loopengine 0.1.85 → 0.1.87

package/README.md

@@ -185,10 +185,14 @@ only their own message to tell whether it's a decision, and anything
 unclear is treated as a question. An approver can also change a request
 first ("make it $40"): the change is checked against the tool's schema
 and the permission rules and shown with **Approve as changed / Keep
-original / Deny**, and nothing runs until they approve it. For
-**Confirm-required tools**, a typed yes only brings up a Confirm button
-showing exactly what will run. Once approvers are listed, only their
-button clicks count too. The same tab lists every decision
+original / Deny**, and nothing runs until they approve it. A plain "yes"
+("approve", "go ahead", "好的", "はい", "sí", 👍…: the whole message,
+matched against a fixed list of phrases in common languages, not by a
+model) runs it; any other reply read as approval ("sure, send
+it", "yes but check the amount") shows exactly what will run with a
+**Confirm** button, and only that click runs it. Arguments are shown
+as labelled fields, with long text such as an email body quoted, not as
+JSON. Once approvers are listed, only their button clicks count too. The same tab lists every decision
 still waiting with Approve/Deny buttons (its count shows on the tab), and
 warns you when an agent has `ask` rules but nobody would be told.
 

package/dist/core/http-notify-triggers/slack.js

@@ -25,6 +25,7 @@
 // call shape).
 import { randomUUID } from 'node:crypto';
 import { decidePath } from '../approval-links.js';
+import { slackArgs, slackEscape, toSlackMrkdwn } from '../messaging/connectors/slack/format.js';
 import { publicBaseUrl } from './webhook.js';
 export class SlackNotifier {
     botToken;
@@ -72,9 +73,12 @@ export class SlackNotifier {
                 type: 'section',
                 text: {
                     type: 'mrkdwn',
-                    text: `*Approval requested*\n*tool:* ${tool}\n*args:* \`${JSON.stringify(args)}\`\n*scope:* ${scope.tenant}/${scope.environment}/${scope.agent}\n*reason:* ${reason}${this.decideLine(pendingId, 'approval')}`,
+                    // Arguments as labelled lines, long text quoted (not JSON);
+                    // a Slack section holds 3,000 characters, so they're kept under.
+                    text: fitSection(`*Approval requested:* \`${tool}\``, slackArgs(args), `*Why:* ${toSlackMrkdwn(slackEscape(reason))}${this.decideLine(pendingId, 'approval')}`),
                 },
             },
+            { type: 'context', elements: [{ type: 'mrkdwn', text: `${scope.agent} · ${scope.tenant}/${scope.environment}` }] },
             ...(this.buttons
                 ? [{
                         type: 'actions',
@@ -99,7 +103,7 @@ export class SlackNotifier {
             action_id: `answer_option_${i}`,
         }));
         this.postMessage(`Question from ${agent}: ${question}`, [
-            { type: 'section', text: { type: 'mrkdwn', text: `*Question from ${agent}${sessionId ? ` (session ${sessionId})` : ''}:*\n${question}${this.decideLine(pendingId, 'question')}` } },
+            { type: 'section', text: { type: 'mrkdwn', text: fitSection(`*Question from ${agent}${sessionId ? ` (session ${sessionId})` : ''}:*`, toSlackMrkdwn(slackEscape(question)), this.decideLine(pendingId, 'question').trim()) } },
             ...(this.buttons
                 ? [{ type: 'actions', elements: [...optionButtons, { type: 'button', text: { type: 'plain_text', text: 'Other…' }, action_id: 'open_answer_modal', value: pendingId }] }]
                 : []),
@@ -134,6 +138,13 @@ export class SlackNotifier {
         });
     }
 }
+const SECTION_MAX = 3000;
+/** A head line, a body cut to fit, and a tail line, in one Slack section. */
+function fitSection(head, body, tail) {
+    const room = SECTION_MAX - head.length - tail.length - 60;
+    const fitted = body.length > room ? body.slice(0, Math.max(0, room)).trimEnd() + '\n… (cut short here; the decision link has it all)' : body;
+    return [head, fitted, tail].filter(Boolean).join('\n');
+}
 /** One plain chat.postMessage, awaited, reporting whether Slack accepted
  * it — backs the console's "Send test" for a Slack notifier, where
  * SlackNotifier.postMessage's fire-and-forget contract would hide the

package/dist/core/messaging/connector.d.ts

@@ -42,6 +42,9 @@ export interface MessagingConnector {
     name: string;
     /** How to refer to a person in a message (Slack: <@U123>). */
     mention(user: string): string;
+    /** Makes text from anyone else (a tool's arguments, an agent's reason)
+     * safe to put in a message, so it can't become a mention or a link. */
+    escape(text: string): string;
     /** The thread's messages, oldest first, its first message included. */
     fetchThread(conversation: string, threadTs: string): Promise<ThreadMessage[]>;
     postInThread(conversation: string, threadTs: string, text: string): Promise<void>;

package/dist/core/messaging/connectors/slack/events.js

@@ -1,4 +1,4 @@
-import { toSlackMrkdwn } from './format.js';
+import { slackEscape, toSlackMrkdwn } from './format.js';
 /** Reads an Events API body. Only people's new messages come through;
  * edits, deletions, joins and every bot's messages (this agent's own
  * included) are `ignore`. */
@@ -40,6 +40,7 @@ export function createSlackConnector(botToken) {
         app: 'slack',
         name: 'Slack',
         mention: (user) => `<@${user}>`,
+        escape: slackEscape,
         // Needs channels:history or groups:history, depending on the channel.
         async fetchThread(conversation, threadTs) {
             const params = new URLSearchParams({ channel: conversation, ts: threadTs, limit: '100' });

package/dist/core/messaging/connectors/slack/format.d.ts

@@ -1 +1,7 @@
 export declare function toSlackMrkdwn(markdown: string): string;
+/** Slack's own escaping, for text that isn't ours (an argument, a
+ * reason): with &, < and > escaped, a value can't become a mention, a
+ * channel-wide ping (<!channel>) or a disguised link. */
+export declare function slackEscape(text: string): string;
+/** A call's arguments as Slack mrkdwn (core/messaging/format-args.ts). */
+export declare function slackArgs(args: Record<string, unknown>, schema?: Record<string, unknown>): string;

package/dist/core/messaging/connectors/slack/format.js

@@ -1,13 +1,22 @@
 // Models write Markdown even when asked for Slack's own format, and Slack
 // shows Markdown's **bold**, [links](url) and # headings as literal
 // characters. This turns the common cases into Slack mrkdwn before a
-// reply is posted; code (```blocks``` and `spans`) is left as written.
-const CODE = /(```[\s\S]*?```|`[^`\n]*`)/;
+// reply is posted; code (```blocks``` and `spans`) is left as written,
+// and so is text slackEscape marked as someone else's.
+import { formatArgs } from '../../format-args.js';
+// slackEscape wraps text that isn't ours in these, so the conversion
+// below never turns it into formatting or a link; they're removed after.
+const OPEN = '\u0001';
+const CLOSE = '\u0002';
+const KEEP = /(```[\s\S]*?```|`[^`\n]*`|\u0001[\s\S]*?\u0002)/;
 export function toSlackMrkdwn(markdown) {
     return markdown
-        .split(CODE)
+        // ~~old value~~ around protected text: the markers sit outside it.
+        .replace(/~~(\u0001[^\u0002]*\u0002)~~/g, '~$1~')
+        .split(KEEP)
         .map((part, i) => (i % 2 === 1 ? part : convertProse(part)))
-        .join('');
+        .join('')
+        .replace(/[\u0001\u0002]/g, '');
 }
 function convertProse(text) {
     const bold = [];
@@ -32,3 +41,13 @@ function convertProse(text) {
     out = out.replace(/\u0000(\d+)\u0000/g, (_m, n) => `*${bold[Number(n)]}*`);
     return out;
 }
+/** Slack's own escaping, for text that isn't ours (an argument, a
+ * reason): with &, < and > escaped, a value can't become a mention, a
+ * channel-wide ping (<!channel>) or a disguised link. */
+export function slackEscape(text) {
+    return OPEN + text.replace(/[\u0001\u0002]/g, '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;') + CLOSE;
+}
+/** A call's arguments as Slack mrkdwn (core/messaging/format-args.ts). */
+export function slackArgs(args, schema) {
+    return toSlackMrkdwn(formatArgs(args, slackEscape, schema));
+}

package/dist/core/messaging/connectors/slack/index.d.ts

@@ -1,4 +1,4 @@
 export { createSlackConnector, parseSlackEvent, type SlackEvent } from './events.js';
-export { toSlackMrkdwn } from './format.js';
+export { slackArgs, slackEscape, toSlackMrkdwn } from './format.js';
 export { SLACK_ANSWER_ACTION_ID, SLACK_ANSWER_BLOCK_ID, openSlackAnswerModal, parseSlackInteraction, replyInSlack, replyPrivatelyInSlack, slackOutcomeText, verifySlackRequest, type SlackInteraction, } from './interactions.js';
 export { listSlackChannelMembers, listSlackChannels, slackAppManifest, type SlackChannel, type SlackMember } from './setup.js';

package/dist/core/messaging/connectors/slack/index.js

@@ -4,6 +4,6 @@
 // Posting requests is still SlackNotifier's job
 // (core/http-notify-triggers/slack.ts).
 export { createSlackConnector, parseSlackEvent } from './events.js';
-export { toSlackMrkdwn } from './format.js';
+export { slackArgs, slackEscape, toSlackMrkdwn } from './format.js';
 export { SLACK_ANSWER_ACTION_ID, SLACK_ANSWER_BLOCK_ID, openSlackAnswerModal, parseSlackInteraction, replyInSlack, replyPrivatelyInSlack, slackOutcomeText, verifySlackRequest, } from './interactions.js';
 export { listSlackChannelMembers, listSlackChannels, slackAppManifest } from './setup.js';

package/dist/core/messaging/engine.d.ts

@@ -25,8 +25,6 @@ export interface MessagingDeps {
     /** Records a decision on a pending request, as the console's own
      * Approve/Deny/Answer would. */
     decide(pendingId: string, decision: MessagingDecision): Promise<DecisionOutcome>;
-    /** Tools whose approval needs a Confirm click (Messaging tab). */
-    confirmTools(): string[];
     /** The tool's argument schema, for proposing a change. */
     toolSchema(tool: string): Promise<Record<string, unknown> | undefined>;
     /** Why changed arguments can't be used (they don't fit the tool's
@@ -57,6 +55,11 @@ export interface DecisionOutcome {
 /** Handles one person's message: a reply in a request's thread gets an
  * answer; anything else is left alone. */
 export declare function handleInboundMessage(message: InboundMessage, deps: MessagingDeps): Promise<void>;
+/** Whether a reply is a plain approval: lower-cased, a leading @mention,
+ * emoji skin tones and "please" dropped, punctuation and spaces
+ * (full-width ones too) ignored, then compared with the fixed list. A
+ * trailing question mark keeps it from matching ("yes?"). */
+export declare function isPlainApproval(text: string): boolean;
 /** A click on one of the engine's own buttons (Approve as changed, Keep
  * original, Confirm, Cancel) — the caller has already checked the
  * person may decide. Returns what the clicked message should now say. */

package/dist/core/messaging/engine.js

@@ -1,5 +1,6 @@
 import { KeyedMutex } from '../session-store.js';
-import { decideReply, describeChange, proposeEdit } from './decide.js';
+import { decideReply, proposeEdit } from './decide.js';
+import { formatArgs, formatChange } from './format-args.js';
 import { findThread, findThreadByPending, recordThread } from './threads.js';
 // An app may redeliver a message it thinks went unanswered (and Slack
 // sends a reply that @mentions the bot as both `message` and
@@ -84,7 +85,7 @@ export async function handleInboundMessage(message, deps) {
                     return;
                 }
                 recordThread(deps.agentDir, { ...link, proposedArgs: proposed });
-                await connector.postChoice(message.conversation, threadTs, `Here's the change ${who} asked for:\n${describeChange(item.args, proposed).map((l) => `• ${l}`).join('\n')}\nNothing else changes.`, [
+                await connector.postChoice(message.conversation, threadTs, `Here's the change ${who} asked for:\n${formatChange(item.args, proposed, connector.escape, await deps.toolSchema(item.tool))}\nNothing else changes.`, [
                     { action: 'approve_edited', label: 'Approve as changed', style: 'primary', pendingId: link.pendingId },
                     { action: 'keep_original', label: 'Keep original', pendingId: link.pendingId },
                     { action: 'deny', label: 'Deny', style: 'danger', pendingId: link.pendingId },
@@ -93,21 +94,24 @@ export async function handleInboundMessage(message, deps) {
             }
             if (verdict.decision === 'approve') {
                 const args = link.proposedArgs ?? item.args;
-                if (deps.confirmTools().includes(item.tool)) {
-                    await connector.postChoice(message.conversation, threadTs, `\`${item.tool}\` needs a Confirm click. It will run with \`${JSON.stringify(args)}\`.`, [
-                        { action: 'confirm', label: 'Confirm', style: 'primary', pendingId: link.pendingId },
-                        { action: 'cancel_confirm', label: 'Cancel', pendingId: link.pendingId },
-                    ]);
+                // A plain "yes" runs it; anything less clear that still reads as
+                // approval asks for a Confirm click first.
+                if (isPlainApproval(message.text)) {
+                    await runApproved(deps, link, item.tool, args, who);
                     return;
                 }
-                await runApproved(deps, link, item.tool, args, who);
+                await connector.postChoice(message.conversation, threadTs, `Confirm to run \`${item.tool}\` with:\n${formatArgs(args, connector.escape, await deps.toolSchema(item.tool))}`, [
+                    { action: 'confirm', label: 'Confirm', style: 'primary', pendingId: link.pendingId },
+                    { action: 'cancel_confirm', label: 'Cancel', pendingId: link.pendingId },
+                ]);
                 return;
             }
             const outcome = await deps.decide(link.pendingId, verdict.decision === 'answer' ? { kind: 'answer', answer: verdict.answer } : { kind: 'deny' });
-            await say(outcomeText(verdict.decision, who, outcome, verdict.decision === 'answer' ? verdict.answer : undefined));
+            const answer = verdict.decision === 'answer' ? connector.escape(verdict.answer) : undefined;
+            await say(outcomeText(verdict.decision, who, outcome, answer));
             if (!outcome.error && !outcome.alreadyResolved) {
                 const what = link.kind === 'approval' ? `\`${item.tool}\`` : 'The question';
-                await replaceRequest(connector, link, `${what} was ${verdict.decision === 'deny' ? 'denied' : `answered ("${verdict.answer}")`} by ${who} in the thread.`);
+                await replaceRequest(connector, link, `${what} was ${verdict.decision === 'deny' ? 'denied' : `answered ("${answer}")`} by ${who} in the thread.`);
             }
             return;
         }
@@ -135,13 +139,65 @@ export async function handleInboundMessage(message, deps) {
             await say(reply);
     });
 }
+// Whole messages that approve and nothing else, in the languages people
+// most often reply in. Matched exactly after the clean-up in
+// isPlainApproval, so a condition or a second thought ("yes but…",
+// "好的，但是…") never counts as plain; a phrase that isn't here just gets
+// a Confirm click. Words that can also mean "hmm", "understood" or "no
+// thanks" (嗯, 了解, いいです) are left out on purpose.
+const PLAIN_APPROVAL_PHRASES = [
+    // English
+    'yes', 'y', 'yep', 'yeah', 'yup', 'sure', 'yes go ahead', 'go ahead', 'approve', 'approved', 'i approve', 'do it', 'yes do it',
+    'ok', 'okay', 'ok go ahead', 'lgtm', 'confirm', 'confirmed', 'send it', 'run it',
+    // Chinese (simplified and traditional)
+    '是', '是的', '好', '好的', '可以', '行', '同意', '批准', '确认', '確認', '没问题', '沒問題', '发吧', '發吧', '执行', '執行', '执行吧', '執行吧',
+    '请执行', '請執行', '好的发吧', '好的發吧', '可以执行', '可以執行', '同意执行', '同意執行',
+    // Japanese
+    'はい', '承認', '承認します', 'お願いします', 'はいお願いします', 'okです', '進めて', '進めてください', '実行してください',
+    // Korean
+    '네', '예', '승인', '승인합니다', '좋아요', '진행해주세요', '네진행해주세요',
+    // Spanish, Portuguese, Italian
+    'sí', 'si', 'aprobado', 'apruebo', 'adelante', 'sí adelante', 'dale', 'de acuerdo',
+    'sim', 'aprovado', 'aprovo', 'pode', 'pode mandar', 'manda', 'pode seguir',
+    'sì', 'approvato', 'approvo', 'vai', 'procedi', 'va bene',
+    // French, German
+    'oui', 'approuvé', "j'approuve", 'vas-y', 'allez-y', "d'accord", 'ok vas-y',
+    'ja', 'genehmigt', 'freigegeben', 'mach es', 'mach das', 'einverstanden', 'passt',
+    // Russian
+    'да', 'одобряю', 'одобрено', 'подтверждаю', 'давай',
+    // Emoji, typed or as Slack shortcodes
+    '👍', '✅', '👌', ':+1:', ':thumbsup:', ':white_check_mark:', ':heavy_check_mark:', ':ok_hand:',
+];
+// "Please" at either end of a reply doesn't change it.
+const PLEASE = /^(please|pls|por favor|bitte|svp|s'il vous plaît|per favore)\s+|\s+(please|pls|por favor|bitte|svp|s'il vous plaît|per favore)$/g;
+function approvalKey(text) {
+    return text
+        .toLowerCase()
+        .replace(/^\s*<@[a-z0-9]+>\s*/, '')
+        .replace(/:skin-tone-\d:/g, '')
+        .replace(/[\u{1F3FB}-\u{1F3FF}\u{FE0F}]/gu, '')
+        .replace(/[\u2018\u2019]/g, "'")
+        .replace(/[,，、;；]+/g, ' ')
+        .replace(/[.!?。！～~]+$/, (m) => (m.includes('?') ? '?' : ''))
+        .trim()
+        .replace(PLEASE, '')
+        .replace(/\s+/g, '');
+}
+const PLAIN_APPROVALS = new Set(PLAIN_APPROVAL_PHRASES.map(approvalKey));
+/** Whether a reply is a plain approval: lower-cased, a leading @mention,
+ * emoji skin tones and "please" dropped, punctuation and spaces
+ * (full-width ones too) ignored, then compared with the fixed list. A
+ * trailing question mark keeps it from matching ("yes?"). */
+export function isPlainApproval(text) {
+    return PLAIN_APPROVALS.has(approvalKey(text));
+}
 /** Says what will run, runs it, reports the outcome and updates the
  * request message. `args` differing from the request's own means it was
  * approved as changed. */
 async function runApproved(deps, link, tool, args, who) {
     const { connector } = deps;
     const edited = Boolean(link.proposedArgs);
-    await connector.postInThread(link.conversation, link.ts, `Approved${edited ? ' as changed' : ''} by ${who}. Running \`${tool}\` with \`${JSON.stringify(args)}\`.`);
+    await connector.postInThread(link.conversation, link.ts, `Approved${edited ? ' as changed' : ''} by ${who}. Running \`${tool}\` with:\n${formatArgs(args, connector.escape, await deps.toolSchema(tool))}`);
     const outcome = await deps.decide(link.pendingId, { kind: 'approve', ...(edited ? { editedArgs: args } : {}) });
     await connector.postInThread(link.conversation, link.ts, outcomeText('approve', who, outcome));
     if (!outcome.error && !outcome.alreadyResolved)
@@ -191,7 +247,7 @@ export function outcomeText(decision, who, outcome, answer) {
         return `${what}. The agent is still waiting on another decision from the same step.`;
     if (outcome.morePending)
         return `${what}. The agent needs another decision; a new request is on its way.`;
-    return `${what}.${outcome.text ? `\n>${outcome.text.replace(/\n/g, '\n>')}` : ''}`;
+    return `${what}.${outcome.text ? `\n> ${outcome.text.replace(/\n/g, '\n> ')}` : ''}`;
 }
 /** The thread as chat messages: the agent's own replies as `assistant`,
  * people's as `user` (with who said it), the request itself left out

package/dist/core/messaging/format-args.d.ts

@@ -0,0 +1,10 @@
+type Escape = (text: string) => string;
+/** "customer_id" / "customerId" -> "Customer id". */
+export declare function labelFor(key: string, schema?: Record<string, unknown>): string;
+/** All of a call's arguments, one per line (long text quoted below its
+ * label). */
+export declare function formatArgs(args: Record<string, unknown>, escape: Escape, schema?: Record<string, unknown>): string;
+/** Only the arguments that differ, old struck through and new beside it;
+ * changed long text is shown in full as it will run. */
+export declare function formatChange(before: Record<string, unknown>, after: Record<string, unknown>, escape: Escape, schema?: Record<string, unknown>): string;
+export {};

package/dist/core/messaging/format-args.js

@@ -0,0 +1,107 @@
+// A tool call's arguments as something a person can read in a chat app,
+// instead of JSON: one labelled line per argument, long or multi-line
+// text (an email body) as a quoted block with its line breaks, lists as
+// bullets. Labels come from the tool's schema (a property's `title`),
+// else from the argument's name ("customer_id" -> "Customer id").
+//
+// The result is Markdown, which each connector turns into its own format
+// (Slack: ./connectors/slack/format.ts). Every value goes through the
+// connector's `escape`, so text the agent wrote can't become a mention,
+// a link or a ping in the app.
+const INLINE_MAX = 80;
+const LONG_MAX = 1500;
+function propertiesOf(schema) {
+    const props = schema?.properties;
+    return props && typeof props === 'object' ? props : {};
+}
+/** A label comes from the tool's own schema, not from the agent, but is
+ * still kept plain: no markup or link characters. */
+function plain(label) {
+    return label.replace(/[*_~`<>&|[\]]/g, '').trim() || 'Value';
+}
+/** "customer_id" / "customerId" -> "Customer id". */
+export function labelFor(key, schema) {
+    const title = propertiesOf(schema)[key]?.title;
+    if (typeof title === 'string' && title.trim())
+        return title.trim();
+    const words = key
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/[_-]+/g, ' ')
+        .trim()
+        .toLowerCase();
+    return words ? words[0].toUpperCase() + words.slice(1) : key;
+}
+/** Keys in the schema's order, then any others. */
+function orderedKeys(args, schema) {
+    const fromSchema = Object.keys(propertiesOf(schema)).filter((k) => k in args);
+    return [...fromSchema, ...Object.keys(args).filter((k) => !fromSchema.includes(k))];
+}
+function isLongText(value) {
+    return typeof value === 'string' && (value.length > INLINE_MAX || value.includes('\n'));
+}
+function quote(text, escape) {
+    const cut = text.length > LONG_MAX ? text.slice(0, LONG_MAX).trimEnd() + '… (cut short here; the decision link has it all)' : text;
+    return cut
+        .split('\n')
+        .map((line) => `> ${escape(line)}`)
+        .join('\n');
+}
+function inline(value, escape) {
+    if (typeof value === 'string')
+        return escape(value);
+    if (value === null || typeof value !== 'object')
+        return String(value);
+    return '`' + escape(JSON.stringify(value)) + '`';
+}
+/** One argument: `**Label:** value`, or the label over a quoted block,
+ * bullets or nested fields. */
+function field(label, value, escape, indent = '') {
+    const head = `${indent}**${plain(label)}:**`;
+    if (isLongText(value))
+        return `${head}\n${quote(value, escape)}`;
+    if (Array.isArray(value)) {
+        if (!value.length)
+            return `${head} (none)`;
+        const simple = value.every((v) => v === null || typeof v !== 'object');
+        const joined = value.map((v) => inline(v, escape)).join(', ');
+        if (simple && joined.length <= INLINE_MAX)
+            return `${head} ${joined}`;
+        return `${head}\n${value.map((v) => `${indent}- ${isLongText(v) ? escape(v.slice(0, 300)) : inline(v, escape)}`).join('\n')}`;
+    }
+    if (value && typeof value === 'object') {
+        const entries = Object.entries(value).filter(([, v]) => v !== undefined);
+        if (!entries.length)
+            return `${head} (empty)`;
+        if (indent)
+            return `${head} ${inline(value, escape)}`;
+        return `${head}\n${entries.map(([k, v]) => field(labelFor(k), v, escape, '  ')).join('\n')}`;
+    }
+    return `${head} ${inline(value, escape)}`;
+}
+/** All of a call's arguments, one per line (long text quoted below its
+ * label). */
+export function formatArgs(args, escape, schema) {
+    const keys = orderedKeys(args, schema).filter((k) => args[k] !== undefined && args[k] !== null);
+    if (!keys.length)
+        return '(no arguments)';
+    return keys.map((k) => field(labelFor(k, schema), args[k], escape)).join('\n');
+}
+/** Only the arguments that differ, old struck through and new beside it;
+ * changed long text is shown in full as it will run. */
+export function formatChange(before, after, escape, schema) {
+    const keys = [...new Set([...orderedKeys(after, schema), ...Object.keys(before)])].filter((k) => JSON.stringify(before[k]) !== JSON.stringify(after[k]));
+    return keys
+        .map((k) => {
+        const label = `**${plain(labelFor(k, schema))}:**`;
+        const was = before[k];
+        const now = after[k];
+        if (now === undefined || now === null)
+            return `${label} ~~${inline(was, escape)}~~ (removed)`;
+        if (isLongText(now) || isLongText(was))
+            return `${label} (changed, now:)\n${quote(typeof now === 'string' ? now : JSON.stringify(now), escape)}`;
+        if (was === undefined || was === null)
+            return `${label} ${inline(now, escape)} (added)`;
+        return `${label} ~~${inline(was, escape)}~~ → ${inline(now, escape)}`;
+    })
+        .join('\n');
+}

package/dist/core/notifier-file.d.ts

@@ -20,8 +20,6 @@ export interface NotifierFile {
     /** slack: the people who can decide a request by replying in its
      * thread, and whose button clicks count once any are listed. */
     approvers?: MessagingApprover[];
-    /** slack: tools whose approval by reply needs a Confirm click. */
-    confirmTools?: string[];
 }
 export interface MessagingApprover {
     /** The app's id for the person (Slack: U0123ABC). */

package/dist/core/notifier-file.js

@@ -81,13 +81,6 @@ export function validateNotifierFile(input) {
         if (approvers.length)
             file.approvers = approvers;
     }
-    if (raw.confirmTools !== undefined && channel === 'slack') {
-        if (!Array.isArray(raw.confirmTools) || raw.confirmTools.some((t) => typeof t !== 'string' || !t.trim()))
-            throw new NotifierFileError('confirmTools must be a list of tool names');
-        const tools = [...new Set(raw.confirmTools.map((t) => t.trim()))];
-        if (tools.length)
-            file.confirmTools = tools;
-    }
     const publicUrl = str('publicUrl');
     if (publicUrl) {
         if (!/^https?:\/\/[^/]+/.test(publicUrl))

package/dist/index.d.ts

@@ -12,15 +12,16 @@ export { listDeliveries, recordDelivery, type NotifierDelivery } from '#core/not
 export { describeNotifier } from '#core/http-notifier.js';
 export { Scheduler, ScheduleError, FileSchedulerStore, getSchedulerStore, setSchedulerStore, createScheduledTask, listScheduledTasks, getScheduledTask, cancelScheduledTask, pauseScheduledTask, resumeScheduledTask, runScheduledTaskNow, deleteScheduledTask, nextScheduledWakeAt, importLegacyScheduledTasks, parseEvery, describeSchedule, type ScheduledTask, type ScheduledTaskRun, type ScheduledTaskStatus, type Schedule, type SchedulerStore, type FireTask, type CreateScheduledTaskInput } from '#core/scheduler.js';
 export { NOTIFIER_SLACK_SIGNING_SECRET_VAR } from '#core/notifier-file.js';
-export { firstSighting, handleInboundMessage, handleMessagingAction, type MessagingDeps, type MessagingDecision, type DecisionOutcome } from '#core/messaging/engine.js';
+export { firstSighting, handleInboundMessage, handleMessagingAction, isPlainApproval, type MessagingDeps, type MessagingDecision, type DecisionOutcome } from '#core/messaging/engine.js';
+export { formatArgs, formatChange, labelFor } from '#core/messaging/format-args.js';
 export { decideReply, proposeEdit, describeChange, type ReplyDecision, type DecisionRequest } from '#core/messaging/decide.js';
 export { recordThread, findThread, findThreadByPending, type ThreadLink } from '#core/messaging/threads.js';
 export type { InboundMessage, MessagingConnector, ThreadMessage, MessagingChoice, MessagingAction } from '#core/messaging/connector.js';
-export { parseSlackEvent, createSlackConnector, verifySlackRequest, parseSlackInteraction, openSlackAnswerModal, replyInSlack, replyPrivatelyInSlack, slackOutcomeText, listSlackChannels, listSlackChannelMembers, slackAppManifest, toSlackMrkdwn, type SlackEvent, type SlackInteraction, type SlackChannel } from '#core/messaging/connectors/slack/index.js';
+export { parseSlackEvent, createSlackConnector, verifySlackRequest, parseSlackInteraction, openSlackAnswerModal, replyInSlack, replyPrivatelyInSlack, slackOutcomeText, listSlackChannels, listSlackChannelMembers, slackAppManifest, toSlackMrkdwn, slackArgs, slackEscape, type SlackEvent, type SlackInteraction, type SlackChannel } from '#core/messaging/connectors/slack/index.js';
 export { createDecisionToken, verifyDecisionToken, decidePath, decideLinkMaker, decisionLinkTtlMs, type DecisionKind } from '#core/approval-links.js';
 export { renderDecidePage, renderDecideGonePage, renderDecideInvalidPage, type DecidePageItem } from './web/decide-page.js';
 export { sendTestWebhook } from '#core/http-notify-triggers/webhook.js';
-export { describeAgentNotifier, saveAgentNotifier, removeAgentNotifier, testAgentNotifier, listAgentPending, slackCredentialsFor, slackConversationsOn, slackClickAllowed, agentApprovers, setAgentApprovers, agentConfirmTools, setAgentConfirmTools, listAgentSlackMembers, listAgentSlackChannels, announceToNotifier, type DefaultWebhook } from './web/notifier-admin.js';
+export { describeAgentNotifier, saveAgentNotifier, removeAgentNotifier, testAgentNotifier, listAgentPending, slackCredentialsFor, slackConversationsOn, slackClickAllowed, agentApprovers, setAgentApprovers, listAgentSlackMembers, listAgentSlackChannels, announceToNotifier, type DefaultWebhook } from './web/notifier-admin.js';
 export type * from './core/loop-events.js';
 export { streamMessage, streamMessageWithCallbacks, sendMessage, approveCall, denyCall, answerQuestion, getSessionHistory, } from './core/client.js';
 export type { RequestOptions, SendMessageResult, PendingApprovalResult, PendingQuestionResult, PendingResult, MessageResult, StreamMessageCallbacks, } from './core/client.js';

package/dist/index.js

@@ -14,14 +14,15 @@ export { listDeliveries, recordDelivery } from '#core/notifier-deliveries.js';
 export { describeNotifier } from '#core/http-notifier.js';
 export { Scheduler, ScheduleError, FileSchedulerStore, getSchedulerStore, setSchedulerStore, createScheduledTask, listScheduledTasks, getScheduledTask, cancelScheduledTask, pauseScheduledTask, resumeScheduledTask, runScheduledTaskNow, deleteScheduledTask, nextScheduledWakeAt, importLegacyScheduledTasks, parseEvery, describeSchedule } from '#core/scheduler.js';
 export { NOTIFIER_SLACK_SIGNING_SECRET_VAR } from '#core/notifier-file.js';
-export { firstSighting, handleInboundMessage, handleMessagingAction } from '#core/messaging/engine.js';
+export { firstSighting, handleInboundMessage, handleMessagingAction, isPlainApproval } from '#core/messaging/engine.js';
+export { formatArgs, formatChange, labelFor } from '#core/messaging/format-args.js';
 export { decideReply, proposeEdit, describeChange } from '#core/messaging/decide.js';
 export { recordThread, findThread, findThreadByPending } from '#core/messaging/threads.js';
-export { parseSlackEvent, createSlackConnector, verifySlackRequest, parseSlackInteraction, openSlackAnswerModal, replyInSlack, replyPrivatelyInSlack, slackOutcomeText, listSlackChannels, listSlackChannelMembers, slackAppManifest, toSlackMrkdwn } from '#core/messaging/connectors/slack/index.js';
+export { parseSlackEvent, createSlackConnector, verifySlackRequest, parseSlackInteraction, openSlackAnswerModal, replyInSlack, replyPrivatelyInSlack, slackOutcomeText, listSlackChannels, listSlackChannelMembers, slackAppManifest, toSlackMrkdwn, slackArgs, slackEscape } from '#core/messaging/connectors/slack/index.js';
 export { createDecisionToken, verifyDecisionToken, decidePath, decideLinkMaker, decisionLinkTtlMs } from '#core/approval-links.js';
 export { renderDecidePage, renderDecideGonePage, renderDecideInvalidPage } from './web/decide-page.js';
 export { sendTestWebhook } from '#core/http-notify-triggers/webhook.js';
-export { describeAgentNotifier, saveAgentNotifier, removeAgentNotifier, testAgentNotifier, listAgentPending, slackCredentialsFor, slackConversationsOn, slackClickAllowed, agentApprovers, setAgentApprovers, agentConfirmTools, setAgentConfirmTools, listAgentSlackMembers, listAgentSlackChannels, announceToNotifier } from './web/notifier-admin.js';
+export { describeAgentNotifier, saveAgentNotifier, removeAgentNotifier, testAgentNotifier, listAgentPending, slackCredentialsFor, slackConversationsOn, slackClickAllowed, agentApprovers, setAgentApprovers, listAgentSlackMembers, listAgentSlackChannels, announceToNotifier } from './web/notifier-admin.js';
 // The framework-agnostic browser client for adapters/http.ts's own wire
 // protocol (see client.ts's own header comment) — this, not a deep
 // subpath import, is how a consumer's React/Vue/etc. chat UI is meant to

package/dist/web/agents-config-page.js

@@ -1194,7 +1194,7 @@ ${consoleShellScript}
         '<td><button type="button" class="delete-btn approver-remove" data-user="' + escapeHtml(a.user) + '"' + (n.canSave === false ? ' disabled' : '') + '>Remove</button></td></tr>';
     }).join('');
     return '<section id="approversSection"><h3>Approvers</h3>' +
-      '<p class="muted" style="margin:0 0 10px">People who can approve, deny, change or answer a request by replying in its thread, like &ldquo;yes, go ahead&rdquo; or &ldquo;make it $40&rdquo;. A change is shown to approve before anything runs. Once anyone is listed, only approvers&#39; button clicks count too. Anyone in the channel can still ask about a request.</p>' +
+      '<p class="muted" style="margin:0 0 10px">People who can approve, deny, change or answer a request by replying in its thread, like &ldquo;yes, go ahead&rdquo; or &ldquo;make it $40&rdquo;. A plain &ldquo;yes&rdquo; runs it; a reply that&#39;s less clear (&ldquo;sure, send it&rdquo;, &ldquo;yes but check the amount&rdquo;) shows exactly what will run with a Confirm button first, and a change is shown to approve first. Once anyone is listed, only approvers&#39; button clicks count too. Anyone in the channel can still ask about a request.</p>' +
       (approvers.length
         ? '<div class="le-table-wrap" style="max-width:560px"><table><thead><tr><th>Name</th><th>Slack ID</th><th></th></tr></thead><tbody>' + rows + '</tbody></table></div>'
         : '<p class="hint">No approvers yet. Until you add someone, anyone in the channel can use the buttons, and deciding by reply is off.</p>') +
@@ -1205,39 +1205,6 @@ ${consoleShellScript}
       '<div id="approversResult" class="hint"></div></section>';
   }
 
-  // Slack only: tools an approver can't approve with a typed yes; the
-  // agent asks for a Confirm click showing exactly what will run.
-  function renderConfirmToolsHtml(n) {
-    if (n.source === 'code' || !n.file || n.file.channel !== 'slack') return '';
-    var chosen = n.file.confirmTools || [];
-    var tools = ((currentCfg && currentCfg.tools) || []).map(function (t) { return t.name; });
-    chosen.forEach(function (t) { if (tools.indexOf(t) === -1) tools.push(t); });
-    var boxes = tools.map(function (t) {
-      return '<label class="tool-picker-item" style="justify-content:flex-start"><input type="checkbox" value="' + escapeHtml(t) + '"' + (chosen.indexOf(t) !== -1 ? ' checked' : '') + (n.canSave === false ? ' disabled' : '') + '> <code>' + escapeHtml(t) + '</code></label>';
-    }).join('');
-    return '<section id="confirmToolsSection"><h3>Confirm-required tools</h3>' +
-      '<p class="muted" style="margin:0 0 10px">For tools that move money or delete data: when an approver replies &ldquo;yes&rdquo;, the agent shows exactly what will run with a Confirm button, and only that click runs it. A click on the request&#39;s own Approve button still runs it straight away.</p>' +
-      (tools.length ? '<div class="tool-picker" style="max-width:560px">' + boxes + '</div>' : '<p class="hint">This agent has no tools.</p>') +
-      (n.canSave === false || !tools.length ? '' : '<p style="margin:8px 0 0"><button type="button" id="confirmToolsSave">Save</button></p>') +
-      '<div id="confirmToolsResult" class="hint"></div></section>';
-  }
-
-  function wireConfirmToolsHandlers(name) {
-    var section = detail.querySelector('#confirmToolsSection');
-    var btn = section && section.querySelector('#confirmToolsSave');
-    if (!btn) return;
-    var result = section.querySelector('#confirmToolsResult');
-    btn.addEventListener('click', function () {
-      var tools = Array.prototype.map.call(section.querySelectorAll('input:checked'), function (el) { return el.value; });
-      result.textContent = 'Saving' + String.fromCharCode(8230);
-      fetchJsonRetryOnce('/agents/' + encodeURIComponent(name) + '/notifier/confirm-tools', {
-        method: 'PUT', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ tools: tools }),
-      }).then(function (r) {
-        result.textContent = r.ok ? 'Saved.' : (r.body.error || 'Could not save');
-      });
-    });
-  }
-
   function wireApproversHandlers(name, n) {
     var section = detail.querySelector('#approversSection');
     if (!section) return;
@@ -1294,7 +1261,6 @@ ${consoleShellScript}
         (n.error ? '<p class="error">' + escapeHtml(n.error) + '</p>' : '') +
         (n.source === 'code' ? '' : renderNotifierForm(n)) + '</section>' +
       renderApproversHtml(n) +
-      renderConfirmToolsHtml(n) +
       '<section><h3>Recent deliveries</h3>' + renderDeliveries(n.deliveries || []) + '</section>';
   }
 
@@ -1456,7 +1422,6 @@ ${consoleShellScript}
       content.innerHTML = renderApprovalsHtml(results[0].body);
       wireApprovalsHandlers(name);
       wireApproversHandlers(name, results[0].body);
-      wireConfirmToolsHandlers(name);
       var pendingEl = detail.querySelector('#pendingContent');
       var pending = (results[1].ok && results[1].body.pending) || [];
       if (pendingEl) {

package/dist/web/notifier-admin.d.ts

@@ -63,11 +63,6 @@ export declare function slackClickAllowed(config: AgentConfig, user: string | un
 /** Replaces the approver list on the agent's saved Slack connection.
  * Throws NotifierFileError when there's no Slack connection to add them to. */
 export declare function setAgentApprovers(config: AgentConfig, approvers: unknown): MessagingApprover[];
-/** Tools whose approval by reply needs a Confirm click. */
-export declare function agentConfirmTools(config: AgentConfig): string[];
-/** Replaces the Confirm-required tools on the agent's saved Slack
- * connection. Throws NotifierFileError without one. */
-export declare function setAgentConfirmTools(config: AgentConfig, tools: unknown): string[];
 /** The people in the agent's Slack channel, for picking approvers. */
 export declare function listAgentSlackMembers(config: AgentConfig): Promise<SlackMember[]>;
 /** Channels for the console's picker, with the token being typed in or,

package/dist/web/notifier-admin.js

@@ -42,8 +42,8 @@ export function describeAgentNotifier(config, defaultWebhook) {
  * form includes one, the channel's secret into the agent's own env.
  * Throws NotifierFileError for an invalid form. */
 export async function saveAgentNotifier(config, body) {
-    // The form doesn't carry the approvers or the Confirm-required tools
-    // (they have their own sections), so saving it keeps them.
+    // The form doesn't carry the approvers (they have their own section),
+    // so saving it keeps them.
     let existing;
     try {
         existing = readNotifierFile(agentDirFor(config));
@@ -52,8 +52,6 @@ export async function saveAgentNotifier(config, body) {
     if (existing && body.channel === existing.channel) {
         if (body.approvers === undefined && existing.approvers)
             body = { ...body, approvers: existing.approvers };
-        if (body.confirmTools === undefined && existing.confirmTools)
-            body = { ...body, confirmTools: existing.confirmTools };
     }
     const file = writeNotifierFile(agentDirFor(config), body);
     if (typeof body.secret === 'string' && body.secret.trim()) {
@@ -115,26 +113,6 @@ export function setAgentApprovers(config, approvers) {
         throw new NotifierFileError('Save a Slack connection first');
     return writeNotifierFile(dir, { ...file, approvers: Array.isArray(approvers) ? approvers : [] }).approvers ?? [];
 }
-/** Tools whose approval by reply needs a Confirm click. */
-export function agentConfirmTools(config) {
-    if (config.httpNotifier)
-        return [];
-    try {
-        return readNotifierFile(agentDirFor(config))?.confirmTools ?? [];
-    }
-    catch {
-        return [];
-    }
-}
-/** Replaces the Confirm-required tools on the agent's saved Slack
- * connection. Throws NotifierFileError without one. */
-export function setAgentConfirmTools(config, tools) {
-    const dir = agentDirFor(config);
-    const file = readNotifierFile(dir);
-    if (!file || file.channel !== 'slack')
-        throw new NotifierFileError('Save a Slack connection first');
-    return writeNotifierFile(dir, { ...file, confirmTools: Array.isArray(tools) ? tools : [] }).confirmTools ?? [];
-}
 /** The people in the agent's Slack channel, for picking approvers. */
 export async function listAgentSlackMembers(config) {
     const { botToken } = slackCredentialsFor(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.85",
+  "version": "0.1.87",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",