agent-from-zero 0.34.2 → 0.35.0

package/dist/auto.js

@@ -0,0 +1,295 @@
+import { randomUUID } from "node:crypto";
+import { ruleHistory, startupRemotes } from "./auto-context.js";
+import { decideRules, screenRules, RULE_ROUTING_VERSION, JEV_CLEAR_RULE_MAX, RULE_POLICY_VERSION } from "./auto-review.js";
+import { CONFIG } from "./config.js";
+import { emit } from "./telemetry.js";
+import { beginReviewDebug, reviewDebugPath } from "./auto-debug.js";
+import { decideReview, needsAuthorizationReview } from "./auto-review.js";
+import { jevReviewer, modelReviewer, modelRuleReviewer, jevRuleReviewer, parseJevAssessment, parseModelAssessment, ReviewProviderUnavailable } from "./auto-providers.js";
+const TIMEOUT_MS = 30_000;
+const MAX_STATE_BYTES = 24_000;
+// Sizes behind the two known cliffs, recorded on every verdict: stateBytes over
+// MAX_STATE_BYTES forces a human prompt, and omittedActions > 0 disables the Jev
+// fast pass. The parts say WHICH input grew (pasted requests vs. a big write).
+const bytes = (value) => Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+function stateSize(state) {
+    return { stateBytes: bytes(state), requestBytes: bytes(state.userRequests), historyBytes: bytes(state.history.actions),
+        actionBytes: bytes(state.action.args), omittedActions: state.history.omittedActions };
+}
+// Compatibility helpers use the exact same parsers and policy as live review.
+export function interpretAutoOutput(value) {
+    const assessment = parseJevAssessment(value);
+    if (!assessment)
+        return null;
+    const verdict = decideReview(assessment);
+    return { ...verdict, reason: `Jev: ${verdict.reason}` };
+}
+export function interpretModelOutput(text) {
+    const assessment = parseModelAssessment(text);
+    return assessment ? decideReview(assessment) : null;
+}
+// Each provider gets a fresh deadline. A Jev timeout must not hand an already
+// aborted signal to the fallback; a USER cancellation must abort both paths.
+async function withDeadline(signal, run) {
+    signal.throwIfAborted();
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    signal.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(abort, TIMEOUT_MS);
+    try {
+        const result = await run(controller.signal);
+        controller.signal.throwIfAborted();
+        return result;
+    }
+    finally {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", abort);
+    }
+}
+export class AutoMode {
+    enabled;
+    policy;
+    ruleModel;
+    ruleJev;
+    workingDirectory = process.cwd();
+    remotes = startupRemotes(this.workingDirectory);
+    errors = 0;
+    requests = [];
+    apiKey;
+    jev;
+    model;
+    projectInstructions;
+    jevFailed = false; // sticky failover: do not retry an exhausted key on every tool
+    constructor(client, options = {}) {
+        this.enabled = CONFIG.autoMode.enabled && !CONFIG.bypassPermissions;
+        this.policy = options.policy ?? CONFIG.autoMode.policy;
+        this.ruleModel = client ? modelRuleReviewer(client, () => CONFIG.judge.model || CONFIG.model) : undefined;
+        this.apiKey = options.apiKey ?? (process.env.JEV_API_KEY?.trim() || process.env.TYPESAFE_API_KEY?.trim() || "");
+        this.ruleJev = this.apiKey ? jevRuleReviewer(this.apiKey, () => CONFIG.autoMode.model, options.request ?? fetch) : undefined;
+        this.jev = this.apiKey ? jevReviewer(this.apiKey, () => CONFIG.autoMode.model, options.request ?? fetch) : undefined;
+        this.model = client ? modelReviewer(client, () => CONFIG.judge.model || CONFIG.model) : undefined;
+        this.projectInstructions = options.projectInstructions ?? "";
+    }
+    // Resolve the fallback model at call time: /model changes must take effect
+    // when no explicit judge.model was configured. Its client/baseURL/key always
+    // come from the same vendor as the main agent.
+    get useJev() { return !!this.apiKey && !this.jevFailed; }
+    get backend() { return this.policy === "rules" ? `${this.useJev ? "Jev screen → " : ""}rule reviewer (${CONFIG.judge.model || CONFIG.model})` : this.useJev ? `Jev (${CONFIG.autoMode.model})` : `model judge (${CONFIG.judge.model || CONFIG.model})`; }
+    startupNotices() {
+        if (CONFIG.bypassPermissions)
+            return [this.status()];
+        if (this.policy === "rules")
+            return [this.status(), this.useJev ? "Rules preview: Jev screens first; flagged or uncertain actions receive one model review." : "Tip: set JEV_API_KEY (or TYPESAFE_API_KEY) for Jev screening; currently using the model reviewer.", ...(reviewDebugPath() ? [`Review debug log: ${reviewDebugPath()}`] : [])];
+        return [
+            this.status(),
+            ...(reviewDebugPath() ? [`Review debug log: ${reviewDebugPath()} (local conversation/tool data; credentials redacted).`] : []),
+            ...(!this.apiKey ? ["Tip: mini-agent supports Jev for permission review. Set JEV_API_KEY (or TYPESAFE_API_KEY) to use it automatically; otherwise /auto uses your current vendor (judge.model overrides the model)."] : []),
+        ];
+    }
+    // Called ONLY at human input boundaries (text or submitted form answers),
+    // before @files, hooks, skills or
+    // summaries are appended. Never infer provenance from role:"user": that role
+    // also carries model-written summaries and teammate notifications here.
+    recordRequest(text) {
+        if (text.trim())
+            this.requests.push(text);
+    }
+    snapshot() { return [...this.requests]; }
+    clearRequests() { this.requests = []; }
+    toggle() {
+        if (CONFIG.bypassPermissions)
+            return this.status(); // CLI bypass lasts until exit
+        this.enabled = !this.enabled;
+        this.errors = 0;
+        this.jevFailed = false;
+        return this.status();
+    }
+    status() {
+        if (CONFIG.bypassPermissions)
+            return "(bypassPermissions — approvals and AI review skipped for this run; hard denies, plan restrictions and hooks still apply)";
+        return `(auto mode ${this.enabled ? "ON" : "OFF"} — ${this.backend}; ${this.enabled ? "uncertain or risky actions require approval" : "use /auto to enable"})`;
+    }
+    async classify(tool, argsJson, userRequests, signal, options = {}) {
+        if (this.policy === "rules")
+            return this.classifyRules(tool, argsJson, userRequests, signal, options);
+        // One ID per review joins the debug log, this verdict event and the human's
+        // later decision in loop.ts — the join that turns logs into labeled data.
+        const reviewId = randomUUID();
+        const started = Date.now();
+        const measured = {};
+        const finish = (verdict, fields = {}) => {
+            emit("agent_auto_verdict", { reviewId, policy: "scores", tool, verdict: verdict.decision, ...measured, ...fields, durationMs: Date.now() - started });
+            return { ...verdict, reviewId };
+        };
+        const ask = (reason) => finish({ decision: "ask", reason }, { outcome: "precondition" });
+        if (!this.jev && !this.model)
+            return ask("Model judge unavailable; manual approval required");
+        if (this.errors >= 3)
+            return ask("Auto review disabled after 3 consecutive failures; manual approval required (toggle /auto off and on to retry)");
+        if (signal.aborted)
+            return ask("Auto review interrupted");
+        if (!userRequests.length)
+            return ask("Auto review needs a fresh user request; restored/synthetic messages are not authorization");
+        let args;
+        try {
+            args = JSON.parse(argsJson);
+        }
+        catch {
+            return ask("Invalid tool arguments");
+        }
+        const state = {
+            reviewId, userRequests, projectInstructions: this.projectInstructions,
+            workingDirectory: process.cwd(), deniedBySettings: CONFIG.permissions.deny,
+            history: options.history ?? { actions: [], omittedActions: 0 }, delegatedTask: options.delegatedTask,
+            action: { tool, args, description: options.description },
+        };
+        Object.assign(measured, stateSize(state));
+        // Never silently truncate an action or earlier restrictions to get an allow.
+        if (measured.stateBytes > MAX_STATE_BYTES)
+            return ask("Auto review context is too large; manual approval required");
+        let activeBackend = this.backend;
+        try {
+            let assessment = null;
+            let backend = "model";
+            let priorAssessment = "";
+            if (this.useJev) {
+                try {
+                    assessment = await withDeadline(signal, (reviewSignal) => this.jev.review(state, reviewSignal));
+                    backend = "jev";
+                }
+                catch (error) {
+                    if (signal.aborted || !this.model)
+                        throw error;
+                    if (!this.jevFailed) {
+                        this.jevFailed = true;
+                        const reason = error instanceof ReviewProviderUnavailable ? error.message : "unavailable or timed out";
+                        options.notify?.(`Tip: Jev ${reason}; falling back to ${this.backend} for this session.`);
+                        emit("agent_auto_fallback", { reason, model: CONFIG.judge.model || CONFIG.model });
+                    }
+                }
+            }
+            // Distinguish an uncertain authorization from a refusal. This one-shot
+            // second stage uses the same state/policy, independently judges BOTH
+            // dimensions, and never changes the session's preferred backend.
+            if (assessment && this.model && needsAuthorizationReview(assessment)) {
+                signal.throwIfAborted();
+                priorAssessment = `Jev authorization=${assessment.authorized}, risk=${assessment.risky} → `;
+                activeBackend = `model judge (${CONFIG.judge.model || CONFIG.model})`;
+                const debug = beginReviewDebug("authorization-review", { state, jevAssessment: assessment, reviewer: activeBackend }, [this.apiKey], reviewId);
+                emit("agent_auto_authorization_review", { tool, model: CONFIG.judge.model || CONFIG.model });
+                try {
+                    assessment = await withDeadline(signal, (reviewSignal) => this.model.review(state, reviewSignal));
+                    debug("assessment", { assessment, verdict: decideReview(assessment) });
+                    backend = "model";
+                }
+                catch (error) {
+                    debug("error", { error: error instanceof Error ? error.message : String(error) });
+                    throw error;
+                }
+            }
+            if (!assessment) {
+                activeBackend = `model judge (${CONFIG.judge.model || CONFIG.model})`;
+                assessment = await withDeadline(signal, (reviewSignal) => this.model.review(state, reviewSignal));
+            }
+            const verdict = decideReview(assessment);
+            verdict.reason = `${priorAssessment}${backend === "jev" ? "Jev" : activeBackend}: ${verdict.reason}`;
+            if (signal.aborted)
+                return ask("Auto review interrupted");
+            this.errors = 0;
+            return finish(verdict, { outcome: "reviewed", backend,
+                model: backend === "jev" ? CONFIG.autoMode.model : CONFIG.judge.model || CONFIG.model,
+                authorization: typeof assessment.authorized === "number" ? assessment.authorized : String(assessment.authorized),
+                risk: typeof assessment.risky === "number" ? assessment.risky : String(assessment.risky) });
+        }
+        catch {
+            if (!signal.aborted)
+                this.errors++;
+            emit("agent_auto_unavailable", { tool, disabled: Number(this.errors >= 3) });
+            return finish({ decision: "ask", reason: `${activeBackend} unavailable, timed out or returned an invalid response; manual approval required` }, { outcome: "unavailable" });
+        }
+    }
+    async classifyRules(tool, argsJson, userRequests, signal, options) {
+        const reviewId = randomUUID();
+        const policyVersion = RULE_POLICY_VERSION;
+        let backend = "model";
+        const debug = beginReviewDebug("rules", { reviewId, policyVersion, routingVersion: RULE_ROUTING_VERSION, cutoff: JEV_CLEAR_RULE_MAX, tool }, [this.apiKey], reviewId);
+        const started = Date.now();
+        const measured = {};
+        let route = "none"; // how the review was routed: jev_allow, jev_flagged, history_truncated, jev_unavailable, no_jev
+        const finish = (verdict) => {
+            debug("verdict", { policyVersion, routingVersion: RULE_ROUTING_VERSION, backend, verdict });
+            emit("agent_auto_verdict", { reviewId, policy: "rules", policyVersion, tool, backend, model: backend === "jev" ? CONFIG.autoMode.model : CONFIG.judge.model || CONFIG.model, verdict: verdict.decision, rules: (verdict.ruleIds ?? []).join(","), route, ...measured, durationMs: Date.now() - started });
+            return { ...verdict, reviewId, reason: `${backend === "jev" ? "Jev" : `rule reviewer (${CONFIG.judge.model || CONFIG.model})`}: ${verdict.reason}` };
+        };
+        const ask = (reason) => finish({ decision: "ask", ruleIds: [], reason });
+        if (signal.aborted)
+            return ask("Review interrupted");
+        if (!this.ruleModel)
+            return ask("Model reviewer unavailable; Jev scores cannot replace rule review");
+        if (this.errors >= 3)
+            return ask("Review disabled after 3 failures; toggle /auto to retry");
+        if (!userRequests.length)
+            return ask("A genuine human request is required");
+        let args;
+        try {
+            args = JSON.parse(argsJson);
+        }
+        catch {
+            return ask("Invalid tool arguments");
+        }
+        const state = {
+            reviewId, policyVersion, userRequests, projectInstructions: this.projectInstructions,
+            workingDirectory: this.workingDirectory, startupRemotes: this.remotes, deniedBySettings: [...CONFIG.permissions.deny],
+            history: ruleHistory(options.history ?? { actions: [], omittedActions: 0 }), delegatedTask: options.delegatedTask,
+            action: { tool, args, description: tool === "run_bash" || tool === "run_bash_background" ? "Execute the supplied shell command." : options.description },
+        };
+        Object.assign(measured, stateSize(state));
+        if (measured.stateBytes > MAX_STATE_BYTES)
+            return ask("Review context too large; no evidence was silently truncated");
+        try {
+            if (this.useJev && this.ruleJev) {
+                try {
+                    const screening = await withDeadline(signal, (s) => this.ruleJev.review(state, s));
+                    signal.throwIfAborted();
+                    const routing = screenRules(screening, state.history);
+                    debug("routing", { routingVersion: RULE_ROUTING_VERSION, cutoff: JEV_CLEAR_RULE_MAX, ...routing });
+                    route = routing.route === "allow" ? "jev_allow" : state.history.omittedActions > 0 ? "history_truncated" : "jev_flagged";
+                    if (routing.route === "allow") {
+                        this.errors = 0;
+                        backend = "jev";
+                        return finish({ decision: "allow", ruleIds: [], reason: routing.reason });
+                    }
+                }
+                catch (error) {
+                    if (signal.aborted)
+                        throw error;
+                    if (!this.jevFailed) {
+                        this.jevFailed = true;
+                        const reason = error instanceof ReviewProviderUnavailable ? error.message : "unavailable or timed out";
+                        options.notify?.(`Tip: Jev ${reason}; falling back to ${this.backend} for this session.`);
+                        emit("agent_auto_fallback", { reason, model: CONFIG.judge.model || CONFIG.model });
+                    }
+                    debug("routing", { routingVersion: RULE_ROUTING_VERSION, route: "review", reason: "Jev unavailable" });
+                    route = "jev_unavailable";
+                }
+            }
+            else {
+                route = "no_jev";
+                debug("routing", { routingVersion: RULE_ROUTING_VERSION, route: "review", reason: this.jevFailed ? "Jev disabled after failure" : "No Jev key" });
+            }
+            // Same state, without first-stage scores. A suspicion is not a confirmed
+            // rule match; the reasoning model evaluates the evidence independently.
+            const assessment = await withDeadline(signal, (s) => this.ruleModel.review(state, s));
+            if (signal.aborted)
+                return ask("Review interrupted");
+            this.errors = 0;
+            return finish(decideRules(assessment));
+        }
+        catch (error) {
+            debug("error", { error: error instanceof Error ? error.message : String(error) });
+            if (!signal.aborted)
+                this.errors++;
+            return ask(signal.aborted ? "Review interrupted" : "Model reviewer unavailable, timed out or returned invalid rules");
+        }
+    }
+}

package/dist/background.js

@@ -17,6 +17,7 @@
 // as events while the main loop runs. There is no shared-memory race to guard,
 // so the whole "daemon thread + mutex" dance collapses into plain callbacks.
 import { spawn } from "node:child_process";
+import { childEnv } from "./auto-debug.js";
 const tasks = new Map(); // id → task, for the whole session
 let seq = 0; // increments per task — seeds the id
 const OUTPUT_CAP = 80_000; // chars of output retained per task (keep the tail)
@@ -38,7 +39,7 @@ function append(task, chunk) {
 // to survive into later turns; only killAll, on session exit, stops them).
 export function startBackground(command) {
     const id = `bg_${++seq}`;
-    const child = spawn(command, { shell: true, stdio: ["ignore", "pipe", "pipe"] }); // shell:true → bash semantics, same as run_bash
+    const child = spawn(command, { shell: true, stdio: ["ignore", "pipe", "pipe"], env: childEnv() }); // shell:true → bash semantics, same as run_bash
     const task = {
         id,
         command,

package/dist/cli.js

@@ -0,0 +1,83 @@
+import { parseArgs } from "node:util";
+import { CONFIG } from "./config.js";
+import { effortMenu, setEffort } from "./effort.js";
+export class CliUsageError extends Error {
+}
+// -p is a mode, not a boundary after which flags turn into task text. Node's
+// parser handles --option=value and the -- delimiter without another dependency.
+export function parseCli(args) {
+    const exec = args[0] === "exec";
+    let parsed;
+    try {
+        parsed = parseArgs({ args: exec ? args.slice(1) : args, strict: true, allowPositionals: true, options: {
+                print: { type: "boolean", short: "p" },
+                prompt: { type: "string" },
+                model: { type: "string" },
+                effort: { type: "string" },
+                auto: { type: "boolean" },
+                "permission-mode": { type: "string" },
+                "dangerously-skip-permissions": { type: "boolean" },
+                resume: { type: "boolean", short: "r" },
+                help: { type: "boolean", short: "h" },
+                version: { type: "boolean", short: "v" },
+                "output-format": { type: "string" },
+            } });
+    }
+    catch (error) {
+        throw new CliUsageError(error.message);
+    }
+    const { values, positionals } = parsed;
+    const print = exec || values.print === true;
+    const requestedMode = values["permission-mode"];
+    if (requestedMode !== undefined && requestedMode !== "default" && requestedMode !== "auto" && requestedMode !== "bypassPermissions") {
+        throw new CliUsageError("--permission-mode must be default, auto, or bypassPermissions");
+    }
+    // Match Claude's precedence: the explicit skip flag wins over a mode flag.
+    const permissionMode = values["dangerously-skip-permissions"] ? "bypassPermissions" : requestedMode;
+    const outputFormat = values["output-format"] ?? "text";
+    if (outputFormat !== "text" && outputFormat !== "json")
+        throw new CliUsageError("--output-format must be text or json");
+    for (const flag of ["model", "effort", "prompt"]) {
+        if (typeof values[flag] === "string" && !values[flag].trim())
+            throw new CliUsageError(`--${flag} cannot be empty`);
+    }
+    if (values.prompt !== undefined && positionals.length)
+        throw new CliUsageError("Use either a positional prompt or --prompt, not both");
+    const prompt = typeof values.prompt === "string" ? values.prompt : positionals.join(" ");
+    if (!print && (prompt || values["output-format"] !== undefined))
+        throw new CliUsageError("Use -p / --print or exec with a prompt or --output-format");
+    return { print, prompt, outputFormat, permissionMode, model: typeof values.model === "string" ? values.model : undefined,
+        effort: typeof values.effort === "string" ? values.effort : undefined, auto: values.auto === true,
+        resume: values.resume === true, help: values.help === true, version: values.version === true };
+}
+// CLI overrides live only in this process; never save them to user settings.
+// Validate against the selected model/endpoint before any request is started.
+export function applyCliOptions(options) {
+    const model = options.model ?? CONFIG.model;
+    if (options.effort !== undefined && options.effort !== "default") {
+        const menu = effortMenu(model);
+        if (!menu.values.includes(options.effort))
+            throw new CliUsageError(menu.values.length
+                ? `Unsupported effort '${options.effort}' for ${model}. Choose: ${menu.values.join(", ")}` : menu.header);
+    }
+    CONFIG.model = model;
+    if (options.effort !== undefined)
+        setEffort(model, options.effort);
+    CONFIG.bypassPermissions = options.permissionMode === "bypassPermissions";
+    if (options.permissionMode !== undefined)
+        CONFIG.autoMode.enabled = options.permissionMode === "auto";
+    else if (options.auto)
+        CONFIG.autoMode.enabled = true;
+}
+// Match print-mode pipe composition: the instruction first, followed by stdin.
+// Wait for EOF so slow producers aren't silently truncated. Never read a TTY.
+export async function readPrintPrompt(prompt, input, isTTY) {
+    const chunks = [];
+    if (!isTTY)
+        for await (const chunk of input)
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    const text = [prompt, Buffer.concat(chunks).toString("utf8")].filter(Boolean).join("\n");
+    if (!text.trim())
+        throw new CliUsageError('Provide a prompt: mini-agent -p "<task>" or pipe text into mini-agent -p');
+    return text;
+}

package/dist/clipboard.js

@@ -0,0 +1,88 @@
+import { execFile } from "node:child_process";
+// Bound native helpers independently of the attachment limit. Always argv,
+// never a shell command containing clipboard text, paths or user input.
+const nativeCommand = (program, args) => new Promise((resolve, reject) => {
+    execFile(program, [...args], { encoding: "buffer", timeout: 8000, maxBuffer: 12 * 1024 * 1024 }, (error, stdout) => {
+        if (error)
+            reject(new Error(`Clipboard helper ${program} failed. Check clipboard access and that the helper is installed.`));
+        else
+            resolve(stdout);
+    });
+});
+function decodeNative(data) {
+    const value = JSON.parse(data.toString("utf8"));
+    if (typeof value.image === "string" && value.image)
+        return { image: Buffer.from(value.image, "base64") };
+    return { text: typeof value.text === "string" ? value.text : "" };
+}
+const MAC_SCRIPT = `ObjC.import('AppKit');
+var board = $.NSPasteboard.generalPasteboard;
+if (board.isNil()) throw Error('Clipboard is unavailable');
+var data = board.dataForType('public.png');
+if (data.isNil()) {
+  var tiff = board.dataForType('public.tiff');
+  if (!tiff.isNil()) {
+    var bitmap = $.NSBitmapImageRep.alloc.initWithData(tiff);
+    if (!bitmap.isNil()) data = bitmap.representationUsingTypeProperties($.NSPNGFileType, $.NSDictionary.dictionary);
+  }
+}
+if (!data.isNil()) {
+  if (Number(data.length) > 5 * 1024 * 1024) throw Error('Image exceeds 5 MB');
+  JSON.stringify({image: ObjC.unwrap(data.base64EncodedStringWithOptions(0))});
+} else {
+  var text = board.stringForType('public.utf8-plain-text');
+  JSON.stringify({text: text.isNil() ? '' : ObjC.unwrap(text)});
+}`;
+const WINDOWS_SCRIPT = `$ErrorActionPreference = 'Stop'
+Add-Type -AssemblyName System.Windows.Forms
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+if ([System.Windows.Forms.Clipboard]::ContainsImage()) {
+  $image = [System.Windows.Forms.Clipboard]::GetImage()
+  $buffer = New-Object System.IO.MemoryStream
+  try {
+    $image.Save($buffer, [System.Drawing.Imaging.ImageFormat]::Png)
+    if ($buffer.Length -gt 5MB) { throw 'Image exceeds 5 MB' }
+    @{ image = [Convert]::ToBase64String($buffer.ToArray()) } | ConvertTo-Json -Compress
+  } finally { $buffer.Dispose(); $image.Dispose() }
+} else {
+  @{ text = [System.Windows.Forms.Clipboard]::GetText() } | ConvertTo-Json -Compress
+}`;
+class MacClipboard {
+    run;
+    constructor(run) {
+        this.run = run;
+    }
+    async read() { return decodeNative(await this.run("osascript", ["-l", "JavaScript", "-e", MAC_SCRIPT])); }
+}
+class WindowsClipboard {
+    run;
+    constructor(run) {
+        this.run = run;
+    }
+    async read() { return decodeNative(await this.run("powershell.exe", ["-NoProfile", "-NonInteractive", "-STA", "-Command", WINDOWS_SCRIPT])); }
+}
+class LinuxClipboard {
+    run;
+    wayland;
+    constructor(run, wayland) {
+        this.run = run;
+        this.wayland = wayland;
+    }
+    async read() {
+        const program = this.wayland ? "wl-paste" : "xclip";
+        const types = (await this.run(program, this.wayland ? ["--list-types"] : ["-selection", "clipboard", "-o", "-t", "TARGETS"])).toString("utf8").split(/\r?\n/);
+        const imageType = ["image/png", "image/jpeg", "image/webp", "image/gif"].find((type) => types.includes(type));
+        const type = imageType ?? (this.wayland ? "text" : "UTF8_STRING");
+        const data = await this.run(program, this.wayland ? ["--no-newline", "--type", type] : ["-selection", "clipboard", "-o", "-t", type]);
+        return imageType ? { image: data } : { text: data.toString("utf8") };
+    }
+}
+export function systemClipboard(platform = process.platform, env = process.env, run = nativeCommand) {
+    if (platform === "darwin")
+        return new MacClipboard(run);
+    if (platform === "win32")
+        return new WindowsClipboard(run);
+    if (platform === "linux")
+        return new LinuxClipboard(run, !!env.WAYLAND_DISPLAY);
+    return { read: async () => { throw new Error(`Clipboard paste is not supported on ${platform}.`); } };
+}

package/dist/completion.js

@@ -0,0 +1,65 @@
+import { effortMenu } from "./effort.js";
+export const COMMANDS = [
+    { value: "/model", description: "Switch the model for this session", children: true },
+    { value: "/effort", description: "Choose this model's reasoning effort", children: true },
+    { value: "/skills", description: "Browse and run available skills", children: true },
+    { value: "/skill", description: "Run a skill by name", children: true },
+    { value: "/help", description: "Show commands and keyboard shortcuts" },
+    { value: "/clear", description: "Start a fresh conversation" },
+    { value: "/compact", description: "Summarize conversation history" },
+    { value: "/stats", description: "Show session event counts" },
+    { value: "/memory", description: "Show remembered project facts" },
+    { value: "/status", description: "Show session usage and account balance/cost", children: true },
+    { value: "/cost", description: "Show tokens and estimated cost" },
+    { value: "/mcp", description: "Manage MCP servers", children: true },
+    { value: "/plan", description: "Toggle plan mode" },
+    { value: "/auto", description: "Toggle automatic permission review", children: true },
+    { value: "/todos", description: "Show the current task plan" },
+    { value: "/bg", description: "Show background tasks" },
+    { value: "/team", description: "Show teammates and status" },
+    { value: "/tasks", description: "Show the shared task board" },
+    { value: "/cron", description: "Show scheduled jobs" },
+    { value: "/undo", description: "Revert the most recent file write" },
+    { value: "/diff", description: "Show file changes this session" },
+    { value: "/resume", description: "Choose a previous session" },
+];
+export function slashCompletions(input, ctx) {
+    if (!input.startsWith("/") || /[\r\n]/.test(input))
+        return null;
+    const [command, ...parts] = input.split(/\s+/);
+    const arg = parts.join(" ").toLowerCase();
+    const filter = (items, prefix = input) => items.filter((item) => item.value.toLowerCase().startsWith(prefix.toLowerCase()));
+    if (command === "/effort") {
+        const menu = effortMenu(ctx.model);
+        return { items: filter(menu.values.map((value, i) => ({ value: `/effort ${value}`, description: menu.labels[i] }))), hint: menu.header };
+    }
+    if (command === "/skills" || command === "/skill") {
+        return { items: ctx.skills.filter((s) => s.name.toLowerCase().startsWith(arg)).map((s) => ({ value: `/skill ${s.name}`, description: s.whenToUse || s.description })), hint: ctx.skills.length ? "Choose a skill to run" : "No skills found in project or user skill directories" };
+    }
+    if (command === "/model") {
+        const save = arg === "save" || arg.startsWith("save ");
+        const prefix = save ? "/model save " : "/model ";
+        const items = [...new Set([ctx.model, ...ctx.models])].sort().map((name) => ({ value: prefix + name, description: name === ctx.model ? "Current model" : "Switch model" }));
+        if (!save)
+            items.push({ value: "/model save", description: "Save a model as your default", children: true });
+        return { items: filter(items, save && arg === "save" ? prefix : input), hint: "Models from your endpoint; you can also type a model name" };
+    }
+    if (command === "/status") {
+        return { items: filter([
+                { value: "/status", description: "Current endpoint account and session usage" },
+                { value: "/status local", description: "Session only; no account API request" },
+                ...["deepseek", "openai", "anthropic"].map((provider) => ({ value: `/status ${provider}`, description: `Query the official ${provider} account with its dedicated credential` })),
+            ], input.trimEnd()) };
+    }
+    if (command === "/auto") {
+        return { items: filter([
+                { value: "/auto", description: "Toggle auto mode" },
+                ...["on", "off", "status"].map((v) => ({ value: `/auto debug ${v}`, description: `${v === "status" ? "Inspect" : v === "on" ? "Enable" : "Disable"} reviewer request logging` })),
+            ], input.trimEnd()) };
+    }
+    if (command === "/mcp") {
+        const items = [{ value: "/mcp", description: "Open MCP server menu" }, ...["reconnect", "auth", "enable", "disable"].flatMap((action) => ctx.servers.map((name) => ({ value: `/mcp ${action} ${name}`, description: `${action} ${name}` })))];
+        return { items: filter(items, input.trimEnd()) };
+    }
+    return { items: filter(COMMANDS), hint: "Commands" };
+}

package/dist/config.js

@@ -52,6 +52,7 @@ export const CONFIG = {
         process.env.DEEPSEEK_API_KEY || // ...over the back-compat one
         "", // empty = missing; requireApiKey() turns that into a helpful error
     model: process.env.MINI_AGENT_MODEL || projectSettings.model || globalSettings.model || "deepseek-chat", // must support function calling
+    effortProfiles: { ...(globalSettings.effortProfiles ?? {}), ...(projectSettings.effortProfiles ?? {}) },
     // Sub-agents (the task tool) can run on a DIFFERENT model than the orchestrator:
     // a cheap/fast one for grunt work (reading many files, broad search), or a
     // strong one as an "advisor" to double-check. undefined → use the main model.
@@ -60,6 +61,8 @@ export const CONFIG = {
         projectSettings.contextWindow || // then files
         globalSettings.contextWindow ||
         1_048_565, // DeepSeek's real window, learned from an actual API error
+    // Explicit CLI opt-in only: never enable unattended bypass from saved settings.
+    bypassPermissions: false,
     permissions: {
         // Both layers apply: global rules + project rules. Mutable on purpose —
         // the test suite injects rules here instead of writing temp files.
@@ -83,6 +86,11 @@ export const CONFIG = {
         enabled: projectSettings.judge?.enabled ?? globalSettings.judge?.enabled ?? false,
         model: projectSettings.judge?.model || globalSettings.judge?.model || undefined, // undefined → use the main model
     },
+    autoMode: {
+        policy: (process.env.MINI_AGENT_AUTO_POLICY ?? projectSettings.autoMode?.policy ?? globalSettings.autoMode?.policy ?? "scores") === "rules" ? "rules" : "scores",
+        enabled: process.env.MINI_AGENT_AUTO_MODE !== undefined ? process.env.MINI_AGENT_AUTO_MODE === "1" : (projectSettings.autoMode?.enabled ?? globalSettings.autoMode?.enabled ?? false),
+        model: projectSettings.autoMode?.model || globalSettings.autoMode?.model || "jev-1.13.0",
+    },
     // Token prices for the /cost estimate (defaults applied in cost.ts). Project
     // overrides global; either may set just the fields it cares about.
     pricing: { ...(globalSettings.pricing ?? {}), ...(projectSettings.pricing ?? {}) },

package/dist/context.js

@@ -1,3 +1,4 @@
+import { effortMessages } from "./effort.js";
 import fs from "node:fs"; // re-reading files from disk during recovery
 import chalk from "chalk"; // status lines
 import { CONFIG } from "./config.js"; // the resolved context window (env > settings files > default)
@@ -23,11 +24,16 @@ export function estimateTokens(text, dense = false) {
 export function estimateHistoryTokens(messages) {
     let total = 0; // running sum
     for (const m of messages) {
-        const content = typeof m.content === "string" ? m.content : JSON.stringify(m.content ?? ""); // content can be structured — serialize it
         const isDense = m.role === "tool"; // tool results are JSON-ish → denser tokens
-        total += estimateTokens(content, isDense) + 8; // +8 per message for role/formatting overhead
+        // Base64 bytes are transport, not text tokens. Image tokenization differs
+        // by model/resolution; reserve a budget per image, then use API usage for
+        // actual accounting and reactive compaction for provider context limits.
+        total += Array.isArray(m.content) ? m.content.reduce((sum, part) => sum + (part.type === "image_url" ? 4096 : estimateTokens(JSON.stringify(part), isDense)), 0) + 8
+            : estimateTokens(m.content ?? "", isDense) + 8;
         if ("tool_calls" in m && m.tool_calls)
             total += estimateTokens(JSON.stringify(m.tool_calls), true); // count the call arguments too
+        if ("reasoning_content" in m && typeof m.reasoning_content === "string")
+            total += estimateTokens(m.reasoning_content);
     }
     return total;
 }
@@ -86,7 +92,7 @@ log = (s) => console.log(s)) {
     log(chalk.magenta(`📦 compacting context (~${before} tokens)...`)); // automatic behavior must be visible
     const res = await client.chat.completions.create({
         model, // same model — no need for a fancier one to summarize
-        messages: [...messages, { role: "user", content: SUMMARY_PROMPT }], // full history + the summary instruction
+        messages: [...effortMessages(model, messages), { role: "user", content: SUMMARY_PROMPT }], // full history + the summary instruction
         // Deliberately NO `tools` parameter: with no tools declared, the API
         // cannot accept a tool call — that is the hard guarantee. The CRITICAL
         // lines in the prompt are the soft second layer of the same defense.

package/dist/cost.js

@@ -79,6 +79,10 @@ export class CostMeter {
     outputTokens() {
         return this.total.output;
     }
+    // Structured values for status cards; callers cannot mutate the meter.
+    snapshot() {
+        return { ...this.total, calls: this.calls, cost: this.cost() };
+    }
     // The /cost report. Estimated, local-only.
     report() {
         const t = this.total;