@ze-norm/cli 0.12.0 → 0.13.0

package/dist/commands/interactive-agent.d.ts

@@ -0,0 +1,92 @@
+import type { ChildProcess, SpawnOptions } from "node:child_process";
+/**
+ * Opt-in coding-agent mode for local `zenorm work` runs.
+ *
+ * When a user opts in (`--interactive` or `.zenorm.json` `interactive: true`),
+ * the daemon does NOT run the agent headlessly. Instead it launches the active
+ * coding agent — Claude Code by default, or Codex when the user runs with
+ * `--agent codex` — as a *live interactive session*, seeded with the
+ * `/zenorm <specId>` handoff. The agent owns the terminal directly (inherited
+ * stdio), so the operator works with it interactively until they close it; when
+ * the agent exits, the daemon releases the worker and moves on to the next task.
+ *
+ * Scope is deliberately narrow (single local operator): the agent is attached
+ * to *this* process's own stdio. There is no network listener, no second
+ * connection, nothing remote — `assertLocalAgentOptions` enforces those
+ * boundaries; this module just launches the local interactive agent.
+ */
+/**
+ * The minimal surface we need from a TTY check — injectable so tests can drive
+ * both the "usable TTY" and "no TTY" branches without a real terminal.
+ *
+ * A usable interactive agent needs BOTH stdin and stdout to be TTYs: stdin so
+ * the operator can type into the agent's TUI, stdout so it can render. We read
+ * them through this indirection rather than touching `process.std*.isTTY`
+ * inline.
+ */
+export interface TtyProbe {
+    stdinIsTty: boolean;
+    stdoutIsTty: boolean;
+}
+/** Read the real process TTY state. */
+export declare function processTtyProbe(): TtyProbe;
+/**
+ * Injectable spawn signature (mirrors `work.ts`'s `SpawnFn`) so the interactive
+ * agent can be unit-tested without launching a real `claude`/`codex` process.
+ */
+export type AgentSpawnFn = (command: string, args: string[], options: SpawnOptions) => ChildProcess;
+/**
+ * Assert a usable local TTY is present, or fail loud. This is the fail-fast
+ * gate the spec's "Fail-fast without usable TTY" constraint requires: an
+ * interactive run with no terminal to attach to must error immediately rather
+ * than hang waiting on input that can never arrive (or silently degrade to a
+ * non-interactive run, which would mask the misconfiguration).
+ */
+export declare function assertUsableTty(probe: TtyProbe): void;
+/**
+ * Local-only guardrails for the interactive agent (spec: "No remote or shared
+ * shells", "Local single-operator agent scope"). These are STRUCTURAL
+ * guardrails: the agent never exposes a remote/shared surface in the first
+ * place. The interactive agent is, by construction, the operator's own
+ * `claude`/`codex` attached to *this* process's own terminal — there is no
+ * socket, no listener, no second connection, and it is bound to this process
+ * group so it cannot outlive (or be detached from) the local task.
+ * `buildLocalAgentOptions` is the single source of truth for those spawn
+ * options, and `assertLocalAgentOptions` enforces them so a future edit cannot
+ * silently introduce a detached or non-local agent session.
+ */
+export declare function buildLocalAgentOptions(): SpawnOptions;
+/**
+ * Guard the spawn options against any non-local/shared configuration. Fails
+ * loud (no masked default) if a caller ever hands the agent options that would
+ * detach it from this process or route its IO anywhere but this terminal.
+ */
+export declare function assertLocalAgentOptions(options: SpawnOptions): void;
+/**
+ * A live, interactive coding-agent session that replaces a task's headless run.
+ * `open` spawns `claude`/`codex` with inherited stdio (so the operator works
+ * with it directly, in its own TUI); the returned child resolves the run when
+ * it exits, which releases the worker. Constructed only after `assertUsableTty`
+ * has passed.
+ *
+ * Single-operator invariant: an instance opens AT MOST one agent session, ever.
+ * A second `open()` — whether the first session is still live or already
+ * closed — is refused loudly, so there is never more than one interactive agent
+ * behind a single task.
+ */
+export declare class InteractiveAgent {
+    private readonly command;
+    private readonly args;
+    private readonly spawnFn;
+    private child;
+    private opened;
+    constructor(command: string, args: string[], spawnFn?: AgentSpawnFn);
+    /**
+     * Spawn the coding agent with inherited stdio so it owns the terminal and the
+     * operator works with it live. Returns the child so the caller can await its
+     * exit (which releases the worker). The single-operator invariant is enforced
+     * here: one session per instance, period.
+     */
+    open(): ChildProcess;
+}
+//# sourceMappingURL=interactive-agent.d.ts.map

package/dist/commands/interactive-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive-agent.d.ts","sourceRoot":"","sources":["../../src/commands/interactive-agent.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIrE;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,uCAAuC;AACvC,wBAAgB,eAAe,IAAI,QAAQ,CAK1C;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAarD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,IAAI,YAAY,CAiBrD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAcnE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAKzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,MAAM,CAAS;gBAGJ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,YAAoB;IAGhD;;;;;OAKG;IACH,IAAI,IAAI,YAAY;CAmBrB"}

package/dist/commands/interactive-agent.js

@@ -0,0 +1,120 @@
+import { spawn } from "node:child_process";
+import { CliError } from "../util/errors.js";
+import { log } from "../util/logger.js";
+/** Read the real process TTY state. */
+export function processTtyProbe() {
+    return {
+        stdinIsTty: process.stdin.isTTY === true,
+        stdoutIsTty: process.stdout.isTTY === true,
+    };
+}
+/**
+ * Assert a usable local TTY is present, or fail loud. This is the fail-fast
+ * gate the spec's "Fail-fast without usable TTY" constraint requires: an
+ * interactive run with no terminal to attach to must error immediately rather
+ * than hang waiting on input that can never arrive (or silently degrade to a
+ * non-interactive run, which would mask the misconfiguration).
+ */
+export function assertUsableTty(probe) {
+    if (!probe.stdinIsTty || !probe.stdoutIsTty) {
+        throw new CliError("Interactive coding-agent mode requires a local terminal (TTY), but none is attached.\n\n" +
+            "`zenorm work --interactive` launches the coding agent as a live session, " +
+            "which needs an interactive stdin and stdout. This run has " +
+            `${probe.stdinIsTty ? "" : "no TTY stdin"}` +
+            `${!probe.stdinIsTty && !probe.stdoutIsTty ? " and " : ""}` +
+            `${probe.stdoutIsTty ? "" : "no TTY stdout"}` +
+            ".\n\nRun it from a real terminal, or drop `--interactive` (and the " +
+            '`interactive` config flag) to run non-interactively.');
+    }
+}
+/**
+ * Local-only guardrails for the interactive agent (spec: "No remote or shared
+ * shells", "Local single-operator agent scope"). These are STRUCTURAL
+ * guardrails: the agent never exposes a remote/shared surface in the first
+ * place. The interactive agent is, by construction, the operator's own
+ * `claude`/`codex` attached to *this* process's own terminal — there is no
+ * socket, no listener, no second connection, and it is bound to this process
+ * group so it cannot outlive (or be detached from) the local task.
+ * `buildLocalAgentOptions` is the single source of truth for those spawn
+ * options, and `assertLocalAgentOptions` enforces them so a future edit cannot
+ * silently introduce a detached or non-local agent session.
+ */
+export function buildLocalAgentOptions() {
+    return {
+        cwd: process.cwd(),
+        // inherit: the agent owns THIS terminal directly (its TUI, raw-mode line
+        // editing, etc. all work). Crucially this is also the local/single-operator
+        // boundary — the agent reads/writes only this process's stdio, never a pipe
+        // we could forward elsewhere. We are explicitly NOT piping the agent's
+        // output through Node (that piping + re-render is the headless path), so
+        // there is no second stream a remote/shared peer could attach, and no raw
+        // text dump: the agent's own TUI renders directly to the terminal.
+        stdio: "inherit",
+        // detached:false keeps the agent in OUR process group so it dies with the
+        // local task process and can never become an orphaned, independently-reachable
+        // session. A detached agent would violate "no remote or shared shells" — so
+        // it is asserted false below.
+        detached: false,
+    };
+}
+/**
+ * Guard the spawn options against any non-local/shared configuration. Fails
+ * loud (no masked default) if a caller ever hands the agent options that would
+ * detach it from this process or route its IO anywhere but this terminal.
+ */
+export function assertLocalAgentOptions(options) {
+    if (options.detached === true) {
+        throw new CliError("Refusing to launch a detached interactive agent: it must stay bound " +
+            "to the local task process (no remote or shared shells).");
+    }
+    if (options.stdio !== "inherit") {
+        throw new CliError("Refusing to launch the interactive agent on non-inherited stdio: it must " +
+            "attach to this local terminal only (no remote or shared shells, no raw " +
+            "text dumping).");
+    }
+}
+/**
+ * A live, interactive coding-agent session that replaces a task's headless run.
+ * `open` spawns `claude`/`codex` with inherited stdio (so the operator works
+ * with it directly, in its own TUI); the returned child resolves the run when
+ * it exits, which releases the worker. Constructed only after `assertUsableTty`
+ * has passed.
+ *
+ * Single-operator invariant: an instance opens AT MOST one agent session, ever.
+ * A second `open()` — whether the first session is still live or already
+ * closed — is refused loudly, so there is never more than one interactive agent
+ * behind a single task.
+ */
+export class InteractiveAgent {
+    command;
+    args;
+    spawnFn;
+    child = null;
+    opened = false;
+    constructor(command, args, spawnFn = spawn) {
+        this.command = command;
+        this.args = args;
+        this.spawnFn = spawnFn;
+    }
+    /**
+     * Spawn the coding agent with inherited stdio so it owns the terminal and the
+     * operator works with it live. Returns the child so the caller can await its
+     * exit (which releases the worker). The single-operator invariant is enforced
+     * here: one session per instance, period.
+     */
+    open() {
+        if (this.opened) {
+            throw new CliError("Interactive agent already launched for this task — only a single local " +
+                "agent session is allowed (no second or shared session).");
+        }
+        this.opened = true;
+        const options = buildLocalAgentOptions();
+        // Belt-and-braces: prove the options are local-only before spawning, so a
+        // future change to buildLocalAgentOptions can't quietly launch a shared agent.
+        assertLocalAgentOptions(options);
+        log.plain(`Launching interactive ${this.command} session — work with it, then exit ` +
+            "the agent to continue to the next task.");
+        this.child = this.spawnFn(this.command, this.args, options);
+        return this.child;
+    }
+}

package/dist/commands/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAQA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuE/D"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAcA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4F/D"}

package/dist/commands/pull.js

@@ -3,7 +3,7 @@ import { writeFileSync } from "node:fs";
 import { ZenormClient } from "../api/client.js";
 import { CliError } from "../util/errors.js";
 import { log } from "../util/logger.js";
-import { blocksToMarkdown, specToMarkdown } from "../util/markdown.js";
+import { attachmentsToMarkdown, blocksToMarkdown, specToMarkdown, } from "../util/markdown.js";
 export async function pullCommand(argv) {
     const { positionals, values } = parseArgs({
         args: argv,
@@ -56,7 +56,28 @@ export async function pullCommand(argv) {
             error: err instanceof Error ? err.message : String(err),
         });
     }
-    const md = blocksMd ? `${specToMarkdown(spec)}\n\n${blocksMd}\n` : specToMarkdown(spec);
+    // Fetch the spec's READY attachments and append them to the work context,
+    // automatically (no flag, no per-run selection — AC "included automatically").
+    // The `?status=ready` filter is the SERVER-SIDE gate, so a worker run can only
+    // ever see ingested files (AC "ready files only"). Tolerate the endpoint 404ing
+    // on older servers — degrade silently like the blocks fetch above.
+    let attachmentsMd = "";
+    try {
+        const { attachments } = await client.get(`/v1/specs/${spec.id}/attachments?status=ready`);
+        attachmentsMd = attachmentsToMarkdown(attachments);
+    }
+    catch (err) {
+        log.debug("Attachment fetch failed, omitting attachments section", {
+            specId: spec.id,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    const sections = [specToMarkdown(spec)];
+    if (blocksMd)
+        sections.push(blocksMd);
+    if (attachmentsMd)
+        sections.push(attachmentsMd);
+    const md = `${sections.join("\n\n")}\n`;
     if (outputPath) {
         writeFileSync(outputPath, md, "utf-8");
         log.success(`Wrote spec to ${outputPath}`);

package/dist/commands/work-render.d.ts

@@ -83,6 +83,7 @@ export declare function splashLogo(): string;
  */
 export declare function daemonBanner(opts: {
     agent: string;
+    model?: string;
     repo: string;
     intervalSeconds: number;
     once: boolean;
@@ -112,6 +113,27 @@ export declare function failureBanner(opts: {
     title: string;
     error: string;
 }): string;
+/**
+ * The ONE-LINE post-agent change summary printed when an interactive
+ * coding-agent session closes (operator exited the agent). It is the only
+ * read-out of an interactive session — the agent's own TUI owned the terminal,
+ * so there is no transcript to footer — and per the spec it must be a SINGLE
+ * line (constraint: "No raw text terminal dumping"): no multi-line dump, no raw
+ * diff. It reports the files the agent touched during the session and the
+ * claimed task's resulting status, then the daemon releases the worker.
+ *
+ * The file list is capped to `maxFiles` names with a `+N more` tail so a large
+ * change set never wraps the line. `status` is the task's server-side status
+ * (e.g. `done` once the agent ran `zenorm task complete`), or the literal
+ * `unknown` when the status read could not be made — the one sanctioned
+ * soft-fallback, since reading the status must never block worker release.
+ */
+export declare function postAgentSummary(opts: {
+    filesTouched: string[];
+    status: string;
+    shortTaskId: string;
+    maxFiles?: number;
+}): string;
 /**
  * The session summary printed when the daemon shuts down (Ctrl-C or `--once`
  * exhausted). Closes the run with a rule + a one-line tally so the user sees the

package/dist/commands/work-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work-render.d.ts","sourceRoot":"","sources":["../../src/commands/work-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAoBH,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AA2DlC;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAM;IAEpB,6EAA6E;IAC7E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAQ7B,wDAAwD;IACxD,KAAK,IAAI,MAAM,EAAE;CAMlB;AA+ED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAoE/D;AAED,kEAAkE;AAClE,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,EAAE,CAAC;AAuBjE,eAAO,MAAM,cAAc,EAAE,aAA+C,CAAC;AAC7E,eAAO,MAAM,aAAa,EAAE,aAA8C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAI/E;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAMR;AA2JD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAenC;AAoBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,CAsBT;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAMT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAKT"}
+{"version":3,"file":"work-render.d.ts","sourceRoot":"","sources":["../../src/commands/work-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAoBH,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AA2DlC;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAM;IAEpB,6EAA6E;IAC7E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAQ7B,wDAAwD;IACxD,KAAK,IAAI,MAAM,EAAE;CAMlB;AA+ED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAoE/D;AAED,kEAAkE;AAClE,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,EAAE,CAAC;AAuBjE,eAAO,MAAM,cAAc,EAAE,aAA+C,CAAC;AAC7E,eAAO,MAAM,aAAa,EAAE,aAA8C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAI/E;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAMR;AA2JD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAenC;AAoBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,CAuBT;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAiBT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAKT"}

package/dist/commands/work-render.js

@@ -537,6 +537,7 @@ export function daemonBanner(opts) {
         `${DIM}spec-authoring agent · claim-and-run daemon${RESET}`,
         "",
         `${DIM}agent     ${RESET}${opts.agent}`,
+        ...(opts.model ? [`${DIM}model     ${RESET}${opts.model}`] : []),
         `${DIM}repo      ${RESET}${opts.repo}`,
         `${DIM}interval  ${RESET}${opts.intervalSeconds}s`,
     ]);
@@ -576,6 +577,38 @@ export function failureBanner(opts) {
         `${DIM}  released back to todo — it can be re-claimed.${RESET}`,
     ].join("\n");
 }
+/**
+ * The ONE-LINE post-agent change summary printed when an interactive
+ * coding-agent session closes (operator exited the agent). It is the only
+ * read-out of an interactive session — the agent's own TUI owned the terminal,
+ * so there is no transcript to footer — and per the spec it must be a SINGLE
+ * line (constraint: "No raw text terminal dumping"): no multi-line dump, no raw
+ * diff. It reports the files the agent touched during the session and the
+ * claimed task's resulting status, then the daemon releases the worker.
+ *
+ * The file list is capped to `maxFiles` names with a `+N more` tail so a large
+ * change set never wraps the line. `status` is the task's server-side status
+ * (e.g. `done` once the agent ran `zenorm task complete`), or the literal
+ * `unknown` when the status read could not be made — the one sanctioned
+ * soft-fallback, since reading the status must never block worker release.
+ */
+export function postAgentSummary(opts) {
+    const max = opts.maxFiles ?? 4;
+    const count = opts.filesTouched.length;
+    const noun = count === 1 ? "file" : "files";
+    let detail;
+    if (count === 0) {
+        detail = `${DIM}no files touched${RESET}`;
+    }
+    else {
+        const shown = opts.filesTouched.slice(0, max);
+        const overflow = count - shown.length;
+        const names = shown.join(", ") + (overflow > 0 ? `, +${overflow} more` : "");
+        detail = `${count} ${noun} touched ${DIM}(${clip(names)})${RESET}`;
+    }
+    return (`${BOLD}◣ agent closed${RESET} ${DIM}·${RESET} ${detail} ` +
+        `${DIM}·${RESET} task ${GREEN}${opts.status}${RESET} ${DIM}(${opts.shortTaskId})${RESET}`);
+}
 /**
  * The session summary printed when the daemon shuts down (Ctrl-C or `--once`
  * exhausted). Closes the run with a rule + a one-line tally so the user sees the

package/dist/commands/work.d.ts

@@ -1,6 +1,7 @@
 import type { SpawnOptions, ChildProcess } from "node:child_process";
 import { ZenormClient } from "../api/client.js";
 import type { SpecTaskRecord } from "../api/types.js";
+import { type TtyProbe } from "./interactive-agent.js";
 /**
  * Agents whose subprocess runner slice 3 will wire up. Validated here so an
  * unknown/missing `--agent` fails loud rather than silently defaulting (project
@@ -35,6 +36,13 @@ export interface TaskRunner {
  * Exported for unit testing.
  */
 export declare function buildHandoffPrompt(task: SpecTaskRecord): string;
+/**
+ * The interactive (coding-agent mode) handoff prompt. Same spec-mode handoff as
+ * the headless prompt, MINUS the "work non-interactively" instruction: in this
+ * mode the agent runs as a live session the operator drives, so it SHOULD pause
+ * for input. Exported for unit testing.
+ */
+export declare function buildInteractiveHandoffPrompt(task: SpecTaskRecord): string;
 /**
  * The headless subprocess invocation for a given agent + task. Pure (no
  * side effects) so it can be unit-tested directly without spawning anything.
@@ -47,7 +55,37 @@ export declare function buildHandoffPrompt(task: SpecTaskRecord): string;
  *
  * Exported for unit testing.
  */
-export declare function buildAgentCommand(agent: SupportedAgent, task: SpecTaskRecord): {
+export declare function buildAgentCommand(agent: SupportedAgent, task: SpecTaskRecord, model?: string): {
+    command: string;
+    args: string[];
+};
+/**
+ * The INTERACTIVE invocation for a given agent + task: launch the agent as a
+ * live session (NOT headless) seeded with the spec handoff, so the operator
+ * works with it directly in its own TUI. Pure (no side effects) so it can be
+ * unit-tested without spawning anything.
+ *
+ * Unlike `buildAgentCommand`, there is no `-p`/`exec`/`--json` and no
+ * stream-json: both agents start an interactive session by default, and the
+ * agent's own TUI renders straight to the inherited terminal (so there is no
+ * raw JSON event stream for us to re-render, and nothing to dump as raw text).
+ * - claude: `claude --permission-mode auto [--model <m>] "<prompt>"`
+ *   (interactive by default; `-p` would make it headless, so it is deliberately
+ *   absent). `--permission-mode auto` runs the background classifier that
+ *   auto-approves safe actions and only blocks destructive ones, so the
+ *   operator is not interrupted by a permission prompt on every gated tool call
+ *   — same guardrail the headless path uses, just keeping the session live.
+ * - codex:  `codex --ask-for-approval never --sandbox workspace-write [-m <m>]
+ *   "<prompt>"` (interactive by default; the `exec` subcommand is what makes it
+ *   non-interactive, so it is deliberately absent). `--ask-for-approval never`
+ *   is codex's full-auto: the operator is never interrupted by an approval
+ *   prompt, while `--sandbox workspace-write` still confines writes to the
+ *   workspace (NOT `--dangerously-bypass-approvals-and-sandbox`, which would
+ *   drop the sandbox entirely).
+ *
+ * Exported for unit testing.
+ */
+export declare function buildInteractiveAgentCommand(agent: SupportedAgent, task: SpecTaskRecord, model?: string): {
     command: string;
     args: string[];
 };
@@ -56,6 +94,31 @@ export declare function buildAgentCommand(agent: SupportedAgent, task: SpecTaskR
  * unit-tested without launching a real agent.
  */
 export type SpawnFn = (command: string, args: string[], options: SpawnOptions) => ChildProcess;
+/**
+ * Snapshot the working tree's changed-file state. Injectable so the interactive
+ * post-agent summary can be unit-tested without a real git repo; the default is
+ * a real `git status --porcelain` in the current repo. Returns the raw porcelain
+ * text (each line is a 3-char status prefix + path); `diffTouchedFiles` parses
+ * it into the touched-file set.
+ */
+export type GitStatusFn = () => string;
+/**
+ * Read the claimed task's CURRENT server-side status (e.g. `done` once the agent
+ * ran `zenorm task complete` inside the session). Injectable so the summary can
+ * be unit-tested without HTTP. Returns the status, or `"unknown"` when the read
+ * could not be made — the summary must never block worker release on a status
+ * read, so this is the one sanctioned soft-fallback (the caller also warns).
+ */
+export type FetchTaskStatusFn = (task: SpecTaskRecord) => Promise<SpecTaskRecord["status"]>;
+/**
+ * Diff two `git status --porcelain` snapshots into the set of files the agent
+ * touched during the session. We compare the porcelain LINE per path across
+ * before/after: a path is "touched" when its line differs (added, removed, or
+ * its status code changed). This deliberately IGNORES pre-existing dirt whose
+ * status did not change during the session (so unrelated stray files already in
+ * the tree don't pollute the summary). Returns a sorted, deduped path list.
+ */
+export declare function diffTouchedFiles(before: string, after: string): string[];
 /**
  * The real runner: spawns the chosen coding agent headlessly against the
  * claimed task and awaits its exit.
@@ -69,9 +132,48 @@ export type SpawnFn = (command: string, args: string[], options: SpawnOptions) =
 export declare class AgentRunner implements TaskRunner {
     private readonly agent;
     private readonly spawnFn;
+    private readonly model?;
+    private readonly interactive;
+    private readonly gitStatus;
+    private readonly fetchTaskStatus?;
     readonly agentName: SupportedAgent;
-    constructor(agent: SupportedAgent, spawnFn?: SpawnFn);
+    constructor(agent: SupportedAgent, spawnFn?: SpawnFn, model?: string | undefined, interactive?: boolean, gitStatus?: GitStatusFn, fetchTaskStatus?: FetchTaskStatusFn | undefined);
     run(task: SpecTaskRecord): Promise<void>;
+    /**
+     * Default (non-interactive) path — UNCHANGED behavior: spawn the agent
+     * headlessly, pipe + re-render its JSON event stream, await its exit.
+     */
+    private runHeadless;
+    /**
+     * Coding-agent (interactive) path. Launch the agent as a LIVE session via
+     * `InteractiveAgent`: inherited stdio so the agent's own TUI owns the terminal
+     * (no piping, no re-render — and therefore no raw text dumping), seeded with
+     * the spec handoff. The operator works with it; when they close the agent it
+     * exits, which resolves this run and RELEASES THE WORKER so the loop claims
+     * the next task. A clean operator exit (code 0) is success; a crash/non-zero
+     * exit is still a loud failure.
+     */
+    private runInteractive;
+    /**
+     * Print the ONE-LINE post-agent change summary, then RESOLVE (releasing the
+     * worker) — in that order, per the spec constraint "Summary before worker
+     * release". Computes the touched-file set from the before/after porcelain
+     * snapshots and reads the claimed task's current server-side status.
+     *
+     * Robustness: this runs after a CLEAN agent exit, so it must NEVER turn that
+     * success into a failure. The whole body is wrapped so `resolve()` always
+     * fires even if the summary work throws. The status read is the one sanctioned
+     * soft-fallback — a fetch failure warns and reports `unknown` rather than
+     * blocking the release; an absent status fetcher (no client wired, e.g. unit
+     * tests) is silently `unknown`.
+     */
+    private summarizeThenRelease;
+    /**
+     * Shared exit/error handling for both paths: ENOENT → install hint, non-zero
+     * exit → loud failure, code 0 → success (releases the worker). `settled`
+     * guards against a double-settle if error and exit both fire.
+     */
+    private wireChild;
 }
 /**
  * `--dry-run` runner: prints the exact headless command + handoff prompt it
@@ -80,8 +182,9 @@ export declare class AgentRunner implements TaskRunner {
  */
 export declare class DryRunRunner implements TaskRunner {
     private readonly agent;
+    private readonly model?;
     readonly agentName: SupportedAgent;
-    constructor(agent: SupportedAgent);
+    constructor(agent: SupportedAgent, model?: string | undefined);
     run(task: SpecTaskRecord): Promise<void>;
 }
 /**
@@ -99,7 +202,18 @@ export declare function parseGitRemote(url: string): {
 interface DaemonDeps {
     runner?: TaskRunner;
     client?: ZenormClient;
+    ttyProbe?: TtyProbe;
 }
+/**
+ * Resolve whether interactive mode is on. Opt-in is explicit by design (the
+ * spec keeps existing runs non-interactive unless enabled): the `--interactive`
+ * flag, or `interactive: true` in `.zenorm.json`. The flag wins; config only
+ * supplies the default when the flag is absent. A bad config value already
+ * threw in `validateConfig`, so this never silently coerces.
+ */
+export declare function resolveInteractive(flagPassed: boolean, config: {
+    interactive?: boolean;
+} | null): boolean;
 /**
  * The poll loop, isolated from arg/repo resolution so it can be unit-tested
  * with an injected client and runner. Returns the number of tasks processed.

package/dist/commands/work.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAqB,cAAc,EAAgB,MAAM,iBAAiB,CAAC;AAgBvF;;;;GAIG;AACH,QAAA,MAAM,gBAAgB,8BAA+B,CAAC;AACtD,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AA0BxD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAeD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAmB/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,cAAc,GACnB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAsCrC;AAQD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB;;;;;;;;;GASG;AACH,qBAAa,WAAY,YAAW,UAAU;IAI1C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,SAAgB,SAAS,EAAE,cAAc,CAAC;gBAGvB,KAAK,EAAE,cAAc,EAErB,OAAO,GAAE,OAAe;IAK3C,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CA0EzC;AAED;;;;GAIG;AACH,qBAAa,YAAa,YAAW,UAAU;IAGjC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,SAAgB,SAAS,EAAE,cAAc,CAAC;gBAEb,KAAK,EAAE,cAAc;IAIlD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAOzC;AAUD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAmD3E;AA4BD,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AA+GD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CA2HlB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CA0Bf"}
+{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,wBAAwB,CAAC;AAehC;;;;GAIG;AACH,QAAA,MAAM,gBAAgB,8BAA+B,CAAC;AACtD,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAuCxD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAeD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAS/D;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAG1E;AAsBD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,cAAc,EACpB,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAwDrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,cAAc,EACpB,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA2BrC;AAQD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AAuB5F;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBxE;AAED;;;;;;;;;GASG;AACH,qBAAa,WAAY,YAAW,UAAU;IAI1C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAOvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAI5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAM1B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAxBnC,SAAgB,SAAS,EAAE,cAAc,CAAC;gBAGvB,KAAK,EAAE,cAAc,EAErB,OAAO,GAAE,OAAe,EAExB,KAAK,CAAC,EAAE,MAAM,YAAA,EAOd,WAAW,UAAQ,EAInB,SAAS,GAAE,WAA2B,EAMtC,eAAe,CAAC,EAAE,iBAAiB,YAAA;IAKtD,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC;;;OAGG;IACH,OAAO,CAAC,WAAW;IAkCnB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAiCtB;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAwClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;CA+ClB;AAED;;;;GAIG;AACH,qBAAa,YAAa,YAAW,UAAU;IAI3C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAJzB,SAAgB,SAAS,EAAE,cAAc,CAAC;gBAGvB,KAAK,EAAE,cAAc,EACrB,KAAK,CAAC,EAAE,MAAM,YAAA;IAKjC,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAOzC;AAUD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAmD3E;AA4BD,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,YAAY,CAAC;IAGtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAwFD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,OAAO,EACnB,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GACvC,OAAO,CAGT;AAoED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CA2HlB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CA+Df"}

package/dist/commands/work.js

@@ -3,7 +3,9 @@ import { execFileSync, spawn } from "node:child_process";
 import { ZenormClient } from "../api/client.js";
 import { CliError } from "../util/errors.js";
 import { log } from "../util/logger.js";
-import { LineSplitter, claudeRenderer, codexRenderer, daemonBanner, failureBanner, sessionSummary, statusLine, taskHeader, taskOutcome, } from "./work-render.js";
+import { loadConfig } from "../config/loader.js";
+import { InteractiveAgent, assertUsableTty, processTtyProbe, } from "./interactive-agent.js";
+import { LineSplitter, claudeRenderer, codexRenderer, daemonBanner, failureBanner, postAgentSummary, sessionSummary, statusLine, taskHeader, taskOutcome, } from "./work-render.js";
 /**
  * Agents whose subprocess runner slice 3 will wire up. Validated here so an
  * unknown/missing `--agent` fails loud rather than silently defaulting (project
@@ -19,7 +21,7 @@ const MAX_INTERVAL_SECONDS = 10;
 const DEFAULT_INTERVAL_SECONDS = 5;
 const HEARTBEAT_INTERVAL_MS = 30_000;
 const USAGE = `Usage:
-  zenorm work --agent <${SUPPORTED_AGENTS.join("|")}> [--interval <seconds>] [--once] [--dry-run]
+  zenorm work --agent <${SUPPORTED_AGENTS.join("|")}> [--model <model>] [--interval <seconds>] [--once] [--dry-run] [--interactive]
 
 Runs a daemon that claims and processes ready tasks for the current git
 repository (resolved from \`git remote get-url origin\`), oldest-first, one at a
@@ -28,10 +30,23 @@ bundled ZeNorm \`execute-task\` skill and posts the task outcome itself.
 
 Options:
   --agent <agent>      Agent to run each task with. Required. One of: ${SUPPORTED_AGENTS.join(", ")}
+  --model <model>      Model the agent runs each task with (alias e.g. opus,
+                       sonnet, or a full model id). Optional; when omitted the
+                       agent uses its own configured default. For claude this
+                       also retargets the server-side advisor tool to the same
+                       model, so a gated \`advisorModel\` no longer 400s the run.
   --interval <seconds> Poll interval when idle. Default ${DEFAULT_INTERVAL_SECONDS}, max ${MAX_INTERVAL_SECONDS}.
   --once               Process at most one claim (or one idle poll) then exit.
   --dry-run            Print the agent command + handoff prompt each task would
-                       run instead of spawning the agent.`;
+                       run instead of spawning the agent.
+  --interactive        Opt into coding-agent mode: instead of running each task
+                       headlessly, launch the active coding agent (the one named
+                       by --agent) as a LIVE interactive session seeded with the
+                       spec handoff. Work with the agent, then exit it to release
+                       the worker and continue to the next task. Local terminal
+                       only — requires a usable TTY and fails fast without one.
+                       Can also be enabled per project via \`interactive: true\`
+                       in .zenorm.json.`;
 /**
  * Headless install hints, surfaced when an agent binary is missing so the
  * failure is actionable rather than a bare ENOENT.
@@ -60,6 +75,26 @@ const AGENT_INSTALL_HINT = {
  */
 export function buildHandoffPrompt(task) {
     const zenormCli = process.env["ZENORM_CLI"]?.trim() || "zenorm";
+    return [
+        ...handoffPromptBody(task, zenormCli),
+        // Headless runs have no operator to wait on — tell the agent to drive
+        // straight through without pausing for input. The interactive variant
+        // (buildInteractiveHandoffPrompt) deliberately omits this line.
+        "Work non-interactively; do not wait for further input.",
+    ].join("\n");
+}
+/**
+ * The interactive (coding-agent mode) handoff prompt. Same spec-mode handoff as
+ * the headless prompt, MINUS the "work non-interactively" instruction: in this
+ * mode the agent runs as a live session the operator drives, so it SHOULD pause
+ * for input. Exported for unit testing.
+ */
+export function buildInteractiveHandoffPrompt(task) {
+    const zenormCli = process.env["ZENORM_CLI"]?.trim() || "zenorm";
+    return handoffPromptBody(task, zenormCli).join("\n");
+}
+/** Shared spec-mode handoff lines for both the headless and interactive prompts. */
+function handoffPromptBody(task, zenormCli) {
     return [
         `/zenorm ${task.specId}`,
         "",
@@ -74,9 +109,8 @@ export function buildHandoffPrompt(task) {
         "ready tasks and implement it alongside the rest. Implement everything",
         "end-to-end in the current repository working directory using the existing",
         "ZeNorm execute workflow, completing each task via the normal",
-        `\`${zenormCli} task complete <task-id>\` flow as you finish it. Work`,
-        "non-interactively; do not wait for further input.",
-    ].join("\n");
+        `\`${zenormCli} task complete <task-id>\` flow as you finish it.`,
+    ];
 }
 /**
  * The headless subprocess invocation for a given agent + task. Pure (no
@@ -90,7 +124,7 @@ export function buildHandoffPrompt(task) {
  *
  * Exported for unit testing.
  */
-export function buildAgentCommand(agent, task) {
+export function buildAgentCommand(agent, task, model) {
     const prompt = buildHandoffPrompt(task);
     switch (agent) {
         case "claude":
@@ -116,11 +150,29 @@ export function buildAgentCommand(agent, task) {
                     "--verbose",
                     "--permission-mode",
                     "auto",
+                    // --model sets the main session model; it does NOT retarget the
+                    // server-side advisor tool, which carries its OWN model from the
+                    // `advisorModel` setting. If that setting points at a model the
+                    // account can't access (e.g. a gated `claude-fable-5`), EVERY turn
+                    // 400s with `tools.N.model: ... is not available`. So when the user
+                    // pins a model we also override `advisorModel` for THIS session via
+                    // --settings, keeping the advisor on a model we know is reachable.
+                    ...(model
+                        ? [
+                            "--model",
+                            model,
+                            "--settings",
+                            JSON.stringify({ advisorModel: model }),
+                        ]
+                        : []),
                     prompt,
                 ],
             };
         case "codex":
-            return { command: "codex", args: ["exec", "--json", prompt] };
+            return {
+                command: "codex",
+                args: ["exec", "--json", ...(model ? ["-m", model] : []), prompt],
+            };
         default: {
             // Exhaustiveness guard — fail loud if SUPPORTED_AGENTS grows without a
             // matching headless invocation here (no error-masking default).
@@ -129,11 +181,112 @@ export function buildAgentCommand(agent, task) {
         }
     }
 }
+/**
+ * The INTERACTIVE invocation for a given agent + task: launch the agent as a
+ * live session (NOT headless) seeded with the spec handoff, so the operator
+ * works with it directly in its own TUI. Pure (no side effects) so it can be
+ * unit-tested without spawning anything.
+ *
+ * Unlike `buildAgentCommand`, there is no `-p`/`exec`/`--json` and no
+ * stream-json: both agents start an interactive session by default, and the
+ * agent's own TUI renders straight to the inherited terminal (so there is no
+ * raw JSON event stream for us to re-render, and nothing to dump as raw text).
+ * - claude: `claude --permission-mode auto [--model <m>] "<prompt>"`
+ *   (interactive by default; `-p` would make it headless, so it is deliberately
+ *   absent). `--permission-mode auto` runs the background classifier that
+ *   auto-approves safe actions and only blocks destructive ones, so the
+ *   operator is not interrupted by a permission prompt on every gated tool call
+ *   — same guardrail the headless path uses, just keeping the session live.
+ * - codex:  `codex --ask-for-approval never --sandbox workspace-write [-m <m>]
+ *   "<prompt>"` (interactive by default; the `exec` subcommand is what makes it
+ *   non-interactive, so it is deliberately absent). `--ask-for-approval never`
+ *   is codex's full-auto: the operator is never interrupted by an approval
+ *   prompt, while `--sandbox workspace-write` still confines writes to the
+ *   workspace (NOT `--dangerously-bypass-approvals-and-sandbox`, which would
+ *   drop the sandbox entirely).
+ *
+ * Exported for unit testing.
+ */
+export function buildInteractiveAgentCommand(agent, task, model) {
+    const prompt = buildInteractiveHandoffPrompt(task);
+    switch (agent) {
+        case "claude":
+            return {
+                command: "claude",
+                args: ["--permission-mode", "auto", ...(model ? ["--model", model] : []), prompt],
+            };
+        case "codex":
+            return {
+                command: "codex",
+                args: [
+                    "--ask-for-approval",
+                    "never",
+                    "--sandbox",
+                    "workspace-write",
+                    ...(model ? ["-m", model] : []),
+                    prompt,
+                ],
+            };
+        default: {
+            // Exhaustiveness guard — fail loud if SUPPORTED_AGENTS grows without a
+            // matching interactive invocation here (no error-masking default).
+            const never = agent;
+            throw new CliError(`No interactive invocation defined for agent "${String(never)}".`);
+        }
+    }
+}
 /** The transcript renderer for each agent's JSON event stream. */
 const AGENT_RENDERER = {
     claude: claudeRenderer,
     codex: codexRenderer,
 };
+/** The real working-tree snapshot: `git status --porcelain` in the current repo. */
+function realGitStatus() {
+    return execFileSync("git", ["status", "--porcelain"], {
+        cwd: process.cwd(),
+        encoding: "utf-8",
+    });
+}
+/**
+ * Parse one `git status --porcelain` line into its path. The format is a 2-char
+ * status code + a space, then the path; a rename/copy renders as `old -> new`,
+ * for which we take the NEW path (`new`). Returns null for a blank line.
+ */
+function porcelainPath(line) {
+    if (line.trim().length === 0)
+        return null;
+    // Drop the 3-char status prefix ("XY ").
+    const rest = line.slice(3);
+    const arrow = rest.indexOf(" -> ");
+    return arrow >= 0 ? rest.slice(arrow + 4) : rest;
+}
+/**
+ * Diff two `git status --porcelain` snapshots into the set of files the agent
+ * touched during the session. We compare the porcelain LINE per path across
+ * before/after: a path is "touched" when its line differs (added, removed, or
+ * its status code changed). This deliberately IGNORES pre-existing dirt whose
+ * status did not change during the session (so unrelated stray files already in
+ * the tree don't pollute the summary). Returns a sorted, deduped path list.
+ */
+export function diffTouchedFiles(before, after) {
+    const index = (porcelain) => {
+        const map = new Map();
+        for (const line of porcelain.split("\n")) {
+            const path = porcelainPath(line);
+            if (path !== null)
+                map.set(path, line);
+        }
+        return map;
+    };
+    const beforeLines = index(before);
+    const afterLines = index(after);
+    const touched = new Set();
+    for (const path of new Set([...beforeLines.keys(), ...afterLines.keys()])) {
+        if (beforeLines.get(path) !== afterLines.get(path))
+            touched.add(path);
+    }
+    return [...touched].sort();
+}
 /**
  * The real runner: spawns the chosen coding agent headlessly against the
  * claimed task and awaits its exit.
@@ -147,16 +300,50 @@ const AGENT_RENDERER = {
 export class AgentRunner {
     agent;
     spawnFn;
+    model;
+    interactive;
+    gitStatus;
+    fetchTaskStatus;
     agentName;
     constructor(agent, 
     // Injectable for tests; defaults to node:child_process spawn.
-    spawnFn = spawn) {
+    spawnFn = spawn, 
+    // Optional model pin, threaded into the agent invocation.
+    model, 
+    // When true, coding-agent (interactive) mode is on: instead of running the
+    // agent headlessly and re-rendering its JSON event stream, the agent is
+    // launched as a LIVE session that owns the terminal (inherited stdio). The
+    // operator works with it until they close it; its exit releases the worker.
+    // The caller is responsible for having already passed the fail-fast TTY
+    // check (assertUsableTty).
+    interactive = false, 
+    // Working-tree snapshot for the interactive post-agent summary. Injectable
+    // for tests; defaults to a real `git status --porcelain`. Only the
+    // interactive path reads it (before open() + after a clean exit).
+    gitStatus = realGitStatus, 
+    // Reads the claimed task's current server-side status for the summary.
+    // Optional: when absent (e.g. the existing interactive unit tests that
+    // construct the runner with no client) the summary falls back to status
+    // `unknown` without warning — only a real fetch FAILURE warns. Wired to the
+    // real client in `workCommand`.
+    fetchTaskStatus) {
         this.agent = agent;
         this.spawnFn = spawnFn;
+        this.model = model;
+        this.interactive = interactive;
+        this.gitStatus = gitStatus;
+        this.fetchTaskStatus = fetchTaskStatus;
         this.agentName = agent;
     }
     run(task) {
-        const { command, args } = buildAgentCommand(this.agent, task);
+        return this.interactive ? this.runInteractive(task) : this.runHeadless(task);
+    }
+    /**
+     * Default (non-interactive) path — UNCHANGED behavior: spawn the agent
+     * headlessly, pipe + re-render its JSON event stream, await its exit.
+     */
+    runHeadless(task) {
+        const { command, args } = buildAgentCommand(this.agent, task, this.model);
         const renderer = AGENT_RENDERER[this.agent];
         return new Promise((resolve, reject) => {
             // Pipe the agent's stdout so we can re-render its JSON event stream into a
@@ -167,16 +354,13 @@ export class AgentRunner {
                 cwd: process.cwd(),
                 stdio: ["ignore", "pipe", "inherit"],
             });
-            // Render stdout line-by-line. Transcript lines go to the user's stdout so
-            // the work session reads like the agent's own interactive session.
+            // Render stdout line-by-line to the user's stdout so the work session
+            // reads like the agent's own interactive session.
             const splitter = new LineSplitter();
-            const emit = (line) => {
-                process.stdout.write(`${line}\n`);
-            };
             const renderLines = (lines) => {
                 for (const raw of lines) {
                     for (const out of renderer(raw))
-                        emit(out);
+                        process.stdout.write(`${out}\n`);
                 }
             };
             child.stdout?.setEncoding("utf-8");
@@ -186,30 +370,125 @@ export class AgentRunner {
             child.stdout?.on("end", () => {
                 renderLines(splitter.flush());
             });
-            let settled = false;
-            child.on("error", (err) => {
-                if (settled)
-                    return;
-                settled = true;
-                if (err.code === "ENOENT") {
-                    reject(new CliError(`Could not launch agent "${this.agent}": \`${command}\` was not found on PATH.\n\n` +
-                        AGENT_INSTALL_HINT[this.agent]));
-                    return;
+            this.wireChild(child, command, task, resolve, reject);
+        });
+    }
+    /**
+     * Coding-agent (interactive) path. Launch the agent as a LIVE session via
+     * `InteractiveAgent`: inherited stdio so the agent's own TUI owns the terminal
+     * (no piping, no re-render — and therefore no raw text dumping), seeded with
+     * the spec handoff. The operator works with it; when they close the agent it
+     * exits, which resolves this run and RELEASES THE WORKER so the loop claims
+     * the next task. A clean operator exit (code 0) is success; a crash/non-zero
+     * exit is still a loud failure.
+     */
+    runInteractive(task) {
+        const { command, args } = buildInteractiveAgentCommand(this.agent, task, this.model);
+        // A fresh session per task (the daemon reuses one runner across tasks, so
+        // the single-operator InteractiveAgent instance must not be shared).
+        const session = new InteractiveAgent(command, args, this.spawnFn);
+        // Snapshot the working tree BEFORE the agent runs so we can diff it against
+        // the post-session state and report which files the agent touched.
+        const before = this.gitStatus();
+        return new Promise((resolve, reject) => {
+            let child;
+            try {
+                // open() enforces the single-operator invariant and local-only spawn
+                // options, then spawns the agent. A throw here (e.g. local-option guard)
+                // means nothing was spawned, so there is no child to orphan.
+                child = session.open();
+            }
+            catch (err) {
+                reject(err instanceof Error ? err : new CliError(String(err)));
+                return;
+            }
+            // On a CLEAN exit, print the one-line post-agent summary BEFORE releasing
+            // the worker (the real `resolve` fires only inside summarizeThenRelease).
+            // `wireChild`'s exit handler stays synchronous (shared with the headless
+            // path); we hand it a wrapper that defers the resolve until the summary is
+            // written. A non-zero exit still rejects through `wireChild` unchanged.
+            const releaseAfterSummary = () => {
+                void this.summarizeThenRelease(task, before, resolve);
+            };
+            this.wireChild(child, command, task, releaseAfterSummary, reject);
+        });
+    }
+    /**
+     * Print the ONE-LINE post-agent change summary, then RESOLVE (releasing the
+     * worker) — in that order, per the spec constraint "Summary before worker
+     * release". Computes the touched-file set from the before/after porcelain
+     * snapshots and reads the claimed task's current server-side status.
+     *
+     * Robustness: this runs after a CLEAN agent exit, so it must NEVER turn that
+     * success into a failure. The whole body is wrapped so `resolve()` always
+     * fires even if the summary work throws. The status read is the one sanctioned
+     * soft-fallback — a fetch failure warns and reports `unknown` rather than
+     * blocking the release; an absent status fetcher (no client wired, e.g. unit
+     * tests) is silently `unknown`.
+     */
+    async summarizeThenRelease(task, before, resolve) {
+        try {
+            const after = this.gitStatus();
+            const filesTouched = diffTouchedFiles(before, after);
+            let status = "unknown";
+            if (this.fetchTaskStatus) {
+                try {
+                    status = await this.fetchTaskStatus(task);
                 }
-                reject(new CliError(`Failed to launch agent "${this.agent}" (\`${command}\`): ${err.message}`));
-            });
-            child.on("exit", (code, signal) => {
-                if (settled)
-                    return;
-                settled = true;
-                if (code === 0) {
-                    resolve();
-                    return;
+                catch (err) {
+                    // The status read must not block worker release — warn and fall back
+                    // to `unknown` (the one allowed soft-fallback) instead of throwing.
+                    log.warn(`Could not read task ${shortId(task.id)} status for summary`, {
+                        error: err instanceof Error ? err.message : String(err),
+                    });
                 }
-                const detail = code !== null ? `exited with code ${code}` : `was terminated by signal ${signal}`;
-                // Fail loud — a non-zero/aborted agent run is a FAILURE, never success.
-                reject(new CliError(`Agent "${this.agent}" (\`${command}\`) ${detail} while running task ${shortId(task.id)}.`));
+            }
+            process.stdout.write(`${postAgentSummary({
+                filesTouched,
+                status,
+                shortTaskId: shortId(task.id),
+            })}\n`);
+        }
+        catch (err) {
+            // A summary failure must never convert a clean agent exit into a failure;
+            // warn and still release the worker below.
+            log.warn(`Could not print post-agent summary for task ${shortId(task.id)}`, {
+                error: err instanceof Error ? err.message : String(err),
             });
+        }
+        finally {
+            resolve();
+        }
+    }
+    /**
+     * Shared exit/error handling for both paths: ENOENT → install hint, non-zero
+     * exit → loud failure, code 0 → success (releases the worker). `settled`
+     * guards against a double-settle if error and exit both fire.
+     */
+    wireChild(child, command, task, resolve, reject) {
+        let settled = false;
+        child.on("error", (err) => {
+            if (settled)
+                return;
+            settled = true;
+            if (err.code === "ENOENT") {
+                reject(new CliError(`Could not launch agent "${this.agent}": \`${command}\` was not found on PATH.\n\n` +
+                    AGENT_INSTALL_HINT[this.agent]));
+                return;
+            }
+            reject(new CliError(`Failed to launch agent "${this.agent}" (\`${command}\`): ${err.message}`));
+        });
+        child.on("exit", (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            const detail = code !== null ? `exited with code ${code}` : `was terminated by signal ${signal}`;
+            // Fail loud — a non-zero/aborted agent run is a FAILURE, never success.
+            reject(new CliError(`Agent "${this.agent}" (\`${command}\`) ${detail} while running task ${shortId(task.id)}.`));
         });
     }
 }
@@ -220,13 +499,15 @@ export class AgentRunner {
  */
 export class DryRunRunner {
     agent;
+    model;
     agentName;
-    constructor(agent) {
+    constructor(agent, model) {
         this.agent = agent;
+        this.model = model;
         this.agentName = agent;
     }
     run(task) {
-        const { command, args } = buildAgentCommand(this.agent, task);
+        const { command, args } = buildAgentCommand(this.agent, task, this.model);
         log.info(`[dry-run] would spawn agent "${this.agent}" for task ${shortId(task.id)}`);
         log.plain(`  cwd: ${process.cwd()}`);
         log.plain(`  command: ${command} ${formatDryRunArgs(args)}`);
@@ -318,9 +599,11 @@ function parseWorkArgs(argv) {
             args: argv,
             options: {
                 agent: { type: "string" },
+                model: { type: "string" },
                 interval: { type: "string" },
                 once: { type: "boolean" },
                 "dry-run": { type: "boolean" },
+                interactive: { type: "boolean" },
             },
             strict: true,
         }));
@@ -336,6 +619,17 @@ function parseWorkArgs(argv) {
     if (!SUPPORTED_AGENTS.includes(agent)) {
         throw new CliError(`Unsupported agent "${agent}".\n\nSupported agents: ${SUPPORTED_AGENTS.join(", ")}`);
     }
+    // --model is optional: when omitted the agent uses its own configured
+    // default. But an explicit empty `--model ""` is a mistake we fail loud on
+    // rather than silently passing a blank model through to the agent.
+    const rawModel = values["model"];
+    let model;
+    if (rawModel !== undefined) {
+        if (rawModel.trim() === "") {
+            throw new CliError(`Invalid --model "${rawModel}". Provide a model alias (e.g. opus, sonnet) or full model id.`);
+        }
+        model = rawModel;
+    }
     let intervalSeconds = DEFAULT_INTERVAL_SECONDS;
     const rawInterval = values["interval"];
     if (rawInterval !== undefined) {
@@ -353,11 +647,25 @@ function parseWorkArgs(argv) {
         // Validated above against SUPPORTED_AGENTS; the readonly-tuple `includes`
         // check above does not narrow `string`, so assert the proven type here.
         agent: agent,
+        model,
         intervalMs: intervalSeconds * 1000,
         once: values["once"] === true,
         dryRun: values["dry-run"] === true,
+        interactive: values["interactive"] === true,
     };
 }
+/**
+ * Resolve whether interactive mode is on. Opt-in is explicit by design (the
+ * spec keeps existing runs non-interactive unless enabled): the `--interactive`
+ * flag, or `interactive: true` in `.zenorm.json`. The flag wins; config only
+ * supplies the default when the flag is absent. A bad config value already
+ * threw in `validateConfig`, so this never silently coerces.
+ */
+export function resolveInteractive(flagPassed, config) {
+    if (flagPassed)
+        return true;
+    return config?.interactive === true;
+}
 /** Write daemon-only meta output (e.g. the dry-run banner) to stderr. */
 function writeDaemonLine(line) {
     process.stderr.write(`${line}\n`);
@@ -372,6 +680,22 @@ async function releaseTaskToTodo(client, task) {
         });
     }
 }
+/**
+ * Read the claimed task's CURRENT server-side status for the interactive
+ * post-agent summary. `GET /v1/specs/:specId/tasks` returns the spec's tasks;
+ * we find this one by id and return its status. Throws if the task is missing
+ * from the response (fail loud rather than masking a wrong/empty list) — the
+ * caller (`summarizeThenRelease`) catches and degrades to `unknown` so a status
+ * read never blocks worker release.
+ */
+async function fetchTaskStatus(client, task) {
+    const { tasks } = await client.get(`/v1/specs/${task.specId}/tasks`);
+    const found = tasks.find((t) => t.id === task.id);
+    if (!found) {
+        throw new CliError(`Task ${shortId(task.id)} not found in spec ${task.specId} tasks list.`);
+    }
+    return found.status;
+}
 async function heartbeatTask(client, task) {
     try {
         await client.post(`/v1/tasks/${task.id}/heartbeat`, {});
@@ -517,16 +841,42 @@ export async function workCommand(argv, deps) {
     // Fatal (CliError) failures — bad args, not a git repo — abort BEFORE the
     // loop starts so they surface immediately rather than being swallowed as a
     // transient blip.
-    const { agent, intervalMs, once, dryRun } = parseWorkArgs(argv);
+    const { agent, model, intervalMs, once, dryRun, interactive: interactiveFlag } = parseWorkArgs(argv);
     const repo = resolveCurrentRepo();
+    // Resolve the interactive opt-in (flag OR project config). `loadConfig` walks
+    // up from cwd for `.zenorm.json`; a malformed config throws (no masked errors).
+    const interactive = resolveInteractive(interactiveFlag, loadConfig());
+    if (interactive && dryRun) {
+        // --dry-run never spawns an agent, so there is no live agent session to drop
+        // into. Refuse the combination loudly rather than silently ignoring one.
+        throw new CliError("`--interactive` cannot be combined with `--dry-run`: dry-run never " +
+            "launches an agent, so there is no interactive coding-agent session to open.");
+    }
+    // Fail-fast gate (spec: "Fail-fast without usable TTY"). Done BEFORE the loop
+    // and BEFORE any claim so a misconfigured interactive run errors immediately
+    // instead of claiming a task and then hanging. Non-interactive runs skip this
+    // entirely — they never require a TTY and never prompt.
+    if (interactive) {
+        assertUsableTty(deps?.ttyProbe ?? processTtyProbe());
+    }
     const client = deps?.client ?? new ZenormClient();
-    const runner = deps?.runner ?? (dryRun ? new DryRunRunner(agent) : new AgentRunner(agent));
+    const runner = deps?.runner ??
+        (dryRun
+            ? new DryRunRunner(agent, model)
+            : new AgentRunner(agent, spawn, model, interactive, 
+            // Real working-tree snapshot for the interactive post-agent summary.
+            realGitStatus, 
+            // Real status read: list the spec's tasks and pick out this task's
+            // current status (it is likely `done` once the agent inside the
+            // session ran `zenorm task complete`).
+            (task) => fetchTaskStatus(client, task)));
     // Startup banner — shown on EVERY run (not just --dry-run) so a real session
     // announces what it's claiming for instead of sitting silent until the first
     // task lands. Written to stderr so it never interleaves with the agent
     // transcript when stdout is piped to a file.
     writeDaemonLine(daemonBanner({
         agent,
+        model,
         repo: `${repo.owner}/${repo.name}`,
         intervalSeconds: intervalMs / 1000,
         once,

package/dist/config/schema.d.ts

@@ -1,6 +1,16 @@
 export interface ZenormConfig {
     org?: string;
     apiUrl?: string;
+    /**
+     * Opt into coding-agent mode for local `zenorm work` runs: instead of running
+     * each task headlessly, launch the active coding agent (the one named by
+     * `--agent`) as a LIVE interactive session seeded with the spec handoff. The
+     * operator works with the agent, then closes it to release the worker and
+     * continue to the next task. Off by default; the `--interactive` flag
+     * overrides this. Requires a usable local TTY at run time (fails loud
+     * otherwise — see `interactive-agent.ts`).
+     */
+    interactive?: boolean;
 }
 export declare function validateConfig(raw: unknown): ZenormConfig;
 //# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAuBzD"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CA8BzD"}

package/dist/config/schema.js

@@ -17,5 +17,11 @@ export function validateConfig(raw) {
         }
         config.apiUrl = obj["apiUrl"];
     }
+    if ("interactive" in obj) {
+        if (typeof obj["interactive"] !== "boolean") {
+            throw new CliError('.zenorm.json: "interactive" must be a boolean');
+        }
+        config.interactive = obj["interactive"];
+    }
     return config;
 }

package/dist/util/markdown.d.ts

@@ -21,4 +21,20 @@ export type SpecBlock = {
  * the agent sees a clean "## goals", "## acceptance_criterion" structure.
  */
 export declare function blocksToMarkdown(blocks: SpecBlock[]): string;
+export type AttachmentRecord = {
+    id: string;
+    fileName: string;
+    fileSize: number;
+    mimeType: string;
+    status: string;
+};
+/**
+ * Render the spec's ready attachments as an "## Attachments" markdown section
+ * for the worker work context. Lists fileName — mimeType — pretty size only;
+ * the file CONTENT/bytes are never inlined (binary can't be, and no AC needs
+ * download). Callers must pass ONLY ready attachments — the server is the gate
+ * (the `?status=ready` filter), this renderer does not re-filter. Returns an
+ * empty string when there are none so `pull` can omit the section.
+ */
+export declare function attachmentsToMarkdown(attachments: AttachmentRecord[]): string;
 //# sourceMappingURL=markdown.d.ts.map

package/dist/util/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/util/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAmB1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAqB1E;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CA+B5D"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/util/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAmB1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAqB1E;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CA+B5D;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAmBF;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAO7E"}

package/dist/util/markdown.js

@@ -77,6 +77,40 @@ export function blocksToMarkdown(blocks) {
     }
     return out.join("\n").trimEnd();
 }
+/**
+ * Render a human-readable byte size (e.g. 1536 → "1.5 KB"). Used for the
+ * attachments listing only — purely cosmetic.
+ */
+function prettySize(bytes) {
+    if (!Number.isFinite(bytes) || bytes < 0)
+        return `${bytes} B`;
+    const units = ["B", "KB", "MB", "GB"];
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    const rounded = unit === 0 ? value : Math.round(value * 10) / 10;
+    return `${rounded} ${units[unit]}`;
+}
+/**
+ * Render the spec's ready attachments as an "## Attachments" markdown section
+ * for the worker work context. Lists fileName — mimeType — pretty size only;
+ * the file CONTENT/bytes are never inlined (binary can't be, and no AC needs
+ * download). Callers must pass ONLY ready attachments — the server is the gate
+ * (the `?status=ready` filter), this renderer does not re-filter. Returns an
+ * empty string when there are none so `pull` can omit the section.
+ */
+export function attachmentsToMarkdown(attachments) {
+    if (attachments.length === 0)
+        return "";
+    const out = ["## Attachments", ""];
+    for (const a of attachments) {
+        out.push(`- ${a.fileName} — ${a.mimeType} — ${prettySize(a.fileSize)}`);
+    }
+    return out.join("\n");
+}
 function humanizeType(type) {
     return type.split("_").map((s) => s.charAt(0).toUpperCase() + s.slice(1)).join(" ");
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ze-norm/cli",
   "private": false,
-  "version": "0.12.0",
+  "version": "0.13.0",
   "license": "SEE LICENSE IN README.md",
   "type": "module",
   "repository": {