@wrongstack/core 0.3.4 → 0.3.7

package/dist/extension/index.d.ts

@@ -1,9 +1,9 @@
-export { A as AfterIterationHook, p as AfterRunHook, q as AfterToolExecutionHook, s as AgentExtension, B as BeforeIterationHook, w as BeforeRunHook, x as BeforeToolExecutionHook, E as ExtensionRegistry, O as OnErrorHook, G as ProviderRunnerFn, z as ProviderRunnerWrapper } from '../index-DedY4Euf.js';
-import '../context-IovtuTf8.js';
+export { A as AfterIterationHook, p as AfterRunHook, q as AfterToolExecutionHook, s as AgentExtension, B as BeforeIterationHook, w as BeforeRunHook, x as BeforeToolExecutionHook, E as ExtensionRegistry, O as OnErrorHook, G as ProviderRunnerFn, z as ProviderRunnerWrapper } from '../index-meJRuQtc.js';
+import '../context-B1kBj1lY.js';
 import '../logger-BMQgxvdy.js';
-import '../system-prompt-Dk1qm8ey.js';
+import '../system-prompt-DNetCecu.js';
 import '../observability-BhnVLBLS.js';
-import '../events-BHIQs4o1.js';
-import '../secret-scrubber-CgG2tV2B.js';
-import '../config-DgE3JslD.js';
+import '../events-BBaKeMfb.js';
+import '../secret-scrubber-DyUAWS09.js';
+import '../config-RlhKLjme.js';
 import '../models-registry-Y2xbog0E.js';

package/dist/{index-DedY4Euf.d.ts → index-meJRuQtc.d.ts}

@@ -1,10 +1,10 @@
-import { u as Tool, z as ToolResultBlock, T as TextBlock, a0 as Context, R as Request, j as Response, D as ToolUseBlock, g as Provider, W as WrongStackError, b as ContentBlock, a7 as RunOptions, J as JSONSchema } from './context-IovtuTf8.js';
+import { u as Tool, z as ToolResultBlock, T as TextBlock, a0 as Context, R as Request, j as Response, D as ToolUseBlock, g as Provider, W as WrongStackError, b as ContentBlock, a7 as RunOptions, J as JSONSchema } from './context-B1kBj1lY.js';
 import { L as Logger } from './logger-BMQgxvdy.js';
-import { R as Renderer, B as BuildContext, C as Container, P as Pipeline, e as ReadonlyPipeline } from './system-prompt-Dk1qm8ey.js';
+import { R as Renderer, B as BuildContext, C as Container, P as Pipeline, e as ReadonlyPipeline } from './system-prompt-DNetCecu.js';
 import { T as Tracer } from './observability-BhnVLBLS.js';
-import { E as EventBus, a as EventName, L as Listener } from './events-BHIQs4o1.js';
-import { a as PermissionPolicy, S as SecretScrubber } from './secret-scrubber-CgG2tV2B.js';
-import { l as ProviderConfig, a as Config } from './config-DgE3JslD.js';
+import { E as EventBus, a as EventName, L as Listener } from './events-BBaKeMfb.js';
+import { a as PermissionPolicy, S as SecretScrubber } from './secret-scrubber-DyUAWS09.js';
+import { l as ProviderConfig, a as Config } from './config-RlhKLjme.js';
 import { W as WireFamily } from './models-registry-Y2xbog0E.js';
 
 /**
@@ -516,8 +516,23 @@ declare class Agent {
     private get permission();
     private get scrubber();
     private get renderer();
+    /**
+     * Switch from inline CLI prompts to event-driven confirmation.
+     * Clears both the ToolExecutor's confirmAwaiter (so it returns
+     * `ToolConfirmPendingResult`) and the permission policy's
+     * promptDelegate (so `evaluate()` returns `confirm`).
+     *
+     * Call this before entering TUI or any mode where stdin is owned
+     * by a UI framework (Ink, WebUI WS bridge). Without this, the
+     * inline prompt writes to stdout and blocks on stdin — both of
+     * which are owned by the framework — making the prompt invisible
+     * and the input deadlocked.
+     */
+    disableInteractiveConfirmation(): void;
     register(tool: Tool): void;
     use(plugin: Plugin, api: PluginAPI): Promise<void>;
+    /** Tear down all plugins in reverse order, calling their teardown hooks. */
+    teardown(): Promise<void>;
     run(userInput: AgentInput, opts?: RunOptions): Promise<RunResult>;
     private runInner;
     /**

package/dist/index.d.ts

@@ -1,33 +1,33 @@
-import { S as SystemPromptBuilder, M as ModelCapabilities, B as BuildContext, C as Container } from './system-prompt-Dk1qm8ey.js';
-export { a as BindOptions, D as Decorator, F as Factory, b as Middleware, c as MiddlewareHandler, N as NextFn, P as Pipeline, d as PipelineOptions, R as Renderer, T as Token } from './system-prompt-Dk1qm8ey.js';
-import { E as EventBus, a as EventName, L as Listener } from './events-BHIQs4o1.js';
-export { b as EventLogger, c as EventMap } from './events-BHIQs4o1.js';
+import { S as SystemPromptBuilder, M as ModelCapabilities, B as BuildContext, C as Container } from './system-prompt-DNetCecu.js';
+export { a as BindOptions, D as Decorator, F as Factory, b as Middleware, c as MiddlewareHandler, N as NextFn, P as Pipeline, d as PipelineOptions, R as Renderer, T as Token } from './system-prompt-DNetCecu.js';
+import { E as EventBus, a as EventName, L as Listener } from './events-BBaKeMfb.js';
+export { b as EventLogger, c as EventMap } from './events-BBaKeMfb.js';
 export { RunController, RunControllerOptions, TOKENS } from './kernel/index.js';
-import { b as ContentBlock, T as TextBlock, a0 as Context } from './context-IovtuTf8.js';
-export { A as AgentError, C as Capabilities, a as ConfigError, a3 as ContextInit, a4 as ConversationState, E as ErrorCode, c as ErrorSeverity, d as ErrorSubsystem, I as ImageBlock, J as JSONSchema, M as Message, e as MessageRole, P as Permission, f as PluginError, g as Provider, h as ProviderError, i as ProviderErrorBody, a5 as ReadonlyConversationState, R as Request, j as Response, k as ResumedSession, a6 as RunEnv, a7 as RunOptions, S as SessionData, l as SessionError, m as SessionEvent, n as SessionMetadata, o as SessionStore, p as SessionSummary, q as SessionWriter, a8 as StateChange, a9 as StateChangeHandler, r as StopReason, s as StreamEvent, t as ThinkingBlock, aa as TodoItem, a1 as TokenCounter, u as Tool, v as ToolCallContext, w as ToolError, x as ToolFinalEvent, y as ToolProgressEvent, z as ToolResultBlock, B as ToolStreamEvent, D as ToolUseBlock, U as Usage, W as WrongStackError, F as asBlocks, G as asText, ab as extractRunEnv, H as isAgentError, K as isConfigError, L as isImageBlock, N as isPluginError, O as isSessionError, Q as isTextBlock, V as isThinkingBlock, X as isToolError, Y as isToolResultBlock, Z as isToolUseBlock, _ as isWrongStackError, $ as toWrongStackError, ac as wrapAsState } from './context-IovtuTf8.js';
-export { P as ProviderRunner, R as RunProviderOptions } from './provider-runner-B39miKRw.js';
-import { a as Config } from './config-DgE3JslD.js';
-export { C as CONTEXT_WINDOW_MODES, b as ConfigLoader, c as ConfigStore, d as ContextConfig, e as ContextWindowAggressiveOn, f as ContextWindowConfigLike, g as ContextWindowMode, h as ContextWindowModeId, i as ContextWindowPolicy, j as ContextWindowThresholds, D as DEFAULT_CONTEXT_WINDOW_MODE_ID, F as FeaturesConfig, L as LogConfig, M as MCPServerConfig, P as PluginConfig, k as ProviderApiKey, l as ProviderConfig, T as ToolsConfig, m as formatContextWindowModeList, n as getContextWindowMode, o as isContextWindowModeId, p as listContextWindowModes, r as resolveContextWindowPolicy } from './config-DgE3JslD.js';
-export { C as CompactReport, a as Compactor } from './compactor-DpJBI1YH.js';
-export { P as PermissionDecision, a as PermissionPolicy, T as TrustPolicy } from './secret-scrubber-CgG2tV2B.js';
-import { e as AttachmentStore, d as AttachmentRef, A as AddAttachmentInput } from './session-reader-CcPi4BQ8.js';
-export { a as Attachment, b as AttachmentKind, c as AttachmentMeta, D as DefaultSessionReader } from './session-reader-CcPi4BQ8.js';
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from './secret-scrubber-Cuy5afaQ.js';
+import { b as ContentBlock, T as TextBlock, a0 as Context } from './context-B1kBj1lY.js';
+export { A as AgentError, C as Capabilities, a as ConfigError, a3 as ContextInit, a4 as ConversationState, E as ErrorCode, c as ErrorSeverity, d as ErrorSubsystem, I as ImageBlock, J as JSONSchema, M as Message, e as MessageRole, P as Permission, f as PluginError, g as Provider, h as ProviderError, i as ProviderErrorBody, a5 as ReadonlyConversationState, R as Request, j as Response, k as ResumedSession, a6 as RunEnv, a7 as RunOptions, S as SessionData, l as SessionError, m as SessionEvent, n as SessionMetadata, o as SessionStore, p as SessionSummary, q as SessionWriter, a8 as StateChange, a9 as StateChangeHandler, r as StopReason, s as StreamEvent, t as ThinkingBlock, aa as TodoItem, a1 as TokenCounter, u as Tool, v as ToolCallContext, w as ToolError, x as ToolFinalEvent, y as ToolProgressEvent, z as ToolResultBlock, B as ToolStreamEvent, D as ToolUseBlock, U as Usage, W as WrongStackError, F as asBlocks, G as asText, ab as extractRunEnv, H as isAgentError, K as isConfigError, L as isImageBlock, N as isPluginError, O as isSessionError, Q as isTextBlock, V as isThinkingBlock, X as isToolError, Y as isToolResultBlock, Z as isToolUseBlock, _ as isWrongStackError, $ as toWrongStackError, ac as wrapAsState } from './context-B1kBj1lY.js';
+export { P as ProviderRunner, R as RunProviderOptions } from './provider-runner-CU9gnU2E.js';
+import { a as Config } from './config-RlhKLjme.js';
+export { C as CONTEXT_WINDOW_MODES, b as ConfigLoader, c as ConfigStore, d as ContextConfig, e as ContextWindowAggressiveOn, f as ContextWindowConfigLike, g as ContextWindowMode, h as ContextWindowModeId, i as ContextWindowPolicy, j as ContextWindowThresholds, D as DEFAULT_CONTEXT_WINDOW_MODE_ID, F as FeaturesConfig, L as LogConfig, M as MCPServerConfig, P as PluginConfig, k as ProviderApiKey, l as ProviderConfig, T as ToolsConfig, m as formatContextWindowModeList, n as getContextWindowMode, o as isContextWindowModeId, p as listContextWindowModes, r as resolveContextWindowPolicy } from './config-RlhKLjme.js';
+export { C as CompactReport, a as Compactor } from './compactor-CFky6JKM.js';
+export { P as PermissionDecision, a as PermissionPolicy, T as TrustPolicy } from './secret-scrubber-DyUAWS09.js';
+import { e as AttachmentStore, d as AttachmentRef, A as AddAttachmentInput } from './session-reader-D-z0AgHs.js';
+export { a as Attachment, b as AttachmentKind, c as AttachmentMeta, D as DefaultSessionReader } from './session-reader-D-z0AgHs.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from './secret-scrubber-Dyh5LVYL.js';
 export { D as DefaultLogger, a as DefaultLoggerOptions } from './logger-BH6AE0W9.js';
-export { D as DefaultPathResolver, a as DefaultTokenCounter } from './path-resolver--59rCou3.js';
+export { D as DefaultPathResolver, a as DefaultTokenCounter } from './path-resolver-Bg4OP5fi.js';
 import { b as MemoryStore } from './memory-CEXuo7sz.js';
 export { M as MemoryEntry, a as MemoryScope } from './memory-CEXuo7sz.js';
-export { C as CompactorOptions, D as DEFAULT_RECOVERY_STRATEGIES, a as DefaultErrorHandler, b as DefaultRetryPolicy, H as HybridCompactor, R as RecoveryStrategy, T as ToolExecutor, c as buildRecoveryStrategies } from './tool-executor-DY0iSXYf.js';
-import { a as SkillLoader } from './skill-C_7znCIC.js';
-export { S as SkillEntry, b as SkillManifest } from './skill-C_7znCIC.js';
+export { C as CompactorOptions, D as DEFAULT_RECOVERY_STRATEGIES, a as DefaultErrorHandler, b as DefaultRetryPolicy, H as HybridCompactor, R as RecoveryStrategy, T as ToolExecutor, c as buildRecoveryStrategies } from './tool-executor-B5bgmEgE.js';
+import { a as SkillLoader } from './skill-DayhFUBb.js';
+export { S as SkillEntry, b as SkillManifest } from './skill-DayhFUBb.js';
 export { I as InputReader, P as PromptOption } from './input-reader-E-ffP2ee.js';
-import { j as SystemPromptContributor, h as SlashCommand, b as PluginAPI, e as PluginPipelines, T as ToolRegistryView, g as ProviderRegistryView, M as MCPRegistryView, i as SlashCommandRegistryView, E as ExtensionRegistry, S as SessionWriterView, a as MetricsSinkView, n as ToolRegistry, o as ProviderRegistry, P as Plugin } from './index-DedY4Euf.js';
-export { A as AfterIterationHook, p as AfterRunHook, q as AfterToolExecutionHook, r as Agent, s as AgentExtension, t as AgentInit, u as AgentInput, v as AgentPipelines, B as BeforeIterationHook, w as BeforeRunHook, x as BeforeToolExecutionHook, D as DEFAULT_MAX_ITERATIONS, O as OnErrorHook, c as PluginCapabilities, d as PluginDependency, y as ProviderFactory, z as ProviderRunnerWrapper, R as RunResult, C as ToolWrapper, U as UserInputPayload, F as createDefaultPipelines } from './index-DedY4Euf.js';
+import { j as SystemPromptContributor, h as SlashCommand, b as PluginAPI, e as PluginPipelines, T as ToolRegistryView, g as ProviderRegistryView, M as MCPRegistryView, i as SlashCommandRegistryView, E as ExtensionRegistry, S as SessionWriterView, a as MetricsSinkView, n as ToolRegistry, o as ProviderRegistry, P as Plugin } from './index-meJRuQtc.js';
+export { A as AfterIterationHook, p as AfterRunHook, q as AfterToolExecutionHook, r as Agent, s as AgentExtension, t as AgentInit, u as AgentInput, v as AgentPipelines, B as BeforeIterationHook, w as BeforeRunHook, x as BeforeToolExecutionHook, D as DEFAULT_MAX_ITERATIONS, O as OnErrorHook, c as PluginCapabilities, d as PluginDependency, y as ProviderFactory, z as ProviderRunnerWrapper, R as RunResult, C as ToolWrapper, U as UserInputPayload, F as createDefaultPipelines } from './index-meJRuQtc.js';
 export { D as DefaultModelsRegistry, a as DefaultModelsRegistryOptions, c as classifyFamily } from './models-registry-DqzwpBQy.js';
 import { c as ModeStore } from './mode-CV077NjV.js';
 export { D as DEFAULT_MODES, M as Mode, a as ModeConfig, b as ModeManifest } from './mode-CV077NjV.js';
-export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from './agent-bridge-C3DUGjSb.js';
-export { n as BudgetExceededError, o as BudgetKind, p as BudgetLimits, q as BudgetUsage, C as CoordinatorEvents, a as CoordinatorStatus, D as DoneCondition, M as MultiAgentConfig, b as MultiAgentCoordinator, S as SpawnResult, r as SubagentBudget, c as SubagentConfig, d as SubagentContext, e as SubagentError, f as SubagentErrorKind, g as SubagentRunContext, h as SubagentRunOutcome, i as SubagentRunner, T as TaskDelegation, j as TaskResult, k as TaskSpec } from './multi-agent-B9a6sflH.js';
+export { I as InMemoryAgentBridge, a as InMemoryBridgeTransport, c as createMessage } from './agent-bridge-DaOnnHNW.js';
+export { n as BudgetExceededError, o as BudgetKind, p as BudgetLimits, q as BudgetUsage, C as CoordinatorEvents, a as CoordinatorStatus, D as DoneCondition, M as MultiAgentConfig, b as MultiAgentCoordinator, S as SpawnResult, r as SubagentBudget, c as SubagentConfig, d as SubagentContext, e as SubagentError, f as SubagentErrorKind, g as SubagentRunContext, h as SubagentRunOutcome, i as SubagentRunner, T as TaskDelegation, j as TaskResult, k as TaskSpec } from './multi-agent-D5m66hzB.js';
 export { C as CriticalPathResult, D as DEFAULT_SPEC_TEMPLATE, S as SpecAnalysis, a as SpecApiEndpoint, b as SpecRequirement, c as SpecSection, d as SpecSectionType, e as SpecStatus, f as SpecTemplate, g as SpecValidationResult, h as Specification, T as TaskAssignment, i as TaskDependency, j as TaskEdge, k as TaskFilter, l as TaskGraph, m as TaskNode, n as TaskPriority, o as TaskProgress, p as TaskSort, q as TaskStatus, r as TaskType, s as computeTaskProgress, t as findCriticalPath, u as topologicalSort } from './task-graph-BITvWt4t.js';
 export { A as AggregateHealth, H as HealthCheck, a as HealthCheckResult, b as HealthRegistry, c as HealthStatus, M as MetricLabels, d as MetricSeries, e as MetricsSink, f as MetricsSnapshot, S as Span, T as Tracer } from './observability-BhnVLBLS.js';
 export { AtomicWriteOptions, BuildChildEnvOptions, CompileFail, CompileResult, MessageRepairReport, MessageRepairResult, NewlineStyle, SafeParseResult, ToolOutputSerializerOptions, UnifiedDiffOptions, ValidationError, ValidationResult, atomicWrite, buildChildEnv, color, compileGlob, compileUserRegex, createToolOutputSerializer, detectNewlineStyle, ensureDir, estimateTextTokens, estimateToolInputTokens, estimateToolResultTokens, formatTodosList, matchAny, matchGlob, normalizeToLf, repairToolUseAdjacency, safeParse, safeStringify, sanitizeJsonString, stripAnsi, toStyle, unifiedDiff, validateAgainstSchema } from './utils/index.js';
@@ -40,13 +40,13 @@ export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AgentFactory, AgentFactoryResult, Ag
 export { DefaultModeStore, LLMSelector, LLMSelectorOptions, ModeLoaderOptions, loadProjectModes, loadUserModes } from './models/index.js';
 export { DefaultTaskStore, GeneratedTask, SpecDrivenDev, SpecDrivenDevOptions, SpecParser, TaskFlow, TaskFlowEventMap, TaskFlowEventName, TaskFlowExecutionContext, TaskFlowOptions, TaskFlowPhase, TaskGenerator, TaskGeneratorOptions, TaskStore, TaskTracker, TaskTrackerOptions, TaskTransition } from './sdd/index.js';
 export { DefaultHealthRegistry, InMemoryMetricsSink, MetricsServerHandle, MetricsServerOptions, NoopMetricsSink, NoopTracer, OTelTracer, OtlpMetricsExporterHandle, OtlpMetricsExporterOptions, OtlpTraceExporterHandle, OtlpTraceExporterOptions, PROMETHEUS_CONTENT_TYPE, buildOtlpMetricsRequest, buildOtlpTracesRequest, renderPrometheus, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents } from './observability/index.js';
-export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, p as slackServer, z as zaiVisionServer } from './mcp-servers-zGiC1lQc.js';
+export { C as ContextManagerAction, a as ContextManagerInput, b as ContextManagerResult, c as ContextManagerToolOptions, d as allServers, e as awsServer, f as blockServer, g as braveSearchServer, h as context7Server, i as contextManagerTool, j as createContextManagerTool, k as everArtServer, l as filesystemServer, m as githubServer, n as googleMapsServer, o as miniMaxVisionServer, s as sentinelServer, p as slackServer, z as zaiVisionServer } from './mcp-servers-Cf4-bJnd.js';
 import { L as Logger } from './logger-BMQgxvdy.js';
 export { a as LogLevel } from './logger-BMQgxvdy.js';
 export { a as ModelsDevPayload, c as ModelsDevProvider, M as ModelsRegistry, b as ResolvedModel, R as ResolvedProvider, W as WireFamily } from './models-registry-Y2xbog0E.js';
 export { S as SecretVault } from './secret-vault-DoISxaKO.js';
 import './path-resolver-CPRj4bFY.js';
-import './selector-wT2fv9Fg.js';
+import './selector-DBEiwXBk.js';
 import 'node:events';
 
 interface InputBuilderOptions {
@@ -113,7 +113,7 @@ declare class InputBuilder {
     private shouldCollapse;
 }
 
-declare const LAYER_1_IDENTITY = "You are WrongStack, a command-line AI coding agent.\n\nYou operate inside the user's terminal with direct read and write access to their working directory, the ability to run shell commands, and access to the web. You assist a developer who knows what they're doing \u2014 your job is to accelerate them, not to second-guess them.\n\n## Core principles\n\n1. **Read before you write.** Always inspect the relevant files before proposing changes. Assumptions about code you haven't read are bugs in waiting.\n2. **Prefer surgical edits over rewrites.** When modifying existing files, use the edit tool with str_replace; only use write for new files or full replacements explicitly requested.\n3. **Show your work.** Before non-trivial changes, briefly state what you're about to do \u2014 one sentence, not a wall of text. After tool calls, summarize what happened, not what you did mechanically.\n4. **Be honest about limits.** If you don't know, say so. If something failed, say what failed and what you'll try next. Never fabricate file contents, API responses, or test results.\n5. **Be concise.** The user is a developer in a terminal. No marketing language, no \"great question!\", no bullet-point lists when prose works. If a one-liner answers, a one-liner is the answer.\n6. **Ask when blocked, proceed when not.** If the task is ambiguous in a way that meaningfully changes the approach, ask. If it's ambiguous in a way that doesn't, pick a reasonable default and proceed, stating the assumption.\n7. **Trust the tools.** If a permission prompt is shown, the user will answer. Do not preemptively explain that you \"would like to\" do something \u2014 call the tool, let the permission flow decide.\n8. **Format for scanability.** Use code blocks for code, backticks for file paths, bold for key terms. One-liners stay one line. Paragraphs max 3 sentences.\n9. **Recover explicitly.** When a tool fails, state: (1) what failed, (2) what you tried, (3) what you'll attempt next. Never silently skip.\n\n## Decision heuristics\n\n- **Task is ambiguous** (unclear which file, conflicting requirements) \u2192 ask before proceeding\n- **Task is clear, approach is unknown** \u2192 try one approach, report what happened\n- **Tool fails** \u2192 retry once with adjusted params, then report failure\n- **Permission prompt shown** \u2192 wait for user, do not act unilaterally\n- **Context window filling up** \u2192 use context_manager proactively; don't wait to be told\n\n## How you work\n\n- **Stay focused.** When fixing a bug, fix only the bug \u2014 don't refactor neighboring code unless the user asks.\n- **Comment with purpose.** Add comments only when they explain why, not what. The code already says what.\n- **Own your output.** Never call work \"production-ready\" or \"fully tested\" \u2014 the user makes that call.\n- **Move on from mistakes.** When something fails, report what happened and what you'll do next. No apologies, no hand-wringing.\n- **Stay in your lane.** Don't lecture about software engineering principles unless explicitly asked \u2014 the user is the expert on their codebase.";
+declare const LAYER_1_IDENTITY = "You are WrongStack, a command-line AI coding agent.\n\nYou operate inside the user's terminal with direct read and write access to their working directory, the ability to run shell commands, and access to the web. You assist a developer who knows what they're doing \u2014 your job is to accelerate them, not to second-guess them.\n\n## Core principles\n\n1. **Read before you write.** Always inspect the relevant files before proposing changes. Assumptions about code you haven't read are bugs in waiting.\n2. **Prefer surgical edits over rewrites.** When modifying existing files, use the edit tool with str_replace; only use write for new files or full replacements explicitly requested.\n3. **Show your work.** Before non-trivial changes, briefly state what you're about to do \u2014 one sentence, not a wall of text. After tool calls, summarize what happened, not what you did mechanically.\n4. **Be honest about limits.** If you don't know, say so. If something failed, say what failed and what you'll try next. Never fabricate file contents, API responses, or test results.\n5. **Be concise.** The user is a developer in a terminal. No marketing language, no \"great question!\", no bullet-point lists when prose works. If a one-liner answers, a one-liner is the answer.\n6. **Ask when blocked, proceed when not.** If the task is ambiguous in a way that meaningfully changes the approach, ask. If it's ambiguous in a way that doesn't, pick a reasonable default and proceed, stating the assumption.\n7. **Trust the tools.** If a permission prompt is shown, the user will answer. Do not preemptively explain that you \"would like to\" do something \u2014 call the tool, let the permission flow decide.\n8. **Format for scanability.** Use code blocks for code, backticks for file paths, bold for key terms. One-liners stay one line. Paragraphs max 3 sentences.\n9. **Recover explicitly.** When a tool fails, state: (1) what failed, (2) what you tried, (3) what you'll attempt next. Never silently skip.\n\n## Decision heuristics\n\n- **Task is ambiguous** (unclear which file, conflicting requirements) \u2192 ask before proceeding\n- **Task is clear, approach is unknown** \u2192 try one approach, report what happened\n- **Tool fails** \u2192 retry once with adjusted params, then report failure\n- **Permission prompt shown** \u2192 wait for user, do not act unilaterally\n- **Tool denied by user** \u2192 do NOT retry the same tool in the next iteration. If the user denies a write, bash, or any tool, respect that decision. The user's \"no\" is final \u2014 acknowledge it and ask if they'd like to clarify what they actually want.\n- **Context window filling up** \u2192 use context_manager proactively; don't wait to be told\n\n## How you work\n\n- **Stay focused.** When fixing a bug, fix only the bug \u2014 don't refactor neighboring code unless the user asks.\n- **Comment with purpose.** Add comments only when they explain why, not what. The code already says what.\n- **Own your output.** Never call work \"production-ready\" or \"fully tested\" \u2014 the user makes that call.\n- **Move on from mistakes.** When something fails, report what happened and what you'll do next. No apologies, no hand-wringing.\n- **Respect denied tools.** If the user denies a tool call (via permission prompt), do not retry that same operation in the next iteration. The user's \"no\" means \"find another way or ask\". Never re-attempt a denied tool unless the user explicitly asks you to try again.\n- **When denied, ask.** If the user refuses a tool call, do not attempt to work around it, do not suggest alternatives unprompted, and do not retry. Acknowledge the denial and explicitly ask: \"What would you like me to do instead?\"\n- **Stay in your lane.** Don't lecture about software engineering principles unless explicitly asked \u2014 the user is the expert on their codebase.";
 interface DefaultSystemPromptBuilderOptions {
     memoryStore?: MemoryStore;
     skillLoader?: SkillLoader;

package/dist/index.js

@@ -2242,6 +2242,13 @@ var InMemoryAgentBridge = class {
         this.pendingRequests.delete(correlationId);
         reject(new Error(`Request ${correlationId} timed out after ${timeout}ms`));
       }, timeout);
+      if (this.stopped) {
+        clearTimeout(timer);
+        this.inflightGuards.delete(correlationId);
+        this.pendingRequests.delete(correlationId);
+        reject(new Error("Bridge stopped"));
+        return;
+      }
       this.pendingRequests.set(correlationId, {
         resolve: resolve4,
         reject,
@@ -2445,6 +2452,15 @@ var ToolExecutor = class {
   opts;
   serializer;
   iterationTimeoutMs;
+  /**
+   * Clear the interactive confirm awaiter so the executor returns
+   * `ToolConfirmPendingResult` instead of blocking on stdin. Used by
+   * the CLI to switch from inline prompts (REPL) to event-driven
+   * confirmation (TUI) at runtime.
+   */
+  clearConfirmAwaiter() {
+    this.opts.confirmAwaiter = void 0;
+  }
   /**
    * Execute a batch of tool uses using the configured strategy.
    * Returns the execution results and the remaining output budget.
@@ -3887,6 +3903,7 @@ var QueueStore = class {
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return [];
+      console.warn(`[QueueStore] failed to read queue file "${this.file}":`, err instanceof Error ? err.message : String(err));
       return [];
     }
     let parsed;
@@ -3986,6 +4003,13 @@ var DefaultAttachmentStore = class {
     return mergeAdjacentText(blocks);
   }
   async clear() {
+    if (this.spoolDir) {
+      const toDelete = [];
+      for (const att of this.items.values()) {
+        if (att.path) toDelete.push(att.path);
+      }
+      await Promise.all(toDelete.map((p) => fsp2.unlink(p).catch(() => void 0)));
+    }
     this.items.clear();
     this.refs.length = 0;
     this.nextSeq = { text: 0, image: 0, file: 0 };
@@ -5001,6 +5025,10 @@ var DirectorStateCheckpoint = class {
       this.timer = null;
     }
     await this.persist();
+    if (this.rewriteRequested) {
+      this.rewriteRequested = false;
+      await this.persist();
+    }
   }
   bumpUpdatedAt() {
     this.snapshot = { ...this.snapshot, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
@@ -5041,12 +5069,49 @@ var DefaultPermissionPolicy = class {
   loaded = false;
   trustFile;
   yolo;
+  /**
+   * Session-scoped "soft deny" map. When the user presses 'n' (block once),
+   * the tool+pattern is added here. If the LLM retries in the same session,
+   * we return deny directly without asking again.
+   *
+   * Cleared on reload() since reload = fresh trust file snapshot.
+   */
+  sessionDenied = /* @__PURE__ */ new Map();
+  /**
+   * Session-scoped "soft trust" map. When the user presses 'a' (allow once),
+   * the tool+pattern is added here. If the LLM retries in the same session,
+   * we return auto directly without asking again.
+   *
+   * Cleared on reload().
+   */
+  sessionAllowed = /* @__PURE__ */ new Map();
+  /**
+   * Interactive prompt delegate. When set, `evaluate()` calls it to get a
+   * user decision synchronously (CLI REPL path). When cleared (TUI / WebUI),
+   * `evaluate()` returns `confirm` so the caller can emit
+   * `tool.confirm_needed` for the UI layer to handle.
+   *
+   * Mutable so the host can switch from CLI-prompt to event-driven
+   * confirmation at runtime (e.g. when `--goal` forces TUI mode after
+   * the agent was already constructed).
+   */
   promptDelegate;
+  /** Pre-compiled wildcard patterns — rebuilt on reload for O(1) lookup. */
+  wildcardEntries = [];
   constructor(opts) {
     this.trustFile = opts.trustFile;
     this.yolo = opts.yolo ?? false;
     this.promptDelegate = opts.promptDelegate;
   }
+  /**
+   * Replace (or clear) the interactive prompt delegate at runtime.
+   * Used by the CLI to switch from inline prompts (REPL) to event-driven
+   * confirmation (TUI) when the run mode is determined after the policy
+   * was constructed (e.g. `--goal` auto-flipping to TUI).
+   */
+  setPromptDelegate(delegate) {
+    this.promptDelegate = delegate;
+  }
   async reload() {
     try {
       const raw = await fsp2.readFile(this.trustFile, "utf8");
@@ -5055,13 +5120,26 @@ var DefaultPermissionPolicy = class {
     } catch {
       this.policy = {};
     }
+    this.wildcardEntries = [];
+    for (const [key, val] of Object.entries(this.policy)) {
+      if (key.includes("*")) this.wildcardEntries.push({ pattern: key, value: val });
+    }
+    this.sessionDenied.clear();
+    this.sessionAllowed.clear();
     this.loaded = true;
   }
-  async evaluate(tool, input, _ctx) {
+  async evaluate(tool, input, ctx) {
     if (!this.loaded) await this.reload();
     const namespaceEntry = this.findNamespaceEntry(tool.name);
     const entry = this.policy[tool.name] ?? namespaceEntry;
     const subject = this.subjectFor(tool.name, input, tool.subjectKey);
+    const subjectKey = `${tool.name}::${subject ?? tool.name}`;
+    if (this.sessionDenied.has(subjectKey)) {
+      return { permission: "deny", source: "deny", reason: "session soft deny (user pressed no)" };
+    }
+    if (this.sessionAllowed.has(subjectKey)) {
+      return { permission: "auto", source: "trust", reason: "session soft allow (user pressed yes)" };
+    }
     if (entry?.deny && subject && matchAny(entry.deny, subject)) {
       return { permission: "deny", source: "deny", reason: "matched deny pattern" };
     }
@@ -5077,6 +5155,11 @@ var DefaultPermissionPolicy = class {
     if (this.yolo) {
       return { permission: "auto", source: "yolo" };
     }
+    if (tool.name === "write" && subject) {
+      if (ctx.hasRead(subject)) {
+        return { permission: "auto", source: "context", reason: "file already read in this session" };
+      }
+    }
     if (tool.permission === "auto") {
       return { permission: "auto", source: "default" };
     }
@@ -5087,6 +5170,7 @@ var DefaultPermissionPolicy = class {
         return { permission: "auto", source: "user", reason: "user always-allowed" };
       }
       if (decision === "deny") {
+        await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
         return { permission: "deny", source: "user", reason: "user denied" };
       }
       return { permission: decision === "yes" ? "auto" : "deny", source: "user" };
@@ -5109,6 +5193,31 @@ var DefaultPermissionPolicy = class {
       throw err;
     }
   }
+  /** Persist a deny rule — this tool+pattern pair is permanently blocked. */
+  async deny(rule) {
+    if (!this.loaded) await this.reload();
+    const entry = this.policy[rule.tool] ?? {};
+    entry.deny = Array.from(/* @__PURE__ */ new Set([...entry.deny ?? [], rule.pattern]));
+    this.policy[rule.tool] = entry;
+    try {
+      await atomicWrite(this.trustFile, JSON.stringify(this.policy, null, 2));
+    } catch (err) {
+      const existing = this.policy[rule.tool];
+      if (existing?.deny) {
+        const idx = existing.deny.indexOf(rule.pattern);
+        if (idx !== -1) existing.deny.splice(idx, 1);
+      }
+      throw err;
+    }
+  }
+  /** Block this tool+pattern for the rest of this session (no trust file). */
+  denyOnce(rule) {
+    this.sessionDenied.set(`${rule.tool}::${rule.pattern}`, true);
+  }
+  /** Auto-approve this tool+pattern for the rest of this session (no trust file). */
+  allowOnce(rule) {
+    this.sessionAllowed.set(`${rule.tool}::${rule.pattern}`, true);
+  }
   subjectFor(toolName, input, subjectKey) {
     if (!input || typeof input !== "object") return void 0;
     const obj = input;
@@ -5136,10 +5245,8 @@ var DefaultPermissionPolicy = class {
     return void 0;
   }
   findNamespaceEntry(toolName) {
-    for (const key of Object.keys(this.policy)) {
-      if (key.includes("*") && matchGlob(key, toolName)) {
-        return this.policy[key];
-      }
+    for (const { pattern, value } of this.wildcardEntries) {
+      if (matchGlob(pattern, toolName)) return value;
     }
     return void 0;
   }
@@ -5153,6 +5260,12 @@ var AutoApprovePermissionPolicy = class {
   }
   async trust() {
   }
+  async deny() {
+  }
+  denyOnce() {
+  }
+  allowOnce() {
+  }
   async reload() {
   }
 };
@@ -7592,8 +7705,8 @@ var Director = class {
     if (this.spawnCount >= this.maxSpawns) {
       throw new DirectorBudgetError("max_spawns", this.maxSpawns, this.spawnCount + 1);
     }
-    this.spawnCount += 1;
     const result = await this.coordinator.spawn(config);
+    this.spawnCount += 1;
     this.subagentMeta.set(result.subagentId, {
       provider: config.provider,
       model: config.model
@@ -10699,12 +10812,14 @@ function requestLimitExtension(opts) {
   const { events, currentIterations, currentLimit, autoExtend, timeoutMs = 3e4 } = opts;
   return new Promise((resolve4) => {
     let resolved = false;
-    const timer = setTimeout(() => {
+    const timerFired = () => {
       if (!resolved) {
         resolved = true;
         resolve4(0);
       }
-    }, timeoutMs);
+    };
+    const timer = setTimeout(timerFired, timeoutMs);
+    timer.unref();
     const deny = () => {
       if (!resolved) {
         resolved = true;
@@ -10816,6 +10931,25 @@ var Agent = class {
   get renderer() {
     return this.container.has(TOKENS.Renderer) ? this.container.resolve(TOKENS.Renderer) : void 0;
   }
+  /**
+   * Switch from inline CLI prompts to event-driven confirmation.
+   * Clears both the ToolExecutor's confirmAwaiter (so it returns
+   * `ToolConfirmPendingResult`) and the permission policy's
+   * promptDelegate (so `evaluate()` returns `confirm`).
+   *
+   * Call this before entering TUI or any mode where stdin is owned
+   * by a UI framework (Ink, WebUI WS bridge). Without this, the
+   * inline prompt writes to stdout and blocks on stdin — both of
+   * which are owned by the framework — making the prompt invisible
+   * and the input deadlocked.
+   */
+  disableInteractiveConfirmation() {
+    this.toolExecutor.clearConfirmAwaiter();
+    const policy = this.permission;
+    if (typeof policy.setPromptDelegate === "function") {
+      policy.setPromptDelegate(void 0);
+    }
+  }
   register(tool) {
     this.tools.register(tool);
   }
@@ -10823,6 +10957,22 @@ var Agent = class {
     await plugin.setup(api);
     this.plugins.push({ plugin, api });
   }
+  /** Tear down all plugins in reverse order, calling their teardown hooks. */
+  async teardown() {
+    const errors = [];
+    for (const { plugin, api } of this.plugins.toReversed()) {
+      if (typeof plugin.teardown !== "function") continue;
+      try {
+        await plugin.teardown(api);
+      } catch (err) {
+        errors.push(err);
+      }
+    }
+    this.plugins.length = 0;
+    if (errors.length > 0) {
+      throw new Error(`Agent teardown failed: ${errors.map(String).join("; ")}`);
+    }
+  }
   async run(userInput, opts = {}) {
     const controller = new RunController({ parentSignal: opts.signal });
     const signal = controller.signal;
@@ -11090,11 +11240,52 @@ var Agent = class {
           toolUseId: result.toolUseId,
           suggestedPattern: result.suggestedPattern
         });
-        const reRunResult = await this.executeSingleWithDecision(
+        if (decision === "always") {
+          try {
+            await this.permission.trust({
+              tool: tool.name,
+              pattern: result.suggestedPattern
+            });
+            this.events.emit("trust.persisted", {
+              tool: tool.name,
+              pattern: result.suggestedPattern,
+              decision
+            });
+          } catch {
+          }
+        } else if (decision === "deny") {
+          try {
+            await this.permission.deny({
+              tool: tool.name,
+              pattern: result.suggestedPattern
+            });
+            this.events.emit("trust.persisted", {
+              tool: tool.name,
+              pattern: result.suggestedPattern,
+              decision
+            });
+          } catch {
+          }
+        }
+        if (decision === "yes") {
+          const p = this.permission;
+          p.allowOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
+        } else if (decision === "no") {
+          const p = this.permission;
+          p.denyOnce?.({ tool: tool.name, pattern: result.suggestedPattern });
+        }
+        const reRunResult = decision === "yes" || decision === "always" ? await this.executeSingleWithDecision(
           tool,
-          { id: result.toolUseId, name: tool.name, input: result.input },
-          decision
-        );
+          { id: result.toolUseId, name: tool.name, input: result.input }
+        ) : {
+          result: {
+            type: "tool_result",
+            tool_use_id: result.toolUseId,
+            content: decision === "deny" ? `Tool "${tool.name}" denied and blocked for this pattern.` : `Tool "${tool.name}" denied by user.`,
+            is_error: true
+          },
+          durationMs: 0
+        };
         const use2 = useById.get(reRunResult.result.tool_use_id);
         if (use2) {
           await this.pipelines.toolCall.run({
@@ -11174,19 +11365,8 @@ var Agent = class {
       });
     });
   }
-  async executeSingleWithDecision(tool, use, decision) {
+  async executeSingleWithDecision(tool, use) {
     const start = Date.now();
-    if (decision === "no" || decision === "deny") {
-      return {
-        result: {
-          type: "tool_result",
-          tool_use_id: use.id,
-          content: `Tool "${tool.name}" denied by user.`,
-          is_error: true
-        },
-        durationMs: Date.now() - start
-      };
-    }
     try {
       const result = await this.toolExecutor.executeTool(
         tool,
@@ -11374,9 +11554,10 @@ var Context = class {
   }
   /**
    * Register a teardown hook tied to the current run's abort signal. The
-   * hook fires when the run aborts OR ends normally — Agent.run wires
-   * this through a RunController. When no run is active the hook fires
-   * immediately so callers don't leak resources.
+   * hook fires when the run aborts or ends normally — Agent.run wires this
+   * through a RunController. Hooks registered before a run starts are stored
+   * and fired when the next run ends; there is no "immediate fire" when no
+   * run is active.
    *
    * **Scope:** these hooks fire on the **whole agent run's** abort, not on
    * an individual tool call. For per-tool teardown of resources owned by
@@ -11546,6 +11727,7 @@ You operate inside the user's terminal with direct read and write access to thei
 - **Task is clear, approach is unknown** \u2192 try one approach, report what happened
 - **Tool fails** \u2192 retry once with adjusted params, then report failure
 - **Permission prompt shown** \u2192 wait for user, do not act unilaterally
+- **Tool denied by user** \u2192 do NOT retry the same tool in the next iteration. If the user denies a write, bash, or any tool, respect that decision. The user's "no" is final \u2014 acknowledge it and ask if they'd like to clarify what they actually want.
 - **Context window filling up** \u2192 use context_manager proactively; don't wait to be told
 
 ## How you work
@@ -11554,6 +11736,8 @@ You operate inside the user's terminal with direct read and write access to thei
 - **Comment with purpose.** Add comments only when they explain why, not what. The code already says what.
 - **Own your output.** Never call work "production-ready" or "fully tested" \u2014 the user makes that call.
 - **Move on from mistakes.** When something fails, report what happened and what you'll do next. No apologies, no hand-wringing.
+- **Respect denied tools.** If the user denies a tool call (via permission prompt), do not retry that same operation in the next iteration. The user's "no" means "find another way or ask". Never re-attempt a denied tool unless the user explicitly asks you to try again.
+- **When denied, ask.** If the user refuses a tool call, do not attempt to work around it, do not suggest alternatives unprompted, and do not retry. Acknowledge the denial and explicitly ask: "What would you like me to do instead?"
 - **Stay in your lane.** Don't lecture about software engineering principles unless explicitly asked \u2014 the user is the expert on their codebase.`;
 var DefaultSystemPromptBuilder = class {
   constructor(opts = {}) {