dsh-thoughtdag 0.5.20 → 0.5.21

package/lib/index.js

@@ -570,7 +570,8 @@ async function modelsPayload(ctx, ownProviders = []) {
   return {
     models,
     default: def && models.some(m => m.id === def) ? def : (models[0]?.id ?? null),
-    capabilities: { webSearch: ownProviders.some(p => isOpenRouterURL(p.baseURL)), searchEngine: 'none', scholarSearch: false, vision: models.some(m => m.vision) },
+    // the harness's own models search through the host's web service; an own OpenRouter interface through `:online`
+    capabilities: { webSearch: typeof ctx.web?.search === 'function' || ownProviders.some(p => isOpenRouterURL(p.baseURL)), searchEngine: 'none', scholarSearch: false, vision: models.some(m => m.vision) },
     harness: { routableProviders: cat.routableProviders ?? [], failures: (cat.failures ?? []).map(f => ({ provider: f.id, message: f.message })) },
   }
 }
@@ -734,6 +735,150 @@ async function callOf(ctx, body, target) {
   return { provider: target.provider, model: target.model, messages, ...(system.length ? { system: system.join('\n\n') } : {}) }
 }
 
+// ── web search for the harness's own models ────────────────────────────
+// The canvas's web toggle reaches a bare model as one tool, web_search,
+// served by the host's web service (ctx.web): the host owns the backend
+// (its own search, or DeepSeek's Search API once the person turns that on
+// in the harness's web search settings) and the credential, so this plugin
+// never holds a key. Results are numbered across the whole answer and
+// stream back in the frames the app's own proxy uses: a { tool } ping per
+// search, { sources } at the end.
+// searches per answer, as the tool's description promises the model
+const SEARCH_LIMIT = 3
+const SEARCH_RESULTS = 5
+// keep in step with makeTools() and the directive in server.mjs
+const WEB_SEARCH_TOOL = {
+  name: 'web_search',
+  description:
+    'ONLY for current events, time-sensitive facts, or specific verifiable claims you cannot answer confidently from your own knowledge. ' +
+    'NEVER use for conceptual, definitional, reasoning or creative questions — answer those directly. ' +
+    'Results are numbered [1], [2], ... — when you use information from a result, cite it inline as [n]. At most 3 searches per answer.',
+  parameters: {
+    type: 'object',
+    properties: { query: { type: 'string', description: 'The search query, in the language most likely to find good results' } },
+    required: ['query'],
+    additionalProperties: false,
+  },
+}
+const SEARCH_DIRECTIVE = [
+  'Tools are AVAILABLE, not mandatory: first decide whether your own knowledge answers the question. Conceptual, definitional, reasoning and creative questions must be answered DIRECTLY, with no tool calls. Search only when the answer depends on current events, specific verifiable facts you are unsure of, or literature citations — or when the user explicitly asks you to look something up.',
+  'After using any search tool, you MUST follow up with a complete answer that SYNTHESIZES the results in your own words — analyze and conclude, never just list the results.',
+  'Cite sources inline as [n], using EXACTLY the bracket numbers shown in this turn\'s search results (they always start at [1]). Ignore any citation numbers appearing in earlier conversation messages — they refer to different sources.',
+  'If the search results are not actually relevant to the question, say so explicitly and answer from your own knowledge instead of forcing citations.',
+  'Never end your turn immediately after a search.',
+].join(' ')
+const SEARCH_LIMIT_NOTE = '\n\n(That was the last search for this answer: write the final answer now from the results above.)'
+
+/** Chunks of one model call assembled the way the host's own assembler
+ *  does it (a closed block as the adapter sent it, an open one from its
+ *  deltas), so a round's blocks line up with its replay state. */
+function chunkAssembler() {
+  const parts = new Map()
+  const order = []
+  let finish = { kind: 'stop' }
+  let replayState
+  const at = (index, blockType) => {
+    let p = parts.get(index)
+    if (!p) { p = { blockType, text: '', args: '' }; parts.set(index, p); order.push(index) }
+    return p
+  }
+  return {
+    push(chunk) {
+      switch (chunk.type) {
+        case 'block-start': at(chunk.index, chunk.blockType); return
+        case 'text-delta':
+        case 'reasoning-delta': { const p = at(chunk.index, chunk.type === 'text-delta' ? 'text' : 'reasoning'); if (!p.block) p.text += chunk.text; return }
+        case 'tool-call-delta': {
+          const p = at(chunk.index, 'tool-call')
+          if (p.block) return
+          p.id = chunk.id
+          if (chunk.name) p.name = chunk.name
+          p.args += chunk.argumentsDelta ?? ''
+          return
+        }
+        case 'block-end': { const p = at(chunk.index, chunk.block.type); if (!p.block) p.block = chunk.block; return }
+        case 'finish': finish = chunk.reason; replayState = chunk.replayState; return
+      }
+    },
+    blocks: () => order.map((index) => {
+      const p = parts.get(index)
+      if (p.block) return p.block
+      if (p.blockType === 'tool-call') return { type: 'tool-call', id: p.id ?? `call-${index}`, name: p.name ?? '', arguments: p.args }
+      return p.blockType === 'text' || p.blockType === 'reasoning' ? { type: p.blockType, text: p.text } : null
+    }).filter(Boolean),
+    get finish() { return finish },
+    get replayState() { return replayState },
+  }
+}
+
+/** One web_search call run through the host; its results join `sources`
+ *  under the next numbers, and the text the model reads comes back. */
+async function webSearchFor(ctx, call, sources, write) {
+  let query = ''
+  try { query = String(JSON.parse(call.arguments || '{}')?.query ?? '').trim() } catch { /* malformed arguments */ }
+  if (!query) return { text: 'web_search needs a query.', isError: true }
+  write({ tool: { name: 'web_search', query } })
+  try {
+    const r = await ctx.web.search({ query, maxResults: SEARCH_RESULTS }, AbortSignal.timeout(60000))
+    const results = (r?.sources ?? []).filter(s => s?.url).map(s => ({
+      title: s.title || s.url,
+      url: s.url,
+      content: String(s.snippet ?? '').slice(0, 600),
+      ...(s.publishedAt ? { date: String(s.publishedAt).slice(0, 10) } : {}),
+    }))
+    const start = sources.length
+    sources.push(...results)
+    if (results.length === 0) return { text: 'No results found.' }
+    return { text: results.map((x, i) => `[${start + i + 1}] ${x.title}${x.date ? ` (${x.date})` : ''}\n${x.url}\n${x.content}`).join('\n\n') }
+  } catch (error) {
+    const why = [error?.code, error instanceof Error ? error.message : String(error)].filter(Boolean).join(': ')
+    return { text: `Search failed (${why}). Answer from your own knowledge and say that the search did not run.`, isError: true }
+  }
+}
+
+/** One answer from a harness model, streamed to the canvas as its frames.
+ *  With search on, the model may call web_search up to SEARCH_LIMIT times:
+ *  each round's blocks and results join the request (the way an agent keeps
+ *  its own tool history) and the next round continues; a call past the
+ *  limit is answered with "no more searches". */
+async function harnessStream(ctx, target, options, search, write, isClosed) {
+  const sources = []
+  const messages = [...options.messages]
+  const request = search
+    ? { ...options, tools: [WEB_SEARCH_TOOL], system: options.system ? `${options.system}\n\n${SEARCH_DIRECTIVE}` : SEARCH_DIRECTIVE }
+    : options
+  let searched = 0
+  for (let round = 0; round <= SEARCH_LIMIT + 1; round++) {
+    const asm = chunkAssembler()
+    for await (const chunk of ctx.llm.stream({ ...request, messages })) {
+      if (isClosed()) return
+      asm.push(chunk)
+      if (chunk.type === 'text-delta' && chunk.text) write({ text: chunk.text })
+      else if (chunk.type === 'reasoning-delta' && chunk.text) write({ reasoning: chunk.text })
+    }
+    const finish = asm.finish
+    if (finish.kind === 'error') throw new Error(finish.failure?.message ?? finish.failure?.code ?? 'the model call failed')
+    if (finish.kind === 'aborted') return
+    // a call cut off by the output limit cannot run safely (the host's rule)
+    const calls = finish.kind === 'max-tokens' ? [] : asm.blocks().filter(b => b.type === 'tool-call')
+    if (!search || calls.length === 0 || round === SEARCH_LIMIT + 1) break
+    messages.push({
+      id: 'td-' + randomUUID(), role: 'assistant', content: asm.blocks(),
+      source: { kind: 'model', provider: target.provider, model: target.model, ...(asm.replayState ? { replayState: asm.replayState } : {}) },
+    })
+    for (const call of calls) {
+      const allowed = call.name === WEB_SEARCH_TOOL.name && searched < SEARCH_LIMIT
+      if (allowed) searched++
+      const r = allowed
+        ? await webSearchFor(ctx, call, sources, write)
+        : { text: 'No more searches for this answer: write the final answer now from the results above.', isError: true }
+      const text = allowed && searched === SEARCH_LIMIT ? r.text + SEARCH_LIMIT_NOTE : r.text
+      messages.push({ id: 'td-' + randomUUID(), role: 'tool', toolCallId: call.id, content: [{ type: 'text', text }], source: { kind: 'tool', callId: call.id }, ...(r.isError ? { isError: true } : {}) })
+    }
+  }
+  if (sources.length > 0) write({ sources })
+}
+
 /** The canvas's compiled messages, split for the agent: the last user
  *  message is the question; everything before it is the context the canvas
  *  wired in, rendered as one block the harness receives ahead of the turn. */
@@ -774,43 +919,152 @@ function toolQuery(name, args) {
 /** sessionId → the canvas turn running in it: its frame emitter, its
  *  close probe, and the tool calls seen so far (callId → name, arguments). */
 const canvasTurns = new Map()
-/** approval id → the resolver waiting for the person's decision */
+/** approval or question id → the resolver waiting for the person's decision */
 const pendingApprovals = new Map()
+/** sessionId → the exact steps the person allowed for the rest of the
+ *  session ("tool name + its arguments"; the harness's own approvals are
+ *  one-shot, so the standing allowance lives here, in memory) */
+const sessionRules = new Map()
+
+const APPROVAL_OUTCOMES = new Set(['allowed-once', 'allowed-session', 'rejected', 'cancelled'])
+
+/** Wait for the person's answer to one canvas card, the canvas stream going
+ *  away, or the harness withdrawing the request — whichever comes first. */
+async function personDecides(id, sessionId, entry, signal, kind) {
+  let clear
+  const decision = new Promise(resolve => { pendingApprovals.set(id, { resolve, sessionId, kind }) })
+  const closed = new Promise(resolve => { const t = setInterval(() => { if (entry.isClosed()) { clearInterval(t); resolve('closed') } }, 500); clear = () => clearInterval(t) })
+  const aborted = new Promise(resolve => {
+    if (!signal) return
+    if (signal.aborted) resolve('aborted')
+    else signal.addEventListener('abort', () => resolve('aborted'), { once: true })
+  })
+  const r = await Promise.race([decision, closed, aborted])
+  pendingApprovals.delete(id)
+  clear?.()
+  return r
+}
+
+// what a step does, without the prose the model writes around it each time
+// (a bash call carries a fresh description and justification on every try)
+const PROSE_ARGS = new Set(['description', 'justification', 'reason', 'rationale', 'explanation', 'summary', 'title'])
+function stepKey(args) {
+  let v = args
+  if (typeof v === 'string') { try { v = JSON.parse(v) } catch { return v } }
+  if (!v || typeof v !== 'object' || Array.isArray(v)) return JSON.stringify(v ?? null)
+  return JSON.stringify(Object.fromEntries(Object.keys(v).filter(k => !PROSE_ARGS.has(k)).sort().map(k => [k, v[k]])))
+}
 
-const APPROVAL_OUTCOMES = new Set(['allowed-once', 'rejected'])
+/** The canvas turn a harness request belongs to, or null when it is the
+ *  person's own (another turn of the same session) or no canvas is watching. */
+function canvasTurnOf(agent) {
+  const entry = canvasTurns.get(agent?.id)
+  if (!entry || entry.turn === null || entry.current() !== entry.turn) return null
+  return entry
+}
 
 function installApprovalAnswerer(ctx) {
   ctx.on('approval/request', async function (req, next) {
-    const entry = canvasTurns.get(req?.agent?.id)
-    if (!entry) return next()
     // an approval raised by another turn of the same session (the person's
     // own tool call, running before or after ours) stays with the harness UI
-    if (entry.turn === null || entry.current() !== entry.turn) return next()
+    const entry = canvasTurnOf(req?.agent)
+    if (!entry) return next()
+    const sessionId = req.agent.id
     const id = 'td-' + randomUUID()
     const call = req.callId !== undefined ? entry.calls.get(req.callId) : undefined
     const name = call?.name ?? req.toolName
+    const args = typeof call?.arguments === 'string' ? call.arguments : (call?.arguments ? JSON.stringify(call.arguments) : null)
+    const query = call ? toolQuery(name, call.arguments) : ''
+    // a standing allowance covers exactly this step: same tool, same arguments
+    const rule = call ? `harness:${name}:${stepKey(call.arguments)}` : null
+    if (rule && sessionRules.get(sessionId)?.has(rule)) {
+      entry.emit({ approvalDecided: { id, outcome: 'allowed-session', auto: true, name, query, rule } })
+      return 'allowed-once'
+    }
     entry.emit({ approval: {
       id, toolName: req.toolName, callId: req.callId ?? null, reason: req.reason ?? null,
-      name, query: call ? toolQuery(name, call.arguments) : '', arguments: typeof call?.arguments === 'string' ? call.arguments : (call?.arguments ? JSON.stringify(call.arguments) : null),
+      name, query, arguments: args, ...(rule ? { rule } : {}),
     } })
-    let clear
-    const decision = new Promise(resolve => { pendingApprovals.set(id, { resolve, sessionId: req.agent.id }) })
-    const closed = new Promise(resolve => { const t = setInterval(() => { if (entry.isClosed()) { clearInterval(t); resolve('closed') } }, 500); clear = () => clearInterval(t) })
-    const aborted = new Promise(resolve => {
-      if (!req.signal) return
-      if (req.signal.aborted) resolve('aborted')
-      else req.signal.addEventListener('abort', () => resolve('aborted'), { once: true })
-    })
-    const r = await Promise.race([decision, closed, aborted])
-    pendingApprovals.delete(id)
-    clear?.()
+    const r = await personDecides(id, sessionId, entry, req.signal, 'approval')
     if (r === 'closed') return next()
     const outcome = r === 'aborted' ? 'cancelled' : r
-    entry.emit({ approvalDecided: { id, outcome } })
-    return outcome
+    if (outcome === 'allowed-session' && rule) {
+      if (!sessionRules.has(sessionId)) sessionRules.set(sessionId, new Set())
+      sessionRules.get(sessionId).add(rule)
+    }
+    entry.emit({ approvalDecided: { id, outcome, ...(outcome === 'allowed-session' && rule ? { rule } : {}) } })
+    return outcome === 'allowed-session' ? 'allowed-once' : outcome
+  }, true)
+
+  // the agent's own questions (ask_user_question, and plan review on leaving
+  // plan mode): one form on the node, the answers back in the harness's
+  // vocabulary — a skip answers every question with nothing picked
+  ctx.on('user-questions/request', async function (req, next) {
+    const entry = canvasTurnOf(req?.agent)
+    if (!entry) return next()
+    const questions = (Array.isArray(req.questions) ? req.questions : []).filter(q => q && typeof q.id === 'string').map(q => ({
+      id: q.id, question: String(q.question ?? ''),
+      ...(typeof q.header === 'string' ? { header: q.header } : {}),
+      ...(typeof q.detail === 'string' ? { detail: q.detail } : {}),
+      options: (Array.isArray(q.options) ? q.options : []).filter(o => o && typeof o.label === 'string').map(o => ({ label: o.label, ...(typeof o.description === 'string' ? { description: o.description } : {}) })),
+      multiSelect: !!q.multiSelect, custom: true,
+    }))
+    if (questions.length === 0) return next()
+    const id = 'td-' + randomUUID()
+    entry.emit({ approval: {
+      id, kind: 'form', toolName: 'ask_user_question', callId: req.callId ?? null, reason: null,
+      name: 'ask_user_question', query: questions.map(q => q.question).join('\n'), arguments: null, questions,
+    } })
+    const r = await personDecides(id, req.agent.id, entry, req.signal, 'form')
+    if (r === 'closed') return next()
+    if (r === 'aborted') { entry.emit({ approvalDecided: { id, outcome: 'cancelled' } }); throw new Error('the question was withdrawn') }
+    const given = r !== 'cancelled' && Array.isArray(r?.answers) ? r.answers : []
+    const answers = questions.map((q) => {
+      const a = given.find(x => x && x.id === q.id)
+      const selected = Array.isArray(a?.selected) ? a.selected.filter(x => typeof x === 'string' && q.options.some(o => o.label === x)) : []
+      const custom = typeof a?.custom === 'string' && a.custom.trim() ? a.custom.trim() : undefined
+      return { id: q.id, selected, ...(custom !== undefined ? { custom } : {}) }
+    })
+    const shown = answers.filter(a => a.selected.length || a.custom).map(a => `${questions.find(q => q.id === a.id)?.header ?? a.id} → ${[...a.selected, ...(a.custom ? [a.custom] : [])].join(', ')}`).join('; ')
+    entry.emit({ approvalDecided: { id, outcome: given.length ? 'answered' : 'cancelled', value: shown || null } })
+    return { answers }
   }, true)
 }
 
+// ── the canvas's permission mode, for the turns it starts ───────────────
+// The canvas has one switch for every agent it runs (ask / auto / allow).
+// Here it maps onto the harness's own permission presets: 'auto' is its
+// Auto review (present when the person installed that integration),
+// 'allow' is full access; 'ask' leaves the session as the person set it.
+// The preset is switched for the canvas's turn only and switched back when
+// the turn ends, so the session keeps its own setting in the harness.
+const CANVAS_PRESETS = { auto: 'auto', allow: 'danger-full-access' }
+let permissionPresets = null
+
+/** Apply the canvas's mode to one turn; returns the undo, or null. */
+function canvasPermission(ctx, agent, mode, emit) {
+  const want = CANVAS_PRESETS[mode]
+  if (!want) return null
+  const presets = permissionPresets
+  const session = agent?.session
+  const report = (applied, reason) => emit({ permission: { mode, applied, ...(reason ? { reason } : {}) } })
+  if (!presets || !session) { report(false, 'unavailable'); return null }
+  try {
+    if (!presets.names.includes(want)) { report(false, 'unavailable'); return null }
+    const before = presets.current(session)
+    if (before === want) { report(true); return null }
+    // a hand-tuned mix of sandbox and approval has no preset to come back to
+    if (before === 'custom') { report(false, 'custom'); return null }
+    const set = (name) => presets.apply(session, name, (policy) => ctx.approval.setPolicy(agent, policy))
+    set(want)
+    report(true)
+    return () => { try { if (presets.current(session) === want) set(before) } catch { /* the session closed */ } }
+  } catch (error) {
+    report(false, 'failed')
+    return null
+  }
+}
+
 /** Run one question through the harness's agent loop, continuing a mirrored
  *  session, forking a dsh mirror at the parent's exact turn, or creating a
  *  fresh session. Report progress as SSE-style frames via `emit`; resolves
@@ -859,6 +1113,7 @@ async function runAgentTurn(ctx, body, emit, isClosed, { answerApprovals = true
   const picked = agentTargetOf(body?.model)
   if (picked && !hasImages) await ctx.sessionController.selectModel({ sessionId, provider: picked.provider, model: picked.model }).catch(() => {})
   const agent = await agentOf(ctx, sessionId)
+  const restorePermission = canvasPermission(ctx, agent, body?.harness?.permission, emit)
   let sawChunk = false      // text deltas reached us live
   let sawReasoning = false  // reasoning deltas reached us live
   let fullText = ''
@@ -957,6 +1212,7 @@ async function runAgentTurn(ctx, body, emit, isClosed, { answerApprovals = true
     if (typeof off === 'function') off()
     if (typeof offStream === 'function') offStream()
     if (canvasTurns.get(sessionId) === turnEntry) canvasTurns.delete(sessionId)
+    restorePermission?.()
   }
   return { sessionId, text: fullText }
 }
@@ -1272,12 +1528,24 @@ export async function apply(ctx, config) {
         registeredProviders = ownProvidersOf(body?.providers)
         return sendJson(res, 200, await modelsPayload(ctx, registeredProviders))
       }
+      // which of the canvas's permission modes this host can honour for its own agent
+      if (path === '/permission-modes' && req.method === 'GET') {
+        let names = []
+        try { names = permissionPresets ? [...permissionPresets.names] : [] } catch { /* the service went away */ }
+        return sendJson(res, 200, { auto: names.includes(CANVAS_PRESETS.auto), allow: names.includes(CANVAS_PRESETS.allow) })
+      }
       const approvalRoute = /^\/approvals\/([^/]+)$/.exec(path)
       if (approvalRoute !== null && req.method === 'POST') {
         const id = decodeURIComponent(approvalRoute[1])
         const body = await readJson(req, MAX_WRITE_BODY_BYTES)
         const pending = pendingApprovals.get(id)
         if (!pending) return sendJson(res, 404, { error: 'no such pending approval' })
+        if (pending.kind === 'form') {
+          // a form takes its answers, or a skip
+          if (Array.isArray(body?.answers)) { pending.resolve({ answers: body.answers }); return sendJson(res, 200, { id, outcome: 'answered' }) }
+          pending.resolve('cancelled')
+          return sendJson(res, 200, { id, outcome: 'cancelled' })
+        }
         const outcome = APPROVAL_OUTCOMES.has(body?.outcome) ? body.outcome : 'rejected'
         pending.resolve(outcome)
         return sendJson(res, 200, { id, outcome })
@@ -1328,11 +1596,8 @@ export async function apply(ctx, config) {
         let closed = false
         req.on('close', () => { closed = true })
         try {
-          for await (const chunk of ctx.llm.stream(options)) {
-            if (closed) break
-            if (chunk.type === 'text-delta' && chunk.text) res.write(`data: ${JSON.stringify({ text: chunk.text })}\n\n`)
-            else if (chunk.type === 'reasoning-delta' && chunk.text) res.write(`data: ${JSON.stringify({ reasoning: chunk.text })}\n\n`)
-          }
+          const search = body?.webSearch === true && typeof ctx.web?.search === 'function'
+          await harnessStream(ctx, target, options, search, frame => { if (!closed) res.write(`data: ${JSON.stringify(frame)}\n\n`) }, () => closed)
           if (!closed) res.write('data: [DONE]\n\n')
         } catch (error) {
           if (!closed) res.write(`data: ${JSON.stringify({ error: error instanceof Error ? error.message : String(error) })}\n\n`)
@@ -1414,5 +1679,11 @@ export async function apply(ctx, config) {
   ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: prefix, handler: staticHandler }), 'thoughtdag: static')
   ctx.logger.info('[dsh-thoughtdag] ThoughtDAG mounted at ' + prefix + '/')
   installApprovalAnswerer(ctx)
+  // the permission presets service is optional: hosts without it keep the canvas's 'ask'
+  ctx.inject(['permissionPresets'], (pctx) => {
+    const svc = pctx.permissionPresets
+    permissionPresets = svc
+    pctx.effect(() => () => { if (permissionPresets === svc) permissionPresets = null }, 'thoughtdag: permission presets')
+  })
   await installWhyLayer(ctx, config)
 }

package/lib/runtime/agents/README.md

@@ -5,7 +5,7 @@ One file per runtime (CommonJS, `.cjs`, so it loads the same under any package t
 - `available()` → where the binary is, or null
 - `models()` → `{ installed, models: [{ provider, id, name, reasoning, vision, efforts, defaultEffort }], default }`; when the CLI is nowhere, `{ installed: false, searched: [dirs] }` names every directory the lookup walked (see `where.cjs`: the process PATH, then the login shell's PATH, then the usual homes and Node version managers), and the next ask looks again — `efforts` are the effort levels the CLI accepts for that model, in its own words, read from the CLI (empty when it has none); `defaultEffort` its own default when it says
 - `run(request, onEvent)` → run id at once; events follow, tagged with it. The request names the runtime, an absolute `cwd`, one `prompt`, optional `images`, a `model` from that runtime's own list, a session to continue (`sessionPath`, plus `forkEntryId` to branch it), and optionally `effort`: one of the levels the runtime itself listed for that model, in its own words (Codex from `model/list`, Claude Code and Pi from their `--help`), which it passes on as is (`--effort`, the turn's `effort`, `set_thinking_level`). A word the runtime did not list is dropped: the CLI's own setting stands.
-- `abort(runId)`, `answer(runId, requestId, { confirmed } | { value } | { cancelled: true })`, `shutdown()`
+- `abort(runId)`, `answer(runId, requestId, { confirmed } | { value } | { answers } | { cancelled: true })`, `shutdown()`
 
 A run emits exactly these event kinds (the renderer reads nothing else):
 
@@ -14,11 +14,13 @@ A run emits exactly these event kinds (the renderer reads nothing else):
 | `session` | which session file this run writes to, and where (cwd); `model.resolved` names the real model when the run used an alias (Claude Code's `opus` → `claude-opus-5`); `effort` is the level the turn actually ran at, read back from the runtime's own record (Pi's state, Codex's rollout `turn_context`, Claude Code's transcript entries), never assumed |
 | `message_update` with a text or thinking delta | the answer or the reasoning growing |
 | `tool_execution_start` / `tool_execution_end` | a tool call, for the live trace |
-| `question` | the agent asks the person: confirm / select / input / editor. A confirm may carry `rule`, an opaque key naming what "allow for this conversation" would cover (Claude Code: its own permission suggestion; Codex: the command, or all file changes); the answer `{ confirmed: true, scope: 'session' }` allows it for good — the runtime tells the CLI where it can (Claude Code `updatedPermissions` scoped to the session, Codex `acceptForSession`) and the canvas keeps the rule on the record, sending every such rule back as `allowRules` on later runs of this conversation |
+| `question` | the agent asks the person: confirm / select / input / editor, or a `form` — several `questions` answered together (Claude Code's AskUserQuestion, Codex's request_user_input), each with options (label, description), `multiSelect`, `custom` (own words taken) and `secret`; the answer is `{ answers: [{ id, selected, custom? }] }`. A confirm may carry `rule`, an opaque key naming what "allow for this conversation" would cover (Claude Code: its own permission suggestion; Codex: the command, or all file changes); the answer `{ confirmed: true, scope: 'session' }` allows it for good — the runtime tells the CLI where it can (Claude Code `updatedPermissions` scoped to the session, Codex `acceptForSession`) and the canvas keeps the rule on the record, sending every such rule back as `allowRules` on later runs of this conversation |
 | `question_answered` | the person's answer went back (record); with `auto: true` the runtime decided from a standing rule of this conversation and nobody was asked — the record is made from its `title`/`message`/`rule` |
 | `fs_changes` | what the shell saw change on disk (produced here, not by the agent) |
 | `run_end` / `run_error` | the turn is over |
 
+The canvas's permission mode reaches every runtime through `<cwd>/.thoughtdag/guard.json` (`{ mode: 'ask' | 'auto' | 'allow', allow: [dirs] }`): Pi's guard reads it on every call (`auto` runs as `ask`; `allow` dirs pass); Codex takes it at thread start or resume (ask: on-request in the workspace sandbox; auto: the same with `approvalsReviewer: 'auto_review'`; allow: never, full access); Claude Code at spawn (ask: `default`; auto: `auto`; allow: `bypassPermissions`). Claude Code's prompt channel stays open in every mode, so its questions reach the person even when nothing needs approval.
+
 Nothing starts at launch. A runtime's process (Pi's rpc, Codex's app-server, a Pi catalog read) is started by the first request that needs it and retires after ten minutes without one (`TD_AGENT_IDLE_MS`); Claude Code runs one process per turn. A launch that never opens the agent group never starts a CLI.
 
 The finished turn is adopted from the session file by the atlas's adapter for that

package/lib/runtime/agents/claude.cjs

@@ -95,11 +95,15 @@ async function sessionFileFor(cwd, sessionId) {
 // UUID of its own (a project path that names a session), so take the LAST
 const sessionIdOf = (sessionPath) => { const all = String(sessionPath ?? '').match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi); return all && all.length ? all[all.length - 1] : null; };
 
-/** The guard file the canvas writes per working directory, as a permission mode. */
+/** The guard file the canvas writes per working directory, as a permission
+ *  mode: ask → the CLI's default (it asks before edits and commands), auto →
+ *  its classifier decides and asks only what it holds risky, allow → nothing
+ *  asked. Questions the model puts to the person reach the canvas in all three. */
 async function permissionModeFor(cwd) {
   try {
     const raw = JSON.parse(await fsp.readFile(path.join(cwd, '.thoughtdag', 'guard.json'), 'utf8'));
     if (raw?.mode === 'allow') return 'bypassPermissions';
+    if (raw?.mode === 'auto') return 'auto';
   } catch { /* default */ }
   return 'default';
 }
@@ -148,8 +152,9 @@ function createClaudeRuntime({ log } = {}) {
           const mode = await permissionModeFor(cwd);
           const model = req.model && typeof req.model === 'object' && req.model.id && req.model.id !== 'default' ? req.model.id : null;
           const resumeId = req.sessionPath ? sessionIdOf(req.sessionPath) : null;
-          const args = ['-p', '--output-format', 'stream-json', '--input-format', 'stream-json', '--verbose', '--include-partial-messages', '--permission-mode', mode];
-          if (mode !== 'bypassPermissions') args.push('--permission-prompt-tool', 'stdio');
+          // the prompt channel stays open in every mode: with nothing to
+          // approve, AskUserQuestion still comes through it
+          const args = ['-p', '--output-format', 'stream-json', '--input-format', 'stream-json', '--verbose', '--include-partial-messages', '--permission-mode', mode, '--permission-prompt-tool', 'stdio'];
           if (model) args.push('--model', model);
           // only a level the CLI itself lists; anything else means its default
           if (req.effort && (await effortsOf(b)).includes(req.effort)) args.push('--effort', req.effort);
@@ -213,6 +218,42 @@ function createClaudeRuntime({ log } = {}) {
                 if (r.subtype !== 'can_use_tool') { write(proc, { type: 'control_response', response: { subtype: 'error', request_id: m.request_id, error: 'unsupported request' } }); break; }
                 const id = `q-${m.request_id}`;
                 const input = r.input ?? {};
+                // the model's own questions for the person: one form, answered
+                // through the same channel — the answers ride back in the tool's
+                // input, keyed by each question's text (a skip is a refusal the
+                // model reads as "not answered")
+                if (r.tool_name === 'AskUserQuestion' && Array.isArray(input.questions)) {
+                  const qs = input.questions.filter((q) => q && typeof q.question === 'string');
+                  state.asks.set(id, (answer) => {
+                    const given = Array.isArray(answer?.answers) ? answer.answers : null;
+                    if (!given || answer?.cancelled) {
+                      write(proc, { type: 'control_response', response: { subtype: 'success', request_id: m.request_id, response: { behavior: 'deny', message: 'The person skipped these questions without answering.' } } });
+                      mark({ type: 'question_answered', id, outcome: 'cancelled', value: null });
+                      return;
+                    }
+                    const answers = {};
+                    qs.forEach((q, i) => {
+                      const a = given.find((x) => x && x.id === String(i));
+                      if (!a) return;
+                      const own = typeof a.custom === 'string' && a.custom.trim() ? a.custom.trim() : null;
+                      const picked = (Array.isArray(a.selected) ? a.selected : []).filter((x) => typeof x === 'string');
+                      if (q.multiSelect) { const all = own ? [...picked, own] : picked; if (all.length) answers[q.question] = all; }
+                      else if (own || picked[0]) answers[q.question] = own ?? picked[0];
+                    });
+                    write(proc, { type: 'control_response', response: { subtype: 'success', request_id: m.request_id, response: { behavior: 'allow', updatedInput: { ...input, answers } } } });
+                    mark({ type: 'question_answered', id, outcome: 'answered', value: Object.entries(answers).map(([k, v]) => `${k} → ${Array.isArray(v) ? v.join(', ') : v}`).join('; ') || null });
+                  });
+                  mark({
+                    type: 'question', kind: 'form', id, title: 'AskUserQuestion', message: qs.map((q) => q.question).join('\n'),
+                    questions: qs.map((q, i) => ({
+                      id: String(i), question: q.question, ...(typeof q.header === 'string' ? { header: q.header } : {}),
+                      options: (Array.isArray(q.options) ? q.options : []).filter((o) => o && typeof o.label === 'string').map((o) => ({ label: o.label, ...(typeof o.description === 'string' ? { description: o.description } : {}) })),
+                      multiSelect: !!q.multiSelect, custom: true,
+                    })),
+                    options: [], placeholder: null, prefill: null, paths: [], suggest: null,
+                  });
+                  break;
+                }
                 const line = typeof input.command === 'string' ? input.command : (input.file_path ?? input.path ?? JSON.stringify(input).slice(0, 200));
                 // the CLI's own "don't ask again" suggestion names what a standing
                 // allowance covers; sent back scoped to the session, never to settings

package/lib/runtime/agents/codex.cjs

@@ -25,13 +25,15 @@ let located = null;
 const findCodex = () => (located ??= locate('codex', EXTRA_HOMES));
 const childEnv = () => envWith(EXTRA_HOMES);
 
-/** The guard file the canvas writes per working directory, as Codex policy. */
+/** The guard file the canvas writes per working directory, as Codex policy:
+ *  ask → the workspace sandbox, escalations asked of the person; auto → the
+ *  same, with escalations decided by Codex's own reviewer (anything it turns
+ *  down still comes to the person); allow → no sandbox, nothing asked. */
 async function policyFor(cwd) {
-  try {
-    const raw = JSON.parse(await fsp.readFile(path.join(cwd, '.thoughtdag', 'guard.json'), 'utf8'));
-    if (raw?.mode === 'allow') return { approvalPolicy: 'never', sandbox: 'danger-full-access' };
-  } catch { /* default */ }
-  return { approvalPolicy: 'on-request', sandbox: 'workspace-write' };
+  let mode = 'ask';
+  try { mode = JSON.parse(await fsp.readFile(path.join(cwd, '.thoughtdag', 'guard.json'), 'utf8'))?.mode ?? 'ask'; } catch { /* default */ }
+  if (mode === 'allow') return { approvalPolicy: 'never', sandbox: 'danger-full-access', approvalsReviewer: 'user' };
+  return { approvalPolicy: 'on-request', sandbox: 'workspace-write', approvalsReviewer: mode === 'auto' ? 'auto_review' : 'user' };
 }
 
 // the thread id is in the rollout's file name; take the LAST UUID in the
@@ -242,17 +244,29 @@ function createCodexRuntime({ log } = {}) {
         return ask({ kind: 'confirm', title: 'more permissions requested', message: [params.reason, JSON.stringify(params.permissions ?? {})].filter(Boolean).join('\n'), options: [], placeholder: null, prefill: null, paths: [], suggest: null },
           (a, id) => { const yes = !!a?.confirmed; reply({ permissions: yes ? (params.permissions ?? {}) : {}, scope: 'turn' }); decided(id, yes ? 'allowed-once' : 'rejected'); });
       case 'item/tool/requestUserInput': {
-        // one question at a time; the answers go back together
-        const qs = Array.isArray(params.questions) ? params.questions : [];
-        const answers = {};
-        const next = (i) => {
-          if (i >= qs.length) { reply({ answers }); return; }
-          const q = qs[i];
-          const opts = (q.options ?? []).map((o) => o.label);
-          ask({ kind: opts.length ? 'select' : 'input', title: q.header || 'question', message: q.question || '', options: opts, placeholder: q.isOther ? 'other…' : null, prefill: null, paths: [], suggest: null },
-            (a, id) => { const v = typeof a?.value === 'string' ? a.value : ''; answers[q.id] = { answers: v ? [v] : [] }; decided(id, v ? 'answered' : 'cancelled', v || null); next(i + 1); });
-        };
-        return next(0);
+        // the questions as one form; the answers go back together, keyed by
+        // question id (a secret answer stays out of the record)
+        const qs = (Array.isArray(params.questions) ? params.questions : []).filter((q) => q && typeof q.id === 'string');
+        return ask({
+          kind: 'form', title: 'request_user_input', message: qs.map((q) => q.question || q.header || '').join('\n'),
+          questions: qs.map((q) => ({
+            id: q.id, question: q.question || '', ...(q.header ? { header: q.header } : {}),
+            options: (Array.isArray(q.options) ? q.options : []).filter((o) => o && typeof o.label === 'string').map((o) => ({ label: o.label, ...(o.description ? { description: o.description } : {}) })),
+            custom: !!q.isOther || !(Array.isArray(q.options) && q.options.length), secret: !!q.isSecret,
+          })),
+          options: [], placeholder: null, prefill: null, paths: [], suggest: null,
+        }, (a, id) => {
+          const given = Array.isArray(a?.answers) ? a.answers : [];
+          const answers = {};
+          for (const q of qs) {
+            const g = given.find((x) => x && x.id === q.id);
+            const own = typeof g?.custom === 'string' && g.custom.trim() ? [g.custom.trim()] : [];
+            answers[q.id] = { answers: [...(Array.isArray(g?.selected) ? g.selected.filter((x) => typeof x === 'string') : []), ...own] };
+          }
+          reply({ answers });
+          const shown = qs.filter((q) => !q.isSecret && answers[q.id].answers.length).map((q) => `${q.header || q.question} → ${answers[q.id].answers.join(', ')}`).join('; ');
+          decided(id, given.length ? 'answered' : 'cancelled', shown || null);
+        });
       }
       default:
         return write({ jsonrpc: '2.0', id: msg.id, error: { code: -32601, message: `unsupported request ${msg.method}` } });

package/lib/runtime/agents/ops.cjs

@@ -45,7 +45,7 @@ async function writeGuard(cwd, config) {
   if (typeof cwd !== 'string' || !path.isAbsolute(cwd)) return false;
   const dir = path.join(cwd, '.thoughtdag');
   await fsp.mkdir(dir, { recursive: true });
-  const mode = config?.mode === 'allow' ? 'allow' : 'ask';
+  const mode = config?.mode === 'allow' || config?.mode === 'auto' ? config.mode : 'ask';
   const allow = Array.isArray(config?.allow) ? config.allow.filter((x) => typeof x === 'string' && path.isAbsolute(x)).slice(0, 100) : [];
   await fsp.writeFile(path.join(dir, 'guard.json'), JSON.stringify({ mode, allow }, null, 2));
   return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-thoughtdag",
-  "version": "0.5.20",
+  "version": "0.5.21",
   "description": "ThoughtDAG for DeepSeek Harness: turn the current DSH session into an editable thought graph on an infinite canvas. Source, releases and issues: github.com/chenxiachan/thoughtdag",
   "author": "Xia Chen",
   "repository": {

package/dist-app/assets/channel-GKL8NncG.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-C0BcALIm.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist-app/assets/classDiagram-ZZMXUADV-CfiMnbJv.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-TICWLB2K-DlYo009w.js";import{_ as i}from"./mermaid.core-C0BcALIm.js";import"./index-CaJu4U8U.js";import"./chunk-5VM5RSS4-B3FJnk33.js";import"./chunk-XXDRQBXY-DSu27P5i.js";import"./chunk-POPQ4Y6H-ISG0Axt5.js";import"./chunk-F27PBJKO-GG0xbyKU.js";import"./purify.es-Cz4mVeUR.js";var f={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{f as diagram};

package/dist-app/assets/classDiagram-v2-VYDZK3BY-CfiMnbJv.js

@@ -1 +0,0 @@
-import{s as a,c as s,a as e,C as t}from"./chunk-TICWLB2K-DlYo009w.js";import{_ as i}from"./mermaid.core-C0BcALIm.js";import"./index-CaJu4U8U.js";import"./chunk-5VM5RSS4-B3FJnk33.js";import"./chunk-XXDRQBXY-DSu27P5i.js";import"./chunk-POPQ4Y6H-ISG0Axt5.js";import"./chunk-F27PBJKO-GG0xbyKU.js";import"./purify.es-Cz4mVeUR.js";var f={parser:e,get db(){return new t},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{f as diagram};