@aragon-agent/cli 0.5.8 → 0.5.9

package/CHANGELOG.md

@@ -7,8 +7,147 @@ were written.
 
 ## Unreleased
 
+### Added
+
+- **A running command shows what it is doing.** `bash` is the only tool here that
+  can run for minutes — `npm test`, a `git clone`, a training job — and while it
+  ran, its card was one line of text that never changed. Nothing in that frame
+  distinguished a test suite at 40% from a child process blocked forever on a
+  password prompt this CLI will never show. Its card now carries the last eight
+  lines of what the command is printing, plus one footer row that reads
+  `(running)` or, once the child has been quiet for ten seconds,
+  `no output for 45s` — with the seconds advancing.
+
+  A `\r`-driven progress bar (npm, pip, curl, docker) is *one* line rewritten a
+  thousand times, and it renders as **one row counting up in place** rather than
+  a thousand rows of nearly the same string — including the ordinary case where
+  the bar emits no newline at all for its entire run.
+
+  Everything the tail shows is **stripped, not interpreted**: ANSI colour, cursor
+  motion, `\r`, `\b`, tabs and every other control byte are removed at the
+  boundary before a row is stored, so nothing can move a cursor inside a frame
+  the renderer believes it owns. It is bounded twice by construction — eight rows
+  per call, sixteen concurrent calls — so a command that writes 400 MB to stdout
+  costs a fixed number of retained rows.
+
+  It is a **display and nothing else**. The text the model receives is
+  byte-for-byte what it was; `Ctrl+O` does nothing while a command runs, because
+  expansion is a promise about stored content and there is no stored rest of a
+  400 MB stream; `/save` during a run writes no tail, since a resumed one would
+  describe a process that died with the session; and at settle the card is
+  replaced by the authoritative result exactly as before.
+
+  New config key `liveToolOutput`, defaulting to **`true`** — unlike
+  `showThinking` below, this adds information rather than hiding it.
+  `aragon config set liveToolOutput false` (or `--no-live-tool-output`, or
+  `ARAGON_LIVE_TOOL_OUTPUT=0`, or the **Live output** row in `/settings`) turns it
+  off, and with it off no store is allocated and no recorder is attached: `bash`
+  is byte-identical to the build before this entry.
+
+- **The working line stops guessing while a tool runs.** It reads
+  `⠙ Running bash` instead of rotating thinking-words. `running` covers the whole
+  turn, including the minutes the model is idle and a child process is doing the
+  work, so "Pondering" during a build was not calm — it was wrong. One row, no
+  digits, no clock: everything the row already promised still holds.
+
+### Changed
+
+- **Reasoning blocks are now hidden by default.** `showThinking` is a new
+  top-level config key and it defaults to `false`. If you have been reading
+  thinking every day, this is the entry that concerns you: `Ctrl+T` still shows
+  it for the session exactly as before, `aragon config set showThinking true`
+  (or `--show-thinking`, or `ARAGON_SHOW_THINKING=1`) restores the old behaviour
+  permanently, and `/settings` has a **Show thinking** row directly under
+  **Thinking**.
+
+  Nothing is hidden silently. A settled turn that thought leaves one muted row
+  where the block used to be — `✱ thought for 12s · ctrl+t to show` — so the fact
+  that reasoning happened, how long it took, and how to see it are all still on
+  screen. In **inline** mode that row omits the key hint and the toast reads
+  `Thinking shown for new output.`, because a settled entry there has already
+  been printed into your terminal's scrollback and cannot be repainted; the
+  toggle applies to the live entry and to everything drawn after it.
+
+  `thinkingLevel` is untouched and means what it always did — the effort the
+  provider is asked to spend. `showThinking` is only whether the terminal draws
+  what came back. They are one word apart in the config file, which is why the
+  flag is `--show-thinking` rather than the shorter name.
+
+### Added
+
+- **A live working line while a run is in flight.** One row above the composer,
+  carrying a spinner and a word that rotates every four seconds:
+  `⠋ Percolating…`. Take reasoning off the screen and the gap between submitting
+  and the first token is otherwise completely blank, which reads as dead rather
+  than as busy — the two changes are one change.
+
+  It carries no clock and no token count, deliberately: the status bar one row
+  below already renders both, under the same running condition and driven by the
+  same 200 ms ticker this row reuses. Under `reducedMotion` the spinner is a
+  static glyph and the word is chosen once and holds, because rotating text is
+  motion too. An idle frame is unchanged, and so is the viewport's row budget —
+  the line shares the row the toast strip already owned rather than adding one.
+
+- **`write_file` and `edit_file` render a real diff.** Hunks with old/new line
+  numbers, a `+N -M` summary, add/remove/context colouring, and `(truncated)` or
+  a `binary` / `too-large` / `unreadable` note when the old side could not be
+  read. Diffs collapse at 12 rows behind the existing `Ctrl+O` — no new
+  keybinding. A resumed session written by an older build, or a card whose patch
+  the bounded store already evicted, falls back to the previous text preview;
+  nothing renders blank.
+
+  `write_file` previously reported creating a 300-line file as
+  `Wrote 8214 bytes to path`, and `edit_file`'s diff trimmed the common prefix
+  and suffix and rendered *everything* in between as one removed block followed
+  by one added block — for a `replace_all` touching line 40 and line 900, that
+  was 860 removed rows followed by 860 nearly identical added ones.
+
+  **The model's input got smaller, not larger.** The structured patch reaches the
+  screen on a CLI-local channel rather than through the tool result, and the text
+  the model reads gained a 4 000-character ceiling it did not have before (its
+  only previous bound was the executor's 100 KB backstop). A single-region edit
+  is byte-for-byte what it was plus one `@@` header; a multi-region edit is
+  strictly smaller. `write_file`'s result text is unchanged.
+
 ### Changed
 
+- **A stream that stops mid-answer is now a loud failure instead of a silent
+  truncated one.** All three provider adapters used to end their SSE loop by
+  yielding "done" with whatever had arrived, so a connection closed cleanly
+  half-way through an answer — a proxy idle cut, a load-balancer timeout, an
+  HTTP/2 GOAWAY — was indistinguishable from a completed reply. You got a
+  truncated answer and were told nothing.
+
+  Each adapter now reports the truncation, which is what lets it be retried and
+  recovered. An **abort** is explicitly excluded and still completes normally, and
+  a model that legitimately says nothing and stops is still a success.
+
+  This is deliberately **not** behind `--no-retry`: an adapter that reports a
+  truncated stream honestly should do so whether or not retry is enabled. A switch
+  that also disabled telling you the truth would be a mute button, not a kill
+  switch.
+
+- **The mouse wheel now only ever scrolls.** A notch scrolls the transcript
+  three rows (a page with `Shift`), or the open overlay when there is one, no
+  matter where the pointer is sitting. Prompt history is recalled by `↑` / `↓`
+  alone, exactly as in Claude Code and Codex.
+
+  **This supersedes the 0.5.0 entry below**, which said the wheel "scrolls what
+  is under the pointer" and stepped prompt history one entry per notch when the
+  pointer was over the input box. That turned out to be wrong in use rather than
+  in principle: the pointer is not an instrument you aim in a TUI — it rests
+  wherever you last left it, which in a chat-shaped app is next to the thing you
+  type into. So the ordinary "scroll back and see what just happened" gesture
+  landed on the composer and replaced the draft with an old prompt, with no
+  error, no undo and nothing visibly connecting the gesture to the outcome. The
+  band that decided this was invisible too: its boundary was a measured row that
+  moved as the toast row, the hint row and the completion popup came and went, so
+  the same gesture could do two different things a second apart.
+
+  Nothing else about the wheel changes — same three rows per notch, same
+  `Shift`+wheel page, same `--no-mouse` / `ARAGON_MOUSE=0` / `mouse: false`
+  escape hatches, same `Shift`+drag for selecting text.
+
 - **A long session stays as fast as a short one.** The TUI used to get slower as
   a session grew and, past a threshold, stopped making progress at all. That was
   structural rather than incidental: Ink has no output caching, so every frame
@@ -68,6 +207,146 @@ were written.
 
 ### Added
 
+- **A fast model tier: a second, cheaper model you can delegate to and be
+  reviewed by.** Off by default — with `fast.enabled: false` the system prompt,
+  the `task` schema, the transcript and the request payloads are byte-identical
+  to a build without it — and it does two things once you turn it on.
+
+  **Delegation.** `task` gains one optional field per subagent, `model: "fast"`.
+  A child marked that way runs on the fast model and is otherwise identical:
+  same tools, same working directory, same `--confirm` gate, same plan-mode
+  gate, same skills ceiling. Delegating to a cheaper model is a *model* choice,
+  never a permission boundary. It is where "not complicated, but very expensive
+  in context" gets paid for — a child that reads nine files and reports four
+  sentences moves the file bodies out of the lead's window and onto a model that
+  costs a fraction as much per token.
+
+  **Periodic review.** Every few turns a small digest of what the lead has been
+  doing goes to the fast model with one question — is this still on track? — and
+  a critique that is not "on track" is injected into the running loop as a
+  `<fast_review>` block, so the lead sees a second opinion while it can still
+  act on it:
+
+  ```
+    fast review #2 · claude-haiku-4-5 · turn 12 · 1.4s
+    You have edited config/schema.ts three times without running the tests.
+  ```
+
+  The digest is built from a bounded ring of recent turns and **never** from the
+  message history: sending a session's accumulated file bodies to the "cheap"
+  model would make a review cost more than the turn it reviews, which is the
+  inversion the whole feature exists to prevent.
+
+  Spend is attributed **per tier** — a fast child's tokens are priced at the
+  fast model's table, not the lead's, and the dispatch report states the two
+  separately. A model the built-in price table has never seen is reported as
+  `unknown` rather than as `$0.00`, because a feature that looks free while it
+  is spending money is worse than one that admits it does not know.
+
+  Turn it on with `/fast model <id>` then `/fast on`, with
+  `aragon config set fast.enabled true`, with `--fast --fast-model <id>`, or with
+  `ARAGON_FAST=1 ARAGON_FAST_MODEL=<id>`. `/fast status` is the guaranteed
+  readout: the resolved model, the budget, and this session's reviews, delegated
+  children, tokens and cost. Eleven `fast.*` config keys, four flags, four
+  environment variables and five settings-screen rows; see the README.
+
+  **The review has a session budget.** A session is not one run — it is one run
+  per message you send — so a cadence bounds the pace and nothing bounds the
+  total. `fast.reviewMaxPerSession` (default **40**, raisable live with
+  `/fast budget <n>`) is the number of reviews a session may *start*; reaching it
+  prints one `info` notice that names the remedy and says delegation is
+  unaffected, and `/fast status` reads `12/40` from the first review rather than a
+  bare count you can only size after the fact. It is denominated in **reviews,
+  not currency**, because the fast tier is exactly where a model the price table
+  has never seen lives — a dollar ceiling would silently never fire for the
+  configuration that most needs one. Delegation is never budgeted: it is spend the
+  lead chose in service of a message you sent, it is already bounded by `team.*`,
+  and it exists to *reduce* total cost.
+
+  **The review also fails fast, so it cannot compete with you.** It calls through
+  its own provider registry with **one** retry rather than the ten
+  `retry.maxRetries` defaults to for the lead, and it observes neither `retry.*`
+  nor `/retry` — that policy says how hard to fight for *your* answer, and
+  inheriting it for an unrequested background call is how an advisory ends up
+  spending a rate-limited provider's quota on itself. Its own wall-clock bound
+  is 20 s.
+
+  Two failure modes are handled out loud rather than silently. If the tier stops
+  resolving mid-session — you switch the main provider and `fast.provider` was
+  inheriting it — `model:"fast"` is downgraded to the main model, **counted, and
+  stated in the report**, because an agent that silently gets an expensive child
+  has no way to learn its cost model is wrong. And three consecutive
+  *misconfiguration* failures disable the reviewer for the session with exactly
+  one warning, while a merely busy provider (rate-limited or overloaded) is
+  treated as transient and never counts — that condition fixes itself, and a
+  session-long silent shutdown over it would not. A review you *cancelled* is
+  neither: Esc, a run that ends first, or quitting leaves a `cancelled` card and
+  no strike against the tier.
+
+  Reviews log under their own `fast` scope rather than under `agent`, so
+  `fast_review_*` records filter cleanly away from the lead's.
+
+- **API calls are retried with backoff, and the waiting is legible.** A transient
+  provider failure — HTTP 429, 529, 5xx, 408, or a dropped connection — used to end
+  the turn. One red notice, an idle prompt, and forty tool calls of work thrown
+  away. It is now retried up to **10 times** with an increasing interval
+  (1 s → 2 → 4 → 8 → 16 → 30 s, equal-jittered, 30 s per wait at most) under a
+  4-minute budget measured from the first failure.
+
+  What you see while it waits is **one line, rewritten in place** — never ten
+  notices — carrying what failed, which attempt this is, and a countdown to the
+  next one:
+
+  ```
+    ↻  Provider overloaded · retry 3/10 in 7s          Esc to cancel
+    ↻  recovered after 3 retries · 12.4s
+  ```
+
+  plus a `retry 3/10 7s` chip on the status bar (`[r3]` on a narrow terminal). The
+  card settles into the transcript as history — `recovered`, `gave up`, or
+  `interrupted` — and shows up in the exit replay, because a turn that spent three
+  minutes retrying is exactly the kind of cost an exported transcript should
+  account for.
+
+  **Esc ends the wait within a frame**, not at the end of the countdown, and it
+  never produces a fabricated error: an aborted request is silent. That is the one
+  detail everything else here depends on, because the provider layer marks an
+  `AbortError` as retryable — so the signal is checked *before* the error, and a
+  user pressing Esc can never be mistaken for a timeout worth retrying.
+
+  Never retried: `auth_error` (401/403), `invalid_request`, `context_overflow`.
+  Ten retries of a bad API key is three minutes of looking broken.
+
+  `Retry-After` is honoured as a **floor**, never a replacement — a `Retry-After: 1`
+  on the ninth retry does not undo eight retries of backoff — and a stated wait
+  longer than a minute is surfaced immediately with the provider's own number
+  rather than silently wedging the terminal.
+
+  A connection that dies **mid-answer** is also covered, and this is the case that
+  needed more than a retry loop: the partial text is discarded, the affected tool
+  cards are removed, and the answer restarts from the top. Nothing is duplicated,
+  because the engine only writes history on a completed turn.
+
+- **`/retry [show|on|off|max <n>]`, `--retry` / `--no-retry`, `--retry-max <n>`,
+  `ARAGON_RETRY`, `ARAGON_RETRY_MAX`, and a `retry` config section** with nine
+  keys (`aragon config set retry.*`). `/retry off` takes effect **in the running
+  session** — subagents included, since they share the lead's provider registry —
+  not only at the next launch. `retry.maxRetries: 0` is the kill switch and is a
+  real value at every one of those entry points. `/settings` gains one read-only
+  `API retries` row.
+
+- **A subagent's retry is visible on the team card.** A child in backoff reports
+  `retry 3/10` on its own row. Children inherit the retry policy for free, but
+  their events never reach the lead's view, so without this a subagent spending
+  three minutes waiting looked exactly like a hung dispatch.
+
+- **Retry lines in `-p` mode go to stderr, never stdout.** `[retry 3/10]
+  overloaded — waiting 7s` and `[retry] recovered after 3 retries` are on stderr,
+  so `aragon -p … | jq` stays valid; a discarded partial answer is announced there
+  too, because a piped consumer otherwise cannot tell a replay from a model that
+  repeated itself. They are not suppressed by `--quiet`: a three-minute pause with
+  no explanation is not a compact run, it is a hang.
+
 - **`/perf`.** Reports what the renderer is actually doing: the frame interval
   and the last commit cost, how many entries exist / are retained / were dropped
   / are mounted, height-cache and render-cache occupancy, and the viewport