@xyagent/cli 0.0.1

package/src-ext/core/createWorkspace.mjs

@@ -0,0 +1,170 @@
+/**
+ * createWorkspace.mjs — workspaces.create RPC 核心实现
+ *
+ * createWorkspace({ runtime, name }, deps?)
+ *   → Promise<{ ok: true, workspacePath: string, created: boolean }
+ *            | { ok: false, code: string, error: string }>
+ *
+ * 支持的 runtime：claude | codex | openclaw | hermes
+ *
+ * 路径计算：
+ *   - claude/codex/openclaw：<workspacesRoot()>/<runtime>/<name>
+ *   - hermes：~/.hermes/profiles/<name>
+ *
+ * 后置操作（按 runtime）：
+ *   - claude：writeCaudeTrust → ~/.claude.json
+ *   - codex：writeCaudeTrust + writeCodexTrust → ~/.codex/config.toml
+ *   - openclaw：openclaw --version 探测 + openclaw agents add
+ *   - hermes：createHermesProfile（含 root .env 复制）
+ *
+ * deps 注入接口（测试用）：
+ *   _workspacesRoot: string  覆盖 workspacesRoot() 返回值
+ *   _hermesRoot: string      覆盖 ~/.hermes 路径
+ *   _claudeJsonPath: string  覆盖 ~/.claude.json 路径
+ *   _codexConfigPath: string 覆盖 ~/.codex/config.toml 路径
+ *   _execFile: Function      覆盖 execFile 调用（测试 openclaw）
+ */
+
+import fs from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { execFile as nodeExecFile } from "node:child_process";
+import { promisify } from "node:util";
+import os from "node:os";
+import path from "node:path";
+
+import { workspacesRoot } from "./defaultWorkspace.mjs";
+import { writeCaudeTrust } from "./claudeTrust.mjs";
+import { writeCodexTrust } from "./codexTrust.mjs";
+import { ensureGitRepo } from "./ensureGitRepo.mjs";
+import { createHermesProfile } from "./hermesProfile.mjs";
+
+const execFileAsync = promisify(nodeExecFile);
+
+/** slug 通用校验正则（1-64 位，首字符字母数字，其余可含 _ -） */
+const SLUG_RE = /^[a-z0-9][a-z0-9_-]{0,62}([a-z0-9])?$/;
+
+/**
+ * 使用可注入的 _execFile 运行命令，返回 { stdout, stderr }。
+ * 失败时 throw，携带 exitCode / stderr / stdout。
+ */
+async function runCmd(cmd, args, _execFile) {
+  const exec = _execFile ?? execFileAsync;
+  try {
+    const result = await exec(cmd, args);
+    // promisify(execFile) 返回 { stdout, stderr }
+    return { stdout: String(result?.stdout ?? ""), stderr: String(result?.stderr ?? "") };
+  } catch (err) {
+    // 注入版或 execFile 失败：携带 exitCode / stderr / stdout
+    const wrapped = new Error(err?.message ?? String(err));
+    wrapped.code = err?.code;
+    wrapped.exitCode = err?.code === "ENOENT" ? null : (err?.exitCode ?? (err?.status ?? null));
+    wrapped.stderr = String(err?.stderr ?? "");
+    wrapped.stdout = String(err?.stdout ?? "");
+    throw wrapped;
+  }
+}
+
+/**
+ * 探测 openclaw 是否安装
+ */
+async function probeOpenclaw(_execFile) {
+  try {
+    await runCmd("openclaw", ["--version"], _execFile);
+    return true;
+  } catch (err) {
+    if (err.code === "ENOENT" || /not found|ENOENT/i.test(err.message)) {
+      return false;
+    }
+    // --version 以非零退出但能运行（极少见），视为已安装
+    return true;
+  }
+}
+
+/**
+ * 创建工作区。
+ *
+ * @param {{ runtime: string, name: string }} params
+ * @param {{
+ *   _workspacesRoot?: string,
+ *   _hermesRoot?: string,
+ *   _claudeJsonPath?: string,
+ *   _codexConfigPath?: string,
+ *   _execFile?: Function,
+ * }} deps  测试依赖注入
+ */
+export async function createWorkspace({ runtime, name }, deps = {}) {
+  const {
+    _workspacesRoot,
+    _hermesRoot,
+    _claudeJsonPath,
+    _codexConfigPath,
+    _execFile,
+  } = deps;
+
+  // hermes 走独立路径（profile 语义不同）
+  if (runtime === "hermes") {
+    return createWorkspace_hermes(name, { _hermesRoot });
+  }
+
+  // ── 通用 slug 校验 ──────────────────────────────────────────────────────
+  if (!name || !SLUG_RE.test(name)) {
+    return { ok: false, code: "name_invalid", error: `invalid workspace name: "${name}"` };
+  }
+
+  // openclaw 需要先探测安装（探测失败则不建目录）
+  if (runtime === "openclaw") {
+    const installed = await probeOpenclaw(_execFile);
+    if (!installed) {
+      return { ok: false, code: "openclaw_not_installed", error: "openclaw not found in PATH" };
+    }
+  }
+
+  // ── 路径计算 ────────────────────────────────────────────────────────────
+  const root = _workspacesRoot ?? workspacesRoot();
+  const workspacePath = path.join(root, runtime, name);
+
+  // ── 幂等检查 ────────────────────────────────────────────────────────────
+  const alreadyExists = existsSync(workspacePath);
+
+  // ── mkdir -p ────────────────────────────────────────────────────────────
+  await fs.mkdir(workspacePath, { recursive: true, mode: 0o700 });
+
+  // ── 后置操作 ────────────────────────────────────────────────────────────
+  if (runtime === "claude") {
+    await writeCaudeTrust(workspacePath, { _claudeJsonPath });
+  } else if (runtime === "codex") {
+    // codex 只认 ~/.codex/config.toml，绝不写 ~/.claude.json（否则 codex 工作区
+    // 会错误地出现在 claude 的扫描结果里——两者扫描源完全独立）
+    await writeCodexTrust(workspacePath, { _configPath: _codexConfigPath });
+    // codex 靠「目录是否 git 仓库」决定可写（workspace-write），trust_level 只管
+    // 加载 .codex 层、不给写权限。非 git 工作区 codex 会退回 read-only → 无法执行。
+    // best-effort：ensureGitRepo 自身吞错，git 缺失也不影响目录创建。
+    await ensureGitRepo(workspacePath, { _execFile });
+  } else if (runtime === "openclaw") {
+    // openclaw agents add <name> --workspace <absPath>
+    try {
+      await runCmd("openclaw", ["agents", "add", name, "--workspace", workspacePath], _execFile);
+      return { ok: true, workspacePath, created: true };
+    } catch (err) {
+      const combinedOutput = (err.stderr + " " + err.stdout).toLowerCase();
+      if (combinedOutput.includes("already")) {
+        // 幂等成功
+        return { ok: true, workspacePath, created: false };
+      }
+      return {
+        ok: false,
+        code: "openclaw_register_failed",
+        error: err.stderr || err.message,
+      };
+    }
+  }
+
+  return { ok: true, workspacePath, created: !alreadyExists };
+}
+
+/**
+ * hermes runtime 创建 profile（独立路径）
+ */
+async function createWorkspace_hermes(name, { _hermesRoot } = {}) {
+  return createHermesProfile(name, { _hermesRoot });
+}

package/src-ext/core/daemonRestart.mjs

@@ -0,0 +1,49 @@
+/**
+ * daemonRestart.mjs — AgentLink daemon 热重启辅助
+ *
+ * kickstartDaemons() 在 macOS 上通过 launchctl kickstart -k
+ * 热重启已注册的 agentlink claude 和 codex daemon。
+ *
+ * 典型调用场景：
+ *   - make cli-link / cli-link-local（新代码链接后自动生效）
+ *   - npm_cli postinstall
+ */
+
+import { execSync as _nodeExecSync } from "node:child_process";
+
+// launchd service labels
+const DAEMON_LABELS = [
+  "com.agentlink.agent.claude",
+  "com.agentlink.agent.codex",
+];
+
+/**
+ * 热重启 AgentLink daemon（仅 macOS）。
+ *
+ * @param {{
+ *   _platform?: string,       // 测试注入，默认 process.platform
+ *   _execSync?: Function,     // 测试注入，默认 node:child_process execSync
+ *   _log?: { warn: Function, info: Function }, // 测试注入，默认 console
+ * }} opts
+ */
+export async function kickstartDaemons({
+  _platform = process.platform,
+  _execSync = _nodeExecSync,
+  _log = console,
+} = {}) {
+  if (_platform !== "darwin") return;
+
+  // 优先用 process.getuid()（Node.js 内置，不需要 spawn 子进程）
+  const uid = String(process.getuid?.() ?? "");
+
+  for (const label of DAEMON_LABELS) {
+    const target = `gui/${uid}/${label}`;
+    const cmd = `launchctl kickstart -k "${target}"`;
+    try {
+      _execSync(cmd, { encoding: "utf8", stdio: "pipe" });
+      _log.info?.(`[daemonRestart] kickstarted ${label}`);
+    } catch (err) {
+      _log.warn(`[daemonRestart] warn: could not kickstart ${label}: ${err?.message ?? err}`);
+    }
+  }
+}

package/src-ext/core/defaultWorkspace.mjs

@@ -0,0 +1,65 @@
+/**
+ * defaultWorkspace.mjs — claude/codex 默认工作区路径管理
+ *
+ * 提供三个函数：
+ *   workspacesRoot()              — 工作区根目录（~/agentlink），供 default + 用户新建工作区共用
+ *   defaultWorkspacePath(runtime) — 纯路径计算，不建目录（供 scan 合成 entry 用）
+ *   ensureDefaultWorkspace(runtime) — mkdir -p 后返回路径（pair 时 eager 创建 + dispatch 懒建）
+ *
+ * 路径结构：<workspacesRoot()>/<runtime>/default
+ *   例如 ~/agentlink/claude/default
+ *        ~/agentlink/codex/default
+ *
+ * 注意：工作区根 ~/agentlink（非隐藏、用户可见的项目目录）刻意与 CLI 状态目录
+ * ~/.agentlink（隐藏，放审计日志 / 凭证 / sessions）分开——前者是 agent 实际读写
+ * 代码的项目根，后者是工具自身状态，二者不能混在一起（参 openclaw 官方同款建议：
+ * workspace 要与 ~/.openclaw 分离）。用户新建工作区走 <workspacesRoot()>/<runtime>/<name>。
+ *
+ * 改名 agentlink 时只需改 workspacesRoot() 的返回值（统一来源）。
+ */
+
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+import { ensureGitRepo } from "./ensureGitRepo.mjs";
+
+/**
+ * 返回工作区根目录的绝对路径（~/agentlink），不建目录。
+ * default 与用户新建工作区都挂在它下面：<root>/<runtime>/<name>。
+ *
+ * @returns {string}  绝对路径
+ */
+export function workspacesRoot() {
+  return path.join(os.homedir(), "agentlink");
+}
+
+/**
+ * 返回 <runtime> 对应默认工作区的绝对路径，不建目录。
+ *
+ * @param {string} runtime  "claude" | "codex"
+ * @returns {string}        绝对路径
+ */
+export function defaultWorkspacePath(runtime) {
+  return path.join(workspacesRoot(), runtime, "default");
+}
+
+/**
+ * 确保 <runtime> 默认工作区目录存在（mkdir -p），返回绝对路径。
+ * 幂等：目录已存在时不报错。
+ *
+ * codex 默认工作区还会 git init（与新建工作区同口径）——codex 靠「目录是否 git
+ * 仓库」决定 workspace-write，非 git 会退回 read-only。best-effort，不阻断。
+ *
+ * @param {string} runtime  "claude" | "codex"
+ * @param {{ _execFile?: Function }} [opts]  测试注入
+ * @returns {Promise<string>}  绝对路径
+ */
+export async function ensureDefaultWorkspace(runtime, { _execFile } = {}) {
+  const p = defaultWorkspacePath(runtime);
+  await fs.mkdir(p, { recursive: true, mode: 0o700 });
+  if (runtime === "codex") {
+    await ensureGitRepo(p, { _execFile });
+  }
+  return p;
+}

package/src-ext/core/ensureGitRepo.mjs

@@ -0,0 +1,57 @@
+/**
+ * ensureGitRepo.mjs — 把工作区初始化为 git 仓库（codex 可写的前提）
+ *
+ * 为什么需要：codex 用「目录是否受版本控制（git）」来决定 sandbox——
+ *   - git 仓库 → workspace-write（agent 可在工作区内读写）
+ *   - 非 git 目录 → read-only（exec 模式甚至直接拒跑：
+ *     "Not inside a trusted directory and --skip-git-repo-check was not specified."）
+ * 这一点经 codex 官方文档（config-reference / agent-approvals："Version-controlled
+ * folders: Auto (workspace write + on-request approvals)"）+ 本地实测双重确认。
+ *
+ * 注意：`~/.codex/config.toml` 的 `[projects."<path>"] trust_level="trusted"` **不是**
+ * 写权限开关——官方原文：trust_level 只决定是否加载项目级 `.codex/` 层（config /
+ * hooks / rules）。所以 writeCodexTrust 解决不了「只读」，必须 git init。
+ *
+ * 幂等 + best-effort：已是仓库（自身或父级 work tree）跳过；git 缺失/失败不抛，
+ * 只返回 ok:false（工作区仍可用，codex 退回 read-only）。
+ */
+
+import { execFile as nodeExecFile } from "node:child_process";
+import { promisify } from "node:util";
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+const execFileAsync = promisify(nodeExecFile);
+
+/**
+ * 确保 dir 是一个 git 仓库。
+ *
+ * @param {string} dir 工作区绝对路径
+ * @param {{ _execFile?: Function }} [opts] 测试注入
+ * @returns {Promise<{ ok: boolean, created: boolean, reason?: string }>}
+ */
+export async function ensureGitRepo(dir, { _execFile } = {}) {
+  const exec = _execFile ?? execFileAsync;
+
+  // 快路径：自身已是仓库根 → 跳过，不 spawn git。
+  // （ensureDefaultWorkspace 每次 dispatch 都会调，这条短路避免每轮起 git 进程。）
+  if (existsSync(path.join(dir, ".git"))) {
+    return { ok: true, created: false };
+  }
+
+  // 已落在某个父级 work tree 内（如 ~/agentlink 本身被 git 管理）→ 也算受版本控制，
+  // 不再嵌套 init。
+  try {
+    await exec("git", ["-C", dir, "rev-parse", "--is-inside-work-tree"]);
+    return { ok: true, created: false };
+  } catch {
+    // 不在任何 work tree 内 → 初始化
+  }
+
+  try {
+    await exec("git", ["init", "-q", dir]);
+    return { ok: true, created: true };
+  } catch (err) {
+    return { ok: false, created: false, reason: err?.message || String(err) };
+  }
+}

package/src-ext/core/hermesProfile.mjs

@@ -0,0 +1,75 @@
+/**
+ * hermesProfile.mjs — 初始化 hermes profile 目录并继承 root 凭证
+ *
+ * createHermesProfile(name, { _hermesRoot? })
+ *   → Promise<{ ok: true, workspacePath: string, created: boolean }
+ *            | { ok: false, code: string, error: string }>
+ *
+ * 流程：
+ *   1. name 校验（/^[a-z0-9][a-z0-9_-]{0,63}$/）
+ *   2. 校验 root ~/.hermes/.env 存在（不存在 → hermes_root_credentials_missing）
+ *   3. mkdir ~/.hermes/profiles/<name>（mode 0o700，递归）
+ *   4. 若 profile .env 不存在，复制 root .env（幂等：已存在不覆盖）
+ *   5. 返回 { ok: true, workspacePath, created }
+ */
+
+import fs from "node:fs/promises";
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+/** hermes profile name 合法正则（与 hermes-profile-isolation spec 一致） */
+const HERMES_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+
+/**
+ * 返回默认 ~/.hermes 根目录
+ */
+function defaultHermesRoot() {
+  return path.join(os.homedir(), ".hermes");
+}
+
+/**
+ * 初始化 hermes profile 目录并继承 root 凭证。
+ *
+ * @param {string} name  profile 名（slug）
+ * @param {{ _hermesRoot?: string }} opts  可注入路径（测试用）
+ * @returns {Promise<{ ok: boolean, workspacePath?: string, created?: boolean, code?: string, error?: string }>}
+ */
+export async function createHermesProfile(name, { _hermesRoot } = {}) {
+  const hermesRoot = _hermesRoot ?? defaultHermesRoot();
+
+  // 1. name 校验
+  if (!HERMES_NAME_RE.test(name)) {
+    return { ok: false, code: "name_invalid", error: `invalid hermes profile name: "${name}"` };
+  }
+
+  const rootEnvPath = path.join(hermesRoot, ".env");
+  const profileDir = path.join(hermesRoot, "profiles", name);
+  const profileEnvPath = path.join(profileDir, ".env");
+
+  // 2. 校验 root .env 存在
+  if (!existsSync(rootEnvPath)) {
+    return {
+      ok: false,
+      code: "hermes_root_credentials_missing",
+      error: `root ~/.hermes/.env not found at ${rootEnvPath}`,
+    };
+  }
+
+  // 3. 检查 profile 是否已存在（幂等判断）
+  const alreadyExists = existsSync(profileDir);
+
+  // 4. mkdir（幂等，已存在不报错）
+  await fs.mkdir(profileDir, { recursive: true, mode: 0o700 });
+
+  // 5. 复制 .env（幂等：profile .env 已存在不覆盖）
+  if (!existsSync(profileEnvPath)) {
+    await fs.copyFile(rootEnvPath, profileEnvPath);
+  }
+
+  return {
+    ok: true,
+    workspacePath: profileDir,
+    created: !alreadyExists,
+  };
+}

package/src-ext/core/interruptGateway.mjs

@@ -0,0 +1,119 @@
+/**
+ * interruptGateway.mjs — HITL interrupt 阻塞闸门
+ *
+ * 语义与 approvalGateway 对齐（openRequest / settle / dispose），
+ * 但接的是 unified interrupt + resume 端点，而非私有 tool_approval 协议。
+ *
+ * 工作流：
+ *   1. handleRequest 发出 interrupt block + run.paused
+ *   2. 调用 openRequest({ runId, blockId, interruptId }) 挂起等待
+ *   3. SSE 消费层收到 run.resumed → 调用 settle(interruptId, value)
+ *   4. promise resolve，handleRequest 继续发 content_block.completed + run.completed
+ *   5. dispose() 在连接关闭 / run cancel 时 reject 所有 pending
+ */
+
+/**
+ * @param {{ log: { info?, warn?, error?, child? } }} opts
+ * @returns {{ openRequest, settle, dispose }}
+ */
+// audit 修复：用户断网/进程异常导致 settle 永不到达时，interrupt 此前永久
+// 悬挂。默认 30 分钟硬超时（/resume picker 用户可能离开较久，给宽裕窗口；
+// relay 侧 decision key TTL 24h，超时后用户再决策由 relay 兜底为无主决策丢弃）。
+const DEFAULT_INTERRUPT_TIMEOUT_MS = 30 * 60_000;
+
+export function createInterruptGateway({ log, timeoutMs = DEFAULT_INTERRUPT_TIMEOUT_MS }) {
+  if (!log) throw new Error("createInterruptGateway: log required");
+  const gwLog = log.child ? log.child({ comp: "interrupt" }) : log;
+
+  // interruptId → { resolve, reject, runId, blockId, openedAt }
+  const pending = new Map();
+
+  /**
+   * 开启一个 interrupt 等待。
+   * @param {{ runId: string, blockId: string, interruptId: string }} params
+   * @returns {{ promise: Promise<any> }}
+   */
+  function openRequest({ runId, blockId, interruptId }) {
+    if (pending.has(interruptId)) {
+      throw new Error(`duplicate interruptId: ${interruptId}`);
+    }
+    let resolveFn, rejectFn;
+    const promise = new Promise((resolve, reject) => {
+      resolveFn = resolve;
+      rejectFn = reject;
+    });
+    let timeoutHandle = null;
+    if (timeoutMs > 0) {
+      timeoutHandle = setTimeout(() => {
+        const e = pending.get(interruptId);
+        if (!e) return;
+        pending.delete(interruptId);
+        gwLog.warn?.("interrupt.timeout", "interrupt wait timed out, rejecting", {
+          interrupt_id: interruptId, run_id: runId, timeout_ms: timeoutMs,
+        });
+        e.reject(new Error("interrupt timeout"));
+      }, timeoutMs);
+      timeoutHandle.unref?.();
+    }
+    pending.set(interruptId, {
+      resolve: resolveFn,
+      reject: rejectFn,
+      runId,
+      blockId,
+      openedAt: Date.now(),
+      timeoutHandle,
+    });
+    gwLog.info?.("interrupt.request.opened", "interrupt request opened", {
+      interrupt_id: interruptId,
+      run_id: runId,
+      block_id: blockId,
+    });
+    return { promise };
+  }
+
+  /**
+   * 以 value resolve 对应 interruptId 的 promise（来自 run.resumed 事件）。
+   * 未知 interruptId 时 warn 并静默忽略。
+   * @param {string} interruptId
+   * @param {any} value  run.resumed extensions.agent.value
+   */
+  function settle(interruptId, value) {
+    const entry = pending.get(interruptId);
+    if (!entry) {
+      gwLog.warn?.("interrupt.settle.unknown", "settle called for unknown interruptId", {
+        interrupt_id: interruptId,
+      });
+      return;
+    }
+    pending.delete(interruptId);
+    if (entry.timeoutHandle) clearTimeout(entry.timeoutHandle);
+    const waitMs = Date.now() - entry.openedAt;
+    gwLog.info?.("interrupt.settled", "interrupt resolved by user decision", {
+      interrupt_id: interruptId,
+      run_id: entry.runId,
+      wait_ms: waitMs,
+    });
+    entry.resolve(value);
+  }
+
+  /**
+   * reject 所有 pending promise，message = "interrupt_gateway_disposed"。
+   * 在连接关闭 / 进程销毁时调用。
+   */
+  function dispose() {
+    const ids = [...pending.keys()];
+    for (const id of ids) {
+      const entry = pending.get(id);
+      if (!entry) continue;
+      pending.delete(id);
+      if (entry.timeoutHandle) clearTimeout(entry.timeoutHandle);
+      gwLog.warn?.("interrupt.dispose", "rejecting pending interrupt on dispose", {
+        interrupt_id: id,
+        run_id: entry.runId,
+      });
+      entry.reject(new Error("interrupt_gateway_disposed"));
+    }
+  }
+
+  return { openRequest, settle, dispose };
+}

package/src-ext/core/interruptRunListener.mjs

@@ -0,0 +1,106 @@
+/**
+ * interruptRunListener.mjs — 等待 relay 的 run.resumed 事件
+ *
+ * 订阅 GET /v1/agents/threads/{tid}/stream（bridge token）,
+ * 解析 SSE 帧，在看到 run.resumed 且 interrupt_id 匹配时 resolve。
+ *
+ * 用于 interrupt picker 分支：bridge 发出 run.paused 后用它等待用户决策。
+ *
+ * @param {{
+ *   relayUrl: string,
+ *   bridgeToken: string,
+ *   threadId: string,
+ *   runId: string,
+ *   interruptId: string,
+ *   timeoutMs?: number,  // 默认 24h（TTL 与 relay decision key 对齐）
+ *   signal?: AbortSignal,
+ *   log?: any,
+ * }} opts
+ * @returns {Promise<{ value: any }>}  resolves with user decision value
+ */
+export async function waitForRunResumed({
+  relayUrl,
+  bridgeToken,
+  threadId,
+  runId,
+  interruptId,
+  timeoutMs = 24 * 60 * 60 * 1000,
+  signal: outerSignal,
+  log,
+}) {
+  const base = String(relayUrl || "").replace(/\/+$/, "");
+  const url = `${base}/v1/agents/threads/${encodeURIComponent(threadId)}/stream`;
+  const headers = {
+    "Authorization": `Bearer ${bridgeToken}`,
+    "Accept": "text/event-stream",
+    "Cache-Control": "no-cache",
+    // Bridge token scoped: relay will not apply caps_filter for interrupt events
+    "X-Agent-Bridge-Token": bridgeToken,
+  };
+
+  const ctrl = new AbortController();
+  // Compose outer signal
+  if (outerSignal) {
+    outerSignal.addEventListener("abort", () => ctrl.abort(), { once: true });
+  }
+  // Auto-timeout
+  const timeoutHandle = setTimeout(() => {
+    ctrl.abort();
+    log?.warn?.("interrupt.listener.timeout", "run.resumed wait timed out", {
+      run_id: runId,
+      interrupt_id: interruptId,
+      timeout_ms: timeoutMs,
+    });
+  }, timeoutMs);
+
+  try {
+    const res = await fetch(url, { headers, signal: ctrl.signal });
+    if (!res.ok) {
+      throw new Error(`interrupt listener: stream ${res.status}`);
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buf = "";
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        throw new Error("interrupt listener: stream ended without run.resumed");
+      }
+      buf += decoder.decode(value, { stream: true });
+      // Parse SSE frames
+      const frames = buf.split("\n\n");
+      buf = frames.pop() ?? "";
+      for (const frame of frames) {
+        if (!frame.trim()) continue;
+        const dataLine = frame.split("\n").find((l) => l.startsWith("data:"));
+        if (!dataLine) continue;
+        const jsonStr = dataLine.slice("data:".length).trim();
+        if (!jsonStr || jsonStr === "[DONE]") continue;
+        let event;
+        try {
+          event = JSON.parse(jsonStr);
+        } catch {
+          continue;
+        }
+        // We only care about run.resumed for our run + interrupt
+        if (event?.type !== "run.resumed") continue;
+        if (event.run_id !== runId) continue;
+        const agentExt = event?.extensions?.agent;
+        if (!agentExt) continue;
+        const eventInterruptId = agentExt.interrupt_id;
+        if (eventInterruptId && eventInterruptId !== interruptId) continue;
+        // Match! Extract value
+        const decisionValue = agentExt.value ?? null;
+        log?.info?.("interrupt.listener.resolved", "run.resumed received", {
+          run_id: runId,
+          interrupt_id: interruptId,
+        });
+        return { value: decisionValue };
+      }
+    }
+  } finally {
+    clearTimeout(timeoutHandle);
+    ctrl.abort(); // ensure stream is closed
+  }
+}