@lucascouts/claude-agent-tui 0.5.2 → 0.7.0

package/dist/linearize.d.ts

@@ -137,7 +137,7 @@ export declare function readOrderedMessages(sessionId: string, dir: string | und
  * Exported (story 043 R2.1) so acp-agent.ts can reuse it as the PRODUCTION reduced base it wraps in
  * the diff-enriched reader when `liveDiff` is ON (it is the same reduced reader `readOrderedMessages`
  * already falls back to). linearize.ts is a fork module imported directly from ../dist/ — NOT via
- * lib.ts, whose public surface is frozen to upstream v0.39.0 — so this export is safe.
+ * lib.ts, whose public surface is frozen to upstream v0.53.0 — so this export is safe.
  */
 export declare function defaultGetMessages(sessionId: string, opts?: {
     dir?: string;
@@ -216,4 +216,3 @@ export interface EndOfTurnBinding {
  * @returns an {@link EndOfTurnBinding} (`notifyEndOfTurn` + `stop`).
  */
 export declare function bindEndOfTurnReparse(opts: BindEndOfTurnOptions): EndOfTurnBinding;
-//# sourceMappingURL=linearize.d.ts.map

package/dist/linearize.js

@@ -277,7 +277,7 @@ export async function readOrderedMessages(sessionId, dir, opts = {}) {
  * Exported (story 043 R2.1) so acp-agent.ts can reuse it as the PRODUCTION reduced base it wraps in
  * the diff-enriched reader when `liveDiff` is ON (it is the same reduced reader `readOrderedMessages`
  * already falls back to). linearize.ts is a fork module imported directly from ../dist/ — NOT via
- * lib.ts, whose public surface is frozen to upstream v0.39.0 — so this export is safe.
+ * lib.ts, whose public surface is frozen to upstream v0.53.0 — so this export is safe.
  */
 export async function defaultGetMessages(sessionId, opts) {
     const sdk = await import("@anthropic-ai/claude-agent-sdk");

package/dist/live-diff-env.d.ts

@@ -4,4 +4,3 @@
  * index.ts calls this so the truth table is unit-checkable without running the entrypoint.
  */
 export declare function liveDiffEnabled(env?: Record<string, string | undefined>): boolean;
-//# sourceMappingURL=live-diff-env.d.ts.map

package/dist/live-subagent-env.d.ts

@@ -4,4 +4,3 @@
  * index.ts calls this so the truth table is unit-checkable without running the entrypoint.
  */
 export declare function liveSubagentWatchEnabled(env?: Record<string, string | undefined>): boolean;
-//# sourceMappingURL=live-subagent-env.d.ts.map

package/dist/mcp-config-writer.d.ts

@@ -0,0 +1,60 @@
+import type { McpServer } from "@agentclientprotocol/sdk";
+/**
+ * A single entry under claude's `--mcp-config` `mcpServers` map. A discriminated union over the
+ * transport claude understands:
+ *   - http/sse → `{ type, url, headers? }` (headers as a plain `{ [name]: value }` object)
+ *   - stdio    → `{ command, args?, env? }` (NO `type` — claude infers stdio from `command`)
+ * ACP-transport servers have no `--mcp-config` equivalent and are dropped before this shape.
+ */
+export type ClaudeMcpEntry = {
+    type: "http" | "sse";
+    url: string;
+    headers?: Record<string, string>;
+} | {
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+};
+/** The full claude `--mcp-config` document: a name-keyed map of {@link ClaudeMcpEntry}. */
+export interface ClaudeMcpConfig {
+    mcpServers: Record<string, ClaudeMcpEntry>;
+}
+/**
+ * Translate the ACP `McpServer[]` union into claude's `--mcp-config` `{ mcpServers: { … } }` shape
+ * (R2.1). PURE and total — never throws; empty/undefined input yields `{ mcpServers: {} }`.
+ *
+ * Discriminator (per the ACP schema): `type === "http"|"sse"|"acp"` selects that transport; a server
+ * with NO `type` field is the bare stdio variant. Per-transport mapping:
+ *   - http / sse → `{ type, url, headers? }`; `headers` is OMITTED when the ACP array is empty.
+ *   - stdio      → `{ command, args?, env? }`; `args` and `env` are each OMITTED when empty; NO `type`.
+ *   - acp        → DROPPED (ACP-channel transport has no `--mcp-config` equivalent); a one-line note
+ *                  is emitted to stderr (no url/headers/env — R2.3).
+ *
+ * Duplicate names collapse onto the same key (last wins) — claude's map is name-keyed, so this matches
+ * how claude itself would resolve a repeated server name.
+ *
+ * @param servers the ACP-declared MCP servers, or `undefined`/`[]` when the client declared none.
+ * @returns the claude `--mcp-config` document (possibly with an empty `mcpServers`).
+ */
+export declare function translateMcpServers(servers: readonly McpServer[] | undefined): ClaudeMcpConfig;
+/**
+ * DURABLY write `config` to a fresh uuid-namespaced scratch file under the OS temp dir with mode
+ * `0600`, and RETURN its absolute path (R2.1, R2.3). The file is `JSON.stringify(config, null, 2)`
+ * plus a trailing newline. The caller passes the returned path to `claude --mcp-config <path>` and
+ * is responsible for removing it on teardown via {@link removeMcpScratch}.
+ *
+ * The file may carry MCP auth headers/env (secrets), so it is created owner-only (0600) and is NEVER
+ * logged here (R2.3).
+ *
+ * @param config the document from {@link translateMcpServers}.
+ * @returns the absolute path of the written scratch file.
+ * @throws {Error} if the durable write fails — the partial temp is cleaned up first (no residue).
+ */
+export declare function writeMcpScratch(config: ClaudeMcpConfig): Promise<string>;
+/**
+ * Idempotently remove a scratch file written by {@link writeMcpScratch} (R2.3 teardown). Uses
+ * `fs.rm(filePath, { force: true })`, so a missing/already-removed path is a no-op and NEVER throws.
+ *
+ * @param filePath the path returned by {@link writeMcpScratch}.
+ */
+export declare function removeMcpScratch(filePath: string): Promise<void>;

package/dist/mcp-config-writer.js

@@ -0,0 +1,172 @@
+// Story 057 / Task 2.1 — translate ACP MCP servers → claude `--mcp-config` JSON + scratch-file seam.
+//
+// The fork spawns the real `claude` TUI; claude consumes externally-declared MCP servers via a
+// `--mcp-config <file.json>` flag (a `{ mcpServers: { <name>: { … } } }` document). The Zed client,
+// however, declares its MCP servers over ACP as a `McpServer[]` array (a discriminated union). This
+// module is the standalone, OFFLINE-testable translation + scratch-file seam between the two:
+//
+//   translateMcpServers(servers) → ClaudeMcpConfig   (PURE — array → claude `{mcpServers:{…}}` shape)
+//   writeMcpScratch(config)      → Promise<string>   (DURABLE 0600 write → returns the scratch path)
+//   removeMcpScratch(path)       → Promise<void>     (idempotent unlink on teardown)
+//
+// It owns NO engine wiring — the before-spawn `--mcp-config` plumbing into acp-agent.ts/the engine is
+// a separate Task (2.2/2.3). The scratch-JSON discipline (temp-file → fsync → atomic rename, with a
+// guaranteed 0600 mode) mirrors `gate/settings-writer.ts`'s private `durableWrite`; that pattern is
+// copied here rather than imported (it is not exported there).
+//
+// SECRETS (R2.3): the scratch file may carry MCP auth headers / env / URLs. Its mode is forced to
+// `0600` (owner-only) and it is removable on teardown. The config object, headers, env, and url are
+// NEVER logged — the ONLY log this module emits is a one-line note when an `acp`-transport server is
+// dropped, and that note carries no secret-bearing field.
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import { randomUUID } from "node:crypto";
+/** Convert an ACP `{name,value}[]` list into a plain `{ [name]: value }` object. */
+function pairsToObject(pairs) {
+    const out = {};
+    for (const { name, value } of pairs) {
+        out[name] = value;
+    }
+    return out;
+}
+/**
+ * Translate the ACP `McpServer[]` union into claude's `--mcp-config` `{ mcpServers: { … } }` shape
+ * (R2.1). PURE and total — never throws; empty/undefined input yields `{ mcpServers: {} }`.
+ *
+ * Discriminator (per the ACP schema): `type === "http"|"sse"|"acp"` selects that transport; a server
+ * with NO `type` field is the bare stdio variant. Per-transport mapping:
+ *   - http / sse → `{ type, url, headers? }`; `headers` is OMITTED when the ACP array is empty.
+ *   - stdio      → `{ command, args?, env? }`; `args` and `env` are each OMITTED when empty; NO `type`.
+ *   - acp        → DROPPED (ACP-channel transport has no `--mcp-config` equivalent); a one-line note
+ *                  is emitted to stderr (no url/headers/env — R2.3).
+ *
+ * Duplicate names collapse onto the same key (last wins) — claude's map is name-keyed, so this matches
+ * how claude itself would resolve a repeated server name.
+ *
+ * @param servers the ACP-declared MCP servers, or `undefined`/`[]` when the client declared none.
+ * @returns the claude `--mcp-config` document (possibly with an empty `mcpServers`).
+ */
+export function translateMcpServers(servers) {
+    const mcpServers = {};
+    if (!servers) {
+        return { mcpServers };
+    }
+    for (const server of servers) {
+        // The ACP union is NOT a uniform discriminated union: http/sse/acp carry a `type` tag, but the
+        // stdio variant has NO `type` field at all. So a `"type" in server` guard (not `server.type`)
+        // first splits the tagged members from the bare stdio variant; within the tagged set, `type`
+        // then selects http/sse vs acp.
+        if ("type" in server) {
+            if (server.type === "http" || server.type === "sse") {
+                const entry = { type: server.type, url: server.url };
+                if (server.headers.length > 0) {
+                    entry.headers = pairsToObject(server.headers);
+                }
+                mcpServers[server.name] = entry;
+            }
+            else {
+                // type === "acp": ACP-transport servers ride the ACP channel (mcp/connect…); claude's
+                // --mcp-config cannot express them, so drop. Log ONLY the (non-secret) name — never
+                // id/url/headers/env (R2.3).
+                console.error(`[mcp-config-writer] dropping ACP-transport MCP server ${JSON.stringify(server.name)}: ` +
+                    `no --mcp-config equivalent (ACP-channel transport is not supported by the claude CLI).`);
+            }
+            continue;
+        }
+        // No `type` field → the bare stdio variant: `{ command, args, env }`. NO `type` is emitted
+        // (claude infers stdio from `command`); empty `args`/`env` are omitted.
+        const entry = { command: server.command };
+        if (server.args.length > 0) {
+            entry.args = [...server.args];
+        }
+        if (server.env.length > 0) {
+            entry.env = pairsToObject(server.env);
+        }
+        mcpServers[server.name] = entry;
+    }
+    return { mcpServers };
+}
+/**
+ * Durably write `text` to `filePath` with mode `0600` via a temp-file → fsync → atomic `rename` so a
+ * reader (claude on startup) never observes a partial file. The 0600 mode is GUARANTEED twice: the
+ * temp is created with `mode: 0o600`, and `chmod(0o600)` is re-applied after the rename so a permissive
+ * umask cannot loosen it. On any failure the partial temp is removed before the error propagates.
+ *
+ * Mirrors `gate/settings-writer.ts`'s private `durableWrite` (copied — that helper is not exported),
+ * with the added 0600 guarantee this scratch file requires (R2.3).
+ */
+async function durableWrite0600(filePath, text) {
+    const dir = path.dirname(filePath);
+    const tmp = path.join(dir, `.${path.basename(filePath)}.fork-tmp-${process.pid}-${Date.now()}`);
+    let handle = null;
+    try {
+        // Create the temp owner-only from the outset so its bytes are never world-readable, even briefly.
+        handle = await fs.open(tmp, "w", 0o600);
+        await handle.writeFile(text, "utf8");
+        await handle.sync(); // flush the file's own bytes to disk before the rename
+        await handle.close();
+        handle = null;
+        await fs.rename(tmp, filePath); // atomic swap into place
+        // Re-assert 0600 AFTER the rename so the active umask cannot have loosened the open() mode.
+        await fs.chmod(filePath, 0o600);
+        // Best-effort fsync of the directory entry so the rename itself is durable.
+        try {
+            const dirHandle = await fs.open(dir, "r");
+            try {
+                await dirHandle.sync();
+            }
+            finally {
+                await dirHandle.close();
+            }
+        }
+        catch {
+            // Some platforms reject O_RDONLY dir fsync; the file fsync above is the load-bearing one.
+        }
+    }
+    catch (err) {
+        if (handle !== null) {
+            try {
+                await handle.close();
+            }
+            catch {
+                // ignore
+            }
+        }
+        try {
+            await fs.rm(tmp, { force: true });
+        }
+        catch {
+            // ignore — nothing durable to clean
+        }
+        throw err;
+    }
+}
+/**
+ * DURABLY write `config` to a fresh uuid-namespaced scratch file under the OS temp dir with mode
+ * `0600`, and RETURN its absolute path (R2.1, R2.3). The file is `JSON.stringify(config, null, 2)`
+ * plus a trailing newline. The caller passes the returned path to `claude --mcp-config <path>` and
+ * is responsible for removing it on teardown via {@link removeMcpScratch}.
+ *
+ * The file may carry MCP auth headers/env (secrets), so it is created owner-only (0600) and is NEVER
+ * logged here (R2.3).
+ *
+ * @param config the document from {@link translateMcpServers}.
+ * @returns the absolute path of the written scratch file.
+ * @throws {Error} if the durable write fails — the partial temp is cleaned up first (no residue).
+ */
+export async function writeMcpScratch(config) {
+    const filePath = path.join(os.tmpdir(), `fork-acp-mcp-${randomUUID()}.json`);
+    const text = `${JSON.stringify(config, null, 2)}\n`;
+    await durableWrite0600(filePath, text);
+    return filePath;
+}
+/**
+ * Idempotently remove a scratch file written by {@link writeMcpScratch} (R2.3 teardown). Uses
+ * `fs.rm(filePath, { force: true })`, so a missing/already-removed path is a no-op and NEVER throws.
+ *
+ * @param filePath the path returned by {@link writeMcpScratch}.
+ */
+export async function removeMcpScratch(filePath) {
+    await fs.rm(filePath, { force: true });
+}

package/dist/model-catalog.d.ts

@@ -1,11 +1,76 @@
 import type { ModelInfo } from "@anthropic-ai/claude-agent-sdk";
+/**
+ * Effort levels offered for reasoning-capable models — the SDK's `supportedEffortLevels` vocabulary.
+ * Story 060: exported so the ultracode guard test can assert membership stays the five real levels
+ * (it must NEVER contain {@link ULTRACODE_EFFORT}; the real `--effort` enum is exactly this set).
+ */
+export declare const REASONING_EFFORT_LEVELS: NonNullable<ModelInfo["supportedEffortLevels"]>;
+/**
+ * Story 060 — the "ultracode" pseudo-level sentinel for the effort selector. NOT a real `--effort`
+ * value (claude 2.1.195 rejects `--effort ultracode`; the enum stays {@link REASONING_EFFORT_LEVELS}).
+ * Selecting it maps to `--effort xhigh` PLUS activating the ultracode keyword-trigger for the session
+ * (story 060 Task 3). Kept OUT of REASONING_EFFORT_LEVELS so no real-effort code path ever emits it.
+ */
+export declare const ULTRACODE_EFFORT = "ultracode";
+/** The real effort level the ultracode pseudo-level maps to (its documented effort component). */
+export declare const ULTRACODE_EFFORT_LEVEL = "xhigh";
+/** Selector label — makes clear it is xhigh + orchestration, NOT a duplicate of the plain `xhigh` entry. */
+export declare const ULTRACODE_EFFORT_LABEL = "ultracode (xhigh + orchestration)";
 /**
  * The static curated catalog advertised to the Zed Agent Panel's `model` selector. Each `value` is a
  * `claude` TUI alias accepted by `/model <alias>` (live) and `--model <alias>` (spawn). `default` is
- * first and is the safe fallback. Effort-capable models (`sonnet`, `opus`) carry the metadata that
- * surfaces the effort selector; `default`/`haiku`/`opusplan` advertise no effort levels.
+ * first and is the safe fallback.
+ *
+ * ORDER + membership mirror the ORIGINAL's `/model` picker, LIVE-VERIFIED against 2.1.195 (PTY probe):
+ * `Default (recommended)`, `Opus`, `Sonnet`, `Sonnet (1M context)`, `Haiku`. The original gets this
+ * from the SDK `supportedModels()` the fork cut, so we curate it statically. The 1M alias is literally
+ * `sonnet[1m]` (`/model sonnet[1m]` accepted; `sonnet-1m` → "not found"). `opusplan` is a fork-only
+ * EXTRA (a real `claude` plan-mode preset the original does not list) kept as the trailing entry.
+ *
+ * Effort-capable models (`default`/`opus`/`sonnet`/`sonnet[1m]`) carry `supportsEffort` +
+ * `supportedEffortLevels`; `haiku`/`opusplan` advertise none. `supportsAutoMode: true` on the same four
+ * surfaces the `auto` permission mode (a model classifier) — the original drops `auto` on `haiku`
+ * (the SDK signal `reconcileModeFromTranscript` clamps), so haiku/opusplan omit it.
  */
 export declare const MODEL_CATALOG: ModelInfo[];
+/**
+ * Story 068 (R1, R1.1, R2) — the REAL per-alias context window, keyed by the EXACT {@link MODEL_CATALOG}
+ * `value`. These windows are NOT uniform: `opus` is natively 1M, `sonnet`/`haiku` are 200K, and
+ * `sonnet[1m]` is the explicit 1M variant. This map is the single source of truth that
+ * `inferContextWindowFromModel` (acp-agent.ts) consults BEFORE the `\b1m\b` regex fallback — the bug it
+ * fixes is `opus` having wrongly reported 200K (the regex only ever matched the literal `1m` token).
+ *
+ * Story 069 (R2): `default` and `opusplan` seed to 1M — `default` is the recommended Opus (the claude TUI's
+ * `/model default` resolves to `claude-opus-4-8[1m]`, a 1M model) and `opusplan` plans with Opus. This is
+ * only the PRE-FIRST-TURN seed: once a turn arrives, `inferContextWindowFromModelId` (story 069)
+ * AUTHORITATIVELY refines the window from the transcript's real `model`. Keys MIRROR `MODEL_CATALOG`
+ * `value`s; the drift guard lives in the test (068 anti-drift: every catalog value has an explicit entry).
+ */
+export declare const MODEL_CONTEXT_WINDOWS: Record<string, number>;
+/**
+ * Story 069 (R1.1) — the REAL context window per concrete model ID, mirroring the claude CLI's
+ * `context:{window}` table. Used to AUTHORITATIVELY refine the window from a turn's actual `model`
+ * (the JSONL `model` field), correcting the alias seed. Opus is NOT uniform: 4.6 = 200K, 4.7+ = 1M.
+ * Dated snapshots / future versions are covered by the family+version heuristic in
+ * `inferContextWindowFromModelId`; this table is the exact-ID source of truth for today's gateway IDs.
+ */
+export declare const MODEL_ID_CONTEXT_WINDOWS: Record<string, number>;
+/**
+ * Story 072 — the version/context PREFIX the claude `/model` picker now shows before the static tagline
+ * (e.g. "Opus 4.8 with 1M context · Best for everyday, complex tasks"). Keyed by catalog `value`.
+ *
+ * CURATED + DRIFT-PRONE, exactly like MODEL_CATALOG membership: the fork holds only aliases pre-turn and
+ * cannot derive the concrete version (the SDK `supportedModels()` was cut), so these MIRROR the LIVE
+ * picker and MUST be re-verified on each model launch (source: the user's live `/model` output). The
+ * static tagline stays on `ModelInfo.description` (069 R3 untouched); this only prepends "<version> · ".
+ * `opusplan` is intentionally absent — its tagline ("Use Opus in plan mode, Sonnet otherwise") already
+ * names the models, so it renders bare.
+ */
+export declare const MODEL_VERSION_LABELS: Record<string, string>;
+/**
+ * Story 072 — compose the Zed selector description: "<version label> · <tagline>", or the bare tagline
+ * when no label exists (e.g. `opusplan`). PURE + TOTAL: never throws on a missing label or tagline.
+ */
+export declare function modelSelectorDescription(info: ModelInfo): string;
 /** The safe fallback entry, kept as a named export so callers can seed/anchor on it without a lookup. */
 export declare const DEFAULT_MODEL_INFO: ModelInfo;
-//# sourceMappingURL=model-catalog.d.ts.map

package/dist/model-catalog.js

@@ -1,45 +1,155 @@
-/** Effort levels offered for reasoning-capable models — the SDK's `supportedEffortLevels` vocabulary. */
-const REASONING_EFFORT_LEVELS = [
+/**
+ * Effort levels offered for reasoning-capable models — the SDK's `supportedEffortLevels` vocabulary.
+ * Story 060: exported so the ultracode guard test can assert membership stays the five real levels
+ * (it must NEVER contain {@link ULTRACODE_EFFORT}; the real `--effort` enum is exactly this set).
+ */
+export const REASONING_EFFORT_LEVELS = [
     "low",
     "medium",
     "high",
+    "xhigh",
+    "max",
 ];
+/**
+ * Story 060 — the "ultracode" pseudo-level sentinel for the effort selector. NOT a real `--effort`
+ * value (claude 2.1.195 rejects `--effort ultracode`; the enum stays {@link REASONING_EFFORT_LEVELS}).
+ * Selecting it maps to `--effort xhigh` PLUS activating the ultracode keyword-trigger for the session
+ * (story 060 Task 3). Kept OUT of REASONING_EFFORT_LEVELS so no real-effort code path ever emits it.
+ */
+export const ULTRACODE_EFFORT = "ultracode";
+/** The real effort level the ultracode pseudo-level maps to (its documented effort component). */
+export const ULTRACODE_EFFORT_LEVEL = "xhigh";
+/** Selector label — makes clear it is xhigh + orchestration, NOT a duplicate of the plain `xhigh` entry. */
+export const ULTRACODE_EFFORT_LABEL = "ultracode (xhigh + orchestration)";
 /**
  * The static curated catalog advertised to the Zed Agent Panel's `model` selector. Each `value` is a
  * `claude` TUI alias accepted by `/model <alias>` (live) and `--model <alias>` (spawn). `default` is
- * first and is the safe fallback. Effort-capable models (`sonnet`, `opus`) carry the metadata that
- * surfaces the effort selector; `default`/`haiku`/`opusplan` advertise no effort levels.
+ * first and is the safe fallback.
+ *
+ * ORDER + membership mirror the ORIGINAL's `/model` picker, LIVE-VERIFIED against 2.1.195 (PTY probe):
+ * `Default (recommended)`, `Opus`, `Sonnet`, `Sonnet (1M context)`, `Haiku`. The original gets this
+ * from the SDK `supportedModels()` the fork cut, so we curate it statically. The 1M alias is literally
+ * `sonnet[1m]` (`/model sonnet[1m]` accepted; `sonnet-1m` → "not found"). `opusplan` is a fork-only
+ * EXTRA (a real `claude` plan-mode preset the original does not list) kept as the trailing entry.
+ *
+ * Effort-capable models (`default`/`opus`/`sonnet`/`sonnet[1m]`) carry `supportsEffort` +
+ * `supportedEffortLevels`; `haiku`/`opusplan` advertise none. `supportsAutoMode: true` on the same four
+ * surfaces the `auto` permission mode (a model classifier) — the original drops `auto` on `haiku`
+ * (the SDK signal `reconcileModeFromTranscript` clamps), so haiku/opusplan omit it.
  */
 export const MODEL_CATALOG = [
     {
         value: "default",
-        displayName: "Default",
-        description: "Use the model the claude TUI is configured with (safe fallback).",
+        displayName: "Default (recommended)",
+        // Story 069 (R3): `default` resolves to the recommended Opus, so it carries the Opus description.
+        description: "Best for everyday, complex tasks",
+        supportsEffort: true,
+        supportedEffortLevels: REASONING_EFFORT_LEVELS,
+        supportsAutoMode: true,
+    },
+    {
+        value: "opus",
+        displayName: "Opus",
+        description: "Best for everyday, complex tasks",
+        supportsEffort: true,
+        supportedEffortLevels: REASONING_EFFORT_LEVELS,
+        supportsAutoMode: true,
     },
     {
         value: "sonnet",
         displayName: "Sonnet",
-        description: "Claude Sonnet — balanced speed and capability; supports reasoning effort.",
+        description: "Efficient for routine tasks",
         supportsEffort: true,
         supportedEffortLevels: REASONING_EFFORT_LEVELS,
+        supportsAutoMode: true,
     },
     {
-        value: "opus",
-        displayName: "Opus",
-        description: "Claude Opus — highest capability; supports reasoning effort.",
+        value: "sonnet[1m]",
+        displayName: "Sonnet (1M context)",
+        // Story 069 (R3): fork-only 1M variant — the Sonnet description plus its 1M-window note.
+        description: "Efficient for routine tasks, with a 1M-token context window",
         supportsEffort: true,
         supportedEffortLevels: REASONING_EFFORT_LEVELS,
+        supportsAutoMode: true,
     },
     {
         value: "haiku",
         displayName: "Haiku",
-        description: "Claude Haiku — fastest and most economical; no reasoning effort levels.",
+        description: "Fastest for quick answers",
     },
     {
         value: "opusplan",
-        displayName: "Opus Plan",
-        description: "Opus while planning, Sonnet for execution (plan-mode workflow).",
+        displayName: "Opus Plan Mode",
+        description: "Use Opus in plan mode, Sonnet otherwise",
     },
 ];
+/**
+ * Story 068 (R1, R1.1, R2) — the REAL per-alias context window, keyed by the EXACT {@link MODEL_CATALOG}
+ * `value`. These windows are NOT uniform: `opus` is natively 1M, `sonnet`/`haiku` are 200K, and
+ * `sonnet[1m]` is the explicit 1M variant. This map is the single source of truth that
+ * `inferContextWindowFromModel` (acp-agent.ts) consults BEFORE the `\b1m\b` regex fallback — the bug it
+ * fixes is `opus` having wrongly reported 200K (the regex only ever matched the literal `1m` token).
+ *
+ * Story 069 (R2): `default` and `opusplan` seed to 1M — `default` is the recommended Opus (the claude TUI's
+ * `/model default` resolves to `claude-opus-4-8[1m]`, a 1M model) and `opusplan` plans with Opus. This is
+ * only the PRE-FIRST-TURN seed: once a turn arrives, `inferContextWindowFromModelId` (story 069)
+ * AUTHORITATIVELY refines the window from the transcript's real `model`. Keys MIRROR `MODEL_CATALOG`
+ * `value`s; the drift guard lives in the test (068 anti-drift: every catalog value has an explicit entry).
+ */
+export const MODEL_CONTEXT_WINDOWS = {
+    default: 1_000_000,
+    opus: 1_000_000,
+    sonnet: 200_000,
+    "sonnet[1m]": 1_000_000,
+    haiku: 200_000,
+    opusplan: 1_000_000,
+};
+/**
+ * Story 069 (R1.1) — the REAL context window per concrete model ID, mirroring the claude CLI's
+ * `context:{window}` table. Used to AUTHORITATIVELY refine the window from a turn's actual `model`
+ * (the JSONL `model` field), correcting the alias seed. Opus is NOT uniform: 4.6 = 200K, 4.7+ = 1M.
+ * Dated snapshots / future versions are covered by the family+version heuristic in
+ * `inferContextWindowFromModelId`; this table is the exact-ID source of truth for today's gateway IDs.
+ */
+export const MODEL_ID_CONTEXT_WINDOWS = {
+    "claude-opus-4-8": 1_000_000,
+    "claude-opus-4-7": 1_000_000,
+    "claude-opus-4-6": 200_000,
+    "claude-fable-5": 1_000_000,
+    "claude-sonnet-5": 1_000_000,
+    "claude-sonnet-4-6": 200_000,
+    "claude-sonnet-4-5-20250929": 200_000,
+    "claude-sonnet-4-20250514": 200_000,
+    "claude-haiku-4-5": 200_000,
+};
+/**
+ * Story 072 — the version/context PREFIX the claude `/model` picker now shows before the static tagline
+ * (e.g. "Opus 4.8 with 1M context · Best for everyday, complex tasks"). Keyed by catalog `value`.
+ *
+ * CURATED + DRIFT-PRONE, exactly like MODEL_CATALOG membership: the fork holds only aliases pre-turn and
+ * cannot derive the concrete version (the SDK `supportedModels()` was cut), so these MIRROR the LIVE
+ * picker and MUST be re-verified on each model launch (source: the user's live `/model` output). The
+ * static tagline stays on `ModelInfo.description` (069 R3 untouched); this only prepends "<version> · ".
+ * `opusplan` is intentionally absent — its tagline ("Use Opus in plan mode, Sonnet otherwise") already
+ * names the models, so it renders bare.
+ */
+export const MODEL_VERSION_LABELS = {
+    default: "Opus 4.8 with 1M context",
+    opus: "Opus 4.8 with 1M context",
+    sonnet: "Sonnet 5",
+    "sonnet[1m]": "Sonnet 5 with 1M context",
+    haiku: "Haiku 4.5",
+};
+/**
+ * Story 072 — compose the Zed selector description: "<version label> · <tagline>", or the bare tagline
+ * when no label exists (e.g. `opusplan`). PURE + TOTAL: never throws on a missing label or tagline.
+ */
+export function modelSelectorDescription(info) {
+    const label = MODEL_VERSION_LABELS[info.value];
+    const tagline = info.description ?? "";
+    if (!label)
+        return tagline;
+    return tagline ? `${label} · ${tagline}` : label;
+}
 /** The safe fallback entry, kept as a named export so callers can seed/anchor on it without a lookup. */
 export const DEFAULT_MODEL_INFO = MODEL_CATALOG[0];

package/dist/permissions/allow-inject.d.ts

@@ -64,4 +64,3 @@ export interface ClearNativePromptOptions {
  * @returns an {@link InjectResult}: `'suppressed'` | `'cleared'` | `'stuck'`.
  */
 export declare function clearNativePrompt(opts: ClearNativePromptOptions): Promise<InjectResult>;
-//# sourceMappingURL=allow-inject.d.ts.map

package/dist/permissions/deny.d.ts

@@ -44,6 +44,18 @@ export declare function denyDecision(toolCall: DenyToolCall, reason?: string): H
  * @returns `{ hookSpecificOutput: { hookEventName:'PreToolUse', permissionDecision:'allow', … } }`.
  */
 export declare function allowDecision(toolCall: DenyToolCall, reason?: string): HookResponse;
+/** Story 064 — the interactive tool the gate denies fail-closed over the Zed bridge (R1). */
+export declare const ASK_USER_QUESTION_TOOL = "AskUserQuestion";
+/** True iff `toolName` is the AskUserQuestion interactive picker tool (exact, case-sensitive). */
+export declare function isAskUserQuestionTool(toolName: string): boolean;
+/**
+ * Story 064 (R1.1) — the deny reason for AskUserQuestion over the Zed bridge. AskUserQuestion renders
+ * an interactive multiple-choice picker bound to the hidden PTY's stdin; the Zed user can neither see
+ * nor answer it, so allowing it would stall the turn until the watchdog fires. Deny it fail-closed with
+ * this reason so the model proceeds without it (interim until story 065 relays it via ACP elicitation).
+ * MUST name the tool and cite the bridge limitation (the body matches `/AskUserQuestion/` and `/bridge/i`).
+ */
+export declare function askUserQuestionDenyReason(): string;
 /**
  * Matcher-scoped deny predicate (R2.3 NUANCE): does this deny matcher target the given tool?
  *
@@ -57,4 +69,3 @@ export declare function allowDecision(toolCall: DenyToolCall, reason?: string):
  * @returns true iff the matcher scopes the deny to this tool.
  */
 export declare function denyMatchesTool(matcher: string, toolName: string): boolean;
-//# sourceMappingURL=deny.d.ts.map

package/dist/permissions/deny.js

@@ -64,6 +64,24 @@ export function allowDecision(toolCall, reason) {
         },
     };
 }
+/** Story 064 — the interactive tool the gate denies fail-closed over the Zed bridge (R1). */
+export const ASK_USER_QUESTION_TOOL = "AskUserQuestion";
+/** True iff `toolName` is the AskUserQuestion interactive picker tool (exact, case-sensitive). */
+export function isAskUserQuestionTool(toolName) {
+    return toolName === ASK_USER_QUESTION_TOOL;
+}
+/**
+ * Story 064 (R1.1) — the deny reason for AskUserQuestion over the Zed bridge. AskUserQuestion renders
+ * an interactive multiple-choice picker bound to the hidden PTY's stdin; the Zed user can neither see
+ * nor answer it, so allowing it would stall the turn until the watchdog fires. Deny it fail-closed with
+ * this reason so the model proceeds without it (interim until story 065 relays it via ACP elicitation).
+ * MUST name the tool and cite the bridge limitation (the body matches `/AskUserQuestion/` and `/bridge/i`).
+ */
+export function askUserQuestionDenyReason() {
+    return (`${ASK_USER_QUESTION_TOOL} is not supported over the Zed bridge: its interactive multiple-choice ` +
+        `picker renders in a hidden PTY the user cannot see or answer, so the turn would stall. Denying it ` +
+        `fail-closed — continue without asking an interactive question.`);
+}
 /**
  * Matcher-scoped deny predicate (R2.3 NUANCE): does this deny matcher target the given tool?
  *

package/dist/permissions/elicitation-bridge.d.ts

@@ -0,0 +1,71 @@
+import type { CreateElicitationRequest, CreateElicitationResponse } from "@agentclientprotocol/sdk";
+/**
+ * The gate decision this bridge yields. Mirrors hook-server's `DenyWithReason`: AskUserQuestion is
+ * ALWAYS denied at the wire, and the user's selection (or the dismissal note) is carried in `reason`.
+ */
+export interface ElicitationDecision {
+    decision: "deny";
+    reason: string;
+}
+/** The `AskUserQuestion` tool_input subset the bridge projects into a form elicitation. */
+export interface AskUserQuestionInput {
+    questions: Array<{
+        /** The human-readable question text — becomes the property `title`. */
+        question: string;
+        /** The short key — becomes the property name AND a `required` entry. */
+        header: string;
+        /** Whether multiple options may be selected (currently projected as a single string-enum). */
+        multiSelect?: boolean;
+        options: Array<{
+            label: string;
+            description?: string;
+        }>;
+    }>;
+}
+/**
+ * The minimal ACP client surface the bridge needs — structurally satisfied by the kept
+ * `AgentSideConnection` (`client.unstable_createElicitation(params)`). Injected so a unit test drives
+ * the bridge with a fake client OFFLINE (no AgentSideConnection, no Zed).
+ */
+export interface ElicitationClient {
+    unstable_createElicitation(params: CreateElicitationRequest): Promise<CreateElicitationResponse>;
+}
+/**
+ * Project an `AskUserQuestion` tool_input into an ACP form `CreateElicitationRequest`, scoped to the
+ * session and tied to the originating tool call by `tool_use.id` (R1.1, R1.2).
+ *
+ * Each question becomes one string-enum property keyed by its `header`: `{ type: "string", title:
+ * <question>, enum: <option labels, in order> }`, and every header is marked `required` (one entry per
+ * question, in order). The returned literal is shaped to satisfy the pinned SDK `zCreateElicitationRequest`.
+ */
+export declare function buildElicitationRequest(toolUseId: string, sessionId: string, toolInput: AskUserQuestionInput): CreateElicitationRequest;
+/**
+ * Map an elicitation outcome back to a gate decision (R2). EVERY branch returns a `deny`: the gate
+ * always denies AskUserQuestion at the wire and surfaces the result through `reason` (the R2.1 seam — a
+ * PreToolUse hook cannot synthesize a native tool_result).
+ *
+ *   - `accept`: the reason embeds EVERY selected answer (e.g. `Env=prod, Cache=yes`) so the model can
+ *     read the choice from the deny reason. `content` null/undefined is handled defensively (still deny).
+ *   - `decline`/`cancel`/any unrecognized-or-missing action: the reason reads as a user DISMISSAL, not
+ *     an answer (default-deny defensively for unknown actions).
+ */
+export declare function mapOutcomeToDecision(resp: CreateElicitationResponse): ElicitationDecision;
+/** Options for {@link requestElicitation}. */
+export interface RequestElicitationOptions {
+    /** The hard upper bound (ms) on the round-trip; a slower client fails closed to a cancel. */
+    timeoutMs: number;
+    /** Optional sink for the fail-closed diagnostics (defaults to no-op; production wires the logger). */
+    onWarn?: (message: string) => void;
+}
+/**
+ * Perform the bounded, fail-closed elicitation round-trip (R4). NEVER throws and NEVER hangs past
+ * ~`timeoutMs`.
+ *
+ *   - Happy path (a well-formed response, action ∈ {accept,decline,cancel}) → returned UNCHANGED.
+ *   - Timeout → `onWarn` (naming the timeout) and resolve `{ action: "cancel" }`.
+ *   - Client throws → `onWarn` (including the underlying error text) and resolve `{ action: "cancel" }`.
+ *   - Malformed response (action not accept|decline|cancel) → normalized to `{ action: "cancel" }`.
+ *
+ * The timer is always cleared on settle so no live handle keeps the event loop open.
+ */
+export declare function requestElicitation(client: ElicitationClient, req: CreateElicitationRequest, opts: RequestElicitationOptions): Promise<CreateElicitationResponse>;