agor-live 0.18.0 → 0.19.0

package/dist/cli/commands/init.d.ts

@@ -48,13 +48,6 @@ declare class Init extends Command {
      * `~/.agor/admin-credentials`.
      */
     private promptAdminSetup;
-    /**
-     * Prompt user for assistant setup
-     *
-     * Stores intent in config.yaml for the UI wizard to pick up.
-     * The framework repo is public, so HTTPS always works.
-     */
-    private promptAssistantSetup;
     /**
      * Prompt user for API key setup
      */

package/dist/cli/commands/init.js

@@ -266,9 +266,6 @@ var Init = class _Init extends Command {
         }
       }
     }
-    if (!skipPrompts) {
-      await this.promptAssistantSetup();
-    }
     this.log("");
     this.log(chalk.green.bold("\u2705 Agor initialized successfully!"));
     this.log("");
@@ -380,51 +377,6 @@ var Init = class _Init extends Command {
     });
     this.log(`${chalk.green("   \u2713")} Admin user created (${chalk.gray(email)})`);
   }
-  /**
-   * Prompt user for assistant setup
-   *
-   * Stores intent in config.yaml for the UI wizard to pick up.
-   * The framework repo is public, so HTTPS always works.
-   */
-  async promptAssistantSetup() {
-    this.log("");
-    this.log(chalk.bold("\u{1F916} Assistant"));
-    this.log("");
-    this.log(
-      chalk.gray("An assistant is a persistent AI companion that manages your Agor instance.")
-    );
-    this.log(
-      chalk.gray(
-        "It maintains memory across sessions, orchestrates work, and learns your preferences."
-      )
-    );
-    this.log("");
-    const { setupAssistant } = await inquirer.prompt([
-      {
-        type: "confirm",
-        name: "setupAssistant",
-        message: "Set up your assistant?",
-        default: true
-      }
-    ]);
-    if (setupAssistant) {
-      const frameworkRepoUrl = "https://github.com/preset-io/agor-assistant.git";
-      await setConfigValue("onboarding.assistantPending", true);
-      await setConfigValue("onboarding.frameworkRepoUrl", frameworkRepoUrl);
-      this.log(`${chalk.green("   \u2713")} Assistant setup queued for the UI wizard`);
-      if (!process.env.ANTHROPIC_API_KEY) {
-        this.log("");
-        this.log(
-          chalk.yellow(
-            "   \u{1F4A1} Tip: Set ANTHROPIC_API_KEY in your environment for Claude Code sessions"
-          )
-        );
-        this.log(chalk.gray("   You can also configure API keys in the UI after setup"));
-      }
-    } else {
-      this.log(chalk.gray("   Skipped. You can set this up later from the UI."));
-    }
-  }
   /**
    * Prompt user for API key setup
    */

package/dist/core/{agentic-tool-DzVU-k-L.d.ts → agentic-tool-CGORlIKq.d.ts}

@@ -1,5 +1,12 @@
 import { A as AgenticToolID } from './id-DkhPzOUr.js';
 
+/**
+ * The set of credential env-var names the resolver knows how to look up.
+ * Kept as an explicit union so callers can't accidentally use an unrelated var.
+ * Lives in types (not config) so it is accessible to the browser bundle and
+ * executor without creating a circular config→types dependency.
+ */
+type ApiKeyName = 'ANTHROPIC_API_KEY' | 'ANTHROPIC_AUTH_TOKEN' | 'CLAUDE_CODE_OAUTH_TOKEN' | 'OPENAI_API_KEY' | 'GEMINI_API_KEY' | 'COPILOT_GITHUB_TOKEN';
 /**
  * Agentic coding tool names
  *
@@ -126,6 +133,22 @@ interface AgenticToolCapabilities {
  * Static capability map for all agentic tools.
  * Source of truth for what each tool supports — avoids scattered `if (tool === 'codex')` checks.
  */
+/**
+ * Auth check result — shared type for ITool.isAuthenticated and the daemon /check-auth service.
+ */
+interface AuthCheckResult {
+    authenticated: boolean;
+    method: 'api-key' | 'oauth' | 'native' | 'none';
+    hint?: string;
+}
+/**
+ * Canonical mapping from AgenticToolName to the env-var name that holds its primary API key.
+ * Tools that authenticate without a key (opencode) are intentionally absent.
+ *
+ * Single source of truth — used by the daemon check-auth service, the executor tool registry,
+ * and the onboarding wizard's API-key step.
+ */
+declare const TOOL_API_KEY_NAMES: Partial<Record<AgenticToolName, ApiKeyName>>;
 declare const AGENTIC_TOOL_CAPABILITIES: Record<AgenticToolName, AgenticToolCapabilities>;
 
-export { AGENTIC_TOOL_CAPABILITIES as A, type ClaudeCodePermissionMode as C, type GeminiPermissionMode as G, type OpenCodePermissionMode as O, type AgenticTool as a, type AgenticToolCapabilities as b, type AgenticToolName as c, type CodexApprovalPolicy as d, type CodexNetworkAccess as e, type CodexPermissionMode as f, type CodexSandboxMode as g, type CopilotPermissionMode as h };
+export { AGENTIC_TOOL_CAPABILITIES as A, type ClaudeCodePermissionMode as C, type GeminiPermissionMode as G, type OpenCodePermissionMode as O, TOOL_API_KEY_NAMES as T, type AgenticTool as a, type AgenticToolCapabilities as b, type AgenticToolName as c, type ApiKeyName as d, type AuthCheckResult as e, type CodexApprovalPolicy as f, type CodexNetworkAccess as g, type CodexPermissionMode as h, type CodexSandboxMode as i, type CopilotPermissionMode as j };

package/dist/core/{agentic-tool-BoVfSlQg.d.cts → agentic-tool-DYek7YVq.d.cts}

@@ -1,5 +1,12 @@
 import { A as AgenticToolID } from './id-DkhPzOUr.cjs';
 
+/**
+ * The set of credential env-var names the resolver knows how to look up.
+ * Kept as an explicit union so callers can't accidentally use an unrelated var.
+ * Lives in types (not config) so it is accessible to the browser bundle and
+ * executor without creating a circular config→types dependency.
+ */
+type ApiKeyName = 'ANTHROPIC_API_KEY' | 'ANTHROPIC_AUTH_TOKEN' | 'CLAUDE_CODE_OAUTH_TOKEN' | 'OPENAI_API_KEY' | 'GEMINI_API_KEY' | 'COPILOT_GITHUB_TOKEN';
 /**
  * Agentic coding tool names
  *
@@ -126,6 +133,22 @@ interface AgenticToolCapabilities {
  * Static capability map for all agentic tools.
  * Source of truth for what each tool supports — avoids scattered `if (tool === 'codex')` checks.
  */
+/**
+ * Auth check result — shared type for ITool.isAuthenticated and the daemon /check-auth service.
+ */
+interface AuthCheckResult {
+    authenticated: boolean;
+    method: 'api-key' | 'oauth' | 'native' | 'none';
+    hint?: string;
+}
+/**
+ * Canonical mapping from AgenticToolName to the env-var name that holds its primary API key.
+ * Tools that authenticate without a key (opencode) are intentionally absent.
+ *
+ * Single source of truth — used by the daemon check-auth service, the executor tool registry,
+ * and the onboarding wizard's API-key step.
+ */
+declare const TOOL_API_KEY_NAMES: Partial<Record<AgenticToolName, ApiKeyName>>;
 declare const AGENTIC_TOOL_CAPABILITIES: Record<AgenticToolName, AgenticToolCapabilities>;
 
-export { AGENTIC_TOOL_CAPABILITIES as A, type ClaudeCodePermissionMode as C, type GeminiPermissionMode as G, type OpenCodePermissionMode as O, type AgenticTool as a, type AgenticToolCapabilities as b, type AgenticToolName as c, type CodexApprovalPolicy as d, type CodexNetworkAccess as e, type CodexPermissionMode as f, type CodexSandboxMode as g, type CopilotPermissionMode as h };
+export { AGENTIC_TOOL_CAPABILITIES as A, type ClaudeCodePermissionMode as C, type GeminiPermissionMode as G, type OpenCodePermissionMode as O, TOOL_API_KEY_NAMES as T, type AgenticTool as a, type AgenticToolCapabilities as b, type AgenticToolName as c, type ApiKeyName as d, type AuthCheckResult as e, type CodexApprovalPolicy as f, type CodexNetworkAccess as g, type CodexPermissionMode as h, type CodexSandboxMode as i, type CopilotPermissionMode as j };

package/dist/core/api/index.d.cts

@@ -1,19 +1,19 @@
-import { M as Message } from '../message-aoAVQOoh.cjs';
+import { M as Message } from '../message-CbUetxFL.cjs';
 import { e as UUID } from '../id-DkhPzOUr.cjs';
-import { b as Artifact } from '../artifact-CJVX9P0W.cjs';
-import { B as Board, k as CardWithType, i as CardType, d as BoardExportBlob } from '../board-DGqozUC3.cjs';
+import { b as Artifact } from '../artifact-k1G9-H6K.cjs';
+import { B as Board, k as CardWithType, i as CardType, d as BoardExportBlob } from '../board-1cbdSXob.cjs';
 import { R as Repo, l as Worktree, C as CloneRepositoryResult } from '../repo-X-f3IbfQ.cjs';
-import { a as Session, P as PermissionMode } from '../session-D2IKSDMm.cjs';
-import { q as User } from '../user-Bh_97om1.cjs';
+import { a as Session, P as PermissionMode } from '../session-CgjZBe3u.cjs';
+import { q as User } from '../user-fbmxIZSn.cjs';
 import { a as ContextFileListItem, C as ContextFileDetail } from '../context-BpkCELpO.cjs';
-import { b as AuthenticationResult } from '../feathers-DZvgVY4k.cjs';
+import { b as AuthenticationResult } from '../feathers-DCslAllZ.cjs';
 import { f as MCPServer } from '../mcp-3o0cxfxv.cjs';
-import { T as Task } from '../task-BwzcDown.cjs';
+import { T as Task } from '../task-Bh63ayAv.cjs';
 import { a as TemplateRenderResponse, T as TemplateRenderRequest } from '../template-Ceyqdfae.cjs';
 import { Application, Params, Paginated } from '@feathersjs/feathers';
 import { Socket } from 'socket.io-client';
 export { default as authenticationClient } from '@feathersjs/authentication-client';
-import '../agentic-tool-BoVfSlQg.cjs';
+import '../agentic-tool-DYek7YVq.cjs';
 
 /**
  * Feathers Client for Agor

package/dist/core/api/index.d.ts

@@ -1,19 +1,19 @@
-import { M as Message } from '../message-0Ym119On.js';
+import { M as Message } from '../message-DhU78eBO.js';
 import { e as UUID } from '../id-DkhPzOUr.js';
-import { b as Artifact } from '../artifact-BiiLXU1_.js';
-import { B as Board, k as CardWithType, i as CardType, d as BoardExportBlob } from '../board-DJssyVxQ.js';
+import { b as Artifact } from '../artifact-DDxlQ02o.js';
+import { B as Board, k as CardWithType, i as CardType, d as BoardExportBlob } from '../board-B3k24jbC.js';
 import { R as Repo, l as Worktree, C as CloneRepositoryResult } from '../repo-rgMGUgtm.js';
-import { a as Session, P as PermissionMode } from '../session-DfaRpjh7.js';
-import { q as User } from '../user-Bu1on2Sn.js';
+import { a as Session, P as PermissionMode } from '../session-DRsYGibl.js';
+import { q as User } from '../user-C-ElgcLJ.js';
 import { a as ContextFileListItem, C as ContextFileDetail } from '../context-BpkCELpO.js';
-import { b as AuthenticationResult } from '../feathers-veXYnC_G.js';
+import { b as AuthenticationResult } from '../feathers-De9RYKO0.js';
 import { f as MCPServer } from '../mcp-BrlfyCrb.js';
-import { T as Task } from '../task-DEuBUSIM.js';
+import { T as Task } from '../task-uaxfWS17.js';
 import { a as TemplateRenderResponse, T as TemplateRenderRequest } from '../template-Ceyqdfae.js';
 import { Application, Params, Paginated } from '@feathersjs/feathers';
 import { Socket } from 'socket.io-client';
 export { default as authenticationClient } from '@feathersjs/authentication-client';
-import '../agentic-tool-DzVU-k-L.js';
+import '../agentic-tool-CGORlIKq.js';
 
 /**
  * Feathers Client for Agor

package/dist/core/{artifact-BiiLXU1_.d.ts → artifact-DDxlQ02o.d.ts}

@@ -1,4 +1,4 @@
-import { S as SandpackTemplate } from './board-DJssyVxQ.js';
+import { S as SandpackTemplate } from './board-B3k24jbC.js';
 import { b as ArtifactID, W as WorktreeID, B as BoardID, e as UUID, f as UserID } from './id-DkhPzOUr.js';
 
 /**

package/dist/core/{artifact-CJVX9P0W.d.cts → artifact-k1G9-H6K.d.cts}

@@ -1,4 +1,4 @@
-import { S as SandpackTemplate } from './board-DGqozUC3.cjs';
+import { S as SandpackTemplate } from './board-1cbdSXob.cjs';
 import { b as ArtifactID, W as WorktreeID, B as BoardID, e as UUID, f as UserID } from './id-DkhPzOUr.cjs';
 
 /**

package/dist/core/{board-DGqozUC3.d.cts → board-1cbdSXob.d.cts}

@@ -1,4 +1,4 @@
-import { c as AgenticToolName } from './agentic-tool-BoVfSlQg.cjs';
+import { c as AgenticToolName } from './agentic-tool-DYek7YVq.cjs';
 import { e as UUID, B as BoardID, b as ArtifactID, W as WorktreeID } from './id-DkhPzOUr.cjs';
 
 /**

package/dist/core/{board-DJssyVxQ.d.ts → board-B3k24jbC.d.ts}

@@ -1,4 +1,4 @@
-import { c as AgenticToolName } from './agentic-tool-DzVU-k-L.js';
+import { c as AgenticToolName } from './agentic-tool-CGORlIKq.js';
 import { e as UUID, B as BoardID, b as ArtifactID, W as WorktreeID } from './id-DkhPzOUr.js';
 
 /**

package/dist/core/claude/index.cjs

@@ -314,7 +314,7 @@ var init_task = __esm({
       // Stop requested, waiting for SDK to halt
       AWAITING_PERMISSION: "awaiting_permission",
       AWAITING_INPUT: "awaiting_input",
-      // Agent asked user a question (AskUserQuestion tool)
+      // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new tasks never enter this state, kept for historical rows
       TIMED_OUT: "timed_out",
       // Permission/input request timed out, executor exited — user must re-prompt
       COMPLETED: "completed",
@@ -613,7 +613,9 @@ var init_schema_postgres = __esm({
             "system",
             "file-history-snapshot",
             "permission_request",
-            "input_request"
+            "input_request",
+            "daemon_restart",
+            "daemon_crash"
           ]
         }).notNull(),
         role: (0, import_pg_core.text)("role", {
@@ -1366,7 +1368,9 @@ var init_schema_sqlite = __esm({
             "system",
             "file-history-snapshot",
             "permission_request",
-            "input_request"
+            "input_request",
+            "daemon_restart",
+            "daemon_crash"
           ]
         }).notNull(),
         role: (0, import_sqlite_core.text)("role", {

package/dist/core/claude/index.d.cts

@@ -1,6 +1,6 @@
-import { M as Message } from '../message-aoAVQOoh.cjs';
+import { M as Message } from '../message-CbUetxFL.cjs';
 import { S as SessionID } from '../id-DkhPzOUr.cjs';
-import { d as TaskStatus, T as Task } from '../task-BwzcDown.cjs';
+import { d as TaskStatus, T as Task } from '../task-Bh63ayAv.cjs';
 import '../context-BpkCELpO.cjs';
 
 /**

package/dist/core/claude/index.d.ts

@@ -1,6 +1,6 @@
-import { M as Message } from '../message-0Ym119On.js';
+import { M as Message } from '../message-DhU78eBO.js';
 import { S as SessionID } from '../id-DkhPzOUr.js';
-import { d as TaskStatus, T as Task } from '../task-DEuBUSIM.js';
+import { d as TaskStatus, T as Task } from '../task-uaxfWS17.js';
 import '../context-BpkCELpO.js';
 
 /**

package/dist/core/claude/index.js

@@ -292,7 +292,7 @@ var init_task = __esm({
       // Stop requested, waiting for SDK to halt
       AWAITING_PERMISSION: "awaiting_permission",
       AWAITING_INPUT: "awaiting_input",
-      // Agent asked user a question (AskUserQuestion tool)
+      // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new tasks never enter this state, kept for historical rows
       TIMED_OUT: "timed_out",
       // Permission/input request timed out, executor exited — user must re-prompt
       COMPLETED: "completed",
@@ -604,7 +604,9 @@ var init_schema_postgres = __esm({
             "system",
             "file-history-snapshot",
             "permission_request",
-            "input_request"
+            "input_request",
+            "daemon_restart",
+            "daemon_crash"
           ]
         }).notNull(),
         role: text("role", {
@@ -1365,7 +1367,9 @@ var init_schema_sqlite = __esm({
             "system",
             "file-history-snapshot",
             "permission_request",
-            "input_request"
+            "input_request",
+            "daemon_restart",
+            "daemon_crash"
           ]
         }).notNull(),
         role: text2("role", {

package/dist/core/client/claude-system-suppression.cjs

@@ -0,0 +1,59 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/claude-system-suppression.ts
+var claude_system_suppression_exports = {};
+__export(claude_system_suppression_exports, {
+  SUPPRESSED_CLAUDE_STATUSES: () => SUPPRESSED_CLAUDE_STATUSES,
+  SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES: () => SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES,
+  shouldHidePersistedClaudeSdkEvent: () => shouldHidePersistedClaudeSdkEvent
+});
+module.exports = __toCommonJS(claude_system_suppression_exports);
+var SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES = /* @__PURE__ */ new Set([
+  "files_persisted",
+  "session_state_changed",
+  "task_started",
+  "task_progress",
+  "task_updated",
+  "task_notification"
+]);
+var SUPPRESSED_CLAUDE_STATUSES = /* @__PURE__ */ new Set([
+  "requesting"
+]);
+function shouldHidePersistedClaudeSdkEvent(block) {
+  if (block.type !== "sdk_event") return false;
+  if (block.sdkType !== "system") return false;
+  if (!block.sdkSubtype) return false;
+  if (SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES.has(block.sdkSubtype)) {
+    return true;
+  }
+  if (block.sdkSubtype === "status") {
+    const status = typeof block.metadata === "object" && block.metadata !== null ? block.metadata.status : void 0;
+    if (typeof status === "string" && SUPPRESSED_CLAUDE_STATUSES.has(status)) {
+      return true;
+    }
+  }
+  return false;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SUPPRESSED_CLAUDE_STATUSES,
+  SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES,
+  shouldHidePersistedClaudeSdkEvent
+});

package/dist/core/client/claude-system-suppression.d.cts

@@ -0,0 +1,80 @@
+import { SDKMessage } from '@anthropic-ai/claude-agent-sdk';
+
+/**
+ * Shared suppression rules for noisy Claude Agent SDK `type:'system'` events.
+ *
+ * Blacklist philosophy: surface unknown subtypes by default so newly added
+ * SDK events (e.g. `mirror_error`, `notification`, `api_retry`, `memory_recall`,
+ * `plugin_install`) reach users without code changes. Only entries we have
+ * confirmed are pure lifecycle telemetry belong in the suppress set.
+ *
+ * Two consumers:
+ *   - executor (`message-processor.ts`): drops these before they ever become
+ *     persisted sdk_event blocks. Forward-only.
+ *   - UI (`RateLimitBlock`): defensive filter for sdk_event rows already in the
+ *     DB from sessions created before a given suppression entry was added.
+ *
+ * History:
+ *   - PR #1116 added `status='requesting'`.
+ *   - PR #1172 added `task_updated` and lifted both rules into this shared
+ *     module so the executor + UI no longer hardcode the same literals.
+ *
+ * This module is browser-safe: it imports types only from
+ * `@anthropic-ai/claude-agent-sdk` (erased at runtime).
+ */
+
+/**
+ * The exhaustive set of `subtype` values for SDK messages with `type:'system'`,
+ * pulled from the SDK's discriminated union. A rename in the SDK turns into a
+ * type error at the call site, rather than a silent miss.
+ */
+type ClaudeSystemSubtype = Extract<SDKMessage, {
+    type: 'system';
+}>['subtype'];
+/**
+ * The `status` values an `SDKStatusMessage` can carry, again derived from the
+ * SDK union so an upstream rename trips typecheck instead of silently leaking.
+ */
+type ClaudeSystemStatus = Extract<SDKMessage, {
+    type: 'system';
+    subtype: 'status';
+}>['status'];
+/**
+ * System subtypes we suppress on sight — pure lifecycle telemetry that has no
+ * user-meaningful content on its own.
+ *
+ * Task failure visibility note: `task_*` events are suppressed wholesale,
+ * including `task_updated` rows where `patch.error` is set. The Task tool's
+ * own `tool_result` block (with `is_error: true`) is the authoritative surface
+ * for subagent task failures; the parallel `task_*` telemetry stream is
+ * redundant. If that invariant ever breaks, revisit this set.
+ */
+declare const SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES: ReadonlySet<ClaudeSystemSubtype>;
+/**
+ * `SDKStatusMessage.status` values we suppress. `requesting` fires on every
+ * API call; `compacting` is handled separately in the executor (it renders as
+ * a real SYSTEM "Compacting…" message). Other status values — `null` (the SDK's
+ * "no active status" sentinel, often co-occurring with `permissionMode` or
+ * `compact_result` fields) and any future additions — are intentionally allowed
+ * to fall through to the generic sdk_event surfacer.
+ */
+declare const SUPPRESSED_CLAUDE_STATUSES: ReadonlySet<NonNullable<ClaudeSystemStatus>>;
+/**
+ * Block shape persisted on `sdk_event` content blocks. Loose by design: this
+ * helper is consumed by the UI from message rows that may predate any given
+ * schema revision.
+ */
+interface PersistedSdkEventBlock {
+    type?: string;
+    sdkType?: string;
+    sdkSubtype?: string;
+    metadata?: unknown;
+}
+/**
+ * Defensive UI filter: returns true when an already-persisted `sdk_event`
+ * block matches one of our suppression rules and should be hidden from the
+ * transcript. Catches rows written before the executor learned to drop them.
+ */
+declare function shouldHidePersistedClaudeSdkEvent(block: PersistedSdkEventBlock): boolean;
+
+export { type ClaudeSystemStatus, type ClaudeSystemSubtype, SUPPRESSED_CLAUDE_STATUSES, SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES, shouldHidePersistedClaudeSdkEvent };

package/dist/core/client/claude-system-suppression.d.ts

@@ -0,0 +1,80 @@
+import { SDKMessage } from '@anthropic-ai/claude-agent-sdk';
+
+/**
+ * Shared suppression rules for noisy Claude Agent SDK `type:'system'` events.
+ *
+ * Blacklist philosophy: surface unknown subtypes by default so newly added
+ * SDK events (e.g. `mirror_error`, `notification`, `api_retry`, `memory_recall`,
+ * `plugin_install`) reach users without code changes. Only entries we have
+ * confirmed are pure lifecycle telemetry belong in the suppress set.
+ *
+ * Two consumers:
+ *   - executor (`message-processor.ts`): drops these before they ever become
+ *     persisted sdk_event blocks. Forward-only.
+ *   - UI (`RateLimitBlock`): defensive filter for sdk_event rows already in the
+ *     DB from sessions created before a given suppression entry was added.
+ *
+ * History:
+ *   - PR #1116 added `status='requesting'`.
+ *   - PR #1172 added `task_updated` and lifted both rules into this shared
+ *     module so the executor + UI no longer hardcode the same literals.
+ *
+ * This module is browser-safe: it imports types only from
+ * `@anthropic-ai/claude-agent-sdk` (erased at runtime).
+ */
+
+/**
+ * The exhaustive set of `subtype` values for SDK messages with `type:'system'`,
+ * pulled from the SDK's discriminated union. A rename in the SDK turns into a
+ * type error at the call site, rather than a silent miss.
+ */
+type ClaudeSystemSubtype = Extract<SDKMessage, {
+    type: 'system';
+}>['subtype'];
+/**
+ * The `status` values an `SDKStatusMessage` can carry, again derived from the
+ * SDK union so an upstream rename trips typecheck instead of silently leaking.
+ */
+type ClaudeSystemStatus = Extract<SDKMessage, {
+    type: 'system';
+    subtype: 'status';
+}>['status'];
+/**
+ * System subtypes we suppress on sight — pure lifecycle telemetry that has no
+ * user-meaningful content on its own.
+ *
+ * Task failure visibility note: `task_*` events are suppressed wholesale,
+ * including `task_updated` rows where `patch.error` is set. The Task tool's
+ * own `tool_result` block (with `is_error: true`) is the authoritative surface
+ * for subagent task failures; the parallel `task_*` telemetry stream is
+ * redundant. If that invariant ever breaks, revisit this set.
+ */
+declare const SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES: ReadonlySet<ClaudeSystemSubtype>;
+/**
+ * `SDKStatusMessage.status` values we suppress. `requesting` fires on every
+ * API call; `compacting` is handled separately in the executor (it renders as
+ * a real SYSTEM "Compacting…" message). Other status values — `null` (the SDK's
+ * "no active status" sentinel, often co-occurring with `permissionMode` or
+ * `compact_result` fields) and any future additions — are intentionally allowed
+ * to fall through to the generic sdk_event surfacer.
+ */
+declare const SUPPRESSED_CLAUDE_STATUSES: ReadonlySet<NonNullable<ClaudeSystemStatus>>;
+/**
+ * Block shape persisted on `sdk_event` content blocks. Loose by design: this
+ * helper is consumed by the UI from message rows that may predate any given
+ * schema revision.
+ */
+interface PersistedSdkEventBlock {
+    type?: string;
+    sdkType?: string;
+    sdkSubtype?: string;
+    metadata?: unknown;
+}
+/**
+ * Defensive UI filter: returns true when an already-persisted `sdk_event`
+ * block matches one of our suppression rules and should be hidden from the
+ * transcript. Catches rows written before the executor learned to drop them.
+ */
+declare function shouldHidePersistedClaudeSdkEvent(block: PersistedSdkEventBlock): boolean;
+
+export { type ClaudeSystemStatus, type ClaudeSystemSubtype, SUPPRESSED_CLAUDE_STATUSES, SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES, shouldHidePersistedClaudeSdkEvent };

package/dist/core/client/claude-system-suppression.js

@@ -0,0 +1,32 @@
+// src/client/claude-system-suppression.ts
+var SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES = /* @__PURE__ */ new Set([
+  "files_persisted",
+  "session_state_changed",
+  "task_started",
+  "task_progress",
+  "task_updated",
+  "task_notification"
+]);
+var SUPPRESSED_CLAUDE_STATUSES = /* @__PURE__ */ new Set([
+  "requesting"
+]);
+function shouldHidePersistedClaudeSdkEvent(block) {
+  if (block.type !== "sdk_event") return false;
+  if (block.sdkType !== "system") return false;
+  if (!block.sdkSubtype) return false;
+  if (SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES.has(block.sdkSubtype)) {
+    return true;
+  }
+  if (block.sdkSubtype === "status") {
+    const status = typeof block.metadata === "object" && block.metadata !== null ? block.metadata.status : void 0;
+    if (typeof status === "string" && SUPPRESSED_CLAUDE_STATUSES.has(status)) {
+      return true;
+    }
+  }
+  return false;
+}
+export {
+  SUPPRESSED_CLAUDE_STATUSES,
+  SUPPRESSED_CLAUDE_SYSTEM_SUBTYPES,
+  shouldHidePersistedClaudeSdkEvent
+};

package/dist/core/client/index.cjs

@@ -61,6 +61,7 @@ __export(client_exports, {
   SERVICE_TIER_RANK: () => SERVICE_TIER_RANK,
   SESSION: () => SESSION,
   SessionStatus: () => SessionStatus,
+  TOOL_API_KEY_NAMES: () => TOOL_API_KEY_NAMES,
   TaskStatus: () => TaskStatus,
   URL_SHORT_ID_LENGTH: () => URL_SHORT_ID_LENGTH,
   WEBSOCKET: () => WEBSOCKET,
@@ -915,6 +916,12 @@ function buildZoneTriggerContext(input) {
 }
 
 // src/types/agentic-tool.ts
+var TOOL_API_KEY_NAMES = {
+  "claude-code": "ANTHROPIC_API_KEY",
+  codex: "OPENAI_API_KEY",
+  gemini: "GEMINI_API_KEY",
+  copilot: "COPILOT_GITHUB_TOKEN"
+};
 var AGENTIC_TOOL_CAPABILITIES = {
   "claude-code": {
     supportsSessionFork: true,
@@ -923,7 +930,7 @@ var AGENTIC_TOOL_CAPABILITIES = {
     supportsStatelessFsMode: true
   },
   codex: {
-    supportsSessionFork: false,
+    supportsSessionFork: true,
     supportsChildSpawn: true,
     supportsSessionImport: false,
     supportsStatelessFsMode: true
@@ -1206,7 +1213,7 @@ var SessionStatus = {
   // Stop requested, waiting for task to stop
   AWAITING_PERMISSION: "awaiting_permission",
   AWAITING_INPUT: "awaiting_input",
-  // Agent asked user a question (AskUserQuestion tool)
+  // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
   TIMED_OUT: "timed_out",
   // Permission/input request timed out, executor exited — user must re-prompt
   COMPLETED: "completed",
@@ -1258,7 +1265,7 @@ var TaskStatus = {
   // Stop requested, waiting for SDK to halt
   AWAITING_PERMISSION: "awaiting_permission",
   AWAITING_INPUT: "awaiting_input",
-  // Agent asked user a question (AskUserQuestion tool)
+  // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new tasks never enter this state, kept for historical rows
   TIMED_OUT: "timed_out",
   // Permission/input request timed out, executor exited — user must re-prompt
   COMPLETED: "completed",
@@ -1389,6 +1396,7 @@ var getPersistedAgentConfig = getAssistantConfig;
   SERVICE_TIER_RANK,
   SESSION,
   SessionStatus,
+  TOOL_API_KEY_NAMES,
   TaskStatus,
   URL_SHORT_ID_LENGTH,
   WEBSOCKET,