@cruxy/cli 1.7.0 → 1.8.0

package/dist/tools/schema-depth.js

@@ -0,0 +1,67 @@
+/**
+ * The provider's tool-schema depth bound, and the counter that measures against
+ * it. ONE home for both, because there are two consumers that must agree: the
+ * CI gate on our own built-ins (`schema-depth.test.ts`) and the runtime bound on
+ * third-party MCP schemas (`../mcp/bounds.ts`). A counter that disagreed with
+ * the bound, or two copies of either drifting apart, would mean a schema that
+ * passes here and dies on the wire.
+ */
+/**
+ * Nesting depth of the JSON Schema we put on the wire, counted the way the
+ * provider counts it: every container (object or array) is one level, scalars
+ * are free. So `{}` is 1, `{a: {}}` is 2, `{a: [{}]}` is 3.
+ *
+ * This is NOT the schema's semantic depth — JSON Schema's own wrapper keys
+ * (`properties`, `items`, `anyOf`) are containers too, so each semantic level a
+ * schema author writes costs TWO levels here, and a union costs two more on top
+ * (the `anyOf` array plus its member). That doubling is why a schema that reads
+ * as five levels deep to a human renders as eleven.
+ *
+ * Deliberately ITERATIVE. The obvious recursive form is a stack-overflow vector
+ * on the MCP path: `mcp.maxSchemaBytes` is the only thing bounding a third-party
+ * schema before it reaches this counter, and that setting has no upper bound in
+ * config (`config/schema.ts`), so a user who raises it hands a hostile server a
+ * crash. An explicit stack cannot blow up, whatever the cap is set to.
+ */
+export function schemaDepth(node) {
+    const isContainer = (n) => Array.isArray(n) || (typeof n === "object" && n !== null);
+    // Scalars are free — a non-container root is depth 0, not 1.
+    if (!isContainer(node))
+        return 0;
+    let deepest = 0;
+    const pending = [{ node, level: 1 }];
+    while (pending.length > 0) {
+        // Non-null: guarded by the loop condition.
+        const { node: current, level } = pending.pop();
+        if (level > deepest)
+            deepest = level;
+        // Arrays contribute their items, objects their values; scalar children are
+        // never pushed, which is exactly "scalars are free".
+        const children = Array.isArray(current)
+            ? current
+            : Object.values(current);
+        for (const child of children) {
+            if (isContainer(child))
+                pending.push({ node: child, level: level + 1 });
+        }
+    }
+    return deepest;
+}
+/**
+ * The provider rejects a tool schema nested 8 or more levels deep, and it
+ * rejects the whole REQUEST — one over-deep tool takes down every turn of every
+ * session, which is what shipped in 1.7.0. So the bound belongs in CI, not in a
+ * field report: any built-in whose rendered schema reaches 8 fails there.
+ *
+ * THIS NUMBER IS NOT OURS TO CHOOSE. It mirrors `maxSchemaDepth` in the gateway
+ * (cruxy-ai/api, `internal/httpx/structured.go`), which its tool validator
+ * applies to every `parameters` schema before any upstream call. Raising it here
+ * does not raise it there — it only moves the failure from a red CI run to every
+ * user's terminal. If a schema cannot fit, the schema changes.
+ *
+ * The bound is EXCLUSIVE: a schema is safe at `MAX_SCHEMA_DEPTH - 1` and dies at
+ * `MAX_SCHEMA_DEPTH`. Both consumers must spell that the same way — the CI gate
+ * asserts `depth < MAX_SCHEMA_DEPTH`, the MCP bound trips on
+ * `depth >= MAX_SCHEMA_DEPTH`.
+ */
+export const MAX_SCHEMA_DEPTH = 8;

package/dist/tui/index.js

@@ -5,6 +5,7 @@ export { ToolVersions, parseVersion, } from "./tool-versions.js";
 export { GitStatusCache, WorkspaceGitCache, } from "./git-status.js";
 export { WorkspaceDiskCache } from "./disk-status.js";
 export { createOverviewView } from "./overview.js";
+export { createPermissionsView } from "./permissions-view.js";
 export { createGitView, gitViewLines, GIT_VIEW_MAX_FILES, } from "./git-view.js";
 export { createTasksView, tasksViewLines, TASKS_VIEW_MAX_JOBS, TASKS_VIEW_TAIL, } from "./tasks-view.js";
 export { createSettingsView, settingsViewLines, formatSettingValue, } from "./settings-view.js";

package/dist/tui/limits-panel.js

@@ -101,6 +101,12 @@ const STALE_AFTER_MS = 5 * 60_000;
  * cap on every self-serve tier, is the window actually about to refuse the next
  * request. The bar is the thing that stops you, and the line under it names
  * which window that is so the figure is never ambiguous.
+ *
+ * `bindingWindow` HERE AND `scarcestWindow` FOR ADMISSION, deliberately not one
+ * selector for both (cli#212). A bar states a proportion, so the window it draws
+ * must be the one whose proportion is the warning; an admission check spends
+ * tokens, so it must take the smaller REMAINDER, which is sometimes the other
+ * window. `limits/reduce.ts` works the disagreement through.
  */
 function poolLines(theme, pool, now) {
     const binding = bindingWindow(pool.monthly, pool.burst);

package/dist/tui/panels.js

@@ -135,12 +135,24 @@ function describeRoutingMode(mode) {
     }
 }
 /**
- * The model panel's body (P4 track 4): which tier is actually running, and why.
+ * The model panel's body (P4 track 4): which tier is actually running, why, and
+ * — since the effort readout — how hard it reasoned.
  *
  * BEFORE THE FIRST TURN there is no served tier — the gateway has not answered
  * — so the panel shows the CONFIGURED value and says it is unresolved. Blank
  * would be worse than useless here: `auto` is the default, and a user looking
  * at an empty model panel cannot tell configuration from breakage.
+ *
+ * EFFORT GETS ITS OWN ROW rather than sharing the mode's, for the reason
+ * `gitPanelLines` gives above: at {@link RAIL_COLS} the two do not fit
+ * together. "downgraded (budget)" is already 19 of 24 columns, so pairing them
+ * would truncate the effort away in exactly the case — a downgrade — where a
+ * user most wants to see what they actually got. A panel that grows by one row
+ * is handled honestly by `stackPanels`; a value clipped mid-word is not.
+ *
+ * The row is present only when the gateway reported an effort. Absence here is
+ * the gateway saying nothing, which is not a fact about the request and does not
+ * earn a row; a reported `none` IS a fact about the request and gets one.
  */
 export function modelPanelLines(theme, state) {
     const { configured, served } = state;
@@ -154,6 +166,13 @@ export function modelPanelLines(theme, state) {
         served.mode === "auto_degraded"
             ? theme.warning(describeRoutingMode(served.mode))
             : theme.muted(describeRoutingMode(served.mode)),
+        // Labelled, like every other rail row: a bare `high` under a tier name says
+        // nothing about what is high. Muted throughout — effort is reporting, not a
+        // condition to act on, and styling a value the user did not choose as a
+        // warning would imply otherwise.
+        ...(served.reasoningEffort !== undefined
+            ? [theme.muted(`effort ${served.reasoningEffort}`)]
+            : []),
     ];
 }
 /**

package/dist/tui/permissions-view.js

@@ -0,0 +1,30 @@
+import { permissionsReport } from "../agent/permissions.js";
+import { permissionsReportLines } from "../render/permissions-view.js";
+/**
+ * The Permissions view (cli#196) — the second caller of `permissionsReport`,
+ * and as thin as the Overview view is, for the same reason: the screen is
+ * already built, this only gives it somewhere to LIVE.
+ *
+ * A command prints once into the scrollback and is gone by the next turn, which
+ * is the wrong lifetime for this particular fact. A standing grant is standing:
+ * it outlives the turn that made it, and the whole failure it guards against is
+ * a user forgetting what they already said yes to. A view is what lets "what am
+ * I currently allowing" be a thing you can look at rather than a thing you have
+ * to remember to ask.
+ *
+ * No `refresh` and no `live`. Every value is a field read over in-memory state
+ * — the mode and an array — so `lines` may recompute it at paint time, and the
+ * two things that move it (a grant taken at a prompt, a `/permissions revoke`)
+ * are both events the renderer already repaints for. A pulse would be a
+ * standing cost for a screen that changes a handful of times a session.
+ *
+ * READ-ONLY, deliberately. Revoking is `/permissions revoke <n>`: a view takes
+ * no input, and the key lease belongs to overlays.
+ */
+export function createPermissionsView(session) {
+    return {
+        id: "permissions",
+        label: "permissions",
+        lines: (theme, cols) => permissionsReportLines(permissionsReport(session), theme, cols),
+    };
+}

package/dist/tui/renderer.js

@@ -275,11 +275,17 @@ export class TuiRenderer {
      * Attach the limits cache (P9). Set after construction like the context gauge,
      * because the credential it reads with is resolved alongside the session.
      *
-     * NO PROBE HAPPENS HERE. The first read is deferred to the first paint that
-     * actually shows the panel — the rule the tool probes already follow — so a
-     * user who keeps `limits` closed, or who runs a one-shot that never paints a
-     * rail, never makes the request at all. The panel is a status surface; it does
-     * not get to spend a round trip on someone who is not looking at it.
+     * NO PROBE HAPPENS HERE. The first read this class kicks off is deferred to
+     * the first paint that actually shows the panel — the rule the tool probes
+     * already follow — because a panel is a status surface and does not get to
+     * spend a round trip on someone who is not looking at it.
+     *
+     * That is a statement about THIS class only, and it stopped being a statement
+     * about the process (cli#212): the same cache is the session's admission
+     * denominator, and `Session.send` refreshes it every turn whether or not any
+     * panel is open. Opening `limits` on turn ten therefore shows a live figure
+     * rather than a first probe — the reading was already being kept current for
+     * a reason that has nothing to do with the rail.
      */
     attachLimits(limits) {
         this.limits = limits;
@@ -714,7 +720,13 @@ export class TuiRenderer {
     servedRouting(routing) {
         if (this.closed)
             return;
-        const unchanged = this.served?.tier === routing.tier && this.served?.mode === routing.mode;
+        // Every field the panel and the status line actually draw is compared. A
+        // partial check here is not a missed repaint, it is a WRONG one held: the
+        // effort would keep reporting the previous request's value while the tier
+        // beside it described this one, and the two would be read as one statement.
+        const unchanged = this.served?.tier === routing.tier &&
+            this.served?.mode === routing.mode &&
+            this.served?.reasoningEffort === routing.reasoningEffort;
         if (unchanged)
             return;
         this.served = routing;
@@ -750,14 +762,21 @@ export class TuiRenderer {
         this.refreshViews();
     }
     /**
-     * Re-read the account's headroom after a turn (P9) — the one moment it is
-     * KNOWN to have moved, because this process just spent some of it.
+     * REPAINT the headroom panel once the turn's reading lands (P9) — no longer
+     * the thing that decides whether the reading happens at all (cli#212).
+     *
+     * `Session.send` now drives `refresh` on every turn, because the reading is
+     * the denominator fan-out admission divides by and not merely a figure on a
+     * panel. That retires the argument this method used to make for skipping the
+     * probe while the panel is closed: a user who hides the figures still spends
+     * the window, and the check that bounds them still has to read it.
      *
-     * Same rules as the git probe: never awaited, a failure leaves the last good
-     * reading standing, and the cache coalesces. Unlike git it is also floored by
-     * a minimum interval, because this one crosses the network — and unlike git it
-     * is skipped entirely while the panel is closed, since a user who has hidden
-     * the figures has no use for the request that fetches them.
+     * What is left is a repaint hook, so the open-panel gate stays — there is
+     * nothing to repaint for a panel nobody is looking at. Calling `refresh` is
+     * how it waits: the cache coalesces onto the turn's in-flight request, so this
+     * resolves exactly when that one lands rather than starting a second. Same
+     * rules as the git probe otherwise — never awaited, and a failure leaves the
+     * last good reading standing.
      */
     refreshLimits() {
         const limits = this.limits;
@@ -1111,13 +1130,26 @@ export class TuiRenderer {
             return phase;
         if (this.modelPanelVisible(width)) {
             // Rebuilt rather than destructured, so the fields kept are stated rather
-            // than implied: only the tier goes, the token counts stay.
+            // than implied: only the tier and the effort go, the token counts stay.
+            // Effort travels with the tier because it is part of the same claim — the
+            // panel says both, and a line reporting `effort high` next to a suppressed
+            // tier would be an orphaned qualifier for a fact on another surface.
             return phase.tokens === undefined
                 ? { kind: "thinking" }
                 : { kind: "thinking", tokens: phase.tokens };
         }
+        // The status line is the only surface left, so it carries both. `effort`
+        // has no asked-for counterpart to fall back to the way `tier` does: the
+        // client never chooses one, so it exists only if the gateway reported it.
         const tier = this.served?.tier ?? phase.tier;
-        return tier === undefined ? phase : { ...phase, tier };
+        const effort = this.served?.reasoningEffort;
+        if (tier === undefined && effort === undefined)
+            return phase;
+        return {
+            ...phase,
+            ...(tier !== undefined ? { tier } : {}),
+            ...(effort !== undefined ? { effort } : {}),
+        };
     }
     statusLine(width) {
         if (this.rawStatus !== null)

package/dist/usage/collect.js

@@ -72,6 +72,9 @@ export class UsageCollector {
             ...(req.routingMode !== undefined
                 ? { routingMode: req.routingMode }
                 : {}),
+            ...(req.reasoningEffort !== undefined
+                ? { reasoningEffort: req.reasoningEffort }
+                : {}),
             at: this.now(),
         });
     }

package/dist/usage/types.js

@@ -100,6 +100,16 @@ export const UsageEntrySchema = z
      * whether that was routing working as asked or a budget downgrade.
      */
     routingMode: z.string().optional(),
+    /**
+     * The reasoning effort the gateway says it applied, verbatim from
+     * `routing.reasoning_effort`. Recorded, not displayed — like
+     * {@link routingMode}, this is forensic: it is what makes two requests on
+     * the same tier costing very different amounts explainable after the fact.
+     *
+     * Absent means the gateway reported nothing, NOT that no reasoning ran; a
+     * gateway saying so writes the literal `"none"`.
+     */
+    reasoningEffort: z.string().optional(),
     /** ISO-8601 timestamp the request completed. */
     at: z.string(),
 })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cruxy/cli",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "an agentic coding CLI",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
     "undici": "^6.21.0",
     "zod": "^3.23.8",
     "zod-to-json-schema": "^3.23.5",
-    "@cruxy/sdk": "0.5.0"
+    "@cruxy/sdk": "0.6.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^12.11.1"