dsh-code 1.0.2 → 1.0.4

package/lib/types/app.d.ts

@@ -21,9 +21,9 @@ import { type ThemeName } from './theme.ts';
 import type { TranscriptStore } from './store.ts';
 import { type TranscriptEntry } from './render/projection.ts';
 import type { ApprovalStore } from './approval.ts';
-import type { CommandsView } from './commands.ts';
+import { type CommandsView } from './commands.ts';
 import type { ModelDirectory, ModelRow } from './models.ts';
-import type { ProviderConfiguration, ProviderSettingsDirectory, ProviderTargetView } from './provider-settings.ts';
+import { type DiscoveredModelView, type ProviderConfiguration, type ProviderSettingsDirectory, type ProviderTargetView } from './provider-settings.ts';
 import type { QuestionStore } from './questions.ts';
 import type { SkillsView, SkillRow } from './skills.ts';
 import { type MentionCandidate } from './mentions.ts';
@@ -108,6 +108,15 @@ export interface AppProps {
     removeModelProvider?(target: ProviderTargetView): Promise<void>;
     /** Save endpoint and explicit model capacities through the provider profile. */
     saveModelProviderConfiguration?(target: ProviderTargetView, configuration: ProviderConfiguration): Promise<void>;
+    /**
+     * Interrogate the provider's real endpoint (typed key wins over the stored
+     * credential) for the models it actually serves — the discovery stage of
+     * the provider setup page.
+     */
+    discoverModelProvider?(target: ProviderTargetView, request: {
+        readonly apiKey?: string;
+        readonly baseURL?: string;
+    }, signal?: AbortSignal): Promise<readonly DiscoveredModelView[]>;
     /** Provider authorization flows and value-free stored-record facts. */
     loadProviderAuthorizations?(): Promise<ProviderAuthorizationDirectory>;
     subscribeProviderAuthorizations?(listener: () => void): () => void;
@@ -163,6 +172,8 @@ export interface AppProps {
     recordHistory(text: string): void;
     /** Cancel one queued inbox message by identity (Delete on the empty composer). */
     cancelQueued(messageId: string): void;
+    /** Apply the Ctrl+R terminal passthrough to the detected editor (/vscode-keys); resolves to a one-line summary. */
+    applyEditorKeys(): Promise<string>;
 }
 /** One completion candidate row. */
 interface CompletionCandidate {

package/lib/types/commands.d.ts

@@ -37,3 +37,16 @@ export declare function watchCommands(ctx: Context): CommandsView;
  * @returns true when the line parses as `/name` or `/name input`.
  */
 export declare function isSlashLine(line: string): boolean;
+/**
+ * The submission payload for one composer line. Trim is a blank check, not a
+ * rewrite: an ordinary prompt keeps its exact leading indentation, inner
+ * layout, and trailing spaces (pasted code must reach the model verbatim).
+ * Only trailing line terminators are stripped — a draft's final newline is a
+ * paste/Enter artifact (an open bracketed paste turns Enter into an inserted
+ * newline), never deliberate content. A syntactic slash line still normalizes
+ * fully so command routing stays stable (completion inserts a trailing space
+ * after `/name`).
+ * @param line - the complete draft text.
+ * @returns the text to submit verbatim.
+ */
+export declare function submissionPayload(line: string): string;

package/lib/types/editor-keys.d.ts

@@ -0,0 +1,105 @@
+/**
+ * VS Code-family terminal keybinding repair. VS Code hands Ctrl+R to the
+ * workbench (Open Recent) even while an integrated terminal owns focus, so
+ * the reasoning-fold key never reaches the TUI. Workspace-scoped keybindings
+ * do not exist, so the fix is one user-level keybindings.json rule that
+ * forwards the raw Ctrl byte via sendSequence under terminalFocus. This
+ * module detects the hosting editor variant, resolves its user
+ * keybindings.json, and merges the rule idempotently; pure merge/detect
+ * helpers are separated from the fs orchestration so both stay testable.
+ * @module @deepseek-ai/dsh-code/editor-keys
+ */
+/** Integrated-terminal editor variants this module can repair. */
+export type EditorTerminalFamily = 'vscode' | 'cursor' | 'vscodium' | 'windsurf';
+/**
+ * Detect the editor hosting this integrated terminal.
+ * @param env - process environment (TERM_PROGRAM decides; case/whitespace tolerant).
+ * @returns the family, or undefined outside VS Code-family terminals.
+ */
+export declare function detectEditorTerminalFamily(env?: NodeJS.ProcessEnv): EditorTerminalFamily | undefined;
+/**
+ * Whether the pty is hosted away from the editor UI (ssh/container/tunnel).
+ * Keybindings live on the client machine, so a remote session must never
+ * write them server-side.
+ */
+export declare function isRemoteTerminalEnv(env?: NodeJS.ProcessEnv): boolean;
+/** Filesystem anchors used to resolve editor config paths (injectable for tests). */
+export interface EditorPathContext {
+    /** User home directory. */
+    homedir: string;
+    /** %APPDATA% on Windows; only read for win32 resolution. */
+    appdata?: string;
+    /** Node platform qualifier. */
+    platform: NodeJS.Platform;
+}
+/**
+ * Resolve the user keybindings.json candidates for one family, most likely
+ * install first. Only paths that exist on disk are repaired.
+ */
+export declare function editorKeybindingCandidates(family: EditorTerminalFamily, context: EditorPathContext): readonly string[];
+/** The one workbench rule that hands Ctrl+R to the focused terminal. */
+export declare const CTRL_R_PASSTHROUGH_RULE: {
+    readonly key: "ctrl+r";
+    readonly command: "workbench.action.terminal.sendSequence";
+    readonly args: {
+        readonly text: "\u0012";
+    };
+    readonly when: "terminalFocus";
+};
+/**
+ * Remove // and block comments from one JSONC document. Double-quoted strings
+ * survive untouched, so comment markers inside string values are preserved.
+ */
+export declare function stripJsoncComments(text: string): string;
+/** Parse one JSONC document; trailing commas are tolerated. */
+export declare function parseJsonc(text: string): unknown;
+/** Outcome of merging the passthrough rule into one keybindings document. */
+export type KeybindingsMerge = {
+    readonly status: 'present';
+} | {
+    readonly status: 'updated';
+    readonly text: string;
+} | {
+    readonly status: 'created';
+    readonly text: string;
+};
+/**
+ * Merge the Ctrl+R passthrough into one keybindings.json document. The raw
+ * text is preserved verbatim (comments included); the rule is inserted right
+ * after the array opener so it cannot be shadowed by later conflicting user
+ * rules. Missing files resolve to a fresh template.
+ * @throws when the document does not carry a rule array.
+ */
+export declare function mergeCtrlRPassthrough(raw: string | undefined): KeybindingsMerge;
+/** User-level marker file content: the startup hint fires at most once per install. */
+export interface EditorKeysFlag {
+    hintShownAt?: string;
+}
+/** Parse one flag file snapshot; missing or corrupt content degrades to unshown. */
+export declare function parseEditorKeysFlag(raw: string | undefined): EditorKeysFlag;
+/** Persist the shown marker; best-effort, the hint is cosmetic and never a gate. */
+export declare function markEditorKeysHintShown(path: string): Promise<void>;
+/** Inputs shared by the apply and startup-hint flows. */
+export interface EditorKeysEnv {
+    /** Process environment (TERM_PROGRAM / VSCODE_IPC_HOOK_CLI). */
+    env: NodeJS.ProcessEnv;
+    /** Filesystem anchors for editor config resolution. */
+    paths: EditorPathContext;
+    /** Absolute path of the one-shot hint marker under the DSH home. */
+    flagPath: string;
+}
+/**
+ * Apply the Ctrl+R passthrough to every local keybindings.json of the hosting
+ * editor and mark the startup hint shown. Existing files get a .dsh-bak
+ * backup before the first write.
+ * @returns a one-line user-facing summary.
+ * @throws with an actionable message when the environment cannot be repaired.
+ */
+export declare function applyCtrlRPassthrough({ env, paths, flagPath }: EditorKeysEnv): Promise<string>;
+/**
+ * Resolve the one-shot startup hint for VS Code-family terminals. Fires at
+ * most once per install (flag file), never when the passthrough rule is
+ * already present, and never in remote ptys where the repair cannot run.
+ * @returns the hint line, or undefined to stay silent.
+ */
+export declare function resolveEditorKeysStartupHint({ env, paths, flagPath }: EditorKeysEnv): Promise<string | undefined>;

package/lib/types/git-workflow.d.ts

@@ -17,7 +17,11 @@ export interface GitDiffView {
 export declare function parseGitDiffFiles(text: string): readonly GitDiffFile[];
 /** Parse the intentionally small, option-safe /diff argument vocabulary. */
 export declare function parseGitDiffSpec(argument: string): GitDiffSpec;
-/** Load one complete textual diff without invoking external diff drivers. */
-export declare function loadGitDiff(cwd: string, argument: string): Promise<GitDiffView>;
+/**
+ * Load one complete textual diff without invoking external diff drivers.
+ * @param signal - aborted by the caller on session switches/quit, killing the
+ * git subprocess instead of letting a stale repository's diff land later.
+ */
+export declare function loadGitDiff(cwd: string, argument: string, signal?: AbortSignal): Promise<GitDiffView>;
 /** Review prompt capped before it reaches a provider context window. */
 export declare function buildReviewPrompt(diff: string, label: string, maxChars?: number): string;

package/lib/types/index.d.ts

@@ -10,6 +10,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
+import { type ImageBlock } from '@deepseek-ai/dsh-llm';
 import { SessionId, type SessionEvent } from '@deepseek-ai/dsh-session';
 import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence';
 import type { TuiStartup } from './startup.ts';
@@ -69,6 +70,33 @@ export interface QuitCleanupStep {
  * @returns the names of the steps that started, in order (for tests).
  */
 export declare function runQuitSequence(steps: readonly QuitCleanupStep[], exit: (code: number) => void, onError?: (name: string, error: unknown) => void): Promise<readonly string[]>;
+/** One composer submission waiting behind the startup delivery. */
+export interface QueuedSubmission {
+    readonly text: string;
+    readonly mode: 'followup' | 'steer';
+    readonly images: readonly ImageBlock[];
+}
+/**
+ * Order-preserving gate for composer input while the startup prompt/images
+ * are still preparing. Anything submitted before the startup delivery settles
+ * queues and flushes afterwards in submit order, so the initial request can
+ * never be overtaken by typing that raced a slow image preparation. The flush
+ * also runs when the startup delivery fails: user input is never stranded.
+ */
+export declare class StartupInputGate {
+    private readonly deliver;
+    private readonly queued;
+    private pending;
+    constructor(deliver: (submission: QueuedSubmission) => void);
+    /** Submit one line: delivered now while idle, queued behind the startup delivery otherwise. */
+    submit(submission: QueuedSubmission): void;
+    /**
+     * Run the startup delivery — the callback receives the direct-delivery sink
+     * for the startup prompt itself — then flush everything that queued behind
+     * it, in order, even when the callback rejects.
+     */
+    run(startup: (deliver: (submission: QueuedSubmission) => void) => Promise<void>): Promise<void>;
+}
 /**
  * Resolve the invocation's target session against the persisted headers.
  * @param startup - the parsed startup flags.

package/lib/types/input-split.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Terminal input arrives as byte chunks, and one chunk can carry several
+ * keypresses: a fast space-then-enter, a bridged stdin that batches reads, a
+ * middle-click paste. Ink parses each chunk as exactly one keypress —
+ * `parseKeypress(' \r')` matches neither member, so both keys silently
+ * vanish (a multi-select question answered with an empty set). The splitter
+ * below cuts every chunk into the individual keypress units Ink's parser
+ * expects, keeping escape sequences and bracketed-paste blocks intact, and
+ * the stdin proxy feeds the split stream to the Ink mount.
+ *
+ * @module @deepseek-ai/dsh-tui/input-split
+ */
+import { PassThrough } from 'node:stream';
+/** One keypress cut from the input stream. */
+export interface KeypressSplitter {
+    /** Feed one chunk; returns every keypress unit this chunk completed. */
+    push(chunk: string): string[];
+    /** Whether an unterminated bracketed-paste block is currently held. */
+    openPaste(): boolean;
+    /**
+     * Last-resort escape hatch for a paste whose end marker never arrived:
+     * drop the start marker and emit the held bytes as plain keypress units so
+     * nothing (Esc and Ctrl+C included) stays hostage. Inert when no paste is
+     * open.
+     */
+    releaseStalePaste(): string[];
+}
+/**
+ * Build a stateful chunk splitter. A partial unit at the end of one chunk
+ * (a cut CSI sequence, an open paste block) waits in the buffer for the
+ * rest. A chunk-trailing lone ESC emits as the Escape key right away:
+ * terminals send Escape as its own chunk, and holding it hostage for a
+ * sequence that may never continue would break every Esc cancel.
+ */
+export declare function createKeypressSplitter(): KeypressSplitter;
+/** The stdin-shaped stream the Ink mount renders through. */
+export interface TuiStdin extends PassThrough {
+    /** Mirrors the real stdin so Ink's raw-mode gate passes. */
+    isTTY: boolean;
+    /** Forwarded to the real stdin; Ink toggles it around focus. */
+    setRawMode(value: boolean): unknown;
+    ref(): void;
+    unref(): void;
+}
+/**
+ * Wrap one real stdin in the splitting proxy: keypress units flow into a
+ * PassThrough Ink reads, while raw-mode/ref calls forward to the source.
+ * @param source - the process (or harness) input stream in raw mode.
+ * @returns the proxy stream plus a dispose that detaches the tap.
+ */
+export declare function createSplitStdin(source: NodeJS.ReadStream): {
+    stdin: TuiStdin;
+    dispose(): void;
+};

package/lib/types/kernel-panels.d.ts

@@ -115,7 +115,7 @@ export declare function StatuslinePanel({ enabled, change, close }: {
  * instead of a bare failure notice. Enter applies one level; Esc returns to
  * the model list without applying.
  */
-export declare function EffortPanel({ row, current, select, back }: {
+export declare function EffortPanel({ row, current, select, back, onExit }: {
     /** The model row whose advertised levels this stage lists. */
     row: ModelRow;
     /** Effective effort currently in force ('' when none), for the ● mark. */
@@ -124,6 +124,8 @@ export declare function EffortPanel({ row, current, select, back }: {
     select(effortId: string): void;
     /** Return to the model list without applying. */
     back(): void;
+    /** Leave the whole /model flow (Ctrl+C). */
+    onExit(): void;
 }): ReactElement;
 /**
  * The /agents panel (the Codex agent-picker contract, read-only): this

package/lib/types/keyboard.d.ts

@@ -42,6 +42,14 @@ export declare function stripTerminalFocusEvents(chunk: string, onFocus: (focuse
 /** Bracketed paste markers as Ink delivers them (it strips the leading ESC). */
 export declare const PASTE_START_MARKER = "[200~";
 export declare const PASTE_END_MARKER = "[201~";
+/**
+ * How long an unterminated bracketed-paste block may hold buffered bytes
+ * before the input splitter strips its start marker and releases them: a
+ * terminal that loses the end marker must never take the whole keyboard
+ * hostage (Esc/Ctrl+C included). Shared by the splitter and the composer's
+ * lost-paste safety net so both use one window.
+ */
+export declare const PASTE_BRACKET_TIMEOUT_MS = 1000;
 /**
  * Remove bracketed paste markers from one input chunk. Panel drafts accept raw
  * `input` text, where an unhandled paste would otherwise persist the literal

package/lib/types/model-capabilities.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Same-id reasoning-capability inheritance for hand-declared pi-ai routes:
+ * the model catalog inherits capabilities by route key, not by model id, so a
+ * relay route listing `gpt-5.5` reads nothing from the installed `openai`
+ * catalog entry and materializes as `reasoning: false` until its settings
+ * entry declares `reasoningEfforts`. This adapter closes that gap without
+ * touching upstream: whenever a pi-ai profile's model entry carries no
+ * declaration and its live row advertises no efforts, but the same model id
+ * is declared (in a sibling settings entry) or advertised (on another route)
+ * elsewhere, the declaration is materialized into settings — verbatim from a
+ * sibling declaration when one exists, otherwise as an identity level map
+ * (`off` maps to null, every other level to its own name), which is the
+ * correct wire spelling for OpenAI-compatible relays. Writes ride the same
+ * `settings.mutate` path as the provider panel, so the upstream
+ * `assertServiceable` gate still rejects anything invalid atomically.
+ *
+ * @module @deepseek-ai/dsh-tui/model-capabilities
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type ModelRow } from './models.ts';
+/** A notice sink structurally compatible with the app bridge's `notify`. */
+export type CapabilityNotice = (text: string, tone?: 'info' | 'warning' | 'error') => void;
+/** One pi-ai provider profile as stored in settings, addressed for mutation. */
+export interface CapabilityProfileSource {
+    /** Settings namespace owning the profile (`llm-pi-ai`). */
+    readonly settingsNs: string;
+    /** Path from the section root to this provider's profile. */
+    readonly settingsPath: readonly string[];
+    /** Revision of the owning section at read time. */
+    readonly revision: number;
+    /** Raw model entries, exactly as stored (declaration fields included). */
+    readonly models: readonly Record<string, unknown>[];
+}
+/** One planned per-provider models rewrite. */
+export interface CapabilitySyncPlan {
+    /** Provider route the plan targets. */
+    readonly provider: string;
+    /** Settings namespace owning the profile. */
+    readonly settingsNs: string;
+    /** Path from the section root to the provider profile. */
+    readonly settingsPath: readonly string[];
+    /** Raw model entries, exactly as stored (declaration fields included). */
+    readonly models: readonly Record<string, unknown>[];
+    /** Fingerprint of the source models array this plan was derived from. */
+    readonly sourceFingerprint: string;
+    /** Document revision of the owning section when the plan was derived. */
+    readonly sourceRevision: number;
+    /** Model ids that gained a declaration, notice-facing. */
+    readonly inherited: readonly string[];
+    /** `provider/model` labels the declarations came from, notice-facing. */
+    readonly sources: readonly string[];
+}
+/**
+ * Plan the reasoning declarations to materialize. A model entry inherits
+ * when it declares nothing (`reasoningEfforts` absent — a dict or `false` is
+ * an explicit choice and is never touched) and its live row advertises no
+ * efforts; the donor is the first sibling settings declaration for the same
+ * id, copied verbatim so dialect wire spellings survive, otherwise the first
+ * other-route row advertising efforts for that id, mapped by identity.
+ * Entries never lose fields and keep their key order; a provider appears in
+ * the result only when at least one entry changes.
+ * @param input - the live model rows and the raw pi-ai profiles from settings.
+ * @returns one plan per provider with at least one inheritance.
+ */
+export declare function planCapabilitySync(input: {
+    readonly rows: readonly ModelRow[];
+    readonly profiles: ReadonlyMap<string, CapabilityProfileSource>;
+}): readonly CapabilitySyncPlan[];
+/**
+ * Materialize same-id reasoning declarations once per provider. Reads the
+ * configurable directory, the redacted settings document, and the live model
+ * rows; plans; then writes each provider's merged models array through
+ * `settings.mutate` under a fresh revision (writes bump the section
+ * revision, so per-plan revisions are re-read). Every failure converges to a
+ * single-line notice — the caller's promise never rejects and the session
+ * keeps running on the previous configuration.
+ * @param ctx - context carrying the `llm` and `settings` services (optional).
+ * @param notify - the app bridge's notice sink, when one is live.
+ */
+export declare function syncModelCapabilities(ctx: Context, notify?: CapabilityNotice): Promise<void>;
+/** Test seam: forget the applied-write fingerprints. */
+export declare function resetCapabilitySyncState(): void;

package/lib/types/provider-settings.d.ts

@@ -48,12 +48,78 @@ export interface ProviderModelSettings {
     readonly name?: string;
     readonly contextWindow?: number;
     readonly maxTokens?: number;
+    /**
+     * Remaining entry fields the editor does not model (`reasoningEfforts`,
+     * `compat`, `input`, …), carried verbatim so a save preserves them.
+     * Populated by {@link loadProviderSettings}; never contains the four
+     * modelled keys.
+     */
+    readonly extras?: Readonly<Record<string, unknown>>;
 }
 /** The small, portable subset of a provider profile the terminal edits. */
 export interface ProviderConfiguration {
     readonly baseURL?: string;
+    /**
+     * Wire protocol the stored profile names (e.g. `openai-responses`), when it
+     * names one. Load-only: the editor never writes it, but endpoint discovery
+     * passes it so the listing speaks the same protocol as real requests.
+     */
+    readonly api?: string;
     readonly models: readonly ProviderModelSettings[];
 }
+/** One model an endpoint reported about itself (mirrors `LlmDiscoveredModel`). */
+export interface DiscoveredModelView {
+    /** Model id the endpoint accepts. */
+    readonly id: string;
+    /** Human-readable name when the endpoint supplies one. */
+    readonly name?: string;
+    /** Context window when disclosed; adoption still owes it if absent. */
+    readonly contextWindow?: number;
+    /** Output cap when disclosed. */
+    readonly maxTokens?: number;
+}
+/** One model an endpoint reported about itself (mirrors LlmDiscoveredModel). */
+export interface DiscoveredModelView {
+    /** Model id the endpoint accepts. */
+    readonly id: string;
+    /** Human-readable name when the endpoint supplies one. */
+    readonly name?: string;
+    /** Context window when disclosed; adoption still owes it if absent. */
+    readonly contextWindow?: number;
+    /** Output cap when disclosed. */
+    readonly maxTokens?: number;
+}
+/**
+ * The seven canonical reasoning levels a reasoningEfforts key may name -
+ * pi-ai's THINKING_LEVELS. A pi-ai upgrade that adds or removes one fails
+ * upstream's own drift gate; this mirror exists so the terminal editor can
+ * validate drafts without importing the pi-ai package.
+ */
+export declare const REASONING_EFFORT_LEVELS: readonly ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+/**
+ * One stored reasoningEfforts declaration: a display-level to wire-value map
+ * (null sends no reasoning parameter), an explicit false disabling the
+ * picker, or undefined leaving the entry to inherit.
+ */
+export type ReasoningEffortsValue = Record<string, string | null> | false | undefined;
+/** Whether a raw extras value is a declared efforts dict (non-empty, non-false). */
+export declare function isDeclaredReasoningEfforts(value: unknown): value is Record<string, string | null>;
+/**
+ * Parse the setup page's compact efforts draft into a storable declaration.
+ * Grammar: empty = clear back to inherit; the single token "false" = disable
+ * the picker; otherwise space-separated level:wire pairs where level is one
+ * of REASONING_EFFORT_LEVELS and wire is any non-empty string or the literal
+ * "null" (send no parameter).
+ */
+export declare function parseReasoningEffortsDraft(draft: string): {
+    readonly ok: true;
+    readonly value: ReasoningEffortsValue;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/** Serialize a stored declaration back to the compact draft form (stored key order preserved). */
+export declare function serializeReasoningEfforts(value: unknown): string;
 /**
  * One provider row in the TUI provider-management panel: the configurable
  * directory entry joined with its settings profile and credential facts.
@@ -136,6 +202,24 @@ export declare function loadProviderSettings(ctx: Context): Promise<ProviderSett
 export declare function saveProviderCredential(ctx: Context, target: ProviderTargetView, rawKey: string): Promise<void>;
 /** Save the endpoint and an explicit model allow-list without rebuilding the profile. */
 export declare function saveProviderConfiguration(ctx: Context, target: ProviderTargetView, configuration: ProviderConfiguration): Promise<void>;
+/**
+ * Interrogate a provider endpoint for the models it really serves, through
+ * the model-discovery capability the provider's settings namespace
+ * registered — the same pipe the official Web Models page uses. The request
+ * is a draft: a typed key forces direct endpoint interrogation (gateway
+ * truth), while an empty key lets the harness resolve the route's stored
+ * credential; with neither baseURL nor route the adapter answers from its
+ * own knowledge.
+ * @param ctx - context carrying the `llm` service (optional discovery).
+ * @param target - provider row whose settings namespace serves the draft.
+ * @param request - typed key and/or endpoint override for this one probe.
+ * @param signal - caller cancellation (panel navigation aborts the probe).
+ * @returns the advertised models in endpoint order, deduplicated.
+ */
+export declare function discoverProviderModels(ctx: Context, target: ProviderTargetView, request: {
+    readonly apiKey?: string;
+    readonly baseURL?: string;
+}, signal?: AbortSignal): Promise<readonly DiscoveredModelView[]>;
 /**
  * Remove the currently named credential without touching the provider
  * profile. Only the resolved profile's own reference is unset; a dormant or

package/lib/types/render/lines.d.ts

@@ -39,3 +39,28 @@ export declare function reasoningLines(text: string, columns: number): readonly
 export declare function transcriptEntryLines(entry: TranscriptEntry, columns: number, showReasoning?: boolean, reasoningToggleHint?: boolean, showToolDetails?: boolean): readonly StyledLine[];
 /** Settled-history variant carrying the Ctrl+R reasoning fold. */
 export declare function settledEntryLines(entry: TranscriptEntry, columns: number, showReasoning: boolean): readonly StyledLine[];
+/** The flexible rows of the live region; chrome (composer/notice/status) is never reduced. */
+export interface LiveAllocation {
+    /** Settled tail rows currently rendered in the live tree. */
+    readonly live: number;
+    /** Rows reserved for the streaming reasoning tail or its marker. */
+    readonly reasoning: number;
+    /** Rows reserved for the streaming answer tail. */
+    readonly answer: number;
+}
+/** A clamped allocation plus the invariant-trip warning that triggered it. */
+export interface LiveAllocationAudit {
+    readonly allocation: LiveAllocation;
+    readonly warning?: string;
+}
+/**
+ * Clamp the live-region allocation so the flexible dynamic rows never exceed
+ * the post-chrome budget. By construction the caller derives these rows from
+ * the same budget; this is the runtime tripwire for a future edit that breaks
+ * that derivation. Reduction order: answer first (the freshest content is the
+ * live tail), then reasoning, then settled live rows; nothing goes negative.
+ * @param allocation - the intended row allocation.
+ * @param dynamicRows - the post-chrome row budget.
+ * @returns the clamped allocation and a warning string when clamping fired.
+ */
+export declare function clampLiveAllocation(allocation: LiveAllocation, dynamicRows: number): LiveAllocationAudit;

package/lib/types/render/markdown.d.ts

@@ -21,7 +21,7 @@ export interface MdSegment {
 export interface MdLine {
     segments: readonly MdSegment[];
 }
-/** Visible width of a run in columns (CJK counts double). */
+/** Visible width of a run in columns (grapheme-cluster and emoji aware). */
 export declare function visibleColumns(text: string): number;
 /** Render markdown text into styled lines of at most `width` columns. */
 export declare function renderMarkdown(text: string, width: number, options?: {

package/lib/types/render/projection.d.ts

@@ -115,6 +115,8 @@ export interface RetryEntry {
     kind: 'retry';
     /** Correlation id shared with the matching `llm/retry-started`. */
     retryId: string;
+    /** Retry policy mode from the event: `always` has no attempt cap. */
+    mode: 'normal' | 'always';
     /** Attempt ordinal and its cap. */
     attempt: number;
     max: number;
@@ -122,7 +124,11 @@ export interface RetryEntry {
     code: string;
     /** Backoff wait before the next attempt, in ms. */
     delayMs: number;
-    /** `running` while the backoff waits, `done` once the attempt started. */
+    /**
+     * `running` while the backoff waits, `done` once the attempt started — or
+     * when the turn ended first (the turn-end sweep finalizes orphans so they
+     * never pin the settled boundary).
+     */
     state: 'running' | 'done';
 }
 /** Turn-tail deliverables: files mutated by the turn's diff-bearing tools. */
@@ -357,8 +363,11 @@ export declare function createReplayAccumulator(): ReplayAccumulator;
  * to a sequential fold; only the `entries` container operations are mutable.
  *
  * @internal Test-instrumentation path; `projectEvents` is the public entry.
+ * @returns whether the event changed the accumulated state — the live store
+ * stays silent and keeps its snapshot identity for ignored events, exactly
+ * like the copy-on-write reducer returning its input view unchanged.
  */
-export declare function replayProjectEvent(acc: ReplayAccumulator, event: SessionEvent): void;
+export declare function replayProjectEvent(acc: ReplayAccumulator, event: SessionEvent): boolean;
 /**
  * Materialize the accumulated fold as a `TranscriptView`, compacting any
  * retired tombstones. The anchors maps are handed through as-is (their
@@ -367,6 +376,17 @@ export declare function replayProjectEvent(acc: ReplayAccumulator, event: Sessio
  * @internal Test-instrumentation path; `projectEvents` is the public entry.
  */
 export declare function finishReplay(acc: ReplayAccumulator): TranscriptView;
+/**
+ * Materialize the accumulated fold as a fresh immutable snapshot for the
+ * live store. Unlike {@link finishReplay} — the one-shot replay entry, which
+ * hands the accumulator's own arrays through because the accumulator is
+ * discarded — every array a renderer can hold is copied here, so later
+ * folds never mutate a snapshot already handed out. Same fields, same
+ * tombstone compaction.
+ *
+ * @internal Live-store path; `projectEvents` is the public entry.
+ */
+export declare function snapshotReplayView(acc: ReplayAccumulator): TranscriptView;
 /**
  * Fold a replayed event history into one view.
  *

package/lib/types/render/status.d.ts

@@ -72,28 +72,35 @@ export declare const STATUS_ITEM_SEPARATOR = " \u00B7 ";
 /** The Codex-style mode cycle hint appended to the permission badge. */
 export declare const STATUS_CYCLE_HINT = " (shift+tab to cycle)";
 /**
- * Interior columns of the segmented context bar (content-type segments plus
- * the free tail whose right edge carries the usage readout). The layout
- * starts every bar at this width so the drop ladder can pre-measure the
- * group, then shrinks the bar inside a tighter budget before dropping it
- * (see CONTEXT_MIN_WIDTH) rather than asking the layout for more room.
+ * Interior columns of the context bar. The layout starts every bar at this
+ * width so the drop ladder can pre-measure the group, then degrades the
+ * readout and shrinks the bar inside a tighter budget before dropping the
+ * group (see CONTEXT_MIN_WIDTH) rather than asking the layout for more room.
  */
 export declare const CONTEXT_BAR_WIDTH = 24;
 /**
- * Render context occupancy as ONE stepless bar: a solid DeepSeek-blue fill
- * run, a dim dotted free track, and the usage readout riding the track's
- * right edge (`12.3K/1.0M 25%`, shrinking to the bare percent as the track
- * narrows). No per-content-type segmentation. Column split is deterministic:
- * the free share is `Math.round(free/window*width)` clamped to at least
- * CONTEXT_MIN_FREE columns and at most the full width; the fill takes every
- * remaining column, so a given occupancy always renders the identical bar.
- * The readout flips to amber once occupancy reaches the warning threshold.
- * @param usedTokens - reported used tokens (drives the readout and percent).
+ * Render context occupancy as ONE stepless proportional bar: a solid
+ * DeepSeek-blue fill run tracking the occupancy and a dim dotted free
+ * track for the rest. Nothing else lives inside the bar — the usage
+ * readout rides outside it (see contextGroupSpans) — so the geometry
+ * always reads as the true remaining share. A given occupancy always
+ * renders the identical bar.
+ * @param usedTokens - reported used tokens.
  * @param contextWindow - route capacity.
- * @param width - total bar interior columns.
+ * @param width - total bar columns.
  * @returns tone-split spans for the footer to paint.
  */
 export declare function contextBar(usedTokens: number, contextWindow: number, width: number): readonly StatusSpan[];
+/** How much usage detail the context group's readout carries. */
+export type ContextReadoutMode = 'full' | 'percent' | 'none';
+/**
+ * Compose the context group: the proportional bar plus the usage readout
+ * OUTSIDE the bar, so the dotted track keeps its proportional meaning no
+ * matter how wide the readout is. `full` reads `12.3K/1.0M 25%`; `percent`
+ * drops the absolute pair; `none` is the bare bar. The readout turns amber
+ * once occupancy reaches the warning threshold.
+ */
+export declare function contextGroupSpans(usedTokens: number, contextWindow: number, barWidth: number, readout: ContextReadoutMode): readonly StatusSpan[];
 /**
  * One customizable status item (the Codex /statusline picker contract).
  * 'left' items render as pipe-separated clusters after the identity dot;