@wrongstack/core 0.260.0 → 0.265.1

package/dist/{agent-bridge-BbskZ7HH.d.ts → agent-bridge-DrkBxszZ.d.ts}

@@ -1,4 +1,4 @@
-import { B as BridgeTransport, a as BridgeMessage, A as AgentBridge, b as AgentBridgeConfig } from './agent-subagent-runner-BNIGZx18.js';
+import { B as BridgeTransport, a as BridgeMessage, A as AgentBridge, b as AgentBridgeConfig } from './agent-subagent-runner-DM2pP-B6.js';
 
 /**
  * In-memory pub/sub transport for agent-to-agent messaging.

package/dist/{agent-subagent-runner-BNIGZx18.d.ts → agent-subagent-runner-DM2pP-B6.d.ts}

@@ -1,12 +1,12 @@
-import { c as ToolCallPipelinePayload, d as ToolWrapper, E as ExtensionRegistry, S as SystemPromptContributor, e as ToolRegistry, P as ProviderRegistry, A as AgentPipelines, f as ToolExecutorLike, g as AgentInit, h as AgentInput, R as RunResult } from './index-BPcg4N3M.js';
-import { C as Container, R as ReadonlyPipeline, a as Renderer } from './pipeline-zflkI2dp.js';
-import { E as EventBus, a as EventName, L as Listener } from './brain-C2yDd7Lw.js';
-import { R as RetryPolicy, E as ErrorHandler } from './retry-policy-Cavrzmtk.js';
+import { c as ToolCallPipelinePayload, d as ToolWrapper, E as ExtensionRegistry, S as SystemPromptContributor, e as ToolRegistry, P as ProviderRegistry, A as AgentPipelines, f as ToolExecutorLike, g as AgentInit, h as AgentInput, R as RunResult } from './index-CEDeNodM.js';
+import { C as Container, R as ReadonlyPipeline, a as Renderer } from './pipeline-DPDxH_7m.js';
+import { E as EventBus, a as EventName, L as Listener } from './brain-BXd_61kQ.js';
+import { R as RetryPolicy, E as ErrorHandler } from './retry-policy-CN0khdlj.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { T as Tracer } from './observability-D-HZN_mF.js';
-import { P as PermissionPolicy } from './permission-BJ7eO9Vl.js';
-import { U as Usage, C as Context, J as JSONSchema, R as Request, b as Response, g as ContentBlock, n as TextBlock, T as Tool, P as Provider, o as RunOptions } from './context-JFOVvu6z.js';
-import { W as WireFamily, H as HookEvent, e as HookMatcher, I as InProcessHook, h as Config } from './config-FG6As4H5.js';
+import { P as PermissionPolicy } from './permission-B9SB45lp.js';
+import { U as Usage, C as Context, J as JSONSchema, R as Request, b as Response, g as ContentBlock, n as TextBlock, T as Tool, P as Provider, o as RunOptions } from './context-MRk5PhNv.js';
+import { W as WireFamily, H as HookEvent, e as HookMatcher, I as InProcessHook, h as Config } from './config-BMCj_XDs.js';
 
 /**
  * Single fleet-wide event with subagent attribution. Whatever a child
@@ -130,6 +130,23 @@ declare class FleetUsageAggregator {
 }
 
 type BudgetKind = 'tool_calls' | 'iterations' | 'tokens' | 'timeout' | 'idle_timeout' | 'cost';
+/**
+ * Fraction of the wall-clock `timeoutMs` window at which a PROACTIVE extension
+ * is negotiated — BEFORE the deadline is actually crossed. The coordinator
+ * watchdog (`executeWithTimeout`) arms at `timeoutMs * TIMEOUT_PREEMPT_FRACTION`
+ * so a still-progressing subagent gets its ceiling raised while it is below the
+ * limit, and never enters a "timed out" state. Reactive enforcement at the real
+ * deadline still stands for the no-progress / denied case. Shared so the asking
+ * side and any future caller agree on the same lead point.
+ */
+declare const TIMEOUT_PREEMPT_FRACTION = 0.85;
+/**
+ * Hard safety net for budget negotiation decisions. If no listener responds to
+ * `budget.threshold_reached` within this window the negotiation defaults to
+ * `'stop'`. Exported so the coordinator's watchdog can reuse the same ceiling
+ * without hardcoding a second copy.
+ */
+declare const DECISION_TIMEOUT_MS = 60000;
 declare class BudgetExceededError extends Error {
     readonly kind: BudgetKind;
     readonly limit: number;
@@ -215,7 +232,18 @@ type BudgetThresholdHandler = (info: {
     used: number;
     limit: number;
     requestDecision: () => Promise<BudgetThresholdDecision>;
-}) => 'throw' | 'continue' | Promise<BudgetThresholdDecision>;
+    /**
+     * Direct grant/deny hooks for SYNCHRONOUS policy or recording handlers that
+     * decide in-process without a wired `budget.threshold_reached` listener
+     * (e.g. the coordinator watchdog). `extend` patches the limits in place;
+     * `deny` records the intent to stop. Production listener-driven handlers use
+     * `requestDecision()` instead and can ignore these.
+     */
+    extend?: (extra: Partial<BudgetLimits>) => void;
+    deny?: () => void;
+}) => 'throw' | 'continue' | 'stop' | {
+    extend: Partial<BudgetLimits>;
+} | Promise<BudgetThresholdDecision>;
 /**
  * Per-subagent budget enforcement. Each subagent gets its own instance so a
  * runaway agent can't drain the cost ceiling of its siblings. All record/check
@@ -237,6 +265,12 @@ type BudgetThresholdHandler = (info: {
  */
 declare class SubagentBudget {
     readonly limits: Readonly<BudgetLimits>;
+    /** Patch one or more budget limits in-place after construction.
+     * Used by the coordinator watchdog when granting an extension.
+     * All fields are optional — only provided fields are updated.
+     * This is the single write path for limit mutations so that future
+     * validation or side-effects live in one place (M1). */
+    patchLimits(ext: Partial<BudgetLimits>): void;
     private iterations;
     private toolCalls;
     private tokenInput;
@@ -263,6 +297,32 @@ declare class SubagentBudget {
      * Used to emit `budget.threshold_reached` events in `'auto'` mode.
      */
     _events?: EventBus | undefined;
+    /**
+     * Guard against dual-path races between the coordinator watchdog
+     * (`executeWithTimeout`) and the budget's own `checkTimeout()`.
+     * Both paths detect `elapsed >= timeoutMs` and can emit
+     * `budget.threshold_reached` for kind `'timeout'` simultaneously.
+     * Set to the current `timeoutMs` ceiling by the coordinator BEFORE
+     * calling `onThreshold`, and cleared after the negotiation resolves.
+     * `checkTimeout()` skips its wall-clock check while this is set so
+     * the coordinator's watchdog is the sole source of wall-clock timeout
+     * events — `checkTimeout()` focuses exclusively on `idle_timeout`.
+     */
+    private _watchdogActive;
+    /** Returns the timeout ceiling currently being negotiated by the watchdog,
+     * or `undefined` when no wall-clock negotiation is in flight.
+     * Used by `executeWithTimeout` to detect a stale lock (M3). */
+    get watchdogActive(): number | undefined;
+    /** Called by the coordinator watchdog BEFORE calling `onThreshold` so that
+     * `checkTimeout()` skips its wall-clock check for this ceiling. Prevents
+     * the budget's own `checkTimeout()` from emitting a second
+     * `budget.threshold_reached` event while the watchdog is already
+     * negotiating the same wall-clock deadline (C1). */
+    setWatchdogNegotiation(timeoutMs: number): void;
+    /** Clears the watchdog guard after negotiation resolves. Called in the
+     * `finally` block of both the pre-empt and deadline branches so it fires
+     * on every exit path: grant, deny, throw, or error. */
+    clearWatchdogNegotiation(): void;
     /**
      * Negotiation mode — controls whether a threshold hit tries to emit
      * `budget.threshold_reached` and wait for a coordinator decision, or
@@ -320,6 +380,24 @@ declare class SubagentBudget {
      * Returns the kinds that were found to be exceeded (for logging/debugging).
      */
     private checkLimits;
+    /**
+     * Invoke `onThreshold` once for `entry` on the NO-LISTENER path and report
+     * whether it decided synchronously. Returns `true` when the handler returned
+     * a synchronous decision (already honored — an `extend` patched the limits),
+     * or `false` when it returned a Promise (async; the caller hard-stops, since
+     * there is no listener to resolve the negotiation). The handler is given the
+     * full info shape (`requestDecision` plus direct `extend`/`deny`) so both
+     * recording handlers and policy handlers work without a wired listener.
+     */
+    private _invokeHandlerSync;
+    /**
+     * Emit `budget.threshold_reached` and resolve to the listener's verdict.
+     * Resolves to `'stop'` immediately when there is no listener (or no bus) so
+     * no negotiation can hang and no fallback timer leaks. Mirrors the
+     * coordinator watchdog's own request path so both agree on the no-listener
+     * default.
+     */
+    private _busRequestDecision;
     /**
      * Per-kind in-flight negotiation Promises. Each budget kind can have its
      * own concurrent negotiation — e.g. iterations and timeout can both
@@ -415,6 +493,15 @@ interface SubagentConfig {
      * default reaper for delegated subagents (see `applyRosterBudget`).
      */
     idleTimeoutMs?: number | undefined;
+    /**
+     * Fraction of `timeoutMs` at which the proactive pre-empt fires (0.0–1.0).
+     * At this point the watchdog negotiates a ceiling extension while the
+     * agent is still under its limit, so a progressing agent gets its
+     * ceiling raised before ever entering a timed-out state.
+     * Defaults to `TIMEOUT_PREEMPT_FRACTION` (0.85). Lower values fire earlier;
+     * higher values fire closer to the deadline. Ignored when `timeoutMs` is unset.
+     */
+    preemptFraction?: number | undefined;
     tools?: string[] | undefined;
     /**
      * Tools to explicitly disable for this subagent. These tools will be
@@ -966,8 +1053,23 @@ interface Plugin {
      * defaultConfig: { ttl: 3600, maxSize: 100 }
      */
     defaultConfig?: Record<string, unknown>;
-    setup(api: PluginAPI): void | Promise<void>;
-    teardown?(api: PluginAPI): void | Promise<void>;
+    /**
+     * Called by the host to activate the plugin. Receives the `PluginAPI`
+     * and an optional `AbortSignal` the plugin should respect for
+     * cancellation and timeout. `setup` must complete before the plugin is
+     * considered loaded; if it times out the plugin is rejected.
+     */
+    setup(api: PluginAPI, opts?: {
+        signal?: AbortSignal | undefined;
+    }): void | Promise<void>;
+    /**
+     * Called by the host during unload. Receives the same `PluginAPI` instance
+     * the plugin saw during `setup` and an optional `AbortSignal`. Teardown
+     * is best-effort — a timeout does not prevent other plugins from unloading.
+     */
+    teardown?(api: PluginAPI, opts?: {
+        signal?: AbortSignal | undefined;
+    }): void | Promise<void>;
     /**
      * Optional health check. Called by the host (e.g. `/diag plugins` slash
      * command or health endpoint) to surface plugin status. Return
@@ -986,7 +1088,9 @@ declare class Agent {
     readonly events: EventBus;
     readonly pipelines: AgentPipelines;
     readonly ctx: Context;
-    readonly maxIterations: number;
+    /** Max agent-loop iterations per run. Mutable so the TUI `/settings` picker
+     *  can apply a new value to the live session (takes effect next run). */
+    maxIterations: number;
     readonly executionStrategy: 'parallel' | 'sequential' | 'smart';
     readonly perIterationOutputCapBytes: number;
     private readonly plugins;
@@ -1082,4 +1186,4 @@ interface AgentRunnerOptions {
  */
 declare function makeAgentSubagentRunner(opts: AgentRunnerOptions): SubagentRunner;
 
-export { type ProviderFactory as $, type AgentBridge as A, type BridgeTransport as B, type CoordinatorStatus as C, type DoneCondition as D, type SlashCommand as E, FleetBus as F, type PluginPipelines as G, type ToolRegistryView as H, type ProviderRegistryView as I, type MCPRegistryView as J, type SlashCommandRegistryView as K, type SessionWriterView as L, type MultiAgentCoordinator as M, type MetricsSinkView as N, type PluginCapabilities as O, type PluginAPI as P, type Plugin as Q, type CoordinatorEvents as R, type SubagentConfig as S, type TaskSpec as T, type PluginDependency as U, type SubagentContext as V, type SubagentError as W, type SubagentErrorKind as X, type SubagentRunContext as Y, type SubagentRunOutcome as Z, type TaskDelegation as _, type BridgeMessage as a, type AgentBridgeConfig as b, type MultiAgentConfig as c, type SubagentRunner as d, type SpawnResult as e, type TaskResult as f, Agent as g, type AgentFactory as h, type AgentFactoryResult as i, type AgentRunnerOptions as j, BudgetExceededError as k, type BudgetKind as l, type BudgetLimits as m, type BudgetNegotiationMode as n, type BudgetThresholdDecision as o, type BudgetThresholdHandler as p, BudgetThresholdSignal as q, type BudgetUsage as r, type FleetEvent as s, type FleetHandler as t, type FleetUsage as u, FleetUsageAggregator as v, SubagentBudget as w, type SubagentUsageSnapshot as x, makeAgentSubagentRunner as y, withDisabledToolFiltering as z };
+export { makeAgentSubagentRunner as $, type AgentBridge as A, type BridgeTransport as B, type CoordinatorStatus as C, type DoneCondition as D, type BudgetNegotiationMode as E, FleetBus as F, type BudgetThresholdDecision as G, type BudgetThresholdHandler as H, BudgetThresholdSignal as I, type BudgetUsage as J, type CoordinatorEvents as K, DECISION_TIMEOUT_MS as L, type MultiAgentCoordinator as M, type FleetEvent as N, type FleetHandler as O, type PluginAPI as P, SubagentBudget as Q, type SubagentContext as R, type SubagentConfig as S, type TaskSpec as T, type SubagentError as U, type SubagentErrorKind as V, type SubagentRunContext as W, type SubagentRunOutcome as X, type SubagentUsageSnapshot as Y, TIMEOUT_PREEMPT_FRACTION as Z, type TaskDelegation as _, type BridgeMessage as a, withDisabledToolFiltering as a0, type ProviderFactory as a1, type AgentBridgeConfig as b, type MultiAgentConfig as c, type SubagentRunner as d, type SpawnResult as e, type TaskResult as f, Agent as g, type AgentFactory as h, type FleetUsage as i, FleetUsageAggregator as j, type SlashCommand as k, type PluginPipelines as l, type ToolRegistryView as m, type ProviderRegistryView as n, type MCPRegistryView as o, type SlashCommandRegistryView as p, type SessionWriterView as q, type MetricsSinkView as r, type PluginCapabilities as s, type PluginDependency as t, type Plugin as u, type AgentFactoryResult as v, type AgentRunnerOptions as w, BudgetExceededError as x, type BudgetKind as y, type BudgetLimits as z };

package/dist/{brain-C2yDd7Lw.d.ts → brain-BXd_61kQ.d.ts}

@@ -1,4 +1,4 @@
-import { U as Usage, C as Context, j as ToolProgressEvent, T as Tool } from './context-JFOVvu6z.js';
+import { U as Usage, C as Context, j as ToolProgressEvent, T as Tool } from './context-MRk5PhNv.js';
 
 type MemoryScope = 'project-agents' | 'project-memory' | 'user-memory';
 type MemoryType = 'fact' | 'decision' | 'convention' | 'preference' | 'reference' | 'anti_pattern';
@@ -256,8 +256,16 @@ interface EventMap {
         id: string;
         event: ToolProgressEvent;
     };
+    /** Cache hit on session store load — used by observability layers. */
+    'storage.cache_hit': {
+        sessionId: string;
+        store: string;
+        filePath: string;
+        operation: string;
+        durationMs: number;
+    };
     /**
-     * Fired when a tool call needs user confirmation and no confirmHandler
+     * Fired when a tool call needs confirmation
      * is registered on the executor. The TUI renders a confirmation dialog
      * from this event. Resolution is driven by calling the resolve function
      * passed in the payload with a decision string ('yes' | 'no' | 'always' | 'deny').
@@ -801,6 +809,27 @@ interface EventMap {
         durationMs?: number;
         traceId?: string;
     };
+    /**
+     * Real-time client status event. Emitted by TUI/CLI/WebUI to report current
+     * session stats (tool calls, tokens, model, mode, cost). Broadcast immediately
+     * to all WebUI clients via setup-events.ts and written to status.json for
+     * external watchers.
+     */
+    'client.status': {
+        clientType: string;
+        clientId: string;
+        projectHash: string;
+        agentCount: number;
+        model: string;
+        mode: string;
+        toolCalls: number;
+        inputTokens: number;
+        outputTokens: number;
+        cacheTokens: number;
+        costUsd: number;
+        timestamp: number;
+        projectSlug: string;
+    };
     error: {
         err: Error;
         phase: string;
@@ -1057,4 +1086,4 @@ declare class DefaultBrainArbiter implements BrainArbiter {
 }
 declare function formatHumanPrompt(request: BrainDecisionRequest): string;
 
-export { type BrainArbiter as B, DefaultBrainArbiter as D, EventBus as E, HumanEscalatingBrainArbiter as H, type Listener as L, type MemoryScope as M, ObservableBrainArbiter as O, type ScoredEntry as S, type EventName as a, type BrainDecision as b, type BrainDecisionOption as c, BrainDecisionQueue as d, type BrainDecisionRequest as e, type BrainDecisionSource as f, type BrainFallback as g, type BrainRisk as h, type DefaultBrainArbiterOptions as i, formatHumanPrompt as j, type MemoryEntry as k, type MemoryStore as l, type MemoryRelevanceContext as m, type EventLogger as n, type EventMap as o, MEMORY_TYPE_LABELS as p, type MemoryClearedPayload as q, type MemoryConsolidatedPayload as r, type MemoryForgottenPayload as s, type MemoryPriority as t, type MemoryRememberedPayload as u, type MemoryType as v, ScopedEventBus as w };
+export { type BrainArbiter as B, DefaultBrainArbiter as D, EventBus as E, HumanEscalatingBrainArbiter as H, type Listener as L, type MemoryScope as M, ObservableBrainArbiter as O, type ScoredEntry as S, type EventName as a, type MemoryEntry as b, type MemoryStore as c, type MemoryRelevanceContext as d, type BrainDecision as e, type BrainDecisionOption as f, BrainDecisionQueue as g, type BrainDecisionRequest as h, type BrainDecisionSource as i, type BrainFallback as j, type BrainRisk as k, type DefaultBrainArbiterOptions as l, type EventLogger as m, type EventMap as n, MEMORY_TYPE_LABELS as o, type MemoryClearedPayload as p, type MemoryConsolidatedPayload as q, type MemoryForgottenPayload as r, type MemoryPriority as s, type MemoryRememberedPayload as t, type MemoryType as u, ScopedEventBus as v, formatHumanPrompt as w };

package/dist/{compactor-t0R_AIt_.d.ts → compactor-B8pOf45Y.d.ts}

@@ -1,4 +1,4 @@
-import { C as Context } from './context-JFOVvu6z.js';
+import { C as Context } from './context-MRk5PhNv.js';
 
 interface CompactRepairReport {
     removedToolUses: string[];

package/dist/{config-FG6As4H5.d.ts → config-BMCj_XDs.d.ts}

@@ -1,4 +1,4 @@
-import { k as Capabilities, f as Permission } from './context-JFOVvu6z.js';
+import { k as Capabilities, f as Permission } from './context-MRk5PhNv.js';
 
 type ContextWindowModeId = 'balanced' | 'frugal' | 'deep' | 'archival';
 type ContextWindowAggressiveOn = 'hard' | 'soft' | 'warn';
@@ -224,6 +224,25 @@ interface ModelsRegistry {
     ageSeconds(): Promise<number>;
 }
 
+/**
+ * Token-saving mode tier levels. Controls how aggressively the system prompt
+ * is compacted to reduce per-request token consumption.
+ *
+ * - 'off'        — Full prompt, all tools, complete guidance (no reduction)
+ * - 'minimal'    — TIER1 tools only (~10), stripped guidance (~3-4k tokens saved)
+ * - 'light'     — Core + memory tools (~14), common patterns, minimal guidance
+ * - 'medium'    — Most development tools (~24), some guidance (default when `true`)
+ * - 'aggressive' — Maximum savings before tools become unusable (~4-5k tokens saved)
+ */
+type TokenSavingTier = 'off' | 'minimal' | 'light' | 'medium' | 'aggressive';
+/**
+ * Normalize a TokenSavingTier value, handling backward-compatible boolean inputs.
+ * - `true`  → 'medium' (existing behavior)
+ * - `false` → 'off'
+ * - string values are returned as-is after validation
+ * - `undefined` → 'off'
+ */
+declare function normalizeTokenSavingTier(val?: TokenSavingTier | boolean): TokenSavingTier;
 interface ContextConfig {
     /** Context-window policy mode. Controls compaction thresholds and preservation depth. */
     mode?: ContextWindowModeId | undefined;
@@ -252,6 +271,30 @@ interface ContextConfig {
     /** Enable LLM-driven selective compaction (default: false for backward compat). */
     llmSelector?: boolean | undefined;
 }
+/**
+ * Runtime configuration for the process circuit breaker (the one owned by the
+ * ProcessRegistry that gates `bash`/`exec`). Toggle via `/settings breaker`.
+ *
+ * The breaker itself is a low-level primitive (`packages/tools/.../circuit-breaker.ts`)
+ * that is on by default; this section controls whether the registry actually
+ * participates in it and how it auto-recovers.
+ */
+interface CircuitBreakerRuntimeConfig {
+    /**
+     * Enable circuit-breaker protection. When false (the default), the breaker
+     * is bypassed — `bash`/`exec` calls always proceed regardless of failure
+     * history. When true, the breaker trips on repeated failures / slow calls /
+     * bursts and blocks further calls until it recovers.
+     */
+    enabled?: boolean | undefined;
+    /**
+     * When the breaker trips, automatically kill all tracked processes AND
+     * reset the breaker to closed after this delay (ms). 0 = disabled (manual
+     * recovery only via `/kill reset`). Only effective when `enabled` is true.
+     * While armed, the statusline shows a live countdown to the kill/reset.
+     */
+    autoKillResetMs?: number | undefined;
+}
 interface ToolsConfig {
     defaultExecutionStrategy: 'parallel' | 'sequential' | 'smart';
     maxIterations: number;
@@ -263,6 +306,14 @@ interface ToolsConfig {
      * limit by 100 when hit. Set to false to require user confirmation.
      */
     autoExtendLimit?: boolean | undefined;
+    /**
+     * When true, file tools (read/write/edit/grep/glob/install) are confined to
+     * the project root and `set_working_dir` may not leave it. Default: false —
+     * tools may access paths outside the project root, still subject to each
+     * tool's permission tier (writes/edits prompt for confirmation). Toggle via
+     * `/settings` ("Filesystem access").
+     */
+    restrictToProjectRoot?: boolean | undefined;
 }
 interface ProviderApiKey {
     /** Short human-readable label (e.g. "personal", "work", "rate-limit-backup"). */
@@ -278,10 +329,12 @@ interface ProviderApiKey {
 interface ProviderConfig {
     type: string;
     /**
-     * Legacy single-key field. Still honored as a fallback when `apiKeys`
-     * is empty. When `apiKeys`/`activeKey` are present, the config loader
-     * mirrors the active entry into this field so downstream consumers
-     * (provider construction, wire adapters) need no changes.
+     * Legacy single-key field. Still honored as a read fallback when `apiKeys`
+     * is empty (for configs not yet migrated to multi-key format). After key
+     * management operations (`writeKeysBack`), this field is **cleared** to
+     * prevent accidental serialization of the plaintext key. Consumers that
+     * need the active API key should use `resolveActiveApiKey()` (cli) or
+     * resolve from `apiKeys[]` directly — never read `cfg.apiKey` in new code.
      */
     apiKey?: string | undefined;
     /** Multiple keys for the same provider — pick one with `activeKey`. */
@@ -375,13 +428,29 @@ interface FeaturesConfig {
     /** Discover + load skills from disk. */
     skills: boolean;
     /**
-     * Token-saving mode: when enabled, non-essential tools are omitted,
-     * skill descriptions are trimmed, and the system prompt is shortened
-     * to reduce per-request token consumption without compromising core
-     * functionality. Enable with `--token-saving-mode` or
-     * `features.tokenSavingMode: true` in config.
+     * Token-saving mode tier. Controls how aggressively the system prompt
+     * is compacted to reduce per-request token consumption.
+     *
+     * - 'off'        — Full prompt, all tools, complete guidance
+     * - 'minimal'    — TIER1 tools only, stripped guidance (~3-4k tokens saved)
+     * - 'light'     — Core + memory tools, common patterns, minimal guidance
+     * - 'medium'    — Most development tools, some guidance
+     * - 'aggressive' — Maximum savings before tools become unusable (~4-5k tokens)
+     *
+     * Boolean values are accepted for backward compatibility:
+     * - `true`  → 'medium'
+     * - `false` → 'off'
+     *
+     * Enable via CLI: `--token-saving-tier <level>` or `--token-saving-mode` (maps to 'medium').
+     * Configure via: `features.tokenSavingMode: "minimal"` in config.
+     */
+    tokenSavingMode?: TokenSavingTier | boolean | undefined;
+    /**
+     * Allow tools to read/write paths outside the project root directory.
+     * When true (default), tools can access any path on the filesystem.
+     * When false, tools are restricted to the project root directory.
      */
-    tokenSavingMode?: boolean | undefined;
+    allowOutsideProjectRoot?: boolean | undefined;
 }
 interface AutonomyConfig {
     /** ms to wait before auto-proceeding in 'auto' mode. Default: 45000. */
@@ -557,6 +626,11 @@ interface Config {
     configScope?: 'global' | 'project' | undefined;
     /** Automatic codebase symbol-index maintenance (session-start + live updates). */
     indexing?: IndexingConfig | undefined;
+    /**
+     * Process circuit-breaker protection (gates `bash`/`exec` on repeated
+     * failures). Default off — toggle with `/settings breaker on|off`.
+     */
+    circuitBreaker?: CircuitBreakerRuntimeConfig | undefined;
     /** Saved launch preferences — restored on next boot for one-line confirmation. */
     launch?: LaunchConfig | undefined;
     /**
@@ -625,4 +699,4 @@ interface ConfigStore {
     watch(cb: (next: Readonly<Config>, prev: Readonly<Config>) => void): () => void;
 }
 
-export { type AutonomyConfig as A, type SessionLoggingConfig as B, type ContextWindowAggressiveOn as C, DEFAULT_CONTEXT_WINDOW_MODE_ID as D, type SyncCategory as E, type FeaturesConfig as F, formatContextWindowModeList as G, type HookEvent as H, type InProcessHook as I, getContextWindowMode as J, isContextWindowModeId as K, type LaunchConfig as L, type ModelsRegistry as M, listContextWindowModes as N, resolveContextWindowPolicy as O, type ProviderConfig as P, type ResolvedProvider as R, type ShellHook as S, type ToolsConfig as T, type WireFamily as W, type ModelsDevPayload as a, type ResolvedModel as b, type MCPServerConfig as c, type ModelMatrixEntry as d, type HookMatcher as e, type HookEntry as f, type ContextWindowPolicy as g, type Config as h, type ConfigStore as i, type ConfigLoader as j, type SyncConfig as k, type HookInput as l, type HookOutcome as m, CONTEXT_WINDOW_MODES as n, type ContextConfig as o, type ContextWindowConfigLike as p, type ContextWindowMode as q, type ContextWindowModeId as r, type ContextWindowThresholds as s, type CustomModelDefinition as t, type IndexingConfig as u, type LogConfig as v, type ModelsDevModel as w, type ModelsDevProvider as x, type PluginConfig as y, type ProviderApiKey as z };
+export { type AutonomyConfig as A, type ProviderApiKey as B, type ContextWindowAggressiveOn as C, DEFAULT_CONTEXT_WINDOW_MODE_ID as D, type SessionLoggingConfig as E, type FeaturesConfig as F, type SyncCategory as G, type HookEvent as H, type InProcessHook as I, type ToolsConfig as J, formatContextWindowModeList as K, type LaunchConfig as L, type ModelsRegistry as M, getContextWindowMode as N, isContextWindowModeId as O, type ProviderConfig as P, listContextWindowModes as Q, type ResolvedProvider as R, type ShellHook as S, type TokenSavingTier as T, normalizeTokenSavingTier as U, resolveContextWindowPolicy as V, type WireFamily as W, type ModelsDevPayload as a, type ResolvedModel as b, type MCPServerConfig as c, type ModelMatrixEntry as d, type HookMatcher as e, type HookEntry as f, type ContextWindowPolicy as g, type Config as h, type ConfigStore as i, type ConfigLoader as j, type SyncConfig as k, type HookInput as l, type HookOutcome as m, CONTEXT_WINDOW_MODES as n, type CircuitBreakerRuntimeConfig as o, type ContextConfig as p, type ContextWindowConfigLike as q, type ContextWindowMode as r, type ContextWindowModeId as s, type ContextWindowThresholds as t, type CustomModelDefinition as u, type IndexingConfig as v, type LogConfig as w, type ModelsDevModel as x, type ModelsDevProvider as y, type PluginConfig as z };

package/dist/{context-JFOVvu6z.d.ts → context-MRk5PhNv.d.ts}

@@ -309,6 +309,11 @@ type Permission = 'auto' | 'confirm' | 'deny';
  * - `destructive` — irreversible or broadside effects (recursive deletes, db drops, etc.)
  */
 type RiskTier = 'safe' | 'standard' | 'destructive';
+/**
+ * Icon identifiers for tools — each UI (WebUI/TUI/REPL) maps these to its own icon library.
+ * Add the icon directly on each Tool so all UIs consume the same canonical value.
+ */
+type ToolIconId = 'file' | 'edit' | 'search' | 'folder' | 'terminal' | 'web' | 'git' | 'tree' | 'code' | 'test' | 'package' | 'document' | 'scaffold' | 'todo' | 'plan' | 'task' | 'meta' | 'index' | 'json' | 'diff' | 'logs' | 'settings' | 'fallback';
 interface JSONSchema {
     type?: string | undefined;
     properties?: Record<string, JSONSchema>;
@@ -405,6 +410,12 @@ interface Tool<I = unknown, O = unknown> {
      * treated conservatively by guards.
      */
     capabilities?: readonly string[] | undefined;
+    /**
+     * Icon identifier for this tool — consumed by all UIs (WebUI/TUI/REPL) to
+     * render a tool-specific icon instead of a generic fallback.
+     * Each UI maps this id to its own icon library.
+     */
+    icon?: ToolIconId | undefined;
     execute(input: I, ctx: Context, opts: {
         signal: AbortSignal;
     }): Promise<O>;
@@ -1285,6 +1296,13 @@ interface ContextInit {
     projectRoot: string;
     /** Mutable working directory. Defaults to `cwd`. Must stay within `projectRoot`. */
     workingDir?: string | undefined;
+    /**
+     * When false, file tools and `setWorkingDir()` are confined to `projectRoot`.
+     * Defaults to `false` (restrictive) when omitted so directly-constructed
+     * contexts (tests, embedded callers) keep the safe behavior; the runtime
+     * passes the config-derived value (default `true` — permissive) explicitly.
+     */
+    allowOutsideProjectRoot?: boolean | undefined;
     model: string;
     tools?: Tool[] | undefined;
     /** Agent id performing this run (e.g. 'leader', 'executor', 'tech-stack'). */
@@ -1331,6 +1349,13 @@ declare class Context implements RunEnv {
     projectRoot: string;
     /** Mutable working directory — starts as `cwd`. Change via `setWorkingDir()`. */
     workingDir: string;
+    /**
+     * When true, file tools (via `_util.ts`) and `setWorkingDir()` reject paths
+     * outside `projectRoot`. When false, those boundary checks are bypassed so
+     * tools may reach paths outside the project (still gated by permission
+     * tiers). Mutable so `/settings` can toggle it live on the running session.
+     */
+    allowOutsideProjectRoot: boolean;
     model: string;
     tools: Tool[];
     meta: Record<string, unknown>;
@@ -1414,4 +1439,4 @@ declare class Context implements RunEnv {
     usage(): Usage;
 }
 
-export { ToolError as $, AgentError as A, type MessageRole as B, Context as C, PluginError as D, ERROR_CODES as E, type FileSnapshot as F, type ProviderErrorBody as G, type ReadonlyConversationState as H, type ImageBlock as I, type JSONSchema as J, type RiskTier as K, type RunEnv as L, type Message as M, SddError as N, SessionError as O, type Provider as P, type StateChange as Q, type Request as R, type SessionEvent as S, type Tool as T, type Usage as U, type StateChangeHandler as V, type StopReason as W, type StreamEvent as X, StreamHangError as Y, type ThinkingBlock as Z, type ToolCallContext as _, type SessionWriter as a, type ToolFinalEvent as a0, type ToolStreamEvent as a1, WrongStackError as a2, asBlocks as a3, asText as a4, extractRunEnv as a5, isAgentError as a6, isConfigError as a7, isFsError as a8, isImageBlock as a9, isPluginError as aa, isSddError as ab, isSessionError as ac, isTextBlock as ad, isThinkingBlock as ae, isToolError as af, isToolResultBlock as ag, isToolUseBlock as ah, isWrongStackError as ai, toWrongStackError as aj, wrapAsState as ak, type Response as b, type TokenCounter as c, type CacheStats as d, ProviderError as e, type Permission as f, type ContentBlock as g, type SessionMetadata as h, type SessionStore as i, type ToolProgressEvent as j, type Capabilities as k, type ToolUseBlock as l, type ToolResultBlock as m, type TextBlock as n, type RunOptions as o, type ResumedSession as p, type SessionData as q, type SessionSummary as r, type TodoItem as s, ConversationState as t, ConfigError as u, type ContextInit as v, type ErrorCode as w, type ErrorSeverity as x, type ErrorSubsystem as y, FsError as z };
+export { ToolError as $, AgentError as A, type MessageRole as B, Context as C, PluginError as D, ERROR_CODES as E, type FileSnapshot as F, type ProviderErrorBody as G, type ReadonlyConversationState as H, type ImageBlock as I, type JSONSchema as J, type RiskTier as K, type RunEnv as L, type Message as M, SddError as N, SessionError as O, type Provider as P, type StateChange as Q, type Request as R, type SessionEvent as S, type Tool as T, type Usage as U, type StateChangeHandler as V, type StopReason as W, type StreamEvent as X, StreamHangError as Y, type ThinkingBlock as Z, type ToolCallContext as _, type SessionWriter as a, type ToolFinalEvent as a0, type ToolIconId as a1, type ToolStreamEvent as a2, WrongStackError as a3, asBlocks as a4, asText as a5, extractRunEnv as a6, isAgentError as a7, isConfigError as a8, isFsError as a9, isImageBlock as aa, isPluginError as ab, isSddError as ac, isSessionError as ad, isTextBlock as ae, isThinkingBlock as af, isToolError as ag, isToolResultBlock as ah, isToolUseBlock as ai, isWrongStackError as aj, toWrongStackError as ak, wrapAsState as al, type Response as b, type TokenCounter as c, type CacheStats as d, ProviderError as e, type Permission as f, type ContentBlock as g, type SessionMetadata as h, type SessionStore as i, type ToolProgressEvent as j, type Capabilities as k, type ToolUseBlock as l, type ToolResultBlock as m, type TextBlock as n, type RunOptions as o, type ResumedSession as p, type SessionData as q, type SessionSummary as r, type TodoItem as s, ConversationState as t, ConfigError as u, type ContextInit as v, type ErrorCode as w, type ErrorSeverity as x, type ErrorSubsystem as y, FsError as z };