fixo-cli 1.0.4 → 2.0.0

package/dist/config.d.ts

@@ -1,5 +1,18 @@
 import type { PolicyProfile } from './runtime/policy.js';
 export declare const DEFAULT_API_URL = "https://freellm-liart.vercel.app/v1";
+/**
+ * How the CLI authenticates against an LLM backend.
+ *
+ *  - `direct` — Requests go straight to a provider (OpenAI, Anthropic,
+ *               Groq, etc.) using a key the user pasted at setup. Zero
+ *               traffic to the FreeLLMAPI proxy. This is the default
+ *               for fresh installs starting with v1.1.
+ *  - `proxy`  — Requests transit the FreeLLMAPI proxy at
+ *               {@link DEFAULT_API_URL} (or a custom URL). Opt-in
+ *               convenience for users who want load-balanced failover
+ *               across free-tier providers without managing keys.
+ */
+export type ProviderMode = 'direct' | 'proxy';
 /** Stream-resume policy. */
 export type StreamResumePolicy = 'auto' | 'never';
 /**
@@ -73,6 +86,25 @@ export interface ToolCallBudgetPolicy {
 }
 /** Pre-save gate severity. */
 export type LspPreSaveMode = 'off' | 'warn' | 'block' | 'sandbox-mock';
+/**
+ * Sandbox mode for `run_command` execution.
+ *
+ *  - `guard`        — Today's behaviour. The in-process command-parser
+ *                     regex layer + WorkspaceGuard path-boundary checks
+ *                     are the only line of defence. Fast, no platform
+ *                     dependencies, no behaviour change.
+ *  - `os-sandbox`   — Opt-in. Wraps every shell command in an
+ *                     OS-enforced sandbox (`sandbox-exec` on macOS,
+ *                     `bwrap` on Linux). Blocks writes outside the
+ *                     workspace + tmpdir even when the regex guard is
+ *                     bypassed by a creative command. Requires the
+ *                     platform binary to be present; surfaces a
+ *                     structured error otherwise rather than silently
+ *                     downgrading to `guard`.
+ *
+ * Always combined with the regex/guard layer — defence in depth.
+ */
+export type SandboxMode = 'guard' | 'os-sandbox';
 /** Safety preferences — Pillar 1, 2, 3 surface. Pillar 4 lives in the
  *  credential vault module, not in the user-facing config. */
 export interface SafetyConfig {
@@ -100,6 +132,166 @@ export interface SafetyConfig {
     predictiveBudgetPct?: number;
     /** Tool-call budget — see {@link ToolCallBudgetPolicy}. */
     toolCalls: ToolCallBudgetPolicy;
+    /** OS-level sandbox for `run_command`. Defaults to `'guard'`. */
+    sandboxMode?: SandboxMode;
+    /**
+     * Phase 2 — automatic post-edit verification. When `true` (default)
+     * AND the run is in BUILD mode AND at least one file-mutating tool
+     * was called, the agent runs the project's detected test/typecheck
+     * command at the end of the tool loop and — if it fails — pushes a
+     * repair-request message back to the model up to
+     * {@link autoVerifyMaxRepairs} times before returning.
+     *
+     * Set to `false` to restore the pre-Phase-2 "trust the model"
+     * behaviour. Cheap-to-detect projects (no test/typecheck command in
+     * {@link import('./project-memory.js').detectProjectFacts}) silently
+     * skip the verifier — there's nothing to run.
+     */
+    autoVerify?: boolean;
+    /**
+     * Maximum number of automatic repair turns the verifier may use in
+     * one run. The default of 1 was chosen so a long-horizon task gets
+     * exactly one self-correction shot — enough to catch obvious type
+     * errors without spinning forever on hard failures.
+     */
+    autoVerifyMaxRepairs?: number;
+}
+/**
+ * Phase 5 — Agent Pool tuning surface.
+ *
+ * Controls the concurrency and per-subtask budget of the orchestrator's
+ * parallel worker pool. All defaults match the constants that were
+ * hardcoded in `agent-pool.ts` before this namespace existed, so adding
+ * the namespace alone is a zero-behavior-change refactor.
+ */
+export interface AgentPoolConfig {
+    /** Maximum concurrent worker subtasks. Default 3. */
+    concurrencyLimit: number;
+    /** Tool-call budget per subtask. Default 12 (raised to 40 in Phase 4a). */
+    subtaskBudget: number;
+    /**
+     * When true, successful peer subtasks are committed even if siblings
+     * fail (Phase 2). Default false; flipped in Phase 7 after the regression
+     * harness validates the partial-commit path.
+     */
+    preservePartialOnFailure: boolean;
+}
+/**
+ * Phase 5 — loop-mitigation policy.
+ *
+ * The legacy `LoopMitigationTracker` (loop-mitigation.ts) blocks reads
+ * on a target permanently once the warn threshold trips. Phase 1b adds a
+ * sliding-window alternative; this config selects between them.
+ */
+export interface AgentLoopGuardConfig {
+    /**
+     * When true, block accounting uses a sliding window of tool calls
+     * instead of session-lifetime lockout. Default false in phase 1b;
+     * flipped to true in Phase 7 after soak.
+     */
+    useSlidingWindow: boolean;
+    /** Sliding-window size in tool calls. Default 10. Ignored when sliding is off. */
+    blockWindowTurns: number;
+    /**
+     * When true, the loop-mitigation tracker is reset between orchestrator
+     * subtasks so one stuck subtask cannot poison the rest of the run.
+     * Default true.
+     */
+    blockResetOnSubtask: boolean;
+}
+/**
+ * Phase 5 — routing-honor policy.
+ *
+ * The router currently surfaces a "model unverified for autonomous DAG
+ * execution" warning but routes to the Orchestrator anyway. Phase 6
+ * makes the warning actionable.
+ */
+export interface AgentRoutingConfig {
+    /**
+     * When true, Complex-classified tasks on models NOT in the
+     * verified-DAG list are routed to SingleAgent. Default false in
+     * Phase 0; flipped to true in Phase 6.
+     */
+    honorVerificationFlag: boolean;
+    /**
+     * Override that permits unverified-model DAG execution even when
+     * `honorVerificationFlag` is true. For power users who explicitly
+     * accept the risk. Default false.
+     */
+    allowUnverifiedDag: boolean;
+}
+/**
+ * Phase 5.3 — DAG-level conflict policy.
+ *
+ * The orchestrator currently parallelizes any subtasks that don't
+ * declare a dependency on each other. This causes write-conflicts
+ * when the LLM emits multiple subtasks targeting the same file (the
+ * "3 workers all writing style.css" race observed in the log).
+ *
+ * `serializeWriteConflicts`, when true, runs a post-pass on the
+ * generated DAG that injects dependency edges whenever two subtasks
+ * could write to overlapping files. Default true since the
+ * alternative is observed-broken; flag exists so users can opt out
+ * for benchmarks or future verified orchestrators.
+ *
+ * `serializeMissingFiles` extends the same policy to subtasks that
+ * declared no files at all (LLMs often omit). Conservative default
+ * trades parallelism for correctness — over-serialization is the
+ * worst case.
+ */
+export interface AgentDagConfig {
+    serializeWriteConflicts: boolean;
+    serializeMissingFiles: boolean;
+}
+export interface AgentConfig {
+    pool: AgentPoolConfig;
+    loopGuard: AgentLoopGuardConfig;
+    routing: AgentRoutingConfig;
+    dag: AgentDagConfig;
+}
+/**
+ * Phase 3.3 — repo-map scan caps.
+ *
+ * Controls how aggressively `buildRepoMap` walks the workspace.
+ * Both fields are optional; defaults track the pre-Phase-3.3
+ * constants (depth 4, 200 files) so existing users see no
+ * behaviour change. Increase these on large repos where the
+ * default cap truncates important directories.
+ */
+export interface RepoMapConfig {
+    /** Maximum recursion depth. Default 4. */
+    maxDepth?: number;
+    /** Maximum files per directory. Default 200. */
+    maxFiles?: number;
+}
+/**
+ * Phase 2.4 — local fast/heavy-tier model substitution.
+ *
+ * When a code path tags its request with `required_capabilities`,
+ * the client looks up the corresponding tier in this table and
+ * substitutes the locally-configured model BEFORE issuing the
+ * request. Works in both direct and proxy modes — direct sends the
+ * substituted model to the provider; proxy still sees the
+ * substitution as well as the legacy metadata headers.
+ *
+ * Per-tier semantics:
+ *   - `fast`    — used for planner classification, complexity
+ *                  routing, summary turns. Optimise for latency
+ *                  + cost; quality is less important.
+ *   - `heavy`   — used for the orchestrator's plan() and any
+ *                  call that asks for `'heavy'`. Optimise for
+ *                  quality.
+ *   - `default` — fallback when a request asks for a capability
+ *                  the user hasn't configured; equivalent to
+ *                  not substituting at all.
+ *
+ * All three fields are optional. When a tier is unset, the
+ * client falls through to the model the caller passed.
+ */
+export interface ModelRoutingConfig {
+    fast?: string;
+    default?: string;
+    heavy?: string;
 }
 /** Resilience preferences for the new withRetry + chatStreamWithResume paths. */
 export interface ResilienceConfig {
@@ -128,9 +320,33 @@ export interface ResilienceConfig {
  * Persisted at `~/.fixocli/config.json`.
  */
 export interface FreeLLMConfig {
+    /**
+     * Authentication mode. New installs default to `'direct'`. Existing
+     * configs that predate this field are inferred at load time:
+     * presence of `freellmapi_api_key` means `'proxy'`, absence means
+     * `'direct'`. Never undefined after {@link loadConfig} returns.
+     */
+    provider_mode: ProviderMode;
+    /**
+     * When `provider_mode === 'direct'`, identifies the provider the
+     * user selected at setup time and the default model to use for new
+     * sessions. The actual API key lives in the providers store
+     * (`~/.fixocli/providers.json`) and the in-memory credential vault,
+     * never here.
+     */
+    directProvider?: {
+        name: string;
+        defaultModel: string;
+    };
     freellmapi_api_key?: string;
     apiUrl?: string;
     defaultModel: string;
+    /** Persisted across launches so the next boot auto-reconnects. */
+    lastSession?: {
+        provider: string;
+        model: string;
+        updatedAt: string;
+    };
     preferences: {
         autoCommit: boolean;
         streaming: boolean;
@@ -165,6 +381,22 @@ export interface FreeLLMConfig {
          * is a programmatic-only surface and is not user-configurable.
          */
         safety: SafetyConfig;
+        /**
+         * Phase 2.4 — per-capability model substitution. Optional. See
+         * {@link ModelRoutingConfig}.
+         */
+        modelRouting?: ModelRoutingConfig;
+        /**
+         * Phase 3.3 — repo-map walk caps. Optional. See
+         * {@link RepoMapConfig}.
+         */
+        repoMap?: RepoMapConfig;
+        /**
+         * Phase 5 — Agent subsystem tunables (pool, loop guard, routing).
+         * Optional. Missing fields fall through to the defaults in
+         * {@link getDefaultConfig}. See {@link AgentConfig}.
+         */
+        agent?: AgentConfig;
     };
     _firstRunComplete: boolean;
 }
@@ -182,6 +414,16 @@ export declare function getDefaultConfig(): FreeLLMConfig;
  * instead — the caller can then decide whether to run the setup wizard.
  */
 export declare function loadConfig(): FreeLLMConfig;
+/**
+ * Returns the resolved {@link AgentConfig} from the loaded config.
+ * Guaranteed non-null — falls back to defaults for old configs that
+ * predate this namespace.
+ */
+export declare function getAgentConfig(config?: FreeLLMConfig): AgentConfig;
+export declare function getAgentPoolConfig(config?: FreeLLMConfig): AgentPoolConfig;
+export declare function getAgentLoopGuardConfig(config?: FreeLLMConfig): AgentLoopGuardConfig;
+export declare function getAgentRoutingConfig(config?: FreeLLMConfig): AgentRoutingConfig;
+export declare function getAgentDagConfig(config?: FreeLLMConfig): AgentDagConfig;
 /**
  * Persists the given config to `~/.fixocli/config.json`.
  * Creates the config directory if it doesn't already exist.

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAO,MAAM,eAAe,wCAAwC,CAAC;AAErE,4BAA4B;AAC5B,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;AAIhE;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;+DAE+D;AAC/D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,8BAA8B;AAC9B,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,cAAc,CAAC;AAEvE;8DAC8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,UAAU,EAAE,cAAc,CAAC;IAC3B,4BAA4B;IAC5B,QAAQ,EAAE,cAAc,CAAC;IACzB,6DAA6D;IAC7D,gBAAgB,EAAE,sBAAsB,CAAC;IACzC;wDACoD;IACpD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,SAAS,EAAE,oBAAoB,CAAC;CACjC;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,YAAY,EAAE,kBAAkB,CAAC;IACjC,6DAA6D;IAC7D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,aAAa,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QACX,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,aAAa,CAAC;QACtB,SAAS,EAAE,OAAO,CAAC;QACnB;;;;;WAKG;QACH,cAAc,EAAE,OAAO,CAAC;QACxB;;;;;WAKG;QACH,eAAe,EAAE,OAAO,CAAC;QACzB,UAAU,EAAE,gBAAgB,CAAC;QAC7B;;;;;;;;;;WAUG;QACH,MAAM,EAAE,YAAY,CAAC;KACtB,CAAC;IACF,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAMD,6DAA6D;AAC7D,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,oFAAoF;AACpF,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAMD,uDAAuD;AACvD,wBAAgB,gBAAgB,IAAI,aAAa,CAgDhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,aAAa,CAuD1C;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAkBtD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAO,MAAM,eAAe,wCAAwC,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9C,4BAA4B;AAC5B,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;AAIhE;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;+DAE+D;AAC/D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,8BAA8B;AAC9B,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,cAAc,CAAC;AAEvE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,YAAY,CAAC;AAEjD;8DAC8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,UAAU,EAAE,cAAc,CAAC;IAC3B,4BAA4B;IAC5B,QAAQ,EAAE,cAAc,CAAC;IACzB,6DAA6D;IAC7D,gBAAgB,EAAE,sBAAsB,CAAC;IACzC;wDACoD;IACpD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,SAAS,EAAE,oBAAoB,CAAC;IAChC,iEAAiE;IACjE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC7B,uBAAuB,EAAE,OAAO,CAAC;IACjC,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,oBAAoB,CAAC;IAChC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,GAAG,EAAE,cAAc,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,YAAY,EAAE,kBAAkB,CAAC;IACjC,6DAA6D;IAC7D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;OAMG;IACH,aAAa,EAAE,mBAAmB,CAAC;IACnC;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,aAAa,EAAE,YAAY,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QACf,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE;QACX,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,aAAa,CAAC;QACtB,SAAS,EAAE,OAAO,CAAC;QACnB;;;;;WAKG;QACH,cAAc,EAAE,OAAO,CAAC;QACxB;;;;;WAKG;QACH,eAAe,EAAE,OAAO,CAAC;QACzB,UAAU,EAAE,gBAAgB,CAAC;QAC7B;;;;;;;;;;WAUG;QACH,MAAM,EAAE,YAAY,CAAC;QACrB;;;WAGG;QACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;QAClC;;;WAGG;QACH,OAAO,CAAC,EAAE,aAAa,CAAC;QACxB;;;;WAIG;QACH,KAAK,CAAC,EAAE,WAAW,CAAC;KACrB,CAAC;IACF,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAMD,6DAA6D;AAC7D,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,oFAAoF;AACpF,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAMD,uDAAuD;AACvD,wBAAgB,gBAAgB,IAAI,aAAa,CAwEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,aAAa,CA2F1C;AAMD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,WAAW,CAIlE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,eAAe,CAE1E;AAED,wBAAgB,uBAAuB,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,oBAAoB,CAEpF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,kBAAkB,CAEhF;AAED,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,cAAc,CAExE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAkBtD"}

package/dist/config.js

@@ -23,6 +23,7 @@ export function getHistoryPath() {
 /** Returns a complete default configuration object. */
 export function getDefaultConfig() {
     return {
+        provider_mode: 'direct',
         defaultModel: 'auto',
         preferences: {
             autoCommit: false,
@@ -65,6 +66,29 @@ export function getDefaultConfig() {
                     autoExtend: true,
                     investigationMultiplier: 3,
                 },
+                sandboxMode: 'guard',
+                autoVerify: true,
+                autoVerifyMaxRepairs: 1,
+            },
+            agent: {
+                pool: {
+                    concurrencyLimit: 3,
+                    subtaskBudget: 12,
+                    preservePartialOnFailure: true,
+                },
+                loopGuard: {
+                    useSlidingWindow: true,
+                    blockWindowTurns: 10,
+                    blockResetOnSubtask: true,
+                },
+                routing: {
+                    honorVerificationFlag: true,
+                    allowUnverifiedDag: false,
+                },
+                dag: {
+                    serializeWriteConflicts: true,
+                    serializeMissingFiles: true,
+                },
             },
         },
         _firstRunComplete: false,
@@ -91,9 +115,20 @@ export function loadConfig() {
         const parsedSemanticLoopTrap = parsedSafety
             .semanticLoopTrap ?? {};
         const parsedToolCalls = parsedSafety.toolCalls ?? {};
+        const parsedAgent = parsedPreferences.agent ?? {};
+        const parsedAgentPool = parsedAgent.pool ?? {};
+        const parsedAgentLoopGuard = parsedAgent.loopGuard ?? {};
+        const parsedAgentRouting = parsedAgent.routing ?? {};
+        const parsedAgentDag = parsedAgent.dag ?? {};
+        // Back-compat: existing configs predating v1.1 don't have
+        // `provider_mode`. If they have a FreeLLMAPI key they were
+        // implicitly proxy users; otherwise they're either fresh or
+        // explicitly direct. Never silently flip an existing user.
+        const inferredMode = parsed.provider_mode ?? (parsed.freellmapi_api_key ? 'proxy' : 'direct');
         return {
             ...defaults,
             ...parsed,
+            provider_mode: inferredMode,
             preferences: {
                 ...defaults.preferences,
                 ...parsedPreferences,
@@ -117,6 +152,24 @@ export function loadConfig() {
                         ...parsedToolCalls,
                     },
                 },
+                agent: {
+                    pool: {
+                        ...defaults.preferences.agent.pool,
+                        ...parsedAgentPool,
+                    },
+                    loopGuard: {
+                        ...defaults.preferences.agent.loopGuard,
+                        ...parsedAgentLoopGuard,
+                    },
+                    routing: {
+                        ...defaults.preferences.agent.routing,
+                        ...parsedAgentRouting,
+                    },
+                    dag: {
+                        ...defaults.preferences.agent.dag,
+                        ...parsedAgentDag,
+                    },
+                },
             },
         };
     }
@@ -125,6 +178,32 @@ export function loadConfig() {
         return getDefaultConfig();
     }
 }
+// ---------------------------------------------------------------------------
+// Agent subsystem helpers (Phase 5 — see AgentConfig)
+// ---------------------------------------------------------------------------
+/**
+ * Returns the resolved {@link AgentConfig} from the loaded config.
+ * Guaranteed non-null — falls back to defaults for old configs that
+ * predate this namespace.
+ */
+export function getAgentConfig(config) {
+    const cfg = config ?? loadConfig();
+    if (cfg.preferences.agent)
+        return cfg.preferences.agent;
+    return getDefaultConfig().preferences.agent;
+}
+export function getAgentPoolConfig(config) {
+    return getAgentConfig(config).pool;
+}
+export function getAgentLoopGuardConfig(config) {
+    return getAgentConfig(config).loopGuard;
+}
+export function getAgentRoutingConfig(config) {
+    return getAgentConfig(config).routing;
+}
+export function getAgentDagConfig(config) {
+    return getAgentConfig(config).dag;
+}
 /**
  * Persists the given config to `~/.fixocli/config.json`.
  * Creates the config directory if it doesn't already exist.

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAqLrE,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE;YACX,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE;gBACV,YAAY,EAAE,MAAM;gBACpB,iBAAiB,EAAE,CAAC;gBACpB,YAAY,EAAE,IAAI;gBAClB,aAAa,EAAE,MAAM;gBACrB,kBAAkB,EAAE,GAAG;aACxB;YACD,MAAM,EAAE;gBACN,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;gBACjC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE;oBACR,YAAY,EAAE,CAAC;oBACf,cAAc,EAAE,CAAC;oBACjB,mBAAmB,EAAE,IAAI;oBACzB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,IAAI;iBACd;gBACD,gBAAgB,EAAE;oBAChB,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,CAAC;oBACb,YAAY,EAAE,CAAC;oBACf,cAAc,EAAE,CAAC;iBAClB;gBACD,kBAAkB,EAAE,EAAE,GAAG,IAAI;gBAC7B,kBAAkB,EAAE,GAAG;gBACvB,SAAS,EAAE;oBACT,SAAS,EAAE,EAAE;oBACb,SAAS,EAAE,GAAG;oBACd,UAAU,EAAE,IAAI;oBAChB,uBAAuB,EAAE,CAAC;iBAC3B;aACF;SACF;QACD,iBAAiB,EAAE,KAAK;KACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACzD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QAEpC,gEAAgE;QAChE,gEAAgE;QAChE,qDAAqD;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACnD,MAAM,gBAAgB,GACnB,iBAAgE,CAAC,UAAU,IAAI,EAAE,CAAC;QACrF,MAAM,YAAY,GACf,iBAAwD,CAAC,MAAM,IAAI,EAAE,CAAC;QACzE,MAAM,cAAc,GACjB,YAAuD,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC1E,MAAM,sBAAsB,GACzB,YAAuE;aACrE,gBAAgB,IAAI,EAAE,CAAC;QAC5B,MAAM,eAAe,GAClB,YAA8D,CAAC,SAAS,IAAI,EAAE,CAAC;QAClF,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,MAAM;YACT,WAAW,EAAE;gBACX,GAAG,QAAQ,CAAC,WAAW;gBACvB,GAAG,iBAAiB;gBACpB,UAAU,EAAE;oBACV,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU;oBAClC,GAAG,gBAAgB;iBACpB;gBACD,MAAM,EAAE;oBACN,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM;oBAC9B,GAAG,YAAY;oBACf,QAAQ,EAAE;wBACR,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ;wBACvC,GAAG,cAAc;qBAClB;oBACD,gBAAgB,EAAE;wBAChB,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB;wBAC/C,GAAG,sBAAsB;qBAC1B;oBACD,SAAS,EAAE;wBACT,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS;wBACxC,GAAG,eAAe;qBACnB;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAqB;IAC9C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACnE,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,CAAC,MAAM,eAAe,GAAG,qCAAqC,CAAC;AAwarE,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,aAAa,EAAE,QAAQ;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE;YACX,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,KAAK;YACtB,UAAU,EAAE;gBACV,YAAY,EAAE,MAAM;gBACpB,iBAAiB,EAAE,CAAC;gBACpB,YAAY,EAAE,IAAI;gBAClB,aAAa,EAAE,MAAM;gBACrB,kBAAkB,EAAE,GAAG;aACxB;YACD,MAAM,EAAE;gBACN,aAAa,EAAE,IAAI;gBACnB,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;gBACjC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE;oBACR,YAAY,EAAE,CAAC;oBACf,cAAc,EAAE,CAAC;oBACjB,mBAAmB,EAAE,IAAI;oBACzB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,IAAI;iBACd;gBACD,gBAAgB,EAAE;oBAChB,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,CAAC;oBACb,YAAY,EAAE,CAAC;oBACf,cAAc,EAAE,CAAC;iBAClB;gBACD,kBAAkB,EAAE,EAAE,GAAG,IAAI;gBAC7B,kBAAkB,EAAE,GAAG;gBACvB,SAAS,EAAE;oBACT,SAAS,EAAE,EAAE;oBACb,SAAS,EAAE,GAAG;oBACd,UAAU,EAAE,IAAI;oBAChB,uBAAuB,EAAE,CAAC;iBAC3B;gBACD,WAAW,EAAE,OAAO;gBACpB,UAAU,EAAE,IAAI;gBAChB,oBAAoB,EAAE,CAAC;aACxB;YACD,KAAK,EAAE;gBACL,IAAI,EAAE;oBACJ,gBAAgB,EAAE,CAAC;oBACnB,aAAa,EAAE,EAAE;oBACjB,wBAAwB,EAAE,IAAI;iBAC/B;gBACD,SAAS,EAAE;oBACT,gBAAgB,EAAE,IAAI;oBACtB,gBAAgB,EAAE,EAAE;oBACpB,mBAAmB,EAAE,IAAI;iBAC1B;gBACD,OAAO,EAAE;oBACP,qBAAqB,EAAE,IAAI;oBAC3B,kBAAkB,EAAE,KAAK;iBAC1B;gBACD,GAAG,EAAE;oBACH,uBAAuB,EAAE,IAAI;oBAC7B,qBAAqB,EAAE,IAAI;iBAC5B;aACF;SACF;QACD,iBAAiB,EAAE,KAAK;KACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACzD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QAEpC,gEAAgE;QAChE,gEAAgE;QAChE,qDAAqD;QACrD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QACnD,MAAM,gBAAgB,GACnB,iBAAgE,CAAC,UAAU,IAAI,EAAE,CAAC;QACrF,MAAM,YAAY,GACf,iBAAwD,CAAC,MAAM,IAAI,EAAE,CAAC;QACzE,MAAM,cAAc,GACjB,YAAuD,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC1E,MAAM,sBAAsB,GACzB,YAAuE;aACrE,gBAAgB,IAAI,EAAE,CAAC;QAC5B,MAAM,eAAe,GAClB,YAA8D,CAAC,SAAS,IAAI,EAAE,CAAC;QAClF,MAAM,WAAW,GACd,iBAAsD,CAAC,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,eAAe,GAClB,WAAmD,CAAC,IAAI,IAAI,EAAE,CAAC;QAClE,MAAM,oBAAoB,GACvB,WAA6D,CAAC,SAAS,IAAI,EAAE,CAAC;QACjF,MAAM,kBAAkB,GACrB,WAAyD,CAAC,OAAO,IAAI,EAAE,CAAC;QAC3E,MAAM,cAAc,GACjB,WAAiD,CAAC,GAAG,IAAI,EAAE,CAAC;QAC/D,0DAA0D;QAC1D,2DAA2D;QAC3D,4DAA4D;QAC5D,2DAA2D;QAC3D,MAAM,YAAY,GAChB,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE3E,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,MAAM;YACT,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE;gBACX,GAAG,QAAQ,CAAC,WAAW;gBACvB,GAAG,iBAAiB;gBACpB,UAAU,EAAE;oBACV,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU;oBAClC,GAAG,gBAAgB;iBACpB;gBACD,MAAM,EAAE;oBACN,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM;oBAC9B,GAAG,YAAY;oBACf,QAAQ,EAAE;wBACR,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ;wBACvC,GAAG,cAAc;qBAClB;oBACD,gBAAgB,EAAE;wBAChB,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB;wBAC/C,GAAG,sBAAsB;qBAC1B;oBACD,SAAS,EAAE;wBACT,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS;wBACxC,GAAG,eAAe;qBACnB;iBACF;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE;wBACJ,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAM,CAAC,IAAI;wBACnC,GAAG,eAAe;qBACnB;oBACD,SAAS,EAAE;wBACT,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAM,CAAC,SAAS;wBACxC,GAAG,oBAAoB;qBACxB;oBACD,OAAO,EAAE;wBACP,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAM,CAAC,OAAO;wBACtC,GAAG,kBAAkB;qBACtB;oBACD,GAAG,EAAE;wBACH,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAM,CAAC,GAAG;wBAClC,GAAG,cAAc;qBAClB;iBACF;aACF;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC;IACnC,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC;IACxD,OAAO,gBAAgB,EAAE,CAAC,WAAW,CAAC,KAAM,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IACvD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAsB;IACtD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAqB;IAC9C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAE3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QACnE,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC"}

package/dist/git/git-manager.d.ts

@@ -21,8 +21,39 @@ export declare class GitManager {
     undoLastCommit(): boolean;
     /** Get last N commit messages for display. */
     getRecentCommits(count?: number): string;
-    /** Discard all uncommitted modifications and untracked files in the workspace. */
-    discardUncommittedChanges(): void;
+    /**
+     * Discard the agent's edits to a specific set of files only.
+     *
+     * Background: an earlier version exposed a `discardUncommittedChanges()`
+     * method that ran `git checkout -- .` followed by `git clean -fd`,
+     * unconditionally wiping every uncommitted change in the workspace —
+     * including pre-existing user work the agent never touched. The
+     * orchestrator's failure-rollback path called it on any error, which
+     * meant a *read-only* task failing on a tool-call budget could
+     * destroy hours of unrelated in-progress work. That method has been
+     * removed. Callers must now name the files they want to roll back.
+     *
+     * For tracked files in `files`, the change is reverted to the
+     * `HEAD` revision. For untracked files in `files` (i.e. new files
+     * the agent created during the run), the file is unlinked. Files
+     * NOT in `files` are left completely alone — including any other
+     * uncommitted user work.
+     *
+     * Passing an empty list is a no-op.
+     *
+     * @param files Absolute or workspace-relative paths the run actually modified.
+     */
+    discardChangesIn(files: string[]): void;
+    /**
+     * Escape hatch — full workspace wipe (`git checkout -- .` + `git clean -fd`).
+     * Removed from any agent-driven path; intentionally kept here for
+     * the rare case where a user explicitly chooses to discard
+     * everything from a slash command. Callers must pass
+     * `{ iAmCertain: true }` to spell out the intent.
+     */
+    forceDiscardAllUncommittedChanges(opts: {
+        iAmCertain: true;
+    }): void;
     /**
      * Create a named workspace snapshot commit (works in non-auto-commit mode).
      * Stages all changes and commits with "fixo-snapshot: <label>" message.

package/dist/git/git-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-manager.d.ts","sourceRoot":"","sources":["../../src/git/git-manager.ts"],"names":[],"mappings":"AAsBA,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,KAAK,CAAiB;gBAElB,GAAG,EAAE,MAAM;IAKvB,iEAAiE;IACjE,SAAS,IAAI,OAAO;IAapB,mCAAmC;IACnC,gBAAgB,IAAI,MAAM;IAY1B,8CAA8C;IAC9C,UAAU,IAAI,OAAO;IAarB,qFAAqF;IACrF,aAAa,IAAI,MAAM,EAAE;IAuBzB,8CAA8C;IAC9C,OAAO,IAAI,MAAM;IA8CjB;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAkEhE,yEAAyE;IACzE,cAAc,IAAI,OAAO;IAsCzB,8CAA8C;IAC9C,gBAAgB,CAAC,KAAK,SAAI,GAAG,MAAM;IAWnC,kFAAkF;IAClF,yBAAyB,IAAI,IAAI;IAWjC;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAgC7C"}
+{"version":3,"file":"git-manager.d.ts","sourceRoot":"","sources":["../../src/git/git-manager.ts"],"names":[],"mappings":"AAwBA,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,KAAK,CAAiB;gBAElB,GAAG,EAAE,MAAM;IAKvB,iEAAiE;IACjE,SAAS,IAAI,OAAO;IAapB,mCAAmC;IACnC,gBAAgB,IAAI,MAAM;IAY1B,8CAA8C;IAC9C,UAAU,IAAI,OAAO;IAarB,qFAAqF;IACrF,aAAa,IAAI,MAAM,EAAE;IA8BzB,8CAA8C;IAC9C,OAAO,IAAI,MAAM;IA8CjB;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI;IAkEhE,yEAAyE;IACzE,cAAc,IAAI,OAAO;IAsCzB,8CAA8C;IAC9C,gBAAgB,CAAC,KAAK,SAAI,GAAG,MAAM;IAWnC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAiDvC;;;;;;OAMG;IACH,iCAAiC,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI;IAanE;;;;OAIG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAiC7C"}

package/dist/git/git-manager.js

@@ -3,6 +3,8 @@
  * All git operations are safely sandboxed to the workspace directory.
  */
 import { execFileSync } from 'child_process';
+import fs from 'node:fs';
+import path from 'node:path';
 import { WorkspaceGuard } from '../workspace-guard.js';
 import { C } from '../ui/colors.js';
 /* ──────────────────────── ANSI Colors ──────────────────────── */
@@ -69,21 +71,27 @@ export class GitManager {
         if (!this.isGitRepo())
             return [];
         try {
-            const output = execFileSync('git', ['status', '--porcelain'], {
+            const output = execFileSync('git', ['status', '--porcelain', '-z'], {
                 cwd: this.cwd,
                 encoding: 'utf-8',
                 stdio: ['pipe', 'pipe', 'pipe'],
             });
-            return output.split('\n')
-                .map(line => line.trim())
-                .filter(line => line.length > 0)
-                .map(line => {
-                let p = line.slice(2).trim();
-                if (p.startsWith('"') && p.endsWith('"')) {
-                    p = p.slice(1, -1).replace(/\\"/g, '"');
+            if (!output)
+                return [];
+            const files = [];
+            const parts = output.split('\0');
+            for (let i = 0; i < parts.length; i++) {
+                const part = parts[i];
+                if (!part)
+                    continue;
+                const xy = part.slice(0, 2);
+                files.push(part.slice(3));
+                // If it's a rename (R) or copy (C), skip the old path that follows
+                if (xy[0] === 'R' || xy[0] === 'C') {
+                    i++;
                 }
-                return p;
-            });
+            }
+            return files;
         }
         catch {
             return [];
@@ -242,17 +250,104 @@ export class GitManager {
             return '(no commits)';
         }
     }
-    /** Discard all uncommitted modifications and untracked files in the workspace. */
-    discardUncommittedChanges() {
+    /**
+     * Discard the agent's edits to a specific set of files only.
+     *
+     * Background: an earlier version exposed a `discardUncommittedChanges()`
+     * method that ran `git checkout -- .` followed by `git clean -fd`,
+     * unconditionally wiping every uncommitted change in the workspace —
+     * including pre-existing user work the agent never touched. The
+     * orchestrator's failure-rollback path called it on any error, which
+     * meant a *read-only* task failing on a tool-call budget could
+     * destroy hours of unrelated in-progress work. That method has been
+     * removed. Callers must now name the files they want to roll back.
+     *
+     * For tracked files in `files`, the change is reverted to the
+     * `HEAD` revision. For untracked files in `files` (i.e. new files
+     * the agent created during the run), the file is unlinked. Files
+     * NOT in `files` are left completely alone — including any other
+     * uncommitted user work.
+     *
+     * Passing an empty list is a no-op.
+     *
+     * @param files Absolute or workspace-relative paths the run actually modified.
+     */
+    discardChangesIn(files) {
+        if (!this.isGitRepo())
+            return;
+        if (files.length === 0) {
+            console.log(`${colors.dim}  ⏪ Rollback: nothing to discard (0 files reported).${colors.reset}`);
+            return;
+        }
+        const relativeFiles = files.map((f) => path.isAbsolute(f) ? path.relative(this.cwd, f) : f);
+        const tracked = [];
+        const untracked = [];
+        try {
+            for (const rel of relativeFiles) {
+                let status = '';
+                try {
+                    status = execFileSync('git', ['status', '--porcelain', '-z', '--', rel], {
+                        cwd: this.cwd,
+                        encoding: 'utf-8',
+                        stdio: ['pipe', 'pipe', 'pipe'],
+                    });
+                }
+                catch {
+                    // safe: file may have been deleted mid-run; treat as no-op
+                    continue;
+                }
+                if (!status)
+                    continue; // file is clean — nothing to roll back
+                if (status.startsWith('??'))
+                    untracked.push(rel);
+                else
+                    tracked.push(rel);
+            }
+            if (tracked.length > 0) {
+                execFileSync('git', ['checkout', 'HEAD', '--', ...tracked], {
+                    cwd: this.cwd,
+                    stdio: ['pipe', 'pipe', 'pipe'],
+                });
+            }
+            for (const rel of untracked) {
+                try {
+                    fs.unlinkSync(path.join(this.cwd, rel));
+                }
+                catch { /* safe: best-effort */ }
+            }
+            const total = tracked.length + untracked.length;
+            if (total > 0) {
+                console.log(`${colors.green}  ⏪ Rolled back ${tracked.length} modified + ${untracked.length} new file(s) the agent touched.${colors.reset}`);
+            }
+            else {
+                console.log(`${colors.dim}  ⏪ Rollback: agent-touched files were already clean.${colors.reset}`);
+            }
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            console.log(`${colors.yellow}  ⚠ Failed to discard targeted changes: ${msg}${colors.reset}`);
+        }
+    }
+    /**
+     * Escape hatch — full workspace wipe (`git checkout -- .` + `git clean -fd`).
+     * Removed from any agent-driven path; intentionally kept here for
+     * the rare case where a user explicitly chooses to discard
+     * everything from a slash command. Callers must pass
+     * `{ iAmCertain: true }` to spell out the intent.
+     */
+    forceDiscardAllUncommittedChanges(opts) {
+        if (!opts.iAmCertain)
+            return;
         if (!this.isGitRepo())
             return;
         try {
             execFileSync('git', ['checkout', '--', '.'], { cwd: this.cwd, stdio: ['pipe', 'pipe', 'pipe'] });
             execFileSync('git', ['clean', '-fd'], { cwd: this.cwd, stdio: ['pipe', 'pipe', 'pipe'] });
-            console.log(`${colors.green}  ⏪ Discarded all uncommitted workspace changes due to execution failure.${colors.reset}`);
+            console.log(`${colors.green}  ⏪ Discarded ALL uncommitted workspace changes (explicit user request).${colors.reset}`);
         }
         catch (error) {
-            console.log(`${colors.yellow}  ⚠ Failed to discard uncommitted changes: ${error.message || error}${colors.reset}`);
+            const msg = error instanceof Error ? error.message : String(error);
+            console.log(`${colors.yellow}  ⚠ Failed to discard uncommitted changes: ${msg}${colors.reset}`);
         }
     }
     /**
@@ -285,7 +380,8 @@ export class GitManager {
             return hash;
         }
         catch (error) {
-            console.log(`${colors.yellow}  ⚠ Snapshot failed: ${(error.message || String(error)).slice(0, 80)}${colors.reset}`);
+            const msg = error instanceof Error ? error.message : String(error);
+            console.log(`${colors.yellow}  ⚠ Snapshot failed: ${msg.slice(0, 80)}${colors.reset}`);
             return null;
         }
     }