@ze-norm/cli 0.12.0 → 0.14.1

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IAIxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,wEAAwE;YAC1D,mBAAmB;IAMjC,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,qBAAqB,IAAI,OAAO;IAQhC,OAAO,CAAC,2BAA2B;YAIrB,QAAQ;YAqBR,OAAO;IAqEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AA0BA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiCD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IAIxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,wEAAwE;YAC1D,mBAAmB;IAMjC,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,qBAAqB,IAAI,OAAO;IAYhC,OAAO,CAAC,2BAA2B;YAIrB,QAAQ;YAqBR,OAAO;IAqEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}

package/dist/api/client.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { ApiError, AuthError, UpgradeRequiredError } from "../util/errors.js";
 import { forceRefreshToken, hasRefreshableCredentials, resolveValidToken, } from "../auth/store.js";
 import { PRODUCTION_API_URL } from "../config/defaults.js";
+import { resolveEnvironment, ZENORM_CLI_ENV_VAR } from "../config/environments.js";
 import { getCliVersion } from "../util/package.js";
 import { log } from "../util/logger.js";
 const UPGRADE_COMMAND = "npm install -g @ze-norm/cli@latest";
@@ -23,11 +24,17 @@ function resolveBaseUrl(explicit) {
     // 1. Explicit option
     if (explicit)
         return explicit;
-    // 2. Environment variable
+    // 2. Named environment via ZENORM_CLI. A selected environment is an explicit
+    //    "talk to this stack" intent, so its API URL wins over a stray
+    //    ZENORM_API_URL / .zenorm.json left over from another workflow.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().apiUrl;
+    }
+    // 3. Environment variable
     const envUrl = process.env["ZENORM_API_URL"];
     if (envUrl)
         return envUrl;
-    // 3. .zenorm.json config file in cwd
+    // 4. .zenorm.json config file in cwd
     const configPath = join(process.cwd(), ".zenorm.json");
     if (existsSync(configPath)) {
         const raw = readFileSync(configPath, "utf-8");
@@ -35,7 +42,7 @@ function resolveBaseUrl(explicit) {
         if (config.apiUrl)
             return config.apiUrl;
     }
-    // 4. Public CLI default
+    // 5. Public CLI default
     return PRODUCTION_API_URL;
 }
 export class ZenormClient {
@@ -95,9 +102,12 @@ export class ZenormClient {
     }
     /** True when requests will intentionally ignore stored credentials. */
     isUsingLocalDevBypass() {
-        return (this.isLocalBaseUrl() &&
-            process.env["ZENORM_LOCAL_DEV_BYPASS_AUTH"] === "true" &&
-            !process.env["ZENORM_API_TOKEN"]);
+        // Selecting the `local` environment implies dev-bypass — that is what the
+        // local stack is (no real Clerk sign-in, dev-bypass headers). An explicit
+        // ZENORM_LOCAL_DEV_BYPASS_AUTH still enables it for a raw localhost URL.
+        const bypassEnabled = process.env["ZENORM_LOCAL_DEV_BYPASS_AUTH"] === "true" ||
+            resolveEnvironment().name === "local";
+        return (this.isLocalBaseUrl() && bypassEnabled && !process.env["ZENORM_API_TOKEN"]);
     }
     shouldBypassAuthForLocalDev() {
         return this.isUsingLocalDevBypass();

package/dist/auth/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkUpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA6UpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}

package/dist/auth/device-flow.js

@@ -5,6 +5,7 @@ import { platform } from "node:os";
 import { URL, URLSearchParams } from "node:url";
 import { log } from "../util/logger.js";
 import { CLI_CALLBACK_PORTS, PRODUCTION_CLERK_CLIENT_ID, PRODUCTION_CLERK_ISSUER, } from "../config/defaults.js";
+import { resolveEnvironment, ZENORM_CLI_ENV_VAR } from "../config/environments.js";
 /**
  * Find the first pre-registered callback port that is free to bind. Clerk
  * matches redirect_uris exactly, so the local listener must use one of the
@@ -26,6 +27,11 @@ async function pickFreeCallbackPort() {
         `Free one of them and run \`zenorm login\` again.`);
 }
 function getClerkIssuer() {
+    // A named environment (ZENORM_CLI) selects the whole Clerk instance, so it
+    // wins over a stray ZENORM_CLERK_ISSUER from another workflow.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().clerkIssuer;
+    }
     return process.env["ZENORM_CLERK_ISSUER"] ?? PRODUCTION_CLERK_ISSUER;
 }
 /** Escape user-influenced text before interpolating into the result page HTML. */
@@ -38,6 +44,11 @@ function escapeHtml(value) {
         .replace(/'/g, "'");
 }
 function getClerkClientId() {
+    // A named environment (ZENORM_CLI) selects the whole Clerk instance, so it
+    // wins over stray ZENORM_CLERK_CLIENT_ID / VITE_CLERK_PUBLISHABLE_KEY vars.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().clerkClientId;
+    }
     return (process.env["ZENORM_CLERK_CLIENT_ID"] ??
         process.env["VITE_CLERK_PUBLISHABLE_KEY"] ??
         PRODUCTION_CLERK_CLIENT_ID);

package/dist/auth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAezD"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAezD"}

package/dist/auth/store.js

@@ -2,12 +2,18 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { refreshAccessToken } from "./device-flow.js";
+import { resolveEnvironment } from "../config/environments.js";
 import { log } from "../util/logger.js";
 // Refresh the access token this many ms before it actually expires, so an
 // in-flight request never races the expiry boundary.
 const EXPIRY_SKEW_MS = 60_000;
+// Credentials are scoped per environment so a prod login and a dev login can
+// coexist instead of overwriting each other. Prod keeps the historical
+// `credentials.json` filename for back-compat; other stacks get a suffix.
 function getCredentialsPath() {
-    return join(homedir(), ".zenorm", "credentials.json");
+    const env = resolveEnvironment();
+    const filename = env.name === "prod" ? "credentials.json" : `credentials.${env.name}.json`;
+    return join(homedir(), ".zenorm", filename);
 }
 function ensureDir() {
     const dir = join(homedir(), ".zenorm");

package/dist/commands/interactive-agent.d.ts

@@ -0,0 +1,92 @@
+import type { ChildProcess, SpawnOptions } from "node:child_process";
+/**
+ * Opt-in coding-agent mode for local `zenorm work` runs.
+ *
+ * When a user opts in (`--interactive` or `.zenorm.json` `interactive: true`),
+ * the daemon does NOT run the agent headlessly. Instead it launches the active
+ * coding agent — Claude Code by default, or Codex when the user runs with
+ * `--agent codex` — as a *live interactive session*, seeded with the
+ * `/zenorm <specId>` handoff. The agent owns the terminal directly (inherited
+ * stdio), so the operator works with it interactively until they close it; when
+ * the agent exits, the daemon releases the worker and moves on to the next task.
+ *
+ * Scope is deliberately narrow (single local operator): the agent is attached
+ * to *this* process's own stdio. There is no network listener, no second
+ * connection, nothing remote — `assertLocalAgentOptions` enforces those
+ * boundaries; this module just launches the local interactive agent.
+ */
+/**
+ * The minimal surface we need from a TTY check — injectable so tests can drive
+ * both the "usable TTY" and "no TTY" branches without a real terminal.
+ *
+ * A usable interactive agent needs BOTH stdin and stdout to be TTYs: stdin so
+ * the operator can type into the agent's TUI, stdout so it can render. We read
+ * them through this indirection rather than touching `process.std*.isTTY`
+ * inline.
+ */
+export interface TtyProbe {
+    stdinIsTty: boolean;
+    stdoutIsTty: boolean;
+}
+/** Read the real process TTY state. */
+export declare function processTtyProbe(): TtyProbe;
+/**
+ * Injectable spawn signature (mirrors `work.ts`'s `SpawnFn`) so the interactive
+ * agent can be unit-tested without launching a real `claude`/`codex` process.
+ */
+export type AgentSpawnFn = (command: string, args: string[], options: SpawnOptions) => ChildProcess;
+/**
+ * Assert a usable local TTY is present, or fail loud. This is the fail-fast
+ * gate the spec's "Fail-fast without usable TTY" constraint requires: an
+ * interactive run with no terminal to attach to must error immediately rather
+ * than hang waiting on input that can never arrive (or silently degrade to a
+ * non-interactive run, which would mask the misconfiguration).
+ */
+export declare function assertUsableTty(probe: TtyProbe): void;
+/**
+ * Local-only guardrails for the interactive agent (spec: "No remote or shared
+ * shells", "Local single-operator agent scope"). These are STRUCTURAL
+ * guardrails: the agent never exposes a remote/shared surface in the first
+ * place. The interactive agent is, by construction, the operator's own
+ * `claude`/`codex` attached to *this* process's own terminal — there is no
+ * socket, no listener, no second connection, and it is bound to this process
+ * group so it cannot outlive (or be detached from) the local task.
+ * `buildLocalAgentOptions` is the single source of truth for those spawn
+ * options, and `assertLocalAgentOptions` enforces them so a future edit cannot
+ * silently introduce a detached or non-local agent session.
+ */
+export declare function buildLocalAgentOptions(): SpawnOptions;
+/**
+ * Guard the spawn options against any non-local/shared configuration. Fails
+ * loud (no masked default) if a caller ever hands the agent options that would
+ * detach it from this process or route its IO anywhere but this terminal.
+ */
+export declare function assertLocalAgentOptions(options: SpawnOptions): void;
+/**
+ * A live, interactive coding-agent session that replaces a task's headless run.
+ * `open` spawns `claude`/`codex` with inherited stdio (so the operator works
+ * with it directly, in its own TUI); the returned child resolves the run when
+ * it exits, which releases the worker. Constructed only after `assertUsableTty`
+ * has passed.
+ *
+ * Single-operator invariant: an instance opens AT MOST one agent session, ever.
+ * A second `open()` — whether the first session is still live or already
+ * closed — is refused loudly, so there is never more than one interactive agent
+ * behind a single task.
+ */
+export declare class InteractiveAgent {
+    private readonly command;
+    private readonly args;
+    private readonly spawnFn;
+    private child;
+    private opened;
+    constructor(command: string, args: string[], spawnFn?: AgentSpawnFn);
+    /**
+     * Spawn the coding agent with inherited stdio so it owns the terminal and the
+     * operator works with it live. Returns the child so the caller can await its
+     * exit (which releases the worker). The single-operator invariant is enforced
+     * here: one session per instance, period.
+     */
+    open(): ChildProcess;
+}
+//# sourceMappingURL=interactive-agent.d.ts.map

package/dist/commands/interactive-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive-agent.d.ts","sourceRoot":"","sources":["../../src/commands/interactive-agent.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIrE;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,uCAAuC;AACvC,wBAAgB,eAAe,IAAI,QAAQ,CAK1C;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAarD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,IAAI,YAAY,CAiBrD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAcnE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB;IAKzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,MAAM,CAAS;gBAGJ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,YAAoB;IAGhD;;;;;OAKG;IACH,IAAI,IAAI,YAAY;CAmBrB"}

package/dist/commands/interactive-agent.js

@@ -0,0 +1,120 @@
+import { spawn } from "node:child_process";
+import { CliError } from "../util/errors.js";
+import { log } from "../util/logger.js";
+/** Read the real process TTY state. */
+export function processTtyProbe() {
+    return {
+        stdinIsTty: process.stdin.isTTY === true,
+        stdoutIsTty: process.stdout.isTTY === true,
+    };
+}
+/**
+ * Assert a usable local TTY is present, or fail loud. This is the fail-fast
+ * gate the spec's "Fail-fast without usable TTY" constraint requires: an
+ * interactive run with no terminal to attach to must error immediately rather
+ * than hang waiting on input that can never arrive (or silently degrade to a
+ * non-interactive run, which would mask the misconfiguration).
+ */
+export function assertUsableTty(probe) {
+    if (!probe.stdinIsTty || !probe.stdoutIsTty) {
+        throw new CliError("Interactive coding-agent mode requires a local terminal (TTY), but none is attached.\n\n" +
+            "`zenorm work --interactive` launches the coding agent as a live session, " +
+            "which needs an interactive stdin and stdout. This run has " +
+            `${probe.stdinIsTty ? "" : "no TTY stdin"}` +
+            `${!probe.stdinIsTty && !probe.stdoutIsTty ? " and " : ""}` +
+            `${probe.stdoutIsTty ? "" : "no TTY stdout"}` +
+            ".\n\nRun it from a real terminal, or drop `--interactive` (and the " +
+            '`interactive` config flag) to run non-interactively.');
+    }
+}
+/**
+ * Local-only guardrails for the interactive agent (spec: "No remote or shared
+ * shells", "Local single-operator agent scope"). These are STRUCTURAL
+ * guardrails: the agent never exposes a remote/shared surface in the first
+ * place. The interactive agent is, by construction, the operator's own
+ * `claude`/`codex` attached to *this* process's own terminal — there is no
+ * socket, no listener, no second connection, and it is bound to this process
+ * group so it cannot outlive (or be detached from) the local task.
+ * `buildLocalAgentOptions` is the single source of truth for those spawn
+ * options, and `assertLocalAgentOptions` enforces them so a future edit cannot
+ * silently introduce a detached or non-local agent session.
+ */
+export function buildLocalAgentOptions() {
+    return {
+        cwd: process.cwd(),
+        // inherit: the agent owns THIS terminal directly (its TUI, raw-mode line
+        // editing, etc. all work). Crucially this is also the local/single-operator
+        // boundary — the agent reads/writes only this process's stdio, never a pipe
+        // we could forward elsewhere. We are explicitly NOT piping the agent's
+        // output through Node (that piping + re-render is the headless path), so
+        // there is no second stream a remote/shared peer could attach, and no raw
+        // text dump: the agent's own TUI renders directly to the terminal.
+        stdio: "inherit",
+        // detached:false keeps the agent in OUR process group so it dies with the
+        // local task process and can never become an orphaned, independently-reachable
+        // session. A detached agent would violate "no remote or shared shells" — so
+        // it is asserted false below.
+        detached: false,
+    };
+}
+/**
+ * Guard the spawn options against any non-local/shared configuration. Fails
+ * loud (no masked default) if a caller ever hands the agent options that would
+ * detach it from this process or route its IO anywhere but this terminal.
+ */
+export function assertLocalAgentOptions(options) {
+    if (options.detached === true) {
+        throw new CliError("Refusing to launch a detached interactive agent: it must stay bound " +
+            "to the local task process (no remote or shared shells).");
+    }
+    if (options.stdio !== "inherit") {
+        throw new CliError("Refusing to launch the interactive agent on non-inherited stdio: it must " +
+            "attach to this local terminal only (no remote or shared shells, no raw " +
+            "text dumping).");
+    }
+}
+/**
+ * A live, interactive coding-agent session that replaces a task's headless run.
+ * `open` spawns `claude`/`codex` with inherited stdio (so the operator works
+ * with it directly, in its own TUI); the returned child resolves the run when
+ * it exits, which releases the worker. Constructed only after `assertUsableTty`
+ * has passed.
+ *
+ * Single-operator invariant: an instance opens AT MOST one agent session, ever.
+ * A second `open()` — whether the first session is still live or already
+ * closed — is refused loudly, so there is never more than one interactive agent
+ * behind a single task.
+ */
+export class InteractiveAgent {
+    command;
+    args;
+    spawnFn;
+    child = null;
+    opened = false;
+    constructor(command, args, spawnFn = spawn) {
+        this.command = command;
+        this.args = args;
+        this.spawnFn = spawnFn;
+    }
+    /**
+     * Spawn the coding agent with inherited stdio so it owns the terminal and the
+     * operator works with it live. Returns the child so the caller can await its
+     * exit (which releases the worker). The single-operator invariant is enforced
+     * here: one session per instance, period.
+     */
+    open() {
+        if (this.opened) {
+            throw new CliError("Interactive agent already launched for this task — only a single local " +
+                "agent session is allowed (no second or shared session).");
+        }
+        this.opened = true;
+        const options = buildLocalAgentOptions();
+        // Belt-and-braces: prove the options are local-only before spawning, so a
+        // future change to buildLocalAgentOptions can't quietly launch a shared agent.
+        assertLocalAgentOptions(options);
+        log.plain(`Launching interactive ${this.command} session — work with it, then exit ` +
+            "the agent to continue to the next task.");
+        this.child = this.spawnFn(this.command, this.args, options);
+        return this.child;
+    }
+}

package/dist/commands/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAQA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuE/D"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAcA,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4F/D"}

package/dist/commands/pull.js

@@ -3,7 +3,7 @@ import { writeFileSync } from "node:fs";
 import { ZenormClient } from "../api/client.js";
 import { CliError } from "../util/errors.js";
 import { log } from "../util/logger.js";
-import { blocksToMarkdown, specToMarkdown } from "../util/markdown.js";
+import { attachmentsToMarkdown, blocksToMarkdown, specToMarkdown, } from "../util/markdown.js";
 export async function pullCommand(argv) {
     const { positionals, values } = parseArgs({
         args: argv,
@@ -56,7 +56,28 @@ export async function pullCommand(argv) {
             error: err instanceof Error ? err.message : String(err),
         });
     }
-    const md = blocksMd ? `${specToMarkdown(spec)}\n\n${blocksMd}\n` : specToMarkdown(spec);
+    // Fetch the spec's READY attachments and append them to the work context,
+    // automatically (no flag, no per-run selection — AC "included automatically").
+    // The `?status=ready` filter is the SERVER-SIDE gate, so a worker run can only
+    // ever see ingested files (AC "ready files only"). Tolerate the endpoint 404ing
+    // on older servers — degrade silently like the blocks fetch above.
+    let attachmentsMd = "";
+    try {
+        const { attachments } = await client.get(`/v1/specs/${spec.id}/attachments?status=ready`);
+        attachmentsMd = attachmentsToMarkdown(attachments);
+    }
+    catch (err) {
+        log.debug("Attachment fetch failed, omitting attachments section", {
+            specId: spec.id,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    const sections = [specToMarkdown(spec)];
+    if (blocksMd)
+        sections.push(blocksMd);
+    if (attachmentsMd)
+        sections.push(attachmentsMd);
+    const md = `${sections.join("\n\n")}\n`;
     if (outputPath) {
         writeFileSync(outputPath, md, "utf-8");
         log.success(`Wrote spec to ${outputPath}`);

package/dist/commands/work-render.d.ts

@@ -83,6 +83,7 @@ export declare function splashLogo(): string;
  */
 export declare function daemonBanner(opts: {
     agent: string;
+    model?: string;
     repo: string;
     intervalSeconds: number;
     once: boolean;
@@ -112,6 +113,27 @@ export declare function failureBanner(opts: {
     title: string;
     error: string;
 }): string;
+/**
+ * The ONE-LINE post-agent change summary printed when an interactive
+ * coding-agent session closes (operator exited the agent). It is the only
+ * read-out of an interactive session — the agent's own TUI owned the terminal,
+ * so there is no transcript to footer — and per the spec it must be a SINGLE
+ * line (constraint: "No raw text terminal dumping"): no multi-line dump, no raw
+ * diff. It reports the files the agent touched during the session and the
+ * claimed task's resulting status, then the daemon releases the worker.
+ *
+ * The file list is capped to `maxFiles` names with a `+N more` tail so a large
+ * change set never wraps the line. `status` is the task's server-side status
+ * (e.g. `done` once the agent ran `zenorm task complete`), or the literal
+ * `unknown` when the status read could not be made — the one sanctioned
+ * soft-fallback, since reading the status must never block worker release.
+ */
+export declare function postAgentSummary(opts: {
+    filesTouched: string[];
+    status: string;
+    shortTaskId: string;
+    maxFiles?: number;
+}): string;
 /**
  * The session summary printed when the daemon shuts down (Ctrl-C or `--once`
  * exhausted). Closes the run with a rule + a one-line tally so the user sees the

package/dist/commands/work-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work-render.d.ts","sourceRoot":"","sources":["../../src/commands/work-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAoBH,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AA2DlC;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAM;IAEpB,6EAA6E;IAC7E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAQ7B,wDAAwD;IACxD,KAAK,IAAI,MAAM,EAAE;CAMlB;AA+ED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAoE/D;AAED,kEAAkE;AAClE,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,EAAE,CAAC;AAuBjE,eAAO,MAAM,cAAc,EAAE,aAA+C,CAAC;AAC7E,eAAO,MAAM,aAAa,EAAE,aAA8C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAI/E;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAMR;AA2JD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAenC;AAoBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,CAsBT;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAMT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAKT"}
+{"version":3,"file":"work-render.d.ts","sourceRoot":"","sources":["../../src/commands/work-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAoBH,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AA2DlC;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAM;IAEpB,6EAA6E;IAC7E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAQ7B,wDAAwD;IACxD,KAAK,IAAI,MAAM,EAAE;CAMlB;AA+ED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAoE/D;AAED,kEAAkE;AAClE,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,EAAE,CAAC;AAuBjE,eAAO,MAAM,cAAc,EAAE,aAA+C,CAAC;AAC7E,eAAO,MAAM,aAAa,EAAE,aAA8C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAI/E;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAMR;AA2JD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAenC;AAoBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,CAuBT;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAiBT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAKT"}

package/dist/commands/work-render.js

@@ -537,6 +537,7 @@ export function daemonBanner(opts) {
         `${DIM}spec-authoring agent · claim-and-run daemon${RESET}`,
         "",
         `${DIM}agent     ${RESET}${opts.agent}`,
+        ...(opts.model ? [`${DIM}model     ${RESET}${opts.model}`] : []),
         `${DIM}repo      ${RESET}${opts.repo}`,
         `${DIM}interval  ${RESET}${opts.intervalSeconds}s`,
     ]);
@@ -576,6 +577,38 @@ export function failureBanner(opts) {
         `${DIM}  released back to todo — it can be re-claimed.${RESET}`,
     ].join("\n");
 }
+/**
+ * The ONE-LINE post-agent change summary printed when an interactive
+ * coding-agent session closes (operator exited the agent). It is the only
+ * read-out of an interactive session — the agent's own TUI owned the terminal,
+ * so there is no transcript to footer — and per the spec it must be a SINGLE
+ * line (constraint: "No raw text terminal dumping"): no multi-line dump, no raw
+ * diff. It reports the files the agent touched during the session and the
+ * claimed task's resulting status, then the daemon releases the worker.
+ *
+ * The file list is capped to `maxFiles` names with a `+N more` tail so a large
+ * change set never wraps the line. `status` is the task's server-side status
+ * (e.g. `done` once the agent ran `zenorm task complete`), or the literal
+ * `unknown` when the status read could not be made — the one sanctioned
+ * soft-fallback, since reading the status must never block worker release.
+ */
+export function postAgentSummary(opts) {
+    const max = opts.maxFiles ?? 4;
+    const count = opts.filesTouched.length;
+    const noun = count === 1 ? "file" : "files";
+    let detail;
+    if (count === 0) {
+        detail = `${DIM}no files touched${RESET}`;
+    }
+    else {
+        const shown = opts.filesTouched.slice(0, max);
+        const overflow = count - shown.length;
+        const names = shown.join(", ") + (overflow > 0 ? `, +${overflow} more` : "");
+        detail = `${count} ${noun} touched ${DIM}(${clip(names)})${RESET}`;
+    }
+    return (`${BOLD}◣ agent closed${RESET} ${DIM}·${RESET} ${detail} ` +
+        `${DIM}·${RESET} task ${GREEN}${opts.status}${RESET} ${DIM}(${opts.shortTaskId})${RESET}`);
+}
 /**
  * The session summary printed when the daemon shuts down (Ctrl-C or `--once`
  * exhausted). Closes the run with a rule + a one-line tally so the user sees the

package/dist/commands/work.d.ts

@@ -1,6 +1,7 @@
 import type { SpawnOptions, ChildProcess } from "node:child_process";
 import { ZenormClient } from "../api/client.js";
 import type { SpecTaskRecord } from "../api/types.js";
+import { type TtyProbe } from "./interactive-agent.js";
 /**
  * Agents whose subprocess runner slice 3 will wire up. Validated here so an
  * unknown/missing `--agent` fails loud rather than silently defaulting (project
@@ -35,6 +36,13 @@ export interface TaskRunner {
  * Exported for unit testing.
  */
 export declare function buildHandoffPrompt(task: SpecTaskRecord): string;
+/**
+ * The interactive (coding-agent mode) handoff prompt. Same spec-mode handoff as
+ * the headless prompt, MINUS the "work non-interactively" instruction: in this
+ * mode the agent runs as a live session the operator drives, so it SHOULD pause
+ * for input. Exported for unit testing.
+ */
+export declare function buildInteractiveHandoffPrompt(task: SpecTaskRecord): string;
 /**
  * The headless subprocess invocation for a given agent + task. Pure (no
  * side effects) so it can be unit-tested directly without spawning anything.
@@ -47,7 +55,37 @@ export declare function buildHandoffPrompt(task: SpecTaskRecord): string;
  *
  * Exported for unit testing.
  */
-export declare function buildAgentCommand(agent: SupportedAgent, task: SpecTaskRecord): {
+export declare function buildAgentCommand(agent: SupportedAgent, task: SpecTaskRecord, model?: string): {
+    command: string;
+    args: string[];
+};
+/**
+ * The INTERACTIVE invocation for a given agent + task: launch the agent as a
+ * live session (NOT headless) seeded with the spec handoff, so the operator
+ * works with it directly in its own TUI. Pure (no side effects) so it can be
+ * unit-tested without spawning anything.
+ *
+ * Unlike `buildAgentCommand`, there is no `-p`/`exec`/`--json` and no
+ * stream-json: both agents start an interactive session by default, and the
+ * agent's own TUI renders straight to the inherited terminal (so there is no
+ * raw JSON event stream for us to re-render, and nothing to dump as raw text).
+ * - claude: `claude --permission-mode auto [--model <m>] "<prompt>"`
+ *   (interactive by default; `-p` would make it headless, so it is deliberately
+ *   absent). `--permission-mode auto` runs the background classifier that
+ *   auto-approves safe actions and only blocks destructive ones, so the
+ *   operator is not interrupted by a permission prompt on every gated tool call
+ *   — same guardrail the headless path uses, just keeping the session live.
+ * - codex:  `codex --ask-for-approval never --sandbox workspace-write [-m <m>]
+ *   "<prompt>"` (interactive by default; the `exec` subcommand is what makes it
+ *   non-interactive, so it is deliberately absent). `--ask-for-approval never`
+ *   is codex's full-auto: the operator is never interrupted by an approval
+ *   prompt, while `--sandbox workspace-write` still confines writes to the
+ *   workspace (NOT `--dangerously-bypass-approvals-and-sandbox`, which would
+ *   drop the sandbox entirely).
+ *
+ * Exported for unit testing.
+ */
+export declare function buildInteractiveAgentCommand(agent: SupportedAgent, task: SpecTaskRecord, model?: string): {
     command: string;
     args: string[];
 };
@@ -56,6 +94,31 @@ export declare function buildAgentCommand(agent: SupportedAgent, task: SpecTaskR
  * unit-tested without launching a real agent.
  */
 export type SpawnFn = (command: string, args: string[], options: SpawnOptions) => ChildProcess;
+/**
+ * Snapshot the working tree's changed-file state. Injectable so the interactive
+ * post-agent summary can be unit-tested without a real git repo; the default is
+ * a real `git status --porcelain` in the current repo. Returns the raw porcelain
+ * text (each line is a 3-char status prefix + path); `diffTouchedFiles` parses
+ * it into the touched-file set.
+ */
+export type GitStatusFn = () => string;
+/**
+ * Read the claimed task's CURRENT server-side status (e.g. `done` once the agent
+ * ran `zenorm task complete` inside the session). Injectable so the summary can
+ * be unit-tested without HTTP. Returns the status, or `"unknown"` when the read
+ * could not be made — the summary must never block worker release on a status
+ * read, so this is the one sanctioned soft-fallback (the caller also warns).
+ */
+export type FetchTaskStatusFn = (task: SpecTaskRecord) => Promise<SpecTaskRecord["status"]>;
+/**
+ * Diff two `git status --porcelain` snapshots into the set of files the agent
+ * touched during the session. We compare the porcelain LINE per path across
+ * before/after: a path is "touched" when its line differs (added, removed, or
+ * its status code changed). This deliberately IGNORES pre-existing dirt whose
+ * status did not change during the session (so unrelated stray files already in
+ * the tree don't pollute the summary). Returns a sorted, deduped path list.
+ */
+export declare function diffTouchedFiles(before: string, after: string): string[];
 /**
  * The real runner: spawns the chosen coding agent headlessly against the
  * claimed task and awaits its exit.
@@ -69,9 +132,48 @@ export type SpawnFn = (command: string, args: string[], options: SpawnOptions) =
 export declare class AgentRunner implements TaskRunner {
     private readonly agent;
     private readonly spawnFn;
+    private readonly model?;
+    private readonly interactive;
+    private readonly gitStatus;
+    private readonly fetchTaskStatus?;
     readonly agentName: SupportedAgent;
-    constructor(agent: SupportedAgent, spawnFn?: SpawnFn);
+    constructor(agent: SupportedAgent, spawnFn?: SpawnFn, model?: string | undefined, interactive?: boolean, gitStatus?: GitStatusFn, fetchTaskStatus?: FetchTaskStatusFn | undefined);
     run(task: SpecTaskRecord): Promise<void>;
+    /**
+     * Default (non-interactive) path — UNCHANGED behavior: spawn the agent
+     * headlessly, pipe + re-render its JSON event stream, await its exit.
+     */
+    private runHeadless;
+    /**
+     * Coding-agent (interactive) path. Launch the agent as a LIVE session via
+     * `InteractiveAgent`: inherited stdio so the agent's own TUI owns the terminal
+     * (no piping, no re-render — and therefore no raw text dumping), seeded with
+     * the spec handoff. The operator works with it; when they close the agent it
+     * exits, which resolves this run and RELEASES THE WORKER so the loop claims
+     * the next task. A clean operator exit (code 0) is success; a crash/non-zero
+     * exit is still a loud failure.
+     */
+    private runInteractive;
+    /**
+     * Print the ONE-LINE post-agent change summary, then RESOLVE (releasing the
+     * worker) — in that order, per the spec constraint "Summary before worker
+     * release". Computes the touched-file set from the before/after porcelain
+     * snapshots and reads the claimed task's current server-side status.
+     *
+     * Robustness: this runs after a CLEAN agent exit, so it must NEVER turn that
+     * success into a failure. The whole body is wrapped so `resolve()` always
+     * fires even if the summary work throws. The status read is the one sanctioned
+     * soft-fallback — a fetch failure warns and reports `unknown` rather than
+     * blocking the release; an absent status fetcher (no client wired, e.g. unit
+     * tests) is silently `unknown`.
+     */
+    private summarizeThenRelease;
+    /**
+     * Shared exit/error handling for both paths: ENOENT → install hint, non-zero
+     * exit → loud failure, code 0 → success (releases the worker). `settled`
+     * guards against a double-settle if error and exit both fire.
+     */
+    private wireChild;
 }
 /**
  * `--dry-run` runner: prints the exact headless command + handoff prompt it
@@ -80,8 +182,9 @@ export declare class AgentRunner implements TaskRunner {
  */
 export declare class DryRunRunner implements TaskRunner {
     private readonly agent;
+    private readonly model?;
     readonly agentName: SupportedAgent;
-    constructor(agent: SupportedAgent);
+    constructor(agent: SupportedAgent, model?: string | undefined);
     run(task: SpecTaskRecord): Promise<void>;
 }
 /**
@@ -99,7 +202,18 @@ export declare function parseGitRemote(url: string): {
 interface DaemonDeps {
     runner?: TaskRunner;
     client?: ZenormClient;
+    ttyProbe?: TtyProbe;
 }
+/**
+ * Resolve whether interactive mode is on. Opt-in is explicit by design (the
+ * spec keeps existing runs non-interactive unless enabled): the `--interactive`
+ * flag, or `interactive: true` in `.zenorm.json`. The flag wins; config only
+ * supplies the default when the flag is absent. A bad config value already
+ * threw in `validateConfig`, so this never silently coerces.
+ */
+export declare function resolveInteractive(flagPassed: boolean, config: {
+    interactive?: boolean;
+} | null): boolean;
 /**
  * The poll loop, isolated from arg/repo resolution so it can be unit-tested
  * with an injected client and runner. Returns the number of tasks processed.