@aragon-agent/tui 0.0.0-stage → 0.0.1

package/dist/model/compaction/types.js

@@ -0,0 +1,22 @@
+/**
+ * CLI-local compaction shapes (context-auto-compaction §5.2 / §3.4.2).
+ *
+ * ASCII ONLY: `src/compaction/**` is inside the glyph scanner's scope.
+ *
+ * A CLI-LOCAL EVENT STREAM, like `FastEvent` / `TeamEvent` / `TodoEvent`, for
+ * the reason each of those records: core's `AgentEvent` union is a public
+ * contract and must not learn host shapes.
+ *
+ * NOTE THE ASYMMETRY WITH CORE. Core emits the two ENGINE events because the
+ * engine is what performs the splice and decides `applied`; the CLI emits the
+ * richer ones because only the CLI knows the model name, the price and the
+ * session totals.
+ *
+ * THIS STREAM IS THE SOLE SOURCE OF REDUCER ACTIONS (D-20 / P1-6), and
+ * `reduceEvent` gains NO cases for `compaction_start` / `compaction_end`. One
+ * compaction arriving through two channels is two transcript cards and a doubled
+ * `tokensReclaimed`; `reduceEvent`'s `default: return []` is already exactly
+ * right for the two core events, which makes "one authority" also the smallest
+ * possible change.
+ */
+export {};

package/dist/model/config/governance-config.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Governance-mode configuration (governance-mode sections 11.1 / 13.2).
+ *
+ * LIVES IN ITS OWN FILE, NOT IN `schema.ts`: that file is far past the repo's
+ * 1000-line limit, and a section whose clamp depends on nothing else in it has no
+ * reason to grow it. `schema.ts` imports and re-exports everything below, so every
+ * importer still reaches the section through `config/schema.js`.
+ *
+ * SELF-CONTAINED ON PURPOSE. The integer/boolean helpers in `schema.ts` are private,
+ * and importing back from it would make a cycle (`schema.ts` re-exports this file).
+ * The two helpers here are four lines each.
+ *
+ * ASCII ONLY: `src/config/**` is inside the glyph scanner's scope.
+ */
+import type { Posture } from '../governance/posture.js';
+import { type ProfileId } from '../governance/types.js';
+export interface GovernanceConfig {
+    /** `false` => the feature is absent: no tools, no prompt blocks, no posture. */
+    enabled: boolean;
+    /** `false` => Shift+Tab stays BUILD<->PLAN; `/gov` still works. */
+    shiftTab: boolean;
+    /** `false` => the status chip only, no legion panel. */
+    panel: boolean;
+    /** Domain profile that names the roles' focus areas. */
+    profile: ProfileId;
+    /** 1..8. Work packages per run. */
+    maxWorkPackages: number;
+    /** 1..6. Phases per run. */
+    maxPhases: number;
+    /** 1..5. Rework rounds per work package. */
+    maxRework: number;
+    /** 1..5. Fix cycles per phase. */
+    maxFixCycles: number;
+    /** 0..5. Question rounds before PLAN+GOVERN may submit a plan. */
+    minAskRounds: number;
+    /** 0..1_000_000_000. Token budget per run; `0` = unlimited. */
+    budgetTokens: number;
+    /** `true` => the user approves the run charter before any dispatch. */
+    confirmCharter: boolean;
+}
+export declare const DEFAULT_GOVERNANCE_CONFIG: GovernanceConfig;
+type NumericKey = 'maxWorkPackages' | 'maxPhases' | 'maxRework' | 'maxFixCycles' | 'minAskRounds' | 'budgetTokens';
+/** The numeric keys, in display order; shared with the settings and `config` surfaces. */
+export declare const GOVERNANCE_NUMERIC_KEYS: readonly NumericKey[];
+/** The inclusive range a numeric key is clamped to. */
+export declare function governanceRangeOf(key: NumericKey): {
+    min: number;
+    max: number;
+};
+/**
+ * THE single gate for every governance-config read AND write, mirroring
+ * `clampTeamConfig` for the reason that one records: hardening only the read path
+ * leaves a bad value on disk that the read path then rewrites on every launch, which
+ * presents to the user as "my setting won't stick". Unknown keys are dropped.
+ */
+export declare function clampGovernanceConfig(raw: unknown): GovernanceConfig;
+/**
+ * `ARAGON_GOVERNANCE=0` is a KILL switch, not a toggle: it can only disable. Any other
+ * value (including `1`) is ignored, so an environment can never switch a feature ON that
+ * the user's config or a `--no-governance` flag turned off.
+ *
+ * Takes the env as a parameter so tests and `doctor` do not touch `process.env`.
+ */
+export declare function isGovernanceEnvDisabled(env?: Readonly<Record<string, string | undefined>>): boolean;
+/**
+ * The config-level reasons governance can be unavailable. A SUBSET of the
+ * `GovernanceUnavailableReason` vocabulary in `governance/copy.ts` (the controller adds
+ * `no_api_key`, `headless`, `restart_required` at runtime); the codes are spelled
+ * identically so the integration can unify the two without renaming anything.
+ */
+export type GovernanceConfigUnavailableReason = 'disabled_config' | 'disabled_env' | 'team_off';
+export type GovernanceConfigAvailability = {
+    ok: true;
+} | {
+    ok: false;
+    reason: GovernanceConfigUnavailableReason;
+};
+/**
+ * Config-only availability, in precedence order: the environment kill switch first (it is
+ * the strongest), then the config key, then the team dependency. Pure: no I/O.
+ */
+export declare function describeGovernanceConfigAvailability(config: {
+    governance?: Pick<GovernanceConfig, 'enabled'>;
+    team: {
+        enabled: boolean;
+    };
+}, env?: Readonly<Record<string, string | undefined>>): GovernanceConfigAvailability;
+/**
+ * Merge the `governance` section across the layers (defaults > file > env > flag).
+ *
+ * The environment and `--no-governance` layers can ONLY switch `enabled` off (they are kill
+ * switches), and they are applied last so nothing in the file can outvote them. The flag is a
+ * launch-only override: it is resolved here into the in-memory config and never reaches the
+ * store, which is what "not persisted" means.
+ */
+export declare function resolveGovernanceConfig(layers: {
+    file?: unknown;
+    env?: unknown;
+    disableForLaunch?: boolean;
+}): GovernanceConfig;
+export interface InitialPostureInput {
+    /** `--govern`. */
+    govern?: boolean;
+    /** `--plan-govern`. Wins over `govern` if a programmatic caller passes both. */
+    planGovern?: boolean;
+    /** The already-resolved `--plan` / `planModeDefault` result (unchanged by governance). */
+    startInPlanMode: boolean;
+    governance: Pick<GovernanceConfig, 'enabled'>;
+    teamEnabled: boolean;
+}
+export interface InitialPostureResolution {
+    posture: Posture;
+    /** Set when a governance posture was requested but could not be honoured. */
+    degradedReason?: GovernanceConfigUnavailableReason;
+}
+/**
+ * The posture the session starts in. Governance flags win over `--plan` / `planModeDefault`
+ * (a user who asked for a governed run did not ask for a plain one); when governance is
+ * unavailable at the CONFIG level the request degrades to the classic posture the same launch
+ * would have had, and the reason is returned so the caller can say so instead of silently
+ * dropping the flag. Without a governance flag this is exactly `startInPlanMode ? 'plan' :
+ * 'build'`, so `--plan` behaviour is untouched.
+ */
+export declare function resolveInitialPosture(input: InitialPostureInput, env?: Readonly<Record<string, string | undefined>>): InitialPostureResolution;
+export {};

package/dist/model/config/governance-config.js

@@ -0,0 +1,164 @@
+/**
+ * Governance-mode configuration (governance-mode sections 11.1 / 13.2).
+ *
+ * LIVES IN ITS OWN FILE, NOT IN `schema.ts`: that file is far past the repo's
+ * 1000-line limit, and a section whose clamp depends on nothing else in it has no
+ * reason to grow it. `schema.ts` imports and re-exports everything below, so every
+ * importer still reaches the section through `config/schema.js`.
+ *
+ * SELF-CONTAINED ON PURPOSE. The integer/boolean helpers in `schema.ts` are private,
+ * and importing back from it would make a cycle (`schema.ts` re-exports this file).
+ * The two helpers here are four lines each.
+ *
+ * ASCII ONLY: `src/config/**` is inside the glyph scanner's scope.
+ */
+import process from 'node:process';
+import { GOV_LIMITS } from '../governance/limits.js';
+import { PROFILE_IDS } from '../governance/types.js';
+export const DEFAULT_GOVERNANCE_CONFIG = {
+    enabled: true,
+    shiftTab: true,
+    panel: true,
+    profile: 'general',
+    maxWorkPackages: 4,
+    maxPhases: 3,
+    maxRework: 3,
+    maxFixCycles: 3,
+    minAskRounds: 2,
+    budgetTokens: 0,
+    confirmCharter: false,
+};
+/**
+ * Inclusive range per numeric key. The upper bounds of the four structural keys are
+ * `GOV_LIMITS.hardMax*` (NOT repeated here), so the clamp and the engine can never
+ * disagree: a hand-edited `config.json` cannot exceed what the engine enforces.
+ */
+const NUMERIC_RANGES = {
+    maxWorkPackages: { min: 1, max: GOV_LIMITS.hardMaxWorkPackages },
+    maxPhases: { min: 1, max: GOV_LIMITS.hardMaxPhases },
+    maxRework: { min: 1, max: GOV_LIMITS.hardMaxRework },
+    maxFixCycles: { min: 1, max: GOV_LIMITS.hardMaxFixCycles },
+    minAskRounds: { min: 0, max: 5 },
+    budgetTokens: { min: 0, max: 1_000_000_000 },
+};
+/** The numeric keys, in display order; shared with the settings and `config` surfaces. */
+export const GOVERNANCE_NUMERIC_KEYS = Object.keys(NUMERIC_RANGES);
+/** The inclusive range a numeric key is clamped to. */
+export function governanceRangeOf(key) {
+    return NUMERIC_RANGES[key];
+}
+/**
+ * Only a real, finite INTEGER survives. A float, NaN, a string ("2") or null is
+ * REPAIRED TO THE DEFAULT, not rounded or coerced: a hand-edited `maxRework: 2.5` has no
+ * defensible reading, and "typo changes nothing" is the discipline every sibling clamp
+ * follows. Out-of-range integers are clamped, not rejected.
+ */
+function clampRangedInt(value, key) {
+    const range = NUMERIC_RANGES[key];
+    const fallback = DEFAULT_GOVERNANCE_CONFIG[key];
+    if (typeof value !== 'number' || !Number.isInteger(value))
+        return fallback;
+    return Math.min(range.max, Math.max(range.min, value));
+}
+function pickBool(value, fallback) {
+    return typeof value === 'boolean' ? value : fallback;
+}
+function pickProfile(value) {
+    return typeof value === 'string' && PROFILE_IDS.includes(value)
+        ? value
+        : DEFAULT_GOVERNANCE_CONFIG.profile;
+}
+/**
+ * THE single gate for every governance-config read AND write, mirroring
+ * `clampTeamConfig` for the reason that one records: hardening only the read path
+ * leaves a bad value on disk that the read path then rewrites on every launch, which
+ * presents to the user as "my setting won't stick". Unknown keys are dropped.
+ */
+export function clampGovernanceConfig(raw) {
+    const src = (raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {});
+    const defaults = DEFAULT_GOVERNANCE_CONFIG;
+    return {
+        enabled: pickBool(src.enabled, defaults.enabled),
+        shiftTab: pickBool(src.shiftTab, defaults.shiftTab),
+        panel: pickBool(src.panel, defaults.panel),
+        profile: pickProfile(src.profile),
+        maxWorkPackages: clampRangedInt(src.maxWorkPackages, 'maxWorkPackages'),
+        maxPhases: clampRangedInt(src.maxPhases, 'maxPhases'),
+        maxRework: clampRangedInt(src.maxRework, 'maxRework'),
+        maxFixCycles: clampRangedInt(src.maxFixCycles, 'maxFixCycles'),
+        minAskRounds: clampRangedInt(src.minAskRounds, 'minAskRounds'),
+        budgetTokens: clampRangedInt(src.budgetTokens, 'budgetTokens'),
+        confirmCharter: pickBool(src.confirmCharter, defaults.confirmCharter),
+    };
+}
+// ---------------------------------------------------------------------------
+// Environment kill switch + availability (config-level part)
+// ---------------------------------------------------------------------------
+/** The spellings of "off" the kill switch accepts, matching the other ARAGON_* switches. */
+const ENV_OFF_VALUES = new Set(['0', 'false', 'off', 'no']);
+/**
+ * `ARAGON_GOVERNANCE=0` is a KILL switch, not a toggle: it can only disable. Any other
+ * value (including `1`) is ignored, so an environment can never switch a feature ON that
+ * the user's config or a `--no-governance` flag turned off.
+ *
+ * Takes the env as a parameter so tests and `doctor` do not touch `process.env`.
+ */
+export function isGovernanceEnvDisabled(env = process.env) {
+    const value = env.ARAGON_GOVERNANCE?.trim().toLowerCase();
+    return value !== undefined && ENV_OFF_VALUES.has(value);
+}
+/**
+ * Config-only availability, in precedence order: the environment kill switch first (it is
+ * the strongest), then the config key, then the team dependency. Pure: no I/O.
+ */
+export function describeGovernanceConfigAvailability(config, env = process.env) {
+    if (isGovernanceEnvDisabled(env))
+        return { ok: false, reason: 'disabled_env' };
+    if (config.governance?.enabled === false)
+        return { ok: false, reason: 'disabled_config' };
+    if (!config.team.enabled)
+        return { ok: false, reason: 'team_off' };
+    return { ok: true };
+}
+// ---------------------------------------------------------------------------
+// Launch resolution (load.ts calls these; kept here so load.ts barely grows)
+// ---------------------------------------------------------------------------
+/**
+ * Merge the `governance` section across the layers (defaults > file > env > flag).
+ *
+ * The environment and `--no-governance` layers can ONLY switch `enabled` off (they are kill
+ * switches), and they are applied last so nothing in the file can outvote them. The flag is a
+ * launch-only override: it is resolved here into the in-memory config and never reaches the
+ * store, which is what "not persisted" means.
+ */
+export function resolveGovernanceConfig(layers) {
+    return clampGovernanceConfig({
+        ...DEFAULT_GOVERNANCE_CONFIG,
+        ...(isPlainObject(layers.file) ? layers.file : {}),
+        ...(isPlainObject(layers.env) ? layers.env : {}),
+        ...(layers.disableForLaunch === true ? { enabled: false } : {}),
+    });
+}
+function isPlainObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * The posture the session starts in. Governance flags win over `--plan` / `planModeDefault`
+ * (a user who asked for a governed run did not ask for a plain one); when governance is
+ * unavailable at the CONFIG level the request degrades to the classic posture the same launch
+ * would have had, and the reason is returned so the caller can say so instead of silently
+ * dropping the flag. Without a governance flag this is exactly `startInPlanMode ? 'plan' :
+ * 'build'`, so `--plan` behaviour is untouched.
+ */
+export function resolveInitialPosture(input, env = process.env) {
+    const classic = input.startInPlanMode ? 'plan' : 'build';
+    const requested = input.planGovern === true
+        ? 'plan_govern'
+        : input.govern === true ? 'govern' : null;
+    if (requested === null)
+        return { posture: classic };
+    const availability = describeGovernanceConfigAvailability({ governance: input.governance, team: { enabled: input.teamEnabled } }, env);
+    return availability.ok
+        ? { posture: requested }
+        : { posture: classic, degradedReason: availability.reason };
+}

package/dist/model/config/kit-resolution.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Where the ACTIVE kit comes from, and the two places a session kit has to be
+ * re-applied (agent-model-kits §4.3 / D-5 / D-6).
+ *
+ * ASCII ONLY - `src/config/**` is inside `glyphs.test.ts::inScope`.
+ *
+ * ONE TRUTH, PURELY DERIVED. `CliConfig` carries only `sessionKit: {id, held}`;
+ * everything a surface prints about "which kit is running" comes out of
+ * `resolveActiveKit(config)`. There is no `config.activeKit` field, because a
+ * second copy of that answer is a copy that can disagree with the first.
+ */
+import type { CliConfig, FastConfig, TeamConfig } from './schema.js';
+import type { ModelProfilesConfig } from './model-profiles.js';
+import { type KitSlot, type SessionKitState } from './model-kits.js';
+/** The three slots, in the order every surface prints them. */
+export declare const ALL_SLOTS: readonly KitSlot[];
+/** The name the UI gives "no kit is in effect" (D-13). */
+export declare const CURRENT_SETUP_NAME = "Current setup";
+/**
+ * The answer when there is no kit, or when the host has no kit support at all.
+ *
+ * A CONSTANT SO CALLERS CANNOT INVENT A SECOND SHAPE: `App` needs one value that
+ * renders "no chip, `Current setup` row" for a controller that predates this
+ * port (a test double, an embedded host), and re-deriving it there would be a
+ * second definition of "nothing".
+ */
+export declare const INACTIVE_KIT: ActiveKit;
+export interface ActiveKit {
+    source: 'session' | 'default' | 'none';
+    id: string | null;
+    /** `Current setup` when `source === 'none'`. */
+    name: string;
+    /** `[]` when `source === 'none'`; all three for a default kit. */
+    held: KitSlot[];
+    /** The kit's definition and the live connections no longer agree (§4.8). */
+    modified: boolean;
+    /** Human-readable ASCII reasons, for `/kit` and the root row. */
+    driftReasons: string[];
+    /** Slots whose referenced profile is gone (RV-P1-1 / I-8). */
+    missingProfiles: KitSlot[];
+}
+/** The session-kit runtime shape, owned by `model-kits.ts` and re-exported here. */
+export type { SessionKitState } from './model-kits.js';
+/**
+ * Which kit is in effect, and whether it has drifted (§4.8).
+ *
+ * Precedence is D-6's: session kit, then the persisted default, then the disk
+ * bindings (which the UI calls `Current setup`).
+ */
+export declare function resolveActiveKit(config: CliConfig): ActiveKit;
+/**
+ * The minimum a candidate has to offer for the held slots to be re-applied.
+ *
+ * STRUCTURAL, NOT `PersistedConfig`: the same routine serves a disk candidate on
+ * its way to `liveCandidate` and a freshly reloaded `CliConfig`, and forcing
+ * either through a cast at the call site would hide the fact that only these
+ * three sections are ever written.
+ */
+export interface HeldTarget {
+    modelProfiles?: ModelProfilesConfig;
+    fast?: Partial<FastConfig>;
+    team?: Partial<TeamConfig>;
+}
+/**
+ * Re-apply the still-`held` slots of a session kit onto a candidate.
+ *
+ * THE RETURN VALUE MAY ONLY EVER FEED `liveCandidate`. It must NEVER be handed
+ * to `commitModelSettings` (I-14 / RV-P0-1): "this session only" is a claim
+ * about the FILE, and a held slot that reaches the commit turns one unrelated
+ * save into a permanent, invisible change of the user's defaults. The one
+ * caller is `prepareModelSettings` in `agent/model-profile-settings.ts`, which
+ * keeps the two candidates in separate variables for exactly this reason.
+ *
+ * Slots whose kit, or whose referenced profile, disappeared are DROPPED and
+ * reported, so the caller can log the release instead of silently forgetting it.
+ */
+export declare function applyHeldToLive<T extends HeldTarget>(candidate: T, sessionKit: SessionKitState | null | undefined): {
+    candidate: T;
+    dropped: KitSlot[];
+};
+/**
+ * Keep a session kit alive across `Reload settings` (D-6).
+ *
+ * THE PROJECTION HAS TO BE RECOMPUTED, not just the bindings: `I-3` says a
+ * library's projections never depend on whether a kit exists, so a live config
+ * whose `mainId` says "kit" while `provider`/`model` still name the reloaded
+ * file would break the equivalence every other surface relies on. Hence the
+ * round trip through `projectModelProfiles` + `resolveModelProfileState`.
+ */
+export declare function carrySessionKit(input: {
+    resolved: CliConfig;
+    previous: CliConfig;
+}): CliConfig;

package/dist/model/config/kit-resolution.js

@@ -0,0 +1,226 @@
+/**
+ * Where the ACTIVE kit comes from, and the two places a session kit has to be
+ * re-applied (agent-model-kits §4.3 / D-5 / D-6).
+ *
+ * ASCII ONLY - `src/config/**` is inside `glyphs.test.ts::inScope`.
+ *
+ * ONE TRUTH, PURELY DERIVED. `CliConfig` carries only `sessionKit: {id, held}`;
+ * everything a surface prints about "which kit is running" comes out of
+ * `resolveActiveKit(config)`. There is no `config.activeKit` field, because a
+ * second copy of that answer is a copy that can disagree with the first.
+ */
+import { getTuiLogger } from '../logging/log-port.js';
+import { normalizeProfileBaseUrl, projectModelProfiles, resolveModelProfileState } from './model-profile-resolution.js';
+import { findKit, kitCandidate, kitSlotConnections } from './model-kits.js';
+/** The three slots, in the order every surface prints them. */
+export const ALL_SLOTS = ['main', 'fast', 'subagent'];
+/** The name the UI gives "no kit is in effect" (D-13). */
+export const CURRENT_SETUP_NAME = 'Current setup';
+/**
+ * The answer when there is no kit, or when the host has no kit support at all.
+ *
+ * A CONSTANT SO CALLERS CANNOT INVENT A SECOND SHAPE: `App` needs one value that
+ * renders "no chip, `Current setup` row" for a controller that predates this
+ * port (a test double, an embedded host), and re-deriving it there would be a
+ * second definition of "nothing".
+ */
+export const INACTIVE_KIT = { source: 'none', id: null,
+    name: CURRENT_SETUP_NAME, held: [], modified: false, driftReasons: [],
+    missingProfiles: [] };
+function driftOfMain(config, connection) {
+    if (!connection)
+        return [];
+    const changed = [];
+    if (config.provider !== connection.provider)
+        changed.push('provider');
+    if (config.model !== connection.model)
+        changed.push('model');
+    if (normalizeProfileBaseUrl(config.baseUrl) !== normalizeProfileBaseUrl(connection.baseUrl)) {
+        changed.push('endpoint');
+    }
+    return changed.length ? [`main: ${changed.join(', ')} changed`] : [];
+}
+function driftOfFast(config, kit, connection) {
+    if (kit.fastProfileId === null) {
+        // D-8: this kit TURNS THE TIER OFF, so the endpoints are irrelevant - only
+        // "is it on" can disagree. Comparing endpoints here would report drift for
+        // every user who ever ran a fast tier before applying a fast-off kit.
+        return config.fast.enabled ? ['fast: turned back on'] : [];
+    }
+    if (!connection)
+        return [];
+    const changed = [];
+    if (!config.fast.enabled)
+        changed.push('off');
+    if (config.fast.provider !== connection.provider)
+        changed.push('provider');
+    if (config.fast.model !== connection.model)
+        changed.push('model');
+    if (normalizeProfileBaseUrl(config.fast.baseUrl)
+        !== normalizeProfileBaseUrl(connection.baseUrl))
+        changed.push('endpoint');
+    return changed.length ? [`fast: ${changed.join(', ')} changed`] : [];
+}
+function driftOfSubagent(config, kit, connection) {
+    if (!connection)
+        return [];
+    const sameMode = config.team?.model === kit.subagent.model;
+    const sameId = kit.subagent.model === 'profile'
+        ? (config.team?.modelProfileId ?? null) === kit.subagent.modelProfileId : true;
+    return sameMode && sameId ? [] : ['subagent: changed'];
+}
+function subagentConnection(config, kit) {
+    if (kit.subagent.model === 'profile')
+        return kit.subagent.modelProfileId;
+    return kit.subagent.model === 'main' ? 'main' : 'fast';
+}
+/** Build the verdict for a kit that exists, whatever installed it. */
+function describe(config, library, kit, source, held) {
+    const connections = kitSlotConnections(library, kit);
+    const drift = { reasons: [], missing: [] };
+    if (held.includes('main')) {
+        if (!connections.main)
+            drift.missing.push('main');
+        else
+            drift.reasons.push(...driftOfMain(config, connections.main));
+    }
+    if (held.includes('fast')) {
+        if (kit.fastProfileId !== null && !connections.fast)
+            drift.missing.push('fast');
+        else
+            drift.reasons.push(...driftOfFast(config, kit, connections.fast));
+    }
+    if (held.includes('subagent')) {
+        const missingProfile = kit.subagent.model === 'profile' && !connections.subagent.name;
+        if (missingProfile)
+            drift.missing.push('subagent');
+        else
+            drift.reasons.push(...driftOfSubagent(config, kit, subagentConnection(config, kit)));
+    }
+    if (held.length < ALL_SLOTS.length)
+        drift.reasons.push(`holds ${held.join('+') || 'nothing'}`);
+    return { source, id: kit.id, name: kit.name, held: [...held],
+        modified: held.length < ALL_SLOTS.length || drift.reasons.length > 0
+            || drift.missing.length > 0,
+        driftReasons: drift.reasons, missingProfiles: drift.missing };
+}
+/**
+ * Which kit is in effect, and whether it has drifted (§4.8).
+ *
+ * Precedence is D-6's: session kit, then the persisted default, then the disk
+ * bindings (which the UI calls `Current setup`).
+ */
+export function resolveActiveKit(config) {
+    const library = config.modelProfiles;
+    const state = config.sessionKit;
+    const session = state ? findKit(library, state.id) : undefined;
+    if (state && session) {
+        const held = state.held.filter((slot) => ALL_SLOTS.includes(slot));
+        return describe(config, library, session, 'session', held.length ? held : []);
+    }
+    const fallback = findKit(library, library?.defaultKitId ?? null);
+    if (library && fallback)
+        return describe(config, library, fallback, 'default', [...ALL_SLOTS]);
+    return { source: 'none', id: null, name: CURRENT_SETUP_NAME, held: [], modified: false,
+        driftReasons: [], missingProfiles: [] };
+}
+function slotSurvives(library, kit, slot) {
+    const ids = new Set(library.entries.map((entry) => entry.id));
+    if (slot === 'main')
+        return ids.has(kit.mainProfileId);
+    if (slot === 'fast')
+        return kit.fastProfileId === null || ids.has(kit.fastProfileId);
+    return kit.subagent.model !== 'profile'
+        || (!!kit.subagent.modelProfileId && ids.has(kit.subagent.modelProfileId));
+}
+/**
+ * Re-apply the still-`held` slots of a session kit onto a candidate.
+ *
+ * THE RETURN VALUE MAY ONLY EVER FEED `liveCandidate`. It must NEVER be handed
+ * to `commitModelSettings` (I-14 / RV-P0-1): "this session only" is a claim
+ * about the FILE, and a held slot that reaches the commit turns one unrelated
+ * save into a permanent, invisible change of the user's defaults. The one
+ * caller is `prepareModelSettings` in `agent/model-profile-settings.ts`, which
+ * keeps the two candidates in separate variables for exactly this reason.
+ *
+ * Slots whose kit, or whose referenced profile, disappeared are DROPPED and
+ * reported, so the caller can log the release instead of silently forgetting it.
+ */
+export function applyHeldToLive(candidate, sessionKit) {
+    const heldIn = sessionKit?.held ?? [];
+    if (!sessionKit || heldIn.length === 0)
+        return { candidate, dropped: [] };
+    const library = candidate.modelProfiles;
+    const kit = findKit(library, sessionKit.id);
+    if (!library || !kit)
+        return { candidate, dropped: [...heldIn] };
+    const held = heldIn.filter((slot) => slotSurvives(library, kit, slot));
+    const dropped = heldIn.filter((slot) => !held.includes(slot));
+    if (!held.length)
+        return { candidate, dropped };
+    const patch = kitCandidate({ library, kit });
+    const next = {
+        ...candidate,
+        modelProfiles: { ...library,
+            ...(held.includes('main') ? { mainId: kit.mainProfileId } : {}),
+            ...(held.includes('fast') ? { fastId: kit.fastProfileId } : {}) },
+    };
+    if (held.includes('subagent')) {
+        next.team = { ...candidate.team, ...patch.team };
+    }
+    if (held.includes('fast')) {
+        next.fast = { ...candidate.fast, enabled: kit.fastProfileId !== null };
+    }
+    return { candidate: next, dropped };
+}
+/**
+ * Keep a session kit alive across `Reload settings` (D-6).
+ *
+ * THE PROJECTION HAS TO BE RECOMPUTED, not just the bindings: `I-3` says a
+ * library's projections never depend on whether a kit exists, so a live config
+ * whose `mainId` says "kit" while `provider`/`model` still name the reloaded
+ * file would break the equivalence every other surface relies on. Hence the
+ * round trip through `projectModelProfiles` + `resolveModelProfileState`.
+ */
+export function carrySessionKit(input) {
+    const state = input.previous.sessionKit;
+    const { resolved } = input;
+    if (!state)
+        return resolved;
+    const library = resolved.modelProfiles;
+    const kit = findKit(library, state.id);
+    if (!library || !kit) {
+        getTuiLogger().warn('config', 'session_kit_released', { reason: 'kit_missing' });
+        return { ...resolved, sessionKit: undefined };
+    }
+    const applied = applyHeldToLive(resolved, state);
+    const held = state.held.filter((slot) => !applied.dropped.includes(slot));
+    if (!held.length) {
+        getTuiLogger().warn('config', 'session_kit_released', { reason: 'slots_dropped' });
+        return { ...resolved, sessionKit: undefined };
+    }
+    const file = applied.candidate;
+    const projected = projectModelProfiles(file).file;
+    const next = { ...resolved, modelProfiles: projected.modelProfiles };
+    if (held.includes('main')) {
+        next.provider = projected.provider;
+        next.model = projected.model;
+        next.baseUrl = projected.baseUrl ?? undefined;
+        if (next.contextWindowOrigin !== 'env') {
+            next.contextWindow = projected.contextWindow ?? null;
+            next.contextWindowOrigin = next.contextWindow === null ? undefined : 'profile';
+        }
+    }
+    if (held.includes('fast') && projected.fast) {
+        next.fast = { ...next.fast, provider: projected.fast.provider ?? '',
+            model: projected.fast.model ?? '', baseUrl: projected.fast.baseUrl ?? '' };
+    }
+    if (held.includes('subagent') && file.team)
+        next.team = { ...next.team, ...file.team };
+    next.modelProfileState = resolveModelProfileState(next);
+    next.sessionKit = { id: kit.id, held };
+    if (applied.dropped.length) {
+        getTuiLogger().warn('config', 'session_kit_slots_dropped', { slots: applied.dropped });
+    }
+    return next;
+}