pi-roundtable 0.22.4 → 0.23.0

package/src/core/modules/host-shell/shell-wrappers.ts

@@ -0,0 +1,104 @@
+import { basename } from "node:path";
+import { COMMAND_PREFIX_WORDS } from "./shell-lexer.ts";
+
+/** A variable assignment word, `NAME=value` or `NAME+=value`, as it stands before a command. */
+export const ASSIGNMENT_WORD = /^[A-Za-z_][A-Za-z0-9_]*\+?=/;
+
+/**
+ * Words that run the next word as the command, with the options of each that take the word after
+ * them as their argument (`env -u NAME`, `timeout -s KILL`): that word is not the command.
+ */
+export const WRAPPERS: ReadonlyMap<string, ReadonlySet<string>> = new Map([
+	[
+		"env",
+		new Set(["-u", "--unset", "-C", "--chdir", "-P", "-S", "--split-string"]),
+	],
+	["nohup", new Set()],
+	["time", new Set(["-f", "--format", "-o", "--output"])],
+	["nice", new Set(["-n", "--adjustment"])],
+	["ionice", new Set(["-c", "--class", "-n", "--classdata", "-p", "-P", "-u"])],
+	["timeout", new Set(["-s", "--signal", "-k", "--kill-after"])],
+	["stdbuf", new Set(["-i", "--input", "-o", "--output", "-e", "--error"])],
+	["exec", new Set(["-a"])],
+	["command", new Set()],
+	["builtin", new Set()],
+	[
+		"xargs",
+		new Set(["-n", "-I", "-J", "-P", "-L", "-s", "-d", "-E", "-a", "-R", "-S"]),
+	],
+	["setsid", new Set()],
+	["unbuffer", new Set()],
+	["caffeinate", new Set(["-t", "-w"])],
+]);
+
+/** Whether a word is the duration `timeout` takes, or the number a wrapper option leaves behind. */
+const DURATION = /^\d+(?:\.\d+)?[smhd]?$/;
+
+/** The string `xargs` replaces with each input line (`-I str`, `-Istr`, `-J str`, `-i`, `--replace`), given one of its options and the word after it. */
+function xargsReplace(
+	option: string,
+	next: string | undefined,
+): string | undefined {
+	if (option === "-I" || option === "-J") return next;
+	if (option.startsWith("-I") || option.startsWith("-J"))
+		return option.slice(2);
+	if (option === "-i" || option === "--replace") return "{}";
+	if (option.startsWith("-i") || option.startsWith("--replace="))
+		return option.slice(
+			option.indexOf("=") === -1 ? 2 : option.indexOf("=") + 1,
+		);
+	return undefined;
+}
+
+/** The string that stands for the input in an `xargs` of `prefix` (the words `program` dropped), if it has one. */
+export function replaceString(prefix: readonly string[]): string | undefined {
+	return prefix.find((word) => word.startsWith("xargs -I "))?.slice(9);
+}
+
+/**
+ * Drops leading variable assignments, wrappers, and their options, leaving the real program;
+ * `prefix` collects what was dropped. An `env -S` splits its argument into a command line, so it is
+ * recorded as `env -S` for the caller to hold, and the string an `xargs` replaces as `xargs -I str`.
+ */
+export function program(words: string[], prefix: string[] = []): string[] {
+	let rest = words;
+	for (;;) {
+		const [first] = rest;
+		if (first === undefined) return rest;
+		if (COMMAND_PREFIX_WORDS.has(first)) {
+			rest = rest.slice(1);
+			continue;
+		}
+		if (ASSIGNMENT_WORD.test(first)) {
+			prefix.push(first);
+			rest = rest.slice(1);
+			continue;
+		}
+		const wrapper = basename(first);
+		const takesArgument = WRAPPERS.get(wrapper);
+		if (takesArgument) {
+			prefix.push(wrapper);
+			rest = rest.slice(1);
+			// Wrapper options (with the argument some take) and the timeout's duration.
+			while (
+				rest[0] !== undefined &&
+				(rest[0].startsWith("-") ||
+					DURATION.test(rest[0]) ||
+					ASSIGNMENT_WORD.test(rest[0]))
+			) {
+				const option = rest[0];
+				rest = rest.slice(1);
+				if (wrapper === "xargs") {
+					const replace = xargsReplace(option, rest[0]);
+					if (replace !== undefined) prefix.push(`xargs -I ${replace}`);
+				}
+				if (!takesArgument.has(option)) continue;
+				if (wrapper === "env" && /^(-S|--split-string)/.test(option))
+					prefix.push("env -S");
+				rest = rest.slice(1);
+			}
+			continue;
+		}
+		return rest;
+	}
+}

package/src/core/modules/schedules/precheck-tools.ts

@@ -417,6 +417,7 @@ export function precheckScriptHoldRule(options: {
 	};
 	return {
 		name: "precheck-scripts",
+		relay: true,
 		describe(tool, input, context) {
 			const held = heldCalls(tool, input, context);
 			if (held.length === 0) return undefined;
@@ -430,6 +431,22 @@ export function precheckScriptHoldRule(options: {
 				held.map((call) => call.held),
 			);
 		},
+		// The classes of every held call the script makes, so yolo mode approves saving it only when it
+		// would approve each of them: a scheduled run makes them with no one to ask. A call no rule
+		// classes gives the name of the rule that holds it, or of this rule when none is known.
+		holdClasses(tool, input, context) {
+			const holds = options.holds();
+			return scriptCalls(tool, input, context).flatMap((call) => {
+				const own = holds.classesOf?.(call.name, call.input, context) ?? [];
+				// A call computed when the script runs may be held for more than its rules say now, so it
+				// is also unclassed: under its own rules' bare names, or the rule that may hold it.
+				if (own.length > 0 && call.literal) return own;
+				const may = holds.mayHold?.(call.name);
+				const bare = own.map((id) => id.split(".")[0] as string);
+				if (own.length > 0) return [...own, ...new Set(bare.concat(may ?? []))];
+				return [may ?? "precheck-scripts"];
+			});
+		},
 		// Whoever approves must be able to approve each held call the script makes.
 		approvalTier(tool, input, context) {
 			const tiers = options.tiers?.();

package/src/core/modules/schedules/schedules.ts

@@ -44,8 +44,14 @@ export interface OwnerSchedules {
 	target?: BackgroundTarget;
 }
 
-/** Finds another agent's channel, for reading its schedules; throws ScheduleError when there is none. */
-export type AgentChannelLookup = (agent: string) => ChannelKey;
+/**
+ * Finds another agent's channel, for reading its schedules, on the asker's surface when that one
+ * hosts agent rooms (`near` is the asker's own conversation); throws ScheduleError when there is none.
+ */
+export type AgentChannelLookup = (
+	agent: string,
+	near: ChannelKey,
+) => ChannelKey;
 
 /** schedule_list for agents: an optional agent name reads that agent's schedules instead. */
 function withAgentOption(spec: ScheduleToolSpec): ScheduleToolSpec {
@@ -99,7 +105,7 @@ export function schedulesExtension(
 					);
 				const peer =
 					agents && typeof input.agent === "string" && input.agent
-						? agents(input.agent)
+						? agents(input.agent, channel)
 						: undefined;
 				const target = peer ?? (await channelFor(channel, author.principalId));
 				const answer = await callScheduleTool(

package/src/core/plugin.ts

@@ -15,7 +15,7 @@ import type { ToolContribution } from "./define.ts";
 import type { TurnProgress } from "./domain/progress.ts";
 import { PluginError } from "./errors.ts";
 import type { HoldCheck, HoldRule } from "./holds.ts";
-import type { HttpRoute } from "./http/listeners.ts";
+import type { HttpRoute, ListenerAddress } from "./http/listeners.ts";
 import type { Locale } from "./i18n/index.ts";
 import type { Logger } from "./log.ts";
 import type {
@@ -321,6 +321,13 @@ export interface PluginContext {
 	 * never throws for that. The value is a secret: keep it out of logs and error messages.
 	 */
 	apiKey(provider: string): Promise<string | undefined>;
+	/**
+	 * Where the host's listener `id` serves, as configured: a unix socket (with its mode) or a TCP
+	 * port (with its hostname, absent when the host did not set one). `undefined` for an id the
+	 * host has no listener for. A plugin that serves without authentication reads it to refuse an
+	 * address that reaches beyond the machine.
+	 */
+	listener(id: string): Readonly<ListenerAddress> | undefined;
 }
 
 /**

package/src/core/presence/direct-channels.ts

@@ -1,6 +1,7 @@
 import type { SurfacePort } from "../contract/surface.ts";
 import type { ChannelKey } from "../domain/conversation.ts";
 import type { Notifier } from "../domain/ports.ts";
+import type { Logger } from "../log.ts";
 import { splitReply } from "../presentation/reply-splitter.ts";
 
 /**
@@ -34,6 +35,13 @@ export interface DirectChannelProvider {
 	 * names, through the surface that serves it.
 	 */
 	deliver?(principalId: string, text: string): Promise<void>;
+	/**
+	 * Called with the notice after another provider delivered it, so this one can echo it, such as
+	 * a web app pushing a prompt to a phone that Discord's direct message already reached. It runs
+	 * only after a delivery, on every provider but the one that delivered; its failure is logged
+	 * and never changes what `notify` returns.
+	 */
+	mirror?(principalId: string, text: string): Promise<void>;
 }
 
 /** Where a person was reached: the provider, and their conversation on it. */
@@ -67,6 +75,7 @@ export interface DirectChannels extends Notifier {
 export function directChannelsPort(
 	providers: () => readonly DirectChannelProvider[],
 	surfaces: Pick<SurfacePort, "sendReply">,
+	logger?: Pick<Logger, "warn">,
 ): DirectChannels {
 	const reach = async (
 		principalId: string,
@@ -77,6 +86,26 @@ export function directChannelsPort(
 		}
 		return undefined;
 	};
+	const mirrored = async (
+		delivered: DirectChannelProvider,
+		principalId: string,
+		text: string,
+	): Promise<void> => {
+		await Promise.all(
+			providers()
+				.filter((provider) => provider !== delivered && provider.mirror)
+				.map(async (provider) => {
+					try {
+						await provider.mirror?.(principalId, text);
+					} catch (error) {
+						logger?.warn(
+							{ err: error, provider: provider.name },
+							"a direct channel did not mirror a notice",
+						);
+					}
+				}),
+		);
+	};
 	return {
 		providers: () => providers(),
 		reach,
@@ -98,6 +127,7 @@ export function directChannelsPort(
 				await surfaces.sendReply(reached.channel, {
 					chunks: splitReply(text),
 				});
+			await mirrored(reached.provider, principalId, text);
 			return true;
 		},
 	};

package/src/core/presentation/reply-body.ts

@@ -0,0 +1,25 @@
+import type { ReplyFile, TurnResult } from "../domain/conversation.ts";
+import { failureNotice } from "./failure-notice.ts";
+import { splitReply } from "./reply-splitter.ts";
+import { thinkingLine } from "./thinking-line.ts";
+
+/** What a turn posts: its answer with a thinking line, or the failure or stopped notice. */
+export function replyBody(result: TurnResult): {
+	thinking?: string;
+	chunks: string[];
+	files?: ReplyFile[];
+	/** Set on the notice for a turn that ended in an error, not on a stopped one. */
+	failed?: true;
+} {
+	if (!result.ok)
+		return {
+			chunks: [failureNotice(result)],
+			...(result.stopped ? {} : { failed: true as const }),
+		};
+	const thinking = result.thinking ? thinkingLine(result.thinking) : undefined;
+	return {
+		...(thinking ? { thinking } : {}),
+		chunks: splitReply(result.text),
+		...(result.files?.length ? { files: result.files } : {}),
+	};
+}

package/src/core/registry/contributions.ts

@@ -1,3 +1,4 @@
+import { CharacterError, resolveCharacter } from "../../characters/index.ts";
 import type { AgentSeed } from "../agents/agent-store.ts";
 import type { BackgroundTarget, ChannelClaim } from "../contract/channels.ts";
 import type { ChatSurface } from "../contract/surface.ts";
@@ -126,6 +127,24 @@ function checkKeys(plugin: string, contribution: Contribution): void {
 	}
 }
 
+/** Refuses a seed whose `character` the characters module would not resolve. */
+function checkSeedCharacters(
+	plugin: string,
+	seeds: readonly AgentSeed[],
+): void {
+	for (const seed of seeds) {
+		if (seed.character === undefined) continue;
+		try {
+			resolveCharacter(seed.character);
+		} catch (error) {
+			if (!(error instanceof CharacterError)) throw error;
+			throw new PluginError(
+				`plugin ${plugin}: seed "${seed.name}" has a bad character, field "${error.field}": ${error.message}.`,
+			);
+		}
+	}
+}
+
 /** The selections' tools and groups, each once, in the order the plugins gave them. */
 function mergeSelections(
 	selections: readonly (() => ToolSelection)[],
@@ -295,13 +314,17 @@ export async function collectContributions(
 	let collected = false;
 	const context: Omit<PluginContext, "services"> = {
 		...base,
-		directChannels: directChannelsPort(() => {
-			if (!collected)
-				throw new NotLinkedError(
-					"direct channels are linked once every plugin is set up. Use them from a service's start, a handler, or a session tool, not during setup.",
-				);
-			return registry.directChannels;
-		}, base.surfaces),
+		directChannels: directChannelsPort(
+			() => {
+				if (!collected)
+					throw new NotLinkedError(
+						"direct channels are linked once every plugin is set up. Use them from a service's start, a handler, or a session tool, not during setup.",
+					);
+				return registry.directChannels;
+			},
+			base.surfaces,
+			base.logger,
+		),
 	};
 	const serviceNames = new Names("service");
 	const sessionTools = new Names("session tool");
@@ -439,6 +462,7 @@ export async function collectContributions(
 		registry.backgroundTargets.push(...backgroundTargets);
 		registry.directChannels.push(...directChannels);
 		registry.dashboard.push(...dashboard);
+		checkSeedCharacters(plugin.name, seeds);
 		registry.seeds.push(...seeds);
 		registry.prompt.push(...prompt);
 		registry.requiredTools.push(...requiredTools);

package/src/core/registry/providers.ts

@@ -30,7 +30,7 @@ function defaults(judgeModel: JudgeModel | undefined): Providers {
 		judge: judgeModel ? new ModelJudge(judgeModel) : unconfiguredJudge(),
 		images: async () => {
 			throw new ProviderError(
-				"no image provider is configured; agents use generated avatars",
+				"no image provider is configured: a plugin fills the images slot to let agents make pictures",
 			);
 		},
 		runtime: () => {

package/src/core/routing/conversation-turns.ts

@@ -13,9 +13,7 @@ import { HostStoppingError, PluginError } from "../errors.ts";
 import { SYSTEM_PRINCIPAL } from "../identity/principal-store.ts";
 import type { Logger } from "../log.ts";
 import type { EventSink } from "../plugin.ts";
-import { failureNotice } from "../presentation/failure-notice.ts";
-import { splitReply } from "../presentation/reply-splitter.ts";
-import { thinkingLine } from "../presentation/thinking-line.ts";
+import { replyBody } from "../presentation/reply-body.ts";
 import { withReplyFiles } from "../reply-files.ts";
 import type { ChannelKey, ToolSelection, TurnSelection } from "../sessions.ts";
 import type { Speaker } from "../speakers.ts";
@@ -226,7 +224,7 @@ export function conversationTurns(
 				if (!result.ok && !result.stopped)
 					logger.error({ channel, kind, err: result.error }, "turn failed");
 				if (input.reply) await input.reply(result);
-				else await surfaces.sendReply(channel, replyOf(result));
+				else await surfaces.sendReply(channel, replyBody(result));
 			} catch (error) {
 				logger.error({ channel, kind, err: error }, "reply not posted");
 			} finally {
@@ -236,14 +234,3 @@ export function conversationTurns(
 		},
 	};
 }
-
-/** The default post: the answer with its thinking line, or the failure or stopped notice. */
-function replyOf(result: TurnResult) {
-	if (!result.ok) return { chunks: [failureNotice(result)] };
-	const thinking = result.thinking ? thinkingLine(result.thinking) : undefined;
-	return {
-		...(thinking ? { thinking } : {}),
-		chunks: splitReply(result.text),
-		...(result.files?.length ? { files: result.files } : {}),
-	};
-}

package/src/core/routing/surface-port.ts

@@ -56,7 +56,11 @@ export function surfacePort(
 			of(channel)?.unreact?.(channel, messageId, emoji),
 		prompts: (channel, scope) =>
 			of(channel)?.prompts?.(channel, scopeOf(scope, options)),
-		interim: (channel) => of(channel)?.interim?.(channel),
+		roomSurfaces: () =>
+			linked()
+				.filter((surface) => surface.agentRooms === true)
+				.map((surface) => surface.surface),
+		interim: (channel, as) => of(channel)?.interim?.(channel, as),
 		progress: async (channel, event) => {
 			await of(channel)?.progress?.(channel, event);
 		},

package/src/core/runtime/extensions/approval-card.ts

@@ -5,6 +5,7 @@ import { messages } from "../../i18n/index.ts";
 import type { ApprovalDetails } from "../../interactions/prompts.ts";
 import { fieldList, schemaFields } from "./approval-fields.ts";
 import { countPoints, firstPoints, prefix } from "./card-text.ts";
+import { isPlainObject } from "./held-calls.ts";
 
 /** The fewest characters of a long string value in a held call's input its approval card keeps, when the input does not fit whole. */
 const CARD_VALUE_CHARS = 200;
@@ -193,8 +194,3 @@ function fileSize(path: string, workspace: string | undefined) {
 		return undefined;
 	}
 }
-
-// pi-lens-ignore: no-unknown-parameters — tool input is untyped model JSON; this is where it is read
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}

package/src/core/runtime/extensions/approval-fields.ts

@@ -1,5 +1,6 @@
 import { messages } from "../../i18n/index.ts";
 import { countPoints, firstPoints } from "./card-text.ts";
+import { isPlainObject } from "./held-calls.ts";
 
 /** The longest label a card shows for a field, in code points. */
 const LABEL_CHARS = 40;
@@ -27,11 +28,6 @@ export interface FieldLimits {
 	totalChars: number;
 }
 
-// pi-lens-ignore: no-unknown-parameters — a tool's parameter schema is untyped JSON
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-
 /**
  * The arguments of a call in the order its tool's parameter schema lists them, each labelled by
  * its property's `title` or else its name; absent arguments are left out, and an argument the
@@ -43,7 +39,7 @@ export function schemaFields(
 	// pi-lens-ignore: no-unknown-parameters — a tool's parameter schema is untyped JSON
 	schema: unknown,
 ): CardField[] | undefined {
-	if (!input || !isRecord(schema) || !isRecord(schema.properties))
+	if (!input || !isPlainObject(schema) || !isPlainObject(schema.properties))
 		return undefined;
 	const properties = schema.properties;
 	const fields: CardField[] = [];
@@ -53,7 +49,7 @@ export function schemaFields(
 		const value = input[name];
 		if (value === undefined) continue;
 		const title =
-			isRecord(property) && typeof property.title === "string"
+			isPlainObject(property) && typeof property.title === "string"
 				? property.title.trim()
 				: "";
 		fields.push({ label: title || name, value });

package/src/core/runtime/extensions/confirmation-gate-extension.ts

@@ -38,8 +38,9 @@ export function confirmationGateExtension(
 			const turn: HoldTurn | undefined = turnOf
 				? { toolTurn: turnOf, ...(ctx.signal ? { signal: ctx.signal } : {}) }
 				: undefined;
-			const { reason, approvedOnCard, approvedBy, approvedPrompt, refused } =
-				await gate.decide(
+			let decision: Awaited<ReturnType<ConfirmationGate["decide"]>>;
+			try {
+				decision = await gate.decide(
 					event.toolName,
 					event.input as Record<string, unknown>,
 					ask,
@@ -48,6 +49,16 @@ export function confirmationGateExtension(
 					pi.getAllTools?.().find((tool) => tool.name === event.toolName)
 						?.parameters,
 				);
+			} catch (error) {
+				// A hold rule that fails must not let the call run unjudged.
+				if (ctx.signal?.aborted) throw error;
+				return {
+					block: true,
+					reason: `The call was blocked because its safety check failed (${error instanceof Error ? error.message : String(error)}). It was not run.`,
+				};
+			}
+			const { reason, approvedOnCard, approvedBy, approvedPrompt, refused } =
+				decision;
 			if (approvedOnCard) approved.add(event.toolCallId);
 			if (!reason && (approvedBy || approvedPrompt))
 				gate.grant(event.toolCallId, {

package/src/core/runtime/extensions/confirmation-gate.ts

@@ -2,7 +2,6 @@ import type {
 	HeldCall,
 	PendingConfirmation,
 } from "../../domain/conversation.ts";
-import type { HoldRefusal } from "../../domain/progress.ts";
 import {
 	HOLD_DESCRIBE_TIMEOUT_MS,
 	type HoldCheck,
@@ -12,19 +11,17 @@ import {
 } from "../../holds.ts";
 import { messages } from "../../i18n/index.ts";
 import type { OwnerIdentity } from "../../identity.ts";
-import type {
-	ApprovedBy,
-	LateAnswer,
-	Prompts,
-} from "../../interactions/prompts.ts";
+import type { ApprovedBy, Prompts } from "../../interactions/prompts.ts";
 import type { ToolTiers } from "../../tool-tiers.ts";
 import { approvalCard, approvalDetails } from "./approval-card.ts";
 import { askOnCard } from "./card-ask.ts";
 import {
+	type AutoApprover,
 	approverOf,
 	askSpeaker,
 	awaitingText,
 	declinedText,
+	type GateDecision,
 	type Needing,
 	namesOf,
 	type Release,
@@ -39,6 +36,7 @@ import {
 	mayApproveNamed,
 	namedApprover,
 	sameCall,
+	spendApproval,
 	unexpired,
 } from "./held-calls.ts";
 import { HoldDescriber } from "./hold-describer.ts";
@@ -55,8 +53,9 @@ export {
 	unexpired,
 } from "./held-calls.ts";
 
-import { type Watch, Withdrawals } from "./withdrawals.ts";
+import { Withdrawals } from "./withdrawals.ts";
 
+export type { AutoApprover, GateDecision } from "./gate-refusals.ts";
 export type { HoldTurn } from "./hold-lookups.ts";
 
 /**
@@ -73,6 +72,8 @@ export class ConfirmationGate {
 	#speaker: SpeakerRef | undefined;
 	/** Whether the running turn's conversation is private to its speaker, who then alone answers its cards. */
 	#private = false;
+	/** The running turn's auto-approver, asked before any card opens. */
+	#auto: AutoApprover | undefined;
 	#pending: PendingConfirmation | undefined;
 	#approved: Release[] = [];
 	/** Calls approved on their cards after the turn that asked stopped waiting; each runs once, in any turn. */
@@ -160,7 +161,8 @@ export class ConfirmationGate {
 	 * approve them. When `confirmed`, the speaker's message approved the held calls, and they are
 	 * the approver the calls' `run` sees; a call that named approvers is released only when the
 	 * speaker is one of them or an owner, and otherwise stays held. `isPrivate` says the turn's
-	 * conversation is private to its speaker: they alone then answer its cards.
+	 * conversation is private to its speaker: they alone then answer its cards. `auto` may approve
+	 * a call the turn makes without a card (yolo mode); it does not change a message's approval.
 	 */
 	beginTurn(
 		selectionId: string,
@@ -168,10 +170,12 @@ export class ConfirmationGate {
 		addressee?: OwnerIdentity,
 		speaker?: SpeakerRef,
 		isPrivate = false,
+		auto?: AutoApprover,
 	): void {
 		this.#selectionId = selectionId;
 		this.#speaker = speaker;
 		this.#private = isPrivate;
+		this.#auto = auto;
 		this.#addressee = addressee ?? this.#owner;
 		const by = approverOf(speaker);
 		const held = this.pending();
@@ -287,16 +291,7 @@ export class ConfirmationGate {
 		ask?: { prompts: Prompts; asker: string; signal?: AbortSignal },
 		turn?: HoldTurn,
 		parameters?: unknown,
-	): Promise<{
-		reason?: string;
-		approvedOnCard?: true;
-		/** Who approved the call, when it was held and a surface or a confirming message said who. */
-		approvedBy?: ApprovedBy;
-		/** The id of the card whose approval released the call, in this turn or answered late; absent for a call a message confirmed. */
-		approvedPrompt?: string;
-		/** Why a hold refused the call, for a surface that tells that from a failure; absent when it ran or the turn stopped. */
-		refused?: HoldRefusal;
-	}> {
+	): Promise<GateDecision> {
 		const found = this.#needingIn(tool, input, turn);
 		const needing = isPromise(found) ? await found : found;
 		if (needing === STOPPED) return { reason: "The turn was stopped." };
@@ -320,6 +315,14 @@ export class ConfirmationGate {
 			if (watch) watch.card = false;
 			return { reason: await this.#held(call), refused };
 		};
+		// Outside a turn there is no speaker whose conversation could be in yolo mode.
+		const auto = turn
+			? this.#auto?.(call, { speakerOnly: needing.speakerOnly === true })
+			: undefined;
+		if (auto) {
+			watch?.end();
+			return { approvedBy: auto };
+		}
 		if (!ask) return held("held");
 		// In a private conversation only its person answers: a call that names others is not theirs.
 		if (this.#private && !mayApproveNamed(this.#speaker, call))
@@ -331,7 +334,14 @@ export class ConfirmationGate {
 				message: approvalCard(call, this.#fileRoot, {}, parameters),
 				signal: ask.signal,
 				minTier: higherTier(this.#tiers?.minTier(call.tool), call.minTier),
-				wait: { late: (late) => this.#late(call, late, watch) },
+				wait: {
+					// A late answer on the card: the text of the turn that tells the model, and the release it earned.
+					late: (late) => {
+						const outcome = lateOutcome(call, late, watch);
+						if (outcome?.release) this.#lateApproved.push(outcome.release);
+						return outcome?.text;
+					},
+				},
 				details: approvalDetails(call, this.#fileRoot, needing.copy),
 				approvers: call.approverIds,
 				speakerOnly: needing.speakerOnly === true,
@@ -377,21 +387,12 @@ export class ConfirmationGate {
 		return held(answer === "unavailable" ? "held" : "expired");
 	}
 
-	/** A late answer on a call's card; see `lateOutcome`. Returns the text of the turn that tells the model. */
-	#late(
-		call: HeldCall,
-		late: LateAnswer,
-		watch: Watch | undefined,
-	): string | undefined {
-		const outcome = lateOutcome(call, late, watch);
-		if (outcome?.release) this.#lateApproved.push(outcome.release);
-		return outcome?.text;
-	}
-
 	/** What a call needs when a rule holds it; undefined when none does. */
 	#needing(tool: string, input: Record<string, unknown>): Needing | undefined {
 		const action = this.#holds(tool, input, this.#context);
-		return action ? this.#unlessApproved(tool, input, { action }) : undefined;
+		if (!action) return undefined;
+		const classes = this.#holds.classesOf?.(tool, input, this.#context);
+		return this.#unlessApproved(tool, input, { action, classes });
 	}
 
 	/**
@@ -431,17 +432,17 @@ export class ConfirmationGate {
 			action: judged.action,
 			...(minTier ? { minTier } : {}),
 			...(judged.approvers ? { approverIds: [...judged.approvers] } : {}),
+			...(judged.classes && judged.classes.length > 0
+				? { holdClasses: [...judged.classes] }
+				: {}),
 		};
 		// A plugin that already withdrew the call lets no approval of it release it.
-		for (const released of judged.supersede?.aborted
-			? []
-			: [this.#approved, this.#lateApproved]) {
-			const approved = released.findIndex((r) => sameCall(r.call, call));
-			const [spent] = approved === -1 ? [] : released.splice(approved, 1);
-			if (spent) {
-				this.#withdrawals.endCall(spent.call);
-				return { released: spent };
-			}
+		const spent = judged.supersede?.aborted
+			? undefined
+			: spendApproval([this.#approved, this.#lateApproved], call);
+		if (spent) {
+			this.#withdrawals.endCall(spent.call);
+			return { released: spent };
 		}
 		return {
 			held: call,