@aragon-agent/cli 0.6.35 → 0.6.36

package/dist/commands/perf.d.ts

@@ -94,6 +94,17 @@ export interface BandPerf {
      * reply, which is exactly the state that used to be unrecoverable.
      */
     headRows: number;
+    /**
+     * Which rung the acceptance section reached inside the rail
+     * (todo-acceptance-criteria §6.9.6): `visible` (header plus rows), `summary` (the
+     * one `AC 2/5` line) or `absent` (nothing - the count is on the status chip).
+     *
+     * `n/a` when there are no criteria at all, which is the same spelling `/perf` uses
+     * for the band outside native mode. It is reported on the EXISTING band line rather
+     * than as a new row, and it comes from `buildPlanSections` - the same function the
+     * rail rendered from, so this is a report and not a second opinion.
+     */
+    acceptance?: 'visible' | 'summary' | 'absent' | 'n/a';
 }
 /**
  * Why the right-edge scrollbar is or is not usable, in one record

package/dist/commands/perf.js

@@ -139,7 +139,8 @@ function formatBandLine(band) {
         `tail=${band.previewRows} pool=${band.bandRows} ` +
         `cols=${band.contentCols}/${band.previewCols} ` +
         `reason=${band.reason} held=${band.heldRailRows}/${band.heldTeamRows} ` +
-        `window=${band.windowStart}/${band.windowEntries} head=${band.headRows}`;
+        `window=${band.windowStart}/${band.windowEntries} head=${band.headRows}` +
+        ` acc=${band.acceptance ?? 'n/a'}`;
 }
 /**
  * Format a snapshot as the seven-line block documented in §5.4 (plus the scrollbar

package/dist/commands/registry.d.ts

@@ -12,6 +12,7 @@ import type { FollowThroughBudget } from '../todo/follow-through.js';
 import type { UpdateCommandPort } from '../update/types.js';
 import type { SessionCommandPort } from './session-command.js';
 import type { BranchCommandPort } from './branch-command.js';
+import type { PromptCommandPort } from '../prompts/types.js';
 export interface CommandContext {
     /** App-owned shared lock and single feedback path for command and selection copies. */
     requestCopy?: (request: CopyRequest) => Promise<CopyRequestResult>;
@@ -161,6 +162,19 @@ export interface CommandContext {
      * value at run time.
      */
     branch?: BranchCommandPort;
+    /**
+     * The quick-prompt library's three capabilities (`/prompts`, quick-prompt-library
+     * §4.3 / P1-3).
+     *
+     * OPTIONAL, and this is the fifth time this file records the same rule: every
+     * fixture in this package builds `CommandContext` by literal, so a REQUIRED field
+     * would fail to compile every one of them for a feature none of them is about
+     * (F-14). Absent means the build has no library, and `/prompts` says exactly that.
+     *
+     * TYPE-ONLY import, for the reason the `branch` note above records: the command
+     * needs the SHAPE of the port, never a value at run time.
+     */
+    prompts?: PromptCommandPort;
 }
 /** What `/mouse` can see and do. Read at command time, never captured. */
 export interface MouseCommandPort {

package/dist/config/app-paths.d.ts

@@ -90,6 +90,21 @@ export declare function getModelWindowsPath(): string;
  * recall (config-state-separation D-1).
  */
 export declare function getPromptHistoryPath(): string;
+/**
+ * `<home>/quick-prompts.json` — the user's own quick-prompt library
+ * (quick-prompt-library D-3).
+ *
+ * A DIRECT CHILD OF THE ROOT, and deliberately NOT a section of `config.json`.
+ * `ui-state.ts:5-13` already wrote the rule this follows: anything carrying USER
+ * CONTENT, and anything that GROWS with usage, opens its own file. A library of
+ * two hundred prompts is exactly that, and `config.json` is where an API key
+ * lives.
+ *
+ * THE APPLICATION WRITES IT, unlike `model-windows.json` above: it is the library's
+ * only truth, and the store creates it on the first `add` rather than at startup.
+ * Naming follows `getPromptHistoryPath` beside it.
+ */
+export declare function getQuickPromptsPath(): string;
 /** `<home>/state.json` — UI bookkeeping scalars only; see `ui-state.ts`. */
 export declare function getUiStatePath(): string;
 /**

package/dist/config/app-paths.js

@@ -89,8 +89,22 @@ function isDirectory(path) {
  * test that sets `ARAGON_HOME` to something bogus quietly gets the real one.
  */
 function fallbackRoot() {
-    if (process.env.VITEST)
-        return join(tmpdir(), `aragon-agent-vitest-${process.pid}`);
+    if (process.env.VITEST) {
+        // ONE DIRECTORY PER WORKER, NOT ONE PER PROCESS.
+        //
+        // The `threads` pool (vitest.config.ts) gives every worker the SAME
+        // `process.pid` - they are threads - so a pid-keyed root is shared by up to
+        // `maxWorkers` test files running at the same time. Two of them cleaning up
+        // (`rmSync(getSessionsDir())`) while a third writes is a race, and it reports
+        // itself as "the session was never written": a red full run whose two files
+        // both pass alone. `VITEST_POOL_ID` is the worker's own id and a worker runs
+        // one file at a time, so keying on it restores the isolation the contract
+        // above promises (measured: `session-store.test.ts` and
+        // `exec-text-parity.test.ts` failed together and passed separately).
+        const worker = process.env.VITEST_POOL_ID ?? '';
+        const suffix = worker.length > 0 ? `-${worker}` : '';
+        return join(tmpdir(), `aragon-agent-vitest-${process.pid}${suffix}`);
+    }
     return join(homedir(), HOME_DIR_NAME);
 }
 function resolveHomeRoot() {
@@ -151,6 +165,23 @@ export function getModelWindowsPath() {
 export function getPromptHistoryPath() {
     return join(resolution.root, 'prompt-history.jsonl');
 }
+/**
+ * `<home>/quick-prompts.json` — the user's own quick-prompt library
+ * (quick-prompt-library D-3).
+ *
+ * A DIRECT CHILD OF THE ROOT, and deliberately NOT a section of `config.json`.
+ * `ui-state.ts:5-13` already wrote the rule this follows: anything carrying USER
+ * CONTENT, and anything that GROWS with usage, opens its own file. A library of
+ * two hundred prompts is exactly that, and `config.json` is where an API key
+ * lives.
+ *
+ * THE APPLICATION WRITES IT, unlike `model-windows.json` above: it is the library's
+ * only truth, and the store creates it on the first `add` rather than at startup.
+ * Naming follows `getPromptHistoryPath` beside it.
+ */
+export function getQuickPromptsPath() {
+    return join(resolution.root, 'quick-prompts.json');
+}
 /** `<home>/state.json` — UI bookkeeping scalars only; see `ui-state.ts`. */
 export function getUiStatePath() {
     return join(resolution.root, 'state.json');

package/dist/config/env.d.ts

@@ -18,7 +18,10 @@
  *     ARAGON_UPDATE,
  *     ARAGON_COMPACTION, ARAGON_COMPACTION_THRESHOLD,
  *     ARAGON_COMPACTION_KEEP_TURNS, ARAGON_COMPACTION_SUBAGENTS,
- *     ARAGON_COMPACTION_ARCHIVE.
+ *     ARAGON_COMPACTION_ARCHIVE,
+ *     ARAGON_JOBS_ENABLED, ARAGON_JOBS_WAIT_SECONDS, ARAGON_JOBS_STALL_SECONDS,
+ *     ARAGON_JOBS_PERSIST_LOG, ARAGON_JOBS_NOTICE_STEER,
+ *     ARAGON_PROMPTS (the quick-prompt library's `enabled` switch, and only that).
  *
  * READ ELSEWHERE, ON PURPOSE: `ARAGON_UPDATE_REGISTRY` and `npm_config_registry`
  * are resolved by `update/registry.ts::resolveRegistryUrl`, NOT here, because

package/dist/config/env.js

@@ -18,7 +18,10 @@
  *     ARAGON_UPDATE,
  *     ARAGON_COMPACTION, ARAGON_COMPACTION_THRESHOLD,
  *     ARAGON_COMPACTION_KEEP_TURNS, ARAGON_COMPACTION_SUBAGENTS,
- *     ARAGON_COMPACTION_ARCHIVE.
+ *     ARAGON_COMPACTION_ARCHIVE,
+ *     ARAGON_JOBS_ENABLED, ARAGON_JOBS_WAIT_SECONDS, ARAGON_JOBS_STALL_SECONDS,
+ *     ARAGON_JOBS_PERSIST_LOG, ARAGON_JOBS_NOTICE_STEER,
+ *     ARAGON_PROMPTS (the quick-prompt library's `enabled` switch, and only that).
  *
  * READ ELSEWHERE, ON PURPOSE: `ARAGON_UPDATE_REGISTRY` and `npm_config_registry`
  * are resolved by `update/registry.ts::resolveRegistryUrl`, NOT here, because
@@ -212,8 +215,10 @@ export function readEnvConfig() {
     }
     const todo = process.env.ARAGON_TODO?.trim().toLowerCase();
     const todoFollow = process.env.ARAGON_TODO_FOLLOW?.trim().toLowerCase();
+    const todoAcceptance = process.env.ARAGON_TODO_ACCEPTANCE?.trim().toLowerCase();
     if ((todo !== undefined && todo.length > 0) ||
-        (todoFollow !== undefined && todoFollow.length > 0)) {
+        (todoFollow !== undefined && todoFollow.length > 0) ||
+        (todoAcceptance !== undefined && todoAcceptance.length > 0)) {
         // Keyed by `TodoConfig` but VALUED `unknown`, which is what lets the mode be
         // written through unvalidated (below) while still failing to compile if a
         // future key is misspelled.
@@ -227,6 +232,16 @@ export function readEnvConfig() {
         if (todoFollow !== undefined && todoFollow.length > 0) {
             section.followThrough = todoFollow;
         }
+        // Same treatment as `enabled`: only the five affirmatives are true, anything
+        // else recognized-as-present is false, and an ABSENT variable leaves the key
+        // out entirely so the next layer's value survives.
+        if (todoAcceptance !== undefined && todoAcceptance.length > 0) {
+            section.acceptance =
+                todoAcceptance === '1' ||
+                    todoAcceptance === 'true' ||
+                    todoAcceptance === 'on' ||
+                    todoAcceptance === 'yes';
+        }
         // A PARTIAL section, safe only because every consumer deep-merges it — the
         // same contract `partial.skills`, `partial.log` and `partial.team` rely on.
         if (Object.keys(section).length > 0)
@@ -292,6 +307,17 @@ export function readEnvConfig() {
         if (Object.keys(section).length > 0)
             partial.jobs = section;
     }
+    // ARAGON_PROMPTS=0 is the kill switch for the whole quick-prompt surface: no
+    // `Ctrl+P`, no header hint, and `/prompts` reports that the feature is off
+    // (D-19 / AC-31). ONLY `enabled` IS REACHABLE HERE. `insertMode` and `hint` are
+    // preferences a human sets once, and an environment variable that could silently
+    // flip a fill into "overwrite what you had typed" is not a kill switch.
+    const prompts = process.env.ARAGON_PROMPTS?.trim().toLowerCase();
+    if (prompts !== undefined && prompts.length > 0) {
+        partial.prompts = {
+            enabled: prompts === '1' || prompts === 'true' || prompts === 'on' || prompts === 'yes',
+        };
+    }
     const retry = process.env.ARAGON_RETRY?.trim().toLowerCase();
     const retryMax = process.env.ARAGON_RETRY_MAX?.trim();
     if ((retry !== undefined && retry.length > 0) || (retryMax !== undefined && retryMax.length > 0)) {

package/dist/config/load.d.ts

@@ -118,6 +118,16 @@ export interface CliFlags {
      * rejected, which is what every other key in this file does.
      */
     todoFollow?: string;
+    /**
+     * `--todo-acceptance` => true, `--no-todo-acceptance` => false, absent =>
+     * undefined (todo-acceptance-criteria §6.8.2).
+     *
+     * DECLARED AS A PAIR, for the reason `--todo-panel` above records at length: it
+     * is a PERSISTED setting, so "not passed" has to stay distinguishable from
+     * `true`, or commander's lone-`--no-x` default would overwrite a config-file
+     * `acceptance: false` on every run that passes no flag at all.
+     */
+    todoAcceptance?: boolean;
     /** `--log-level <lv>` — this run only, never persisted. */
     logLevel?: string;
     /** `--log-file` ⇒ true, `--no-log-file` ⇒ false, absent ⇒ undefined. */

package/dist/config/load.js

@@ -7,7 +7,7 @@
  */
 import process from 'node:process';
 import { JOB_WAIT_MARGIN_MS } from '../proc/limits.js';
-import { DEFAULT_CONFIG, DEFAULT_SCROLL_MODE, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampCompactionConfig, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampBashConfig, clampJobsConfig, clampUpdateConfig, clampTheme, clampThinkingLevel, clampContextWindow, clampMaxTokens, clampMaxRenderInterval, clampScrollMode, clampScrollResumeMs, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, legacyTeamCeilingPatch, parseThresholdInput, } from './schema.js';
+import { DEFAULT_CONFIG, DEFAULT_SCROLL_MODE, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampCompactionConfig, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampBashConfig, clampJobsConfig, clampPromptsConfig, clampUpdateConfig, clampTheme, clampThinkingLevel, clampContextWindow, clampMaxTokens, clampMaxRenderInterval, clampScrollMode, clampScrollResumeMs, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, legacyTeamCeilingPatch, parseThresholdInput, } from './schema.js';
 import { loadDotenv, readEnvConfig, readEnvDisabledSkills } from './env.js';
 import { readConfigFile, updatePersistedConfig } from './store.js';
 import { projectModelProfiles, resolveModelProfileState, resolveModelRoleKey, } from './model-profile-resolution.js';
@@ -159,6 +159,7 @@ function resolveTodoConfig(flags, env, file) {
         ...(env.todo ?? {}),
         ...(flags.todo !== undefined ? { enabled: flags.todo } : {}),
         ...(flags.todoPanel !== undefined ? { panel: flags.todoPanel } : {}),
+        ...(flags.todoAcceptance !== undefined ? { acceptance: flags.todoAcceptance } : {}),
         // `!== undefined` for the third time, though for a value flag the risk is
         // milder: commander leaves `opts.todoFollow` absent unless it was passed.
         // Written this way anyway so the three lines read as one rule.
@@ -731,6 +732,12 @@ export function loadConfig(flags = {}, options = {}) {
         // NOT `resolveJobsConfig(...)` a second time: that would re-apply the
         // un-converged `waitSeconds` and silently undo I-4.
         jobs,
+        // The quick-prompt library's three policy scalars (quick-prompt-library D-19).
+        // Resolved through the SAME clamp the read and write paths use, so an env-only
+        // `ARAGON_PROMPTS=0` and a file-only `prompts.enabled: false` cannot arrive as
+        // two different shapes on `CliConfig`.
+        prompts: clampPromptsConfig({ ...DEFAULT_CONFIG.prompts, ...(env.partial.prompts ?? {}),
+            ...(file.prompts ?? {}) }),
         cwd,
         color,
         colorLevel,

package/dist/config/schema.d.ts

@@ -489,6 +489,17 @@ export interface TodoConfig {
      * be, and would mean replacing both merges first.
      */
     followThrough: FollowThroughMode;
+    /**
+     * Must a plan also declare acceptance criteria, and does the UI show them
+     * (todo-acceptance-criteria §6.8.1). Default TRUE.
+     *
+     * THE FOURTH SCALAR, and it is a scalar for exactly the reason above: both
+     * hand-written merges in `config/store.ts` spread the whole `todo` object, so a
+     * new scalar key flows through them automatically. `clampTodoConfig` below is the
+     * only other place that has to know about it - a value that is missing THERE
+     * would silently keep the default and make `--no-todo-acceptance` look broken.
+     */
+    acceptance: boolean;
 }
 export declare const DEFAULT_TODO_CONFIG: TodoConfig;
 /**
@@ -851,6 +862,43 @@ export declare const DEFAULT_JOBS_CONFIG: JobsConfig;
  * resolve to `undefined` and the setting would silently never apply.
  */
 export declare function clampJobsConfig(raw: unknown): JobsConfig;
+/**
+ * The quick-prompt library's three POLICY scalars (quick-prompt-library D-19).
+ *
+ * THE LIBRARY ITSELF IS NOT HERE (D-3). Two hundred prompts with bodies is user
+ * content that grows with usage, and `ui-state.ts:5-13` already wrote the rule:
+ * anything carrying user content opens its own file. `config.json` holds the three
+ * decisions that are about BEHAVIOUR - whether the key exists, what a fill does to
+ * a non-empty draft, and whether the header teaches the key.
+ *
+ * ONE LEVEL DEEP, like every section beside it: `runConfigGet` splits on a single
+ * dot, so `prompts.hint` resolves and `prompts.some.nested` would not.
+ */
+export interface PromptsConfig {
+    /**
+     * `false` stops `Ctrl+P` and the header hint; `/prompts` STAYS REGISTERED and
+     * reports that the feature is off (D-19 / AC-30). Removing the command as well
+     * would leave the one surface that can explain the switch unable to run.
+     */
+    enabled: boolean;
+    /**
+     * What a fill does to a draft that already has text in it (D-6).
+     * `insert` keeps the user's words; `replace` overwrites them.
+     */
+    insertMode: 'insert' | 'replace';
+    /** Whether the header's right-hand column may teach `^P prompts`. */
+    hint: boolean;
+}
+export declare const DEFAULT_PROMPTS_CONFIG: PromptsConfig;
+/**
+ * THE single gate for every `prompts` read AND write, like the eleven sections
+ * above it.
+ *
+ * An unrecognized `insertMode` falls back to `insert` rather than to `replace`,
+ * and that direction is deliberate: a typo must never silently start DISCARDING
+ * what the user has already typed into the composer.
+ */
+export declare function clampPromptsConfig(raw: unknown): PromptsConfig;
 /**
  * Parse `0.9`, `90%` or `90` into a ratio, or `null` when it is neither.
  *
@@ -1013,6 +1061,8 @@ export interface PersistedConfig {
     bash: BashConfig;
     /** Background jobs and bounded waiting. The ELEVENTH; scalars only (see JobsConfig). */
     jobs: JobsConfig;
+    /** Quick prompts. The TWELFTH; three scalars (see PromptsConfig). */
+    prompts: PromptsConfig;
 }
 export declare const DEFAULT_CONFIG: PersistedConfig;
 /**
@@ -1351,6 +1401,24 @@ export interface CliConfig {
      * `undefined` and report an empty value for a setting that IS on disk.
      */
     jobs: JobsConfig;
+    /**
+     * Quick prompts (quick-prompt-library D-19). The TWELFTH nested object; three
+     * scalars, one level deep.
+     *
+     * ON `CliConfig` AS WELL AS `PersistedConfig`, for the reason every section above
+     * records: `App` reads `cfg.prompts?.enabled` / `.hint` / `.insertMode` from a
+     * `CliConfig`, so a key added to the persisted shape alone would round-trip
+     * through the `config` commands, appear in `config list`, and change nothing.
+     *
+     * OPTIONAL ON THIS SHAPE ONLY, and `loadConfig` always fills it. The reason is the
+     * one the `jobs` note above does not have to state: `CliConfig` is built by hand in
+     * ~20 test fixtures, and a REQUIRED section turns every one of them into a compile
+     * error for a feature none of them is about. The three readers then fall back to the
+     * DOCUMENTED defaults (`enabled: true`, `insertMode: 'insert'`, `hint: true`), so a
+     * missing section can only ever behave like a default session - never like a
+     * disabled or destructive one.
+     */
+    prompts?: PromptsConfig;
     /**
      * Lifetime submit count driving the composer hint fade (`HINT_FADE_AFTER`).
      *

package/dist/config/schema.js

@@ -578,6 +578,7 @@ export const DEFAULT_TODO_CONFIG = {
     enabled: true,
     panel: true,
     followThrough: 'notify',
+    acceptance: true,
 };
 /**
  * There is no enum helper in this file, so this follows the `isThinkingLevel`
@@ -606,6 +607,10 @@ export function clampTodoConfig(raw) {
         // `ARAGON_TODO_FOLLOW=garbage` therefore resolves to `'notify'` and throws
         // nothing (AC-5).
         followThrough: followMode(src.followThrough, DEFAULT_TODO_CONFIG.followThrough),
+        // The fourth key needs nothing beyond this line: no migration, because
+        // `CONFIG_VERSION` is only stamped and never branched, and an old file reaches
+        // the new default through `{ ...DEFAULT, ...partial } + clamp`.
+        acceptance: bool(src.acceptance, DEFAULT_TODO_CONFIG.acceptance),
     };
 }
 export const DEFAULT_RETRY_CONFIG = {
@@ -958,6 +963,31 @@ export function clampJobsConfig(raw) {
         noticeSteer: bool(src.noticeSteer, DEFAULT_JOBS_CONFIG.noticeSteer),
     };
 }
+export const DEFAULT_PROMPTS_CONFIG = {
+    enabled: true,
+    insertMode: 'insert',
+    hint: true,
+};
+const PROMPT_INSERT_MODES = ['insert', 'replace'];
+/**
+ * THE single gate for every `prompts` read AND write, like the eleven sections
+ * above it.
+ *
+ * An unrecognized `insertMode` falls back to `insert` rather than to `replace`,
+ * and that direction is deliberate: a typo must never silently start DISCARDING
+ * what the user has already typed into the composer.
+ */
+export function clampPromptsConfig(raw) {
+    const src = (raw && typeof raw === 'object' ? raw : {});
+    const mode = typeof src.insertMode === 'string' ? src.insertMode.trim().toLowerCase() : '';
+    return {
+        enabled: bool(src.enabled, DEFAULT_PROMPTS_CONFIG.enabled),
+        insertMode: PROMPT_INSERT_MODES.includes(mode)
+            ? mode
+            : DEFAULT_PROMPTS_CONFIG.insertMode,
+        hint: bool(src.hint, DEFAULT_PROMPTS_CONFIG.hint),
+    };
+}
 /**
  * Parse `0.9`, `90%` or `90` into a ratio, or `null` when it is neither.
  *
@@ -1062,6 +1092,15 @@ export const DEFAULT_CONFIG = {
     // to `undefined` would throw on `config.jobs.waitSeconds` at construction
     // rather than quietly disabling something.
     jobs: DEFAULT_JOBS_CONFIG,
+    // And one section later again, for the seventh time, and this one has BOTH
+    // failure directions at once: `prompts.enabled` and `prompts.hint` are `true` by
+    // default, so a `config.json` predating this feature would resolve them to
+    // `undefined` (falsy) and arrive with the key and its hint silently off - while
+    // `prompts.insertMode` would be `undefined`, which is neither `'insert'` nor
+    // `'replace'` and would make `planPromptFill` fall through to its `replace`
+    // branch. That branch discards the user's own words, so the miss would be a data
+    // loss rather than a missing hint.
+    prompts: DEFAULT_PROMPTS_CONFIG,
 };
 /**
  * Runtime state that used to be stored in `config.json` by mistake

package/dist/config/store.js

@@ -17,7 +17,7 @@ import { getConfigPath, getSessionsDir } from './app-paths.js';
 import { registerProfileSecrets, registerSecretsFrom } from '../logging/secret-registry.js';
 import { adaptLegacyConnectionPatch, ModelProfileConfigError, readModelSettingsDisk } from './model-profile-store.js';
 import { normalizeModelProfiles } from './model-profiles.js';
-import { clampBashConfig, clampJobsConfig, CONFIG_VERSION, DEFAULT_CONFIG, clampCompactionConfig, clampFastConfig, clampLogConfig, clampMaxTokens, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampContextWindow, clampUpdateConfig, isAutoToken, stripLegacyStateKeys, } from './schema.js';
+import { clampBashConfig, clampJobsConfig, clampPromptsConfig, CONFIG_VERSION, DEFAULT_CONFIG, clampCompactionConfig, clampFastConfig, clampLogConfig, clampMaxTokens, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampContextWindow, clampUpdateConfig, isAutoToken, stripLegacyStateKeys, } from './schema.js';
 /**
  * Normalize `maxTokens` for both directions of the config file.
  *
@@ -195,6 +195,11 @@ export function normalizePersistedConfig(input) {
         // outright, which is a crash on the first `job_wait` rather than a silently
         // wrong setting.
         jobs: clampJobsConfig({ ...DEFAULT_CONFIG.jobs, ...(partial.jobs ?? {}) }),
+        // And the twelfth, on the same line and for the same reason - with one extra
+        // edge: without it `prompts.insertMode` reads `undefined`, which is neither
+        // `'insert'` nor `'replace'`, so a fill into a non-empty draft would take the
+        // branch that REPLACES what the user typed.
+        prompts: clampPromptsConfig({ ...DEFAULT_CONFIG.prompts, ...(partial.prompts ?? {}) }),
     };
 }
 /**
@@ -302,6 +307,12 @@ export function mergePersistedConfig(current, patch) {
         // absent — with `noticeSteer`'s default masking it on the next load, so the
         // user would never learn that their privacy switch had been turned back on.
         jobs: clampJobsConfig({ ...current.jobs, ...(patch.jobs ?? {}) }),
+        // The twelfth section, and the seventh time this file records the same trap.
+        // `aragon config set prompts.hint false` sends `{ prompts: { hint: false } }`;
+        // without this line the shallow top-level spread REPLACES the section and
+        // `insertMode` is written absent - which reads back as neither `'insert'` nor
+        // `'replace'`, i.e. the next fill overwrites the user's own draft.
+        prompts: clampPromptsConfig({ ...current.prompts, ...(patch.prompts ?? {}) }),
     };
     return merged;
 }

package/dist/config/ui-state.d.ts

@@ -90,6 +90,21 @@ export interface UiState {
      * others for the same reasons the two above record, and NOT a schema bump.
      */
     scrollModeNoticeVersion: number;
+    /**
+     * Which revision of the "Ctrl+P moved to the prompt library" notice this user has
+     * been shown (`0` = none; quick-prompt-library D-20).
+     *
+     * A VERSION BESIDE THE OTHERS AND NOT A SCHEMA BUMP, for the third time in this
+     * file: bumping `UI_STATE_SCHEMA` makes `readFromDisk` discard the whole object, so
+     * every user's `submitCount` resets and the composer hint un-fades - to re-show one
+     * line. A NEW field simply reads as its default on an older file, which is exactly
+     * the behaviour wanted here.
+     *
+     * IT EXISTS BECAUSE THE KEY MOVED. `Ctrl+P` now opens the prompt library and the
+     * mode fallback is `Ctrl+N`; the audience for that sentence is every existing user,
+     * and a boolean could only ever say "shown", never "shown WHAT".
+     */
+    promptKeyNoticeVersion: number;
 }
 /** Read the state, caching it for the life of the process. Never throws. */
 export declare function loadUiState(): UiState;
@@ -107,6 +122,9 @@ export declare function setVtInputNoticeVersion(version: number): void;
 /** `0` on a file written before the field existed. */
 export declare function getScrollModeNoticeVersion(): number;
 export declare function setScrollModeNoticeVersion(version: number): void;
+/** `0` on a file written before the field existed; see the field's comment. */
+export declare function getPromptKeyNoticeVersion(): number;
+export declare function setPromptKeyNoticeVersion(version: number): void;
 /**
  * Migration-only: fill in fields that are still at their default, and never
  * overwrite a value already here. A second import — after a half-finished

package/dist/config/ui-state.js

@@ -38,6 +38,7 @@ const DEFAULT_UI_STATE = {
     mouseNoticeVersion: 0,
     vtInputNoticeVersion: 0,
     scrollModeNoticeVersion: 0,
+    promptKeyNoticeVersion: 0,
 };
 let memory = null;
 /** Non-negative integer or `fallback`; shared by both numeric fields. */
@@ -71,6 +72,7 @@ function readFromDisk() {
             mouseNoticeVersion: coerceCount(parsed.mouseNoticeVersion, DEFAULT_UI_STATE.mouseNoticeVersion),
             vtInputNoticeVersion: coerceCount(parsed.vtInputNoticeVersion, DEFAULT_UI_STATE.vtInputNoticeVersion),
             scrollModeNoticeVersion: coerceCount(parsed.scrollModeNoticeVersion, DEFAULT_UI_STATE.scrollModeNoticeVersion),
+            promptKeyNoticeVersion: coerceCount(parsed.promptKeyNoticeVersion, DEFAULT_UI_STATE.promptKeyNoticeVersion),
         };
     }
     catch {
@@ -151,6 +153,13 @@ export function getScrollModeNoticeVersion() {
 export function setScrollModeNoticeVersion(version) {
     update({ scrollModeNoticeVersion: version });
 }
+/** `0` on a file written before the field existed; see the field's comment. */
+export function getPromptKeyNoticeVersion() {
+    return loadUiState().promptKeyNoticeVersion;
+}
+export function setPromptKeyNoticeVersion(version) {
+    update({ promptKeyNoticeVersion: version });
+}
 /**
  * Migration-only: fill in fields that are still at their default, and never
  * overwrite a value already here. A second import — after a half-finished

package/dist/exec/events.d.ts

@@ -192,6 +192,22 @@ export interface ExecTodoEvent {
         content: string;
         status: 'pending' | 'in_progress' | 'completed';
     }[];
+    /**
+     * Acceptance counts (todo-acceptance-criteria §6.13.2). `null` when the capability
+     * is off or the plan has no criteria.
+     *
+     * REQUIRED BUT NULLABLE, not optional: `runner` is the only producer and can
+     * always answer, while for a consumer `null` and "field absent" mean the same
+     * thing under the forward-compatibility contract above. Per-criterion `evidence`
+     * never reaches this stream (I-8) - a machine consumer that needs it reads the
+     * session file.
+     */
+    acceptance: {
+        total: number;
+        checked: number;
+        passed: number;
+        failed: number;
+    } | null;
 }
 export interface ExecTeamEvent {
     type: 'team';
@@ -371,6 +387,15 @@ export interface ExecResultEvent {
         id: string;
     };
     todos: ExecTodoCounts | null;
+    /**
+     * The acceptance tally for the run (todo-acceptance-criteria §6.13.2), on the same
+     * terms as `ExecTodoEvent.acceptance`: required but nullable, no evidence.
+     */
+    acceptance: {
+        total: number;
+        passed: number;
+        failed: number;
+    } | null;
     error: ExecErrorInfo | null;
 }
 /**

package/dist/exec/events.js

@@ -44,6 +44,10 @@ export const EXEC_CAPABILITIES = [
     // Background job lifecycle events (long-task-jobs §4.10). A consumer that does
     // not know the `job` type ignores it; this string is how it asks first.
     'background-jobs',
+    // Acceptance counts on the todo event and the result event
+    // (todo-acceptance-criteria §6.13.2). APPEND-ONLY: a wrapper detects support by
+    // asking for this string, and an older wrapper never asks.
+    'todo-acceptance',
 ];
 export function buildInitEvent(params) {
     return {

package/dist/exec/index.js

@@ -112,7 +112,7 @@ async function execute(input) {
     });
     if (plan.saved) {
         controller.replaceMessages(plan.saved.messages, plan.saved.compactionIdentity);
-        controller.restoreTodos(plan.saved.todos);
+        controller.restoreTodos(plan.saved.todos, plan.saved.acceptance);
     }
     const config = controller.getConfig();
     emitter.init({
@@ -190,6 +190,14 @@ async function execute(input) {
         cost: buildCost(controller, stats.usage, stats.compactionBilling),
         model: { provider: config.provider, id: config.model },
         todos: todo ? { total: todo.total, done: todo.doneCount } : null,
+        // The verdict tally for the run, with no per-criterion evidence (I-8).
+        acceptance: todo?.acceptance
+            ? {
+                total: todo.acceptance.total,
+                passed: todo.acceptance.passedCount,
+                failed: todo.acceptance.failedCount,
+            }
+            : null,
         error: stats.errorCode && stats.errorMessage
             ? { code: stats.errorCode, message: stats.errorMessage }
             : null,
@@ -288,6 +296,7 @@ function failedResult(sessionId, config, message, code, durationMs) {
         cost: { amount: 0, currency: 'USD', known: false },
         model: { provider: config.provider, id: config.model },
         todos: null,
+        acceptance: null,
         error: { code, message },
     };
 }
@@ -479,6 +488,12 @@ function persist(plan, controller, turns, usage, cli, at) {
                 ...(controller.getSessionSnapshot?.() ?? { messages: controller.getMessages() }),
                 entries: [],
                 todos: controller.getTodoSnapshot?.()?.items ?? [],
+                // From the STORE, not the render projection: a run whose capability is off
+                // must still persist the verdicts it already has. OPTIONAL CALL, like the line
+                // above: `ExecControllerFactory` is a port, and a caller whose controller
+                // predates this feature must keep saving sessions rather than fail on a method
+                // it never heard of - the failure mode would be a session silently not written.
+                acceptance: controller.getAcceptanceItems?.() ?? [],
             },
             meta,
         });

package/dist/exec/runner.js

@@ -108,6 +108,16 @@ export class ExecRunner {
                 done: doneCount,
                 activeIndex,
                 items: items.map((item) => ({ content: item.content, status: item.status })),
+                // Counts only, never per-criterion evidence (I-8): this stream is a machine
+                // surface, and a criterion's evidence is written for a human to read.
+                acceptance: event.snapshot.acceptance
+                    ? {
+                        total: event.snapshot.acceptance.total,
+                        checked: event.snapshot.acceptance.checkedCount,
+                        passed: event.snapshot.acceptance.passedCount,
+                        failed: event.snapshot.acceptance.failedCount,
+                    }
+                    : null,
             });
         });
         if (todos)

package/dist/proc/limits.d.ts

@@ -79,6 +79,22 @@ export declare const PROC_LIMITS: {
     readonly outputCoalesceMs: 100;
     /** `SIGTERM` -> `SIGKILL` escalation window for a graceful stop. */
     readonly stopGraceMs: 3000;
+    /**
+     * How long to KEEP ASKING whether the `SIGKILL` actually landed before
+     * declaring the job `stopped`.
+     *
+     * THIS NUMBER IS NOT A GUESS ABOUT THE PLATFORM. `killTree` spawns `taskkill`,
+     * which is a process of its own: a Windows tree kill of a shell plus its node
+     * child measures ~0.8 s on the reference machine (while starting `cmd` costs
+     * 50 ms), so the fixed 250 ms this used to allow expired first and `stop()`
+     * reported `stopped` with the child still running - AC-18 caught exactly that.
+     * The wait stays BOUNDED against the opposite failure (a promise that never
+     * resolves); at this deadline the record keeps the honest `killIncomplete`
+     * flag instead.
+     */
+    readonly killVerifyMs: 2000;
+    /** Liveness poll interval while waiting for a `SIGKILL` to land. */
+    readonly killVerifyPollMs: 50;
     /** Below this many terminal columns the status chip degrades to `[N]`. */
     readonly statusCompactCols: 92;
     /**