@buildaharness/aielia 0.3.5 → 0.3.6

package/dist/cli-config.d.ts

@@ -18,10 +18,13 @@ export declare function isConfigKey(key: string): key is keyof AssistantConfig;
  * before this module existed (ASSISTANT_ENABLE_WEB/ASSISTANT_ENABLE_SHELL must be exactly "1").
  */
 export declare function envOverridesFromProcessEnv(env: NodeJS.ProcessEnv): Partial<AssistantConfig>;
+export declare function findInvalidNumericSettings(config: AssistantConfig): string[];
 /** Thrown by parseConfigValue on a value that doesn't fit the target key's type — cli.ts reports .message and leaves the config unchanged. */
 export declare class ConfigValueParseError extends Error {
 }
 /** Parses a raw `/config set <key> <value>` string into the type AssistantConfig[key] expects. */
 export declare function parseConfigValue(key: keyof AssistantConfig, raw: string): unknown;
+/** A URL with any user:password, and every query-string value, masked, so a credential embedded in proxyUrl is never printed. Text that is not a URL is returned unchanged. */
+export declare function redactUrlCredentials(text: string): string;
 /** Renders /config's full listing as a single multi-line string — cli.ts just console.logs the result. */
 export declare function formatConfigListing(config: AssistantConfig, overriddenKeys: ReadonlySet<keyof AssistantConfig>): string;

package/dist/cli-session.d.ts

@@ -7,11 +7,12 @@ import { GoalGraphState } from './goal-graph-service.js';
 import { UndoLogEntry } from './action-snapshot.js';
 import { UserFact } from './fact-extraction.js';
 /**
- * Pure formatting/logic backing cli.ts's session-level commands (/help, /status, /export,
- * /memory, /cost, /doctor) — split out so it's unit-testable without a real readline loop,
- * the same way cli-config.ts already is for the /config family. cli.ts stays thin glue
- * (reading live state, calling these, doing actual file I/O) on top of these functions.
+ * Text that came from the model, a tool result, a file or a web page must not reach the terminal raw: an
+ * embedded escape sequence can clear the screen, rewrite earlier lines (hiding what an approval prompt is
+ * really asking), set the window title or write the clipboard (OSC 52). Newlines and tabs survive; everything
+ * that could drive the terminal is removed. Plain text is returned unchanged.
  */
+export declare function stripTerminalControls(text: string): string;
 export interface CliCommandHelp {
     command: string;
     description: string;

package/dist/cli.d.ts

@@ -28,6 +28,12 @@ export interface RunCliOptions {
         id: string;
         status: TaskStatus;
     }[]) => void;
+    /**
+     * Called with true when a conversational turn starts being worked on and false when it has finished (in a
+     * `finally`, so also after an error) — including turns run as deferred follow-ups, which no `dispatchLine()`
+     * promise covers. The TUI's liveness indicator follows this rather than guessing from output events.
+     */
+    onTurnBusyChange?: (busy: boolean) => void;
     dataDir?: string;
     configStore?: ConfigStore;
     backend?: FsBackend;
@@ -97,6 +103,9 @@ export declare function runCli(options?: RunCliOptions): Promise<CliInstance>;
  * `runTuiApp` is imported dynamically so a disabled (the default) or non-TTY run never loads Ink
  * at all — `main()` behaves byte-for-byte as it does today in both those cases.
  */
+/** A reason the assistant refuses to start (invalid configuration, unusable environment): shown to the user verbatim, exit code 1. */
+export declare class StartupError extends Error {
+}
 export declare function main(argv?: readonly string[]): Promise<void>;
 /**
  * True when `entryArg` (a `process.argv[1]` value) refers to the same file as

package/dist/cli.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import "./bin-CjKpxDxl.js";
+import "./bin-BYRl4xXM.js";
 //# sourceMappingURL=cli.js.map

package/dist/config.d.ts

@@ -157,6 +157,8 @@ export interface AssistantConfig {
      * check, never the explicit `aielia update` command. CLI-only, like `tuiMode`.
      */
     updateCheck?: UpdateCheckMode;
+    /** Colour theme of the chat-ui/desktop window: 'system' (default, follows the OS), 'dark' or 'light'. The CLI ignores it. */
+    theme?: 'system' | 'dark' | 'light';
     /**
      * The project label newly captured project-scoped facts are tagged with, and the one
      * project-scoped facts are filtered against when building a turn's context (see

package/dist/debug-log.d.ts

@@ -5,12 +5,21 @@
  * caller opts into this explicitly (see PersonalAssistantOptions.onDebugLog) knowing it
  * carries real content, not just metadata.
  *
+ * `approval_request` is a state-changing action (write/shell/email) staged for the user's yes/no, and
+ * `approval_decision` is how that was resolved ('approved' or 'declined'); the executed result of an
+ * approved action is the separate `tool_call` entry, so a log reader can reconstruct the whole exchange.
+ *
+ * `next_steps` is the numbered list of suggestions printed under a reply (one entry per turn that produced any).
+ *
+ * `note` records a robustness action the loop took on its own (an empty final answer retried, or replaced by a
+ * deterministic fallback), so a log reader can see why a reply is not what the model first returned.
+ *
  * Split into its own file so both assistant.ts (user_message/assistant_reply kinds, emitted from
  * `turn()`) and agent-loop.ts (tool_call kind, emitted from the ReAct loop) can depend on it
  * without either owning the other.
  */
 export interface DebugLogEntry {
-    kind: 'user_message' | 'assistant_reply' | 'tool_call';
+    kind: 'user_message' | 'user_message_queued' | 'assistant_reply' | 'tool_call' | 'approval_request' | 'approval_decision' | 'note' | 'next_steps';
     sessionId: string;
     content: string;
 }

package/dist/email.d.ts

@@ -53,8 +53,10 @@ export interface ResendSenderOptions {
  */
 export declare function createResendSender(options: ResendSenderOptions): SendEmail;
 /**
- * One-line human-readable summary of a staged email, for the approval prompt and trace. Kept here
+ * Human-readable summary of a staged email, for the approval prompt and trace. Kept here
  * (not in agent-loop.ts) so the MCP server (file-tools-mcp-server.mjs) and the CLI can format the
- * same way without importing the loop.
+ * same way without importing the loop. The approver must see everything that will be sent: every
+ * recipient (Cc/Bcc included, since a hidden Bcc is a silent exfiltration channel) and the whole
+ * body, never a truncated preview.
  */
-export declare function formatEmailApprovalReason(message: Pick<EmailMessage, 'to' | 'subject' | 'body'>): string;
+export declare function formatEmailApprovalReason(message: Pick<EmailMessage, 'to' | 'subject' | 'body' | 'cc' | 'bcc'>): string;

package/dist/file-tools-mcp-server.mjs

@@ -86,7 +86,7 @@
  * logic without a real MCP client attached over stdio): node file-tools-mcp-server.mjs --test
  */
 
-import { readFile, writeFile, mkdir, readdir, realpath as fsRealpath, mkdtemp, rm } from 'node:fs/promises'
+import { readFile, writeFile, mkdir, readdir, realpath as fsRealpath, mkdtemp, rm, rename } from 'node:fs/promises'
 import { readFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -111,10 +111,16 @@ export class PathOutsideWorkspaceError extends Error {
   }
 }
 
+// Mirrors file-tools.ts's normalizePath: splits on both `/` and `\`, and treats a Windows drive-letter
+// prefix as absolute — otherwise a backslash-style `..\..\x` is one opaque segment here that never
+// pops, yet the real OS resolves it as a traversal.
 function normalizePath(path) {
-  const absolute = path.startsWith('/')
+  const driveMatch = /^([A-Za-z]:)[\\/]/.exec(path)
+  const absolute = driveMatch !== null || path.startsWith('/') || path.startsWith('\\')
+  const prefix = driveMatch ? driveMatch[1] : ''
+  const rest = driveMatch ? path.slice(driveMatch[0].length) : path
   const segments = []
-  for (const part of path.split('/')) {
+  for (const part of rest.split(/[\\/]/)) {
     if (part === '' || part === '.') continue
     if (part === '..') {
       if (segments.length > 0 && segments[segments.length - 1] !== '..') segments.pop()
@@ -123,12 +129,13 @@ function normalizePath(path) {
       segments.push(part)
     }
   }
-  return (absolute ? '/' : '') + segments.join('/')
+  return prefix + (absolute ? '/' : '') + segments.join('/')
 }
 
 export function resolveInWorkspace(workspaceRoot, requestedPath) {
   const root = normalizePath(workspaceRoot)
-  const combined = requestedPath.startsWith('/') ? requestedPath : `${root}/${requestedPath}`
+  const requestedIsAbsolute = /^[A-Za-z]:[\\/]/.test(requestedPath) || requestedPath.startsWith('/') || requestedPath.startsWith('\\')
+  const combined = requestedIsAbsolute ? requestedPath : `${root}/${requestedPath}`
   const resolved = normalizePath(combined)
   if (resolved !== root && !resolved.startsWith(`${root}/`)) {
     throw new PathOutsideWorkspaceError(requestedPath)
@@ -176,7 +183,18 @@ function isEnoent(err) {
 // once the current one resolves, instead of dropping it.
 let lastStagedIdThisProcess
 
-export async function stagePendingAction(workspaceRoot, payload) {
+// Two staging calls in flight at once (a client may issue tool calls concurrently) would both read the same
+// `lastStagedIdThisProcess` and both link it forward, so one link overwrote the other and that action was never
+// surfaced for approval. Staging is therefore serialized.
+let stagingChain = Promise.resolve()
+
+export function stagePendingAction(workspaceRoot, payload) {
+  const run = stagingChain.then(() => stagePendingActionNow(workspaceRoot, payload))
+  stagingChain = run.then(() => undefined, () => undefined)
+  return run
+}
+
+async function stagePendingActionNow(workspaceRoot, payload) {
   const id = randomUUID()
   const dir = `${workspaceRoot}/${PENDING_ACTIONS_DIR}`
   await mkdir(dir, { recursive: true })
@@ -375,7 +393,18 @@ function doRequestToolGate(port, payload, options) {
 // ── Trust boundary for fetched content — mirrors trust-tagging.ts ──────────
 
 export function wrapUntrusted(text) {
-  return `<untrusted_external_content>\n${text}\n</untrusted_external_content>`
+  // Same defanging as trust-tagging.ts: content cannot close (or re-open) the boundary itself.
+  // String scan, not a regex: this is a structural delimiter check, not a natural-language gate.
+  const safe = text
+    .split('<')
+    .map((part, i) => {
+      if (i === 0) return part
+      let rest = part.trimStart()
+      if (rest.startsWith('/')) rest = rest.slice(1).trimStart()
+      return rest.toLowerCase().startsWith('untrusted_external_content') ? '&lt;' + part : '<' + part
+    })
+    .join('')
+  return `<untrusted_external_content>\n${safe}\n</untrusted_external_content>`
 }
 
 // Reads the same canonical JSON trust-tagging.ts's own INJECTION_PATTERNS compiles from
@@ -427,17 +456,46 @@ function isPrivateIPv4(ip) {
   if (a === 172 && b >= 16 && b <= 31) return true // RFC1918
   if (a === 192 && b === 168) return true // RFC1918
   if (a === 169 && b === 254) return true // link-local, includes the 169.254.169.254 cloud metadata endpoint
+  if (a === 100 && b >= 64 && b <= 127) return true // carrier-grade NAT
+  if (a === 198 && (b === 18 || b === 19)) return true // benchmarking
+  if (a >= 224) return true // multicast, reserved, broadcast
   if (a === 0) return true // "this network"
   return false
 }
 
+// Same logic as web-fetch-core.ts's ipv6Groups/isPrivateIPv6 (kept in sync by hand, see file header).
+// Notably URL parsing serialises `[::ffff:127.0.0.1]` as `::ffff:7f00:1`, which the old dotted-quad-only
+// regex never matched — a literal-IP fetch of a mapped loopback address got through.
+function ipv6Groups(ip) {
+  let text = ip
+  const v4 = /(\d+\.\d+\.\d+\.\d+)$/.exec(text)
+  if (v4) {
+    const octets = v4[1].split('.').map(Number)
+    if (octets.some((o) => o > 255)) return null
+    text = `${text.slice(0, -v4[1].length)}${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`
+  }
+  const halves = text.split('::')
+  if (halves.length > 2) return null
+  const head = halves[0] === '' ? [] : halves[0].split(':')
+  const tail = halves.length === 2 && halves[1] !== '' ? halves[1].split(':') : []
+  const missing = 8 - head.length - tail.length
+  if (halves.length === 1 ? missing !== 0 : missing < 1) return null
+  const groups = [...head, ...Array(halves.length === 2 ? missing : 0).fill('0'), ...tail].map((g) => parseInt(g, 16))
+  if (groups.length !== 8 || groups.some((g) => Number.isNaN(g) || g < 0 || g > 0xffff)) return null
+  return groups
+}
+
 function isPrivateIPv6(ip) {
-  const normalized = ip.toLowerCase()
-  if (normalized === '::1' || normalized === '::') return true
-  if (normalized.startsWith('fe80:')) return true // link-local
-  if (normalized.startsWith('fc') || normalized.startsWith('fd')) return true // unique local, fc00::/7
-  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(normalized)
-  if (mapped) return isPrivateIPv4(mapped[1])
+  const groups = ipv6Groups(ip.toLowerCase().split('%')[0])
+  if (!groups) return true // unparseable: refuse rather than guess
+  const embeddedV4 = `${groups[6] >> 8}.${groups[6] & 0xff}.${groups[7] >> 8}.${groups[7] & 0xff}`
+  const firstFiveZero = groups.slice(0, 5).every((g) => g === 0)
+  if (firstFiveZero && groups[5] === 0 && groups[6] === 0 && (groups[7] === 0 || groups[7] === 1)) return true // :: and ::1
+  if (firstFiveZero && (groups[5] === 0xffff || groups[5] === 0)) return isPrivateIPv4(embeddedV4) // mapped / compatible
+  if (groups[0] === 0x64 && groups[1] === 0xff9b && groups.slice(2, 6).every((g) => g === 0)) return isPrivateIPv4(embeddedV4) // NAT64
+  if ((groups[0] & 0xffc0) === 0xfe80) return true // link-local fe80::/10
+  if ((groups[0] & 0xfe00) === 0xfc00) return true // unique local fc00::/7
+  if ((groups[0] & 0xff00) === 0xff00) return true // multicast
   return false
 }
 
@@ -457,6 +515,13 @@ export async function assertPublicHttpUrl(url) {
     throw new PrivateNetworkTargetError(url, `unsupported scheme "${parsed.protocol}"`)
   }
 
+  if (parsed.username || parsed.password) {
+    throw new PrivateNetworkTargetError(url, 'credentials in the URL are not allowed')
+  }
+  if (parsed.port && parsed.port !== '80' && parsed.port !== '443') {
+    throw new PrivateNetworkTargetError(url, `port "${parsed.port}" is not allowed (only 80/443)`)
+  }
+
   const hostname = stripBrackets(parsed.hostname)
   if (hostname === 'localhost') {
     throw new PrivateNetworkTargetError(url, '"localhost" resolves to a loopback address')
@@ -495,22 +560,72 @@ function truncateFetchedText(text) {
   return `${text.slice(0, MAX_FETCH_CHARS)}\n\n[... truncated at ${MAX_FETCH_CHARS} characters; the page is longer than shown here ...]`
 }
 
+const FETCH_TIMEOUT_MS = 10_000
+// Streamed-read ceiling (a lying/absent Content-Length must not force an unbounded download); mirrors
+// web-fetch-core.ts's DEFAULT_MAX_FETCH_BYTES.
+const MAX_FETCH_BYTES = 4 * MAX_FETCH_CHARS
+
+async function readCappedText(response, signal) {
+  const reader = response.body?.getReader()
+  if (!reader) return (await response.text()).slice(0, MAX_FETCH_BYTES)
+  const chunks = []
+  let total = 0
+  try {
+    while (total < MAX_FETCH_BYTES) {
+      if (signal.aborted) throw new Error('aborted')
+      const { done, value } = await new Promise((resolve, reject) => {
+        const onAbort = () => reject(new Error('aborted'))
+        signal.addEventListener('abort', onAbort, { once: true })
+        reader.read().then(
+          (r) => { signal.removeEventListener('abort', onAbort); resolve(r) },
+          (e) => { signal.removeEventListener('abort', onAbort); reject(e) },
+        )
+      })
+      if (done) break
+      chunks.push(value)
+      total += value.byteLength
+    }
+  } finally {
+    void reader.cancel().catch(() => {})
+  }
+  const merged = new Uint8Array(Math.min(total, MAX_FETCH_BYTES))
+  let offset = 0
+  for (const chunk of chunks) {
+    const room = merged.length - offset
+    if (room <= 0) break
+    merged.set(chunk.subarray(0, room), offset)
+    offset += Math.min(chunk.length, room)
+  }
+  return new TextDecoder('utf-8', { fatal: false }).decode(merged)
+}
+
 export async function fetchUrlSafely(url) {
   let currentUrl = url
   for (let redirect = 0; redirect <= MAX_REDIRECTS; redirect++) {
     await assertPublicHttpUrl(currentUrl)
-    const response = await fetch(currentUrl, { redirect: 'manual' })
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get('location')
-      if (!location) throw new Error(`Redirect response from "${currentUrl}" had no Location header`)
-      currentUrl = new URL(location, currentUrl).toString()
-      continue
+    // One timer bounds the headers and the body read, as in web-fetch-core.ts.
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS)
+    try {
+      const response = await fetch(currentUrl, { redirect: 'manual', signal: controller.signal })
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get('location')
+        await response.body?.cancel().catch(() => {})
+        if (!location) throw new Error(`Redirect response from "${currentUrl}" had no Location header`)
+        currentUrl = new URL(location, currentUrl).toString()
+        continue
+      }
+      const body = await readCappedText(response, controller.signal)
+      // Same rule as web-tools.ts's fetchUrlSafely: a 5xx is a server fault, not page content — an error the model and the
+      // parent's ControlState can see (a 4xx page stays content).
+      if (response.status >= 500) throw new Error(`HTTP ${response.status} from ${url}: ${body.slice(0, 200).trim()}`)
+      return truncateFetchedText(body)
+    } catch (err) {
+      if (controller.signal.aborted) throw new Error(`Timed out fetching "${currentUrl}" after ${FETCH_TIMEOUT_MS}ms`)
+      throw err
+    } finally {
+      clearTimeout(timer)
     }
-    const body = await response.text()
-    // Same rule as web-tools.ts's fetchUrlSafely: a 5xx is a server fault, not page content — an error the model and the
-    // parent's ControlState can see (a 4xx page stays content).
-    if (response.status >= 500) throw new Error(`HTTP ${response.status} from ${url}: ${body.slice(0, 200).trim()}`)
-    return truncateFetchedText(body)
   }
   throw new Error(`Too many redirects while fetching "${url}"`)
 }
@@ -623,14 +738,24 @@ async function readRemindersFile(remindersFile) {
 
 async function writeRemindersFile(remindersFile, reminders) {
   await mkdir(remindersFile.slice(0, remindersFile.lastIndexOf('/')), { recursive: true })
-  await writeFile(remindersFile, JSON.stringify({ key: REMINDERS_KEY, value: reminders }), 'utf-8')
+  // Write-then-rename so a crash mid-write cannot leave a truncated file that fails to parse on every later read.
+  const tmp = `${remindersFile}.tmp-${randomUUID()}`
+  await writeFile(tmp, JSON.stringify({ key: REMINDERS_KEY, value: reminders }), 'utf-8')
+  await rename(tmp, remindersFile)
 }
 
-export async function createReminder(remindersFile, rawText) {
-  const reminders = await readRemindersFile(remindersFile)
-  const record = { id: randomUUID(), rawText, createdAt: new Date().toISOString(), dueAt: null, done: false }
-  await writeRemindersFile(remindersFile, [...reminders, record])
-  return record
+// Concurrent create_reminder calls would each read the same list and the last write would drop the others.
+let reminderChain = Promise.resolve()
+
+export function createReminder(remindersFile, rawText) {
+  const run = reminderChain.then(async () => {
+    const reminders = await readRemindersFile(remindersFile)
+    const record = { id: randomUUID(), rawText, createdAt: new Date().toISOString(), dueAt: null, done: false }
+    await writeRemindersFile(remindersFile, [...reminders, record])
+    return record
+  })
+  reminderChain = run.then(() => undefined, () => undefined)
+  return run
 }
 
 async function main() {

package/dist/file-tools.d.ts

@@ -33,6 +33,8 @@ export declare function assertRealPathInWorkspace(backend: FsBackend, workspaceR
  * "nothing to diff against" signal `applyPendingAction`'s own `previousContent` uses.
  */
 export declare function readCurrentFileContent(backend: FsBackend, workspaceRoot: string, requestedPath: string): Promise<string | undefined>;
+/** A workspace file path in one comparable form: relative to the workspace root, no leading "./" or "/". Absolute paths inside the workspace and relative ones name the same file. */
+export declare function workspaceRelative(workspaceRoot: string, requestedPath: string): string;
 export declare const READ_FILE_TOOL: ToolDefinition;
 export declare const LIST_DIRECTORY_TOOL: ToolDefinition;
 export declare const WRITE_FILE_TOOL: ToolDefinition;

package/dist/git-exclude.d.ts

@@ -0,0 +1,9 @@
+/** Directories Aielia keeps inside the workspace for its own state. */
+export declare const AIELIA_STATE_DIRS: readonly [".pending-actions", ".undo-log", ".buildaharness"];
+/**
+ * Keeps Aielia's own state directories out of version control when the workspace is inside a git repo, by adding them to
+ * `<gitdir>/info/exclude` — the per-clone ignore file git itself provides for this. The user's tracked `.gitignore` is never
+ * touched, and a non-git directory is left exactly as it was. Idempotent and best-effort: returns the entries it added and
+ * never throws (a read-only .git must not stop the assistant from starting).
+ */
+export declare function excludeAieliaStateFromGit(workspaceRoot: string): string[];

package/dist/index.d.ts

@@ -34,7 +34,7 @@ export { braveSearch } from './web-search-provider.js';
 export type { BraveSearchOptions } from './web-search-provider.js';
 export { buildClaudePrompt, parseClaudeCliOutput, ALREADY_STAGED_ACTION_TOOL, stagedActionInput } from './claude-cli-prompt.js';
 export type { ParsedClaudeCliOutput } from './claude-cli-prompt.js';
-export { stripMcpToolPrefix, summarizeToolStep } from './tool-step.js';
+export { stripMcpToolPrefix, summarizeToolStep, summarizeSettledToolStep } from './tool-step.js';
 export type { AssistantToolStep } from './tool-step.js';
 export type { DecomposedTaskSpec } from './decomposition-classifier.js';
 export { detectHomogeneousBatchList } from './batch-list-detector.js';

package/dist/index.js

@@ -1,8 +1,8 @@
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-import { bi as parseModelJson, a0 as classifyRiskLexical } from "./provider-setup-LFsaTkpf.js";
-import { A, a, b, C, c, D, e, f, g, h, i, j, k, l, m, o, F, p, I, L, q, r, s, t, u, v, w, x, M, P, y, z, B, R, G, S, H, J, W, K, N, O, Q, T, U, V, X, Y, Z, _, $, a1, a2, a3, a4, a5, a6, a7, a8, a9, aa, ac, ad, ae, ag, ah, ai, aj, ak, al, am, an, ap, aq, ar, as, au, av, ax, ay, aA, aB, aD, aE, aH, aJ, aK, aL, aM, aO, aP, aQ, aR, aS, aT, aV, aW, aX, aY, aZ, a_, a$, b0, b1, b3, b4, b5, b6, b7, b8, b9, ba, bb, bc, bd, be, bg, bj, bk, bl, bn, bo, bp, bq, br, bs, bt, bu, bv, bw, bx, by, bz, bA, bB, bC, bD, bF, bG, bI, bJ, bK, bL, bM, bN, bO, bP } from "./provider-setup-LFsaTkpf.js";
+import { bj as parseModelJson, a0 as classifyRiskLexical } from "./provider-setup-CV3S_TAS.js";
+import { A, a, b, C, c, D, e, f, g, h, i, j, k, l, m, o, F, p, I, L, q, r, s, t, u, v, w, x, M, P, y, z, B, R, G, S, H, J, W, K, N, O, Q, T, U, V, X, Y, Z, _, $, a1, a2, a3, a4, a5, a6, a7, a8, a9, aa, ac, ad, ae, ag, ah, ai, aj, ak, al, am, ao, aq, ar, as, at, av, aw, ay, az, aB, aC, aE, aF, aI, aK, aL, aM, aN, aP, aQ, aR, aS, aT, aU, aW, aX, aY, aZ, a_, a$, b0, b1, b2, b4, b5, b6, b7, b8, b9, ba, bb, bc, bd, be, bf, bh, bk, bl, bm, bp, bq, br, bs, bt, bu, bv, bw, bx, by, bz, bA, bB, bC, bD, bE, bF, bH, bI, bK, bM, bN, bO, bP, bQ, bR, bS, bT } from "./provider-setup-CV3S_TAS.js";
 import { DEFAULT_LAYER_POLICY_MODE, MAX_OPTIONS_PER_QUESTION, MAX_QUESTIONS_PER_BATCH, MIN_OPTIONS_PER_QUESTION, validateAskResponse } from "@buildaharness/harness";
 const PLAN_SCHEMA = {
   type: "object",
@@ -217,82 +217,83 @@ export {
   ak as executeShellTool,
   al as executeWebTool,
   am as explicitEnvOverride,
-  an as findLayer,
-  ap as formatCostSummary,
-  aq as formatDoctorReport,
-  ar as formatEmailApprovalReason,
-  as as formatGoalGraphState,
-  au as formatLayerListing,
-  av as formatMemoryArchive,
-  ax as formatMemoryHistory,
-  ay as formatMemoryInjection,
-  aA as formatMemoryStatus,
-  aB as formatMemorySummary,
-  aD as formatPlanProgress,
-  aE as formatSearchResults,
-  aH as formatTranscriptMarkdown,
-  aJ as getProviderSetup,
-  aK as harnessGatePolicy,
-  aL as injectionDetectionEnabled,
-  aM as isAdaptivePolicyEnabled,
-  aO as isGoalGraphEnabled,
-  aP as isGoalGraphSuggestEnabled,
-  aQ as isLayerPolicyMode,
-  aR as isLikelyEmailAddress,
-  aS as isPlanGraphEnabled,
-  aT as isPolicyRecordingEnabled,
-  aV as isToggleable,
-  aW as lexicalActive,
-  aX as lexicalOffEnvValue,
-  aY as listTemplateNames,
-  aZ as loadActivePlan,
-  a_ as loadPendingAction,
-  a$ as loadTemplate,
-  b0 as lowerConfidenceSourceLines,
-  b1 as matchTemplateIfConfident,
-  b3 as memoryStatusChecks,
-  b4 as nextPendingTask,
-  b5 as nodeDisplayName,
-  b6 as nodeToLayer,
-  b7 as normalizeAmbiguityGuardMode,
-  b8 as normalizeAskMode,
-  b9 as normalizeGoalGraphMode,
-  ba as normalizeGoalGraphSuggestMode,
-  bb as normalizeLayerPolicyMode,
-  bc as normalizeOneLoopMode,
-  bd as normalizePlanGraphMode,
-  be as normalizePlanMode,
-  bg as parseClaudeCliOutput,
-  bj as pickTemplateForTask,
-  bk as planCompletionPct,
-  bl as planToSnapshot,
-  bn as resolveAmbiguityGuardMode,
-  bo as resolveAskMode,
-  bp as resolveConfig,
-  bq as resolveEscalationPlan,
-  br as resolveGoalGraphMode,
-  bs as resolveGoalGraphSuggestMode,
-  bt as resolveInWorkspace,
-  bu as resolveLayerPolicyMode,
-  bv as resolveLayerPolicyModeFromConfig,
-  bw as resolveLexicalMode,
-  bx as resolveLexicalOff,
-  by as resolveMemoryWriteMode,
-  bz as resolveOneLoopMode,
-  bA as resolvePlanGraphMode,
-  bB as resolvePlanMode,
-  bC as sanitizeLayerChoices,
-  bD as savePlan,
-  bF as stagePendingAction,
-  bG as stagedActionInput,
-  bI as stripMcpToolPrefix,
-  bJ as summarizeToolStep,
-  bK as syncHarnessLexicalEnv,
-  bL as testApiKey,
-  bM as turnPolicyBudget,
-  bN as updatePlanFromRun,
+  ao as findLayer,
+  aq as formatCostSummary,
+  ar as formatDoctorReport,
+  as as formatEmailApprovalReason,
+  at as formatGoalGraphState,
+  av as formatLayerListing,
+  aw as formatMemoryArchive,
+  ay as formatMemoryHistory,
+  az as formatMemoryInjection,
+  aB as formatMemoryStatus,
+  aC as formatMemorySummary,
+  aE as formatPlanProgress,
+  aF as formatSearchResults,
+  aI as formatTranscriptMarkdown,
+  aK as getProviderSetup,
+  aL as harnessGatePolicy,
+  aM as injectionDetectionEnabled,
+  aN as isAdaptivePolicyEnabled,
+  aP as isGoalGraphEnabled,
+  aQ as isGoalGraphSuggestEnabled,
+  aR as isLayerPolicyMode,
+  aS as isLikelyEmailAddress,
+  aT as isPlanGraphEnabled,
+  aU as isPolicyRecordingEnabled,
+  aW as isToggleable,
+  aX as lexicalActive,
+  aY as lexicalOffEnvValue,
+  aZ as listTemplateNames,
+  a_ as loadActivePlan,
+  a$ as loadPendingAction,
+  b0 as loadTemplate,
+  b1 as lowerConfidenceSourceLines,
+  b2 as matchTemplateIfConfident,
+  b4 as memoryStatusChecks,
+  b5 as nextPendingTask,
+  b6 as nodeDisplayName,
+  b7 as nodeToLayer,
+  b8 as normalizeAmbiguityGuardMode,
+  b9 as normalizeAskMode,
+  ba as normalizeGoalGraphMode,
+  bb as normalizeGoalGraphSuggestMode,
+  bc as normalizeLayerPolicyMode,
+  bd as normalizeOneLoopMode,
+  be as normalizePlanGraphMode,
+  bf as normalizePlanMode,
+  bh as parseClaudeCliOutput,
+  bk as pickTemplateForTask,
+  bl as planCompletionPct,
+  bm as planToSnapshot,
+  bp as resolveAmbiguityGuardMode,
+  bq as resolveAskMode,
+  br as resolveConfig,
+  bs as resolveEscalationPlan,
+  bt as resolveGoalGraphMode,
+  bu as resolveGoalGraphSuggestMode,
+  bv as resolveInWorkspace,
+  bw as resolveLayerPolicyMode,
+  bx as resolveLayerPolicyModeFromConfig,
+  by as resolveLexicalMode,
+  bz as resolveLexicalOff,
+  bA as resolveMemoryWriteMode,
+  bB as resolveOneLoopMode,
+  bC as resolvePlanGraphMode,
+  bD as resolvePlanMode,
+  bE as sanitizeLayerChoices,
+  bF as savePlan,
+  bH as stagePendingAction,
+  bI as stagedActionInput,
+  bK as stripMcpToolPrefix,
+  bM as summarizeSettledToolStep,
+  bN as summarizeToolStep,
+  bO as syncHarnessLexicalEnv,
+  bP as testApiKey,
+  bQ as turnPolicyBudget,
+  bR as updatePlanFromRun,
   validateAskResponse,
-  bO as validateConfig,
-  bP as withLayerChoice
+  bS as validateConfig,
+  bT as withLayerChoice
 };
 //# sourceMappingURL=index.js.map

package/dist/ink-select-prompt.d.ts

@@ -7,6 +7,8 @@ export interface SelectPromptProps {
     /** Called once, with the chosen option's `key` — either Enter on the highlighted row, or a direct keystroke matching an option's `key`. */
     onSubmit: (key: string) => void;
     isActive?: boolean;
+    /** Keys arriving within this many ms of the prompt appearing are ignored: a key typed ahead for the previous turn (an Enter, a 'y') must not answer a question the user has not seen yet. Default 0 (no guard). */
+    armDelayMs?: number;
 }
 /**
  * Phase 7 of the internal plan: an arrow-key + numbered/shortcut-key

package/dist/ink-test-render.d.ts

@@ -17,6 +17,8 @@ export interface TestInkInstance {
     lastFrame: () => string | undefined;
     /** See `TestStdout.fullOutput`'s doc comment — needed to assert on `<Static>` content. */
     fullOutput: () => string;
+    /** How many writes (frames and control sequences) the render has produced so far — constant while the UI is idle. */
+    writeCount: () => number;
     rerender: (tree: ReactElement) => void;
     unmount: () => void;
 }

package/dist/memory-service.d.ts

@@ -350,7 +350,13 @@ export declare class MemoryService {
      * (memory-write-gate.test.ts) asserts this is the only call in the file that writes the durable key.
      */
     private commitDurable;
+    /** Tail of the in-process chain serialising the audit log's read-modify-write (concurrent appends lost entries and reused seq numbers). */
+    private auditChain;
+    /** Same for the usage flush's read-modify-write of the fact stores. */
+    private flushChain;
+    private serialized;
     private appendAudit;
+    private appendAuditNow;
     /** `/memory history` — newest last; the last `limit` entries. */
     getAuditLog(limit?: number): Promise<AuditEntry[]>;
     /**
@@ -487,6 +493,7 @@ export declare class MemoryService {
     restoreArchivedFact(listIndex: number, sessionId?: string): Promise<UserFact | undefined>;
     /** Writes the batched `injectedCount`/`lastInjectedAt` updates collected by budgeted renders, to whichever store(s) hold each fact. A no-op (no writes) when nothing was rendered. */
     private flushInjectionUsage;
+    private flushInjectionUsageNow;
     /**
      * `/memory confirm <n>` — promotes the nth (1-based in `/memory`'s display, 0-based here) entry
      * in PENDING_CONFIRMATION_KEY to DURABLE_FACTS_KEY. Runs the same promotion-time check as
@@ -535,6 +542,7 @@ export declare class MemoryService {
     forgetArchived(index: number): Promise<UserFact | undefined>;
     /** Strips one fact's pre/post-images from the audit log (entries stay, marked `erased`, and can no longer be undone) and unlinks `supersedes` references to it. */
     private eraseFromAuditLog;
+    private eraseFromAuditLogNow;
     /** Read-only health snapshot (`/doctor`, memory panel). Never touches usage counters or the last-injection record. */
     getMemoryStatus(sessionId: string): Promise<MemoryStatus>;
     /** M3 (D4): `/memory forget digest <id>` or, with no id, every digest. Returns how many were removed. */