@garuda-agent/garuda 0.14.1 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## 0.16.0 (2026-10-06)
+
+Setup for editors and the ACP Registry (design: [docs/lld/setup.md](docs/lld/setup.md)).
+
+- Stored provider keys: Garuda reads `~/.garuda/credentials` (JSON, key name → key) when no
+  environment variable sets the key. It reads the file only when it is a regular file (not a link),
+  owned by you, with mode 0600; else it ignores the file with a warning. The key never enters
+  Garuda's environment, and the redactor knows it. `garuda setup` writes this file.
+- Commands in the OS sandbox cannot read `~/.garuda/credentials` (macOS and Linux).
+- `"default"` in `~/.garuda/models.json`: the model when neither `--model` nor `GARUDA_MODEL` names
+  one.
+- The redactor removes every provider key that Garuda keeps, also one whose variable name does not
+  look secret (a custom provider's `apiKeyEnv`).
+- `garuda setup`: choose a provider and a model, enter the key once (hidden input), check it with
+  one free request to the provider, then store the model as the default and the key in
+  `~/.garuda/credentials`. `--show` shows where each key comes from (masked); `--forget [NAME]`
+  removes stored keys. With no terminal, it stops with a message.
+- The messages for a missing model or key name `garuda setup`.
+- `garuda acp`: Terminal Auth. An editor that can run it (`auth.terminal`) gets a "Set up Garuda"
+  method; it runs `garuda acp setup` in a terminal. A session with no model or no key fails with
+  ACP's "auth required", so the editor offers the setup. The setup is read again for each new
+  session: no restart after `garuda setup`.
+- Native Windows: `garuda acp` sessions and `garuda setup` stop with a message to use WSL.
+- Docs: `garuda setup` in the quick start, the landing page, the README and the Editors page; editor
+  entries need no API key in their settings. Tested live in Zed 1.22: with no model and no key, Zed
+  offered the setup, ran it in a terminal, and the next thread worked with no restart.
+- `-p --output-format stream-json`: `apiKeySource` in `system/init` is `credentials` for a stored
+  Claude key.
+
+## 0.15.0 (2026-10-06)
+
+Garuda in your editor. Version 0.15.0 is not the old "0.15" branch label of the status table (code
+intelligence), which shipped in 0.14.0.
+
+### Editors
+
+- `garuda acp`: Garuda as an agent for editors over the Agent Client Protocol (v1): VS Code (with
+  the "ACP Client" extension), Zed, JetBrains, Neovim, Emacs. One runtime per editor session, with
+  the same permission engine, OS sandbox, team policy, hooks and audit log as the terminal.
+- Approval questions name their tool call (`callId`), and file writes carry the whole change, so an
+  editor shows each question next to the right call, with its own diff view.
+- A stop in the editor names what it ended: each stopped tool call shows as failed, with a line
+  such as "Garuda: $ sleep 60 cancelled." (or "the turn was cancelled." when no call ran). A call
+  that has not reported within 3 s of the stop ends as failed, so none stays "running".
+- Docs: the website's Editors page (VS Code with ACP Client, Zed, other ACP editors). Tested live
+  in VS Code and Zed on macOS.
+
 ## 0.14.1 (2026-10)
 
 The first version on npm (`@garuda-agent/garuda`) and Homebrew (`madhu-sv/garuda/garuda`). It fixes
@@ -10,7 +57,8 @@ of the other areas are closed. Each fix has a test that fails without it.
 
 - npm: `npm install -g @garuda-agent/garuda`. Published from the release workflow with npm trusted
   publishing, with provenance.
-- Homebrew: `brew install madhu-sv/garuda/garuda`.
+- Homebrew: `brew tap madhu-sv/garuda`, `brew trust --formula madhu-sv/garuda/garuda`, then
+  `brew install garuda`.
 
 ### Security
 

package/README.md

@@ -4,8 +4,10 @@
 
 Website and docs: https://madhu-sv.github.io/garuda/
 
-Garuda is a terminal coding agent. This is version 0.14.1: the 0.14–0.17 branches after the merge gate
-and Garuda's own review (see the notes under the status table). Release notes: [CHANGELOG.md](CHANGELOG.md).
+Garuda is a terminal coding agent. This is version 0.16.0: `garuda setup` (choose a model and store
+its key once) and the sign-in from editors, on top of 0.15.0 (Garuda in your editor over the Agent
+Client Protocol, `garuda acp`) and 0.14.1 (the 0.14–0.17 branches after the merge gate and Garuda's own
+review; see the notes under the status table). Release notes: [CHANGELOG.md](CHANGELOG.md).
 Design documents: [docs/](docs/README.md) (architecture, high-level design, low-level design per component).
 The requirements doc defines the scope. Code, tests and commits refer to its IDs (F1–F26, N1–N8).
 
@@ -34,6 +36,11 @@ The requirements doc defines the scope. Code, tests and commits refer to its IDs
 | 0.15: multi-language AST code intelligence (Python, Java, TS/JS, call graph, blast radius, /callers, /defs, /impact, ast_query) | Done (0.14.0) |
 | 0.16: language plugins (Go and Rust built in, user plugins in ~/.garuda/languages, /languages; project plugins not loaded) | Done (0.14.0) |
 | 0.17: Mixture-of-Experts subagents (opt-in), team policy and audit log (W5) | Done (0.14.0) |
+| Editors over the Agent Client Protocol (`garuda acp`: VS Code with an extension, Zed, JetBrains, Neovim, Emacs) | Done (0.15.0) |
+| `garuda setup` (model and stored key) and the editor sign-in (ACP Terminal Auth) | Done (0.16.0) |
+
+The rows labelled 0.14–0.17 are branch labels, not versions: the "0.15" and "0.16" branches (code
+intelligence, language plugins) shipped in 0.14.0. The last two rows are versions 0.15.0 and 0.16.0.
 
 The 0.14–0.17 rows were built on stacked branches that were never released. They ship together as
 0.14.0 after the merge gate: the high findings of the branch review are fixed (policy source, audit
@@ -45,7 +52,7 @@ headings below keep the branch labels (0.14–0.17).
 Before 0.14.0, Garuda reviewed its own code with Fable 5.1, one area at a time (knowledge,
 permissions, tools, sandbox, audit, loop, agents), in plan mode. 0.14.1 adds the cli and extensions
 areas and fixes the open findings of all nine areas (see [CHANGELOG.md](CHANGELOG.md)). Known limits
-in 0.14.1:
+in 0.16.0:
 
 - G09: project language plugins are not loaded (no consent flow for their imports yet).
 - Subagents: each child has its own step and token budget (capped by the team policy); it does not
@@ -57,14 +64,28 @@ in 0.14.1:
   `~/.m2/wrapper`) hold programs that a build runs later outside the sandbox. They stay writable, because
   `./gradlew` needs them in the sandbox; a sandboxed command could change them.
 - The jdtls download is checked against the `.sha256` file of the same server, not a pinned hash.
+- Editors (`garuda acp`): Garuda's session history is not in the editor (no `session/load`), the
+  editor's MCP servers are not started, Garuda reads saved files (not unsaved buffers), the terminal's
+  own commands (`/undo`, `/diff` …) are not available, and an edit is approved as a whole (no hunks).
+- Stored keys are in a file (`~/.garuda/credentials`, mode 0600, hidden from the sandbox), not in the
+  OS keychain yet. Keep the file out of backups and dotfile sync.
+- Native Windows is not supported; use WSL.
 
 ## Use
 
 Install (0.14.1 and later) with Homebrew or npm. You need Node 22 or later; Homebrew installs it.
 
 ```sh
-brew install madhu-sv/garuda/garuda     # Homebrew (macOS and Linux)
-npm install -g @garuda-agent/garuda     # or npm
+npm install -g @garuda-agent/garuda
+```
+
+Or with Homebrew (macOS and Linux). Homebrew loads a formula from a third-party tap only after you
+trust it, so trust the Garuda formula first:
+
+```sh
+brew tap madhu-sv/garuda
+brew trust --formula madhu-sv/garuda/garuda
+brew install garuda
 ```
 
 Or build from source. You need Node 22 or later, pnpm 10 and git. Node 25 and later do not include
@@ -82,8 +103,7 @@ pnpm link --global  # optional: puts `garuda` on your PATH (run `pnpm setup` onc
 Then:
 
 ```sh
-export ANTHROPIC_API_KEY=...
-export GARUDA_MODEL=<model-id>
+garuda setup                            # once: pick a provider and model, enter the key
 garuda                                  # chat in the current folder
 garuda -p "Explain what this repo does" # run one task and exit
 echo "Explain this repo" | garuda       # the same, from stdin
@@ -91,6 +111,13 @@ echo "Explain this repo" | garuda       # the same, from stdin
 
 From a source build without `pnpm link`, use `node dist/cli/index.js` in place of `garuda`.
 
+`garuda setup` (0.16) asks for the provider, the model and the key (hidden input), checks the key
+with one free request to the provider, and stores the model as `"default"` in
+`~/.garuda/models.json` and the key in `~/.garuda/credentials` (mode 0600; commands in the sandbox
+cannot read it). `garuda setup --show` shows the model and where each key comes from (masked);
+`garuda setup --forget [NAME]` removes stored keys. Environment variables still work and win:
+`ANTHROPIC_API_KEY`, `GARUDA_MODEL`. Do not sync or back up `~/.garuda/credentials` to other places.
+
 Tools: read_file, glob and grep run with no question.
 write_file, edit_file and bash show a diff or the command first. You pick: allow once, allow for this session, or deny.
 Commands run in an OS sandbox when your machine has one (see Sandbox below). Without a sandbox,
@@ -134,13 +161,15 @@ Set the context window, price and output limit per model, and add providers, in
 ```json
 {
   "providers": { "lab": { "type": "openai-compatible", "baseUrl": "https://llm.example.com/v1", "apiKeyEnv": "LAB_KEY" } },
-  "models": { "ollama/qwen3-coder:30b": { "contextWindow": 65536, "maxTokens": 8192 } }
+  "models": { "ollama/qwen3-coder:30b": { "contextWindow": 65536, "maxTokens": 8192 } },
+  "default": "ollama/qwen3-coder:30b"
 }
 ```
 
 - Only this file in your home folder can define providers; a project cannot send your code elsewhere.
   Keys come from environment variables. Plain http works only to this machine (or with
   `"allowInsecureHttp": true`).
+- `"default"` is the model when neither `--model` nor `GARUDA_MODEL` names one.
 - Some small models write a tool call as JSON text. When the whole reply is such a call to a known
   tool, Garuda runs it as a real call, with the usual approvals. For a model that also writes
   sentences around the call (for example `qwen2.5-coder:7b`), set `"textToolCalls": "lines"` for that
@@ -236,6 +265,47 @@ Set the context window, price and output limit per model, and add providers, in
 
 Model text goes to stdout; tool activity and notes go to stderr. So `garuda -p "…" > answer.md` keeps only the answer.
 
+## Editors (ACP, 0.15; sign-in 0.16)
+
+`garuda acp` runs Garuda as an agent for editors that speak the Agent Client Protocol. The editor
+starts it, shows the conversation, the tool calls and the questions, and Garuda does the work with
+the same permission engine, OS sandbox, team policy, hooks and audit log as in the terminal.
+
+Run `garuda setup` once in a terminal (see Use): then the editor needs no key in its settings.
+
+VS Code, with the extension "ACP Client" (`formulahendry.acp-client`), in the user settings
+(Cmd+Shift+P, **Preferences: Open User Settings (JSON)**). Use the full path from `which garuda`:
+VS Code started from the Dock does not get your shell's `PATH`.
+
+```json
+{
+  "acp.agents": {
+    "Garuda": { "command": "/opt/homebrew/bin/garuda", "args": ["acp"] }
+  }
+}
+```
+
+Zed: the same command and argument under `agent_servers` (with `"type": "custom"`). With no model
+or key, Zed offers **Set up Garuda** (ACP Terminal Auth, 0.16): it runs `garuda acp setup` in a
+terminal, and the next thread works. The website's
+[Editors](https://madhu-sv.github.io/garuda/docs/editors/) page has the steps and what the editor
+shows.
+
+- Each edit asks in the editor, with the editor's diff view; "Allow for this session" lasts for this
+  session only. Keep an extension's auto-approve off: it answers Garuda's questions for you.
+- The editor's stop button ends the turn: a running command stops, and a waiting question is a deny.
+  Each call that the stop ended shows as failed, with a line such as "Garuda: $ sleep 60 cancelled."
+  A command that exits with an error shows as done (the model reads the error); a refused call shows
+  as failed.
+- Build and plan modes are in the editor's mode menu; custom commands and skills are in its `/` menu.
+  Built-in chat commands (`/undo`, `/diff` ...) are only in the terminal in this version.
+- Garuda reads and writes files and runs commands itself; it does not use the editor's file or
+  terminal access, so it reads the saved file, not an unsaved buffer. It does not start MCP servers
+  that the editor sends (its own `~/.garuda/mcp.json` and the project's work as usual).
+- Project settings that loosen safety apply only after a yes in a terminal (`garuda` in that folder).
+
+Design: [docs/lld/acp.md](docs/lld/acp.md).
+
 ## Init: set up a folder
 
 `garuda init` (or `/init` in the chat) sets up the current folder:

package/dist/acpCommand-AJJBKAE5.js

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+import {
+  FileSessionStore,
+  Runtime,
+  auditDirFor
+} from "./chunk-WIJL72ZE.js";
+import "./chunk-G2AX7MGS.js";
+import "./chunk-A2QAIRQL.js";
+import "./chunk-ULAJPMY7.js";
+import {
+  chooseModel,
+  keepProviderKeys,
+  loadModelsConfig,
+  providerKeySource,
+  resolveModel
+} from "./chunk-NP6RIC25.js";
+import "./chunk-EIXUSVFX.js";
+import "./chunk-R7I2NBPX.js";
+import {
+  loadSearchConfig
+} from "./chunk-B25VL4RU.js";
+import "./chunk-23FXBNBB.js";
+import {
+  VERSION
+} from "./chunk-XOK5OZOC.js";
+import "./chunk-5DEWP3YX.js";
+import "./chunk-ZAE25JM2.js";
+import "./chunk-ATW7BNIG.js";
+import "./chunk-PZS3V6P3.js";
+import "./chunk-OUCV3FCT.js";
+import "./chunk-GXZACJUI.js";
+import "./chunk-WMOLXTBU.js";
+import "./chunk-3EQU2GUX.js";
+import "./chunk-HUIK3WXO.js";
+import "./chunk-3NJNVZTK.js";
+
+// src/cli/acpCommand.ts
+import { homedir } from "os";
+import { Readable } from "stream";
+var WINDOWS_MESSAGE = "Garuda supports macOS and Linux. On Windows, run Garuda in WSL (Windows Subsystem for Linux).";
+async function acpCommand(options) {
+  if (options.action !== void 0) {
+    if (options.action !== "setup") {
+      process.stderr.write(`Unknown argument "${options.action}". Use: garuda acp [setup]
+`);
+      return 1;
+    }
+    const { setupCommand, terminalIO } = await import("./setupCommand-VA7D5MZK.js");
+    return setupCommand({}, { io: await terminalIO() });
+  }
+  const output = protocolOutput(process.stdout, process.stderr);
+  const input = Readable.toWeb(process.stdin);
+  const { acpServer, setupNeeded } = await import("./server-KHHNHUYV.js");
+  const server = acpServer({
+    version: VERSION,
+    // Not on native Windows: the setup there could not keep a key private (no 0600).
+    ...process.platform === "win32" ? {} : { terminalAuth: { args: ["setup"] } },
+    createRuntime: async ({ root, approver, onEvent, onNotice }) => {
+      const setup = await prepare(options);
+      if ("problem" in setup) {
+        throw setup.setupNeeded ? setupNeeded(setup.problem) : new Error(setup.problem);
+      }
+      return createRuntime(setup, { root, approver, onEvent, onNotice });
+    }
+  });
+  process.on("exit", () => server.shutdown());
+  const stop = () => {
+    server.shutdown();
+    process.exit(143);
+  };
+  process.once("SIGTERM", stop);
+  await server.serve(output, input);
+  await server.close();
+  return 0;
+}
+function protocolOutput(stdout, stderr) {
+  const write = stdout.write.bind(stdout);
+  const toStderr = stderr.write.bind(stderr);
+  stdout.write = ((...args) => toStderr(...args));
+  return new WritableStream({
+    write: (chunk) => new Promise((resolve, reject) => {
+      write(chunk, (error) => error ? reject(error) : resolve());
+    })
+  });
+}
+var SETUP_HINT = "Run `garuda setup` in a terminal, or use the editor's sign-in for Garuda.";
+async function prepare(options, from = {}) {
+  const fail = (problem, setupNeeded = false) => ({ problem, setupNeeded });
+  if ((from.platform ?? process.platform) === "win32") return fail(WINDOWS_MESSAGE);
+  const home = from.home ?? homedir();
+  const models = await loadModelsConfig(home);
+  if (models.problem !== void 0) return fail(models.problem);
+  const spec = chooseModel(models.config, options.model, process.env.GARUDA_MODEL);
+  if (!spec) return fail(`Garuda has no model. ${SETUP_HINT}`, true);
+  let resolved;
+  let sub;
+  try {
+    resolved = resolveModel(spec, models.config);
+    const subSpec = process.env.GARUDA_SUBAGENT_MODEL;
+    if (subSpec) sub = resolveModel(subSpec, models.config);
+  } catch (error) {
+    return fail(error.message);
+  }
+  const search = await loadSearchConfig(home);
+  const credentialsWarning = await keepProviderKeys(
+    [resolved.def.apiKeyEnv, sub?.def.apiKeyEnv, "ANTHROPIC_API_KEY"],
+    home
+  );
+  if (credentialsWarning !== void 0) process.stderr.write(`garuda acp: ${credentialsWarning}
+`);
+  const keyName = resolved.def.type === "anthropic" ? resolved.def.apiKeyEnv ?? "ANTHROPIC_API_KEY" : resolved.def.apiKeyEnv;
+  const sdkToken = resolved.def.type === "anthropic" && (process.env.ANTHROPIC_AUTH_TOKEN ?? "") !== "";
+  if (keyName !== void 0 && providerKeySource(keyName) === void 0 && !sdkToken) {
+    const why = credentialsWarning === void 0 ? "" : ` ${credentialsWarning}`;
+    return fail(`Garuda has no key for ${resolved.spec} (${keyName}).${why} ${SETUP_HINT}`, true);
+  }
+  const { loadTeamPolicy } = await import("./policy-EJPLEEXP.js");
+  let team;
+  try {
+    team = await loadTeamPolicy("managed" in from ? { home, managed: from.managed } : { home });
+  } catch (error) {
+    return fail(`Team policy: ${error.message}`);
+  }
+  return {
+    resolved,
+    ...sub === void 0 ? {} : { sub },
+    models: models.config,
+    ...team === void 0 ? {} : { team: { policy: team.policy, sources: team.sources } },
+    search,
+    ...credentialsWarning === void 0 ? {} : { credentialsWarning }
+  };
+}
+function createRuntime(setup, input) {
+  const { resolved, sub, models, team, search } = setup;
+  return Runtime.create({
+    root: input.root,
+    modelId: resolved.spec,
+    ...team === void 0 ? {} : { policy: team.policy, policySources: team.sources },
+    audit: { dir: auditDirFor(input.root) },
+    model: () => resolved.create(),
+    modelInfo: resolved.info,
+    ...resolved.maxTokens === void 0 ? {} : { maxTokens: resolved.maxTokens },
+    ...sub === void 0 ? {} : { subagentModel: { spec: sub.spec, model: () => sub.create(), info: sub.info } },
+    approver: input.approver,
+    store: new FileSessionStore(input.root),
+    undo: {},
+    skills: {},
+    languages: {},
+    // The editor cannot answer a question before session/new returns: only project settings that
+    // the user approved in a terminal apply; the rest is left out with a notice (docs/lld/acp.md).
+    projectSettings: { home: homedir(), ask: false },
+    ...search.config === void 0 && search.claude === void 0 ? {} : {
+      search: {
+        ...search.config === void 0 ? {} : { config: search.config },
+        ...search.claude === void 0 ? {} : { claude: search.claude },
+        ...search.use === void 0 ? {} : { use: search.use },
+        home: homedir()
+      }
+    },
+    agents: {
+      resolveModel: (spec) => {
+        const r = resolveModel(spec, models);
+        return { spec: r.spec, model: () => r.create(), info: r.info };
+      }
+    },
+    models: {
+      resolve: (spec) => {
+        const r = resolveModel(spec, models);
+        return {
+          spec: r.spec,
+          model: () => r.create(),
+          info: r.info,
+          ...r.maxTokens === void 0 ? {} : { maxTokens: r.maxTokens }
+        };
+      },
+      configured: Object.keys(models.models)
+    },
+    ...input.onEvent === void 0 ? {} : { onEvent: input.onEvent },
+    onNotice: input.onNotice
+  }).then((runtime) => {
+    if (setup.credentialsWarning !== void 0) input.onNotice(setup.credentialsWarning);
+    return runtime;
+  });
+}
+export {
+  WINDOWS_MESSAGE,
+  acpCommand,
+  prepare,
+  protocolOutput
+};
+//# sourceMappingURL=acpCommand-AJJBKAE5.js.map

package/dist/chunk-23FXBNBB.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+
+// src/commands/builtins.ts
+var BUILTIN_COMMANDS = [
+  "help",
+  "usage",
+  "session",
+  "sessions",
+  "models",
+  "export",
+  "compact",
+  "diff",
+  "schedule",
+  "jobs",
+  "where",
+  "defs",
+  "refs",
+  "callers",
+  "impact",
+  "map",
+  "mcp",
+  "hooks",
+  "lsp",
+  "languages",
+  "experts",
+  "audit",
+  "commands",
+  "agents",
+  "plan",
+  "build",
+  "new",
+  "init",
+  "editor",
+  "details",
+  "thinking",
+  "search",
+  "undo",
+  "redo",
+  "exit",
+  "quit"
+];
+
+export {
+  BUILTIN_COMMANDS
+};
+//# sourceMappingURL=chunk-23FXBNBB.js.map

package/dist/chunk-3EQU2GUX.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+// src/model/types.ts
+var EFFORTS = ["low", "medium", "high", "xhigh", "max"];
+var ZERO_USAGE = {
+  inputTokens: 0,
+  outputTokens: 0,
+  cacheReadTokens: 0,
+  cacheWriteTokens: 0
+};
+function addUsage(a, b) {
+  const searches = (a.webSearches ?? 0) + (b.webSearches ?? 0);
+  return {
+    inputTokens: a.inputTokens + b.inputTokens,
+    outputTokens: a.outputTokens + b.outputTokens,
+    cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+    cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens,
+    ...searches === 0 ? {} : { webSearches: searches }
+  };
+}
+
+export {
+  EFFORTS,
+  ZERO_USAGE,
+  addUsage
+};
+//# sourceMappingURL=chunk-3EQU2GUX.js.map

package/dist/{chunk-YIZWYUBG.js → chunk-44QN5SWZ.js}

@@ -2,7 +2,7 @@
 import {
   JobGitError,
   git
-} from "./chunk-ZGZ2ZADL.js";
+} from "./chunk-TUUEBHG2.js";
 
 // src/jobs/worktree.ts
 import { createHash } from "crypto";
@@ -135,4 +135,4 @@ export {
   commitJob,
   jobChanges
 };
-//# sourceMappingURL=chunk-YIZWYUBG.js.map
+//# sourceMappingURL=chunk-44QN5SWZ.js.map

package/dist/chunk-4JSUUDFQ.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+
+// src/cli/approver.ts
+import { styleText } from "util";
+var TerminalApprover = class {
+  /** Set by the CLI: it aborts the current turn. */
+  onInterrupt = () => {
+  };
+  /** One question at a time (0.14.1, review): two prompts at once mixed their keys. */
+  ask(request, signal) {
+    const next = this.asking === 0 ? this.askNow(request, signal) : this.queue.then(() => this.askNow(request, signal));
+    this.asking++;
+    this.queue = next.catch(() => {
+    }).finally(() => {
+      this.asking--;
+    });
+    return next;
+  }
+  asking = 0;
+  queue = Promise.resolve();
+  async askNow(request, signal) {
+    signal.throwIfAborted();
+    const out = process.stderr;
+    out.write(`
+${header(request)}
+${colorPreview(request)}
+`);
+    if (!process.stdin.isTTY) {
+      out.write("No terminal to ask for approval, so Garuda denies this call.\n");
+      return "deny";
+    }
+    const sessionLabel = request.labels?.session ?? (request.target.kind === "command" ? "Yes, and allow this exact command for this session" : request.target.kind === "url" ? `Yes, and allow ${request.target.host} for this session` : `Yes, and allow all ${request.tool} calls for this session`);
+    const { select } = await import("@inquirer/prompts");
+    try {
+      return await select(
+        {
+          message: request.question ?? "Allow?",
+          choices: [
+            { name: request.labels?.once ?? "Yes, once", value: "once" },
+            { name: sessionLabel, value: "session" },
+            { name: request.labels?.deny ?? "No, deny", value: "deny" }
+          ].filter((c) => request.choices?.includes(c.value) ?? true)
+        },
+        { signal, output: out }
+      );
+    } catch (error) {
+      if (error.name === "ExitPromptError") this.onInterrupt();
+      throw error;
+    }
+  }
+};
+var SwitchApprover = class {
+  constructor(current) {
+    this.current = current;
+  }
+  current;
+  /** Called before each question: the chat's notifier (0.6). */
+  onAsk = () => {
+  };
+  ask(request, signal) {
+    this.onAsk(request);
+    return this.current.ask(request, signal);
+  }
+};
+function visible(text) {
+  return text.replace(/[\u0000-\u0008\u000b-\u001f]/g, (c) => String.fromCodePoint(9216 + c.charCodeAt(0))).replace(/\u007f/g, "\u2421").replace(
+    /[\u0080-\u009f\u200b-\u200f\u202a-\u202e\u2060-\u2064\u2066-\u2069\ufeff\u{e0000}-\u{e007f}]/gu,
+    (c) => `[U+${(c.codePointAt(0) ?? 0).toString(16).toUpperCase().padStart(4, "0")}]`
+  );
+}
+function hasHidden(text) {
+  return visible(text) !== text;
+}
+var HIDDEN_WARNING = "! This holds hidden or control characters, shown as \u240D, \u241B or [U+\u2026]. Read it with care.";
+function headerText(request) {
+  const { tool, target, isolation } = request;
+  if (request.title !== void 0) return visible(request.title);
+  if (target.kind === "command") {
+    const where = isolation === "none" ? "on your machine, no sandbox" : target.outsideSandbox ? "OUTSIDE the sandbox: network on, writes anywhere" : `sandbox: ${isolation}`;
+    return `${tool} wants to run a command (${where}):`;
+  }
+  if (target.kind === "input") return `${tool} wants to run with this input:`;
+  if (target.kind === "url") return `${tool} wants to fetch from ${visible(target.host)}:`;
+  return `${tool} wants to change ${visible(target.path)}:`;
+}
+function header(request) {
+  return styleText("bold", headerText(request));
+}
+function colorPreview({ target, preview }) {
+  const warning = hasHidden(preview) ? `
+${styleText("yellow", `  ${HIDDEN_WARNING}`)}` : "";
+  if (target.kind === "command") return `${styleText("cyan", `  $ ${visible(preview)}`)}${warning}`;
+  if (target.kind === "url") return `${visible(preview)}${warning}`;
+  return `${colorDiff(visible(preview))}${warning}`;
+}
+function colorDiff(text) {
+  return text.split("\n").map((line) => {
+    if (line.startsWith("+++") || line.startsWith("---") || line.startsWith("diff --git"))
+      return styleText("bold", line);
+    if (line.startsWith("+")) return styleText("green", line);
+    if (line.startsWith("-")) return styleText("red", line);
+    if (line.startsWith("@@")) return styleText("cyan", line);
+    return line;
+  }).join("\n");
+}
+
+export {
+  TerminalApprover,
+  SwitchApprover,
+  visible,
+  hasHidden,
+  HIDDEN_WARNING,
+  headerText,
+  header,
+  colorPreview,
+  colorDiff
+};
+//# sourceMappingURL=chunk-4JSUUDFQ.js.map

package/dist/{chunk-KWRJREUH.js → chunk-B25VL4RU.js}

@@ -3,46 +3,6 @@ import {
   isLoopbackHost
 } from "./chunk-ATW7BNIG.js";
 
-// src/commands/builtins.ts
-var BUILTIN_COMMANDS = [
-  "help",
-  "usage",
-  "session",
-  "sessions",
-  "models",
-  "export",
-  "compact",
-  "diff",
-  "schedule",
-  "jobs",
-  "where",
-  "defs",
-  "refs",
-  "callers",
-  "impact",
-  "map",
-  "mcp",
-  "hooks",
-  "lsp",
-  "languages",
-  "experts",
-  "audit",
-  "commands",
-  "agents",
-  "plan",
-  "build",
-  "new",
-  "init",
-  "editor",
-  "details",
-  "thinking",
-  "search",
-  "undo",
-  "redo",
-  "exit",
-  "quit"
-];
-
 // src/web/search.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { homedir } from "os";
@@ -273,11 +233,10 @@ async function readCapped(response, max) {
 }
 
 export {
-  BUILTIN_COMMANDS,
   MAX_RESULTS,
   providerLabel,
   loadSearchConfig,
   saveSearchUse,
   search
 };
-//# sourceMappingURL=chunk-KWRJREUH.js.map
+//# sourceMappingURL=chunk-B25VL4RU.js.map