@cruxy/cli 1.3.0 → 1.5.0

package/dist/agent/status.js

@@ -0,0 +1,96 @@
+import { readContext } from "./context.js";
+import { modeDescription } from "./mode.js";
+import { globalDir } from "../config/paths.js";
+import { GLOBAL_DIR_NAME } from "../constants.js";
+/**
+ * Where the disk figures come from: every declared root, plus `~/.cruxy`.
+ *
+ * The home directory is in the list because it is the one that fills up
+ * invisibly. A root's usage is the user's own files, which they know about;
+ * `~/.cruxy` accumulates session transcripts, the usage store and — the big one
+ * — a checkpoint shadow copy per run. Reporting only the roots would leave the
+ * cruxy-specific half of "why is this disk full" out of cruxy's own status
+ * screen.
+ */
+function diskLocations(roots, disk) {
+    const locations = [];
+    for (const root of roots) {
+        const capacity = disk(root.absPath);
+        if (capacity)
+            locations.push({ label: root.name, capacity });
+    }
+    const home = disk(globalDir());
+    // Labelled `~/.cruxy` rather than the resolved path: the row is 40 columns of
+    // numbers already, and the literal home path adds width without adding a fact
+    // — `/status` prints every root's real path a few lines further down anyway.
+    if (home)
+        locations.push({ label: `~/${GLOBAL_DIR_NAME}`, capacity: home });
+    return locations;
+}
+/** Count real user turns: `role: "user"` with STRING content — tool results
+ * are also role "user" but carry blocks, so this counts what the human said. */
+function userTurns(session) {
+    return session.messages.filter((m) => m.role === "user" && typeof m.content === "string").length;
+}
+/** Everything `/status` and the Overview view show, from live session state. */
+export function buildSessionStatus(session, git, 
+/**
+ * The tier the gateway last said actually SERVED a request, when the caller
+ * is somewhere that knows it. Only the TUI renderer tracks this — it arrives
+ * on the stream's routing frame — so `/status`, which has no renderer, omits
+ * it and shows the configured value alone.
+ */
+servedTier, 
+/**
+ * Free space where cruxy writes. Omitted rather than defaulted to a live
+ * probe: a caller that doesn't supply one gets no disk rows, which is the
+ * only safe default for a function whose whole contract is that it never
+ * touches the world itself.
+ */
+disk) {
+    const toolCtx = session.toolContext;
+    const config = toolCtx.config;
+    const mode = session.getMode();
+    const roots = toolCtx.workspace.roots().map((r) => {
+        const info = git(r.absPath);
+        return {
+            name: r.name,
+            path: r.absPath,
+            primary: r.primary,
+            // Spread rather than assigned, so "not probed" stays ABSENT rather than
+            // becoming an explicit `undefined` the renderer would have to re-check.
+            ...(info === undefined ? {} : { git: info }),
+        };
+    });
+    const jobs = session.jobs?.list();
+    const locations = disk
+        ? diskLocations(toolCtx.workspace.roots(), disk)
+        : undefined;
+    return {
+        sessionId: session.sessionId,
+        turns: userTurns(session),
+        mode,
+        modeDescription: modeDescription(mode),
+        ...(session.model ? { model: session.model.current() } : {}),
+        ...(servedTier === undefined ? {} : { servedTier }),
+        provider: config.model.provider,
+        roots,
+        context: readContext(session.messages, config.context),
+        sandboxEnabled: Boolean(toolCtx.sandbox),
+        ...(toolCtx.sandbox ? { sandboxRuntime: toolCtx.sandbox.runtimeName } : {}),
+        checkpoints: Boolean(toolCtx.checkpointsActive),
+        // Absent when nothing could be read, not an empty array — same rule as the
+        // rest of this object: an omitted field is a fact we don't have.
+        ...(locations && locations.length > 0 ? { disk: locations } : {}),
+        ...(jobs
+            ? {
+                jobs: {
+                    total: jobs.length,
+                    running: jobs.filter((j) => j.status === "running").length,
+                    needingApproval: jobs.filter((j) => j.pendingApproval).length,
+                },
+            }
+            : {}),
+        tools: session.toolRegistry.list().length,
+    };
+}

package/dist/cli/commands/run.js

@@ -1,10 +1,12 @@
 import { Command } from "commander";
 import { randomUUID } from "node:crypto";
+import { LimitsClient } from "@cruxy/sdk";
+import { LimitsCache } from "../../limits/index.js";
 import { logger } from "../../utils/logger.js";
 import { SessionLog, listSessions, resumeById, resumePicker, shortId, } from "../../session/index.js";
 /** Sessions shown in the TUI sidebar — the same depth as the resume picker. */
 const SIDEBAR_SESSIONS = 10;
-import { loadConfig, resolveApiKey } from "../../config/index.js";
+import { globalDir, loadConfig, resolveApiKey } from "../../config/index.js";
 import { agentIncomplete, authMissingKey, shouldUseColor, usageError, } from "../../errors/index.js";
 import { createRenderer } from "../../render/index.js";
 import { themeForColor } from "../../theme/index.js";
@@ -14,7 +16,7 @@ import { SandboxService } from "../../sandbox/index.js";
 import { buildHooksService, buildHooksRouter } from "../../hooks/index.js";
 import { DEFAULT_MODE, } from "../../agent/index.js";
 import { runInteractive } from "../repl.js";
-import { ContextGauge, createKeyLease, runTui, TuiRenderer, } from "../../tui/index.js";
+import { ContextGauge, createKeyLease, createGitView, createOverviewView, createSettingsView, createTasksView, runTui, TuiRenderer, WorkspaceDiskCache, WorkspaceGitCache, } from "../../tui/index.js";
 import { buildAgentSession } from "../session-factory.js";
 import { apiKeyEnvVar, maybeRunOnboarding } from "../onboard.js";
 import { resetLspServices } from "../../lsp/index.js";
@@ -71,7 +73,10 @@ export async function executeRun(promptParts, opts) {
             ]
             : [`provide a task, e.g. ${invokedAs} "fix the failing test"`]);
     }
-    const { config, sources } = loadConfig();
+    // Kept whole (not destructured away) because the Settings view needs the raw
+    // layers this result was merged from to say where each value came from.
+    const loaded = loadConfig();
+    const { config, sources } = loaded;
     let apiKey = resolveApiKey(config.model.provider);
     // Declared workspace roots (C.26). This is the ONE place `run` reads the
     // process working directory — the invocation directory is the base for
@@ -337,6 +342,52 @@ export async function executeRun(promptParts, opts) {
     // provider, where the constructor's static value stands and `/model` declines.
     if (session.model)
         tui?.attachModel(session.model);
+    // The limits rail panel (P9) — the account's headroom, read from the gateway
+    // that enforces it.
+    //
+    // ONLY ON THE CRUXY PROVIDER, and only with a key. `/limits` is a cruxy
+    // gateway endpoint; a bring-your-own-provider session has no such notion, and
+    // pointing this at someone else's base URL would be a request to a stranger.
+    // The cache is still attached without a key so the panel can say "not signed
+    // in" — a fact worth stating, and one that costs no request to establish.
+    const limitsKey = config.model.provider === "cruxy" ? apiKey : undefined;
+    tui?.attachLimits(new LimitsCache(limitsKey === undefined
+        ? undefined
+        : (signal) => new LimitsClient({
+            apiKey: limitsKey,
+            gatewayUrl: config.cruxy.gatewayUrl,
+        }).read(signal)));
+    // The main-pane views (P7). Registered here — the one place that has both the
+    // renderer and the session — and after the session exists, because a view
+    // reads its live state. Each root gets its own cached git probe: writes fan
+    // across every declared root when checkpoints are on, so a primary-only
+    // answer would under-report what a turn actually touched.
+    if (tui) {
+        // ONE cache, both views. They ask the same question of the same trees, and
+        // a second instance would double the subprocesses to hold two copies of an
+        // answer that must agree anyway.
+        const workspaceGit = new WorkspaceGitCache(session.toolContext.workspace.roots().map((r) => r.absPath));
+        // Every root, plus `~/.cruxy` — the two kinds of place a run fills up. The
+        // home directory is the one nobody watches: checkpoints shadow-copy the
+        // tree once per run, and they accumulate there rather than in the repo.
+        const workspaceDisk = new WorkspaceDiskCache([
+            ...session.toolContext.workspace.roots().map((r) => r.absPath),
+            globalDir(),
+        ]);
+        tui.attachViews([
+            createOverviewView(session, workspaceGit, () => tui.servedTier(), workspaceDisk),
+            createGitView(() => session.toolContext.workspace.roots(), workspaceGit),
+            // Registered even when background jobs are disabled — the view says so,
+            // and a nav whose rows appear and vanish with config is worse than one
+            // row that explains itself. `session.jobs` is undefined in that case.
+            createTasksView(session.jobs),
+            // The SAME loaded config the session was built from, not a fresh read —
+            // the view's whole claim is "what this session is running on", and a
+            // second load could already disagree with it. `apiKey` is a getter
+            // because onboarding may have supplied one after this line was written.
+            createSettingsView(loaded, () => apiKey !== undefined),
+        ]);
+    }
     if (multiTurn) {
         try {
             // Same session, same renderer seam, two shells: the TUI when the

package/dist/cli/session-commands.js

@@ -1,13 +1,15 @@
 import { MODE_LABELS, SESSION_MODES, modeDescription, modeFromFlags, parseMode, } from "../agent/index.js";
 import { existsSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { contextReport, readContext } from "../agent/context.js";
+import { contextReport } from "../agent/context.js";
+import { buildSessionStatus } from "../agent/status.js";
 import { scaffoldProjectInstructions } from "../config/index.js";
 import { resolveSlash } from "../hooks/index.js";
 import { contextReportLines } from "../render/context-view.js";
 import { renderUnifiedDiff } from "../render/index.js";
 import { sessionStatusLines } from "../render/status-view.js";
 import { defaultExportName, exportMarkdown } from "../session/index.js";
+import { readDiskCapacitySync } from "../utils/disk.js";
 import { getGitInfo } from "../utils/git.js";
 import { currentBranch, diffAgainst, hasChanges } from "../vcs/git.js";
 import { MODEL_CHOICES, describeModelChoice, parseModelChoice, } from "../routing/index.js";
@@ -365,57 +367,22 @@ function handleInit(ctx) {
  */
 function handleStatus(ctx) {
     const { out, session } = ctx;
-    const toolCtx = session.toolContext;
-    const config = toolCtx.config;
-    const mode = session.getMode();
-    // A real user turn is `role: "user"` with STRING content — tool results are
-    // also role "user" but carry blocks, so this counts what the human said.
-    const turns = session.messages.filter((m) => m.role === "user" && typeof m.content === "string").length;
-    const roots = toolCtx.workspace.roots().map((r) => {
-        // A synchronous probe, on an explicitly-requested command. The rail's rule
-        // (never probe on the paint path) is about frames, not about a user who
-        // just asked; there is no frame budget to blow here.
-        const git = getGitInfo(r.absPath);
-        return {
-            name: r.name,
-            path: r.absPath,
-            primary: r.primary,
-            ...(git === null ? {} : { branch: git.branch, changed: git.changed }),
-        };
-    });
-    const jobs = session.jobs?.list();
-    for (const line of sessionStatusLines({
-        sessionId: session.sessionId,
-        turns,
-        mode,
-        modeDescription: modeDescription(mode),
-        ...(session.model ? { model: session.model.current() } : {}),
-        provider: config.model.provider,
-        roots,
-        context: readContext(session.messages, config.context),
-        sandboxEnabled: Boolean(toolCtx.sandbox),
-        ...(toolCtx.sandbox
-            ? { sandboxRuntime: toolCtx.sandbox.runtimeName }
-            : {}),
-        checkpoints: Boolean(toolCtx.checkpointsActive),
-        ...(jobs
-            ? {
-                jobs: {
-                    total: jobs.length,
-                    running: jobs.filter((j) => j.status === "running").length,
-                    needingApproval: jobs.filter((j) => j.pendingApproval).length,
-                },
-            }
-            : {}),
-        tools: toolCount(ctx),
-    }, out.theme)) {
+    // A SYNCHRONOUS probe, and the one caller allowed one. The paint path's rule
+    // (never spawn during compose) is about frames; a user who just typed
+    // `/status` has no frame budget to blow, and an answer that says "checking…"
+    // for a fact this could have fetched would be worse than the 45ms.
+    //
+    // Everything else comes from the shared builder, so this and the Overview
+    // view cannot drift: they differ in exactly this argument and nowhere else.
+    const status = buildSessionStatus(session, (absPath) => getGitInfo(absPath), undefined, 
+    // Synchronous here for the same reason git is: the user asked. This one is
+    // a single syscall rather than two subprocesses, so it costs microseconds
+    // on any disk that is answering at all.
+    (path) => readDiskCapacitySync(path));
+    for (const line of sessionStatusLines(status, out.theme)) {
         out.print(out.fit(line));
     }
 }
-/** Tools advertised to the model this session — the registry the loop dispatches against. */
-function toolCount(ctx) {
-    return ctx.session.toolRegistry.list().length;
-}
 /**
  * `/diff` (P6 track 4) — what has changed on disk, without leaving the session.
  *

package/dist/components/keys.js

@@ -3,6 +3,7 @@
  * transformation — no terminal, no state — so every mapping row is directly
  * unit-testable. The stateful raw-mode plumbing lives in `input.ts`.
  */
+const CTRL_B = 0x02;
 const CTRL_C = 0x03;
 const CTRL_D = 0x04;
 const CTRL_K = 0x0b;
@@ -18,6 +19,18 @@ const DELETE = 0x7f;
  * unlike the arrows it is safe to accept with OR without parameters.
  */
 const CBT = 0x5a;
+/**
+ * CSI final byte `~` — the "tilde sequence" family, where the NUMERIC PARAMETER
+ * carries the identity (`5` = Page Up, `6` = Page Down) rather than the final
+ * byte. That inverts the arrow rule below: for `~` the parameter must be read,
+ * not rejected, so these are matched on the leading number instead.
+ */
+const TILDE = 0x7e;
+/** Leading `~`-sequence parameter → key. `ESC [ 5 ~` / `ESC [ 6 ~`. */
+const TILDES = {
+    5: "page-up",
+    6: "page-down",
+};
 /** CSI final byte → arrow key, for `ESC [ <final>` sequences. */
 const ARROWS = {
     0x41: "up", // A
@@ -61,6 +74,26 @@ export function decodeKeys(chunk) {
                         i = j + 1;
                         continue;
                     }
+                    if (buf[j] === TILDE) {
+                        // `ESC [ <n> ~`. The number is the key, so it is read rather than
+                        // rejected — the opposite of the arrow rule below, and for the same
+                        // underlying reason: match on whatever byte actually carries the
+                        // identity. A modifier (`ESC [ 5 ; 2 ~`) still means Page Up, so
+                        // only the parameter BEFORE the first `;` is parsed; an unmapped
+                        // number (`3` = Delete) falls through and is swallowed like any
+                        // other unbound sequence.
+                        let n = 0;
+                        let digits = 0;
+                        for (let k = i + 2; k < j && buf[k] >= 0x30 && buf[k] <= 0x39; k++) {
+                            n = n * 10 + (buf[k] - 0x30);
+                            digits++;
+                        }
+                        const tilde = digits > 0 ? TILDES[n] : undefined;
+                        if (tilde)
+                            keys.push({ kind: tilde });
+                        i = j + 1;
+                        continue;
+                    }
                     // Only a bare `ESC [ <final>` maps to an arrow; parameterized
                     // sequences (modifier arrows, Home/End variants) are swallowed —
                     // an unmapped combo must do nothing, not act as a plain arrow.
@@ -79,6 +112,11 @@ export function decodeKeys(chunk) {
             i++;
             continue;
         }
+        if (byte === CTRL_B) {
+            keys.push({ kind: "ctrl-b" });
+            i++;
+            continue;
+        }
         if (byte === CTRL_C) {
             keys.push({ kind: "ctrl-c" });
             i++;

package/dist/config/effective.js

@@ -0,0 +1,225 @@
+import { ENV_OVERRIDES, } from "./manager.js";
+/** What a redacted scalar renders as. A marker, never a length-preserving mask
+ * — a mask that matched the length would leak the length. */
+export const REDACTED = "<redacted>";
+/** Layers in precedence order (last wins), paired with the origin they name. */
+function layerOrder(layers) {
+    return [
+        ["global", layers.global],
+        ["project", layers.project],
+        ["explicit", layers.explicit],
+        ["env", layers.env],
+    ];
+}
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Whether `layer` explicitly sets `path`.
+ *
+ * Presence, not definedness: `in` rather than `!== undefined`, because a key
+ * written as `null` was still written, and reporting it as "default" would
+ * point someone at the schema for a value their file is responsible for.
+ */
+function hasPath(layer, path) {
+    if (layer === null)
+        return false;
+    let cursor = layer;
+    for (const key of path.split(".")) {
+        if (!isPlainObject(cursor) || !(key in cursor))
+            return false;
+        cursor = cursor[key];
+    }
+    return true;
+}
+/** The highest-precedence layer that set `path`, or `default` if none did. */
+function originOf(layers, path) {
+    let found = "default";
+    for (const [origin, layer] of layerOrder(layers)) {
+        if (hasPath(layer, path))
+            found = origin;
+    }
+    return found;
+}
+/**
+ * Paths whose value NAMES a secret rather than being one — checked before the
+ * name heuristic below, which would otherwise redact both of them.
+ *
+ * This distinction is the whole point of these two fields: `credentialRef` and
+ * `apiKeyEnv` exist so that a config file can say WHERE the secret comes from
+ * without containing it, and redacting them would hide the answer to "which
+ * credential is this server using" while protecting nothing.
+ */
+const SECRET_REFERENCE_PATHS = [
+    /^mcp\.servers\.[^.]+\.credentialRef$/,
+    /^web\.apiKeyEnv$/,
+];
+/**
+ * Paths that carry a live secret, structurally.
+ *
+ * `mcp.servers.<id>.headers.<name>` is the obvious one — the schema calls a live
+ * header value a secret in so many words, and only accepts it from user-scope
+ * config for that reason. `env` is the same class by a different route: it is
+ * how a stdio server is handed its token (`GITHUB_TOKEN`, `…_API_KEY`), and the
+ * fact that it is spelled as an environment variable rather than a header
+ * changes nothing about what is in it.
+ */
+const SECRET_VALUE_PATHS = [
+    /^mcp\.servers\.[^.]+\.headers\.[^.]+$/,
+    /^mcp\.servers\.[^.]+\.env\.[^.]+$/,
+];
+/**
+ * Backstop for keys that do not exist yet.
+ *
+ * The structural rules above enumerate today's secret-carrying paths, and an
+ * enumeration is exactly the kind of thing a later schema addition forgets to
+ * update — at which point a new key holding a credential renders in full on a
+ * pane someone is screen-sharing. So the leaf NAME is also checked, and the
+ * failure mode is inverted: a new secret is redacted by default, and a false
+ * positive costs one line of a read-only pane (the value is still readable
+ * with `cruxy config get`).
+ *
+ * `token` is NOT in this list, and that omission is the whole reason the rule
+ * needs stating carefully. In this schema "token" almost always means an LLM
+ * token: `context.maxTokens`, `memory.maxRecallTokens`,
+ * `agent.maxTokensPerTurn`, `index.search.tokenBudget`. A heuristic that
+ * matched it would blank out a dozen of the most-consulted numbers in the
+ * product to protect nothing — a redaction that hides only ordinary values
+ * teaches the reader that `<redacted>` means "noise", which is exactly how a
+ * real one gets skimmed past. {@link isSecretPath} catches the credential-ish
+ * senses of the word through the value type instead: a token COUNT is a
+ * number, a bearer token is a string.
+ */
+const SECRET_NAME = /(secret|password|passwd|apikey|api_key|credential)/i;
+/** Names that are secret-shaped only when they carry a string. */
+const SECRET_NAME_IF_STRING = /(token|bearer)/i;
+/** Whether this leaf's value must never be printed. */
+function isSecretPath(path, value) {
+    if (SECRET_REFERENCE_PATHS.some((re) => re.test(path)))
+        return false;
+    if (SECRET_VALUE_PATHS.some((re) => re.test(path)))
+        return true;
+    const leaf = path.split(".").pop() ?? "";
+    if (SECRET_NAME.test(leaf))
+        return true;
+    return typeof value === "string" && SECRET_NAME_IF_STRING.test(leaf);
+}
+/**
+ * A URL with its credential-carrying parts removed: userinfo (`user:pass@`) and
+ * the query string, which is where a remote MCP endpoint's token most often
+ * rides (`?token=…`). The origin and path survive, because WHICH server this is
+ * remains the useful part and it is not the sensitive one.
+ *
+ * Returns null when nothing had to be removed, so an ordinary URL is not
+ * flagged as redacted.
+ */
+function redactUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        // Not parseable as a URL — the schema rejects those, but this module is
+        // also handed layers that never reached the schema. Leave it alone rather
+        // than guess at its structure.
+        return null;
+    }
+    const hadUserinfo = url.username !== "" || url.password !== "";
+    const hadQuery = url.search !== "";
+    if (!hadUserinfo && !hadQuery)
+        return null;
+    url.username = "";
+    url.password = "";
+    if (hadQuery)
+        url.search = "";
+    let out = url.toString();
+    // Both removals are MARKED rather than silent: a URL that quietly lost its
+    // query reads as the whole address, and someone debugging why a server 401s
+    // would be looking at a string their config does not contain.
+    if (hadQuery)
+        out += `?${REDACTED}`;
+    if (hadUserinfo)
+        out = out.replace("://", `://${REDACTED}@`);
+    return out;
+}
+/** One leaf's display value, with any secret removed. */
+function redact(path, value) {
+    if (isSecretPath(path, value))
+        return { value: REDACTED, redacted: true };
+    if (typeof value === "string" && /^https?:\/\//i.test(value)) {
+        const stripped = redactUrl(value);
+        if (stripped !== null)
+            return { value: stripped, redacted: true };
+    }
+    return { value, redacted: false };
+}
+/**
+ * Depth-first walk to the leaves.
+ *
+ * A leaf is anything that is not a plain object — INCLUDING an array (the merge
+ * replaces arrays wholesale, so an array is one decision, not many) and an
+ * empty object, which is a real answer: `routing.map: {}` is what "routing is
+ * configured but inert" looks like, and a walk that recursed into it would emit
+ * nothing and leave the key looking unset.
+ *
+ * The walk is over the RESOLVED config, so what it yields is exactly the keys
+ * that have an effective value. A schema key that is optional with no default
+ * (`shell.executable`, `git.defaultBase`, `test.command`) therefore has no row
+ * while it is unset — there is no value to attribute and no layer to blame.
+ * The moment any layer sets one it appears, correctly attributed, because JSON
+ * cannot express `undefined`: a key present in a file is present in the merge.
+ * Enumerating the schema's unset knobs is a job for documentation and
+ * `cruxy config set`, not for a pane whose subject is what is in effect.
+ */
+function walk(value, prefix, out) {
+    if (isPlainObject(value) && Object.keys(value).length > 0) {
+        for (const [key, child] of Object.entries(value)) {
+            walk(child, prefix === "" ? key : `${prefix}.${key}`, out);
+        }
+        return;
+    }
+    out.push({ path: prefix, value });
+}
+/**
+ * Every effective setting, in schema order, with its origin and nothing secret.
+ *
+ * Schema order rather than alphabetical or overrides-first: this is read by
+ * scanning, and a list that reorders itself as values change moves the row
+ * being read out from under the reader — the same reason the Tasks view keeps
+ * dispatch order.
+ */
+export function effectiveSettings(loaded) {
+    const leaves = [];
+    walk(loaded.config, "", leaves);
+    return leaves.map(({ path, value }) => {
+        const { value: shown, redacted } = redact(path, value);
+        return {
+            path,
+            value: shown,
+            redacted,
+            origin: originOf(loaded.layers, path),
+        };
+    });
+}
+/**
+ * Which environment variables are contributing to this result, by name. Read
+ * off the layer this load actually built, through the one {@link ENV_OVERRIDES}
+ * table — never `process.env`, so what is named is what was USED (a variable
+ * exported after startup is not in effect, and must not be listed as if it is).
+ */
+export function envOverrideNames(loaded) {
+    return ENV_OVERRIDES.filter(({ path }) => hasPath(loaded.layers.env, path)).map(({ envVar }) => envVar);
+}
+/** The file a given origin was read from, when it has one. */
+export function originFile(loaded, origin) {
+    switch (origin) {
+        case "global":
+            return loaded.sources.global;
+        case "project":
+            return loaded.sources.project;
+        case "explicit":
+            return loaded.sources.explicit;
+        default:
+            return null;
+    }
+}

package/dist/config/index.js

@@ -1,5 +1,6 @@
 export * from "./schema.js";
 export * from "./paths.js";
 export * from "./manager.js";
+export * from "./effective.js";
 export * from "./project.js";
 export * from "./credentials.js";