@with-logic/elwood 0.1.0 → 0.1.2

package/dist/core/startup-automation.d.ts

@@ -1,54 +0,0 @@
-/**
- * Emits activity for automated startup prompt responses.
- * Implements PRD §5.4 and C-API-18.
- */
-import type { ElwoodActivityEvent, ElwoodAgentKind } from "./activity.ts";
-import type { TrustPromptIdFor } from "./trust-prompts.ts";
-export type { TrustPromptIdFor } from "./trust-prompts.ts";
-/**
- * The single source of truth for the non-trust startup-prompt labels, keyed by
- * owning agent: the browser-tools onboarding decline is Claude-only (C-CLAUDE-11)
- * and the skip-update prompt is Codex-only (C-CODEX-12). Every non-trust union
- * and the runtime label set below are DERIVED from this table, so they cannot
- * drift from each other or from the §5.4 label contract. Adding an agent's label
- * here automatically extends both the type and the validator.
- */
-declare const nonTrustStartupLabels: {
-    readonly claude: readonly ["browser_tools"];
-    readonly codex: readonly ["update"];
-};
-/**
- * The non-trust startup-prompt labels for one agent, derived from the table so
- * each impossible pairing (Claude + `update`, Codex + `browser_tools`) stays
- * unrepresentable, matching the §5.4 label table exactly.
- */
-type NonTrustStartupLabel<A extends ElwoodAgentKind> = (typeof nonTrustStartupLabels)[A][number];
-/**
- * Every startup-prompt label for one agent: its own allowlisted trust ids plus
- * its own non-trust prompts. Matches the PRD's exact per-agent label contract
- * (§5.4) so a second implementation and this type can never drift.
- */
-export type StartupPromptLabelFor<A extends ElwoodAgentKind> = TrustPromptIdFor<A> | NonTrustStartupLabel<A>;
-/**
- * The outcome of handling a startup prompt for agent `A`, discriminated so the
- * two states cannot be confused: an `answered` prompt ALWAYS carries the `input`
- * sent and is labeled with any of the agent's startup labels, while an
- * `option_pending` prompt (recognized allowlisted trust prompt whose affirmative
- * option has not rendered yet — a TRANSIENT render delay, C-CLAUDE-14) NEVER
- * carries an input and is limited to the agent's TRUST ids (a non-trust prompt
- * like `browser_tools`/`update` is never "recognized but option-pending"). Both
- * correlate the label to `A`, so an off-agent or impossible label does not compile.
- */
-export type StartupPromptOutcome<A extends ElwoodAgentKind = ElwoodAgentKind> = {
-    readonly kind: "answered";
-    readonly prompt: StartupPromptLabelFor<A>;
-    readonly input: string;
-} | {
-    readonly kind: "option_pending";
-    readonly prompt: TrustPromptIdFor<A>;
-};
-export type StartupActivityEmitter = {
-    emit(event: "activity", payload: ElwoodActivityEvent): void;
-};
-export declare function emitStartupPromptActivity<A extends ElwoodAgentKind>(emitter: StartupActivityEmitter, agent: A, elwoodSessionId: string, automation: StartupPromptOutcome<A>): void;
-//# sourceMappingURL=startup-automation.d.ts.map

package/dist/core/startup-automation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-automation.d.ts","sourceRoot":"","sources":["../../src/core/startup-automation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;;;;GAOG;AACH,QAAA,MAAM,qBAAqB;;;CAGoC,CAAC;AAEhE;;;;GAIG;AACH,KAAK,oBAAoB,CAAC,CAAC,SAAS,eAAe,IAAI,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjG;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,eAAe,IACvD,gBAAgB,CAAC,CAAC,CAAC,GACnB,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChG;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;CAAE,CAAC;AAE9E,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC7D,CAAC;AA2BF,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,eAAe,EACjE,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,CAAC,EACR,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAClC,IAAI,CAEN"}

package/dist/core/startup-automation.js

@@ -1,40 +0,0 @@
-/**
- * Emits activity for automated startup prompt responses.
- * Implements PRD §5.4 and C-API-18.
- */
-/**
- * The single source of truth for the non-trust startup-prompt labels, keyed by
- * owning agent: the browser-tools onboarding decline is Claude-only (C-CLAUDE-11)
- * and the skip-update prompt is Codex-only (C-CODEX-12). Every non-trust union
- * and the runtime label set below are DERIVED from this table, so they cannot
- * drift from each other or from the §5.4 label contract. Adding an agent's label
- * here automatically extends both the type and the validator.
- */
-const nonTrustStartupLabels = {
-    claude: ["browser_tools"],
-    codex: ["update"],
-};
-function activityFromStartupPrompt(agent, elwoodSessionId, automation) {
-    if (automation.kind === "option_pending") {
-        return {
-            elwoodSessionId,
-            agent,
-            source: "terminal",
-            kind: "attention",
-            label: automation.prompt,
-            text: `Recognized ${agent} ${automation.prompt} prompt; affirmative option not rendered yet, awaiting a later frame.`,
-        };
-    }
-    return {
-        elwoodSessionId,
-        agent,
-        source: "terminal",
-        kind: "startup_prompt",
-        label: automation.prompt,
-        text: `Detected ${agent} ${automation.prompt} prompt; sent ${automation.input}.`,
-    };
-}
-export function emitStartupPromptActivity(emitter, agent, elwoodSessionId, automation) {
-    emitter.emit("activity", activityFromStartupPrompt(agent, elwoodSessionId, automation));
-}
-//# sourceMappingURL=startup-automation.js.map

package/dist/core/startup-automation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-automation.js","sourceRoot":"","sources":["../../src/core/startup-automation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG;IAC5B,MAAM,EAAE,CAAC,eAAe,CAAC;IACzB,KAAK,EAAE,CAAC,QAAQ,CAAC;CAC4C,CAAC;AAoChE,SAAS,yBAAyB,CAChC,KAAQ,EACR,eAAuB,EACvB,UAAmC;IAEnC,IAAI,UAAU,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACzC,OAAO;YACL,eAAe;YACf,KAAK;YACL,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,IAAI,EAAE,cAAc,KAAK,IAAI,UAAU,CAAC,MAAM,uEAAuE;SACtH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,eAAe;QACf,KAAK;QACL,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,UAAU,CAAC,MAAM;QACxB,IAAI,EAAE,YAAY,KAAK,IAAI,UAAU,CAAC,MAAM,iBAAiB,UAAU,CAAC,KAAK,GAAG;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAA+B,EAC/B,KAAQ,EACR,eAAuB,EACvB,UAAmC;IAEnC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,yBAAyB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/core/startup-frame.d.ts

@@ -1,39 +0,0 @@
-/**
- * Shared startup-frame helpers keeping telemetry off the critical frame path.
- * Implements PRD §5.7/§9.1 (C-API-14, C-API-37): a warning is TELEMETRY and must
- * never control session progress. On the hot terminal-frame callback a throwing
- * `warning`/`activity` listener must not skip the rest of the frame (readiness
- * detection, prompt automation, login/attention detection, `terminal:data`), and the
- * preflight/version warning must reach a caller that subscribes in the same turn it
- * receives the session — so it is delivered on a deferred macrotask AFTER start
- * resolves, not on an early startup frame a caller cannot yet observe.
- */
-import type { ElwoodWarningEvent } from "./types.ts";
-/** A session's live warning sink (emits a batch as `warning` + `activity`). */
-export type FrameWarningSink = {
-    readonly emitWarnings: (warnings: readonly ElwoodWarningEvent[]) => void;
-};
-/**
- * Delivers `warnings` through `sink` but CONTAINS a throwing listener so frame
- * processing continues. Warnings are live-only: a contained throw drops the warning
- * (it is not retried), exactly as a human's terminal does not re-show a flashed banner.
- */
-export declare function deliverFrameWarnings(sink: FrameWarningSink | undefined, warnings: readonly ElwoodWarningEvent[]): void;
-/**
- * A buffer-then-live warning sink for the STARTUP region. Warnings emitted BEFORE the
- * caller can subscribe (during the pre-return startup gate — MCP/transcript/preflight
- * diagnostics) are BUFFERED, then flushed on a deferred macrotask AFTER start resolves,
- * so a caller attaching a `warning` listener in the same turn it receives the session
- * still observes them (C-API-14) — WITHOUT restoring general late-subscriber replay.
- * Once opened, delivery is live pass-through. Every observed startup warning is
- * delivered: PRD §5.7/C-API-14 defines no overflow exception, and the buffer drains one
- * macrotask after start resolves, so it is inherently short-lived (the finite set of
- * startup diagnostics), not an unbounded queue — a silent cap could drop the guaranteed
- * `version_unparseable` warning. A macrotask (not a microtask) is required: a microtask
- * runs before the caller's post-`await` continuation, so it would fire into no listener.
- */
-export declare function createStartupWarningGate(sink: FrameWarningSink): {
-    readonly emitWarnings: (warnings: readonly ElwoodWarningEvent[]) => void;
-    readonly openAfterReturn: () => void;
-};
-//# sourceMappingURL=startup-frame.d.ts.map

package/dist/core/startup-frame.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-frame.d.ts","sourceRoot":"","sources":["../../src/core/startup-frame.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,KAAK,IAAI,CAAC;CAC1E,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,gBAAgB,GAAG,SAAS,EAClC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,GACtC,IAAI,CAQN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,GAAG;IAChE,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,KAAK,IAAI,CAAC;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC;CACtC,CAiBA"}

package/dist/core/startup-frame.js

@@ -1,60 +0,0 @@
-/**
- * Shared startup-frame helpers keeping telemetry off the critical frame path.
- * Implements PRD §5.7/§9.1 (C-API-14, C-API-37): a warning is TELEMETRY and must
- * never control session progress. On the hot terminal-frame callback a throwing
- * `warning`/`activity` listener must not skip the rest of the frame (readiness
- * detection, prompt automation, login/attention detection, `terminal:data`), and the
- * preflight/version warning must reach a caller that subscribes in the same turn it
- * receives the session — so it is delivered on a deferred macrotask AFTER start
- * resolves, not on an early startup frame a caller cannot yet observe.
- */
-/**
- * Delivers `warnings` through `sink` but CONTAINS a throwing listener so frame
- * processing continues. Warnings are live-only: a contained throw drops the warning
- * (it is not retried), exactly as a human's terminal does not re-show a flashed banner.
- */
-export function deliverFrameWarnings(sink, warnings) {
-    if (!sink || warnings.length === 0)
-        return;
-    try {
-        sink.emitWarnings(warnings);
-    }
-    catch {
-        // Telemetry must not wedge the frame: a throwing listener is contained here so
-        // readiness, prompt automation, login detection, and terminal:data still run.
-    }
-}
-/**
- * A buffer-then-live warning sink for the STARTUP region. Warnings emitted BEFORE the
- * caller can subscribe (during the pre-return startup gate — MCP/transcript/preflight
- * diagnostics) are BUFFERED, then flushed on a deferred macrotask AFTER start resolves,
- * so a caller attaching a `warning` listener in the same turn it receives the session
- * still observes them (C-API-14) — WITHOUT restoring general late-subscriber replay.
- * Once opened, delivery is live pass-through. Every observed startup warning is
- * delivered: PRD §5.7/C-API-14 defines no overflow exception, and the buffer drains one
- * macrotask after start resolves, so it is inherently short-lived (the finite set of
- * startup diagnostics), not an unbounded queue — a silent cap could drop the guaranteed
- * `version_unparseable` warning. A macrotask (not a microtask) is required: a microtask
- * runs before the caller's post-`await` continuation, so it would fire into no listener.
- */
-export function createStartupWarningGate(sink) {
-    let open = false;
-    const buffered = [];
-    return {
-        emitWarnings: (warnings) => {
-            if (open)
-                return deliverFrameWarnings(sink, warnings);
-            buffered.push(...warnings);
-        },
-        openAfterReturn: () => {
-            const timer = setTimeout(() => {
-                open = true; // subsequent startup-frame warnings deliver live from here on
-                const batch = buffered.splice(0);
-                if (batch.length > 0)
-                    deliverFrameWarnings(sink, batch);
-            }, 0);
-            timer.unref?.();
-        },
-    };
-}
-//# sourceMappingURL=startup-frame.js.map

package/dist/core/startup-frame.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-frame.js","sourceRoot":"","sources":["../../src/core/startup-frame.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAkC,EAClC,QAAuC;IAEvC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC3C,IAAI,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,8EAA8E;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAI7D,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,OAAO;QACL,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE;YACzB,IAAI,IAAI;gBAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC7B,CAAC;QACD,eAAe,EAAE,GAAG,EAAE;YACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,GAAG,IAAI,CAAC,CAAC,8DAA8D;gBAC3E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1D,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/startup-write.d.ts

@@ -1,47 +0,0 @@
-/**
- * Completion-aware settlement for automated startup-prompt PTY writes.
- * Implements PRD §5.1, §5.4, and §5.7: a startup prompt is marked answered (its
- * `startup_prompt` activity emitted) ONLY after its `sendInput` write actually
- * fulfills. A rejected write leaves the prompt retryable and surfaces a bounded,
- * content-free `startup_prompt_write_failed` warning instead of false telemetry
- * (C-CLAUDE-16, C-CODEX-17).
- */
-import type { ElwoodAgentKind } from "./activity.ts";
-import type { TrustPromptIdFor } from "./startup-automation.ts";
-import { type StartupActivityEmitter, type StartupPromptLabelFor } from "./startup-automation.ts";
-import type { ElwoodWarningEvent } from "./warnings.ts";
-/**
- * A settled startup-prompt automation, discriminated by `outcome.kind` so the
- * invalid pairings are unrepresentable: an `answered` outcome ALWAYS carries the
- * write-completion `settled` promise (resolves on write success, rejects — after
- * the responder un-settles the prompt — on a rejected write), and an
- * `option_pending` outcome (no write happened) NEVER carries one. This makes a
- * false success ("answered" with no write to await) and a silently lost warning
- * (write present on a non-answered outcome) impossible to construct (§5.4, §5.7).
- */
-export type SettledStartupOutcome<A extends ElwoodAgentKind> = {
-    readonly outcome: {
-        readonly kind: "answered";
-        readonly prompt: StartupPromptLabelFor<A>;
-        readonly input: string;
-    };
-    readonly settled: Promise<void>;
-} | {
-    readonly outcome: {
-        readonly kind: "option_pending";
-        readonly prompt: TrustPromptIdFor<A>;
-    };
-    readonly settled?: undefined;
-};
-/** Where a rejected startup-prompt write is reported. */
-export type StartupWarningSink = {
-    emitWarnings(warnings: readonly ElwoodWarningEvent[]): void;
-};
-/**
- * Emit each settled automation's activity at the RIGHT time: an `option_pending`
- * or write-less outcome emits immediately; a write-backed `answered` outcome emits
- * its `startup_prompt` activity only once the write resolves, and on rejection
- * emits a bounded warning instead — never a false "answered" activity.
- */
-export declare function emitSettledStartupOutcomes<A extends ElwoodAgentKind>(emitter: StartupActivityEmitter, agent: A, elwoodSessionId: string, settledOutcomes: readonly SettledStartupOutcome<NoInfer<A>>[], warnings: StartupWarningSink | undefined): void;
-//# sourceMappingURL=startup-write.d.ts.map

package/dist/core/startup-write.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-write.d.ts","sourceRoot":"","sources":["../../src/core/startup-write.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAE3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,kBAAkB,EAA4B,MAAM,eAAe,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,eAAe,IACvD;IACE,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC;IAC5F,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;CAC9B,CAAC;AAEN,yDAAyD;AACzD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,GAAG,IAAI,CAAC;CAC7D,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,eAAe,EAClE,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,CAAC,EACR,eAAe,EAAE,MAAM,EAIvB,eAAe,EAAE,SAAS,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAC7D,QAAQ,EAAE,kBAAkB,GAAG,SAAS,GACvC,IAAI,CAgCN"}

package/dist/core/startup-write.js

@@ -1,73 +0,0 @@
-/**
- * Completion-aware settlement for automated startup-prompt PTY writes.
- * Implements PRD §5.1, §5.4, and §5.7: a startup prompt is marked answered (its
- * `startup_prompt` activity emitted) ONLY after its `sendInput` write actually
- * fulfills. A rejected write leaves the prompt retryable and surfaces a bounded,
- * content-free `startup_prompt_write_failed` warning instead of false telemetry
- * (C-CLAUDE-16, C-CODEX-17).
- */
-import { emitStartupPromptActivity, } from "./startup-automation.js";
-/**
- * Emit each settled automation's activity at the RIGHT time: an `option_pending`
- * or write-less outcome emits immediately; a write-backed `answered` outcome emits
- * its `startup_prompt` activity only once the write resolves, and on rejection
- * emits a bounded warning instead — never a false "answered" activity.
- */
-export function emitSettledStartupOutcomes(emitter, agent, elwoodSessionId, 
-// `NoInfer` blocks inference of `A` from the outcomes, so `A` is pinned by the
-// `agent` argument alone. Passing Codex outcomes with `agent: "claude"` no
-// longer widens `A` to the union and cannot construct a cross-agent warning.
-settledOutcomes, warnings) {
-    for (const settledOutcome of settledOutcomes) {
-        if (settledOutcome.settled === undefined) {
-            // An `option_pending` outcome: no write happened, so there is nothing to
-            // await — emit its attention activity immediately. The discriminated union
-            // guarantees this branch is only ever `option_pending`. CONTAIN a throwing
-            // activity listener exactly as the promise-backed branch does: this runs on the
-            // hot startup frame, so an escaping throw would skip the rest of the frame
-            // (readiness/blocking observation, `terminal:data`) and could let an already-armed
-            // readiness deadline drain queued input into an unlatched dialog (C-API-28).
-            try {
-                emitStartupPromptActivity(emitter, agent, elwoodSessionId, settledOutcome.outcome);
-            }
-            catch {
-                // Telemetry must not wedge the frame; the activity is dropped (live-only).
-            }
-            continue;
-        }
-        // An `answered` outcome always carries the write-completion promise: its
-        // activity is emitted only once the write fulfills, and a rejected write
-        // surfaces a bounded warning instead of a false "answered" activity.
-        const { outcome, settled } = settledOutcome;
-        // A terminal `.catch` OWNS the derived promise: both continuations call public
-        // event paths that can throw (activity emission rethrows listener failures;
-        // warning recording can fail), and a floated rejection would be an unhandled
-        // rejection that can terminate the host during startup. Swallow it here.
-        settled
-            .then(() => emitStartupPromptActivity(emitter, agent, elwoodSessionId, outcome), () => warnings?.emitWarnings([writeFailedWarning(agent, elwoodSessionId, outcome)]))
-            .catch(() => undefined);
-    }
-}
-// `agent` and `outcome` are always the SAME concrete `A` here — the caller
-// (`emitSettledStartupOutcomes`) already pins `A` via NoInfer, so this internal
-// helper needs no extra guard and its correlation is enforced by construction.
-function writeFailedWarning(agent, elwoodSessionId, outcome) {
-    // `outcome.prompt` is already the agent-correlated label, so no cast discards
-    // the correlation: an off-agent (label, agent) pairing cannot be constructed.
-    const label = outcome.prompt;
-    const warning = {
-        elwoodSessionId,
-        agent,
-        source: "terminal",
-        code: "startup_prompt_write_failed",
-        severity: "warning",
-        message: `Startup prompt ${label} could not be answered: PTY write was rejected; leaving it retryable.`,
-        label,
-        raw: `startup_prompt_write_failed label=${label}`,
-    };
-    // A concrete `StartupPromptWriteFailed<"claude"|"codex">` IS an ElwoodWarningEvent
-    // member; the widening bridges TS's generic-union assignability gap only (the
-    // agent/label correlation above is already enforced at construction).
-    return warning;
-}
-//# sourceMappingURL=startup-write.js.map

package/dist/core/startup-write.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-write.js","sourceRoot":"","sources":["../../src/core/startup-write.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EACL,yBAAyB,GAI1B,MAAM,yBAAyB,CAAC;AA+BjC;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA+B,EAC/B,KAAQ,EACR,eAAuB;AACvB,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,eAA6D,EAC7D,QAAwC;IAExC,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,cAAc,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzC,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,gFAAgF;YAChF,2EAA2E;YAC3E,mFAAmF;YACnF,6EAA6E;YAC7E,IAAI,CAAC;gBACH,yBAAyB,CAAC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,2EAA2E;YAC7E,CAAC;YACD,SAAS;QACX,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QAC5C,+EAA+E;QAC/E,4EAA4E;QAC5E,6EAA6E;QAC7E,yEAAyE;QACzE,OAAO;aACJ,IAAI,CACH,GAAG,EAAE,CAAC,yBAAyB,CAAC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EACzE,GAAG,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CACpF;aACA,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,SAAS,kBAAkB,CACzB,KAAQ,EACR,eAAuB,EACvB,OAAgC;IAEhC,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAgC;QAC3C,eAAe;QACf,KAAK;QACL,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,kBAAkB,KAAK,uEAAuE;QACvG,KAAK;QACL,GAAG,EAAE,qCAAqC,KAAK,EAAE;KAClD,CAAC;IACF,mFAAmF;IACnF,8EAA8E;IAC9E,sEAAsE;IACtE,OAAO,OAA6B,CAAC;AACvC,CAAC"}

package/dist/core/trust-blocking.d.ts

@@ -1,22 +0,0 @@
-/**
- * Shared builder for the per-agent trust blocking screen-fact rules.
- * Implements PRD §5.1/§5.5 (C-ATTN-03): a trust prompt that stays UNANSWERED
- * under the policy classifies as a blocking prompt. Both adapters build these
- * rules identically, so the construction — option-aware header recognition,
- * stable semantic ids, base-table append — lives here once instead of diverging
- * across `claude/screen-table.ts` and `codex/screen-table.ts`.
- */
-import type { ElwoodAgentKind } from "./activity.ts";
-import type { ScreenFactTable } from "./screen-facts.ts";
-/**
- * `base` plus one `blocking_prompt_visible` rule per trust prompt that stays
- * unanswered under `autotrust`. Each rule recognizes the prompt only by its
- * HEADER outside the option region (`trustHeaderMatches`, the same recognizer
- * the responder uses; the non-option text is computed once per frame and cached
- * across the rules), so an unrelated numbered/cursor option containing a trust
- * phrase is NOT mistaken for a blocking trust prompt (PRD §5.1). Returns `base`
- * unchanged when no trust prompt blocks (e.g. every allowlisted prompt is
- * auto-answered).
- */
-export declare function withTrustBlockingRules(base: ScreenFactTable, agent: ElwoodAgentKind, autotrust: boolean): ScreenFactTable;
-//# sourceMappingURL=trust-blocking.d.ts.map

package/dist/core/trust-blocking.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-blocking.d.ts","sourceRoot":"","sources":["../../src/core/trust-blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIzE;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,eAAe,CAgBjB"}

package/dist/core/trust-blocking.js

@@ -1,38 +0,0 @@
-/**
- * Shared builder for the per-agent trust blocking screen-fact rules.
- * Implements PRD §5.1/§5.5 (C-ATTN-03): a trust prompt that stays UNANSWERED
- * under the policy classifies as a blocking prompt. Both adapters build these
- * rules identically, so the construction — option-aware header recognition,
- * stable semantic ids, base-table append — lives here once instead of diverging
- * across `claude/screen-table.ts` and `codex/screen-table.ts`.
- */
-import { nonOptionText } from "./terminal-options.js";
-import { blockingTrustSpecs, trustHeaderMatches } from "./trust-prompts.js";
-/**
- * `base` plus one `blocking_prompt_visible` rule per trust prompt that stays
- * unanswered under `autotrust`. Each rule recognizes the prompt only by its
- * HEADER outside the option region (`trustHeaderMatches`, the same recognizer
- * the responder uses; the non-option text is computed once per frame and cached
- * across the rules), so an unrelated numbered/cursor option containing a trust
- * phrase is NOT mistaken for a blocking trust prompt (PRD §5.1). Returns `base`
- * unchanged when no trust prompt blocks (e.g. every allowlisted prompt is
- * auto-answered).
- */
-export function withTrustBlockingRules(base, agent, autotrust) {
-    let cachedFrame;
-    let cachedHeader = "";
-    const headerFor = (text) => {
-        if (text !== cachedFrame) {
-            cachedFrame = text;
-            cachedHeader = nonOptionText(text);
-        }
-        return cachedHeader;
-    };
-    const rules = blockingTrustSpecs(agent, autotrust).map((spec) => ({
-        id: `${agent}-${spec.id}-prompt`,
-        fact: "blocking_prompt_visible",
-        match: (text) => trustHeaderMatches(headerFor(text), spec),
-    }));
-    return rules.length === 0 ? base : { ...base, rules: [...base.rules, ...rules] };
-}
-//# sourceMappingURL=trust-blocking.js.map

package/dist/core/trust-blocking.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-blocking.js","sourceRoot":"","sources":["../../src/core/trust-blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,KAAsB,EACtB,SAAkB;IAElB,IAAI,WAA+B,CAAC;IACpC,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,WAAW,GAAG,IAAI,CAAC;YACnB,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,KAAK,GAAqB,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,SAAS;QAChC,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;KAC3D,CAAC,CAAC,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;AACnF,CAAC"}

package/dist/core/trust-prompts.d.ts

@@ -1,135 +0,0 @@
-/**
- * Allowlist of known adapter startup trust prompts and how to answer them.
- * Implements PRD §5.1 and §5.5 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
- *
- * This is an EXPLICIT allowlist, not an open-ended matcher: each entry names one
- * concrete prompt by its on-screen text and a fixed affirmative outcome. A new
- * CLI prompt is trusted only by adding a deliberate entry here — Elwood never
- * blanket-answers "any first-run confirmation", which would silently bypass a
- * future CLI security gate for third-party code or config.
- */
-import type { ElwoodAgentKind } from "./activity.ts";
-/**
- * The fields common to every allowlisted trust prompt. The prompt and its answer
- * are BOTH matched within the same current frame: `headerPattern` identifies the
- * prompt by its HEADER wording, and `accept` matches the exact affirmative option
- * label in that same prompt. This prevents a stale phrase from one frame pairing
- * with a "Yes" from a different, current dialog (which could auto-confirm an
- * unrelated security gate). `headerPattern` is a HEADER matcher, not a
- * whole-frame matcher: it is only safe when tested against the frame's non-option
- * lines (via `trustHeaderMatches`), never applied raw to the full frame.
- */
-type TrustPromptBase = {
-    /**
-     * Identifies the prompt by its HEADER wording. MUST be tested only against the
-     * frame's non-option lines (see `trustHeaderMatches`) — applying it raw to the
-     * full frame would let an option-only trust phrase spoof recognition.
-     * Verified against the CLI versions below.
-     */
-    readonly headerPattern: RegExp;
-    /** Matches the exact affirmative option label for THIS prompt (per-prompt, not generic). */
-    readonly accept: RegExp;
-};
-/**
- * When an allowlisted prompt is answered. `"autotrust"` prompts are answered ONLY
- * under the caller's full-trust posture; `"always"` prompts are answered
- * regardless of it (Elwood's own hook bridge, never third-party code).
- */
-export type TrustAnswerPolicy = "always" | "autotrust";
-/**
- * One allowlisted trust prompt, as an agent+id-DISCRIMINATED union so that (a) a
- * typo in `id` cannot compile into a public startup label, and (b)
- * `answerPolicy: "always"` — answered regardless of `autotrust` — is permitted
- * ONLY on Codex `hook_trust`, Elwood's OWN integration (the hook bridge) that the
- * session requires to work. Every third-party trust prompt (skills, plugins, MCP
- * servers, folder trust) is `answerPolicy: "autotrust"`, staying gated on the
- * caller's full-trust posture, so the invalid "third-party prompt answered
- * always" state is unrepresentable.
- */
-export type TrustPromptSpec = ({
-    readonly agent: "claude";
-    readonly id: ClaudeTrustPromptId;
-    readonly answerPolicy: "autotrust";
-} & TrustPromptBase) | ({
-    readonly agent: "codex";
-    readonly id: "workspace_trust";
-    readonly answerPolicy: "autotrust";
-} & TrustPromptBase) | ({
-    readonly agent: "codex";
-    readonly id: "hook_trust";
-    /** Answered regardless of `autotrust`: Elwood's own hook bridge (never third-party code). */
-    readonly answerPolicy: "always";
-} & TrustPromptBase);
-/** The Claude trust-prompt ids: folder trust plus the CLI's first-run skill/plugin/MCP gates. */
-type ClaudeTrustPromptId = "workspace_trust" | "skill_trust" | "plugin_trust" | "mcp_trust";
-/**
- * The allowlist. Wording verified against claude 2.1.205–2.1.252 and codex-cli 0.142.5.
- * `workspace`/`directory` trust are the folder-trust gates; `skill`, `plugin`,
- * and `mcp` cover the CLI's first-run trust prompts for loading third-party
- * skills, plugins, and MCP servers under a full-trust launch.
- */
-export declare const trustPromptAllowlist: readonly [{
-    readonly id: "workspace_trust";
-    readonly agent: "claude";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "skill_trust";
-    readonly agent: "claude";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "plugin_trust";
-    readonly agent: "claude";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "mcp_trust";
-    readonly agent: "claude";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "workspace_trust";
-    readonly agent: "codex";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "autotrust";
-}, {
-    readonly id: "hook_trust";
-    readonly agent: "codex";
-    readonly headerPattern: RegExp;
-    readonly accept: RegExp;
-    readonly answerPolicy: "always";
-}];
-/**
- * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
- * text as produced by `nonOptionText`. This is the ONE shared, option-aware
- * recognizer: the responder, the cursor navigator, and the screen-fact blocking
- * rules all go through it (each computes `nonOptionText` once per frame and
- * tests every spec against that), so a numbered or cursor-selectable option whose
- * label merely contains a trust phrase is never recognized as a prompt. Matching
- * joined non-option lines also keeps wrapped headers matchable (§5.1).
- */
-export declare function trustHeaderMatches(header: string, spec: TrustPromptBase): boolean;
-/** `trustHeaderMatches` over a raw frame, for callers that test a single spec. */
-export declare function trustPromptHeaderVisible(frame: string, spec: TrustPromptBase): boolean;
-/**
- * The stable public `startup_prompt` trust labels (§5.4), derived from the
- * allowlist so the two can never drift: deleting, adding, or renaming an entry
- * updates this union automatically. Because `TrustPromptSpec` fixes each agent's
- * ids to a closed literal union, a typo in an entry's `id` fails to compile
- * against `satisfies` rather than silently widening this derived label union.
- */
-export type TrustPromptId = (typeof trustPromptAllowlist)[number]["id"];
-/** The trust label ids for one specific agent (e.g. Codex automation cannot use a Claude-only id). */
-export type TrustPromptIdFor<A extends ElwoodAgentKind> = Extract<(typeof trustPromptAllowlist)[number], {
-    readonly agent: A;
-}>["id"];
-/** Specs for one agent that stay UNANSWERED under the effective policy (block on the human). */
-export declare function blockingTrustSpecs(agent: ElwoodAgentKind, autotrust: boolean): readonly TrustPromptSpec[];
-export {};
-//# sourceMappingURL=trust-prompts.d.ts.map

package/dist/core/trust-prompts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-prompts.d.ts","sourceRoot":"","sources":["../../src/core/trust-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD;;;;;;;;;GASG;AACH,KAAK,eAAe,GAAG;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GACvB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,GAAG,eAAe,CAAC,CAAC;AAEzB,iGAAiG;AACjG,KAAK,mBAAmB,GAAG,iBAAiB,GAAG,aAAa,GAAG,cAAc,GAAG,WAAW,CAAC;AAW5F;;;;;GAKG;AAKH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsDc,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEjF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAExE,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI,OAAO,CAC/D,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,EACrC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CACtB,CAAC,IAAI,CAAC,CAAC;AAER,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,SAAS,eAAe,EAAE,CAM5B"}

package/dist/core/trust-prompts.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-prompts.js","sourceRoot":"","sources":["../../src/core/trust-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA8DtD,oFAAoF;AACpF,MAAM,UAAU,GAAG,qDAAqD,CAAC;AACzE,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,sCAAsC,EAAE,GAAG,CAAC,CAAC;AACxF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,mCAAmC,EAAE,GAAG,CAAC,CAAC;AACxF,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,mCAAmC,EAAE,GAAG,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC;QACE,2EAA2E;QAC3E,0EAA0E;QAC1E,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,4DAA4D;QAC3E,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,0EAA0E;QACzF,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,mEAAmE;QAClF,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,2EAA2E;QAC3E,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,4DAA4D;QAC3E,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,wEAAwE;QACxE,4DAA4D;QAC5D,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,8CAA8C;QAC7D,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD,+EAA+E;IAC/E,iFAAiF;IACjF;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,oBAAoB;QACnC,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,EAAE,gBAAgB;QACxB,YAAY,EAAE,QAAQ;KACvB;CAC4C,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAqB;IACtE,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,IAAqB;IAC3E,OAAO,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAiBD,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,SAAkB;IAElB,OAAO,oBAAoB,CAAC,MAAM;IAChC,8EAA8E;IAC9E,gFAAgF;IAChF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,SAAS,CAC/E,CAAC;AACJ,CAAC"}

package/dist/core/trust-responder.d.ts

@@ -1,48 +0,0 @@
-/**
- * Detects and answers the allowlisted family of adapter startup trust prompts.
- * Implements PRD §5.1 and §9.1 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
- *
- * Policy (PRD §5.1): an agent must NEVER be left waiting on a trust gate.
- * Under the caller's full-trust posture, when an allowlisted trust prompt is
- * visible in the current frame, Elwood selects its affirmative option and sends
- * it — always say yes. Elwood only auto-answers ALLOWLISTED prompts (an
- * off-allowlist confirmation is left to the human), and never re-answers the same
- * prompt; those are the only limits.
- */
-import type { ElwoodAgentKind } from "./activity.ts";
-import { type TrustPromptIdFor } from "./trust-prompts.ts";
-/** An answered trust prompt; `prompt` is narrowed to the responder's agent. */
-export type TrustPromptAutomation<A extends ElwoodAgentKind = ElwoodAgentKind> = {
-    readonly prompt: TrustPromptIdFor<A>;
-    readonly input: string;
-};
-/**
- * The completion of an answered trust write: a `void | Promise<void>` write is
- * normalized to a promise that resolves on success and rejects once the prompt
- * has been un-settled (kept retryable) on a rejected write.
- */
-export type TrustWriteResult = void | Promise<void>;
-/**
- * The outcome of handling a frame: an answered prompt, a recognized prompt whose
- * affirmative option has not rendered yet (a TRANSIENT render delay — under the
- * say-yes policy a later frame carrying the option is still answered, so this is
- * never a terminal wedge), or nothing.
- */
-export type TrustPromptResult<A extends ElwoodAgentKind = ElwoodAgentKind> = {
-    readonly kind: "answered";
-    readonly automation: TrustPromptAutomation<A>;
-    readonly settled: Promise<void>;
-} | {
-    readonly kind: "option_pending";
-    readonly prompt: TrustPromptIdFor<A>;
-} | undefined;
-export declare class TrustPromptResponder<A extends ElwoodAgentKind> {
-    private readonly autotrust;
-    private readonly specs;
-    private readonly settled;
-    private readonly reportedPending;
-    constructor(agent: A, autotrust?: boolean);
-    /** `frame` MUST be the CURRENT rendered screen, not an accumulated buffer. */
-    handle(frame: string, write: (input: string) => TrustWriteResult, readFrame?: () => string): TrustPromptResult<A>;
-}
-//# sourceMappingURL=trust-responder.d.ts.map

package/dist/core/trust-responder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-responder.d.ts","sourceRoot":"","sources":["../../src/core/trust-responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAQrD,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,oBAAoB,CAAC;AAQ5B,+EAA+E;AAC/E,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI;IAC/E,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IACrE;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAG9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;CAAE,GACzE,SAAS,CAAC;AAEd,qBAAa,oBAAoB,CAAC,CAAC,SAAS,eAAe;IAGzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAI1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkC;gBAEtD,KAAK,EAAE,CAAC,EAAE,SAAS,UAAQ;IAKvC,8EAA8E;IAC9E,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,gBAAgB,EAC1C,SAAS,CAAC,EAAE,MAAM,MAAM,GACvB,iBAAiB,CAAC,CAAC,CAAC;CA0CxB"}