@datename/fastcode-termux 0.1.6-beta → 0.1.8-beta.0

package/dist/commands/about.js

@@ -9,7 +9,7 @@ export const aboutCommand = {
             `Platform: ${platformLabel()}  •  Node ${process.version}`,
             ``,
             `GitHub:   https://github.com/dateName/fastcode-termux`,
-            `Skills:   https://skillshub.wtf`,
+            `Skills:   configure a registry with /skills registry <url>`,
         ];
         return { message: lines.join("\n") };
     },

package/dist/commands/clear.d.ts

@@ -7,5 +7,6 @@ export declare const clearCommand: {
     }): {
         message: string;
         silent: boolean;
+        cleared: boolean;
     };
 };

package/dist/commands/clear.js

@@ -4,6 +4,6 @@ export const clearCommand = {
     aliases: ["cls"],
     run({ actions }) {
         actions.clearHistory();
-        return { message: "Conversation cleared.", silent: false };
+        return { message: "Conversation cleared.", silent: false, cleared: true };
     },
 };

package/dist/commands/compact.d.ts

@@ -6,5 +6,17 @@ export declare const compactCommand: {
         actions: any;
     }): {
         message: string;
+        compacted?: undefined;
+    } | {
+        message: string;
+        compacted: {
+            summaryRef: string;
+            source: string;
+            beforeTokens: number;
+            afterTokens: number;
+            droppedMessages: number;
+            keepMessages: number;
+            reason: string;
+        };
     };
 };

package/dist/commands/compact.js

@@ -1,11 +1,14 @@
-import { compactMessages, DEFAULT_COMPACTION_CONFIG } from "../agent/compaction.js";
+import { compactMessages, compactionConfigFromEnv } from "../agent/compaction.js";
 import { getModelMeta } from "../lib/model-meta.js";
 export const compactCommand = {
     name: "compact",
     description: "Force local context compaction now",
     run({ state, actions }) {
+        const config = compactionConfigFromEnv();
+        if (!config.enabled)
+            return { message: "Compaction is disabled by FASTCODE_COMPACTION." };
         const meta = getModelMeta(state.providerId, state.model);
-        const result = compactMessages(state.history, { ...DEFAULT_COMPACTION_CONFIG, localThresholdRatio: 0 }, {
+        const result = compactMessages(state.history, { ...config, localThresholdRatio: 0 }, {
             contextWindow: meta.contextWindow,
             providerId: state.providerId,
             model: state.model,
@@ -17,6 +20,15 @@ export const compactCommand = {
         return {
             message: `[context compacted] ${result.beforeTokens} → ${result.afterTokens} tokens (${result.droppedMessages} messages summarized).` +
                 (result.summaryFile ? `\nSummary: ${result.summaryFile}` : ""),
+            compacted: {
+                summaryRef: result.summaryFile,
+                source: "local",
+                beforeTokens: result.beforeTokens,
+                afterTokens: result.afterTokens,
+                droppedMessages: result.droppedMessages,
+                keepMessages: result.keptMessages,
+                reason: "manual",
+            },
         };
     },
 };

package/dist/commands/context.js

@@ -1,22 +1,23 @@
-import { DEFAULT_COMPACTION_CONFIG, heapExceeded, localThresholdTokens } from "../agent/compaction.js";
+import { compactionConfigFromEnv, heapExceeded, localThresholdTokens } from "../agent/compaction.js";
 import { estMessagesTokens, getModelMeta } from "../lib/model-meta.js";
 export const contextCommand = {
     name: "context",
     description: "Show estimated context tokens, compaction threshold, and heap usage",
     run(ctx) {
         const meta = getModelMeta(ctx.state.providerId, ctx.state.model);
+        const config = compactionConfigFromEnv();
         const tokens = estMessagesTokens(ctx.state.history, {
             providerId: ctx.state.providerId,
             model: ctx.state.model,
         });
-        const threshold = localThresholdTokens(DEFAULT_COMPACTION_CONFIG, meta.contextWindow);
+        const threshold = localThresholdTokens(config, meta.contextWindow);
         const percent = meta.contextWindow > 0 ? (tokens / meta.contextWindow) * 100 : 0;
         const heapMb = process.memoryUsage().heapUsed / 1024 / 1024;
         return {
             message: [
                 `Context: ~${tokens.toLocaleString()} / ${meta.contextWindow.toLocaleString()} tokens (${percent.toFixed(1)}%)`,
-                `Compaction threshold: ${threshold.toLocaleString()} tokens (${Math.round(DEFAULT_COMPACTION_CONFIG.localThresholdRatio * 100)}%)`,
-                `Heap: ${heapMb.toFixed(1)} MB / ${DEFAULT_COMPACTION_CONFIG.heapLimitMb} MB${heapExceeded(DEFAULT_COMPACTION_CONFIG) ? "  [forced compaction]" : ""}`,
+                `Compaction threshold: ${threshold.toLocaleString()} tokens (${Math.round(config.localThresholdRatio * 100)}%)${config.enabled ? "" : "  [disabled]"}`,
+                `Heap: ${heapMb.toFixed(1)} MB / ${config.heapLimitMb} MB${heapExceeded(config) ? "  [forced compaction]" : ""}`,
                 `Messages: ${ctx.state.history.length}  ·  chars/token: ~${meta.charsPerToken}`,
             ].join("\n"),
         };

package/dist/commands/index.js

@@ -28,6 +28,7 @@ import { expandCommand } from "./expand.js";
 import { attachCommand } from "./attach.js";
 import { bgCommand } from "./bg.js";
 import { editCommand } from "./edit.js";
+import { threadsCommand } from "./threads.js";
 export const COMMANDS = [
     helpCommand,
     agentCommand,
@@ -59,6 +60,7 @@ export const COMMANDS = [
     attachCommand,
     bgCommand,
     editCommand,
+    threadsCommand,
 ];
 export function findCommand(name) {
     const lower = name.toLowerCase();

package/dist/commands/jobs.js

@@ -8,9 +8,10 @@ export const jobsCommand = {
             return { message: "No shell sessions. Long commands return a session id automatically." };
         const lines = jobs.map((job) => {
             const exit = job.exitCode === undefined || job.exitCode === null ? "" : ` exit=${job.exitCode}`;
+            const age = Math.max(0, Math.round((Date.now() - job.startedAt) / 1000));
             const command = job.command.length > 80 ? job.command.slice(0, 77) + "…" : job.command;
-            return `${job.id}  ${job.status}${exit}  ${(job.bytes / 1024).toFixed(1)}KB  ${command}`;
+            return `${job.id}  ${job.status}${exit}  ${age}s  ${(job.bytes / 1024).toFixed(1)}KB  ${command}`;
         });
-        return { message: ["Shell sessions:", ...lines, "", "Kill one with: /kill <id>"].join("\n") };
+        return { message: ["Shell sessions:", ...lines, "", "Kill one with: /kill <id>", "Completed sessions are pruned after 10 minutes; resident pool cap is 2."].join("\n") };
     },
 };

package/dist/commands/kill.js

@@ -6,6 +6,8 @@ export const killCommand = {
         const id = ctx.args[0];
         if (!id)
             return { message: "Usage: /kill <session-id>  (see /jobs)" };
-        return { message: killShellSession(id) ? `Killed ${id} (process tree).` : `No running session named ${id}.` };
+        return { message: killShellSession(id)
+                ? `Killed ${id} (process group killed; setsid descendants may escape).`
+                : `No running session named ${id}.` };
     },
 };

package/dist/commands/login.d.ts

@@ -5,12 +5,12 @@
  * provider. Shared by the `/login` command and the guided flow in the app.
  */
 export declare function saveScopedKey(providerId: any, providerLabel: any, model: any, key: any): string;
+export declare function maskLoginEcho(args: any): string;
 export declare const loginCommand: {
     name: string;
     description: string;
-    run({ args, state, actions }: {
+    run({ args, actions }: {
         args: any;
-        state: any;
         actions: any;
     }): {
         message: string;

package/dist/commands/login.js

@@ -21,13 +21,25 @@ export function saveScopedKey(providerId, providerLabel, model, key) {
         `Remove with /logout ${providerId}`,
     ].join("\n");
 }
+export function maskLoginEcho(args) {
+    const parts = ["/login", args[0] ?? ""];
+    if (args.length === 2) {
+        parts.push("********");
+    }
+    else if (args.length >= 3) {
+        parts.push(args[1]);
+        for (let i = 2; i < args.length; i += 1)
+            parts.push("********");
+    }
+    return parts.filter((part) => part !== "").join(" ");
+}
 export const loginCommand = {
     name: "login",
     description: "Bind a provider-wide API key. Usage: /login [provider] [model] [key]",
-    run({ args, state, actions }) {
+    run({ args, actions }) {
         if (args.length === 0) {
-            actions.startLogin({});
-            return { message: introText(state) };
+            actions.startLogin({ flow: "login" });
+            return { message: "Configure a provider: choose a provider and model, then enter its API key." };
         }
         const provider = getProvider(args[0]);
         if (!provider) {
@@ -49,15 +61,3 @@ export const loginCommand = {
         return { message: saveScopedKey(provider.id, provider.label, model, key) };
     },
 };
-function introText(state) {
-    const env = getProvider(state.providerId)?.authEnv?.[0] ?? "PROVIDER_API_KEY";
-    return [
-        "Bind a provider-wide API key (reused by every model of that provider).",
-        "",
-        `  current provider: ${state.providerId}`,
-        "",
-        "FastCode will ask for the provider, then optionally a model name, then the key.",
-        "  one-liner:  /login <provider> <model> <key>",
-        `  or set:     export ${env}=<key>   (provider-wide, any model)`,
-    ].join("\n");
-}

package/dist/commands/model.d.ts

@@ -1,3 +1,4 @@
+export declare function isValidModelId(value: any): boolean;
 export declare const modelCommand: {
     name: string;
     description: string;
@@ -7,18 +8,5 @@ export declare const modelCommand: {
         actions: any;
     }): Promise<{
         message: string;
-        picker?: undefined;
-    } | {
-        message: string;
-        picker: {
-            title: string;
-            current: any;
-            items: {
-                value: any;
-                label: any;
-                hint: string;
-            }[];
-            onSelect: (id: any) => void;
-        };
     }>;
 };

package/dist/commands/model.js

@@ -1,5 +1,7 @@
-import { getProviderOrThrow, probeProvider } from "../providers/index.js";
-import { resolveProviderKey } from "../config/store.js";
+import { getProviderOrThrow } from "../providers/index.js";
+export function isValidModelId(value) {
+    return /^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,199}$/.test(value);
+}
 export const modelCommand = {
     name: "model",
     description: "Pick a model interactively, or switch with /model <id>",
@@ -10,41 +12,7 @@ export const modelCommand = {
             actions.setModel(id);
             return { message: `Model set to ${id}.` };
         }
-        const { key } = resolveProviderKey(provider.id, provider.authEnv);
-        const fetched = await provider.listModels(key).catch(() => []);
-        const models = dedupe(fetched);
-        if (models.length === 0) {
-            return { message: `No models available from ${provider.label}.` };
-        }
-        const online = await probeProvider(provider, key);
-        const list = models.slice(0, 50);
-        return {
-            message: `Models for ${provider.label}: ${list.length}${online ? "" : " (offline — showing the built-in list)"}.\n` +
-                "Use ↑/↓, a number, or Enter to select.",
-            picker: {
-                title: `Select model · ${provider.label}${online ? "" : " (offline)"}`,
-                current: state.model,
-                items: list.map((m) => ({
-                    value: m.id,
-                    label: m.id,
-                    hint: m.label ? `— ${m.label}` : undefined,
-                })),
-                onSelect: (id) => {
-                    actions.setModel(id);
-                    actions.pushSystemMessage(`Model set to ${id}.`);
-                },
-            },
-        };
+        actions.startLogin({ flow: "model", provider: provider.id, model: state.model });
+        return { message: `Configure ${provider.label}: choose a model, then enter its API key.` };
     },
 };
-function dedupe(models) {
-    const seen = new Set();
-    const out = [];
-    for (const model of models) {
-        if (!model?.id || seen.has(model.id))
-            continue;
-        seen.add(model.id);
-        out.push(model);
-    }
-    return out;
-}

package/dist/commands/provider.d.ts

@@ -1,24 +1,10 @@
 export declare const providerCommand: {
     name: string;
     description: string;
-    run({ args, actions, state }: {
+    run({ args, actions }: {
         args: any;
         actions: any;
-        state: any;
     }): {
         message: string;
-        picker: {
-            title: string;
-            current: any;
-            items: {
-                value: string;
-                label: string;
-                hint: string;
-            }[];
-            onSelect: (id: any) => void;
-        };
-    } | {
-        message: string;
-        picker?: undefined;
     };
 };

package/dist/commands/provider.js

@@ -1,29 +1,11 @@
-import { PROVIDERS, getProvider } from "../providers/index.js";
+import { getProvider } from "../providers/index.js";
 export const providerCommand = {
     name: "provider",
     description: "List or switch the active LLM provider. Usage: /provider [id]",
-    run({ args, actions, state }) {
+    run({ args, actions }) {
         if (args.length === 0) {
-            return {
-                message: "Select a provider (↑/↓ or a number, Enter to confirm).",
-                picker: {
-                    title: "Select provider",
-                    current: state.providerId,
-                    items: PROVIDERS.map((p) => ({
-                        value: p.id,
-                        label: `${p.id.padEnd(12)} ${p.label}`,
-                        hint: p.authEnv.length === 0 ? "(no key needed)" : `[${p.authEnv.join(", ")}]`,
-                    })),
-                    onSelect: (id) => {
-                        const next = getProvider(id);
-                        if (!next)
-                            return;
-                        actions.setProvider(next.id);
-                        actions.setModel(next.defaultModel);
-                        actions.pushSystemMessage(`Provider set to ${next.label}. Default model: ${next.defaultModel}.`);
-                    },
-                },
-            };
+            actions.startLogin({ flow: "provider" });
+            return { message: "Configure a provider: choose a provider and model, then enter its API key." };
         }
         const target = args[0];
         const next = getProvider(target);

package/dist/commands/skills.js

@@ -1,4 +1,4 @@
-import { installSkill, uninstallSkill, listInstalledSkills, searchRegistry, getSkill, } from "../skills/manager.js";
+import { installSkill, uninstallSkill, listInstalledSkills, searchRegistry, getSkill, rebaselineSkills, resolveRegistry, } from "../skills/manager.js";
 export const skillsCommand = {
     name: "skills",
     description: "Manage Agent Skills (download from skills.sh and toggle).",
@@ -17,15 +17,20 @@ export const skillsCommand = {
                 const enabled = state.enabledSkills.includes(s.name) ? "● " : "  ";
                 lines.push(`${enabled}${s.name}  — ${truncate(s.description, 80)}`);
                 lines.push(`    source: ${s.source}`);
+                if (s.integrity !== "ok")
+                    lines.push(`    integrity: ${s.integrity === "drift" ? "DRIFT (disabled; run /skills verify " + s.name + " --confirm)" : "unverified (run /skills verify " + s.name + " --confirm)"}`);
             }
             lines.push("");
             lines.push("Toggle with `/skills enable <name>` or `/skills disable <name>`.");
             return { message: lines.join("\n") };
         }
         if (sub === "search") {
+            const registry = resolveRegistry(process.env["FASTCODE_SKILLS_REGISTRY"], state.skillsRegistry);
+            if (!registry)
+                return { message: "No skills registry configured. Set one with `/skills registry <url>` or FASTCODE_SKILLS_REGISTRY." };
             if (rest.length === 0)
                 return { message: "Usage: /skills search <query>" };
-            const hits = await searchRegistry(rest.join(" "), state.skillsRegistry);
+            const hits = await searchRegistry(rest.join(" "), registry);
             if (hits.length === 0) {
                 return { message: `No skills found for "${rest.join(" ")}".` };
             }
@@ -66,6 +71,10 @@ export const skillsCommand = {
             const skill = getSkill(rest[0]);
             if (!skill)
                 return { message: `Skill "${rest[0]}" is not installed.` };
+            if (skill.integrity !== "ok") {
+                const reason = skill.integrity === "drift" ? "content drift detected" : "no integrity baseline";
+                return { message: `Skill "${skill.name}" is disabled (${reason}). Run /skills verify ${skill.name} --confirm to re-baseline.` };
+            }
             actions.enableSkill(skill.name);
             return { message: `Enabled skill "${skill.name}".` };
         }
@@ -84,9 +93,30 @@ export const skillsCommand = {
             const head = `# ${skill.name}\n_${skill.description}_\n\nSource: ${skill.source}\n\n---\n\n`;
             return { message: head + skill.body };
         }
+        if (sub === "verify") {
+            const confirm = rest.includes("--confirm") || rest.includes("--yes");
+            const all = rest.includes("--all");
+            const names = rest.filter((entry) => !entry.startsWith("-"));
+            if (!all && names.length === 0)
+                return { message: "Usage: /skills verify <name> --confirm   (or /skills verify --all --confirm)" };
+            if (!confirm) {
+                return { message: `Re-baselining ${all ? "all skills" : names.join(", ")} trusts the current files as the new baseline. ` +
+                        "Re-run the same command with --confirm to proceed." };
+            }
+            const results = rebaselineSkills(all ? undefined : names);
+            if (results.length === 0)
+                return { message: "No matching installed skills to verify." };
+            const lines = ["Skill integrity re-baselined:"];
+            for (const result of results)
+                lines.push(result.ok ? `  • ${result.name}: locked` : `  • ${result.name}: FAILED — ${result.warning ?? "unknown error"}`);
+            return { message: lines.join("\n") };
+        }
         if (sub === "registry") {
             if (rest.length === 0) {
-                return { message: `Skills registry: ${state.skillsRegistry}` };
+                const registry = resolveRegistry(process.env["FASTCODE_SKILLS_REGISTRY"], state.skillsRegistry);
+                return { message: registry
+                        ? `Skills registry: ${registry}`
+                        : "No skills registry configured. Set one with `/skills registry <url>` or FASTCODE_SKILLS_REGISTRY." };
             }
             // Mutate via AppActions so the in-memory React state stays in sync —
             // direct saveConfig() would be silently overwritten by the next state
@@ -95,7 +125,7 @@ export const skillsCommand = {
             return { message: `Skills registry set to ${rest[0]}.` };
         }
         return {
-            message: "Unknown subcommand. Try: list, search, install, uninstall, enable, disable, info, registry.",
+            message: "Unknown subcommand. Try: list, search, install, uninstall, enable, disable, info, verify, registry.",
         };
     },
 };

package/dist/commands/threads.d.ts

@@ -0,0 +1,9 @@
+import type { CommandContext } from "../types.js";
+export declare const threadsCommand: {
+    name: string;
+    aliases: string[];
+    description: string;
+    run({ args, actions }: CommandContext): {
+        message: string;
+    };
+};

package/dist/commands/threads.js

@@ -0,0 +1,26 @@
+import { DEFAULT_SHELL_POOL_SIZE, MAX_SHELL_POOL_SIZE, shellPoolSize } from "../agent/shell-session.js";
+export const threadsCommand = {
+    name: "threads",
+    aliases: ["pool"],
+    description: `Show or set resident shell concurrency (default ${DEFAULT_SHELL_POOL_SIZE}, max ${MAX_SHELL_POOL_SIZE}). Usage: /threads [1-${MAX_SHELL_POOL_SIZE}]`,
+    run({ args, actions }) {
+        const before = shellPoolSize();
+        if (args.length === 0) {
+            return {
+                message: `Shell concurrency: ${before} resident slot(s) (default ${DEFAULT_SHELL_POOL_SIZE}, max ${MAX_SHELL_POOL_SIZE}). ` +
+                    `Usage: /threads <1-${MAX_SHELL_POOL_SIZE}>.`,
+            };
+        }
+        const requested = Number(args[0]);
+        if (!Number.isFinite(requested)) {
+            return { message: `Invalid thread count "${args[0]}". Use /threads <1-${MAX_SHELL_POOL_SIZE}>.` };
+        }
+        actions.setShellPoolSize(requested);
+        const applied = shellPoolSize();
+        const clamped = applied !== Math.floor(requested) ? " (clamped)" : "";
+        return {
+            message: `Shell concurrency: ${before} → ${applied}${clamped} (default ${DEFAULT_SHELL_POOL_SIZE}, max ${MAX_SHELL_POOL_SIZE}). ` +
+                "Running jobs keep their slots.",
+        };
+    },
+};

package/dist/config/store.d.ts

@@ -22,10 +22,25 @@ export declare const DEFAULT_CONFIG: {
     contextBudgetChars: number;
     /** Thinking depth: auto = send nothing, provider default. */
     reasoningEffort: string;
+    /** Resident shell concurrency: safe default 2, max 6. `/threads` changes it. */
+    shellPoolSize: number;
     /** Cached per-provider/model capabilities (native vs pseudo tool calling). */
     capabilities: {
         toolCalling: {};
     };
+    /**
+     * Application-layer egress policy. Default is audit-only; set
+     * enabled:true + mode:"block" to enforce. See docs/CONFIGURATION.md.
+     */
+    egress: {
+        enabled: boolean;
+        mode: import("../agent/policy/defaults.js").EgressMode;
+        denyPaths: string[];
+        denyGlobs: string[];
+        denyContentMarkers: string[];
+        maxScanBytes: number;
+        scanToolOutput: boolean;
+    };
 };
 export interface StoredCredential {
     provider: string;
@@ -54,6 +69,12 @@ export type KeyLookup = {
 } | {
     status: "missing";
 };
+/** Drop the cached config so the next loadConfig() re-stats and re-reads. */
+export declare function invalidateConfigCache(): void;
+export declare function configCacheStatus(): {
+    cached: boolean;
+    fingerprint?: string;
+};
 export declare function loadConfig(): any;
 export declare function saveConfig(cfg: any): void;
 /** Composite id used by the legacy v2 format; kept for API compatibility. */

package/dist/config/store.js

@@ -10,10 +10,11 @@
  * reuses the same key. The old "provider::model" (v2) and provider-only (v1)
  * formats are read and migrated to the provider-scoped v3 layout on first load.
  */
-import { readFileSync, writeFileSync, existsSync, renameSync, copyFileSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, renameSync, copyFileSync, statSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { getPaths, lockdown, ensureDir } from "./paths.js";
 import { DEFAULT_THEME } from "./themes.js";
+import { DEFAULT_EGRESS_CONFIG } from "../agent/policy/defaults.js";
 export const DEFAULT_CONFIG = {
     providerId: "anthropic",
     model: "claude-sonnet-5.5",
@@ -25,7 +26,7 @@ export const DEFAULT_CONFIG = {
         "or unified diffs the user can apply.",
     enabledSkills: [],
     enabledPlugins: [],
-    skillsRegistry: "https://skillshub.wtf",
+    skillsRegistry: "",
     lifetimeCostUsd: 0,
     /**
      * Extra directories the file tools may read and write outside the project
@@ -41,27 +42,64 @@ export const DEFAULT_CONFIG = {
     contextBudgetChars: 400_000,
     /** Thinking depth: auto = send nothing, provider default. */
     reasoningEffort: "auto",
+    /** Resident shell concurrency: safe default 2, max 6. `/threads` changes it. */
+    shellPoolSize: 2,
     /** Cached per-provider/model capabilities (native vs pseudo tool calling). */
     capabilities: {
         toolCalling: {},
     },
+    /**
+     * Application-layer egress policy. Default is audit-only; set
+     * enabled:true + mode:"block" to enforce. See docs/CONFIGURATION.md.
+     */
+    egress: { ...DEFAULT_EGRESS_CONFIG },
 };
 export const AUTH_VERSION = 3;
-export function loadConfig() {
-    const { config } = getPaths();
-    if (!existsSync(config))
-        return { ...DEFAULT_CONFIG };
+let configCache;
+function configFingerprint(file) {
     try {
-        const raw = JSON.parse(readFileSync(config, "utf8"));
-        return { ...DEFAULT_CONFIG, ...raw };
+        const info = statSync(file);
+        // mtime + size are required; ctime adds resilience on filesystems with
+        // coarse mtime resolution. stat() is much cheaper than a full read on
+        // Termux shared storage.
+        return `${info.mtimeMs}:${info.size}:${info.ctimeMs}`;
     }
     catch {
-        return { ...DEFAULT_CONFIG };
+        return "missing";
+    }
+}
+/** Drop the cached config so the next loadConfig() re-stats and re-reads. */
+export function invalidateConfigCache() {
+    configCache = undefined;
+}
+export function configCacheStatus() {
+    return configCache ? { cached: true, fingerprint: configCache.fingerprint } : { cached: false };
+}
+export function loadConfig() {
+    const { config } = getPaths();
+    const fingerprint = configFingerprint(config);
+    if (configCache && configCache.path === config && configCache.fingerprint === fingerprint)
+        return { ...configCache.value };
+    let value;
+    if (!existsSync(config)) {
+        value = { ...DEFAULT_CONFIG };
+    }
+    else {
+        try {
+            const raw = JSON.parse(readFileSync(config, "utf8"));
+            value = { ...DEFAULT_CONFIG, ...raw };
+        }
+        catch {
+            value = { ...DEFAULT_CONFIG };
+        }
     }
+    configCache = { path: config, fingerprint, value };
+    return { ...value };
 }
 export function saveConfig(cfg) {
     const { config } = getPaths();
     atomicWrite(config, JSON.stringify(cfg, null, 2));
+    invalidateConfigCache();
 }
 /** Composite id used by the legacy v2 format; kept for API compatibility. */
 export function scopeId(providerId, model) {

package/dist/config/trust.d.ts

@@ -20,3 +20,12 @@ export declare function listTrusted(): Array<{
     path: string;
     addedAt: string;
 }>;
+/** Check a tool/fingerprint approval bound to the current tool catalog. */
+export declare function isToolApproved(key: string, catalogHash: string): boolean;
+export declare function rememberToolApproval(key: string, catalogHash: string): void;
+export declare function forgetToolApproval(key: string): boolean;
+export declare function listToolApprovals(): Array<{
+    key: string;
+    grantedAt: string;
+    catalogHash: string;
+}>;