@wrongstack/cli 1.0.6 → 1.0.7

package/dist/{acp-GOQURNC2.js → acp-A5EQEXQO.js}

@@ -5,6 +5,9 @@ import {
   refreshAcpRegistry,
   setupProvider
 } from "./chunk-KEPABQYT.js";
+import {
+  createHqCommandDispatcher
+} from "./chunk-JY52HWL6.js";
 import {
   startCliHqConnection
 } from "./chunk-TE3Q32JP.js";
@@ -36,18 +39,50 @@ import { WebSocketServer } from "ws";
 
 // src/acp-hq-telemetry.ts
 import { AgentStatusTracker } from "@wrongstack/core/coordination";
-import { startSessionTelemetryBridge } from "@wrongstack/core/hq";
+import {
+  createApprovalRegistry,
+  startApprovalTelemetryBridge,
+  startSessionTelemetryBridge
+} from "@wrongstack/core/hq";
 var NO_REGISTRY = { updateAgents: async () => void 0 };
 function startAcpHqTelemetry(options) {
+  const entries = /* @__PURE__ */ new Map();
+  let stopped = false;
+  const resolveApproval = (toolUseId, decision, sessionId) => {
+    if (sessionId !== void 0) {
+      return entries.get(sessionId)?.approvals?.resolve(toolUseId, decision, sessionId) ?? false;
+    }
+    for (const entry of entries.values()) {
+      if (entry.approvals?.resolve(toolUseId, decision) === true) return true;
+    }
+    return false;
+  };
   const connection = startCliHqConnection({
     clientKind: "acp",
     projectRoot: options.projectRoot,
     ...options.projectName !== void 0 ? { projectName: options.projectName } : {},
     ...options.appConfig !== void 0 ? { appConfig: options.appConfig } : {},
-    capabilities: ["telemetry.publish", "mailbox.summary", "fleet.summary", "session.summary"]
+    capabilities: [
+      "telemetry.publish",
+      "mailbox.summary",
+      "fleet.summary",
+      "session.summary",
+      // Approvals are the ONLY control this host accepts. `control.receive` is
+      // the server's gate for any command at all, so it has to be declared;
+      // everything except `approve` falls through the dispatcher and is
+      // refused, because an ACP session has no mailbox to steer and no leader
+      // to abort.
+      "control.receive",
+      "control.approve"
+    ],
+    onCommand: createHqCommandDispatcher({
+      interruptLeader: () => false,
+      sessionTag: () => "acp",
+      ownsSession: (sessionId) => entries.has(sessionId),
+      allowRunCommand: () => false,
+      resolveApproval
+    })
   });
-  const entries = /* @__PURE__ */ new Map();
-  let stopped = false;
   const attach = (sessionId, agent, cwd) => {
     if (stopped || entries.has(sessionId)) return;
     const publisher = connection.getPublisher();
@@ -73,7 +108,19 @@ function startAcpHqTelemetry(options) {
       tracker.stop();
       return;
     }
-    entries.set(sessionId, { tracker, stopBridge });
+    const entry = { tracker, stopBridge };
+    try {
+      const approvals = createApprovalRegistry(events);
+      entry.approvals = approvals;
+      entry.stopApprovalBridge = startApprovalTelemetryBridge({
+        registry: approvals,
+        publisher,
+        projectRoot: cwd,
+        sessionId
+      });
+    } catch {
+    }
+    entries.set(sessionId, entry);
   };
   const detach = (sessionId) => {
     const entry = entries.get(sessionId);
@@ -83,6 +130,14 @@ function startAcpHqTelemetry(options) {
       entry.stopBridge();
     } catch {
     }
+    try {
+      entry.stopApprovalBridge?.();
+    } catch {
+    }
+    try {
+      entry.approvals?.dispose();
+    } catch {
+    }
     try {
       entry.tracker.stop();
     } catch {
@@ -1102,4 +1157,4 @@ ${renderAcpBenchText(result)}
 export {
   acpCmd
 };
-//# sourceMappingURL=acp-GOQURNC2.js.map
+//# sourceMappingURL=acp-A5EQEXQO.js.map

package/dist/{auth-WBXXIQUO.js → auth-3K6EN5JP.js}

@@ -14,7 +14,7 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-5A5GCSJC.js";
+} from "./chunk-FSZ5QU3M.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
@@ -23,7 +23,7 @@ import "./chunk-B4JLSXZB.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
-import "./chunk-VUVOMXWP.js";
+import "./chunk-3VXYY5JC.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -619,4 +619,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-WBXXIQUO.js.map
+//# sourceMappingURL=auth-3K6EN5JP.js.map

package/dist/boot/container-wiring.d.ts

@@ -4,6 +4,7 @@ import type { Config, Logger, ModelsRegistry, Renderer } from '@wrongstack/core/
 import type { WstackPaths } from '@wrongstack/core/utils';
 import { createDefaultContainer } from '@wrongstack/runtime';
 import { makePromptDelegate } from '../permission-prompt.js';
+import { type ApprovalMirrorRef } from '../permission-prompt-mirror.js';
 interface WireContainerDeps {
     config: Config;
     wpaths: WstackPaths;
@@ -30,6 +31,7 @@ export declare function wireContainer(deps: WireContainerDeps): {
     pathResolver: InstanceType<typeof DefaultPathResolver>;
     events: EventBus;
     container: ReturnType<typeof createDefaultContainer>;
+    approvalMirror: ApprovalMirrorRef;
 };
 export {};
 //# sourceMappingURL=container-wiring.d.ts.map

package/dist/{chunk-VUVOMXWP.js → chunk-3VXYY5JC.js}

@@ -102,6 +102,13 @@ function modelDetails(models) {
         tools: model.tool_call,
         vision: model.modalities?.input?.includes("image"),
         reasoning: model.reasoning ?? model.reasoningConfig !== void 0,
+        // Documented effort vocabulary, mirroring the gate
+        // `getActiveModelReasoningEffortLevels` applies for the settings
+        // panel: `effortSupported === false` is a documented "no effort
+        // control", and the picker must not offer a strip for it. An absent
+        // field stays absent, which the strip reads as "undocumented →
+        // canonical set".
+        ...model.reasoningConfig?.effortSupported && model.reasoningConfig.effortLevels?.length ? { effortLevels: [...model.reasoningConfig.effortLevels] } : {},
         maxContext: model.limit?.context,
         maxOutput: model.limit?.output,
         inputCost: model.cost?.input,
@@ -120,4 +127,4 @@ export {
   hasApiKey,
   buildPickableProviders
 };
-//# sourceMappingURL=chunk-VUVOMXWP.js.map
+//# sourceMappingURL=chunk-3VXYY5JC.js.map

package/dist/{chunk-NR7BD73C.js → chunk-4OLAZIIN.js}

@@ -22,7 +22,7 @@ async function handleHelpVersionShortCircuit(argv) {
   }
   if (earlyFlags["help"] === true) {
     if (positional.length > 0) {
-      const { subcommandNames } = await import("./subcommands-DEYSYHIM.js");
+      const { subcommandNames } = await import("./subcommands-VFVUTYAV.js");
       if (subcommandNames.includes(positional[0])) {
         const first = positional[0];
         const deep = positional[1];
@@ -43,4 +43,4 @@ async function handleHelpVersionShortCircuit(argv) {
 export {
   handleHelpVersionShortCircuit
 };
-//# sourceMappingURL=chunk-NR7BD73C.js.map
+//# sourceMappingURL=chunk-4OLAZIIN.js.map

package/dist/{chunk-5A5GCSJC.js → chunk-FSZ5QU3M.js}

@@ -6,7 +6,7 @@ import {
   hasApiKey,
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-VUVOMXWP.js";
+} from "./chunk-3VXYY5JC.js";
 import {
   openBrowser
 } from "./chunk-DAKVBMD4.js";
@@ -1813,4 +1813,4 @@ export {
   addCustomProvider,
   addKeyForProvider
 };
-//# sourceMappingURL=chunk-5A5GCSJC.js.map
+//# sourceMappingURL=chunk-FSZ5QU3M.js.map

package/dist/{chunk-KNMIBKLV.js → chunk-JY52HWL6.js}

@@ -235,6 +235,52 @@ async function dispatch(controller, commandId, type, payload) {
       });
       return { commandId, status: "completed", message };
     }
+    case "approve": {
+      const resolveApproval = controller.resolveApproval;
+      if (resolveApproval === void 0) {
+        return {
+          commandId,
+          status: "rejected",
+          message: "this client does not mirror approvals"
+        };
+      }
+      const toolUseId = typeof payload["toolUseId"] === "string" ? payload["toolUseId"] : "";
+      const decision = payload["decision"];
+      if (toolUseId.length === 0 || decision !== "yes" && decision !== "no" && decision !== "always" && decision !== "deny") {
+        return { commandId, status: "rejected", message: "malformed approve command" };
+      }
+      const applied = resolveApproval(toolUseId, decision, sessionId);
+      if (!applied) {
+        return {
+          commandId,
+          status: "rejected",
+          // Says WHY, because "rejected" alone reads as a failure the operator
+          // should retry — and retrying a settled prompt does nothing.
+          message: `approval ${toolUseId} is no longer pending (already answered, aborted or timed out)`
+        };
+      }
+      return { commandId, status: "completed", message: `approval ${decision}` };
+    }
+    case "answer-input": {
+      const resolver = controller.resolveUserInput;
+      if (!resolver)
+        return {
+          commandId,
+          status: "rejected",
+          message: "this client does not mirror user input forms"
+        };
+      const requestId = typeof payload["requestId"] === "string" ? payload["requestId"] : "";
+      const response = payload["response"];
+      if (!requestId || !response || !Array.isArray(response.answers))
+        return { commandId, status: "rejected", message: "malformed answer-input command" };
+      if (!resolver(requestId, response, sessionId))
+        return {
+          commandId,
+          status: "rejected",
+          message: `user input ${requestId} is no longer pending`
+        };
+      return { commandId, status: "completed", message: "user input submitted" };
+    }
     case "run-command": {
       if (!controller.allowRunCommand()) {
         return {
@@ -274,4 +320,4 @@ export {
   createProjectKanbanAssignHandler,
   createHqCommandDispatcher
 };
-//# sourceMappingURL=chunk-KNMIBKLV.js.map
+//# sourceMappingURL=chunk-JY52HWL6.js.map

package/dist/{chunk-QDQPF4PB.js → chunk-RLCKKLJA.js}

@@ -1,9 +1,9 @@
 
 // src/subcommands/index.ts
 var loaders = {
-  acp: async () => (await import("./acp-GOQURNC2.js")).acpCmd,
+  acp: async () => (await import("./acp-A5EQEXQO.js")).acpCmd,
   init: async () => (await import("./init-DRMMFG2G.js")).initCmd,
-  auth: async () => (await import("./auth-WBXXIQUO.js")).authCmd,
+  auth: async () => (await import("./auth-3K6EN5JP.js")).authCmd,
   update: async () => (await import("./update-5DPB4YD4.js")).updateCmd,
   sessions: async () => (await import("./sessions-config-UL45XKX7.js")).sessionsCmd,
   config: async () => (await import("./sessions-config-UL45XKX7.js")).configCmd,
@@ -14,8 +14,8 @@ var loaders = {
   audit: async () => (await import("./audit-46YK5DSC.js")).auditCmd,
   tools: async () => (await import("./tools-skills-GH24UCBY.js")).toolsCmd,
   skills: async () => (await import("./tools-skills-GH24UCBY.js")).skillsCmd,
-  providers: async () => (await import("./providers-models-6MOGAOVK.js")).providersCmd,
-  models: async () => (await import("./providers-models-6MOGAOVK.js")).modelsCmd,
+  providers: async () => (await import("./providers-models-LFNZ5WI7.js")).providersCmd,
+  models: async () => (await import("./providers-models-LFNZ5WI7.js")).modelsCmd,
   mcp: async () => (await import("./mcp-FX7TKPTV.js")).mcpCmd,
   plugin: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
   plugins: async () => (await import("./plugin-usage-M6KET4OZ.js")).pluginCmd,
@@ -27,11 +27,11 @@ var loaders = {
   version: async () => (await import("./version-help-WXI42PZ3.js")).versionCmd,
   help: async () => (await import("./version-help-WXI42PZ3.js")).helpCmd,
   projects: async () => (await import("./projects-LMNAGGEU.js")).projectsCmd,
-  modeldiag: async () => (await import("./modeldiag-46CMWUNM.js")).modeldiagCmd,
+  modeldiag: async () => (await import("./modeldiag-CJSFHZ3J.js")).modeldiagCmd,
   quick: async () => (await import("./quick-CNB4Z3HS.js")).quickCmd,
   bench: async () => (await import("./bench-YBU6BVQP.js")).benchCmd,
   chronicle: async () => (await import("./chronicle-UTFETHP6.js")).chronicleCmd,
-  hq: async () => (await import("./hq-V4PHEETW.js")).hqCmd,
+  hq: async () => (await import("./hq-G5PCP325.js")).hqCmd,
   mailbox: async () => (await import("./mailbox-serve-X3CR6VFW.js")).mailboxServeCmd,
   permissions: async () => (await import("./permissions-CFDLXETM.js")).permissionsCmd,
   project: async () => (await import("./project-AOQI5XTK.js")).projectCmd,
@@ -51,4 +51,4 @@ export {
   subcommands,
   subcommandNames
 };
-//# sourceMappingURL=chunk-QDQPF4PB.js.map
+//# sourceMappingURL=chunk-RLCKKLJA.js.map

package/dist/{chunk-VPS2SJW4.js → chunk-RMQNCHGO.js}

@@ -27,7 +27,8 @@ import {
   writeOut
 } from "@wrongstack/core/utils";
 function makePromptDelegate(reader) {
-  return async (tool, input, suggestedPattern) => {
+  return async (tool, input, suggestedPattern, signal) => {
+    if (signal?.aborted) return "no";
     writeOut("\x07");
     writeOut(
       `
@@ -54,7 +55,8 @@ ${theme.warn("\u26A0 APPROVAL REQUIRED")} ${theme.primary("\u2502")} ${theme.bol
     const alwaysHint = noAlwaysReason ? "" : `  ${theme.bold("[a]")}lways allow (${sanitizeTerminalText2(suggestedPattern)})`;
     const answer = await reader.readKey(
       `${theme.bold("[y]")}es  ${theme.bold("[n]")}o${alwaysHint}  ${theme.bold("[d]")}eny: `,
-      options
+      options,
+      ...signal ? [{ signal }] : []
     );
     return answer;
   };
@@ -480,4 +482,4 @@ export {
   detectProjectFacts,
   renderAgentsTemplate
 };
-//# sourceMappingURL=chunk-VPS2SJW4.js.map
+//# sourceMappingURL=chunk-RMQNCHGO.js.map

package/dist/{chunk-PQZPHGGD.js → chunk-XIZZ2EXG.js}

@@ -2118,7 +2118,11 @@ async function authorizeHqCommand(input) {
     // bootstrap exchange, which is the same thing the dashboard does.
     actor: { kind: authMethod === "session" ? "user" : "remote-client", id: enqueuedBy },
     surface: "hq",
-    capability: command.type === "run-command" ? "hq.control.execute" : "hq.control.enqueue",
+    capability: command.type === "run-command" ? "hq.control.execute" : (
+      // Approvals get their own capability string so a policy can allow
+      // steering while still refusing remote approval of tool calls.
+      command.type === "approve" || command.type === "answer-input" ? "hq.control.approve" : "hq.control.enqueue"
+    ),
     subject,
     risk: command.type === "run-command" ? "critical" : "high",
     scope: { projectId: target.projectId },
@@ -2481,6 +2485,34 @@ async function handleApiCommand(req, res, url, mutableAuth, sessions, clients, b
     res.end(JSON.stringify({ error: "unrecognized or malformed command", type: body.type }));
     return;
   }
+  if ((validated.type === "approve" || validated.type === "answer-input") && isCookieAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.approve")) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "forbidden: browser session lacks control.approve capability"
+      })
+    );
+    return;
+  }
+  if ((validated.type === "approve" || validated.type === "answer-input") && isTokenAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.approve")) {
+    res.writeHead(403, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "forbidden: token lacks control.approve capability"
+      })
+    );
+    return;
+  }
+  if ((validated.type === "approve" || validated.type === "answer-input") && !target.capabilities.includes("control.approve")) {
+    res.writeHead(409, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({
+        error: "client does not mirror approvals",
+        clientId: body.clientId
+      })
+    );
+    return;
+  }
   if (validated.type === "run-command" && isCookieAuth(auth) && auth.capabilities !== void 0 && !auth.capabilities.includes("control.execute")) {
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
@@ -4899,4 +4931,4 @@ export {
   startHqServer,
   HqInsecureExposureError2 as HqInsecureExposureError
 };
-//# sourceMappingURL=chunk-PQZPHGGD.js.map
+//# sourceMappingURL=chunk-XIZZ2EXG.js.map

package/dist/{cli-context-BYKJDAFF.js → cli-context-TIAP6YQK.js}

@@ -5,7 +5,7 @@ import {
   makePromptDelegate,
   renderAgentsTemplate,
   renderDiff
-} from "./chunk-VPS2SJW4.js";
+} from "./chunk-RMQNCHGO.js";
 import {
   theme as theme2
 } from "./chunk-QD544J2B.js";
@@ -19,17 +19,17 @@ import {
 } from "./chunk-GPPRNAKW.js";
 import {
   subcommands
-} from "./chunk-QDQPF4PB.js";
+} from "./chunk-RLCKKLJA.js";
 import {
   renderDeepHelp,
   renderFocusedHelp
 } from "./chunk-JX6KL7OF.js";
 import {
   handleHelpVersionShortCircuit
-} from "./chunk-NR7BD73C.js";
+} from "./chunk-4OLAZIIN.js";
 import {
   DEFAULT_PORT
-} from "./chunk-PQZPHGGD.js";
+} from "./chunk-XIZZ2EXG.js";
 import "./chunk-HXJYHAR4.js";
 import {
   resolveHqPasswordInput
@@ -63,13 +63,13 @@ import {
   runPicker,
   saveToGlobalConfig,
   theme
-} from "./chunk-5A5GCSJC.js";
+} from "./chunk-FSZ5QU3M.js";
 import "./chunk-2VMJ3E5Z.js";
 import "./chunk-B4JLSXZB.js";
 import {
   isKeylessLocalProvider,
   visibleModelIds
-} from "./chunk-VUVOMXWP.js";
+} from "./chunk-3VXYY5JC.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
@@ -125,11 +125,64 @@ function resolveBundledSkillsDir() {
   }
 }
 
+// src/permission-prompt-mirror.ts
+import { randomUUID } from "node:crypto";
+import { describeWriteTargets } from "@wrongstack/core/security";
+var REPL_MIRROR_TTL_MS = 6e4;
+var REPL_MIRROR_HEARTBEAT_MS = 2e4;
+function makeMirroredPromptDelegate(deps) {
+  const now = deps.now ?? Date.now;
+  return async (tool, input, suggestedPattern) => {
+    const registry = deps.getRegistry();
+    const controller = new AbortController();
+    if (registry === void 0) {
+      return deps.inner(tool, input, suggestedPattern, controller.signal);
+    }
+    const toolUseId = `repl:${randomUUID()}`;
+    let settled = false;
+    let remoteDecision;
+    const finish = registry.register({
+      toolUseId,
+      toolName: tool.name,
+      sessionId: deps.getSessionId?.(),
+      deadlineAt: now() + REPL_MIRROR_TTL_MS,
+      input,
+      suggestedPattern,
+      ...tool.riskTier ? { riskTier: tool.riskTier } : {},
+      decisionSource: "default",
+      writeTargets: describeWriteTargets(tool, input),
+      destructive: tool.riskTier === "destructive",
+      resolve: (decision) => {
+        if (settled) return;
+        settled = true;
+        remoteDecision = decision;
+        controller.abort();
+      }
+    });
+    const heartbeat = setInterval(() => {
+      registry.renew(toolUseId, now() + REPL_MIRROR_TTL_MS);
+    }, REPL_MIRROR_HEARTBEAT_MS);
+    heartbeat.unref?.();
+    try {
+      const typed = await deps.inner(tool, input, suggestedPattern, controller.signal);
+      if (remoteDecision !== void 0) return remoteDecision;
+      settled = true;
+      const decision = typed === "yes" || typed === "always" || typed === "deny" ? typed : "no";
+      finish(decision);
+      return decision;
+    } finally {
+      clearInterval(heartbeat);
+      finish("no");
+    }
+  };
+}
+
 // src/boot/container-wiring.ts
 function wireContainer(deps) {
   const pathResolver = new DefaultPathResolver(deps.cwd);
   const events = new CoreEventBus();
   events.setLogger(deps.logger);
+  const approvalMirror = { current: void 0 };
   const container = createDefaultContainer({
     config: deps.config,
     wpaths: deps.wpaths,
@@ -138,7 +191,15 @@ function wireContainer(deps) {
     events,
     permission: {
       yolo: deps.config.yolo,
-      promptDelegate: makePromptDelegate(deps.reader)
+      // Wrapped so the REPL's terminal prompt also appears on the HQ
+      // dashboard and can be answered from there. The wrapper is a no-op
+      // until `approvalMirror.current` is populated (HQ telemetry boot), and
+      // the terminal prompt itself behaves exactly as it always has.
+      promptDelegate: makeMirroredPromptDelegate({
+        inner: makePromptDelegate(deps.reader),
+        getRegistry: () => approvalMirror.current,
+        getSessionId: () => approvalMirror.sessionId?.()
+      })
     },
     compactor: {
       preserveK: deps.config.context.preserveK,
@@ -150,7 +211,7 @@ function wireContainer(deps) {
   container.bind(TOKENS.PathResolver, () => pathResolver);
   container.bind(TOKENS.Renderer, () => deps.renderer);
   container.bind(TOKENS.InputReader, () => deps.reader);
-  return { pathResolver, events, container };
+  return { pathResolver, events, container, approvalMirror };
 }
 
 // src/boot/launch-menu.ts
@@ -805,7 +866,7 @@ async function isPortInUse(host, port) {
 }
 async function handleHqShortCircuit(flags) {
   if (flags["hq"] !== true) return null;
-  const { startHqServer } = await import("./hq-server-MZ7DV6X7.js");
+  const { startHqServer } = await import("./hq-server-G3VVVMIG.js");
   const tunnelRequested = flags["tunnel"] === true;
   const rawPublicUrl = typeof flags["hq-public-url"] === "string" ? flags["hq-public-url"] : process.env.WRONGSTACK_HQ_PUBLIC_URL;
   let publicOrigin;
@@ -1827,8 +1888,10 @@ var ReadlineInputReader = class {
       }
     });
   }
-  async readKey(prompt, options) {
+  async readKey(prompt, options, opts = {}) {
     setOutputLineGuard(null);
+    const signal = opts.signal;
+    if (signal?.aborted) return "";
     writeOut(prompt);
     return new Promise((resolve2) => {
       const stdin = process.stdin;
@@ -1858,14 +1921,21 @@ var ReadlineInputReader = class {
         cleanup();
         resolve2("");
       };
+      const onAbort = () => {
+        cleanup();
+        writeOut("\n");
+        resolve2("");
+      };
       const cleanup = () => {
         stdin.off("data", onData);
         stdin.off("close", onClose);
+        signal?.removeEventListener("abort", onAbort);
         setRawMode2(stdin, wasRaw);
         if (wasPaused) stdin.pause();
       };
       stdin.on("data", onData);
       stdin.on("close", onClose);
+      signal?.addEventListener("abort", onAbort, { once: true });
     });
   }
   /**
@@ -3210,7 +3280,7 @@ async function initializeCli(argv) {
     }).catch(() => {
     });
   });
-  const { events, container } = wireContainer({
+  const { events, container, approvalMirror } = wireContainer({
     config,
     wpaths,
     cwd,
@@ -3225,6 +3295,7 @@ async function initializeCli(argv) {
     updateInfo: refreshedUpdateInfo,
     events,
     container,
+    approvalMirror,
     configStore,
     webuiSessionChild
   };
@@ -3232,4 +3303,4 @@ async function initializeCli(argv) {
 export {
   initializeCli
 };
-//# sourceMappingURL=cli-context-BYKJDAFF.js.map
+//# sourceMappingURL=cli-context-TIAP6YQK.js.map

package/dist/cli-context.d.ts

@@ -22,6 +22,8 @@ import type { BootContext } from './boot.js';
 export interface CliContext extends BootContext {
     events: EventBus;
     container: ReturnType<typeof wireContainer>['container'];
+    /** Late-bound handle the REPL prompt uses to mirror approvals to HQ. */
+    approvalMirror: ReturnType<typeof wireContainer>['approvalMirror'];
     configStore: ConfigStore;
     webuiSessionChild?: WebuiSessionChildOptions | undefined;
 }