@aragon-agent/cli 0.5.6 → 0.5.9

package/dist/config/cli-commands.js

@@ -1,6 +1,6 @@
 /**
- * `aragon config get | list | edit | home`, plus the `log.*` and `team.*`
- * branches of `config set`.
+ * `aragon config get | list | edit | home`, plus the `log.*`, `team.*`,
+ * `retry.*` and `fast.*` branches of `config set`.
  *
  * These live here rather than in `cli.tsx` because `runConfigSet` is already a
  * 21-case switch — well past the complexity ceiling this package writes down —
@@ -13,7 +13,7 @@ import process from 'node:process';
 import { getConfigBackupPath, getConfigPath, getHomeRoot, getLogsDir, getPromptHistoryPath, getUiStatePath, isHomeOverridden, } from './app-paths.js';
 import { getHomeMigrationBreadcrumbPath } from './migrate-home.js';
 import { loadPersistedConfig, updatePersistedConfig } from './store.js';
-import { coercePositiveInt, maskSecret, DEFAULT_TEAM_CONFIG, } from './schema.js';
+import { clampFastConfig, clampRetryConfig, coercePositiveInt, maskSecret, DEFAULT_FAST_CONFIG, DEFAULT_RETRY_CONFIG, DEFAULT_TEAM_CONFIG, } from './schema.js';
 import { clampLogLevel } from '../logging/levels.js';
 /** Config keys under `log.` that `aragon config set` accepts. */
 export const LOG_CONFIG_SET_KEYS = [
@@ -43,6 +43,50 @@ export const TEAM_CONFIG_SET_KEYS = [
     'team.dispatchTimeoutMs',
     'team.maxTurnsPerSubagent',
 ];
+/**
+ * Config keys under `retry.` that `aragon config set` accepts
+ * (llm-api-retry-backoff §8.2).
+ *
+ * Handled here rather than in `cli.tsx`'s switch for the reason this module's
+ * header gives about `log.*` and `team.*`: that switch is past this package's
+ * complexity ceiling, and a key added to the membership set but forgotten in the
+ * switch falls through every case, writes nothing, and still prints
+ * `Set retry.maxRetries = 0`.
+ */
+export const RETRY_CONFIG_SET_KEYS = [
+    'retry.enabled',
+    'retry.maxRetries',
+    'retry.initialDelayMs',
+    'retry.maxDelayMs',
+    'retry.multiplier',
+    'retry.jitter',
+    'retry.respectRetryAfter',
+    'retry.maxElapsedMs',
+    'retry.onPartialStream',
+];
+/**
+ * Config keys under `fast.` that `aragon config set` accepts (fast-model-tier
+ * §4.2).
+ *
+ * A DEDICATED SETTER RATHER THAN A GENERIC DOTTED WRITER, for the reason the
+ * three sets above each record: a generic setter would write `fast` as a FLAT
+ * string key (`"fast.model": "haiku"` at the top level of the file), the section
+ * would silently never take effect, and `config set` would still print
+ * `Set fast.model = haiku`.
+ */
+export const FAST_CONFIG_SET_KEYS = [
+    'fast.enabled',
+    'fast.provider',
+    'fast.model',
+    'fast.baseUrl',
+    'fast.thinkingLevel',
+    'fast.delegate',
+    'fast.review',
+    'fast.reviewEveryTurns',
+    'fast.reviewContextTurns',
+    'fast.reviewMaxChars',
+    'fast.reviewMaxPerSession',
+];
 function isTrue(value) {
     return value === 'true' || value === '1';
 }
@@ -112,6 +156,95 @@ export function applyTeamConfigSet(key, value) {
             return null;
     }
 }
+/**
+ * Translate a `retry.*` dotted key into a patch, or `null` for anything else.
+ *
+ * The patch is a PARTIAL `retry` section, safe only because
+ * `updatePersistedConfig` deep-merges that section — with a shallow merge,
+ * setting the retry count would silently reset `respectRetryAfter` and `jitter`.
+ *
+ * `maxRetries` GOES THROUGH `clampRetryConfig`, NOT `coercePositiveInt`, and that
+ * is not a style choice (R-16): `coercePositiveInt` returns its fallback for
+ * `n <= 0`, so `config set retry.maxRetries 0` would write **10** — the maximum
+ * instead of the kill switch, silently. The whole section is routed through the
+ * one gate so no key here can pick up the wrong coercion later; the caller echoes
+ * the STORED value, which is what makes an out-of-range input visible.
+ */
+export function applyRetryConfigSet(key, value) {
+    const patch = (retry) => ({ retry });
+    const clampOne = (field) => {
+        const merged = clampRetryConfig({ ...DEFAULT_RETRY_CONFIG, [field]: value });
+        return { [field]: merged[field] };
+    };
+    switch (key) {
+        case 'retry.enabled':
+            return patch({ enabled: isTrue(value) });
+        case 'retry.maxRetries':
+            return patch(clampOne('maxRetries'));
+        case 'retry.initialDelayMs':
+            return patch(clampOne('initialDelayMs'));
+        case 'retry.maxDelayMs':
+            return patch(clampOne('maxDelayMs'));
+        case 'retry.multiplier':
+            return patch(clampOne('multiplier'));
+        case 'retry.jitter':
+            return patch({ jitter: isTrue(value) });
+        case 'retry.respectRetryAfter':
+            return patch({ respectRetryAfter: isTrue(value) });
+        case 'retry.maxElapsedMs':
+            return patch(clampOne('maxElapsedMs'));
+        case 'retry.onPartialStream':
+            return patch({ onPartialStream: isTrue(value) });
+        default:
+            return null;
+    }
+}
+/**
+ * Translate a `fast.*` dotted key into a patch, or `null` for anything else.
+ *
+ * The patch is a PARTIAL `fast` section, safe only because
+ * `updatePersistedConfig` deep-merges that section — with a shallow merge,
+ * setting the cadence would silently switch the whole tier off (R-10).
+ *
+ * EVERY NUMERIC AND ENUM KEY ROUTES THROUGH `clampFastConfig`, not through
+ * `coercePositiveInt` or a local parse, for the reason `applyRetryConfigSet`
+ * records: one gate for both directions means no key here can pick up a
+ * different coercion later, and `config set fast.reviewEveryTurns 400` writes
+ * the clamped 50 while the caller echoes the STORED value (AC-13).
+ */
+export function applyFastConfigSet(key, value) {
+    const patch = (fast) => ({ fast });
+    const clampOne = (field) => {
+        const merged = clampFastConfig({ ...DEFAULT_FAST_CONFIG, [field]: value });
+        return { [field]: merged[field] };
+    };
+    switch (key) {
+        case 'fast.enabled':
+            return patch({ enabled: isTrue(value) });
+        case 'fast.provider':
+            return patch(clampOne('provider'));
+        case 'fast.model':
+            return patch(clampOne('model'));
+        case 'fast.baseUrl':
+            return patch(clampOne('baseUrl'));
+        case 'fast.thinkingLevel':
+            return patch(clampOne('thinkingLevel'));
+        case 'fast.delegate':
+            return patch({ delegate: isTrue(value) });
+        case 'fast.review':
+            return patch({ review: isTrue(value) });
+        case 'fast.reviewEveryTurns':
+            return patch(clampOne('reviewEveryTurns'));
+        case 'fast.reviewContextTurns':
+            return patch(clampOne('reviewContextTurns'));
+        case 'fast.reviewMaxChars':
+            return patch(clampOne('reviewMaxChars'));
+        case 'fast.reviewMaxPerSession':
+            return patch(clampOne('reviewMaxPerSession'));
+        default:
+            return null;
+    }
+}
 /**
  * `log.redactSecrets false` is the one setting that lets credentials reach the
  * disk. It is command-line-only (there is no settings-screen entry) and it says

package/dist/config/env.d.ts

@@ -5,9 +5,14 @@
  *   - Provider secrets: ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY /
  *     GEMINI_API_KEY.
  *   - Overrides: ARAGON_PROVIDER, ARAGON_MODEL, ARAGON_BASE_URL, ARAGON_THINKING,
+ *     ARAGON_SHOW_THINKING,
  *     ARAGON_MAX_TOKENS (a number, or `auto` / `0` for the per-model ceiling),
  *     ARAGON_THEME, ARAGON_MOUSE, ARAGON_PLAN, ARAGON_TEAM,
- *     ARAGON_TEAM_MAX, ARAGON_LOG_LEVEL, ARAGON_LOG_FILE, ARAGON_LOG_DIR.
+ *     ARAGON_TEAM_MAX, ARAGON_RETRY, ARAGON_RETRY_MAX, ARAGON_FAST,
+ *     ARAGON_FAST_PROVIDER, ARAGON_FAST_MODEL, ARAGON_FAST_BASE_URL,
+ *     ARAGON_LOG_LEVEL,
+ *     ARAGON_LOG_FILE, ARAGON_LOG_DIR, ARAGON_TRANSCRIPT_RETAIN,
+ *     ARAGON_RENDER_GOVERNOR, ARAGON_MAX_RENDER_INTERVAL_MS.
  *
  * NOT here: `ARAGON_HOME`. It is read when `config/app-paths.ts` is first
  * evaluated, which is long before `loadDotenv()` runs, so a `.env` can never

package/dist/config/env.js

@@ -5,9 +5,14 @@
  *   - Provider secrets: ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY /
  *     GEMINI_API_KEY.
  *   - Overrides: ARAGON_PROVIDER, ARAGON_MODEL, ARAGON_BASE_URL, ARAGON_THINKING,
+ *     ARAGON_SHOW_THINKING,
  *     ARAGON_MAX_TOKENS (a number, or `auto` / `0` for the per-model ceiling),
  *     ARAGON_THEME, ARAGON_MOUSE, ARAGON_PLAN, ARAGON_TEAM,
- *     ARAGON_TEAM_MAX, ARAGON_LOG_LEVEL, ARAGON_LOG_FILE, ARAGON_LOG_DIR.
+ *     ARAGON_TEAM_MAX, ARAGON_RETRY, ARAGON_RETRY_MAX, ARAGON_FAST,
+ *     ARAGON_FAST_PROVIDER, ARAGON_FAST_MODEL, ARAGON_FAST_BASE_URL,
+ *     ARAGON_LOG_LEVEL,
+ *     ARAGON_LOG_FILE, ARAGON_LOG_DIR, ARAGON_TRANSCRIPT_RETAIN,
+ *     ARAGON_RENDER_GOVERNOR, ARAGON_MAX_RENDER_INTERVAL_MS.
  *
  * NOT here: `ARAGON_HOME`. It is read when `config/app-paths.ts` is first
  * evaluated, which is long before `loadDotenv()` runs, so a `.env` can never
@@ -59,6 +64,27 @@ export function readEnvConfig() {
     if (process.env.ARAGON_THINKING) {
         partial.thinkingLevel = clampThinkingLevel(process.env.ARAGON_THINKING.trim(), 'off');
     }
+    // Parsed by the POSITIVE list, like ARAGON_FULLSCREEN: anything else is left
+    // ABSENT so the config file underneath still wins.
+    const showThinking = process.env.ARAGON_SHOW_THINKING?.trim().toLowerCase();
+    if (showThinking !== undefined && showThinking.length > 0) {
+        partial.showThinking =
+            showThinking === '1' ||
+                showThinking === 'true' ||
+                showThinking === 'on' ||
+                showThinking === 'yes';
+    }
+    // The same positive-list parse as its neighbour, and the same "a non-empty
+    // value is an ANSWER" rule -- which is what lets `ARAGON_LIVE_TOOL_OUTPUT=0`
+    // turn a default-ON feature off (agent-activity-presentation-live §4.1).
+    const liveToolOutput = process.env.ARAGON_LIVE_TOOL_OUTPUT?.trim().toLowerCase();
+    if (liveToolOutput !== undefined && liveToolOutput.length > 0) {
+        partial.liveToolOutput =
+            liveToolOutput === '1' ||
+                liveToolOutput === 'true' ||
+                liveToolOutput === 'on' ||
+                liveToolOutput === 'yes';
+    }
     // `auto` / `0` mean AUTO (`null`); a number is clamped to the accepted range.
     // Anything else is LEFT ABSENT rather than written as `null`: a typo here used
     // to become AUTO and silently discard the number in the config file under it,
@@ -177,6 +203,110 @@ export function readEnvConfig() {
         if (Object.keys(section).length > 0)
             partial.todo = section;
     }
+    // ARAGON_RETRY=0 is the kill switch for API retry; ARAGON_RETRY_MAX=<n>
+    // overrides the count. Parsed by the POSITIVE list, exactly as
+    // ARAGON_FULLSCREEN / ARAGON_MOUSE / ARAGON_PLAN / ARAGON_TEAM / ARAGON_TODO
+    // are — NOT by `envBool` below, which uses a negative list.
+    //
+    // TWO VARS ONLY, and no third for the delays: every env var in this file exists
+    // because a flag and a config file are BOTH unreachable in the channel it
+    // serves, and nobody tunes a backoff multiplier from a container entrypoint.
+    //
+    // `>= 0`, NOT `> 0`, and the difference is the whole point (R-16).
+    // `ARAGON_TEAM_MAX` above guards `parsed > 0`, which is right for a fan-out
+    // width and wrong here: `0` is this key's documented floor AND its kill switch,
+    // so a `> 0` guard would drop `ARAGON_RETRY_MAX=0` on the floor and leave the
+    // user with the default 10. "Left ABSENT when unparseable" still holds and
+    // still matters — an unparseable value must not look permanently supplied, or
+    // the config file can never win again.
+    const retry = process.env.ARAGON_RETRY?.trim().toLowerCase();
+    const retryMax = process.env.ARAGON_RETRY_MAX?.trim();
+    if ((retry !== undefined && retry.length > 0) || (retryMax !== undefined && retryMax.length > 0)) {
+        const section = {};
+        if (retry !== undefined && retry.length > 0) {
+            section.enabled = retry === '1' || retry === 'true' || retry === 'on' || retry === 'yes';
+        }
+        if (retryMax !== undefined && retryMax.length > 0) {
+            const parsed = Number.parseInt(retryMax, 10);
+            if (Number.isFinite(parsed) && parsed >= 0)
+                section.maxRetries = parsed;
+        }
+        // A PARTIAL section, safe only because every consumer deep-merges it — the
+        // same contract `partial.skills` / `partial.log` / `partial.team` rely on.
+        if (Object.keys(section).length > 0)
+            partial.retry = section;
+    }
+    // ARAGON_FAST=1 turns the fast model tier on; the other three name it
+    // (fast-model-tier §4.3). Parsed by the POSITIVE list, exactly as
+    // ARAGON_FULLSCREEN / ARAGON_MOUSE / ARAGON_PLAN / ARAGON_TEAM / ARAGON_TODO /
+    // ARAGON_RETRY are — NOT by `envBool` below, whose NEGATIVE list disagrees with
+    // it on values like `ARAGON_FAST=disable`.
+    //
+    // FOUR VARS, AND DELIBERATELY NO `ARAGON_FAST_REVIEW_EVERY` / `_MAX_CHARS` /
+    // `_DELEGATE` (D-14). The rule this file states is that an environment variable
+    // exists only where a flag AND a config file are BOTH unreachable — a
+    // container, an ssh session, being spawned by another tool. "Which model, and
+    // is it on" passes that test; tuning a review cadence does not, and every key
+    // that fails it is documentation debt plus a fifth place for the value to
+    // disagree with itself.
+    //
+    // ONE ACCUMULATED SECTION, ASSIGNED ONCE — the shape the `team`, `todo` and
+    // `retry` branches above all use, and NOT four `if` blocks each assigning
+    // `partial.fast`. THE CAST IS WHAT WOULD MAKE THAT MISTAKE SILENT: a second
+    // assignment compiles clean and drops `enabled`, so
+    // `ARAGON_FAST=1 ARAGON_FAST_MODEL=x` would quietly resolve with the tier off
+    // (the P1-4 defect this file records for `todo`).
+    const fast = process.env.ARAGON_FAST?.trim().toLowerCase();
+    const fastProvider = process.env.ARAGON_FAST_PROVIDER?.trim();
+    const fastModel = process.env.ARAGON_FAST_MODEL?.trim();
+    const fastBaseUrl = process.env.ARAGON_FAST_BASE_URL?.trim();
+    if ((fast !== undefined && fast.length > 0) ||
+        (fastProvider !== undefined && fastProvider.length > 0) ||
+        (fastModel !== undefined && fastModel.length > 0) ||
+        (fastBaseUrl !== undefined && fastBaseUrl.length > 0)) {
+        const section = {};
+        if (fast !== undefined && fast.length > 0) {
+            section.enabled = fast === '1' || fast === 'true' || fast === 'on' || fast === 'yes';
+        }
+        if (fastProvider !== undefined && fastProvider.length > 0)
+            section.provider = fastProvider;
+        if (fastModel !== undefined && fastModel.length > 0)
+            section.model = fastModel;
+        if (fastBaseUrl !== undefined && fastBaseUrl.length > 0)
+            section.baseUrl = fastBaseUrl;
+        // A PARTIAL section, safe only because every consumer deep-merges it — the
+        // same contract the four sections above rely on.
+        if (Object.keys(section).length > 0)
+            partial.fast = section;
+    }
+    // Render bounds (tui-render-performance §5.3). Same channel story as
+    // ARAGON_FULLSCREEN: a container or a wrapper that owns argv can reach neither
+    // a flag nor a config file, and a session that freezes is exactly the case
+    // where the user needs a knob they can turn from the outside.
+    //
+    // ARAGON_TRANSCRIPT_RETAIN / ARAGON_MAX_RENDER_INTERVAL_MS are left ABSENT
+    // when unparseable rather than written as a default, so the config file can
+    // still win — the rule `ARAGON_TEAM_MAX` above records.
+    const retain = process.env.ARAGON_TRANSCRIPT_RETAIN?.trim();
+    if (retain !== undefined && retain.length > 0) {
+        const parsed = Number.parseInt(retain, 10);
+        if (Number.isFinite(parsed) && parsed > 0)
+            partial.transcriptRetain = parsed;
+    }
+    // Parsed by the POSITIVE list, exactly as ARAGON_FULLSCREEN / ARAGON_MOUSE /
+    // ARAGON_PLAN / ARAGON_TEAM / ARAGON_TODO are — NOT by `envBool` below, which
+    // uses a negative list. The two readers disagree on `ARAGON_RENDER_GOVERNOR=disable`.
+    const governor = process.env.ARAGON_RENDER_GOVERNOR?.trim().toLowerCase();
+    if (governor !== undefined && governor.length > 0) {
+        partial.renderGovernor =
+            governor === '1' || governor === 'true' || governor === 'on' || governor === 'yes';
+    }
+    const renderInterval = process.env.ARAGON_MAX_RENDER_INTERVAL_MS?.trim();
+    if (renderInterval !== undefined && renderInterval.length > 0) {
+        const parsed = Number.parseInt(renderInterval, 10);
+        if (Number.isFinite(parsed) && parsed > 0)
+            partial.maxRenderIntervalMs = parsed;
+    }
     const log = readEnvLogConfig();
     if (log)
         partial.log = log;

package/dist/config/load.d.ts

@@ -27,6 +27,13 @@ export interface CliFlags {
     compact?: boolean;
     /** `--hints` ⇒ true, `--no-hints` ⇒ false, absent ⇒ undefined. */
     hints?: boolean;
+    /** `--show-thinking` ⇒ true, `--no-show-thinking` ⇒ false, absent ⇒ undefined. */
+    showThinking?: boolean;
+    /**
+     * `--live-tool-output` ⇒ true, `--no-live-tool-output` ⇒ false, absent ⇒ undefined
+     * (agent-activity-presentation-live §4.1).
+     */
+    liveToolOutput?: boolean;
     /** `--mouse` ⇒ true, `--no-mouse` ⇒ false, absent ⇒ undefined. */
     mouse?: boolean;
     /** `--no-skills` ⇒ false. Turns the whole skill subsystem off (§7.5). */
@@ -85,6 +92,62 @@ export interface CliFlags {
     logFile?: boolean;
     /** `--log-dir <dir>` — this run only. */
     logDir?: string;
+    /** `--transcript-retain <n>` — the `ViewState` ring cap for this run (L1). */
+    transcriptRetain?: string | number;
+    /**
+     * `--render-governor` ⇒ true, `--no-render-governor` ⇒ false, absent ⇒
+     * undefined (L4).
+     *
+     * DECLARED AS A PAIR for the reason `--todo-panel` records: `renderGovernor`
+     * is PERSISTED, so a lone `--no-render-governor` would make commander default
+     * `opts.renderGovernor` to `true` and silently overwrite a stored `false` on
+     * every run that passed no flag at all.
+     */
+    renderGovernor?: boolean;
+    /** `--max-render-interval <ms>` — the governor ceiling for this run (L4). */
+    maxRenderInterval?: string | number;
+    /**
+     * `--retry` ⇒ true, `--no-retry` ⇒ false, absent ⇒ undefined
+     * (llm-api-retry-backoff §6.2).
+     *
+     * DECLARED AS A PAIR, for the reason `--todo-panel` and `--render-governor`
+     * each record: `retry.enabled` is PERSISTED, so a lone `--no-retry` would make
+     * commander default `opts.retry` to `true` and silently overwrite a stored
+     * `enabled: false` on every run that passed no flag at all.
+     */
+    retry?: boolean;
+    /**
+     * `--retry-max <n>` — override `retry.maxRetries` for this run (still clamped).
+     *
+     * `0` IS A LEGITIMATE VALUE HERE and is the flag's kill switch, which is why
+     * `resolveRetryConfig` tests `!== undefined` rather than truthiness and why the
+     * clamp is `clampIntAllowingZero`.
+     */
+    retryMax?: string | number;
+    /**
+     * `--fast` ⇒ true, `--no-fast` ⇒ false, absent ⇒ undefined
+     * (fast-model-tier §4.3).
+     *
+     * DECLARED AS A PAIR — MANDATORY (C-9), for the reason `--team`,
+     * `--todo-panel`, `--render-governor` and `--retry` each record in turn.
+     * `fast.enabled` is PERSISTED and defaults to `false`, so a lone `--fast`
+     * would be indistinguishable from silence and the DEFAULT-OFF guarantee (R-d)
+     * would depend on a commander detail.
+     */
+    fast?: boolean;
+    /** `--fast-model <id>` — implies nothing about `enabled` on its own. */
+    fastModel?: string;
+    /** `--fast-provider <id>` — `''` (absent) inherits the main provider. */
+    fastProvider?: string;
+    /**
+     * `--fast-review <n|off>` — `off` sets `fast.review: false`, a number sets
+     * `reviewEveryTurns`.
+     *
+     * ONE FLAG FOR TWO KEYS, and deliberately: "how often" and "at all" are one
+     * decision to a user, and a separate `--no-fast-review` would be a fifth pair
+     * to keep in step with `toFlags`.
+     */
+    fastReview?: string;
 }
 /**
  * Resolve the effective config by merging all layers, then derive the runtime

package/dist/config/load.js

@@ -6,11 +6,12 @@
  * legitimately long single tool run can never be watchdog-killed.
  */
 import process from 'node:process';
-import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampLogConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampTheme, clampThinkingLevel, clampMaxTokens, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, } from './schema.js';
+import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampTheme, clampThinkingLevel, clampMaxTokens, clampMaxRenderInterval, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, } from './schema.js';
 import { loadDotenv, readEnvConfig, readEnvDisabledSkills } from './env.js';
 import { readConfigFile } from './store.js';
 import { getConfigPath } from './app-paths.js';
 import { setHistoryEnabled } from './prompt-history.js';
+import { setEntryRetain } from '../agent/entry-limits.js';
 import { readSubmitCount } from './ui-state.js';
 import { getLogger } from '../logging/logger.js';
 import { registerSecret, registerSecretsFrom } from '../logging/secret-registry.js';
@@ -120,6 +121,89 @@ function resolveTodoConfig(flags, env, file) {
         ...(flags.todoFollow !== undefined ? { followThrough: flags.todoFollow } : {}),
     });
 }
+/**
+ * Merge the `retry` section across all four layers (defaults › file › env ›
+ * flags), llm-api-retry-backoff §6.2.
+ *
+ * `!== undefined` ON BOTH FLAGS, and that is the whole point — the rule
+ * `resolveTeamConfig` and `resolveTodoConfig` each state once. Commander
+ * materialises a lone `--no-retry` as `opts.retry = true` when the flag is
+ * ABSENT, so a truthiness check cannot tell `--no-retry` from "not passed"; and
+ * `flags.retryMax` may legitimately be `0`, which a truthiness check would drop
+ * on the floor and replace with the default 10 (R-16).
+ */
+function resolveRetryConfig(flags, env, file) {
+    return clampRetryConfig({
+        ...DEFAULT_CONFIG.retry,
+        ...(file.retry ?? {}),
+        ...(env.retry ?? {}),
+        ...(flags.retry !== undefined ? { enabled: flags.retry } : {}),
+        ...(flags.retryMax !== undefined && flags.retryMax !== ''
+            ? { maxRetries: flags.retryMax }
+            : {}),
+    });
+}
+/**
+ * Merge the `fast` section across all four layers (defaults › file › env ›
+ * flags), fast-model-tier §3.7.
+ *
+ * `!== undefined` ON `flags.fast`, which is the rule `resolveTeamConfig`,
+ * `resolveTodoConfig` and `resolveRetryConfig` each state once (C-9): commander
+ * materialises a lone `--no-fast` as `opts.fast = true` when the flag is absent,
+ * so a truthiness check cannot tell `--no-fast` from "not passed" — and here the
+ * damage would run the other way from usual, silently turning a default-OFF
+ * feature ON for every run that passed no flag at all.
+ *
+ * `--fast-review` maps onto TWO keys, so it is parsed rather than spread: `off`
+ * is `review: false`, a number is `reviewEveryTurns`, and anything else is
+ * ignored (the clamp discipline every other key in this file follows).
+ */
+function resolveFastConfig(flags, env, file) {
+    const reviewFlag = flags.fastReview?.trim().toLowerCase();
+    const reviewPatch = {};
+    if (reviewFlag !== undefined && reviewFlag.length > 0) {
+        if (reviewFlag === 'off') {
+            reviewPatch.review = false;
+        }
+        else {
+            const n = Number.parseInt(reviewFlag, 10);
+            if (Number.isFinite(n) && n > 0)
+                reviewPatch.reviewEveryTurns = n;
+        }
+    }
+    return clampFastConfig({
+        ...DEFAULT_CONFIG.fast,
+        ...(file.fast ?? {}),
+        ...(env.fast ?? {}),
+        ...(flags.fast !== undefined ? { enabled: flags.fast } : {}),
+        ...(flags.fastModel !== undefined && flags.fastModel !== ''
+            ? { model: flags.fastModel }
+            : {}),
+        ...(flags.fastProvider !== undefined && flags.fastProvider !== ''
+            ? { provider: flags.fastProvider }
+            : {}),
+        ...reviewPatch,
+    });
+}
+/**
+ * Resolve the adaptive render governor: flag › env › file › default `true`
+ * (tui-render-performance L4).
+ *
+ * Shaped like `resolveMouse` rather than like `resolveFullscreen`: there are no
+ * heuristics for an explicit `true` to override, so a persisted `true` is just a
+ * value and not an opinion that has to be told apart from silence. `!==
+ * undefined` on the flag is what makes `--no-render-governor` beat a config file
+ * that turned it on (P1-4's rule, one feature later).
+ */
+function resolveRenderGovernor(flags, env, file) {
+    if (flags.renderGovernor !== undefined)
+        return flags.renderGovernor;
+    if (env.renderGovernor !== undefined)
+        return env.renderGovernor;
+    if (file.renderGovernor !== undefined)
+        return file.renderGovernor;
+    return DEFAULT_CONFIG.renderGovernor;
+}
 /** Merge the `log` section across all four layers (defaults › file › env › flags). */
 function resolveLogConfig(flags, env, file) {
     const merged = clampLogConfig({
@@ -203,6 +287,16 @@ export function loadConfig(flags = {}) {
     const model = pick(flags.model, env.partial.model, file.model) ?? DEFAULT_CONFIG.model;
     const baseUrl = pick(flags.baseUrl, env.partial.baseUrl ?? undefined, file.baseUrl ?? undefined);
     const thinkingLevel = clampThinkingLevel(pick(flags.thinking, env.partial.thinkingLevel, file.thinkingLevel), DEFAULT_CONFIG.thinkingLevel);
+    // BESIDE ITS SIBLING, and through the same three layers (§4.1 / P1-2). This is
+    // the ONLY place flags, environment and file are joined, so a key resolved
+    // anywhere else reaches the UI from at most one of them.
+    const showThinking = pick(flags.showThinking, env.partial.showThinking, file.showThinking) ??
+        DEFAULT_CONFIG.showThinking;
+    // THE SAME THREE LAYERS, in the same one place (§4.1). Round 1's P1-2 and the
+    // fast tier's round-2 IF both record the identical failure: a key resolved
+    // anywhere else reaches the UI from at most one of flags, environment and file.
+    const liveToolOutput = pick(flags.liveToolOutput, env.partial.liveToolOutput, file.liveToolOutput) ??
+        DEFAULT_CONFIG.liveToolOutput;
     const maxTokens = resolveMaxTokens(flags, env.partial, file);
     // `clampTheme` is also where the v0.3.0 `dark` name is migrated to `cool`,
     // so reading a legacy config file needs no extra step here (§4.5 / R-4).
@@ -268,11 +362,30 @@ export function loadConfig(flags = {}) {
     // The prompt-history store is a module-level singleton, so the resolved value
     // has to be pushed into it — this is the ONLY place that happens.
     setHistoryEnabled(historyEnabled);
+    // Transcript bounds (tui-render-performance L1 / L3).
+    //
+    // `transcriptRetain` is RAISED TO `transcriptWindow` when the two conflict:
+    // retaining fewer entries than the window can scroll to would silently make
+    // part of the window unreachable, and the user would see a horizon they can
+    // never actually reach.
+    //
+    // The raise is REPORTED, not just performed (§5.1). Overriding a value the
+    // user typed and saying nothing is the one thing this feature is not allowed
+    // to add — every other adjustment it makes is announced somewhere, and a
+    // config key is the last place to start making exceptions.
+    const transcriptWindow = clampTranscriptWindow(pick(env.partial.transcriptWindow, file.transcriptWindow), DEFAULT_CONFIG.transcriptWindow);
+    const requestedRetain = clampTranscriptRetain(pick(flags.transcriptRetain, env.partial.transcriptRetain, file.transcriptRetain), DEFAULT_CONFIG.transcriptRetain);
+    const transcriptRetain = Math.max(transcriptWindow, requestedRetain);
+    // `viewReducer` is pure and takes no config, so the resolved ring cap reaches
+    // it through the same module-singleton channel `setHistoryEnabled` uses.
+    setEntryRetain(transcriptRetain);
     const config = {
         provider,
         model,
         baseUrl,
         thinkingLevel,
+        showThinking,
+        liveToolOutput,
         maxTokens,
         theme,
         reducedMotion,
@@ -280,7 +393,11 @@ export function loadConfig(flags = {}) {
         exitTranscript: flags.exitTranscript !== undefined
             ? flags.exitTranscript
             : file.exitTranscript ?? DEFAULT_CONFIG.exitTranscript,
-        transcriptWindow: clampTranscriptWindow(file.transcriptWindow, DEFAULT_CONFIG.transcriptWindow),
+        transcriptWindow,
+        transcriptRetain,
+        ...(requestedRetain < transcriptRetain ? { transcriptRetainRequested: requestedRetain } : {}),
+        renderGovernor: resolveRenderGovernor(flags, env.partial, file),
+        maxRenderIntervalMs: clampMaxRenderInterval(pick(flags.maxRenderInterval, env.partial.maxRenderIntervalMs, file.maxRenderIntervalMs), DEFAULT_CONFIG.maxRenderIntervalMs),
         confirmTools,
         toolTimeoutMs,
         idleTimeoutMs,
@@ -309,6 +426,8 @@ export function loadConfig(flags = {}) {
         log: resolveLogConfig(flags, env.partial, file),
         team: resolveTeamConfig(flags, env.partial, file),
         todo: resolveTodoConfig(flags, env.partial, file),
+        retry: resolveRetryConfig(flags, env.partial, file),
+        fast: resolveFastConfig(flags, env.partial, file),
         cwd,
         color,
         colorLevel,
@@ -345,6 +464,10 @@ function recordResolvedConfig(config) {
         idleTimeoutMs: config.idleTimeoutMs,
         historyEnabled: config.historyEnabled,
         logLevel: config.log.level,
+        // Four layers feed this one too, and none of them would otherwise leave a
+        // trace — so "why did my failing call sit there for three minutes" (or
+        // "why did it not retry at all") has an answer after the fact.
+        retry: config.retry.enabled ? config.retry.maxRetries : 'off',
         hasApiKey: Boolean(config.apiKeys[config.provider]),
         configPath: getConfigPath(),
     });