indusagi-coding-agent 0.1.61 → 0.2.0

package/dist/types/console/input/keymap.d.ts

@@ -84,6 +84,15 @@ export interface KeyChord {
  *   Model / reasoning
  *     - `model:cycleThinking` — advance the reasoning-effort ladder one step.
  *
+ *   Permission mode
+ *     - `mode:cyclePermission` — cycle through ALL permission modes (Shift+Tab),
+ *       advancing one step per press: default → acceptEdits → plan → bypass →
+ *       (wrap) default. In `plan` mode every mutating tool is blocked; in `bypass`
+ *       every tool is auto-allowed.
+ *     - `mode:togglePlan` — toggle read-only plan mode on/off. Drives `/plan`; no
+ *       longer bound to Shift+Tab (which now cycles all modes). In plan mode every
+ *       mutating tool is blocked at the permission gate.
+ *
  *   Queue
  *     - `queue:dequeue`    — pull the most recently queued input back into the
  *       composer so it can be edited or dropped.
@@ -106,7 +115,7 @@ export interface KeyChord {
  *   Inert
  *     - `none`             — the keystroke carries no console meaning.
  */
-export type ConsoleVerb = "text:type" | "text:newline" | "edit:erasePrev" | "edit:eraseNext" | "edit:clearLine" | "nav:left" | "nav:right" | "nav:home" | "nav:end" | "nav:up" | "nav:down" | "flow:submit" | "flow:dismiss" | "flow:accept" | "flow:interrupt" | "flow:suspend" | "flow:cycleModel" | "model:cycleThinking" | "queue:dequeue" | "input:pasteImage" | "input:externalEditor" | "overlay:open" | "view:expandTools" | "view:toggleReasoning" | "none";
+export type ConsoleVerb = "text:type" | "text:newline" | "edit:erasePrev" | "edit:eraseNext" | "edit:clearLine" | "nav:left" | "nav:right" | "nav:home" | "nav:end" | "nav:up" | "nav:down" | "flow:submit" | "flow:dismiss" | "flow:accept" | "flow:interrupt" | "flow:suspend" | "flow:cycleModel" | "model:cycleThinking" | "mode:cyclePermission" | "mode:togglePlan" | "queue:dequeue" | "input:pasteImage" | "input:externalEditor" | "overlay:open" | "view:expandTools" | "view:toggleReasoning" | "none";
 /**
  * A classified keystroke: a {@link ConsoleVerb} plus the small payload a verb
  * may carry — the literal text for a `text:type` insert, or the target overlay

package/dist/types/console/overlays/approval-queue.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Approval queue — the headless, pure serializer behind the approval overlay.
+ *
+ * The permission gate may reach an `ask` decision while another approval prompt is
+ * already on screen (e.g. a turn that batches several tool calls). The UI shows ONE
+ * prompt at a time, so the pending requests are held in an ordered queue: each
+ * `enqueue` parks a request, the HEAD is the prompt currently shown, and `settle`
+ * resolves the head's parked promise then advances to the next. This module is a
+ * pure reducer over an immutable {@link ApprovalQueueState} plus a couple of tiny
+ * helpers — no React, no Ink, no timers — so the queue logic is unit-testable in
+ * isolation (the overlay component only renders the head and dispatches settles).
+ *
+ * Each queued entry carries the parked promise's `resolve` (the gate awaits it) and
+ * the request itself. Settling resolves with an {@link ApprovalChoice}; an
+ * abort/clear settles every outstanding entry with `"deny"` so a cancelled turn
+ * never hangs on a pending prompt.
+ */
+import type { ApprovalChoice } from "../../conductor";
+import type { ApprovalRequest } from "./approval";
+/** One parked approval request awaiting the user's choice. */
+export interface ApprovalEntry {
+    /** A stable id, unique within the queue's lifetime, used to settle the right one. */
+    readonly id: string;
+    /** The pending request the prompt renders. */
+    readonly request: ApprovalRequest;
+    /** Fulfil the gate's parked promise with the user's choice. Called exactly once. */
+    readonly resolve: (choice: ApprovalChoice) => void;
+}
+/**
+ * The immutable queue state. The array is ordered oldest-first; the head (index 0)
+ * is the request currently prompted. An empty queue means no prompt is showing.
+ */
+export interface ApprovalQueueState {
+    /** The parked entries, oldest first; `[0]` is the active prompt. */
+    readonly entries: readonly ApprovalEntry[];
+}
+/** The empty queue — no approval prompt pending. */
+export declare const EMPTY_APPROVAL_QUEUE: ApprovalQueueState;
+/**
+ * The closed action union the queue reducer folds:
+ *   - `enqueue` — park a new request at the tail.
+ *   - `settle`  — resolve the entry matching `id` with `choice` and drop it.
+ *   - `clear`   — drop EVERY entry (the caller resolves each with `"deny"`).
+ */
+export type ApprovalQueueEvent = {
+    readonly type: "enqueue";
+    readonly entry: ApprovalEntry;
+} | {
+    readonly type: "settle";
+    readonly id: string;
+} | {
+    readonly type: "clear";
+};
+/**
+ * Fold one {@link ApprovalQueueEvent} over the queue, returning a fresh state.
+ *
+ * Pure and total: it never resolves a promise itself (the caller does that around
+ * a `settle`/`clear`), it only mutates the ordered entry list. `enqueue` appends;
+ * `settle` removes the entry with the matching `id` (a no-op when absent, e.g. a
+ * double-settle); `clear` empties the queue.
+ *
+ * @param state the prior queue state
+ * @param event the action to apply
+ */
+export declare function approvalQueueReducer(state: ApprovalQueueState, event: ApprovalQueueEvent): ApprovalQueueState;
+/**
+ * The active prompt — the head entry — or `undefined` when the queue is empty.
+ *
+ * @param state the queue state
+ */
+export declare function activeApproval(state: ApprovalQueueState): ApprovalEntry | undefined;

package/dist/types/console/overlays/approval.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Approval overlay — the interactive tool-permission prompt.
+ *
+ * This group owns the single modal kind raised when the permission gate reaches an
+ * `ask` decision for a tool call: it shows the pending request (tool name, a short
+ * rendering of the arguments, and any suggested allow-rule) and lets the user pick
+ * one of three outcomes — allow this one call, allow it for the rest of the session
+ * (which the gate turns into a session allow-rule), or deny it. It is mounted
+ * unconditionally by {@link import("./host").OverlayHost}, which routes by
+ * {@link ModalState.kind}; this component renders a dialog body only for its own
+ * `approval` kind and is otherwise inert.
+ *
+ * The wiring is a parked promise: when the React layer builds the conductor's
+ * approval resolver it returns a promise and stashes the request (plus the
+ * promise's `resolve`) under {@link ModalState.payload}. This overlay reads that
+ * payload, renders the choices, and on a pick calls `payload.resolve(choice)` then
+ * closes the modal — handing control back to the gate, which proceeds or denies. An
+ * Esc (the dialog's own close) resolves `"deny"` so a dismissed prompt never hangs
+ * the in-flight turn. The actual select UI reuses the framework `ThemeDialog`
+ * (a labelled, navigable pick-from-list with descriptions), so the overlay needs no
+ * bespoke key handling.
+ *
+ * React/Ink are obtained the same way the other overlays do (default React export
+ * from `indusagi/react-host`, `Box`/`Text` from `indusagi/react-host/ink`).
+ */
+import { type ThemeDialogItem } from "indusagi/react-ink";
+import type { ApprovalChoice } from "../../conductor";
+import type { OverlayGroupProps } from "./pickers";
+/**
+ * The pending tool-permission request a prompt is raised for. Mirrors the
+ * arguments the conductor's approval resolver is handed for an `ask` decision.
+ */
+export interface ApprovalRequest {
+    /** The tool the model asked to run (e.g. `"Bash"`, `"Edit"`). */
+    readonly toolName: string;
+    /** The validated arguments the tool would run with. */
+    readonly input: unknown;
+    /**
+     * Optional human-readable allow-rule suggestions the prompt surfaces (e.g.
+     * `"Bash(npm run test:*)"`), so the user knows what an "allow always" remembers.
+     */
+    readonly suggestions?: readonly string[];
+}
+/**
+ * The opaque {@link ModalState.payload} the `approval` overlay narrows: the pending
+ * request plus the resolver of the parked approval promise. The overlay calls
+ * `resolve(choice)` exactly once, then closes the modal.
+ */
+export interface ApprovalPayload {
+    /** The pending request to render. */
+    readonly request: ApprovalRequest;
+    /** Fulfil the parked approval promise with the user's choice. */
+    readonly resolve: (choice: ApprovalChoice) => void;
+}
+/**
+ * The three offerable outcomes, in listing order. The `id` is the
+ * {@link ApprovalChoice} the gate consumes; `label`/`description` are what the
+ * prompt shows. Kept as data (not an `if`-ladder) so the choice→resolution mapping
+ * is a pure table the headless test asserts against.
+ */
+export declare const APPROVAL_CHOICES: readonly (ThemeDialogItem & {
+    id: ApprovalChoice;
+})[];
+/** The {@link ApprovalChoice} a dismissed (Esc) prompt resolves to. */
+export declare const DISMISS_CHOICE: ApprovalChoice;
+/**
+ * Map a selected dialog `id` back to the {@link ApprovalChoice} the gate consumes.
+ *
+ * Pure and total: a recognised id maps to itself; anything unrecognised falls back
+ * to {@link DISMISS_CHOICE} (`"deny"`) so a stray selection can never silently
+ * allow a tool. This is the unit the headless test pins.
+ *
+ * @param id the `id` the {@link ThemeDialog} reported on select
+ */
+export declare function choiceFromId(id: string): ApprovalChoice;
+/**
+ * Narrow the opaque modal payload into a typed {@link ApprovalPayload}, or
+ * `undefined` when it is not a well-formed approval request (a defensive guard —
+ * the overlay renders nothing rather than crash on a malformed payload).
+ *
+ * @param payload the opaque {@link ModalState.payload}
+ */
+export declare function readApprovalPayload(payload: unknown): ApprovalPayload | undefined;
+/**
+ * Render a tool call's arguments as a single short, human-readable line for the
+ * prompt body. A shell `command` (or any `command` field) shows verbatim;
+ * otherwise a compact JSON encoding is used. Long values are elided so the prompt
+ * never floods the terminal.
+ *
+ * @param input the validated tool arguments
+ */
+export declare function summarizeInput(input: unknown): string;
+/**
+ * The approval overlay group: the single `approval` modal kind.
+ *
+ * Renders the prompt body when the active modal is `approval` and its payload is a
+ * well-formed {@link ApprovalPayload}; every other kind (and a malformed payload)
+ * yields nothing. Unlike the session/auth groups this does NOT require the runtime
+ * services bundle — the payload carries everything the prompt needs — so it works
+ * on any mount path that wired a resolver.
+ *
+ * @param props the forwarded overlay props (modal, services, theme, dispatch, closer)
+ */
+export declare function ApprovalOverlays(props: OverlayGroupProps): JSX.Element | null;

package/dist/types/console/overlays/approval.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Approval overlay — headless unit tests for the pure logic behind the prompt.
+ *
+ * Rendering an Ink dialog headlessly is brittle, so these tests pin the two pure
+ * pieces the interactive overlay is built from — exactly the bar the task sets:
+ *
+ *   1. The choice→resolution mapping ({@link choiceFromId}) + the payload narrowing
+ *      ({@link readApprovalPayload}) + the argument summary ({@link summarizeInput}):
+ *      a selected dialog row maps to the {@link ApprovalChoice} the gate consumes, a
+ *      malformed payload is rejected, and a stray id falls back to `deny`.
+ *   2. The queue reducer ({@link approvalQueueReducer}) + head selector
+ *      ({@link activeApproval}): requests serialise oldest-first, a settle drops the
+ *      matching entry (and a double-settle is inert), and a clear empties the queue.
+ *
+ * No React, no Ink, no conductor — just the exported functions.
+ */
+export {};

package/dist/types/console/overlays/host.d.ts

@@ -10,9 +10,10 @@
  * owns a disjoint slice of the kind space and renders a body only for its own
  * kinds:
  *
- *   - {@link PickerOverlays}  — `models`, `scopedModels`, `theme`, `settings`.
- *   - {@link SessionOverlays} — `sessions`, `tree`, `userTurns`.
- *   - {@link AuthOverlays}    — `signIn`, `signOut`, `oauth`, `plugin`.
+ *   - {@link PickerOverlays}   — `models`, `scopedModels`, `theme`, `settings`.
+ *   - {@link SessionOverlays}  — `sessions`, `tree`, `userTurns`.
+ *   - {@link AuthOverlays}     — `signIn`, `signOut`, `oauth`, `plugin`.
+ *   - {@link ApprovalOverlays} — `approval` (the tool-permission prompt).
  *
  * When no overlay is raised (`kind === "none"`) the host renders nothing, so the
  * composer keeps focus and the groups are never mounted needlessly.

package/dist/types/console/overlays/index.d.ts

@@ -11,3 +11,5 @@ export { OverlayHost, type OverlayHostProps } from "./host";
 export { PickerOverlays, type OverlayGroupProps } from "./pickers";
 export { SessionOverlays } from "./sessions";
 export { AuthOverlays } from "./auth";
+export { ApprovalOverlays, choiceFromId, readApprovalPayload, summarizeInput, APPROVAL_CHOICES, DISMISS_CHOICE, type ApprovalRequest, type ApprovalPayload, } from "./approval";
+export { approvalQueueReducer, activeApproval, EMPTY_APPROVAL_QUEUE, type ApprovalEntry, type ApprovalQueueState, type ApprovalQueueEvent, } from "./approval-queue";

package/dist/types/console/theme/adapter.d.ts

@@ -42,6 +42,25 @@ import type { InkThemeAdapter, ThemeTokens } from "../contract";
  *   info            ← notice        (informational status tone)
  *   highlight       ← inkText       (high-contrast on-accent text)
  *
+ * Plus the markdown / diff / syntax-highlight role keys the framework's rich
+ * render path (`theme.role(...)` / `theme.roleBackground(...)`) resolves. These
+ * key names match the framework adapter's default role → key map exactly, so the
+ * styled transcript, colored diffs, and fenced-code highlighting resolve their
+ * colours straight from the console's derived tokens:
+ *
+ *   codeInline      ← codeInline      (inline `code` foreground)
+ *   heading         ← heading         (markdown heading foreground)
+ *   blockquoteBar   ← blockquoteBar   (dim quote bar)
+ *   diffAddedBg     ← diffAddedBg     (added-line background tint)
+ *   diffRemovedBg   ← diffRemovedBg   (removed-line background tint)
+ *   diffAddedText   ← diffAddedText   (added foreground / `+`)
+ *   diffRemovedText ← diffRemovedText (removed foreground / `-`)
+ *   synKeyword      ← synKeyword      (syntax: keywords)
+ *   synString       ← synString       (syntax: strings)
+ *   synNumber       ← synNumber       (syntax: numbers)
+ *   synComment      ← synComment      (syntax: comments)
+ *   synType         ← synType         (syntax: types / classes)
+ *
  * @param tokens the derived semantic token map for a scheme
  * @returns a flat colour Record keyed by the framework's vocabulary
  */

package/dist/types/console/theme/index.d.ts

@@ -12,7 +12,7 @@
  * Consumers import from `src/console/theme` and never reach into the individual
  * palette/tokens/adapter/resolve modules.
  */
-export { MIDNIGHT_PALETTE, DAYLIGHT_PALETTE, PALETTES } from "./palette";
+export { MIDNIGHT_PALETTE, DAYLIGHT_PALETTE, MIDNIGHT_CB_PALETTE, DAYLIGHT_CB_PALETTE, PALETTES, } from "./palette";
 export { deriveTokens } from "./tokens";
 export { themeAdapter, frameworkColors } from "./adapter";
 export { THEMES, THEME_SCHEMES, resolveTheme } from "./resolve";

package/dist/types/console/theme/palette.d.ts

@@ -33,6 +33,31 @@ export declare const MIDNIGHT_PALETTE: ThemePalette;
  * to a dark-on-light slate.
  */
 export declare const DAYLIGHT_PALETTE: ThemePalette;
+/**
+ * The dark-terminal color-blind-safe ramp.
+ *
+ * A clone of {@link MIDNIGHT_PALETTE} that re-derives the three *status* hues so
+ * a red-green color-blind user (deuteran/protan, ~8% of men) can tell success
+ * from failure without relying on the red-green axis. Success moves off green
+ * onto a vivid blue (`affirm → #4aa3ff`); failure stays red but is deepened to a
+ * darker tone (`alarm → #c83232`) so it sits well below the bright blue in
+ * lightness, and the amber warning is nudged brighter — so the three status
+ * tones separate by *lightness*, not hue alone. The three accent hues and the
+ * neutral gradient are carried over unchanged from the base midnight ramp — only
+ * the status stops move, so the overall look stays the midnight scheme.
+ */
+export declare const MIDNIGHT_CB_PALETTE: ThemePalette;
+/**
+ * The light-terminal color-blind-safe ramp.
+ *
+ * The daylight counterpart of {@link MIDNIGHT_CB_PALETTE}: clones
+ * {@link DAYLIGHT_PALETTE} and remaps success to a deeper blue tuned for a
+ * bright background (`affirm → #1f6fd6`), deepens the red alarm
+ * (`alarm → #b02622`) for lightness separation from that blue, and darkens the
+ * amber warning so the three status tones stay separable by lightness on a light
+ * terminal too.
+ */
+export declare const DAYLIGHT_CB_PALETTE: ThemePalette;
 /**
  * The raw ramp for each scheme, keyed by {@link ThemeScheme}.
  *

package/dist/types/console/theme/tokens.d.ts

@@ -25,6 +25,28 @@
  *   - `caution`       ← `caution`    (warning tone)
  *   - `alarm`         ← `alarm`      (error/fault tone)
  *   - `pending`       ← `primary`    (busy/in-flight tone)
+ *
+ * Rich-render roles (markdown / diff / syntax highlighting) are derived from the
+ * same nine stops so the rebuild's new styled-transcript / colored-diff /
+ * fenced-code surfaces recolour with the scheme and need no extra palette stop:
+ *
+ *   - `codeInline`      ← `primary`                      (inline code accent)
+ *   - `heading`         ← `primary`                      (heading accent)
+ *   - `blockquoteBar`   ← `muted`                        (dim quote bar)
+ *   - `diffAddedBg`     ← `affirm` darkened toward ink   (added-line tint)
+ *   - `diffRemovedBg`   ← `alarm`  darkened toward ink   (removed-line tint)
+ *   - `diffAddedText`   ← `affirm`                       (added foreground / `+`)
+ *   - `diffRemovedText` ← `alarm`                        (removed foreground / `-`)
+ *   - `synKeyword`      ← `primary`                      (keywords)
+ *   - `synString`       ← `affirm`                       (strings)
+ *   - `synNumber`       ← `caution`                      (numbers)
+ *   - `synComment`      ← `muted`                        (comments)
+ *   - `synType`         ← `tertiary`                     (types / classes)
+ *
+ * Deriving the two diff backgrounds (rather than adding raw stops) keeps the
+ * {@link ThemePalette} a flat nine-stop ramp while guaranteeing every scheme —
+ * including the color-blind variants — gets a legible `+`/`-` tint that tracks
+ * its own success/alarm hue.
  */
 import type { ThemePalette, ThemeTokens } from "../contract";
 /**
@@ -35,6 +57,6 @@ import type { ThemePalette, ThemeTokens } from "../contract";
  * assignments are shared by both schemes — only the ramp handed in differs.
  *
  * @param palette the raw nine-stop ramp for a scheme
- * @returns the thirteen-role semantic token map
+ * @returns the full semantic token map (status + rich-render roles)
  */
 export declare function deriveTokens(palette: ThemePalette): ThemeTokens;

package/dist/types/index.d.ts

@@ -21,4 +21,4 @@ export * as insight from "./insight";
 export * as kit from "./kit";
 export * as settings from "./settings";
 export * as sessions from "./sessions";
-export declare const VERSION = "0.1.61";
+export { VERSION } from "./workspace";

package/dist/types/launch/contract.d.ts

@@ -171,6 +171,8 @@ export interface Invocation {
     readonly attachments?: Attachments;
     /** Explicit model selector (`--model` / `-m`), provider-qualified or bare. */
     readonly model?: string;
+    /** Model to fall back to when the selected model is overloaded mid-turn (`--fallback-model`). */
+    readonly fallbackModel?: string;
     /** Named credential account to authenticate the run with (`--account`). */
     readonly account?: string;
     /** Working directory the run is scoped to (`--cwd`); absent means process cwd. */

package/dist/types/launch/index.d.ts

@@ -20,7 +20,7 @@ export { runPackageCommand, defaultPackageIo, PACKAGE_COMMANDS, } from "./packag
 export type { PackageCommand, PackageIo, PackageCommandOptions, PackageResult, } from "./packages";
 export { runCredentialCommand, defaultCredentialIo, formatCredentialFault, validateApiKey, validateAccountName, findProvider, isOAuthCapable, asSigninMethod, PROVIDER_DIRECTORY, } from "./credentials";
 export type { CredentialIo, CredentialResult, SigninMethod } from "./credentials";
-export { registerBuiltInOAuthProviders, listLoginProviders, startOAuthLogin, openLoginUrl, } from "./oauth";
+export { registerBuiltInOAuthProviders, listLoginProviders, startOAuthLogin, openLoginUrl, hasRegisteredOAuthClientId, } from "./oauth";
 export type { AuthKind, LoginProvider, OAuthLoginResult, } from "./oauth";
 export { printModelCatalog, defaultCatalogIo, registrySource } from "./catalog";
 export type { CatalogIo, CatalogModelSource } from "./catalog";

package/dist/types/launch/oauth.d.ts

@@ -29,6 +29,19 @@ import type { AuthVault } from "./contract";
  * that are registered after the call, for callers that want to confirm the set.
  */
 export declare function registerBuiltInOAuthProviders(): string[];
+/**
+ * Whether a registered sign-in provider has a *real* OAuth client id wired in
+ * (its env var is set to something other than the framework's sentinel), so its
+ * browser sign-in can actually complete.
+ *
+ * Reads the env var live (not at import time) so a deployer that exports the id
+ * before launching `/login` is honored. A provider with no known client-id
+ * wiring (i.e. not one of the three sentinel-shipped framework providers) is
+ * treated as registered — we only gate the providers we know ship a sentinel.
+ *
+ * @param providerId the registered sign-in provider id
+ */
+export declare function hasRegisteredOAuthClientId(providerId: string): boolean;
 /** How a provider authenticates in the merged sign-in directory. */
 export type AuthKind = "oauth" | "apiKey";
 /** One row of the merged sign-in directory. */

package/dist/types/settings/contract.d.ts

@@ -48,6 +48,46 @@ export type DeliveryMode = "all" | "one-at-a-time";
 export declare const DELIVERY_MODES: readonly DeliveryMode[];
 /** Narrow an arbitrary value to a known {@link DeliveryMode}. */
 export declare function isDeliveryMode(value: unknown): value is DeliveryMode;
+/**
+ * How aggressively the per-tool permission gate auto-allows tool calls before it
+ * falls back to asking (or denying):
+ *
+ *   - `default`      — consult the allow/ask/deny rules; read-only tools are
+ *                      auto-allowed, anything else with no matching allow rule
+ *                      falls through to `ask`.
+ *   - `acceptEdits`  — additionally auto-allow filesystem edits/writes (the
+ *                      mutating edit/write/multiedit tools), leaving everything
+ *                      else on the `default` path.
+ *   - `bypass`       — allow every tool with no prompt (the unsafe "trust all"
+ *                      mode; `bypassPermissions` is accepted as an alias).
+ *   - `plan`         — deny every mutating tool outright (read-only research only)
+ *                      so the agent can plan without touching the workspace.
+ */
+export type PermissionMode = "default" | "acceptEdits" | "bypass" | "plan" | "bypassPermissions";
+/** The canonical {@link PermissionMode} values, as a frozen tuple for menus/guards. */
+export declare const PERMISSION_MODES: readonly PermissionMode[];
+/** Narrow an arbitrary value to a known {@link PermissionMode} (folds the alias). */
+export declare function isPermissionMode(value: unknown): value is PermissionMode;
+/**
+ * The declarative permission policy a session reads at startup.
+ *
+ * `allow`/`ask`/`deny` are ordered lists of induscode-style rule strings — a bare
+ * tool name (`"Bash"`) or a tool name with an argument specifier
+ * (`"Bash(npm run test:*)"`). Across tiers the three lists are concatenated, and
+ * `deny` wins over `ask` wins over `allow`. `defaultMode` seeds the session's
+ * permission mode when no flag overrides it. Every field is optional so an empty
+ * `{}` (or an absent `permissions` key) keeps today's allow-all behavior.
+ */
+export interface PermissionSettings {
+    /** Rule strings that auto-allow a matching tool call (lowest precedence). */
+    allow?: string[];
+    /** Rule strings that force a matching tool call to prompt for approval. */
+    ask?: string[];
+    /** Rule strings that hard-block a matching tool call (highest precedence). */
+    deny?: string[];
+    /** The permission mode the session opens in when no flag overrides it. */
+    defaultMode?: PermissionMode;
+}
 /**
  * Every preference an interactive coding-agent session reads, as one flat,
  * fully-optional record.
@@ -93,12 +133,31 @@ export interface Preferences {
     defaultThinkingLevel?: ThinkingLevel;
     /** Suppress the banner / tips shown on a normal interactive launch. */
     quietStartup?: boolean;
+    /**
+     * The last product version whose full masthead the user has already seen. The
+     * banner auto-condenses to a one-line header when this equals the running
+     * version (and nothing else demands the full block); it is rewritten to the
+     * running version after the full masthead is shown, so a launch only shows the
+     * big wordmark on the first sight of a version or a version bump.
+     */
+    lastSeenVersion?: string;
+    /** Opt-in static colour-sweep flourish tinting the startup wordmark / emblem. */
+    logoSweep?: boolean;
+    /** When set, motion-flavoured flourishes (e.g. the logo sweep) are suppressed. */
+    reducedMotion?: boolean;
     /** Whether the window-budget manager compacts the transcript automatically. */
     autoCompact?: boolean;
     /** What a double-escape does in the console. */
     doubleEscapeAction?: EscapeAction;
     /** Extension-package sources the launcher installs and loads (npm / git / local). */
     extensionPackages?: string[];
+    /**
+     * The declarative tool-permission policy: ordered allow/ask/deny rule lists and
+     * the opening permission mode. Across the project/global tiers the rule lists
+     * are concatenated (not overridden) and `deny > ask > allow` decides; an absent
+     * value (or an empty object) preserves today's allow-all behavior.
+     */
+    permissions?: PermissionSettings;
 }
 /** The set of legal preference keys, derived from {@link Preferences}. */
 export type SettingKey = keyof Preferences;

package/dist/types/settings/index.d.ts

@@ -7,7 +7,7 @@
  * {@link PreferenceStore} reader/writer. Console surfaces and boot stages depend
  * on this module rather than reaching into the individual files.
  */
-export type { Preferences, SettingKey, EscapeAction, DeliveryMode, ThinkingLevel, } from "./contract";
-export { DEFAULT_PREFERENCES, SETTING_KEYS, ESCAPE_ACTIONS, isEscapeAction, DELIVERY_MODES, isDeliveryMode, } from "./contract";
+export type { Preferences, SettingKey, EscapeAction, DeliveryMode, ThinkingLevel, PermissionMode, PermissionSettings, } from "./contract";
+export { DEFAULT_PREFERENCES, SETTING_KEYS, ESCAPE_ACTIONS, isEscapeAction, DELIVERY_MODES, isDeliveryMode, PERMISSION_MODES, isPermissionMode, } from "./contract";
 export { PreferenceStore } from "./manager";
 export type { PreferenceLocations } from "./manager";

package/dist/types/window-budget/condenser.d.ts

@@ -28,8 +28,22 @@
  * matching session-scope entrypoint. Both are re-exported here so callers can
  * summarize a slice directly without building a full {@link Condenser}.
  */
-import type { AgentMessage, CondenserDeps, Condenser, Summary } from "./contract.js";
+import type { AgentMessage, BudgetPolicy, CondenserDeps, Condenser, Summary } from "./contract.js";
 import { condenseScope, type SummarizeDeps } from "./summarize/index.js";
+/**
+ * The fallback {@link BudgetPolicy} when the caller supplies none. These are
+ * ordinary configuration defaults — a window-relative ratio plus a token tail —
+ * computed from the model's own context window rather than fixed magic numbers.
+ *   - `triggerRatio` 0.75 — condense once ~three-quarters of the window is used.
+ *   - `keepRecent`   6000 — keep roughly the last 6k tokens of turns verbatim.
+ *   - `reserveTokens` 2048 — carve a little headroom off the window first.
+ *
+ * Exported as {@link AUTO_CONDENSE_POLICY} so the conductor's token gate and the
+ * session runner's slice planner share **one** policy — the value the auto-path
+ * trigger ({@link isOverBudget}) compares against must equal the value the slice
+ * planner ({@link planSlice}) cuts with, or the gate and the cut disagree.
+ */
+export declare const AUTO_CONDENSE_POLICY: BudgetPolicy;
 /**
  * Build a {@link Condenser} from a {@link CondenserDeps} bundle. The result plugs
  * straight into the conductor's `CondenseFn` seam.

package/dist/types/window-budget/index.d.ts

@@ -12,4 +12,6 @@ export type { AgentMessage, BudgetPolicy, CompleteFn, CondensePlan, Condenser, C
 export { budgetLimit, estimateMessageTokens, estimateTokens, isOverBudget, planSlice, prefixTokens, } from "./budget/index.js";
 export { buildSummaryPrompt, CONDENSER_BRIEF, flattenTranscript, summarize, } from "./summarize/index.js";
 export type { SummarizeDeps } from "./summarize/index.js";
-export { condense, condenseScope, createCondenser } from "./condenser.js";
+export { AUTO_CONDENSE_POLICY, condense, condenseScope, createCondenser } from "./condenser.js";
+export { CLEARED_TOOL_RESULT, clearStaleToolResults, COMPACTABLE_TOOL_NAMES, } from "./microcompact.js";
+export { rehydrateRecentReads, RESTORED_FILE_PREFIX } from "./rehydrate.js";

package/dist/types/window-budget/microcompact.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Window-budget / microcompact — clear stale tool-result bodies in place.
+ *
+ * The cheapest token to reclaim is one that is already dead weight: the verbatim
+ * body of a tool result the model has long since acted on. Once an agent has
+ * read a file, run a search, or executed a command and moved several turns past
+ * it, the full body of that result rarely needs to stay in the window — the
+ * model's subsequent reasoning already captured what mattered. Yet those bodies
+ * (a 2,000-line `read`, a noisy `bash` log, a wide `grep`) dominate the token
+ * budget.
+ *
+ * **Microcompaction** runs *before* a full {@link condense}: it walks the
+ * transcript, keeps the last few tool results verbatim (the model may still be
+ * working with them), and replaces the body of every older compactable tool
+ * result with a short sentinel. This reclaims tokens for free — no model call,
+ * no summary round-trip — and often defers (or shrinks the input to) the real
+ * condense.
+ *
+ * Shape note (this rebuild): a tool result is its OWN top-level
+ * {@link ToolResultMessage} (`role: 'toolResult'`), not a block nested inside a
+ * user message. Clearing one therefore means replacing *that message's*
+ * `content` array with a single sentinel text block — never editing a sub-block
+ * of some other message. We only clear results whose owning assistant `toolCall`
+ * named a compactable tool, so structural/control results stay intact.
+ *
+ * Behavior-preserving by construction: when there is nothing to clear (no
+ * compactable results, or every one is within the keep window) the *same input
+ * reference* is returned, so a caller can cheaply detect a no-op.
+ */
+import type { AgentMessage } from "./contract.js";
+/**
+ * The placeholder spliced in where a stale tool-result body used to be. Kept
+ * short on purpose — the whole point is to reclaim the tokens the original body
+ * occupied — while still signalling to the model (and to a human reading the
+ * transcript) that real content was elided rather than lost.
+ */
+export declare const CLEARED_TOOL_RESULT = "[Old tool result content cleared]";
+/**
+ * The wire names of tools whose results are safe to clear once stale.
+ *
+ * These are the read-mostly / output-heavy tools whose bodies are reconstructable
+ * (re-read the file, re-run the search) and whose stale content the model has
+ * already digested. Control/state tools (todo, memory, task) are deliberately
+ * absent — their results can carry standing instructions the model still needs.
+ */
+export declare const COMPACTABLE_TOOL_NAMES: ReadonlySet<string>;
+/**
+ * Clear the bodies of stale compactable tool results, keeping the most recent
+ * `keepRecent` of them verbatim.
+ *
+ * Walks the transcript, identifies every `role:'toolResult'` message that
+ * belongs to a compactable tool call, keeps the last `keepRecent` (floored at 1
+ * — `slice(-0)` would keep everything), and replaces each older one's `content`
+ * with a single `{ type:'text', text: CLEARED_TOOL_RESULT }` block. Non-tool
+ * messages, control-tool results, and already-cleared results are left exactly
+ * as they were.
+ *
+ * Returns the **same input array reference** when nothing was cleared, so the
+ * caller can detect a no-op by identity. Otherwise returns a new array; cleared
+ * messages are fresh objects (the originals are not mutated).
+ *
+ * @param messages the active transcript, oldest-first
+ * @param opts.keepRecent how many most-recent compactable results to keep
+ *   verbatim (default {@link DEFAULT_KEEP_RECENT}, floored at 1)
+ */
+export declare function clearStaleToolResults(messages: AgentMessage[], opts?: {
+    keepRecent?: number;
+}): AgentMessage[];

package/dist/types/window-budget/microcompact.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Window-budget / microcompact + rehydrate — unit tests for item #18.
+ *
+ * Three layers ride the condense path:
+ *   1. microcompact ({@link clearStaleToolResults}) — blank older completed
+ *      tool-result bodies to a sentinel, keeping the last N verbatim; no-op
+ *      (same reference) otherwise.
+ *   2. rehydration ({@link rehydrateRecentReads}) — re-attach the most-recently
+ *      dropped file reads as synthetic user messages, deduped against the kept
+ *      tail, honoring maxFiles / tokenBudget.
+ *   3. circuit breaker — covered in the conductor suite (3 throwing condense
+ *      calls stop further attempts, a success resets).
+ *
+ * Pure + network-free: no model is bound anywhere here.
+ */
+export {};