@aragon-agent/cli 0.5.1 → 0.5.3

package/dist/config/prompt-history.js

@@ -0,0 +1,332 @@
+/**
+ * The prompts the user submitted, as an append-only JSON Lines file at
+ * `<home>/prompt-history.jsonl` (config-state-separation §4.3).
+ *
+ * ══════════════════════════════════════════════════════════════════════════
+ * WHY THIS IS NOT IN config.json ANY MORE: it used to be a `promptHistory`
+ * array inside the config file, which meant every single submit rewrote the
+ * whole file — API key section included — and left a user who opened
+ * `config.json` to change their model scrolling past their own typing. A
+ * config file holds what the user DECLARED; this holds what they DID.
+ * ══════════════════════════════════════════════════════════════════════════
+ *
+ * APPEND, never read-modify-write. Two `aragon` windows are an ordinary setup,
+ * and `O_APPEND` + one `writeSync` per entry means they interleave instead of
+ * overwriting each other's snapshots. It also means a process killed mid-write
+ * costs one broken line rather than a truncated array that reads back as "your
+ * history is gone" — hence the per-line tolerance in `parseLine`.
+ *
+ * FAILURE POLICY (C2), the same one `skills/usage.ts` documents: every function
+ * here swallows its errors. This is recall convenience; a read-only home
+ * directory must degrade to "no history", never to a CLI that will not start.
+ * The one thing that policy makes dangerous is a MISSING WRITE — it would be
+ * invisible — which is why the write path creates `<home>` first and why a
+ * failed append is logged rather than merely ignored.
+ */
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, writeSync, } from 'node:fs';
+import process from 'node:process';
+import { getHomeRoot, getPromptHistoryPath } from './app-paths.js';
+import { PROMPT_HISTORY_CAP } from './schema.js';
+import { getLogger } from '../logging/logger.js';
+export const PROMPT_HISTORY_FILENAME = 'prompt-history.jsonl';
+export const PROMPT_HISTORY_LINE_VERSION = 1;
+/**
+ * Longer submissions are not recorded at all (D-6).
+ *
+ * Storing a TRUNCATED copy would be worse than storing nothing: the user
+ * presses `↑`, gets back something that looks complete, and sends half a
+ * prompt. 16 KiB is far past anything typed by hand.
+ */
+export const PROMPT_ENTRY_MAX_CHARS = 16_384;
+/** Physical lines tolerated before the file is rewritten down to the cap. */
+export const HISTORY_COMPACT_AT_LINES = 400;
+// ---------------------------------------------------------------------------
+// In-memory state
+// ---------------------------------------------------------------------------
+let memory = null;
+let loadedLines = 0;
+let appendedLines = 0;
+/**
+ * Starts `true`, and that initial value is load-bearing (RV-5).
+ *
+ * `loadConfig()` calls `setHistoryEnabled()`, but the startup migration runs
+ * BEFORE any `loadConfig()`. Something has to be true in that window, and
+ * `true` is what the config key itself defaults to. The one case in that window
+ * that must honour an explicit opt-out — importing a legacy `promptHistory` —
+ * reads the value straight off the config file instead of trusting this flag
+ * (see `migrate-state-out-of-config.ts`).
+ */
+let historyEnabled = true;
+// ---------------------------------------------------------------------------
+// Parsing
+// ---------------------------------------------------------------------------
+function parseLine(line) {
+    try {
+        const parsed = JSON.parse(line);
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        // Unknown versions are skipped rather than coerced: that is what lets a
+        // future field be added without an older CLI reading the file as garbage.
+        if (parsed.v !== PROMPT_HISTORY_LINE_VERSION)
+            return null;
+        if (typeof parsed.text !== 'string' || parsed.text.length === 0)
+            return null;
+        const ts = typeof parsed.ts === 'number' && Number.isFinite(parsed.ts) ? parsed.ts : 0;
+        return { v: PROMPT_HISTORY_LINE_VERSION, ts, text: parsed.text };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read and parse the file. `null` means the read itself failed — distinct from
+ * "no file yet", because compaction must not rewrite a file it could not read.
+ */
+function readFromDisk() {
+    const path = getPromptHistoryPath();
+    if (!existsSync(path))
+        return { entries: [], lines: 0 };
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const entries = [];
+    let lines = 0;
+    for (const line of raw.split('\n')) {
+        if (line.trim().length === 0)
+            continue;
+        lines += 1;
+        const entry = parseLine(line);
+        if (entry)
+            entries.push(entry);
+    }
+    return { entries, lines };
+}
+/**
+ * Drop repeats, keeping the LAST occurrence, then keep the newest `cap`.
+ *
+ * Oldest-first ordering is the contract `PromptInput` walks with `↑`/`↓`, and
+ * "last occurrence wins" reproduces what the old in-config implementation did
+ * with `filter(p => p !== text)` followed by an append.
+ */
+function dedupeEntries(entries) {
+    const seen = new Set();
+    const reversed = [];
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const entry = entries[i];
+        if (seen.has(entry.text))
+            continue;
+        seen.add(entry.text);
+        reversed.push(entry);
+    }
+    reversed.reverse();
+    return reversed.slice(-PROMPT_HISTORY_CAP);
+}
+// ---------------------------------------------------------------------------
+// Read
+// ---------------------------------------------------------------------------
+/**
+ * The recall list: oldest first, de-duplicated, capped. Cached for the life of
+ * the process so `/reload` — which calls `loadConfig()` again — cannot discard
+ * entries added during this session.
+ *
+ * Reads even when `historyEnabled` is false (RV-12): turning recording off
+ * stops new writes, but someone who wants to see what is already stored before
+ * deleting it must not be told "nothing here" while the file still exists.
+ */
+export function loadPromptHistory() {
+    if (memory !== null)
+        return memory;
+    const read = readFromDisk() ?? { entries: [], lines: 0 };
+    memory = dedupeEntries(read.entries).map((entry) => entry.text);
+    loadedLines = read.lines;
+    appendedLines = 0;
+    return memory;
+}
+/** Every entry on disk with its timestamp, newest first. For `history list`. */
+export function listPromptHistory() {
+    const read = readFromDisk();
+    if (!read)
+        return [];
+    return [...read.entries].reverse();
+}
+// ---------------------------------------------------------------------------
+// Write
+// ---------------------------------------------------------------------------
+/**
+ * Append one line. Returns whether it reached the disk.
+ *
+ * `mkdirSync` IS NOT DEFENSIVE NOISE — deleting it breaks a real user. `<home>`
+ * is created by the logger (only when `log.toFile` is on) or by the first
+ * config write (only when the user changes a setting); someone on a fresh
+ * install who did neither has no directory here, `openSync` throws `ENOENT`,
+ * the swallow below hides it, and their history silently never persists.
+ *
+ * A short-lived descriptor rather than a kept-open one: this is a once-per-
+ * submit write, and a descriptor held for the life of the process would make
+ * `aragon history clear` unable to delete the file on Windows.
+ */
+function appendLine(entry) {
+    try {
+        mkdirSync(getHomeRoot(), { recursive: true });
+        const fd = openSync(getPromptHistoryPath(), 'a', 0o600);
+        try {
+            writeSync(fd, `${JSON.stringify(entry)}\n`);
+        }
+        finally {
+            closeSync(fd);
+        }
+        return true;
+    }
+    catch (err) {
+        getLogger().warn('history', 'history_append_failed', {
+            reason: err instanceof Error ? err.message : String(err),
+        });
+        return false;
+    }
+}
+/**
+ * Record one submitted prompt and return THE UPDATED LIST.
+ *
+ * The return value is the whole point of the signature (RV-1). `App.tsx` writes
+ * `setPromptHistory(appendPrompt(text))`: the recall list rendered by the
+ * composer is React state, and a module-level array updated in here re-renders
+ * nothing. Drop the return value and `↑` stops recalling what was just
+ * submitted — but only until the next restart, which makes it about as hard to
+ * diagnose as a bug in this area gets.
+ *
+ * Returns the current list unchanged when recording is off, the text is blank,
+ * or the text is oversized, so callers never need a branch.
+ */
+export function appendPrompt(text, now = Date.now()) {
+    const current = loadPromptHistory();
+    if (!historyEnabled)
+        return current;
+    if (text.trim().length === 0)
+        return current;
+    if (text.length > PROMPT_ENTRY_MAX_CHARS) {
+        getLogger().debug('history', 'prompt_history_entry_too_large', {
+            chars: text.length,
+            max: PROMPT_ENTRY_MAX_CHARS,
+        });
+        return current;
+    }
+    memory = [...current.filter((prompt) => prompt !== text), text].slice(-PROMPT_HISTORY_CAP);
+    if (appendLine({ v: PROMPT_HISTORY_LINE_VERSION, ts: now, text })) {
+        appendedLines += 1;
+        if (loadedLines + appendedLines > HISTORY_COMPACT_AT_LINES)
+            compact();
+    }
+    return memory;
+}
+/**
+ * Rewrite the file down to the cap.
+ *
+ * THE RE-READ ON THE FIRST LINE IS THE WHOLE POINT (RV-3). Writing this
+ * process's in-memory array over the file would reintroduce exactly the
+ * multi-instance clobbering that append-only exists to avoid — and not "a few
+ * trailing entries" either, but everything every other instance wrote since
+ * this one last read. A failed read therefore skips compaction entirely: the
+ * file keeps growing and the next append tries again, which is strictly better
+ * than replacing it with a stale snapshot.
+ */
+function compact() {
+    const disk = readFromDisk();
+    if (!disk)
+        return;
+    // Entries this session has but the file does not — normally none, since the
+    // appends above are already on disk. It only matters if a read raced a write.
+    const onDisk = new Set(disk.entries.map((entry) => entry.text));
+    const carried = (memory ?? [])
+        .filter((text) => !onDisk.has(text))
+        .map((text) => ({ v: PROMPT_HISTORY_LINE_VERSION, ts: Date.now(), text }));
+    const kept = dedupeEntries([...disk.entries, ...carried]);
+    const path = getPromptHistoryPath();
+    const tmp = `${path}.tmp-${process.pid}`;
+    try {
+        mkdirSync(getHomeRoot(), { recursive: true });
+        const payload = kept.map((entry) => `${JSON.stringify(entry)}\n`).join('');
+        writeFileSync(tmp, payload, { encoding: 'utf-8', mode: 0o600 });
+        renameSync(tmp, path);
+        // rename does not preserve mode everywhere, and this file holds the user's
+        // prompts verbatim — re-apply it rather than hope (RV-6, as `store.ts` does).
+        if (process.platform !== 'win32')
+            chmodSync(path, 0o600);
+        memory = kept.map((entry) => entry.text);
+        loadedLines = kept.length;
+        appendedLines = 0;
+    }
+    catch (err) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch {
+            // Nothing further to try; the original file is untouched either way.
+        }
+        getLogger().warn('history', 'history_compact_failed', {
+            reason: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/**
+ * Migration-only: append the texts that are not in the file yet, returning how
+ * many were written.
+ *
+ * Ignores `historyEnabled` on purpose — the caller decides, because it is the
+ * only code that can see an explicit `historyEnabled: false` in the config file
+ * before `loadConfig()` has run (§4.6 step 3).
+ */
+export function importLegacyPromptHistory(entries) {
+    const read = readFromDisk();
+    if (!read)
+        return 0;
+    const known = new Set(read.entries.map((entry) => entry.text));
+    let written = 0;
+    for (const text of entries) {
+        if (typeof text !== 'string')
+            continue;
+        if (text.trim().length === 0)
+            continue;
+        if (text.length > PROMPT_ENTRY_MAX_CHARS)
+            continue;
+        if (known.has(text))
+            continue;
+        if (!appendLine({ v: PROMPT_HISTORY_LINE_VERSION, ts: Date.now(), text }))
+            break;
+        known.add(text);
+        written += 1;
+    }
+    // The cache, if anything already built one, no longer matches the file.
+    if (written > 0)
+        memory = null;
+    return written;
+}
+/** Delete the file and empty the cache. Returns how many entries were removed. */
+export function clearPromptHistory() {
+    const removed = readFromDisk()?.entries.length ?? 0;
+    try {
+        rmSync(getPromptHistoryPath(), { force: true });
+    }
+    catch {
+        // Same policy as every other failure here: a file we could not delete is
+        // not worth an error the user can do nothing about.
+    }
+    memory = [];
+    loadedLines = 0;
+    appendedLines = 0;
+    return removed;
+}
+/** Called once by `loadConfig()` after `historyEnabled` has been resolved. */
+export function setHistoryEnabled(enabled) {
+    historyEnabled = enabled;
+}
+/** Test-only: forget the cache, the line counters and the switch. */
+export function resetPromptHistoryForTests() {
+    memory = null;
+    loadedLines = 0;
+    appendedLines = 0;
+    historyEnabled = true;
+}

package/dist/config/schema.d.ts

@@ -55,9 +55,13 @@ export declare const DEFAULT_TOOL_TIMEOUT_MS = 180000;
 export declare const IDLE_TIMEOUT_MARGIN_MS = 30000;
 /** Watchdog idle timeout (§3.8) — must stay ≥ toolTimeout so long tools survive. */
 export declare const DEFAULT_IDLE_TIMEOUT_MS: number;
-/** Cap on persisted prompt history / recent-model MRU lists. */
+/**
+ * Cap on the recall list.
+ *
+ * The list itself now lives in `<home>/prompt-history.jsonl`; this constant is
+ * consumed by `config/prompt-history.ts`, not by the UI.
+ */
 export declare const PROMPT_HISTORY_CAP = 100;
-export declare const RECENT_MODELS_CAP = 10;
 /**
  * How many trailing entries the full-screen viewport renders (invariant I-3).
  * Yoga lays out every child even when `overflow: hidden` clips it, so the cost
@@ -190,6 +194,51 @@ export declare const DEFAULT_LOG_CONFIG: LogConfig;
  * but none of it".
  */
 export declare function clampLogConfig(raw: unknown): LogConfig;
+export interface TeamConfig {
+    /** Register the `task` tool at all. Defaults to TRUE (R-b). */
+    enabled: boolean;
+    /** Children per dispatch. Clamped to [1, HARD_MAX_SUBAGENTS] (R-g). */
+    maxSubagents: number;
+    /**
+     * Children in flight at once.
+     *
+     * A SEPARATE KNOB FROM `maxSubagents` on purpose (D-6): provider rate limits
+     * are a different constraint from context economics, and folding them into one
+     * number makes both wrong. Five simultaneous streams against one API key is a
+     * reliable way to collect HTTP 429s, each of which lands in the report as a
+     * failed subagent.
+     */
+    maxConcurrent: number;
+    /** One child's wall clock before its own abort. */
+    subagentTimeoutMs: number;
+    /** The whole dispatch's wall clock. Also the `task` tool-timeout override. */
+    dispatchTimeoutMs: number;
+    /** Runaway-loop cap: turns one child may take before it is stopped. */
+    maxTurnsPerSubagent: number;
+}
+/**
+ * The requirement's ceiling on the fan-out (R-g).
+ *
+ * Re-exported from `TEAM_LIMITS` rather than re-spelled, because it is enforced
+ * in TWO places — here on the config value, and again in
+ * `normalizeSubagentSpecs` on what the model asked for — and two copies of the
+ * same 10 is exactly how a hand-edited `config.json` ends up being able to raise
+ * a ceiling the requirement fixed.
+ */
+export declare const HARD_MAX_SUBAGENTS: 10;
+export declare const DEFAULT_TEAM_CONFIG: TeamConfig;
+/**
+ * THE single gate for every team-config read AND write, mirroring
+ * `clampSkillsConfig` / `clampLogConfig` for the reason those two record:
+ * hardening only the read path leaves a bad value on disk that reverts to the
+ * default on every launch, which presents to the user as "my setting won't
+ * stick".
+ *
+ * `maxConcurrent` is additionally capped at `maxSubagents`: a pool wider than
+ * the population it draws from is not wrong so much as meaningless, and letting
+ * the two disagree would make the panel's `n/m` readout confusing for no gain.
+ */
+export declare function clampTeamConfig(raw: unknown): TeamConfig;
 export interface PersistedConfig {
     version: number;
     provider: string;
@@ -211,14 +260,27 @@ export interface PersistedConfig {
     idleTimeoutMs: number;
     /** provider -> key. Masked in the UI; the file is written 0600 on POSIX. */
     apiKeys: Record<string, string | null>;
-    recentModels: string[];
-    promptHistory: string[];
+    /**
+     * Record submitted prompts to `<home>/prompt-history.jsonl` at all (D-9).
+     *
+     * A real preference, and the reason it belongs here rather than in
+     * `state.json`: the user declares it, and switching it off is a decision they
+     * expect to survive. Command-line only, like `log.redactSecrets` — there is
+     * no settings-screen entry, because it is set once and then forgotten.
+     */
+    historyEnabled: boolean;
     /** Entry spacing: `comfortable` keeps a blank line at turn boundaries (§4.3). */
     density: DensityMode;
     /** Show the composer hint row at all. */
     hints: boolean;
-    /** Lifetime submit count driving the progressive-disclosure fade (§4.6). */
-    submitCount: number;
+    /**
+     * Enable SGR mouse reporting in full-screen mode so the wheel scrolls the
+     * region under the pointer (mouse-wheel-region-routing §5.7).
+     *
+     * A PLAIN BOOLEAN, not a `fullscreen`-style tri-state: there are no
+     * heuristics for an explicit `true` to override (D-10).
+     */
+    mouse: boolean;
     /** Start every session in PLAN mode (plan-mode §4.4). */
     planModeDefault: boolean;
     /** `ask_user` rounds allowed per user turn; clamped to [1, 10]. */
@@ -229,8 +291,34 @@ export interface PersistedConfig {
     skills: SkillsConfig;
     /** Logging settings. The THIRD nested object; scalars only (see LogConfig). */
     log: LogConfig;
+    /** Team mode. The FOURTH nested object; scalars only (see TeamConfig). */
+    team: TeamConfig;
 }
 export declare const DEFAULT_CONFIG: PersistedConfig;
+/**
+ * Runtime state that used to be stored in `config.json` by mistake
+ * (config-state-separation §4.5). Each one now lives in its own file:
+ * `promptHistory` → `prompt-history.jsonl`, `submitCount` / `mouseNoticeSeen`
+ * → `state.json`, and `recentModels` was dead — nothing ever wrote it.
+ */
+export declare const LEGACY_STATE_KEYS: readonly ["promptHistory", "submitCount", "mouseNoticeSeen", "recentModels"];
+/**
+ * THE single gate that keeps those keys out of `config.json`, and the one thing
+ * in this change that cannot be skipped.
+ *
+ * `loadPersistedConfig()` merges `{ ...DEFAULT_CONFIG, ...partial }` where
+ * `partial` is the raw parse of whatever is on disk. Removing the fields from
+ * the interface therefore removes NOTHING from the file: the keys ride through
+ * the spread and `updatePersistedConfig` writes them straight back. The user
+ * deletes `promptHistory` by hand and watches it grow back.
+ *
+ * Applied on the READ side on purpose, which is what makes it self-healing:
+ * every write goes read-strip-merge-write, so a hand-edited file, a downgrade
+ * to 0.5.x and back, or a half-finished migration all converge on a clean file
+ * at the next write. Same shape as `clampSkillsConfig` / `clampLogConfig` —
+ * one door for both directions.
+ */
+export declare function stripLegacyStateKeys<T extends object>(raw: T): T;
 export interface CliConfig {
     provider: string;
     model: string;
@@ -259,11 +347,22 @@ export interface CliConfig {
     idleTimeoutMs: number;
     /** provider -> resolved key (config-file key ?? provider env var). */
     apiKeys: Record<string, string | undefined>;
-    recentModels: string[];
-    promptHistory: string[];
+    /**
+     * Whether submitted prompts are recorded (D-9).
+     *
+     * The recall LIST is deliberately not here: its only consumer is one
+     * `useState` seed in `App.tsx`, and carrying it on `CliConfig` would make
+     * every `loadConfig()` — `aragon logs tail` and `aragon skills list`
+     * included — read a file it has no use for (D-4).
+     */
+    historyEnabled: boolean;
     density: DensityMode;
     hints: boolean;
-    submitCount: number;
+    /**
+     * Whether this session may enable SGR mouse reporting (full-screen + TTY
+     * only). Resolved by `resolveMouse` in `load.ts`.
+     */
+    mouse: boolean;
     /**
      * Whether this session opens in PLAN mode.
      *
@@ -279,6 +378,23 @@ export interface CliConfig {
     skillsRuntime: SkillsRuntimeOptions;
     /** Resolved logging settings; the authoritative input to `Logger.reconfigure`. */
     log: LogConfig;
+    /**
+     * Resolved team-mode settings (team-subagents §3.10).
+     *
+     * `enabled` here decides whether `task` is REGISTERED, which happens once at
+     * construction and can never be undone (§4.5 / D-17). The live on/off switch
+     * `/team` flips is a separate flag on the controller.
+     */
+    team: TeamConfig;
+    /**
+     * Lifetime submit count driving the composer hint fade (`HINT_FADE_AFTER`).
+     *
+     * Read from `<home>/state.json` rather than the config file. It stays on
+     * `CliConfig` — unlike the recall list — because it is one scalar that is
+     * already plumbed through `controller.getConfig()` / `setSubmitCount()` and
+     * read during render (D-4).
+     */
+    submitCount: number;
     /** Working directory for tools (default `process.cwd()`, overridable). */
     cwd: string;
     /** Whether ANSI color is enabled. */

package/dist/config/schema.js

@@ -7,6 +7,7 @@
  */
 import { isAbsolute } from 'node:path';
 import { clampLogLevel } from '../logging/levels.js';
+import { TEAM_LIMITS } from '../team/limits.js';
 // ---------------------------------------------------------------------------
 // Provider set — only the adapter-backed providers are usable at run time (R5).
 // ---------------------------------------------------------------------------
@@ -88,9 +89,13 @@ export const DEFAULT_TOOL_TIMEOUT_MS = 180_000;
 export const IDLE_TIMEOUT_MARGIN_MS = 30_000;
 /** Watchdog idle timeout (§3.8) — must stay ≥ toolTimeout so long tools survive. */
 export const DEFAULT_IDLE_TIMEOUT_MS = DEFAULT_TOOL_TIMEOUT_MS + IDLE_TIMEOUT_MARGIN_MS;
-/** Cap on persisted prompt history / recent-model MRU lists. */
+/**
+ * Cap on the recall list.
+ *
+ * The list itself now lives in `<home>/prompt-history.jsonl`; this constant is
+ * consumed by `config/prompt-history.ts`, not by the UI.
+ */
 export const PROMPT_HISTORY_CAP = 100;
-export const RECENT_MODELS_CAP = 10;
 /**
  * How many trailing entries the full-screen viewport renders (invariant I-3).
  * Yoga lays out every child even when `overflow: hidden` clips it, so the cost
@@ -260,6 +265,52 @@ export function clampLogConfig(raw) {
             : DEFAULT_LOG_CONFIG.previewChars,
     };
 }
+/**
+ * The requirement's ceiling on the fan-out (R-g).
+ *
+ * Re-exported from `TEAM_LIMITS` rather than re-spelled, because it is enforced
+ * in TWO places — here on the config value, and again in
+ * `normalizeSubagentSpecs` on what the model asked for — and two copies of the
+ * same 10 is exactly how a hand-edited `config.json` ends up being able to raise
+ * a ceiling the requirement fixed.
+ */
+export const HARD_MAX_SUBAGENTS = TEAM_LIMITS.hardMaxSubagents;
+export const DEFAULT_TEAM_CONFIG = {
+    enabled: true,
+    maxSubagents: 5,
+    maxConcurrent: 3,
+    subagentTimeoutMs: 300_000,
+    dispatchTimeoutMs: 900_000,
+    maxTurnsPerSubagent: 24,
+};
+const SUBAGENTS_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
+const CONCURRENT_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
+const SUBAGENT_TIMEOUT_RANGE = { min: 30_000, max: 1_800_000 };
+const DISPATCH_TIMEOUT_RANGE = { min: 60_000, max: 3_600_000 };
+const TURNS_RANGE = { min: 4, max: 100 };
+/**
+ * THE single gate for every team-config read AND write, mirroring
+ * `clampSkillsConfig` / `clampLogConfig` for the reason those two record:
+ * hardening only the read path leaves a bad value on disk that reverts to the
+ * default on every launch, which presents to the user as "my setting won't
+ * stick".
+ *
+ * `maxConcurrent` is additionally capped at `maxSubagents`: a pool wider than
+ * the population it draws from is not wrong so much as meaningless, and letting
+ * the two disagree would make the panel's `n/m` readout confusing for no gain.
+ */
+export function clampTeamConfig(raw) {
+    const src = (raw && typeof raw === 'object' ? raw : {});
+    const maxSubagents = clampInt(src.maxSubagents, DEFAULT_TEAM_CONFIG.maxSubagents, SUBAGENTS_RANGE);
+    return {
+        enabled: bool(src.enabled, DEFAULT_TEAM_CONFIG.enabled),
+        maxSubagents,
+        maxConcurrent: Math.min(maxSubagents, clampInt(src.maxConcurrent, DEFAULT_TEAM_CONFIG.maxConcurrent, CONCURRENT_RANGE)),
+        subagentTimeoutMs: clampInt(src.subagentTimeoutMs, DEFAULT_TEAM_CONFIG.subagentTimeoutMs, SUBAGENT_TIMEOUT_RANGE),
+        dispatchTimeoutMs: clampInt(src.dispatchTimeoutMs, DEFAULT_TEAM_CONFIG.dispatchTimeoutMs, DISPATCH_TIMEOUT_RANGE),
+        maxTurnsPerSubagent: clampInt(src.maxTurnsPerSubagent, DEFAULT_TEAM_CONFIG.maxTurnsPerSubagent, TURNS_RANGE),
+    };
+}
 export const DEFAULT_CONFIG = {
     version: CONFIG_VERSION,
     provider: 'anthropic',
@@ -276,17 +327,51 @@ export const DEFAULT_CONFIG = {
     toolTimeoutMs: DEFAULT_TOOL_TIMEOUT_MS,
     idleTimeoutMs: DEFAULT_IDLE_TIMEOUT_MS,
     apiKeys: {},
-    recentModels: [],
-    promptHistory: [],
+    historyEnabled: true,
     density: 'comfortable',
     hints: true,
-    submitCount: 0,
+    mouse: true,
     planModeDefault: false,
     planModeMaxAskRounds: DEFAULT_PLAN_MAX_ASK_ROUNDS,
     planModeHumanTimeoutMs: DEFAULT_PLAN_HUMAN_TIMEOUT_MS,
     skills: DEFAULT_SKILLS_CONFIG,
     log: DEFAULT_LOG_CONFIG,
+    team: DEFAULT_TEAM_CONFIG,
 };
+/**
+ * Runtime state that used to be stored in `config.json` by mistake
+ * (config-state-separation §4.5). Each one now lives in its own file:
+ * `promptHistory` → `prompt-history.jsonl`, `submitCount` / `mouseNoticeSeen`
+ * → `state.json`, and `recentModels` was dead — nothing ever wrote it.
+ */
+export const LEGACY_STATE_KEYS = [
+    'promptHistory',
+    'submitCount',
+    'mouseNoticeSeen',
+    'recentModels',
+];
+/**
+ * THE single gate that keeps those keys out of `config.json`, and the one thing
+ * in this change that cannot be skipped.
+ *
+ * `loadPersistedConfig()` merges `{ ...DEFAULT_CONFIG, ...partial }` where
+ * `partial` is the raw parse of whatever is on disk. Removing the fields from
+ * the interface therefore removes NOTHING from the file: the keys ride through
+ * the spread and `updatePersistedConfig` writes them straight back. The user
+ * deletes `promptHistory` by hand and watches it grow back.
+ *
+ * Applied on the READ side on purpose, which is what makes it self-healing:
+ * every write goes read-strip-merge-write, so a hand-edited file, a downgrade
+ * to 0.5.x and back, or a half-finished migration all converge on a clean file
+ * at the next write. Same shape as `clampSkillsConfig` / `clampLogConfig` —
+ * one door for both directions.
+ */
+export function stripLegacyStateKeys(raw) {
+    const out = { ...raw };
+    for (const key of LEGACY_STATE_KEYS)
+        delete out[key];
+    return out;
+}
 // ---------------------------------------------------------------------------
 // Coercion / validation helpers
 // ---------------------------------------------------------------------------