wisp-agents 0.15.0 → 0.17.0

package/server/runner.js

@@ -4,23 +4,44 @@
 // setting they wait until the run finishes.
 
 import { EventEmitter } from 'node:events';
-import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { adapters } from './adapters/index.js';
 import { systemPrompt, parsePresentation, heroOf } from './protocol.js';
 import { captureCheckpoint, freshCheckpoint, readGitFile } from './checkpoint.js';
 import { teamNote, copies, SUBAGENT_ASK } from './subagents.js';
+import { handoffNote } from './handoff.js';
+import { agentPrompt, plainMentions } from './mentions.js';
+import { bad, MODES, newId } from './util.js';
 
 const MAX_ACTIVITY = 400;
-const MODES = new Set(['plan', 'edits', 'auto']);
 const LINGER_MS = 3000; // how long a CLI may keep running after it reported its result
 const BACKGROUND_MAX_MS = 60 * 60_000; // how long a turn may wait on its background tasks
 const ASK_SERVER = path.join(path.dirname(fileURLToPath(import.meta.url)), 'mcp-ask.js');
 // The delegate tool lives on the same injected server, so harnesses name it like ask_user.
 const delegateTool = (askTool) => askTool && askTool.replace(/ask_user$/, 'delegate');
+// The answers a live approval offers. Typed text instead is a "no, do this instead".
+export const APPROVAL = { allow: 'Allow', always: 'Always allow in this task', deny: 'Deny' };
+const sameAction = (a, b) => a.tool === b.tool && a.detail === b.detail;
 
-export const newId = () => randomUUID().replace(/-/g, '').slice(0, 12);
+// A live approval's answer: the button the user clicked, a yes/no typed out, or anything else,
+// which denies the call and hands the agent the user's words.
+export function approvalDecision(text) {
+  const t = String(text || '').trim();
+  if (t === APPROVAL.always || /^(always\b|2$)/i.test(t)) return { decision: 'allow', always: true };
+  if (t === APPROVAL.allow || /^(y|yes|ok|allow|approve|go ahead|1)$/i.test(t)) return { decision: 'allow' };
+  if (t === APPROVAL.deny || /^(n|no|deny|reject|3)$/i.test(t)) return { decision: 'deny' };
+  return { decision: 'deny', message: t };
+}
+
+// The follow-up that retries what a turn's permissions refused, once the user allowed it.
+function retryPrompt(items, scoped) {
+  const list = items.map((b) => `- ${b.tool}${b.detail ? `: \`${b.detail}\`` : ''}`).join('\n');
+  const how = scoped ? 'I allowed exactly these for this follow-up' : 'This follow-up runs in Full auto, so nothing is blocked';
+  return `These actions were blocked by your permissions last turn:\n${list}\n\n${how}. Run them now and finish the task.`;
+}
+
+export { newId };
 
 // Where the agent actually works: its own worktree when it has one, else the project folder.
 export const workdir = (s) => s.worktree?.cwd || s.cwd;
@@ -32,8 +53,18 @@ function workspaceNote(s) {
   return `\n\n## Workspace\n\nYou are in an isolated git worktree (${wt.path}) on branch \`${wt.branch}\`, created from \`${wt.baseRef}\` for this task only. Other agents may be working in the user's main checkout, so make every change here. Dependencies and build output (node_modules, virtualenvs, dist/) are not shared with the main checkout: install them if a command needs them. Leave your changes uncommitted unless the user asks you to commit; the user ships them from wisp (commit, push, pull request).`;
 }
 
+// A follow-up's { agent, model, effort }, or null when it's what the session already runs on.
+// Fields left out keep the session's; a new harness without a model gets its default.
+function changedRun(session, run) {
+  if (!run || typeof run !== 'object') return null;
+  const agent = run.agent || session.agent;
+  const same = agent === session.agent;
+  const next = { agent, model: String(run.model ?? (same ? session.model : '') ?? ''), effort: String(run.effort ?? (same ? session.effort : '') ?? '') };
+  return same && next.model === (session.model || '') && next.effort === (session.effort || '') ? null : next;
+}
+
 function autoTitle(prompt) {
-  const line = prompt.trim().split('\n')[0].replace(/\s+/g, ' ');
+  const line = plainMentions(prompt).trim().split('\n')[0].replace(/\s+/g, ' ');
   return line.length > 64 ? `${line.slice(0, 63)}…` : line;
 }
 
@@ -68,6 +99,7 @@ export function summarize(s, store) {
     live: s.ask ? `Asks: ${s.ask.question}` : last?.status === 'running' ? waitingOn || lastAct?.label || 'Starting up' : '',
     asks: !!s.ask || !!last?.presentation?.blocks?.some((b) => b.type === 'question'),
     question: s.ask?.question || '',
+    approval: !!s.ask?.permission, // the question is a live approval (Allow / Deny)
     branch: s.worktree?.branch || '',
     toShip: s.toShip || null, // { dirty, ahead, unpushed } of the worktree, null until checked
     pr: s.pr ? { number: s.pr.number, url: s.pr.url, state: s.pr.state, draft: s.pr.draft, review: s.pr.review, checks: s.pr.checks } : null,
@@ -82,7 +114,7 @@ export function summarize(s, store) {
     ),
     ...(s.parentId && { parentId: s.parentId, member: s.member }),
     // Auto: what it picked and why, for the card's tooltip.
-    route: s.route ? { goal: s.route.goal, type: s.route.type, label: s.route.label, chance: s.route.chance, n: s.route.n, usd: s.route.usd, explored: s.route.explored, trying: s.route.trying, alternatives: s.route.alternatives } : null,
+    route: s.route ? { goal: s.route.goal, type: s.route.type, label: s.route.label, chance: s.route.chance, n: s.route.n, usd: s.route.usd, explored: s.route.explored, trying: s.route.trying, alternatives: s.route.alternatives, ...(s.route.switched && { switched: true }) } : null,
   };
 }
 
@@ -112,7 +144,7 @@ export class Runner extends EventEmitter {
   }
 
   // subagents: the team a lead may delegate to. parentId/member: this session is one of them.
-  create({ id = newId(), prompt, cwd, agent = 'claude', mode = 'edits', model = '', effort = '', attachments = [], worktree = null, groupId = null, origin = null, subagents = [], parentId = null, member = '', route = null }) {
+  create({ id = newId(), prompt, cwd, agent = 'claude', mode = 'auto', model = '', effort = '', attachments = [], worktree = null, groupId = null, origin = null, subagents = [], parentId = null, member = '', route = null }) {
     if (!adapters[agent]) throw new Error(`Unknown agent: ${agent}`);
     const now = Date.now();
     const session = {
@@ -129,6 +161,7 @@ export class Runner extends EventEmitter {
       createdAt: now,
       updatedAt: now,
       agentSessionId: null,
+      agentSessions: {}, // harness -> its own conversation id, so switching back resumes it
       queue: [],
       turns: [],
       ...(worktree && { worktree }),
@@ -145,10 +178,14 @@ export class Runner extends EventEmitter {
   }
 
   // mode: switch the permission mode (plan / edits / auto) from this follow-up on. A queued
-  // follow-up keeps its own, so the run before it isn't affected.
-  reply(session, text, attachments = [], { queue = false, mode } = {}) {
+  // follow-up keeps its own, so the run before it isn't affected. run: { agent, model, effort }
+  // switches the harness, model and thinking level the same way (see #switchRun).
+  // grants / once: a retry of what the last turn's permissions blocked (see approveBlocked).
+  reply(session, text, attachments = [], { queue = false, mode, run, grants, once } = {}) {
     if (!MODES.has(mode) || mode === session.mode) mode = undefined;
-    if (session.ask && !mode) {
+    run = changedRun(session, run);
+    const extra = { ...(mode && { mode }), ...(run && { run }), ...(grants?.length && { grants }), ...(MODES.has(once) && { once }) };
+    if (session.ask && !Object.keys(extra).length) {
       this.answer(session, text);
       return { answered: true };
     }
@@ -158,27 +195,65 @@ export class Runner extends EventEmitter {
       // The run already produced its result and the CLI is only lingering on its way out:
       // there's nothing to wait for, so let it go and start the follow-up now.
       if (turn?.status !== 'running') {
-        session.queue.push({ id: newId(), text, attachments, ...(mode && { mode }) });
+        session.queue.push({ id: newId(), text, attachments, ...extra });
         handle.release();
         return { queued: session.queue.length > 0 };
       }
       // Interrupting needs an agent session to resume; before the agent reports one, queue.
       if (queue || !session.agentSessionId) {
-        session.queue.push({ id: newId(), text, attachments, ...(mode && { mode }) });
+        session.queue.push({ id: newId(), text, attachments, ...extra });
         this.#touch(session);
         return { queued: true, ahead: session.queue.length - 1 };
       }
       // Ahead of anything queued, but after earlier interrupting follow-ups, so they keep their order.
       const at = session.queue.findIndex((q) => !q.now);
-      session.queue.splice(at < 0 ? session.queue.length : at, 0, { id: newId(), text, attachments, now: true, ...(mode && { mode }) });
+      session.queue.splice(at < 0 ? session.queue.length : at, 0, { id: newId(), text, attachments, now: true, ...extra });
       this.#interrupt(session);
       return { interrupted: true };
     }
     if (mode) session.mode = mode;
-    this.#startTurn(session, text, attachments);
+    if (run) this.#switchRun(session, run);
+    this.#startTurn(session, text, attachments, extra);
     return { queued: false };
   }
 
+  // The card under a turn whose permissions refused something: allow retries it as a follow-up,
+  // with exactly those actions allowed where the harness can scope a grant, else in Full auto for
+  // that one follow-up. Deny just closes the card.
+  approveBlocked(session, { turnId, allow }) {
+    const turn = turnId ? session.turns.find((t) => t.id === turnId) : session.turns.at(-1);
+    if (!turn?.blocked?.length) throw bad('Nothing on that turn is waiting for approval.', 404);
+    if (turn.approval) throw bad(`Already ${turn.approval}.`, 409);
+    if (turn !== session.turns.at(-1) || this.live.has(session.id)) throw bad('The task has moved on since; send a follow-up instead.', 409);
+    turn.approval = allow ? 'allowed' : 'denied';
+    if (!allow) {
+      this.#touch(session, { turn: turn.id });
+      return { denied: true };
+    }
+    const scoped = turn.blocked.every((b) => b.rule !== undefined);
+    const out = this.reply(session, retryPrompt(turn.blocked, scoped), [], scoped ? { grants: turn.blocked.map((b) => b.rule) } : { once: 'auto' });
+    this.#touch(session, { turn: turn.id });
+    return { ...out, scoped };
+  }
+
+  // A follow-up on another harness, model or thinking level. A model or level change resumes the
+  // same conversation; a harness change resumes that harness's own one (if it ran earlier in this
+  // task) or starts it fresh, and #startTurn hands it the turns it missed.
+  #switchRun(session, { agent, model, effort }) {
+    session.agentSessions ||= {};
+    // Sessions from before agentSessions: their conversation belongs to the harness they ran on.
+    if (session.agentSessionId) session.agentSessions[session.agent] = session.agentSessionId;
+    for (const t of session.turns) t.agent ||= session.agent;
+    // Auto's pick was overruled: the card stops crediting it, and the router learns (services/auto.js).
+    if (session.route && (agent !== session.agent || model !== session.model)) session.route.switched = true;
+    if (agent !== session.agent) {
+      session.agent = agent;
+      session.agentSessionId = session.agentSessions[agent] || null;
+    }
+    session.model = model;
+    session.effort = effort;
+  }
+
   // Drop a follow-up that hasn't gone out yet.
   unqueue(session, itemId) {
     const at = session.queue.findIndex((q) => q.id === itemId);
@@ -189,7 +264,8 @@ export class Runner extends EventEmitter {
   }
 
   // ask_user: the agent is blocked inside a tool call until answer() is called.
-  ask(session, { question, context, options }) {
+  // permission: set for a live approval ({ tool, action, detail }), see requestApproval().
+  ask(session, { question, context, options, permission }) {
     const turn = session.turns.at(-1);
     session.ask = {
       id: newId(),
@@ -197,34 +273,66 @@ export class Runner extends EventEmitter {
       context: context ? String(context) : '',
       options: Array.isArray(options) ? options.map(String).slice(0, 6) : [],
       askedAt: Date.now(),
+      ...(permission && { permission }),
     };
     session.state = 'waiting';
     session.unread = true;
     delete session.archived; // a question needs the user, so it comes back to the feed
-    if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'ask', label: `Asked you: ${session.ask.question}` });
+    const label = permission ? `Needs your OK to ${permission.action}` : `Asked you: ${session.ask.question}`;
+    if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'ask', label });
     this.#touch(session, { turn: turn?.id });
     this.emit('finished', { session: summarize(session, this.store) });
     return session.ask.id;
   }
 
+  // Live approval: the harness asks before a tool call its permission mode doesn't allow on its
+  // own (Claude's --permission-prompt-tool). It waits on the answer like ask_user; something the
+  // user said "always" to earlier in this task goes through at once.
+  requestApproval(session, { tool, input }) {
+    const adapter = adapters[session.agent];
+    const p = adapter.permission?.(String(tool || ''), input && typeof input === 'object' ? input : {}, workdir(session)) || { tool: String(tool || 'tool'), action: `use ${tool}`, detail: '' };
+    const turn = session.turns.at(-1);
+    if ((session.grants || []).some((g) => sameAction(g, p))) {
+      if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'answer', label: `Allowed (always in this task): ${p.action}` });
+      return { decision: 'allow' };
+    }
+    const id = this.ask(session, {
+      question: `Allow ${adapter.name} to ${p.action}?`,
+      context: p.why || '',
+      options: [APPROVAL.allow, APPROVAL.always, APPROVAL.deny],
+      permission: { tool: p.tool, action: p.action, detail: p.detail },
+    });
+    return { id };
+  }
+
   answer(session, text) {
     const ask = session.ask;
     if (!ask) return false;
     ask.answer = text;
-    this.answers.set(ask.id, text);
+    const turn = session.turns.at(-1);
+    let label = `You answered: ${text}`;
+    if (ask.permission) {
+      const d = approvalDecision(text);
+      this.answers.set(ask.id, { answer: text, ...d });
+      const p = ask.permission;
+      if (d.always) (session.grants ||= []).push({ tool: p.tool, detail: p.detail });
+      // Denied here, so the turn's "blocked" card shouldn't offer it again.
+      if (d.decision === 'deny' && turn) (turn.denied ||= []).push({ tool: p.tool, detail: p.detail });
+      label = d.decision === 'allow' ? `You allowed${d.always ? ' (always in this task)' : ''}: ${p.action}` : `You denied: ${p.action}${d.message ? ` (“${d.message}”)` : ''}`;
+    } else this.answers.set(ask.id, { answer: text });
     delete session.ask;
     session.state = this.live.has(session.id) ? 'running' : 'review';
-    const turn = session.turns.at(-1);
-    if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'answer', label: `You answered: ${text}` });
+    if (turn) this.#onEvent(session, turn, { type: 'tool', kind: 'answer', label });
     this.#touch(session, { turn: turn?.id });
     return true;
   }
 
+  // { answer } once answered (plus { decision, message? } for an approval), { pending }, or { cancelled }.
   pollAnswer(askId) {
     if (this.answers.has(askId)) {
-      const answer = this.answers.get(askId);
+      const out = this.answers.get(askId);
       this.answers.delete(askId);
-      return { answer };
+      return out;
     }
     const open = this.store.all().some((s) => s.ask?.id === askId);
     return open ? { pending: true } : { cancelled: true };
@@ -234,9 +342,9 @@ export class Runner extends EventEmitter {
   // created on first use and resumed after that. Returns one record (or { error }) per task.
   delegate(lead, tasks) {
     const turn = lead.turns.at(-1);
-    if (turn?.status !== 'running') throw Object.assign(new Error('The lead agent is not running.'), { status: 409 });
+    if (turn?.status !== 'running') throw bad('The lead agent is not running.', 409);
     const team = lead.subagents || [];
-    if (!team.length) throw Object.assign(new Error('This session has no subagents. The user can add them when launching.'), { status: 400 });
+    if (!team.length) throw bad('This session has no subagents. The user can add them when launching.');
     const out = [];
     const claimed = new Set(); // copies handed a task in this call
     const busy = (name) => claimed.has(name) || this.live.has(lead.children?.[name]);
@@ -320,7 +428,8 @@ export class Runner extends EventEmitter {
     this.live.get(session.id).stop();
   }
 
-  #startTurn(session, prompt, attachments = []) {
+  // The record of a new turn, with the checkpoint taken before the agent touches anything.
+  #newTurn(session, prompt, attachments, mode = session.mode) {
     const id = newId();
     // A subagent's edits land in the lead's turn, whose checkpoint already covers them.
     const checkpoint =
@@ -329,13 +438,13 @@ export class Runner extends EventEmitter {
         : !session.turns.length && session.worktree?.head
           ? freshCheckpoint(session.worktree)
           : captureCheckpoint(workdir(session), session.id, id);
-    const turn = {
+    return {
       id,
       prompt,
       agent: session.agent,
       model: session.model,
       effort: session.effort || '',
-      mode: session.mode,
+      mode,
       attachments: attachments.map(({ id, name, mime, size }) => ({ id, name, mime, size })),
       startedAt: Date.now(),
       endedAt: null,
@@ -346,6 +455,42 @@ export class Runner extends EventEmitter {
       presentation: null,
       stats: null,
     };
+  }
+
+  // The wisp protocol for this run: a lead hears about its team, a subagent that it can't ask.
+  #systemPrompt(session, adapter, team) {
+    const base = session.parentId
+      ? systemPrompt({ ask: SUBAGENT_ASK })
+      : systemPrompt({ askTool: adapter.askTool }) + teamNote(team, adapters, delegateTool(adapter.askTool ?? 'mcp__wisp__ask_user'));
+    return base + workspaceNote(session) + this.promptExtra(session);
+  }
+
+  // wisp's own MCP server (ask_user, delegate), for harnesses that take one. Subagents get none.
+  #mcpServers(session, adapter, team) {
+    if (!this.bridge || adapter.askTool === null || session.parentId) return {};
+    return {
+      wisp: {
+        command: process.execPath,
+        args: [ASK_SERVER],
+        // Inside the desktop app execPath is the Electron binary; without
+        // ELECTRON_RUN_AS_NODE it boots a second app (extra Dock icon) per turn.
+        env: {
+          ELECTRON_RUN_AS_NODE: '1',
+          WISP_URL: this.bridge.url,
+          WISP_TOKEN: this.bridge.token,
+          WISP_SESSION: session.id,
+          ...(adapter.approveTool && { WISP_APPROVE: '1' }),
+          ...(team.length && { WISP_TEAM: JSON.stringify(team.map((m) => ({ name: m.name, agent: adapters[m.agent]?.name || m.agent, model: m.model, effort: m.effort, use: m.use, count: m.count || 1, copies: copies(m) }))) }),
+        },
+      },
+    };
+  }
+
+  // grants: harness rules allowing what the user approved, for this turn only. once: a mode for
+  // this turn only (an approved retry the harness can't scope runs in Full auto).
+  #startTurn(session, prompt, attachments = [], { grants = [], once } = {}) {
+    const mode = MODES.has(once) ? once : session.mode;
+    const turn = this.#newTurn(session, prompt, attachments, mode);
     session.turns.push(turn);
     session.state = 'running';
     session.unread = false;
@@ -359,37 +504,24 @@ export class Runner extends EventEmitter {
     const adapter = adapters[session.agent];
     // Leads get the delegate tool next to ask_user; subagents get neither (nobody to ask).
     const team = adapter.askTool !== null ? session.subagents || [] : [];
-    const prompt0 = session.parentId
-      ? systemPrompt({ ask: SUBAGENT_ASK })
-      : systemPrompt({ askTool: adapter.askTool }) + teamNote(team, adapters, delegateTool(adapter.askTool ?? 'mcp__wisp__ask_user'));
+    // A harness that hasn't seen every earlier turn (the user switched to it) gets them first.
+    const handoff = session.parentId ? '' : handoffNote(session, session.agent, session.agentSessionId, (t) => adapters[t.agent]?.name || t.agent);
+    // Mentioned tasks: a lead reads them with wisp_session; a run without wisp's tools gets their reports.
+    const tools = !session.parentId && adapter.askTool !== null && this.bridge;
+    const text = agentPrompt(prompt, this.store, { tool: tools ? (adapter.askTool ?? 'mcp__wisp__ask_user').replace(/ask_user$/, 'wisp_session') : null, self: session.id });
     const handle = adapter.run({
-      prompt,
+      prompt: handoff ? `${handoff}\n\n${text}` : text,
       attachments,
       cwd: workdir(session),
       resumeId: session.agentSessionId,
-      mode: session.mode,
+      mode,
+      grants,
       model: session.model,
       effort: session.effort || '',
-      systemPrompt: prompt0 + workspaceNote(session) + this.promptExtra(session),
+      systemPrompt: this.#systemPrompt(session, adapter, team),
       // A lead with a team delegates through wisp, so the harness's own subagent tool is switched off.
       delegating: team.length > 0 && !!this.bridge,
-      mcpServers: this.bridge && adapter.askTool !== null && !session.parentId
-        ? {
-            wisp: {
-              command: process.execPath,
-              args: [ASK_SERVER],
-              // Inside the desktop app execPath is the Electron binary; without
-              // ELECTRON_RUN_AS_NODE it boots a second app (extra Dock icon) per turn.
-              env: {
-                ELECTRON_RUN_AS_NODE: '1',
-                WISP_URL: this.bridge.url,
-                WISP_TOKEN: this.bridge.token,
-                WISP_SESSION: session.id,
-                ...(team.length && { WISP_TEAM: JSON.stringify(team.map((m) => ({ name: m.name, agent: adapters[m.agent]?.name || m.agent, model: m.model, effort: m.effort, use: m.use, count: m.count || 1, copies: copies(m) }))) }),
-              },
-            },
-          }
-        : {},
+      mcpServers: this.#mcpServers(session, adapter, team),
       onEvent: (ev) => {
         if (released) return; // a lingering process we already let go of
         const waiting = this.#onEvent(session, turn, ev) === 'waiting';
@@ -417,7 +549,8 @@ export class Runner extends EventEmitter {
       this.stopping.delete(session.id); // a stop that landed after the result has nothing left to stop
       const next = session.queue.shift();
       if (next?.mode) session.mode = next.mode;
-      if (next && this.store.get(session.id)) this.#startTurn(session, next.text, next.attachments);
+      if (next?.run && adapters[next.run.agent]) this.#switchRun(session, next.run);
+      if (next && this.store.get(session.id)) this.#startTurn(session, next.text, next.attachments, next);
       else this.#touch(session);
     };
     handle.release = release;
@@ -429,6 +562,7 @@ export class Runner extends EventEmitter {
     switch (ev.type) {
       case 'session':
         session.agentSessionId = ev.id;
+        (session.agentSessions ||= {})[session.agent] = ev.id;
         return;
       case 'tool':
       case 'tool_error':
@@ -465,6 +599,14 @@ export class Runner extends EventEmitter {
         if (leadTurn?.status === 'running') this.#onEvent(lead, leadTurn, { ...ev, by: session.member });
         return;
       }
+      case 'blocked': {
+        // A tool call the harness's permissions refused. The card after the turn offers to retry it.
+        const item = { tool: String(ev.tool || 'tool'), detail: String(ev.detail ?? ''), ...(ev.rule !== undefined && { rule: ev.rule }) };
+        const list = (turn.blocked ||= []);
+        if (!list.some((b) => sameAction(b, item))) list.push(item);
+        this.store.save(session);
+        return;
+      }
       case 'background': {
         turn.background = ev.tasks;
         if (turn.interim) this.#waitItem(session, turn);
@@ -532,6 +674,7 @@ export class Runner extends EventEmitter {
       // Compare runs keep the prompt's title: they're one task, and one run's headline shouldn't name it.
       if (hero?.title && session.titleAuto && session.turns.length === 1 && !session.groupId) session.title = hero.title;
     }
+    if (!ev.stopped) blockedCard(turn);
     session.state = 'review';
     session.unread = !interrupted;
     this.store.save(session, { now: true });
@@ -550,3 +693,27 @@ export class Runner extends EventEmitter {
     if (turn) this.emit('turn', { sessionId: session.id, turnId: turn });
   }
 }
+
+// What the turn's permissions refused, as one "blocked" block after the hero: the harness's own
+// reports (which can carry a rule to allow exactly that) merged with the agent's "blocked" block,
+// minus anything the user already denied. turn.blocked keeps the list for the retry.
+function blockedCard(turn) {
+  const blocks = turn.presentation?.blocks || [];
+  const own = blocks.filter((b) => b.type === 'blocked').flatMap((b) => (Array.isArray(b.items) ? b.items : []));
+  const items = [...(turn.blocked || [])];
+  for (const i of own) {
+    if (!i || typeof i !== 'object') continue;
+    const item = { tool: String(i.tool || 'tool'), detail: String(i.detail ?? i.command ?? i.path ?? ''), ...(i.why && { why: String(i.why) }) };
+    const known = items.find((b) => sameAction(b, item) || (item.detail && b.detail === item.detail));
+    if (known) known.why ||= item.why;
+    else items.push(item);
+  }
+  // The agent may name a tool its own way (shell for Bash): the same command still counts.
+  const left = items.filter((b) => !(turn.denied || []).some((d) => sameAction(d, b) || (b.detail && d.detail === b.detail))).slice(0, 12);
+  if (left.length) turn.blocked = left;
+  else delete turn.blocked;
+  if (!turn.presentation) return;
+  const rest = blocks.filter((b) => b.type !== 'blocked');
+  if (left.length) rest.splice(rest[0]?.type === 'hero' ? 1 : 0, 0, { type: 'blocked', items: left.map(({ rule, ...b }) => b) });
+  turn.presentation.blocks = rest;
+}

package/server/services/auto.js

@@ -0,0 +1,67 @@
+// Auto: wisp picks harness and model per task and learns from outcomes (server/router.js).
+// This wires the router to the rest of the server: which harnesses are installed here, the
+// user's Auto settings, and the outcome signals that come back from summaries.
+
+import { listAgents } from '../adapters/index.js';
+import { GOALS } from '../router.js';
+import { bad } from '../util.js';
+
+export function createAuto(app) {
+  const { store, router } = app;
+  let agentsHere = [];
+
+  const detect = async (opts) => {
+    const agents = await listAgents(opts);
+    agentsHere = agents;
+    const added = router.sync(agents);
+    if (added.length) app.broadcast('router', { added });
+    return agents;
+  };
+  // This computer's harnesses: the last ones detected, else detected now.
+  const agents = async () => (agentsHere.length ? agentsHere : await detect());
+
+  const opts = () => {
+    const r = store.config.defaults.router || {};
+    return { explore: r.explore !== 'off', allowed: Array.isArray(r.allowed) && r.allowed.length ? r.allowed : null };
+  };
+  const goalOf = (model) => (GOALS[model] ? model : GOALS[store.config.defaults.models?.auto] ? store.config.defaults.models.auto : 'balanced');
+
+  // Subagents set to Auto are routed on their first task, from this computer's harnesses.
+  app.runner.routeAuto = (prompt) => router.choose({ prompt, agents: agentsHere, goal: goalOf(), ...opts() });
+
+  // A routed session's outcome so far, from its summary: works the same for sessions on machines.
+  // Follow-ups after the first turn count as corrections; a merged or closed PR settles it, unless
+  // the user moved the task to another harness or model first.
+  const signals = (sum) => {
+    if (!sum?.id || !router.route(sum.id) || sum.status === 'running' || sum.state === 'running') return;
+    const pr = sum.pr?.state;
+    router.signal(sum.id, {
+      hero: ['done', 'partial', 'blocked', 'info'].includes(sum.status) ? sum.status : undefined,
+      followups: Math.max(0, (sum.turnCount || 1) - 1),
+      merged: pr === 'MERGED' || undefined,
+      closed: pr === 'CLOSED' || undefined,
+      switched: sum.route?.switched || undefined,
+    });
+  };
+
+  // agent 'auto' (and compare entries set to it) → a harness and model picked by the router from
+  // `agents`: this computer's, or the machine's the launch goes to. Model is the goal for Auto.
+  const resolve = async (body, agents, { team = false } = {}) => {
+    const want = [{ agent: body.agent, model: body.model, effort: body.effort }, ...(Array.isArray(body.compare) ? body.compare : [])];
+    if (!want.some((r) => r.agent === 'auto')) return body;
+    const taken = [];
+    const out = want.map((r, i) => {
+      if (r.agent !== 'auto') return r;
+      const pick = router.choose({ prompt: body.prompt, attachments: (body.attachments || []).length, agents, goal: goalOf(r.model), important: !!body.important, exclude: taken, needDelegate: i === 0 && team, ...opts() });
+      if (!pick) throw bad('Auto found no installed harness to run this on.');
+      taken.push(pick.key);
+      return { agent: pick.agent, model: pick.model, effort: '', route: pick.route };
+    });
+    return { ...body, ...out[0], compare: out.slice(1) };
+  };
+
+  // What the Auto view shows: goals, settings, and what the router learned.
+  const view = async () => ({ goals: GOALS, goal: goalOf(), settings: { explore: opts().explore, allowed: opts().allowed }, ...router.report(await agents()) });
+
+  return { detect, agents, opts, goalOf, signals, resolve, view };
+}

package/server/services/feedback.js

@@ -0,0 +1,53 @@
+// Feedback for the wisp team: thumbs on a turn and/or a note.
+// A rating sticks to its turn (it shows on the card and can be taken back). What goes out is
+// the rating, the user's own words, and how the run was set up — never the prompt or the result.
+
+import { splitId } from '../machines.js';
+import { feedbackAvailable } from '../telemetry.js';
+import { bad } from '../util.js';
+import { runProps } from './telemetry.js';
+
+export function createFeedback(app) {
+  const { store, machines, telemetry } = app;
+
+  return async function sendFeedback({ rating, text, sessionId, turnId, source } = {}) {
+    if (rating !== undefined && rating !== null && rating !== 'up' && rating !== 'down') throw bad('rating must be up or down');
+    text = String(text || '').trim();
+    if (rating === undefined && !text) throw bad('Write something, or pick 👍 / 👎.');
+    // A session on a machine: that wisp keeps the rating on its turn and sends it.
+    const at = sessionId && splitId(sessionId);
+    if (sessionId && turnId && rating !== undefined) app.router.signal(sessionId, { feedback: rating });
+    if (at) {
+      try {
+        return await machines.json(at.machine, 'POST', '/feedback', { rating, text, sessionId: at.id, turnId, source });
+      } catch (err) {
+        if (err.status === 400) throw err; // offline, or an older wisp there: send it from here, without the run
+      }
+    }
+    const s = sessionId && !at ? store.get(sessionId) : null;
+    if (sessionId && !at && !s) throw bad('no such session', 404);
+    const turn = s && (turnId ? s.turns.find((t) => t.id === turnId) : s.turns.at(-1));
+    if (turnId && s && !turn) throw bad('no such turn', 404);
+    // Only thumbs on a turn stick to it; a rating in the feedback dialog is about wisp as a whole.
+    if (turn && turnId && rating !== undefined) {
+      turn.feedback = rating ? { rating, at: Date.now() } : undefined;
+      store.save(s);
+      app.broadcast('turn', { sessionId: s.id, turnId: turn.id });
+    }
+    const blocks = turn?.presentation?.blocks || [];
+    const context = turn && {
+      ...runProps(s, turn),
+      status: turn.status,
+      heroStatus: blocks.find((b) => b.type === 'hero')?.status,
+      blockTypes: [...new Set(blocks.map((b) => b.type))],
+      durationMs: turn.endedAt ? turn.endedAt - turn.startedAt : undefined,
+      tour: s.agent === 'wisp' || undefined,
+    };
+    const props = { ...context, rating: rating || undefined, source: String(source || (turn ? 'turn' : 'app')).slice(0, 20), machine: at ? true : undefined };
+    // Thumbs on a turn count as a rating; anything written, or sent from the dialog, is 'feedback'.
+    const event = text || !turnId ? 'feedback' : 'turn_rated';
+    if (event === 'turn_rated' && rating === null) props.cleared = true;
+    const sent = await telemetry.feedback(event, { ...props, text: text || undefined });
+    return { ok: true, sent, available: feedbackAvailable() };
+  };
+}