agent-nuvira 3.3.0 → 3.3.3

package/dist/tools/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/tools/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,EAAE,CAAC,EAAgB,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AAMpD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,UAAU,CAAC;AAElE,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,IAAI;IACnB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,aAAa,EAAE,GAAG,CAAC;IACnB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,4CAA4C;IAC5C,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,OAAO,gCAAgC,EAAE,kBAAkB,CAAC;IAC/E;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/D,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,oBAAoB,EAAE,SAAS,CAAC;IACjD;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,qBAAqB,EAAE,YAAY,CAAC;IACvD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD;;;;WAIG;QACH,SAAS,CAAC,CAAC,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1G,4EAA4E;QAC5E,aAAa,CAAC,CAAC,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,GAAG,SAAS,CAAC;QACjF,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;YAAC,IAAI,EAAE,UAAU,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/J,sFAAsF;QACtF,MAAM,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QACjD;;2EAEmE;QACnE,gBAAgB,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;YAAC,IAAI,EAAE,UAAU,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtJ,SAAS,EAAE;YAAE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAA;SAAE,CAAC;KACxF,CAAC;IACF;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,iBAAiB,EAAE,aAAa,CAAC;IACpD;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC1C;AAyED,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB;;;;;;;;;iBAK5B,CAAC;AAKH,iGAAiG;AACjG,eAAO,MAAM,iBAAiB;;;;;iBAc5B,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,YAAY;;;iBAUvB,CAAC;AAEH,+DAA+D;AAC/D,eAAO,MAAM,aAAa;;;;;;;;;;;iBAMxB,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAgB1B,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;iBAczB,CAAC;AA0IH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;iBAejC,CAAC;AAMH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAE7C;AAED,8BAA8B;AAC9B,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAEtD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,IAAI,IAAI,EAAE,CAElC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAOtE;AAID;;;;;GAKG;AACH,eAAO,MAAM,aAAa,w8JAiB8R,CAAC;AAEzT,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,gsKAK2C,CAAC;AAkhB3E;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAyBvE;AASD,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/tools/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,EAAE,CAAC,EAAgB,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AAMpD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,UAAU,CAAC;AAElE,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;;GAIG;AACH,MAAM,WAAW,IAAI;IACnB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,aAAa,EAAE,GAAG,CAAC;IACnB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,KAAK,CAAC,EAAE,GAAG,CAAC;IACZ,4CAA4C;IAC5C,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,OAAO,gCAAgC,EAAE,kBAAkB,CAAC;IAC/E;;;;;;;;;;;;;OAaG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,OAAO,gCAAgC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC1E;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,OAAO,0BAA0B,EAAE,QAAQ,CAAC;IACvD,kEAAkE;IAClE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/D,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,oBAAoB,EAAE,SAAS,CAAC;IACjD;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,qBAAqB,EAAE,YAAY,CAAC;IACvD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACrD;;;;WAIG;QACH,SAAS,CAAC,CAAC,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1G,4EAA4E;QAC5E,aAAa,CAAC,CAAC,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,GAAG,SAAS,CAAC;QACjF,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;YAAC,IAAI,EAAE,UAAU,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/J,sFAAsF;QACtF,MAAM,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QACjD;;2EAEmE;QACnE,gBAAgB,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;YAAC,IAAI,EAAE,UAAU,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtJ,SAAS,EAAE;YAAE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAA;SAAE,CAAC;KACxF,CAAC;IACF;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,iBAAiB,EAAE,aAAa,CAAC;IACpD;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC1C;AAyED,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB;;;;;;;;;iBAK5B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;iBAahC,CAAC;AAKH,iGAAiG;AACjG,eAAO,MAAM,iBAAiB;;;;;iBAc5B,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,YAAY;;;iBAUvB,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;iBASxB,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;iBAgB1B,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;iBAczB,CAAC;AA0IH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;iBAejC,CAAC;AAMH;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAE7C;AAED,8BAA8B;AAC9B,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAEtD;AAED,gFAAgF;AAChF,wBAAgB,SAAS,IAAI,IAAI,EAAE,CAElC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAOtE;AAID;;;;;GAKG;AACH,eAAO,MAAM,aAAa,08JAiB8R,CAAC;AAEzT,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,ksKAK2C,CAAC;AAukB3E;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAyBvE;AASD,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}

package/dist/tools/registry.js

@@ -98,6 +98,26 @@ export const publishToolSchema = z.object({
     dry_run: z.boolean().default(false).describe('Preview the publish phases without publishing anything'),
     skip_tests: z.boolean().default(false).describe('Skip the test-verification phase'),
 });
+/**
+ * Release credentials (store/status/forget/verify) — the E3c publish tool can
+ * only release with a GitHub and an npm token, and this is how the agent keeps
+ * them. Storing is NOT an irreversible external action, so it is not gated —
+ * but the VALUE must come from the user: `ask_user` for it, never invent one.
+ */
+export const credentialsToolSchema = z.object({
+    action: z
+        .enum(['status', 'store', 'forget', 'verify'])
+        .default('status')
+        .describe('status = which credentials exist and where each came from; store = persist a token the user supplied; forget = delete a stored token; verify = check the tokens against the live services'),
+    key: z
+        .string()
+        .optional()
+        .describe('Credential name for store/forget: GITHUB_TOKEN | GIT_USERNAME | NPM_TOKEN | NPM_REGISTRY'),
+    value: z
+        .string()
+        .optional()
+        .describe('Value to store (action=store). Must come from the USER via ask_user — never invent, guess or reuse a token from elsewhere in the transcript.'),
+});
 /** E3c — the task tools all carry a goal (model-decides vocabulary). */
 const taskGoalArgs = z.object({ goal: z.string().describe('The task goal passed to the agent pipeline') });
 /** E3g — gateway message delivery: target + text + optional media (model-decides vocabulary). */
@@ -128,13 +148,16 @@ export const runCliSchema = z.object({
         .default(false)
         .describe('Set true ONLY after the user explicitly confirmed a destructive/system-level command you initiated. When the user’s own request resolves to the exact command (they asked to stop the dashboard), that IS the confirmation — the tool applies it. Irreversible intents (history.clear, memory.prune, stats.cost.clear, publish) always need it.'),
 });
-/** P3b — gated git args: structured status/log/diff/commit. */
+/** P3b — gated git args: structured status/log/diff/commit, plus the gated push. */
 export const gitToolSchema = z.object({
-    action: z.enum(['status', 'log', 'diff', 'commit']).describe('What to do — status/log are read-only; diff returns a structured diff (rendered as a card); commit is GATED unless the user’s own request asked for the commit.'),
+    action: z.enum(['status', 'log', 'diff', 'commit', 'push']).describe('What to do — status/log are read-only; diff returns a structured diff (rendered as a card); commit is GATED unless the user’s own request asked for the commit; push is GATED and STAYS gated unless the user’s own request named the push ("commit and push this to GitHub"). A request to commit locally does NOT authorize a push.'),
     message: z.string().optional().describe('Commit message (action=commit, required)'),
     files: z.array(z.string()).optional().describe('Files to stage+commit — the ACCEPTED subset after the user reviewed the diff card (absent = all changes)'),
-    confirm: z.boolean().default(false).describe('Commit gate — required only when the MODEL initiated the commit. When the user’s own request asks for a commit ("commit these changes"), that request IS the approval: call it with confirm:false and it applies.'),
+    confirm: z.boolean().default(false).describe('Gate for the two history-changing actions (commit, push) — required when the MODEL initiated the action. When the user’s own request asks for it, that request IS the approval: call it with confirm:false and it applies (for commit: "commit these changes"; for push: the request must name the push itself).'),
     limit: z.number().int().min(1).max(100).optional().describe('Log limit (action=log, default 20)'),
+    remote: z.string().optional().describe('Push destination (action=push, default: the repository’s first remote)'),
+    branch: z.string().optional().describe('Push source branch (action=push, default: the current branch)'),
+    tags: z.boolean().default(false).describe('action=push — also push tags after the branch'),
 });
 /** P3a — clone_repo args: a git URL to assess (depth-1 shallow only). */
 export const cloneRepoSchema = z.object({
@@ -351,7 +374,7 @@ export const TOOL_CONTRACT = `You have tools available. Call them when appropria
 - If a request asks to publish a release (npm/GitHub), call \`publish\`. It leaves this machine and is irreversible — confirm the bump type and target with the user via \`ask_user\` first unless they already specified them.
 - If a request's completeness is uncertain, call \`verify_requirement\` first.
 - If a request asks to deliver a message or result to a DIFFERENT contact/channel than the one you are currently chatting on (WhatsApp, Telegram, Slack, email, …), call \`gateway_send\` with the target (e.g. \`whatsapp:Alex\`) and the text. Do NOT call gateway_send to reply to the CURRENT conversation — your text response is automatically delivered back. If the target contact is not configured, tell the user what to set up.
-- If a request asks to manage the system/agent itself in plain English — start/stop the dashboard or gateway, check status, add/remove a verified sender, configure a platform (telegram/whatsapp), run evals, show stats — call \`run_cli\` with the plain-English ask. It resolves the exact \`buff\` command and runs it. If the user's own request already resolves to that command ("stop the dashboard"), it just runs — do not ask for permission to do what was just asked. If it reports AMBIGUOUS, call \`ask_user\` with the two choices; if the intent is one YOU chose rather than the user (or is irreversible: history.clear, memory.prune, stats.cost.clear, publish), call \`ask_user\` first and retry with confirm:true.
+- If a request asks to manage the system/agent itself in plain English — start/stop the dashboard or gateway, check status, add/remove a verified sender, configure a platform (telegram/whatsapp), run evals, show stats — call \`run_cli\` with the plain-English ask. It resolves the exact \`nuvira\` command and runs it. If the user's own request already resolves to that command ("stop the dashboard"), it just runs — do not ask for permission to do what was just asked. If it reports AMBIGUOUS, call \`ask_user\` with the two choices; if the intent is one YOU chose rather than the user (or is irreversible: history.clear, memory.prune, stats.cost.clear, publish), call \`ask_user\` first and retry with confirm:true.
 - If a subtask can be delegated to a specialized sub-agent (gather context, review, security scan, run tests), call \`delegate\` with the agent type, a focused prompt, and optional file paths.
 - To find code matching a pattern (context gathering, locating definitions/usages), call \`code_search\` with the pattern and optional globs.
 - To READ the project: call \`read_file\` to open a file (with line numbers), \`list_dir\` to see a directory's contents, or \`glob\` to find files by pattern. Always prefer reading the actual file over assuming its contents — a large file reports a line range, continue with offset/limit.
@@ -438,6 +461,16 @@ registerTool({
     endsAgentStep: true,
     run: (args, ctx) => runPublishTool(args, ctx),
 });
+registerTool({
+    name: 'credentials',
+    description: 'Release credentials: status (what exists, and where from), store (persist a GitHub/npm token so releases work without an environment export), forget (delete one), verify (check the tokens against the live services). Call status before a release; if a token is missing, ask_user for it and store it — never invent one.',
+    category: 'workflow',
+    inputSchema: credentialsToolSchema,
+    // Not a dispenser: the model must read the credential picture and act on it
+    // (store the missing token, or proceed with the release).
+    endsAgentStep: false,
+    run: (args, ctx) => runCredentialsTool(args, ctx),
+});
 registerTool({
     name: 'ask_user',
     description: 'Ask the user a clarifying question with 2–4 choices (multi-select optional). Use when a request is ambiguous or missing information.',
@@ -449,6 +482,33 @@ registerTool({
     endsAgentStep: false,
     run: async (args, ctx) => {
         const { question, choices, multi_select } = askUserSchema.parse(args);
+        // ── Stage 2: REPETITION gate — never re-ask a question already answered ──
+        // Checked FIRST, before the authorization suppression below, because asking
+        // the same question twice is a defect on its own terms whatever the request
+        // authorized. The evidence is the RUN TRACE, not the current text: the
+        // question is compared to every question the agent has already asked in this
+        // conversation, and a repeat is refused with the answer the user gave.
+        //
+        // This is the mechanism the live audit lacked. A turn asked four variants of
+        // "may I run `node -c script.js`?" and nothing in the system held the fact
+        // that it had asked before, so it could not stop, and could not answer the
+        // user asking why it kept asking. Irreversible choices are exempt: "which of
+        // these two files should I delete?" is a genuine new decision each time.
+        const priorAsks = ctx.runTrace?.priorAskMatches(question) ?? [];
+        if (priorAsks.length > 0 && !IRREVERSIBLE_ACTION_RE.test(question)) {
+            const answer = ctx.runTrace?.priorAnswer(question);
+            ctx.runTrace?.recordAsk(question, false, answer);
+            ctx.emit?.('autonomy:repeat-suppressed', {
+                question,
+                times: priorAsks.length + 1,
+                answer,
+            }, 'tool-loop');
+            return (`Not shown to the user: you have already asked this ${priorAsks.length === 1 ? 'once' : `${priorAsks.length} times`} in this conversation` +
+                (answer ? `, and they answered "${answer}"` : '') +
+                '. Do NOT ask it again — the answer you have is the answer. Act on it, or state plainly ' +
+                'what blocks you. If something genuinely NEW has appeared that the user has not seen, ask ' +
+                'about THAT new thing instead of re-asking this.');
+        }
         // ── G13: do not round-trip a permission question the ask already answered ─
         // Over a chat surface (WhatsApp/Telegram) an ask_user call is a MESSAGE to
         // the user, so a reflexive "Do you want me to create the full project
@@ -460,18 +520,26 @@ registerTool({
         // Narrow on purpose — both conditions must hold, and any question naming an
         // irreversible action (overwrite, delete, publish, deploy, send, pay…) is
         // passed straight through, because that decision IS the user's.
-        if (ctx.writesAuthorized?.authorized === true &&
+        if ((ctx.writesAuthorized?.authorized === true || Boolean(ctx.envelope)) &&
             detectPermissionSeeking(question) &&
             !IRREVERSIBLE_ACTION_RE.test(question)) {
             const recommended = choices[0]?.label ?? '';
+            // Read the authorizer from whichever one is live, so the audit line names
+            // the real reason ("the user approved this plan" reads very differently
+            // from "this message asked for files").
+            const authorization = ctx.envelope
+                ? `approved envelope: ${ctx.envelope.goal} (${ctx.envelope.source})`
+                : (ctx.writesAuthorized?.reason ?? 'the request authorized this work');
             ctx.emit?.('autonomy:consult-suppressed', {
                 question,
-                authorization: ctx.writesAuthorized.reason,
+                authorization,
             }, 'tool-loop');
-            return ('Not shown to the user: their request already authorized this work, and this is a ' +
-                'permission question about doing it. Decide it yourself and continue.\n' +
+            ctx.runTrace?.recordAsk(question, false);
+            return ('Not shown to the user: their request or approved plan already authorized this work, ' +
+                'and this is a permission question about doing it. Decide it yourself and continue.\n' +
                 (recommended ? `Recommended default: "${recommended}".\n` : '') +
                 'Carry the work out now and state the decision in your answer so the user can redirect. ' +
+                'Do NOT ask again for the same work — the answer is already yes. ' +
                 'Only if the choice is genuinely theirs — it cannot proceed without an answer, is ' +
                 'high-impact and irreversible, and has no sensible default — re-call ask_user naming ' +
                 'that specific irreversible choice (e.g. whether to overwrite an existing file).');
@@ -479,6 +547,10 @@ registerTool({
         const render = ctx.askUser || (await import('./ask-user.js')).renderAskUser;
         const answer = await render(question, choices, multi_select);
         const picked = Array.isArray(answer.answer) ? answer.answer.join(', ') : answer.answer;
+        // Recorded SHOWN and with the answer, so the trace can hand both back when
+        // the agent tries to ask it a second time (and so a self-report can say what
+        // the user actually replied, instead of "asked 4×, no answer recorded").
+        ctx.runTrace?.recordAsk(question, true, picked);
         return `User answered: ${picked}${answer.custom ? ` (custom: ${answer.custom})` : ''}`;
     },
 });
@@ -809,11 +881,12 @@ registerTool({
 // The agent can commit IN CONVERSATION, visibly: `git diff` emits a
 // structured event the dashboard renders as a 🔧 diff card (per-file +/−
 // sections); `git commit` is GATED (confirm:true after ask_user) and stages
-// only the ACCEPTED files subset. push/reset --hard/clean are structurally
-// unexpressible (the action enum) AND deny-guarded — parity with run_terminal.
+// only the ACCEPTED files subset. `git push` is a real GATED action here (the
+// only outbound one — it asks unless the user's own request named the push),
+// while reset --hard/clean remain structurally unexpressible AND deny-guarded.
 registerTool({
     name: 'git',
-    description: 'Structured git operations: status/log (read-only), diff (unified output + a diff card in the GUI), and commit (GATED — confirm:true only after the user approved via ask_user; optional files = the accepted subset to stage+commit). Use for the whole commit flow: diff → ask_user (accept/reject files) → commit with confirm:true.',
+    description: 'Structured git operations: status/log (read-only), diff (unified output + a diff card in the GUI), commit (GATED — confirm:true only after the user approved via ask_user; optional files = the accepted subset to stage+commit), and push (GATED — sends a branch to a remote; runs when the user’s own request named the push, otherwise ask via ask_user first). Use for the whole flow: diff → ask_user (accept/reject files) → commit → push.',
     category: 'workflow',
     inputSchema: gitToolSchema,
     endsAgentStep: false,
@@ -905,6 +978,10 @@ function runPipelineTool(action, args, ctx) {
 function runPublishTool(args, ctx) {
     return import('./publish-tool.js').then((m) => m.runPublishTool(args, ctx));
 }
+/** Release credentials as a tool (store/status/forget/verify) — see credentials-tool.ts. */
+function runCredentialsTool(args, ctx) {
+    return import('./credentials-tool.js').then((m) => m.runCredentialsTool(args, ctx));
+}
 /** The C2 requirementState check — see executor.ts. */
 function verifyRequirement(request, ctx) {
     return import('./verify-requirement.js').then((m) => m.verifyRequirementTool(request, ctx));