kira-glasses-bridge 2.25.0 → 2.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kira-glasses-bridge",
-  "version": "2.25.0",
+  "version": "2.27.0",
   "description": "Connects your Mac to Kira, the assistant for Even G2 glasses: Claude Code sessions, files, folders and apps, by voice.",
   "type": "module",
   "bin": {

package/src/agents/checks.mjs

@@ -0,0 +1,61 @@
+// Kira decides each tool call a job's agent wants to make: the bridge asks the API (job.check), which
+// answers from the person's rules (Settings › Permissions) with allow, ask, deny, or mode: no rule
+// decided, so Claude Code's own permission mode does. An API too old to check never says it does,
+// and its jobs are left to Claude Code's mode (asking before edits, settings.mjs); one that checks
+// but can't be reached refuses.
+import { homedir } from 'node:os'
+
+const CHECK_TIMEOUT_MS = 30_000
+const RESEND_MS = 1000
+const MODE = { effect: 'mode', why: null, rule: null, suggest: '' }
+/** What a call is checked on; the rest (a file's whole new text) stays on the Mac. */
+const FIELDS = ['command', 'file_path', 'notebook_path', 'path', 'pattern', 'url', 'query', 'subagent_type']
+
+let checking = false
+let seq = 0
+
+/** Waiting checks by id: the message, to send again after a reconnect, and who's waiting. */
+const waits = new Map()
+
+/** The API said hello: whether it decides tool calls. A check sent just before a disconnect is sent again. */
+export function kiraChecks(on, send) {
+  checking = !!on
+  if (checking) for (const w of waits.values()) send(w.msg)
+}
+
+/** Whether Kira decides each tool call (else Claude Code's mode does, asking before edits). */
+export const kiraDecides = () => checking
+
+/**
+ * Ask Kira about one call. `send` delivers a message now and says whether it could; while the
+ * connection is down (an API deploy) it's tried again until the answer is overdue.
+ */
+export function checkCall(jobId, { tool, input, cwd }, send) {
+  if (!checking) return Promise.resolve(MODE)
+  const id = `c${++seq}-${Date.now().toString(36)}`
+  const fields = Object.fromEntries(FIELDS.filter(f => typeof input?.[f] === 'string').map(f => [f, input[f]]))
+  const msg = { type: 'job.check', jobId, id, call: { tool, input: fields, cwd, home: homedir() } }
+  return new Promise(resolve => {
+    let resend = null
+    const done = decision => {
+      clearTimeout(timer)
+      clearTimeout(resend)
+      waits.delete(id)
+      resolve(decision)
+    }
+    const unreachable = { effect: 'deny', why: 'Kira could not be reached to check this, so it was not run.' }
+    const timer = setTimeout(() => done({ ...unreachable, rule: null, suggest: '' }), CHECK_TIMEOUT_MS)
+    timer.unref?.()
+    waits.set(id, { msg, done })
+    const attempt = () => {
+      if (!send(msg)) resend = setTimeout(attempt, RESEND_MS)
+    }
+    attempt()
+  })
+}
+
+/** Kira's answer to a check. */
+export function decided(msg) {
+  const done = waits.get(String(msg.id))?.done
+  if (done) done({ effect: msg.effect, why: msg.why ?? null, rule: msg.rule ?? null, suggest: msg.suggest ?? '' })
+}

package/src/agents/claude-calls.mjs

@@ -0,0 +1,150 @@
+// Claude Code's tool calls in Kira's agent protocol (protocol.mjs): each one as an action the job
+// shows, as a request when a person has to decide, and the person's answer back as what the Agent
+// SDK expects.
+import { homedir } from 'node:os'
+import { relative, resolve, sep } from 'node:path'
+import { PLAN_OPTIONS, permissionOptions, requestId } from './protocol.mjs'
+
+/** What an agent is told when it may not do something. */
+export const NOT_ANOTHER_WAY =
+  'Do not achieve the same effect another way; if the task cannot proceed without it, ' +
+  'stop and say what you could not do.'
+
+export const TEXT_CAP = 4000
+const DIFF_CAP = 6000
+
+export const short = (s, n = 160) => (String(s ?? '').length > n ? `${String(s).slice(0, n)}…` : String(s ?? ''))
+
+export function displayPath(p, cwd) {
+  if (!p) return ''
+  const rel = relative(cwd, resolve(cwd, p))
+  if (rel && !rel.startsWith('..') && !rel.startsWith(sep)) return rel
+  const home = relative(homedir(), resolve(cwd, p))
+  return home && !home.startsWith('..') ? `~/${home}` : p
+}
+
+/** Claude's tool call as a protocol action. */
+export function describeAction(name, input, cwd) {
+  const i = input ?? {}
+  const act = (type, label, target, more = {}) => ({ type, label, target, ...more })
+  const path = p => displayPath(p, cwd)
+  const cut = (old, now, n) => ({ old: short(old, n), new: short(now, n) })
+  switch (name) {
+    case 'Read':
+      return act('read', 'Read', path(i.file_path))
+    case 'Glob':
+      return act('search', 'Find', i.pattern)
+    case 'Grep':
+      return act('search', 'Search', `${i.pattern}${i.path ? ` in ${path(i.path)}` : ''}`)
+    case 'LS':
+      return act('read', 'List', path(i.path) || '.')
+    case 'Edit': {
+      const edit = { ...cut(i.old_string, i.new_string, DIFF_CAP), all: !!i.replace_all }
+      return act('edit', 'Edit', path(i.file_path), { detail: { edit } })
+    }
+    case 'MultiEdit': {
+      const edits = (i.edits ?? []).slice(0, 20).map(e => cut(e.old_string, e.new_string, 1500))
+      return act('edit', 'Edit', path(i.file_path), { detail: { edits } })
+    }
+    case 'Write':
+      return act('write', 'Write', path(i.file_path), { detail: { content: short(i.content, DIFF_CAP) } })
+    case 'NotebookEdit':
+      return act('edit', 'Edit notebook', path(i.notebook_path))
+    case 'Bash': {
+      const note = i.description ? short(i.description, 120) : undefined
+      return act('run', 'Run', short(i.command, 400), { note, detail: { command: short(i.command, 2000) } })
+    }
+    case 'WebFetch':
+      return act('fetch', 'Fetch', short(i.url, 200))
+    case 'WebSearch':
+      return act('fetch', 'Search the web', short(i.query, 160))
+    case 'Task':
+      return act('delegate', 'Subtask', short(i.description ?? i.prompt, 160))
+    case 'TodoWrite':
+      return act('plan', 'Plan', `${(i.todos ?? []).length} steps`)
+    case 'ExitPlanMode':
+      return act('plan', 'Plan ready', 'asks to go ahead')
+    case 'AskUserQuestion':
+      return act('other', 'Question', short((i.questions ?? []).map(q => q.question).join(' / '), 200))
+    default:
+      return act('other', name, short(JSON.stringify(i), 200))
+  }
+}
+
+/** Claude's tool call as a request, when a person has to decide; `verdict`: what Kira's rules said about it. */
+export function toRequest(name, input, cwd, verdict) {
+  const act = describeAction(name, input, cwd)
+  if (name === 'AskUserQuestion') {
+    const questions = (input.questions ?? []).map((q, n) => ({
+      id: `q${n + 1}`,
+      question: q.question,
+      header: q.header,
+      multi: !!q.multiSelect,
+      options: (q.options ?? []).map((o, k) => ({ id: `o${k + 1}`, label: o.label, description: o.description })),
+    }))
+    const first = questions[0]
+    return {
+      id: requestId(),
+      type: 'choice',
+      title: questions.length === 1 ? first.question : `${questions.length} questions`,
+      options: first?.options ?? [],
+      multi: !!first?.multi,
+      allowText: true,
+      questions,
+      action: { tool: name, label: act.label, target: act.target },
+    }
+  }
+  if (name === 'ExitPlanMode') {
+    return {
+      id: requestId(),
+      type: 'plan',
+      title: 'Claude has a plan and asks to go ahead',
+      detail: short(input.plan ?? '', 6000),
+      options: PLAN_OPTIONS,
+      allowText: true,
+      action: { tool: name, label: act.label, target: act.target },
+    }
+  }
+  const edit = act.detail?.edit
+  const detail = act.detail?.command ?? act.detail?.content ?? (edit ? `- ${edit.old}\n+ ${edit.new}` : undefined)
+  return {
+    id: requestId(),
+    type: 'permission',
+    title: `Claude wants to ${act.label.toLowerCase()} ${act.target}`.trim(),
+    detail: detail ? short(detail, 2000) : undefined,
+    options: permissionOptions(verdict?.suggest),
+    // "No, and tell Claude what to do differently", as Claude Code asks.
+    allowText: true,
+    action: { tool: name, label: act.label, target: act.target },
+    ...(verdict?.suggest ? { rule: verdict.suggest } : {}),
+    ...(verdict?.why ? { why: verdict.why } : {}),
+  }
+}
+
+/** Turn a protocol answer back into what the SDK expects. */
+export function applyAnswer(name, input, request, answer) {
+  const chosen = answer.optionIds ?? []
+  if (request.type === 'choice') {
+    const answers = {}
+    for (const q of request.questions ?? []) {
+      const per = answer.answers?.[q.id]
+      const ids = per?.optionIds ?? (q.id === 'q1' ? chosen : [])
+      const labels = ids.map(id => q.options.find(o => o.id === id)?.label).filter(Boolean)
+      const text = per?.text ?? (q.id === 'q1' ? answer.text : undefined)
+      answers[q.question] = labels.length ? labels.join(', ') : text ?? ''
+    }
+    const filled = Object.values(answers).some(Boolean)
+    const message = 'The user did not answer the question. Stop and say what you need to know.'
+    if (!filled) return { behavior: 'deny', message }
+    return { behavior: 'allow', updatedInput: { ...input, answers, ...(answer.text ? { response: answer.text } : {}) } }
+  }
+  if (request.type === 'plan') {
+    if (chosen.includes('approve')) return { behavior: 'allow', updatedInput: input }
+    const revise = 'The user asked you to revise the plan before going ahead.'
+    return { behavior: 'deny', message: answer.text ? `The user wants the plan changed: ${answer.text}` : revise }
+  }
+  // "Don't ask again" is kept by Kira as a rule of theirs (the request carries it), not by this session.
+  if (chosen.includes('always') || chosen.includes('allow')) return { behavior: 'allow', updatedInput: input }
+  if (answer.text) return { behavior: 'deny', message: `The user said no, and to do this instead: ${answer.text}` }
+  return { behavior: 'deny', message: `The user said no. ${NOT_ANOTHER_WAY}` }
+}

package/src/agents/claude-local.mjs

@@ -1,6 +1,8 @@
-// Claude Code on this Mac, as the person signed in to it: which account it uses, and one piece
-// of text written with that sign-in (complete.mjs). The bridge's calls for both.
+// Claude Code on this Mac, as the person signed in to it: which account it uses, the permission
+// rules in their own settings, and one piece of text written with that sign-in (complete.mjs).
 import { execFile } from 'node:child_process'
+import { readFile } from 'node:fs/promises'
+import { FOLDERS } from '../config-folders.mjs'
 import { completeText } from './complete.mjs'
 
 /** Which Claude account Claude Code on this Mac is signed in to (`claude auth status --json`). */
@@ -26,4 +28,26 @@ async function claudeAccount() {
   )
 }
 
-export const claudeTools = { claude_account: claudeAccount, complete_text: completeText }
+/** The permissions block of a Claude Code settings file, as written there (nothing when it has none). */
+export function permissionsIn(settings) {
+  const p = settings?.permissions ?? {}
+  const rules = v => (Array.isArray(v) ? v.filter(r => typeof r === 'string').slice(0, 200) : [])
+  const defaultMode = typeof p.defaultMode === 'string' ? p.defaultMode : null
+  return { allow: rules(p.allow), ask: rules(p.ask), deny: rules(p.deny), defaultMode }
+}
+
+/** The rules in ~/.claude/settings.json, which Claude Code applies to Kira's jobs as well. */
+async function claudePermissions() {
+  const text = await readFile(FOLDERS.claude.settings(), 'utf8').catch(() => '{}')
+  try {
+    return permissionsIn(JSON.parse(text))
+  } catch {
+    return permissionsIn({})
+  }
+}
+
+export const claudeTools = {
+  claude_account: claudeAccount,
+  claude_permissions: claudePermissions,
+  complete_text: completeText,
+}

package/src/agents/claude.mjs

@@ -1,191 +1,73 @@
 // Claude Code as an agent, through the Agent SDK. Runs in this process on the
 // user's Mac with their own Claude login; files never leave the machine.
 import { query } from '@anthropic-ai/claude-agent-sdk'
-import { homedir } from 'node:os'
-import { relative, resolve, sep } from 'node:path'
-import { PERMISSION_OPTIONS, PLAN_OPTIONS, requestId } from './protocol.mjs'
-import { decide, ruleFor } from './policy.mjs'
-import { policyFor, sdkOptionsFor } from './settings.mjs'
-
-const TEXT_CAP = 4000
-const DIFF_CAP = 6000
-
-const short = (s, n = 160) => (String(s ?? '').length > n ? `${String(s).slice(0, n)}…` : String(s ?? ''))
-
-function displayPath(p, cwd) {
-  if (!p) return ''
-  const rel = relative(cwd, resolve(cwd, p))
-  if (rel && !rel.startsWith('..') && !rel.startsWith(sep)) return rel
-  const home = relative(homedir(), resolve(cwd, p))
-  return home && !home.startsWith('..') ? `~/${home}` : p
-}
-const inside = (cwd, p) => {
-  const rel = relative(cwd, resolve(cwd, String(p ?? '')))
-  return !!rel && !rel.startsWith('..') && !rel.startsWith(sep)
-}
+import {
+  NOT_ANOTHER_WAY,
+  TEXT_CAP,
+  applyAnswer,
+  describeAction,
+  short,
+  toRequest,
+} from './claude-calls.mjs'
+import { kiraDecides } from './checks.mjs'
+import { sdkOptionsFor } from './settings.mjs'
+import { kiraPluginOptions } from '../kira-plugin.mjs'
 
 /** Kira's MCP server as Claude Code connects to it: Streamable HTTP, the token as the bearer. */
 const kiraServer = ({ url, token }) => ({ type: 'http', url, headers: { Authorization: `Bearer ${token}` } })
 
-/** Claude's tool call as a protocol action. */
-function describeAction(name, input, cwd) {
-  const i = input ?? {}
-  switch (name) {
-    case 'Read':
-      return { type: 'read', label: 'Read', target: displayPath(i.file_path, cwd) }
-    case 'Glob':
-      return { type: 'search', label: 'Find', target: i.pattern }
-    case 'Grep':
-      return { type: 'search', label: 'Search', target: `${i.pattern}${i.path ? ` in ${displayPath(i.path, cwd)}` : ''}` }
-    case 'LS':
-      return { type: 'read', label: 'List', target: displayPath(i.path, cwd) || '.' }
-    case 'Edit':
-      return { type: 'edit', label: 'Edit', target: displayPath(i.file_path, cwd), detail: { edit: { old: short(i.old_string, DIFF_CAP), new: short(i.new_string, DIFF_CAP), all: !!i.replace_all } } }
-    case 'MultiEdit':
-      return { type: 'edit', label: 'Edit', target: displayPath(i.file_path, cwd), detail: { edits: (i.edits ?? []).slice(0, 20).map(e => ({ old: short(e.old_string, 1500), new: short(e.new_string, 1500) })) } }
-    case 'Write':
-      return { type: 'write', label: 'Write', target: displayPath(i.file_path, cwd), detail: { content: short(i.content, DIFF_CAP) } }
-    case 'NotebookEdit':
-      return { type: 'edit', label: 'Edit notebook', target: displayPath(i.notebook_path, cwd) }
-    case 'Bash':
-      return { type: 'run', label: 'Run', target: short(i.command, 400), note: i.description ? short(i.description, 120) : undefined, detail: { command: short(i.command, 2000) } }
-    case 'WebFetch':
-      return { type: 'fetch', label: 'Fetch', target: short(i.url, 200) }
-    case 'WebSearch':
-      return { type: 'fetch', label: 'Search the web', target: short(i.query, 160) }
-    case 'Task':
-      return { type: 'delegate', label: 'Subtask', target: short(i.description ?? i.prompt, 160) }
-    case 'TodoWrite':
-      return { type: 'plan', label: 'Plan', target: `${(i.todos ?? []).length} steps` }
-    case 'ExitPlanMode':
-      return { type: 'plan', label: 'Plan ready', target: 'asks to go ahead' }
-    case 'AskUserQuestion':
-      return { type: 'other', label: 'Question', target: short((i.questions ?? []).map(q => q.question).join(' / '), 200) }
-    default:
-      return { type: 'other', label: name, target: short(JSON.stringify(i), 200) }
-  }
-}
-
-/** Claude's tool call as a request, when a person has to decide. */
-function toRequest(name, input, cwd, suggestions) {
-  const act = describeAction(name, input, cwd)
-  if (name === 'AskUserQuestion') {
-    const questions = (input.questions ?? []).map((q, n) => ({
-      id: `q${n + 1}`,
-      question: q.question,
-      header: q.header,
-      multi: !!q.multiSelect,
-      options: (q.options ?? []).map((o, k) => ({ id: `o${k + 1}`, label: o.label, description: o.description })),
-    }))
-    const first = questions[0]
-    return {
-      id: requestId(),
-      type: 'choice',
-      title: questions.length === 1 ? first.question : `${questions.length} questions`,
-      options: first?.options ?? [],
-      multi: !!first?.multi,
-      allowText: true,
-      questions,
-      action: { tool: name, label: act.label, target: act.target },
-    }
-  }
-  if (name === 'ExitPlanMode') {
-    return { id: requestId(), type: 'plan', title: 'Claude has a plan and asks to go ahead', detail: short(input.plan ?? '', 6000), options: PLAN_OPTIONS, allowText: true, action: { tool: name, label: act.label, target: act.target } }
-  }
-  const detail = act.detail?.command ?? act.detail?.content ?? (act.detail?.edit ? `- ${act.detail.edit.old}\n+ ${act.detail.edit.new}` : undefined)
-  return {
-    id: requestId(),
-    type: 'permission',
-    title: `Claude wants to ${act.label.toLowerCase()} ${act.target}`.trim(),
-    detail: detail ? short(detail, 2000) : undefined,
-    options: PERMISSION_OPTIONS,
-    allowText: false,
-    action: { tool: name, label: act.label, target: act.target },
-  }
-}
-
-/** Turn a protocol answer back into what the SDK expects. */
-function applyAnswer(name, input, request, answer, suggestions) {
-  const chosen = answer.optionIds ?? []
-  if (request.type === 'choice') {
-    const answers = {}
-    for (const q of request.questions ?? []) {
-      const per = answer.answers?.[q.id]
-      const ids = per?.optionIds ?? (q.id === 'q1' ? chosen : [])
-      const labels = ids.map(id => q.options.find(o => o.id === id)?.label).filter(Boolean)
-      const text = per?.text ?? (q.id === 'q1' ? answer.text : undefined)
-      answers[q.question] = labels.length ? labels.join(', ') : text ?? ''
-    }
-    const filled = Object.values(answers).some(Boolean)
-    if (!filled) return { behavior: 'deny', message: 'The user did not answer the question. Stop and say what you need to know.' }
-    return { behavior: 'allow', updatedInput: { ...input, answers, ...(answer.text ? { response: answer.text } : {}) } }
-  }
-  if (request.type === 'plan') {
-    if (chosen.includes('approve')) return { behavior: 'allow', updatedInput: input }
-    return { behavior: 'deny', message: answer.text ? `The user wants the plan changed: ${answer.text}` : 'The user asked you to revise the plan before going ahead.' }
-  }
-  if (chosen.includes('always') || chosen.includes('allow')) return { behavior: 'allow', updatedInput: input, ...(chosen.includes('always') && suggestions?.length ? { updatedPermissions: suggestions } : {}) }
-  return { behavior: 'deny', message: `The user declined this${answer.text ? ` ("${answer.text}")` : ''}. Do not achieve the same effect another way; if the task cannot proceed without it, stop and say what you could not do.` }
-}
-
 /** Claude Code's own prompt, with what Kira adds for this run after it. */
 function systemPromptFor(persona) {
   return { type: 'preset', preset: 'claude_code', ...(persona.systemPrompt ? { append: persona.systemPrompt } : {}) }
 }
 
+/** The pre-tool hook's answer: go ahead, ask, or refuse, and why. */
+const hookAnswer = (permissionDecision, permissionDecisionReason) => ({
+  hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision, permissionDecisionReason },
+})
+
+/** Questions for the person, not permissions: they always reach them, whatever the rules say. */
+const QUESTIONS = new Set(['AskUserQuestion', 'ExitPlanMode'])
+
 /**
  * Run one instruction in a Claude session.
  * @param io.emit(event)       a protocol event
  * @param io.ask(request)      resolves to { answer, by } when a person answers (the caller times it out)
+ * @param io.check(call)       what Kira's rules say about a tool call (checks.mjs)
  * @returns { ok, text, error, sessionId, stats }
  */
-/** "Always allow" answers, kept for the rest of the process per session: sessionId -> Set of rules. */
-const sessionRules = new Map()
-
-async function run({ prompt, sessionId, cwd, policy, persona, settings, abort }, io) {
+async function run({ prompt, sessionId, cwd, persona, settings, abort }, io) {
   let session = sessionId ?? null
   let text = ''
   let error = null
-  const rulesFor = () => (session && sessionRules.get(session)) || new Set()
-  // The composer's mode: "Ask" makes the policy ask for edits and commands (settings.mjs).
-  const ruled = policyFor(policy, settings)
-  const judge = (toolName, input) => decide(ruled, toolName, input ?? {}, cwd, rulesFor())
+  /** What Kira's rules said about each tool call, by its id, for the question if Claude Code asks. */
+  const verdicts = new Map()
 
-  // Pre-tool hook: the policy is authoritative. It forces the prompt for what
-  // it does not allow (so a permissive local config cannot bypass the person)
-  // and refuses outright what it denies.
-  // A member with a restricted shell (a designer, a researcher) runs only what its preset allows.
-  const shellAllow = persona?.shellAllow ? new RegExp(persona.shellAllow) : null
-  // A member that only produces artifacts (a designer, a researcher) writes nowhere but its output folders.
-  const within = (persona?.writeWithin ?? []).map(d => resolve(cwd, d))
-  const writeTools = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit'])
-  const preToolUse = async input => {
+  /** Refused before it runs: the job shows why, and Claude is told (`told`, when it needs more). */
+  const refuse = (tool, reason, told = reason) => {
+    const answer = { optionIds: ['deny'] }
+    io.emit({ kind: 'request_resolved', id: `policy-${Date.now().toString(36)}`, answer, by: 'policy', tool, reason })
+    return hookAnswer('deny', told)
+  }
+  // Pre-tool hook: Kira's rules (io.check asks the API), a member's role among them. Allow and deny
+  // are final; ask forces the question even where the person's own Claude Code settings would allow
+  // it; a call no rule decides is left to Claude Code's permission mode, which asks through canUseTool.
+  const preToolUse = async (input, toolUseID) => {
     if (input.hook_event_name !== 'PreToolUse') return {}
-    if (within.length && writeTools.has(input.tool_name)) {
-      const target = resolve(cwd, String(input.tool_input?.file_path ?? input.tool_input?.notebook_path ?? ''))
-      if (!within.some(dir => target === dir || target.startsWith(dir + sep))) {
-        const reason = `${persona.name} only writes under ${persona.writeWithin.join(', ')}; ${displayPath(target, cwd)} is off limits. Describe what an engineer should change in your spec instead.`
-        io.emit({ kind: 'request_resolved', id: `persona-${Date.now().toString(36)}`, answer: { optionIds: ['deny'] }, by: 'policy', tool: input.tool_name, reason })
-        return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } }
-      }
-    }
-    // Every command in a chain ("ls; rm -rf x", "a && b", "a | b") has to be allowed, not only the first.
-    const segments = c => String(c ?? '').split(/&&|\|\||;|\|/).map(x => x.trim()).filter(Boolean)
-    if (shellAllow && input.tool_name === 'Bash' && !segments(input.tool_input?.command).every(seg => shellAllow.test(seg))) {
-      const reason = `${persona.name} uses the shell only for git and for reading files; run that another way or leave it.`
-      io.emit({ kind: 'request_resolved', id: `persona-${Date.now().toString(36)}`, answer: { optionIds: ['deny'] }, by: 'policy', tool: 'Bash', reason })
-      return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason } }
-    }
-    const { decision, reason } = judge(input.tool_name, input.tool_input)
-    if (decision === 'deny') io.emit({ kind: 'request_resolved', id: `policy-${Date.now().toString(36)}`, answer: { optionIds: ['deny'] }, by: 'policy', tool: input.tool_name, reason })
-    return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: decision, permissionDecisionReason: `Kira: ${reason}` } }
+    if (QUESTIONS.has(input.tool_name)) return {}
+    const verdict = await io.check({ tool: input.tool_name, input: input.tool_input ?? {}, cwd })
+    // Kept only for a question that may follow: an ask, or Claude Code's own mode asking.
+    if (toolUseID && (verdict.effect === 'ask' || verdict.effect === 'mode')) verdicts.set(toolUseID, verdict)
+    if (verdict.effect === 'mode') return {}
+    const reason = `Kira: ${verdict.why ?? 'your rules'}${verdict.rule ? ` (${verdict.rule})` : ''}`
+    if (verdict.effect === 'deny') return refuse(input.tool_name, reason, `${reason}. ${NOT_ANOTHER_WAY}`)
+    return hookAnswer(verdict.effect, reason)
   }
 
-  const canUseTool = async (toolName, input, { signal, suggestions }) => {
-    const { decision, reason } = judge(toolName, input)
-    if (decision === 'allow') return { behavior: 'allow', updatedInput: input }
-    if (decision === 'deny') return { behavior: 'deny', message: `Refused by the user's policy (${reason}). Do not achieve the same effect another way; say what you could not do.` }
-    const request = toRequest(toolName, input, cwd, suggestions)
+  const canUseTool = async (toolName, input, { signal, toolUseID }) => {
+    const verdict = verdicts.get(toolUseID)
+    verdicts.delete(toolUseID)
+    const request = toRequest(toolName, input, cwd, verdict)
     io.emit({ kind: 'request', request })
     let resolved
     try {
@@ -193,13 +75,8 @@ async function run({ prompt, sessionId, cwd, policy, persona, settings, abort },
     } catch (err) {
       resolved = { answer: { optionIds: [], text: err.message }, by: 'timeout' }
     }
-    const rule = ruleFor(toolName, input)
-    io.emit({ kind: 'request_resolved', id: request.id, answer: resolved.answer, by: resolved.by, rule })
-    if ((resolved.answer.optionIds ?? []).includes('always') && session) {
-      if (!sessionRules.has(session)) sessionRules.set(session, new Set())
-      sessionRules.get(session).add(rule)
-    }
-    return applyAnswer(toolName, input, request, resolved.answer, suggestions)
+    io.emit({ kind: 'request_resolved', id: request.id, answer: resolved.answer, by: resolved.by })
+    return applyAnswer(toolName, input, request, resolved.answer)
   }
 
   // Background work (subagents, `run_in_background` shell commands, monitors)
@@ -224,7 +101,7 @@ async function run({ prompt, sessionId, cwd, policy, persona, settings, abort },
         env,
         ...(sessionId ? { resume: sessionId } : {}),
         // The model, effort and permission mode the person chose in the composer (plan mode: plan first).
-        ...sdkOptionsFor(settings),
+        ...sdkOptionsFor(settings, kiraDecides()),
         ...(abort ? { abortController: abort } : {}),
         // A Kira agent runs as its Claude Code subagent (~/.claude/agents/<name>.md, agent-files.mjs): the
         // file's body takes the place of Claude Code's default instructions, and what Kira adds for the
@@ -237,6 +114,8 @@ async function run({ prompt, sessionId, cwd, policy, persona, settings, abort },
         // Claude as the person's Kira: her tools come from her own MCP server, with a token the API
         // made for this conversation. Claude Code loads them as it needs them (no tool ceiling).
         ...(persona?.kiraTools ? { mcpServers: { kira: kiraServer(persona.kiraTools) } } : {}),
+        // Her built-in skills, as Claude Code's own: a plugin the bridge writes (kira-plugin.mjs).
+        ...(await kiraPluginOptions(persona)),
         canUseTool,
         hooks: { PreToolUse: [{ hooks: [preToolUse] }] },
         ...(process.env.KIRA_CLAUDE_BIN ? { pathToClaudeCodeExecutable: process.env.KIRA_CLAUDE_BIN } : {}),

package/src/agents/codex-items.mjs

@@ -0,0 +1,96 @@
+// Codex's thread items and settings in Kira's agent protocol (protocol.mjs). Pure.
+import { displayPath, short } from './claude-calls.mjs'
+
+/**
+ * The composer's permission modes in Codex's own terms: accept edits = it writes in the project
+ * (workspace-write) and asks before commands it doesn't trust; ask before edits = read-only, so every
+ * change and command asks; plan = read-only and it never asks, so it can only look and propose.
+ */
+const MODES = {
+  acceptEdits: { sandbox: 'workspace-write', approvalPolicy: 'untrusted' },
+  default: { sandbox: 'read-only', approvalPolicy: 'untrusted' },
+  plan: { sandbox: 'read-only', approvalPolicy: 'never' },
+}
+/** The composer's older names for the same modes. */
+const OLD_MODES = { auto: 'acceptEdits', ask: 'default' }
+const EFFORTS = new Set(['low', 'medium', 'high'])
+/** A model as Codex's own list names it (codex-local.mjs); never a Claude one. */
+const MODEL = /^(?!claude)[a-z0-9][a-z0-9.-]{0,63}$/
+
+/** thread/start's options for these settings; what's unset is left to the person's ~/.codex/config.toml. */
+export function codexOptionsFor(settings, kiraDecides = true) {
+  const s = settings ?? {}
+  const named = OLD_MODES[s.mode] ?? s.mode
+  const mode = Object.hasOwn(MODES, named) ? named : 'acceptEdits'
+  // Without Kira deciding each call, nothing is written without asking (as with Claude Code).
+  const chosen = kiraDecides || mode === 'plan' ? MODES[mode] : MODES.default
+  return {
+    ...chosen,
+    ...(typeof s.model === 'string' && MODEL.test(s.model) ? { model: s.model } : {}),
+    ...(EFFORTS.has(s.effort) ? { effort: s.effort } : {}),
+  }
+}
+
+/** Codex runs each command as `/bin/zsh -lc '<script>'`. */
+const WRAPPED = /^(?:\/(?:usr\/)?bin\/)?(?:ba|z)?sh -l?c (?:'((?:[^']|'\\'')*)'|"((?:[^"\\$`]|\\["\\$`])*)")$/s
+
+/** The script Codex runs, as the person would have typed it; anything unusual is left as it is (and asks). */
+export function scriptOf(command) {
+  const m = WRAPPED.exec(String(command ?? '').trim())
+  if (!m) return String(command ?? '')
+  return m[1] !== undefined ? m[1].replaceAll("'\\''", "'") : m[2].replace(/\\(["\\$`])/g, '$1')
+}
+
+/** Codex's call as Kira's rules read it: a command is Bash, each changed file an Edit. */
+export function callsOf(method, params, changes) {
+  if (method === 'item/commandExecution/requestApproval') {
+    return [{ tool: 'Bash', input: { command: scriptOf(params.command) }, cwd: params.cwd }]
+  }
+  return (changes ?? []).map(c => ({ tool: 'Edit', input: { file_path: c.path } }))
+}
+
+/** The strictest of several verdicts: any refusal refuses, any ask asks, and allow only when all allow. */
+export function strictest(verdicts) {
+  const order = ['deny', 'ask', 'mode', 'allow']
+  return [...verdicts].sort((a, b) => order.indexOf(a.effect) - order.indexOf(b.effect))[0] ?? null
+}
+
+const act = (type, label, target, more = {}) => ({ type, label, target, ...more })
+
+/** One of Codex's items as a protocol action (null for what isn't one: messages, reasoning). */
+export function itemAction(item, cwd) {
+  switch (item.type) {
+    case 'commandExecution': {
+      const command = scriptOf(item.command)
+      return act('run', 'Run', short(command, 400), { tool: 'Bash', detail: { command: short(command, 2000) } })
+    }
+    case 'fileChange': {
+      const paths = (item.changes ?? []).map(c => displayPath(c.path, cwd))
+      const more = paths.length > 1 ? ` and ${paths.length - 1} more` : ''
+      const diff = (item.changes ?? []).map(c => c.diff).join('\n')
+      return act('edit', 'Edit', `${paths[0] ?? ''}${more}`, { tool: 'Edit', detail: { content: short(diff, 6000) } })
+    }
+    case 'mcpToolCall':
+      return act('other', item.tool, short(JSON.stringify(item.arguments ?? {}), 200), {
+        tool: `mcp__${item.server}__${item.tool}`,
+      })
+    case 'webSearch':
+      return act('fetch', 'Search the web', short(item.query ?? '', 160), { tool: 'WebSearch' })
+    case 'plan':
+      return act('plan', 'Plan', short(item.text, 160), { tool: 'Plan' })
+    case 'collabAgentToolCall':
+      return act('delegate', 'Subtask', short(item.prompt ?? '', 160), { tool: 'Subtask' })
+    default:
+      return null
+  }
+}
+
+/** A finished item's outcome: whether it went through, and what it said. */
+export function itemResult(item) {
+  if (item.type === 'commandExecution') {
+    const ok = item.status === 'completed' && (item.exitCode ?? 0) === 0
+    return { ok, preview: short(String(item.aggregatedOutput ?? '').trim(), 240) }
+  }
+  if (item.type === 'mcpToolCall') return { ok: !item.error && item.status === 'completed', preview: '' }
+  return { ok: item.status ? item.status === 'completed' : true, preview: '' }
+}