alissa-tools-github-revloop 0.31.2__tar.gz → 0.31.4__tar.gz

{alissa_tools_github_revloop-0.31.2/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.31.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.31.2
+Version: 0.31.4
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.31.2 → alissa_tools_github_revloop-0.31.4}/src/main/alissa/tools/github/revloop/alissa.py

@@ -4,12 +4,15 @@ reviewer session (orchestration P1)."""
 from __future__ import annotations
 
 import logging
+import os
 import re
+import time
 from dataclasses import dataclass
 from datetime import datetime
 from pathlib import Path
 
 from .proc import CommandError, run, run_json
+from .prompts import ALLOWED_KEYS
 
 log = logging.getLogger(__name__)
 
@@ -236,7 +239,7 @@ _VERDICT_RE = re.compile(
 # The envelope's merge-readiness judgment (issue #130). The alissa-code-review
 # skill writes it as one list line in the verdict envelope:
 #   - **Merge-Readiness:** auto
-#   - **Merge-Readiness:** operator — touches convex/schema.ts
+#   - **Merge-Readiness:** operator — schema-migration: removes users.legacyId
 # Tolerant of the markdown around the label -- an optional bullet, optional
 # `**` bold around the label (with the colon inside or outside it), optional
 # bold around the value -- but NOT of the value's case: `Auto` is not a
@@ -252,21 +255,83 @@ _READINESS_RE = re.compile(
     re.MULTILINE,
 )
 
+# The operator reason's CLASS (issue #142). An `operator` judgment names WHY
+# the merge is a human's, and until now it did so in prose the merge edge
+# could not act on: of 14 operator verdicts on ~40 studio PRs, 3 named real
+# merge risk and 11 were "the PR body lists an unverified item" -- validation
+# work the human does at gate 2 anyway, not a reason to withhold the merge.
+# So the reason now LEADS with one token from this closed enum, in the
+# consumer's grammar:
+#
+#   Merge-Readiness: auto
+#   Merge-Readiness: operator — <class>: <one-line reason>
+#
+# The order below is the SEVERITY order: when more than one row applies, the
+# reviewer names the one nearest the top (the most severe wins), and exactly
+# one. `auto` never carries a class. An operator line whose reason does not
+# lead with a recognised token is still valid grammar -- it parses, value and
+# reason intact -- and reads as UNCLASSED (`klass=None`); the consumer treats
+# unclassed as a hard hold (fail closed), so a reviewer that forgets the
+# class loses throughput, never safety. The token is matched exactly as
+# written here (lowercase, hyphenated): `Schema-Migration:` is not a class
+# this daemon reads, for the same reason `Auto` is not a value it carries.
+READINESS_CLASSES: "tuple[str, ...]" = (
+    "schema-migration",   # schema shape changes needing a migration / removal / rename on live data
+    "data-backfill",      # one-off writes over existing rows (backfills, stored-shape version bumps)
+    "secrets-env",        # new / changed env vars, secrets, credentials the deploy must carry
+    "infra-deploy",       # Dockerfiles, workflows, Railway config, base-image pins -- what runs
+    "billing",            # credit charging, pricing, tiers, quotas
+    "security",           # auth, permission gates, redaction, sandboxing flagged operator-worthy
+    "unverified-ux",      # the PR body's operator gate is a human look at a screen / copy / mockup
+    "unverified-runtime",  # the PR body's operator gate is a live smoke / real-model run / replay
+    "release-act",        # the merge itself is a release (VERSION bump -> publish, tag, npm)
+)
+_READINESS_CLASS_RE = re.compile(
+    r"^(" + "|".join(re.escape(klass) for klass in READINESS_CLASSES) + r")[ \t]*:"
+)
+
 # The reason lands in a GitHub review body (as a line-anchored trailer) and in
 # a log line, so it is bounded and flattened at the parser: one line, no
 # backticks (a fence would swallow the trailer and everything after it), and
-# no more than this many characters.
+# no more than this many characters. The class prefix is PART of the reason
+# and survives the flattening untouched: the native trailer must stay
+# byte-equal to the envelope's line, class included.
 MAX_READINESS_REASON_CHARS = 200
 
 
 def clean_readiness_reason(text: object) -> str:
-    """Flatten a Merge-Readiness reason to one bounded, backtick-free line."""
+    """Flatten a Merge-Readiness reason to one bounded, backtick-free line.
+
+    The `<class>:` prefix, when present, is kept intact at the head of the
+    line -- classify_readiness_reason reads it off the cleaned reason, and the
+    emitter copies the cleaned reason whole.
+    """
     if not isinstance(text, str):
         return ""
     flat = " ".join(text.replace("`", "").split())
     return flat[:MAX_READINESS_REASON_CHARS].rstrip()
 
 
+def classify_readiness_reason(value: object, reason: object) -> "str | None":
+    """The READINESS_CLASSES token an `operator` reason leads with, or None.
+
+    None for `auto` (never classed), for an operator reason that leads with
+    no recognised token (UNCLASSED -- the consumer's hard hold), and for a
+    token in the wrong case or spelling. The reason itself is never altered:
+    the class is read off it, not cut out of it.
+    """
+    if value != READINESS_OPERATOR or not isinstance(reason, str):
+        return None
+    match = _READINESS_CLASS_RE.match(reason)
+    return match.group(1) if match else None
+
+
+def _classed(value: "str | None", raw_reason: object) -> "tuple[str | None, str, str | None]":
+    """The `(value, reason, klass)` triple both parsers hand back."""
+    reason = clean_readiness_reason(raw_reason)
+    return (value, reason, classify_readiness_reason(value, reason))
+
+
 # The trailer's own grammar (issue #134) -- the bare-line sibling of
 # _READINESS_RE. This is the line a native review ENDS with, whoever wrote
 # it: the daemon's emitter (loop.readiness_trailer) when it posts the verdict
@@ -285,37 +350,42 @@ _TRAILER_RE = re.compile(
 )
 
 
-def parse_trailer(body: object) -> "tuple[str | None, str]":
-    """`(value, reason)` from the first bare `Merge-Readiness:` line in a
-    review body, or `(None, "")` when no line matches the trailer grammar.
+def parse_trailer(body: object) -> "tuple[str | None, str, str | None]":
+    """`(value, reason, klass)` from the first bare `Merge-Readiness:` line in
+    a review body, or `(None, "", None)` when no line matches the trailer
+    grammar.
 
     Strict where parse_readiness is tolerant: the line inside backticks
     mid-sentence (studio #1258) and the envelope's `- **Merge-Readiness:**`
     bullet both read as MISSING here, because the consumer's regex is what
     decides whether the merge edge sees the judgment at all. CRLF bodies (a
     review typed into the web form) are normalised first; the grammar itself
-    is unchanged.
+    is unchanged. `klass` is the READINESS_CLASSES token an operator reason
+    leads with, or None (auto, or an unclassed operator -- issue #142).
     """
     if not isinstance(body, str):
-        return (None, "")
+        return (None, "", None)
     match = _TRAILER_RE.search(body.replace("\r\n", "\n"))
     if match is None:
-        return (None, "")
-    return (match.group(1), clean_readiness_reason(match.group(2)))
+        return (None, "", None)
+    return _classed(match.group(1), match.group(2))
 
 
-def parse_readiness(blob: object) -> "tuple[str | None, str]":
-    """`(value, reason)` from the first Merge-Readiness line in `blob`.
+def parse_readiness(blob: object) -> "tuple[str | None, str, str | None]":
+    """`(value, reason, klass)` from the first Merge-Readiness line in `blob`.
 
     `value` is READINESS_AUTO / READINESS_OPERATOR, or None when no line
-    parses; `reason` is the cleaned trailing text (empty when there is none).
+    parses; `reason` is the cleaned trailing text (empty when there is none),
+    class prefix included; `klass` is the READINESS_CLASSES token that reason
+    leads with, or None when the value is `auto`, the reason is unclassed, or
+    nothing parsed (issue #142).
     """
     if not isinstance(blob, str):
-        return (None, "")
+        return (None, "", None)
     match = _READINESS_RE.search(blob)
     if match is None:
-        return (None, "")
-    return (match.group(1), clean_readiness_reason(match.group(2)))
+        return (None, "", None)
+    return _classed(match.group(1), match.group(2))
 
 
 @dataclass(frozen=True)
@@ -336,6 +406,83 @@ class Task:
 # kill on.
 REVIEW_SESSION_PREFIX = "review-"
 
+# `alissa tmux new` names the REAL tmux session `ali-<name>`; the roster's
+# `name` is the managed name without it. The raw tmux surface below addresses
+# the real one, and the waiting marker (docker/claude/hooks/note-waiting.py)
+# is named after it too.
+MANAGED_PREFIX = "ali-"
+
+# The console's session-name rule (webui.server), stated once so the raw
+# tmux argv builders and the HTTP surface can never drift: a managed name
+# starts with a letter or digit and carries only these characters, which is
+# what keeps a `-flag`-shaped or shell-metacharacter name out of any argv.
+SAFE_SESSION = re.compile(r"\A[A-Za-z0-9._][A-Za-z0-9._-]{0,199}\Z")
+
+
+def tmux_socket() -> str:
+    """The path of the tmux server socket the reviewer sessions live on:
+    `$TMUX_TMPDIR/tmux-<uid>/default` (tmux's own default). Spelled out
+    rather than left to tmux because the daemon may run without `TMUX` in
+    its environment and must still reach the SAME server `alissa tmux new`
+    created for the reviewers -- same container, same user, same socket."""
+    base = os.environ.get("TMUX_TMPDIR", "").strip() or "/tmp"
+    return os.path.join(base, f"tmux-{os.getuid()}", "default")
+
+
+def tmux_target(name: str) -> str:
+    """The `-t` target for a managed session: the real tmux name, prefixed
+    with `=` so tmux matches it EXACTLY (its default is prefix matching, and
+    `review-widgets-pr1-r1-abcdef` is a prefix of `…-r1-abcdef0`) and
+    suffixed with `:` so the target is the session's CURRENT WINDOW (and its
+    active pane) -- a bare `=name` is a session target, which `capture-pane`
+    and `send-keys` refuse with "can't find pane" (tmux 3.3a)."""
+    real = name if name.startswith(MANAGED_PREFIX) else MANAGED_PREFIX + name
+    return "=" + real + ":"
+
+
+def check_session_name(name: "str | None") -> str:
+    """`name` when it passes SAFE_SESSION, else ValueError. Every raw tmux
+    argv builder calls this first."""
+    if not name or not SAFE_SESSION.match(name):
+        raise ValueError(f"invalid session name {name!r}")
+    return name
+
+
+def capture_pane_argv(name: str, lines: int) -> "list[str]":
+    """`tmux -S <socket> capture-pane -p -t =<real> -S -<lines>`: the last
+    `lines` lines of the session's active pane, printed to stdout, with
+    escape sequences stripped (`-p` without `-e`)."""
+    check_session_name(name)
+    return [
+        "tmux", "-S", tmux_socket(), "capture-pane", "-p",
+        "-t", tmux_target(name), "-S", f"-{max(1, int(lines))}",
+    ]
+
+
+def pane_path_argv(name: str) -> "list[str]":
+    check_session_name(name)
+    return [
+        "tmux", "-S", tmux_socket(), "display-message", "-p",
+        "-t", tmux_target(name), "#{pane_current_path}",
+    ]
+
+
+def send_keys_argv(name: str, keys: "tuple[str, ...]") -> "list[str]":
+    """`tmux -S <socket> send-keys -t =<real> <key>…` with every key drawn
+    from `prompts.ALLOWED_KEYS`. Anything else -- a letter, a word, a path --
+    is a ValueError before any process is spawned: the responder presses a
+    dialog's buttons and can never type into a reviewer."""
+    check_session_name(name)
+    if not keys:
+        raise ValueError("send_keys needs at least one key")
+    bad = [k for k in keys if k not in ALLOWED_KEYS]
+    if bad:
+        raise ValueError(
+            f"key(s) not in the allowlist {sorted(ALLOWED_KEYS)}: {bad!r}"
+        )
+    return ["tmux", "-S", tmux_socket(), "send-keys", "-t", tmux_target(name), *keys]
+
+
 # The reviewer-session GRAMMAR. The sweep kills sessions and the worker
 # container is shared with other lanes (`develop-*`, `fix-*`, `maintain-*`,
 # ...), so only a name that parses as one of the two shapes the review loop
@@ -419,11 +566,29 @@ class ManagedSession:
     # not report one -- treated as "long quiet", so a missing field can never
     # indefinitely immunize a session against the sweep.
     last_activity: float = 0.0
+    # The REAL tmux session name (`ali-<name>`, the roster's `session`
+    # field), or None when the CLI did not report one. The prompt responder
+    # names the waiting marker by it; absent, `MANAGED_PREFIX + name`.
+    session: "str | None" = None
 
     @property
     def is_idle(self) -> bool:
         return self.status == "idle"
 
+    @property
+    def tmux_name(self) -> str:
+        """The real tmux session name -- the roster's, else derived."""
+        return self.session or MANAGED_PREFIX + self.name
+
+    @property
+    def quiet_for(self) -> "float | None":
+        """Seconds since the last tmux activity, or None when the CLI
+        reported no timestamp (the sweep reads that 0 as "long quiet"; the
+        prompt responder reads it as "unknown" and waits for a marker)."""
+        if not self.last_activity:
+            return None
+        return max(0.0, time.time() - self.last_activity)
+
     @property
     def ref(self) -> "SessionRef | None":
         """What the name says about the round -- see parse_session_name."""
@@ -482,12 +647,17 @@ class VerdictEnvelope:
     envelope has no parseable `Merge-Readiness` line -- the case the native
     post fails closed on. `readiness_reason` is already one bounded,
     backtick-free line (see clean_readiness_reason); empty when the envelope
-    gave none.
+    gave none. `readiness_class` is the READINESS_CLASSES token an operator
+    reason leads with (issue #142), or None: for `auto`, for an unclassed
+    operator reason, and for a missing line alike -- the reason keeps the
+    prefix either way, so the class is never lost between here and the
+    native trailer.
     """
 
     verdict: str
     readiness: "str | None" = None
     readiness_reason: str = ""
+    readiness_class: "str | None" = None
 
 
 @dataclass(frozen=True)
@@ -988,9 +1158,9 @@ class Alissa:
                     continue
                 match = _VERDICT_RE.search(blob)
                 if match:
-                    readiness, reason = parse_readiness(content)
+                    readiness, reason, klass = parse_readiness(content)
                     if readiness is None:
-                        readiness, reason = parse_readiness(title)
+                        readiness, reason, klass = parse_readiness(title)
                     found.append(
                         (Alissa._created_key(item.get("createdAt")),
                          index,
@@ -998,6 +1168,7 @@ class Alissa:
                              verdict=match.group(1).lower(),
                              readiness=readiness,
                              readiness_reason=reason,
+                             readiness_class=klass,
                          ))
                     )
                     break
@@ -1117,11 +1288,13 @@ class Alissa:
             name = row.get("name")
             if isinstance(name, str) and parse_session_name(name) is not None:
                 last = row.get("lastActivity")
+                real = row.get("session")
                 sessions.append(
                     ManagedSession(
                         name=name,
                         status=str(row.get("status") or ""),
                         last_activity=float(last) if isinstance(last, (int, float)) else 0.0,
+                        session=real if isinstance(real, str) and real else None,
                     )
                 )
         return sessions
@@ -1161,6 +1334,72 @@ class Alissa:
             log.debug("could not tail %s: %s", session, exc)
             return ""
 
+    def capture_pane(self, name: str, lines: int = 40) -> str:
+        """The last `lines` of ONE managed session's pane over raw tmux
+        (`capture-pane -p`), or "" when tmux cannot answer (no such session,
+        the socket gone, a timeout).
+
+        The responder's evidence seam (issue #138). Like `tail_session` it
+        returns UNTRUSTED, possibly sensitive terminal content: the caller
+        classifies it and lets only the classification -- plus a scrubbed
+        signature line -- reach an operator-facing level. A READ, so it runs
+        under dry-run too: a dry pass has to classify what a live one would.
+        Raw tmux rather than the `alissa` CLI because the CLI's `tail` is a
+        convenience without `send-keys` beside it, and the answer has to land
+        on the very pane the capture read."""
+        try:
+            argv = capture_pane_argv(name, lines)
+        except ValueError as exc:
+            log.warning("capture_pane refused: %s", exc)
+            return ""
+        try:
+            out = run(argv, timeout=15)
+        except CommandError as exc:
+            log.debug("could not capture the pane of %s (%s)", name, exc)
+            return ""
+        return out.rstrip("\n")
+
+    def pane_path(self, name: str) -> str:
+        """The session's pane current path (`#{pane_current_path}`), or ""
+        when tmux cannot answer. One leg of the review-checkout resolution:
+        a reviewer that `cd`ed into its `REVIEW-*` checkout names it here."""
+        try:
+            argv = pane_path_argv(name)
+        except ValueError as exc:
+            log.warning("pane_path refused: %s", exc)
+            return ""
+        try:
+            return run(argv, timeout=15).strip()
+        except CommandError as exc:
+            log.debug("could not read the pane path of %s (%s)", name, exc)
+            return ""
+
+    def send_keys(self, name: str, *keys: str, dry_run: bool = False) -> bool:
+        """Press `keys` -- each one of `prompts.ALLOWED_KEYS`, nothing else
+        -- on ONE managed session's pane. True when tmux accepted them.
+
+        The ONLY key-pressing surface in this daemon, and deliberately
+        narrow: an allowlisted enum, a validated session name, an exact-match
+        target, one `send-keys` per call. A key outside the allowlist is
+        refused before any process is spawned and logged at WARNING (it is a
+        programming error, never a pane's doing -- keys come from the
+        policy table, not from the screen). Dry-run logs the intent and
+        sends nothing."""
+        try:
+            argv = send_keys_argv(name, tuple(keys))
+        except ValueError as exc:
+            log.warning("send_keys refused for %s: %s", name, exc)
+            return False
+        if dry_run:
+            log.info("[dry-run] would send keys %s to %s", " ".join(keys), name)
+            return False
+        try:
+            run(argv, timeout=15)
+        except CommandError as exc:
+            log.warning("could not send keys %s to %s (%s)", " ".join(keys), name, exc)
+            return False
+        return True
+
     def add_repo_to_workspace(
         self, owner: str, repo: str, workspace_root: Path, *, dry_run: bool = False
     ) -> None:

{alissa_tools_github_revloop-0.31.2 → alissa_tools_github_revloop-0.31.4}/src/main/alissa/tools/github/revloop/config.py

@@ -35,6 +35,7 @@ from __future__ import annotations
 
 import fnmatch
 import json
+import logging
 import os
 import re
 from dataclasses import dataclass, field
@@ -42,6 +43,8 @@ from pathlib import Path
 from typing import Any, Mapping
 from urllib.parse import urlsplit
 
+log = logging.getLogger(__name__)
+
 # A POSIX-ish environment variable name -- what `reviewer_token_env` must be.
 _ENV_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 
@@ -196,6 +199,11 @@ CONFIG_KEYS = (
     "task_list_bow_id",
     "loop_events_enabled",
     "fleet_vitals_enabled",
+    "prompt_responder",
+    "prompt_quiet_seconds",
+    "prompt_kill_minutes",
+    "prompt_max_answers",
+    "waiting_dir",
     "alissa_endpoint",
     "dry_run",
 )
@@ -454,6 +462,20 @@ def _validate_actor_id(entry: str) -> None:
 
 MIN_POLL_INTERVAL = 10  # the search API allows 30 req/min
 
+# The prompt responder's master switch (issue #138; devloop #127's names):
+# `on` answers, `observe` classifies and narrates but sends nothing, `off`
+# never captures a pane.
+PROMPT_ON = "on"
+PROMPT_OBSERVE = "observe"
+PROMPT_OFF = "off"
+_PROMPT_MODES = frozenset((PROMPT_ON, PROMPT_OBSERVE, PROMPT_OFF))
+
+# Where the container's hooks leave the "this session is waiting for input"
+# marker (`docker/claude/hooks/note-waiting.py`): `${ALISSA_WAITING_DIR}/<tmux
+# session>.json`. The daemon reads the same directory, so the two halves
+# agree by construction on a default deployment.
+DEFAULT_WAITING_DIR = "/workspace/.waiting"
+
 # A reviewer session that has not submitted after this long is presumed dead
 # (skill failure mode: "reviewer session stalls"). The round is re-enqueued --
 # but only with a second signal agreeing: the timer alone cannot tell a dead
@@ -853,6 +875,40 @@ class Config:
     # about the client (its bearer token) comes from the environment.
     alissa_endpoint: str = DEFAULT_ALISSA_ENDPOINT
 
+    # The prompt responder (issue #138; devloop #127's knobs under the same
+    # names): every poll, for every ALIVE reviewer session this daemon owns,
+    # a waiting marker from the container's hook OR a session quiet for
+    # `prompt_quiet_seconds` triggers a pane capture, the classifier and the
+    # policy table (`prompts.py`), and the answer lands in seconds -- no
+    # SSH, no LLM in the loop. `on` (the default) answers; `observe`
+    # classifies and narrates but sends no key, kills nothing and pages
+    # nobody; `off` never captures a pane. Every side effect honours dry_run
+    # (a dry pass classifies and logs, sends nothing).
+    prompt_responder: str = PROMPT_ON
+
+    # How long a reviewer session must have been quiet (`lastActivity` in
+    # the roster) before its pane is read WITHOUT a waiting marker. The
+    # marker is the fast path (seconds); this is the net under it, for a
+    # hook that did not fire. Floored at 30 so a session between two tool
+    # calls is not read as parked.
+    prompt_quiet_seconds: int = 90
+
+    # The unknown-dialog ladder's last rung: a dialog no signature knows is
+    # waited out one poll, dismissed with Escape on its second sighting, and
+    # after this many minutes still on screen the session is killed so the
+    # ordinary stale-round re-entry takes over. Floored at 1.
+    prompt_kill_minutes: int = 10
+
+    # The per-session answer cap: after this many keystroke answers the
+    # session is killed and its round re-queued -- a reviewer that keeps
+    # producing prompts is diverging, and the narration says so. Floored at 1.
+    prompt_max_answers: int = 5
+
+    # Where the waiting markers are (see DEFAULT_WAITING_DIR). The hooks
+    # read ALISSA_WAITING_DIR at run time; the container's config renderer
+    # writes the same value here so the daemon looks where the hooks wrote.
+    waiting_dir: str = DEFAULT_WAITING_DIR
+
     dry_run: bool = False
 
     def __post_init__(self) -> None:
@@ -875,6 +931,23 @@ class Config:
     def manifest_path(self) -> Path:
         return self.workspace_root / "alissa-workspace.yaml"
 
+    @property
+    def prompt_kill_seconds(self) -> int:
+        """The unknown-dialog kill rung in seconds, floored at one minute
+        here as well as in `build()` so a Config assembled without it can
+        never kill a session on its first sighting."""
+        return max(1, self.prompt_kill_minutes) * 60
+
+    @property
+    def prompt_quiet_floor(self) -> int:
+        """`prompt_quiet_seconds` with the 30 s floor applied again
+        (`build()` clamps, and so does the read)."""
+        return max(30, self.prompt_quiet_seconds)
+
+    @property
+    def prompt_answer_cap(self) -> int:
+        return max(1, self.prompt_max_answers)
+
     def hub_for(self, owner: str, repo: str) -> Path:
         return Path(
             self.hub_template.format(
@@ -1217,6 +1290,47 @@ class Config:
                     f"token — got {_describe(token_env)}.{rotate}"
                 )
 
+        # The prompt responder's knobs (issue #138). The mode is an enum
+        # validated by NAME like repos_source (a typo must not read as
+        # "off"); the three numbers have FLOORS rather than 0-sentinels --
+        # none of them has a meaningful "off" value, and each floor is the
+        # smallest value that cannot answer a session that is merely between
+        # two tool calls -- and are clamped up with a warning, because none of
+        # them is worth failing a boot.
+        prompt_mode = str(raw.get("prompt_responder", cls.prompt_responder)).strip()
+        if prompt_mode not in _PROMPT_MODES:
+            raise ValueError(
+                f"prompt_responder must be one of {sorted(_PROMPT_MODES)}, "
+                f"got {prompt_mode!r}"
+            )
+        prompt_quiet = int(raw.get("prompt_quiet_seconds", cls.prompt_quiet_seconds))
+        if prompt_quiet < 30:
+            log.warning(
+                "prompt_quiet_seconds=%d is below the 30 s floor — a shorter "
+                "window would read a session between two tool calls as "
+                "parked; clamping up to 30", prompt_quiet,
+            )
+            prompt_quiet = 30
+        prompt_kill = int(raw.get("prompt_kill_minutes", cls.prompt_kill_minutes))
+        if prompt_kill < 1:
+            log.warning(
+                "prompt_kill_minutes=%d is below the 1 min floor — the "
+                "unknown-dialog ladder needs at least one poll between the "
+                "dismissal and the kill; clamping up to 1", prompt_kill,
+            )
+            prompt_kill = 1
+        prompt_answers = int(raw.get("prompt_max_answers", cls.prompt_max_answers))
+        if prompt_answers < 1:
+            log.warning(
+                "prompt_max_answers=%d is below the floor of 1 — a cap of 0 "
+                "would kill every session on its first prompt; clamping up "
+                "to 1", prompt_answers,
+            )
+            prompt_answers = 1
+        waiting_dir = str(raw.get("waiting_dir", cls.waiting_dir)).strip()
+        if not waiting_dir:
+            raise ValueError("waiting_dir must be a non-empty path")
+
         state_path = raw.get("state_path")
         return cls(
             workspace_root=Path(workspace_root),
@@ -1248,6 +1362,11 @@ class Config:
             task_list_bow_id=bow_id,
             loop_events_enabled=bool(raw.get("loop_events_enabled", False)),
             fleet_vitals_enabled=bool(raw.get("fleet_vitals_enabled", False)),
+            prompt_responder=prompt_mode,
+            prompt_quiet_seconds=prompt_quiet,
+            prompt_kill_minutes=prompt_kill,
+            prompt_max_answers=prompt_answers,
+            waiting_dir=waiting_dir,
             alissa_endpoint=endpoint,
             dry_run=bool(raw.get("dry_run", False)),
         )