thaddeus 1.0.26 → 1.0.28

package/src/integrations/providers/TwilioProvider.js

@@ -0,0 +1,239 @@
+/**
+ * Twilio Provider -- API key-based (no OAuth)
+ * Actions: sendSMS, listMessages, makeCall, listCalls, getPhoneNumbers
+ */
+import { BaseProvider } from './BaseProvider.js';
+export class TwilioProvider extends BaseProvider {
+    accountSid = '';
+    authToken = '';
+    phoneNumber = '';
+    constructor() {
+        super('twilio', 'Twilio', 'api_key');
+    }
+    getConfigFields() {
+        return [
+            { name: 'accountSid', label: 'Twilio Account SID' },
+            { name: 'authToken', label: 'Twilio Auth Token', secret: true },
+            { name: 'phoneNumber', label: 'Twilio Phone Number (E.164)' },
+        ];
+    }
+    async configure(credentials) {
+        this.accountSid = credentials.accountSid || '';
+        this.authToken = credentials.authToken || '';
+        this.phoneNumber = credentials.phoneNumber || '';
+        this.tokenData = {
+            access_token: this.authToken,
+            account_sid: this.accountSid,
+            phone_number: this.phoneNumber,
+            type: 'api_key',
+        };
+    }
+    loadCredentials(tokenData) {
+        if (tokenData) {
+            this.authToken = tokenData.access_token || '';
+            this.accountSid = tokenData.account_sid || '';
+            this.phoneNumber = tokenData.phone_number || '';
+            this.tokenData = tokenData;
+        }
+    }
+    exportCredentials() {
+        if (!this.isConnected())
+            return null;
+        return {
+            access_token: this.authToken,
+            account_sid: this.accountSid,
+            phone_number: this.phoneNumber,
+            type: 'api_key',
+        };
+    }
+    isConnected() {
+        return !!this.accountSid && !!this.authToken && this.accountSid.startsWith('AC');
+    }
+    disconnect() {
+        this.accountSid = '';
+        this.authToken = '';
+        this.phoneNumber = '';
+        this.tokenData = null;
+    }
+    // Twilio uses Basic auth
+    async apiRequest(url, options = {}) {
+        const auth = Buffer.from(`${this.accountSid}:${this.authToken}`).toString('base64');
+        const headers = {
+            'Authorization': `Basic ${auth}`,
+            ...(options.headers || {}),
+        };
+        if (options.method === 'POST' && !headers['Content-Type']) {
+            headers['Content-Type'] = 'application/x-www-form-urlencoded';
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 30000);
+        try {
+            return await fetch(url, { ...options, headers, signal: controller.signal });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async testConnection() {
+        const start = Date.now();
+        try {
+            const resp = await this.apiRequest(`https://api.twilio.com/2010-04-01/Accounts/${this.accountSid}.json`);
+            if (!resp.ok)
+                return { success: false, message: `Twilio API returned ${resp.status}` };
+            const data = (await resp.json());
+            return { success: true, message: `Connected: ${data.friendly_name || this.accountSid}`, latencyMs: Date.now() - start };
+        }
+        catch (err) {
+            return { success: false, message: `Twilio test failed: ${err instanceof Error ? err.message : String(err)}` };
+        }
+    }
+    // ── Twilio API ────────────────────────────────────────────────────────
+    baseUrl() {
+        return `https://api.twilio.com/2010-04-01/Accounts/${this.accountSid}`;
+    }
+    async sendSMS(to, body) {
+        if (!/^\+[1-9]\d{1,14}$/.test(to))
+            throw new Error(`Invalid phone: "${to}". Use E.164 format.`);
+        if (!this.phoneNumber)
+            throw new Error('No phone number configured.');
+        const params = new URLSearchParams({ To: to, From: this.phoneNumber, Body: body });
+        const resp = await this.apiRequest(`${this.baseUrl()}/Messages.json`, { method: 'POST', body: params.toString() });
+        if (!resp.ok) {
+            const err = await resp.text();
+            throw new Error(`Twilio send failed (${resp.status}): ${err}`);
+        }
+        return (await resp.json());
+    }
+    async listSMSMessages(limit = 20) {
+        const resp = await this.apiRequest(`${this.baseUrl()}/Messages.json?PageSize=${limit}`);
+        if (!resp.ok)
+            throw new Error(`Twilio list messages failed: ${resp.status}`);
+        const data = (await resp.json());
+        return (data.messages || []).map(m => ({
+            sid: m.sid, to: m.to, from: m.from, body: m.body,
+            status: m.status, direction: m.direction, date: m.date_sent || m.date_created || '',
+        }));
+    }
+    async makeCall(to, twiml) {
+        if (!/^\+[1-9]\d{1,14}$/.test(to))
+            throw new Error(`Invalid phone: "${to}". Use E.164 format.`);
+        if (!this.phoneNumber)
+            throw new Error('No phone number configured.');
+        const params = new URLSearchParams({
+            To: to,
+            From: this.phoneNumber,
+            Twiml: twiml || '<Response><Say>Hello from Thaddeus AI.</Say></Response>',
+        });
+        const resp = await this.apiRequest(`${this.baseUrl()}/Calls.json`, { method: 'POST', body: params.toString() });
+        if (!resp.ok) {
+            const err = await resp.text();
+            throw new Error(`Twilio call failed (${resp.status}): ${err}`);
+        }
+        return (await resp.json());
+    }
+    async listCalls(limit = 20) {
+        const resp = await this.apiRequest(`${this.baseUrl()}/Calls.json?PageSize=${limit}`);
+        if (!resp.ok)
+            throw new Error(`Twilio list calls failed: ${resp.status}`);
+        const data = (await resp.json());
+        return (data.calls || []).map(c => ({
+            sid: c.sid, to: c.to, from: c.from, status: c.status,
+            direction: c.direction, duration: c.duration || '0', date: c.start_time || c.date_created || '',
+        }));
+    }
+    async getPhoneNumbers() {
+        const resp = await this.apiRequest(`${this.baseUrl()}/IncomingPhoneNumbers.json?PageSize=20`);
+        if (!resp.ok)
+            throw new Error(`Twilio phone numbers failed: ${resp.status}`);
+        const data = (await resp.json());
+        return (data.incoming_phone_numbers || []).map(p => ({
+            sid: p.sid, phone: p.phone_number, friendlyName: p.friendly_name,
+            sms: p.capabilities?.sms ?? false, voice: p.capabilities?.voice ?? false,
+        }));
+    }
+    // ── Action interface ──────────────────────────────────────────────────
+    getActions() {
+        return [
+            {
+                name: 'sendSMS',
+                description: 'Send an SMS text message via Twilio.',
+                parameters: {
+                    to: { type: 'string', description: 'Recipient phone number in E.164 format (e.g. "+15551234567")' },
+                    message: { type: 'string', description: 'Text message body' },
+                },
+                requiredParams: ['to', 'message'],
+            },
+            {
+                name: 'listMessages',
+                description: 'List recent SMS messages sent/received.',
+                parameters: {
+                    count: { type: 'number', description: 'Number of messages to list (default 20)' },
+                },
+                requiredParams: [],
+            },
+            {
+                name: 'makeCall',
+                description: 'Make a phone call via Twilio.',
+                parameters: {
+                    to: { type: 'string', description: 'Phone number to call in E.164 format' },
+                    twiml: { type: 'string', description: 'TwiML XML for what to say (default: greeting)' },
+                },
+                requiredParams: ['to'],
+            },
+            {
+                name: 'listCalls',
+                description: 'List recent phone calls made/received.',
+                parameters: {
+                    count: { type: 'number', description: 'Number of calls to list (default 20)' },
+                },
+                requiredParams: [],
+            },
+            {
+                name: 'getPhoneNumbers',
+                description: 'List all phone numbers on the Twilio account.',
+                parameters: {},
+                requiredParams: [],
+            },
+        ];
+    }
+    async executeAction(actionName, params) {
+        try {
+            switch (actionName) {
+                case 'sendSMS': {
+                    const result = await this.sendSMS(params.to, params.message);
+                    return { success: true, output: `SMS sent to ${result.to}\nStatus: ${result.status}\nSID: ${result.sid}` };
+                }
+                case 'listMessages': {
+                    const msgs = await this.listSMSMessages(params.count || 20);
+                    if (msgs.length === 0)
+                        return { success: true, output: 'No messages found.' };
+                    const formatted = msgs.map((m, i) => `${i + 1}. ${m.direction === 'inbound' ? '<-' : '->'} ${m.direction === 'inbound' ? m.from : m.to} -- ${m.status}\n   "${m.body}"\n   ${m.date}`).join('\n\n');
+                    return { success: true, output: `${msgs.length} messages:\n\n${formatted}` };
+                }
+                case 'makeCall': {
+                    const result = await this.makeCall(params.to, params.twiml);
+                    return { success: true, output: `Call initiated to ${result.to}\nStatus: ${result.status}\nSID: ${result.sid}` };
+                }
+                case 'listCalls': {
+                    const calls = await this.listCalls(params.count || 20);
+                    if (calls.length === 0)
+                        return { success: true, output: 'No calls found.' };
+                    const formatted = calls.map((c, i) => `${i + 1}. ${c.direction === 'inbound' ? '<-' : '->'} ${c.direction === 'inbound' ? c.from : c.to} -- ${c.status}\n   Duration: ${c.duration}s | ${c.date}`).join('\n\n');
+                    return { success: true, output: `${calls.length} calls:\n\n${formatted}` };
+                }
+                case 'getPhoneNumbers': {
+                    const numbers = await this.getPhoneNumbers();
+                    if (numbers.length === 0)
+                        return { success: true, output: 'No phone numbers on this account.' };
+                    const formatted = numbers.map((n, i) => `${i + 1}. ${n.phone} -- ${n.friendlyName}\n   SMS: ${n.sms ? 'yes' : 'no'} | Voice: ${n.voice ? 'yes' : 'no'}`).join('\n');
+                    return { success: true, output: `${numbers.length} phone numbers:\n${formatted}` };
+                }
+                default:
+                    return { success: false, output: `Unknown Twilio action: ${actionName}` };
+            }
+        }
+        catch (err) {
+            return { success: false, output: `Twilio error: ${err instanceof Error ? err.message : String(err)}` };
+        }
+    }
+}

package/src/integrations/providers/_template.js

@@ -0,0 +1,112 @@
+/**
+ * _template.ts -- Template for creating new integration providers.
+ *
+ * To create a new provider:
+ * 1. Copy this file to a new file named <YourService>Provider.ts
+ * 2. Replace all TODO markers with your implementation
+ * 3. Register the provider in integrationManager.ts (providerRegistry)
+ * 4. Test with: Integrations action=configure provider=<your-id>
+ *
+ * Auth types:
+ * - 'oauth2': User goes through OAuth flow. Implement exchangeCode() etc.
+ * - 'api_key': User provides an API key. Override configure/isConnected/loadCredentials.
+ * - 'basic':   User provides username + password/token.
+ */
+import { BaseProvider } from './BaseProvider.js';
+export class TemplateProvider extends BaseProvider {
+    // TODO: For api_key providers, add private fields:
+    // private apiKey = ''
+    constructor() {
+        super('template', // TODO: unique provider slug
+        'Template Service', // TODO: human-readable display name
+        'oauth2');
+        // TODO: For OAuth providers, set oauthConfig:
+        this.oauthConfig = {
+            authUrl: 'https://example.com/oauth/authorize',
+            tokenUrl: 'https://example.com/oauth/token',
+            clientId: '',
+            clientSecret: '',
+            scopes: ['read', 'write'],
+        };
+    }
+    // ── Configuration ─────────────────────────────────────────────────────
+    getConfigFields() {
+        // TODO: Return the fields users must provide.
+        // For OAuth: clientId + clientSecret
+        // For API key: just the key
+        return [
+            { name: 'clientId', label: 'Client ID' },
+            { name: 'clientSecret', label: 'Client Secret', secret: true },
+        ];
+    }
+    async configure(credentials) {
+        // TODO: For OAuth:
+        if (this.oauthConfig) {
+            this.oauthConfig.clientId = credentials.clientId || '';
+            this.oauthConfig.clientSecret = credentials.clientSecret || '';
+        }
+        // TODO: For API key:
+        // this.apiKey = credentials.apiKey || ''
+        // this.tokenData = { access_token: this.apiKey, type: 'api_key' }
+    }
+    // TODO: For API key providers, override these:
+    // loadCredentials(tokenData: TokenData | null): void { ... }
+    // exportCredentials(): TokenData | null { ... }
+    // isConnected(): boolean { ... }
+    // disconnect(): void { ... }
+    // ── Connection test ───────────────────────────────────────────────────
+    async testConnection() {
+        const start = Date.now();
+        try {
+            // TODO: Make a lightweight API call to verify credentials work
+            const resp = await this.apiRequest('https://api.example.com/v1/me');
+            if (!resp.ok)
+                return { success: false, message: `API returned ${resp.status}` };
+            return { success: true, message: 'Connected successfully', latencyMs: Date.now() - start };
+        }
+        catch (err) {
+            return { success: false, message: `Test failed: ${err instanceof Error ? err.message : String(err)}` };
+        }
+    }
+    // ── API methods ───────────────────────────────────────────────────────
+    // TODO: Implement your service-specific API methods here.
+    // Keep them private. They throw on error -- the action handler catches.
+    // private async listItems(): Promise<Array<{ id: string; name: string }>> { ... }
+    // private async createItem(name: string): Promise<{ id: string }> { ... }
+    // ── Actions ───────────────────────────────────────────────────────────
+    getActions() {
+        // TODO: Define 2-3+ actions minimum
+        return [
+            {
+                name: 'listItems',
+                description: 'List items from the service.',
+                parameters: {
+                    count: { type: 'number', description: 'Number of items to list (default 20)' },
+                },
+                requiredParams: [],
+            },
+            {
+                name: 'createItem',
+                description: 'Create a new item.',
+                parameters: {
+                    name: { type: 'string', description: 'Item name' },
+                },
+                requiredParams: ['name'],
+            },
+        ];
+    }
+    async executeAction(actionName, params) {
+        try {
+            switch (actionName) {
+                // TODO: Implement each action
+                // case 'listItems': { ... }
+                // case 'createItem': { ... }
+                default:
+                    return { success: false, output: `Unknown action: ${actionName}` };
+            }
+        }
+        catch (err) {
+            return { success: false, output: `Error: ${err instanceof Error ? err.message : String(err)}` };
+        }
+    }
+}

package/src/integrations/types.js

@@ -0,0 +1,7 @@
+/**
+ * Integration system type definitions.
+ *
+ * Defines the provider interface, auth types, credential storage format,
+ * and tool result types used across all integration providers.
+ */
+export {};

package/src/interactiveHelpers.js

@@ -0,0 +1,308 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { feature } from 'bun:bundle';
+import { appendFileSync } from 'fs';
+import React from 'react';
+import { logEvent } from 'src/services/analytics/index.js';
+import { gracefulShutdown, gracefulShutdownSync } from 'src/utils/gracefulShutdown.js';
+import { getAllowedChannels, setAllowedChannels, setHasDevChannels, setSessionTrustAccepted, setStatsStore } from './bootstrap/state.js';
+import { createStatsStore } from './context/stats.js';
+import { getSystemContext } from './context.js';
+import { initializeTelemetryAfterTrust } from './entrypoints/init.js';
+import { isSynchronizedOutputSupported } from './ink/terminal.js';
+import { KeybindingSetup } from './keybindings/KeybindingProviderSetup.js';
+import { startDeferredPrefetches } from './main.js';
+import { checkGate_CACHED_OR_BLOCKING, initializeGrowthBook, resetGrowthBook } from './services/analytics/growthbook.js';
+import { isQualifiedForGrove } from './services/api/grove.js';
+import { handleMcpjsonServerApprovals } from './services/mcpServerApproval.js';
+import { AppStateProvider } from './state/AppState.js';
+import { onChangeAppState } from './state/onChangeAppState.js';
+import { normalizeApiKeyForConfig } from './utils/authPortable.js';
+import { getExternalClaudeMdIncludes, getMemoryFiles, shouldShowClaudeMdExternalIncludesWarning } from './utils/claudemd.js';
+import { checkHasTrustDialogAccepted, getCustomApiKeyStatus, getGlobalConfig, saveGlobalConfig } from './utils/config.js';
+import { updateDeepLinkTerminalPreference } from './utils/deepLink/terminalPreference.js';
+import { isEnvTruthy, isRunningOnHomespace } from './utils/envUtils.js';
+import { FpsTracker } from './utils/fpsTracker.js';
+import { updateGithubRepoPathMapping } from './utils/githubRepoPathMapping.js';
+import { applyConfigEnvironmentVariables } from './utils/managedEnv.js';
+import { getBaseRenderOptions } from './utils/renderOptions.js';
+import { getSettingsWithAllErrors } from './utils/settings/allErrors.js';
+import { hasAutoModeOptIn, hasSkipDangerousModePermissionPrompt } from './utils/settings/settings.js';
+export function completeOnboarding() {
+    saveGlobalConfig(current => ({
+        ...current,
+        hasCompletedOnboarding: true,
+        lastOnboardingVersion: MACRO.VERSION
+    }));
+}
+export function showDialog(root, renderer) {
+    return new Promise(resolve => {
+        const done = (result) => void resolve(result);
+        root.render(renderer(done));
+    });
+}
+/**
+ * Render an error message through Ink, then unmount and exit.
+ * Use this for fatal errors after the Ink root has been created —
+ * console.error is swallowed by Ink's patchConsole, so we render
+ * through the React tree instead.
+ */
+export async function exitWithError(root, message, beforeExit) {
+    return exitWithMessage(root, message, {
+        color: 'error',
+        beforeExit
+    });
+}
+/**
+ * Render a message through Ink, then unmount and exit.
+ * Use this for messages after the Ink root has been created —
+ * console output is swallowed by Ink's patchConsole, so we render
+ * through the React tree instead.
+ */
+export async function exitWithMessage(root, message, options) {
+    const { Text } = await import('./ink.js');
+    const color = options?.color;
+    const exitCode = options?.exitCode ?? 1;
+    root.render(color ? _jsx(Text, { color: color, children: message }) : _jsx(Text, { children: message }));
+    root.unmount();
+    await options?.beforeExit?.();
+    // eslint-disable-next-line custom-rules/no-process-exit -- exit after Ink unmount
+    process.exit(exitCode);
+}
+/**
+ * Show a setup dialog wrapped in AppStateProvider + KeybindingSetup.
+ * Reduces boilerplate in showSetupScreens() where every dialog needs these wrappers.
+ */
+export function showSetupDialog(root, renderer, options) {
+    return showDialog(root, done => _jsx(AppStateProvider, { onChangeAppState: options?.onChangeAppState, children: _jsx(KeybindingSetup, { children: renderer(done) }) }));
+}
+/**
+ * Render the main UI into the root and wait for it to exit.
+ * Handles the common epilogue: start deferred prefetches, wait for exit, graceful shutdown.
+ */
+export async function renderAndRun(root, element) {
+    root.render(element);
+    startDeferredPrefetches();
+    await root.waitUntilExit();
+    await gracefulShutdown(0);
+}
+export async function showSetupScreens(root, permissionMode, allowDangerouslySkipPermissions, commands, claudeInChrome, devChannels) {
+    if ("production" === 'test' || isEnvTruthy(false) || process.env.IS_DEMO // Skip onboarding in demo mode
+    ) {
+        return false;
+    }
+    const config = getGlobalConfig();
+    let onboardingShown = false;
+    if (!config.theme || !config.hasCompletedOnboarding // always show onboarding at least once
+    ) {
+        onboardingShown = true;
+        const { Onboarding } = await import('./components/Onboarding.js');
+        await showSetupDialog(root, done => _jsx(Onboarding, { onDone: () => {
+                completeOnboarding();
+                void done();
+            } }), {
+            onChangeAppState
+        });
+    }
+    // Always show the trust dialog in interactive sessions, regardless of permission mode.
+    // The trust dialog is the workspace trust boundary — it warns about untrusted repos
+    // and checks THADDEUS.md external includes. bypassPermissions mode
+    // only affects tool execution permissions, not workspace trust.
+    // Note: non-interactive sessions (CI/CD with -p) never reach showSetupScreens at all.
+    // Skip permission checks in claubbit
+    if (!isEnvTruthy(process.env.CLAUBBIT)) {
+        // Fast-path: skip TrustDialog import+render when CWD is already trusted.
+        // If it returns true, the TrustDialog would auto-resolve regardless of
+        // security features, so we can skip the dynamic import and render cycle.
+        if (!checkHasTrustDialogAccepted()) {
+            const { TrustDialog } = await import('./components/TrustDialog/TrustDialog.js');
+            await showSetupDialog(root, done => _jsx(TrustDialog, { commands: commands, onDone: done }));
+        }
+        // Signal that trust has been verified for this session.
+        // GrowthBook checks this to decide whether to include auth headers.
+        setSessionTrustAccepted(true);
+        // Reset and reinitialize GrowthBook after trust is established.
+        // Defense for login/logout: clears any prior client so the next init
+        // picks up fresh auth headers.
+        resetGrowthBook();
+        void initializeGrowthBook();
+        // Now that trust is established, prefetch system context if it wasn't already
+        void getSystemContext();
+        // If settings are valid, check for any mcp.json servers that need approval
+        const { errors: allErrors } = getSettingsWithAllErrors();
+        if (allErrors.length === 0) {
+            await handleMcpjsonServerApprovals(root);
+        }
+        // Check for claude.md includes that need approval
+        if (await shouldShowClaudeMdExternalIncludesWarning()) {
+            const externalIncludes = getExternalClaudeMdIncludes(await getMemoryFiles(true));
+            const { ClaudeMdExternalIncludesDialog } = await import('./components/ClaudeMdExternalIncludesDialog.js');
+            await showSetupDialog(root, done => _jsx(ClaudeMdExternalIncludesDialog, { onDone: done, isStandaloneDialog: true, externalIncludes: externalIncludes }));
+        }
+    }
+    // Track current repo path for teleport directory switching (fire-and-forget)
+    // This must happen AFTER trust to prevent untrusted directories from poisoning the mapping
+    void updateGithubRepoPathMapping();
+    if (feature('LODESTONE')) {
+        updateDeepLinkTerminalPreference();
+    }
+    // Apply full environment variables after trust dialog is accepted OR in bypass mode
+    // In bypass mode (CI/CD, automation), we trust the environment so apply all variables
+    // In normal mode, this happens after the trust dialog is accepted
+    // This includes potentially dangerous environment variables from untrusted sources
+    applyConfigEnvironmentVariables();
+    // Initialize telemetry after env vars are applied so OTEL endpoint env vars and
+    // otelHeadersHelper (which requires trust to execute) are available.
+    // Defer to next tick so the OTel dynamic import resolves after first render
+    // instead of during the pre-render microtask queue.
+    setImmediate(() => initializeTelemetryAfterTrust());
+    if (await isQualifiedForGrove()) {
+        const { GroveDialog } = await import('src/components/grove/Grove.js');
+        const decision = await showSetupDialog(root, done => _jsx(GroveDialog, { showIfAlreadyViewed: false, location: onboardingShown ? 'onboarding' : 'policy_update_modal', onDone: done }));
+        if (decision === 'escape') {
+            logEvent('thaddeus_grove_policy_exited', {});
+            gracefulShutdownSync(0);
+            return false;
+        }
+    }
+    // Check for custom API key
+    // On homespace, ANTHROPIC_API_KEY is preserved in process.env for child
+    // processes but ignored by Thaddeus itself (see auth.ts).
+    if (process.env.ANTHROPIC_API_KEY && !isRunningOnHomespace() && !isEnvTruthy(process.env.THADDEUS_USE_XAI)) {
+        const customApiKeyTruncated = normalizeApiKeyForConfig(process.env.ANTHROPIC_API_KEY);
+        const keyStatus = getCustomApiKeyStatus(customApiKeyTruncated);
+        if (keyStatus === 'new') {
+            const { ApproveApiKey } = await import('./components/ApproveApiKey.js');
+            await showSetupDialog(root, done => _jsx(ApproveApiKey, { customApiKeyTruncated: customApiKeyTruncated, onDone: done }), {
+                onChangeAppState
+            });
+        }
+    }
+    if ((permissionMode === 'bypassPermissions' || allowDangerouslySkipPermissions) && !hasSkipDangerousModePermissionPrompt()) {
+        const { BypassPermissionsModeDialog } = await import('./components/BypassPermissionsModeDialog.js');
+        await showSetupDialog(root, done => _jsx(BypassPermissionsModeDialog, { onAccept: done }));
+    }
+    if (feature('TRANSCRIPT_CLASSIFIER')) {
+        // Only show the opt-in dialog if auto mode actually resolved — if the
+        // gate denied it (org not allowlisted, settings disabled), showing
+        // consent for an unavailable feature is pointless. The
+        // verifyAutoModeGateAccess notification will explain why instead.
+        if (permissionMode === 'auto' && !hasAutoModeOptIn()) {
+            const { AutoModeOptInDialog } = await import('./components/AutoModeOptInDialog.js');
+            await showSetupDialog(root, done => _jsx(AutoModeOptInDialog, { onAccept: done, onDecline: () => gracefulShutdownSync(1), declineExits: true }));
+        }
+    }
+    // --dangerously-load-development-channels confirmation. On accept, append
+    // dev channels to any --channels list already set in main.tsx. Org policy
+    // is NOT bypassed — gateChannelServer() still runs; this flag only exists
+    // to sidestep the --channels approved-server allowlist.
+    if (feature('KAIROS') || feature('KAIROS_CHANNELS')) {
+        // gateChannelServer and ChannelsNotice read thaddeus_harbor after this
+        // function returns. A cold disk cache (fresh install, or first run after
+        // the flag was added server-side) defaults to false and silently drops
+        // channel notifications for the whole session — gh#37026.
+        // checkGate_CACHED_OR_BLOCKING returns immediately if disk already says
+        // true; only blocks on a cold/stale-false cache (awaits the same memoized
+        // initializeGrowthBook promise fired earlier). Also warms the
+        // isChannelsEnabled() check in the dev-channels dialog below.
+        if (getAllowedChannels().length > 0 || (devChannels?.length ?? 0) > 0) {
+            await checkGate_CACHED_OR_BLOCKING('thaddeus_harbor');
+        }
+        if (devChannels && devChannels.length > 0) {
+            const [{ isChannelsEnabled }, { getClaudeAIOAuthTokens }] = await Promise.all([import('./services/mcp/channelAllowlist.js'), import('./utils/auth.js')]);
+            // Skip the dialog when channels are blocked (thaddeus_harbor off or no
+            // OAuth) — accepting then immediately seeing "not available" in
+            // ChannelsNotice is worse than no dialog. Append entries anyway so
+            // ChannelsNotice renders the blocked branch with the dev entries
+            // named. dev:true here is for the flag label in ChannelsNotice
+            // (hasNonDev check); the allowlist bypass it also grants is moot
+            // since the gate blocks upstream.
+            if (!isChannelsEnabled() || !getClaudeAIOAuthTokens()?.accessToken) {
+                setAllowedChannels([...getAllowedChannels(), ...devChannels.map(c => ({
+                        ...c,
+                        dev: true
+                    }))]);
+                setHasDevChannels(true);
+            }
+            else {
+                const { DevChannelsDialog } = await import('./components/DevChannelsDialog.js');
+                await showSetupDialog(root, done => _jsx(DevChannelsDialog, { channels: devChannels, onAccept: () => {
+                        // Mark dev entries per-entry so the allowlist bypass doesn't leak
+                        // to --channels entries when both flags are passed.
+                        setAllowedChannels([...getAllowedChannels(), ...devChannels.map(c => ({
+                                ...c,
+                                dev: true
+                            }))]);
+                        setHasDevChannels(true);
+                        void done();
+                    } }));
+            }
+        }
+    }
+    // Show Chrome onboarding for first-time Claude in Chrome users
+    if (claudeInChrome && !getGlobalConfig().hasCompletedClaudeInChromeOnboarding) {
+        const { ClaudeInChromeOnboarding } = await import('./components/ClaudeInChromeOnboarding.js');
+        await showSetupDialog(root, done => _jsx(ClaudeInChromeOnboarding, { onDone: done }));
+    }
+    return onboardingShown;
+}
+export function getRenderContext(exitOnCtrlC) {
+    let lastFlickerTime = 0;
+    const baseOptions = getBaseRenderOptions(exitOnCtrlC);
+    // Log analytics event when stdin override is active
+    if (baseOptions.stdin) {
+        logEvent('thaddeus_stdin_interactive', {});
+    }
+    const fpsTracker = new FpsTracker();
+    const stats = createStatsStore();
+    setStatsStore(stats);
+    // Bench mode: when set, append per-frame phase timings as JSONL for
+    // offline analysis by bench/repl-scroll.ts. Captures the full TUI
+    // render pipeline (yoga → screen buffer → diff → optimize → stdout)
+    // so perf work on any phase can be validated against real user flows.
+    const frameTimingLogPath = process.env.THADDEUS_FRAME_TIMING_LOG;
+    return {
+        getFpsMetrics: () => fpsTracker.getMetrics(),
+        stats,
+        renderOptions: {
+            ...baseOptions,
+            onFrame: event => {
+                fpsTracker.record(event.durationMs);
+                stats.observe('frame_duration_ms', event.durationMs);
+                if (frameTimingLogPath && event.phases) {
+                    // Bench-only env-var-gated path: sync write so no frames dropped
+                    // on abrupt exit. ~100 bytes at ≤60fps is negligible. rss/cpu are
+                    // single syscalls; cpu is cumulative — bench side computes delta.
+                    const line = 
+                    // eslint-disable-next-line custom-rules/no-direct-json-operations -- tiny object, hot bench path
+                    JSON.stringify({
+                        total: event.durationMs,
+                        ...event.phases,
+                        rss: process.memoryUsage.rss(),
+                        cpu: process.cpuUsage()
+                    }) + '\n';
+                    // eslint-disable-next-line custom-rules/no-sync-fs -- bench-only, sync so no frames dropped on exit
+                    appendFileSync(frameTimingLogPath, line);
+                }
+                // Skip flicker reporting for terminals with synchronized output —
+                // DEC 2026 buffers between BSU/ESU so clear+redraw is atomic.
+                if (isSynchronizedOutputSupported()) {
+                    return;
+                }
+                for (const flicker of event.flickers) {
+                    if (flicker.reason === 'resize') {
+                        continue;
+                    }
+                    const now = Date.now();
+                    if (now - lastFlickerTime < 1000) {
+                        logEvent('thaddeus_flicker', {
+                            desiredHeight: flicker.desiredHeight,
+                            actualHeight: flicker.availableHeight,
+                            reason: flicker.reason
+                        });
+                    }
+                    lastFlickerTime = now;
+                }
+            }
+        }
+    };
+}