janissary 0.5.0

package/LICENSE

@@ -0,0 +1,75 @@
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+Required Notice: Copyright Derrick Parkhurst (https://github.com/thirtysixthspan)
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose.  However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software.  Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization.  **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

package/README.md

@@ -0,0 +1,28 @@
+# Janissary
+
+Janissary is an **Agentic Working Environment**. In other words, it is an application for supporting your work using workflows augmented with agents.
+
+A [Janissary](https://en.wikipedia.org/wiki/Janissary) was an elite infantry soldier in the Ottoman Empire — a servant of the gate, loyal, and ever-ready. 
+
+See the [User Docs](https://thirtysixthspan.github.io/janissary/user-documentation/getting-started/application) for the full command reference, tab types, and automation/advanced-agent guides.
+
+See the [Developer Docs](https://thirtysixthspan.github.io/janissary/developer-documentation/) for advanced usage, coding, linting and testing practices.  
+
+## Prerequisites
+
+- macOS
+- Node.js 24+
+- Google Chrome 
+
+## Usage
+
+```
+npx janus
+```
+
+Or install globally:
+
+```
+npm install -g janissary
+janus
+```

package/agent-names.json

@@ -0,0 +1,52 @@
+[
+  "ahmed",
+  "akbar",
+  "aslan",
+  "basir",
+  "bekir",
+  "bilal",
+  "cafer",
+  "cahit",
+  "cavus",
+  "davud",
+  "demir",
+  "dogan",
+  "ekrem",
+  "emrah",
+  "ersin",
+  "farid",
+  "fariz",
+  "fikri",
+  "hakim",
+  "hamza",
+  "harun",
+  "idris",
+  "ilyas",
+  "imran",
+  "jabir",
+  "jalal",
+  "jamal",
+  "kadir",
+  "kamil",
+  "kasim",
+  "latif",
+  "lutfi",
+  "mahir",
+  "malik",
+  "murad",
+  "omair",
+  "orhan",
+  "osman",
+  "rasim",
+  "recep",
+  "rifat",
+  "sabri",
+  "salih",
+  "selim",
+  "tahir",
+  "timur",
+  "turan",
+  "yahya",
+  "yavuz",
+  "yusuf"
+]

package/bin/janus.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { existsSync } from 'node:fs';
+
+// Janissary runs as a local web app: this launcher boots the Node server (which opens the
+// browser to a token-gated localhost URL) and stays attached so Ctrl+C shuts it down.
+const root = path.join(import.meta.dirname, '..');
+const compiled = path.join(root, 'dist', 'main.js');
+const source = path.join(root, 'src', 'main.ts');
+const localTsx = path.join(root, 'node_modules', 'tsx', 'dist', 'cli.mjs');
+const arguments_ = process.argv.slice(2);
+
+let command, commandArguments;
+if (existsSync(compiled)) {
+  command = process.execPath;
+  commandArguments = [compiled, ...arguments_];
+} else if (existsSync(localTsx)) {
+  command = process.execPath;
+  commandArguments = [localTsx, source, ...arguments_];
+} else {
+  command = 'npx';
+  commandArguments = ['tsx', source, ...arguments_];
+}
+
+const result = spawnSync(command, commandArguments, { stdio: 'inherit' });
+process.exit(result.status ?? 1);

package/chrome-extension/content-script.js

@@ -0,0 +1,62 @@
+// Relays the text currently visible in this frame's viewport to the Janissary app's top window, so
+// a monitor watching a page tab can see what the user is actually looking at right now. Runs in
+// every frame (manifest `all_frames: true`), but only ever acts inside an embedded page tab's
+// iframe — the app's own top-level window is never a nested frame of itself, so it is a no-op there.
+(function () {
+  if (window.top === window.self) return;
+
+  var CAPTURE_DEBOUNCE_MS = 500;
+  var SOURCE = 'janissary-page-content';
+  var timer = null;
+
+  function isVisible(el) {
+    var style = window.getComputedStyle(el);
+    if (style.display === 'none' || style.visibility === 'hidden') return false;
+    if (parseFloat(style.opacity) === 0) return false;
+    var rect = el.getBoundingClientRect();
+    if (rect.width === 0 || rect.height === 0) return false;
+    return rect.bottom > 0 && rect.right > 0 && rect.top < window.innerHeight && rect.left < window.innerWidth;
+  }
+
+  // Walk the live DOM, collecting the direct text of elements that are both viewport-intersecting
+  // and not hidden by CSS, joined in document order. Off-screen and hidden content is skipped.
+  function collectVisibleText(root) {
+    var parts = [];
+    var walker = document.createTreeWalker(root, NodeFilter.SHOW_ELEMENT, {
+      acceptNode: function (node) {
+        var tag = node.tagName;
+        if (tag === 'SCRIPT' || tag === 'STYLE' || tag === 'NOSCRIPT') return NodeFilter.FILTER_REJECT;
+        return isVisible(node) ? NodeFilter.FILTER_ACCEPT : NodeFilter.FILTER_REJECT;
+      },
+    });
+    var node = walker.nextNode();
+    while (node) {
+      for (var i = 0; i < node.childNodes.length; i++) {
+        var child = node.childNodes[i];
+        if (child.nodeType === Node.TEXT_NODE) {
+          var text = child.textContent.trim();
+          if (text) parts.push(text);
+        }
+      }
+      node = walker.nextNode();
+    }
+    return parts.join('\n');
+  }
+
+  function capture() {
+    if (!document.body) return;
+    var text = document.title + '\n\n' + collectVisibleText(document.body);
+    window.top.postMessage({ source: SOURCE, url: window.location.href, text: text }, '*');
+  }
+
+  function scheduleCapture() {
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(capture, CAPTURE_DEBOUNCE_MS);
+  }
+
+  scheduleCapture();
+  new MutationObserver(scheduleCapture).observe(document.documentElement, {
+    childList: true, subtree: true, characterData: true, attributes: true,
+  });
+  window.addEventListener('scroll', scheduleCapture, { passive: true, capture: true });
+})();

package/chrome-extension/manifest.json

@@ -0,0 +1,25 @@
+{
+  "manifest_version": 3,
+  "name": "Janissary Frame Enabler",
+  "version": "1.0",
+  "description": "Removes X-Frame-Options and CSP frame-ancestors from embedded page responses so all sites render in page tabs.",
+  "permissions": ["declarativeNetRequest"],
+  "host_permissions": ["<all_urls>"],
+  "declarative_net_request": {
+    "rule_resources": [
+      {
+        "id": "framing",
+        "enabled": true,
+        "path": "rules.json"
+      }
+    ]
+  },
+  "content_scripts": [
+    {
+      "matches": ["<all_urls>"],
+      "all_frames": true,
+      "js": ["content-script.js"],
+      "run_at": "document_idle"
+    }
+  ]
+}

package/chrome-extension/rules.json

@@ -0,0 +1,16 @@
+[
+  {
+    "id": 1,
+    "priority": 1,
+    "condition": {
+      "resourceTypes": ["sub_frame"]
+    },
+    "action": {
+      "type": "modifyHeaders",
+      "responseHeaders": [
+        { "header": "x-frame-options", "operation": "remove" },
+        { "header": "content-security-policy", "operation": "remove" }
+      ]
+    }
+  }
+]

package/dist/acp/index.js

@@ -0,0 +1,93 @@
+import { spawn } from 'node:child_process';
+import { Readable, Writable } from 'node:stream';
+import { ClientSideConnection, ndJsonStream, PROTOCOL_VERSION, } from '@agentclientprotocol/sdk';
+import { sandboxSpawn } from '../sandbox/index.js';
+import { getGithubToken } from '../github-token.js';
+import { decidePermission } from './tools.js';
+/**
+ * Connect to an arbitrary ACP agent launched as a subprocess and drive it as an ACP
+ * client over stdio. This is agent-agnostic — the caller supplies the command to run
+ * (e.g. `npx @agentclientprotocol/claude-agent-acp` or `opencode acp`).
+ *
+ * Scope: streams `agent_message_chunk` text into the prompt handler and advertises no fs/terminal
+ * capabilities (so the agent never calls those back). Tool permission requests are denied unless
+ * `options.allowedTools` opts a classified web tool in (see acp-tools.ts) — undefined/empty (every
+ * non-monitor caller and every tool-less persona) denies every request, as before.
+ *
+ * `workspaceDir`/`offline` confine the subprocess to that workspace via a Seatbelt sandbox (see
+ * sandbox.ts); omitted (monitor sessions never set them), the command runs exactly as before.
+ */
+export function connectAcp(options) {
+    const baseEnv = options.env ? { ...process.env, ...options.env } : process.env;
+    const { command, args, env } = sandboxSpawn({
+        workspaceDir: options.workspaceDir,
+        offline: options.offline,
+        githubToken: options.workspaceDir ? getGithubToken() : undefined,
+    }, options.command, options.args, baseEnv);
+    const proc = spawn(command, args, {
+        cwd: options.cwd,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env,
+    });
+    proc.on('error', (error) => options.onError(`failed to start ACP agent: ${error.message}`));
+    // The current in-flight prompt's handlers; session updates are routed here.
+    let current;
+    const client = {
+        async sessionUpdate(parameters) {
+            const update = parameters.update;
+            if (update.sessionUpdate === 'agent_message_chunk' && update.content.type === 'text') {
+                current?.onChunk(update.content.text);
+            }
+        },
+        // Deny every tool request unless the persona's allowlist opts a classified web tool in.
+        async requestPermission(params) {
+            return { outcome: decidePermission(options.allowedTools, params.toolCall, params.options) };
+        },
+    };
+    const input = Readable.toWeb(proc.stdout);
+    const output = Writable.toWeb(proc.stdin);
+    const conn = new ClientSideConnection(() => client, ndJsonStream(output, input));
+    let sessionId;
+    let ready;
+    const ensureSession = () => {
+        ready ??= (async () => {
+            const init = await conn.initialize({ protocolVersion: PROTOCOL_VERSION, clientCapabilities: {} });
+            const response = await conn.newSession({ cwd: options.cwd, mcpServers: [] });
+            sessionId = response.sessionId;
+            // Provider from the agent's reported name (fallback: the command basename);
+            // model is best-effort from the session's current mode (ACP has no model field).
+            const provider = init.agentInfo?.name ?? options.command.replace(/^.*[\\/]/, '');
+            const modes = response.modes;
+            const model = modes
+                ? modes.availableModes.find((m) => m.id === modes.currentModeId)?.name ?? modes.currentModeId
+                : undefined;
+            options.onConnect?.({ provider, model });
+        })();
+        return ready;
+    };
+    return {
+        prompt: (text, handlers) => {
+            current = handlers;
+            void (async () => {
+                try {
+                    await ensureSession();
+                    const response = await conn.prompt({ sessionId: sessionId, prompt: [{ type: 'text', text }] });
+                    handlers.onEnd(response.stopReason);
+                }
+                catch (error) {
+                    handlers.onError(error instanceof Error ? error.message : String(error));
+                }
+                finally {
+                    if (current === handlers)
+                        current = undefined;
+                }
+            })();
+        },
+        kill: () => {
+            try {
+                proc.kill();
+            }
+            catch { /* already gone */ }
+        },
+    };
+}

package/dist/acp/loop.js

@@ -0,0 +1,75 @@
+// Autonomous tool loop for an ACP agent: the agent emits a single command, the
+// host runs it, feeds the output back, and repeats until the agent answers
+// without a command (or a step cap is reached). The control flow is pure — all
+// side effects (rendering the transcript, executing the command) are injected,
+// which keeps it testable independently of the live agent.
+/**
+ * Drive the loop. Each turn streams the agent reply, then looks for a command:
+ * if one is found and the step budget remains, it is executed, its output is
+ * fed back as a follow-up prompt, and the loop continues; otherwise the loop
+ * ends. The primer is prepended only to the very first prompt.
+ */
+export function runAcpToolLoop(session, userPrompt, dependencies, h) {
+    const maxSteps = dependencies.maxSteps ?? 8;
+    // Start a turn's transcript entry, then issue the prompt into it.
+    function turn(turnPrompt, isFirst, step) {
+        h.startTurn(isFirst);
+        promptOnce(turnPrompt, isFirst, step, 0);
+    }
+    // Send one prompt for the current turn. A freshly connected agent sometimes
+    // returns an empty first reply (cold start — the model/provider loads lazily on
+    // the first prompt); retry the first turn once, reusing the same entry, before
+    // treating an empty reply as a final (no-command) answer.
+    function promptOnce(turnPrompt, isFirst, step, attempt) {
+        let buffer = '';
+        const sent = isFirst && dependencies.primer ? `${dependencies.primer}\n\n${userPrompt}` : turnPrompt;
+        session.prompt(sent, {
+            onChunk: (text) => { buffer += text; h.chunk(buffer); },
+            onEnd: async () => {
+                if (!buffer.trim() && isFirst && attempt === 0) {
+                    promptOnce(turnPrompt, isFirst, step, attempt + 1);
+                    return;
+                }
+                const command = dependencies.extractCommand(buffer);
+                const display = filterCommandFromDisplay(buffer, command);
+                h.endTurn(display);
+                if (command && step < maxSteps) {
+                    // Only await when the command is actually async (e.g. browser); a sync command
+                    // (db) must complete in the same tick so callers/tests observing synchronously
+                    // see the full loop.
+                    const returnValue = dependencies.runCommand(command);
+                    const result = returnValue instanceof Promise ? await returnValue : returnValue;
+                    h.ranCommand(command, result);
+                    const followUp = `Output of \`${command}\`:\n${result}\n\n` +
+                        'If the task is complete, reply with the final answer and no command. ' +
+                        'Otherwise issue the next command. ' +
+                        'Be concise: do not explain what you are doing. Only output commands and the final answer.';
+                    turn(followUp, false, step + 1);
+                }
+                else {
+                    h.finished(command ? 'capped' : 'answered', maxSteps);
+                }
+            },
+            onError: (message) => h.error(message),
+        });
+    }
+    turn(userPrompt, true, 0);
+}
+function filterCommandFromDisplay(display, command) {
+    if (!command)
+        return display;
+    const lines = display.split('\n');
+    const cleaned = lines.map((l) => l.replace(/^[\s`$>]+/, '').replace(/`+\s*$/, '').trim());
+    const index = cleaned.indexOf(command);
+    if (index === -1)
+        return display;
+    lines.splice(index, 1);
+    // Remove adjacent code fence markers left behind by the removed command.
+    if (index < lines.length && /^`{3,}\s*$/.test(lines[index]))
+        lines.splice(index, 1);
+    if (index > 0 && /^`{3,}\s*$/.test(lines[index - 1]))
+        lines.splice(index - 1, 1);
+    while (lines.length > 0 && lines.at(-1).trim() === '')
+        lines.pop();
+    return lines.join('\n');
+}

package/dist/acp/manager.js

@@ -0,0 +1,126 @@
+import { connectAcp } from './index.js';
+import { runAcpToolLoop } from './loop.js';
+import { extractBrowserCommand, BROWSER_PRIMER } from '../browser/command.js';
+import { messageBus } from '../bus.js';
+import { notify } from '../notifications.js';
+import { isRateLimitError } from './rate-limit.js';
+import { makeUpdateRunning } from './runner.js';
+// The ACP agent the manager connects to and the model it runs. Hardcoded for now (the only provider
+// wired up); the model string drives the `provider/model` label shown in the connections panel.
+const ACP_COMMAND = 'opencode';
+const ACP_ARGS = ['acp'];
+const ACP_MODEL = 'google/gemini-3.1-flash-lite';
+const RESPONSE_BEGIN = '━━━━━━━━━━ BEGIN MODEL RESPONSE ━━━━━━━━━━';
+const RESPONSE_END = '━━━━━━━━━━ END MODEL RESPONSE ━━━━━━━━━━';
+// Prefix a still-streaming buffer with the begin marker only — the end marker appears once the
+// turn is actually finished, not on every intermediate chunk.
+function delimitStreaming(text) {
+    return text ? `${RESPONSE_BEGIN}\n${text}` : text;
+}
+// Wrap a finished turn's text with both markers, so the model's own reply reads as a clearly
+// bounded block distinct from tool-call output and other transcript content around it.
+function delimitFinal(text) {
+    return text ? `${RESPONSE_BEGIN}\n${text}\n${RESPONSE_END}` : text;
+}
+// Split a `provider/model` config string into its parts; a bare `model` with no slash has no
+// provider. Drives the connections-panel label.
+function parseModel(model) {
+    const slash = model.indexOf('/');
+    return slash === -1 ? { model } : { provider: model.slice(0, slash), model: model.slice(slash + 1) };
+}
+// Owns the per-tab ACP sessions (keyed by tab label) and their reported model info. Sessions connect
+// lazily on first use and persist across prompts; the manager spawns/reuses them, exposes the
+// connection label, and tears them down. The prompt/tool-loop orchestration stays with the caller —
+// the manager only hands back the live session.
+export class AcpManager {
+    managers;
+    sessions = new Map();
+    info = new Map();
+    constructor(managers) {
+        this.managers = managers;
+    }
+    // Whether a tab has a connected (or connecting) ACP session. Drives the connections panel and completion.
+    has(label) {
+        return this.sessions.has(label);
+    }
+    // The `provider/model` (or bare `model`) string for a tab's session, or undefined when none is
+    // connected. Display-only; populated on the connection handshake.
+    label(label) {
+        const info = this.info.get(label);
+        if (!info)
+            return undefined;
+        return info.provider ? `${info.provider}/${info.model ?? ''}` : info.model;
+    }
+    // The tab's ACP session, connecting one on first use and reusing it thereafter. The agent runs in
+    // `cwd`; `hooks.onConnect` fires after the handshake, by which point the session's model info is
+    // recorded (so `label` resolves).
+    session(label, cwd, hooks) {
+        let session = this.sessions.get(label);
+        if (!session) {
+            const info = parseModel(ACP_MODEL);
+            const tab = this.managers.tab.tabs.find((t) => t.label === label);
+            session = connectAcp({
+                command: ACP_COMMAND, args: ACP_ARGS, cwd,
+                onError: hooks.onError,
+                onConnect: () => { this.info.set(label, info); hooks.onConnect(); },
+                env: { OPENCODE_CONFIG_CONTENT: JSON.stringify({ model: ACP_MODEL }) },
+                workspaceDir: tab?.workspaceDir,
+                offline: tab?.offline,
+            });
+            this.sessions.set(label, session);
+        }
+        return session;
+    }
+    // Kill and forget a tab's session (and its info). Returns whether one was open — the
+    // `connection close acp` path re-renders and reports only when it actually closed one.
+    close(label) {
+        const session = this.sessions.get(label);
+        if (!session)
+            return false;
+        session.kill();
+        this.sessions.delete(label);
+        this.info.delete(label);
+        return true;
+    }
+    // Kill every session and forget all info (app shutdown).
+    closeAll() {
+        for (const [, session] of this.sessions)
+            session.kill();
+        this.sessions.clear();
+        this.info.clear();
+    }
+    run(label, command, onDone) {
+        const prompt = command.replace(/^acp\b\s*/i, '').trim();
+        if (!prompt) {
+            this.managers.tab.append(label, { input: command, output: 'Usage: acp <prompt>.' });
+            return;
+        }
+        const session = this.session(label, this.managers.tab.cwdOf(label) ?? process.cwd(), {
+            onError: (m) => this.managers.tab.append(label, { input: '', output: `ACP: ${m}` }),
+            onConnect: () => messageBus.emit('state', { type: 'dirty' }),
+        });
+        const updateRunning = makeUpdateRunning(label, this.managers);
+        let lastAnswer = '';
+        runAcpToolLoop(session, prompt, {
+            primer: `${this.managers.database.primer}\n\n${BROWSER_PRIMER}\n\nWrite your replies in GitHub-flavored Markdown (headings, lists, tables, fenced code blocks, etc.); the tab renders them as formatted Markdown.`,
+            runCommand: (c) => (/^browser\b/i.test(c) ? this.managers.browser.run(label, c) : this.managers.database.runInTab(label, c)),
+            extractCommand: (t) => extractBrowserCommand(t) ?? this.managers.database.extract(t) ?? null,
+        }, {
+            startTurn: (isFirst) => { this.managers.tab.addBusy(label); if (isFirst)
+                notify(this.managers, 'agent-start', label); this.managers.tab.append(label, { input: isFirst ? prompt : '', output: '', running: true, markdown: true }); },
+            chunk: (buffer) => updateRunning(delimitStreaming(buffer), true),
+            endTurn: (final) => { updateRunning(delimitFinal(final), false); lastAnswer = final; },
+            ranCommand: (c, result) => this.managers.tab.append(label, { input: c, output: result, acp: true }),
+            finished: (reason, maxSteps) => {
+                this.managers.tab.deleteBusy(label);
+                notify(this.managers, 'state-change', label);
+                if (reason === 'capped')
+                    this.managers.tab.append(label, { input: '', output: `(stopped after ${maxSteps} tool steps)` });
+                messageBus.emit('state', { type: 'dirty' });
+                onDone?.(lastAnswer);
+            },
+            error: (m) => { updateRunning(`ACP error: ${m}`, false); this.managers.tab.deleteBusy(label); notify(this.managers, 'state-change', label); if (isRateLimitError(m))
+                notify(this.managers, 'rate-limited', label); onDone?.(`ACP error: ${m}`); },
+        });
+    }
+}

package/dist/acp/rate-limit.js

@@ -0,0 +1,8 @@
+// Best-effort detection of a rate-limit failure from an ACP query's error message. The ACP
+// protocol and its agent adapters carry no structured error code, so this is a case-insensitive
+// match against a small set of markers known to appear in provider rate-limit messages.
+const RATE_LIMIT_MARKERS = ['429', 'rate limit', 'too many requests'];
+export function isRateLimitError(message) {
+    const lower = message.toLowerCase();
+    return RATE_LIMIT_MARKERS.some((marker) => lower.includes(marker));
+}

package/dist/acp/runner.js

@@ -0,0 +1,18 @@
+import { messageBus } from '../bus.js';
+export function makeUpdateRunning(label, managers) {
+    return (output, running) => {
+        const t = managers.tab.tabs.find((x) => x.label === label);
+        if (t) {
+            const log = [...t.log];
+            const index = log.findLastIndex((e) => e.running);
+            if (index !== -1)
+                log[index] = { ...log[index], output, running };
+            t.log = log;
+            if (!running)
+                managers.tab.persist(managers.tab.buildAgentState(t));
+        }
+        if (!running && output && t)
+            messageBus.emit('transcript', { type: 'entry:appended', tabLabel: label, entry: { input: '', output }, tab: t });
+        messageBus.emit('state', { type: 'dirty' });
+    };
+}

package/dist/acp/tools.js

@@ -0,0 +1,27 @@
+// Classify a tool-permission request into a canonical web-tool id, or null when it is not
+// confidently one of them (erring toward null keeps the deny boundary safe).
+export function classifyTool(toolCall) {
+    const title = (toolCall.title ?? '').toLowerCase();
+    // web_fetch: `kind: 'fetch'` is unambiguous (retrieve a URL); also accept a title match for
+    // adapters that leave `kind` unset.
+    if (toolCall.kind === 'fetch' || /web[_ ]?fetch|webfetch/.test(title))
+        return 'web_fetch';
+    // web_search: `kind: 'search'` is ambiguous — a local file/codebase search also reports it — so
+    // require a title match; never map a bare `kind: 'search'` to web search.
+    if (/web[_ ]?search/.test(title))
+        return 'web_search';
+    return null;
+}
+// Decide the outcome for a monitor tool-permission request: approve only a classified web tool the
+// persona's allowlist includes, choosing the least-privilege allow option (`allow_once`, falling
+// back to `allow_always`); deny everything else. An undefined/empty allowlist — every non-monitor
+// caller and every tool-less persona — denies unconditionally, exactly as before.
+export function decidePermission(allowedTools, toolCall, options) {
+    if (!allowedTools || allowedTools.length === 0)
+        return { outcome: 'cancelled' };
+    const tool = classifyTool(toolCall);
+    if (!tool || !allowedTools.includes(tool))
+        return { outcome: 'cancelled' };
+    const option = options.find((o) => o.kind === 'allow_once') ?? options.find((o) => o.kind === 'allow_always');
+    return option ? { outcome: 'selected', optionId: option.optionId } : { outcome: 'cancelled' };
+}