@zergai/ztc 0.4.0-beta.1 → 0.5.0-beta.1

package/dist/components/MessageList.d.ts

@@ -16,6 +16,8 @@ interface MessageListProps {
      */
     externalTranscript?: boolean;
     showThinking?: boolean;
+    showTurnMetadata?: boolean;
+    cols?: number;
 }
 export declare const MessageList: React.FC<MessageListProps>;
 export default MessageList;

package/dist/components/MessageList.js

@@ -2,7 +2,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useRef, useMemo } from 'react';
 import { InkNode } from '../ui/ink/index.js';
 import { buildMessageListView } from '../ui/views/message_list.js';
-export const MessageList = ({ messages, height, maxMessages = 50, debug = false, expandToolOutputs = false, scrollback = false, externalTranscript = false, showThinking = true, }) => {
+export const MessageList = ({ messages, height, maxMessages = 50, debug = false, expandToolOutputs = false, scrollback = false, externalTranscript = false, showThinking = true, showTurnMetadata = true, cols = process.stdout.columns || 80, }) => {
     // In scrollback mode, track which messages have been rendered to avoid duplication
     const renderedIdsRef = useRef(new Set());
     // Filter to only new, complete messages in scrollback mode
@@ -46,6 +46,8 @@ export const MessageList = ({ messages, height, maxMessages = 50, debug = false,
         scrollback,
         externalTranscript,
         showThinking,
+        showTurnMetadata,
+        cols,
     });
     return _jsx(InkNode, { node: node });
 };

package/dist/components/SingleMessage.d.ts

@@ -3,6 +3,8 @@ import { Message } from '../types.js';
 interface SingleMessageProps {
     message: Message;
     expandToolOutputs?: boolean;
+    showTurnMetadata?: boolean;
+    cols?: number;
 }
 export declare const SingleMessage: React.FC<SingleMessageProps>;
 export default SingleMessage;

package/dist/components/SingleMessage.js

@@ -1,5 +1,7 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { Box, Text } from 'ink';
+import { messageHeaderSuffix } from '../ui/core/turn_metadata.js';
+import { displayWidth } from '../ui/core/text_width.js';
 // Box-drawing characters for tables
 const BOX = {
     topLeft: '╭',
@@ -152,7 +154,7 @@ const ContentRenderer = ({ content, diffLines, isToolTrace }) => {
                 return _jsx(Text, { children: line }, lineIdx);
             }) }, segIdx))) }));
 };
-export const SingleMessage = ({ message, expandToolOutputs = false }) => {
+export const SingleMessage = ({ message, expandToolOutputs = false, showTurnMetadata = true, cols = process.stdout.columns || 80, }) => {
     const config = roleConfigs[message.role] || roleConfigs.system;
     const metadata = message.metadata;
     const toolOutput = metadata?.toolOutput;
@@ -173,6 +175,6 @@ export const SingleMessage = ({ message, expandToolOutputs = false }) => {
     if (isToolTrace) {
         return (_jsx(Box, { flexDirection: "column", marginY: 0, paddingX: 1, children: _jsx(Box, { flexDirection: "column", marginLeft: 1, children: _jsx(ContentRenderer, { content: content, diffLines: diffLines, isToolTrace: true }) }) }));
     }
-    return (_jsxs(Box, { flexDirection: "column", marginY: 1, paddingX: 1, children: [_jsxs(Box, { flexDirection: "row", children: [_jsxs(Text, { color: config.color, bold: true, children: [config.icon, " ", config.label] }), _jsxs(Text, { color: "gray", dimColor: true, children: [" \u2022 ", formatTime(message.timestamp)] }), message.isStreaming && _jsx(Text, { color: "yellow", bold: true, children: " \u258C" })] }), _jsx(Box, { flexDirection: "column", marginLeft: 2, children: _jsx(ContentRenderer, { content: content, diffLines: diffLines, isToolTrace: false }) })] }));
+    return (_jsxs(Box, { flexDirection: "column", marginY: 1, paddingX: 1, children: [_jsxs(Box, { flexDirection: "row", children: [_jsxs(Text, { color: config.color, bold: true, children: [config.icon, " ", config.label] }), _jsxs(Text, { color: "gray", dimColor: true, children: [" \u2022 ", formatTime(message.timestamp), messageHeaderSuffix(message, cols, displayWidth(`${config.icon} ${config.label} • ${formatTime(message.timestamp)}${message.isStreaming ? ' ▌' : ''}`), showTurnMetadata)] }), message.isStreaming && _jsx(Text, { color: "yellow", bold: true, children: " \u258C" })] }), _jsx(Box, { flexDirection: "column", marginLeft: 2, children: _jsx(ContentRenderer, { content: content, diffLines: diffLines, isToolTrace: false }) })] }));
 };
 export default SingleMessage;

package/dist/components/StatusBar.d.ts

@@ -1,5 +1,5 @@
 import React from 'react';
-import { AgentState } from '../types.js';
+import type { AgentState, InputMode } from '../types.js';
 import { ContextStatus } from '../utils/context.js';
 import type { AgentMode } from '../app/modes.js';
 import type { CodexReasoningEffort } from '../config/types.js';
@@ -7,6 +7,7 @@ import type { StatusLineSettings } from '../ui/status_line_config.js';
 interface StatusBarProps {
     state: AgentState;
     sessionId?: string;
+    sessionName?: string;
     version?: string;
     connectionStatus?: 'connected' | 'disconnected' | 'connecting';
     contextLength?: number;
@@ -17,7 +18,8 @@ interface StatusBarProps {
     emulationId?: string;
     /** Effort in effect for the active model; undefined follows the provider. */
     effort?: CodexReasoningEffort;
-    inputMode?: 'queue' | 'interrupt';
+    inputMode?: InputMode;
+    escapeHint?: string;
     toast?: string | null;
     spinnerLabel?: string | null;
     debug?: boolean;

package/dist/components/StatusBar.js

@@ -1,10 +1,11 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { InkNode } from '../ui/ink/index.js';
 import { buildStatusBarView } from '../ui/views/status_bar.js';
-export const StatusBar = ({ state, sessionId, version = '0.1.0', connectionStatus = 'connected', contextLength, contextEstimated, contextStatus, provider, model, emulationId, effort, inputMode, toast, spinnerLabel, debug = false, mode, cols, statusLine, }) => {
+export const StatusBar = ({ state, sessionId, sessionName, version = '0.1.0', connectionStatus = 'connected', contextLength, contextEstimated, contextStatus, provider, model, emulationId, effort, inputMode = 'steer', escapeHint, toast, spinnerLabel, debug = false, mode, cols, statusLine, }) => {
     const node = buildStatusBarView({
         state,
         sessionId,
+        sessionName,
         version,
         connectionStatus,
         contextLength,
@@ -15,6 +16,7 @@ export const StatusBar = ({ state, sessionId, version = '0.1.0', connectionStatu
         emulationId,
         effort,
         inputMode,
+        escapeHint,
         toast,
         spinnerLabel,
         debug,

package/dist/conductor_branch.js

@@ -57,6 +57,9 @@ export function resolveConductorWorkspace(branch, env = process.env) {
 }
 export function buildConductorBranchLaunch(branch, ztcArgs, options = {}) {
     const env = options.env || process.env;
+    if (env.ZTC_DESKTOP_RUNTIME_MANIFEST) {
+        throw new Error('The bundled ZTC runtime does not support --branch; use a source or npm CLI to run branch-local code.');
+    }
     const callerCwd = options.callerCwd || process.cwd();
     const workspacePath = resolveConductorWorkspace(branch, env);
     if (!existsSync(workspacePath) || !statSync(workspacePath).isDirectory()) {

package/dist/config/api_retry.d.ts

@@ -22,7 +22,7 @@ export declare const MIN_API_RETRY_ATTEMPTS = 1;
  * How many times to retry, and how long to wait, are the user's decisions. A
  * long outage may be worth riding out with more attempts than a fixed menu
  * offers, and a local endpoint may want a 10 ms backoff where a hosted one wants
- * seconds. Nothing here caps that.
+ * seconds. The configurable delay cap limits each wait, not the attempt count.
  */
 export declare const MAX_API_RETRY_ATTEMPTS: number;
 export declare const MIN_API_RETRY_BASE_DELAY_MS = 0;
@@ -39,6 +39,11 @@ export declare const DEFAULT_API_RETRY: Required<ApiRetrySettings>;
 export declare function parseApiRetryAttempts(value: unknown): number | null;
 export declare function parseApiRetryBaseDelayMs(value: unknown): number | null;
 export declare function parseApiRetryTimeoutMs(value: unknown): number | null;
+export declare function parseApiRetryMaxDelayMs(value: unknown): number | null;
+/** null is continuous recovery; undefined denotes an invalid setting. */
+export declare function parseApiRecoveryWindowMs(value: unknown): number | null | undefined;
+/** Capped equal jitter avoids synchronized retry waves and timer overflow. */
+export declare function apiRetryDelayMs(attempt: number, policy: Required<ApiRetrySettings>): number;
 /**
  * Fill in defaults for missing or unusable fields.
  *

package/dist/config/api_retry.js

@@ -21,7 +21,7 @@ export const MIN_API_RETRY_ATTEMPTS = 1;
  * How many times to retry, and how long to wait, are the user's decisions. A
  * long outage may be worth riding out with more attempts than a fixed menu
  * offers, and a local endpoint may want a 10 ms backoff where a hosted one wants
- * seconds. Nothing here caps that.
+ * seconds. The configurable delay cap limits each wait, not the attempt count.
  */
 export const MAX_API_RETRY_ATTEMPTS = Number.MAX_SAFE_INTEGER;
 export const MIN_API_RETRY_BASE_DELAY_MS = 0;
@@ -38,6 +38,8 @@ export const DEFAULT_API_RETRY = {
     maxAttempts: 3,
     baseDelayMs: 2_000,
     requestTimeoutMs: 120_000,
+    maxDelayMs: 30_000,
+    recoveryWindowMs: null,
 };
 function parseBoundedInteger(value, min, max) {
     if (value === undefined || value === null || value === '')
@@ -56,6 +58,20 @@ export function parseApiRetryBaseDelayMs(value) {
 export function parseApiRetryTimeoutMs(value) {
     return parseBoundedInteger(value, MIN_API_RETRY_TIMEOUT_MS, MAX_API_RETRY_TIMEOUT_MS);
 }
+export function parseApiRetryMaxDelayMs(value) {
+    return parseBoundedInteger(value, 1, MAX_TIMER_DELAY_MS);
+}
+/** null is continuous recovery; undefined denotes an invalid setting. */
+export function parseApiRecoveryWindowMs(value) {
+    if (value === null || value === 'continuous')
+        return null;
+    return parseBoundedInteger(value, 0, Number.MAX_SAFE_INTEGER) ?? undefined;
+}
+/** Capped equal jitter avoids synchronized retry waves and timer overflow. */
+export function apiRetryDelayMs(attempt, policy) {
+    const cap = Math.min(policy.maxDelayMs, policy.baseDelayMs * 2 ** Math.min(attempt - 1, 1023));
+    return Math.floor(cap * (0.5 + Math.random() * 0.5));
+}
 /**
  * Fill in defaults for missing or unusable fields.
  *
@@ -69,5 +85,7 @@ export function resolveApiRetrySettings(config) {
         baseDelayMs: parseApiRetryBaseDelayMs(config.apiRetry?.baseDelayMs) ?? DEFAULT_API_RETRY.baseDelayMs,
         requestTimeoutMs: parseApiRetryTimeoutMs(config.apiRetry?.requestTimeoutMs)
             ?? DEFAULT_API_RETRY.requestTimeoutMs,
+        maxDelayMs: parseApiRetryMaxDelayMs(config.apiRetry?.maxDelayMs) ?? DEFAULT_API_RETRY.maxDelayMs,
+        recoveryWindowMs: parseApiRecoveryWindowMs(config.apiRetry?.recoveryWindowMs) ?? DEFAULT_API_RETRY.recoveryWindowMs,
     };
 }

package/dist/config/defaults.d.ts

@@ -1,3 +1,4 @@
+import type { ReasoningWireSurface } from '@zerg/model-contracts';
 import type { CodexReasoningEffort, ZTCConfig } from './types.js';
 export declare const DEFAULT_OPENAI_MODEL = "gpt-5.4-nano";
 export declare const DEFAULT_CODEX_MODEL = "gpt-5.6-sol";
@@ -14,7 +15,7 @@ export declare const DEFAULT_CLARIFAI_MODEL = "https://clarifai.com/openai/chat-
  * undefined (use the provider default). Used both when building an agent
  * (factory) and to display the active effort in the model picker.
  */
-export declare function resolveCodexEffort(config: ZTCConfig, provider?: string, model?: string): CodexReasoningEffort | undefined;
+export declare function resolveCodexEffort(config: ZTCConfig, provider?: string, model?: string, contract?: ReasoningWireSurface | import('../utils/router_catalog.js').RouterModelCapabilities): CodexReasoningEffort | undefined;
 /**
  * The highest-priority saved effort when the active model rejects it, so the
  * UI can say the choice is not applied instead of silently falling back.

package/dist/config/defaults.js

@@ -20,14 +20,19 @@ export const DEFAULT_CLARIFAI_MODEL = 'https://clarifai.com/openai/chat-completi
  * undefined (use the provider default). Used both when building an agent
  * (factory) and to display the active effort in the model picker.
  */
-export function resolveCodexEffort(config, provider, model) {
+export function resolveCodexEffort(config, provider, model, contract = config.authMode === 'zrouter' || provider === 'openai_compatible' ? 'chat_tools' : 'native_api') {
     const candidates = [
         model ? config.codexEffortByModel?.[model] : undefined,
         provider ? config.codexEffortByProvider?.[provider] : undefined,
         config.codexEffort,
     ];
     for (const candidate of candidates) {
-        if (candidate && isCodexReasoningEffortSupported(provider, model, candidate))
+        if (!candidate)
+            continue;
+        const supported = typeof contract === 'string'
+            ? isCodexReasoningEffortSupported(provider, model, candidate, contract)
+            : contract.reasoning?.choices.includes(candidate);
+        if (candidate && supported)
             return candidate;
     }
     return undefined;
@@ -143,6 +148,8 @@ export function getDefaultApiKeyForProvider(provider) {
             return process.env.DEEPSEEK_API_KEY;
         case 'modal':
             return undefined; // Modal credentials belong to the Router platform.
+        case 'fireworks':
+            return process.env.FIREWORKS_API_KEY;
         default:
             return (process.env.ANTHROPIC_API_KEY
                 || process.env.OPENAI_API_KEY

package/dist/config/message_display.d.ts

@@ -7,5 +7,6 @@ export declare const MIN_TOOL_OUTPUT_LINES = 0;
  */
 export declare const MAX_TOOL_OUTPUT_LINES: number;
 export declare const DEFAULT_MESSAGE_DISPLAY: Required<MessageDisplaySettings>;
+export declare function parseProseReadingRate(value: unknown): number | null | undefined;
 export declare function parseToolOutputLines(value: unknown): number | null;
 export declare function resolveMessageDisplaySettings(config: Pick<ZTCConfig, 'messageDisplay'>): Required<MessageDisplaySettings>;

package/dist/config/message_display.js

@@ -9,9 +9,20 @@ export const DEFAULT_MESSAGE_DISPLAY = {
     toolOutputLines: 2,
     collapseToolCalls: true,
     groupToolCalls: true,
-    showThinking: true,
+    showThinking: false,
+    showTurnMetadata: true,
     smoothStreaming: true,
+    proseReadingRateWordsPerSecond: null,
 };
+export function parseProseReadingRate(value) {
+    if (value === null || (typeof value === 'string' && value.trim().toLowerCase() === 'off'))
+        return null;
+    if ((typeof value !== 'number' && typeof value !== 'string')
+        || (typeof value === 'string' && value.trim() === ''))
+        return undefined;
+    const rate = Number(value);
+    return Number.isFinite(rate) && rate > 0 ? rate : undefined;
+}
 export function parseToolOutputLines(value) {
     const parsed = Number(value);
     if (!Number.isSafeInteger(parsed)
@@ -22,11 +33,15 @@ export function parseToolOutputLines(value) {
 }
 export function resolveMessageDisplaySettings(config) {
     const configuredLines = parseToolOutputLines(config.messageDisplay?.toolOutputLines);
+    const readingRate = parseProseReadingRate(config.messageDisplay?.proseReadingRateWordsPerSecond);
     return {
         toolOutputLines: configuredLines ?? DEFAULT_MESSAGE_DISPLAY.toolOutputLines,
         collapseToolCalls: config.messageDisplay?.collapseToolCalls !== false,
         groupToolCalls: config.messageDisplay?.groupToolCalls !== false,
-        showThinking: config.messageDisplay?.showThinking !== false,
+        showThinking: config.messageDisplay?.showThinking ?? DEFAULT_MESSAGE_DISPLAY.showThinking,
+        showTurnMetadata: config.messageDisplay?.showTurnMetadata !== false,
         smoothStreaming: config.messageDisplay?.smoothStreaming !== false,
+        proseReadingRateWordsPerSecond: readingRate === undefined
+            ? DEFAULT_MESSAGE_DISPLAY.proseReadingRateWordsPerSecond : readingRate,
     };
 }

package/dist/config/permissions.d.ts

@@ -0,0 +1,21 @@
+import { type SandboxBackendStatus } from '../utils/sandbox.js';
+import type { ZTCConfig, ZTCPermissionProfile, ZTCToolCapability } from './types.js';
+export declare const PERMISSION_CAPABILITIES: readonly ["file_read", "file_write", "shell_exec", "network", "screen_capture", "computer_control", "ml_inference"];
+export interface PermissionPolicySnapshot {
+    id: string;
+    capabilities: Record<ZTCToolCapability, boolean>;
+    approvalRequiredCapabilities: ZTCToolCapability[];
+    commandSandbox: SandboxBackendStatus & {
+        requested: boolean;
+        required: boolean;
+    };
+    scope: string;
+}
+export declare function resolvePermissionProfile(config: ZTCConfig): ZTCPermissionProfile;
+export declare function projectPermissionPolicy(config: ZTCConfig): PermissionPolicySnapshot;
+/** Native provider-owned tools do not pass through ZTC's capability/approval boundary. */
+export declare function admitPermissionProvider(profile: ZTCPermissionProfile, policy: PermissionPolicySnapshot, provider: string): void;
+export declare function describePermissionPolicy(policy: PermissionPolicySnapshot): string;
+export declare function describePermissionChanges(before: PermissionPolicySnapshot, after: PermissionPolicySnapshot): string;
+/** Explicit user import only. Never auto-activate policy from a repository. */
+export declare function readRepoPermissionProfiles(cwd: string): Promise<Record<string, ZTCPermissionProfile>>;

package/dist/config/permissions.js

@@ -0,0 +1,89 @@
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { z } from 'zod';
+import { DEFAULT_PERMISSION_PROFILES } from '../config.js';
+import { getSandboxPolicyStatus } from '../utils/sandbox.js';
+import { normalizeProviderId } from '../agent/backends/provider_ids.js';
+export const PERMISSION_CAPABILITIES = ['file_read', 'file_write', 'shell_exec', 'network', 'screen_capture', 'computer_control', 'ml_inference'];
+const strings = z.array(z.string().min(1).max(2048)).max(128);
+const profileSchema = z.object({
+    description: z.string().max(2000).optional(),
+    capabilities: z.object(Object.fromEntries(PERMISSION_CAPABILITIES.map(cap => [cap, z.boolean().optional()]))).strict().optional(),
+    approvalRequiredCapabilities: z.array(z.enum(PERMISSION_CAPABILITIES)).max(7).optional(),
+    allowedPaths: strings.optional(), deniedPaths: strings.optional(),
+    allowedShellCommands: strings.optional(), deniedShellCommands: strings.optional(),
+    networkHosts: z.object({ allow: strings.optional(), deny: strings.optional() }).strict().optional(),
+    sandbox: z.object({ backend: z.enum(['auto', 'none', 'seatbelt', 'bubblewrap', 'windows-job']).optional(), requireOsEnforcement: z.boolean().optional() }).strict().optional(),
+}).strict();
+export function resolvePermissionProfile(config) {
+    const id = config.permissionProfile ?? 'trusted';
+    const profile = config.permissionProfiles?.[id] ?? DEFAULT_PERMISSION_PROFILES[id];
+    if (!profile)
+        throw new Error(`Unknown permission profile: ${id}`);
+    const parsed = profileSchema.safeParse(profile);
+    if (!parsed.success)
+        throw new Error(`Invalid permission profile: ${id}`);
+    return parsed.data;
+}
+export function projectPermissionPolicy(config) {
+    const id = config.permissionProfile ?? 'trusted', profile = resolvePermissionProfile(config);
+    const capabilities = Object.fromEntries(PERMISSION_CAPABILITIES.map(cap => [cap,
+        config.toolPermissions?.[cap] !== false && profile.capabilities?.[cap] !== false]));
+    const approvals = id === 'ask_before_mutation' ? ['file_write', 'shell_exec', 'computer_control']
+        : profile.approvalRequiredCapabilities ?? [];
+    return { id, capabilities, approvalRequiredCapabilities: [...new Set(approvals)].filter(cap => capabilities[cap]),
+        commandSandbox: getSandboxPolicyStatus({ profile, profileId: id, sandbox: config.sandbox }),
+        scope: profile.allowedPaths?.length ? `File roots: ${profile.allowedPaths.join(', ')}` : 'File roots: unrestricted by profile',
+    };
+}
+/** Native provider-owned tools do not pass through ZTC's capability/approval boundary. */
+export function admitPermissionProvider(profile, policy, provider) {
+    const native = ['claude_code', 'claude_code_direct', 'codex_app_server', 'codex_legacy', 'kimi_code'].includes(normalizeProviderId(provider).replaceAll('-', '_'));
+    const constrained = Object.values(policy.capabilities).includes(false) || policy.approvalRequiredCapabilities.length > 0
+        || Boolean(profile.allowedPaths?.length || profile.deniedPaths?.length || profile.allowedShellCommands?.length
+            || profile.deniedShellCommands?.length || profile.networkHosts?.allow?.length || profile.networkHosts?.deny?.length || policy.commandSandbox.requested);
+    if (native && constrained)
+        throw new Error('Permission profile unsupported by this native provider; use a ZTC-managed API provider for tool policy and host approval enforcement.');
+    if (policy.commandSandbox.required && policy.commandSandbox.enforcement !== 'os')
+        throw new Error('Permission profile requires OS command sandbox enforcement, but the selected backend is unavailable.');
+}
+export function describePermissionPolicy(policy) {
+    const sandbox = policy.commandSandbox;
+    return [
+        `Permission profile: ${policy.id}. Policy checks at tool boundaries; not session-wide OS isolation.`,
+        ...PERMISSION_CAPABILITIES.map(cap => `  ${cap}: ${policy.capabilities[cap] ? 'on' : 'off'}${policy.approvalRequiredCapabilities.includes(cap) ? ' (host approval required)' : ''}`),
+        policy.scope,
+        !sandbox.requested ? 'OS command sandbox: not requested.'
+            : `OS command sandbox: ${sandbox.required ? 'required' : 'requested'}; ${sandbox.backend} ${sandbox.available ? `available (${sandbox.enforcement}) for managed command launches` : 'unavailable (unsupported)'}. ${sandbox.required && sandbox.enforcement !== 'os' ? 'Command launch is blocked.' : 'This is backend availability, not proof that a command ran in isolation.'}`,
+    ].join('\n');
+}
+export function describePermissionChanges(before, after) {
+    const label = (policy, cap) => !policy.capabilities[cap] ? 'off'
+        : policy.approvalRequiredCapabilities.includes(cap) ? 'on with approval' : 'on';
+    const changed = PERMISSION_CAPABILITIES.filter(cap => label(before, cap) !== label(after, cap));
+    return ['Permission changes:', ...changed.map(cap => `  ${cap}: ${label(before, cap)} → ${label(after, cap)}`),
+        ...(changed.length ? [] : ['  No capability changes; existing tool permission denials still apply.']), describePermissionPolicy(after)].join('\n');
+}
+/** Explicit user import only. Never auto-activate policy from a repository. */
+export async function readRepoPermissionProfiles(cwd) {
+    let input;
+    try {
+        const bytes = await readFile(join(cwd, '.ztc', 'config.json'));
+        if (bytes.length > 256 * 1024)
+            throw new Error('oversized');
+        input = JSON.parse(bytes.toString('utf8'));
+    }
+    catch {
+        throw new Error('Invalid repo permission config; expected .ztc/config.json (maximum 256 KiB)');
+    }
+    const parsed = z.object({ permissionProfiles: z.record(z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), profileSchema) }).safeParse(input);
+    if (!parsed.success)
+        throw new Error('Invalid repo permission profiles; capability values must be booleans and policy fields must be supported');
+    const anchor = (path) => resolve(cwd, path === '~' ? homedir() : path.replace(/^~(?=\/|$)/, homedir()));
+    return Object.fromEntries(Object.entries(parsed.data.permissionProfiles).map(([id, profile]) => [id, {
+            ...profile,
+            ...(profile.allowedPaths ? { allowedPaths: profile.allowedPaths.map(anchor) } : {}),
+            ...(profile.deniedPaths ? { deniedPaths: profile.deniedPaths.map(anchor) } : {}),
+        }]));
+}

package/dist/config/resolved.d.ts

@@ -35,8 +35,8 @@ export interface AuthContext {
  * `apiKey` is the DIRECT provider key (what a direct backend would use).
  * `authToken` is the platform/proxy bearer. When `useProxy` is true the active
  * backend streams through `proxyUrl` with `authToken`; the direct `apiKey` is
- * still surfaced so callers that special-case a provider (e.g. a direct Gemini
- * key) can opt out of the proxy.
+ * still surfaced for direct-provider construction. Auto-mode preferences are
+ * resolved before `useProxy` is returned.
  */
 export interface ResolvedLLMConfig {
     provider: string;

package/dist/config/types.d.ts

@@ -183,6 +183,8 @@ export interface ZTCPermissionProfile {
     description?: string;
     /** Capability allow/deny map. Missing entries default to allowed. */
     capabilities?: Partial<Record<ZTCToolCapability, boolean>>;
+    /** Existing host approval gate, applied before tools with these capabilities. */
+    approvalRequiredCapabilities?: ZTCToolCapability[];
     /** File roots that read/write tools may access. Relative entries resolve from the current cwd. */
     allowedPaths?: string[];
     /** File roots that read/write tools may never access. Relative entries resolve from the current cwd. */
@@ -223,12 +225,17 @@ export interface ContextProgressBarSettings {
 }
 export interface ApiRetrySettings {
     /**
-     * Total attempts for a retryable LLM request failure, including the first
-     * try. 1 disables retrying. Default: 3.
+     * Attempts before entering sustained recovery, including the first try.
+     * 1 disables Agent-level retries and recovery. Default: 3.
      */
     maxAttempts?: number;
     /** Exponential backoff base in milliseconds. Default: 2000 (2s, 4s, 8s, …). */
     baseDelayMs?: number;
+    /** Maximum jittered retry wait in milliseconds. Default: 30000. */
+    maxDelayMs?: number;
+    /** Extra recovery window after the initial attempts. null waits until
+     * cancellation; 0 disables sustained recovery. Default: null. */
+    recoveryWindowMs?: number | null;
     /**
      * Per-attempt inactivity timeout in milliseconds. `ZTC_LLM_REQUEST_TIMEOUT_MS`
      * (legacy `ZTC_LLM_TIMEOUT_MS`) overrides this when set. Default: 120000.
@@ -242,14 +249,18 @@ export interface MessageDisplaySettings {
     collapseToolCalls?: boolean;
     /** Combine consecutive tool calls into one transcript entry. Default: true. */
     groupToolCalls?: boolean;
-    /** Render provider reasoning messages in the terminal transcript. Default: true. */
+    /** Render provider reasoning messages in the terminal transcript. Default: false. */
     showThinking?: boolean;
+    /** Show elapsed time and model usage beside assistant timestamps. Default: true. */
+    showTurnMetadata?: boolean;
     /**
      * Pace streaming answers instead of painting each arrival as one burst.
-     * Small chunks still show immediately; the reveal keeps a bounded lag and
-     * never delays the finished message. Default: true.
+     * With the reading cap off, small chunks show immediately and completed
+     * answers flush the bounded-lag reveal. Default: true.
      */
     smoothStreaming?: boolean;
+    /** Assistant prose reveal rate; null disables the cap. Default: 9 words/second. */
+    proseReadingRateWordsPerSecond?: number | null;
 }
 /** How conversation history is compacted when the context fills up. */
 export type CompactionMethod = 'summary' | 'jev';
@@ -296,7 +307,16 @@ export interface CompactionSettings {
     method?: CompactionMethod;
     jev?: JevCompactionSettings;
 }
+export interface TerminalInteractionSettings {
+    mouseCapture?: boolean;
+    /** Number of lines per wheel event, from 1 through 20. */
+    wheelScrollLines?: number;
+}
 export interface ZTCConfig {
+    /** Presence creates a guarded remote session with required, host-managed leases. */
+    remoteResources?: import('../agent/runtime/remote_resources.js').RemoteResource[];
+    /** Number of unowned, unnamed sessions retained per workspace. Null/absent disables automatic pruning. */
+    sessionRetentionCount?: number | null;
     /** Marks the one-time replacement of pre-preset settings in this profile. */
     settingsDefaultsVersion?: number;
     /** Configurable terminal status line fields, ordering, separator, and colors. */
@@ -315,6 +335,11 @@ export interface ZTCConfig {
     hostedThreadInstructions?: string;
     /** ZergRouter-only fallback plan. Direct provider backends ignore this. */
     zrouterRoutePlan?: ZRouterRoutePlan;
+    /** Explicit hosted native Messages transport; bypasses all provider-key discovery. */
+    nativeAnthropicMessagesRouter?: {
+        baseUrl: string;
+        authToken: string;
+    };
     zergEndpoint?: string;
     emulationId?: string;
     spinnerVerbs?: string[];
@@ -329,6 +354,8 @@ export interface ZTCConfig {
     execution?: import('./execution.js').ExecutionSettings;
     /** Terminal transcript density and reasoning visibility. */
     messageDisplay?: MessageDisplaySettings;
+    /** Native terminal mouse capture and wheel scrolling preferences. */
+    terminalInteraction?: TerminalInteractionSettings;
     /** Context compaction strategy (summarize, or Jev delete-only). */
     compaction?: CompactionSettings;
     /**

package/dist/config.d.ts

@@ -1,4 +1,7 @@
-import { ZTCConfig, ZTCAuthCredentials, ApiEnvironment, ZTCAuthMode, ZTCConfigScope, CompactionTriggerMode, OpenAICompatibleSettings, ZTCPermissionProfile, IntentLayerSettings, ContextProgressBarSettings, CodexReasoningEffort, WorkflowSettings, Account, AccountRotation } from './config/types.js';
+import { type ReasoningWireSurface } from '@zerg/model-contracts';
+import { type RouterCatalog, type RouterCatalogConnection } from './utils/router_catalog.js';
+import type { ReasoningContract } from './utils/reasoning.js';
+import { ZTCConfig, ZTCAuthCredentials, ApiEnvironment, ZTCAuthMode, ZTCConfigScope, CompactionTriggerMode, OpenAICompatibleSettings, ZTCPermissionProfile, IntentLayerSettings, ContextProgressBarSettings, CodexReasoningEffort, WorkflowSettings, Account, AccountRotation, type TerminalInteractionSettings } from './config/types.js';
 import type { AuthContext, ResolvedLLMConfig } from './config/resolved.js';
 /** Validate and normalize an OpenAI-compatible inference destination. */
 export declare function compatEndpoint(value: string, options?: {
@@ -8,12 +11,20 @@ export declare function normalizeAuthMode(value: string | undefined): ZTCAuthMod
 export declare function resolveAuthMode(config: Pick<ZTCConfig, 'authMode'>): ZTCAuthMode;
 export declare const DEFAULT_PERMISSION_PROFILES: Record<string, ZTCPermissionProfile>;
 export declare const DEFAULT_CONTEXT_PROGRESS_BAR: ContextProgressBarSettings;
+export declare const DEFAULT_TERMINAL_INTERACTION: Required<TerminalInteractionSettings>;
+export declare function resolveTerminalInteractionSettings(value: unknown): Required<TerminalInteractionSettings>;
 export declare function build_default_config(): ZTCConfig;
 export declare function shouldRefreshSuperuserStatus(env?: NodeJS.ProcessEnv): boolean;
 export declare class ConfigStore {
     private config;
     private profileEmulation;
     private legacyApiKeyFromEnvironment;
+    /**
+     * Whether the routing in `this.config` came from a saved file or an explicit
+     * choice, rather than the built-in default. A config-less process that never
+     * picked a route must not hard-fail on the preset Router route it inherited.
+     */
+    private routingIsConfigured;
     private routerCredentials;
     private routerCredentialsError;
     private routerFallbackWarning;
@@ -21,6 +32,7 @@ export declare class ConfigStore {
     private configScope;
     /** Session-local overrides. Never persisted to config.json. */
     private sessionOverrides;
+    private restoredSessionSelection;
     /** CLI-only overrides. Never persisted to config.json. */
     private cliOverrides;
     /**
@@ -35,6 +47,10 @@ export declare class ConfigStore {
     private applyEnvOverrides;
     load(force?: boolean): Promise<ZTCConfig>;
     refresh(): Promise<void>;
+    /** Copy saved settings and Router credentials, then activate them transactionally.
+     * Account registrations retain their credential paths; account homes are not cloned.
+     */
+    duplicateProfile(requestedName: string, source?: string, activate?: () => void | Promise<void>): Promise<string>;
     /** Load a profile in this process; restore the old view if runtime activation fails. */
     switchProfile(name: string, activate: () => void | Promise<void>): Promise<void>;
     save(): Promise<void>;
@@ -54,6 +70,7 @@ export declare class ConfigStore {
     setConfigScope(scope: ZTCConfigScope): void;
     clearSessionOverrides(): void;
     withConfigScope<T>(scope: ZTCConfigScope, fn: () => T | Promise<T>): Promise<T>;
+    private releaseRestoredSelection;
     set<K extends keyof ZTCConfig>(key: K, value: ZTCConfig[K]): void;
     setGlobal<K extends keyof ZTCConfig>(key: K, value: ZTCConfig[K]): void;
     setAll(next: Partial<ZTCConfig>): void;
@@ -68,7 +85,7 @@ export declare class ConfigStore {
      * `undefined` removes the override instead of shadowing the saved value with
      * an explicit undefined, so the configured setting applies again.
      */
-    setCliOverride<K extends keyof Pick<ZTCConfig, 'provider' | 'model' | 'codexEffort'>>(key: K, value: Pick<ZTCConfig, 'provider' | 'model' | 'codexEffort'>[K]): void;
+    setCliOverride<K extends keyof Pick<ZTCConfig, 'provider' | 'model' | 'codexEffort' | 'authMode' | 'zergProxyUrl'>>(key: K, value: Pick<ZTCConfig, 'provider' | 'model' | 'codexEffort' | 'authMode' | 'zergProxyUrl'>[K] | undefined): void;
     getProvider(): string;
     setProvider(provider: string): void;
     /** All registered accounts (empty when no pool is configured). */
@@ -110,7 +127,10 @@ export declare class ConfigStore {
      * Effective Codex effort for the active (or given) provider/model. Priority:
      * per-model > per-provider > global. Defaults to the current provider/model.
      */
+    getReasoningWireSurface(provider?: string, model?: string): ReasoningWireSurface;
     getCodexEffort(provider?: string, model?: string): CodexReasoningEffort | undefined;
+    /** The active transport owns the model's choices, aliases and advertised default. */
+    getReasoningContract(provider?: string, model?: string): ReasoningContract;
     /** Saved effort the active (or given) model rejects; undefined when it applies. */
     getUnsupportedCodexEffort(provider?: string, model?: string): CodexReasoningEffort | undefined;
     /** Effort chosen by a startup `--effort` flag for this process (= none when unset). */
@@ -165,6 +185,21 @@ export declare class ConfigStore {
      * getters stay — they are still used widely.
      */
     getAuthContext(): AuthContext;
+    restoreSessionSelection(metadata: {
+        provider: string;
+        model: string;
+        authMode?: ZTCAuthMode;
+        routerOrigin?: string;
+        configProfile?: string;
+    }): void;
+    getRouterCatalogConnection(destination?: string | undefined): RouterCatalogConnection | undefined;
+    /** New children use configured routing, not a parent's restored inference route. */
+    getChildAuthMode(): ZTCAuthMode;
+    adoptRouterCatalog(catalog: RouterCatalog): Promise<void>;
+    getRouterCatalog(): RouterCatalog | undefined;
+    getResolvedAuthMode(): ZTCAuthMode;
+    getRoutedModelCatalog(): RouterCatalog | undefined;
+    getModelContextWindow(model?: string, provider?: string): number | null | undefined;
     /**
      * Resolve everything a backend factory needs into one struct. Folds in the
      * provider/model override precedence, the direct-key precedence
@@ -179,8 +214,7 @@ export declare class ConfigStore {
      *
      * Reads through `get()` and the env-aware getters (never raw `this.config`)
      * so cli/session overrides stay honored. `apiKey` is the DIRECT provider key;
-     * `authToken`/`useProxy` describe the proxy route separately, so a caller can
-     * still prefer a direct key (e.g. Gemini) over the proxy.
+     * `authToken`/`useProxy` describe the selected proxy route separately.
      */
     resolveLLMBackendConfig(opts?: {
         provider?: string;