@cruxy/cli 1.0.2 → 1.0.4

package/dist/cli/commands/skills.d.ts

@@ -1,8 +0,0 @@
-import { Command } from "commander";
-/**
- * `cruxy skills` — list the skills available to the agent (the same catalog the
- * `list_skills` tool sees). `--status` additionally shows the three source
- * directories in precedence order and any validation errors (skills that were
- * excluded for being malformed).
- */
-export declare function skillsCommand(): Command;

package/dist/cli/commands/test.d.ts

@@ -1,9 +0,0 @@
-import { Command } from "commander";
-/**
- * `cruxy test` (C.13) — run the project's detected/configured test command
- * once and print the structured result the agent would see. Directly
- * user-invoked, so there is no approval gate (typing the command IS the
- * consent — same as running the suite by hand); the process exit code mirrors
- * the suite's pass/fail so scripts and CI can branch on it.
- */
-export declare function testCommand(): Command;

package/dist/cli/commands/usage.d.ts

@@ -1,9 +0,0 @@
-import { Command } from "commander";
-/**
- * `cruxy usage` (C.22) — show LOCAL token usage and (when priced) cost, read
- * back from `~/.cruxy/usage`. Read-only and local: it prints your own accounting
- * and transmits nothing. Every figure is real — a request the provider never
- * reported usage for is shown as unreported, never a fabricated number, and cost
- * appears only for tiers you have priced.
- */
-export declare function usageCommand(): Command;

package/dist/cli/onboard.d.ts

@@ -1,25 +0,0 @@
-import type { CruxyConfig } from "../config/index.js";
-import { type OnboardingResult } from "../onboarding/index.js";
-/**
- * CLI-layer glue between the entry points and the onboarding module (U.6). Keeps
- * `run`/`program`/`login`/`init` thin: they decide *when* to onboard; this builds
- * the production wiring (live validation, credential persistence, first-win run).
- */
-/** The env var that holds the key for a provider (for the fail-loud message). */
-export declare function apiKeyEnvVar(provider: string): string;
-/** Run one first-win task end-to-end against the just-saved key. */
-export declare function runFirstWinTask(config: CruxyConfig, cwd: string, prompt: string): Promise<void>;
-export interface MaybeOnboardOptions {
-    /** Whether stdin is a TTY (the gate). */
-    ttyInteractive: boolean;
-    /** Offer the first-win demo run (no real task queued). */
-    offerFirstWin: boolean;
-    cwd: string;
-}
-/**
- * Run the guided first-run flow **iff** this is a first run; otherwise return
- * `null` so the caller can fall back (fail loud, or show a banner). Never throws
- * for an aborted setup — `result.completed` is `false` and the caller exits
- * cleanly.
- */
-export declare function maybeRunOnboarding(config: CruxyConfig, opts: MaybeOnboardOptions): Promise<OnboardingResult> | null;

package/dist/cli/program.d.ts

@@ -1,2 +0,0 @@
-import { Command } from "commander";
-export declare function buildProgram(): Command;

package/dist/cli/repl.d.ts

@@ -1,27 +0,0 @@
-import type { Readable, Writable } from "node:stream";
-import type { Session } from "../agent/index.js";
-import type { CheckpointGate } from "../checkpoint/index.js";
-import { type SlashCommandSpec } from "../hooks/index.js";
-import { type StreamRenderer } from "../render/index.js";
-/**
- * The REPL's slash commands — the autocomplete candidate set (U.7). Keep in
- * sync with the dispatch below and the HELP text.
- */
-export declare const REPL_COMMANDS: readonly ["/help", "/clear", "/compact", "/reload", "/plan", "/jobs", "/logs", "/cancel", "/exit", "/quit"];
-/** The stdin/stdout pair the REPL reads from and prompts on. Injectable for tests. */
-export interface ReplIO {
-    input: Readable;
-    output: Writable;
-}
-/**
- * Drive an interactive multi-turn session: prompt, read a line, dispatch slash
- * commands or run a turn, repeat. Assistant text and tool-call progress stream
- * through the `renderer` from within `session.send`; this loop only owns input
- * and control.
- *
- * `io` defaults to real stdin/stdout; tests inject a scripted stream pair. The
- * renderer defaults to whatever `io.output` supports (a TTY gets the managed
- * live region, anything else the plain append-only renderer); `cruxy run`
- * passes its own so the approval prompt's status-suspend hook shares it.
- */
-export declare function runInteractive(session: Session, io?: ReplIO, renderer?: StreamRenderer, checkpoints?: CheckpointGate, slashCommands?: readonly SlashCommandSpec[]): Promise<void>;

package/dist/cli/session-factory.d.ts

@@ -1,42 +0,0 @@
-import type { CruxyConfig } from "../config/index.js";
-import { withCheckpointGate } from "../checkpoint/index.js";
-import type { CheckpointGate } from "../checkpoint/index.js";
-export { withCheckpointGate };
-import type { SandboxService } from "../sandbox/index.js";
-import type { StreamRenderer } from "../render/index.js";
-import { ToolRegistry, type Tool } from "../tools/index.js";
-import { Session, type LifecycleHookRunner } from "../agent/index.js";
-import type { Workspace } from "../workspace/index.js";
-/**
- * Register every CONDITIONALLY-enabled runtime tool onto `registry`, in the fixed
- * order the model sees them: `remember` (memory), the four LSP tools, the two web
- * tools, the trusted MCP tools, then `spawn_subagent`. Factored out of
- * {@link buildAgentSession} for ONE reason beyond tidiness: it makes the *complete
- * runtime* tool set enumerable by a test (JC-B). The default registry only covers
- * the 14 always-on tools; the allowlist test that pins "no tool can add a workspace
- * root" is only sound if it runs against the SAME set the session ships — so the
- * session factory and that test both build the surface through this one seam. A new
- * conditionally-registered tool added here fails the allowlist test until it is
- * consciously listed and audited.
- *
- * Each family is opt-in and inert when its feature flag is off, exactly as before —
- * this function is a pure move of the inline registration, same guards, same order.
- * `spawnTool` is passed in (already depth-bound) because it needs the orchestrator;
- * it registers only when nesting is allowed (`subagent.maxDepth > 0`).
- */
-export declare function registerRuntimeTools(registry: ToolRegistry, config: CruxyConfig, opts?: {
-    mcpTools?: Tool[];
-    spawnTool?: Tool;
-    spawnManyTool?: Tool;
-    jobTool?: Tool;
-}): void;
-/**
- * Build a ready-to-run agent {@link Session} from a resolved key — the wiring
- * shared by `cruxy run` and the onboarding first-win task (so they can't drift).
- * The approval gate's interactivity tracks the TTY, exactly as in `run`.
- *
- * When `planMode` is on (C.31), it additionally wires a {@link PlanExecutionPolicy}
- * over the shared U.3 allowlist and a `planRunner` so `session.send` proposes →
- * approves → executes. Plan mode is fully opt-in; the default path is unchanged.
- */
-export declare function buildAgentSession(config: CruxyConfig, apiKey: string, workspace: Workspace, ttyInteractive: boolean, planMode?: boolean, renderer?: StreamRenderer, checkpoints?: CheckpointGate, sandbox?: SandboxService, hooks?: LifecycleHookRunner, mcpTools?: Tool[]): Session;

package/dist/cli/stream-print.d.ts

@@ -1,14 +0,0 @@
-/**
- * Wrap a raw write sink into a printer for streamed assistant text.
- *
- * Models routinely begin a turn with one or more leading newlines; written
- * verbatim those land as blank lines between the prompt and the answer. The
- * printer drops the leading newline run of a turn (until the first visible
- * character) so output starts on a single fresh line, and otherwise forwards
- * text untouched — internal blank lines (markdown paragraphs, code) are
- * preserved. State is per printer, so create one per turn.
- *
- * All turn output — the deltas and the loop's single segment-terminating
- * newline — flows through this one sink, so nothing races the stream on stdout.
- */
-export declare function createStreamPrinter(write: (text: string) => void): (delta: string) => void;

package/dist/components/autocomplete.d.ts

@@ -1,32 +0,0 @@
-/**
- * Autocomplete (U.7): pure completion over an injectable candidate list, plus
- * the readline adapter the REPL uses for Tab-completion. Non-destructive by
- * construction — this module transforms strings and returns suggestions; it
- * has no access to the session, so completing can never execute anything.
- * Enter (the existing REPL path) remains the only way to act.
- */
-/** The outcome of one completion attempt. */
-export interface Completion {
-    /** The (possibly extended) input line. Unchanged when nothing matches. */
-    line: string;
-    /** Every candidate the input currently prefixes (shown on ambiguity). */
-    suggestions: string[];
-}
-/**
- * Complete `line` against `candidates` (exact-prefix filter):
- * - no match → line unchanged, no suggestions;
- * - one match → completed fully to it;
- * - several → extended to their longest common prefix, all listed.
- * Pure data in, data out — deterministic and order-preserving.
- */
-export declare function completeLine(line: string, candidates: readonly string[]): Completion;
-/**
- * A Node-readline `completer` over a live candidate source. Only the leading
- * word of a line starting with `/` completes (slash commands); everything
- * else — prompts to the model — is left alone, so Tab never mangles prose.
- *
- * readline's contract: return `[hits, prefixBeingReplaced]`; readline itself
- * extends to the common prefix and lists hits on a second Tab. It rewrites
- * only the edit buffer — submission stays on Enter.
- */
-export declare function makeReplCompleter(candidates: () => readonly string[]): (line: string) => [string[], string];

package/dist/components/frame.d.ts

@@ -1,28 +0,0 @@
-import { stripAnsi } from "../render/layout.js";
-import type { RenderCapabilities } from "../render/index.js";
-/** The visible text of a possibly-styled row (re-exported from the U.12 home). */
-export { stripAnsi };
-/**
- * The transient multi-line region interactive components draw into (U.7) —
- * the multi-row analog of the TTY renderer's single managed status line, with
- * the same discipline:
- *
- * - Only the frame is ever rewritten (erase + redraw in place) — committed
- *   output above it is never touched.
- * - Every line is hard-truncated to the terminal width so a row can never
- *   soft-wrap; wrapped rows would break erasure and leave artifacts.
- * - `clear()` removes the frame entirely — after a component resolves, the
- *   screen holds zero leftover bytes from the interaction.
- * - On resize (U.12) the frame reflows its current rows in place at the new
- *   width; committed output above is untouched. `clear()` also unsubscribes.
- *
- * Requires cursor control (`caps.cursor`); components guard on that before
- * constructing one.
- */
-export interface Frame {
-    /** Repaint the frame with these rows (erases the previous paint first). */
-    render(lines: string[]): void;
-    /** Erase the frame completely and release the resize subscription. Idempotent. */
-    clear(): void;
-}
-export declare function createFrame(write: (text: string) => void, caps: RenderCapabilities): Frame;

package/dist/components/fuzzy.d.ts

@@ -1,61 +0,0 @@
-import { type Theme } from "../theme/index.js";
-import { type ComponentIO, type InteractiveResult } from "./input.js";
-/**
- * Fuzzy finding (U.7): a deterministic, honest subsequence scorer (pure,
- * headless-tested) plus the interactive type-to-filter component built on it.
- * No fabricated relevance — a label either contains the query as a
- * subsequence or it does not, and the score is three documented bonuses.
- */
-/** A successful match: its rank score and the label indices that matched. */
-export interface FuzzyMatch {
-    score: number;
-    /** Indices into the label of the matched characters (for highlighting). */
-    positions: number[];
-}
-/**
- * Case-insensitive greedy-leftmost subsequence match.
- * - Empty query matches everything: score 0, no positions (nothing to
- *   highlight, nothing to fabricate).
- * - Not a subsequence → `null`.
- * - Score = Σ per matched char: {@link BASE} + {@link CONSECUTIVE} when the
- *   match continues a run + {@link BOUNDARY} when it starts a word.
- * Deterministic by construction — same inputs, same output, no randomness,
- * no length normalization (ties break in {@link rankItems}).
- */
-export declare function fuzzyScore(query: string, label: string): FuzzyMatch | null;
-/** An item that survived filtering, with everything the finder renders. */
-export interface RankedItem<T> {
-    item: T;
-    label: string;
-    match: FuzzyMatch;
-}
-/**
- * Filter + rank a list against a query. Ordering is fully stable and
- * deterministic: score descending, then shorter label, then original index.
- * An empty query returns every item in original order.
- */
-export declare function rankItems<T>(items: readonly T[], toLabel: (item: T) => string, query: string): RankedItem<T>[];
-/**
- * Bold the matched characters of a label via the theme's accent role. With
- * color off (NO_COLOR, pipe) the roles are identity — plain text, zero ANSI.
- */
-export declare function highlightMatch(label: string, positions: readonly number[], theme: Theme): string;
-export interface FuzzyFindOptions<T> {
-    /** Label an item filters/renders under. Required — items are opaque. */
-    toLabel: (item: T) => string;
-    /** Header above the query line (e.g. "pick a checkpoint"). */
-    title?: string;
-    /** Non-TTY fallback: resolve to this instead of failing loud. */
-    defaultValue?: T;
-    /** `--flag` alternatives listed in the non-TTY error. */
-    nonInteractiveHint?: string[];
-    /** Visible result rows before the list scrolls (default 10). */
-    maxVisible?: number;
-}
-/**
- * Interactive fuzzy finder: type to filter, ↑/↓ to move through the ranked
- * results, Enter to select the highlighted item (inert while there are no
- * matches), Esc / Ctrl-C / EOF to cancel. The transient frame is fully erased
- * before resolving — the screen keeps no trace of the interaction.
- */
-export declare function fuzzyFind<T>(items: readonly T[], opts: FuzzyFindOptions<T>, io?: ComponentIO): Promise<InteractiveResult<T>>;

package/dist/components/index.d.ts

@@ -1,6 +0,0 @@
-export * from "./keys.js";
-export * from "./input.js";
-export * from "./frame.js";
-export * from "./select.js";
-export * from "./fuzzy.js";
-export * from "./autocomplete.js";

package/dist/components/input.d.ts

@@ -1,78 +0,0 @@
-import type { RenderCapabilities } from "../render/index.js";
-import { type Key } from "./keys.js";
-/**
- * The one raw-mode input reader (U.7). Every interactive component — and the
- * refactored approval/onboarding key readers — reads keys through this seam;
- * nothing else in the CLI touches `setRawMode`. The lifecycle is strict:
- * `begin()` → `read()` loop → `restore()` in a `finally`, so the terminal is
- * never left in raw mode on any exit path (selection, cancel, throw).
- */
-/** The minimal stdin surface the reader needs. Injectable for tests. */
-export interface RawInput {
-    isTTY?: boolean;
-    setRawMode?(mode: boolean): unknown;
-    resume(): unknown;
-    pause(): unknown;
-    on(event: "data" | "end", listener: (chunk: Buffer) => void): unknown;
-    removeListener(event: "data" | "end", listener: (chunk: Buffer) => void): unknown;
-}
-/** Raw-mode key source with an explicit begin/read/restore lifecycle. */
-export interface KeyReader {
-    /** Enter raw mode and start decoding. Safe to call once per interaction. */
-    begin(): void;
-    /**
-     * The next decoded key. After stream end (or `restore()`), resolves
-     * `{kind:"eof"}` forever — a component's read loop can never hang or reject.
-     */
-    read(): Promise<Key>;
-    /** Leave raw mode, detach, pause. Idempotent; call in `finally`, always. */
-    restore(): void;
-}
-/** Build the real reader over `stdin` (or an injected fake in tests). */
-export declare function createKeyReader(stdin?: RawInput): KeyReader;
-/**
- * Read exactly one key with the full begin/restore lifecycle — the shared
- * backend for the approval prompt's single-key read and the onboarding
- * `readKey`. Resolves the printable character, `"\n"` for enter, and `""` for
- * anything that means "no answer" (Ctrl-C, EOF, escape, arrows) — preserving
- * the callers' default-deny mapping.
- */
-export declare function readSingleKey(stdin?: RawInput): Promise<string>;
-/**
- * Every component resolves to a selection or a clean, typed cancellation
- * (Ctrl-C / EOF / escape). Cancellation is data for the caller to interpret —
- * never a thrown error, never a partial value.
- */
-export type InteractiveResult<T> = {
-    kind: "selected";
-    value: T;
-} | {
-    kind: "cancelled";
-};
-/**
- * What a component needs from the environment, bundled so tests can script
- * all of it. `caps` is the existing U.2 capability detection — components
- * never re-probe NO_COLOR / width / TTY themselves.
- */
-export interface ComponentIO {
-    caps: RenderCapabilities;
-    /**
-     * The whole interactive contract in one flag: stdin is a TTY *and* the
-     * output supports cursor control (`TERM=dumb` fails this). When false, no
-     * frame is drawn and no key is read — ever.
-     */
-    interactive: boolean;
-    /** Transient frame bytes. Defaults to stderr so stdout stays pipe-clean. */
-    write(text: string): void;
-    keys: KeyReader;
-}
-/** The real environment: frames to stderr, keys from stdin, caps from stderr. */
-export declare function defaultComponentIO(): ComponentIO;
-/**
- * The shared non-TTY gate, run before any frame byte or key read:
- * - interactive → proceed;
- * - not interactive + a default was supplied → resolve to it immediately;
- * - otherwise → throw `CRUXY_E_INTERACTIVE_REQUIRED` (usage, exit 2).
- * Never blocks on a pipe, never silently picks an option.
- */
-export declare function resolveNonInteractive<T>(io: ComponentIO, what: string, defaultValue: T | undefined, alternatives?: string[]): InteractiveResult<T> | null;

package/dist/components/keys.d.ts

@@ -1,48 +0,0 @@
-/**
- * Byte → key decoding for the interactive components (U.7). Pure data
- * transformation — no terminal, no state — so every mapping row is directly
- * unit-testable. The stateful raw-mode plumbing lives in `input.ts`.
- */
-/** One decoded keypress. The full vocabulary the U.7 components consume. */
-export type Key = 
-/** A printable character (UTF-8; may be multi-byte, never a control char). */
-{
-    kind: "char";
-    char: string;
-} | {
-    kind: "enter";
-} | {
-    kind: "backspace";
-} | {
-    kind: "tab";
-} | {
-    kind: "escape";
-} | {
-    kind: "up";
-} | {
-    kind: "down";
-} | {
-    kind: "left";
-} | {
-    kind: "right";
-}
-/** Ctrl-C in raw mode (no SIGINT is delivered) — components must cancel. */
- | {
-    kind: "ctrl-c";
-}
-/** Ctrl-D or stream end — components must cancel. */
- | {
-    kind: "eof";
-};
-/**
- * Decode one raw-mode chunk into keys. A paste or fast typing delivers many
- * keys per chunk; all are returned in order.
- *
- * Escape handling is deliberately simple: `ESC [ A..D` decodes to an arrow,
- * any other CSI sequence (`ESC [ …final`) is swallowed whole (unmapped keys
- * must not leak garbage chars into a query), and a lone ESC decodes to
- * `escape`. Terminals send arrow sequences atomically in practice; a sequence
- * split across chunks degrades to `escape` + literal chars, which is safe
- * (escape cancels).
- */
-export declare function decodeKeys(chunk: Buffer | string): Key[];

package/dist/components/select.d.ts

@@ -1,28 +0,0 @@
-import { type ComponentIO, type InteractiveResult } from "./input.js";
-/**
- * SelectList (U.7): arrow-key pick from a short list of options. Single-select
- * only — multi-select is a deliberate seam for a later build (the result type
- * and key loop extend without breaking callers).
- */
-export interface SelectOptions<T> {
-    /** Label an item renders under. Defaults to `String(item)`. */
-    toLabel?: (item: T) => string;
-    /** Header row above the options. */
-    title?: string;
-    /** Index highlighted first (so Enter-once picks a sensible default). */
-    initialIndex?: number;
-    /** Non-TTY fallback: resolve to this instead of failing loud. */
-    defaultValue?: T;
-    /** `--flag` alternatives listed in the non-TTY error. */
-    nonInteractiveHint?: string[];
-    /** Visible rows before the list scrolls (default 10). */
-    maxVisible?: number;
-}
-/**
- * Pick one item: ↑/↓ move (wrapping past either end), Enter selects the
- * highlighted item, Esc / Ctrl-C / EOF cancel. Renders a transient frame via
- * the shared U.7 frame (width-truncated rows, no soft-wrap) and erases it
- * completely before resolving. Empty `items` resolves cancelled — there is
- * nothing to select.
- */
-export declare function selectList<T>(items: readonly T[], opts?: SelectOptions<T>, io?: ComponentIO): Promise<InteractiveResult<T>>;

package/dist/config/credentials.d.ts

@@ -1,18 +0,0 @@
-/** `~/.cruxy/credentials.json` */
-export declare function credentialsPath(): string;
-/** The stored key for `provider`, or `undefined`. Never throws. */
-export declare function readCredential(provider: string, file?: string): string | undefined;
-/**
- * The stored MCP bearer token for credential name `ref`, or `undefined` (C.27c).
- * Reads ONLY this owner-only store — never the environment, never any config file
- * — so a project config that merely NAMES a credential can never widen where the
- * secret is sourced from. Never throws.
- */
-export declare function readMcpCredential(ref: string, file?: string): string | undefined;
-/** Persist MCP bearer token for credential name `ref`. Same owner-only guarantee. */
-export declare function writeMcpCredential(ref: string, token: string, file?: string): void;
-/**
- * Persist `key` for `provider`, merging into any existing store. Written
- * owner-only (see {@link writeInto}); refuses loudly if that can't be enforced.
- */
-export declare function writeCredential(provider: string, key: string, file?: string): void;

package/dist/config/index.d.ts

@@ -1,5 +0,0 @@
-export * from "./schema.js";
-export * from "./paths.js";
-export * from "./manager.js";
-export * from "./project.js";
-export * from "./credentials.js";

package/dist/config/manager.d.ts

@@ -1,39 +0,0 @@
-import { type CruxyConfig } from "./schema.js";
-export interface LoadOptions {
-    /** Explicit config file, bypassing project discovery. */
-    configPath?: string;
-    /** Start dir for project-config discovery (defaults to cwd). */
-    cwd?: string;
-}
-export interface LoadedConfig {
-    config: CruxyConfig;
-    sources: {
-        global: string | null;
-        project: string | null;
-        explicit: string | null;
-    };
-}
-/**
- * Resolution order (later wins):
- *   schema defaults -> global file -> project file (or explicit) -> env vars
- */
-export declare function loadConfig(opts?: LoadOptions): LoadedConfig;
-/** Resolve a dot-path (e.g. "model.temperature") against a config object. */
-export declare function getPath(obj: unknown, path: string): unknown;
-/**
- * Set a dot-path on the given config file (creating it if needed), validating
- * the full merged result before writing. Returns the written file path.
- */
-export declare function setValue(path: string, rawValue: string, file: string): string;
-/** Write a default config to `file` if it does not already exist. */
-export declare function initConfig(file: string): {
-    path: string;
-    created: boolean;
-};
-/**
- * Provider API key, resolved **env → credentials store → undefined**. The
- * environment always wins (CI / one-off overrides); the credentials store
- * (`~/.cruxy/credentials.json`, written by onboarding / `cruxy login`) is the
- * persistent fallback. The key is never read from `config.json`.
- */
-export declare function resolveApiKey(provider: string): string | undefined;

package/dist/config/owner-only.d.ts

@@ -1,19 +0,0 @@
-/**
- * Make `path` owner-only, or throw. On Windows the ACL is verified after the
- * edit (both the `icacls` exit code AND a read-back), so a returned call is a
- * genuine guarantee, never a best-effort attempt.
- *
- * @throws if owner-only permissions cannot be established (non-zero `icacls`,
- *   an unresolvable SID, a filesystem without ACLs/modes, …).
- */
-export declare function enforceOwnerOnly(path: string, opts?: {
-    directory?: boolean;
-}): void;
-/**
- * Whether `path` is currently owner-only. POSIX: no group/other bits. Windows:
- * best-effort — the ACL names no broad principal (Everyone / Authenticated
- * Users / Users). Used both to verify {@link enforceOwnerOnly} and to warn on a
- * pre-existing store with loose permissions. Returns `true` when it genuinely
- * cannot tell (a missing tool), so a warning path never cries wolf.
- */
-export declare function isOwnerOnly(path: string): boolean;

package/dist/config/paths.d.ts

@@ -1,9 +0,0 @@
-/** ~/.cruxy */
-export declare function globalDir(): string;
-/** ~/.cruxy/config.json */
-export declare function globalConfigPath(): string;
-/**
- * Walk up from `startDir` looking for a project config file. Returns the first
- * match, or null if none is found before the filesystem root.
- */
-export declare function findProjectConfig(startDir?: string): string | null;

package/dist/config/project.d.ts

@@ -1,10 +0,0 @@
-/**
- * Load project instructions from `cwd`: the first of CRUXY.md, then AGENTS.md
- * that exists is read and returned. A missing (or unreadable) file is not an
- * error — it simply yields `null`. Oversized files are truncated to `MAX_BYTES`
- * with a trailing notice so they can't blow up the system prompt.
- *
- * Only `cwd` is consulted (no parent-directory walk) — instructions are scoped
- * to the project you launched cruxy in.
- */
-export declare function loadProjectInstructions(cwd: string): string | null;