@aragon-agent/cli 0.6.47 → 0.6.48

package/dist/config/schema.d.ts

@@ -1,1645 +0,0 @@
-/**
- * Config schema — the persisted config-file shape, the in-memory effective
- * config, sane defaults, and small validation/masking helpers.
- *
- * See spec §3.5 (resolution pipeline), §6.1 (config file), and §3.8 (timeout
- * invariant).
- */
-import { type RetryPolicy, type ThinkingLevel } from '@aragon-agent/core';
-import { type LogLevelName } from '../logging/levels.js';
-import { type GovernanceConfig } from './governance-config.js';
-import type { Posture } from '../governance/posture.js';
-import type { FollowThroughMode } from '../todo/types.js';
-export { clampGovernanceConfig, DEFAULT_GOVERNANCE_CONFIG, type GovernanceConfig, } from './governance-config.js';
-/**
- * `ModelRegistry` seeds builtin lists for five providers, but `initProviders()`
- * registers only three adapters. Running a model whose provider has no adapter
- * throws `Unknown LLM provider`, so the CLI only ever offers these three.
- */
-export declare const ADAPTER_PROVIDERS: readonly ["anthropic", "openai", "google"];
-export type AdapterProviderId = (typeof ADAPTER_PROVIDERS)[number];
-export declare function isAdapterProvider(id: string): id is AdapterProviderId;
-export declare const THINKING_LEVELS: ThinkingLevel[];
-export declare function isThinkingLevel(v: unknown): v is ThinkingLevel;
-export declare function clampThinkingLevel(v: unknown, fallback: ThinkingLevel): ThinkingLevel;
-export declare const THEME_NAMES: readonly ["auto", "warm", "cool", "light"];
-export type ThemeName = (typeof THEME_NAMES)[number];
-/** The v0.3.0 name for what is now `cool`. Accepted forever as an alias. */
-export declare const LEGACY_DARK_THEME = "dark";
-export declare function isThemeName(v: unknown): v is ThemeName;
-/**
- * THE single gate for every theme write (spec §4.5 / R-4).
- *
- * All three write paths funnel through here — config resolution (`load.ts`),
- * `aragon config set theme`, and the `/theme` slash command — which is why the
- * `dark -> cool` migration lives here and nowhere else. Putting it in a
- * `load.ts` normalization step instead would migrate what users *read* but not
- * what they *write*, producing the worst kind of bug: "the flag works but the
- * setting won't stick."
- *
- * An unrecognized value still falls back silently (plus a warn toast at the call
- * site). Turning that into a hard exit would be an unannounced breaking change
- * and would not match `clampThinkingLevel` / `clampTranscriptWindow`.
- */
-export declare function clampTheme(v: unknown, fallback: ThemeName): ThemeName;
-export declare const SCROLL_MODES: readonly ["native", "app"];
-/**
- * How the interactive TUI scrolls (tui-native-terminal-scroll D1).
- *
- * `native` prints settled conversation into the host terminal's own scrollback and
- * keeps only a bounded live region on screen; `app` is the original full-screen
- * alternate-screen layout with application-owned scrolling.
- */
-export type ScrollMode = (typeof SCROLL_MODES)[number];
-export declare const DEFAULT_SCROLL_MODE: ScrollMode;
-export declare function clampScrollMode(v: unknown, fallback: ScrollMode): ScrollMode;
-export declare const DENSITY_MODES: readonly ["comfortable", "compact"];
-export type DensityMode = (typeof DENSITY_MODES)[number];
-export declare function clampDensity(v: unknown, fallback: DensityMode): DensityMode;
-/**
- * Submissions after which the composer hint collapses to `? help` (§4.6).
- * Only the IDLE hint fades; the running hint carries the abort key and is
- * always shown in full.
- */
-export declare const HINT_FADE_AFTER = 8;
-export declare const CONFIG_VERSION = 1;
-export declare const DEFAULT_MODEL = "claude-sonnet-4-5-20250929";
-/** Per-tool executor ceiling (§3.8). Headroom for typical installs/builds. */
-export declare const DEFAULT_TOOL_TIMEOUT_MS = 180000;
-/** Extra margin so idle timeout is strictly greater than the tool ceiling. */
-export declare const IDLE_TIMEOUT_MARGIN_MS = 30000;
-/** Watchdog idle timeout (§3.8) — must stay ≥ toolTimeout so long tools survive. */
-export declare const DEFAULT_IDLE_TIMEOUT_MS: number;
-/**
- * Cap on the recall list.
- *
- * The list itself now lives in `<home>/prompt-history.jsonl`; this constant is
- * consumed by `config/prompt-history.ts`, not by the UI.
- */
-export declare const PROMPT_HISTORY_CAP = 100;
-/**
- * The SCROLL HORIZON: entries older than this are not reachable inside the app
- * and render as the "N earlier entries collapsed" line instead (invariant I-3).
- *
- * It used to be a rendering budget as well, because yoga laid out every child
- * even when `overflow: hidden` clipped it. The viewport is virtualised now
- * (tui-render-performance L3) — off-screen entries are not mounted at all — so
- * the horizon costs O(entries) of arithmetic rather than O(characters) of layout
- * and the default rises 300 -> 1000 with a 20000 ceiling. An existing persisted
- * `300` is still valid and still clamps; no config migration is required.
- */
-export declare const DEFAULT_TRANSCRIPT_WINDOW = 1000;
-export declare const MIN_TRANSCRIPT_WINDOW = 50;
-export declare const MAX_TRANSCRIPT_WINDOW = 20000;
-export declare function clampTranscriptWindow(v: unknown, fallback: number): number;
-/**
- * Bounds for a hand-supplied context window.
- *
- * The floor is roughly the smallest window any current model ships with; the
- * ceiling is well above the largest, and both exist to keep a typo (a missing
- * or an extra zero) from producing a gauge that is permanently red or
- * permanently flat.
- */
-export declare const MIN_CONTEXT_WINDOW = 8000;
-export declare const MAX_CONTEXT_WINDOW = 5000000;
-/**
- * THE single gate for every `contextWindow` read AND write.
- *
- * TRI-STATE, AND `null` MUST PASS STRAIGHT THROUGH (RV-12). `null` means AUTO -
- * take the model table's number, or the 128k placeholder. Clamping it into
- * `[8000, ...]` yields 8000, which removes "auto" from the config permanently
- * and presents to the user as an 8k denominator with a permanently red bar and
- * no visible source. `maxTokens` above is the existing tri-state precedent and
- * this deliberately copies its shape rather than inventing a second convention.
- */
-export declare function clampContextWindow(v: unknown, fallback: number | null): number | null;
-/**
- * Where the effective `contextWindow` override came from
- * (profile-context-window §5.2).
- *
- * A CLI-LOCAL RUNTIME FACT: never persisted, never promoted into Core's event
- * shapes. It exists so `/context` can name WHICH surface supplied a
- * denominator the user asserted - the environment, the legacy top-level key,
- * or the model profile bound as Main.
- */
-export type ContextWindowOrigin = 'env' | 'config' | 'profile';
-/**
- * Parse text typed into the settings screen or the profile editor for a
- * context window (profile-context-window §5.3).
- *
- * THE MIRROR OF `parseMaxTokensInput` BELOW, down to the tri-state shape: it
- * distinguishes AUTO from "the user typed nonsense", which `clampContextWindow`
- * cannot - a typo must change NOTHING rather than silently discard the number
- * the user meant to set. `''` / `'auto'` / `'0'` are AUTO (`isAutoToken`);
- * a digit run is clamped through THE single gate; anything else is invalid.
- */
-export declare function parseContextWindowInput(raw: string): {
-    kind: 'auto';
-} | {
-    kind: 'value';
-    value: number;
-    clamped: boolean;
-} | {
-    kind: 'invalid';
-};
-/**
- * Entries kept in `ViewState` at all (tui-render-performance L1 / R5).
- *
- * A DIFFERENT BOUND FROM `transcriptWindow`, and the two must not be merged:
- * the window is what the user can scroll to, this is what the process keeps in
- * memory and what `/save` can export. Dropped entries are COUNTED and reported
- * (`/perf`, and a leading line in the exported transcript) — never silent.
- */
-export declare const DEFAULT_TRANSCRIPT_RETAIN = 1000;
-export declare const MIN_TRANSCRIPT_RETAIN = 200;
-export declare const MAX_TRANSCRIPT_RETAIN = 20000;
-export declare function clampTranscriptRetain(v: unknown, fallback: number): number;
-/** Adaptive coalescing under load. On by default; `--no-render-governor` kills it. */
-export declare const DEFAULT_RENDER_GOVERNOR = true;
-/**
- * Ceiling of the governor ladder, in ms. `33` flattens the ladder to a single
- * rung, which is the pre-feature behaviour without needing the kill switch.
- */
-export declare const DEFAULT_MAX_RENDER_INTERVAL_MS = 320;
-export declare function clampMaxRenderInterval(v: unknown, fallback: number): number;
-/**
- * Repaint only the frame lines that changed (full-screen only).
- *
- * ON by default, and `--no-diff-render` restores today's byte stream EXACTLY —
- * the interposer is not constructed at all, so a regression on an exotic
- * terminal is one flag away from being neutralised (§3.5 rung 2).
- */
-export declare const DEFAULT_DIFF_RENDER = true;
-/**
- * Wrap each repaint batch in DEC 2026 begin/end synchronized update.
- *
- * ON by default with NO capability probe (§3.3): terminals that do not implement
- * mode 2026 parse the CSI sequence, find an unknown private mode and discard it,
- * so a false positive costs nothing — and a false negative costs nothing either,
- * because the frame differ already removes the flicker on its own.
- */
-export declare const DEFAULT_SYNC_OUTPUT = true;
-/**
- * Drag-select + copy, and — because §4.4.1 gates `\x1b[?1002h` on exactly this
- * value — whether motion reporting is requested from the terminal at all.
- *
- * That gating is what makes `false` BYTE-IDENTICAL to a pre-feature session
- * rather than merely equivalent (AC-8 / D-15). Ignored when `mouse` is false,
- * since there is no capture to select with.
- */
-export declare const DEFAULT_MOUSE_SELECT = true;
-/**
- * Idle delay before a paused viewport returns to the newest line, in ms.
- *
- * Five seconds is chosen to be LONGER than a glance and SHORTER than a read.
- * `0` disables auto-resume entirely, and it is a real value rather than a
- * sentinel-shaped default: `shouldArmResume` refuses on it before any timer is
- * created (AC-9), so the revert for Rule B is one config key.
- *
- * NO CLI FLAG (§6.1). It is a comfort preference, set once
- * (`aragon config set scrollResumeMs 8000`) and then forgotten — the same
- * argument this file already makes for `historyEnabled`. Adding a flag for every
- * scalar is how a CLI ends up with sixty of them.
- */
-export declare const DEFAULT_SCROLL_RESUME_MS = 5000;
-/**
- * `clampIntAllowingZero`, and the choice is load-bearing: `clampInt` delegates to
- * `coercePositiveInt`, which returns the FALLBACK for `n <= 0` — so `0` would
- * silently become 5000 and the documented off switch would not be an off switch.
- * Exactly the trap `retry.maxRetries` needed this helper for.
- */
-export declare function clampScrollResumeMs(v: unknown, fallback: number): number;
-/**
- * Ceiling on ONE human wait, in ms. Thirty minutes is far outside "the user
- * went to get coffee", but a ceiling has to exist: an unattended terminal must
- * not wedge a CI job or a stale ssh session forever.
- *
- * THIS IS NOT A ROUND LIMIT and the distinction matters. It bounds a single wait
- * (liveness); it says nothing about how many times the model may ask.
- */
-export declare const DEFAULT_PLAN_HUMAN_TIMEOUT_MS = 1800000;
-export declare function clampHumanTimeout(v: unknown, fallback: number): number;
-export interface SkillsConfig {
-    enabled: boolean;
-    /** Skill names the user has switched off. */
-    disabled: string[];
-    /** Gate `skill_install` / `skill_create` behind a human confirmation (D12). */
-    requireApproval: boolean;
-    /** Hosts an install may fetch from. Anything else is refused (SSRF guard). */
-    allowedHosts: string[];
-    /** Project-relative skill roots, in ascending precedence. */
-    projectDirs: string[];
-    /** Absolute, normalized directories the user has trusted (D13 / §9.3). */
-    trustedProjectDirs: string[];
-    /** D19: BYTES, not characters. */
-    catalogMaxBytes: number;
-    /** D19: BYTES, not characters. Upper bound derives from SKILL_RESULT_MAX_BYTES. */
-    bodyMaxBytes: number;
-    /**
-     * What to do when SKILL.md no longer matches the copy that was approved (§8.2).
-     *
-     * Defaults to `warn`, NOT `strict` (D-A13). Hand-editing an installed skill is
-     * a legitimate workflow — the same one `update --force` exists to protect —
-     * and a default that silently removed the edited skill from the catalog would
-     * present as "I changed one line and it disappeared".
-     */
-    integrity: SkillsIntegrityMode;
-    /**
-     * Keep local per-skill use counters to rank the catalog (§9). Name, count and
-     * timestamp only; never transmitted. `false` disables all reads and writes.
-     */
-    usageTracking: boolean;
-    /**
-     * How hard `allowed-tools` bites (§5.5).
-     *
-     * Defaults to `enforce`, NOT `warn` — the opposite of `integrity`, and the two
-     * are not comparable. A false integrity alarm punishes a user for legitimately
-     * editing a file they own; a false ceiling refusal requires a skill AUTHOR to
-     * have under-declared what their own skill uses, which is a bug in the skill
-     * and one that `doctor` reports before it can bite. Add the three narrowings
-     * that already apply — one turn only, only for skills that declared anything,
-     * and every read-only tool in the floor — and shipping it off by default would
-     * just be a second decorative field.
-     */
-    toolPolicy: SkillsToolPolicyMode;
-    /**
-     * Automatic skill triage (skill-triage-and-unbounded-ask §4.2.9): compute a
-     * short candidate list for each new task and put it in the system prompt, so
-     * "is a skill applicable?" becomes a question the protocol forces the model to
-     * answer rather than one it has to remember to ask.
-     *
-     * DEFAULT ON, and OFF must be byte-identical to the pre-feature prompt. That is
-     * what the block's conditional splice in `buildSystemPrompt` guarantees
-     * (invariant I-T1) — a permanently-on block would be a prompt change nobody
-     * could turn off.
-     */
-    triage: boolean;
-}
-export declare const SKILLS_INTEGRITY_MODES: readonly ["off", "warn", "strict"];
-export type SkillsIntegrityMode = (typeof SKILLS_INTEGRITY_MODES)[number];
-export declare function clampSkillsIntegrity(v: unknown, fallback: SkillsIntegrityMode): SkillsIntegrityMode;
-export declare const SKILLS_TOOL_POLICY_MODES: readonly ["off", "warn", "enforce"];
-export type SkillsToolPolicyMode = (typeof SKILLS_TOOL_POLICY_MODES)[number];
-export declare function isSkillsToolPolicyMode(v: unknown): v is SkillsToolPolicyMode;
-export declare function clampSkillsToolPolicy(v: unknown, fallback: SkillsToolPolicyMode): SkillsToolPolicyMode;
-export declare const DEFAULT_ALLOWED_SKILL_HOSTS: string[];
-export declare const DEFAULT_SKILLS_CONFIG: SkillsConfig;
-/**
- * THE single gate for every skills-config read AND write (§10.3.1).
- *
- * Shared by `loadConfig()`, `loadPersistedConfig()` and `updatePersistedConfig()`
- * on purpose: hardening only the read path would leave a corrupt value on disk
- * that silently reverts to a default on every launch — the failure looks like
- * "my setting won't stick" with no error anywhere.
- */
-export declare function clampSkillsConfig(raw: unknown): SkillsConfig;
-/**
- * Run-time-only skill switches (§7.5). These come from flags / env and are
- * NEVER persisted, which is why they do not live in `SkillsConfig`.
- */
-export interface SkillsRuntimeOptions {
-    /** `--skill <name>` ×N — force Level 2 injection for this run only. */
-    forcedSkills: string[];
-    /** `--skills-yes` — approve installs for this run only. */
-    approveAll: boolean;
-    /**
-     * `--skill-tool-policy <mode>` — override the ceiling mode for this run.
-     *
-     * Sits BETWEEN the session override and the config file (D-G19), not on top of
-     * everything: the refusal text tells the user to run `/skills policy off`, and
-     * a flag that outranked that command would make the documented escape hatch a
-     * no-op with no message to explain it.
-     */
-    toolPolicy?: SkillsToolPolicyMode;
-}
-export declare const DEFAULT_SKILLS_RUNTIME: SkillsRuntimeOptions;
-export interface LogConfig {
-    level: LogLevelName;
-    /** Whether records reach a file at all. */
-    toFile: boolean;
-    /** Absolute log directory; empty string means `<home>/logs`. */
-    dir: string;
-    /** Rotate a file once it would exceed this many bytes. */
-    maxFileBytes: number;
-    /** Files kept in the log directory; the oldest beyond this are deleted. */
-    maxFiles: number;
-    /**
-     * Run every record through the redaction pipeline. The ONE switch a user can
-     * flip to put credentials on disk, which is why turning it off prints a
-     * warning and has no settings-screen entry (§4.3).
-     */
-    redactSecrets: boolean;
-    /** Truncation length for user content at `debug`; `trace` is never truncated. */
-    previewChars: number;
-}
-export declare const DEFAULT_LOG_CONFIG: LogConfig;
-/**
- * THE single gate for every log-config read AND write, exactly like
- * `clampSkillsConfig`: hardening only the read path leaves a bad value on disk
- * that reverts on every launch, which presents as "my setting won't stick".
- *
- * `previewChars` uses its own coercion because `coercePositiveInt` rejects `0`,
- * and `0` is a legitimate value here — it means "record that content existed,
- * but none of it".
- */
-export declare function clampLogConfig(raw: unknown): LogConfig;
-export interface TeamConfig {
-    /** Register the `task` tool at all. Defaults to TRUE (R-b). */
-    enabled: boolean;
-    /** Children per dispatch. Clamped to [1, HARD_MAX_SUBAGENTS] (R-g). */
-    maxSubagents: number;
-    /**
-     * Children in flight at once.
-     *
-     * A SEPARATE KNOB FROM `maxSubagents` on purpose (D-6): provider rate limits
-     * are a different constraint from context economics, and folding them into one
-     * number makes both wrong. Five simultaneous streams against one API key is a
-     * reliable way to collect HTTP 429s, each of which lands in the report as a
-     * failed subagent.
-     */
-    maxConcurrent: number;
-    /**
-     * The one-shot marker `migrateLegacyTeamFanout` writes (subagent-fanout
-     * D-3), and NOTHING else may ever write it.
-     *
-     * It exists because the fan-out default moved 5/3 -> 8/8 while every save
-     * materializes the whole section: without a marker, a user who deliberately
-     * returns to 5/3 is migrated back to 8/8 on the next launch, for ever. Absent
-     * means "not yet migrated"; it is never written as `false`.
-     */
-    fanoutMigrated?: boolean;
-    /**
-     * One child's wall clock before its own abort. `0` (the default) means NO
-     * ceiling: a subagent runs until it finishes or is aborted, exactly like
-     * the lead, whose only in-run ceiling is the event-silence idle watchdog
-     * a child already keeps. A wedged child still dies on its OWN watchdog.
-       *
-       * WITH `team.overseer` ON (the default) this NEVER aborts anything
-       * (subagent-overseer-v2 D-4): a positive value is only a COMPATIBILITY
-       * SOURCE for the supervisor's first cadence check, honouring users who
-       * already treated it as a trigger point. The only hard abort left is
-       * the legacy regime (`team.overseer: false`).
-     */
-    subagentTimeoutMs: number;
-    /**
-     * The whole dispatch's wall clock, and the `task` tool-timeout override.
-     * `0` (the default) means NO ceiling: the executor override of `0` arms no
-     * timer (see Core `ToolExecutor`), so the fan-out lasts as long as its
-     * slowest child and only an Esc ends it early.
-     */
-    dispatchTimeoutMs: number;
-    /**
-     * Runaway-loop cap: turns one child may take before it is stopped.
-     * `0` (the default) means NO cap - the same exposure the lead has, and
-     * the deliberate trade of "subagents as capable as the main agent".
-     */
-    maxTurnsPerSubagent: number;
-    /**
-     * The dispatch supervisor (team-overseer / subagent-overseer-v2): time
-     * ceilings on children become inspection triggers for a fast-tier
-     * supervisor that decides wait / nudge / replace / abandon, instead of
-     * aborts. Default TRUE.
-     *
-     * READ PER DISPATCH. The supervisor ticks on a cadence ladder over every
-     * live child, and NO timeout is a death sentence while this is on: with
-     * the fast tier missing a tick degrades to an announced unassisted wait,
-     * never a kill. With this FALSE, children run exactly the pre-feature
-     * legacy regime: `subagentTimeoutMs` is a hard abort and silence is the
-     * child's own watchdog.
-     */
-    overseer: boolean;
-    /**
-     * Supervisor cadence BASE, in milliseconds (subagent-overseer-v2 D-8).
-     * `0` (the default) = the structural default
-     * (`TEAM_LIMITS.overseerDefaultCheckMs`, 300 s).
-     *
-     * EFFECTIVE FIRST CHECK, derived read-only and never written back:
-     * `overseerIntervalMs > 0` wins; otherwise a positive
-     * `subagentTimeoutMs` is honoured (users who already treated it as a
-     * trigger point); otherwise the structural default. Later checks grow
-     * by `overseerCadenceRatio` (1.6), clamped to [60 s, 900 s]. Only
-     * meaningful while `team.overseer` is true.
-     */
-    overseerIntervalMs: number;
-    /**
-     * Which model a team child runs on (subagent-model-and-question-controls
-     * D-2). `'main'` = the lead's own connection - the default and the
-     * historical parity behavior; `'fast'` = the fast tier, resolved per
-     * dispatch through `resolveFastTier`; `'profile'` = the entry named by
-     * `team.modelProfileId`.
-     *
-     * A USER-OWNED SETTING, NEVER A TOOL PARAMETER (D-1): `normalizeSubagentSpecs`
-     * keeps silently dropping a stale `model` key, so the MODEL cannot downgrade
-     * its own delegation. This key is the one explicit, visible, reversible
-     * switch the human owns.
-     */
-    model: 'main' | 'fast' | 'profile';
-    /**
-     * The profile entry a `model: 'profile'` dispatch binds to; `null` = not
-     * bound. IGNORED by the other modes. Existence is NOT validated here - a
-     * dangling id degrades to the main model with a disclosed reason at
-     * resolution time (D-4), so deleting a profile can never break a dispatch.
-     */
-    modelProfileId: string | null;
-}
-/**
- * The requirement's ceiling on the fan-out (R-g).
- *
- * Re-exported from `TEAM_LIMITS` rather than re-spelled, because it is enforced
- * in TWO places — here on the config value, and again in
- * `normalizeSubagentSpecs` on what the model asked for — and two copies of the
- * same 10 is exactly how a hand-edited `config.json` ends up being able to raise
- * a ceiling the requirement fixed.
- */
-export declare const HARD_MAX_SUBAGENTS: 10;
-export declare const DEFAULT_TEAM_CONFIG: TeamConfig;
-/**
- * THE single gate for every team-config read AND write, mirroring
- * `clampSkillsConfig` / `clampLogConfig` for the reason those two record:
- * hardening only the read path leaves a bad value on disk that reverts to the
- * default on every launch, which presents to the user as "my setting won't
- * stick".
- *
- * `maxConcurrent` is additionally capped at `maxSubagents`: a pool wider than
- * the population it draws from is not wrong so much as meaningless, and letting
- * the two disagree would make the panel's `n/m` readout confusing for no gain.
- */
-export declare function clampTeamConfig(raw: unknown): TeamConfig;
-/**
- * The team ceilings cli <= 0.6.16 (7a6bf5630) persisted as its OWN defaults:
- * every user who touched team mode back then still carries this exact triple
- * in config.json, because `resolveTeamConfig` merges file values verbatim and
- * no migration ever rewrote them. They are the kill ceilings behind F-8's
- * "first block all failed" dispatches, so loading rewrites them to 0 (= no
- * ceiling, the shipped default since 2ff15a9c3).
- *
- * EXACT-EQUALITY ONLY: a value that differs was a deliberate user choice and
- * survives untouched. The price of that test is that a user who hand-types
- * 300000 today is migrated to 0 too - the accepted trade, and the safe
- * direction (no ceiling, not a cliff).
- */
-export declare const LEGACY_TEAM_CEILING_DEFAULTS: Readonly<{
-    subagentTimeoutMs: number;
-    dispatchTimeoutMs: number;
-    maxTurnsPerSubagent: number;
-}>;
-/**
- * The `{ key: 0 }` patch for legacy-default-equal ceilings, or `null` when
- * nothing matches. Pure on purpose: `loadConfig` decides WHERE the patch is
- * applied and persisted; this function only answers WHICH keys match, so the
- * equality test lives beside the constants it reads.
- */
-export declare function legacyTeamCeilingPatch(raw: unknown): Partial<TeamConfig> | null;
-/**
- * The fan-out defaults cli <= 0.6.x persisted as its OWN defaults
- * (subagent-fanout F-2 / R-1).
- *
- * THE SAME TRAP AS THE CEILINGS ABOVE, ONE SECTION OVER. `mergePersistedConfig`
- * writes the WHOLE `team` section on every save, so a user who has ever touched
- * any setting carries this exact pair in `config.json` - changing
- * `DEFAULT_TEAM_CONFIG` alone would never reach them, and they would keep
- * seeing "only 3 subagents at once" for ever.
- */
-export declare const LEGACY_TEAM_FANOUT_DEFAULTS: {
-    readonly maxSubagents: 5;
-    readonly maxConcurrent: 3;
-};
-/**
- * The `{ maxSubagents, maxConcurrent, fanoutMigrated }` patch for the legacy
- * default pair, or `null` when nothing matches (subagent-fanout D-3).
- *
- * EXACT-EQUALITY ONLY, the rule `legacyTeamCeilingPatch` records: a value that
- * differs was a deliberate user choice and survives untouched. Two differences
- * from that function, both deliberate:
- *
- *  - `fanoutMigrated: true` short-circuits to `null`. That is what makes "the
- *    user changed their mind and went back to 5/3" stick: without it the next
- *    launch would migrate them again, every launch, for ever.
- *  - `maxConcurrent` is allowed to be ABSENT as well as 3, because a
- *    hand-written section may name only one key and a half-written pair is
- *    still the legacy intent, not a user decision.
- *
- * Pure on purpose: `loadConfig` decides WHERE the patch is applied and
- * persisted; this function only answers WHICH keys match, so the equality test
- * lives beside the constants it reads.
- */
-export declare function legacyTeamFanoutPatch(raw: unknown): Partial<TeamConfig> | null;
-export interface TodoConfig {
-    /** Register `todo_write` at all. Default TRUE. */
-    enabled: boolean;
-    /**
-     * Render the right rail.
-     *
-     * INDEPENDENT OF `enabled` ON PURPOSE (D-16): a screen-reader user wants the
-     * planning discipline without the column, and the prompt block varies one
-     * sentence rather than disappearing (§3.7).
-     */
-    panel: boolean;
-    /**
-     * What happens when a run ends with unfinished steps
-     * (todo-plan-followthrough §4.1). Default `'notify'`, which reproduces round
-     * 1's behaviour byte for byte.
-     *
-     * THE THIRD SCALAR, and it stays a scalar for the reason the section header
-     * above gives: `store.ts` merges this section BY HAND, and both of its merges
-     * spread the whole object (`{ ...DEFAULT_CONFIG.todo, ...(partial.todo ?? {}) }`
-     * and `{ ...current.todo, ...(patch.todo ?? {}) }`), so a third scalar key is
-     * carried automatically and needs no change there. A NESTED field would not
-     * be, and would mean replacing both merges first.
-     */
-    followThrough: FollowThroughMode;
-    /**
-     * Must a plan also declare acceptance criteria, and does the UI show them
-     * (todo-acceptance-criteria §6.8.1). Default TRUE.
-     *
-     * THE FOURTH SCALAR, and it is a scalar for exactly the reason above: both
-     * hand-written merges in `config/store.ts` spread the whole `todo` object, so a
-     * new scalar key flows through them automatically. `clampTodoConfig` below is the
-     * only other place that has to know about it - a value that is missing THERE
-     * would silently keep the default and make `--no-todo-acceptance` look broken.
-     */
-    acceptance: boolean;
-}
-export declare const DEFAULT_TODO_CONFIG: TodoConfig;
-/**
- * THE single gate for every todo-config read AND write, mirroring
- * `clampSkillsConfig` / `clampLogConfig` / `clampTeamConfig` for the reason
- * those record: hardening only the read path leaves a bad value on disk that
- * reverts to the default on every launch, which presents to the user as "my
- * setting won't stick".
- */
-export declare function clampTodoConfig(raw: unknown): TodoConfig;
-export interface RetryConfig {
-    /**
-     * The user's switch. KEPT SEPARATE FROM `maxRetries: 0` on purpose: `enabled`
-     * survives round-tripping through the settings screen, while `maxRetries: 0` is
-     * what `toRetryPolicy` produces from it. Folding them would make
-     * `/retry off; /retry on` forget the user's chosen count.
-     */
-    enabled: boolean;
-    /** Retries AFTER the initial attempt. `0` is the kill switch, not a typo. */
-    maxRetries: number;
-    initialDelayMs: number;
-    maxDelayMs: number;
-    /** Growth factor. THE ONLY FLOAT KEY in this section. */
-    multiplier: number;
-    jitter: boolean;
-    respectRetryAfter: boolean;
-    /** Wall-clock budget from the first failure of one request. */
-    maxElapsedMs: number;
-    /** Allow a restart after content has already streamed to the transcript. */
-    onPartialStream: boolean;
-}
-export declare const DEFAULT_RETRY_CONFIG: RetryConfig;
-/**
- * `hardMaxRetries` re-exported rather than re-spelled, for the reason
- * `HARD_MAX_SUBAGENTS` records: the ceiling is enforced in TWO places — here on
- * the config value, and again by `normalizePolicy` inside the engine — and two
- * copies of the same 20 is exactly how a hand-edited `config.json` ends up able
- * to raise a ceiling the mechanism fixed.
- */
-export declare const HARD_MAX_RETRIES: 20;
-/**
- * THE single gate for every retry-config read AND write, mirroring
- * `clampSkillsConfig` / `clampLogConfig` / `clampTeamConfig` / `clampTodoConfig`
- * for the reason those record: hardening only the read path leaves a bad value on
- * disk that reverts to the default on every launch, which presents to the user as
- * "my setting won't stick".
- *
- * Three invariants live inside the gate:
- *
- *  - `maxDelayMs = max(maxDelayMs, initialDelayMs)` — a ceiling under the floor
- *    makes the ladder a flat line and the countdown a lie.
- *  - `multiplier` goes through `clampNumber`, not `clampInt`: `2.5` is a
- *    legitimate factor and `coercePositiveInt` would floor it to 2.
- *  - `maxRetries` goes through `clampIntAllowingZero`. THIS IS THE ONE THAT SHIPS
- *    BROKEN WITHOUT IT (R-16): `clampInt` returns the fallback for `n <= 0`, so
- *    `clampRetryConfig({ maxRetries: 0 })` would yield 10 — the maximum instead
- *    of the minimum, silently, for the key that gates the whole feature.
- *
- * `maxElapsedMs` intentionally keeps plain `clampInt`: its floor is 10 000, so it
- * has no `0` to express.
- */
-export declare function clampRetryConfig(raw: unknown): RetryConfig;
-/**
- * `RetryConfig` (user intent) -> `RetryPolicy` (engine policy), or `null` for
- * "the user said no".
- *
- * `null` rather than a policy with `maxRetries: 0` because `ProviderRegistry`
- * short-circuits on a null policy and returns the adapter's iterator DIRECTLY —
- * an opted-out session is then allocation-identical to a pre-feature build.
- *
- * TOTAL, AND IT ACCEPTS A MISSING SECTION. `loadConfig` always supplies one, but
- * a `CliConfig` built by hand — every controller test in this package does exactly
- * that, and so would an embedder — legitimately omits it, and a `TypeError` from a
- * pure translation function is the wrong way to find out. Routing through
- * `clampRetryConfig` also means an out-of-range hand-built value can never reach
- * the engine, which is the same "one gate, both directions" rule every other
- * section in this file follows.
- */
-export declare function toRetryPolicy(cfg: RetryConfig | undefined): RetryPolicy | null;
-export interface FastConfig {
-    /**
-     * Resolve the tier at all. Defaults to FALSE (R-d).
-     *
-     * OFF IS BYTE-IDENTICAL (I-2): with this false the system prompt, `task`'s
-     * schema, the tool array, the transcript, the status bar and the request
-     * payloads are exactly what a pre-feature build produces.
-     */
-    enabled: boolean;
-    /** `''` INHERITS the main provider — what makes `fast.model` alone a complete
-     *  configuration for the common "same vendor, cheaper model" case. */
-    provider: string;
-    /** The fast model id. Empty means NOT CONFIGURED, never "same as main": that
-     *  distinction is what keeps R-e (opt in to fast == main) from being
-     *  indistinguishable from a typo (D-4). */
-    model: string;
-    /** `''` inherits only when the provider matches — a base URL belongs to one
-     *  API, so a fast tier on a different vendor must not borrow it. */
-    baseUrl: string;
-    /** Applied to fast-tier children and to the review call. Defaults to `'off'`:
-     *  a "fast" model asked to think for 32 768 tokens is not fast (D-13). */
-    thinkingLevel: ThinkingLevel;
-    /** Run the periodic asynchronous review. */
-    review: boolean;
-    /** Completed turns between reviews. */
-    reviewEveryTurns: number;
-    /** Turn frames included in one digest. */
-    reviewContextTurns: number;
-    /** Ceiling on an injected critique, in characters. */
-    reviewMaxChars: number;
-    /**
-     * Reviews STARTED per session, across all runs (fast-model-tier-hardening
-     * §4.1 / W1).
-     *
-     * The one bound on spend the user never asked for. `reviewEveryTurns`
-     * controls the PACE; this controls the TOTAL — and the two are different
-     * questions, because a session is not one run. `reviewsThisRun` is reset by
-     * every user message, so thirty messages buys thirty runs' worth of reviews
-     * with nothing counting across them.
-     *
-     * DENOMINATED IN REVIEWS, NOT CURRENCY (D-H1). The fast tier is by
-     * construction the likeliest place in the product to name a model the static
-     * cost table has never seen, and `buildRuntimeModel` prices exactly those at
-     * zero (C-11) — so a dollar budget would silently never trigger for the
-     * configuration that most needs it. A count is exact for every model, and
-     * because per-review cost is already bounded on both sides (a 4 000-char
-     * digest in, 512 tokens out), `count x bound` is an honest ceiling.
-     */
-    reviewMaxPerSession: number;
-}
-export declare const DEFAULT_FAST_CONFIG: FastConfig;
-/**
- * THE single gate for every fast-config read AND write, mirroring
- * `clampSkillsConfig` / `clampLogConfig` / `clampTeamConfig` / `clampTodoConfig`
- * for the reason those four record: hardening only the read path leaves a bad
- * value on disk that reverts to the default on every launch, which presents to
- * the user as "my setting won't stick".
- *
- * `provider` is CLAMPED TO `''` rather than rejected when it names something
- * with no adapter. `''` means "inherit the main provider", which is the safe
- * reading of a typo — and `resolveFastTier` reports `no_adapter` for the case a
- * user really did configure a dead vendor as the MAIN one.
- */
-export declare function clampFastConfig(raw: unknown): FastConfig;
-/** `auto` installs; `notify` only reports; `off` disables the subsystem. */
-export declare const UPDATE_MODES: readonly ["auto", "notify", "off"];
-export type UpdateMode = (typeof UPDATE_MODES)[number];
-export declare function isUpdateMode(v: unknown): v is UpdateMode;
-export interface UpdateConfig {
-    /**
-     * Whether the updater installs, merely reports, or does nothing at all.
-     *
-     * DEFAULTS TO `'auto'`, and that is a PRODUCT decision rather than a technical
-     * one: this CLI's users are overwhelmingly on a stale version they did not
-     * choose. The trade it makes — a wider supply-chain window in exchange for
-     * users who are actually on the current release — is stated plainly in the
-     * README (R-1), and `'off'` plus `ARAGON_UPDATE=0` are the documented kill
-     * switches.
-     */
-    mode: UpdateMode;
-    /** Minimum wall-clock between registry checks, MACHINE-WIDE (§3.7). */
-    checkIntervalMs: number;
-    /** `''` = derive: `ARAGON_UPDATE_REGISTRY` › `npm_config_registry` › npmjs. */
-    registry: string;
-    /** The dist-tag to track. */
-    distTag: string;
-}
-export declare const DEFAULT_UPDATE_CONFIG: UpdateConfig;
-/**
- * THE single gate for every update-config read AND write, mirroring
- * `clampSkillsConfig` / `clampLogConfig` / `clampTeamConfig` / `clampTodoConfig`
- * / `clampRetryConfig` / `clampFastConfig` for the reason all six record:
- * hardening only the read path leaves a bad value on disk that reverts to the
- * default on every launch, which presents to the user as "my setting won't
- * stick".
- *
- * `registry` is CLAMPED TO `''` rather than rejected when it is not an
- * `http(s):` URL. `''` means "derive it" (§3.3), which is the safe reading of a
- * typo — the alternative is a background timer that throws on a value the user
- * cannot see it reading.
- */
-export declare function clampUpdateConfig(raw: unknown): UpdateConfig;
-export type CompactionFailureMode = 'truncate' | 'stop';
-export interface CompactionConfig {
-    /**
-     * Whether a `ContextManager` is constructed at all. Default TRUE.
-     *
-     * THE ONLY KEY IN THIS SECTION THAT DEFAULTS ON, AND THE ONLY ONE READ ONCE AT
-     * CONSTRUCTION — the `team.enabled` / `todo.enabled` / `fast.enabled` rule.
-     *
-     * IT DEFAULTS TO `true` UNLIKE EVERY OTHER OPTIONAL SUBSYSTEM HERE, and that is
-     * deliberate (D-16): `fast.enabled` and `team.enabled` default off because they
-     * ADD behaviour the user did not ask for. This one REMOVES a failure the user
-     * did not ask for — without it, the answer to a full context window is a dead
-     * run. Byte-identity is still honoured: `--no-compaction` constructs no
-     * manager, subscribes nothing, allocates no registry, and leaves the engine
-     * loop with `ctx.contextManager === undefined`.
-     */
-    enabled: boolean;
-    /** Occupancy ratio that triggers compaction. Read LIVE. */
-    threshold: number;
-    /**
-     * Where the status-bar gauge turns amber.
-     *
-     * CLAMPED JOINTLY WITH `threshold`, AND THE ORDER IS FIXED — see
-     * `clampCompactionConfig`. "Jointly" is not an instruction.
-     */
-    warnThreshold: number;
-    /** Complete turns kept verbatim in the tail. Read LIVE. */
-    keepRecentTurns: number;
-    /**
-     * Summarize with the fast tier when it resolves. Default TRUE.
-     *
-     * A PREFERENCE, NOT THE COMMON PATH (P2-8). `resolveFastTier` returns
-     * `{ok:false, reason:'disabled'}` on `fast.enabled !== true` alone, and
-     * `fast.enabled` defaults to `false` — so out of the box the summarizer is the
-     * SESSION'S OWN MODEL, and the first compaction is a ~30 k-token call on it.
-     */
-    useFastTier: boolean;
-    /** Legacy truncate remains readable; all failures now preserve history. */
-    onFailure: CompactionFailureMode;
-    /**
-     * Give `task` children their own compaction
-     * (context-auto-compaction-hardening §3.4 / W3). Default TRUE.
-     *
-     * IT REVERSES D-15, WHOSE PREMISE IS MEASURABLY FALSE at the configured bounds:
-     * D-15 measured `team.maxTurnsPerSubagent` 24 and `team.dispatchTimeoutMs`
-     * 900 000, where 24 turns over fifteen minutes is already the same profile
-     * as the lead run this feature exists for — and the parity defaults of
-     * 2ff15a9c3 later removed both ceilings (0 = no turn cap, no wall clock),
-     * which makes the premise falser still, not truer. When a child overflows
-     * today its history is discarded and the lead receives one partial sentence
-     * for the whole dispatch.
-     *
-     * `false` REPRODUCES ROUND 1 EXACTLY: `subagent.ts` spreads no `contextManager`
-     * key at all, so the child's loop gate tests an absent field.
-     */
-    subagents: boolean;
-    /**
-     * Write the dropped messages to `<home>/compaction/` before adopting a splice
-     * (context-auto-compaction-hardening §3.5 / W4). Default TRUE.
-     *
-     * NOT UNDO (§12): restoring an over-full history restores the condition that
-     * triggered the compaction. This is fidelity on disk, so "the summary is wrong
-     * and the agent proceeded on a false record" becomes something a human can
-     * check rather than something they must accept.
-     */
-    archive: boolean;
-}
-export declare const DEFAULT_COMPACTION_CONFIG: CompactionConfig;
-/**
- * THE single gate for every compaction-config read AND write, mirroring the six
- * clamps above for the reason all of them record: hardening only the read path
- * leaves a bad value on disk that reverts to the default on every launch, which
- * presents to the user as "my setting won't stick".
- *
- * THE ORDER IS FIXED AND IT MATTERS (§4.2 / P2-5). `threshold` is clamped to
- * `[0.5, 0.95]` FIRST, then `warnThreshold` to
- * `[0.4, clampedThreshold - 0.05]`. The other order lets a file holding
- * `{threshold: 0.6, warnThreshold: 0.9}` produce a warn mark ABOVE the trigger —
- * a gauge that turns amber after it has already gone red. Both bounds of the
- * second range stay reachable at the extremes: `threshold` floored at `0.5`
- * gives `warnThreshold` a range of `[0.4, 0.45]`.
- */
-export declare function clampCompactionConfig(raw: unknown): CompactionConfig;
-export interface BashConfig {
-    /**
-     * Register `bash_output` / `bash_kill`, honour `background`, splice the prompt
-     * block, render the chip. Default TRUE.
-     *
-     * READ ONCE AT CONSTRUCTION, the `team.enabled` / `todo.enabled` /
-     * `fast.enabled` rule.
-     *
-     * IT GOVERNS *SERVICES*, NEVER *INTERRUPTIBILITY* (I-2 / D-9). `Esc`/`Esc`,
-     * the foreground child registry and `forceStop()` are unconditional, because
-     * "bash always settles" and "Esc twice always works" are promised
-     * unconditionally — a user who turned background services off has not asked
-     * for a less interruptible agent.
-     */
-    background: boolean;
-    /**
-     * Let the classifier decide when the model did not say. Default TRUE.
-     *
-     * RESOLVES TO `false` WITHOUT AN INTERACTIVE VIEW (D-15 / P1-8), and that is
-     * decided at the tool layer rather than here: the value on disk is the user's
-     * preference, and headless has no card, no `/bg` and no user to keep a service
-     * alive, so the rescue would be a surprise instead. An explicit
-     * `background: true` is still honoured there — that one the model asked for.
-     */
-    autoBackground: boolean;
-    /** How long a background launch may block the turn before returning. */
-    startupSettleMs: number;
-    /** How long a service may stay `starting` before it is called `running`. */
-    readyTimeoutMs: number;
-}
-export declare const DEFAULT_BASH_CONFIG: BashConfig;
-/**
- * THE single gate for every bash-config read AND write, mirroring
- * `clampSkillsConfig` / `clampLogConfig` / `clampTeamConfig` / `clampTodoConfig`
- * for the reason those record: hardening only the read path leaves a bad value
- * on disk that reverts to the default on every launch, which presents to the
- * user as "my setting won't stick".
- *
- * CLAMPED, NEVER REJECTED — the discipline every other key in this file follows.
- * A garbage `startupSettleMs` resolves to 4000 and throws nothing.
- */
-export declare function clampBashConfig(raw: unknown): BashConfig;
-export interface JobsConfig {
-    /**
-     * Register `job_wait` / `job_list`, splice the `<background_jobs>` block,
-     * mirror job logs. Default TRUE.
-     *
-     * READ ONCE AT CONSTRUCTION, the `bash.background` / `team.enabled` rule. Its
-     * job is to be the single switch under which the tool array, the tool
-     * descriptions and the system prompt are BYTE-IDENTICAL to the pre-feature
-     * build (I-3) - which is why it is a registration switch and not a behaviour
-     * flag.
-     */
-    enabled: boolean;
-    /**
-     * Seconds one `job_wait` blocks by default. Default 30, range 5..1200.
-     *
-     * NOT CONVERGED AGAINST `toolTimeoutMs` ANY MORE (extended-job-wait I-4'): the
-     * executor gives `job_wait` its own ceiling and the idle watchdog is paused for
-     * the whole wait, so a long default no longer risks `Command timed out`.
-     */
-    waitSeconds: number;
-    /**
-     * Seconds without output before a job is reported `[stalled]`. Default 300,
-     * range 30..3600.
-     *
-     * A REPORT, NEVER AN ACTION: nothing kills or retries on this (R-13). The
-     * default is deliberately generous, because a training epoch that prints every
-     * five minutes is healthy.
-     */
-    stallSeconds: number;
-    /**
-     * Mirror each job's full output to `<home>/jobs/<session>/<id>.log`. Default
-     * TRUE; `false` creates no directory at all, for privacy- or IO-sensitive
-     * environments (D-6).
-     */
-    persistLog: boolean;
-    /**
-     * Whether a completion notice may STEER the running turn. Default TRUE.
-     *
-     * NOT A NOTICE SWITCH (§6.5). With this off, notices still arrive at the end of
-     * the next tool result and before the next user turn; only the active
-     * interruption stops. Turning notifications off entirely would require running
-     * no jobs.
-     */
-    noticeSteer: boolean;
-}
-export declare const DEFAULT_JOBS_CONFIG: JobsConfig;
-/**
- * THE single gate for every `jobs` read AND write, mirroring `clampBashConfig`
- * and the four sections before it.
- *
- * THE ELEVENTH SECTION, AND THE FIRST ONE THAT `config set` CAN REACH BY
- * NESTED KEY (§6.5). Every key is a SCALAR and the section is ONE level deep,
- * because `runConfigGet` splits on a single dot - a `jobs.mirror.enabled` would
- * resolve to `undefined` and the setting would silently never apply.
- */
-export declare function clampJobsConfig(raw: unknown): JobsConfig;
-/**
- * The quick-prompt library's three POLICY scalars (quick-prompt-library D-19).
- *
- * THE LIBRARY ITSELF IS NOT HERE (D-3). Two hundred prompts with bodies is user
- * content that grows with usage, and `ui-state.ts:5-13` already wrote the rule:
- * anything carrying user content opens its own file. `config.json` holds the three
- * decisions that are about BEHAVIOUR - whether the key exists, what a fill does to
- * a non-empty draft, and whether the header teaches the key.
- *
- * ONE LEVEL DEEP, like every section beside it: `runConfigGet` splits on a single
- * dot, so `prompts.hint` resolves and `prompts.some.nested` would not.
- */
-export interface PromptsConfig {
-    /**
-     * `false` stops `Ctrl+P` and the header hint; `/prompts` STAYS REGISTERED and
-     * reports that the feature is off (D-19 / AC-30). Removing the command as well
-     * would leave the one surface that can explain the switch unable to run.
-     */
-    enabled: boolean;
-    /**
-     * What a fill does to a draft that already has text in it (D-6).
-     * `insert` keeps the user's words; `replace` overwrites them.
-     */
-    insertMode: 'insert' | 'replace';
-}
-export declare const DEFAULT_PROMPTS_CONFIG: PromptsConfig;
-/**
- * THE single gate for every `prompts` read AND write, like the eleven sections
- * above it.
- *
- * An unrecognized `insertMode` falls back to `insert` rather than to `replace`,
- * and that direction is deliberate: a typo must never silently start DISCARDING
- * what the user has already typed into the composer.
- */
-export declare function clampPromptsConfig(raw: unknown): PromptsConfig;
-/**
- * The task label's two switches (tui-shortcut-drawer-and-task-summary §4.8).
- *
- * ONE LEVEL DEEP, like every section beside it: `runConfigGet` splits on a single
- * dot, so `taskSummary.enabled` resolves and a nested key would not (F-18).
- *
- * NEITHER KEY IS ABOUT THE LABEL'S CONTENT. `enabled` is the kill switch: off
- * means no call is made and no cell is drawn. `fallback` decides what happens when
- * the call cannot produce a label - the deterministic verbatim-prefix floor, or
- * nothing at all. Both are BEHAVIOUR, which is why they are here rather than in
- * `fast/limits.ts` (F-13).
- */
-export interface TaskSummaryConfig {
-    /** The kill switch. `false` removes the header cell and the automatic call. */
-    enabled: boolean;
-    /** The deterministic verbatim-prefix floor (D-9). `false` = show nothing instead. */
-    fallback: boolean;
-}
-export declare const DEFAULT_TASK_SUMMARY_CONFIG: TaskSummaryConfig;
-/**
- * THE single gate for every `taskSummary` read AND write, like the twelve sections
- * above it.
- *
- * BOTH DEFAULTS ARE `true`, AND THE DIRECTION MATTERS: a corrupt or hand-edited
- * section must not silently switch off a feature the user asked for, and - more
- * importantly - it must not switch off the FLOOR, which is the only thing standing
- * between a failed call and an empty header cell.
- */
-export declare function clampTaskSummaryConfig(raw: unknown): TaskSummaryConfig;
-/**
- * Parse `0.9`, `90%` or `90` into a ratio, or `null` when it is neither.
- *
- * `null` RATHER THAN A CLAMPED DEFAULT, because this is a COMMAND argument and
- * not a config value: `/compact threshold banana` must say so rather than
- * silently setting 0.9 and reporting success.
- */
-export declare function parseThresholdInput(raw: string): number | null;
-export interface PersistedConfig {
-    modelProfiles?: import('./model-profiles.js').ModelProfilesConfig;
-    version: number;
-    provider: string;
-    model: string;
-    baseUrl: string | null;
-    thinkingLevel: ThinkingLevel;
-    /**
-     * Whether the terminal DRAWS the reasoning that came back
-     * (agent-activity-presentation §4.1).
-     *
-     * ADJACENT TO `thinkingLevel` AND DELIBERATELY NAMED DIFFERENTLY: that key is
-     * the effort the provider is asked to SPEND, this one is whether the transcript
-     * shows it. They are one word apart in the config file and must never be
-     * confused, which is why the flag is `--show-thinking` rather than the shorter
-     * `--thinking` the existing key already resembles.
-     */
-    showThinking: boolean;
-    /**
-     * Whether a RUNNING tool card draws a bounded tail of its live output
-     * (agent-activity-presentation-live §4.1).
-     *
-     * DEFAULT `true`, unlike `showThinking` next door (D-28). That key hides
-     * information by default because reasoning is noise most of the time; this one
-     * ADDS the information the requirement asks for, and its cost is bounded by
-     * construction -- eight rows per call, sixteen calls, whatever the command
-     * emits. It exists as a KILL SWITCH, not as an opt-in: "a build's output
-     * redraws the transcript" is exactly the kind of change a user on a slow SSH
-     * link may want off.
-     */
-    liveToolOutput: boolean;
-    /**
-     * Output token cap.
-     *
-     *   a number — an explicit cap, clamped to `[256, 200000]` on the way in AND
-     *              on the way out, then clamped again at request time down to the
-     *              target model's real ceiling when that ceiling is lower.
-     *   `null`   — AUTO: use each model's own ceiling, never above 64000.
-     *   absent   — the product default, 64000.
-     *
-     * `null` MEANS AUTO. It used to resolve to 64000 by accident (`pick()` skips
-     * `null`), which left the user no way to express "let the model decide".
-     */
-    maxTokens: number | null;
-    /**
-     * The context window to measure occupancy against, or `null` for AUTO
-     * (context-usage-gauge-accuracy §3.6).
-     *
-     * `null` MEANS AUTO - the model table's window, or `buildRuntimeModel`'s 128k
-     * placeholder for a model the table has never seen. It exists because that
-     * placeholder is a FABRICATED denominator: on a custom `baseUrl` or an
-     * unlisted model id the gauge is a percentage of a number nobody supplied, and
-     * before this key there was no way to correct it. Setting it also removes the
-     * `?` marker from the absolute pair (I-6).
-     */
-    contextWindow: number | null;
-    theme: ThemeName;
-    /** Replace spinners with a static glyph for calmer, low-motion output. */
-    reducedMotion: boolean;
-    /** Full-screen TUI (still subject to the automatic downgrades in §4.1). */
-    /** Replay a plain-text session summary after leaving the alternate screen. */
-    exitTranscript: boolean;
-    /** Entries reachable by scrolling; older ones show the "collapsed" line (I-3). */
-    transcriptWindow: number;
-    /** Entries kept in `ViewState`; older ones are dropped and counted (L1). */
-    transcriptRetain: number;
-    /** Adaptive coalescing under load (L4). */
-    renderGovernor: boolean;
-    /** Ceiling of the governor ladder in ms; `33` flattens it (L4). */
-    maxRenderIntervalMs: number;
-    /** Repaint only the frame rows that changed (tui-input-flicker-fix §5.1). */
-    diffRender: boolean;
-    /** Native terminal scrolling vs the full-screen app layout (tui-native-terminal-scroll D1). */
-    scrollMode: ScrollMode;
-    /** Wrap each repaint batch in DEC 2026 synchronized update (§5.1). */
-    syncOutput: boolean;
-    confirmTools: boolean;
-    toolTimeoutMs: number;
-    idleTimeoutMs: number;
-    /** provider -> key. Masked in the UI; the file is written 0600 on POSIX. */
-    apiKeys: Record<string, string | null>;
-    /**
-     * Record submitted prompts to `<home>/prompt-history.jsonl` at all (D-9).
-     *
-     * A real preference, and the reason it belongs here rather than in
-     * `state.json`: the user declares it, and switching it off is a decision they
-     * expect to survive. Command-line only, like `log.redactSecrets` — there is
-     * no settings-screen entry, because it is set once and then forgotten.
-     */
-    historyEnabled: boolean;
-    /** Entry spacing: `comfortable` keeps a blank line at turn boundaries (§4.3). */
-    density: DensityMode;
-    /** Show the composer hint row at all. */
-    hints: boolean;
-    /**
-     * Enable SGR mouse reporting in full-screen mode so the wheel scrolls the
-     * transcript, whatever row the pointer is on (wheel-scrolls-transcript-only
-     * §4.1).
-     *
-     * A plain boolean: persisted values and per-run overrides use the same meaning.
-     */
-    mouse: boolean;
-    /**
-     * Drag-select + copy in full-screen mode (tui-selection-and-scroll-follow
-     * §6.1). Ignored when `mouse` is false; also decides whether `?1002h` is
-     * written at all, so `false` is byte-identical to a pre-feature session.
-     */
-    mouseSelect: boolean;
-    /**
-     * Recognise pasted text and collapse a large paste into a placeholder
-     * (tui-paste-handling D-10 / section 7.3).
-     *
-     * A PLAIN BOOLEAN and the ONLY user-facing key this feature adds: the collapse
-     * threshold and every size bound are structural and live in `input/limits.ts`
-     * / `ui/composer-limits.ts`. A tunable threshold is a preference nobody has
-     * asked for; a kill switch is what a bug report needs.
-     */
-    paste: boolean;
-    /**
-     * Ask the terminal to report modified keys distinctly so Shift+Enter can
-     * insert a newline (win32-input-mode on Windows, kitty disambiguate +
-     * modifyOtherKeys elsewhere). A KILL SWITCH in the exact sense `paste`
-     * above records: the encoding tables are structural and live in
-     * `input/win32-input-mode.ts` / `input/csiu-keys.ts`.
-     */
-    keyboardEnhancement: boolean;
-    /** Idle ms before a paused viewport returns to the newest line; `0` disables. */
-    scrollResumeMs: number;
-    /** Start every session in PLAN mode (plan-mode §4.4). */
-    planModeDefault: boolean;
-    /** Ceiling on a single human wait in ms; clamped to [60_000, 7_200_000]. */
-    planModeHumanTimeoutMs: number;
-    /** Skill system settings. The SECOND nested object in this file after apiKeys. */
-    skills: SkillsConfig;
-    /** Logging settings. The THIRD nested object; scalars only (see LogConfig). */
-    log: LogConfig;
-    /** Team mode. The FOURTH nested object; scalars only (see TeamConfig). */
-    team: TeamConfig;
-    /** Todo planning. The FIFTH nested object; scalars only (see TodoConfig). */
-    todo: TodoConfig;
-    /** API retry. The SIXTH nested object; scalars only (see RetryConfig). */
-    retry: RetryConfig;
-    /** Fast model tier. The SEVENTH nested object; scalars only (see FastConfig). */
-    fast: FastConfig;
-    /** Auto-update. The EIGHTH nested object; scalars only (see UpdateConfig). */
-    update: UpdateConfig;
-    /** Context compaction. The NINTH nested object; scalars only (see CompactionConfig). */
-    compaction: CompactionConfig;
-    /** Background services. The TENTH nested object; scalars only (see BashConfig). */
-    bash: BashConfig;
-    /** Background jobs and bounded waiting. The ELEVENTH; scalars only (see JobsConfig). */
-    jobs: JobsConfig;
-    /** Quick prompts. The TWELFTH; two scalars (see PromptsConfig). */
-    prompts: PromptsConfig;
-    /** The header task label. The THIRTEENTH; two scalars (see TaskSummaryConfig). */
-    taskSummary: TaskSummaryConfig;
-    /** Governance mode. The FOURTEENTH; scalars only (see GovernanceConfig). */
-    governance: GovernanceConfig;
-}
-export declare const DEFAULT_CONFIG: PersistedConfig;
-/**
- * Runtime state that used to be stored in `config.json` by mistake
- * (config-state-separation §4.5). Each one now lives in its own file:
- * `promptHistory` → `prompt-history.jsonl`, `submitCount` / `mouseNoticeSeen`
- * → `state.json`, and `recentModels` was dead — nothing ever wrote it.
- */
-export declare const LEGACY_STATE_KEYS: readonly ["promptHistory", "submitCount", "mouseNoticeSeen", "recentModels"];
-/**
- * THE single gate that keeps those keys out of `config.json`, and the one thing
- * in this change that cannot be skipped.
- *
- * `loadPersistedConfig()` merges `{ ...DEFAULT_CONFIG, ...partial }` where
- * `partial` is the raw parse of whatever is on disk. Removing the fields from
- * the interface therefore removes NOTHING from the file: the keys ride through
- * the spread and `updatePersistedConfig` writes them straight back. The user
- * deletes `promptHistory` by hand and watches it grow back.
- *
- * Applied on the READ side on purpose, which is what makes it self-healing:
- * every write goes read-strip-merge-write, so a hand-edited file, a downgrade
- * to 0.5.x and back, or a half-finished migration all converge on a clean file
- * at the next write. Same shape as `clampSkillsConfig` / `clampLogConfig` —
- * one door for both directions.
- */
-export declare function stripLegacyStateKeys<T extends object>(raw: T): T;
-/**
- * Config keys whose MEANING was removed, mapped to the explanation a user gets if
- * they still try to set one.
- *
- * SEPARATE FROM `LEGACY_STATE_KEYS`, because the disposition differs: those keys'
- * values were MOVED somewhere else, while these have nowhere to go — the feature
- * they configured no longer exists. Merging the two lists would erase that
- * difference at exactly the moment someone is reading the file to find out what
- * happened to their setting.
- *
- * Stripped on the READ side for the same reason `stripLegacyStateKeys` is:
- * `loadPersistedConfig()` merges `{ ...DEFAULT_CONFIG, ...partial }`, so a key
- * left on disk rides that spread into memory and `updatePersistedConfig` writes it
- * straight back. The user deletes the line, launches once, and watches it return.
- */
-export declare const RETIRED_CONFIG_KEYS: Readonly<Record<string, string>>;
-/**
- * THE single gate that keeps retired keys out of `config.json`. Applied on the
- * read side, so it is self-healing: every write is read-strip-merge-write, and a
- * hand-edited file, a downgrade to an older CLI and back, or a half-finished
- * migration all converge on a clean file at the next write.
- */
-export declare function stripRetiredConfigKeys<T extends object>(raw: T): T;
-export interface CliConfig {
-    /** A committed model snapshot failed to apply; no further requests may start. */
-    modelSettingsRestartRequired?: boolean;
-    modelProfiles?: import('./model-profiles.js').ModelProfilesConfig;
-    modelProfileState?: import('./model-profiles.js').ModelProfilesRuntime;
-    /**
-     * The SESSION kit (agent-model-kits D-5 / §7.2). RUNTIME-ONLY.
-     *
-     * IT IS NOT IN `PersistedConfig` AND IT NEVER WILL BE (I-5 / I-14): `ctrl+K`
-     * and `/kit use` promise "this session only", and that promise is worth more
-     * than a saved convenience - it is what makes "one keystroke changed my
-     * defaults" structurally impossible rather than merely unlikely.
-     *
-     * `held` is the only fact worth storing: WHICH slots still belong to the kit.
-     * The bindings are derivable, and a stored copy of them would be a second
-     * truth (I-7: every held slot must have been written into the live config).
-     */
-    sessionKit?: {
-        id: string;
-        held: import('./model-kits.js').KitSlot[];
-    };
-    apiKeyOverrideTarget?: {
-        provider: string;
-        baseUrl: string | null;
-    };
-    provider: string;
-    model: string;
-    baseUrl?: string;
-    thinkingLevel: ThinkingLevel;
-    /**
-     * Seeds `ViewState.thinkingVisible` on the first frame (§4.1 / P1-2).
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`. `App` reads `cfg.*`,
-     * where `cfg` is a `CliConfig`; a key added to the persisted shape alone would
-     * round-trip through `config set`, appear in `config list` — and never reach
-     * `initialViewState`. `--show-thinking` and `ARAGON_SHOW_THINKING` would parse
-     * and be discarded. Nothing would fail; the setting would simply do nothing.
-     */
-    showThinking: boolean;
-    /**
-     * Whether `AgentController` allocates the live-output store and binds
-     * `recordOutput` (agent-activity-presentation-live §4.1).
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason its
-     * neighbour records one comment up: the controller reads `config.*`, where
-     * `config` is a `CliConfig`, so a key added to the persisted shape alone would
-     * round-trip through `config set`, appear in `config list` -- and never reach
-     * the constructor. `--live-tool-output` and `ARAGON_LIVE_TOOL_OUTPUT` would
-     * parse and be discarded, with nothing failing.
-     */
-    liveToolOutput: boolean;
-    /** The resolved cap, or `undefined` for AUTO (per-model ceiling, ≤ 64000). */
-    maxTokens?: number;
-    /**
-     * The user's context-window override, or `null` for AUTO.
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason
-     * `showThinking` / `liveToolOutput` / `diffRender` each record above: the
-     * runtime reads `config.*`, where `config` is a `CliConfig`, so a key added to
-     * the persisted shape alone would round-trip through `config set`, appear in
-     * `config list` - and never reach `ContextMeter`. `ARAGON_CONTEXT_WINDOW`
-     * would parse and be discarded, with nothing failing.
-     */
-    contextWindow: number | null;
-    /**
-     * WHERE the override above came from, or `undefined` when there is none
-     * (profile-context-window §5.2). RUNTIME-ONLY, never persisted.
-     *
-     * THE CONTRACT IS AN IFF: `contextWindowOrigin !== undefined` exactly when
-     * `contextWindow !== null`. An explicit AUTO (profile set to auto,
-     * `config set contextWindow auto`, `ARAGON_CONTEXT_WINDOW=auto`) has value
-     * null, so its origin is undefined - "the user asserted this denominator"
-     * and "the user declared AUTO" are different facts, and the meter's
-     * override branch only ever sees the first.
-     */
-    contextWindowOrigin?: ContextWindowOrigin;
-    theme: ThemeName;
-    reducedMotion: boolean;
-    /** Replay a plain-text summary on exit (full-screen only — see §4.4). */
-    exitTranscript: boolean;
-    /** Entries reachable by scrolling; older ones show the "collapsed" line (I-3). */
-    transcriptWindow: number;
-    /**
-     * Entries kept in `ViewState` (L1).
-     *
-     * Resolved to be `>= transcriptWindow`: retaining fewer entries than the
-     * window can scroll to would silently make part of the window unreachable.
-     */
-    transcriptRetain: number;
-    /**
-     * What the user actually asked `transcriptRetain` to be, present ONLY when
-     * that value had to be raised (§5.1).
-     *
-     * A setting ignored without a word is the one failure mode this feature is
-     * not allowed to add: the eco chip, `/perf` and the dropped-entry line all
-     * exist so that nothing it does happens unannounced, and a config key
-     * overwritten in silence would be the exception. `undefined` means nothing
-     * was overridden, which is every default session.
-     */
-    transcriptRetainRequested?: number;
-    /** Adaptive coalescing under load (L4). */
-    renderGovernor: boolean;
-    /** Ceiling of the governor ladder in ms; `33` flattens it (L4). */
-    maxRenderIntervalMs: number;
-    /**
-     * Repaint only the frame rows that changed (tui-input-flicker-fix §5.1).
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason
-     * `showThinking` / `liveToolOutput` / `update` each record: `runInteractive`
-     * reads `config.diffRender`, where `config` is a `CliConfig`, so a key added to
-     * the persisted shape alone would round-trip through `config set`, appear in
-     * `config list` — and never reach the one gate that constructs the writer.
-     * `--no-diff-render` and `ARAGON_DIFF_RENDER=0` would parse and be discarded,
-     * with no compile error and no runtime error.
-     */
-    diffRender: boolean;
-    /**
-     * Native terminal scrolling vs the full-screen app layout
-     * (tui-native-terminal-scroll D1).
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason
-     * `diffRender` above records: `runInteractive` reads `config.scrollMode`, where
-     * `config` is a `CliConfig`, so a key added to the persisted shape alone would
-     * round-trip through `config set` and never reach the screen plan.
-     *
-     * OPTIONAL ON THIS SHAPE ONLY so the many hand-built `CliConfig` fixtures in the
-     * test suite stay valid without edits (I-S9); `loadConfig` always sets it and
-     * the one reader (`runInteractive`) falls back to `DEFAULT_SCROLL_MODE`.
-     */
-    scrollMode?: ScrollMode;
-    /** Wrap each repaint batch in DEC 2026 synchronized update (§5.1). */
-    syncOutput: boolean;
-    confirmTools: boolean;
-    toolTimeoutMs: number;
-    idleTimeoutMs: number;
-    /** provider -> resolved key (config-file key ?? provider env var). */
-    apiKeys: Record<string, string | undefined>;
-    /**
-     * Whether submitted prompts are recorded (D-9).
-     *
-     * The recall LIST is deliberately not here: its only consumer is one
-     * `useState` seed in `App.tsx`, and carrying it on `CliConfig` would make
-     * every `loadConfig()` — `aragon logs tail` and `aragon skills list`
-     * included — read a file it has no use for (D-4).
-     */
-    historyEnabled: boolean;
-    density: DensityMode;
-    hints: boolean;
-    /**
-     * Whether this session may enable SGR mouse reporting (full-screen + TTY
-     * only). Resolved by `resolveMouse` in `load.ts`.
-     */
-    mouse: boolean;
-    /**
-     * Whether this session may drag-select and copy.
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason
-     * `diffRender` above records at length: `runInteractive` reads
-     * `config.mouseSelect` — where `config` is a `CliConfig` — to decide the
-     * `?1002h` write, the controller and the `decorate` hook. A key added to the
-     * persisted shape alone would round-trip through `config set`, appear in
-     * `config list`, and never reach a single one of them.
-     */
-    mouseSelect: boolean;
-    /**
-     * Whether this session recognises pastes at all.
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason
-     * `mouseSelect` above records: `runInteractive` reads `config.paste` -- where
-     * `config` is a `CliConfig` -- to decide the filter's `paste` feature, the
-     * `?2004h` write and the `PasteBridge`. A key added to the persisted shape
-     * alone would round-trip through `config set`, appear in `config list`, and
-     * reach none of them.
-     */
-    paste: boolean;
-    /**
-     * Whether this session may push the keyboard-enhancement modes.
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason
-     * `paste` above records: `runInteractive` reads it -- where `config`
-     * is a `CliConfig` -- to decide the filter's `enhancedKeys` feature
-     * and the `enableKeyboardEnhancement` push.
-     */
-    keyboardEnhancement: boolean;
-    /** Idle ms before a paused viewport returns to the newest line; `0` disables. */
-    scrollResumeMs: number;
-    /**
-     * Whether this session opens in PLAN mode.
-     *
-     * Named for what it DOES rather than mirroring the persisted key: after
-     * resolution it is a resolved starting posture, not a preference, and the
-     * live mode from here on belongs to the controller.
-     */
-    startInPlanMode: boolean;
-    planModeHumanTimeoutMs: number;
-    skills: SkillsConfig;
-    /** Flag/env-only skill switches for this run (§7.5). Never persisted. */
-    skillsRuntime: SkillsRuntimeOptions;
-    /** Resolved logging settings; the authoritative input to `Logger.reconfigure`. */
-    log: LogConfig;
-    /**
-     * Resolved team-mode settings (team-subagents §3.10).
-     *
-     * `enabled` here decides whether `task` is REGISTERED, which happens once at
-     * construction and can never be undone (§4.5 / D-17). The live on/off switch
-     * `/team` flips is a separate flag on the controller.
-     */
-    team: TeamConfig;
-    /**
-     * Resolved todo-planning settings (todo-plan-execution §4.2).
-     *
-     * `enabled` here decides whether `todo_write` is REGISTERED, which happens
-     * once at construction and can never be undone (C-1). The live on/off switch
-     * `/todo` flips is a separate flag on the controller; `panel` is read at
-     * RENDER time through `controller.getConfig()`, which is why `/todo panel`
-     * must call `setTodoConfig` as well as persisting (P1-2).
-     */
-    todo: TodoConfig;
-    /**
-     * Resolved API-retry settings (llm-api-retry-backoff §6.2).
-     *
-     * Unlike `team.enabled` / `todo.enabled` this decides NOTHING at construction
-     * time: the policy lives on the `ProviderRegistry` and `setRetryConfig()`
-     * replaces it live, so `/retry off` takes effect in the running session. That is
-     * why the controller has no `retryRegistered` twin of the two flags above.
-     */
-    retry: RetryConfig;
-    /**
-     * Resolved fast-tier settings (fast-model-tier §4.2).
-     *
-     * `enabled` here decides `fastRegistered` — whether `task`'s schema carries a
-     * `model` property at all — which happens once at construction and can never
-     * be undone (C-2). The live on/off switch `/fast` flips is a separate flag on
-     * `FastWiring`.
-     *
-     * THE OTHER NINE KEYS ARE READ LIVE, and that is not the same statement.
-     * `provider` / `model` / `baseUrl` feed `resolveFastTier`, which is re-run on
-     * every config mutation (§3.2 rule 8 / RV-3) because `''` INHERITS from
-     * `config.provider` / `config.baseUrl` and those are rewritten by `/model`,
-     * `/provider`, `/reload` and the settings screen.
-     */
-    fast: FastConfig;
-    /**
-     * Resolved auto-update settings (cli-auto-update §4.1).
-     *
-     * `mode` here decides whether `runInteractive` CONSTRUCTS the service at all
-     * (§3.8), which is what makes `'off'` byte-identical to a pre-feature build:
-     * no timer, no file read, no socket. The other three keys are read by the
-     * service on every check, so a `/update off` mid-session stops the next one.
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason
-     * `showThinking` and `liveToolOutput` each record above: the gate reads
-     * `cfg.update`, where `cfg` is a `CliConfig`, so a key added to the persisted
-     * shape alone would round-trip through `config set`, appear in `config list` —
-     * and never reach the gate. `--no-update` and `ARAGON_UPDATE=0` would parse
-     * and be discarded, with no compile error and no runtime error.
-     */
-    update: UpdateConfig;
-    /**
-     * Resolved context-compaction settings (context-auto-compaction §4.2).
-     *
-     * `enabled` here decides whether `AgentController` CONSTRUCTS a
-     * `CompactionWiring` at all, which is what makes `false` byte-identical to a
-     * pre-feature build: no manager is passed to `new Agent({...})`, nothing is
-     * subscribed, no registry is allocated, and the loop's checkpoint is one `if`
-     * against an absent field. The other five keys are read LIVE on every use, so
-     * `/compact threshold 0.8` takes effect in the running session.
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason
-     * `showThinking`, `liveToolOutput`, `diffRender`, `mouseSelect` and `update`
-     * each record above: the controller and the compactor read `config.compaction`,
-     * where `config` is a `CliConfig`, so a key added to the persisted shape alone
-     * would round-trip through `config set`, appear in `config list` — and never
-     * reach either of them.
-     */
-    compaction: CompactionConfig;
-    /**
-     * Resolved background-service settings (background-service-supervision §5.4).
-     *
-     * `background` here decides whether `bash`'s schema carries a `background`
-     * property, whether `bash_output` / `bash_kill` are REGISTERED and whether
-     * `<background_services>` is spliced — all three at construction, and none of
-     * them undoable, the `team.enabled` / `todo.enabled` / `fast.enabled` rule.
-     * The other three keys are read LIVE.
-     *
-     * IT DOES NOT GATE THE INTERRUPT LADDER (I-2 / D-9). `ProcSupervisor` is
-     * constructed unconditionally, because `Esc`/`Esc` and the foreground registry
-     * are what make G2 and G3 true and those are promised whatever this says.
-     *
-     * IT MUST EXIST HERE AND NOT ONLY IN `PersistedConfig`, for the reason every
-     * section above records: the controller and `bash` read `config.bash`, where
-     * `config` is a `CliConfig`, so a key added to the persisted shape alone would
-     * round-trip through `config set`, appear in `config list` — and never reach
-     * either of them.
-     */
-    bash: BashConfig;
-    /**
-     * Background jobs and bounded waiting (long-task-jobs §6.5). The ELEVENTH
-     * nested object; five scalar keys, one level deep.
-     *
-     * ON `CliConfig` AS WELL AS `PersistedConfig`, for the reason every section
-     * above records: `AgentController` reads `config.jobs.waitSeconds` through a
-     * closure and `job_wait` reads it again at call time, so a key persisted and
-     * never projected would round-trip through `config set`, show up in
-     * `config list`, and change nothing.
-     *
-     * ONE LEVEL DEEP IS A HARD REQUIREMENT, NOT A PREFERENCE: `runConfigGet` splits
-     * `jobs.waitSeconds` on a single dot, so a nested sub-object would resolve to
-     * `undefined` and report an empty value for a setting that IS on disk.
-     */
-    jobs: JobsConfig;
-    /**
-     * Quick prompts (quick-prompt-library D-19). The TWELFTH nested object; three
-     * scalars, one level deep.
-     *
-     * ON `CliConfig` AS WELL AS `PersistedConfig`, for the reason every section above
-     * records: `App` reads `cfg.prompts?.enabled` / `.insertMode` from a
-     * `CliConfig`, so a key added to the persisted shape alone would round-trip
-     * through the `config` commands, appear in `config list`, and change nothing.
-     *
-     * OPTIONAL ON THIS SHAPE ONLY, and `loadConfig` always fills it. The reason is the
-     * one the `jobs` note above does not have to state: `CliConfig` is built by hand in
-     * ~20 test fixtures, and a REQUIRED section turns every one of them into a compile
-     * error for a feature none of them is about. The three readers then fall back to the
-     * DOCUMENTED defaults (`enabled: true`, `insertMode: 'insert'`, `hint: true`), so a
-     * missing section can only ever behave like a default session - never like a
-     * disabled or destructive one.
-     */
-    prompts?: PromptsConfig;
-    /**
-     * The header task label (tui-shortcut-drawer-and-task-summary §4.8). The
-     * THIRTEENTH nested object; two scalars, one level deep.
-     *
-     * OPTIONAL HERE FOR THE SAME REASON AS `prompts` ABOVE: `CliConfig` is built by
-     * hand in many fixtures, and every reader uses `!== false`, so a missing section
-     * behaves exactly like a default session (label on, floor on) rather than like a
-     * switched-off feature.
-     */
-    taskSummary?: TaskSummaryConfig;
-    /**
-     * Governance mode (governance-mode 11.1). The FOURTEENTH nested object; scalars only.
-     *
-     * OPTIONAL HERE FOR THE SAME REASON AS `prompts` / `taskSummary` ABOVE: `CliConfig` is built
-     * by hand in many fixtures, `loadConfig` always fills it, and readers treat a missing
-     * section as the documented defaults. `enabled` here (after env kill switch and
-     * `--no-governance`) decides whether governance tools are REGISTERED, once at construction.
-     */
-    governance?: GovernanceConfig;
-    /**
-     * The posture the session starts in (governance-mode 11.2): `--plan` / `planModeDefault`
-     * still decide `startInPlanMode` exactly as before, and `--govern` / `--plan-govern` win over
-     * them when governance is available. Optional on this shape for the fixture reason above;
-     * `loadConfig` always fills it. Without a governance flag it is `'plan'` when
-     * `startInPlanMode`, else `'build'`.
-     */
-    initialPosture?: Posture;
-    /**
-     * Lifetime submit count driving the composer hint fade (`HINT_FADE_AFTER`).
-     *
-     * Read from `<home>/state.json` rather than the config file. It stays on
-     * `CliConfig` — unlike the recall list — because it is one scalar that is
-     * already plumbed through `controller.getConfig()` / `setSubmitCount()` and
-     * read during render (D-4).
-     */
-    submitCount: number;
-    /** Working directory for tools (default `process.cwd()`, overridable). */
-    cwd: string;
-    /** Whether ANSI color is enabled. */
-    color: boolean;
-    /** Resolved color depth: TUI policy or non-interactive terminal detection. */
-    colorLevel?: 0 | 1 | 2 | 3;
-    /** TUI always enables Unicode; non-interactive output uses detection. */
-    unicode?: boolean;
-    /** One-shot `--api-key` override; applies to the active provider only. */
-    apiKeyOverride?: string;
-}
-/**
- * Coerce an arbitrary value into a positive integer, or `undefined`.
- *
- * Kept because callers outside this feature still use it, and deliberately
- * WITHOUT the range clamp so its behaviour for in-range values is byte-identical
- * to what it always was. New code wants `clampMaxTokens`.
- */
-export declare function coerceMaxTokens(v: unknown): number | undefined;
-/**
- * The accepted range for an explicit output cap.
- *
- * The floor is the engine's: below it a turn cannot produce a usable tool call.
- * The ceiling is a sanity bound on a hand-edited file, not a model limit — the
- * real per-model ceiling is applied later, by `resolveOutputTokens`.
- */
-export declare const MAX_TOKENS_RANGE: {
-    min: number;
-    max: number;
-};
-/** `auto`, an empty string and `0` all mean AUTO — "let the model decide". */
-export declare function isAutoToken(v: unknown): boolean;
-/**
- * THE single gate for every `maxTokens` read AND write, in the shape
- * `clampSkillsConfig` / `clampLogConfig` / `clampTeamConfig` already use.
- *
- * Both directions on purpose: hardening only the read path leaves a bad value on
- * disk that reverts to a default on every launch, which presents to the user as
- * "my setting won't stick".
- *
- * Returns `undefined` for AUTO and for anything unusable — the caller decides
- * which of the two it was, because they mean different things.
- */
-export declare function clampMaxTokens(v: unknown): number | undefined;
-/**
- * Parse text typed into the settings screen, a slash command, or `config set`.
- *
- * Distinguishes AUTO from "the user typed nonsense", which `clampMaxTokens`
- * cannot: both come back as `undefined` there, and treating a typo as AUTO would
- * silently discard the number the user meant to set.
- */
-export declare function parseMaxTokensInput(raw: string): {
-    kind: 'auto';
-} | {
-    kind: 'value';
-    value: number;
-    clamped: boolean;
-} | {
-    kind: 'invalid';
-};
-/** The product default, re-exported so the CLI never spells the number itself. */
-export declare const DEFAULT_MAX_TOKENS = 64000;
-/** Coerce a value into a positive integer with a fallback (for timeouts). */
-export declare function coercePositiveInt(v: unknown, fallback: number): number;
-/**
- * Mask a secret for display: keep a short prefix + suffix, redact the middle.
- * A short/empty key is fully redacted so the length is not leaked.
- *
- * The glyphs are parameters with ASCII defaults (spec §4.1 tier B). This module
- * has no terminal capabilities to consult, and the result is rendered in the
- * settings screen — which on a legacy `cmd.exe` used to show two question-mark
- * boxes where the redaction dots belonged. The UI passes its resolved glyphs;
- * every other caller gets output that is safe anywhere.
- */
-export declare function maskSecret(key: string | undefined | null, opts?: {
-    maskChar?: string;
-    ellipsis?: string;
-}): string;