waterplane 0.0.1 → 0.1.6

package/packages/host/dist/composer.js

@@ -0,0 +1,453 @@
+/**
+ * WHERE on a rendered screen the composer is, and what it is holding.
+ *
+ * `echo.ts` is the comparison rule — "is THIS text in that?" — asked of any
+ * string. This file finds the string worth asking it of: the box the user is
+ * typing into, found STRUCTURALLY by its own rules and cursor row rather than
+ * by distance from the bottom of the render, because the replay tears mid-turn
+ * and strands the live composer above stale rows (`composerSpans`). Every reader
+ * here hands what it found back to `echo.ts`'s `screenEcho`, so a box can only
+ * be judged by the same rule a whole screen is.
+ *
+ * Split out of `echo.ts` by subject when that file reached the 900-line cap:
+ * the text rules there take strings, the readers here take rendered rows.
+ * Imports go one way — this file imports `echo.ts`, never the reverse.
+ */
+import { SLICE_MIN, screenEcho, squash } from "./echo.js";
+/**
+ * The composer's own full-width rules, above and below its input row.
+ *
+ * Shared with `prompt.ts` — the CONSTANT, deliberately not the semantics. That
+ * file asks "has this dialog been ANSWERED", so its notion of a composer row is
+ * and should be loose; this file asks "is this the box the user is typing
+ * into", where the same looseness is the bug (see `COMPOSER_CURSOR_RE`).
+ */
+export const COMPOSER_RULE_RE = /^[\u2500\u2501\u2504\u2505\u2508\u2509]{20,}$/;
+/**
+ * The composer's input row: `❯` and then whitespace — NBSP included,
+ * because that is what the live capture holds (the TUI pads the cursor row with
+ * one, and `renderCapture` trims spaces and tabs but not NBSP).
+ *
+ * `❯` ONLY, never a plain `>`. `prompt.ts`'s row test accepts both and is
+ * right to — a shell stub that echoes `> ` is a composer for the purpose of
+ * retiring a box. Here that would destroy the whole point: this CLI SCROLLS
+ * rather than repainting, and it renders a past user turn into the scrollback
+ * as `> yes all 3`, verbatim, for as long as it stays on screen. A `>` row
+ * would let a prompt that ran twenty minutes ago read as one sitting unsent in
+ * the box — "press Return there", aimed at an empty composer, which is the one
+ * mistake this family of rules exists to stop making.
+ */
+const COMPOSER_CURSOR_RE = /^\u276f(?:[\s\u00a0]|$)/;
+/**
+ * The two depths this file's readers use, and why they are not the same number.
+ *
+ * `ROW_WINDOW` is what the ANCHORED rules (`composerSpans` and everything built
+ * on them) are given. Wider than the 40 rows the rest of the delivery path
+ * reads, because the anchor is STRUCTURAL rather than positional: it looks for
+ * the composer's own box, and mid-turn that box is not near the bottom of the
+ * replay. `render.ts` replays the whole buffer into a fixed 50-row VT, so a
+ * repaint caught half-done leaves stale rows — a duplicated footer, then rows
+ * of streaming turn output — sitting UNDER the newest composer frame. Reading
+ * more rows costs nothing extra: it is still one render call, asked for more of
+ * what it already produced.
+ *
+ * `FALLBACK_ROWS` is what the DISTANCE rule gets, and it is deliberately the
+ * old 40 rather than the wider window. That rule places a hit by counting rows
+ * between it and the bottom of the capture, and one of its branches (the
+ * slash-completion allowance) accepts a hit at ANY height as long as two
+ * squashed rows below it start with `/`. Rows starting with `/` are file paths,
+ * i.e. most of what tool output is made of, so the only thing bounding that
+ * branch was that the old code physically could not see past 40 rows. Handing
+ * it 100 makes a `/review packages/host/…` that ran sixty rows ago read as one
+ * sitting unsent in the box — "already typed, provably ours", nothing typed,
+ * and a Return into an empty composer. The anchored rule gets the wide view
+ * because it knows WHERE the box is; the fallback exists precisely for the
+ * screens where nobody knows that, so it keeps the reach it was safe at.
+ *
+ * Both live here rather than at either caller because `deliver.ts` and
+ * `settle.ts` must ask the same question of the same screen — a window that
+ * disagreed would mean a tear deliver can confirm and settle cannot see.
+ */
+export const ROW_WINDOW = 100;
+export const FALLBACK_ROWS = 40;
+/** A rendered row with the box borders and the indent taken off. */
+const bareRow = (row) => row.replace(/^\s+/, "").replace(/^[\u2502\u2503|]\s*/, "").replace(/[\u2502\u2503|]\s*$/, "");
+const isRuleRow = (row, rule = COMPOSER_RULE_RE) => rule.test(row.trim());
+/**
+ * From a blank row inside a frame, the index of the rule that closes the box,
+ * or -1 when nothing does: a `❯` row first (the next frame), the end of the
+ * screen, or a rule that OPENS a frame (a `❯` row is its next non-blank row).
+ */
+function closingRuleAfter(rawRows, from, cursor, rule) {
+    for (let k = from; k < rawRows.length; k++) {
+        const row = rawRows[k];
+        if (!row.trim())
+            continue;
+        if (cursor.test(bareRow(row)))
+            return -1;
+        if (!isRuleRow(row, rule))
+            continue;
+        let next = k + 1;
+        while (next < rawRows.length && !rawRows[next].trim())
+            next++;
+        return next < rawRows.length && cursor.test(bareRow(rawRows[next])) ? -1 : k;
+    }
+    return -1;
+}
+/**
+ * Every composer frame drawn on this rendered screen, top to bottom.
+ *
+ * **Why this exists at all: the bottom of the render is not the bottom of the
+ * screen.** `deliver.ts` used to accept an echo only if it sat within ~11 rows
+ * of the last row of the capture, which is a fine rule for an idle TUI and
+ * wrong for a working one. `render.ts` replays the WHOLE buffer into a fixed
+ * 50-row VT, so a repaint caught half-done tears: a live capture of a delivery
+ * that was declared a miss had the typed text sitting in the composer with a
+ * DUPLICATED footer and eight rows of streaming turn output underneath it. The
+ * echo was found and then refused for being too far up, the delivery came back
+ * `unconfirmed`, and the sweep that follows sent an Esc into a running turn.
+ * "How far from the bottom" measures the tear; "is it inside the box" measures
+ * the thing we actually wanted to know.
+ *
+ * A frame is a `❯` input row with one of the composer's full-width rules
+ * ADJACENT ABOVE it, running down to the rule that closes the box. Both anchors
+ * are load-bearing: the rule above is what stops a `❯` cursor drawn by one
+ * of the CLI's inline pickers from reading as a composer, and the rule below is
+ * what stops the span from running on into whatever the turn is printing under
+ * the box. Blank rows are skipped looking upward because the replay squeezes
+ * runs of them; looking DOWN a blank row is the text's own blank line, kept
+ * only while a rule still closes the box below it (`closingRuleAfter`).
+ *
+ * Structural, so it degrades the safe way: an upstream redraw this does not
+ * recognise yields NO spans, and every caller falls back to what it did before.
+ * A composer we cannot see must never brick delivery.
+ */
+export function composerSpans(rawRows, cursor = COMPOSER_CURSOR_RE, rule = COMPOSER_RULE_RE) {
+    const out = [];
+    for (let i = 0; i < rawRows.length; i++) {
+        const head = bareRow(rawRows[i]);
+        if (!cursor.test(head))
+            continue;
+        let above = i - 1;
+        while (above >= 0 && !rawRows[above].trim())
+            above--;
+        if (above < 0 || !isRuleRow(rawRows[above], rule))
+            continue;
+        // The cursor itself is not content: an EMPTY box must read as empty, which
+        // is how `newestOnly` below tells a live frame from a stale one.
+        const rows = [head.replace(cursor, "")];
+        for (let j = i + 1; j < rawRows.length; j++) {
+            const row = rawRows[j];
+            if (!row.trim()) {
+                // A blank row is INSIDE the box when the text has a blank line in it
+                // (measured on 2.1.301, `fixtures/screens/paste-blankrow.txt`): stopping
+                // here dropped the tail, the one thing tying a placeholder to its text.
+                // It is believed only when the rows after it still CLOSE this box — a
+                // rule that is not the top of another frame — so a frame torn open at
+                // the bottom never runs on into the turn printing under it.
+                const close = closingRuleAfter(rawRows, j, cursor, rule);
+                if (close < 0)
+                    break;
+                for (; j < close; j++)
+                    rows.push(bareRow(rawRows[j]));
+                break;
+            }
+            if (isRuleRow(row, rule))
+                break; // the rule that closes it
+            if (cursor.test(bareRow(row)))
+                break; // the next frame, not this one
+            rows.push(bareRow(row));
+        }
+        out.push({ at: i, rows });
+    }
+    return out;
+}
+/** What one frame is holding, in the comparison view every rule here runs on. */
+export const composerText = (span) => squash(span.rows.join(""));
+/**
+ * Is this text in the composer — asked STRUCTURALLY, of the box itself?
+ *
+ * Answers `null` when there is no composer frame on this screen at all, which
+ * is a different statement from `"none"` and callers must keep them apart:
+ * `null` means "this rule cannot speak about that screen, use your fallback",
+ * `"none"` means "the box is right there and your text is not in it". Folding
+ * the two together is how a heuristic that stopped recognising an upstream
+ * redraw would turn every delivery into a gravestone.
+ *
+ * All frames are scanned bottom-up by default, because a torn repaint can leave
+ * a stale EMPTY frame below the live one, and the after-write poll has no doubt
+ * about ownership anyway — it typed the text moments ago. `newestOnly` is for
+ * the question asked BEFORE typing: "does this composer ALREADY hold my text"
+ * is a claim about the live box, so it is asked of the bottom-most frame that
+ * is holding anything, and of nothing else.
+ *
+ * `newestOnly` skipping empty frames is a GUESS about which frame is live, and
+ * a caller that will act on the answer must put `composerFramesAmbiguous()` in
+ * front of it — see that function for the case where the guess is wrong.
+ */
+export function composerEcho(rawRows, text, opts = {}) {
+    const spans = composerSpans(rawRows);
+    if (!spans.length)
+        return null;
+    const bottomUp = [...spans].reverse();
+    const candidates = opts.newestOnly
+        ? [bottomUp.find((s) => composerText(s)) ?? bottomUp[0]]
+        : bottomUp;
+    for (const span of candidates) {
+        const held = composerText(span);
+        const rule = screenEcho(held, text);
+        // The order is the evidence order, not the cheapness order. `exact` and
+        // `paste` already tie the box to this text as tightly as anything here
+        // can. Below them the box being a WINDOW onto our text is strictly more
+        // evidence than its first fourteen characters happening to be drawn — so a
+        // prompt whose head is visible AND whose visible rows are all ours is
+        // reported as the stronger of the two, not the weaker.
+        if (rule === "exact" || rule === "paste")
+            return rule;
+        if (scrolledEcho(held, text))
+            return "scrolled";
+        if (rule !== "none")
+            return rule;
+    }
+    return "none";
+}
+/**
+ * Is this box a VIEWPORT onto our text rather than a field holding all of it?
+ *
+ * The CLI's composer scrolls (`SLICE_MIN`), so everything it is drawing can be
+ * a contiguous window of a longer prompt with both ends off the box. A window
+ * is asked for as a substring rather than a suffix deliberately, even though
+ * the window a delivery produces is a suffix: the cursor is at the end when we
+ * have just typed, but `settle.ts` asks the same question minutes later, and by
+ * then the box may have been scrolled anywhere — the live capture that started
+ * this showed the HEAD of a 632-character prompt hours after it was typed.
+ *
+ * `held` must already be `squash`ed — `composerText` is what produces it.
+ */
+function scrolledEcho(held, text) {
+    if (held.length < SLICE_MIN)
+        return false;
+    return squash(text).includes(held);
+}
+/**
+ * Do the drawn frames DISAGREE about what the live composer is holding?
+ *
+ * `newestOnly` above answers "does the box already hold my text" off the
+ * bottom-most frame that is holding anything — which is the right guess for the
+ * tear this file was written for (a stale EMPTY frame stranded below the live
+ * one), and the wrong one for the same tear the other way up. An interjection
+ * that was just SUBMITTED leaves the live box empty at the bottom of the replay
+ * with a stale frame above it still showing the words that have already gone.
+ * Skipping the empty frame then reads the stale one and says "your text is
+ * already in the composer" about a box that is empty — after which the caller
+ * types nothing and presses Return at nothing, i.e. `unsubmitted` for a prompt
+ * that never ran.
+ *
+ * Neither frame can be shown to be the live one from a rendered screen, so this
+ * does not try: it reports that the screen is not answerable, and the standing
+ * rule here is that "I cannot tell" is not a confident match. The caller's
+ * honest move is the one that has no side effect at all — type nothing, submit
+ * nothing, say why (`deliver.ts`'s `retry`) — never a guess between two frames
+ * where one of the two outcomes runs somebody's words and the other runs none.
+ *
+ * Deliberately NOT folded into `composerEcho`'s return type. The three rules
+ * are evidence grades that `echoAmbiguous`, `settle.ts` and the delivery path
+ * all switch on; a fourth member meaning "disregard the other three" would have
+ * to be handled correctly at every one of those sites on pain of reading as a
+ * match, and a predicate the one caller that cares asks first cannot be
+ * silently mishandled by the ones that do not.
+ */
+export function composerFramesAmbiguous(rawRows) {
+    const spans = composerSpans(rawRows);
+    if (spans.length < 2)
+        return false; // one box, nothing to disagree with
+    if (composerText(spans[spans.length - 1]))
+        return false; // the live box speaks for itself
+    return spans.some((s) => composerText(s));
+}
+/** claude's composer: a `❯` input row under one of its full-width rules. */
+export const CLAUDE_COMPOSER = Object.freeze({
+    cursor: COMPOSER_CURSOR_RE,
+    rule: COMPOSER_RULE_RE,
+});
+/** A box border at the start of a row — opencode's `┃` gutter (or `│`/`|`). */
+const GUTTER_RE = /^\s*[┃│|]/;
+/**
+ * How many non-blank rows a cursor-only composer may have UNDER it and still be
+ * the composer. Codex (0.160.0, measured) draws the composer and then a blank,
+ * a model/cwd row and a hint row — two. A `›` row with more than this below it
+ * is a past prompt in the transcript, which this TUI draws with the same glyph.
+ */
+const CURSOR_ONLY_FOOTER_MAX = 4;
+/**
+ * Is the cursor row at `at` a DRAWN composer, rather than the last thing a
+ * cursor-only TUI happened to draw with the same glyph?
+ *
+ * Codex draws its composer, its past prompts and a modal's selected option all
+ * with `›`, so "the bottom-most `›` row with a short footer" is a guess, and
+ * with a modal up and no composer drawn it guessed a transcript row or the
+ * option `› 1. Yes, proceed (y)` — which then read as text "held" in the box and
+ * refused a send with "clear it at the desk" about a box nobody could clear.
+ * Two shapes are evidence AGAINST, measured on 0.160.0 and its fake:
+ *
+ *  - a numbered option (`1. …`, `1) …`) under the cursor — a picker, not a box;
+ *  - a row that starts at column 0 before the first blank row — a transcript
+ *    bullet (`• ping`) directly under a PAST prompt. The live composer is
+ *    followed by its own wrapped (indented) rows and then a BLANK row before the
+ *    model/cwd footer, or by the end of the screen.
+ *
+ * Either ⇒ no box this rule can place ⇒ `composerHeld` answers null: no
+ * opinion, never a refusal.
+ */
+function cursorOnlyComposerDrawn(rawRows, at) {
+    if (/^[\s\u00a0]*\d+[.)][\s\u00a0]/.test(bareRow(rawRows[at]).replace(/^\S+/, "")))
+        return false;
+    for (let j = at + 1; j < rawRows.length; j++) {
+        const row = rawRows[j];
+        if (!row.trim())
+            return true;
+        if (/^\S/.test(row))
+            return false;
+    }
+    return true;
+}
+/**
+ * What the LIVE composer is holding right now, as drawn — or `null` when this
+ * screen gives no composer this rule can place.
+ *
+ * Asked BEFORE typing, by `deliver.ts`, about a different thing from
+ * `composerEcho`: not "is my text there" but "is ANYTHING there". A key pressed
+ * at the desk after the phone answered a box (Codex's `y`, measured in 4 of 4
+ * live rounds) is ordinary text in the composer, and typing a prompt after it
+ * sends `yReply …` — words merged that nobody wrote together.
+ *
+ * `""` means the box was found and is empty; `null` means "cannot speak about
+ * this screen", and the caller must then do exactly what it did before this
+ * reader existed. Three shapes, by which anchors the backend gives:
+ *
+ *  - cursor AND rule (claude): `composerSpans`, the bottom-most frame. A torn
+ *    replay whose frames disagree (`composerFramesAmbiguous`) is null — which
+ *    frame is live is not readable, and refusing on a guess would hold a send
+ *    for a box that may well be empty.
+ *  - cursor only (Codex's `›`): the bottom-most cursor row, provided at most
+ *    `CURSOR_ONLY_FOOTER_MAX` non-blank rows sit under it. Its first row only:
+ *    "is anything there" needs nothing more.
+ *  - rule only (opencode's `╹▀▀▀`): the `┃` gutter rows directly above the
+ *    bottom-most rule, minus the lowest one, which is the box's own
+ *    `Build · <model>` status row.
+ *
+ * What it can NOT see is the attribute an empty box's hint is drawn in: claude's
+ * `Try "…"` and Codex's `Ask Codex to do anything` are DIM (SGR 2, both
+ * measured), so on the plain rendered text they read as content. The caller
+ * asks again of the rows with dim cells blanked (`render.ts`'s `undimmed`) before
+ * believing a non-empty answer, and `placeholder` covers a hint drawn in a
+ * colour instead.
+ */
+export function composerHeld(rawRows, a) {
+    const tidy = (s) => s.replace(/[\s ]+/g, " ").trim();
+    let held = null;
+    if (a.cursor && a.rule) {
+        const spans = composerSpans(rawRows, a.cursor, a.rule);
+        if (!spans.length)
+            return null;
+        const live = spans[spans.length - 1];
+        const text = tidy(live.rows.join(" "));
+        // The bottom box empty and an older one holding words is the tear
+        // `composerFramesAmbiguous` describes: no opinion, never a refusal.
+        if (!text)
+            return spans.some((s) => composerText(s)) ? null : "";
+        held = text;
+    }
+    else if (a.cursor) {
+        let below = 0;
+        for (let i = rawRows.length - 1; i >= 0; i--) {
+            const row = bareRow(rawRows[i]);
+            if (a.cursor.test(row)) {
+                if (!cursorOnlyComposerDrawn(rawRows, i))
+                    return null;
+                held = tidy(row.replace(a.cursor, ""));
+                break;
+            }
+            if (rawRows[i].trim() && ++below > CURSOR_ONLY_FOOTER_MAX)
+                return null;
+        }
+        if (held === null)
+            return null;
+    }
+    else if (a.rule) {
+        let r = -1;
+        for (let i = rawRows.length - 1; i >= 0; i--)
+            if (a.rule.test(rawRows[i])) {
+                r = i;
+                break;
+            }
+        if (r < 0)
+            return null;
+        const box = [];
+        for (let i = r - 1; i >= 0 && GUTTER_RE.test(rawRows[i]); i--)
+            box.unshift(bareRow(rawRows[i]));
+        if (box.length < 2)
+            return null; // no room for a status row AND an input row: not a box we know
+        held = tidy(box.slice(0, -1).join(" "));
+    }
+    else {
+        return null;
+    }
+    if (held && a.placeholder?.test(held))
+        return "";
+    return held;
+}
+/**
+ * Is THIS text what the LIVE composer is holding — asked before typing?
+ *
+ * The question `deliver.ts` asks to decide "already typed, just press Return",
+ * and the one place a wrong yes costs a whole prompt: nothing is typed and a
+ * Return lands in an empty box. Measured with the Codex plugin's race harness
+ * (`SAME_HEAD=1`): a prompt whose first fourteen squashed characters equalled
+ * the PREVIOUS one's — two "Run exactly this one shell command…", or
+ * "continue" twice, or a plain re-send — was never typed, because on a backend
+ * whose box `composerEcho` (claude's anchors) cannot place, the old
+ * distance-from-the-bottom rule found the earlier prompt still drawn in the
+ * transcript a few rows above the live box.
+ *
+ * So the judgment is made on the live box and nothing else, found by the
+ * BACKEND'S OWN anchors — claude's `composerSpans` (the newest frame holding
+ * anything, as `composerEcho`'s `newestOnly`), else `composerHeld` for a
+ * cursor-only or rule-only reader — and a `head` match counts only when the box
+ * holds a PREFIX of our text and nothing else: a box whose fourteen-character
+ * head agrees and whose rest goes on differently is another prompt, and
+ * `deliver.ts`'s foreign-text check is where that belongs.
+ *
+ * `null` = no reader for this backend, or no box it can place on this screen:
+ * no opinion, and the caller decides what that degrades to.
+ */
+export function liveComposerEcho(rawRows, text, a, opts = {}) {
+    let held;
+    if (a.cursor && a.rule) {
+        const spans = composerSpans(rawRows, a.cursor, a.rule);
+        if (!spans.length)
+            return null;
+        const bottomUp = [...spans].reverse();
+        held = composerText(bottomUp.find((s) => composerText(s)) ?? bottomUp[0]);
+    }
+    else {
+        const h = composerHeld(rawRows, a);
+        if (h === null)
+            return null;
+        held = squash(h);
+    }
+    if (!held)
+        return "none";
+    const rule = screenEcho(held, text);
+    if (rule === "exact" || rule === "paste")
+        return rule;
+    if (scrolledEcho(held, text))
+        return "scrolled";
+    // `looseHead` is the old prefix-only reading, kept for the one caller that
+    // asks it to tell a RIVAL delivery's words from a stranger's (same verdict,
+    // a different sentence) — never to conclude "already typed".
+    if (rule === "head" && (opts.looseHead || squash(text).startsWith(held)))
+        return "head";
+    return "none";
+}
+//# sourceMappingURL=composer.js.map

package/packages/host/dist/composer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer.js","sourceRoot":"","sources":["../src/composer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAiB,MAAM,WAAW,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,+CAA+C,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC;AAC9B,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAUhC,oEAAoE;AACpE,MAAM,OAAO,GAAG,CAAC,GAAW,EAAU,EAAE,CACtC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;AAEhG,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,OAAe,gBAAgB,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAEnG;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAA0B,EAAE,IAAY,EAAE,MAAc,EAAE,IAAY;IAC9F,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,SAAS;QAC1B,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,SAAS;QACpC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,CAAC;QAC9D,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA0B,EAC1B,SAAiB,kBAAkB,EACnC,OAAe,gBAAgB;IAE/B,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;YAAE,KAAK,EAAE,CAAC;QACrD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;YAAE,SAAS;QAC5D,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,IAAI,GAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChB,qEAAqE;gBACrE,yEAAyE;gBACzE,wEAAwE;gBACxE,sEAAsE;gBACtE,sEAAsE;gBACtE,4DAA4D;gBAC5D,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACzD,IAAI,KAAK,GAAG,CAAC;oBAAE,MAAM;gBACrB,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,MAAM;YACR,CAAC;YACD,IAAI,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,MAAM,CAAqB,0BAA0B;YAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,CAAgB,+BAA+B;YACpF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAEvF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA0B,EAC1B,IAAY,EACZ,OAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU;QAChC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,QAAQ,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,uDAAuD;QACvD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,OAAO,UAAU,CAAC;QAChD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA0B;IAChE,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAqB,oCAAoC;IAC5F,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,iCAAiC;IAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAkBD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAoB,MAAM,CAAC,MAAM,CAAC;IAC5D,MAAM,EAAE,kBAAkB;IAC1B,IAAI,EAAE,gBAAgB;CACvB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,uBAAuB,CAAC,OAA0B,EAAE,EAAU;IACrE,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,YAAY,CAAC,OAA0B,EAAE,CAAkB;IACzE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,kEAAkE;QAClE,oEAAoE;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;SAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACtD,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBACvC,MAAM;YACR,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,sBAAsB;gBAAE,OAAO,IAAI,CAAC;QACzE,CAAC;QACD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,+DAA+D;QAChG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA0B,EAC1B,IAAY,EACZ,CAAkB,EAClB,OAAgC,EAAE;IAElC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAChD,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/packages/host/dist/confirmgate.d.ts

@@ -0,0 +1,34 @@
+import type { IncomingMessage } from "node:http";
+import { type ComplianceReport } from "@waterplane/shared";
+export declare const CONFIRM_TTL_MS: number;
+export interface ConfirmGate {
+    mint(scope: string, bind: string, allowed?: Iterable<string>): string;
+    /** Null = may proceed (call `consume` once the action was accepted); else the refusal. */
+    check(token: unknown, scope: string, bind: string, asked?: Iterable<string>): string | null;
+    consume(token: unknown): void;
+    /** Tests. */
+    size(): number;
+}
+export declare function createConfirmGate(now?: () => number): ConfirmGate;
+/** The one gate the routes share (process-wide, per host boot — a restart drops every token). */
+export declare const confirmGate: ConfirmGate;
+/** (a): a browser's POST. Null = has an allowed `Origin`; else the refusal. */
+export declare function browserOriginRefusal(req: Pick<IncomingMessage, "headers">): string | null;
+/** (a) then (b) in one call. */
+export declare function gateRefusal(req: Pick<IncomingMessage, "headers">, token: unknown, scope: string, bind: string, asked?: Iterable<string>, gate?: ConfirmGate): string | null;
+export declare const FIX_SCOPE = "fix";
+export declare const ONBOARD_START_SCOPE = "onboard.start";
+export declare const ONBOARD_RESUME_SCOPE = "onboard.resume";
+/** `PUT /api/askrules`, bound to the list's `rev` (`askrules.ts`). */
+export declare const ASK_RULES_SCOPE = "askrules";
+export declare const fixBind: (worktree: string, fixId: string) => string;
+/** A report the phone will draw: one token per confirm-gated fix it offers, for that worktree. */
+export declare function withFixConfirms<R extends ComplianceReport>(worktree: string, report: R, gate?: ConfirmGate): R;
+/**
+ * `POST …/compliance/fix`: null when the list may run (consume the token after), else the
+ * refusal and its status. A gated id runs ALONE — never inside a "Fix all" list.
+ */
+export declare function fixGateRefusal(req: Pick<IncomingMessage, "headers">, worktree: string, fixes: string[], token: unknown, gate?: ConfirmGate): {
+    error: string;
+    status: number;
+} | null;

package/packages/host/dist/confirmgate.js

@@ -0,0 +1,114 @@
+/**
+ * The server-side half of "the second tap IS the consent" (first-app plan, "Review fixes").
+ *
+ * Three things this daemon can do on a person's behalf are consent, not convenience: accept
+ * Google's Android SDK licence and download a toolchain (`android-toolchain`), make a signing key
+ * (`signing-key`), write a repo's Claude settings (`auto-compact`) — the `CONFIRM_GATED_FIXES` —
+ * and start or widen the first-app job (`POST /api/onboard`, `/resume` with consent) — and replace
+ * the ask-rule list (`PUT /api/askrules`, bound to the list's rev so a stale copy is refused). The phone
+ * asks for them with a two-tap confirm or a consent screen; before this gate, the HOST took the
+ * caller's word for it. Any Origin-less POST (curl, the `claude` agent this daemon spawns, a
+ * plugin's script) could tick the box.
+ *
+ * The gate, per request:
+ *   (a) an `Origin` header that passes `origin.ts` — every browser sends one on a POST, a script
+ *       has to forge one on purpose; Origin-less is refused HERE (never by loosening origin.ts,
+ *       which keeps allowing Origin-less everywhere else);
+ *   (b) a one-shot token minted by the GET that DRAWS the confirm (the compliance report, the
+ *       onboard plan, the stopped job), bound to what it confirms: the worktree + fix id, the
+ *       onboard path + the consent ids that screen listed, or the job id.
+ *
+ * Honest about its reach: a process running as this user can run `sdkmanager` itself; nothing in
+ * the daemon can stop that. What it stops is the accident — one documented POST from an agent or
+ * a plugin that silently accepts a licence. Taking these paths now means a GET, reading a token,
+ * and forging a browser header: a deliberate act, and the log says it happened.
+ *
+ * A token is consumed only when the action it gates was accepted, so a refusal for some other
+ * reason (a job already running) leaves the screen's token usable; a used one never works twice.
+ */
+import { randomBytes } from "node:crypto";
+import { CONFIRM_GATED_FIXES } from "@waterplane/shared";
+import { originHeaderAllowed } from "./origin.js";
+export const CONFIRM_TTL_MS = 15 * 60_000;
+const MAX_LIVE = 64;
+export function createConfirmGate(now = Date.now) {
+    const live = new Map();
+    const sweep = () => {
+        const t = now();
+        for (const [k, e] of live)
+            if (e.expiresAt <= t)
+                live.delete(k);
+        while (live.size > MAX_LIVE)
+            live.delete(live.keys().next().value);
+    };
+    return {
+        mint(scope, bind, allowed) {
+            const token = randomBytes(16).toString("hex");
+            live.set(token, { scope, bind, allowed: allowed ? new Set(allowed) : null, expiresAt: now() + CONFIRM_TTL_MS });
+            sweep();
+            return token;
+        },
+        check(token, scope, bind, asked) {
+            sweep();
+            if (typeof token !== "string" || !token)
+                return "no confirm token — confirm it on the phone's screen";
+            const e = live.get(token);
+            if (!e)
+                return "this confirm has expired or was already used — open the screen again";
+            if (e.scope !== scope || e.bind !== bind)
+                return "this confirm was for something else — open the screen again";
+            if (e.allowed && asked) {
+                const extra = [...asked].filter((a) => !e.allowed.has(a));
+                if (extra.length)
+                    return `not on the screen you confirmed: ${extra.join(", ")}`;
+            }
+            return null;
+        },
+        consume(token) { if (typeof token === "string")
+            live.delete(token); },
+        size() { sweep(); return live.size; },
+    };
+}
+/** The one gate the routes share (process-wide, per host boot — a restart drops every token). */
+export const confirmGate = createConfirmGate();
+/** (a): a browser's POST. Null = has an allowed `Origin`; else the refusal. */
+export function browserOriginRefusal(req) {
+    const o = req.headers.origin;
+    const origin = Array.isArray(o) ? o[0] : o;
+    if (!origin || !origin.trim())
+        return "this needs the phone's confirm: a request with no Origin cannot give consent";
+    if (!originHeaderAllowed(origin))
+        return "origin not allowed";
+    return null;
+}
+/** (a) then (b) in one call. */
+export function gateRefusal(req, token, scope, bind, asked, gate = confirmGate) {
+    return browserOriginRefusal(req) ?? gate.check(token, scope, bind, asked);
+}
+export const FIX_SCOPE = "fix";
+export const ONBOARD_START_SCOPE = "onboard.start";
+export const ONBOARD_RESUME_SCOPE = "onboard.resume";
+/** `PUT /api/askrules`, bound to the list's `rev` (`askrules.ts`). */
+export const ASK_RULES_SCOPE = "askrules";
+export const fixBind = (worktree, fixId) => `${worktree}\0${fixId}`;
+/** A report the phone will draw: one token per confirm-gated fix it offers, for that worktree. */
+export function withFixConfirms(worktree, report, gate = confirmGate) {
+    const ids = [...new Set(report.checks.map((c) => c.fix).filter((f) => !!f && CONFIRM_GATED_FIXES.includes(f)))];
+    if (!ids.length)
+        return report;
+    return { ...report, confirm: Object.fromEntries(ids.map((id) => [id, gate.mint(FIX_SCOPE, fixBind(worktree, id))])) };
+}
+/**
+ * `POST …/compliance/fix`: null when the list may run (consume the token after), else the
+ * refusal and its status. A gated id runs ALONE — never inside a "Fix all" list.
+ */
+export function fixGateRefusal(req, worktree, fixes, token, gate = confirmGate) {
+    const gated = fixes.filter((f) => CONFIRM_GATED_FIXES.includes(f));
+    if (!gated.length)
+        return null;
+    if (fixes.length > 1)
+        return { status: 400, error: `${gated.join(", ")} needs its own confirm and is never part of a list — nothing was applied` };
+    const why = gateRefusal(req, token, FIX_SCOPE, fixBind(worktree, gated[0]), undefined, gate);
+    return why ? { status: 403, error: `${why} — nothing was applied` } : null;
+}
+//# sourceMappingURL=confirmgate.js.map

package/packages/host/dist/confirmgate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmgate.js","sourceRoot":"","sources":["../src/confirmgate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,mBAAmB,EAAyB,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1C,MAAM,QAAQ,GAAG,EAAE,CAAC;AAapB,MAAM,UAAU,iBAAiB,CAAC,MAAoB,IAAI,CAAC,GAAG;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiB,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,IAAI,GAAG,QAAQ;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IAC/E,CAAC,CAAC;IACF,OAAO;QACL,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO;YACvB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;YAChH,KAAK,EAAE,CAAC;YACR,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK;YAC7B,KAAK,EAAE,CAAC;YACR,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;gBAAE,OAAO,qDAAqD,CAAC;YACtG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,CAAC;gBAAE,OAAO,sEAAsE,CAAC;YACtF,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,6DAA6D,CAAC;YAC/G,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,MAAM;oBAAE,OAAO,oCAAoC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,GAAqC;IACxE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,8EAA8E,CAAC;IACrH,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,WAAW,CAAC,GAAqC,EAAE,KAAc,EAAE,KAAa,EAAE,IAAY,EAAE,KAAwB,EAAE,OAAoB,WAAW;IACvK,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;AAC/B,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAC1C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,KAAK,KAAK,EAAE,CAAC;AAEpF,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAA6B,QAAgB,EAAE,MAAS,EAAE,OAAoB,WAAW;IACtH,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7H,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC/B,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAqC,EAAE,QAAgB,EAAE,KAAe,EAAE,KAAc,EAAE,OAAoB,WAAW;IACtJ,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0EAA0E,EAAE,CAAC;IACnJ,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,wBAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC"}

package/packages/host/dist/context.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Context-window figure detection.
+ *
+ * Works on ANSI-stripped PTY tail text, like prompt.ts / limit.ts, and is
+ * equally heuristic: the phrasings are pinned to what the Claude Code TUI
+ * prints for its context indicator (the auto-compact note, the "context left"
+ * footer, a "128k/200k tokens" gauge, the /context breakdown). TUI copy
+ * changes can break this — it degrades to "unknown" (null), never a wrong
+ * number, so a miss just hides the badge.
+ */
+export interface ContextInfo {
+    /** Percent of the window still FREE (0–100), or null. */
+    leftPct: number | null;
+    /** Tokens used, when an absolute figure is printed. */
+    usedTok?: number;
+    /** Window total in tokens, when printed. */
+    totalTok?: number;
+}
+/** The last context-indicator row in the text, or null when there is none.
+ *  Last, because a repaint-based TUI leaves older frames above the fresh one. */
+export declare function contextMeterRow(text: string): string | null;
+export declare function detectContext(text: string): ContextInfo;