@namzu/cli 26.3.0 → 28.0.0

package/dist/config/schema.d.ts

@@ -48,17 +48,17 @@ export type HookEvent = ShellHookEvent;
 export type HookEntry = ShellHookEntry;
 export type HooksConfig = ShellHooksConfig;
 /** See `NamzuCliConfig.limits`. */
-export interface RunLimitsConfig {
-    /** Main-loop iterations one run may make. Omitted or 0 means unlimited. */
+export interface TurnLimitsConfig {
+    /** Main-loop iterations one turn may make. Omitted or 0 means unlimited. */
     readonly maxIterations?: number;
-    /** Aggregate prompt and completion tokens for the run and descendants. Omitted or 0 means unlimited. */
+    /** Aggregate prompt and completion tokens for the turn and descendants. Omitted or 0 means unlimited. */
     readonly tokenBudget?: number;
-    /** Total run duration in milliseconds. Omitted or 0 means unlimited. */
+    /** Total turn duration in milliseconds. Omitted or 0 means unlimited. */
     readonly timeoutMs?: number;
     /**
-     * Milliseconds a headless run may spend waiting out provider pauses — a
-     * rate limit, an outage — resuming from its checkpoint after each, before
-     * it stops with exit code 75. Default 0: a pause ends the run at once.
+     * Milliseconds a headless `namzu exec` may spend waiting out provider
+     * pauses — a rate limit, an outage — resuming from its checkpoint after
+     * each, before it stops with exit code 75. Default 0: a pause ends it at once.
      */
     readonly waitForProviderMs?: number;
 }
@@ -88,7 +88,7 @@ export interface CompactionCliConfig {
     readonly contextWindowTokens?: number;
     /**
      * Use consolidation (one `learning` entry) instead of the default
-     * extracted-claim promoter when the run ends. Both write to the project's
+     * extracted-claim promoter when the turn ends. Both write to the project's
      * memory store. This selects the writer; `memory.recall` controls retrieval.
      */
     readonly consolidate?: boolean;
@@ -142,7 +142,7 @@ export interface NamzuCliConfig {
      * What the operator believes the table above decides, checked at startup.
      *
      * Each entry names a tool, an input, and the expected `"allow" | "ask" |
-     * "deny"`. A mismatch is reported by index and the run continues — the
+     * "deny"`. A mismatch is reported by index and the turn continues — the
      * point is to say that a policy does not do what its author said, which
      * a table of globs cannot be read for. Absent means nothing is checked,
      * which is what it meant before this existed.
@@ -177,12 +177,12 @@ export interface NamzuCliConfig {
     /** Executable extension bundles. Absent keeps discovery and imports off. */
     readonly plugins?: PluginConfig;
     /**
-     * How far one run may go before the kernel stops it. Headless `run` and
-     * `run-stream` read these; `--max-iterations` and `--token-budget` override
-     * them for one run. Absent means unlimited tokens, iterations and run duration.
+     * How far one turn may go before the kernel stops it. Headless `exec` and
+     * `exec --json` read these; `--max-iterations` and `--token-budget` override
+     * them for one turn. Absent means unlimited tokens, iterations and turn duration.
      * Explicit token budgets cover descendants.
      */
-    readonly limits?: RunLimitsConfig;
+    readonly limits?: TurnLimitsConfig;
     /**
      * Isolation for the commands this CLI runs.
      *
@@ -209,7 +209,7 @@ export interface NamzuCliConfig {
     readonly web?: WebConfig;
     /**
      * Shell commands to run at points in the agent's loop: before or after a
-     * tool call, when a run starts or ends. File-only, never from the
+     * tool call, when a turn starts or ends. File-only, never from the
      * environment — a hook runs a command with the operator's authority, and
      * a shell profile must not be able to plant one. Exit `2` from a
      * `pre_tool_use` hook blocks the call and tells the model why; any other
@@ -265,6 +265,20 @@ export interface NamzuCliConfig {
     readonly telemetry?: TelemetryConfig;
     /** Interactive-terminal-only behaviour. Absent leaves notifications off. */
     readonly tui?: TuiConfig;
+    /**
+     * Refresh provider model catalogues in the background on every launch.
+     *
+     * Today this is the Zen and Zen Go catalogue. Absent or `true` means on: the
+     * interactive TUI, `resume`, `exec` and `acp` start one refresh
+     * that never delays startup, gives up after 30 seconds, and is cancelled when
+     * the command ends. A refresh that lands becomes the catalogue the session
+     * lists and routes with and is kept under the application home as the
+     * last-good copy; one that fails keeps the last-good copy, or the bundled
+     * snapshot, and logs one line. `false` turns it off entirely — no network
+     * read, and no last-good copy either: the bundled snapshot alone. Read
+     * before a project is trusted, so a project file does not affect it.
+     */
+    readonly modelCatalogueRefresh?: boolean;
 }
 export interface TelemetryConfig {
     /**
@@ -310,14 +324,39 @@ export interface SessionExportConfig {
 export type SessionExportRedactorName = 'secrets';
 export interface SandboxConfig {
     /**
-     * Run commands inside a sandbox. Default `true`.
+     * Run commands inside an OS sandbox.
+     *
+     * Off by default: commands and file tools run on this machine, under the
+     * permission prompts, the way other coding agents run them — a shell
+     * command is reviewed before it runs, and a file tool's path outside the
+     * working directory and the added directories is an approval request,
+     * not a refusal. `true` confines each command to the working directory
+     * and the added directories, with the network cut where the platform can
+     * cut it; whatever the sandbox cannot reach then needs `/add-dir` or a
+     * per-command escape the user approves.
      *
-     * Setting it to `false` is a real choice with a real reason — a host
-     * that provides its own isolation, or a platform where the sandbox
-     * cannot start — and it is announced on startup rather than assumed.
-     * It is not a way to make a failing sandbox quiet.
+     * Unset, it is on when `requireIsolation` names a control or `workspace`
+     * is `ephemeral`: both only mean anything inside a sandbox, and dropping
+     * a requirement because a switch was left at its default is the silent
+     * downgrade this key exists to prevent. The resolved state is announced
+     * on startup either way.
      */
     readonly enabled?: boolean;
+    /**
+     * Whether a sandboxed `bash` call may ask to run one command outside the
+     * sandbox (`dangerously_disable_sandbox`). Default `true`: the request is
+     * put to the user every time — `auto` and `--yolo` included; `plan` and
+     * `strict` refuse it — and written to the session's audit trail. `false`
+     * refuses every such request.
+     */
+    readonly allowEscape?: boolean;
+    /**
+     * Whether that escape may be granted with nobody to ask (a headless or
+     * `--print` turn, a drained turn). Default `false`: an unattended escape
+     * is refused. `true` grants it without a prompt, on the audit record;
+     * set it only for a host where leaving the sandbox is already decided.
+     */
+    readonly allowUnattendedEscape?: boolean;
     /**
      * Controls this machine must actually enforce, or the CLI refuses to
      * start.
@@ -339,7 +378,7 @@ export interface SandboxConfig {
      */
     readonly workspace?: 'working-directory' | 'ephemeral';
     /**
-     * How long a completed or cancelled run waits for sandbox teardown.
+     * How long a completed or cancelled turn waits for sandbox teardown.
      * Defaults to 30 seconds. Set to `0` to preserve the former unbounded wait.
      */
     readonly teardownTimeoutMs?: number;

package/dist/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,SAAS,CAAC,CAAA;AAExE,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;AAEpE,iEAAiE;AACjE,MAAM,MAAM,yBAAyB,GAAG,cAAc,GAAG,mBAAmB,CAAA;AAE5E,kEAAkE;AAClE,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,KAAK,CAAA;AAEvD,MAAM,WAAW,SAAS;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,yBAAyB,EAAE,CAAA;IACvE,gFAAgF;IAChF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAA;CACxD;AAED,4DAA4D;AAC5D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAA;AAE5C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,CAAA;AACtC,MAAM,MAAM,SAAS,GAAG,cAAc,CAAA;AACtC,MAAM,MAAM,WAAW,GAAG,gBAAgB,CAAA;AAE1C,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,wGAAwG;IACxG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,mBAAmB;IACnC,qGAAqG;IACrG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,0GAA0G;IAC1G,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;IACzC,yHAAyH;IACzH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IAC1C,0FAA0F;IAC1F,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,UAAU,CAAA;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC3C,mGAAmG;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAA;IAC5C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,eAAe;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC/C,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;IAC5B,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAA;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IAClD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAA;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAA;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAA;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CACxB;AAED,MAAM,WAAW,eAAe;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAA;CAC5C;AAED,MAAM,WAAW,mBAAmB;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAA;CACzD;AAED,kDAAkD;AAClD,MAAM,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAEjD,MAAM,WAAW,aAAa;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC,EAAE,CAAA;IAC7E;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAAA;IACtD;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,eAAO,MAAM,cAAc,EAAE,cAG3B,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,SAAS,CAAC,CAAA;AAExE,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;AAEpE,iEAAiE;AACjE,MAAM,MAAM,yBAAyB,GAAG,cAAc,GAAG,mBAAmB,CAAA;AAE5E,kEAAkE;AAClE,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,KAAK,CAAA;AAEvD,MAAM,WAAW,SAAS;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,yBAAyB,EAAE,CAAA;IACvE,gFAAgF;IAChF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAA;CACxD;AAED,4DAA4D;AAC5D,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAA;AAE5C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,CAAA;AACtC,MAAM,MAAM,SAAS,GAAG,cAAc,CAAA;AACtC,MAAM,MAAM,WAAW,GAAG,gBAAgB,CAAA;AAE1C,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,yGAAyG;IACzG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,uCAAuC;AACvC,MAAM,WAAW,mBAAmB;IACnC,qGAAqG;IACrG,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,0GAA0G;IAC1G,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;IACzC,yHAAyH;IACzH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IAC1C,0FAA0F;IAC1F,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,UAAU,CAAA;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC3C,mGAAmG;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAA;IAC5C,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,eAAe;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC/C,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,cAAc;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAA;IAC5B,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAA;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IAClD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAA;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IAClC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAA;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAA;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAA;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;CACxC;AAED,MAAM,WAAW,eAAe;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAA;CAC5C;AAED,MAAM,WAAW,mBAAmB;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAA;CACzD;AAED,kDAAkD;AAClD,MAAM,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAEjD,MAAM,WAAW,aAAa;IAC7B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;IACxC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC,EAAE,CAAA;IAC7E;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAAA;IACtD;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,eAAO,MAAM,cAAc,EAAE,cAG3B,CAAA"}

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsWH,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,KAAK;CACZ,CAAC,CAAA"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6YH,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,KAAK;CACZ,CAAC,CAAA"}

package/dist/config/tool-result-screens.js

@@ -32,7 +32,7 @@ export function toolResultScreenName(entry) {
 /**
  * Built on demand rather than held in a table: a screen is cheap and
  * stateless, and a shared instance would be one more thing a caller could
- * mutate out from under a later run.
+ * mutate out from under a later turn.
  */
 function buildScreen(entry) {
     const name = toolResultScreenName(entry);

package/dist/config/turn-guards.d.ts

@@ -0,0 +1,23 @@
+import type { SessionLog, TurnId } from '@namzu/sdk';
+import type { NamzuCliConfig } from './schema.js';
+/** The `limits` block of a CLI config: what one turn may spend. */
+type LimitsConfig = NonNullable<NamzuCliConfig['limits']>;
+export type TurnGuardKey = 'tokenBudget' | 'maxIterations' | 'timeoutMs';
+export type TurnGuards = {
+    -readonly [K in TurnGuardKey]: number;
+};
+/** CLI policy; independent of the SDK's defaults for embedding hosts. */
+export declare function resolveTurnGuards(...layers: readonly (LimitsConfig | undefined)[]): TurnGuards;
+/**
+ * Restore a turn's own limits, including overrides made before a provider
+ * pause, from the `turn_started` record that opened it.
+ *
+ * The session log is the only place a turn's settings are written, so this
+ * reads the log rather than a sidecar. The read is strict: a log whose chain
+ * does not verify is refused rather than trusted for the limits a resumed
+ * turn runs under. `undefined` means the log holds no such turn, which is
+ * what an embedded host that never recorded one looks like.
+ */
+export declare function readStoredTurnGuards(log: Pick<SessionLog, 'sessionId' | 'read'>, turnId: TurnId): Promise<TurnGuards | undefined>;
+export {};
+//# sourceMappingURL=turn-guards.d.ts.map

package/dist/config/turn-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-guards.d.ts","sourceRoot":"","sources":["../../src/config/turn-guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,mEAAmE;AACnE,KAAK,YAAY,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAA;AAEzD,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,eAAe,GAAG,WAAW,CAAA;AACxE,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,UAAU,CAAC,IAAI,YAAY,GAAG,MAAM;CAAE,CAAA;AAIlE,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,GAAG,MAAM,EAAE,SAAS,CAAC,YAAY,GAAG,SAAS,CAAC,EAAE,GAAG,UAAU,CAkB9F;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACzC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,MAAM,CAAC,EAC3C,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAejC"}

package/dist/config/turn-guards.js

@@ -0,0 +1,46 @@
+const GUARD_KEYS = ['tokenBudget', 'maxIterations', 'timeoutMs'];
+/** CLI policy; independent of the SDK's defaults for embedding hosts. */
+export function resolveTurnGuards(...layers) {
+    const resolved = { tokenBudget: 0, maxIterations: 0, timeoutMs: 0 };
+    for (const layer of layers) {
+        for (const key of GUARD_KEYS) {
+            const value = layer?.[key];
+            if (value === undefined)
+                continue;
+            if (!Number.isSafeInteger(value) ||
+                value < 0 ||
+                (key === 'timeoutMs' && value > 2_147_483_647))
+                throw new Error(`Invalid ${key}: use a nonnegative safe integer${key === 'timeoutMs' ? ' at most 2147483647' : ''}. 0 means unlimited.`);
+            resolved[key] = value;
+        }
+    }
+    return resolved;
+}
+/**
+ * Restore a turn's own limits, including overrides made before a provider
+ * pause, from the `turn_started` record that opened it.
+ *
+ * The session log is the only place a turn's settings are written, so this
+ * reads the log rather than a sidecar. The read is strict: a log whose chain
+ * does not verify is refused rather than trusted for the limits a resumed
+ * turn runs under. `undefined` means the log holds no such turn, which is
+ * what an embedded host that never recorded one looks like.
+ */
+export async function readStoredTurnGuards(log, turnId) {
+    for await (const { record } of log.read({ mode: 'strict' })) {
+        if (record.type !== 'turn_started' || record.turnId !== turnId)
+            continue;
+        if (record.sessionId !== log.sessionId)
+            throw new Error('Turn record belongs to a different session than the resumed turn');
+        const config = { ...record.config };
+        if (GUARD_KEYS.some((key) => typeof config[key] !== 'number'))
+            throw new Error('Turn record does not contain its original limits');
+        return resolveTurnGuards({
+            tokenBudget: config.tokenBudget,
+            maxIterations: config.maxIterations,
+            timeoutMs: config.timeoutMs,
+        });
+    }
+    return undefined;
+}
+//# sourceMappingURL=turn-guards.js.map

package/dist/config/turn-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-guards.js","sourceRoot":"","sources":["../../src/config/turn-guards.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,WAAW,CAAU,CAAA;AAEzE,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,GAAG,MAA6C;IACjF,MAAM,QAAQ,GAAe,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;IAC/E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;YAC1B,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAQ;YACjC,IACC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;gBAC5B,KAAK,GAAG,CAAC;gBACT,CAAC,GAAG,KAAK,WAAW,IAAI,KAAK,GAAG,aAAa,CAAC;gBAE9C,MAAM,IAAI,KAAK,CACd,WAAW,GAAG,mCAAmC,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,sBAAsB,CACvH,CAAA;YACF,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACtB,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,GAA2C,EAC3C,MAAc;IAEd,IAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,SAAQ;QACxE,IAAI,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;YACrC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;QACpF,MAAM,MAAM,GAA4B,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;QAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACpE,OAAO,iBAAiB,CAAC;YACxB,WAAW,EAAE,MAAM,CAAC,WAAqB;YACzC,aAAa,EAAE,MAAM,CAAC,aAAuB;YAC7C,SAAS,EAAE,MAAM,CAAC,SAAmB;SACrC,CAAC,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC"}

package/dist/context/directories.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The session's added directories: the ones `/add-dir` extends and every turn
+ * reads fresh — the query, the sandbox binds and the environment prompt.
+ */
+export interface SessionDirectories {
+    list(): readonly string[];
+    /**
+     * Add one for the rest of the session, stored under its canonical path.
+     *
+     * A directory inside the working directory is not added: the tools
+     * already reach it, and a root inside the tree the agent writes to is one
+     * a later command could swap for a link.
+     *
+     * A directory outside the working directory — decided after links are
+     * followed — is added only when `approve` answers yes for the canonical
+     * path it leads to. Adding one lets every file tool reach
+     * it with no further question, which is exactly the question a path there
+     * otherwise gets, so the user is asked once here instead. Without an
+     * `approve` such a directory is refused: an add that nobody confirmed is
+     * not one this session makes on its own.
+     */
+    add(path: string, options?: {
+        readonly approve?: (absolute: string) => Promise<boolean>;
+    }): Promise<{
+        readonly added: boolean;
+        readonly path: string;
+        readonly reason?: string;
+    }>;
+}
+/**
+ * The session's directories over a list the caller keeps.
+ *
+ * The list is shared rather than copied: the session reads it at every turn,
+ * and `/add-dir` must be visible to the next one.
+ */
+export declare function createSessionDirectories(cwd: string, directories: string[]): SessionDirectories;
+//# sourceMappingURL=directories.d.ts.map

package/dist/context/directories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directories.d.ts","sourceRoot":"","sources":["../../src/context/directories.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,IAAI,SAAS,MAAM,EAAE,CAAA;IACzB;;;;;;;;;;;;;;OAcG;IACH,GAAG,CACF,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,GACrE,OAAO,CAAC;QACV,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KACxB,CAAC,CAAA;CACF;AAQD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAqD/F"}

package/dist/context/directories.js

@@ -0,0 +1,69 @@
+import { realpath, stat } from 'node:fs/promises';
+import { isAbsolute, relative, resolve } from 'node:path';
+/** True when `candidate` is `root` or below it. */
+function isInside(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+/**
+ * The session's directories over a list the caller keeps.
+ *
+ * The list is shared rather than copied: the session reads it at every turn,
+ * and `/add-dir` must be visible to the next one.
+ */
+export function createSessionDirectories(cwd, directories) {
+    const root = resolve(cwd);
+    return {
+        list: () => [...directories],
+        add: async (path, options) => {
+            const absolute = resolve(root, path);
+            if (absolute === root)
+                return { added: false, path: absolute, reason: 'That is the working directory.' };
+            if (directories.includes(absolute))
+                return { added: false, path: absolute, reason: 'Already added.' };
+            const entry = await stat(absolute).catch(() => null);
+            if (!entry?.isDirectory())
+                return { added: false, path: absolute, reason: 'Not a directory.' };
+            // Decided on canonical paths, because the file tools resolve an
+            // added directory through its links (`resolveWithinReal`): a
+            // lexical test would call `./link -> /elsewhere` inside, add it
+            // unasked, and every tool would then reach /elsewhere. The
+            // question names where it really leads.
+            const real = await realpath(absolute);
+            const realRoot = await realpath(root).catch(() => root);
+            if (real === realRoot)
+                return { added: false, path: absolute, reason: 'That is the working directory.' };
+            // Inside the working directory there is nothing to add: the tools
+            // already reach it. Adding it anyway would make a root the agent can
+            // rewrite — `rm -r sub && ln -s /elsewhere sub` from one command, a
+            // sandboxed one included — and the file tools canonicalize a root at
+            // every call, so the added root would then lead elsewhere unasked.
+            if (isInside(realRoot, real)) {
+                return {
+                    added: false,
+                    path: real,
+                    reason: 'It is inside the working directory, which the tools already reach.',
+                };
+            }
+            if (directories.includes(real))
+                return { added: false, path: real, reason: 'Already added.' };
+            if (!options?.approve) {
+                return {
+                    added: false,
+                    path: absolute,
+                    reason: 'It is outside the working directory, and adding it needs your approval, which this surface cannot ask for.',
+                };
+            }
+            if (!(await options.approve(real))) {
+                return { added: false, path: absolute, reason: 'Not approved.' };
+            }
+            // The canonical path, the one that was approved — never the spelling.
+            // The file tools canonicalize a root at every call, so a stored
+            // `./link` would follow wherever the link points later, not where it
+            // pointed when the question was asked.
+            directories.push(real);
+            return { added: true, path: real };
+        },
+    };
+}
+//# sourceMappingURL=directories.js.map

package/dist/context/directories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directories.js","sourceRoot":"","sources":["../../src/context/directories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiCzD,mDAAmD;AACnD,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACrC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,WAAqB;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzB,OAAO;QACN,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC;QAC5B,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACpC,IAAI,QAAQ,KAAK,IAAI;gBACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;YAClF,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;YAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YACpD,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;YAC9F,gEAAgE;YAChE,6DAA6D;YAC7D,gEAAgE;YAChE,2DAA2D;YAC3D,wCAAwC;YACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YACvD,IAAI,IAAI,KAAK,QAAQ;gBACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;YAClF,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACN,KAAK,EAAE,KAAK;oBACZ,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,oEAAoE;iBAC5E,CAAA;YACF,CAAC;YACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;YAC7F,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;gBACvB,OAAO;oBACN,KAAK,EAAE,KAAK;oBACZ,IAAI,EAAE,QAAQ;oBACd,MAAM,EACL,4GAA4G;iBAC7G,CAAA;YACF,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;YACjE,CAAC;YACD,sEAAsE;YACtE,gEAAgE;YAChE,qEAAqE;YACrE,uCAAuC;YACvC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACnC,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/context/environment.d.ts

@@ -31,11 +31,66 @@
  * text only changes when the fact changes, a fresh read costs a cache miss
  * exactly when a cache hit would have been wrong.
  */
+/**
+ * Where the tools run and how the model gets past the edge of it.
+ *
+ * The model used to learn its boundary from refusal strings — "Path escapes
+ * the working directory… Tools may only reach inside X" — and read every one
+ * as a wall, including the ones with a door in them. Stated up front, it can
+ * say what it can reach, and ask for the right thing when it cannot.
+ */
+export interface ExecutionBoundary {
+    /** Present when commands run in the OS sandbox; absent means the host. */
+    readonly sandbox?: {
+        /** The environment the sandbox resolved to, e.g. `linux-bwrap`. */
+        readonly environment: string;
+        /** Controls this machine actually applies, e.g. `filesystem`, `network`. */
+        readonly enforced: readonly string[];
+    };
+    /**
+     * What a sandboxed command's `dangerously_disable_sandbox` gets: put to the
+     * user (`ask`), granted unasked by configuration (`unattended`), or refused
+     * (`refused` — escapes off, or nobody to ask). Ignored on the host.
+     */
+    readonly escape: 'ask' | 'unattended' | 'refused';
+    /** Whether a person answers the permission prompts in this session. */
+    readonly interactive: boolean;
+}
+/** What the model needs to know about running under WSL. */
+export interface WslFacts {
+    /** `WSL_DISTRO_NAME`, when the environment carries it. */
+    readonly distro: string | null;
+    /** Windows executables can be started from the Linux side. */
+    readonly interop: boolean;
+    /** Windows drives mounted under `/mnt`, as `/mnt/<letter>`. */
+    readonly drives: readonly string[];
+}
+/**
+ * WSL, or `undefined` on any other Linux.
+ *
+ * The environment is the signal: WSL sets `WSL_DISTRO_NAME` in every
+ * process it starts, and `WSL_INTEROP` names the interop socket when interop
+ * is on. Interop also counts as on when its binfmt handler is registered
+ * (`/proc/sys/fs/binfmt_misc/WSLInterop`), which survives a shell that
+ * dropped the variable. Drives are the one-letter directories under `/mnt`
+ * — `/mnt/wsl` and `/mnt/wslg` are WSL's own and are not drives.
+ *
+ * Every probe is injectable so a test can describe a machine it is not
+ * running on; the defaults read this one.
+ */
+export declare function detectWsl(env?: NodeJS.ProcessEnv, probe?: {
+    readonly exists?: (path: string) => boolean;
+    readonly list?: (path: string) => readonly string[];
+}): WslFacts | undefined;
 export interface EnvironmentFacts {
     /** ISO calendar date, `YYYY-MM-DD`, in the machine's own timezone. */
     readonly today: string;
     /** Directories besides the working directory the file tools may reach, absolute. */
     readonly additionalDirectories?: readonly string[];
+    /** Where the tools run; absent leaves the boundary unstated, as before. */
+    readonly boundary?: ExecutionBoundary;
+    /** Present when this is WSL. */
+    readonly wsl?: WslFacts;
     /**
      * `branch` when on one, `null` when the working directory is not a
      * repository, `'detached'` when it is one with no branch checked out.

package/dist/context/environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/context/environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAUH,MAAM,WAAW,gBAAgB;IAChC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClD;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,CAG9C;AAeD,wBAAsB,oBAAoB,CACzC,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAmB3B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAoBxE"}
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/context/environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAWH;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,mEAAmE;QACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,4EAA4E;QAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACpC,CAAA;IACD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,YAAY,GAAG,SAAS,CAAA;IACjD,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC7B;AAED,4DAA4D;AAC5D,MAAM,WAAW,QAAQ;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IACN,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAC9C,GACJ,QAAQ,GAAG,SAAS,CAoBtB;AAED,MAAM,WAAW,gBAAgB;IAChC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClD,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;IACrC,gCAAgC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAA;IACvB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,GAAG,MAAM,CAG9C;AAeD,wBAAsB,oBAAoB,CACzC,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,IAAiB,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAmB3B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAsBxE"}

package/dist/context/environment.js

@@ -32,10 +32,46 @@
  * exactly when a cache hit would have been wrong.
  */
 import { execFile } from 'node:child_process';
+import { existsSync, readdirSync } from 'node:fs';
 import { promisify } from 'node:util';
 const run = promisify(execFile);
 /** Bound on a single git call. A wedged repository must not stall a turn. */
 const GIT_TIMEOUT_MS = 2_000;
+/**
+ * WSL, or `undefined` on any other Linux.
+ *
+ * The environment is the signal: WSL sets `WSL_DISTRO_NAME` in every
+ * process it starts, and `WSL_INTEROP` names the interop socket when interop
+ * is on. Interop also counts as on when its binfmt handler is registered
+ * (`/proc/sys/fs/binfmt_misc/WSLInterop`), which survives a shell that
+ * dropped the variable. Drives are the one-letter directories under `/mnt`
+ * — `/mnt/wsl` and `/mnt/wslg` are WSL's own and are not drives.
+ *
+ * Every probe is injectable so a test can describe a machine it is not
+ * running on; the defaults read this one.
+ */
+export function detectWsl(env = process.env, probe = {}) {
+    const distro = env.WSL_DISTRO_NAME?.trim() || null;
+    const socket = env.WSL_INTEROP?.trim() || null;
+    if (!distro && !socket)
+        return undefined;
+    const exists = probe.exists ?? existsSync;
+    const list = probe.list ??
+        ((path) => {
+            try {
+                return readdirSync(path);
+            }
+            catch {
+                return [];
+            }
+        });
+    const interop = socket !== null || exists('/proc/sys/fs/binfmt_misc/WSLInterop');
+    const drives = list('/mnt')
+        .filter((name) => /^[a-z]$/i.test(name))
+        .sort()
+        .map((name) => `/mnt/${name}`);
+    return { distro, interop, drives };
+}
 /**
  * The machine's local calendar date.
  *
@@ -94,7 +130,67 @@ export function composeEnvironmentPrompt(facts) {
     if (facts.additionalDirectories && facts.additionalDirectories.length > 0) {
         lines.push(`Besides the working directory, the file tools may reach these directories, by absolute path: ${facts.additionalDirectories.map((d) => `\`${d}\``).join(', ')}. Relative paths still resolve against the working directory.`);
     }
+    if (facts.boundary)
+        lines.push(...boundaryLines(facts.boundary));
+    if (facts.wsl)
+        lines.push(...wslLines(facts.wsl, facts.boundary));
     lines.push('These are facts about right now. Prefer them over any date or branch you would otherwise assume.');
     return `## Environment\n\n${lines.join('\n')}`;
 }
+/** The boundary, and the way past it, in the words the model acts on. */
+function boundaryLines(boundary) {
+    if (!boundary.sandbox) {
+        const outside = boundary.interactive
+            ? 'A path anywhere else is not refused outright: the user is asked to approve that call first, every time — in plan mode too, for a read; the strict permission mode refuses it. When you need a directory repeatedly, suggest the user add it with `/add-dir <path>`.'
+            : 'A path anywhere else is refused in this session, because it needs a person to approve it and nobody is at the terminal. If you need one, say which directory and why, so the user can add it (`--add-dir <path>`) and run again.';
+        return [
+            'Tools run on this machine, not in a sandbox: shell commands and file changes go through the permission settings, which may ask the user before they run.',
+            `The file tools reach the working directory and any added directories directly. ${outside} A refusal that remains is a decision, not a missing file; say so rather than retrying another spelling.`,
+        ];
+    }
+    const { environment, enforced } = boundary.sandbox;
+    const network = enforced.includes('network')
+        ? ' The network is cut inside it.'
+        : ' It does not cut the network on this machine.';
+    const escapeRoute = boundary.escape === 'ask'
+        ? 'When one command genuinely cannot work inside it (it needs the network, a path it does not mount, or a host tool), set `dangerously_disable_sandbox: true` on that one `bash` call: the user is asked to approve it every time, whatever else is approved; the plan and strict permission modes refuse it. Never use it to get around a permission refusal.'
+        : boundary.escape === 'unattended'
+            ? 'When one command genuinely cannot work inside it, `dangerously_disable_sandbox: true` on that `bash` call runs it on the host: this session is configured to allow that without asking, and every use is recorded. Use it only when the sandbox is the obstacle.'
+            : 'Commands cannot leave the sandbox in this session. When one needs something the sandbox withholds, say what and why, and let the user decide.';
+    // Said per what the platform enforces, never more. A tier that does not
+    // confine the file system (`linux-namespace`, `basic`) leaves the whole
+    // host visible to a command; one that does still shows it the system
+    // directories programs need, read-only, and a private /tmp.
+    const files = enforced.includes('filesystem')
+        ? ' Inside it, commands can read and write the working directory and the added directories; the system directories programs need are readable, /tmp is private to the command, and the rest of this machine (the home directory, other projects, other mounts) cannot be reached from it, so no spelling of such a path will be found.'
+        : ' It does not confine the file system here, so commands can still see files outside the working directory.';
+    return [
+        `Shell commands run in a sandbox (${environment}${enforced.length > 0 ? `, enforcing ${enforced.join(', ')}` : ', enforcing nothing on this platform'}).${files}${network} The file tools reach only the working directory and the added directories.`,
+        `To reach another directory, ask the user to add it with \`/add-dir <path>\` (the next turn binds it). ${escapeRoute}`,
+    ];
+}
+/** WSL: where the Windows side is, and how to reach it from here. */
+function wslLines(wsl, boundary) {
+    // Only a sandbox that confines the file system hides the drives; one that
+    // does not leaves them visible to commands, like the host.
+    const sandboxed = boundary?.sandbox?.enforced.includes('filesystem') === true;
+    const fileTools = boundary?.sandbox !== undefined
+        ? 'the file tools reach them only once added with `/add-dir`'
+        : boundary?.interactive === false
+            ? 'a file tool reaching them is refused in this session, since nobody is here to approve it'
+            : 'a file tool reaching them asks for approval first, like any other outside path';
+    const drives = wsl.drives.length > 0
+        ? `Windows drives are mounted under ${wsl.drives.map((d) => `\`${d}\``).join(', ')} (\`C:\\Users\` is \`/mnt/c/Users\`; \`wslpath -w\` and \`wslpath -u\` convert).`
+        : 'No Windows drive is mounted under `/mnt` right now.';
+    const reach = sandboxed
+        ? 'They are outside the sandbox, so a command there needs `/add-dir` or the sandbox escape.'
+        : `They are outside the working directory, so ${fileTools}.`;
+    const interop = wsl.interop
+        ? `Windows programs start from the shell through WSL interop, by their \`.exe\` name: \`powershell.exe -NoProfile -Command ...\`, \`cmd.exe /c ...\`, \`explorer.exe .\`. \`cmd.exe\` started from a Linux directory warns that UNC paths are unsupported and falls back to C:\\Windows, so \`cd\` under \`/mnt/c\` first or use \`powershell.exe\`. If a name is not found, the Windows side of \`PATH\` was not appended; \`cmd.exe\` is under \`/mnt/c/Windows/System32\` and \`powershell.exe\` under its \`WindowsPowerShell/v1.0\`.${sandboxed ? ' The sandbox does not mount the Windows drives those programs live on, so running one needs the sandbox escape.' : ''}`
+        : 'WSL interop is off here, so Windows `.exe` programs cannot be started from the shell.';
+    return [
+        `This machine is Windows Subsystem for Linux${wsl.distro ? ` (distro \`${wsl.distro}\`)` : ''}. ${drives} ${reach}`,
+        interop,
+    ];
+}
 //# sourceMappingURL=environment.js.map

package/dist/context/environment.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../src/context/environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAE/B,6EAA6E;AAC7E,MAAM,cAAc,GAAG,KAAK,CAAA;AAe5B;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAS;IACrC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAuB;IACtD,IAAI,CAAC;QACJ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QACzB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;QACtE,uEAAuE;QACvE,4CAA4C;QAC5C,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,GAAW,EACX,MAAY,IAAI,IAAI,EAAE;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,WAAW;IACX,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAChD,GAAG,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,cAAc,KAAK,MAAM,CAAA;IAC9C,OAAO;QACN,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;QACxB,0EAA0E;QAC1E,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QACpD,YAAY;KACZ,CAAA;AACF,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAuB;IAC/D,MAAM,KAAK,GAAG,CAAC,mBAAmB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAA;IACjD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAC7D,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CACT,oJAAoJ,CACpJ,CAAA;IACF,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,yDAAyD,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,KAAK,CAAC,IAAI,CACT,gGAAgG,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D,CAC5N,CAAA;IACF,CAAC;IACD,KAAK,CAAC,IAAI,CACT,kGAAkG,CAClG,CAAA;IACD,OAAO,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AAC/C,CAAC"}
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../src/context/environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAE/B,6EAA6E;AAC7E,MAAM,cAAc,GAAG,KAAK,CAAA;AAsC5B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CACxB,MAAyB,OAAO,CAAC,GAAG,EACpC,QAGI,EAAE;IAEN,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAClD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;IAC9C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,UAAU,CAAA;IACzC,MAAM,IAAI,GACT,KAAK,CAAC,IAAI;QACV,CAAC,CAAC,IAAY,EAAE,EAAE;YACjB,IAAI,CAAC;gBACJ,OAAO,WAAW,CAAC,IAAI,CAAC,CAAA;YACzB,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,EAAE,CAAA;YACV,CAAC;QACF,CAAC,CAAC,CAAA;IACH,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,qCAAqC,CAAC,CAAA;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACvC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACnC,CAAC;AAmBD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAS;IACrC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAuB;IACtD,IAAI,CAAC;QACJ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QACzB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;QACtE,uEAAuE;QACvE,4CAA4C;QAC5C,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,GAAW,EACX,MAAY,IAAI,IAAI,EAAE;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,WAAW;IACX,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAChD,GAAG,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,cAAc,KAAK,MAAM,CAAA;IAC9C,OAAO;QACN,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC;QACxB,0EAA0E;QAC1E,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QACpD,YAAY;KACZ,CAAA;AACF,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAuB;IAC/D,MAAM,KAAK,GAAG,CAAC,mBAAmB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAA;IACjD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAC7D,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CACT,oJAAoJ,CACpJ,CAAA;IACF,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,yDAAyD,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,KAAK,CAAC,IAAI,CACT,gGAAgG,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D,CAC5N,CAAA;IACF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;IAChE,IAAI,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjE,KAAK,CAAC,IAAI,CACT,kGAAkG,CAClG,CAAA;IACD,OAAO,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED,yEAAyE;AACzE,SAAS,aAAa,CAAC,QAA2B;IACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW;YACnC,CAAC,CAAC,qQAAqQ;YACvQ,CAAC,CAAC,kOAAkO,CAAA;QACrO,OAAO;YACN,0JAA0J;YAC1J,kFAAkF,OAAO,0GAA0G;SACnM,CAAA;IACF,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAA;IAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,+CAA+C,CAAA;IAClD,MAAM,WAAW,GAChB,QAAQ,CAAC,MAAM,KAAK,KAAK;QACxB,CAAC,CAAC,6VAA6V;QAC/V,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,YAAY;YACjC,CAAC,CAAC,kQAAkQ;YACpQ,CAAC,CAAC,+IAA+I,CAAA;IACpJ,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC5C,CAAC,CAAC,qUAAqU;QACvU,CAAC,CAAC,2GAA2G,CAAA;IAC9G,OAAO;QACN,oCAAoC,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,sCAAsC,KAAK,KAAK,GAAG,OAAO,6EAA6E;QACtP,yGAAyG,WAAW,EAAE;KACtH,CAAA;AACF,CAAC;AAED,qEAAqE;AACrE,SAAS,QAAQ,CAAC,GAAa,EAAE,QAAuC;IACvE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,SAAS,GAAG,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI,CAAA;IAC7E,MAAM,SAAS,GACd,QAAQ,EAAE,OAAO,KAAK,SAAS;QAC9B,CAAC,CAAC,2DAA2D;QAC7D,CAAC,CAAC,QAAQ,EAAE,WAAW,KAAK,KAAK;YAChC,CAAC,CAAC,0FAA0F;YAC5F,CAAC,CAAC,gFAAgF,CAAA;IACrF,MAAM,MAAM,GACX,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,oCAAoC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kFAAkF;QACpK,CAAC,CAAC,qDAAqD,CAAA;IACzD,MAAM,KAAK,GAAG,SAAS;QACtB,CAAC,CAAC,0FAA0F;QAC5F,CAAC,CAAC,8CAA8C,SAAS,GAAG,CAAA;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO;QAC1B,CAAC,CAAC,ygBAAygB,SAAS,CAAC,CAAC,CAAC,iHAAiH,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/oB,CAAC,CAAC,uFAAuF,CAAA;IAC1F,OAAO;QACN,8CAA8C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,EAAE;QACnH,OAAO;KACP,CAAA;AACF,CAAC"}

package/dist/context/project-tracker.d.ts

@@ -3,7 +3,7 @@ import { type SkippedInstructionFile } from './project.js';
 /** Total model-visible instruction text held by one session. */
 export declare const MAX_TOTAL_PROJECT_INSTRUCTION_CHARS = 256000;
 /**
- * Session-owned live instruction state. Each run gets its own drain cursor;
+ * Session-owned live instruction state. Each turn gets its own drain cursor;
  * children share discovery without being able to consume the parent's update.
  */
 export declare class ProjectInstructionTracker {
@@ -15,8 +15,8 @@ export declare class ProjectInstructionTracker {
     rehydrate(messages: readonly Message[]): void;
     /** Refresh known scopes and return the exact policy for a new human turn. */
     prepareSnapshot(messages: readonly Message[]): UserMessage | null;
-    /** Each run's durable messages are its cursor over the shared discovered state. */
-    createRunContext(): ProjectInstructionContext;
+    /** Each turn's durable messages are its cursor over the shared discovered state. */
+    createTurnContext(): ProjectInstructionContext;
     get instructionFiles(): readonly string[];
     get skippedInstructionFiles(): readonly SkippedInstructionFile[];
     private observe;

package/dist/context/project-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-tracker.d.ts","sourceRoot":"","sources":["../../src/context/project-tracker.ts"],"names":[],"mappings":"AAEA,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAE9B,KAAK,WAAW,EAGhB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAIN,KAAK,sBAAsB,EAG3B,MAAM,cAAc,CAAA;AAErB,gEAAgE;AAChE,eAAO,MAAM,mCAAmC,SAAU,CAAA;AA0D1D;;;GAGG;AACH,qBAAa,yBAAyB;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAE3C,GAAG,EAAE,MAAM;IAMvB,mFAAmF;IACnF,SAAS,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI;IAa7C,6EAA6E;IAC7E,eAAe,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI;IAKjE,mFAAmF;IACnF,gBAAgB,IAAI,yBAAyB;IAa7C,IAAI,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAExC;IAED,IAAI,uBAAuB,IAAI,SAAS,sBAAsB,EAAE,CAE/D;IAED,OAAO,CAAC,OAAO;IAyBf,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,IAAI;IAkDZ,OAAO,CAAC,QAAQ;IAWhB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,uBAAuB;CAa/B"}
+{"version":3,"file":"project-tracker.d.ts","sourceRoot":"","sources":["../../src/context/project-tracker.ts"],"names":[],"mappings":"AAEA,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAE9B,KAAK,WAAW,EAGhB,MAAM,YAAY,CAAA;AAGnB,OAAO,EAIN,KAAK,sBAAsB,EAG3B,MAAM,cAAc,CAAA;AAErB,gEAAgE;AAChE,eAAO,MAAM,mCAAmC,SAAU,CAAA;AA0D1D;;;GAGG;AACH,qBAAa,yBAAyB;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAE3C,GAAG,EAAE,MAAM;IAMvB,mFAAmF;IACnF,SAAS,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI;IAa7C,6EAA6E;IAC7E,eAAe,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,WAAW,GAAG,IAAI;IAKjE,oFAAoF;IACpF,iBAAiB,IAAI,yBAAyB;IAa9C,IAAI,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAExC;IAED,IAAI,uBAAuB,IAAI,SAAS,sBAAsB,EAAE,CAE/D;IAED,OAAO,CAAC,OAAO;IAyBf,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,IAAI;IAkDZ,OAAO,CAAC,QAAQ;IAWhB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,uBAAuB;CAa/B"}