@with-logic/elwood 0.1.0

package/dist/core/trust/prompts.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Allowlist of known adapter startup trust prompts and how to answer them.
+ * Implements PRD §5.1 and §5.5 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
+ *
+ * This is an EXPLICIT allowlist, not an open-ended matcher: each entry names one
+ * concrete prompt by its on-screen text and a fixed affirmative outcome. A new
+ * CLI prompt is trusted only by adding a deliberate entry here — Elwood never
+ * blanket-answers "any first-run confirmation", which would silently bypass a
+ * future CLI security gate for third-party code or config.
+ */
+import type { ElwoodAgentKind } from "../activity/index.ts";
+/**
+ * The fields common to every allowlisted trust prompt. The prompt and its answer
+ * are BOTH matched within the same current frame: `headerPattern` identifies the
+ * prompt by its HEADER wording, and `accept` matches the exact affirmative option
+ * label in that same prompt. This prevents a stale phrase from one frame pairing
+ * with a "Yes" from a different, current dialog (which could auto-confirm an
+ * unrelated security gate). `headerPattern` is a HEADER matcher, not a
+ * whole-frame matcher: it is only safe when tested against the frame's non-option
+ * lines (via `trustHeaderMatches`), never applied raw to the full frame.
+ */
+type TrustPromptBase = {
+    /**
+     * Identifies the prompt by its HEADER wording. MUST be tested only against the
+     * frame's non-option lines (see `trustHeaderMatches`) — applying it raw to the
+     * full frame would let an option-only trust phrase spoof recognition.
+     * Verified against the CLI versions below.
+     */
+    readonly headerPattern: RegExp;
+    /** Matches the exact affirmative option label for THIS prompt (per-prompt, not generic). */
+    readonly accept: RegExp;
+};
+/**
+ * When an allowlisted prompt is answered. `"autotrust"` prompts are answered ONLY
+ * under the caller's full-trust posture; `"always"` prompts are answered
+ * regardless of it (Elwood's own hook bridge, never third-party code).
+ */
+export type TrustAnswerPolicy = "always" | "autotrust";
+/**
+ * One allowlisted trust prompt, as an agent+id-DISCRIMINATED union so that (a) a
+ * typo in `id` cannot compile into a public startup label, and (b)
+ * `answerPolicy: "always"` — answered regardless of `autotrust` — is permitted
+ * ONLY on Codex `hook_trust`, Elwood's OWN integration (the hook bridge) that the
+ * session requires to work. Every third-party trust prompt (skills, plugins, MCP
+ * servers, folder trust) is `answerPolicy: "autotrust"`, staying gated on the
+ * caller's full-trust posture, so the invalid "third-party prompt answered
+ * always" state is unrepresentable.
+ */
+export type TrustPromptSpec = ({
+    readonly agent: "claude";
+    readonly id: ClaudeTrustPromptId;
+    readonly answerPolicy: "autotrust";
+} & TrustPromptBase) | ({
+    readonly agent: "codex";
+    readonly id: "workspace_trust";
+    readonly answerPolicy: "autotrust";
+} & TrustPromptBase) | ({
+    readonly agent: "codex";
+    readonly id: "hook_trust";
+    /** Answered regardless of `autotrust`: Elwood's own hook bridge (never third-party code). */
+    readonly answerPolicy: "always";
+} & TrustPromptBase);
+/** The Claude trust-prompt ids: folder trust plus the CLI's first-run skill/plugin/MCP gates. */
+type ClaudeTrustPromptId = "workspace_trust" | "skill_trust" | "plugin_trust" | "mcp_trust";
+/**
+ * The allowlist. Wording verified against claude 2.1.205–2.1.252 and codex-cli 0.142.5.
+ * `workspace`/`directory` trust are the folder-trust gates; `skill`, `plugin`,
+ * and `mcp` cover the CLI's first-run trust prompts for loading third-party
+ * skills, plugins, and MCP servers under a full-trust launch.
+ */
+export declare const trustPromptAllowlist: readonly [{
+    readonly id: "workspace_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "skill_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "plugin_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "mcp_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "workspace_trust";
+    readonly agent: "codex";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "hook_trust";
+    readonly agent: "codex";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "always";
+}];
+/**
+ * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
+ * text as produced by `nonOptionText`. This is the ONE shared, option-aware
+ * recognizer: the responder, the cursor navigator, and the screen-fact blocking
+ * rules all go through it (each computes `nonOptionText` once per frame and
+ * tests every spec against that), so a numbered or cursor-selectable option whose
+ * label merely contains a trust phrase is never recognized as a prompt. Matching
+ * joined non-option lines also keeps wrapped headers matchable (§5.1).
+ */
+export declare function trustHeaderMatches(header: string, spec: TrustPromptBase): boolean;
+/** `trustHeaderMatches` over a raw frame, for callers that test a single spec. */
+export declare function trustPromptHeaderVisible(frame: string, spec: TrustPromptBase): boolean;
+/**
+ * The stable public `startup_prompt` trust labels (§5.4), derived from the
+ * allowlist so the two can never drift: deleting, adding, or renaming an entry
+ * updates this union automatically. Because `TrustPromptSpec` fixes each agent's
+ * ids to a closed literal union, a typo in an entry's `id` fails to compile
+ * against `satisfies` rather than silently widening this derived label union.
+ */
+export type TrustPromptId = (typeof trustPromptAllowlist)[number]["id"];
+/** The trust label ids for one specific agent (e.g. Codex automation cannot use a Claude-only id). */
+export type TrustPromptIdFor<A extends ElwoodAgentKind> = Extract<(typeof trustPromptAllowlist)[number], {
+    readonly agent: A;
+}>["id"];
+/** Specs for one agent that stay UNANSWERED under the effective policy (block on the human). */
+export declare function blockingTrustSpecs(agent: ElwoodAgentKind, autotrust: boolean): readonly TrustPromptSpec[];
+export {};
+//# sourceMappingURL=prompts.d.ts.map

package/dist/core/trust/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAG5D;;;;;;;;;GASG;AACH,KAAK,eAAe,GAAG;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GACvB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,GAAG,eAAe,CAAC,CAAC;AAEzB,iGAAiG;AACjG,KAAK,mBAAmB,GAAG,iBAAiB,GAAG,aAAa,GAAG,cAAc,GAAG,WAAW,CAAC;AAW5F;;;;;GAKG;AAKH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsDc,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEjF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAExE,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI,OAAO,CAC/D,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,EACrC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CACtB,CAAC,IAAI,CAAC,CAAC;AAER,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,SAAS,eAAe,EAAE,CAM5B"}

package/dist/core/trust/prompts.js

@@ -0,0 +1,108 @@
+/**
+ * Allowlist of known adapter startup trust prompts and how to answer them.
+ * Implements PRD §5.1 and §5.5 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
+ *
+ * This is an EXPLICIT allowlist, not an open-ended matcher: each entry names one
+ * concrete prompt by its on-screen text and a fixed affirmative outcome. A new
+ * CLI prompt is trusted only by adding a deliberate entry here — Elwood never
+ * blanket-answers "any first-run confirmation", which would silently bypass a
+ * future CLI security gate for third-party code or config.
+ */
+import { nonOptionText } from "../terminal-options.js";
+// Affirmative option shapes. Each rejects decline words so "No, ..." never matches.
+const notDecline = "(?!.*\\b(no|without|not|quit|cancel|deny|don't)\\b)";
+const yesOption = new RegExp(`^${notDecline}.*\\b(yes|trust|continue|proceed)\\b`, "i");
+const useMcpOption = new RegExp(`^${notDecline}.*\\buse this(?:.*\\bMCP)? server`, "i");
+// Codex hook trust's real affirmative is "Trust all and continue" / "Trust
+// hooks" — matched specifically so a nearby unrelated dialog's generic "Yes,
+// continue" (e.g. a credential prompt) can never be selected for hook trust.
+const trustHooksOption = new RegExp(`^${notDecline}.*\\btrust\\b.*\\b(hooks?|all)\\b`, "i");
+/**
+ * The allowlist. Wording verified against claude 2.1.205–2.1.252 and codex-cli 0.142.5.
+ * `workspace`/`directory` trust are the folder-trust gates; `skill`, `plugin`,
+ * and `mcp` cover the CLI's first-run trust prompts for loading third-party
+ * skills, plugins, and MCP servers under a full-trust launch.
+ */
+// Each `headerPattern` matches the prompt's QUESTION/HEADER wording — never a
+// phrase that lives only in an affirmative option — so recognition anchors on a
+// header line (matched via `trustHeaderMatches` over the frame's non-option
+// text), which a hostile option cannot spoof (PRD §5.1).
+export const trustPromptAllowlist = [
+    {
+        // Header renders as "Do you trust this folder?" or "Quick safety check: Is
+        // this a project you created or one you trust?" (claude 2.1.205/2.1.206).
+        id: "workspace_trust",
+        agent: "claude",
+        headerPattern: /do you trust this folder|project you .*\bor one you trust/i,
+        accept: yesOption,
+        answerPolicy: "autotrust",
+    },
+    {
+        id: "skill_trust",
+        agent: "claude",
+        headerPattern: /do you (?:want to )?(?:trust|load) (?:this|the) skill|load this skill\?/i,
+        accept: yesOption,
+        answerPolicy: "autotrust",
+    },
+    {
+        id: "plugin_trust",
+        agent: "claude",
+        headerPattern: /do you (?:want to )?trust (?:this|the) plugin|trust the plugin\?/i,
+        accept: yesOption,
+        answerPolicy: "autotrust",
+    },
+    {
+        // Header "New MCP server found in this project"; the affirmative option is
+        // "Use this MCP server" (no yes/trust/continue word), needing a per-prompt
+        // accept — the generic yes-matcher would leave it wedged.
+        id: "mcp_trust",
+        agent: "claude",
+        headerPattern: /New MCP server found|do you trust (?:this|the) MCP server/i,
+        accept: useMcpOption,
+        answerPolicy: "autotrust",
+    },
+    {
+        // Codex's directory-trust gate keeps the stable `workspace_trust` label
+        // (PRD §5.4) even though its wording differs from Claude's.
+        id: "workspace_trust",
+        agent: "codex",
+        headerPattern: /Do you trust the contents of this directory/i,
+        accept: yesOption,
+        answerPolicy: "autotrust",
+    },
+    // Hook trust is Elwood's own integration, required for the session to work, so
+    // it is always answered (not gated on autotrust) — see `answerPolicy: "always"`.
+    {
+        id: "hook_trust",
+        agent: "codex",
+        headerPattern: /Hooks need review/i,
+        // Specific to hook trust's own option ("Trust all and continue"), never a
+        // generic "Yes" that could belong to a different dialog in the same frame.
+        accept: trustHooksOption,
+        answerPolicy: "always",
+    },
+];
+/**
+ * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
+ * text as produced by `nonOptionText`. This is the ONE shared, option-aware
+ * recognizer: the responder, the cursor navigator, and the screen-fact blocking
+ * rules all go through it (each computes `nonOptionText` once per frame and
+ * tests every spec against that), so a numbered or cursor-selectable option whose
+ * label merely contains a trust phrase is never recognized as a prompt. Matching
+ * joined non-option lines also keeps wrapped headers matchable (§5.1).
+ */
+export function trustHeaderMatches(header, spec) {
+    return spec.headerPattern.test(header);
+}
+/** `trustHeaderMatches` over a raw frame, for callers that test a single spec. */
+export function trustPromptHeaderVisible(frame, spec) {
+    return trustHeaderMatches(nonOptionText(frame), spec);
+}
+/** Specs for one agent that stay UNANSWERED under the effective policy (block on the human). */
+export function blockingTrustSpecs(agent, autotrust) {
+    return trustPromptAllowlist.filter(
+    // An `answerPolicy: "always"` prompt (hook trust) is auto-handled, so it must
+    // NOT be classified as human-blocking. Others block only when autotrust is off.
+    (spec) => spec.agent === agent && spec.answerPolicy !== "always" && !autotrust);
+}
+//# sourceMappingURL=prompts.js.map

package/dist/core/trust/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AA8DvD,oFAAoF;AACpF,MAAM,UAAU,GAAG,qDAAqD,CAAC;AACzE,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,sCAAsC,EAAE,GAAG,CAAC,CAAC;AACxF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,mCAAmC,EAAE,GAAG,CAAC,CAAC;AACxF,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,mCAAmC,EAAE,GAAG,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC;QACE,2EAA2E;QAC3E,0EAA0E;QAC1E,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,4DAA4D;QAC3E,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,0EAA0E;QACzF,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,mEAAmE;QAClF,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,2EAA2E;QAC3E,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,4DAA4D;QAC3E,MAAM,EAAE,YAAY;QACpB,YAAY,EAAE,WAAW;KAC1B;IACD;QACE,wEAAwE;QACxE,4DAA4D;QAC5D,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,8CAA8C;QAC7D,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,WAAW;KAC1B;IACD,+EAA+E;IAC/E,iFAAiF;IACjF;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,OAAO;QACd,aAAa,EAAE,oBAAoB;QACnC,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,EAAE,gBAAgB;QACxB,YAAY,EAAE,QAAQ;KACvB;CAC4C,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAqB;IACtE,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,IAAqB;IAC3E,OAAO,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAiBD,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,SAAkB;IAElB,OAAO,oBAAoB,CAAC,MAAM;IAChC,8EAA8E;IAC9E,gFAAgF;IAChF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,SAAS,CAC/E,CAAC;AACJ,CAAC"}

package/dist/core/trust/responder.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Detects and answers the allowlisted family of adapter startup trust prompts.
+ * Implements PRD §5.1 and §9.1 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
+ *
+ * Policy (PRD §5.1): an agent must NEVER be left waiting on a trust gate.
+ * Under the caller's full-trust posture, when an allowlisted trust prompt is
+ * visible in the current frame, Elwood selects its affirmative option and sends
+ * it — always say yes. Elwood only auto-answers ALLOWLISTED prompts (an
+ * off-allowlist confirmation is left to the human), and never re-answers the same
+ * prompt; those are the only limits.
+ */
+import type { ElwoodAgentKind } from "../activity/index.ts";
+import { type TrustPromptIdFor } from "./prompts.ts";
+/** An answered trust prompt; `prompt` is narrowed to the responder's agent. */
+export type TrustPromptAutomation<A extends ElwoodAgentKind = ElwoodAgentKind> = {
+    readonly prompt: TrustPromptIdFor<A>;
+    readonly input: string;
+};
+/**
+ * The completion of an answered trust write: a `void | Promise<void>` write is
+ * normalized to a promise that resolves on success and rejects once the prompt
+ * has been un-settled (kept retryable) on a rejected write.
+ */
+export type TrustWriteResult = void | Promise<void>;
+/**
+ * The outcome of handling a frame: an answered prompt, a recognized prompt whose
+ * affirmative option has not rendered yet (a TRANSIENT render delay — under the
+ * say-yes policy a later frame carrying the option is still answered, so this is
+ * never a terminal wedge), or nothing.
+ */
+export type TrustPromptResult<A extends ElwoodAgentKind = ElwoodAgentKind> = {
+    readonly kind: "answered";
+    readonly automation: TrustPromptAutomation<A>;
+    readonly settled: Promise<void>;
+} | {
+    readonly kind: "option_pending";
+    readonly prompt: TrustPromptIdFor<A>;
+} | undefined;
+export declare class TrustPromptResponder<A extends ElwoodAgentKind> {
+    private readonly autotrust;
+    private readonly specs;
+    private readonly settled;
+    private readonly reportedPending;
+    constructor(agent: A, autotrust?: boolean);
+    /** `frame` MUST be the CURRENT rendered screen, not an accumulated buffer. */
+    handle(frame: string, write: (input: string) => TrustWriteResult, readFrame?: () => string): TrustPromptResult<A>;
+}
+//# sourceMappingURL=responder.d.ts.map

package/dist/core/trust/responder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responder.d.ts","sourceRoot":"","sources":["../../../src/core/trust/responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQ5D,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,cAAc,CAAC;AAQtB,+EAA+E;AAC/E,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI;IAC/E,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IACrE;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAG9C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;CAAE,GACzE,SAAS,CAAC;AAEd,qBAAa,oBAAoB,CAAC,CAAC,SAAS,eAAe;IAGzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAI1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkC;gBAEtD,KAAK,EAAE,CAAC,EAAE,SAAS,UAAQ;IAKvC,8EAA8E;IAC9E,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,gBAAgB,EAC1C,SAAS,CAAC,EAAE,MAAM,MAAM,GACvB,iBAAiB,CAAC,CAAC,CAAC;CA0CxB"}

package/dist/core/trust/responder.js

@@ -0,0 +1,119 @@
+/**
+ * Detects and answers the allowlisted family of adapter startup trust prompts.
+ * Implements PRD §5.1 and §9.1 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
+ *
+ * Policy (PRD §5.1): an agent must NEVER be left waiting on a trust gate.
+ * Under the caller's full-trust posture, when an allowlisted trust prompt is
+ * visible in the current frame, Elwood selects its affirmative option and sends
+ * it — always say yes. Elwood only auto-answers ALLOWLISTED prompts (an
+ * off-allowlist confirmation is left to the human), and never re-answers the same
+ * prompt; those are the only limits.
+ */
+import { delay } from "../delay.js";
+import { nonOptionText, optionInput, optionKeystrokes, selectableOptions, } from "../terminal-options.js";
+import { trustHeaderMatches, trustPromptAllowlist, trustPromptHeaderVisible, } from "./prompts.js";
+const cursorRetryMs = 250;
+const cursorNavigationTimeoutMs = 5_000;
+export class TrustPromptResponder {
+    // Whether the caller launched under full trust (`autotrust`). `answerPolicy:
+    // "always"` prompts (hook trust) are answered even when this is false.
+    autotrust;
+    specs;
+    settled = new Set();
+    // A prompt whose "option not rendered yet" state was reported once, kept
+    // SEPARATE from `settled` so a later frame with the real option can still be
+    // answered — the pending state is transient, not terminal.
+    reportedPending = new Set();
+    constructor(agent, autotrust = false) {
+        this.autotrust = autotrust;
+        this.specs = trustPromptAllowlist.filter((spec) => spec.agent === agent);
+    }
+    /** `frame` MUST be the CURRENT rendered screen, not an accumulated buffer. */
+    handle(frame, write, readFrame) {
+        const header = nonOptionText(frame);
+        for (const spec of this.specs) {
+            const id = spec.id;
+            // `answerPolicy: "always"` prompts (Elwood's own hook bridge) answer
+            // regardless of autotrust; every other trust prompt requires the caller's
+            // full-trust posture.
+            if (!(this.autotrust || spec.answerPolicy === "always"))
+                continue;
+            // Recognized when the prompt's HEADER wording appears on a NON-OPTION line
+            // (via the shared `trustHeaderMatches`), so a phrase living only inside an
+            // option label can't spoof a prompt. That is the ONLY guard — recognition
+            // means "say yes".
+            if (this.settled.has(id) || !trustHeaderMatches(header, spec))
+                continue;
+            const options = selectableOptions(frame);
+            const option = options.find((candidate) => spec.accept.test(candidate.label));
+            if (option === undefined) {
+                // Affirmative not rendered yet (partial frame). Report once, but DON'T
+                // settle — a later frame with the option can still be answered.
+                if (this.reportedPending.has(id))
+                    continue;
+                this.reportedPending.add(id);
+                return { kind: "option_pending", prompt: id };
+            }
+            // Settle OPTIMISTICALLY so a second frame in the same tick does not re-answer,
+            // but keep the settle contingent on the write: if the write is rejected we
+            // un-settle here so a later frame re-attempts it, and the returned `settled`
+            // promise rejects so the caller emits a warning instead of a false "answered".
+            this.settled.add(id);
+            const input = optionInput(option);
+            const operation = option.style === "cursor"
+                ? readFrame === undefined
+                    ? Promise.reject(new Error("Cursor trust navigation requires live screen reads."))
+                    : navigateCursorOption(spec, input, write, readFrame)
+                : writeOptionKeys(optionKeystrokes(option), write);
+            const settled = operation.catch((error) => {
+                this.settled.delete(id);
+                throw error;
+            });
+            return { kind: "answered", automation: { prompt: id, input }, settled };
+        }
+        return undefined;
+    }
+}
+/** Writes one option's keys in order (numbered prompts and parser-only tests). */
+async function writeOptionKeys(keys, write) {
+    for (const key of keys)
+        await write(key);
+}
+/** Navigates a cursor prompt one observed frame at a time, retrying swallowed startup input. */
+async function navigateCursorOption(spec, originalInput, write, readFrame) {
+    const deadline = Date.now() + cursorNavigationTimeoutMs;
+    while (Date.now() < deadline) {
+        const before = readFrame();
+        if (!trustPromptHeaderVisible(before, spec)) {
+            throw new Error("Cursor trust prompt disappeared before confirmation.");
+        }
+        const target = selectableOptions(before).find((option) => spec.accept.test(option.label));
+        if (target?.style !== "cursor") {
+            await delay(cursorRetryMs);
+            continue;
+        }
+        const key = target.offset === 0 ? "\r" : target.offset < 0 ? "\u001b[A" : "\u001b[B";
+        await write(key);
+        const progress = await waitForCursorProgress(spec, target.offset, readFrame);
+        if (progress === "cleared")
+            return;
+    }
+    throw new Error(`Cursor trust navigation timed out (${originalInput}).`);
+}
+async function waitForCursorProgress(spec, priorOffset, readFrame) {
+    const deadline = Date.now() + cursorRetryMs;
+    while (Date.now() < deadline) {
+        await delay(20);
+        const frame = readFrame();
+        if (!trustPromptHeaderVisible(frame, spec)) {
+            if (priorOffset === 0)
+                return "cleared";
+            throw new Error("Cursor trust prompt disappeared before confirmation.");
+        }
+        const target = selectableOptions(frame).find((option) => spec.accept.test(option.label));
+        if (target?.style === "cursor" && target.offset !== priorOffset)
+            return "retry";
+    }
+    return "retry";
+}
+//# sourceMappingURL=responder.js.map

package/dist/core/trust/responder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responder.js","sourceRoot":"","sources":["../../../src/core/trust/responder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAKtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAgCxC,MAAM,OAAO,oBAAoB;IAC/B,6EAA6E;IAC7E,uEAAuE;IACtD,SAAS,CAAU;IACnB,KAAK,CAA8B;IACnC,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1D,yEAAyE;IACzE,6EAA6E;IAC7E,2DAA2D;IAC1C,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IAElE,YAAY,KAAQ,EAAE,SAAS,GAAG,KAAK;QACrC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED,8EAA8E;IAC9E,MAAM,CACJ,KAAa,EACb,KAA0C,EAC1C,SAAwB;QAExB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAyB,CAAC;YAC1C,qEAAqE;YACrE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC;gBAAE,SAAS;YAClE,2EAA2E;YAC3E,2EAA2E;YAC3E,0EAA0E;YAC1E,mBAAmB;YACnB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;gBAAE,SAAS;YACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,uEAAuE;gBACvE,gEAAgE;gBAChE,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAChD,CAAC;YACD,+EAA+E;YAC/E,2EAA2E;YAC3E,6EAA6E;YAC7E,+EAA+E;YAC/E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,SAAS,GACb,MAAM,CAAC,KAAK,KAAK,QAAQ;gBACvB,CAAC,CAAC,SAAS,KAAK,SAAS;oBACvB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;oBAClF,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC;gBACvD,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACjD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,kFAAkF;AAClF,KAAK,UAAU,eAAe,CAC5B,IAAuB,EACvB,KAA0C;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,oBAAoB,CACjC,IAAsB,EACtB,aAAqB,EACrB,KAA0C,EAC1C,SAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,MAAM,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACrF,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7E,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;IACrC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,aAAa,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAsB,EACtB,WAAmB,EACnB,SAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;IAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,WAAW,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzF,IAAI,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/trust-blocking.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared builder for the per-agent trust blocking screen-fact rules.
+ * Implements PRD §5.1/§5.5 (C-ATTN-03): a trust prompt that stays UNANSWERED
+ * under the policy classifies as a blocking prompt. Both adapters build these
+ * rules identically, so the construction — option-aware header recognition,
+ * stable semantic ids, base-table append — lives here once instead of diverging
+ * across `claude/screen-table.ts` and `codex/screen-table.ts`.
+ */
+import type { ElwoodAgentKind } from "./activity.ts";
+import type { ScreenFactTable } from "./screen-facts.ts";
+/**
+ * `base` plus one `blocking_prompt_visible` rule per trust prompt that stays
+ * unanswered under `autotrust`. Each rule recognizes the prompt only by its
+ * HEADER outside the option region (`trustHeaderMatches`, the same recognizer
+ * the responder uses; the non-option text is computed once per frame and cached
+ * across the rules), so an unrelated numbered/cursor option containing a trust
+ * phrase is NOT mistaken for a blocking trust prompt (PRD §5.1). Returns `base`
+ * unchanged when no trust prompt blocks (e.g. every allowlisted prompt is
+ * auto-answered).
+ */
+export declare function withTrustBlockingRules(base: ScreenFactTable, agent: ElwoodAgentKind, autotrust: boolean): ScreenFactTable;
+//# sourceMappingURL=trust-blocking.d.ts.map

package/dist/core/trust-blocking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-blocking.d.ts","sourceRoot":"","sources":["../../src/core/trust-blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIzE;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,eAAe,CAgBjB"}

package/dist/core/trust-blocking.js

@@ -0,0 +1,38 @@
+/**
+ * Shared builder for the per-agent trust blocking screen-fact rules.
+ * Implements PRD §5.1/§5.5 (C-ATTN-03): a trust prompt that stays UNANSWERED
+ * under the policy classifies as a blocking prompt. Both adapters build these
+ * rules identically, so the construction — option-aware header recognition,
+ * stable semantic ids, base-table append — lives here once instead of diverging
+ * across `claude/screen-table.ts` and `codex/screen-table.ts`.
+ */
+import { nonOptionText } from "./terminal-options.js";
+import { blockingTrustSpecs, trustHeaderMatches } from "./trust-prompts.js";
+/**
+ * `base` plus one `blocking_prompt_visible` rule per trust prompt that stays
+ * unanswered under `autotrust`. Each rule recognizes the prompt only by its
+ * HEADER outside the option region (`trustHeaderMatches`, the same recognizer
+ * the responder uses; the non-option text is computed once per frame and cached
+ * across the rules), so an unrelated numbered/cursor option containing a trust
+ * phrase is NOT mistaken for a blocking trust prompt (PRD §5.1). Returns `base`
+ * unchanged when no trust prompt blocks (e.g. every allowlisted prompt is
+ * auto-answered).
+ */
+export function withTrustBlockingRules(base, agent, autotrust) {
+    let cachedFrame;
+    let cachedHeader = "";
+    const headerFor = (text) => {
+        if (text !== cachedFrame) {
+            cachedFrame = text;
+            cachedHeader = nonOptionText(text);
+        }
+        return cachedHeader;
+    };
+    const rules = blockingTrustSpecs(agent, autotrust).map((spec) => ({
+        id: `${agent}-${spec.id}-prompt`,
+        fact: "blocking_prompt_visible",
+        match: (text) => trustHeaderMatches(headerFor(text), spec),
+    }));
+    return rules.length === 0 ? base : { ...base, rules: [...base.rules, ...rules] };
+}
+//# sourceMappingURL=trust-blocking.js.map

package/dist/core/trust-blocking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-blocking.js","sourceRoot":"","sources":["../../src/core/trust-blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,KAAsB,EACtB,SAAkB;IAElB,IAAI,WAA+B,CAAC;IACpC,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,WAAW,GAAG,IAAI,CAAC;YACnB,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,KAAK,GAAqB,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,SAAS;QAChC,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;KAC3D,CAAC,CAAC,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;AACnF,CAAC"}

package/dist/core/trust-prompts.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Allowlist of known adapter startup trust prompts and how to answer them.
+ * Implements PRD §5.1 and §5.5 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
+ *
+ * This is an EXPLICIT allowlist, not an open-ended matcher: each entry names one
+ * concrete prompt by its on-screen text and a fixed affirmative outcome. A new
+ * CLI prompt is trusted only by adding a deliberate entry here — Elwood never
+ * blanket-answers "any first-run confirmation", which would silently bypass a
+ * future CLI security gate for third-party code or config.
+ */
+import type { ElwoodAgentKind } from "./activity.ts";
+/**
+ * The fields common to every allowlisted trust prompt. The prompt and its answer
+ * are BOTH matched within the same current frame: `headerPattern` identifies the
+ * prompt by its HEADER wording, and `accept` matches the exact affirmative option
+ * label in that same prompt. This prevents a stale phrase from one frame pairing
+ * with a "Yes" from a different, current dialog (which could auto-confirm an
+ * unrelated security gate). `headerPattern` is a HEADER matcher, not a
+ * whole-frame matcher: it is only safe when tested against the frame's non-option
+ * lines (via `trustHeaderMatches`), never applied raw to the full frame.
+ */
+type TrustPromptBase = {
+    /**
+     * Identifies the prompt by its HEADER wording. MUST be tested only against the
+     * frame's non-option lines (see `trustHeaderMatches`) — applying it raw to the
+     * full frame would let an option-only trust phrase spoof recognition.
+     * Verified against the CLI versions below.
+     */
+    readonly headerPattern: RegExp;
+    /** Matches the exact affirmative option label for THIS prompt (per-prompt, not generic). */
+    readonly accept: RegExp;
+};
+/**
+ * When an allowlisted prompt is answered. `"autotrust"` prompts are answered ONLY
+ * under the caller's full-trust posture; `"always"` prompts are answered
+ * regardless of it (Elwood's own hook bridge, never third-party code).
+ */
+export type TrustAnswerPolicy = "always" | "autotrust";
+/**
+ * One allowlisted trust prompt, as an agent+id-DISCRIMINATED union so that (a) a
+ * typo in `id` cannot compile into a public startup label, and (b)
+ * `answerPolicy: "always"` — answered regardless of `autotrust` — is permitted
+ * ONLY on Codex `hook_trust`, Elwood's OWN integration (the hook bridge) that the
+ * session requires to work. Every third-party trust prompt (skills, plugins, MCP
+ * servers, folder trust) is `answerPolicy: "autotrust"`, staying gated on the
+ * caller's full-trust posture, so the invalid "third-party prompt answered
+ * always" state is unrepresentable.
+ */
+export type TrustPromptSpec = ({
+    readonly agent: "claude";
+    readonly id: ClaudeTrustPromptId;
+    readonly answerPolicy: "autotrust";
+} & TrustPromptBase) | ({
+    readonly agent: "codex";
+    readonly id: "workspace_trust";
+    readonly answerPolicy: "autotrust";
+} & TrustPromptBase) | ({
+    readonly agent: "codex";
+    readonly id: "hook_trust";
+    /** Answered regardless of `autotrust`: Elwood's own hook bridge (never third-party code). */
+    readonly answerPolicy: "always";
+} & TrustPromptBase);
+/** The Claude trust-prompt ids: folder trust plus the CLI's first-run skill/plugin/MCP gates. */
+type ClaudeTrustPromptId = "workspace_trust" | "skill_trust" | "plugin_trust" | "mcp_trust";
+/**
+ * The allowlist. Wording verified against claude 2.1.205–2.1.252 and codex-cli 0.142.5.
+ * `workspace`/`directory` trust are the folder-trust gates; `skill`, `plugin`,
+ * and `mcp` cover the CLI's first-run trust prompts for loading third-party
+ * skills, plugins, and MCP servers under a full-trust launch.
+ */
+export declare const trustPromptAllowlist: readonly [{
+    readonly id: "workspace_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "skill_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "plugin_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "mcp_trust";
+    readonly agent: "claude";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "workspace_trust";
+    readonly agent: "codex";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "autotrust";
+}, {
+    readonly id: "hook_trust";
+    readonly agent: "codex";
+    readonly headerPattern: RegExp;
+    readonly accept: RegExp;
+    readonly answerPolicy: "always";
+}];
+/**
+ * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
+ * text as produced by `nonOptionText`. This is the ONE shared, option-aware
+ * recognizer: the responder, the cursor navigator, and the screen-fact blocking
+ * rules all go through it (each computes `nonOptionText` once per frame and
+ * tests every spec against that), so a numbered or cursor-selectable option whose
+ * label merely contains a trust phrase is never recognized as a prompt. Matching
+ * joined non-option lines also keeps wrapped headers matchable (§5.1).
+ */
+export declare function trustHeaderMatches(header: string, spec: TrustPromptBase): boolean;
+/** `trustHeaderMatches` over a raw frame, for callers that test a single spec. */
+export declare function trustPromptHeaderVisible(frame: string, spec: TrustPromptBase): boolean;
+/**
+ * The stable public `startup_prompt` trust labels (§5.4), derived from the
+ * allowlist so the two can never drift: deleting, adding, or renaming an entry
+ * updates this union automatically. Because `TrustPromptSpec` fixes each agent's
+ * ids to a closed literal union, a typo in an entry's `id` fails to compile
+ * against `satisfies` rather than silently widening this derived label union.
+ */
+export type TrustPromptId = (typeof trustPromptAllowlist)[number]["id"];
+/** The trust label ids for one specific agent (e.g. Codex automation cannot use a Claude-only id). */
+export type TrustPromptIdFor<A extends ElwoodAgentKind> = Extract<(typeof trustPromptAllowlist)[number], {
+    readonly agent: A;
+}>["id"];
+/** Specs for one agent that stay UNANSWERED under the effective policy (block on the human). */
+export declare function blockingTrustSpecs(agent: ElwoodAgentKind, autotrust: boolean): readonly TrustPromptSpec[];
+export {};
+//# sourceMappingURL=trust-prompts.d.ts.map

package/dist/core/trust-prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-prompts.d.ts","sourceRoot":"","sources":["../../src/core/trust-prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD;;;;;;;;;GASG;AACH,KAAK,eAAe,GAAG;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GACvB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,GAAG,eAAe,CAAC,CAAC;AAEzB,iGAAiG;AACjG,KAAK,mBAAmB,GAAG,iBAAiB,GAAG,aAAa,GAAG,cAAc,GAAG,WAAW,CAAC;AAW5F;;;;;GAKG;AAKH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsDc,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEjF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAExE,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI,OAAO,CAC/D,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,EACrC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CACtB,CAAC,IAAI,CAAC,CAAC;AAER,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,SAAS,eAAe,EAAE,CAM5B"}