@with-logic/elwood 0.1.3 → 0.2.0

package/dist/core/trust/blocking.js

@@ -4,35 +4,81 @@
  * under the policy classifies as a blocking prompt. Both adapters build these
  * rules identically, so the construction — option-aware header recognition,
  * stable semantic ids, base-table append — lives here once instead of diverging
- * across `claude/screen-table.ts` and `codex/screen-table.ts`.
+ * across `claude/screen-table.ts` and `codex/screen-table.ts`. A native-shaped gate
+ * whose header is OFF the allowlist is hold-only under every policy (C-TRUST-01).
  */
-import { nonOptionText } from "../terminal-options.js";
-import { blockingTrustSpecs, trustHeaderMatches } from "./prompts.js";
+import { parseTrustCandidates } from "./dialog.js";
+import { blockingTrustSpecs, trustPromptAllowlist } from "./prompts.js";
 /**
- * `base` plus one `blocking_prompt_visible` rule per trust prompt that stays
- * unanswered under `autotrust`. Each rule recognizes the prompt only by its
- * HEADER outside the option region (`trustHeaderMatches`, the same recognizer
- * the responder uses; the non-option text is computed once per frame and cached
- * across the rules), so an unrelated numbered/cursor option containing a trust
- * phrase is NOT mistaken for a blocking trust prompt (PRD §5.1). Returns `base`
- * unchanged when no trust prompt blocks (e.g. every allowlisted prompt is
- * auto-answered).
+ * Blocking rules for every native trust candidate: allowlisted gates the human owns
+ * (held even when their body is unsafe to automate) plus the off-allowlist fallback.
  */
 export function withTrustBlockingRules(base, agent, autotrust) {
     let cachedFrame;
-    let cachedHeader = "";
-    const headerFor = (text) => {
-        if (text !== cachedFrame) {
+    let cached = [];
+    const regionsFor = (text) => {
+        if (cachedFrame !== text) {
             cachedFrame = text;
-            cachedHeader = nonOptionText(text);
+            cached = parseTrustCandidates(text);
         }
-        return cachedHeader;
+        return cached;
     };
     const rules = blockingTrustSpecs(agent, autotrust).map((spec) => ({
         id: `${agent}-${spec.id}-prompt`,
         fact: "blocking_prompt_visible",
-        match: (text) => trustHeaderMatches(headerFor(text), spec),
+        match: (text) => {
+            return regionsFor(text).some(({ dialog }) => spec.headerPattern.test(dialog.header));
+        },
     }));
-    return rules.length === 0 ? base : { ...base, rules: [...base.rules, ...rules] };
+    rules.push({
+        id: `${agent}-unknown_gate-prompt`,
+        fact: "blocking_prompt_visible",
+        // Yields to ANY earlier rule that already set `blocking_prompt_visible` for this
+        // frame — permission and approval dialogs, but also the update and model-switch
+        // rules — so a gate an adapter table already names keeps its own label.
+        fallback: true,
+        match: (text) => unknownGateVisible(regionsFor(text), agent),
+    });
+    return {
+        ...base,
+        rules: [...base.rules, ...rules],
+        trustGateVisible: (text) => gateVisible(regionsFor(text), agent),
+    };
+}
+/**
+ * A reworded or new gate behind a recognized native header prefix (`headerStart`): the
+ * bottom-most region is a COMPLETE option dialog — a real header, options, nothing
+ * below them but the native footer that ends the frame, no conversation row above —
+ * and NO region names an allowlisted prompt. Enter would answer it, so it holds input.
+ */
+function unknownGateVisible(regions, agent) {
+    const gate = regions[0];
+    return (gate?.validTail === true &&
+        gate.footer &&
+        gate.dialog.header !== "" &&
+        gate.dialog.options.length > 0 &&
+        !namesAllowlistedPrompt(regions, agent));
+}
+/**
+ * Any trust gate is on screen: an allowlisted candidate (even a hold-only one whose body
+ * or options are unsupported) or an off-allowlist gate. Non-trust startup automation
+ * (update skip, browser-tools decline) consults this before EVERY write and MUST NOT
+ * write while it holds. Of the frames it covers, only allowlisted candidates are ever
+ * answered, and only by `TrustPromptResponder` under the trust policy; an off-allowlist
+ * gate is hold-only and stays for the human, so nothing here may answer it.
+ *
+ * Boundary, deliberately narrow: "off-allowlist gate" means the grammar `unknownGateVisible`
+ * documents — a recognized header prefix, a complete option dialog, a native footer ending
+ * the frame, no conversation row above. A prompt outside that grammar is NOT reported here,
+ * so this is a positive signal to withhold a write, never a proof that a frame is safe.
+ */
+export function trustGateVisible(frame, agent) {
+    return gateVisible(parseTrustCandidates(frame), agent);
+}
+function gateVisible(regions, agent) {
+    return namesAllowlistedPrompt(regions, agent) || unknownGateVisible(regions, agent);
+}
+function namesAllowlistedPrompt(regions, agent) {
+    return regions.some(({ dialog }) => trustPromptAllowlist.some((spec) => spec.agent === agent && spec.headerPattern.test(dialog.header)));
 }
 //# sourceMappingURL=blocking.js.map

package/dist/core/trust/blocking.js.map

@@ -1 +1 @@
-{"version":3,"file":"blocking.js","sourceRoot":"","sources":["../../../src/core/trust/blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,KAAsB,EACtB,SAAkB;IAElB,IAAI,WAA+B,CAAC;IACpC,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE;QACjC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,WAAW,GAAG,IAAI,CAAC;YACnB,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,KAAK,GAAqB,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,SAAS;QAChC,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;KAC3D,CAAC,CAAC,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;AACnF,CAAC"}
+{"version":3,"file":"blocking.js","sourceRoot":"","sources":["../../../src/core/trust/blocking.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAIxE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAqB,EACrB,KAAsB,EACtB,SAAkB;IAElB,IAAI,WAA+B,CAAC;IACpC,IAAI,MAAM,GAAiB,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;QAClC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,KAAK,GAAqB,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,EAAE,SAAS;QAChC,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACvF,CAAC;KACF,CAAC,CAAC,CAAC;IACJ,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,GAAG,KAAK,sBAAsB;QAClC,IAAI,EAAE,yBAAyB;QAC/B,iFAAiF;QACjF,gFAAgF;QAChF,wEAAwE;QACxE,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC;QAChC,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;KACjE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAqB,EAAE,KAAsB;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CACL,IAAI,EAAE,SAAS,KAAK,IAAI;QACxB,IAAI,CAAC,MAAM;QACX,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE;QACzB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC9B,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,KAAsB;IACpE,OAAO,WAAW,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,OAAqB,EAAE,KAAsB;IAChE,OAAO,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAqB,EAAE,KAAsB;IAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CACjC,oBAAoB,CAAC,IAAI,CACvB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACzE,CACF,CAAC;AACJ,CAAC"}

package/dist/core/trust/clearance.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The trust-clearance seam: the shared coordinator asks an ADAPTER whether a frame is
+ * the CLI's own native composer, rather than carrying both CLIs' layout grammars itself
+ * (PRD §5.4, C-TRUST-01). Each adapter owns its grammar beside its screen-fact table, so
+ * a CLI layout change lands in exactly one place per adapter.
+ *
+ * The helper below serves Claude's whole-frame option guard. Codex checks only the
+ * native region beneath its last composer: numbered transcript rows above it are
+ * valid conversation content, not a dialog (see codex/screen/clearance.ts).
+ */
+/** True when the frame is the agent's own idle native composer and no dialog is up. */
+export type TrustClearance = (frame: string) => boolean;
+/**
+ * Builds an adapter's clearance predicate from its composer row and the chrome that
+ * proves the frame is that CLI's own idle screen. `composerRow` is used twice on
+ * purpose: to recognize clearance, and to tell the composer caret apart from a dialog
+ * caret, which is the collision `docs/cli-behavior.md` records.
+ */
+export declare function nativeComposerClearance(composerRow: RegExp, chrome: (frame: string) => boolean): TrustClearance;
+//# sourceMappingURL=clearance.d.ts.map

package/dist/core/trust/clearance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clearance.d.ts","sourceRoot":"","sources":["../../../src/core/trust/clearance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,uFAAuF;AACvF,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,GACjC,cAAc,CAShB"}

package/dist/core/trust/clearance.js

@@ -0,0 +1,25 @@
+/**
+ * The trust-clearance seam: the shared coordinator asks an ADAPTER whether a frame is
+ * the CLI's own native composer, rather than carrying both CLIs' layout grammars itself
+ * (PRD §5.4, C-TRUST-01). Each adapter owns its grammar beside its screen-fact table, so
+ * a CLI layout change lands in exactly one place per adapter.
+ *
+ * The helper below serves Claude's whole-frame option guard. Codex checks only the
+ * native region beneath its last composer: numbered transcript rows above it are
+ * valid conversation content, not a dialog (see codex/screen/clearance.ts).
+ */
+/**
+ * Builds an adapter's clearance predicate from its composer row and the chrome that
+ * proves the frame is that CLI's own idle screen. `composerRow` is used twice on
+ * purpose: to recognize clearance, and to tell the composer caret apart from a dialog
+ * caret, which is the collision `docs/cli-behavior.md` records.
+ */
+export function nativeComposerClearance(composerRow, chrome) {
+    return (frame) => {
+        if (/^\s*[❯›>]?\s*\d+[.)]\s+\S/m.test(frame) ||
+            frame.split("\n").some((line) => /^\s*[❯›]/.test(line) && !composerRow.test(line)))
+            return false;
+        return chrome(frame) && composerRow.test(frame);
+    };
+}
+//# sourceMappingURL=clearance.js.map

package/dist/core/trust/clearance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clearance.js","sourceRoot":"","sources":["../../../src/core/trust/clearance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,MAAkC;IAElC,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IACE,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;YACxC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAElF,OAAO,KAAK,CAAC;QACf,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/trust/copy.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Recognized native trust-dialog explanations, excluding arbitrary intervening prose.
+ * Implements PRD §5.4/C-TRUST-01. Claude copy is captured in trust-responder-cursor
+ * and trust-bypass-permissions tests; Codex directory/hooks were captured from 0.154.0.
+ *
+ * A prompt with known copy REQUIRES an explanatory sentence before any key is
+ * written: a bare allowlisted header is a hold-only candidate, never a verified
+ * dialog. Only version-variable rows (a count, a link label, a later sentence)
+ * stay optional.
+ */
+/** Skill/plugin/MCP gates have no captured explanatory copy; none is accepted. */
+export declare const noTrustDescription: RegExp;
+export declare const claudeWorkspaceDescription: RegExp;
+export declare const claudeBypassDescription: RegExp;
+export declare const codexWorkspaceDescription: RegExp;
+export declare const codexHooksDescription: RegExp;
+/** Codex 0.156.1 folder access copy, captured through the native PTY. */
+export declare const codexFolderAccessDescription: RegExp;
+//# sourceMappingURL=copy.d.ts.map

package/dist/core/trust/copy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy.d.ts","sourceRoot":"","sources":["../../../src/core/trust/copy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,QAAO,CAAC;AAMvC,eAAO,MAAM,0BAA0B,QAEtC,CAAC;AAEF,eAAO,MAAM,uBAAuB,QACyM,CAAC;AAE9O,eAAO,MAAM,yBAAyB,QACmI,CAAC;AAE1K,eAAO,MAAM,qBAAqB,QAC0E,CAAC;AAE7G,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,QACoM,CAAC"}

package/dist/core/trust/copy.js

@@ -0,0 +1,23 @@
+/**
+ * Recognized native trust-dialog explanations, excluding arbitrary intervening prose.
+ * Implements PRD §5.4/C-TRUST-01. Claude copy is captured in trust-responder-cursor
+ * and trust-bypass-permissions tests; Codex directory/hooks were captured from 0.154.0.
+ *
+ * A prompt with known copy REQUIRES an explanatory sentence before any key is
+ * written: a bare allowlisted header is a hold-only candidate, never a verified
+ * dialog. Only version-variable rows (a count, a link label, a later sentence)
+ * stay optional.
+ */
+/** Skill/plugin/MCP gates have no captured explanatory copy; none is accepted. */
+export const noTrustDescription = /^$/;
+// Whole sentences only, so a half-painted body never validates. Either sentence
+// proves the native body; 2.1.206 omits ", or work from your team".
+const likeYourOwn = String.raw `\(Like your own code, a well-known open source project(?:, or work from your team)?\)\. If not, take a moment to review what's in this folder first\.`;
+const ableTo = String.raw `Claude Code'll be able to read, edit, and execute files here\.`;
+export const claudeWorkspaceDescription = new RegExp(`^(?:${likeYourOwn}\\s*(?:${ableTo}\\s*)?|${ableTo}\\s*)(?:Security guide)?$`);
+export const claudeBypassDescription = /^In Bypass Permissions mode, Claude Code will not ask for your approval before running potentially dangerous commands\.\s*(?:By proceeding, you accept all responsibility for actions taken while running in Bypass Permissions mode\.)?$/;
+export const codexWorkspaceDescription = /^Working with untrusted contents comes with higher risk of prompt injection\. Trusting the directory allows project-local config, hooks, and exec policies to load\.$/;
+export const codexHooksDescription = /^(?:\d+ hooks? (?:is|are) new or changed\.\s*)?Hooks can run outside the sandbox after you trust them\.$/;
+/** Codex 0.156.1 folder access copy, captured through the native PTY. */
+export const codexFolderAccessDescription = /^Codex can read, edit, and run files here, subject to your permission settings\. Folder settings can run code automatically, even without a model request\. Continue only if you trust these files\. Your trust decision will be saved\.$/;
+//# sourceMappingURL=copy.js.map

package/dist/core/trust/copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy.js","sourceRoot":"","sources":["../../../src/core/trust/copy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,uJAAuJ,CAAC;AACtL,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAA,gEAAgE,CAAC;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,MAAM,CAClD,OAAO,WAAW,UAAU,MAAM,UAAU,MAAM,2BAA2B,CAC9E,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAClC,2OAA2O,CAAC;AAE9O,MAAM,CAAC,MAAM,yBAAyB,GACpC,uKAAuK,CAAC;AAE1K,MAAM,CAAC,MAAM,qBAAqB,GAChC,0GAA0G,CAAC;AAE7G,yEAAyE;AACzE,MAAM,CAAC,MAAM,4BAA4B,GACvC,2OAA2O,CAAC"}

package/dist/core/trust/dialog.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Parses one active terminal dialog before matching the trust allowlist.
+ * Implements PRD §5.4 and C-TRUST-01; native copy is validated separately per prompt.
+ */
+import { type SelectableOption } from "../terminal-options.ts";
+export type TrustDialog = {
+    readonly header: string;
+    readonly options: readonly SelectableOption[];
+};
+/** Parse the last standalone candidate once; never borrow an earlier candidate's options. */
+export declare function parseTrustDialog(frame: string): TrustDialog | undefined;
+type Candidate = {
+    readonly dialog: TrustDialog;
+    readonly validTail: boolean;
+    /** The frame ends in a native footer row: the dialog finished painting. */
+    readonly footer: boolean;
+};
+/**
+ * A provenance-checked header may hold input even while its native body is incomplete.
+ * Every standalone header region, bottom-most first. Only the bottom-most can be a
+ * safe write target; an earlier one exists so that header-like text BELOW a known
+ * gate cannot make the gate disappear from input holding (it fails closed instead).
+ */
+export declare function parseTrustCandidates(frame: string): readonly Candidate[];
+/** Native candidate copy, shared with positive composer safety; not an automation allowlist. */
+export declare function isTrustDialogHeader(line: string): boolean;
+export {};
+//# sourceMappingURL=dialog.d.ts.map

package/dist/core/trust/dialog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialog.d.ts","sourceRoot":"","sources":["../../../src/core/trust/dialog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAWhC,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC/C,CAAC;AAEF,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAGvE;AAED,KAAK,SAAS,GAAG;IACf,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,SAAS,EAAE,CAmBxE;AAED,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/core/trust/dialog.js

@@ -0,0 +1,96 @@
+/**
+ * Parses one active terminal dialog before matching the trust allowlist.
+ * Implements PRD §5.4 and C-TRUST-01; native copy is validated separately per prompt.
+ */
+import { cursorOptionRows, nonOptionText, selectableOptions, } from "../terminal-options.js";
+const headerStart = /^(?:Do you|Quick safety|Is this|Load this|Trust the|Trust this|New MCP|WARNING:|Claude Code running|Hooks need)/i;
+const numberedRow = /^\s*[❯›>]?\s*\d+[.)]\s*\S/;
+const footerRow = /^\s*(?:(?:Enter to confirm|Esc to cancel)(?:\s*[·•]\s*(?:Enter to confirm|Esc to cancel))*|Press enter to (?:continue|confirm or esc to (?:cancel|go back))|enter continue · esc quit)\s*$/i;
+// Native Codex's location prelude begins with >; conversation/composer rows do too.
+const conversationRow = /^\s*(?:[●•]|[❯›](?!\s*\d+[.)])|>(?!\s+You are in (?:\/|[A-Z]:[\\/]))(?!\s*\d+[.)])|(?:user|assistant)\s*:)/i;
+/** Parse the last standalone candidate once; never borrow an earlier candidate's options. */
+export function parseTrustDialog(frame) {
+    const candidate = parseTrustCandidates(frame)[0];
+    return candidate?.validTail ? candidate.dialog : undefined;
+}
+/**
+ * A provenance-checked header may hold input even while its native body is incomplete.
+ * Every standalone header region, bottom-most first. Only the bottom-most can be a
+ * safe write target; an earlier one exists so that header-like text BELOW a known
+ * gate cannot make the gate disappear from input holding (it fails closed instead).
+ */
+export function parseTrustCandidates(frame) {
+    const lines = frame.split("\n");
+    const starts = [];
+    // A cursor block's unselected rows carry no caret, so only the parsed bounds can
+    // tell them from prose; numbered rows announce themselves and are tracked inline.
+    const cursorBlock = cursorOptionRows(lines);
+    let insideNumberedOption = false;
+    for (const [row, line] of lines.entries()) {
+        if (cursorBlock !== undefined && row >= cursorBlock.firstRow && row <= cursorBlock.lastRow)
+            continue;
+        if (numberedRow.test(line))
+            insideNumberedOption = true;
+        else if (isSeparator(line))
+            insideNumberedOption = false;
+        else if (!insideNumberedOption && isTrustDialogHeader(line))
+            starts.unshift(row);
+    }
+    return starts.flatMap((start, index) => {
+        const candidate = candidateAt(lines, start);
+        if (candidate === undefined)
+            return [];
+        return [index === 0 ? candidate : { ...candidate, validTail: false }];
+    });
+}
+/** Native candidate copy, shared with positive composer safety; not an automation allowlist. */
+export function isTrustDialogHeader(line) {
+    return headerStart.test(line.trim());
+}
+function candidateAt(lines, start) {
+    // Keep the provenance of a candidate when removing its prelude. Exact native
+    // copy quoted below a conversation row is still conversation content.
+    if (lines.slice(0, start).some((line) => conversationRow.test(line)))
+        return undefined;
+    const tail = lines.slice(start);
+    const unknownTail = tail.some((line) => /^\s*(?:[●•]|(?:user|assistant)\s*:)/i.test(line));
+    const text = tail.join("\n");
+    const header = nonOptionText(text);
+    const options = selectableOptions(text);
+    // nonOptionText joins original rows with a space, preserving their lengths.
+    // Replacing each newline by a space therefore gives the same boundary.
+    let offset = 0;
+    const optionStart = tail.findIndex((line) => {
+        const afterHeader = offset > header.length;
+        offset += line.length + 1;
+        return afterHeader;
+    });
+    return {
+        dialog: { header: header.trim().replace(/\s+/g, " "), options },
+        validTail: !unknownTail && (optionStart < 0 || validOptionTail(tail.slice(optionStart), options)),
+        footer: footerRow.test(text.slice(text.trimEnd().lastIndexOf("\n") + 1)),
+    };
+}
+function isSeparator(line) {
+    return line.trim() === "" || footerRow.test(line) || /^[─━]{3}/.test(line.trim());
+}
+function validOptionTail(lines, options) {
+    let footer = false;
+    for (const line of lines) {
+        if (line.trim() === "")
+            continue;
+        if (footerRow.test(line)) {
+            footer = true;
+            continue;
+        }
+        if (footer)
+            return false;
+        if (numberedRow.test(line))
+            continue;
+        const label = line.trim().replace(/^[❯›]\s+/, "");
+        if (!options.some((option) => option.style === "cursor" && option.label === label))
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=dialog.js.map

package/dist/core/trust/dialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialog.js","sourceRoot":"","sources":["../../../src/core/trust/dialog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,gBAAgB,EAChB,aAAa,EAEb,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,GACf,kHAAkH,CAAC;AACrH,MAAM,WAAW,GAAG,2BAA2B,CAAC;AAChD,MAAM,SAAS,GACb,6LAA6L,CAAC;AAChM,oFAAoF;AACpF,MAAM,eAAe,GACnB,6GAA6G,CAAC;AAOhH,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,iFAAiF;IACjF,kFAAkF;IAClF,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,IAAI,WAAW,KAAK,SAAS,IAAI,GAAG,IAAI,WAAW,CAAC,QAAQ,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO;YACxF,SAAS;QACX,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,oBAAoB,GAAG,IAAI,CAAC;aACnD,IAAI,WAAW,CAAC,IAAI,CAAC;YAAE,oBAAoB,GAAG,KAAK,CAAC;aACpD,IAAI,CAAC,oBAAoB,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACrC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB,EAAE,KAAa;IAC1D,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3C,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1B,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE;QAC/D,SAAS,EACP,CAAC,WAAW,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QACxF,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,eAAe,CAAC,KAAwB,EAAE,OAAoC;IACrF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACjC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;YAChF,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/trust/options.d.ts

@@ -0,0 +1,9 @@
+/** Native trust option rows; unrelated text cannot masquerade as a cursor sibling (C-TRUST-01). */
+export declare const claudeWorkspaceOptions: RegExp;
+export declare const claudeExtensionOptions: RegExp;
+export declare const claudeMcpOptions: RegExp;
+export declare const claudeBypassOptions: RegExp;
+export declare const codexWorkspaceOptions: RegExp;
+export declare const codexHooksOptions: RegExp;
+export declare const codexFolderAccessOptions: RegExp;
+//# sourceMappingURL=options.d.ts.map

package/dist/core/trust/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/core/trust/options.ts"],"names":[],"mappings":"AAAA,mGAAmG;AAEnG,eAAO,MAAM,sBAAsB,QACmD,CAAC;AACvF,eAAO,MAAM,sBAAsB,QACgD,CAAC;AACpF,eAAO,MAAM,gBAAgB,QACiJ,CAAC;AAC/K,eAAO,MAAM,mBAAmB,QAAkC,CAAC;AACnE,eAAO,MAAM,qBAAqB,QAA4C,CAAC;AAC/E,eAAO,MAAM,iBAAiB,QAC8D,CAAC;AAE7F,eAAO,MAAM,wBAAwB,QAAkC,CAAC"}

package/dist/core/trust/options.js

@@ -0,0 +1,9 @@
+/** Native trust option rows; unrelated text cannot masquerade as a cursor sibling (C-TRUST-01). */
+export const claudeWorkspaceOptions = /^(?:Yes(?:, (?:I trust this folder|proceed|continue))?|No(?:, (?:exit|cancel))?)$/i;
+export const claudeExtensionOptions = /^(?:Yes(?:, (?:trust it|load this skill|continue))?|No(?:, (?:exit|cancel))?)$/i;
+export const claudeMcpOptions = /^(?:Use this(?: MCP)? server|Use this and all future MCP servers in this project|Use all future servers|Continue without using this MCP server|No(?:, (?:exit|cancel))?)$/i;
+export const claudeBypassOptions = /^(?:Yes, I accept|No, exit)$/i;
+export const codexWorkspaceOptions = /^(?:Yes(?:, continue)?|No(?:, quit)?)$/i;
+export const codexHooksOptions = /^(?:Review hooks|Trust all and continue|Continue without trusting \(hooks won't run\))$/i;
+export const codexFolderAccessOptions = /^(?:Trust and continue|Quit)$/;
+//# sourceMappingURL=options.js.map

package/dist/core/trust/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/core/trust/options.ts"],"names":[],"mappings":"AAAA,mGAAmG;AAEnG,MAAM,CAAC,MAAM,sBAAsB,GACjC,oFAAoF,CAAC;AACvF,MAAM,CAAC,MAAM,sBAAsB,GACjC,iFAAiF,CAAC;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAC3B,4KAA4K,CAAC;AAC/K,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,0FAA0F,CAAC;AAE7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,+BAA+B,CAAC"}

package/dist/core/trust/prompts.d.ts

@@ -10,45 +10,34 @@
  */
 import type { ElwoodAgentKind } from "../activity/index.ts";
 import { trustPromptAllowlist } from "./allowlist.ts";
+import type { TrustDialog } from "./dialog.ts";
 export { trustPromptAllowlist } from "./allowlist.ts";
-/**
- * The fields common to every allowlisted trust prompt. The prompt and its answer
- * are BOTH matched within the same current frame: `headerPattern` identifies the
- * prompt by its HEADER wording, and `accept` matches the exact affirmative option
- * label in that same prompt. This prevents a stale phrase from one frame pairing
- * with a "Yes" from a different, current dialog (which could auto-confirm an
- * unrelated security gate). `headerPattern` is a HEADER matcher, not a
- * whole-frame matcher: it is only safe when tested against the frame's non-option
- * lines (via `trustHeaderMatches`), never applied raw to the full frame.
- */
+/** Header and affirmative matchers for one active dialog (C-TRUST-01). */
 type TrustPromptBase = {
-    /**
-     * Identifies the prompt by its HEADER wording. MUST be tested only against the
-     * frame's non-option lines (see `trustHeaderMatches`) — applying it raw to the
-     * full frame would let an option-only trust phrase spoof recognition.
-     * Verified against the CLI versions below.
-     */
+    /** Anchored standalone header, matched only inside an active trust-dialog region. */
     readonly headerPattern: RegExp;
+    /** Native copy after the header: required where the prompt has any; unknown prose fails closed. */
+    readonly descriptionPattern: RegExp;
+    /** Every parsed row must be one of this dialog's native choices, including declines. */
+    readonly optionPattern: RegExp;
     /** Matches the exact affirmative option label for THIS prompt (per-prompt, not generic). */
     readonly accept: RegExp;
 };
+/** The Claude trust-prompt ids: folder trust plus the CLI's first-run skill/plugin/MCP gates. */
+type ClaudeTrustPromptId = "workspace_trust" | "skill_trust" | "plugin_trust" | "mcp_trust" | "bypass_permissions";
 /**
  * When an allowlisted prompt is answered. `"autotrust"` prompts are answered ONLY
  * under the caller's full-trust posture; `"always"` prompts are answered
- * regardless of it (Elwood's own hook bridge, never third-party code).
+ * regardless of it (Codex trusts all configured hooks, including third-party hooks).
  */
-/** The Claude trust-prompt ids: folder trust plus the CLI's first-run skill/plugin/MCP gates. */
-type ClaudeTrustPromptId = "workspace_trust" | "skill_trust" | "plugin_trust" | "mcp_trust" | "bypass_permissions";
 export type TrustAnswerPolicy = "always" | "autotrust";
 /**
  * One allowlisted trust prompt, as an agent+id-DISCRIMINATED union so that (a) a
  * typo in `id` cannot compile into a public startup label, and (b)
  * `answerPolicy: "always"` — answered regardless of `autotrust` — is permitted
- * ONLY on Codex `hook_trust`, Elwood's OWN integration (the hook bridge) that the
- * session requires to work. Every third-party trust prompt (skills, plugins, MCP
- * servers, folder trust) is `answerPolicy: "autotrust"`, staying gated on the
- * caller's full-trust posture, so the invalid "third-party prompt answered
- * always" state is unrepresentable.
+ * ONLY on Codex `hook_trust`. Codex hook trust is session-wide, covering Elwood's
+ * bridge and every third-party hook. Other trust prompts (skills, plugins, MCP
+ * servers, folder trust) remain gated on the caller's full-trust posture.
  */
 export type TrustPromptSpec = ({
     readonly agent: "claude";
@@ -61,21 +50,11 @@ export type TrustPromptSpec = ({
 } & TrustPromptBase) | ({
     readonly agent: "codex";
     readonly id: "hook_trust";
-    /** Answered regardless of `autotrust`: Elwood's own hook bridge (never third-party code). */
+    /** Answered regardless of `autotrust`: all configured Codex hooks, including third-party code. */
     readonly answerPolicy: "always";
 } & TrustPromptBase);
-/**
- * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
- * text as produced by `nonOptionText`. This is the ONE shared, option-aware
- * recognizer: the responder, the cursor navigator, and the screen-fact blocking
- * rules all go through it (each computes `nonOptionText` once per frame and
- * tests every spec against that), so a numbered or cursor-selectable option whose
- * label merely contains a trust phrase is never recognized as a prompt. Matching
- * joined non-option lines also keeps wrapped headers matchable (§5.1).
- */
-export declare function trustHeaderMatches(header: string, spec: TrustPromptBase): boolean;
-/** `trustHeaderMatches` over a raw frame, for callers that test a single spec. */
-export declare function trustPromptHeaderVisible(frame: string, spec: TrustPromptBase): boolean;
+/** Match one already-parsed active dialog against its header and native explanation. */
+export declare function activeTrustDialogVisible(dialog: TrustDialog | undefined, spec: TrustPromptBase): boolean;
 /**
  * The stable public `startup_prompt` trust labels (§5.4), derived from the
  * allowlist so the two can never drift: deleting, adding, or renaming an entry

package/dist/core/trust/prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;;;;;;;GASG;AACH,KAAK,eAAe,GAAG;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,iGAAiG;AACjG,KAAK,mBAAmB,GACpB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,WAAW,GACX,oBAAoB,CAAC;AAEzB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,GACvB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,GAAG,eAAe,CAAC,CAAC;AAEzB;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEjF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAExE,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI,OAAO,CAC/D,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,EACrC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CACtB,CAAC,IAAI,CAAC,CAAC;AAER,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,SAAS,eAAe,EAAE,CAM5B"}
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,0EAA0E;AAC1E,KAAK,eAAe,GAAG;IACrB,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,iGAAiG;AACjG,KAAK,mBAAmB,GACpB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,WAAW,GACX,oBAAoB,CAAC;AAEzB;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GACvB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;CACpC,GAAG,eAAe,CAAC,GACpB,CAAC;IACC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,GAAG,eAAe,CAAC,CAAC;AAEzB,wFAAwF;AACxF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,IAAI,EAAE,eAAe,GACpB,OAAO,CAQT;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAExE,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,eAAe,IAAI,OAAO,CAC/D,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,EACrC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CACtB,CAAC,IAAI,CAAC,CAAC;AAER,gGAAgG;AAChG,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,OAAO,GACjB,SAAS,eAAe,EAAE,CAM5B"}

package/dist/core/trust/prompts.js

@@ -8,30 +8,22 @@
  * blanket-answers "any first-run confirmation", which would silently bypass a
  * future CLI security gate for third-party code or config.
  */
-import { nonOptionText } from "../terminal-options.js";
 import { trustPromptAllowlist } from "./allowlist.js";
 export { trustPromptAllowlist } from "./allowlist.js";
-/**
- * True when `spec`'s HEADER wording appears in `header` — the frame's NON-option
- * text as produced by `nonOptionText`. This is the ONE shared, option-aware
- * recognizer: the responder, the cursor navigator, and the screen-fact blocking
- * rules all go through it (each computes `nonOptionText` once per frame and
- * tests every spec against that), so a numbered or cursor-selectable option whose
- * label merely contains a trust phrase is never recognized as a prompt. Matching
- * joined non-option lines also keeps wrapped headers matchable (§5.1).
- */
-export function trustHeaderMatches(header, spec) {
-    return spec.headerPattern.test(header);
-}
-/** `trustHeaderMatches` over a raw frame, for callers that test a single spec. */
-export function trustPromptHeaderVisible(frame, spec) {
-    return trustHeaderMatches(nonOptionText(frame), spec);
+/** Match one already-parsed active dialog against its header and native explanation. */
+export function activeTrustDialogVisible(dialog, spec) {
+    if (dialog === undefined)
+        return false;
+    const header = spec.headerPattern.exec(dialog.header);
+    return (header !== null &&
+        spec.descriptionPattern.test(dialog.header.slice(header[0].length).trim()) &&
+        dialog.options.every((option) => spec.optionPattern.test(option.label)));
 }
 /** Specs for one agent that stay UNANSWERED under the effective policy (block on the human). */
 export function blockingTrustSpecs(agent, autotrust) {
     return trustPromptAllowlist.filter(
-    // An `answerPolicy: "always"` prompt (hook trust) is auto-handled, so it must
-    // NOT be classified as human-blocking. Others block only when autotrust is off.
+    // Static human rules omit automation-owned prompts. The coordinator separately
+    // exposes recoverable human blocking when an owned trust episode expires.
     (spec) => spec.agent === agent && spec.answerPolicy !== "always" && !autotrust);
 }
 //# sourceMappingURL=prompts.js.map

package/dist/core/trust/prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAmEtD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,IAAqB;IACtE,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,IAAqB;IAC3E,OAAO,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAiBD,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,SAAkB;IAElB,OAAO,oBAAoB,CAAC,MAAM;IAChC,8EAA8E;IAC9E,gFAAgF;IAChF,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,SAAS,CAC/E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../../src/core/trust/prompts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAuDtD,wFAAwF;AACxF,MAAM,UAAU,wBAAwB,CACtC,MAA+B,EAC/B,IAAqB;IAErB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,CACL,MAAM,KAAK,IAAI;QACf,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAiBD,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAChC,KAAsB,EACtB,SAAkB;IAElB,OAAO,oBAAoB,CAAC,MAAM;IAChC,+EAA+E;IAC/E,0EAA0E;IAC1E,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,SAAS,CAC/E,CAAC;AACJ,CAAC"}

package/dist/core/trust/responder.d.ts

@@ -1,50 +1,32 @@
-/**
- * Detects and answers the allowlisted family of adapter startup trust prompts.
- * Implements PRD §5.1 and §9.1 (C-CLAUDE-10, C-CODEX-11, C-CLAUDE-14, C-CODEX-15).
- *
- * Policy (PRD §5.1): an agent must NEVER be left waiting on a trust gate.
- * Under the caller's full-trust posture, when an allowlisted trust prompt is
- * visible in the current frame, Elwood selects its affirmative option and sends
- * it — always say yes. Elwood only auto-answers ALLOWLISTED prompts (an
- * off-allowlist confirmation is left to the human), and never re-answers the same
- * prompt; those are the only limits.
- */
+/** Owns trust episodes, bounded attempts, and recoverable blocking (PRD §5.4/C-TRUST-01). */
 import type { ElwoodAgentKind } from "../activity/index.ts";
-import { type TrustPromptIdFor } from "./prompts.ts";
-/** An answered trust prompt; `prompt` is narrowed to the responder's agent. */
-export type TrustPromptAutomation<A extends ElwoodAgentKind = ElwoodAgentKind> = {
-    readonly prompt: TrustPromptIdFor<A>;
-    readonly input: string;
-};
-/**
- * The completion of an answered trust write: a `void | Promise<void>` write is
- * normalized to a promise that resolves on success and rejects once the prompt
- * has been un-settled (kept retryable) on a rejected write.
- */
-export type TrustWriteResult = void | Promise<void>;
-/**
- * The outcome of handling a frame: an answered prompt, a recognized prompt whose
- * affirmative option has not rendered yet (a TRANSIENT render delay — under the
- * say-yes policy a later frame carrying the option is still answered, so this is
- * never a terminal wedge), or nothing.
- */
-export type TrustPromptResult<A extends ElwoodAgentKind = ElwoodAgentKind> = {
-    readonly kind: "answered";
-    readonly automation: TrustPromptAutomation<A>;
-    readonly settled: Promise<void>;
-} | {
-    readonly kind: "option_pending";
-    readonly prompt: TrustPromptIdFor<A>;
-} | undefined;
+import type { TrustClearance } from "./clearance.ts";
+import type { TrustPromptIdFor } from "./prompts.ts";
+import type { TrustPromptResult, TrustWriteResult } from "./types.ts";
+export type { TrustPromptAutomation, TrustPromptResult, TrustWriteResult } from "./types.ts";
+export { trustPromptVisible } from "./view.ts";
 export declare class TrustPromptResponder<A extends ElwoodAgentKind> {
+    private episode;
+    private humanPrompt;
+    private timer;
+    private readonly attempts;
+    private disposed;
+    private readonly agent;
     private readonly autotrust;
-    private readonly specs;
-    private readonly settled;
-    private readonly reportedPending;
-    constructor(agent: A, autotrust?: boolean);
-    /** `frame` MUST be the CURRENT rendered screen, not an accumulated buffer. */
-    handle(frame: string, write: (input: string) => TrustWriteResult, readFrame?: () => string): TrustPromptResult<A>;
+    private readonly onStateChange;
+    /** The ADAPTER's clearance grammar; the coordinator never encodes a CLI's layout. */
+    private readonly clearance;
+    constructor(agent: A, clearance: TrustClearance, autotrust?: boolean, onStateChange?: () => void);
+    get inputBlocking(): boolean;
+    get blockedPrompt(): TrustPromptIdFor<A> | undefined;
+    /** Read the latest settled frame; undefined during pending/synchronized/failed rendering
+     * holds input until the deadline. Omit the reader only for static/legacy numbered writes. */
+    handle(frame: string, write: (input: string) => TrustWriteResult, readFrame?: () => string | undefined): TrustPromptResult<A>;
+    /** Session closing owns all cancellation, including writes whose promises settle late. */
+    dispose(): void;
+    private observe;
+    private arm;
+    private release;
+    private notify;
 }
-/** Whether any allowlisted trust prompt for `agent` is showing its header in `text`. */
-export declare function trustPromptVisible(text: string, agent: ElwoodAgentKind): boolean;
 //# sourceMappingURL=responder.d.ts.map