@cruxy/cli 1.0.2 → 1.0.4

package/dist/agent/session.d.ts

@@ -1,212 +0,0 @@
-import type { Message, Provider, Usage } from "@cruxy/sdk";
-import type { CruxyConfig } from "../config/index.js";
-import type { StreamRenderer } from "../render/index.js";
-import { type Router } from "../routing/index.js";
-import type { ToolContext } from "../tools/index.js";
-import type { ToolRegistry } from "../tools/index.js";
-import type { JobManager } from "../jobs/index.js";
-import { type RequestUsage, type UsageRecord } from "../usage/index.js";
-import { type AgentResult, type LifecycleHookRunner } from "./loop.js";
-/**
- * Plan-mode turn runner (C.31), injected so the agent package doesn't depend on
- * the plan package. When plan mode is on, `send` delegates the whole turn to
- * this instead of a single `runAgent` call. Receives the running history (with
- * the user turn already appended) and returns the extended history to adopt.
- */
-export type PlanRunner = (args: {
-    messages: Message[];
-    projectInstructions: string | null;
-    recalledMemory: string | null;
-    renderer?: StreamRenderer;
-    /** Usage telemetry (C.22): forwarded to every model request the plan-mode
-     * turn drives (propose + each execution step), so plan runs are attributed
-     * exactly like a normal turn. */
-    onRequestUsage?: (req: RequestUsage) => void;
-}) => Promise<AgentResult>;
-export interface SessionArgs {
-    /** A constructed provider to stream from. */
-    provider: Provider;
-    /** The tool catalogue advertised to the model and dispatched against. */
-    registry: ToolRegistry;
-    /** Resolved CLI configuration. */
-    config: CruxyConfig;
-    /** Ambient capabilities handed to each tool. */
-    ctx: ToolContext;
-    /** Git context (branch + dirty), loaded at startup, for the system prompt. */
-    git?: {
-        branch: string;
-        dirty: boolean;
-    } | null;
-    /** Project instructions (e.g. CRUXY.md) folded into every turn's system prompt. */
-    projectInstructions?: string | null;
-    /**
-     * Persistent memory (C.29): the pre-rendered recall block, injected into every
-     * turn's system prompt as reference data. Built once at session start (user
-     * memory + trusted project memory); null when memory is off or empty. Fixed
-     * for the session — it does not re-read mid-session.
-     */
-    recalledMemory?: string | null;
-    /** Start in plan mode (C.31). Toggleable at runtime via `setPlanMode`. */
-    planMode?: boolean;
-    /** The plan-mode turn runner; required for plan mode to actually engage. */
-    planRunner?: PlanRunner;
-    /**
-     * Lifecycle hooks (C.19). When set, `before-run` fires before each turn (a
-     * blocking failure — including an untrusted project — aborts the turn) and
-     * `after-run` fires after; the same runner is threaded into the agent loop for
-     * `before-tool`/`after-tool`/`on-file-change`.
-     */
-    hooks?: LifecycleHookRunner;
-    /**
-     * Multi-model routing (C.30). When set, main turns route on `main-turn` and
-     * context compaction on `summarize`; omitted → the provider default (unchanged).
-     */
-    router?: Router;
-    /**
-     * Usage telemetry sink (C.22): called once per `send` with that run's
-     * {@link UsageRecord} (real per-request usage, tier-attributed). The sink
-     * persists it locally — it never transmits. Omitted → no persistence.
-     */
-    onRunUsage?: (record: UsageRecord) => void;
-    /**
-     * Session-scoped background jobs (C.28): the manager the `run_in_background`
-     * tool dispatches onto. Exposed on the session so the REPL can service pending
-     * job approvals between turns and drive `/jobs`/`/logs`/`/cancel`, and so
-     * `cruxy run` can cancel every live job on session exit. Present only when
-     * `jobs.enabled`; omitted → no background jobs (unchanged behaviour).
-     */
-    jobs?: JobManager;
-}
-/**
- * Estimate the token footprint of a message list with a cheap chars/4 heuristic
- * — no tokenizer dependency. Good enough to decide *when* to compact; exact
- * counts are deferred to a later phase. Counts only textual payload (block
- * structure and role labels are negligible and ignored).
- */
-export declare function estimateTokens(messages: Message[]): number;
-/**
- * Owns the state of one multi-turn conversation: the running message history and
- * the usage accumulated across turns. Each `send` continues from the prior
- * history (tool_use/tool_result blocks included) rather than starting cold.
- *
- * This is also the home for context compaction: before each turn the running
- * history is measured and, if it crosses the configured threshold, its older
- * prefix is summarized away so the conversation stays within the model's window.
- * The system prompt lives in `runAgent`, never in `messages`, so compaction
- * cannot touch it.
- */
-export declare class Session {
-    /** The full running conversation, replaced with the extended history each turn. */
-    messages: Message[];
-    /** Token usage summed across every `send` (and every compaction) in this session. */
-    readonly usage: Usage;
-    /** Stable id for this session (C.22), so a run's usage record groups with the
-     * other runs of the same interactive session (`cruxy usage --session`). */
-    readonly sessionId: string;
-    /** The most recent run's usage record (C.22) — the one-shot path reads it to
-     * print the end-of-run summary. */
-    lastRun?: UsageRecord;
-    private readonly args;
-    /** Mutable so `/reload` can refresh CRUXY.md mid-session. */
-    private projectInstructions;
-    /** Mutable so `/plan` can toggle plan mode mid-session. */
-    private planMode;
-    constructor(args: SessionArgs);
-    /** The ambient tool capabilities (gate + sandbox + cwd/config). Exposed so a
-     * shell-bound custom slash command (C.19) runs through the SAME gated path. */
-    get toolContext(): ToolContext;
-    /** The background-job manager (C.28), or undefined when jobs are disabled.
-     * The REPL uses it to service paused-job approvals and drive `/jobs`; `cruxy
-     * run` uses it to cancel every live job on exit. */
-    get jobs(): JobManager | undefined;
-    /** Whether plan mode is currently on. */
-    getPlanMode(): boolean;
-    /**
-     * Toggle plan mode. Only takes effect when a `planRunner` was wired (built by
-     * the session factory); without one, plan mode stays off.
-     */
-    setPlanMode(enabled: boolean): void;
-    /**
-     * Run one user turn: append the prompt, compact if the history has grown past
-     * the threshold, drive the agent loop over the full history, adopt the
-     * extended history, and accumulate usage. Returns the turn's `AgentResult`.
-     *
-     * `renderer`, when supplied, receives assistant text deltas and tool-call
-     * progress as they stream so the caller sees the turn live (see the REPL);
-     * history is unaffected.
-     */
-    send(userPrompt: string, renderer?: StreamRenderer): Promise<AgentResult>;
-    /**
-     * Re-read project instructions (CRUXY.md / AGENTS.md) from the working
-     * directory so edits take effect without restarting. Returns the new text, or
-     * `null` if none is present. Backs the `/reload` command.
-     */
-    reloadProjectInstructions(): string | null;
-    /** Drop the conversation history but keep the session (for `/clear`). */
-    clear(): void;
-    /**
-     * Compact `this.messages` only when it has grown past threshold, adopting the
-     * result. On success logs a one-line notice and returns the number of older
-     * messages folded into the summary; otherwise returns `null` (under threshold,
-     * nothing safe to cut, or summary failed).
-     */
-    maybeCompact(onRequestUsage?: (req: RequestUsage) => void): Promise<number | null>;
-    /**
-     * The mid-loop compaction seam (build item 3) handed to {@link runAgent}: same
-     * threshold/cut/summarize path as {@link maybeCompact}, but over the loop's own
-     * running history rather than `this.messages` (the loop owns and adopts its
-     * copy). Reuses the exact machinery so no summarization logic is duplicated and
-     * the loop stays ignorant of it. Under threshold it returns the history
-     * unchanged — cheap, no model call.
-     */
-    private compactLoopHistory;
-    /**
-     * Force compaction regardless of the threshold (backs `/compact`). Returns the
-     * number of older messages summarized, or `null` if there was nothing safe to
-     * cut or the summary call failed.
-     */
-    compact(): Promise<number | null>;
-    /**
-     * Compact `messages` when its estimated footprint exceeds
-     * `compactThreshold * maxTokens`, else return it untouched. The estimate adds a
-     * fixed `reserveTokens` allowance for the system prompt and tool schemas that
-     * {@link estimateTokens} never sees (~4.5k+ tokens of real request payload), so
-     * the trigger reflects the actual request size rather than only the visible
-     * history — otherwise the loop can sit just under the visible threshold while
-     * the real request has already overrun the window. Logs a one-line notice on a
-     * successful compaction.
-     */
-    private compactIfOverThreshold;
-    /**
-     * Find a clean cut, summarize the older prefix into a synthetic user/assistant
-     * pair, and splice it in front of the kept-recent messages. Best-effort: a
-     * failed summary call leaves the history untouched and reports `compacted:
-     * null` (fail open — losing compaction is degraded, not unsafe). Pure with
-     * respect to `this.messages`: it returns the new array for the caller to adopt
-     * (the loop and the session each own their own history), and only accumulates
-     * the summary's usage into the session total.
-     */
-    private runCompaction;
-    /**
-     * Choose the boundary between the summarized prefix and the kept-recent tail.
-     *
-     * Tool-call integrity is the constraint: a `tool_use` (assistant) and its
-     * matching `tool_result` (the next user message) must never straddle the cut,
-     * or the next provider call breaks. A real user *prompt* (`role:"user"` with
-     * string content) only occurs at a completed turn boundary, where every prior
-     * tool exchange is already resolved — so the kept region must begin there. The
-     * synthetic compaction-summary user message is also string content, so a
-     * repeat compaction always finds at least the previous summary as a clean cut.
-     *
-     * Start from `length - keepRecentMessages` and walk *backwards* to the nearest
-     * such prompt: this keeps at least the recent floor and lands clean. Returns
-     * the cut index, or `null` if no safe boundary leaves a non-empty prefix
-     * (e.g. a single long in-progress turn — nothing safe to compact).
-     */
-    private findCut;
-    /**
-     * Summarize a prefix via a standalone, tool-less provider call over a rendered
-     * transcript. Throws on a stream error or empty output so callers fail open.
-     */
-    private summarize;
-}

package/dist/approval/classify.d.ts

@@ -1,18 +0,0 @@
-import type { ApproveAction } from "../tools/types.js";
-import type { ApprovalRequest } from "./types.js";
-/**
- * Classify a pending tool action into a {@link RiskTier} + a tight session
- * {@link Scope}. The cardinal rule: **anything unrecognized is `destructive`**
- * (most-restrictive) so a future/unknown action can never slip through as
- * read-only or low-risk.
- */
-export declare function classify(action: ApproveAction, cwd: string): ApprovalRequest;
-/**
- * Tokenize a command **only if** we can positively prove it is a single, simple
- * invocation (the granted program plus plain args, no shell features). Returns
- * the tokens, or `null` for anything we can't prove safe — deny-by-default. This
- * is what makes a `git` session grant refuse `git push && rm -rf /`.
- */
-export declare function commandTokens(command: string): string[] | null;
-/** Is `target` the root itself or a descendant of it? (Also true if root is a file == target.) */
-export declare function isInside(root: string, target: string): boolean;

package/dist/approval/index.d.ts

@@ -1,6 +0,0 @@
-export * from "./types.js";
-export * from "./classify.js";
-export * from "./policy.js";
-export * from "./prompt.js";
-export * from "./service.js";
-export * from "./mutex.js";

package/dist/approval/mutex.d.ts

@@ -1,45 +0,0 @@
-import type { ApprovalDecision } from "./types.js";
-import type { ApproveAction } from "../tools/types.js";
-/**
- * The approval mutex (C.33, JC-C) — the spine of the concurrent-subagent safety
- * model. Node is single-threaded, so the only hazard between parallel subagents
- * is interleaving at `await` boundaries; the one resource they genuinely contend
- * for is the interactive terminal (one prompt at a time) and the run's shared
- * checkpoint state (one snapshot/set-write at a time). Serializing every
- * *gated write* through this one lock resolves BOTH with a single mechanism:
- *
- *   • **one prompt at a time** — a child blocked awaiting the user's keypress
- *     holds the lock, so no sibling can paint a second prompt over it (the
- *     keypress is always attributable to the one displayed prompt); and
- *   • **serialized gated writes** — the checkpoint hook (snapshot + per-root set
- *     member write) runs inside the same critical section, so two concurrent
- *     writes to disjoint roots can never race on `ensureCheckpoint`'s latch or
- *     the set manifest.
- *
- * It is a plain promise-chain serializer: `runExclusive(fn)` runs `fn` only
- * after every previously-enqueued `fn` has settled. It is a LEAF lock — nothing
- * is acquired while holding it except the terminal and the filesystem, neither
- * of which waits on a subagent resource — so it cannot take part in a cycle
- * (see the deadlock argument in the C.33 design doc).
- */
-export declare class ApprovalMutex {
-    /** The settled-marker chain: always resolves (never rejects), so a rejecting
-     * critical section never wedges the queue for the next waiter. */
-    private tail;
-    /** Run `fn` in mutual exclusion with every other `runExclusive` on this mutex. */
-    runExclusive<T>(fn: () => Promise<T>): Promise<T>;
-}
-/**
- * Wrap a fully-built gate (`ApprovalService.requestApproval` behind the C.32
- * checkpoint hook) so that every gated action serializes through `mutex`.
- *
- * Every action that actually reaches the gate is a *mutation* — read-only tools
- * never call `requestApproval` at all (see the ToolContext contract), so a
- * parallel READ fan-out is already free of the lock and never stalls behind a
- * sibling's pending prompt. The `read`-tier short-circuit below is therefore
- * defensive belt-and-suspenders (mirroring `ApprovalService`'s own read check):
- * if a read-classified action ever did flow here, it would bypass the spine
- * rather than needlessly hold it. What the mutex serializes in practice is the
- * mutating set — exactly the prompt + checkpoint work that must be one-at-a-time.
- */
-export declare function serializeGate(gate: (action: ApproveAction) => Promise<ApprovalDecision>, mutex: ApprovalMutex, cwd: string): (action: ApproveAction) => Promise<ApprovalDecision>;

package/dist/approval/policy.d.ts

@@ -1,43 +0,0 @@
-import { type PromptIO } from "./prompt.js";
-import type { ApprovalDecision, ApprovalPolicy, ApprovalRequest, Scope } from "./types.js";
-/**
- * The in-memory, per-session allowlist. Grants are **scoped** (a command prefix
- * or a path subtree) and **tier-keyed** (a `mutate` grant can never cover a
- * `destructive` action), **never blanket**, and **never persisted**. A new
- * session ⇒ a new allowlist (it is owned by the per-session ApprovalService).
- */
-export declare class SessionAllowlist {
-    private grants;
-    /** Record a session grant for `request`'s scope. No-op when nothing is safe to grant. */
-    grant(request: ApprovalRequest): void;
-    /** Does an existing grant cover `request`? Requires same tier **and** scope match. */
-    allows(request: ApprovalRequest): boolean;
-    clear(): void;
-    size(): number;
-}
-/**
- * Whether `scope` covers `request`. Shell: the command must be *provably simple*
- * ({@link commandTokens}) and its program token must equal the granted token —
- * so a `git` grant never matches `git push && rm -rf /`. File: every target must
- * resolve inside the granted subtree.
- *
- * Multi-repo (C.26): `shell-prefix`, `shell-exact`, and `mcp-tool` grants are
- * additionally **bound to the root they were taken in** — the grant only covers a
- * request whose `cwd` is the same root. So "allow `git` this session" in repo A
- * never auto-approves `git` in repo B. `file-subtree` needs no such check: it is
- * an absolute path, so a different root is already a different subtree.
- */
-export declare function scopeCovers(scope: Exclude<Scope, {
-    kind: "none";
-}>, request: ApprovalRequest): boolean;
-/**
- * The default policy: consult the allowlist, otherwise prompt. On "allow this
- * session" it records the scoped grant; a rejection carries optional feedback
- * back to the agent.
- */
-export declare class InteractivePolicy implements ApprovalPolicy {
-    private readonly allowlist;
-    private readonly io;
-    constructor(allowlist: SessionAllowlist, io: PromptIO);
-    decide(request: ApprovalRequest): Promise<ApprovalDecision>;
-}

package/dist/approval/prompt.d.ts

@@ -1,48 +0,0 @@
-import type { ApprovalRequest } from "./types.js";
-/**
- * The interactive prompt: render a pending action (a real diff for file edits,
- * the exact command + cwd for shell) and read a 4-way choice. Rendering is data
- * → string so it's testable; color is gated on `io.color` (NO_COLOR / non-TTY
- * aware). **Default-deny**: EOF / Ctrl-C / any unrecognized key → reject.
- *
- * Diff/preview rendering is the shared implementation in `render/diff.ts` —
- * the streaming path and this prompt draw the same bytes for the same change.
- */
-/** The four user choices (plus the implicit default-deny). */
-export type PromptChoice = {
-    kind: "once";
-} | {
-    kind: "session";
-} | {
-    kind: "reject";
-    reason?: string;
-} | {
-    kind: "instruct";
-    instruction: string;
-};
-/** I/O surface for the prompt — injectable so tests script the keys/lines. */
-export interface PromptIO {
-    write(text: string): void;
-    /** Read a single keypress; resolves "" on EOF / Ctrl-C. */
-    readKey(): Promise<string>;
-    /** Read one line (no trailing newline); resolves "" on EOF. */
-    readLine(): Promise<string>;
-    /** Whether to emit ANSI color. */
-    color: boolean;
-    /**
-     * Terminal columns (U.12). Optional so every existing PromptIO literal is
-     * unchanged; when absent the render resolves the width itself. Threaded so a
-     * narrow prompt reflows the command and never truncates the risk marker.
-     */
-    columns?: number;
-}
-/**
- * Render the action, read one key, and map it to a {@link PromptChoice}. `n`/`t`
- * read a follow-up line (reason / instruction). Anything else — including EOF —
- * is a reject.
- */
-export declare function promptForApproval(request: ApprovalRequest, io: PromptIO): Promise<PromptChoice>;
-/** Render the full prompt block: header, detail (diff or command+cwd), choices. */
-export declare function render(request: ApprovalRequest, color: boolean, columns?: number): string;
-/** Build the real PromptIO: prompt to stderr, read keys/lines from stdin. */
-export declare function defaultPromptIO(color: boolean): PromptIO;

package/dist/approval/service.d.ts

@@ -1,36 +0,0 @@
-import type { ApproveAction } from "../tools/types.js";
-import { type PromptIO } from "./prompt.js";
-import type { ApprovalDecision, ApprovalPolicy } from "./types.js";
-/**
- * The approval gate, called by the tool layer **before any side effect**. It
- * classifies the action, lets read-only actions through, **throws
- * CRUXY_E_APPROVAL_REQUIRED when it can't ask** (non-interactive — default-deny,
- * never auto-approve), and otherwise defers to the policy. It owns the
- * per-session allowlist, so a new service ⇒ a fresh session.
- */
-export interface ApprovalServiceOptions {
-    /** Resolved project root the actions run in. */
-    cwd: string;
-    /** Whether cruxy can actually prompt (stdin is a TTY). */
-    interactive: boolean;
-    /** Override the decision policy (the seam — tests / a future CI policy). */
-    policy?: ApprovalPolicy;
-    /** Override the prompt I/O (tests script keys/lines). */
-    io?: PromptIO;
-}
-export declare class ApprovalService {
-    private readonly cwd;
-    private readonly interactive;
-    private readonly allowlist;
-    private readonly policy;
-    constructor(opts: ApprovalServiceOptions);
-    /**
-     * Decide whether `action` may proceed. Read-only ⇒ allow. Non-interactive ⇒
-     * throw {@link approvalRequired} (the U.5 error system, exit 10). Otherwise the
-     * policy prompts. A returned `{allow:false}` is a clean rejection (fed back to
-     * the agent), not an error.
-     */
-    requestApproval(action: ApproveAction): Promise<ApprovalDecision>;
-    /** Clear all session grants (a fresh session). */
-    resetSession(): void;
-}

package/dist/approval/types.d.ts

@@ -1,82 +0,0 @@
-import type { ApproveAction } from "../tools/types.js";
-/**
- * Types for the approval gate (U.3) — the security boundary between the agent
- * and side-effecting actions. The gate is **default-deny**: no response means
- * reject, never auto-approve.
- */
-/**
- * Risk classification for a pending action. Friction is reserved for what's
- * risky, so users don't rubber-stamp.
- * - `read` — read-only, auto-allowed (read tools bypass the gate entirely).
- * - `mutate` — reversible-ish mutation (file write/edit) → approve, normal style.
- * - `destructive` — irreversible / high blast radius (shell, delete) → approve,
- *   visually distinct. **Unknown actions classify here.**
- */
-export type RiskTier = "read" | "mutate" | "destructive";
-/**
- * The tight scope a session grant is keyed by. Never blanket.
- * - `shell-prefix` — a command's leading program token (e.g. `git`); only ever
- *   matches commands we can *positively* prove are simple (no shell features).
- *   **Bound to `root`** (C.26): a `git` grant in repo A never covers `git` in B.
- * - `shell-exact` — one exact command string, for `test` actions only (C.13):
- *   a grant covers re-runs of precisely that test command, nothing else.
- *   **Bound to `root`**: a `pnpm test` grant in A never covers B.
- * - `file-subtree` — an absolute directory (or, under the root-cap, an exact
- *   file path); matches targets that resolve inside it. Inherently root-safe —
- *   different roots are different absolute subtrees, so it needs no `root` field.
- * - `mcp-tool` — one exact MCP server+tool pair (C.27): a grant covers re-calls
- *   of precisely that tool on that server, and never any other MCP tool.
- *   **Bound to `root`**: the same server+tool in another root still prompts.
- * - `none` — nothing safe to grant (e.g. a multi-file patch spanning the root).
- */
-export type Scope = {
-    readonly kind: "shell-prefix";
-    readonly token: string;
-    readonly root: string;
-} | {
-    readonly kind: "shell-exact";
-    readonly command: string;
-    readonly root: string;
-} | {
-    readonly kind: "file-subtree";
-    readonly root: string;
-} | {
-    readonly kind: "mcp-tool";
-    readonly server: string;
-    readonly tool: string;
-    readonly root: string;
-} | {
-    readonly kind: "none";
-};
-/** A pending action, classified and ready to show / decide on. */
-export interface ApprovalRequest {
-    /** The raw tool action (kind, path/command, preview). */
-    readonly action: ApproveAction;
-    /** Risk classification. */
-    readonly tier: RiskTier;
-    /** The tight scope a session grant would use. */
-    readonly scope: Scope;
-    /** One plain line describing the action (e.g. "run: git status"). */
-    readonly summary: string;
-    /** Absolute resolved target paths for file actions; `[]` for shell. */
-    readonly targets: readonly string[];
-    /** Resolved project root the action runs in (shown as the shell cwd). */
-    readonly cwd: string;
-}
-/**
- * The gate's verdict. On reject, `feedback` (if any) is fed back to the agent as
- * the tool result so it can adapt — a rejection is data, not an error.
- */
-export type ApprovalDecision = {
-    readonly allow: true;
-} | {
-    readonly allow: false;
-    readonly feedback?: string;
-};
-/**
- * Pluggable decision strategy — the seam. Only `InteractivePolicy` ships in U.3;
- * a future non-interactive/CI policy slots in here without touching call sites.
- */
-export interface ApprovalPolicy {
-    decide(request: ApprovalRequest): Promise<ApprovalDecision>;
-}

package/dist/brand/index.d.ts

@@ -1 +0,0 @@
-export { CANONICAL_TERMS, FORBIDDEN_MODEL_NAMES, FORBIDDEN_TERMS, MODEL_NAME_PLACEHOLDER, MODEL_TIERS, PRODUCT_MASTHEAD, PRODUCT_NAME, PRODUCT_TAGLINE, scanForbidden, scrubModelNames, type ForbiddenTerm, type LexiconViolation, } from "./voice.js";

package/dist/brand/voice.d.ts

@@ -1,94 +0,0 @@
-/**
- * The cruxy brand voice (U.8) — a tiny living document, enforced by a test, not
- * vibes. It centralizes the product name/tagline, the canonical lexicon, and the
- * forbidden set (deprecated synonyms + the base-model gag) so every user-facing
- * surface reads as one product. Presentation/copy only — nothing here changes
- * behavior; the {@link scanForbidden} helper backs the lexicon test.
- *
- * Voice, in one breath: concise, direct, second-person for guidance,
- * lowercase-leaning for status, no marketing fluff, no exclamation-spam. The
- * product name is ALWAYS lowercase `cruxy`.
- */
-/** The product name — always lowercase, in running text, banners, and help. */
-export declare const PRODUCT_NAME = "cruxy";
-/** The one-line tagline (mirrors package.json's description). */
-export declare const PRODUCT_TAGLINE = "an agentic coding CLI";
-/** The `cruxy --help` / banner masthead: `cruxy — an agentic coding CLI`. */
-export declare const PRODUCT_MASTHEAD = "cruxy \u2014 an agentic coding CLI";
-/**
- * The ONLY model names cruxy ever shows a user. The upstream model powering a
- * tier is never named — a hard rule asserted by the lexicon test.
- */
-export declare const MODEL_TIERS: readonly ["kavi", "vaani", "mira"];
-/**
- * The canonical term for each concept — the words every surface must use.
- * Documented here so the lexicon is reviewable in one place; the forbidden
- * synonyms below are what the test actually enforces.
- */
-export declare const CANONICAL_TERMS: {
-    readonly product: "cruxy";
-    readonly backend: "gateway";
-    readonly extension: "skill";
-    readonly lifecycleHook: "hook";
-    readonly undoUnit: "checkpoint";
-    readonly isolation: "sandbox";
-    readonly secret: "API key";
-    readonly pullRequest: "pull request";
-    readonly permission: "approval";
-};
-/** One deprecated/off-voice term the copy must not use, and what to use instead. */
-export interface ForbiddenTerm {
-    /** Matches the forbidden term (word-bounded, case-insensitive). */
-    pattern: RegExp;
-    /** The forbidden term, for the failure message. */
-    term: string;
-    /** The canonical term to use instead. */
-    use: string;
-}
-/**
- * Deprecated synonyms banned from user-facing copy. Scoped to the curated
- * surfaces the lexicon test scans (command descriptions, error output, brand +
- * onboarding constants) — NOT a raw source grep — so legitimate internal uses
- * (`mcp.servers` config key, docker `.Server.Version`, code comments) never
- * false-trip, while every string a user reads is covered.
- */
-export declare const FORBIDDEN_TERMS: readonly ForbiddenTerm[];
-/**
- * Upstream model names — the base-model gag. None may appear in user-facing
- * copy; only {@link MODEL_TIERS} ever do. `anthropic`/`openai` are deliberately
- * absent: they are real bring-your-own-provider config values, not model names.
- */
-export declare const FORBIDDEN_MODEL_NAMES: RegExp;
-/** The neutral token an upstream model name is replaced with in user-facing copy. */
-export declare const MODEL_NAME_PLACEHOLDER = "\u00ABmodel\u00BB";
-/**
- * Replace every upstream model IDENTIFIER in an arbitrary, externally-sourced
- * string with {@link MODEL_NAME_PLACEHOLDER}, collapsing a whole `name-name-vers`
- * run to a single token.
- *
- * The U.8 gag is structural *inside the process* (the routing package can't
- * produce an upstream id — see `resolveModelId`), but a gateway/provider error
- * body is an arbitrary external string that bypasses that guarantee. This is the
- * scrub applied at the error-construction boundary so no upstream id reaches a
- * user-facing `CruxyError.cause`.
- *
- * Scrubs model ids as whole TOKENS, never a bare vendor word or a substring
- * inside an unrelated word/path — so legitimate output (`/home/claude`, the
- * `opus` codec, a `claude-bot` username) is left intact (see {@link isModelId}).
- * Provider names (`anthropic`/`openai`) are absent from the set, so bring-your-own
- * provider config values survive too.
- */
-export declare function scrubModelNames(text: string): string;
-/** One lexicon violation found in a scanned string. */
-export interface LexiconViolation {
-    /** The forbidden term (or "model-name" for a gag violation). */
-    term: string;
-    /** The canonical replacement, when the term is a deprecated synonym. */
-    use?: string;
-}
-/**
- * Scan one user-facing string for lexicon violations — deprecated synonyms and
- * upstream model names. Returns every violation (empty ⇒ on-voice). Pure; the
- * lexicon test runs it over the curated surfaces.
- */
-export declare function scanForbidden(text: string): LexiconViolation[];

package/dist/checkpoint/capture.d.ts

@@ -1,17 +0,0 @@
-import type { CaptureFile } from "./types.js";
-/**
- * Snapshot-scope enumeration (C.32): every regular file the agent could touch —
- * tracked + untracked-non-ignored — and nothing it must never see:
- *   • gitignored paths (they are not the run's undo unit and may be huge),
- *   • the C.17 secrets denylist ({@link isSecretPath} — a checkpoint must never
- *     copy a secret into `.cruxy/` or the git object DB),
- *   • `.cruxy/` itself (a checkpoint of the checkpoints would recurse),
- *   • symlinks and other non-regular files (restore writes plain files only).
- *
- * In a git repo the file list comes from `git ls-files` (read-only), which
- * honors `.gitignore`, `.git/info/exclude`, and the user's global excludes
- * exactly. Outside a repo, the indexing walker enumerates with its gitignore
- * emulation — with binaries included and no size cap, because a snapshot that
- * skips files cannot restore them.
- */
-export declare function captureFiles(root: string, gitWorkTree: boolean): Promise<CaptureFile[]>;

package/dist/checkpoint/gate-hook.d.ts

@@ -1,28 +0,0 @@
-import type { ApprovalDecision } from "../approval/types.js";
-import type { ApproveAction } from "../tools/types.js";
-import type { Workspace } from "../workspace/index.js";
-import type { CheckpointGate } from "./gate.js";
-/**
- * Wrap an approval gate with the C.32 auto-checkpoint hook. Ordering is the whole
- * point: a tool mutates only *after* `requestApproval` resolves, so snapshotting
- * after an `allow` decision but before returning it means the checkpoint always
- * lands before the run's first mutation — and a denied action never creates one.
- * The same seam records which paths the run touched (file actions) or that
- * attribution is lost (shell), for rollback's external-change detection.
- *
- * Lives in the checkpoint package (not the CLI wiring) so the SAME hook can be
- * composed by the session factory, the subagent orchestrator, AND the C.28 job
- * approval path without any of them importing the others.
- */
-export declare function withCheckpointGate(requestApproval: (action: ApproveAction) => Promise<ApprovalDecision>, gate: CheckpointGate | undefined, ws: Workspace): (action: ApproveAction) => Promise<ApprovalDecision>;
-/**
- * Group a file action's resolved absolute targets by the root that contains each
- * (JC-G). write/edit carry an already-absolute `path`; patch preview paths are
- * relative to the PRIMARY cwd (`path.relative(ctx.cwd, abs)` in apply_patch), so
- * we reconstruct the absolute path from the primary root rather than trusting
- * classify's `targets` — which also correctly handles a patch spanning roots.
- */
-export declare function attributeFileTargets(action: ApproveAction, ws: Workspace): Map<string, {
-    rootAbsPath: string;
-    paths: string[];
-}>;