@cruxy/cli 0.29.0 → 0.29.3

package/dist/config/owner-only.js

@@ -0,0 +1,114 @@
+import { execFileSync } from "node:child_process";
+import { chmodSync, statSync } from "node:fs";
+/**
+ * Cross-platform "owner-only" file/dir permissions — the one place that knows
+ * how to make a path readable by nobody but its owner, and how to check whether
+ * it already is.
+ *
+ * POSIX is `chmod` (`0600` file / `0700` dir). Windows has no POSIX modes —
+ * `fs.chmod` there only toggles the read-only attribute and never touches the
+ * NTFS ACL (a libuv limitation), so it is worthless for confidentiality. The
+ * Windows equivalent is an ACL edit via `icacls`: strip the inherited ACEs (the
+ * only source of "others" access on a fresh file) and grant Full to exactly the
+ * current user's SID.
+ *
+ * Every function here THROWS rather than swallowing a failure — the caller (the
+ * credential store) turns that into a loud refusal to persist a secret it can't
+ * secure. Nothing here silently claims success.
+ */
+const isWindows = process.platform === "win32";
+/** `undefined` = not yet resolved, `null` = resolution failed this process. */
+let cachedSid;
+/**
+ * The current user's SID (e.g. `S-1-5-21-…`) via `whoami /user`, resolved once
+ * and cached. We grant to the SID — never a name — so the ACL is correct
+ * regardless of the machine's display language (`BUILTIN\Users` etc. localise).
+ * Returns `null` if it cannot be determined.
+ */
+function currentUserSid() {
+    if (cachedSid !== undefined)
+        return cachedSid;
+    try {
+        const out = execFileSync("whoami", ["/user", "/fo", "csv", "/nh"], {
+            encoding: "utf8",
+        });
+        const m = out.match(/S-1-[0-9-]+/);
+        cachedSid = m ? m[0] : null;
+    }
+    catch {
+        cachedSid = null;
+    }
+    return cachedSid;
+}
+/**
+ * Make `path` owner-only, or throw. On Windows the ACL is verified after the
+ * edit (both the `icacls` exit code AND a read-back), so a returned call is a
+ * genuine guarantee, never a best-effort attempt.
+ *
+ * @throws if owner-only permissions cannot be established (non-zero `icacls`,
+ *   an unresolvable SID, a filesystem without ACLs/modes, …).
+ */
+export function enforceOwnerOnly(path, opts = {}) {
+    const directory = opts.directory ?? false;
+    if (isWindows) {
+        const sid = currentUserSid();
+        if (!sid) {
+            throw new Error("could not resolve the current user's SID (whoami failed) — cannot set an owner-only ACL");
+        }
+        // /inheritance:r removes inherited ACEs (where any "others" access comes
+        // from); /grant:r replaces the DACL with exactly this one grant. A directory
+        // grant carries (OI)(CI) so files created inside inherit owner-only at birth.
+        // The SID must be written `*S-1-…` — a bare token is read as an account NAME
+        // ("No mapping between account names and security IDs" otherwise).
+        const principal = `*${sid}`;
+        const grant = directory ? `${principal}:(OI)(CI)F` : `${principal}:F`;
+        try {
+            execFileSync("icacls", [path, "/inheritance:r", "/grant:r", grant], {
+                stdio: ["ignore", "ignore", "pipe"],
+            });
+        }
+        catch (err) {
+            const stderr = err.stderr?.toString().trim();
+            throw new Error(`icacls could not restrict "${path}"${stderr ? `: ${stderr}` : ""}`);
+        }
+    }
+    else {
+        chmodSync(path, directory ? 0o700 : 0o600);
+    }
+    // Verify the end state rather than trust the set — the guarantee is the point.
+    if (!isOwnerOnly(path)) {
+        throw new Error(`"${path}" is not owner-only after attempting to restrict it`);
+    }
+}
+/**
+ * Whether `path` is currently owner-only. POSIX: no group/other bits. Windows:
+ * best-effort — the ACL names no broad principal (Everyone / Authenticated
+ * Users / Users). Used both to verify {@link enforceOwnerOnly} and to warn on a
+ * pre-existing store with loose permissions. Returns `true` when it genuinely
+ * cannot tell (a missing tool), so a warning path never cries wolf.
+ */
+export function isOwnerOnly(path) {
+    if (!isWindows) {
+        return (statSync(path).mode & 0o077) === 0;
+    }
+    let out;
+    try {
+        out = execFileSync("icacls", [path], { encoding: "utf8" });
+    }
+    catch {
+        return true; // can't inspect → don't raise a false alarm
+    }
+    // `icacls <path>` resolves SIDs to names (locale-dependent on non-English
+    // Windows, hence best-effort): flag the well-known broad principals by name
+    // and by SID for the cases icacls leaves a SID unresolved.
+    const broad = [
+        /\bEveryone\b/i,
+        /\bAuthenticated Users\b/i,
+        /\bBUILTIN\\Users\b/i,
+        /\\Users:/i,
+        /S-1-1-0/, // Everyone
+        /S-1-5-11/, // Authenticated Users
+        /S-1-5-32-545/, // BUILTIN\Users
+    ];
+    return !broad.some((re) => re.test(out));
+}

package/dist/config/schema.d.ts

@@ -41,6 +41,19 @@ export declare const AgentConfigSchema: z.ZodObject<{
      * `maxIterations` — a user may deliberately set it lower or higher.
      */
     maxIterationsOneShot: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Optional hard cap on combined input+output tokens for a SINGLE user turn
+     * — a last-resort runaway guard, not cost control (cumulative session cost
+     * is C.22's concern). OFF by default (0 = off): today's behavior is
+     * preserved exactly and no turn is ever token-stopped. When set, a turn that
+     * crosses the cap stops at the next turn boundary with a coherent partial
+     * history (`stop: "budget"`); in one-shot that fails loud (exit 20), while
+     * interactively the human simply continues. Compaction is the everyday
+     * pressure valve for context — this only bounds a genuinely runaway turn, so
+     * a hostile hard stop mid-work stays opt-in. Reset each `send`, never
+     * cumulative across turns.
+     */
+    maxTokensPerTurn: z.ZodDefault<z.ZodNumber>;
     /** Skip per-action confirmation prompts. */
     autoApprove: z.ZodDefault<z.ZodBoolean>;
     /** Plan mode: propose a plan for approval before executing (C.31, opt-in). */
@@ -48,11 +61,13 @@ export declare const AgentConfigSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     maxIterations: number;
     maxIterationsOneShot: number;
+    maxTokensPerTurn: number;
     autoApprove: boolean;
     planMode: boolean;
 }, {
     maxIterations?: number | undefined;
     maxIterationsOneShot?: number | undefined;
+    maxTokensPerTurn?: number | undefined;
     autoApprove?: boolean | undefined;
     planMode?: boolean | undefined;
 }>;
@@ -103,16 +118,26 @@ export declare const ContextConfigSchema: z.ZodObject<{
     maxTokens: z.ZodDefault<z.ZodNumber>;
     /** Compact once the history estimate exceeds this fraction of maxTokens. */
     compactThreshold: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Fixed token allowance for request payload that `estimateTokens` never
+     * sees — the system prompt and every tool's JSON schema — added to the
+     * measured history before the threshold test so the trigger reflects the
+     * real request size, not just the visible messages. Roughly the size of
+     * the built system prompt plus the default tool catalogue today.
+     */
+    reserveTokens: z.ZodDefault<z.ZodNumber>;
     /** Most-recent messages always kept verbatim (a floor; the cut rounds up to
      * a clean turn boundary). */
     keepRecentMessages: z.ZodDefault<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     maxTokens: number;
     compactThreshold: number;
+    reserveTokens: number;
     keepRecentMessages: number;
 }, {
     maxTokens?: number | undefined;
     compactThreshold?: number | undefined;
+    reserveTokens?: number | undefined;
     keepRecentMessages?: number | undefined;
 }>;
 /**
@@ -1009,6 +1034,19 @@ export declare const CruxyConfigSchema: z.ZodObject<{
          * `maxIterations` — a user may deliberately set it lower or higher.
          */
         maxIterationsOneShot: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Optional hard cap on combined input+output tokens for a SINGLE user turn
+         * — a last-resort runaway guard, not cost control (cumulative session cost
+         * is C.22's concern). OFF by default (0 = off): today's behavior is
+         * preserved exactly and no turn is ever token-stopped. When set, a turn that
+         * crosses the cap stops at the next turn boundary with a coherent partial
+         * history (`stop: "budget"`); in one-shot that fails loud (exit 20), while
+         * interactively the human simply continues. Compaction is the everyday
+         * pressure valve for context — this only bounds a genuinely runaway turn, so
+         * a hostile hard stop mid-work stays opt-in. Reset each `send`, never
+         * cumulative across turns.
+         */
+        maxTokensPerTurn: z.ZodDefault<z.ZodNumber>;
         /** Skip per-action confirmation prompts. */
         autoApprove: z.ZodDefault<z.ZodBoolean>;
         /** Plan mode: propose a plan for approval before executing (C.31, opt-in). */
@@ -1016,11 +1054,13 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     }, "strict", z.ZodTypeAny, {
         maxIterations: number;
         maxIterationsOneShot: number;
+        maxTokensPerTurn: number;
         autoApprove: boolean;
         planMode: boolean;
     }, {
         maxIterations?: number | undefined;
         maxIterationsOneShot?: number | undefined;
+        maxTokensPerTurn?: number | undefined;
         autoApprove?: boolean | undefined;
         planMode?: boolean | undefined;
     }>>;
@@ -1068,16 +1108,26 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         maxTokens: z.ZodDefault<z.ZodNumber>;
         /** Compact once the history estimate exceeds this fraction of maxTokens. */
         compactThreshold: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Fixed token allowance for request payload that `estimateTokens` never
+         * sees — the system prompt and every tool's JSON schema — added to the
+         * measured history before the threshold test so the trigger reflects the
+         * real request size, not just the visible messages. Roughly the size of
+         * the built system prompt plus the default tool catalogue today.
+         */
+        reserveTokens: z.ZodDefault<z.ZodNumber>;
         /** Most-recent messages always kept verbatim (a floor; the cut rounds up to
          * a clean turn boundary). */
         keepRecentMessages: z.ZodDefault<z.ZodNumber>;
     }, "strict", z.ZodTypeAny, {
         maxTokens: number;
         compactThreshold: number;
+        reserveTokens: number;
         keepRecentMessages: number;
     }, {
         maxTokens?: number | undefined;
         compactThreshold?: number | undefined;
+        reserveTokens?: number | undefined;
         keepRecentMessages?: number | undefined;
     }>>;
     approval: z.ZodDefault<z.ZodObject<{
@@ -1746,6 +1796,22 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     approval: {
         mode: "prompt";
     };
+    mcp: {
+        startupTimeout: number;
+        requestTimeout: number;
+        servers: Record<string, {
+            args: string[];
+            env: Record<string, string>;
+            command?: string | undefined;
+            credentialRef?: string | undefined;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+        }>;
+        enabled: boolean;
+        maxToolsPerServer: number;
+        maxDescriptionChars: number;
+        maxSchemaBytes: number;
+    };
     subagent: {
         maxDepth: number;
         maxConcurrency: number;
@@ -1768,6 +1834,7 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     agent: {
         maxIterations: number;
         maxIterationsOneShot: number;
+        maxTokensPerTurn: number;
         autoApprove: boolean;
         planMode: boolean;
     };
@@ -1783,6 +1850,7 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     context: {
         maxTokens: number;
         compactThreshold: number;
+        reserveTokens: number;
         keepRecentMessages: number;
     };
     index: {
@@ -1827,22 +1895,6 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         map: Partial<Record<"main-turn" | "subagent" | "plan" | "commit-msg" | "classify" | "summarize", "kavi" | "vaani" | "mira">>;
         default?: "kavi" | "vaani" | "mira" | undefined;
     };
-    mcp: {
-        startupTimeout: number;
-        requestTimeout: number;
-        servers: Record<string, {
-            args: string[];
-            env: Record<string, string>;
-            command?: string | undefined;
-            credentialRef?: string | undefined;
-            url?: string | undefined;
-            headers?: Record<string, string> | undefined;
-        }>;
-        enabled: boolean;
-        maxToolsPerServer: number;
-        maxDescriptionChars: number;
-        maxSchemaBytes: number;
-    };
     web: {
         provider: "tavily";
         timeoutMs: number;
@@ -1899,6 +1951,22 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     approval?: {
         mode?: "prompt" | undefined;
     } | undefined;
+    mcp?: {
+        startupTimeout?: number | undefined;
+        requestTimeout?: number | undefined;
+        servers?: Record<string, {
+            command?: string | undefined;
+            credentialRef?: string | undefined;
+            url?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            headers?: Record<string, string> | undefined;
+        }> | undefined;
+        enabled?: boolean | undefined;
+        maxToolsPerServer?: number | undefined;
+        maxDescriptionChars?: number | undefined;
+        maxSchemaBytes?: number | undefined;
+    } | undefined;
     subagent?: {
         maxDepth?: number | undefined;
         maxConcurrency?: number | undefined;
@@ -1921,6 +1989,7 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     agent?: {
         maxIterations?: number | undefined;
         maxIterationsOneShot?: number | undefined;
+        maxTokensPerTurn?: number | undefined;
         autoApprove?: boolean | undefined;
         planMode?: boolean | undefined;
     } | undefined;
@@ -1936,6 +2005,7 @@ export declare const CruxyConfigSchema: z.ZodObject<{
     context?: {
         maxTokens?: number | undefined;
         compactThreshold?: number | undefined;
+        reserveTokens?: number | undefined;
         keepRecentMessages?: number | undefined;
     } | undefined;
     index?: {
@@ -1980,22 +2050,6 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         map?: Partial<Record<"main-turn" | "subagent" | "plan" | "commit-msg" | "classify" | "summarize", "kavi" | "vaani" | "mira">> | undefined;
         default?: "kavi" | "vaani" | "mira" | undefined;
     } | undefined;
-    mcp?: {
-        startupTimeout?: number | undefined;
-        requestTimeout?: number | undefined;
-        servers?: Record<string, {
-            command?: string | undefined;
-            credentialRef?: string | undefined;
-            url?: string | undefined;
-            args?: string[] | undefined;
-            env?: Record<string, string> | undefined;
-            headers?: Record<string, string> | undefined;
-        }> | undefined;
-        enabled?: boolean | undefined;
-        maxToolsPerServer?: number | undefined;
-        maxDescriptionChars?: number | undefined;
-        maxSchemaBytes?: number | undefined;
-    } | undefined;
     web?: {
         provider?: "tavily" | undefined;
         timeoutMs?: number | undefined;

package/dist/config/schema.js

@@ -41,6 +41,19 @@ export const AgentConfigSchema = z
      * `maxIterations` — a user may deliberately set it lower or higher.
      */
     maxIterationsOneShot: z.number().int().positive().default(40),
+    /**
+     * Optional hard cap on combined input+output tokens for a SINGLE user turn
+     * — a last-resort runaway guard, not cost control (cumulative session cost
+     * is C.22's concern). OFF by default (0 = off): today's behavior is
+     * preserved exactly and no turn is ever token-stopped. When set, a turn that
+     * crosses the cap stops at the next turn boundary with a coherent partial
+     * history (`stop: "budget"`); in one-shot that fails loud (exit 20), while
+     * interactively the human simply continues. Compaction is the everyday
+     * pressure valve for context — this only bounds a genuinely runaway turn, so
+     * a hostile hard stop mid-work stays opt-in. Reset each `send`, never
+     * cumulative across turns.
+     */
+    maxTokensPerTurn: z.number().int().nonnegative().default(0),
     /** Skip per-action confirmation prompts. */
     autoApprove: z.boolean().default(false),
     /** Plan mode: propose a plan for approval before executing (C.31, opt-in). */
@@ -81,6 +94,14 @@ export const ContextConfigSchema = z
     maxTokens: z.number().int().positive().default(100000),
     /** Compact once the history estimate exceeds this fraction of maxTokens. */
     compactThreshold: z.number().min(0).max(1).default(0.75),
+    /**
+     * Fixed token allowance for request payload that `estimateTokens` never
+     * sees — the system prompt and every tool's JSON schema — added to the
+     * measured history before the threshold test so the trigger reflects the
+     * real request size, not just the visible messages. Roughly the size of
+     * the built system prompt plus the default tool catalogue today.
+     */
+    reserveTokens: z.number().int().nonnegative().default(4500),
     /** Most-recent messages always kept verbatim (a floor; the cut rounds up to
      * a clean turn boundary). */
     keepRecentMessages: z.number().int().positive().default(6),

package/dist/errors/constructors.d.ts

@@ -24,6 +24,15 @@ export declare function configParse(path: string, underlying?: unknown): CruxyEr
 export declare function configInvalid(issues: string, path?: string): CruxyError;
 export declare function authMissingKey(provider: string, envVar: string): CruxyError;
 export declare function authInvalid(underlying?: unknown): CruxyError;
+/**
+ * A credential could not be persisted with owner-only permissions, so it was
+ * NOT written (C.27c). Chiefly a Windows case: the store's ACL could not be
+ * restricted to the current user (non-NTFS filesystem, `icacls`/SID
+ * unavailable), and we refuse to leave a secret at inheritable permissions while
+ * claiming otherwise. Provider keys point at the env-var fallback; MCP tokens
+ * have no such fallback, so the message says so plainly.
+ */
+export declare function credentialsUnprotected(kind: "provider" | "mcp", path: string, underlying?: unknown): CruxyError;
 export declare function gatewayUnreachable(underlying?: unknown): CruxyError;
 export declare function apiError(underlying?: unknown): CruxyError;
 export declare function apiRateLimit(underlying?: unknown): CruxyError;

package/dist/errors/constructors.js

@@ -142,6 +142,33 @@ export function authInvalid(underlying) {
         underlying,
     });
 }
+/**
+ * A credential could not be persisted with owner-only permissions, so it was
+ * NOT written (C.27c). Chiefly a Windows case: the store's ACL could not be
+ * restricted to the current user (non-NTFS filesystem, `icacls`/SID
+ * unavailable), and we refuse to leave a secret at inheritable permissions while
+ * claiming otherwise. Provider keys point at the env-var fallback; MCP tokens
+ * have no such fallback, so the message says so plainly.
+ */
+export function credentialsUnprotected(kind, path, underlying) {
+    const nextSteps = kind === "provider"
+        ? [
+            "set the key via the CRUXY_API_KEY environment variable instead — env is never written to disk and always wins",
+            "or store it on a filesystem that supports owner-only permissions (NTFS, not FAT/exFAT)",
+        ]
+        : [
+            "an MCP bearer token has no environment fallback — it can only live in the owner-only store",
+            "store it on a filesystem that supports owner-only permissions (NTFS, not FAT/exFAT)",
+        ];
+    return new CruxyError({
+        code: ErrorCode.CredentialsUnprotected,
+        title: `refusing to write a credential that cannot be made owner-only: ${path}`,
+        cause: scrubbedMessageOf(underlying),
+        nextSteps,
+        underlying,
+        meta: { path, kind },
+    });
+}
 // ── network (exit 5) ──────────────────────────────────────────────────────────
 export function gatewayUnreachable(underlying) {
     return new CruxyError({

package/dist/errors/types.d.ts

@@ -29,6 +29,12 @@ export declare const ErrorCode: {
     readonly AuthMissingKey: "CRUXY_E_AUTH_MISSING_KEY";
     readonly AuthInvalid: "CRUXY_E_AUTH_INVALID";
     readonly ForgeAuth: "CRUXY_E_FORGE_AUTH";
+    /** A credential could not be persisted with owner-only permissions (C.27c) —
+     * e.g. on Windows the store's ACL could not be restricted to the current user
+     * (non-NTFS filesystem, `icacls`/SID unavailable). Refused loudly rather than
+     * written world-inheritable: a secret is never persisted at permissions we
+     * could not verify as owner-only. */
+    readonly CredentialsUnprotected: "CRUXY_E_CREDENTIALS_UNPROTECTED";
     readonly GatewayUnreachable: "CRUXY_E_GATEWAY_UNREACHABLE";
     readonly GitPushFailed: "CRUXY_E_GIT_PUSH_FAILED";
     readonly Api: "CRUXY_E_API";

package/dist/errors/types.js

@@ -33,6 +33,12 @@ export const ErrorCode = {
     AuthMissingKey: "CRUXY_E_AUTH_MISSING_KEY",
     AuthInvalid: "CRUXY_E_AUTH_INVALID",
     ForgeAuth: "CRUXY_E_FORGE_AUTH",
+    /** A credential could not be persisted with owner-only permissions (C.27c) —
+     * e.g. on Windows the store's ACL could not be restricted to the current user
+     * (non-NTFS filesystem, `icacls`/SID unavailable). Refused loudly rather than
+     * written world-inheritable: a secret is never persisted at permissions we
+     * could not verify as owner-only. */
+    CredentialsUnprotected: "CRUXY_E_CREDENTIALS_UNPROTECTED",
     // network (exit 5)
     GatewayUnreachable: "CRUXY_E_GATEWAY_UNREACHABLE",
     GitPushFailed: "CRUXY_E_GIT_PUSH_FAILED",
@@ -249,6 +255,7 @@ const EXIT_CODES = {
     [ErrorCode.AuthMissingKey]: 4,
     [ErrorCode.AuthInvalid]: 4,
     [ErrorCode.ForgeAuth]: 4,
+    [ErrorCode.CredentialsUnprotected]: 4,
     [ErrorCode.GatewayUnreachable]: 5,
     [ErrorCode.GitPushFailed]: 5,
     [ErrorCode.Api]: 6,

package/dist/indexing/service.js

@@ -131,7 +131,10 @@ async function openStore(root, kind, logger) {
         // an in-memory index with a warning (no quality loss, just no persistence).
         if (kind === "sqlite")
             throw indexStoreUnavailable(err);
-        logger.warn(`sqlite index unavailable (${err.message}); using an in-memory index`);
+        logger.warn(`persistent index unavailable (${err.message}); using an ephemeral ` +
+            `in-memory index — it reindexes from scratch each session. To enable persistence, ` +
+            `let better-sqlite3 build (install your platform's C/C++ build tools) or run on Node ≥22 ` +
+            `(which ships a prebuilt binary).`);
         return { store: new InMemoryVectorStore(), storePath: null };
     }
 }

package/dist/jobs/manager.js

@@ -2,7 +2,8 @@ import { runAgent } from "../agent/loop.js";
 import { ApprovalService, classify, serializeGate, } from "../approval/index.js";
 import { CheckpointGate, withCheckpointGate } from "../checkpoint/index.js";
 import { CruxyError, ErrorCode, approvalRequired, jobLimitExceeded, jobNotFound, jobsDisabled, messageOf, } from "../errors/index.js";
-import { Budget, resolveBudget, scopeRegistry, } from "../subagent/index.js";
+import { Budget, resolveBudget } from "../agent/budget.js";
+import { scopeRegistry } from "../subagent/index.js";
 import { Workspace } from "../workspace/index.js";
 import { LogBuffer } from "./log-buffer.js";
 import { JobLogRenderer } from "./log-renderer.js";

package/dist/memory/types.d.ts

@@ -45,14 +45,14 @@ export declare const MemoryEntrySchema: z.ZodObject<{
     /** ISO 8601 timestamp the entry was recorded. */
     createdAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    id: string;
     kind: "fact" | "decision" | "preference";
+    id: string;
     createdAt: string;
     content: string;
     scope: "project" | "user";
 }, {
-    id: string;
     kind: "fact" | "decision" | "preference";
+    id: string;
     createdAt: string;
     content: string;
     scope: "project" | "user";

package/dist/subagent/index.d.ts

@@ -1,5 +1,4 @@
 export * from "./types.js";
-export * from "./budget.js";
 export * from "./semaphore.js";
 export * from "./registry-scope.js";
 export * from "./orchestrator.js";

package/dist/subagent/index.js

@@ -1,5 +1,4 @@
 export * from "./types.js";
-export * from "./budget.js";
 export * from "./semaphore.js";
 export * from "./registry-scope.js";
 export * from "./orchestrator.js";

package/dist/subagent/orchestrator.js

@@ -2,7 +2,7 @@ import path from "node:path";
 import { runAgent } from "../agent/loop.js";
 import { CruxyError, ErrorCode, messageOf, subagentDepthExceeded, subagentScopeOverlap, } from "../errors/index.js";
 import { Workspace } from "../workspace/index.js";
-import { Budget, resolveBudget } from "./budget.js";
+import { Budget, resolveBudget } from "../agent/budget.js";
 import { scopeRegistry, SUBAGENT_WRITE_TOOLS } from "./registry-scope.js";
 import { Semaphore } from "./semaphore.js";
 import { makeSpawnSubagentTool } from "./spawn-tool.js";

package/dist/subagent/types.d.ts

@@ -1,5 +1,7 @@
 import type { Usage } from "@cruxy/sdk";
 import type { TaskClass } from "../routing/index.js";
+import type { BudgetLimits } from "../agent/budget.js";
+export type { BudgetLimits };
 /**
  * Types for subagent orchestration (C.14): the main agent delegates a bounded
  * subtask to a child agent that runs the SAME loop with its own fresh history,
@@ -14,19 +16,6 @@ import type { TaskClass } from "../routing/index.js";
  * dressed up as `done`.
  */
 export type SubagentStatus = "done" | "budget-exceeded" | "failed" | "cancelled";
-/**
- * Hard caps a subagent runs under. `maxIterations` and `maxTokens` are always
- * finite — a subagent is bounded by construction; `timeoutMs` is an optional
- * wall-clock backstop on top.
- */
-export interface BudgetLimits {
-    /** Cap on the subagent's model turns. */
-    maxIterations: number;
-    /** Cap on the subagent's combined input+output tokens. */
-    maxTokens: number;
-    /** Optional wall-clock cap in milliseconds. */
-    timeoutMs?: number;
-}
 /** A spawn request: the bounded task plus optional scope/budget narrowing. */
 export interface SubagentSpec {
     /** The complete, self-contained subtask the subagent should perform. */

package/dist/testing/runner.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { killTree, spawnTree } from "../utils/process-tree.js";
 import { parseFailures } from "./parse.js";
 /**
  * The shipped {@link TestRunner}: spawn the command via the system shell (the
@@ -15,11 +15,10 @@ export class CommandTestRunner {
             const capture = new TailCapture(opts.captureBytes);
             let child;
             try {
-                child = spawn(command, {
-                    shell: true,
-                    cwd: opts.cwd,
-                    detached: true,
-                });
+                // Same killable-tree discipline as run_command: `spawnTree` groups the
+                // shell (POSIX process group / win32 OS tree) so a timeout can reap the
+                // whole tree via `killTree`.
+                child = spawnTree(command, [], { shell: true, cwd: opts.cwd });
             }
             catch (err) {
                 resolve(failed(null, err.message, startedAt));
@@ -111,14 +110,3 @@ export class TailCapture {
         return this.truncated ? `… [earlier output truncated]\n${body}` : body;
     }
 }
-/** Kill the whole process group (POSIX; matches run_command's behavior). */
-function killTree(pid) {
-    if (pid === undefined)
-        return;
-    try {
-        process.kill(-pid, "SIGKILL");
-    }
-    catch {
-        // Already exited, or no group — nothing to kill.
-    }
-}

package/dist/tools/shell/exec.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { killTree, spawnTree } from "../../utils/process-tree.js";
 /**
  * Gate `command` through `ctx.requestApproval`, then — only if allowed — execute
  * it via the sandbox (when `ctx.sandbox` is set) or the bounded host spawn. A
@@ -50,9 +50,10 @@ async function runSandboxed(command, ctx) {
 function runBounded(command, ctx) {
     const { timeoutMs, maxOutputBytes } = ctx.config.shell;
     return new Promise((resolve) => {
-        // `detached` makes the child its own process-group leader so the whole tree
-        // (the shell plus anything it spawns) can be killed on timeout.
-        const child = spawn(command, { shell: true, cwd: ctx.cwd, detached: true });
+        // `spawnTree` makes the child the head of a killable tree (its own process
+        // group on POSIX; the OS parent-PID tree on win32) so the whole tree — the
+        // shell plus anything it spawns — can be killed on timeout via `killTree`.
+        const child = spawnTree(command, [], { shell: true, cwd: ctx.cwd });
         const chunks = [];
         let captured = 0;
         let truncated = false;
@@ -150,18 +151,3 @@ function runBounded(command, ctx) {
         });
     });
 }
-/**
- * Kill the command's entire process group. POSIX-specific (negative pid targets
- * the group); fine on our darwin/linux targets. Swallows errors — the process
- * may already be gone.
- */
-function killTree(pid) {
-    if (pid === undefined)
-        return;
-    try {
-        process.kill(-pid, "SIGKILL");
-    }
-    catch {
-        // Already exited, or no group — nothing to kill.
-    }
-}