comisai 1.0.41 → 1.0.44

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/index.js

@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * @comis/skills terminal-driver barrel — the public surface the daemon wiring
+ * (composition root, `setup-tools.ts`) consumes: the nine AgentTool factories
+ * (eight implemented + one stub [`status`]), the `TerminalSessionRegistry`
+ * constructor + its production worker-spawn helper, and the allowlist + IPC types
+ * the wiring needs to map config → `AllowEntryLike` and to type the injected ports.
+ *
+ * Re-exported through `../../index.js` (the `./tools` subpath). The public-export
+ * consumer is the daemon wiring (it constructs the registry + pushes the tools).
+ *
+ * @module
+ */
+// The eight implemented tools + their shared deps contract.
+export { createTerminalSessionCreateTool, createTerminalSessionReadTool, createTerminalSessionListTool, createTerminalSessionKillTool, createTerminalSessionSendTextTool, createTerminalSessionSendKeyTool, createTerminalSessionResizeTool, createTerminalSessionWaitTool, } from "./terminal-tools.js";
+// 124-06: terminal_session_status is now a REAL, classifier-backed, owner-scoped tool
+// (the lone P0 not_implemented stub is closed). Its body lives in terminal-status-tool.ts;
+// terminal-tools-stubs.ts re-exports it so this import path is unchanged. Still never-export
+// (the tool-metadata-registry entry is unchanged — default-deny preserved).
+export { createTerminalSessionStatusTool } from "./terminal-tools-stubs.js";
+// The daemon-side session registry.
+export { createTerminalSessionRegistry, } from "./terminal-session-registry.js";
+// Deterministic unattended honest-fail backstop (webhook-claude-cli-tdd-20260701): reap a turn's
+// LIVE never-tasked drives at an unattended (webhook/cron) turn-end so the origin records an honest
+// failure instead of a silent success with a leaked idle drive (the model-independent floor beneath
+// the wait-tool `WAIT_TASK_NOT_DELIVERED_NOTE` best-effort recovery).
+export { reapNeverTaskedDrives } from "./terminal-reap-untasked.js";
+// The production worker-spawn posture helper (extracted from the registry to keep it
+// under the 800-line cap; re-exported here so the package surface is unchanged).
+export { buildProductionSpawnWorker, resolveWorkerMainPath, WORKER_PERMISSION_ARGS, } from "./terminal-worker-launch.js";
+// DUR-01 socket-path helpers (PURE) — re-exported so the daemon's recover-on-boot
+// liveness probe derives the SAME `<dataDir>/terminal-worker/tmux.sock` the worker binds.
+// Importing for the re-export runs no side effect: worker-main's `main()` is `isEntryScript`-guarded.
+export { terminalWorkerDir, resolveTmuxSocketPath } from "./terminal-worker-main.js";
+// The no-secret host-allowlist egress proxy (EgressControlPort impl, spec §3.5),
+// moved here from @comis/daemon so the standalone worker process can construct
+// its OWN egress for `network: listed-hosts` (the worker runs outside the jail
+// and has network; the daemon also constructs one for the in-process test path).
+export { createTerminalEgressProxy, } from "./terminal-egress-proxy.js";
+// The PERSISTENT, agent-scoped projects-root allocator (`<agentWorkspaceDir>/projects`).
+// The daemon injects it as the registry's `allocateWorkspace` with a no-op
+// `cleanupWorkspace`, so a driven session's work persists in the agent's own
+// workspace instead of a throwaway /tmp dir. See its doc + buildScopeArgs' carve-out
+// re-bind for the security posture (only this subtree is re-exposed in the jail).
+export { prepareAgentTerminalWorkspace } from "./terminal-workspace.js";
+// The per-session usage-cap primitive (closure-local counters + injected
+// clock). The tool layer consumes createSessionCaps to REJECT on
+// maxRequestsPerSession and EVICT on maxInteractions/wallClockMs.
+export { createSessionCaps, } from "./terminal-caps.js";
+// The injected-timer reaper (idle-TTL + wall-clock sweep + max-sessions
+// overflow). The registry composes it; the tool layer reuses EvictReason on the same
+// onEvict path for max_interactions. TYPE-ONLY TimerPort + injected clock — never @comis/infra.
+export { createTerminalReaper, } from "./terminal-reaper.js";
+// The length-prefixed IPC framer's max-frame guard — the registry's
+// stdout handler branches on FrameTooLargeError to drop a corrupt worker.
+export { FrameTooLargeError, MAX_FRAME_BYTES, } from "./terminal-ipc.js";
+// The canonical-binary allowlist matcher + the config-mapping types. `TerminalScope`
+// is the scope contract the daemon wiring maps config scope onto.
+export { matchAllowEntry, buildDirectSpawn, canonicalize, } from "./allowlist-matcher.js";
+// The supervised worker entry (the daemon wires its production spawn posture).
+export { createTerminalWorker, defaultLoadPty, } from "./terminal-worker-entry.js";
+// P5 124-08 (OPS-05, spec §4.6): the tmux worker backend — the THIRD loadBackend option
+// (node-pty | pipe | tmux) for milestone-length runs. tmux owns the PTY in a
+// DETERMINISTICALLY-named session (comis-<sessionId>) so the server outlives the worker and
+// a restart RE-ATTACHES (has-session → read the existing pane) rather than re-creating
+// (RESEARCH Pitfall 6). The daemon (124-09) binds the resolved tmux path + has-session probe
+// into the loadTmux seam. Pure command builders + the FakePtyLike-shaped factory (a node-pty
+// `tmux attach` that streams + drives); dependency-free (the one-shot runner + attach-pty
+// spawner are injected). The live drive/survival test is Linux-gated.
+export { createTmuxBackend, tmuxSessionName, buildTmuxSpawnArgv, buildTmuxHasSessionArgv, buildTmuxKillArgv, buildTmuxAttachArgv, buildTmuxSetOptionArgv, } from "./terminal-tmux-backend.js";
+// P5 124-03 (spec §4.3, the #1 de-risk): the pure state classifier + the
+// load-bearing cursor-parked gate. The worker (124-05/06) drives classifyFrame each
+// settled frame; the session_status tool surfaces its state. Pure + infra-free + no
+// raw clock — value-imports only node builtins + the render snapshot type.
+export { classifyFrame, isCursorParked, } from "./terminal-classifier.js";
+// P5 124-04 (spec §4.5/§4.6, SEC-12): the pure safe-only auto-answer policy. The woken
+// turn (124-09) calls decideAutoAnswer on a settled prompt — a safe-pattern match sends
+// a canned keystroke via the P4 send-guards; everything else (incl. auth/destructive/
+// approval, escalate-always) escalates with no keystroke. Operator-dialable, never
+// model-dialable; pure + infra-free (only @comis/core's scrubSecretsFromText).
+export { decideAutoAnswer, } from "./terminal-auto-answer.js";
+// v2.26 (Terminal Platform Profiles): the read-side per-platform perception/render profile
+// registry. The daemon woken turn resolves a session's profile by its operator-declared allowId
+// to feed `decideAutoAnswer` the profile's dialogs (DIALOG-01); the worker/classifier consume the
+// render transform + perception package-internally. Selection is by allowId only (§5/INV-3).
+export { getPlatformProfile, } from "./platforms/index.js";
+// P5 124-04 (spec §4.6, SEC-11): the normalized region-scoped loop guard. The woken
+// turn (124-09) calls observe() on a settled prompt region — a repeated NORMALIZED
+// prompt (spinner/timestamp/progress-only diff) escalates (terminal:escalated, reason
+// loop_detected) and COMPOSES with the P4 maxInteractions EVICT. Closure-local ring,
+// injected clock, never-throw typed result; infra-free (only node:crypto).
+export { createLoopGuard, } from "./terminal-loop-guard.js";
+// 164-01 (DRIVE-01, design §7.1.6): the pure bounded content-free drive-state journal —
+// a promoted drive's CROSS-WAKE MEMORY. The daemon woken-turn driver (164-06) reads+updates
+// it per wake via the closure-local Map<sessionId, DriveJournal> holder in setupTerminalWake.
+// Pure shape + (de)serialize/append/oldest-trim; content-free (I3), bounded (I7).
+export { emptyJournal, appendAnswered, appendStep, updateJournal, serializeJournal, deserializeJournal, CAP_ANSWERED, CAP_STEPS, TAG_MAX, } from "./terminal-drive-journal.js";
+// 164-03 (READ-01, design §7.1 OD-3): the pure bounded digest/diff read selector + the
+// content-free one-line screen digest. The daemon woken-turn read (164-06) applies
+// boundedReadDigest to the returned view + threads screenDigestLine into the journal's
+// lastScreenDigest (run through scrubSecretsFromText); the read tool delegates to
+// boundedReadDigest (digest default). Pure, byte-capped (I7), never throws.
+export { boundedReadDigest, screenDigestLine, READ_DIGEST_BYTE_CAP, } from "./terminal-read-digest.js";
+// 165-01 (DUR-01): the pure re-attach DECISION + the persisted durable session IDENTITY.
+// The registry's recover-on-boot (165-06) consumes reattachDecision; the daemon (165-07)
+// (de)serializes descriptors via serialize/deserialize for the durable descriptor store.
+// Pure, total, infra-free (injected has-session probe); the descriptor (de)serialize rejects
+// a malformed/partial identity to undefined (corrupt-skip, never partial-trust authorization).
+export { reattachDecision, serializeDescriptor, deserializeDescriptor, } from "./terminal-reattach-match.js";
+// 165-06 (DUR-01): the recover-on-boot SCAN orchestrator + the injected descriptor-store
+// port + the rehydrate/persist/durable-lost helpers the registry delegates to (kept here so
+// the 800-line registry stays lean). The daemon (165-07) implements SessionDescriptorStorePort
+// as the fs-safe durable descriptor store + injects it onto the registry deps. Pure via the
+// injected port; consumes 165-01's reattachDecision; the bulk lives here, not the registry.
+export { recoverSessionDescriptors, rehydrateHandleFromDescriptor, buildSessionDescriptor, applyRecoveredSessions, markRunningSessionsLost, staysRecoverable, } from "./terminal-session-reattach.js";
+// 165-02 (LIVE-01 / ENDURE-01): the pure busy-vs-hung predicate the LIVE-01 backstop
+// (165-07) turns into a synthesized `stuck` ONLY on `"hung"` + the ENDURE-01 reaper idle
+// exclusion consumes on `"busy"` — ONE shared definition of "alive and making progress".
+// Promoted to the barrel here (165-07 is its first cross-package consumer).
+export { busyOrHung } from "./terminal-busy-predicate.js";
+// 165-03 (ENDURE-01): the pure spend-ceiling check over the drive journal's run-total cost
+// — the 165-07 wake-turn loop escalates/stops on a breach (never a silent overspend).
+export { checkSpendCeiling } from "./terminal-spend-ceiling.js";
+// 166-01 (NOTIFY-01): the pure three-way wake decision + the I9-safe terminal-outcome map
+// (done/needs-you/failed — the failed outcome deferred from Phase 165 lands here). The
+// daemon wake-notify wiring (plan 03) is their first consumer.
+export { decideWakeAction, mapTerminalOutcome, } from "./terminal-drive-outcome.js";
+// 166-01 (NOTIFY-01): the pure drive.notify gate — needs-you ALWAYS fires (I4); done/failed
+// suppressed only under "none". Consumed by the plan-03 outcome-notify wiring.
+export { shouldNotifyOutcome } from "./terminal-notify-policy.js";
+// 166-02 (NOTIFY-02): the pure content-free heartbeat one-liner from the drive journal (I3).
+// The plan-03 heartbeat cadence timer notifies it for each promoted drive.
+export { heartbeatLine } from "./terminal-heartbeat-digest.js";
+// P5 124-05 (spec §2.3, TR-11): the transition-only in-worker attention emitter — the
+// WORKER half of the no-poll mechanism. The worker (124-05 Task 2) calls observe() with
+// each settled frame's classification; the emitter writes a redaction-safe
+// TerminalEventFrame to the injected fd3-writer ONLY on a state TRANSITION (edge-, not
+// level-triggered) — NO timer, NO clock. Closure-local last-state; infra-free (only the
+// terminal-ipc framer).
+export { createAttentionEmitter, } from "./terminal-attention-emitter.js";

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/platforms/claude-code/profile.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The `claude-code` platform profile (Layer 2) — paired with
+ * `packages/daemon/bundled-skills/claude-code/SKILL.md` by the shared `id` + `platformVersion`.
+ *
+ * Phase 167: the render transform — the FINDING-3 dim-autocomplete ghost-strip, RELOCATED here out
+ * of the agnostic `terminal-render.ts` (RENDER-01). Perception (Phase 168) and dialogs (Phase 169)
+ * follow in later phases.
+ *
+ * @module
+ */
+import type { RenderCell } from "../../terminal-render.js";
+import type { TerminalPlatformProfile } from "../terminal-platform-profile.js";
+/**
+ * Render one terminal row to text while STRIPPING the dim autocomplete ghost-text (FINDING-3,
+ * live VPS 2026-06-17). Claude Code shows a DIM suggestion in its composer (e.g. `commit this`);
+ * the plain-text `read()` capture can't convey the dim styling, so the driving model can't tell
+ * the suggestion from real queued input — it halts to ask about it and drops later steps. On the
+ * cursor's row, a cell at column `>= cursorX` that is DIM is autocomplete (real input is NON-dim
+ * and at/left of the cursor), so it is omitted; everything else (the non-dim prompt, real input,
+ * dim cells LEFT of the cursor) is kept. Trailing whitespace is trimmed to match
+ * `translateToString(true)`. Pure + total. Applied to the cursor row REGARDLESS of the alt-screen
+ * flag (the tmux backend's `tmux attach` renders in the alt screen, so the flag can't gate it);
+ * the (also-dim) status bar on other rows is never touched.
+ *
+ * Relocated VERBATIM from `terminal-render.ts` (v2.26 RENDER-01) — the engine no longer carries it.
+ */
+export declare function stripGhostFromRow(cells: readonly RenderCell[], cursorX: number): string;
+/**
+ * The `claude-code` profile. `allowIds` claims the documented operator id (`claude`, per
+ * `docs/agent-tools/terminal-driver.mdx`) + the `claude-code` alias. `platformVersion` MUST track
+ * the bundled SKILL.md `version` (drift-guarded by the architecture test).
+ */
+export declare const claudeCodeProfile: TerminalPlatformProfile;

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/platforms/claude-code/profile.js

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * The `claude-code` platform profile (Layer 2) — paired with
+ * `packages/daemon/bundled-skills/claude-code/SKILL.md` by the shared `id` + `platformVersion`.
+ *
+ * Phase 167: the render transform — the FINDING-3 dim-autocomplete ghost-strip, RELOCATED here out
+ * of the agnostic `terminal-render.ts` (RENDER-01). Perception (Phase 168) and dialogs (Phase 169)
+ * follow in later phases.
+ *
+ * @module
+ */
+/**
+ * Render one terminal row to text while STRIPPING the dim autocomplete ghost-text (FINDING-3,
+ * live VPS 2026-06-17). Claude Code shows a DIM suggestion in its composer (e.g. `commit this`);
+ * the plain-text `read()` capture can't convey the dim styling, so the driving model can't tell
+ * the suggestion from real queued input — it halts to ask about it and drops later steps. On the
+ * cursor's row, a cell at column `>= cursorX` that is DIM is autocomplete (real input is NON-dim
+ * and at/left of the cursor), so it is omitted; everything else (the non-dim prompt, real input,
+ * dim cells LEFT of the cursor) is kept. Trailing whitespace is trimmed to match
+ * `translateToString(true)`. Pure + total. Applied to the cursor row REGARDLESS of the alt-screen
+ * flag (the tmux backend's `tmux attach` renders in the alt screen, so the flag can't gate it);
+ * the (also-dim) status bar on other rows is never touched.
+ *
+ * Relocated VERBATIM from `terminal-render.ts` (v2.26 RENDER-01) — the engine no longer carries it.
+ */
+export function stripGhostFromRow(cells, cursorX) {
+    let out = "";
+    for (let x = 0; x < cells.length; x++) {
+        const c = cells[x];
+        if (c.width === 0)
+            continue; // wide-char trailing / combining slot — translateToString skips it
+        if (x >= cursorX && c.dim)
+            continue; // the dim autocomplete ghost-text right of the cursor
+        out += c.chars.length > 0 ? c.chars : " ";
+    }
+    return out.replace(/\s+$/u, "");
+}
+/**
+ * The `claude-code` `transformSnapshot`: re-render the cursor row of the plain-text snapshot with
+ * the ghost-strip applied, using the viewport cell grid (`snap.grid`) for the dim attributes the
+ * flattened `screen` string has lost. A no-op when `snap.grid` is absent (the engine populates it
+ * only for text-format snapshots) — so ansi/html reads and the agnostic path are untouched (INV-1).
+ *
+ * The cursor row's index WITHIN `screen` accounts for any scrollback rows the engine prepended:
+ * `screen` carries `(lines.length - rows)` scrollback rows before the viewport, so the cursor's
+ * viewport row `cursor.y` sits at `screen` line `(lines.length - rows) + cursor.y`.
+ */
+function transformSnapshot(snap) {
+    const grid = snap.grid;
+    if (grid === undefined)
+        return snap; // no cell grid (ansi/html / agnostic) — identity
+    const cursorRowCells = grid[snap.cursor.y];
+    if (cursorRowCells === undefined)
+        return snap;
+    const lines = snap.screen.split("\n");
+    const viewportStart = lines.length - snap.rows; // scrollback rows precede the viewport, if any
+    const cursorLineIdx = viewportStart + snap.cursor.y;
+    if (cursorLineIdx < 0 || cursorLineIdx >= lines.length)
+        return snap;
+    lines[cursorLineIdx] = stripGhostFromRow(cursorRowCells, snap.cursor.x);
+    return { ...snap, screen: lines.join("\n") };
+}
+/**
+ * The `claude-code` profile. `allowIds` claims the documented operator id (`claude`, per
+ * `docs/agent-tools/terminal-driver.mdx`) + the `claude-code` alias. `platformVersion` MUST track
+ * the bundled SKILL.md `version` (drift-guarded by the architecture test).
+ */
+export const claudeCodeProfile = {
+    id: "claude-code",
+    allowIds: ["claude", "claude-code"],
+    platformVersion: "1.1.5",
+    transformSnapshot,
+    // CLASSIFY-01 (Phase 168): Claude Code perception signatures the classifier consumes (layered on
+    // the generic structural detection). All anchored + ReDoS-safe (the registry guard enforces at load).
+    perception: {
+        // The composer input caret — Claude's `❯ ` prompt box (the LIVE-02 idle-`❯` awaiting-input cue).
+        promptAffordance: [/(?:^|\s)❯\s/u],
+        // The working spinner: a SPINNER GLYPH (not the generic `·` middot — review WR-02, it over-matches
+        // prose `· Building`) + a gerund (e.g. `✻ Crunching`), or the `(esc to interrupt)` hint Claude
+        // renders while busy — a settled-but-RECENT frame showing this is mid-work, not a prompt.
+        workingLine: [/[✢✳✶✻✽]\s+\w+ing\b/u, /\(esc to interrupt\)/iu],
+        // Pickers/menus: the `/model` picker, a dismiss affordance, or a `❯`/`›` selector on an
+        // enumerated option — the D5 fix for the v2.11 full-screen menu → awaiting-input misread.
+        menuOrPicker: [/Select\s+(?:a\s+)?Model/iu, /\bEsc to (?:cancel|exit|go back)\b/iu, /(?:^|\s)[›❯]\s+\d+[.)]/u],
+        // A completed-action bullet. POPULATED (the §6-v2 structured-perception field) but NOT routed into
+        // the classifier's awaiting-input branch: `⏺` is Claude's per-tool-action bullet (`⏺ Read(…)`), so
+        // feeding it would over-fire awaiting-input on a mid-turn tool-use pause (review WR-01). The idle
+        // `❯` composer (promptAffordance) is the real awaiting-input cue.
+        turnEnd: [/⏺\s+\S/u],
+    },
+    // DIALOG-01 (Phase 169): Claude's interactive dialogs + their SAFE answer. The operator safe-only
+    // policy + the escalate-always veto STILL gate these (a profile proposes; the policy disposes) — a
+    // screen carrying an auth/destructive/approval cue escalates regardless. safeAnswer is RAW text
+    // (Enter), sent via send_text exactly like the canned hintPattern answer.
+    dialogs: [
+        {
+            // The first-launch trust gate. Benign — the operator launched Claude in their own workspace;
+            // Enter accepts the pre-selected "trust" option. NOT destructive. The phrasing has changed
+            // across Claude Code versions, so match all known forms (ReDoS-safe — bounded char class):
+            //   pre-2.1:  "Do you trust the files in this folder?"
+            //   >= 2.1.x: "Quick safety check: Is this a project you created or one you trust?"
+            //             with option "1. Yes, I trust this folder"
+            // (webhook-claude-cli-tdd-20260630: a stale regex matching only the pre-2.1 wording stalled a
+            // driven claude 2.1.196 session at the gate — auto-answer never fired.)
+            name: "trust-gate",
+            detect: /trust the files in this folder|is this a project you[^\n]{0,80}trust|yes, i trust this folder/iu,
+            safeAnswer: ["\r"],
+            destructive: false,
+        },
+        {
+            // A standard permission prompt ("Do you want to proceed?"). Enter accepts the default; a
+            // DESTRUCTIVE action on the same screen (delete/overwrite/…) is caught by the escalate-always
+            // veto and escalated regardless. NOT inherently destructive.
+            name: "permission-prompt",
+            detect: /Do you want to proceed\?/iu,
+            safeAnswer: ["\r"],
+            destructive: false,
+        },
+    ],
+};

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/platforms/codex/profile.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The `codex` platform profile (Layer 2) — paired with
+ * `packages/daemon/bundled-skills/codex/SKILL.md` by the shared `id` + `platformVersion`.
+ *
+ * Phase 167 (scaffold): no render transform (Codex has no ghost-strip). Perception (Phase 168)
+ * and dialogs (Phase 169 — the approval overlay) are added in later phases.
+ *
+ * @module
+ */
+import type { TerminalPlatformProfile } from "../terminal-platform-profile.js";
+/**
+ * The `codex` profile. `allowIds` claims the conventional operator id (`codex`, matching the
+ * bundled skill name). `platformVersion` MUST track the bundled SKILL.md `version` (drift-guarded
+ * by the architecture test).
+ */
+export declare const codexProfile: TerminalPlatformProfile;

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/platforms/codex/profile.js

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * The `codex` platform profile (Layer 2) — paired with
+ * `packages/daemon/bundled-skills/codex/SKILL.md` by the shared `id` + `platformVersion`.
+ *
+ * Phase 167 (scaffold): no render transform (Codex has no ghost-strip). Perception (Phase 168)
+ * and dialogs (Phase 169 — the approval overlay) are added in later phases.
+ *
+ * @module
+ */
+/**
+ * The `codex` profile. `allowIds` claims the conventional operator id (`codex`, matching the
+ * bundled skill name). `platformVersion` MUST track the bundled SKILL.md `version` (drift-guarded
+ * by the architecture test).
+ */
+export const codexProfile = {
+    id: "codex",
+    allowIds: ["codex"],
+    platformVersion: "1.1.1",
+    // CLASSIFY-01 (Phase 168): Codex perception signatures the classifier consumes (layered on the
+    // generic structural detection). All anchored + ReDoS-safe (the registry guard enforces at load).
+    perception: {
+        // The Codex composer caret.
+        promptAffordance: [/(?:^|\s)›\s/u],
+        // The canonical Codex working line `Working (Ns)`, the working banner, and the ascii spinner
+        // (ANCHORED to line-start so a markdown bullet `- thinking` / table cell does not match — review
+        // WR-03) — a settled-but-RECENT frame showing one of these is mid-work, not a hang.
+        workingLine: [/Working \(\d+s\)/u, /Working on your request/iu, /^\s*[|/\\-]\s+thinking\b/iu],
+        // A Codex selection menu (approval/sandbox/model). Boxed Codex menus are also caught generically.
+        menuOrPicker: [/Select\s+(?:approval|sandbox|model)\b/iu],
+        // The composer-return banner after a turn completes.
+        turnEnd: [/(?:^|\s)›\s*$/u],
+    },
+    // DIALOG-01 (Phase 169): Codex's approval overlay. Approving COMMAND EXECUTION is privilege-bearing,
+    // so it is flagged `destructive` ⇒ ALWAYS escalates to a human (never auto-answered, even under mode
+    // `all`) — an operator who wants unattended Codex uses Codex's own auto-approve flag, not the driver.
+    // The safeAnswer is declared but moot (destructive wins); even a missed `detect` still escalates
+    // (the boxed overlay → generic awaiting-input → no safeAnswer path → escalate).
+    dialogs: [
+        {
+            name: "approval-overlay",
+            detect: /\b(?:Approve|Allow)\b.{0,40}\b(?:command|run|execute|exec)\b/iu,
+            safeAnswer: ["\r"],
+            destructive: true,
+        },
+    ],
+};

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/platforms/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The platform-profile REGISTRY (design §4/§7) — `getPlatformProfile(allowId)`.
+ *
+ * Selection is by the operator-declared `allowId` (exact-string match, unique). `undefined` ⇒ the
+ * agnostic default (§3). The driven program cannot pick its own profile (no content-sniffing —
+ * §5/INV-3): only an allowId the operator declared in the allowlist resolves a profile.
+ *
+ * Two load-time guards run ONCE at module import over `ALL_PROFILES`, so a malformed profile set
+ * FAILS AT LOAD (never a silent mis-selection):
+ *   - `assertUniqueAllowIds` — no allowId maps to >1 profile (D3).
+ *   - `assertSafeProfilePatterns` — every perception/dialog regex is free of nested unbounded
+ *     quantifiers (the ReDoS shapes); patterns run on every read/settle frame (hot path — D1).
+ *
+ * @module
+ */
+import type { TerminalPlatformProfile } from "./terminal-platform-profile.js";
+export type { TerminalPlatformProfile, PlatformPerception, PlatformDialog, KeySpec, } from "./terminal-platform-profile.js";
+/**
+ * Throw when two profiles claim the same `allowId` — the D3 1:1 invariant. Called at module load
+ * over the shipped set AND exported for the registry test. The message names the colliding allowId.
+ */
+export declare function assertUniqueAllowIds(profiles: readonly TerminalPlatformProfile[]): void;
+/**
+ * Throw when any of a profile's hot-path patterns (perception.* + dialogs[].detect) is ReDoS-prone.
+ * Called at module load over the shipped set AND exported for the registry test.
+ */
+export declare function assertSafeProfilePatterns(profile: TerminalPlatformProfile): void;
+/** Every shipped profile, in registration order. */
+export declare const ALL_PROFILES: readonly TerminalPlatformProfile[];
+/**
+ * Resolve the read-side platform profile for an operator-declared `allowId`. Exact-string match;
+ * `undefined` ⇒ the agnostic default (§3). This is the SOLE selection path — by allowId, never by
+ * content (§5/INV-3).
+ */
+export declare function getPlatformProfile(allowId: string): TerminalPlatformProfile | undefined;

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/platforms/index.js

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: Apache-2.0
+// @allow-throw: fail-closed load-time validation — `assertUniqueAllowIds` + `assertSafeProfilePatterns`
+// throw ONCE at module import over the static, developer-authored profile set. A throw means a
+// developer shipped a malformed profile (an allowId collision or a ReDoS-prone hot-path pattern) —
+// caught at load / by the registry test, NEVER a runtime user path and never a silent mis-selection.
+/**
+ * The platform-profile REGISTRY (design §4/§7) — `getPlatformProfile(allowId)`.
+ *
+ * Selection is by the operator-declared `allowId` (exact-string match, unique). `undefined` ⇒ the
+ * agnostic default (§3). The driven program cannot pick its own profile (no content-sniffing —
+ * §5/INV-3): only an allowId the operator declared in the allowlist resolves a profile.
+ *
+ * Two load-time guards run ONCE at module import over `ALL_PROFILES`, so a malformed profile set
+ * FAILS AT LOAD (never a silent mis-selection):
+ *   - `assertUniqueAllowIds` — no allowId maps to >1 profile (D3).
+ *   - `assertSafeProfilePatterns` — every perception/dialog regex is free of nested unbounded
+ *     quantifiers (the ReDoS shapes); patterns run on every read/settle frame (hot path — D1).
+ *
+ * @module
+ */
+import { claudeCodeProfile } from "./claude-code/profile.js";
+import { codexProfile } from "./codex/profile.js";
+/**
+ * Throw when two profiles claim the same `allowId` — the D3 1:1 invariant. Called at module load
+ * over the shipped set AND exported for the registry test. The message names the colliding allowId.
+ */
+export function assertUniqueAllowIds(profiles) {
+    const seen = new Map(); // allowId → first profile id
+    for (const p of profiles) {
+        for (const a of p.allowIds) {
+            const prior = seen.get(a);
+            if (prior !== undefined) {
+                throw new Error(`terminal platform-profile allowId collision: "${a}" claimed by both "${prior}" and "${p.id}"`);
+            }
+            seen.set(a, p.id);
+        }
+    }
+}
+/**
+ * A conservative ReDoS heuristic: reject a regex with a QUANTIFIED group whose body can itself match
+ * its input more than one way — the catastrophic-backtracking shapes `(a+)+`, `(\w+)*`, `(a{2,})+`,
+ * `((a)*)*`, `(a|a)*`. Profile patterns are hot-path (run per read/settle frame); a pathological one
+ * could stall the worker, so the registry rejects it at LOAD rather than at the first hostile screen.
+ *
+ * Implemented as a paren-matching scan (not a single-level regex — which misses nested and brace/
+ * alternation shapes, WR-01): walk the source skipping escaped chars + character classes, and for each
+ * group whose CLOSING paren is followed by an unbounded quantifier (`*`/`+`/`{`), flag it if its BODY
+ * contains an inner unbounded quantifier (`*`/`+`/`{n,}`) OR an alternation (`|`). Conservative by
+ * design — it favors rejection (an author rewrites a flagged pattern), but it does NOT trip on the
+ * shapes real perception patterns use: escaped literal parens (`Working \(\d+s\)`), `?`-quantified
+ * optional groups, UNquantified alternation groups (`Esc to (?:cancel|interrupt)`), or char classes.
+ * Anchoring is NOT forced (substring perception patterns match mid-screen).
+ */
+function isReDoSProne(source) {
+    const groupStarts = [];
+    for (let i = 0; i < source.length; i++) {
+        const ch = source[i];
+        if (ch === "\\") {
+            i++; // skip the escaped char so `\(` `\)` `\[` are literals, not structure
+            continue;
+        }
+        if (ch === "[") {
+            // skip the whole character class wholesale (its unescaped `]` closes it)
+            i++;
+            while (i < source.length && source[i] !== "]") {
+                if (source[i] === "\\")
+                    i++;
+                i++;
+            }
+            continue;
+        }
+        if (ch === "(") {
+            groupStarts.push(i);
+            continue;
+        }
+        if (ch === ")") {
+            const start = groupStarts.pop();
+            if (start === undefined)
+                continue; // unbalanced — the RegExp ctor already rejected it
+            const next = source[i + 1];
+            const quantified = next === "*" || next === "+" || next === "{";
+            if (!quantified)
+                continue; // `?` / no quantifier ⇒ bounded ⇒ safe
+            const body = source.slice(start + 1, i);
+            // A quantified group whose body has an inner unbounded quantifier, an unbounded `{n,}` brace,
+            // or an alternation is the catastrophic shape (nested / overlapping repetition).
+            if (/[*+]/.test(body) || /\{\d+,\}/.test(body) || body.includes("|"))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Throw when any of a profile's hot-path patterns (perception.* + dialogs[].detect) is ReDoS-prone.
+ * Called at module load over the shipped set AND exported for the registry test.
+ */
+export function assertSafeProfilePatterns(profile) {
+    const patterns = [];
+    const perc = profile.perception;
+    if (perc !== undefined) {
+        for (const field of [perc.promptAffordance, perc.workingLine, perc.menuOrPicker, perc.turnEnd]) {
+            if (field !== undefined)
+                patterns.push(...field);
+        }
+    }
+    if (profile.dialogs !== undefined) {
+        for (const d of profile.dialogs)
+            patterns.push(d.detect);
+    }
+    for (const re of patterns) {
+        if (isReDoSProne(re.source)) {
+            throw new Error(`terminal platform-profile "${profile.id}" carries a ReDoS-prone pattern: /${re.source}/`);
+        }
+    }
+}
+/** Every shipped profile, in registration order. */
+export const ALL_PROFILES = [claudeCodeProfile, codexProfile];
+// Fail at LOAD on a malformed profile set (uniqueness + ReDoS) — never a silent mis-selection.
+assertUniqueAllowIds(ALL_PROFILES);
+for (const profile of ALL_PROFILES)
+    assertSafeProfilePatterns(profile);
+/** allowId → profile, built once from the validated set. */
+const BY_ALLOW_ID = (() => {
+    const m = new Map();
+    for (const p of ALL_PROFILES) {
+        for (const a of p.allowIds)
+            m.set(a, p);
+    }
+    return m;
+})();
+/**
+ * Resolve the read-side platform profile for an operator-declared `allowId`. Exact-string match;
+ * `undefined` ⇒ the agnostic default (§3). This is the SOLE selection path — by allowId, never by
+ * content (§5/INV-3).
+ */
+export function getPlatformProfile(allowId) {
+    return BY_ALLOW_ID.get(allowId);
+}

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/platforms/terminal-platform-profile.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The `TerminalPlatformProfile` interface — Layer 2 of the 3-layer model (design §2/§4):
+ * the read-side perception/render tuning for a first-class TUI (Claude Code, Codex, …),
+ * selected by the operator-declared `allowId`.
+ *
+ * READ-SIDE ONLY (§5/INV-2): a profile transforms what we *perceive* (the post-jail emulator
+ * snapshot) and how we *classify* it. It NEVER widens the bwrap jail, the env, or the launch —
+ * those stay operator-controlled Layer 3. Selection is by `allowId` (operator-declared in the
+ * allowlist), so the driven program cannot choose its own profile (no content-sniffing — D3/INV-3).
+ *
+ * Declarative-first (D1): perception + dialogs are DATA (pattern lists), reviewable and testable
+ * as data. `transformSnapshot` is the SINGLE code escape hatch — render needs cell-level access
+ * (the FINDING-3 ghost-strip reads `RenderCell.dim`). The agnostic default (no profile) keeps
+ * today's generic behavior byte-identical (§3/INV-1).
+ *
+ * LEAF + type-only deps: this module type-imports the render snapshot/cell shapes from the
+ * sibling engine leaf (`terminal-render.ts`) and value-imports NOTHING — the registry composes it.
+ *
+ * @module
+ */
+import type { EmulatorSnapshot } from "../terminal-render.js";
+/**
+ * A safe auto-answer keystroke — RAW text fragments that the auto-answer path joins
+ * (`keys.join("")`) and sends via `send_text`, EXACTLY like the canned `["\r"]` Enter the
+ * operator-hintPattern path already sends (the woken turn does not name-key-encode these).
+ * E.g. `["\r"]` to accept a default (Enter), `["2", "\r"]` for choice-2-then-Enter. Consumed in
+ * Phase 169. (NOT the named-key `send_key` vocabulary — that path is not used by the auto-answer.)
+ */
+export type KeySpec = readonly string[];
+/**
+ * Perception patterns the classifier consumes INSTEAD of hardcoding platform special-cases.
+ * Each is additive: present ⇒ refine/override the generic heuristics; absent ⇒ generic only.
+ * Populated in Phase 168 (empty for the scaffold). All patterns are hot-path (run per
+ * read/settle frame) ⇒ ReDoS-guarded at registry load (`assertSafeProfilePatterns`).
+ */
+export interface PlatformPerception {
+    /** The "input is awaited" affordance — Claude's `❯`-box composer ; Codex composer. */
+    readonly promptAffordance?: readonly RegExp[];
+    /** The "the CLI is working" line — Claude spinner glyph+gerund ; Codex `Working (Ns)`. */
+    readonly workingLine?: readonly RegExp[];
+    /** A picker/menu is open — Claude 2.1 full-screen menus ; the `/model` picker ; `Select Model`. */
+    readonly menuOrPicker?: readonly RegExp[];
+    /** A turn ended — Claude `✻ Cooked for Ns` / `⏺ Done` ; Codex composer-return. */
+    readonly turnEnd?: readonly RegExp[];
+}
+/**
+ * A known dialog + its SAFE auto-answer keystroke. The operator's safe-only auto-answer policy
+ * still gates these (a profile proposes; the operator policy disposes). `destructive` entries are
+ * NEVER auto-answered — they escalate (§4/§5). Populated in Phase 169 (empty for the scaffold).
+ */
+export interface PlatformDialog {
+    /** A stable label — `"trust-gate" | "permission-prompt" | "approval-overlay"`. */
+    readonly name: string;
+    /** The detection pattern (hot-path ⇒ ReDoS-guarded). */
+    readonly detect: RegExp;
+    /** The safe answer chord (omitted ⇒ detection-only; the policy still gates the send). */
+    readonly safeAnswer?: KeySpec;
+    /** `true` ⇒ escalate, never auto-answer (the safety floor). */
+    readonly destructive?: boolean;
+}
+/**
+ * A read-side per-platform perception/render profile. `undefined` from the registry ⇒ the agnostic
+ * default (§3). Selected by `allowId` exact-match (D3); paired with the bundled SKILL.md by a shared
+ * `id` + a shared `platformVersion` (drift-guarded at build time — D2).
+ */
+export interface TerminalPlatformProfile {
+    /** Conceptual pairing id (matches the bundled SKILL.md name): `"claude-code" | "codex" | …`. */
+    readonly id: string;
+    /**
+     * The operator-declared allowIds this profile applies to (the create allowlist entry's id).
+     * Selection is by allowId ONLY — operator-controlled, unspoofable by the driven program.
+     * Exact-string membership; a load-time uniqueness check forbids one allowId mapping to >1 profile.
+     */
+    readonly allowIds: readonly string[];
+    /**
+     * The version this profile is paired with — MUST equal the bundled SKILL.md frontmatter
+     * `version` (enforced by a build-time architecture test, D2; never a runtime gate).
+     */
+    readonly platformVersion: string;
+    /**
+     * READ-SIDE render transform on the agnostic emulator snapshot (post-jail; pure; total).
+     * Default (no profile) = identity. The Claude ghost-strip is the `claude-code` profile's
+     * transform (Phase 167). The transform reads `snap.grid` (the viewport cell grid, present for
+     * text-format snapshots) when it needs cell-level attributes; it must no-op when `grid` is absent.
+     */
+    readonly transformSnapshot?: (snap: EmulatorSnapshot) => EmulatorSnapshot;
+    /** Perception patterns the classifier consumes (Phase 168). */
+    readonly perception?: PlatformPerception;
+    /** Known dialogs + safe answers the dialog-detector/auto-answer consume (Phase 169). */
+    readonly dialogs?: readonly PlatformDialog[];
+}