@wrongstack/core 0.264.0 → 0.267.0

package/dist/{agent-bridge-D8sa1vtv.d.ts → agent-bridge-STJ3JwwK.d.ts}

@@ -1,4 +1,4 @@
-import { B as BridgeTransport, a as BridgeMessage, A as AgentBridge, b as AgentBridgeConfig } from './agent-subagent-runner-c9DLkaas.js';
+import { B as BridgeTransport, a as BridgeMessage, A as AgentBridge, b as AgentBridgeConfig } from './agent-subagent-runner-CzPGP3jA.js';
 
 /**
  * In-memory pub/sub transport for agent-to-agent messaging.

package/dist/{agent-subagent-runner-c9DLkaas.d.ts → agent-subagent-runner-CzPGP3jA.d.ts}

@@ -1,12 +1,12 @@
-import { c as ToolCallPipelinePayload, d as ToolWrapper, E as ExtensionRegistry, S as SystemPromptContributor, e as ToolRegistry, P as ProviderRegistry, A as AgentPipelines, f as ToolExecutorLike, g as AgentInit, h as AgentInput, R as RunResult } from './index-CbLSI66_.js';
-import { C as Container, R as ReadonlyPipeline, a as Renderer } from './pipeline-CXCeMz8J.js';
-import { E as EventBus, a as EventName, L as Listener } from './brain-O1IdKPaK.js';
-import { R as RetryPolicy, E as ErrorHandler } from './retry-policy-CFhdtRzz.js';
+import { c as ToolCallPipelinePayload, d as ToolWrapper, E as ExtensionRegistry, S as SystemPromptContributor, e as ToolRegistry, P as ProviderRegistry, A as AgentPipelines, f as ToolExecutorLike, g as AgentInit, h as AgentInput, R as RunResult } from './index-Bms0m4oy.js';
+import { C as Container, R as ReadonlyPipeline, a as Renderer } from './pipeline-BfD2k1rT.js';
+import { E as EventBus, a as EventName, L as Listener } from './brain-Cdg77tVN.js';
+import { R as RetryPolicy, E as ErrorHandler } from './retry-policy-BilV1ujH.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { T as Tracer } from './observability-D-HZN_mF.js';
-import { P as PermissionPolicy } from './permission-4yvGmMRB.js';
-import { U as Usage, C as Context, J as JSONSchema, R as Request, b as Response, g as ContentBlock, n as TextBlock, T as Tool, P as Provider, o as RunOptions } from './context-BGSpZNSE.js';
-import { W as WireFamily, H as HookEvent, e as HookMatcher, I as InProcessHook, h as Config } from './config-Dz2F3H2K.js';
+import { P as PermissionPolicy } from './permission-B75JAi3-.js';
+import { U as Usage, C as Context, J as JSONSchema, R as Request, b as Response, g as ContentBlock, o as TextBlock, T as Tool, P as Provider, p as RunOptions } from './context-dT5Ueund.js';
+import { W as WireFamily, H as HookEvent, f as HookMatcher, I as InProcessHook, i as Config } from './config-Du3pYYln.js';
 
 /**
  * Single fleet-wide event with subagent attribution. Whatever a child
@@ -130,6 +130,23 @@ declare class FleetUsageAggregator {
 }
 
 type BudgetKind = 'tool_calls' | 'iterations' | 'tokens' | 'timeout' | 'idle_timeout' | 'cost';
+/**
+ * Fraction of the wall-clock `timeoutMs` window at which a PROACTIVE extension
+ * is negotiated — BEFORE the deadline is actually crossed. The coordinator
+ * watchdog (`executeWithTimeout`) arms at `timeoutMs * TIMEOUT_PREEMPT_FRACTION`
+ * so a still-progressing subagent gets its ceiling raised while it is below the
+ * limit, and never enters a "timed out" state. Reactive enforcement at the real
+ * deadline still stands for the no-progress / denied case. Shared so the asking
+ * side and any future caller agree on the same lead point.
+ */
+declare const TIMEOUT_PREEMPT_FRACTION = 0.85;
+/**
+ * Hard safety net for budget negotiation decisions. If no listener responds to
+ * `budget.threshold_reached` within this window the negotiation defaults to
+ * `'stop'`. Exported so the coordinator's watchdog can reuse the same ceiling
+ * without hardcoding a second copy.
+ */
+declare const DECISION_TIMEOUT_MS = 60000;
 declare class BudgetExceededError extends Error {
     readonly kind: BudgetKind;
     readonly limit: number;
@@ -215,7 +232,18 @@ type BudgetThresholdHandler = (info: {
     used: number;
     limit: number;
     requestDecision: () => Promise<BudgetThresholdDecision>;
-}) => 'throw' | 'continue' | Promise<BudgetThresholdDecision>;
+    /**
+     * Direct grant/deny hooks for SYNCHRONOUS policy or recording handlers that
+     * decide in-process without a wired `budget.threshold_reached` listener
+     * (e.g. the coordinator watchdog). `extend` patches the limits in place;
+     * `deny` records the intent to stop. Production listener-driven handlers use
+     * `requestDecision()` instead and can ignore these.
+     */
+    extend?: (extra: Partial<BudgetLimits>) => void;
+    deny?: () => void;
+}) => 'throw' | 'continue' | 'stop' | {
+    extend: Partial<BudgetLimits>;
+} | Promise<BudgetThresholdDecision>;
 /**
  * Per-subagent budget enforcement. Each subagent gets its own instance so a
  * runaway agent can't drain the cost ceiling of its siblings. All record/check
@@ -237,6 +265,12 @@ type BudgetThresholdHandler = (info: {
  */
 declare class SubagentBudget {
     readonly limits: Readonly<BudgetLimits>;
+    /** Patch one or more budget limits in-place after construction.
+     * Used by the coordinator watchdog when granting an extension.
+     * All fields are optional — only provided fields are updated.
+     * This is the single write path for limit mutations so that future
+     * validation or side-effects live in one place (M1). */
+    patchLimits(ext: Partial<BudgetLimits>): void;
     private iterations;
     private toolCalls;
     private tokenInput;
@@ -263,6 +297,32 @@ declare class SubagentBudget {
      * Used to emit `budget.threshold_reached` events in `'auto'` mode.
      */
     _events?: EventBus | undefined;
+    /**
+     * Guard against dual-path races between the coordinator watchdog
+     * (`executeWithTimeout`) and the budget's own `checkTimeout()`.
+     * Both paths detect `elapsed >= timeoutMs` and can emit
+     * `budget.threshold_reached` for kind `'timeout'` simultaneously.
+     * Set to the current `timeoutMs` ceiling by the coordinator BEFORE
+     * calling `onThreshold`, and cleared after the negotiation resolves.
+     * `checkTimeout()` skips its wall-clock check while this is set so
+     * the coordinator's watchdog is the sole source of wall-clock timeout
+     * events — `checkTimeout()` focuses exclusively on `idle_timeout`.
+     */
+    private _watchdogActive;
+    /** Returns the timeout ceiling currently being negotiated by the watchdog,
+     * or `undefined` when no wall-clock negotiation is in flight.
+     * Used by `executeWithTimeout` to detect a stale lock (M3). */
+    get watchdogActive(): number | undefined;
+    /** Called by the coordinator watchdog BEFORE calling `onThreshold` so that
+     * `checkTimeout()` skips its wall-clock check for this ceiling. Prevents
+     * the budget's own `checkTimeout()` from emitting a second
+     * `budget.threshold_reached` event while the watchdog is already
+     * negotiating the same wall-clock deadline (C1). */
+    setWatchdogNegotiation(timeoutMs: number): void;
+    /** Clears the watchdog guard after negotiation resolves. Called in the
+     * `finally` block of both the pre-empt and deadline branches so it fires
+     * on every exit path: grant, deny, throw, or error. */
+    clearWatchdogNegotiation(): void;
     /**
      * Negotiation mode — controls whether a threshold hit tries to emit
      * `budget.threshold_reached` and wait for a coordinator decision, or
@@ -320,6 +380,24 @@ declare class SubagentBudget {
      * Returns the kinds that were found to be exceeded (for logging/debugging).
      */
     private checkLimits;
+    /**
+     * Invoke `onThreshold` once for `entry` on the NO-LISTENER path and report
+     * whether it decided synchronously. Returns `true` when the handler returned
+     * a synchronous decision (already honored — an `extend` patched the limits),
+     * or `false` when it returned a Promise (async; the caller hard-stops, since
+     * there is no listener to resolve the negotiation). The handler is given the
+     * full info shape (`requestDecision` plus direct `extend`/`deny`) so both
+     * recording handlers and policy handlers work without a wired listener.
+     */
+    private _invokeHandlerSync;
+    /**
+     * Emit `budget.threshold_reached` and resolve to the listener's verdict.
+     * Resolves to `'stop'` immediately when there is no listener (or no bus) so
+     * no negotiation can hang and no fallback timer leaks. Mirrors the
+     * coordinator watchdog's own request path so both agree on the no-listener
+     * default.
+     */
+    private _busRequestDecision;
     /**
      * Per-kind in-flight negotiation Promises. Each budget kind can have its
      * own concurrent negotiation — e.g. iterations and timeout can both
@@ -415,6 +493,15 @@ interface SubagentConfig {
      * default reaper for delegated subagents (see `applyRosterBudget`).
      */
     idleTimeoutMs?: number | undefined;
+    /**
+     * Fraction of `timeoutMs` at which the proactive pre-empt fires (0.0–1.0).
+     * At this point the watchdog negotiates a ceiling extension while the
+     * agent is still under its limit, so a progressing agent gets its
+     * ceiling raised before ever entering a timed-out state.
+     * Defaults to `TIMEOUT_PREEMPT_FRACTION` (0.85). Lower values fire earlier;
+     * higher values fire closer to the deadline. Ignored when `timeoutMs` is unset.
+     */
+    preemptFraction?: number | undefined;
     tools?: string[] | undefined;
     /**
      * Tools to explicitly disable for this subagent. These tools will be
@@ -423,6 +510,17 @@ interface SubagentConfig {
      * fully enforce (e.g., preventing delegation by removing the delegate tool).
      */
     disabledTools?: string[] | undefined;
+    /**
+     * Capability allowlist for this subagent's `AutoApprovePermissionPolicy`.
+     * Subagents run non-interactively, so the policy auto-approves only tools
+     * whose declared capabilities intersect this list; everything else is
+     * denied by the subagent guard. Defaults (when omitted) to the read-only
+     * safe set `['fs.read', 'net.outbound']`. Widen it per-spawn when a task
+     * legitimately needs more — e.g. `/techstack` adds `'fs.write'` so the
+     * subagent can write its report. Never grant `shell.*` unless the task
+     * truly requires arbitrary command execution.
+     */
+    allowedCapabilities?: readonly string[] | undefined;
     model?: string | undefined;
     priority?: number | undefined;
     /**
@@ -732,6 +830,13 @@ interface SlashCommand {
      * If absent, `/help <name>` falls back to `description`.
      */
     help?: string | undefined;
+    /**
+     * When true, this command does not appear in the slash-picker list
+     * triggered by typing `/` alone. It is still dispatchable and
+     * searchable when the user types a matching prefix (e.g. `/f`).
+     * Defaults to false.
+     */
+    hidden?: boolean | undefined;
     /**
      * Execute the command.
      * @param args Everything after the command name (trimmed by dispatch).
@@ -966,8 +1071,23 @@ interface Plugin {
      * defaultConfig: { ttl: 3600, maxSize: 100 }
      */
     defaultConfig?: Record<string, unknown>;
-    setup(api: PluginAPI): void | Promise<void>;
-    teardown?(api: PluginAPI): void | Promise<void>;
+    /**
+     * Called by the host to activate the plugin. Receives the `PluginAPI`
+     * and an optional `AbortSignal` the plugin should respect for
+     * cancellation and timeout. `setup` must complete before the plugin is
+     * considered loaded; if it times out the plugin is rejected.
+     */
+    setup(api: PluginAPI, opts?: {
+        signal?: AbortSignal | undefined;
+    }): void | Promise<void>;
+    /**
+     * Called by the host during unload. Receives the same `PluginAPI` instance
+     * the plugin saw during `setup` and an optional `AbortSignal`. Teardown
+     * is best-effort — a timeout does not prevent other plugins from unloading.
+     */
+    teardown?(api: PluginAPI, opts?: {
+        signal?: AbortSignal | undefined;
+    }): void | Promise<void>;
     /**
      * Optional health check. Called by the host (e.g. `/diag plugins` slash
      * command or health endpoint) to surface plugin status. Return
@@ -1084,4 +1204,4 @@ interface AgentRunnerOptions {
  */
 declare function makeAgentSubagentRunner(opts: AgentRunnerOptions): SubagentRunner;
 
-export { type ProviderFactory as $, type AgentBridge as A, type BridgeTransport as B, type CoordinatorStatus as C, type DoneCondition as D, type BudgetThresholdDecision as E, FleetBus as F, type BudgetThresholdHandler as G, BudgetThresholdSignal as H, type BudgetUsage as I, type CoordinatorEvents as J, type FleetEvent as K, type FleetHandler as L, type MultiAgentCoordinator as M, type PluginDependency as N, SubagentBudget as O, type PluginAPI as P, type SubagentContext as Q, type SubagentError as R, type SubagentConfig as S, type TaskSpec as T, type SubagentErrorKind as U, type SubagentRunContext as V, type SubagentRunOutcome as W, type SubagentUsageSnapshot as X, type TaskDelegation as Y, makeAgentSubagentRunner as Z, withDisabledToolFiltering as _, type BridgeMessage as a, type AgentBridgeConfig as b, type MultiAgentConfig as c, type SubagentRunner as d, type SpawnResult as e, type TaskResult as f, Agent as g, type AgentFactory as h, type FleetUsage as i, FleetUsageAggregator as j, type SlashCommand as k, type PluginPipelines as l, type ToolRegistryView as m, type ProviderRegistryView as n, type MCPRegistryView as o, type SlashCommandRegistryView as p, type SessionWriterView as q, type MetricsSinkView as r, type PluginCapabilities as s, type Plugin as t, type AgentFactoryResult as u, type AgentRunnerOptions as v, BudgetExceededError as w, type BudgetKind as x, type BudgetLimits as y, type BudgetNegotiationMode as z };
+export { makeAgentSubagentRunner as $, type AgentBridge as A, type BridgeTransport as B, type CoordinatorStatus as C, type DoneCondition as D, type BudgetNegotiationMode as E, FleetBus as F, type BudgetThresholdDecision as G, type BudgetThresholdHandler as H, BudgetThresholdSignal as I, type BudgetUsage as J, type CoordinatorEvents as K, DECISION_TIMEOUT_MS as L, type MultiAgentCoordinator as M, type FleetEvent as N, type FleetHandler as O, type PluginAPI as P, SubagentBudget as Q, type SubagentContext as R, type SubagentConfig as S, type TaskSpec as T, type SubagentError as U, type SubagentErrorKind as V, type SubagentRunContext as W, type SubagentRunOutcome as X, type SubagentUsageSnapshot as Y, TIMEOUT_PREEMPT_FRACTION as Z, type TaskDelegation as _, type BridgeMessage as a, withDisabledToolFiltering as a0, type ProviderFactory as a1, type AgentBridgeConfig as b, type MultiAgentConfig as c, type SubagentRunner as d, type SpawnResult as e, type TaskResult as f, Agent as g, type AgentFactory as h, type FleetUsage as i, FleetUsageAggregator as j, type SlashCommand as k, type PluginPipelines as l, type ToolRegistryView as m, type ProviderRegistryView as n, type MCPRegistryView as o, type SlashCommandRegistryView as p, type SessionWriterView as q, type MetricsSinkView as r, type PluginCapabilities as s, type PluginDependency as t, type Plugin as u, type AgentFactoryResult as v, type AgentRunnerOptions as w, BudgetExceededError as x, type BudgetKind as y, type BudgetLimits as z };

package/dist/{brain-O1IdKPaK.d.ts → brain-Cdg77tVN.d.ts}

@@ -1,4 +1,4 @@
-import { U as Usage, C as Context, j as ToolProgressEvent, T as Tool } from './context-BGSpZNSE.js';
+import { U as Usage, C as Context, j as ToolProgressEvent, T as Tool, k as ToolOutputMetadata } from './context-dT5Ueund.js';
 
 type MemoryScope = 'project-agents' | 'project-memory' | 'user-memory';
 type MemoryType = 'fact' | 'decision' | 'convention' | 'preference' | 'reference' | 'anti_pattern';
@@ -256,8 +256,16 @@ interface EventMap {
         id: string;
         event: ToolProgressEvent;
     };
+    /** Cache hit on session store load — used by observability layers. */
+    'storage.cache_hit': {
+        sessionId: string;
+        store: string;
+        filePath: string;
+        operation: string;
+        durationMs: number;
+    };
     /**
-     * Fired when a tool call needs user confirmation and no confirmHandler
+     * Fired when a tool call needs confirmation
      * is registered on the executor. The TUI renders a confirmation dialog
      * from this event. Resolution is driven by calling the resolve function
      * passed in the payload with a decision string ('yes' | 'no' | 'always' | 'deny').
@@ -279,6 +287,43 @@ interface EventMap {
         pattern: string;
         decision: 'always' | 'deny';
     };
+    /**
+     * Fired when the agent loop detects that the model is repeating the same
+     * response shape over and over — a tight loop that would otherwise burn
+     * iterations indefinitely. The loop breaks with status `max_iterations`
+     * after `repeatCount` consecutive identical iterations.
+     *
+     * Two flavours caught by the same safety valve:
+     *  - `kind: 'tool'` — the same tool(s) called with effectively the same
+     *    inputs (catches k2p7's tendency to retry identical tool calls when
+     *    a tool returns an unexpected empty result).
+     *  - `kind: 'message'` — the same assistant text repeated, with no tool
+     *    calls. K2P7 and other weak-instruction-following models can echo
+     *    their last assistant turn verbatim across many iterations in
+     *    autonomous-continue mode. The fingerprint also matches this case
+     *    so the safety valve catches it too.
+     *  - `kind: 'mixed'` — both: the response contains tool calls AND text,
+     *    and the combined fingerprint (tool names + text) repeats.
+     *
+     * UIs can render a warning chip. The `kind` field is additive — older
+     * subscribers that only read `tools` continue to work.
+     */
+    'tool.loop_detected': {
+        ctx: Context;
+        /** Comma-separated tool names involved in the loop, or empty string for pure message loops. */
+        tools: string;
+        /** Number of consecutive identical iterations detected. */
+        repeatCount: number;
+        /** 0-based iteration index where the loop was detected. */
+        iteration: number;
+        /**
+         * Shape of the loop. `tool` = identical tool calls; `message` = identical
+         * text-only response; `mixed` = both tool calls and text repeated.
+         * Defaults to `tool` for backward compatibility with subscribers that
+         * pre-date the field.
+         */
+        kind?: 'tool' | 'message' | 'mixed' | undefined;
+    };
     /**
      * `output` is a truncated preview of the tool's serialized result text
      * (capped at ~400 chars by the emitter). UIs render this inline in the
@@ -318,6 +363,13 @@ interface EventMap {
          * actual lines the model received and forwards it here. Undefined
          * for tools without a meaningful line count. */
         outputLines?: number | undefined;
+        /**
+         * Parsed context-management metadata for the result the model saw. This is
+         * intentionally compact: file/symbol/error/path-integrity hints, not the
+         * full output body. Compaction uses it to distinguish seen information from
+         * information later referenced by the assistant.
+         */
+        metadata?: ToolOutputMetadata | undefined;
     };
     /**
      * Fired by the `delegate` tool right before it hands work to a subagent
@@ -445,6 +497,21 @@ interface EventMap {
         load: number;
         /** Provider's max context window in tokens. */
         maxContext: number;
+        /** Budget snapshot used for the compaction decision. */
+        budget?: {
+            maxContext: number;
+            inputTokens: number;
+            availableInputTokens: number;
+            remainingInputTokens: number;
+            reservedOutputTokens: number;
+            reservedSafetyTokens: number;
+            load: number;
+            overflowTokens: number;
+        } | undefined;
+        /** Adaptive trigger signals observed alongside token pressure. */
+        signals?: {
+            repeatedReadCount?: number | undefined;
+        } | undefined;
         /** Full compaction report from the compactor. */
         report: {
             before: number;
@@ -470,6 +537,19 @@ interface EventMap {
         level: 'warn' | 'soft' | 'hard';
         tokens: number;
         maxContext: number;
+        budget?: {
+            maxContext: number;
+            inputTokens: number;
+            availableInputTokens: number;
+            remainingInputTokens: number;
+            reservedOutputTokens: number;
+            reservedSafetyTokens: number;
+            load: number;
+            overflowTokens: number;
+        } | undefined;
+        signals?: {
+            repeatedReadCount?: number | undefined;
+        } | undefined;
         load: number;
         fatal: boolean;
     };
@@ -801,6 +881,27 @@ interface EventMap {
         durationMs?: number;
         traceId?: string;
     };
+    /**
+     * Real-time client status event. Emitted by TUI/CLI/WebUI to report current
+     * session stats (tool calls, tokens, model, mode, cost). Broadcast immediately
+     * to all WebUI clients via setup-events.ts and written to status.json for
+     * external watchers.
+     */
+    'client.status': {
+        clientType: string;
+        clientId: string;
+        projectHash: string;
+        agentCount: number;
+        model: string;
+        mode: string;
+        toolCalls: number;
+        inputTokens: number;
+        outputTokens: number;
+        cacheTokens: number;
+        costUsd: number;
+        timestamp: number;
+        projectSlug: string;
+    };
     error: {
         err: Error;
         phase: string;

package/dist/{compactor-BBy0rCtB.d.ts → compactor-iMZ84CXq.d.ts}

@@ -1,4 +1,4 @@
-import { C as Context } from './context-BGSpZNSE.js';
+import { C as Context } from './context-dT5Ueund.js';
 
 interface CompactRepairReport {
     removedToolUses: string[];
@@ -39,6 +39,24 @@ interface CompactReport {
      * session log). Undefined when no range was collapsed this pass.
      */
     collapsedDigest?: string | undefined;
+    /**
+     * Compact state digest derived from tool-output instrumentation. It carries
+     * intent, path integrity, referenced tool results, active errors and implicit
+     * facts without copying full tool outputs back into the context window.
+     */
+    evidenceDigest?: string | undefined;
+    /**
+     * Deterministic post-compaction sanity check. This is deliberately local and
+     * cheap; LLM self-verification can be layered on top, but the compactor still
+     * records whether the compacted context retained an intent anchor and path
+     * trail.
+     */
+    quality?: {
+        ok: boolean;
+        hasIntent: boolean;
+        hasPathTrail: boolean;
+        issues: string[];
+    } | undefined;
 }
 interface Compactor {
     compact(ctx: Context, opts?: {

package/dist/{config-Dz2F3H2K.d.ts → config-Du3pYYln.d.ts}

@@ -1,4 +1,4 @@
-import { k as Capabilities, f as Permission } from './context-BGSpZNSE.js';
+import { l as Capabilities, f as Permission } from './context-dT5Ueund.js';
 
 type ContextWindowModeId = 'balanced' | 'frugal' | 'deep' | 'archival';
 type ContextWindowAggressiveOn = 'hard' | 'soft' | 'warn';
@@ -181,7 +181,7 @@ type ModelsDevPayload = Record<string, ModelsDevProvider>;
  * Canonical wire-format families WrongStack knows how to speak natively.
  * Used by the provider registry to pick a transport.
  */
-type WireFamily = 'anthropic' | 'openai' | 'openai-compatible' | 'google' | 'unsupported';
+type WireFamily = 'anthropic' | 'anthropic-oauth' | 'openai' | 'openai-compatible' | 'openai-codex' | 'github-copilot' | 'google' | 'unsupported';
 interface ResolvedProvider {
     id: string;
     name: string;
@@ -224,6 +224,25 @@ interface ModelsRegistry {
     ageSeconds(): Promise<number>;
 }
 
+/**
+ * Token-saving mode tier levels. Controls how aggressively the system prompt
+ * is compacted to reduce per-request token consumption.
+ *
+ * - 'off'        — Full prompt, all tools, complete guidance (no reduction)
+ * - 'minimal'    — TIER1 tools only (~10), stripped guidance (~3-4k tokens saved)
+ * - 'light'     — Core + memory tools (~14), common patterns, minimal guidance
+ * - 'medium'    — Most development tools (~24), some guidance (default when `true`)
+ * - 'aggressive' — Maximum savings before tools become unusable (~4-5k tokens saved)
+ */
+type TokenSavingTier = 'off' | 'minimal' | 'light' | 'medium' | 'aggressive';
+/**
+ * Normalize a TokenSavingTier value, handling backward-compatible boolean inputs.
+ * - `true`  → 'medium' (existing behavior)
+ * - `false` → 'off'
+ * - string values are returned as-is after validation
+ * - `undefined` → 'off'
+ */
+declare function normalizeTokenSavingTier(val?: TokenSavingTier | boolean): TokenSavingTier;
 interface ContextConfig {
     /** Context-window policy mode. Controls compaction thresholds and preservation depth. */
     mode?: ContextWindowModeId | undefined;
@@ -252,6 +271,30 @@ interface ContextConfig {
     /** Enable LLM-driven selective compaction (default: false for backward compat). */
     llmSelector?: boolean | undefined;
 }
+/**
+ * Runtime configuration for the process circuit breaker (the one owned by the
+ * ProcessRegistry that gates `bash`/`exec`). Toggle via `/settings breaker`.
+ *
+ * The breaker itself is a low-level primitive (`packages/tools/.../circuit-breaker.ts`)
+ * that is on by default; this section controls whether the registry actually
+ * participates in it and how it auto-recovers.
+ */
+interface CircuitBreakerRuntimeConfig {
+    /**
+     * Enable circuit-breaker protection. When false (the default), the breaker
+     * is bypassed — `bash`/`exec` calls always proceed regardless of failure
+     * history. When true, the breaker trips on repeated failures / slow calls /
+     * bursts and blocks further calls until it recovers.
+     */
+    enabled?: boolean | undefined;
+    /**
+     * When the breaker trips, automatically kill all tracked processes AND
+     * reset the breaker to closed after this delay (ms). 0 = disabled (manual
+     * recovery only via `/kill reset`). Only effective when `enabled` is true.
+     * While armed, the statusline shows a live countdown to the kill/reset.
+     */
+    autoKillResetMs?: number | undefined;
+}
 interface ToolsConfig {
     defaultExecutionStrategy: 'parallel' | 'sequential' | 'smart';
     maxIterations: number;
@@ -263,6 +306,14 @@ interface ToolsConfig {
      * limit by 100 when hit. Set to false to require user confirmation.
      */
     autoExtendLimit?: boolean | undefined;
+    /**
+     * When true, file tools (read/write/edit/grep/glob/install) are confined to
+     * the project root and `set_working_dir` may not leave it. Default: false —
+     * tools may access paths outside the project root, still subject to each
+     * tool's permission tier (writes/edits prompt for confirmation). Toggle via
+     * `/settings` ("Filesystem access").
+     */
+    restrictToProjectRoot?: boolean | undefined;
 }
 interface ProviderApiKey {
     /** Short human-readable label (e.g. "personal", "work", "rate-limit-backup"). */
@@ -274,14 +325,42 @@ interface ProviderApiKey {
     apiKey: string;
     /** ISO-8601 timestamp the key was added. */
     createdAt: string;
+    /**
+     * How this credential was obtained.
+     * - `api_key`       — manually pasted API key (default)
+     * - `oauth`         — OAuth 2.0 device-code / authorization-code flow
+     * - `session_token` — extracted from browser session (ChatGPT web, etc.)
+     */
+    authMethod?: 'api_key' | 'oauth' | 'session_token' | undefined;
+    /** ISO-8601 expiry. When set, the token manager will refresh before this time. */
+    expiresAt?: string | undefined;
+    /**
+     * OAuth refresh token. Stored encrypted by the secret-vault walker because
+     * the field name contains `Token` (case-insensitive match by vault).
+     */
+    refreshToken?: string | undefined;
+    /** Token type as returned by the OAuth endpoint (e.g. "bearer"). */
+    tokenType?: string | undefined;
+    /** OAuth scope string (e.g. "openai.models.read openai.models.use"). */
+    scope?: string | undefined;
+    /**
+     * ChatGPT account id, extracted from the OAuth access-token JWT
+     * (`https://api.openai.com/auth`.chatgpt_account_id). Sent as the
+     * `chatgpt-account-id` header by the `openai-codex` wire family. Cached
+     * here for display/diagnostics; the provider re-derives it from the live
+     * token at request time so it can never go stale after a refresh.
+     */
+    accountId?: string | undefined;
 }
 interface ProviderConfig {
     type: string;
     /**
-     * Legacy single-key field. Still honored as a fallback when `apiKeys`
-     * is empty. When `apiKeys`/`activeKey` are present, the config loader
-     * mirrors the active entry into this field so downstream consumers
-     * (provider construction, wire adapters) need no changes.
+     * Legacy single-key field. Still honored as a read fallback when `apiKeys`
+     * is empty (for configs not yet migrated to multi-key format). After key
+     * management operations (`writeKeysBack`), this field is **cleared** to
+     * prevent accidental serialization of the plaintext key. Consumers that
+     * need the active API key should use `resolveActiveApiKey()` (cli) or
+     * resolve from `apiKeys[]` directly — never read `cfg.apiKey` in new code.
      */
     apiKey?: string | undefined;
     /** Multiple keys for the same provider — pick one with `activeKey`. */
@@ -309,6 +388,23 @@ interface ProviderConfig {
      * capability overrides. The model id is the key, not a fully qualified id.
      */
     customModels?: Record<string, CustomModelDefinition>;
+    /**
+     * Per-provider OAuth configuration. When present, `wstack auth login <id>`
+     * uses this instead of prompting for a raw API key. Set by the catalog or
+     * by the user via `/settings`.
+     */
+    oauthConfig?: {
+        /** OAuth client id registered with the provider. */
+        clientId?: string | undefined;
+        /** Device authorization endpoint (RFC 8628). */
+        deviceCodeEndpoint?: string | undefined;
+        /** Token endpoint for code exchange and refresh. */
+        tokenEndpoint?: string | undefined;
+        /** Authorization server URL shown to the user for opening in browser. */
+        authorizationEndpoint?: string | undefined;
+        /** Default OAuth scopes to request. */
+        scopes?: string[] | undefined;
+    } | undefined;
 }
 /**
  * One entry in the per-task model matrix. Pins a catalog role, a phase, or
@@ -338,6 +434,14 @@ interface MCPServerConfig {
     permission?: Permission | undefined;
     startupTimeoutMs?: number | undefined;
     requestTimeoutMs?: number | undefined;
+    /**
+     * Lazy connect: when true, the server process is NOT spawned at boot. Its
+     * tools are registered from a cached manifest (discovered on the first ever
+     * connect) and the server only spawns when one of its tools is actually
+     * called, then auto-sleeps after an idle period. Default (false/undefined) =
+     * eager connect at boot.
+     */
+    lazy?: boolean | undefined;
 }
 interface LogConfig {
     level: 'error' | 'warn' | 'info' | 'debug' | 'trace';
@@ -375,13 +479,23 @@ interface FeaturesConfig {
     /** Discover + load skills from disk. */
     skills: boolean;
     /**
-     * Token-saving mode: when enabled, non-essential tools are omitted,
-     * skill descriptions are trimmed, and the system prompt is shortened
-     * to reduce per-request token consumption without compromising core
-     * functionality. Enable with `--token-saving-mode` or
-     * `features.tokenSavingMode: true` in config.
+     * Token-saving mode tier. Controls how aggressively the system prompt
+     * is compacted to reduce per-request token consumption.
+     *
+     * - 'off'        — Full prompt, all tools, complete guidance
+     * - 'minimal'    — TIER1 tools only, stripped guidance (~3-4k tokens saved)
+     * - 'light'     — Core + memory tools, common patterns, minimal guidance
+     * - 'medium'    — Most development tools, some guidance
+     * - 'aggressive' — Maximum savings before tools become unusable (~4-5k tokens)
+     *
+     * Boolean values are accepted for backward compatibility:
+     * - `true`  → 'medium'
+     * - `false` → 'off'
+     *
+     * Enable via CLI: `--token-saving-tier <level>` or `--token-saving-mode` (maps to 'medium').
+     * Configure via: `features.tokenSavingMode: "minimal"` in config.
      */
-    tokenSavingMode?: boolean | undefined;
+    tokenSavingMode?: TokenSavingTier | boolean | undefined;
     /**
      * Allow tools to read/write paths outside the project root directory.
      * When true (default), tools can access any path on the filesystem.
@@ -563,6 +677,11 @@ interface Config {
     configScope?: 'global' | 'project' | undefined;
     /** Automatic codebase symbol-index maintenance (session-start + live updates). */
     indexing?: IndexingConfig | undefined;
+    /**
+     * Process circuit-breaker protection (gates `bash`/`exec` on repeated
+     * failures). Default off — toggle with `/settings breaker on|off`.
+     */
+    circuitBreaker?: CircuitBreakerRuntimeConfig | undefined;
     /** Saved launch preferences — restored on next boot for one-line confirmation. */
     launch?: LaunchConfig | undefined;
     /**
@@ -631,4 +750,4 @@ interface ConfigStore {
     watch(cb: (next: Readonly<Config>, prev: Readonly<Config>) => void): () => void;
 }
 
-export { type AutonomyConfig as A, type SessionLoggingConfig as B, type ContextWindowAggressiveOn as C, DEFAULT_CONTEXT_WINDOW_MODE_ID as D, type SyncCategory as E, type FeaturesConfig as F, formatContextWindowModeList as G, type HookEvent as H, type InProcessHook as I, getContextWindowMode as J, isContextWindowModeId as K, type LaunchConfig as L, type ModelsRegistry as M, listContextWindowModes as N, resolveContextWindowPolicy as O, type ProviderConfig as P, type ResolvedProvider as R, type ShellHook as S, type ToolsConfig as T, type WireFamily as W, type ModelsDevPayload as a, type ResolvedModel as b, type MCPServerConfig as c, type ModelMatrixEntry as d, type HookMatcher as e, type HookEntry as f, type ContextWindowPolicy as g, type Config as h, type ConfigStore as i, type ConfigLoader as j, type SyncConfig as k, type HookInput as l, type HookOutcome as m, CONTEXT_WINDOW_MODES as n, type ContextConfig as o, type ContextWindowConfigLike as p, type ContextWindowMode as q, type ContextWindowModeId as r, type ContextWindowThresholds as s, type CustomModelDefinition as t, type IndexingConfig as u, type LogConfig as v, type ModelsDevModel as w, type ModelsDevProvider as x, type PluginConfig as y, type ProviderApiKey as z };
+export { type AutonomyConfig as A, type ProviderApiKey as B, type ContextWindowAggressiveOn as C, DEFAULT_CONTEXT_WINDOW_MODE_ID as D, type SessionLoggingConfig as E, type FeaturesConfig as F, type SyncCategory as G, type HookEvent as H, type InProcessHook as I, type ToolsConfig as J, formatContextWindowModeList as K, type LaunchConfig as L, type ModelsRegistry as M, getContextWindowMode as N, isContextWindowModeId as O, type ProviderConfig as P, listContextWindowModes as Q, type ResolvedProvider as R, type ShellHook as S, type TokenSavingTier as T, normalizeTokenSavingTier as U, resolveContextWindowPolicy as V, type WireFamily as W, type ModelsDevPayload as a, type ResolvedModel as b, type MCPServerConfig as c, type ModelMatrixEntry as d, type ModelsDevModel as e, type HookMatcher as f, type HookEntry as g, type ContextWindowPolicy as h, type Config as i, type ConfigStore as j, type ConfigLoader as k, type SyncConfig as l, type HookInput as m, type HookOutcome as n, CONTEXT_WINDOW_MODES as o, type CircuitBreakerRuntimeConfig as p, type ContextConfig as q, type ContextWindowConfigLike as r, type ContextWindowMode as s, type ContextWindowModeId as t, type ContextWindowThresholds as u, type CustomModelDefinition as v, type IndexingConfig as w, type LogConfig as x, type ModelsDevProvider as y, type PluginConfig as z };