xcoder-jarvis-agent 0.0.0-stage → 1.4.0

package/dist/jarvis/agent.js

@@ -0,0 +1,305 @@
+// xcoder:version 16 | xcoder:task task-482677 | xcoder:updated 2026-11-05T03:51:32.763Z | xcoder:subtask code-st-729fd8
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { createLlmClient, requestScope, shortId, XCODER_VERSION } from "xcoder-dna";
+import { ArgvError, parseArgv, USAGE } from "./argv.js";
+import { BudgetExceeded, clampIterations, DEFAULT_CAPS, RunBudget } from "./budget.js";
+import { CHAT_DIRECTIVE } from "./chat/prompt.js";
+import { runChatSession } from "./chat/session.js";
+import { EXIT } from "./exit.js";
+import { MemoryStore, resolveUserId, workspaceScopeId } from "./memory/store.js";
+import { assembleSystemPrompt } from "./prompt/assemble.js";
+import { POLICY_VERSION, renderPolicy } from "./prompt/policy.js";
+import { discoverSkills } from "./prompt/skills.js";
+import { MAX_ITERATIONS, runReactLoop } from "./react-loop.js";
+import { writeProvenance, pruneProvenance } from "./telemetry/provenance.js";
+import { createConfirm } from "./util/confirm.js";
+import { sha256 } from "./util/text.js";
+import { createKillProbe, readKillState } from "./util/kill.js";
+import { DEFAULT_LIMITS, createToolRegistry } from "./tools/registry.js";
+import { FS_TOOLS } from "./tools/fs-tools.js";
+import { MEMORY_TOOLS } from "./tools/memory-tools.js";
+export const JARVIS_AGENT_NAME = "jarvis-agent";
+// Re-exported so `EXIT` keeps its documented public path (design §2.3, T7),
+// even though the table itself now lives in a leaf module.
+export { EXIT } from "./exit.js";
+function emit(stream, text) {
+    try {
+        stream.write(text);
+    }
+    catch {
+        /* a closed stream must not fail the run */
+    }
+}
+/** Resolve a scope id from the real path, falling back to the raw path. */
+async function scopeIdFor(workspaceRoot) {
+    try {
+        return workspaceScopeId(await fsp.realpath(workspaceRoot));
+    }
+    catch {
+        return workspaceScopeId(path.resolve(workspaceRoot));
+    }
+}
+/**
+ * Runs one Jarvis invocation and returns a process exit code.
+ *
+ * Never throws for expected conditions: a bad flag, a missing key, a model
+ * failure, a tripped kill switch and an exhausted budget all become a number
+ * plus a redacted message (T7). Provenance is written in a `finally` so an
+ * aborted run still leaves an audit record.
+ */
+export async function runJarvisAgent(argv, deps = {}) {
+    const stdout = deps.stdout ?? process.stdout;
+    const stderr = deps.stderr ?? process.stderr;
+    const now = deps.now ?? (() => new Date());
+    let request;
+    try {
+        request = parseArgv(argv);
+    }
+    catch (err) {
+        const message = err instanceof ArgvError ? err.message : "invalid arguments";
+        emit(stderr, `jarvis: ${message}\n\n${USAGE}\n`);
+        return EXIT.error;
+    }
+    if (request.help) {
+        emit(stdout, `${USAGE}\n`);
+        return EXIT.answered;
+    }
+    // Chat runs many turns over one stdin/stdout pair; it owns its own loop.
+    // `runJarvisAgent` is injected rather than imported by the loop, so the two
+    // modules stay a DAG instead of a cycle (the loop calls back into this
+    // function once per turn, inheriting the same validation gate).
+    if (request.chat) {
+        return await runChatSession(request, runJarvisAgent, deps);
+    }
+    if (request.task.length === 0) {
+        emit(stderr, `jarvis: no task given\n\n${USAGE}\n`);
+        return EXIT.error;
+    }
+    const workspaceRoot = path.resolve(deps.workspaceRoot ?? process.cwd());
+    const memoryRoot = deps.memoryRoot ?? path.join(workspaceRoot, ".xcoder", "jarvis", "memory");
+    const runLogRoot = deps.runLogRoot ?? path.join(workspaceRoot, ".xcoder", "jarvis", "runs");
+    const env = deps.env ?? process.env;
+    const session = request.session ?? shortId("jarvis");
+    const runId = shortId("run");
+    const userId = resolveUserId(request.user);
+    const workspaceId = await scopeIdFor(workspaceRoot);
+    const kill = createKillProbe(workspaceRoot);
+    const confirm = deps.confirm ?? createConfirm({ stdin: process.stdin, stdout: stderr });
+    const memory = new MemoryStore({
+        rootDir: memoryRoot,
+        scope: { workspaceId, userId },
+        now,
+    });
+    const toolContext = {
+        workspaceRoot,
+        memory,
+        session,
+        confirm,
+        limits: DEFAULT_LIMITS,
+    };
+    const tools = deps.tools ?? [...FS_TOOLS, ...MEMORY_TOOLS];
+    const registry = createToolRegistry({ tools });
+    // Fail closed before doing any work at all.
+    const initialKill = readKillState(workspaceRoot);
+    if (initialKill.killed) {
+        const result = {
+            outcome: "aborted",
+            exitCode: EXIT.aborted,
+            iterations: 0,
+            runId,
+            session,
+            skills: [],
+            error: `kill switch tripped (${initialKill.reason})`,
+        };
+        emit(stderr, `jarvis: aborted — kill switch tripped (${initialKill.reason})\n`);
+        await safeWriteProvenance(runLogRoot, result, {
+            workspaceId,
+            userId,
+            policyVersion: POLICY_VERSION,
+            policySha256: sha256(renderPolicy(registry.describeForPrompt())),
+            skills: [],
+            skippedSkills: [],
+            toolAllowlist: registry.allowlist(),
+            toolsUsed: [],
+            memoryWrites: 0,
+            redactions: 0,
+            now,
+        });
+        return EXIT.aborted;
+    }
+    // ---- skills ----
+    const discovered = await discoverSkills({
+        workspaceRoot,
+        allow: request.skills.length > 0 ? request.skills : undefined,
+        env,
+    });
+    if (request.skills.length > 0 && discovered.packs.length === 0) {
+        emit(stderr, `jarvis: none of the requested skill packs were found (${request.skills.join(", ")})\n`);
+        return EXIT.error;
+    }
+    // In chat mode the user's line is recorded BEFORE the turn runs, so a failed
+    // turn still leaves a trace (tradeoff T4). It is stored as user-sourced data.
+    if (deps.chatTurn && request.memory) {
+        try {
+            await memory.append({
+                session,
+                kind: "task",
+                value: request.task,
+                source: "user",
+            });
+        }
+        catch {
+            /* a read-only memory dir must not fail the turn */
+        }
+    }
+    // ---- memory window (re-read every turn: this IS the continuity mechanism) ----
+    let window = [];
+    if (request.memory) {
+        try {
+            window = await memory.window();
+        }
+        catch {
+            window = [];
+        }
+    }
+    // ---- prompt ----
+    // The directive is the TRUSTED instruction section (PRM-02). A chat turn must
+    // never splice the user's text there, so it passes a constant; user text only
+    // ever arrives as transcript DATA (AC15).
+    const directive = deps.chatTurn ? CHAT_DIRECTIVE : request.task;
+    const assembled = assembleSystemPrompt({
+        agentName: JARVIS_AGENT_NAME,
+        directive,
+        skills: discovered.packs,
+        window,
+        toolAllowlist: registry.allowlist(),
+        toolManifest: registry.describeForPrompt(),
+        skippedSkills: discovered.skipped,
+        now: now(),
+    });
+    // ---- client ----
+    let client;
+    try {
+        client = deps.createClient ? deps.createClient() : createLlmClient("orchestrator");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message.slice(0, 300) : "model client could not start";
+        emit(stderr, `jarvis: ${message}\n`);
+        return EXIT.error;
+    }
+    const budget = new RunBudget({ ...DEFAULT_CAPS, maxIterations: clampIterations(request.maxIterations, MAX_ITERATIONS) }, now);
+    const toolsUsed = [];
+    let outcome = "error";
+    let answer;
+    let iterations = 0;
+    let errorMessage;
+    let memoryWrites = 0;
+    try {
+        // Install a recordUsage sink so dna-side usage events reach provenance.
+        const loopResult = await requestScope.run({ recordUsage: () => undefined }, () => runReactLoop({
+            task: request.task,
+            systemPrompt: assembled,
+            client,
+            registry,
+            toolContext,
+            maxIterations: clampIterations(request.maxIterations, MAX_ITERATIONS),
+            budget,
+            isKilled: kill,
+            onToolUsed: (name, observation) => {
+                toolsUsed.push({ name, ok: observation.ok, bytes: observation.bytes });
+                if (name === "remember" && observation.ok)
+                    memoryWrites += 1;
+            },
+        }));
+        outcome = loopResult.outcome;
+        answer = loopResult.answer;
+        iterations = loopResult.iterations;
+        errorMessage = loopResult.error;
+    }
+    catch (err) {
+        if (err instanceof BudgetExceeded) {
+            outcome = "budget_exceeded";
+            errorMessage = err.message;
+        }
+        else {
+            outcome = "error";
+            errorMessage = err instanceof Error ? err.message.slice(0, 300) : "run failed";
+            if (process.env["JARVIS_DEBUG"] === "1" && err instanceof Error && err.stack) {
+                emit(stderr, `${err.stack}\n`);
+            }
+        }
+    }
+    const exitCode = EXIT[outcome];
+    const result = {
+        outcome,
+        ...(answer !== undefined ? { answer } : {}),
+        exitCode,
+        iterations,
+        runId,
+        session,
+        skills: discovered.packs.map((p) => p.name),
+        ...(errorMessage !== undefined ? { error: errorMessage } : {}),
+    };
+    const usage = budget.snapshot();
+    const provenancePath = await safeWriteProvenance(runLogRoot, result, {
+        workspaceId,
+        userId,
+        policyVersion: assembled.provenance.policyVersion,
+        policySha256: assembled.provenance.policySha256,
+        skills: assembled.provenance.skills.map((s) => ({ name: s.name, sha256: s.sha256 })),
+        skippedSkills: assembled.provenance.skippedSkills,
+        toolAllowlist: registry.allowlist(),
+        toolsUsed,
+        memoryWrites,
+        redactions: memory.redactions(),
+        usage: { inputTokens: usage.inputTokens, outputTokens: usage.outputTokens },
+        outcome,
+        iterations,
+        error: errorMessage,
+        now,
+    });
+    // Retention pruning is housekeeping: off the hot path, never fatal.
+    void pruneProvenance(runLogRoot, now()).catch(() => undefined);
+    // ---- report ----
+    if (request.json) {
+        emit(stdout, JSON.stringify({ ...result, provenancePath }) + "\n");
+    }
+    else if (outcome === "answered") {
+        emit(stdout, `${answer ?? ""}\n`);
+    }
+    else {
+        emit(stderr, `jarvis: ${outcome}${errorMessage ? ` — ${errorMessage}` : ""}\n`);
+    }
+    return exitCode;
+}
+async function safeWriteProvenance(dir, result, extra) {
+    try {
+        return await writeProvenance(dir, {
+            v: 1,
+            runId: result.runId,
+            ts: extra.now().toISOString(),
+            agent: JARVIS_AGENT_NAME,
+            version: XCODER_VERSION,
+            workspaceId: extra.workspaceId,
+            userId: extra.userId,
+            session: result.session,
+            policyVersion: extra.policyVersion,
+            policySha256: extra.policySha256,
+            skills: extra.skills,
+            skippedSkills: extra.skippedSkills,
+            toolAllowlist: extra.toolAllowlist,
+            toolsUsed: extra.toolsUsed,
+            iterations: extra.iterations ?? result.iterations,
+            outcome: extra.outcome ?? result.outcome,
+            usage: extra.usage ?? { inputTokens: 0, outputTokens: 0 },
+            memoryWrites: extra.memoryWrites,
+            redactions: extra.redactions,
+            ...(extra.error !== undefined ? { error: extra.error } : {}),
+        });
+    }
+    catch {
+        // A read-only workspace must not turn a good answer into a failure.
+        return undefined;
+    }
+}

package/dist/jarvis/argv.d.ts

@@ -0,0 +1,30 @@
+/**
+ * CLI argument parsing (design §2.3).
+ *
+ * argv is untrusted input (PRM-01). This parser therefore only ever produces
+ * a validated `JarvisRunRequest`: an unknown flag is a hard error rather than
+ * being ignored, and numeric values are clamped in one place so a hostile
+ * `--max-iterations 100000` cannot widen the loop bound.
+ */
+export interface JarvisRunRequest {
+    task: string;
+    skills: string[];
+    maxIterations: number;
+    memory: boolean;
+    session?: string;
+    user?: string;
+    json: boolean;
+    help: boolean;
+    /** Interactive multi-turn mode (`--chat`). */
+    chat: boolean;
+    /** Session-wide cap on executed chat turns. Clamped to MAX_TURNS_CEILING. */
+    maxTurns: number;
+}
+export declare class ArgvError extends Error {
+    constructor(message: string);
+}
+export declare const USAGE: string;
+/** Session turn cap (AI-09): a chat can never run unbounded. */
+export declare const MAX_TURNS_CEILING = 200;
+export declare const MAX_TURNS_DEFAULT = 50;
+export declare function parseArgv(argv: readonly string[]): JarvisRunRequest;

package/dist/jarvis/argv.js

@@ -0,0 +1,138 @@
+// xcoder:version 6 | xcoder:task task-482677 | xcoder:updated 2026-11-05T03:46:34.204Z | xcoder:subtask code-st-729fd8
+export class ArgvError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ArgvError";
+    }
+}
+export const USAGE = `
+jarvis — a ReAct agent with memory and skill packs
+
+Usage:
+  jarvis [options] <task words...>
+  jarvis --chat [options]      multi-turn conversation on stdin
+
+Options:
+  --skill NAME            load only this skill pack (repeatable)
+  --max-iterations N      reasoning steps, 1..8 (default 8)
+  --chat                  read many turns from stdin until exit|quit|bye or EOF
+  --max-turns N           chat turns, 1..200 (default 50)
+  --no-memory             do not load or write memory for this run
+  --session ID            session label (default: generated)
+  --user ID               memory scope label (default: OS user)
+  --json                  emit one JSON line per executed turn
+  --help                  show this help and exit 0
+
+Chat:
+  Each line you type is one turn. Type exit, quit or bye on a line by itself
+  (case-insensitive) or send EOF to leave. A blank line is ignored. Earlier
+  turns are kept in the shared memory session, so the agent can recall them.
+  A terminator typed at a confirmation prompt denies that tool and ends the
+  session at the next turn boundary.
+
+Exit codes:
+  0 answered  1 error  2 iteration limit  3 budget exceeded  4 aborted
+  In chat mode 3 also means the --max-turns cap was reached.
+`.trim();
+const MAX_ITERATIONS_CEILING = 8;
+/** Session turn cap (AI-09): a chat can never run unbounded. */
+export const MAX_TURNS_CEILING = 200;
+export const MAX_TURNS_DEFAULT = 50;
+export function parseArgv(argv) {
+    const request = {
+        task: "",
+        skills: [],
+        maxIterations: MAX_ITERATIONS_CEILING,
+        memory: true,
+        session: undefined,
+        user: undefined,
+        json: false,
+        help: false,
+        chat: false,
+        maxTurns: MAX_TURNS_DEFAULT,
+    };
+    const positional = [];
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--") {
+            positional.push(...argv.slice(i + 1));
+            break;
+        }
+        if (!arg.startsWith("--")) {
+            positional.push(arg);
+            continue;
+        }
+        switch (arg) {
+            case "--help":
+                request.help = true;
+                break;
+            case "--json":
+                request.json = true;
+                break;
+            case "--no-memory":
+                request.memory = false;
+                break;
+            case "--chat":
+                request.chat = true;
+                break;
+            case "--max-turns": {
+                const value = argv[i + 1];
+                if (!value || value.startsWith("--")) {
+                    throw new ArgvError("--max-turns requires a number");
+                }
+                const n = Number(value);
+                if (!Number.isFinite(n) || !Number.isInteger(n)) {
+                    throw new ArgvError("--max-turns must be an integer");
+                }
+                request.maxTurns = Math.min(MAX_TURNS_CEILING, Math.max(1, n));
+                i += 1;
+                break;
+            }
+            case "--skill": {
+                const value = argv[i + 1];
+                if (!value || value.startsWith("--"))
+                    throw new ArgvError("--skill requires a pack name");
+                request.skills.push(value);
+                i += 1;
+                break;
+            }
+            case "--max-iterations": {
+                const value = argv[i + 1];
+                if (!value || value.startsWith("--")) {
+                    throw new ArgvError("--max-iterations requires a number");
+                }
+                const n = Number(value);
+                if (!Number.isFinite(n) || !Number.isInteger(n)) {
+                    throw new ArgvError("--max-iterations must be an integer");
+                }
+                request.maxIterations = Math.min(MAX_ITERATIONS_CEILING, Math.max(1, n));
+                i += 1;
+                break;
+            }
+            case "--session":
+            case "--user": {
+                const value = argv[i + 1];
+                if (!value || value.startsWith("--"))
+                    throw new ArgvError(`${arg} requires a value`);
+                if (arg === "--session")
+                    request.session = value.slice(0, 128);
+                else
+                    request.user = value.slice(0, 128);
+                i += 1;
+                break;
+            }
+            default:
+                // An unrecognised flag is an error, not something to ignore: silently
+                // accepting it could hide a misspelled security-relevant option.
+                throw new ArgvError(`unknown option ${arg}`);
+        }
+    }
+    request.task = positional.join(" ").trim();
+    // Tradeoff T2: a typed task alongside --chat is an error, never silently
+    // discarded — a dropped task looks like a model bug to the person who
+    // typed it. The chat loop takes its turns from stdin only.
+    if (request.chat && request.task.length > 0) {
+        throw new ArgvError("--chat reads its turns from stdin; do not pass a task as well");
+    }
+    return request;
+}

package/dist/jarvis/budget.d.ts

@@ -0,0 +1,49 @@
+export interface BudgetCaps {
+    /** Hard iteration ceiling. Clamped to 1..MAX_ITERATIONS by the runner. */
+    maxIterations: number;
+    maxInputTokens: number;
+    maxOutputTokens: number;
+    maxWallMs: number;
+}
+export declare const DEFAULT_CAPS: BudgetCaps;
+export declare class BudgetExceeded extends Error {
+    readonly dimension: "iterations" | "input-tokens" | "output-tokens" | "wall-clock";
+    constructor(message: string, dimension: "iterations" | "input-tokens" | "output-tokens" | "wall-clock");
+}
+export interface BudgetSnapshot {
+    inputTokens: number;
+    outputTokens: number;
+    wallMs: number;
+    iterations: number;
+}
+/**
+ * Per-run resource cap (AI-09).
+ *
+ * Jarvis owns this rather than reusing xcoder-dna's `RequestBudget` because
+ * that class is not exported from the dna barrel (and reaching past the
+ * barrel is forbidden by the boundary checker), and because a dollar cap is
+ * meaningless when the caller may be pointed at a local model. Caps here are
+ * token, iteration and wall-clock based. See design tradeoff T4.
+ */
+export declare class RunBudget {
+    private readonly caps;
+    private readonly now;
+    private inputTokens;
+    private outputTokens;
+    private iterations;
+    private readonly startedAt;
+    constructor(caps?: BudgetCaps, now?: () => Date);
+    /** Count one completed reasoning iteration. */
+    countIteration(): void;
+    chargeUsage(u: {
+        inputTokens: number;
+        outputTokens: number;
+    }): void;
+    /** Throws BudgetExceeded as soon as any dimension is over its cap. */
+    check(): void;
+    remainingIterations(): number;
+    wallMs(): number;
+    snapshot(): BudgetSnapshot;
+}
+/** Clamp a user-supplied iteration count into the safe band. */
+export declare function clampIterations(requested: number | undefined, fallback?: number): number;

package/dist/jarvis/budget.js

@@ -0,0 +1,83 @@
+// xcoder:version 1 | xcoder:task task-f1b5f6 | xcoder:updated 2026-11-05T02:44:59.650Z | xcoder:subtask code-st-53c7b5
+export const DEFAULT_CAPS = {
+    maxIterations: 8,
+    maxInputTokens: 60_000,
+    maxOutputTokens: 16_000,
+    maxWallMs: 180_000,
+};
+export class BudgetExceeded extends Error {
+    dimension;
+    constructor(message, dimension) {
+        super(message);
+        this.dimension = dimension;
+        this.name = "BudgetExceeded";
+    }
+}
+/**
+ * Per-run resource cap (AI-09).
+ *
+ * Jarvis owns this rather than reusing xcoder-dna's `RequestBudget` because
+ * that class is not exported from the dna barrel (and reaching past the
+ * barrel is forbidden by the boundary checker), and because a dollar cap is
+ * meaningless when the caller may be pointed at a local model. Caps here are
+ * token, iteration and wall-clock based. See design tradeoff T4.
+ */
+export class RunBudget {
+    caps;
+    now;
+    inputTokens = 0;
+    outputTokens = 0;
+    iterations = 0;
+    startedAt;
+    constructor(caps = DEFAULT_CAPS, now = () => new Date()) {
+        this.caps = caps;
+        this.now = now;
+        this.startedAt = this.now().getTime();
+    }
+    /** Count one completed reasoning iteration. */
+    countIteration() {
+        this.iterations += 1;
+        this.check();
+    }
+    chargeUsage(u) {
+        const input = Number.isFinite(u.inputTokens) ? Math.max(0, u.inputTokens) : 0;
+        const output = Number.isFinite(u.outputTokens) ? Math.max(0, u.outputTokens) : 0;
+        this.inputTokens += input;
+        this.outputTokens += output;
+        this.check();
+    }
+    /** Throws BudgetExceeded as soon as any dimension is over its cap. */
+    check() {
+        if (this.iterations > this.caps.maxIterations) {
+            throw new BudgetExceeded(`iteration budget exhausted (${this.caps.maxIterations})`, "iterations");
+        }
+        if (this.inputTokens > this.caps.maxInputTokens) {
+            throw new BudgetExceeded(`input token budget exhausted (${this.caps.maxInputTokens})`, "input-tokens");
+        }
+        if (this.outputTokens > this.caps.maxOutputTokens) {
+            throw new BudgetExceeded(`output token budget exhausted (${this.caps.maxOutputTokens})`, "output-tokens");
+        }
+        if (this.wallMs() > this.caps.maxWallMs) {
+            throw new BudgetExceeded(`wall-clock budget exhausted (${this.caps.maxWallMs}ms)`, "wall-clock");
+        }
+    }
+    remainingIterations() {
+        return Math.max(0, this.caps.maxIterations - this.iterations);
+    }
+    wallMs() {
+        return Math.max(0, this.now().getTime() - this.startedAt);
+    }
+    snapshot() {
+        return {
+            inputTokens: this.inputTokens,
+            outputTokens: this.outputTokens,
+            wallMs: this.wallMs(),
+            iterations: this.iterations,
+        };
+    }
+}
+/** Clamp a user-supplied iteration count into the safe band. */
+export function clampIterations(requested, fallback = 8) {
+    const base = Number.isFinite(requested) ? Math.trunc(requested) : fallback;
+    return Math.min(8, Math.max(1, base));
+}

package/dist/jarvis/chat/confirm.d.ts

@@ -0,0 +1,23 @@
+import type { ConfirmFn } from "../util/confirm.js";
+import type { LineSource } from "./lines.js";
+/**
+ * Human-in-the-loop gate for chat mode (AI-03, design K3/AC20).
+ *
+ * Three properties matter:
+ *  - it reads from the SAME LineSource the loop uses, so there is still only
+ *    one reader on stdin and a prompt cannot swallow a queued turn;
+ *  - it fails closed when the session is not interactive — nobody is there to
+ *    approve, so the answer is deny;
+ *  - a terminator typed at the prompt denies the tool and records a pending
+ *    exit, so a person can leave a session that is asking them something
+ *    (tradeoff T5). Re-queueing the line would risk an unbounded read cycle.
+ */
+export interface ChatConfirm extends ConfirmFn {
+    /** True once a terminator was typed at a prompt; the loop exits at the next boundary. */
+    readonly pendingExit: boolean;
+}
+export declare function createChatConfirm(opts: {
+    lines: LineSource;
+    stdout: NodeJS.WritableStream;
+    isInteractive: boolean;
+}): ChatConfirm;

package/dist/jarvis/chat/confirm.js

@@ -0,0 +1,37 @@
+import { isTerminator } from "./terminator.js";
+const RISK_LABEL = {
+    read: "reads data",
+    write: "modifies local state",
+    irreversible: "CANNOT BE UNDONE",
+};
+const YES_RE = /^y(es)?$/i;
+export function createChatConfirm(opts) {
+    const { lines, stdout, isInteractive } = opts;
+    let pendingExit = false;
+    const confirm = async (req) => {
+        if (!isInteractive)
+            return false;
+        const summary = req.summary.slice(0, 200).replace(/\s+/g, " ");
+        try {
+            stdout.write(`jarvis: allow tool "${req.tool}" (${RISK_LABEL[req.risk]})? ${summary} [y/N] `);
+        }
+        catch {
+            /* a closed stream must not fail the turn */
+        }
+        const result = await lines.next();
+        if (result.kind !== "line") {
+            // EOF or an oversized line cannot be an approval.
+            pendingExit = true;
+            return false;
+        }
+        if (isTerminator(result.text)) {
+            pendingExit = true;
+            return false;
+        }
+        return YES_RE.test(result.text.trim());
+    };
+    return Object.defineProperty(confirm, "pendingExit", {
+        get: () => pendingExit,
+        enumerable: true,
+    });
+}