indusagi-coding-agent 0.1.61 → 0.2.0

package/dist/types/conductor/permissions.d.ts

@@ -0,0 +1,217 @@
+/**
+ * Permission rule engine + the `canUseTool` gate seam.
+ *
+ * This module is the product-side brain of the permission stack. It is split in
+ * two layers:
+ *
+ *   1. **A pure rule engine** — {@link resolveRuleDecision} maps a single tool
+ *      call `(toolName, input, mode, rules)` to a {@link PermissionBehavior}
+ *      (`allow` / `ask` / `deny`). It is total, synchronous, and side-effect free
+ *      so the precedence (deny > ask > mode auto-allow > allow) is exhaustively
+ *      unit-testable. Rule strings are induscode-style: a bare tool name
+ *      (`"Bash"`) or a tool name with an argument specifier
+ *      (`"Bash(npm run test:*)"`).
+ *
+ *   2. **A gate factory** — {@link createPermissionGate} turns that engine into a
+ *      framework {@link CanUseToolFn}: the hard async hook the framework agent
+ *      awaits immediately before every tool runs. An `ask` decision is routed to
+ *      an OPTIONAL host-supplied approval resolver; when the resolver is absent
+ *      (a non-interactive boot) `ask` denies with a clear message. An
+ *      `allow-always` approval appends a session-scoped allow rule so later
+ *      identical calls auto-allow.
+ *
+ * Backwards-compatibility: the framework `canUseTool` hook is itself optional, so
+ * a session that never builds a gate keeps today's allow-all behavior. A gate
+ * built from an empty rule set in `default` mode allows read-only tools and asks
+ * for everything else — and, with no resolver, the `ask` denials are explicit
+ * rather than silent.
+ */
+import type { PermissionMode } from "../settings";
+/** Re-exported so consumers of the engine get the mode vocabulary in one import. */
+export type { PermissionMode };
+/** The verdict the rule engine renders for a single tool call. */
+export type PermissionBehavior = "allow" | "ask" | "deny";
+/**
+ * One parsed permission rule: a behavior plus the tool it targets, with an
+ * optional argument specifier (`ruleContent`) that further narrows the match.
+ */
+export interface PermissionRule {
+    /** What happens when this rule matches a tool call. */
+    readonly ruleBehavior: PermissionBehavior;
+    /** The tool (and optional argument specifier) this rule selects. */
+    readonly ruleValue: {
+        /** The canonical tool name, e.g. `"Bash"` / `"bash"` (matched case-insensitively). */
+        readonly toolName: string;
+        /** An optional argument specifier, e.g. `"npm run test:*"`. Absent = bare match. */
+        readonly ruleContent?: string;
+    };
+}
+/**
+ * The framework's tool-permission verdict. Mirrors `indusagi/agent`'s
+ * `PermissionDecision`; re-declared here so the product engine never imports the
+ * framework just for a structural type (the gate is assignable to the
+ * framework's `CanUseToolFn` because the shapes coincide).
+ */
+export type PermissionDecision = {
+    behavior: "allow";
+    updatedInput?: unknown;
+} | {
+    behavior: "deny";
+    message: string;
+};
+/**
+ * The hard permission gate the framework agent awaits before each tool executes.
+ * Structurally identical to `indusagi/agent`'s `CanUseToolFn`, so a value of this
+ * type is accepted by `new Agent({ canUseTool })` with no cast.
+ */
+export type CanUseToolFn = (toolName: string, input: unknown, opts: {
+    signal?: AbortSignal;
+}) => Promise<PermissionDecision>;
+/**
+ * The outcome of the host approval prompt raised for an `ask` decision:
+ *   - `allow-once`   — run this single call, do not remember.
+ *   - `allow-always` — run it and append a session allow rule for the tool.
+ *   - `deny`         — block this call.
+ */
+export type ApprovalChoice = "allow-once" | "allow-always" | "deny";
+/**
+ * The OPTIONAL host approval resolver. When present, an `ask` decision awaits it;
+ * the host (an interactive overlay) returns the user's choice. It MUST resolve to
+ * `"deny"` on abort so a cancelled turn never hangs on a pending prompt. When the
+ * resolver is absent (non-interactive boot / oneshot / link), an `ask` decision
+ * deterministically denies.
+ */
+export type ApprovalResolver = (toolName: string, input: unknown, opts: {
+    signal?: AbortSignal;
+}) => Promise<ApprovalChoice>;
+/**
+ * Tool names known to only inspect state (never mutate). Mirrors the framework's
+ * `READ_ONLY_TOOL_NAMES`; matched case-insensitively. A tool the framework marks
+ * `readOnly: true` is also auto-allowed via {@link createPermissionGate}'s
+ * `readOnlyToolNames` option, so this set is the static fallback for callers that
+ * only know names.
+ */
+export declare const READ_ONLY_TOOL_NAMES: ReadonlySet<string>;
+/**
+ * Tool names that mutate the workspace by editing or writing files. Auto-allowed
+ * under `acceptEdits`, and (together with every other non-read-only tool) denied
+ * under `plan`.
+ */
+export declare const EDIT_TOOL_NAMES: ReadonlySet<string>;
+/** Whether `toolName` is a statically-known read-only tool. */
+export declare function isReadOnlyToolName(toolName: string, extra?: ReadonlySet<string>): boolean;
+/** Whether `toolName` is an edit/write tool (auto-allowed under `acceptEdits`). */
+export declare function isEditToolName(toolName: string): boolean;
+/**
+ * Parse an induscode-style rule string into its tool name and optional argument
+ * specifier.
+ *
+ *   - `"Bash"`                 → `{ toolName: "Bash" }`
+ *   - `"Bash(npm run test:*)"` → `{ toolName: "Bash", ruleContent: "npm run test:*" }`
+ *   - `"mcp__server"`          → `{ toolName: "mcp__server" }`
+ *
+ * Whitespace around the tool name is trimmed; an empty argument specifier
+ * (`"Bash()"`) is treated as a bare rule.
+ */
+export declare function parseRule(raw: string): {
+    toolName: string;
+    ruleContent?: string;
+};
+/**
+ * Build a {@link PermissionRule} from a behavior and an induscode-style rule
+ * string. The single place a raw settings list entry becomes a typed rule.
+ */
+export declare function makeRule(ruleBehavior: PermissionBehavior, raw: string): PermissionRule;
+/**
+ * Whether a tool call matches a rule (the ANY-match semantics used for deny/ask).
+ *
+ * The tool name must match (case-insensitive), with an `mcp__server` rule also
+ * matching every `mcp__server__tool` under it (the induscode MCP-wildcard
+ * convention). A bare rule (no specifier) matches any arguments.
+ *
+ * When the rule carries an argument specifier:
+ *   - for the **shell** tool the command is split into its constituent
+ *     sub-commands and the specifier is tested against EACH — a match on ANY
+ *     sub-command counts (so `Bash(rm:*)` denies `git status && rm x`);
+ *   - for any other tool the specifier is tested against the single rendered
+ *     subject (the command field, or a JSON encoding).
+ *
+ * The any-match semantics are correct for `deny` and `ask` (a single offending
+ * sub-command should trigger them). The `allow` branch needs ALL sub-commands
+ * covered instead — see {@link bashAllowCoversAll}.
+ */
+export declare function toolMatchesRule(toolName: string, input: unknown, rule: PermissionRule): boolean;
+/**
+ * Resolve the behavior for a single tool call against the rule set and mode.
+ *
+ * Precedence, highest first:
+ *   1. **deny rules** — any matching `deny` rule blocks, regardless of mode. Deny
+ *      wins across every tier (the caller concatenates the tiers before passing
+ *      the list in, and this scans all deny rules first).
+ *   2. **plan mode** — denies any mutating (non-read-only) tool outright.
+ *   3. **ask rules** — a matching `ask` rule forces a prompt (unless a deny
+ *      already fired). Mode auto-allow does NOT override an explicit ask.
+ *   4. **bypass mode** — allows everything not already denied/asked.
+ *   5. **read-only auto-allow** — a known read-only tool allows in any mode.
+ *   6. **acceptEdits mode** — auto-allows edit/write tools.
+ *   7. **allow rules** — a matching `allow` rule (or, for the shell tool, the
+ *      allow rule SET) allows.
+ *   8. **fallthrough** — `ask` (the safe default: prompt, then deny when no
+ *      resolver is wired).
+ *
+ * The catastrophic-command blocklist sits ABOVE all of this (step 0): a shell
+ * command on the built-in blocklist (`rm -rf /`, fork bombs, `curl | sh`, …) is
+ * denied regardless of rules or mode — even `bypass` cannot run it. See
+ * {@link evaluateCatastrophic}.
+ *
+ * Shell handling threads through the per-sub-command matching: a compound
+ * command (`a && b; c | d`) is split into its constituent commands and each rule
+ * is evaluated against each — a deny/ask on ANY sub-command fires, while
+ * auto-allow requires the allow rule set to cover EVERY sub-command.
+ *
+ * Pure and total: no I/O, no async, deterministic for a given input.
+ */
+export declare function resolveRuleDecision(toolName: string, input: unknown, rules: readonly PermissionRule[], mode: PermissionMode, readOnlyExtra?: ReadonlySet<string>): PermissionBehavior;
+/** Configuration for {@link createPermissionGate}. */
+export interface PermissionGateConfig {
+    /**
+     * The ordered rule set, already concatenated across the project/global tiers.
+     * Deny rules are scanned first so a deny anywhere in the list wins.
+     */
+    readonly rules: readonly PermissionRule[];
+    /** A live getter for the current permission mode (so a mode switch is honored). */
+    readonly mode: () => PermissionMode;
+    /**
+     * The OPTIONAL host approval resolver consulted on an `ask` decision. Absent on
+     * a non-interactive boot — then `ask` deterministically denies.
+     */
+    readonly requestApproval?: ApprovalResolver;
+    /**
+     * Append a session-scoped allow rule when the host returns `allow-always`. The
+     * conductor owns the mutable rule list and passes a setter here so the new rule
+     * is visible to subsequent calls within the session.
+     */
+    readonly appendAllowRule?: (rule: PermissionRule) => void;
+    /**
+     * Tool names (beyond {@link READ_ONLY_TOOL_NAMES}) to treat as read-only —
+     * derived from the deck's `readOnly: true` tool flags so MCP/custom read-only
+     * tools also auto-allow.
+     */
+    readonly readOnlyToolNames?: ReadonlySet<string>;
+}
+/**
+ * Build a framework {@link CanUseToolFn} from the rule engine + the current mode.
+ *
+ * The returned gate:
+ *   - resolves the behavior via {@link resolveRuleDecision},
+ *   - on `allow` proceeds (the framework keeps the validated args),
+ *   - on `deny` short-circuits with a clear message (the framework turns it into
+ *     an `isError` tool result so the model sees why),
+ *   - on `ask` awaits {@link PermissionGateConfig.requestApproval} when present —
+ *     `allow-once` proceeds, `allow-always` proceeds and appends a session allow
+ *     rule, `deny` blocks — and DENIES when no resolver is wired (the safe
+ *     non-interactive default).
+ *
+ * The result is assignable to `indusagi/agent`'s `CanUseToolFn`.
+ */
+export declare function createPermissionGate(config: PermissionGateConfig): CanUseToolFn;

package/dist/types/conductor/permissions.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Permission rule engine + gate — unit tests.
+ *
+ * Exhaustively pins the pure decision ({@link resolveRuleDecision}) precedence
+ * (deny > plan-deny > ask > bypass > read-only > acceptEdits > allow > ask
+ * fallthrough), the induscode rule parsing/matching ({@link parseRule},
+ * {@link toolMatchesRule}, including argument specifiers and the `mcp__` wildcard),
+ * the mode behaviors, and the {@link createPermissionGate} `ask` routing — a host
+ * resolver returns allow-once / allow-always (which appends a session allow rule)
+ * / deny, and an ABSENT resolver denies. No framework, no network.
+ */
+export {};

package/dist/types/conductor/plan-mode.integration.test.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Plan-mode round-trip — integration across the gate + the conductor handshake.
+ *
+ * Two proofs, against the REAL wired pieces (the rule engine's gate + the live
+ * conductor), not mocks of an unwired module:
+ *
+ *   1. **The gate denies edits in plan mode.** A `createPermissionGate` whose mode
+ *      getter reads the conductor's LIVE `permissionMode()` allows an edit in
+ *      `default` mode, denies it once the conductor enters plan mode
+ *      (`togglePlanMode(true)` / `setPermissionMode('plan')`), and allows it again
+ *      once an approved exit restores the prior mode. This is the exact gate the
+ *      conductor threads into the framework `Agent`, so the deny lands where tools
+ *      execute.
+ *
+ *   2. **ExitPlanMode approval restores the mode, persists the plan, and resumes.**
+ *      A scripted fake agent emits a `tool_execution_end` carrying the
+ *      `{ exitPlan: true, plan }` detail the conductor intercepts. With an approval
+ *      resolver installed that approves, a turn run while in plan mode: restores
+ *      the captured pre-plan mode, writes the plan to a file under `plansDir`, and
+ *      enqueues the approved plan as a follow-up so the model proceeds from it. A
+ *      rejecting resolver keeps the session in plan mode and writes nothing.
+ */
+export {};

package/dist/types/conductor/post-edit-diagnostics.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Conductor-integration tests for the post-edit live-diagnostics seam.
+ *
+ * Drives a scripted {@link AgentLike} that emits a `tool_execution_start` for an
+ * `edit`/`write` tool during `prompt`, with an injected {@link DiagnosticsEngine}
+ * over a scripted in-memory runner (no real tsc spawn). Verifies:
+ *   - a turn that introduces a NEW diagnostic enqueues the summary follow-up;
+ *   - a clean edit (no new diagnostics) enqueues nothing;
+ *   - re-editing a file re-surfaces a previously-cleared diagnostic;
+ *   - a non-TS edit never triggers the checker;
+ *   - the injected follow-up turn (which edits nothing) does not loop.
+ */
+export {};

package/dist/types/conductor/transcript-store/serialize.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Transcript serialization — head usage round-trip.
+ *
+ * Focused coverage for the cost-cmd durability seam: the head line now carries
+ * the session's cumulative {@link Usage}, and {@link encodeHead} →
+ * {@link parseSessionText} must round-trip it faithfully so resume can restore the
+ * running token/cost total instead of seeding zero. Heads without usage (legacy
+ * files, fresh sessions) must still parse cleanly with `usage` absent.
+ */
+export {};

package/dist/types/conductor/transcript-store/store.d.ts

@@ -27,6 +27,7 @@
  */
 import type { AgentMessage, SessionHead, TranscriptEntry, TranscriptRole } from "../contract";
 import { TRANSCRIPT_SCHEMA } from "../contract";
+import type { Usage } from "indusagi/ai";
 /**
  * Where a transcript's NDJSON log lives. The store appends lines and, on branch,
  * rewrites the whole file; a backend supplies those three primitives plus a way
@@ -101,6 +102,13 @@ export declare class TranscriptStore {
     get sessionId(): string;
     /** The current head (session id + active leaf). */
     get head(): SessionHead;
+    /**
+     * The cumulative session usage last persisted onto the head, or `undefined`
+     * when none has been written (a fresh session, or a legacy file without a
+     * usage-bearing head). `resume` reads this to restore the running token/cost
+     * total instead of seeding zero.
+     */
+    get usage(): Usage | undefined;
     /** Number of nodes currently in the transcript. */
     get size(): number;
     /** Backend location this session persists to (for diagnostics/UI). */
@@ -116,6 +124,16 @@ export declare class TranscriptStore {
      * a settled turn.
      */
     append(content: AgentMessage, role?: TranscriptRole, meta?: Readonly<Record<string, unknown>>): Promise<TranscriptEntry>;
+    /**
+     * Persist the session's cumulative usage onto the head and rewrite the backing
+     * file so the running token/cost total survives a reload. Distinct from
+     * {@link append}, which only appends an entry line and never rewrites the head:
+     * usage durability MUST flow through here so the re-emitted head line carries
+     * the latest tally. Leaves the node tree and active leaf untouched.
+     *
+     * @param usage the cumulative usage to pin on the head
+     */
+    persistUsage(usage: Usage): Promise<void>;
     /**
      * Repoint the head at an earlier node, forking a branch. The next {@link append}
      * becomes a child of `id`; existing nodes are untouched. Rewrites the head line.

package/dist/types/console/components/Banner.d.ts

@@ -33,6 +33,26 @@ export interface BannerProps {
      * single compact header line. Wired from the verbose / quiet-startup flag.
      */
     readonly quiet?: boolean;
+    /**
+     * When set, the masthead auto-condenses to a single emblem + brand + model
+     * line (the repeat-launch presentation): the user has already seen this
+     * version's full masthead, so the big wordmark is skipped. Distinct from
+     * {@link quiet}, which is the manual suppression toggle; either collapses the
+     * banner, but `compact` keeps the small emblem and the welcome line.
+     */
+    readonly compact?: boolean;
+    /**
+     * The signed-in account label, used for the personalized "Welcome back,
+     * {name}!" line. Absent → the plain "Welcome back!" fallback is shown.
+     */
+    readonly name?: string;
+    /**
+     * Opt-in static colour-sweep flourish: when set, the wordmark and emblem fill
+     * are tinted along a frozen primary→secondary gradient instead of the flat
+     * accent. The caller is responsible for suppressing it under reduced-motion /
+     * non-TTY; this prop is simply the resolved on/off decision.
+     */
+    readonly sweep?: boolean;
     /** The gathered session resources rendered as the Startup Map panel. */
     readonly startup?: StartupMap;
     /** Out-of-band lines drawn above the wordmark (errors, warnings, info). */
@@ -43,12 +63,14 @@ export interface BannerProps {
 /**
  * Render the console masthead.
  *
- * In the default (loud) mode this is the block-letter wordmark, the brand /
- * version line, the optional notices region, the bordered Startup Map, and the
- * changelog block. The {@link BannerProps.quiet} flag collapses all of that to a
- * single compact header line (brand + version + model), still carrying the
- * notices and a condensed changelog so nothing important is silently dropped.
+ * In the default (loud) mode this is the two-tone emblem beside the block-letter
+ * wordmark, the brand / version line, the personalized welcome line, the
+ * optional notices region, the bordered Startup Map, and the changelog block.
+ * The {@link BannerProps.quiet} or {@link BannerProps.compact} flags collapse
+ * all of that to a single compact header line (emblem glyph + brand + version +
+ * model), still carrying the welcome line, the notices, and a condensed
+ * changelog so nothing important is silently dropped.
  *
  * @param props the wordmark context, version, session facts, and startup chrome
  */
-export declare function Banner({ theme, modelId, workspace, version, verbose, quiet, startup, notices, changelog, }: BannerProps): JSX.Element;
+export declare function Banner({ theme, modelId, workspace, version, verbose, quiet, compact, name, sweep, startup, notices, changelog, }: BannerProps): JSX.Element;

package/dist/types/console/components/Emblem.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Emblem — the two-tone block monogram that sits to the left of the wordmark
+ * (roadmap #2).
+ *
+ * Before this, the masthead was lettering alone — the "INDUS CODE" wordmark
+ * *was* the whole identity, painted in one flat accent. The emblem gives the
+ * brand a *mark*: a small fixed-width block glyph built from the box quadrant
+ * family (`▛ ▜ ▙ ▟ ▝ ▘ ▗ ▖ █ ▓`), split per row into a bright "fill" span and a
+ * dim "shadow" span so it reads as a single solid shape lit from one corner.
+ * The fill is the primary accent; the shadow is the secondary accent — the two
+ * distinct palette hues the scheme already carries — so the mark is genuinely
+ * two-tone rather than a single colour with a darker edge.
+ *
+ * It is purely presentational: a fixed glyph grid tinted through the framework
+ * {@link InkThemeAdapter} at render time, no state, no effects, no props beyond
+ * the theme and an optional row-colour override the banner uses to fold the
+ * emblem's fill into a frozen colour-sweep.
+ *
+ * Layout is a `flexDirection="column"` of one `<Box>` per row; within a row the
+ * fill and shadow are adjacent `<Text>` spans so each row's two tones share a
+ * line. The whole emblem is the same display width on every row, so it stacks
+ * into a clean column the wordmark can sit beside in a parent row Box.
+ */
+import type { InkThemeAdapter } from "indusagi/react-ink";
+/** How many terminal rows the emblem occupies (its glyph-grid height). */
+export declare const EMBLEM_HEIGHT: number;
+/** What the {@link Emblem} renders. */
+export interface EmblemProps {
+    /** The framework adapter that turns token roles into terminal colours. */
+    readonly theme: InkThemeAdapter;
+    /**
+     * Optional per-row fill colour (a `#rrggbb` hex), indexed by row. When supplied
+     * (the banner's frozen colour-sweep), row `i`'s fill is painted with
+     * `rowColors[i]` via chalk's hex path instead of the flat accent role; the
+     * shadow keeps the secondary accent so the mark stays two-tone. Absent rows
+     * fall back to the accent role.
+     */
+    readonly rowColors?: readonly string[];
+}
+/**
+ * Render the two-tone block emblem.
+ *
+ * Each row paints its fill span in the accent role (or the supplied sweep colour
+ * for that row) and its shadow span in the secondary `customMessage` role, so the
+ * monogram reads as one solid mark with a lit and a shadowed face.
+ *
+ * @param props the theme adapter and an optional per-row fill-colour override
+ */
+export declare function Emblem({ theme, rowColors }: EmblemProps): JSX.Element;

package/dist/types/console/components/StatusBar.d.ts

@@ -10,6 +10,7 @@
  * (Renamed surface: the console's status strip.)
  */
 import { type InkThemeAdapter, type SessionSnapshot, type StatusMessage } from "indusagi/react-ink";
+import type { PermissionMode } from "../../settings";
 /** What the {@link StatusBar} renders. */
 export interface StatusBarProps {
     /** The framework adapter that turns token roles into terminal colours. */
@@ -22,10 +23,20 @@ export interface StatusBarProps {
     readonly providerCount: number;
     /** The transient status toast, when one is showing. */
     readonly status?: StatusMessage;
+    /**
+     * The active permission mode. When supplied, a small badge is rendered above the
+     * footer (parallel to the transient status toast) so the user can see at a glance
+     * which of the four cycled modes is live: `default` (tools prompt as usual),
+     * `acceptEdits` (edits auto-approved), `plan` (mutating tools blocked), or
+     * `bypass` (every tool auto-allowed — drawn in an alert colour). The
+     * `bypassPermissions` alias renders as `bypass`. Omitted renders nothing extra.
+     */
+    readonly permissionMode?: PermissionMode;
 }
 /**
- * Render the toast row above the footer strip.
+ * Render the toast row above the footer strip, plus an optional permission-mode
+ * badge when a non-default mode is active.
  *
- * @param props the snapshot + status to display
+ * @param props the snapshot + status (+ optional permission mode) to display
  */
-export declare function StatusBar({ theme, snapshot, branch, providerCount, status, }: StatusBarProps): JSX.Element;
+export declare function StatusBar({ theme, snapshot, branch, providerCount, status, permissionMode, }: StatusBarProps): JSX.Element;

package/dist/types/console/components/WorkingIndicator.d.ts

@@ -0,0 +1,44 @@
+/**
+ * WorkingIndicator — the live "agent is working" affordance.
+ *
+ * While a turn is in flight (`busy`) this draws an animated braille spinner, a
+ * label, an elapsed-seconds clock, and an "esc to interrupt" hint. The label is
+ * a rotating whimsical word (changing every few seconds, induscode-style) for
+ * the general thinking/streaming case, and a concrete phase label while the
+ * agent runs tools or compacts context.
+ *
+ * It renders nothing when idle, and self-drives its animation via a short
+ * interval that ticks ONLY while busy (torn down the moment `busy` clears), so an
+ * idle console does no spinner work. It is a sibling row above the
+ * {@link Composer} and does NOT consume the sticky status toast — so a previous
+ * toast (e.g. the permission-mode line) can never mask that the agent is working.
+ */
+import type { InkThemeAdapter } from "indusagi/react-ink";
+/**
+ * The rotating "thinking" words shown while the agent reasons/streams. Whimsical
+ * present participles, in the spirit of induscode's spinner — purely cosmetic.
+ */
+export declare const WORKING_WORDS: readonly ["Cogitating", "Pondering", "Noodling", "Simmering", "Brewing", "Percolating", "Conjuring", "Tinkering", "Wrangling", "Synthesizing", "Computing", "Musing", "Scheming", "Hatching", "Whirring", "Crunching", "Spelunking", "Untangling", "Marinating", "Ruminating", "Architecting", "Finagling", "Concocting", "Deliberating", "Orchestrating", "Calibrating", "Channeling", "Vibing", "Forging", "Assembling"];
+/** Pick a working word by (wrapping, non-negative) index. Exported for testing. */
+export declare function pickWord(index: number): string;
+/** What the {@link WorkingIndicator} renders. */
+export interface WorkingIndicatorProps {
+    /** The framework adapter that turns token roles into terminal colours. */
+    readonly theme: InkThemeAdapter;
+    /** Whether a turn is in flight. When false the indicator renders nothing. */
+    readonly busy: boolean;
+    /** The conductor snapshot phase, used to pick a concrete label when relevant. */
+    readonly phase?: string;
+}
+/**
+ * The concrete label for the phases where a specific word is more useful than a
+ * whimsical one. Returns null for the general thinking/streaming case (the caller
+ * then shows a rotating {@link WORKING_WORDS} word instead). Exported for testing.
+ */
+export declare function phaseLabel(phase: string | undefined): string | null;
+/**
+ * Render the animated working row, or nothing when idle.
+ *
+ * @param props the theme, the busy flag, and the snapshot phase
+ */
+export declare function WorkingIndicator({ theme, busy, phase, }: WorkingIndicatorProps): JSX.Element | null;

package/dist/types/console/components/WorkingIndicator.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WorkingIndicator — unit tests for the pure label/word logic.
+ *
+ * The animated render is driven by an Ink-only timer that is impractical to
+ * assert headlessly; the load-bearing pure logic is {@link phaseLabel} (concrete
+ * labels for tool/compaction phases) and {@link pickWord} (the rotating whimsical
+ * word for the general thinking case).
+ */
+export {};

package/dist/types/console/components/banner-sweep.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Banner colour-sweep helpers — the pure, render-agnostic maths behind the
+ * optional startup flourish (roadmap #14) and the personalized welcome line
+ * (#7).
+ *
+ * Two concerns, no React or Ink, no I/O, no state:
+ *
+ *   - {@link rowGradient} computes a *frozen* (single-pass, no animation timer)
+ *     colour for one wordmark row by lerping between two palette hexes across
+ *     the block's rows. The banner paints row `i` of `n` with this colour when
+ *     the opt-in sweep is on; off, the wordmark stays a flat accent. Because it
+ *     takes no clock and never schedules a frame, it is reduced-motion safe by
+ *     construction — the suppression decision lives at the call site, which
+ *     simply does not ask for a gradient when motion is reduced.
+ *
+ *   - {@link welcomeLine} formats the "Welcome back{, name}!" greeting from the
+ *     signed-in account label, with a length guard and a name-less fallback, so
+ *     the banner and its tests share one formatter rather than re-deriving the
+ *     string.
+ *
+ * Everything here is referentially transparent: same inputs → same output.
+ */
+/**
+ * Format the personalized welcome greeting.
+ *
+ * Returns `"Welcome back, {name}!"` for a usable name, and the plain
+ * `"Welcome back!"` fallback when the name is absent, blank, or too long to read
+ * as a name. The name is trimmed of surrounding whitespace before the checks so
+ * a padded label does not slip past the guards.
+ *
+ * @param name the signed-in account label, if one is known
+ * @returns the greeting string (never the tag markup — plain text)
+ */
+export declare function welcomeLine(name?: string): string;
+/**
+ * The frozen sweep colour for one wordmark row.
+ *
+ * Lerps from `primaryHex` (the first row) to `secondaryHex` (the last row)
+ * across the `rowCount` rows of the block, returning the colour for row
+ * `rowIndex` as a `#rrggbb` hex string. A single-row block pins to the primary;
+ * the endpoints are exact (row 0 = primary, row n-1 = secondary). If either hex
+ * cannot be parsed, the corresponding raw input hex is returned so the banner
+ * still gets a usable colour string rather than nothing.
+ *
+ * This computes a *static* gradient — there is no timer, no frame loop, no
+ * clock. The whole sweep is laid down in the one render pass, which is exactly
+ * why it is safe under reduced-motion: the flourish is colour, not movement.
+ *
+ * @param rowIndex     the zero-based row being painted
+ * @param rowCount     the total number of rows in the wordmark block
+ * @param primaryHex   the colour of the first row (e.g. the accent)
+ * @param secondaryHex the colour of the last row (e.g. the secondary accent)
+ * @returns a `#rrggbb` hex string (or a raw input hex when one is unparseable)
+ */
+export declare function rowGradient(rowIndex: number, rowCount: number, primaryHex: string, secondaryHex: string): string;

package/dist/types/console/components/banner.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Banner colour-sweep helpers — pure behavioural tests.
+ *
+ * These exercise the render-agnostic maths behind the masthead flourish without
+ * mounting Ink: the welcome-line formatter (#7) and the frozen colour-sweep
+ * gradient (#14). Both are referentially transparent, so the assertions are
+ * exact.
+ */
+export {};

package/dist/types/console/contract.d.ts

@@ -56,13 +56,17 @@ export type { SessionSnapshot, ToolExecutionState, StatusMessage, UiDisplayBlock
 /** Re-exported conductor vocabulary the console renders and drives. */
 export type { SessionConductor, SessionSignal, ConductorState };
 /**
- * The two built-in colour schemes the console ships with.
- *
- * Named for the time-of-day they evoke rather than a bare light/dark axis:
- *   - `midnight` — a low-luminance scheme for dark terminals.
- *   - `daylight` — a high-luminance scheme for light terminals.
+ * The built-in colour schemes the console ships with.
+ *
+ * Named for the time-of-day they evoke rather than a bare light/dark axis, with
+ * a daltonized (color-blind-friendly) variant of each:
+ *   - `midnight`    — a low-luminance scheme for dark terminals.
+ *   - `daylight`    — a high-luminance scheme for light terminals.
+ *   - `midnight-cb` — the dark scheme re-derived so success vs failure separates
+ *     off the red-green axis (success → blue), deuteran/protan-safe.
+ *   - `daylight-cb` — the light scheme's color-blind-safe counterpart.
  */
-export type ThemeScheme = "midnight" | "daylight";
+export type ThemeScheme = "midnight" | "daylight" | "midnight-cb" | "daylight-cb";
 /** The default scheme applied before any user preference is loaded. */
 export declare const DEFAULT_SCHEME: ThemeScheme;
 /**
@@ -96,6 +100,23 @@ export declare function isThemeScheme(value: string): value is ThemeScheme;
  *   - `caution`      — warning status tone.
  *   - `alarm`        — error/fault status tone.
  *   - `pending`      — busy/in-flight status tone.
+ *
+ * Rich-render roles (markdown / diff / syntax highlighting). These feed the
+ * framework adapter's markdown/diff/highlight accessors so the styled
+ * transcript, colored diffs, and fenced-code highlighting recolor for free with
+ * each scheme:
+ *   - `codeInline`     — inline `` `code` `` foreground.
+ *   - `heading`        — markdown heading foreground.
+ *   - `blockquoteBar`  — the dim bar drawn beside a blockquote.
+ *   - `diffAddedBg`    — background tint for an added (`+`) diff line.
+ *   - `diffRemovedBg`  — background tint for a removed (`-`) diff line.
+ *   - `diffAddedText`  — foreground for added-line content / `+` marker.
+ *   - `diffRemovedText`— foreground for removed-line content / `-` marker.
+ *   - `synKeyword`     — syntax scope: keywords.
+ *   - `synString`      — syntax scope: string literals.
+ *   - `synNumber`      — syntax scope: numeric literals.
+ *   - `synComment`     — syntax scope: comments.
+ *   - `synType`        — syntax scope: types / classes / built-ins.
  */
 export interface ThemeTokens {
     readonly signal: string;
@@ -111,6 +132,18 @@ export interface ThemeTokens {
     readonly caution: string;
     readonly alarm: string;
     readonly pending: string;
+    readonly codeInline: string;
+    readonly heading: string;
+    readonly blockquoteBar: string;
+    readonly diffAddedBg: string;
+    readonly diffRemovedBg: string;
+    readonly diffAddedText: string;
+    readonly diffRemovedText: string;
+    readonly synKeyword: string;
+    readonly synString: string;
+    readonly synNumber: string;
+    readonly synComment: string;
+    readonly synType: string;
 }
 /** The closed set of token role names, for iteration and validation. */
 export type ThemeToken = keyof ThemeTokens;
@@ -211,8 +244,9 @@ export interface ViewRow {
  *   - `signOut`      — the provider sign-out confirmation.
  *   - `oauth`        — the in-flight OAuth device/redirect flow.
  *   - `plugin`       — a plugin-supplied select/confirm/input/custom overlay.
+ *   - `approval`     — a pending tool-permission prompt (allow once / always / deny).
  */
-export type ModalKind = "none" | "settings" | "models" | "scopedModels" | "theme" | "sessions" | "tree" | "userTurns" | "signIn" | "signOut" | "oauth" | "plugin";
+export type ModalKind = "none" | "settings" | "models" | "scopedModels" | "theme" | "sessions" | "tree" | "userTurns" | "signIn" | "signOut" | "oauth" | "plugin" | "approval";
 /**
  * The active modal plus any opaque payload the matching dialog needs.
  *