@aragon-agent/cli 0.5.8 → 0.5.9

package/dist/commands/builtins.js

@@ -1,14 +1,15 @@
 /**
  * Built-in slash commands (spec §5.2):
  * /help /model /settings /thinking /max-tokens /tools /clear /reset /cwd /save
- * /resume /copy /exit (/quit).
+ * /resume /copy /exit (/quit), plus the /team, /fast and /todo subsystems.
  */
 import { spawn } from 'node:child_process';
 import { existsSync, statSync } from 'node:fs';
 import { isAbsolute, resolve } from 'node:path';
 import process from 'node:process';
 import { resolveOutputTokens } from '@aragon-agent/core';
-import { clampThinkingLevel, clampTheme, isThemeName, parseMaxTokensInput, DEFAULT_MAX_TOKENS, LEGACY_DARK_THEME, THEME_NAMES, THINKING_LEVELS, } from '../config/schema.js';
+import { clampThinkingLevel, clampTheme, isAdapterProvider, isThemeName, parseMaxTokensInput, ADAPTER_PROVIDERS, DEFAULT_MAX_TOKENS, HARD_MAX_RETRIES, LEGACY_DARK_THEME, THEME_NAMES, THINKING_LEVELS, } from '../config/schema.js';
+import { computeCost, formatCost, formatTokens } from '../agent/usage.js';
 import { TODO_FOLLOW_LIMITS } from '../todo/limits.js';
 import { buildContinuationMessage } from '../todo/follow-through.js';
 import { MODE_LABEL, nextMode } from '../agent/agent-mode.js';
@@ -16,6 +17,59 @@ import { loadConfig } from '../config/load.js';
 import { loadSession, resolveSessionPath, saveSession } from '../session/persist.js';
 import { getLogger } from '../logging/logger.js';
 import { perfCommand } from './perf.js';
+/**
+ * `/fast status` — THE GUARANTEED REPORTING SURFACE for the tier (§4.4 / R-8).
+ *
+ * The chip degrades on a narrow terminal and the card only appears when a review
+ * happens; this is the one place that always answers "is it on, what is it, and
+ * has it done anything". The session totals are here rather than on the status
+ * bar because the aggregate there cannot answer "is the cheap tier actually
+ * saving me anything?".
+ *
+ * `unknown (no price table for <model>)` RATHER THAN A CURRENCY AMOUNT when the
+ * static table has never seen the model (C-11 / RV-4 / AC-34): `$0.00` on a
+ * feature that is spending money is the same class of lie as pricing a Haiku
+ * child at Sonnet rates.
+ */
+function formatFastStatus(controller) {
+    const status = controller.getFastStatus();
+    const cfg = controller.getFastConfig();
+    const state = !status.registered
+        ? 'off for this session (not configured at launch)'
+        : status.enabled
+            ? 'on'
+            : 'off';
+    const lines = [];
+    if (status.tier.ok) {
+        const same = status.tier.sameAsMain ? '  (same as main)' : '';
+        lines.push(`Fast tier: ${state}. Model: ${status.tier.ref.providerId}:${status.tier.ref.modelId}${same}.`);
+    }
+    else {
+        lines.push(`Fast tier: ${state}. Model: ${cfg.model || '(not set)'}.`);
+    }
+    lines.push(`Review: ${cfg.review ? `every ${cfg.reviewEveryTurns} turns` : 'off'}. ` +
+        `Delegation: ${cfg.delegate ? 'on' : 'off'}.`);
+    const snapshot = status.snapshot;
+    const cost = snapshot.pricingUnknown
+        ? `unknown (no price table for ${snapshot.model})`
+        : formatCost(computeCost(snapshot.usage, status.tier.ok ? controller.getModelInfoFor(status.tier.ref).cost : undefined));
+    // `n/N`, NEVER A BARE `n` (fast-model-tier-hardening §4.3). A bare count
+    // answers "what have I spent" only for a reader who already knows the
+    // ceiling, which is precisely what the user does not know; `12/40` answers
+    // that and "how much is left" in the same three characters, and makes the
+    // budget discoverable to someone who never read the config schema. The
+    // exhausted form names the remedy inline, because a status line that reports
+    // a stop without its escape hatch just relocates the question.
+    //
+    // `budgetReached` is READ, not re-derived (RV-H10): with the tier off both
+    // numbers are `0` placeholders and `reviews >= reviewBudget` would be true.
+    const budget = snapshot.budgetReached ? ' (budget reached - raise with /fast budget <n>)' : '';
+    lines.push(`This session: ${snapshot.reviews}/${snapshot.reviewBudget} reviews${budget}, ` +
+        `${snapshot.delegated} delegated subagents, ` +
+        `in ${formatTokens(snapshot.usage.inputTokens)} / out ` +
+        `${formatTokens(snapshot.usage.outputTokens)}, cost ${cost}.`);
+    return lines.join('\n');
+}
 const COMMANDS = [
     {
         name: 'help',
@@ -223,6 +277,187 @@ const COMMANDS = [
             ctx.notify('warn', `Unknown argument "${verb}" - use /team [status|on|off|max <n>].`);
         },
     },
+    {
+        name: 'fast',
+        description: 'Fast model tier: status | on | off | model <id> | provider <id> | same | ' +
+            'review <n|off> | budget <n> | delegate on|off',
+        /**
+         * `/fast on` CANNOT turn the tier on in a session that started without it,
+         * for the reason `/team on` above records at length: the tool array is built
+         * ONCE and rebuilding it is forbidden (C-2), so a session that grew a schema
+         * field mid-flight would be a session whose request payloads change shape
+         * between turns.
+         *
+         * EVERY MUTATING BRANCH DOES THE TWO CALLS PLUS PERSIST that `/todo`
+         * documents: `controller.setFastConfig(patch)` updates the object `App`
+         * reads at render time AND re-resolves the tier AND rebuilds the prompt;
+         * `ctx.persistConfig({ fast: patch })` survives the session. Persist alone
+         * reports success and changes nothing until relaunch; the setter alone
+         * forgets by morning.
+         */
+        run: (ctx) => {
+            const arg = ctx.args.trim();
+            const [rawVerb, value] = arg.split(/\s+/, 2);
+            const verb = (rawVerb ?? '').toLowerCase();
+            const controller = ctx.controller;
+            // Refused mid-dispatch for the reason `/team` records: half a dispatch
+            // under one tier and half under another produces a report nothing can
+            // afterwards explain. THAT ARGUMENT IS ABOUT WRITES, so the two READS are
+            // grouped and answerable (RV-H3): `/fast status` always was, and a bare
+            // `/fast budget` reports the same numbers by another name. `/fast budget
+            // 80` is a write and is still refused.
+            const isRead = verb === 'status' || (verb === 'budget' && !value);
+            if (verb && !isRead && controller.isTeamBusy()) {
+                ctx.notify('warn', 'Cannot change fast-tier settings mid-dispatch.');
+                return;
+            }
+            const persist = (patch) => {
+                controller.setFastConfig(patch);
+                ctx.persistConfig({ fast: patch });
+            };
+            if (!verb || verb === 'status') {
+                ctx.notify('info', formatFastStatus(controller));
+                return;
+            }
+            if (verb === 'on' || verb === 'off') {
+                const enabled = verb === 'on';
+                persist({ enabled });
+                if (!controller.isFastRegistered()) {
+                    // The honest branch, and the whole point of splitting by what was
+                    // decided at construction (§3.3). It is one sentence, and it keeps
+                    // AC-2 / AC-3 intact: a session launched without the tier never grows
+                    // a schema field, whatever the user types afterwards.
+                    ctx.notify('info', enabled
+                        ? 'The fast tier is off for this session (not configured at launch). ' +
+                            'Saved for next launch.'
+                        : 'The fast tier is already off for this session. Saved for next launch.');
+                    return;
+                }
+                controller.setFastEnabled(enabled);
+                ctx.toast('success', `Fast tier ${enabled ? 'on' : 'off'}.`);
+                return;
+            }
+            if (verb === 'model') {
+                const raw = (value ?? '').trim();
+                if (!raw) {
+                    ctx.notify('warn', 'Usage: /fast model <id>  (or provider:model)');
+                    return;
+                }
+                // `provider:model` is accepted because that is how a user thinks about a
+                // tier on another vendor, and an unknown provider is rejected with THE
+                // MESSAGE `cli.tsx` ALREADY PRINTS rather than a second wording for the
+                // same fact (RV-16).
+                const colon = raw.indexOf(':');
+                if (colon > 0) {
+                    const provider = raw.slice(0, colon);
+                    const model = raw.slice(colon + 1);
+                    if (!isAdapterProvider(provider)) {
+                        ctx.notify('warn', `Unknown provider "${provider}". Choose: ${ADAPTER_PROVIDERS.join(', ')}.`);
+                        return;
+                    }
+                    persist({ provider, model });
+                    ctx.toast('success', `Fast model set to ${provider}:${model}.`);
+                    return;
+                }
+                persist({ model: raw });
+                ctx.toast('success', `Fast model set to ${raw}.`);
+                return;
+            }
+            if (verb === 'provider') {
+                const raw = (value ?? '').trim();
+                if (!raw) {
+                    ctx.notify('warn', 'Usage: /fast provider <id>');
+                    return;
+                }
+                if (!isAdapterProvider(raw)) {
+                    ctx.notify('warn', `Unknown provider "${raw}". Choose: ${ADAPTER_PROVIDERS.join(', ')}.`);
+                    return;
+                }
+                persist({ provider: raw });
+                ctx.toast('success', `Fast provider set to ${raw}.`);
+                return;
+            }
+            if (verb === 'same') {
+                // R-e IN ONE WORD. `sameAsMain` is display-only and no branch reads it
+                // (R-13): the user is allowed to run both tiers on one model, and the
+                // review still costs what it costs.
+                const cfg = controller.getConfig();
+                persist({
+                    provider: cfg.provider,
+                    model: cfg.model,
+                    baseUrl: cfg.baseUrl ?? '',
+                });
+                ctx.toast('success', `Fast tier set to ${cfg.provider}:${cfg.model} (same as main).`);
+                return;
+            }
+            if (verb === 'review') {
+                const raw = (value ?? '').trim().toLowerCase();
+                if (raw === 'off') {
+                    persist({ review: false });
+                    ctx.toast('success', 'Fast review off.');
+                    return;
+                }
+                const n = Number.parseInt(raw, 10);
+                if (!Number.isFinite(n) || n <= 0) {
+                    ctx.notify('warn', 'Usage: /fast review <n> | off');
+                    return;
+                }
+                // Clamped by `setFastConfig` and again on the persist path, so a value
+                // outside the range can reach neither the runtime nor the file.
+                const applied = controller.setFastConfig({ review: true, reviewEveryTurns: n });
+                ctx.persistConfig({
+                    fast: { review: true, reviewEveryTurns: applied.reviewEveryTurns },
+                });
+                ctx.toast('success', `Fast review every ${applied.reviewEveryTurns} turns.`);
+                return;
+            }
+            if (verb === 'budget') {
+                const snapshot = controller.getFastStatus().snapshot;
+                const raw = (value ?? '').trim();
+                if (!raw) {
+                    // The READ. Answerable mid-dispatch (see the guard above), and it
+                    // reports the same pair `/fast status` renders as `n/N`.
+                    ctx.notify('info', `Fast review budget: ${snapshot.reviews} of ${snapshot.reviewBudget} used ` +
+                        'this session. Use /fast budget <1-500> to raise it.');
+                    return;
+                }
+                const n = Number.parseInt(raw, 10);
+                if (!Number.isFinite(n) || n <= 0) {
+                    // Change NOTHING on a typo, the discipline `/max-tokens` sets: a
+                    // silent resolve to the default discards the number the user meant.
+                    ctx.notify('warn', 'Usage: /fast budget <1-500>');
+                    return;
+                }
+                // BOTH CALLS, IN THIS ORDER (RV-H4 / AC-H17). `setFastConfig` is what
+                // makes a raised budget take effect LIVE - the reviewer's `budgetLimit()`
+                // reads the controller's in-memory config, never disk - and it also
+                // re-emits `tier_changed`, which is how the new denominator reaches the
+                // status chip without a restart. See the comment on this command: a
+                // persist alone reports success and changes nothing until relaunch.
+                const applied = controller.setFastConfig({ reviewMaxPerSession: n });
+                ctx.persistConfig({
+                    fast: { reviewMaxPerSession: applied.reviewMaxPerSession },
+                });
+                // The APPLIED value, not the requested one, so a clamp is visible.
+                ctx.toast('success', `Fast review budget: ${applied.reviewMaxPerSession} per session. ` +
+                    `${snapshot.reviews} used.`);
+                return;
+            }
+            if (verb === 'delegate') {
+                const raw = (value ?? '').trim().toLowerCase();
+                if (raw !== 'on' && raw !== 'off') {
+                    ctx.notify('warn', 'Usage: /fast delegate <on|off>');
+                    return;
+                }
+                persist({ delegate: raw === 'on' });
+                ctx.toast('success', `Fast delegation ${raw}.`);
+                return;
+            }
+            ctx.notify('warn', `Unknown argument "${verb}" - use /fast ` +
+                '[status|on|off|model <id>|provider <id>|same|review <n|off>|budget <n>|' +
+                'delegate on|off].');
+        },
+    },
     {
         name: 'todo',
         description: 'Todo planning: status | on | off | panel on|off | follow <mode> | clear | continue',
@@ -377,6 +612,77 @@ const COMMANDS = [
                 '/todo [status|on|off|panel on|off|follow <mode>|clear|continue].');
         },
     },
+    {
+        name: 'retry',
+        description: 'API retry: show | on | off | max <n>',
+        /**
+         * TWO CALLS FOR EVERY MUTATION, IN THIS ORDER, and neither is optional
+         * (llm-api-retry-backoff §6.9 / §6.3):
+         *
+         *   `setRetryConfig`  replaces the policy on the live `ProviderRegistry`, so
+         *                     the change takes effect in THIS session — and, because
+         *                     `TeamRuntime` holds the same registry instance, for every
+         *                     child too. Without it `/retry off` reports success and
+         *                     changes nothing until the next launch.
+         *   `persistConfig`   is what survives the session.
+         *
+         * UNLIKE `/team on` AND `/todo on` there is no "off for this session" branch:
+         * retry is not a tool, nothing is registered at construction, and there is
+         * therefore no state a flag could have made unreachable. `--no-retry` is a
+         * starting value, not a permanent verdict.
+         */
+        run: (ctx) => {
+            const arg = ctx.args.trim().toLowerCase();
+            const [verb, value] = arg.split(/\s+/, 2);
+            const controller = ctx.controller;
+            if (!verb || verb === 'show' || verb === 'status') {
+                const cfg = controller.getRetryConfig();
+                if (!cfg.enabled || cfg.maxRetries <= 0) {
+                    ctx.notify('info', `API retry: off (maxRetries ${cfg.maxRetries}). Use /retry on or /retry max <n>.`);
+                    return;
+                }
+                ctx.notify('info', `API retry: on. Up to ${cfg.maxRetries} retries, ${cfg.initialDelayMs}ms doubling to ` +
+                    `${cfg.maxDelayMs}ms${cfg.jitter ? ' with jitter' : ''}, ` +
+                    `giving up after ${Math.round(cfg.maxElapsedMs / 1000)}s. ` +
+                    `Retry-After ${cfg.respectRetryAfter ? 'honoured' : 'ignored'}.`);
+                return;
+            }
+            if (verb === 'on' || verb === 'off') {
+                const enabled = verb === 'on';
+                const applied = controller.setRetryConfig({ enabled });
+                // A PARTIAL `retry` section, safe only because `updatePersistedConfig`
+                // deep-merges it — the same contract `/team on` relies on.
+                ctx.persistConfig({ retry: { enabled } });
+                if (enabled && applied.maxRetries <= 0) {
+                    // Honest rather than cheerful: `enabled` is on but the count is the
+                    // kill switch, so nothing will actually retry.
+                    ctx.notify('warn', 'API retry enabled, but maxRetries is 0 - use /retry max <n>.');
+                    return;
+                }
+                ctx.toast('success', `API retry ${enabled ? 'on' : 'off'}.`);
+                return;
+            }
+            if (verb === 'max') {
+                // `Number.isFinite` and `>= 0`, NOT `> 0`: `0` is this key's documented
+                // floor and its kill switch, and rejecting it here would make `/retry max 0`
+                // the one documented control that does not work (R-16).
+                const n = Number.parseInt(value ?? '', 10);
+                if (!Number.isFinite(n) || n < 0) {
+                    ctx.notify('warn', `Usage: /retry max <0-${HARD_MAX_RETRIES}>  (0 turns retry off)`);
+                    return;
+                }
+                const applied = controller.setRetryConfig({ maxRetries: n });
+                ctx.persistConfig({
+                    retry: { maxRetries: applied.maxRetries },
+                });
+                ctx.toast('success', applied.maxRetries === 0
+                    ? 'API retry off (maxRetries 0).'
+                    : `API retry: up to ${applied.maxRetries} retries.`);
+                return;
+            }
+            ctx.notify('warn', `Unknown argument "${verb}" - use /retry [show|on|off|max <n>].`);
+        },
+    },
     {
         name: 'expand',
         description: 'Expand / collapse a recent tool card (default: last)',

package/dist/config/cli-commands.d.ts

@@ -1,6 +1,6 @@
 /**
- * `aragon config get | list | edit | home`, plus the `log.*` and `team.*`
- * branches of `config set`.
+ * `aragon config get | list | edit | home`, plus the `log.*`, `team.*`,
+ * `retry.*` and `fast.*` branches of `config set`.
  *
  * These live here rather than in `cli.tsx` because `runConfigSet` is already a
  * 21-case switch — well past the complexity ceiling this package writes down —
@@ -21,6 +21,28 @@ export declare const LOG_CONFIG_SET_KEYS: readonly ["log.level", "log.toFile", "
  * `Set team.enabled = false`.
  */
 export declare const TEAM_CONFIG_SET_KEYS: readonly ["team.enabled", "team.maxSubagents", "team.maxConcurrent", "team.subagentTimeoutMs", "team.dispatchTimeoutMs", "team.maxTurnsPerSubagent"];
+/**
+ * Config keys under `retry.` that `aragon config set` accepts
+ * (llm-api-retry-backoff §8.2).
+ *
+ * Handled here rather than in `cli.tsx`'s switch for the reason this module's
+ * header gives about `log.*` and `team.*`: that switch is past this package's
+ * complexity ceiling, and a key added to the membership set but forgotten in the
+ * switch falls through every case, writes nothing, and still prints
+ * `Set retry.maxRetries = 0`.
+ */
+export declare const RETRY_CONFIG_SET_KEYS: readonly ["retry.enabled", "retry.maxRetries", "retry.initialDelayMs", "retry.maxDelayMs", "retry.multiplier", "retry.jitter", "retry.respectRetryAfter", "retry.maxElapsedMs", "retry.onPartialStream"];
+/**
+ * Config keys under `fast.` that `aragon config set` accepts (fast-model-tier
+ * §4.2).
+ *
+ * A DEDICATED SETTER RATHER THAN A GENERIC DOTTED WRITER, for the reason the
+ * three sets above each record: a generic setter would write `fast` as a FLAT
+ * string key (`"fast.model": "haiku"` at the top level of the file), the section
+ * would silently never take effect, and `config set` would still print
+ * `Set fast.model = haiku`.
+ */
+export declare const FAST_CONFIG_SET_KEYS: readonly ["fast.enabled", "fast.provider", "fast.model", "fast.baseUrl", "fast.thinkingLevel", "fast.delegate", "fast.review", "fast.reviewEveryTurns", "fast.reviewContextTurns", "fast.reviewMaxChars", "fast.reviewMaxPerSession"];
 /**
  * Translate a `log.*` dotted key into a patch, or `null` for anything else.
  *
@@ -43,6 +65,35 @@ export declare function applyLogConfigSet(key: string, value: string): Partial<P
  * won't stick". `clampTeamConfig` is the one gate both directions pass through.
  */
 export declare function applyTeamConfigSet(key: string, value: string): Partial<PersistedConfig> | null;
+/**
+ * Translate a `retry.*` dotted key into a patch, or `null` for anything else.
+ *
+ * The patch is a PARTIAL `retry` section, safe only because
+ * `updatePersistedConfig` deep-merges that section — with a shallow merge,
+ * setting the retry count would silently reset `respectRetryAfter` and `jitter`.
+ *
+ * `maxRetries` GOES THROUGH `clampRetryConfig`, NOT `coercePositiveInt`, and that
+ * is not a style choice (R-16): `coercePositiveInt` returns its fallback for
+ * `n <= 0`, so `config set retry.maxRetries 0` would write **10** — the maximum
+ * instead of the kill switch, silently. The whole section is routed through the
+ * one gate so no key here can pick up the wrong coercion later; the caller echoes
+ * the STORED value, which is what makes an out-of-range input visible.
+ */
+export declare function applyRetryConfigSet(key: string, value: string): Partial<PersistedConfig> | null;
+/**
+ * Translate a `fast.*` dotted key into a patch, or `null` for anything else.
+ *
+ * The patch is a PARTIAL `fast` section, safe only because
+ * `updatePersistedConfig` deep-merges that section — with a shallow merge,
+ * setting the cadence would silently switch the whole tier off (R-10).
+ *
+ * EVERY NUMERIC AND ENUM KEY ROUTES THROUGH `clampFastConfig`, not through
+ * `coercePositiveInt` or a local parse, for the reason `applyRetryConfigSet`
+ * records: one gate for both directions means no key here can pick up a
+ * different coercion later, and `config set fast.reviewEveryTurns 400` writes
+ * the clamped 50 while the caller echoes the STORED value (AC-13).
+ */
+export declare function applyFastConfigSet(key: string, value: string): Partial<PersistedConfig> | null;
 /**
  * `log.redactSecrets false` is the one setting that lets credentials reach the
  * disk. It is command-line-only (there is no settings-screen entry) and it says

package/dist/config/cli-commands.js

@@ -1,6 +1,6 @@
 /**
- * `aragon config get | list | edit | home`, plus the `log.*` and `team.*`
- * branches of `config set`.
+ * `aragon config get | list | edit | home`, plus the `log.*`, `team.*`,
+ * `retry.*` and `fast.*` branches of `config set`.
  *
  * These live here rather than in `cli.tsx` because `runConfigSet` is already a
  * 21-case switch — well past the complexity ceiling this package writes down —
@@ -13,7 +13,7 @@ import process from 'node:process';
 import { getConfigBackupPath, getConfigPath, getHomeRoot, getLogsDir, getPromptHistoryPath, getUiStatePath, isHomeOverridden, } from './app-paths.js';
 import { getHomeMigrationBreadcrumbPath } from './migrate-home.js';
 import { loadPersistedConfig, updatePersistedConfig } from './store.js';
-import { coercePositiveInt, maskSecret, DEFAULT_TEAM_CONFIG, } from './schema.js';
+import { clampFastConfig, clampRetryConfig, coercePositiveInt, maskSecret, DEFAULT_FAST_CONFIG, DEFAULT_RETRY_CONFIG, DEFAULT_TEAM_CONFIG, } from './schema.js';
 import { clampLogLevel } from '../logging/levels.js';
 /** Config keys under `log.` that `aragon config set` accepts. */
 export const LOG_CONFIG_SET_KEYS = [
@@ -43,6 +43,50 @@ export const TEAM_CONFIG_SET_KEYS = [
     'team.dispatchTimeoutMs',
     'team.maxTurnsPerSubagent',
 ];
+/**
+ * Config keys under `retry.` that `aragon config set` accepts
+ * (llm-api-retry-backoff §8.2).
+ *
+ * Handled here rather than in `cli.tsx`'s switch for the reason this module's
+ * header gives about `log.*` and `team.*`: that switch is past this package's
+ * complexity ceiling, and a key added to the membership set but forgotten in the
+ * switch falls through every case, writes nothing, and still prints
+ * `Set retry.maxRetries = 0`.
+ */
+export const RETRY_CONFIG_SET_KEYS = [
+    'retry.enabled',
+    'retry.maxRetries',
+    'retry.initialDelayMs',
+    'retry.maxDelayMs',
+    'retry.multiplier',
+    'retry.jitter',
+    'retry.respectRetryAfter',
+    'retry.maxElapsedMs',
+    'retry.onPartialStream',
+];
+/**
+ * Config keys under `fast.` that `aragon config set` accepts (fast-model-tier
+ * §4.2).
+ *
+ * A DEDICATED SETTER RATHER THAN A GENERIC DOTTED WRITER, for the reason the
+ * three sets above each record: a generic setter would write `fast` as a FLAT
+ * string key (`"fast.model": "haiku"` at the top level of the file), the section
+ * would silently never take effect, and `config set` would still print
+ * `Set fast.model = haiku`.
+ */
+export const FAST_CONFIG_SET_KEYS = [
+    'fast.enabled',
+    'fast.provider',
+    'fast.model',
+    'fast.baseUrl',
+    'fast.thinkingLevel',
+    'fast.delegate',
+    'fast.review',
+    'fast.reviewEveryTurns',
+    'fast.reviewContextTurns',
+    'fast.reviewMaxChars',
+    'fast.reviewMaxPerSession',
+];
 function isTrue(value) {
     return value === 'true' || value === '1';
 }
@@ -112,6 +156,95 @@ export function applyTeamConfigSet(key, value) {
             return null;
     }
 }
+/**
+ * Translate a `retry.*` dotted key into a patch, or `null` for anything else.
+ *
+ * The patch is a PARTIAL `retry` section, safe only because
+ * `updatePersistedConfig` deep-merges that section — with a shallow merge,
+ * setting the retry count would silently reset `respectRetryAfter` and `jitter`.
+ *
+ * `maxRetries` GOES THROUGH `clampRetryConfig`, NOT `coercePositiveInt`, and that
+ * is not a style choice (R-16): `coercePositiveInt` returns its fallback for
+ * `n <= 0`, so `config set retry.maxRetries 0` would write **10** — the maximum
+ * instead of the kill switch, silently. The whole section is routed through the
+ * one gate so no key here can pick up the wrong coercion later; the caller echoes
+ * the STORED value, which is what makes an out-of-range input visible.
+ */
+export function applyRetryConfigSet(key, value) {
+    const patch = (retry) => ({ retry });
+    const clampOne = (field) => {
+        const merged = clampRetryConfig({ ...DEFAULT_RETRY_CONFIG, [field]: value });
+        return { [field]: merged[field] };
+    };
+    switch (key) {
+        case 'retry.enabled':
+            return patch({ enabled: isTrue(value) });
+        case 'retry.maxRetries':
+            return patch(clampOne('maxRetries'));
+        case 'retry.initialDelayMs':
+            return patch(clampOne('initialDelayMs'));
+        case 'retry.maxDelayMs':
+            return patch(clampOne('maxDelayMs'));
+        case 'retry.multiplier':
+            return patch(clampOne('multiplier'));
+        case 'retry.jitter':
+            return patch({ jitter: isTrue(value) });
+        case 'retry.respectRetryAfter':
+            return patch({ respectRetryAfter: isTrue(value) });
+        case 'retry.maxElapsedMs':
+            return patch(clampOne('maxElapsedMs'));
+        case 'retry.onPartialStream':
+            return patch({ onPartialStream: isTrue(value) });
+        default:
+            return null;
+    }
+}
+/**
+ * Translate a `fast.*` dotted key into a patch, or `null` for anything else.
+ *
+ * The patch is a PARTIAL `fast` section, safe only because
+ * `updatePersistedConfig` deep-merges that section — with a shallow merge,
+ * setting the cadence would silently switch the whole tier off (R-10).
+ *
+ * EVERY NUMERIC AND ENUM KEY ROUTES THROUGH `clampFastConfig`, not through
+ * `coercePositiveInt` or a local parse, for the reason `applyRetryConfigSet`
+ * records: one gate for both directions means no key here can pick up a
+ * different coercion later, and `config set fast.reviewEveryTurns 400` writes
+ * the clamped 50 while the caller echoes the STORED value (AC-13).
+ */
+export function applyFastConfigSet(key, value) {
+    const patch = (fast) => ({ fast });
+    const clampOne = (field) => {
+        const merged = clampFastConfig({ ...DEFAULT_FAST_CONFIG, [field]: value });
+        return { [field]: merged[field] };
+    };
+    switch (key) {
+        case 'fast.enabled':
+            return patch({ enabled: isTrue(value) });
+        case 'fast.provider':
+            return patch(clampOne('provider'));
+        case 'fast.model':
+            return patch(clampOne('model'));
+        case 'fast.baseUrl':
+            return patch(clampOne('baseUrl'));
+        case 'fast.thinkingLevel':
+            return patch(clampOne('thinkingLevel'));
+        case 'fast.delegate':
+            return patch({ delegate: isTrue(value) });
+        case 'fast.review':
+            return patch({ review: isTrue(value) });
+        case 'fast.reviewEveryTurns':
+            return patch(clampOne('reviewEveryTurns'));
+        case 'fast.reviewContextTurns':
+            return patch(clampOne('reviewContextTurns'));
+        case 'fast.reviewMaxChars':
+            return patch(clampOne('reviewMaxChars'));
+        case 'fast.reviewMaxPerSession':
+            return patch(clampOne('reviewMaxPerSession'));
+        default:
+            return null;
+    }
+}
 /**
  * `log.redactSecrets false` is the one setting that lets credentials reach the
  * disk. It is command-line-only (there is no settings-screen entry) and it says

package/dist/config/env.d.ts

@@ -5,11 +5,14 @@
  *   - Provider secrets: ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY /
  *     GEMINI_API_KEY.
  *   - Overrides: ARAGON_PROVIDER, ARAGON_MODEL, ARAGON_BASE_URL, ARAGON_THINKING,
+ *     ARAGON_SHOW_THINKING,
  *     ARAGON_MAX_TOKENS (a number, or `auto` / `0` for the per-model ceiling),
  *     ARAGON_THEME, ARAGON_MOUSE, ARAGON_PLAN, ARAGON_TEAM,
- *     ARAGON_TEAM_MAX, ARAGON_LOG_LEVEL, ARAGON_LOG_FILE, ARAGON_LOG_DIR,
- *     ARAGON_TRANSCRIPT_RETAIN, ARAGON_RENDER_GOVERNOR,
- *     ARAGON_MAX_RENDER_INTERVAL_MS.
+ *     ARAGON_TEAM_MAX, ARAGON_RETRY, ARAGON_RETRY_MAX, ARAGON_FAST,
+ *     ARAGON_FAST_PROVIDER, ARAGON_FAST_MODEL, ARAGON_FAST_BASE_URL,
+ *     ARAGON_LOG_LEVEL,
+ *     ARAGON_LOG_FILE, ARAGON_LOG_DIR, ARAGON_TRANSCRIPT_RETAIN,
+ *     ARAGON_RENDER_GOVERNOR, ARAGON_MAX_RENDER_INTERVAL_MS.
  *
  * NOT here: `ARAGON_HOME`. It is read when `config/app-paths.ts` is first
  * evaluated, which is long before `loadDotenv()` runs, so a `.env` can never