@aragon-agent/cli 0.6.12 → 0.6.14

package/dist/agent/model-profile-settings.js

@@ -0,0 +1,208 @@
+import { loadConfig } from '../config/load.js';
+import { DEFAULT_CONFIG } from '../config/schema.js';
+import { mergePersistedConfig } from '../config/store.js';
+import { adaptLegacyConnectionPatch, assertLegacyFastTarget, commitModelSettings, readModelSettingsDisk, } from '../config/model-profile-store.js';
+import { projectModelProfiles, resolveModelProfileState } from '../config/model-profile-resolution.js';
+import { validateModelProfiles } from '../config/model-profiles.js';
+import { registerProfileSecrets } from '../logging/secret-registry.js';
+/** Capture both baselines when the editor opens, without migrating or writing anything. */
+export function createModelSettingsDraft(live, liveRevision) {
+    const disk = readModelSettingsDisk();
+    return {
+        diskRevision: disk.revision, liveRevision,
+        baseline: structuredClone(disk.config ?? DEFAULT_CONFIG),
+        liveBaseline: structuredClone(live),
+        profiles: disk.config?.modelProfiles
+            ? structuredClone(disk.config.modelProfiles) : undefined,
+        activateRoles: [], patch: {},
+        ...(!disk.ok ? { readError: 'Cannot read config. Repair it with aragon config edit.' } : {}),
+    };
+}
+/** Map stable failure codes to safe UI text; never include parser or SDK error messages. */
+export function modelSettingsResultMessage(result) {
+    if (result.status === 'saved_apply_failed') {
+        return result.persisted
+            ? 'Saved, but this session could not apply all settings. Restart required.'
+            : 'Could not apply the reloaded settings completely. Restart required.';
+    }
+    if (result.status === 'restart_required') {
+        return 'Saved. Fast tier requires a restart; check its model and credentials.';
+    }
+    const messages = {
+        busy: 'Wait for the run, team, review, or compaction to finish before saving.',
+        conflict: 'Settings changed elsewhere. Reload before saving.',
+        read_failed: 'Cannot read config. Repair it with aragon config edit.',
+        write_failed: 'Could not write config. Your draft is preserved.',
+        invalid: 'Invalid model settings. Check the highlighted field or aragon config edit.',
+        profile_key_required: 'This profile has a dedicated key. Edit or copy it in /settings.',
+        legacy_conversion_unsupported: 'This endpoint needs a profile. Edit it in /settings.',
+    };
+    return result.ok ? 'Settings saved.' : messages[result.code ?? 'invalid'];
+}
+function rejected(code) {
+    return { ok: false, persisted: false, status: 'rejected', code };
+}
+function connectionChanged(draft, role) {
+    if (draft.profiles === undefined)
+        return false;
+    const before = draft.baseline.modelProfiles;
+    const after = draft.profiles;
+    if ((before?.[`${role}Id`] ?? null) !== (after?.[`${role}Id`] ?? null))
+        return true;
+    const id = after?.[`${role}Id`];
+    if (!id)
+        return false;
+    const a = before?.entries.find((entry) => entry.id === id);
+    const b = after?.entries.find((entry) => entry.id === id);
+    return ['provider', 'model', 'baseUrl', 'apiKey']
+        .some((key) => a?.[key] !== b?.[key]);
+}
+function hasConnectionPatch(patch, role) {
+    const section = role === 'main' ? patch : patch.fast;
+    return !!section && ['provider', 'model', 'baseUrl'].some((key) => key in section);
+}
+function liveCandidate(live, candidate, draft) {
+    const patch = draft.patch;
+    const normalizedPatch = {};
+    for (const key of Object.keys(patch)) {
+        normalizedPatch[key] = candidate[key];
+    }
+    const next = { ...live, ...normalizedPatch };
+    for (const section of ['apiKeys', 'fast', 'compaction', 'log']) {
+        const normalized = { ...live[section] };
+        for (const key of Object.keys(patch[section] ?? {})) {
+            normalized[key] = candidate[section][key];
+        }
+        Object.assign(next, { [section]: normalized });
+    }
+    if (patch.apiKeys && Object.hasOwn(patch.apiKeys, live.provider)) {
+        next.apiKeyOverride = undefined;
+        next.apiKeyOverrideTarget = undefined;
+    }
+    // These fields have intentionally different disk and runtime representations.
+    if ('maxTokens' in patch)
+        next.maxTokens = candidate.maxTokens ?? undefined;
+    if ('baseUrl' in patch)
+        next.baseUrl = candidate.baseUrl ?? undefined;
+    const projected = projectModelProfiles(candidate).file;
+    if (draft.profiles !== undefined || candidate.modelProfiles !== undefined) {
+        next.modelProfiles = structuredClone(projected.modelProfiles);
+    }
+    next.liveToolOutput = live.liveToolOutput;
+    for (const role of ['main', 'fast']) {
+        if (!draft.activateRoles.includes(role) && !connectionChanged(draft, role)
+            && !hasConnectionPatch(patch, role))
+            continue;
+        if (role === 'main') {
+            next.provider = projected.provider;
+            next.model = projected.model;
+            next.baseUrl = projected.baseUrl ?? undefined;
+            next.apiKeyOverride = undefined;
+            next.apiKeyOverrideTarget = undefined;
+        }
+        else {
+            next.fast = { ...next.fast, provider: projected.fast.provider,
+                model: projected.fast.model, baseUrl: projected.fast.baseUrl };
+        }
+    }
+    if (next.apiKeyOverride && !next.apiKeyOverrideTarget
+        && (next.modelProfiles?.mainId || next.modelProfiles?.fastId)) {
+        next.apiKeyOverrideTarget = { provider: live.provider, baseUrl: live.baseUrl ?? null };
+    }
+    next.modelProfileState = resolveModelProfileState(next);
+    return next;
+}
+/** Validate and prepare everything before the one synchronous, atomic disk commit. */
+export function saveModelSettings(input) {
+    const { draft, controller } = input;
+    if (controller.isModelSettingsBusy())
+        return rejected('busy');
+    if (draft.liveRevision !== controller.getSettingsRevision())
+        return rejected('conflict');
+    const disk = readModelSettingsDisk();
+    if (!disk.ok || draft.readError)
+        return rejected('read_failed');
+    if (disk.revision !== draft.diskRevision)
+        return rejected('conflict');
+    const issues = validateModelProfiles(draft.profiles ?? disk.config?.modelProfiles);
+    if (issues.length)
+        return { ...rejected('invalid'), issues };
+    let snapshot;
+    let candidate;
+    try {
+        const current = disk.config ?? structuredClone(DEFAULT_CONFIG);
+        const profilesChanged = draft.activateRoles.length > 0
+            || JSON.stringify(draft.profiles) !== JSON.stringify(draft.baseline.modelProfiles);
+        const implicitLegacy = draft.profiles === undefined || !profilesChanged;
+        const patch = adaptLegacyConnectionPatch({ current, patch: implicitLegacy
+                ? draft.patch : { ...draft.patch, modelProfiles: draft.profiles } });
+        candidate = mergePersistedConfig(current, patch);
+        registerProfileSecrets(candidate);
+        const next = liveCandidate(controller.getConfig(), candidate, draft);
+        // Disk preferences cannot reveal startup/session gateways retained by the live main role.
+        if (implicitLegacy && current.modelProfiles?.fastId && hasConnectionPatch(draft.patch, 'fast')) {
+            assertLegacyFastTarget(next.fast, next);
+        }
+        snapshot = controller.prepareModelSettingsSnapshot(next);
+    }
+    catch (error) {
+        const code = error.code ?? 'invalid';
+        return rejected(code);
+    }
+    const commit = commitModelSettings({ candidate, diskRevision: draft.diskRevision });
+    if (!commit.ok)
+        return rejected(commit.code ?? 'write_failed');
+    return applyPreparedSnapshot(controller, snapshot, true);
+}
+function applyPreparedSnapshot(controller, snapshot, persisted) {
+    try {
+        controller.applyModelSettingsSnapshot(snapshot);
+    }
+    catch {
+        controller.blockModelSettingsRequests();
+        return { ok: false, persisted, status: 'saved_apply_failed', code: 'apply_failed', restartRequired: true };
+    }
+    try {
+        controller.applyModelSettingsEffects();
+    }
+    catch {
+        return { ok: false, persisted, status: 'saved_apply_failed', code: 'apply_failed', restartRequired: true };
+    }
+    const restartRequired = snapshot.config.fast.enabled && !controller.isFastRegistered();
+    return { ok: true, persisted, status: restartRequired ? 'restart_required' : 'applied',
+        restartRequired };
+}
+/** Reload the complete model snapshot; invalid disk content never replaces a live session. */
+export function reloadModelSettings(controller) {
+    if (controller.isModelSettingsBusy())
+        return rejected('busy');
+    const disk = readModelSettingsDisk();
+    if (!disk.ok)
+        return rejected('read_failed');
+    if (validateModelProfiles(disk.config?.modelProfiles).length)
+        return rejected('invalid');
+    try {
+        const live = controller.getConfig();
+        const resolved = loadConfig({ cwd: live.cwd });
+        resolved.liveToolOutput = live.liveToolOutput;
+        // The mounted renderer owns these session preferences. Reloading model
+        // settings must not re-detect the shell or discard a startup --no-color.
+        resolved.color = live.color;
+        if (live.colorLevel !== undefined)
+            resolved.colorLevel = live.colorLevel;
+        if (live.unicode !== undefined)
+            resolved.unicode = live.unicode;
+        resolved.reducedMotion ||= !live.color;
+        const after = readModelSettingsDisk();
+        if (!after.ok)
+            return rejected('read_failed');
+        if (after.revision !== disk.revision)
+            return rejected('conflict');
+        if (resolved.modelProfileState?.main.invalid)
+            return rejected('invalid');
+        return applyPreparedSnapshot(controller, controller.prepareModelSettingsSnapshot(resolved), false);
+    }
+    catch {
+        return rejected('invalid');
+    }
+}

package/dist/agent/queued-messages.d.ts

@@ -4,5 +4,17 @@ export interface PendingSteering {
     readonly queueId: string;
     readonly text: string;
 }
+/** Hide only active pending entries, using the same projection for measurement and paint. */
+export declare function selectTranscriptEntries(entries: Entry[], pending: readonly PendingSteering[]): Entry[];
+/** Restore trimmed messages in FIFO order before atomically accepting known receipts. */
+export declare function reconcileSteeringReceipt(options: {
+    entries: Entry[];
+    pending: readonly PendingSteering[];
+    ids: readonly string[];
+}): {
+    entries: Entry[];
+    pending: PendingSteering[];
+    changed: boolean;
+};
 /** Supplement trimmed/cleared history for save and exit without deduplicating text. */
 export declare function mergePendingEntries(entries: Entry[], pending: readonly PendingSteering[]): Entry[];

package/dist/agent/queued-messages.js

@@ -1,3 +1,21 @@
+/** Hide only active pending entries, using the same projection for measurement and paint. */
+export function selectTranscriptEntries(entries, pending) {
+    if (pending.length === 0)
+        return entries;
+    const ids = new Set(pending.map((item) => item.queueId));
+    return entries.filter((entry) => entry.kind !== 'queued' || !ids.has(entry.queueId ?? ''));
+}
+/** Restore trimmed messages in FIFO order before atomically accepting known receipts. */
+export function reconcileSteeringReceipt(options) {
+    const receipts = new Set(options.ids);
+    const ids = new Set(options.pending.filter((item) => receipts.has(item.queueId))
+        .map((item) => item.queueId));
+    if (!ids.size)
+        return { entries: options.entries, pending: [...options.pending], changed: false };
+    const entries = mergePendingEntries(options.entries, options.pending).map((entry) => entry.kind === 'queued' && ids.has(entry.queueId ?? '')
+        ? { id: entry.id, kind: 'user', text: entry.text } : entry);
+    return { entries, pending: options.pending.filter((item) => !ids.has(item.queueId)), changed: true };
+}
 /** Supplement trimmed/cleared history for save and exit without deduplicating text. */
 export function mergePendingEntries(entries, pending) {
     if (pending.length === 0)

package/dist/agent/reducer.d.ts

@@ -22,7 +22,7 @@ import type { RetryPhase } from './retry-view.js';
 import type { FilePatch } from '../tools/patch.js';
 export type NoticeLevel = 'info' | 'warn' | 'error';
 export type ToastLevel = NoticeLevel | 'success';
-export type Overlay = null | 'settings' | 'model' | 'help' | 'confirm' | 'question' | 'plan';
+export type Overlay = null | 'settings' | 'model' | 'help' | 'queue' | 'confirm' | 'question' | 'plan';
 export type ToolStatus = 'pending' | 'running' | 'done' | 'error';
 /** Ephemeral, auto-dismissed acknowledgement (spec §3.9). */
 export interface Toast {
@@ -278,6 +278,13 @@ export interface RetrySnapshot {
 export interface ViewState {
     entries: Entry[];
     pendingSteering: PendingSteering[];
+    seenSteeringIds: ReadonlySet<string>;
+    runPhase: 'idle' | 'starting' | 'waiting' | 'thinking' | 'generating' | 'preparing-tool' | 'tool';
+    activeTool?: {
+        toolCallId: string;
+        name: string;
+    };
+    runOutcome: 'none' | 'ended' | 'interrupted' | 'failed';
     status: 'idle' | 'running';
     usageTotal: UsageTotal;
     /**
@@ -412,6 +419,10 @@ export type ViewAction = {
     ids: readonly string[];
 } | {
     type: 'runStart';
+} | {
+    type: 'runStarting';
+} | {
+    type: 'runError';
 } | {
     type: 'turnStart';
 } | {
@@ -438,6 +449,7 @@ export type ViewAction = {
 } | {
     type: 'toolExecStart';
     toolCallId: string;
+    toolName?: string;
 } | {
     type: 'toolExecEnd';
     toolCallId: string;

package/dist/agent/reducer.js

@@ -11,6 +11,7 @@
  *     synthesizes a generic error notice (a swallowed throw is never a no-op).
  */
 import process from 'node:process';
+import { reconcileSteeringReceipt } from './queued-messages.js';
 import { emptyContextUsage } from '../compaction/meter.js';
 import { addUsage, computeCost } from './usage.js';
 import { ENTRY_LIMITS, appendBounded, entryRetain, trimEntries } from './entry-limits.js';
@@ -47,6 +48,9 @@ export function initialViewState(seed = {}) {
     return {
         entries: [],
         pendingSteering: [],
+        seenSteeringIds: new Set(),
+        runPhase: 'idle',
+        runOutcome: 'none',
         status: 'idle',
         usageTotal: EMPTY_USAGE_TOTAL,
         context: emptyContextUsage(),
@@ -145,7 +149,7 @@ export function reduceEvent(event, cost, patches) {
         case 'agent_end':
             return [{ type: 'runEnd' }];
         case 'tool_execution_start':
-            return [{ type: 'toolExecStart', toolCallId: event.toolCallId }];
+            return [{ type: 'toolExecStart', toolCallId: event.toolCallId, toolName: event.toolName }];
         case 'tool_execution_end': {
             const patch = patches?.take(event.toolCallId);
             const preview = buildToolPreview(event.result);
@@ -200,8 +204,6 @@ function reduceStreamEvent(se) {
         case 'text_delta':
             return [{ type: 'textDelta', delta: se.delta }];
         case 'tool_call_start':
-            if (SELF_RENDERING_TOOLS.has(se.toolName))
-                return [];
             return [
                 { type: 'toolCallStart', toolCallId: se.toolCallId, toolName: se.toolName },
             ];
@@ -213,6 +215,7 @@ function reduceStreamEvent(se) {
             return [{ type: 'toolCallEnd', toolCallId: se.toolCallId, args: se.args }];
         case 'error':
             return [
+                { type: 'runError' },
                 {
                     type: 'notice',
                     level: 'error',
@@ -405,7 +408,40 @@ function findToolEntryId(state, toolCallId) {
     }
     return undefined;
 }
+/** Runtime facts outlive transcript cards and are independent of command/clipboard notices. */
+function reduceRunFacts(state, action) {
+    switch (action.type) {
+        case 'runStarting': return { ...state, runPhase: 'starting', runOutcome: 'none' };
+        case 'runStart': return { ...state, runPhase: 'waiting', runOutcome: 'none', activeTool: undefined };
+        case 'turnStart': return { ...state, runPhase: 'waiting' };
+        case 'thinkingStart':
+        case 'thinkingDelta': return { ...state, runPhase: 'thinking' };
+        case 'textDelta': return { ...state, runPhase: 'generating' };
+        case 'toolCallStart':
+        case 'toolCallDelta':
+        case 'toolCallEnd': return { ...state, runPhase: 'preparing-tool' };
+        case 'toolExecStart': {
+            const card = state.entries.find((entry) => entry.kind === 'tool' && entry.toolCallId === action.toolCallId);
+            return { ...state, runPhase: 'tool', activeTool: {
+                    toolCallId: action.toolCallId,
+                    name: action.toolName ?? (card?.kind === 'tool' ? card.name : 'tool'),
+                } };
+        }
+        case 'toolExecEnd': return state.activeTool?.toolCallId === action.toolCallId
+            ? { ...state, runPhase: 'waiting', activeTool: undefined } : state;
+        case 'runError': return { ...state, runOutcome: 'failed' };
+        case 'abortMark': return { ...state, runOutcome: 'interrupted' };
+        case 'runEnd': return { ...state, runPhase: 'idle', activeTool: undefined,
+            runOutcome: state.runOutcome !== 'none' ? state.runOutcome
+                : !state.turnProduced && !state.errorNoticed && !state.aborted ? 'failed' : 'ended' };
+        case 'resetConversation':
+        case 'restoreEntries': return { ...state, runPhase: 'idle', activeTool: undefined,
+            runOutcome: 'none', seenSteeringIds: new Set() };
+        default: return state;
+    }
+}
 export function viewReducer(state, action) {
+    state = reduceRunFacts(state, action);
     switch (action.type) {
         case 'submit': {
             const { id, seq } = nextId(state);
@@ -429,6 +465,8 @@ export function viewReducer(state, action) {
             };
         }
         case 'steerQueued': {
+            if (state.seenSteeringIds.has(action.queueId))
+                return state;
             const { id, seq } = nextId(state);
             const entry = { id, kind: 'queued', queueId: action.queueId, text: action.text };
             // NOTHING ELSE RESETS. This is not a new turn -- `turnProduced`,
@@ -437,20 +475,19 @@ export function viewReducer(state, action) {
             // guard misfire on a turn that produced plenty.
             return {
                 ...state, seq, ...appendEntry(state, state.entries, entry),
+                seenSteeringIds: new Set([...state.seenSteeringIds, action.queueId]),
                 pendingSteering: [...state.pendingSteering, { queueId: action.queueId, text: action.text }],
             };
         }
         case 'steeringAccepted': {
-            const receipts = new Set(action.ids);
-            const ids = new Set(state.pendingSteering
-                .filter((item) => receipts.has(item.queueId)).map((item) => item.queueId));
-            if (ids.size === 0)
+            const receipt = reconcileSteeringReceipt({
+                entries: state.entries, pending: state.pendingSteering, ids: action.ids,
+            });
+            if (!receipt.changed)
                 return state;
-            const pendingSteering = state.pendingSteering.filter((item) => !ids.has(item.queueId));
-            const entries = state.entries.map((entry) => entry.kind === 'queued' && entry.queueId !== undefined && ids.has(entry.queueId)
-                ? { id: entry.id, kind: 'user', text: entry.text }
-                : entry);
-            return { ...state, pendingSteering, entries };
+            const trimmed = trimEntries(receipt.entries, entryRetain());
+            return { ...state, pendingSteering: receipt.pending, entries: trimmed.entries,
+                droppedEntries: state.droppedEntries + trimmed.dropped };
         }
         case 'runStart':
             return {
@@ -517,6 +554,8 @@ export function viewReducer(state, action) {
             };
         }
         case 'toolCallStart': {
+            if (SELF_RENDERING_TOOLS.has(action.toolName))
+                return state;
             const { id, seq } = nextId(state);
             const entry = {
                 id,
@@ -1151,6 +1190,7 @@ export function viewReducer(state, action) {
                 prev.source === next.source &&
                 prev.deltaTokens === next.deltaTokens &&
                 prev.windowKnown === next.windowKnown &&
+                prev.windowSource === next.windowSource &&
                 prev.windowOverridden === next.windowOverridden) {
                 return state;
             }

package/dist/boot/guard.d.ts

@@ -109,9 +109,9 @@ export declare function runBootGuard(deps?: BootGuardDeps): void;
  *
  * Called from two places, and both matter:
  *
- *  - `cli.tsx::runInteractive`, immediately after `render()` returns - the
- *    earliest moment at which "this build starts" is PROVEN: the module graph
- *    loaded, config resolved, Ink mounted. This is the primary, and it is what
+ *  - `cli.tsx::runInteractive`, after mount-time exit promises settle, while
+ *    the app is still live (or has exited successfully): the module graph
+ *    loaded, config resolved, Ink mounted successfully. This primary path
  *    makes a long session that is later `SIGKILL`ed (terminal window closed,
  *    machine slept badly, OOM killer) still count as healthy.
  *  - the exit hook installed by `runBootGuard`, when the code is `0` - the

package/dist/boot/guard.js

@@ -178,9 +178,9 @@ export function runBootGuard(deps = {}) {
  *
  * Called from two places, and both matter:
  *
- *  - `cli.tsx::runInteractive`, immediately after `render()` returns - the
- *    earliest moment at which "this build starts" is PROVEN: the module graph
- *    loaded, config resolved, Ink mounted. This is the primary, and it is what
+ *  - `cli.tsx::runInteractive`, after mount-time exit promises settle, while
+ *    the app is still live (or has exited successfully): the module graph
+ *    loaded, config resolved, Ink mounted successfully. This primary path
  *    makes a long session that is later `SIGKILL`ed (terminal window closed,
  *    machine slept badly, OOM killer) still count as healthy.
  *  - the exit hook installed by `runBootGuard`, when the code is `0` - the

package/dist/cli.js

@@ -16,8 +16,9 @@ import { fileURLToPath } from 'node:url';
 import process from 'node:process';
 import '../runtime/insecure-tls-warning.cjs';
 // Must precede every other dependency that imports Ink: CI detection is cached.
-import { render } from './ui/ink-runtime.js';
+import { renderTui as render } from './ui/ink-runtime.js';
 import { Command } from 'commander';
+import { ModelProfileConfigError } from './config/model-profile-store.js';
 import { loadConfig } from './config/load.js';
 import { getConfigPath, readConfigFile, updatePersistedConfig } from './config/store.js';
 import { formatMigrationNotice, migrateLegacyState } from './config/migrate-legacy-state.js';
@@ -53,7 +54,7 @@ import { supportsWindowsVtInput } from './ui/win-vt-input.js';
 import { forceWindowsVtInput } from './ui/win-vt-force.js';
 import { readExitSnapshot } from './ui/exit-snapshot.js';
 import { renderTranscriptText } from './ui/transcript-text.js';
-import { detectCapabilities } from './ui/capabilities.js';
+import { resolveTuiCapabilities } from './ui/capabilities.js';
 import { pickGlyphs } from './ui/glyphs.js';
 import { getTheme } from './ui/theme.js';
 import { createSelectionController, } from './ui/selection/selection-controller.js';
@@ -223,7 +224,7 @@ function toFlags(opts) {
  * instead of writing to disk unattended.
  */
 function makeController(flags, opts = { interactive: true }) {
-    const config = loadConfig(flags);
+    const config = loadConfig(flags, { interactive: opts.interactive });
     // The authoritative log level lands here (§4.4.5). `installLogging()` only
     // resolved a bootstrap level — it ran before commander and before `.env` were
     // readable — and without this hand-off the fully resolved one never applies.
@@ -282,6 +283,7 @@ function makeController(flags, opts = { interactive: true }) {
  */
 function makeExecController(flags, deps) {
     const { controller } = makeController(flags, { interactive: false, ...deps });
+    void controller.refreshModelMetadata();
     const logger = getLogger();
     logger.info('cli', 'run_exec', {});
     logger.onFailure((reason) => process.stderr.write(`[log] ${reason}\n`));
@@ -387,9 +389,14 @@ function runInteractive(flags, extras = {}) {
         return;
     }
     const { controller, confirmBridge, humanInputBridge } = makeController(flags);
+    void controller.refreshModelMetadata();
     const config = controller.getConfig();
+    const caps = resolveTuiCapabilities({}, config.color);
     const logger = getLogger();
-    logger.info('cli', 'run_interactive', { mode: 'fullscreen', provider: config.provider, model: config.model });
+    logger.info('cli', 'run_interactive', {
+        mode: 'fullscreen', provider: config.provider, model: config.model,
+        unicode: caps.unicode, colorLevel: caps.colorLevel,
+    });
     attachAgentEvents(logger, controller);
     // The team stream is CLI-local (D-10), so `attachAgentEvents` cannot see it.
     // Without this a dispatch leaves NO trace in the log file at all — the wrong
@@ -458,7 +465,7 @@ function runInteractive(flags, extras = {}) {
     // advising the user about a mode they just disabled.
     const wantPaste = config.paste && !!process.stdin.isTTY;
     const pasteBridge = { notify: null };
-    const filter = wantMouse || wantPaste
+    const filter = process.stdin.isTTY
         ? tryCreateStdinFilter(process.stdin, { mouse: wantMouse, paste: wantPaste }, (reason) => logger.warn('cli', 'stdin_filter_failed', { reason }), pasteBridge)
         : null;
     /**
@@ -547,7 +554,7 @@ function runInteractive(flags, extras = {}) {
             return; // Never published (instant exit) — skip, do not throw.
         writeExitTranscript(process.stdout, renderTranscriptText(snapshot.entries, {
             // Same terminal the TUI just left, so the same glyph tier applies.
-            glyphs: pickGlyphs(detectCapabilities(process.env, process.stdout)),
+            glyphs: pickGlyphs(caps),
             usageTotal: snapshot.usageTotal,
             provider: snapshot.provider,
             model: snapshot.model,
@@ -634,8 +641,8 @@ function runInteractive(flags, extras = {}) {
             // the SAME `copyText` door and the SAME bridge `onCopied` toast
             // funnel -- the controller keeps only the selection state machine.
             // Read at PAINT time, not captured: `/theme` rebuilds the theme mid-session.
-            theme: () => getTheme(config.theme, detectCapabilities(process.env, process.stdout)),
-            caps: detectCapabilities(process.env, process.stdout),
+            theme: () => getTheme(config.theme, caps),
+            caps,
             cols: () => process.stdout.columns ?? 80,
             // The STATIC half of the gate. The dynamic half — "no overlay is open" —
             // belongs to `App`, which owns that state and calls `setEnabled`.
@@ -648,6 +655,7 @@ function runInteractive(flags, extras = {}) {
     };
     const terminalBridge = {
         mouseSelect: wantSelect,
+        deleteDisambiguated: filter !== null,
         scrollbar,
         ...(mouseOn
             ? {
@@ -716,14 +724,15 @@ function runInteractive(flags, extras = {}) {
             // every existing path is provably unchanged.
             stdin: filter?.stdin ?? process.stdin,
             stdout: frameObserver.stdout,
-        });
+        }, caps);
     }
     catch (error) {
         failInteractive(error);
         throw error;
     }
-    // H1's primary disarm, and this is the earliest moment at which "this build
-    // STARTS" is proven: the module graph loaded, config resolved, Ink mounted
+    // H1's primary disarm. Let mount-time exit promises settle first: Ink may
+    // return from render after its error boundary has already unmounted the app.
+    // A live app on the next turn has loaded, resolved config, and mounted
     // (cli-auto-update-hardening section 5.1.4). It is what makes a long session
     // that is later `SIGKILL`ed - terminal window closed, machine slept badly, OOM
     // killer - still count as healthy.
@@ -733,7 +742,8 @@ function runInteractive(flags, extras = {}) {
     // never armed it this is one read and one string compare. Gating it would mean
     // a user who switches `mode` to `off` between the install and the next launch
     // leaves the guard armed with nothing able to disarm it.
-    markBootHealthy(VERSION);
+    setImmediate(() => { if (!interactiveClosed)
+        markBootHealthy(VERSION); });
     if (updateEligible) {
         // DYNAMIC, and fire-and-forget AFTER `render()` (D-25). Dynamic because a
         // static import would make AC-1 false for `aragon -p`, which shares this
@@ -776,6 +786,9 @@ function runInteractive(flags, extras = {}) {
         .waitUntilExit()
         .then(() => {
         interactiveClosed = true;
+        // Also cover a successful immediate exit when launched via dist/cli.js,
+        // which bypasses the launcher's code-zero boot-guard backstop.
+        markBootHealthy(VERSION);
         screen?.restore();
         // BEFORE `disposeStdinFilter()`, which clears the listener set it subscribed to,
         // and after `restore()` for the reason that call records: the terminal must
@@ -811,6 +824,7 @@ async function runOneShot(flags, prompt, quiet) {
     // install. The gate must know that up front rather than discovering a null
     // handler and defaulting to "yes" (§7.4 / AC-13).
     const { controller } = makeController(flags, { interactive: false });
+    void controller.refreshModelMetadata();
     const logger = getLogger();
     logger.info('cli', 'run_oneshot', { quiet });
     // Headless has no frame, so a logging failure can safely reach stderr — the
@@ -829,10 +843,16 @@ async function runOneShot(flags, prompt, quiet) {
     // `followThrough` is read off the REAL controller here rather than through
     // `HeadlessController`, which is deliberately the minimal surface a test can
     // satisfy with an object literal (todo-plan-followthrough §3.6).
-    const code = await runHeadless(controller, prompt, {
-        quiet,
-        followThrough: controller.getTodoConfig().followThrough,
-    });
+    let code;
+    try {
+        code = await runHeadless(controller, prompt, {
+            quiet,
+            followThrough: controller.getTodoConfig().followThrough,
+        });
+    }
+    finally {
+        controller.dispose();
+    }
     // Flushed HERE and not inside `runHeadless`: that module is deliberately
     // injectable (its own controller interface, its own stdout/stderr) and has an
     // early `return 2`, so a singleton dependency in there would be both a new
@@ -1009,6 +1029,18 @@ function runConfigSetContextWindow(value) {
     process.stdout.write(`Set contextWindow = ${merged.contextWindow ?? 'auto'}\n`);
 }
 function runConfigSet(key, value) {
+    try {
+        runConfigSetValue(key, value);
+    }
+    catch (error) {
+        const invalid = error instanceof ModelProfileConfigError
+            && !['read_failed', 'write_failed'].includes(error.code);
+        process.stderr.write(error instanceof ModelProfileConfigError
+            ? `${error.message}\n` : 'Could not write config. Check file permissions.\n');
+        process.exitCode = invalid ? 2 : 1;
+    }
+}
+function runConfigSetValue(key, value) {
     if (!CONFIG_SET_KEYS.has(key)) {
         process.stderr.write(`Unknown config key "${key}". Known keys: ${[...CONFIG_SET_KEYS].join(', ')}.\n`);
         process.exitCode = 2;