airlock-bot 0.0.1 → 0.2.2

package/dist/hitl/engine.d.ts

@@ -0,0 +1,36 @@
+import type { AuditLogger } from '../audit/logger.js';
+import type { HitlProvider, ApprovalApi } from './providers/types.js';
+export type HitlResult = 'approved' | 'denied' | 'timeout';
+export interface HitlTicket {
+    id: string;
+    code: string;
+    result: Promise<HitlResult>;
+}
+export declare class HitlEngine implements ApprovalApi {
+    private auditLogger;
+    private provider;
+    readonly timeoutMs: number;
+    private pending;
+    private byCode;
+    constructor(auditLogger: AuditLogger, provider: HitlProvider, timeoutMs: number);
+    create(params: {
+        agentId: string;
+        tool: string;
+        args: Record<string, unknown>;
+    }): HitlTicket;
+    /** Approve by code (used by providers) or by id (used by API) */
+    approve(codeOrId: string): void;
+    /** Deny by code or id */
+    deny(codeOrId: string, reason?: string): void;
+    getPending(): Array<{
+        id: string;
+        code: string;
+        agentId: string;
+        tool: string;
+        args: Record<string, unknown>;
+    }>;
+    private resolveRequest;
+    /** Recover pending requests from DB on startup */
+    recoverPending(): Promise<void>;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/hitl/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/hitl/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAKtE,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7B;AAYD,qBAAa,UAAW,YAAW,WAAW;IAK1C,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,QAAQ;IAChB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAN5B,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,MAAM,CAA6B;gBAGjC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM;IAG5B,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,UAAU;IAkC5F,iEAAiE;IACjE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAc/B,yBAAyB;IACzB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAc7C,UAAU,IAAI,KAAK,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC/B,CAAC;IAUF,OAAO,CAAC,cAAc;IAStB,kDAAkD;IAE5C,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CA8DtC"}

package/dist/hitl/engine.js

@@ -0,0 +1,150 @@
+import { generateId, generateApprovalCode } from '../util/id.js';
+import { childLogger } from '../util/logger.js';
+const log = childLogger('hitl-engine');
+export class HitlEngine {
+    auditLogger;
+    provider;
+    timeoutMs;
+    pending = new Map(); // id → request
+    byCode = new Map(); // code → id
+    constructor(auditLogger, provider, timeoutMs) {
+        this.auditLogger = auditLogger;
+        this.provider = provider;
+        this.timeoutMs = timeoutMs;
+    }
+    create(params) {
+        const id = generateId();
+        const code = generateApprovalCode();
+        // Persist to DB synchronously before returning
+        this.auditLogger.insertHitl({
+            id,
+            code,
+            agent_id: params.agentId,
+            tool: params.tool,
+            args: JSON.stringify(params.args),
+            status: 'pending',
+            created_at: new Date().toISOString(),
+        });
+        const result = new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                this.byCode.delete(code);
+                this.auditLogger.updateHitlStatus(id, 'timeout');
+                log.warn({ id, code, tool: params.tool }, 'HITL request timed out');
+                resolve('timeout');
+            }, this.timeoutMs);
+            timer.unref();
+            const req = { id, code, ...params, resolve, timer };
+            this.pending.set(id, req);
+            this.byCode.set(code, id);
+        });
+        log.info({ id, code, agent: params.agentId, tool: params.tool }, 'HITL request created');
+        return { id, code, result };
+    }
+    /** Approve by code (used by providers) or by id (used by API) */
+    approve(codeOrId) {
+        const req = this.resolveRequest(codeOrId);
+        if (!req) {
+            log.warn({ codeOrId }, 'No pending HITL request found');
+            return;
+        }
+        clearTimeout(req.timer);
+        this.pending.delete(req.id);
+        this.byCode.delete(req.code);
+        this.auditLogger.updateHitlStatus(req.id, 'approved');
+        log.info({ id: req.id, code: req.code }, 'HITL approved');
+        req.resolve('approved');
+    }
+    /** Deny by code or id */
+    deny(codeOrId, reason) {
+        const req = this.resolveRequest(codeOrId);
+        if (!req) {
+            log.warn({ codeOrId }, 'No pending HITL request found');
+            return;
+        }
+        clearTimeout(req.timer);
+        this.pending.delete(req.id);
+        this.byCode.delete(req.code);
+        this.auditLogger.updateHitlStatus(req.id, 'denied', reason);
+        log.info({ id: req.id, code: req.code, reason }, 'HITL denied');
+        req.resolve('denied');
+    }
+    getPending() {
+        return Array.from(this.pending.values()).map((r) => ({
+            id: r.id,
+            code: r.code,
+            agentId: r.agentId,
+            tool: r.tool,
+            args: r.args,
+        }));
+    }
+    resolveRequest(codeOrId) {
+        // Try as id first
+        if (this.pending.has(codeOrId))
+            return this.pending.get(codeOrId);
+        // Try as code
+        const id = this.byCode.get(codeOrId);
+        if (id)
+            return this.pending.get(id);
+        return undefined;
+    }
+    /** Recover pending requests from DB on startup */
+    // eslint-disable-next-line @typescript-eslint/require-await
+    async recoverPending() {
+        const rows = this.auditLogger.getPendingHitl();
+        if (rows.length === 0)
+            return;
+        log.info({ count: rows.length }, 'Recovering pending HITL requests from DB');
+        for (const row of rows) {
+            let args = {};
+            try {
+                args = JSON.parse(row.args);
+            }
+            catch {
+                log.warn({ id: row.id }, 'Failed to parse HITL args from DB, using empty args');
+            }
+            const elapsed = Date.now() - new Date(row.created_at).getTime();
+            const remaining = this.timeoutMs - elapsed;
+            if (remaining <= 0) {
+                this.auditLogger.updateHitlStatus(row.id, 'timeout');
+                continue;
+            }
+            // Re-arm without re-notifying (provider may not be ready yet)
+            const promise = new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    this.pending.delete(row.id);
+                    this.byCode.delete(row.code);
+                    this.auditLogger.updateHitlStatus(row.id, 'timeout');
+                    resolve('timeout');
+                }, remaining);
+                timer.unref();
+                const req = {
+                    id: row.id,
+                    code: row.code,
+                    agentId: row.agent_id,
+                    tool: row.tool,
+                    args,
+                    resolve,
+                    timer,
+                };
+                this.pending.set(row.id, req);
+                this.byCode.set(row.code, row.id);
+            });
+            // Notify again so operator sees recovered requests
+            void this.provider
+                .notify([
+                {
+                    id: row.id,
+                    code: row.code,
+                    agentId: row.agent_id,
+                    tool: row.tool,
+                    args,
+                    timeoutMs: remaining,
+                },
+            ])
+                .catch((err) => log.warn({ err }, 'Failed to re-notify recovered HITL request'));
+            void promise; // tracked in pending map
+        }
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/hitl/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/hitl/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,GAAG,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;AAoBvC,MAAM,OAAO,UAAU;IAKX;IACA;IACC;IANH,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC,CAAC,eAAe;IAC5D,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,YAAY;IAExD,YACU,WAAwB,EACxB,QAAsB,EACrB,SAAiB;QAFlB,gBAAW,GAAX,WAAW,CAAa;QACxB,aAAQ,GAAR,QAAQ,CAAc;QACrB,cAAS,GAAT,SAAS,CAAQ;IACzB,CAAC;IAEJ,MAAM,CAAC,MAAwE;QAC7E,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QAEpC,+CAA+C;QAC/C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;YAC1B,EAAE;YACF,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,OAAO;YACxB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;gBACpE,OAAO,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnB,KAAK,CAAC,KAAK,EAAE,CAAC;YAEd,MAAM,GAAG,GAAmB,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,sBAAsB,CAAC,CAAC;QACzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,iEAAiE;IACjE,OAAO,CAAC,QAAgB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,QAAgB,EAAE,MAAe;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAED,UAAU;QAOR,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,kBAAkB;QAClB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClE,cAAc;QACd,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kDAAkD;IAClD,4DAA4D;IAC5D,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE9B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAE7E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,GAA4B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,qDAAqD,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC;YAE3C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBACrD,SAAS;YACX,CAAC;YAED,8DAA8D;YAC9D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;gBAClD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC7B,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;oBACrD,OAAO,CAAC,SAAS,CAAC,CAAC;gBACrB,CAAC,EAAE,SAAS,CAAC,CAAC;gBACd,KAAK,CAAC,KAAK,EAAE,CAAC;gBAEd,MAAM,GAAG,GAAmB;oBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,CAAC,QAAQ;oBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,OAAO;oBACP,KAAK;iBACN,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;YAEH,mDAAmD;YACnD,KAAK,IAAI,CAAC,QAAQ;iBACf,MAAM,CAAC;gBACN;oBACE,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,CAAC,QAAQ;oBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI;oBACJ,SAAS,EAAE,SAAS;iBACrB;aACF,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC,CAAC;YAEnF,KAAK,OAAO,CAAC,CAAC,yBAAyB;QACzC,CAAC;IACH,CAAC;CACF"}

package/dist/hitl/formatter.d.ts

@@ -0,0 +1,4 @@
+import type { HitlNotification } from './providers/types.js';
+export declare function formatNotification(req: HitlNotification): string;
+export declare function formatBatch(requests: HitlNotification[]): string;
+//# sourceMappingURL=formatter.d.ts.map

package/dist/hitl/formatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.d.ts","sourceRoot":"","sources":["../../src/hitl/formatter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAwBhE;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAMhE"}

package/dist/hitl/formatter.js

@@ -0,0 +1,31 @@
+export function formatNotification(req) {
+    const timeoutMin = Math.round(req.timeoutMs / 60000);
+    const argLines = Object.entries(req.args)
+        .map(([k, v]) => {
+        const val = typeof v === 'string'
+            ? v.length > 200
+                ? `"${v.slice(0, 200)}..." (truncated)`
+                : `"${v}"`
+            : JSON.stringify(v);
+        return `  ${k}: ${val}`;
+    })
+        .join('\n');
+    return [
+        `🔒 APPROVE? [${req.code}]`,
+        ``,
+        `Agent: ${req.agentId}`,
+        `Tool:  ${req.tool}`,
+        argLines,
+        ``,
+        `approve ${req.code} / deny ${req.code}`,
+        `Expires: ${timeoutMin}m`,
+    ].join('\n');
+}
+export function formatBatch(requests) {
+    if (requests.length === 1)
+        return formatNotification(requests[0]);
+    const header = `🔒 ${requests.length} APPROVAL REQUESTS`;
+    const items = requests.map((r) => formatNotification(r)).join('\n\n---\n\n');
+    return `${header}\n\n${items}`;
+}
+//# sourceMappingURL=formatter.js.map

package/dist/hitl/formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatter.js","sourceRoot":"","sources":["../../src/hitl/formatter.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,MAAM,GAAG,GACP,OAAO,CAAC,KAAK,QAAQ;YACnB,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG;gBACd,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB;gBACvC,CAAC,CAAC,IAAI,CAAC,GAAG;YACZ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;QACL,gBAAgB,GAAG,CAAC,IAAI,GAAG;QAC3B,EAAE;QACF,UAAU,GAAG,CAAC,OAAO,EAAE;QACvB,UAAU,GAAG,CAAC,IAAI,EAAE;QACpB,QAAQ;QACR,EAAE;QACF,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,EAAE;QACxC,YAAY,UAAU,GAAG;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAA4B;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,oBAAoB,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7E,OAAO,GAAG,MAAM,OAAO,KAAK,EAAE,CAAC;AACjC,CAAC"}

package/dist/hitl/parser.d.ts

@@ -0,0 +1,7 @@
+export interface ParsedApproval {
+    type: 'approve' | 'deny';
+    code: string;
+    reason?: string;
+}
+export declare function parseApprovalCommand(text: string): ParsedApproval | null;
+//# sourceMappingURL=parser.d.ts.map

package/dist/hitl/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/hitl/parser.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAcxE"}

package/dist/hitl/parser.js

@@ -0,0 +1,17 @@
+const CODE = '[A-Z0-9]{6,8}';
+// Matches both bare commands ("approve ABC123") and prefixed ("hitl approve ABC123")
+const APPROVE_RE = new RegExp(`(?:hitl\\s+)?approve\\s+(${CODE})\\s*$`, 'i');
+const DENY_RE = new RegExp(`(?:hitl\\s+)?deny\\s+(${CODE})(?:\\s+(.+))?\\s*$`, 'i');
+export function parseApprovalCommand(text) {
+    const trimmed = text.trim();
+    const approveMatch = trimmed.match(APPROVE_RE);
+    if (approveMatch) {
+        return { type: 'approve', code: approveMatch[1].toUpperCase() };
+    }
+    const denyMatch = trimmed.match(DENY_RE);
+    if (denyMatch) {
+        return { type: 'deny', code: denyMatch[1].toUpperCase(), reason: denyMatch[2] };
+    }
+    return null;
+}
+//# sourceMappingURL=parser.js.map

package/dist/hitl/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/hitl/parser.ts"],"names":[],"mappings":"AAMA,MAAM,IAAI,GAAG,eAAe,CAAC;AAE7B,qFAAqF;AACrF,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,4BAA4B,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC7E,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,yBAAyB,IAAI,qBAAqB,EAAE,GAAG,CAAC,CAAC;AAEpF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hitl/provider-factory.d.ts

@@ -0,0 +1,4 @@
+import type { HitlProvider, ApprovalApi } from './providers/types.js';
+import type { HitlProviderConfig } from '../config/schema.js';
+export declare function createHitlProvider(cfg: HitlProviderConfig | HitlProviderConfig[], approvalApi: ApprovalApi): HitlProvider;
+//# sourceMappingURL=provider-factory.d.ts.map

package/dist/hitl/provider-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-factory.d.ts","sourceRoot":"","sources":["../../src/hitl/provider-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAc9D,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,EAC9C,WAAW,EAAE,WAAW,GACvB,YAAY,CAMd"}

package/dist/hitl/provider-factory.js

@@ -0,0 +1,42 @@
+import { CompositeHitlProvider } from './providers/composite.js';
+import { StdioHitlProvider } from './providers/stdio.js';
+import { TelegramHitlProvider } from './providers/telegram.js';
+import { OpenClawHitlProvider } from './providers/openclaw.js';
+import { SlackHitlProvider } from './providers/slack.js';
+import { WebhookHitlProvider } from './providers/webhook.js';
+import { TuiHitlProvider } from './providers/tui.js';
+import { MacosHitlProvider } from './providers/macos.js';
+import { DashboardHitlProvider } from './providers/dashboard.js';
+import { childLogger } from '../util/logger.js';
+const log = childLogger('hitl-factory');
+export function createHitlProvider(cfg, approvalApi) {
+    if (Array.isArray(cfg)) {
+        const providers = cfg.map((c) => createSingleProvider(c, approvalApi));
+        return providers.length === 1 ? providers[0] : new CompositeHitlProvider(providers);
+    }
+    return createSingleProvider(cfg, approvalApi);
+}
+function createSingleProvider(cfg, approvalApi) {
+    switch (cfg.type) {
+        case 'telegram':
+            return new TelegramHitlProvider({ bot_token: cfg.bot_token, chat_id: cfg.chat_id }, approvalApi);
+        case 'openclaw':
+            return new OpenClawHitlProvider({ gateway_url: cfg.gateway_url, token: cfg.token, session_key: cfg.session_key }, approvalApi);
+        case 'slack':
+            return new SlackHitlProvider({ webhook_url: cfg.webhook_url });
+        case 'webhook':
+            return new WebhookHitlProvider({ url: cfg.url, headers: cfg.headers });
+        case 'tui':
+            return new TuiHitlProvider(approvalApi);
+        case 'macos':
+            return new MacosHitlProvider(approvalApi);
+        case 'dashboard':
+            return new DashboardHitlProvider({ port: cfg.port }, approvalApi);
+        case 'stdio':
+            return new StdioHitlProvider(approvalApi);
+        default:
+            log.warn({ type: cfg.type }, 'Unknown HITL provider type, falling back to stdio');
+            return new StdioHitlProvider(approvalApi);
+    }
+}
+//# sourceMappingURL=provider-factory.js.map

package/dist/hitl/provider-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-factory.js","sourceRoot":"","sources":["../../src/hitl/provider-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,GAAG,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;AAExC,MAAM,UAAU,kBAAkB,CAChC,GAA8C,EAC9C,WAAwB;IAExB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QACvE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAuB,EAAE,WAAwB;IAC7E,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,IAAI,oBAAoB,CAC7B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAClD,WAAW,CACZ,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,IAAI,oBAAoB,CAC7B,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAChF,WAAW,CACZ,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,KAAK,SAAS;YACZ,OAAO,IAAI,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,KAAK,KAAK;YACR,OAAO,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1C,KAAK,OAAO;YACV,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC5C,KAAK,WAAW;YACd,OAAO,IAAI,qBAAqB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;QACpE,KAAK,OAAO;YACV,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC5C;YACE,GAAG,CAAC,IAAI,CACN,EAAE,IAAI,EAAG,GAAwB,CAAC,IAAI,EAAE,EACxC,mDAAmD,CACpD,CAAC;YACF,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/hitl/providers/composite.d.ts

@@ -0,0 +1,9 @@
+import type { HitlProvider, HitlNotification } from './types.js';
+export declare class CompositeHitlProvider implements HitlProvider {
+    private providers;
+    constructor(providers: HitlProvider[]);
+    init(): Promise<void>;
+    notify(requests: HitlNotification[]): Promise<void>;
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=composite.d.ts.map

package/dist/hitl/providers/composite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composite.d.ts","sourceRoot":"","sources":["../../../src/hitl/providers/composite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAKjE,qBAAa,qBAAsB,YAAW,YAAY;IAC5C,OAAO,CAAC,SAAS;gBAAT,SAAS,EAAE,YAAY,EAAE;IAEvC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASnD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAG5B"}

package/dist/hitl/providers/composite.js

@@ -0,0 +1,23 @@
+import { childLogger } from '../../util/logger.js';
+const log = childLogger('hitl-composite');
+export class CompositeHitlProvider {
+    providers;
+    constructor(providers) {
+        this.providers = providers;
+    }
+    async init() {
+        await Promise.all(this.providers.map((p) => p.init()));
+    }
+    async notify(requests) {
+        const results = await Promise.allSettled(this.providers.map((p) => p.notify(requests)));
+        for (const r of results) {
+            if (r.status === 'rejected') {
+                log.error({ err: r.reason }, 'HITL provider notify failed');
+            }
+        }
+    }
+    async stop() {
+        await Promise.allSettled(this.providers.map((p) => p.stop()));
+    }
+}
+//# sourceMappingURL=composite.js.map

package/dist/hitl/providers/composite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composite.js","sourceRoot":"","sources":["../../../src/hitl/providers/composite.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,GAAG,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;AAE1C,MAAM,OAAO,qBAAqB;IACZ;IAApB,YAAoB,SAAyB;QAAzB,cAAS,GAAT,SAAS,CAAgB;IAAG,CAAC;IAEjD,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAA4B;QACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC5B,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/hitl/providers/dashboard.d.ts

@@ -0,0 +1,17 @@
+import type { HitlProvider, HitlNotification, ApprovalApi } from './types.js';
+export interface DashboardHitlConfig {
+    port: number;
+}
+export declare class DashboardHitlProvider implements HitlProvider {
+    private config;
+    private approvalApi;
+    private server?;
+    private clients;
+    private pending;
+    constructor(config: DashboardHitlConfig, approvalApi: ApprovalApi);
+    init(): Promise<void>;
+    stop(): Promise<void>;
+    notify(requests: HitlNotification[]): Promise<void>;
+    private broadcast;
+}
+//# sourceMappingURL=dashboard.d.ts.map

package/dist/hitl/providers/dashboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../../src/hitl/providers/dashboard.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAI9E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,qBAAsB,YAAW,YAAY;IAMtD,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,WAAW;IANrB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,OAAO,CAAoE;IACnF,OAAO,CAAC,OAAO,CAAuC;gBAG5C,MAAM,EAAE,mBAAmB,EAC3B,WAAW,EAAE,WAAW;IAG5B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4ErB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAe3B,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD,OAAO,CAAC,SAAS;CAUlB"}

package/dist/hitl/providers/dashboard.js

@@ -0,0 +1,210 @@
+import { createServer } from 'http';
+import { childLogger } from '../../util/logger.js';
+const log = childLogger('hitl-dashboard');
+export class DashboardHitlProvider {
+    config;
+    approvalApi;
+    server;
+    clients = new Set();
+    pending = new Map();
+    constructor(config, approvalApi) {
+        this.config = config;
+        this.approvalApi = approvalApi;
+    }
+    async init() {
+        this.server = createServer((req, res) => {
+            const url = new URL(req.url ?? '/', `http://localhost:${this.config.port}`);
+            if (url.pathname === '/') {
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(DASHBOARD_HTML);
+                return;
+            }
+            if (url.pathname === '/events') {
+                res.writeHead(200, {
+                    'Content-Type': 'text/event-stream',
+                    'Cache-Control': 'no-cache',
+                    Connection: 'keep-alive',
+                });
+                this.clients.add(res);
+                // Send current pending requests
+                for (const req of this.pending.values()) {
+                    res.write(`data: ${JSON.stringify({ type: 'new', request: req })}\n\n`);
+                }
+                req.on('close', () => this.clients.delete(res));
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/approve') {
+                const code = url.searchParams.get('code');
+                if (code) {
+                    this.pending.delete(code);
+                    this.approvalApi.approve(code);
+                    this.broadcast({ type: 'resolved', code, action: 'approved' });
+                    log.info({ code }, 'Approved via dashboard');
+                }
+                res.writeHead(200);
+                res.end('ok');
+                return;
+            }
+            if (req.method === 'POST' && url.pathname === '/deny') {
+                const code = url.searchParams.get('code');
+                if (code) {
+                    this.pending.delete(code);
+                    this.approvalApi.deny(code, 'Denied via dashboard');
+                    this.broadcast({ type: 'resolved', code, action: 'denied' });
+                    log.info({ code }, 'Denied via dashboard');
+                }
+                res.writeHead(200);
+                res.end('ok');
+                return;
+            }
+            res.writeHead(404);
+            res.end('not found');
+        });
+        await new Promise((resolve) => {
+            this.server.on('error', (err) => {
+                if (err.code === 'EADDRINUSE') {
+                    log.warn({ port: this.config.port }, 'Dashboard port in use — running without dashboard UI');
+                    this.server = undefined;
+                    resolve();
+                }
+                else {
+                    log.error({ err }, 'Dashboard server error');
+                    resolve(); // don't crash the process
+                }
+            });
+            this.server.listen(this.config.port, '127.0.0.1', () => {
+                log.info({ port: this.config.port }, 'HITL dashboard listening');
+                resolve();
+            });
+        });
+    }
+    async stop() {
+        for (const client of this.clients) {
+            try {
+                client.end();
+            }
+            catch {
+                /* swallow */
+            }
+        }
+        this.clients.clear();
+        await new Promise((resolve) => {
+            if (this.server)
+                this.server.close(() => resolve());
+            else
+                resolve();
+        });
+    }
+    notify(requests) {
+        for (const req of requests) {
+            this.pending.set(req.code, req);
+            this.broadcast({ type: 'new', request: req });
+        }
+        return Promise.resolve();
+    }
+    broadcast(data) {
+        const msg = `data: ${JSON.stringify(data)}\n\n`;
+        for (const client of this.clients) {
+            try {
+                client.write(msg);
+            }
+            catch {
+                /* swallow */
+            }
+        }
+    }
+}
+const DASHBOARD_HTML = `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Airlock</title>
+<style>
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: #0d1117; color: #c9d1d9; padding: 20px; }
+  h1 { font-size: 18px; margin-bottom: 16px; color: #58a6ff; }
+  #empty { color: #484f58; font-style: italic; }
+  .card { background: #161b22; border: 1px solid #30363d; border-radius: 8px; padding: 16px; margin-bottom: 12px; }
+  .card.approved { border-color: #238636; opacity: 0.5; }
+  .card.denied { border-color: #da3633; opacity: 0.5; }
+  .tool { font-weight: 600; color: #f0883e; font-size: 15px; }
+  .agent { color: #8b949e; font-size: 13px; margin-top: 2px; }
+  .args { font-family: "SF Mono", Monaco, monospace; font-size: 12px; background: #0d1117; border-radius: 4px; padding: 8px; margin: 8px 0; white-space: pre-wrap; word-break: break-all; color: #8b949e; max-height: 120px; overflow-y: auto; }
+  .code { font-family: "SF Mono", Monaco, monospace; font-size: 11px; color: #484f58; margin-bottom: 8px; }
+  .actions { display: flex; gap: 8px; }
+  .btn { border: none; padding: 6px 16px; border-radius: 6px; font-size: 13px; font-weight: 600; cursor: pointer; }
+  .btn-approve { background: #238636; color: #fff; }
+  .btn-approve:hover { background: #2ea043; }
+  .btn-deny { background: #21262d; color: #f85149; border: 1px solid #da3633; }
+  .btn-deny:hover { background: #da3633; color: #fff; }
+  .status { font-size: 12px; font-weight: 600; margin-top: 8px; }
+  .status.approved { color: #3fb950; }
+  .status.denied { color: #f85149; }
+</style>
+</head>
+<body>
+<h1>Airlock Approvals</h1>
+<div id="list"><div id="empty">No pending requests</div></div>
+<script>
+const list = document.getElementById('list');
+const empty = document.getElementById('empty');
+const cards = new Map();
+
+function render(req) {
+  const el = document.createElement('div');
+  el.className = 'card';
+  el.id = 'card-' + req.code;
+  const args = JSON.stringify(req.args, null, 2);
+  el.innerHTML = \`
+    <div class="tool">\${esc(req.tool)}</div>
+    <div class="agent">agent: \${esc(req.agentId)}</div>
+    <div class="args">\${esc(args)}</div>
+    <div class="code">\${req.code}</div>
+    <div class="actions">
+      <button class="btn btn-approve" onclick="act('approve','\${req.code}')">Approve</button>
+      <button class="btn btn-deny" onclick="act('deny','\${req.code}')">Deny</button>
+    </div>
+  \`;
+  cards.set(req.code, el);
+  list.prepend(el);
+  empty.style.display = 'none';
+}
+
+function act(action, code) {
+  fetch('/' + action + '?code=' + code, { method: 'POST' });
+  const el = cards.get(code);
+  if (el) {
+    el.querySelector('.actions').innerHTML = '<div class="status ' + action + (action === 'approve' ? 'd' : '') + '">' + action + 'd</div>';
+    el.classList.add(action === 'approve' ? 'approved' : 'denied');
+  }
+}
+
+function esc(s) { const d = document.createElement('div'); d.textContent = s; return d.innerHTML; }
+
+if ('Notification' in window) Notification.requestPermission();
+
+const es = new EventSource('/events');
+es.onmessage = (e) => {
+  const msg = JSON.parse(e.data);
+  if (msg.type === 'new') {
+    render(msg.request);
+    if (Notification.permission === 'granted') {
+      new Notification('Airlock: ' + msg.request.tool, {
+        body: 'agent: ' + msg.request.agentId + '\\n' + msg.request.code,
+        tag: msg.request.code,
+      });
+    }
+  }
+  if (msg.type === 'resolved') {
+    const el = cards.get(msg.code);
+    if (el) {
+      el.querySelector('.actions').innerHTML = '<div class="status ' + (msg.action === 'approved' ? 'approved' : 'denied') + '">' + msg.action + '</div>';
+      el.classList.add(msg.action);
+    }
+  }
+};
+</script>
+</body>
+</html>`;
+//# sourceMappingURL=dashboard.js.map

package/dist/hitl/providers/dashboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.js","sourceRoot":"","sources":["../../../src/hitl/providers/dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,MAAM,GAAG,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;AAM1C,MAAM,OAAO,qBAAqB;IAMtB;IACA;IANF,MAAM,CAAU;IAChB,OAAO,GAAG,IAAI,GAAG,EAAyD,CAAC;IAC3E,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEtD,YACU,MAA2B,EAC3B,WAAwB;QADxB,WAAM,GAAN,MAAM,CAAqB;QAC3B,gBAAW,GAAX,WAAW,CAAa;IAC/B,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAE5E,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,mBAAmB;oBACnC,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,YAAY;iBACzB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,gCAAgC;gBAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;oBACxC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC1E,CAAC;gBACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACzD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC/B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;gBAC/C,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACtD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;oBACpD,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAC7D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,sBAAsB,CAAC,CAAC;gBAC7C,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBACtD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,GAAG,CAAC,IAAI,CACN,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAC1B,sDAAsD,CACvD,CAAC;oBACF,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;oBACxB,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;oBAC7C,OAAO,EAAE,CAAC,CAAC,0BAA0B;gBACvC,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBACtD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,0BAA0B,CAAC,CAAC;gBACjE,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;;gBAC/C,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,QAA4B;QACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEO,SAAS,CAAC,IAAa;QAC7B,MAAM,GAAG,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;QAChD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa;YACf,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4Ff,CAAC"}

package/dist/hitl/providers/macos.d.ts

@@ -0,0 +1,10 @@
+import type { HitlProvider, HitlNotification, ApprovalApi } from './types.js';
+export declare class MacosHitlProvider implements HitlProvider {
+    private approvalApi;
+    constructor(approvalApi: ApprovalApi);
+    init(): Promise<void>;
+    stop(): Promise<void>;
+    notify(requests: HitlNotification[]): Promise<void>;
+    private showDialog;
+}
+//# sourceMappingURL=macos.d.ts.map

package/dist/hitl/providers/macos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos.d.ts","sourceRoot":"","sources":["../../../src/hitl/providers/macos.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAI9E,qBAAa,iBAAkB,YAAW,YAAY;IACxC,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,WAAW;IAE5C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIf,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD,OAAO,CAAC,UAAU;CAoDnB"}