command-code 1.82.4 → 1.83.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # command-code
 
+## 1.83.0
+
+### Minor Changes
+
+- feat: Planning and Implementation models follow the live model catalog
+- feat: mods get panes, widgets, toasts, hot reload, permission answers, transcript redaction, per-request model routing
+- feat: mods can use `cmd.state` / `cmd.store` / `cmd.clock` / `cmd.model` / `cmd.prompt`, sub-agent types, `/mods`, `cmd mods inspect`, and `--safe-mode`
+- feat: panes host `cmd.ui` input, select, and markdown elements with a keyboard focus model (Alt+↑, Tab, Esc), docking beside the prompt on wide terminals
+- feat: mods can copy to the clipboard with `cmd.ui.copy` and play sounds with `cmd.audio.play` / `cmd.audio.bell`
+- feat: mods can rewrite the model's answer as it streams via `hooks.transformTextDelta` (committed text matches what was shown) and stream a child process's output with `cmd.process.spawn`
+- feat: mods can restyle built-in TUI rows with `cmd.ui.override` (spinner, tool rows, user messages, command output), never the permission prompt
+
+## 1.82.5
+
+### Patch Changes
+
+- feat: credit errors say when your renewal payment is still processing
+
 ## 1.82.4
 
 ### Patch Changes

package/dist/bundled/command-code-knowledge/live-models.ts

@@ -81,7 +81,39 @@ function changedSinceBuild(model: CatalogModelV1): boolean {
 	);
 }
 
-function bucketModels(effective: EffectiveModelCatalog): ModelBuckets {
+export interface LiveModelSessionModel {
+	readonly id: string;
+	// The catalog the session model runs on: the session pin, which may be older than the section's.
+	readonly catalog: EffectiveModelCatalog;
+}
+
+// A row answers to its id and its aliases, as the catalog resolves ids.
+function rowNames(row: CatalogModelV1, id: string): boolean {
+	return row.id === id || row.aliases.includes(id);
+}
+
+// The session model's row from the catalog it runs on, so the section never tells the model a
+// window or effort levels the session is not running on; any other model's row as served.
+interface ServedRowParams {
+	readonly model: CatalogModelV1;
+	readonly sessionModel?: LiveModelSessionModel;
+}
+
+function servedRow(params: ServedRowParams): CatalogModelV1 {
+	const {model, sessionModel} = params;
+	if (!sessionModel || !rowNames(model, sessionModel.id)) return model;
+	return (
+		sessionModel.catalog.catalog.models.find(row =>
+			rowNames(row, sessionModel.id),
+		) ?? model
+	);
+}
+
+function bucketModels(params: {
+	readonly effective: EffectiveModelCatalog;
+	readonly sessionModel?: LiveModelSessionModel;
+}): ModelBuckets {
+	const {effective, sessionModel} = params;
 	const known = listSelectableModelIds({catalog: builtCatalog()});
 	const knownSet = new Set(known);
 	const added: CatalogModelV1[] = [];
@@ -97,11 +129,12 @@ function bucketModels(effective: EffectiveModelCatalog): ModelBuckets {
 			continue;
 		}
 		if (state !== 'selectable') continue;
-		if (!knownSet.has(model.id)) {
-			added.push(model);
+		const row = servedRow({model, sessionModel});
+		if (!knownSet.has(row.id)) {
+			added.push(row);
 			continue;
 		}
-		if (changedSinceBuild(model)) changed.push(model);
+		if (changedSinceBuild(row)) changed.push(row);
 	}
 	// A shipped id the catalog no longer carries at all (no row, no alias), or now marks update
 	// required, is refused by /model and sub-agents too.
@@ -119,6 +152,8 @@ function bucketModels(effective: EffectiveModelCatalog): ModelBuckets {
 
 export interface BuildLiveModelSectionParams {
 	readonly catalog?: EffectiveModelCatalog;
+	// The session's model and its pin, when the pin knows it: that row wins over `catalog`'s.
+	readonly sessionModel?: LiveModelSessionModel;
 }
 
 /**
@@ -132,7 +167,10 @@ export function buildLiveModelSection(
 	const effective =
 		params.catalog ?? getInstalledModelCatalogManager()?.getEffective();
 	if (!effective) return '';
-	const {added, hidden, outdated, changed} = bucketModels(effective);
+	const {added, hidden, outdated, changed} = bucketModels({
+		effective,
+		sessionModel: params.sessionModel,
+	});
 	if (added.length + hidden.length + outdated.length + changed.length === 0)
 		return '';
 	const parts = [
@@ -166,23 +204,42 @@ export function buildLiveModelSection(
 	return parts.join('\n\n');
 }
 
+// One built section, keyed by the inputs it was built from.
+interface LiveModelSectionMemo {
+	readonly catalog: EffectiveModelCatalog;
+	readonly sessionModel: LiveModelSessionModel | undefined;
+	readonly text: string;
+}
+
+function sameSessionModel(
+	left: LiveModelSessionModel | undefined,
+	right: LiveModelSessionModel | undefined,
+): boolean {
+	return left?.id === right?.id && left?.catalog === right?.catalog;
+}
+
 /**
- * The section built once per catalog `getCatalog` answers with. A session hands in its pin when the
- * pin came from the live catalog, else the newest catalog — so every activation (the activate_skill
- * tool, a `/command-code-knowledge` turn, an inline mention) reads the same text until a catalog
- * lands or /model re-pins.
+ * The section built once per catalog and session model `getParams` answers with. A session hands in
+ * its pin when the pin came from the live catalog, else the newest catalog, plus its own model held
+ * to the pin — so every activation (the activate_skill tool, a `/command-code-knowledge` turn, an
+ * inline mention) reads the same text until a catalog lands or /model re-pins.
  */
 export function createLiveModelSectionCache(
-	getCatalog: () => EffectiveModelCatalog | undefined,
+	getParams: () => BuildLiveModelSectionParams,
 ): () => string {
-	let cached:
-		| {readonly catalog: EffectiveModelCatalog; readonly text: string}
-		| undefined;
+	let cached: LiveModelSectionMemo | undefined;
 	return () => {
-		const catalog = getCatalog();
+		const {catalog, sessionModel} = getParams();
 		if (!catalog) return '';
-		if (cached?.catalog !== catalog) {
-			cached = {catalog, text: buildLiveModelSection({catalog})};
+		if (
+			cached?.catalog !== catalog ||
+			!sameSessionModel(cached.sessionModel, sessionModel)
+		) {
+			cached = {
+				catalog,
+				sessionModel,
+				text: buildLiveModelSection({catalog, sessionModel}),
+			};
 		}
 		return cached.text;
 	};

package/dist/bundled/command-code-knowledge/reference/custom-slash-commands.md

@@ -38,6 +38,7 @@ Every built-in command, grouped by area. Aliases are shown in parentheses on the
 | `/unshare`                     | Stop sharing conversation                                                                             |
 | `/exit` (`/quit`)              | Exit Command Code                                                                                     |
 | `/reload`                      | Restart Command Code and resume this session (applies a staged update)                                |
+| `/mods`                        | List loaded [mods](https://commandcode.ai/docs/mods) and panes; `/mods reload [name]` hot-reloads, `/mods open\|close <pane>`     |
 
 ### Context & compaction
 

package/dist/bundled/command-code-knowledge/reference/models.md

@@ -52,10 +52,10 @@ The model catalog — every id `/model`, `--model`, `model:effort` shorthand, an
 | `tencent/hy3-paid` | Tencent Hy3 | 262K | — | $0.14/$0.58 · cache $0.035 | Go and above | sparse-MoE reasoning & agentic tool use |
 | `tencent/hy4-preview` | Tencent Hy4 Preview | 1.05M | low, medium, high | $0.834/$2.501 · cache $0.042 | Go and above | agentic coding & sustained multi-step tool use |
 | `nvidia/nemotron-3-ultra-550b-a55b` | Nemotron 3 Ultra | 1M | — | $0.6/$2.4 · cache $0.12 | Go and above | open reasoning model for long-horizon autonomous agents |
+| `nvidia/nemotron-3.5-super-vl` | Nemotron 3.5 Super VL | 262K | low, medium, high | $0.2/$0.5 · cache $0.04 | Go and above | open vision-language model for coding and documents |
 | `thinkingmachines/inkling` | Inkling | 256K | — | $1/$4.05 · cache $0.17 | Go and above | multimodal MoE reasoning |
 | `thinkingmachines/inkling-small` | Inkling Small | 1M | — | $0.5/$1.2 · cache $0.1 | Go and above | lightweight MoE reasoning at lower cost and latency |
 | `poolside/laguna-s-2.1-free` | Laguna S 2.1 | 256K | — | $0/$0 · cache $0 | Go and above | open-weight agentic coding and long-horizon work |
-| `inclusionai/ling-3.0-flash-sante:free` | Ling 3.0 Flash Sante | 262K | — | $0/$0 · cache $0 | Go and above | health & medicine tuned lightweight-MoE, still strong on code |
 | `inclusionai/ling-3.1-flash` | Ling 3.1 Flash | 262K | low, medium, high | $0.3/$0.9 · cache $0.06 | Go and above | hybrid-reasoning MoE for coding & tool-using agents |
 | `mistral/mistral-large-4` | Mistral Large 4 | 524K | low, medium, high | $1.36/$4.18 · cache $0.14 | Go and above | frontier open-weight multimodal model for coding & analysis |
 ## Stealth
@@ -63,6 +63,7 @@ The model catalog — every id `/model`, `--model`, `model:effort` shorthand, an
 | Id (use EXACTLY this) | Name | Context | Efforts | $/1M in/out · cache read | Min plan | Best for |
 |---|---|---|---|---|---|---|
 | `stealth/glyph-cluster:free` | Glyph Cluster | 256K | low, medium, high, xhigh | $0/$0 · cache $0 | Go and above | stealth reasoning model in early access |
+| `stealth/cat-jam:free` | Cat Jam | 1.05M | low, medium, high, xhigh, max | $0/$0 · cache $0 | Go and above | stealth reasoning model for coding and agentic work |
 ## Anthropic
 
 | Id (use EXACTLY this) | Name | Context | Efforts | $/1M in/out · cache read | Min plan | Best for |
@@ -118,6 +119,7 @@ The model catalog — every id `/model`, `--model`, `model:effort` shorthand, an
 | `meta/muse-spark-1.2-contributor` | Muse Spark 1.2 Contributor | 1.05M | low, medium, high, xhigh | $0.1/$0.2 · cache $0.002 | Go and above | Muse Spark 1.2 at ~95% off |
 | `meta/muse-spark-1.3` | Muse Spark 1.3 | 1.05M | low, medium, high, xhigh, max | $1.25/$4.25 · cache $0.15 | GOAT and above | multimodal reasoning for long-horizon agentic and coding workflows |
 | `meta/muse-spark-1.3-contributor` | Muse Spark 1.3 Contributor | 1.05M | low, medium, high, xhigh | $0.1/$0.2 · cache $0.002 | Go and above | Muse Spark 1.3 at up to 95% off |
+| `meta/muse-spark-open` | Muse Spark Open | 1.05M | low, medium, high | $1.25/$4.25 · cache $0.15 | Go and above | open-weight Muse Spark for coding and agentic workflows |
 | `meta/muse-wonder-1.0` | Muse Wonder | 1.05M | low, medium, high, xhigh | $4/$20 · cache $0.2 | Max | frontier coding, long-running agents and advanced computer use |
 ## xAI
 

package/dist/bundled/command-code-knowledge/reference/product-help.md

@@ -73,6 +73,7 @@
 - /extra: Buy extra usage at API cost, zero markup
 - /update: Update Command Code to the latest version
 - /reload: Restart Command Code and resume this session (applies a staged update)
+- /mods: List loaded mods and panes; /mods reload [name] hot-reloads, /mods open|close <pane>
 - /help: Display help information
 - /exit: Exit Command Code
 - /quit: Exit Command Code (alias of /exit)
@@ -139,6 +140,7 @@
 - --base <branch>: Base branch for a new cloud session
 - --mod <path>: Load a mod file or directory for this session (repeatable)
 - --mod-option <name=value>: Set a mod-declared flag value (repeatable)
+- --safe-mode: Load built-in mods only for this session (no installed mods, no --mod)
 - --skill <path>: Load extra skills from a path (a skill directory or a directory of skills); repeatable
 - --no-skills: Skip skill discovery; paths given via --skill still load
 - --skip-onboarding: Skip taste onboarding (for automated runs)
@@ -329,17 +331,19 @@ Valid model ids (the /model catalog — use these EXACT ids):
 - google/gemini-3.1-flash-lite
 - sakana/fugu-ultra
 - nvidia/nemotron-3-ultra-550b-a55b
+- nvidia/nemotron-3.5-super-vl
 - thinkingmachines/inkling
 - thinkingmachines/inkling-small
 - stealth/glyph-cluster:free
+- stealth/cat-jam:free
 - poolside/laguna-s-2.1-free
-- inclusionai/ling-3.0-flash-sante:free
 - inclusionai/ling-3.1-flash
 - meta/muse-spark-1.1
 - meta/muse-spark-1.2
 - meta/muse-spark-1.2-contributor
 - meta/muse-spark-1.3
 - meta/muse-spark-1.3-contributor
+- meta/muse-spark-open
 - meta/muse-wonder-1.0
 - xai/grok-4.5
 - xai/grok-4.6

package/dist/bundled/mod-builder/SKILL.md

@@ -59,6 +59,7 @@ the job to the seam, then open the matching example file:
 | react to what happens | `cmd.on(event, handler)` | `examples/observe-events.ts` |
 | print custom styled feed rows | `cmd.addRenderer` + `cmd.showEntry` | `examples/custom-entry-renderer.ts` |
 | take configurable options | `cmd.addFlag` + `cmd.getFlag` | `examples/flags-and-options.ts` |
+| rewrite the answer as it streams / stream a process's output | `cmd.hooks({transformTextDelta})` + `cmd.process.spawn` | `examples/stream-filter.ts` |
 | everything at once (a tour) | — | `examples/kitchen-sink.ts` |
 
 ## 3. The one rule: hooks mutate, `on` observes

package/dist/bundled/mod-builder/examples/model-router.ts

@@ -0,0 +1,43 @@
+// Example mod: route requests between models, and call a model yourself.
+//
+// hooks.beforeModelRequest runs at the start of each request's round, so its tools and prompt are
+// built for the model it picks. Returning {model} sends THAT request to another model; the next request goes back to the session's model (use
+// prepareNextTurn to switch for the rest of a run). Here: the first request of each run, which
+// usually just reads the prompt and picks tools, goes to a cheaper model.
+//
+// cmd.model.complete runs one prompt on the session's own client, with no transcript and no
+// tools. It always resolves: {isAnswered: true, text} or {isAnswered: false, reason}.
+
+import type {ModApi} from '@commandcode/harness';
+
+export default function (cmd: ModApi): void {
+	cmd.addFlag('router-model', {
+		type: 'string',
+		description: 'Model for the first request of each run',
+	});
+
+	cmd.hooks({
+		beforeModelRequest: async ({turnNumber}) => {
+			const cheap = cmd.getFlag('router-model');
+			if (turnNumber !== 1 || typeof cheap !== 'string' || !cheap)
+				return undefined;
+			return {model: cheap};
+		},
+	});
+
+	cmd.addCommand({
+		name: 'haiku',
+		description:
+			'Write a haiku about the argument with a one-shot model call',
+		argumentHint: '<topic>',
+		handler: async ({args}) => {
+			const result = await cmd.model.complete({
+				prompt: `Write a haiku about: ${args || 'code review'}`,
+				maxOutputTokens: 200,
+			});
+			if (!result.isAnswered)
+				return {message: `No haiku (${result.reason}).`};
+			return {message: result.text};
+		},
+	});
+}

package/dist/bundled/mod-builder/examples/pane-and-buttons.ts

@@ -0,0 +1,60 @@
+// Example mod: a live pane with buttons, a band above the prompt, and a toast.
+//
+// cmd.ui.pane draws a titled panel the person opens and closes; cmd.ui.widget draws a band of
+// lines around the prompt. Both take a `render` that returns plain data: strings, or elements
+// ({type: 'text' | 'row' | 'box' | 'button' | 'progress' | 'divider'}). Never React components,
+// so the same mod draws in any host.
+//
+// Values a drawing reads live in cmd.state: host-held, so they survive a hot reload, and
+// setting one repaints every widget and pane. While the pane is open, Alt+<hotkey> presses its
+// buttons and Alt+0 closes it.
+
+import type {ModApi} from '@commandcode/harness';
+
+export default function (cmd: ModApi): void {
+	const calls = (): number => cmd.state.get<number>('calls') ?? 0;
+
+	cmd.on('tool_completed', () => {
+		cmd.state.set('calls', calls() + 1);
+	});
+
+	// The band above the prompt: one line, always visible.
+	cmd.ui.widget({
+		placement: 'above-editor',
+		render: () => [
+			{type: 'text', text: `tool calls: ${calls()}`, dim: true},
+		],
+	});
+
+	cmd.ui.pane({
+		id: 'calls',
+		title: 'Tool calls',
+		render: () => [
+			{type: 'progress', label: 'budget', value: calls() / 50, width: 20},
+			{
+				type: 'row',
+				children: [
+					{type: 'text', text: `${calls()} of 50`, bold: true},
+					{
+						type: 'button',
+						label: 'Reset',
+						hotkey: 'r',
+						onPress: () => {
+							cmd.state.set('calls', 0);
+							cmd.ui.toast('Counter reset', {level: 'success'});
+						},
+					},
+				],
+			},
+		],
+	});
+
+	// /calls opens the pane.
+	cmd.addCommand({
+		name: 'calls',
+		description: 'Show the tool-call counter pane',
+		handler: () => {
+			cmd.ui.openPane('calls');
+		},
+	});
+}

package/dist/bundled/mod-builder/examples/pane-form.ts

@@ -0,0 +1,68 @@
+// Example mod: a small form in a pane, with a text input, a select, markdown, and a button.
+//
+// `input` and `select` elements only take keys while their pane has focus: `/standup` opens the
+// pane with focus (dialog-like), and Alt+↑ focuses the newest open pane from the prompt. While
+// focused, Tab walks the fields, ←/→ choose an option, Enter submits or picks, and Esc goes
+// back to the prompt. Typing never reaches a pane that does not have focus.
+//
+// The values live in cmd.state, so they survive a hot reload and setting one repaints the pane.
+
+import type {ModApi} from '@commandcode/harness';
+
+const MOODS = [
+	{label: 'Great', value: 'great'},
+	{label: 'Okay', value: 'okay'},
+	{label: 'Blocked', value: 'blocked'},
+] as const;
+
+export default function (cmd: ModApi): void {
+	const note = (): string => cmd.state.get<string>('note') ?? '';
+	const mood = (): string => cmd.state.get<string>('mood') ?? 'okay';
+
+	cmd.ui.pane({
+		id: 'standup',
+		title: 'Standup',
+		render: () => [
+			{
+				type: 'markdown',
+				text: '**Today**: one line, then pick how it is going.',
+			},
+			{
+				type: 'input',
+				key: 'note',
+				placeholder: 'what are you working on?',
+				value: note(),
+				onSubmit: text => cmd.state.set('note', text.trim()),
+			},
+			{
+				type: 'select',
+				key: 'mood',
+				options: MOODS,
+				value: mood(),
+				onSelect: value => cmd.state.set('mood', value),
+			},
+			{
+				type: 'button',
+				label: 'Post',
+				hotkey: 's',
+				onPress: () => {
+					if (!note()) {
+						cmd.ui.toast('Type a note first', {level: 'warning'});
+						return;
+					}
+					cmd.ui.notify(`standup (${mood()}): ${note()}`);
+					cmd.ui.closePane('standup');
+				},
+			},
+		],
+	});
+
+	// /standup opens the form with the keyboard in it.
+	cmd.addCommand({
+		name: 'standup',
+		description: 'Post a one-line standup from a form pane',
+		handler: () => {
+			cmd.ui.openPane('standup', {focus: true});
+		},
+	});
+}

package/dist/bundled/mod-builder/examples/permission-policy.ts

@@ -0,0 +1,34 @@
+// Example mod: answer permission prompts with a team policy.
+//
+// hooks.onPermissionRequest fires ONLY where Command Code was about to ask you. Deny rules,
+// plan mode, and dont-ask have already run, so a mod can never undo them. Return 'allow' or
+// 'deny' to answer for the person, or undefined to let them decide. A prompt a safety check
+// forced (isSafetyPrompt: a sensitive file, a risky command) can be denied but never allowed:
+// an 'allow' there is ignored and you are asked as usual.
+
+import type {ModApi} from '@commandcode/harness';
+
+// Anything that can chain or redirect a second command goes to the person: without this,
+// `git status && npm publish` would pass as a safe `git status`.
+const SHELL_CONTROL = /[;&|`<>\n]|\$\(/;
+
+// Anchored at both ends, so the whole command must be one of these.
+const SAFE_SHELL = [
+	/^git (status|diff|log)( .*)?$/,
+	/^pnpm (test|lint|typecheck)( .*)?$/,
+];
+
+export default function (cmd: ModApi): void {
+	cmd.hooks({
+		onPermissionRequest: ({toolName, input}) => {
+			if (toolName !== 'shell_command') return undefined;
+			const command =
+				typeof input.command === 'string' ? input.command : '';
+			if (/\bcurl\b.*\|\s*(ba)?sh\b/.test(command)) return 'deny';
+			if (SHELL_CONTROL.test(command)) return undefined;
+			if (SAFE_SHELL.some(pattern => pattern.test(command)))
+				return 'allow';
+			return undefined;
+		},
+	});
+}

package/dist/bundled/mod-builder/examples/redact-secrets.ts

@@ -0,0 +1,46 @@
+// Example mod: redact secrets from everything the transcript keeps.
+//
+// hooks.transformMessage sees every message before it is committed: your prompt, each model
+// reply, every tool result, steering and follow-up messages. What it returns is what the
+// transcript stores AND what every later request sends, so a key a tool printed never reaches
+// the model on the next turn. The role and every tool_use / tool_result id must stay as they
+// were; a rewrite that changes them is rejected and the message is kept.
+
+import type {ModApi} from '@commandcode/harness';
+
+const SECRET_PATTERNS = [
+	/\bsk-[A-Za-z0-9_-]{16,}\b/g, // API keys
+	/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, // GitHub tokens
+	/\bAKIA[0-9A-Z]{16}\b/g, // AWS access key ids
+];
+
+function redact(text: string): string {
+	return SECRET_PATTERNS.reduce(
+		(current, pattern) => current.replace(pattern, '[REDACTED]'),
+		text,
+	);
+}
+
+export default function (cmd: ModApi): void {
+	cmd.hooks({
+		transformMessage: ({message}) => {
+			if (message.role === 'assistant') return message;
+			return {
+				...message,
+				content: message.content.map(block => {
+					if (block.type === 'text')
+						return {...block, text: redact(block.text)};
+					if (block.type !== 'tool_result') return block;
+					return {
+						...block,
+						content: block.content.map(part =>
+							part.type === 'text'
+								? {...part, text: redact(part.text)}
+								: part,
+						),
+					};
+				}),
+			};
+		},
+	});
+}

package/dist/bundled/mod-builder/examples/spinner-count.ts

@@ -0,0 +1,47 @@
+// Example mod: restyle built-in rows with cmd.ui.override.
+//
+// `spinner` appends nodes after the working status line, so "tool calls: 3" sits beside the
+// spinner while the agent works. `tool_row` draws a tool's row instead of the built-in one;
+// returning undefined keeps the built-in row, and `next()` is what mods loaded after this one
+// drew (undefined when nobody did). A throwing override falls back to the built-in drawing.
+//
+// The permission prompt is never overridable: what a person approves is always drawn by the host.
+
+import type {ModApi, ModUiOverrideProps} from '@commandcode/harness';
+
+function statusMark(status: ModUiOverrideProps['tool_row']['status']): string {
+	if (status === 'error') return '✗';
+	if (status === 'pending') return '…';
+	return '✓';
+}
+
+export default function (cmd: ModApi): void {
+	const calls = (): number => cmd.state.get<number>('calls') ?? 0;
+
+	cmd.on('tool_completed', () => {
+		cmd.state.set('calls', calls() + 1);
+	});
+	// One count per run: reset when the agent starts working on a new prompt.
+	cmd.on('run_start', () => {
+		cmd.state.set('calls', 0);
+	});
+
+	cmd.ui.override('spinner', (_props, next) => [
+		{type: 'text', text: `tool calls: ${calls()}`, color: 'cyan'},
+		...(next() ?? []),
+	]);
+
+	// Shell rows as one compact line; every other tool keeps its built-in row.
+	cmd.ui.override('tool_row', ({toolName, input, status}) => {
+		if (toolName !== 'shell_command') return undefined;
+		return [
+			{
+				type: 'row',
+				children: [
+					{type: 'text', text: statusMark(status), bold: true},
+					{type: 'text', text: `$ ${input}`, dim: true},
+				],
+			},
+		];
+	});
+}

package/dist/bundled/mod-builder/examples/stream-filter.ts

@@ -0,0 +1,70 @@
+// Example mod: filter the model's answer as it streams, and stream a process's output.
+//
+// hooks.transformTextDelta sees every chunk of the answer before it is shown. Return the chunk
+// to show (rewritten or not), or '' to hold it back. When the answer is complete it is called
+// once more with {delta: '', done: true}: return whatever you held back. The transcript keeps
+// exactly what was shown. It must be synchronous and fast: it runs inside the stream.
+//
+// A key can arrive split across chunks ("sk-ab" then "cdef..."), so this filter holds back a
+// tail that might be the start of one and decides when the next chunk (or the end) arrives.
+//
+// cmd.process.spawn runs a command and hands each stdout/stderr chunk to onOutput as it is
+// produced; cmd.exec only answers once the process exits.
+
+import type {ModApi} from '@commandcode/harness';
+
+const KEY_PATTERN = /\bsk-[A-Za-z0-9_-]{16,}/g;
+// A tail that could still grow into a key: "s", "sk", "sk-", "sk-abc...".
+const MAYBE_KEY_TAIL = /(?:\bs|\bsk|\bsk-[A-Za-z0-9_-]*)$/;
+
+function redact(text: string): string {
+	return text.replace(KEY_PATTERN, '[REDACTED]');
+}
+
+export default function (cmd: ModApi): void {
+	// Held-back text, for the stream it belongs to. A retry or a new turn starts a new stream.
+	let held = '';
+	let stream = '';
+
+	cmd.hooks({
+		transformTextDelta: ({delta, done, turnNumber, attempt}) => {
+			const id = `${turnNumber}:${attempt}`;
+			if (id !== stream) {
+				stream = id;
+				held = '';
+			}
+			const text = held + delta;
+			if (done) {
+				held = '';
+				return redact(text);
+			}
+			const tail = MAYBE_KEY_TAIL.exec(text)?.[0] ?? '';
+			held = tail;
+			return redact(text.slice(0, text.length - tail.length));
+		},
+	});
+
+	cmd.addCommand({
+		name: 'stream',
+		description: 'Run a command and show its latest output line as it runs',
+		argumentHint: '<command>',
+		handler: async ({args}) => {
+			if (!args.trim()) return {message: 'usage: /stream <command>'};
+			let lines = 0;
+			cmd.ui.setStatus(`running ${args}`);
+			try {
+				const {code} = await cmd.process.spawn({
+					command: args,
+					onOutput: (chunk, from) => {
+						const last = chunk.trimEnd().split('\n').at(-1) ?? '';
+						lines += chunk.split('\n').length - 1;
+						if (last) cmd.ui.setStatus(`${from}: ${last}`);
+					},
+				});
+				return {message: `${args} exited ${code} after ${lines} lines`};
+			} finally {
+				cmd.ui.setStatus(null);
+			}
+		},
+	});
+}