indusagi-coding-agent 0.1.62 → 0.2.1

package/dist/types/conductor/contract.d.ts

@@ -34,10 +34,14 @@
  *
  * The conductor never re-declares these; it composes them.
  */
-import type { AgentMessage, AgentTool, ThinkingLevel } from "indusagi/agent";
+import type { AgentMessage, AgentTool, CanUseToolFn, ThinkingLevel } from "indusagi/agent";
 import type { KnownProvider, Model, Usage } from "indusagi/ai";
+import type { PermissionMode } from "../settings";
+import type { ApprovalResolver } from "./permissions";
 /** Re-exported framework vocabulary that conductor consumers routinely need. */
-export type { AgentMessage, AgentTool, ThinkingLevel, Model, Usage, KnownProvider };
+export type { AgentMessage, AgentTool, CanUseToolFn, ThinkingLevel, Model, Usage, KnownProvider };
+/** Re-exported permission vocabulary, so conductor consumers get it in one import. */
+export type { PermissionMode, ApprovalResolver };
 /**
  * The closed set of failure categories the conductor can surface.
  *
@@ -203,6 +207,13 @@ export interface SessionHead {
     readonly sessionId: string;
     /** Id of the active leaf node, or `null` for an empty transcript. */
     readonly leaf: string | null;
+    /**
+     * Cumulative session usage (tokens + cost) persisted alongside the head so
+     * resume can restore the running total instead of seeding zero. Optional and
+     * absent on legacy transcripts; the store rewrites the head line on every
+     * flush, keeping this current with the live tally.
+     */
+    readonly usage?: Usage;
 }
 /**
  * A lightweight, resolved reference to one model card in the catalog.
@@ -348,6 +359,42 @@ export interface BashOutcome {
     /** Process exit code (`0` on success; non-zero, or `1` on a thrown error). */
     readonly exitCode: number;
 }
+/**
+ * The minimal file-checkpoint surface the conductor drives for rewind (#24).
+ *
+ * The product mints a concrete `CheckpointStore` (in `boot/runners/checkpoint.ts`),
+ * injects it into the deck's `ctx.framework` bag under the `'checkpoint'` key so
+ * the framework's write/edit tools record pre-mutation file content against the
+ * active transcript node, and ALSO hands it to the conductor as this port. The
+ * conductor pins the active node id as its head advances ({@link setActiveNodeId})
+ * so a turn's edits key to the node that was active before the turn, and exposes
+ * {@link restore}/{@link hasSnapshot} so the tree picker can roll the working tree
+ * back when navigating to an earlier node.
+ *
+ * Declared as a tiny structural port (not the concrete store) so the conductor
+ * stays free of any boot-layer import — the product's store satisfies it by shape.
+ */
+export interface CheckpointPort {
+    /**
+     * Pin the transcript node subsequent file snapshots are filed under. Called by
+     * the conductor as its head advances (at turn start) so a turn's edits key to
+     * the node active before the turn ran.
+     *
+     * @param id the active transcript node id, or `null` to fall back to the root
+     */
+    setActiveNodeId(id: string | null): void;
+    /** Whether a node has ANY recorded file snapshot (the picker's restore gate). */
+    hasSnapshot(nodeId: string): boolean;
+    /**
+     * Roll the working tree back to a node's recorded state, rewriting each tracked
+     * file to its pre-mutation content (deleting files recorded as absent). A safe
+     * no-op when the node has no snapshot.
+     *
+     * @param nodeId the transcript node whose file state to restore to
+     * @returns the absolute paths that were written or deleted
+     */
+    restore(nodeId: string): string[];
+}
 /**
  * Options that configure a {@link SessionConductor} at assembly time.
  *
@@ -365,6 +412,14 @@ export interface SessionConductorOptions {
     readonly tools?: AgentTool[];
     /** Initial reasoning effort for models that support it. */
     readonly thinking?: ThinkingLevel;
+    /**
+     * Canonical id of a model to fall back to when the bound model is overloaded
+     * (HTTP 529 / "overloaded") mid-turn (`--fallback-model`). When set, an
+     * overload that exhausts the transient-retry budget swaps to this model once
+     * per turn and retries instead of surfacing a terminal fault. Absent disables
+     * the swap entirely (behavior-preserving default).
+     */
+    readonly fallbackModelId?: string;
     /** Working directory the session is scoped to (defaults to process cwd). */
     readonly workspace?: string;
     /**
@@ -385,6 +440,53 @@ export interface SessionConductorOptions {
      * environment lookup. May be sync or async.
      */
     readonly getApiKey?: (provider: string) => Promise<string | undefined> | string | undefined;
+    /**
+     * The hard per-tool permission gate, threaded straight to the framework `Agent`.
+     * The framework awaits it on the validated arguments immediately before each
+     * tool runs and either proceeds (optionally with substituted input) or
+     * short-circuits to an `isError` tool result.
+     *
+     * Supplied as a **factory** `(currentMode, requestApproval?) => CanUseToolFn`:
+     * the conductor calls it once with a getter onto its OWN live permission mode,
+     * so the gate it returns reads `permissionMode()` live — a
+     * {@link SessionConductor.setPermissionMode} retargets later tool calls with no
+     * agent rebuild. (A caller that does not care about the live mode can simply
+     * ignore the getter and close over a fixed gate.)
+     *
+     * The OPTIONAL second argument is a stable {@link ApprovalResolver} delegate the
+     * conductor owns: it forwards to whatever resolver was installed via
+     * {@link SessionConductor.setApprovalResolver} at call time (and denies when none
+     * is installed). An interactive front-end can therefore wire its approval overlay
+     * AFTER the conductor (and its gate) are built — the factory just closes over the
+     * delegate. A factory that ignores it keeps today's behavior.
+     *
+     * Optional everywhere: omit it and the framework allows every tool (today's
+     * allow-all behavior).
+     */
+    readonly canUseTool?: (currentMode: () => PermissionMode, requestApproval?: ApprovalResolver) => CanUseToolFn;
+    /**
+     * The permission mode the session opens in. Seeds {@link SessionConductor.permissionMode};
+     * defaults to `"default"` when absent. The mode is consulted live by the
+     * {@link canUseTool} gate, so a later {@link SessionConductor.setPermissionMode}
+     * changes subsequent tool calls without rebuilding the gate.
+     */
+    readonly permissionMode?: PermissionMode;
+    /**
+     * Directory the approved plan-mode plan is persisted into. When the model calls
+     * `exit_plan_mode` and the user approves leaving plan mode, the conductor writes
+     * the plan as a slug-named markdown file under `<plansDir>/plans/`. Absent keeps
+     * the handshake (mode flip + context injection) but skips the disk write —
+     * tests and headless probes can run the round-trip without a filesystem.
+     */
+    readonly plansDir?: string;
+    /**
+     * The per-session file-checkpoint store for rewind (#24), or `undefined` to run
+     * without code checkpointing. When present, the conductor pins the active
+     * transcript node on it (the head leaf at turn start) so a turn's file edits key
+     * to the node that was active before the turn, and {@link SessionConductor.restoreCode}
+     * delegates to it so the tree picker can revert the working tree.
+     */
+    readonly checkpoint?: CheckpointPort;
 }
 /**
  * The conductor of a single coding-agent session.
@@ -460,6 +562,19 @@ export interface SessionConductor {
      * @param id canonical id of the model to switch to
      */
     selectModel(id: string): void;
+    /**
+     * Replace the agent's tool deck for subsequent turns.
+     *
+     * Used by `/mcp` to inject the tools of freshly-connected MCP servers into the
+     * live session (and to drop them again on disconnect). The conductor merges the
+     * passed list with its own seed deck (the built-in tools the session was
+     * assembled with), so callers pass only the *extra* tools to add — never the
+     * built-ins, which are preserved automatically. Pass `[]` to clear the extras
+     * and fall back to the seed deck alone.
+     *
+     * @param tools the additional tools to layer over the seed deck
+     */
+    registerTools(tools: AgentTool[]): void;
     /**
      * Manually run the same transcript-condense path the auto-compactor uses,
      * emitting the existing `compacted` signal. Safe to call when idle; a no-op
@@ -482,6 +597,29 @@ export interface SessionConductor {
      * @param nodeId the transcript node to make the active leaf
      */
     navigateTree(nodeId: string): Promise<void>;
+    /**
+     * Roll the working tree back to a transcript node's file-checkpoint state
+     * (rewind, #24). Reverts every file the node tracked to its pre-mutation content
+     * (deleting files that were absent at that point). Additive and code-only: it
+     * does NOT move the conversation head — pair it with {@link navigateTree}/{@link fork}
+     * for a combined "restore code and conversation". A safe no-op when no checkpoint
+     * store is wired or the node has no recorded snapshot.
+     *
+     * @param nodeId the transcript node whose file state to restore to
+     * @returns the absolute paths that were restored (written or deleted)
+     */
+    restoreCode(nodeId: string): Promise<string[]>;
+    /**
+     * Whether the tree picker should offer "restore code" for a node — i.e. whether
+     * the node has any recorded file-checkpoint snapshot. `false` when no checkpoint
+     * store is wired or the node never mutated files, so the picker's restore option
+     * is a safe no-op there.
+     *
+     * @param nodeId the transcript node to test
+     */
+    codeRestoreInfo(nodeId: string): Promise<{
+        readonly canRestore: boolean;
+    }>;
     /**
      * Run a shell command in the session workspace, returning its combined
      * stdout+stderr and exit code. Unless `opts.excludeFromContext` is set, the
@@ -494,6 +632,12 @@ export interface SessionConductor {
     executeBash(command: string, opts?: ExecuteBashOptions): Promise<BashOutcome>;
     /** A point-in-time {@link SessionStats} tally for the active session. */
     stats(): SessionStats;
+    /**
+     * Render the session's cumulative cost + token usage as a human-readable,
+     * multi-line report. Drives the `/cost` slash command without the caller
+     * having to format the {@link SessionStats} figures itself.
+     */
+    costReport(): string;
     /** The reasoning effort currently applied to the session. */
     thinkingLevel(): ThinkingLevel;
     /**
@@ -508,6 +652,74 @@ export interface SessionConductor {
      * return the newly-selected level.
      */
     cycleThinkingLevel(): ThinkingLevel;
+    /**
+     * The permission mode currently in effect. The live `canUseTool` gate reads
+     * this on every tool call, so the value reflects the most recent
+     * {@link setPermissionMode}.
+     */
+    permissionMode(): PermissionMode;
+    /**
+     * Switch the permission mode for subsequent tool calls. The gate consults the
+     * mode live (via a getter), so this takes effect on the next tool call with no
+     * agent rebuild. A no-op-equivalent when no gate was wired (the conductor still
+     * tracks the mode for the UI).
+     *
+     * @param mode the permission mode to apply
+     */
+    setPermissionMode(mode: PermissionMode): void;
+    /**
+     * Install (or clear) the host approval resolver an `ask` decision routes to.
+     *
+     * The `canUseTool` gate consults a STABLE delegate the conductor owns; this
+     * method swaps the resolver behind that delegate, so an interactive front-end
+     * can wire its approval overlay AFTER the conductor (and its gate) are built —
+     * the exact post-mount install the React console needs. Passing `undefined`
+     * clears it (an `ask` then deterministically denies, the non-interactive
+     * default). A no-op-equivalent when no gate was wired; the resolver is simply
+     * never consulted.
+     *
+     * @param resolver the resolver to consult on an `ask`, or `undefined` to clear
+     */
+    setApprovalResolver(resolver: ApprovalResolver | undefined): void;
+    /**
+     * Toggle plan mode on or off.
+     *
+     * Entering plan mode (`true`) captures the current mode as the pre-plan mode and
+     * switches to `"plan"` (read-only — the gate blocks every mutating tool).
+     * Leaving (`false`) restores the captured pre-plan mode (or `"default"` when none
+     * was captured). Idempotent: toggling on while already in plan mode is a no-op,
+     * and toggling off when not in plan mode restores/keeps `"default"`. Drives the
+     * `/plan` command and the Shift+Tab toggle, and is the same path the conductor's
+     * own `enter_plan_mode` / approved `exit_plan_mode` handshake uses.
+     *
+     * @param on `true` to enter plan mode, `false` to leave it
+     * @returns the permission mode in effect after the toggle
+     */
+    togglePlanMode(on: boolean): PermissionMode;
+    /**
+     * Advance the permission mode to the NEXT mode in the fixed cycle and return the
+     * new mode. The order is `default → acceptEdits → plan → bypass → (wrap)
+     * default`; the `"bypassPermissions"` alias is folded to `"bypass"` when reading
+     * the current mode so the cycle is stable.
+     *
+     * Built on top of {@link setPermissionMode}, so the live `canUseTool` gate (which
+     * reads {@link permissionMode} on every call) picks the new mode up immediately
+     * with no agent rebuild. Plan bookkeeping is preserved: ENTERING `"plan"` captures
+     * the pre-plan mode exactly as {@link togglePlanMode} does, so a later round-trip
+     * restores the prior mode; LEAVING `"plan"` (cycling `plan → bypass`) is a plain
+     * mode change — it does NOT run the `exit_plan_mode` approval handshake, since a
+     * manual cycle is not a plan exit. Drives the Shift+Tab cycle; {@link togglePlanMode}
+     * remains the path `/plan` uses.
+     *
+     * @returns the permission mode in effect after the advance
+     */
+    cyclePermissionMode(): PermissionMode;
+    /**
+     * The mode captured when plan mode was last entered, restored on exit — or
+     * `undefined` when not currently in (or paused from) plan mode. Exposed so a UI
+     * (and the round-trip tests) can observe the Enter/Exit pairing.
+     */
+    prePlanMode(): PermissionMode | undefined;
     /** The human-readable session name, or `undefined` when none is set. */
     sessionName(): string | undefined;
     /**

package/dist/types/conductor/diagnostics.d.ts

@@ -0,0 +1,183 @@
+/**
+ * Post-edit live diagnostics — an LSP-free, shell-sourced baseline-diff engine.
+ *
+ * The full induscode story runs a long-lived LSP and pulls structured
+ * diagnostics off the language server. That stack is out of scope for the
+ * clean-room product, so this is the **pragmatic shell path**: after a turn that
+ * edited TypeScript/JS files, the conductor asks this engine to run a project
+ * checker (`tsc --noEmit`, plus `eslint --format json` when an eslint config is
+ * present), scoped to the workspace, and diff the result against a *per-session
+ * baseline* captured before the edits. Only the diagnostics that are genuinely
+ * **new** (not in the baseline, not already delivered in a prior turn) are
+ * surfaced, and they are injected into the NEXT agent turn as a follow-up note.
+ *
+ * Everything here is best-effort and non-fatal:
+ *   - the checker spawns its OWN child process (lazy `node:child_process`), so
+ *     the module stays importable in a non-Node test context;
+ *   - a missing/slow/erroring checker NEVER faults the turn — the run is bounded
+ *     by an {@link AbortController} timeout and every failure resolves to `[]`;
+ *   - results are deduplicated and volume-capped (10/file, 30 total,
+ *     severity-sorted) so a broken project can't dump hundreds of lines into
+ *     context;
+ *   - it is fully opt-out-able (`DiagnosticsConfig.enabled === false`) and
+ *     defaults OFF when the workspace has no `tsconfig.json`.
+ *
+ * The line/column convention mirrors the LSP `Diagnostic.range`: 0-based.
+ * `tsc` reports 1-based positions, so {@link runTscDiagnostics} subtracts 1 and
+ * {@link formatDiagnosticsSummary} re-adds 1 when rendering for a human/agent.
+ */
+/** Severity rank, ordered most→least urgent for the volume cap's sort. */
+export type DiagnosticSeverity = "Error" | "Warning" | "Info" | "Hint";
+/** A zero-based line/column position. */
+export interface Position {
+    readonly line: number;
+    readonly character: number;
+}
+/** A single diagnostic, shaped after the LSP `Diagnostic` (0-based range). */
+export interface Diagnostic {
+    readonly message: string;
+    readonly severity: DiagnosticSeverity;
+    readonly range: {
+        readonly start: Position;
+        readonly end: Position;
+    };
+    readonly source?: string;
+    readonly code?: string | number;
+}
+/** All diagnostics for one file, keyed by an absolute fs path used as the uri. */
+export interface DiagnosticFile {
+    readonly uri: string;
+    readonly diagnostics: Diagnostic[];
+}
+/** Max diagnostics surfaced for any single file (mirrors the LSP registry cap). */
+export declare const MAX_PER_FILE = 10;
+/** Max diagnostics surfaced across all files in one turn. */
+export declare const MAX_TOTAL = 30;
+/** Char budget for the rendered summary (truncated past this). */
+export declare const MAX_SUMMARY_CHARS = 4000;
+/**
+ * A stable identity for one diagnostic: position + code + (trimmed) message.
+ * Two diagnostics with the same key are "the same problem" for dedup/baseline
+ * purposes even across separate checker runs.
+ */
+export declare function createDiagnosticKey(d: Diagnostic): string;
+/** Structural equality over a diagnostic's salient fields (via the dedup key). */
+export declare function areDiagnosticsEqual(a: Diagnostic, b: Diagnostic): boolean;
+/** Options for {@link deduplicateAndCap}. */
+export interface DedupOptions {
+    readonly maxPerFile?: number;
+    readonly maxTotal?: number;
+}
+/**
+ * Filter, deduplicate, severity-sort, and volume-cap a batch of diagnostic
+ * files against a cross-turn `delivered` ledger.
+ *
+ *   - drops any diagnostic whose key is already in `delivered[uri]` (already
+ *     surfaced in a prior turn — don't nag);
+ *   - dedups within a file (identical keys collapse to one);
+ *   - sorts each file's diagnostics by severity then position;
+ *   - caps to `maxPerFile` per file and `maxTotal` overall (errors win the cap);
+ *   - records every diagnostic it RETURNS into `delivered` (FIFO-capped per uri)
+ *     so the next turn won't re-surface it.
+ *
+ * `delivered` is mutated in place. Files that end up empty are dropped.
+ */
+export declare function deduplicateAndCap(files: readonly DiagnosticFile[], delivered: Map<string, Set<string>>, opts?: DedupOptions): DiagnosticFile[];
+/** Inline ASCII severity marker (no `figures` dep). */
+export declare function getSeveritySymbol(severity: DiagnosticSeverity): string;
+/**
+ * Render a deduped/capped batch into a compact, agent-readable block. Positions
+ * are re-converted to 1-based for display (the engine carries 0-based). The
+ * output is truncated to `maxChars` so it can never blow up a context window.
+ */
+export declare function formatDiagnosticsSummary(files: readonly DiagnosticFile[], maxChars?: number): string;
+/** A diagnostics source: produces files for the workspace, honoring `signal`. */
+export type DiagnosticRunner = (cwd: string, signal?: AbortSignal) => Promise<DiagnosticFile[]>;
+/**
+ * Run a project `tsc --noEmit --pretty false` and parse the flat diagnostic
+ * lines. Resolves to `[]` on ANY failure (binary missing, abort, non-Node).
+ * The local `node_modules/.bin/tsc` is preferred over a global/`npx` install to
+ * avoid a version mismatch with the project's own config.
+ *
+ * tsc lines look like: `src/x.ts(12,5): error TS2322: Type 'a' ...`
+ * Positions are 1-based in tsc; we store them 0-based (subtract 1).
+ */
+export declare function runTscDiagnostics(cwd: string, signal?: AbortSignal): Promise<DiagnosticFile[]>;
+/** Parse the combined stdout/stderr of a `tsc --pretty false` run. */
+export declare function parseTscOutput(output: string, cwd: string): DiagnosticFile[];
+/**
+ * Run a project `eslint --format json` over `files` and parse the result.
+ * Resolves to `[]` when eslint is absent, no config is found, or anything else
+ * goes wrong. severity 2→Error, 1→Warning. Positions are 1-based; stored 0-based.
+ */
+export declare function runEslintDiagnostics(files: readonly string[], cwd: string, signal?: AbortSignal): Promise<DiagnosticFile[]>;
+/** Parse `eslint --format json` output. Resolves config-not-found to `[]`. */
+export declare function parseEslintOutput(output: string, cwd: string): DiagnosticFile[];
+/** Configuration for the {@link DiagnosticsEngine}. */
+export interface DiagnosticsConfig {
+    /** Master switch. When `false` the engine reports nothing (opt-out). */
+    readonly enabled?: boolean;
+    /** The diagnostic sources to run. Defaults to `[runTscDiagnostics]`. */
+    readonly runners?: DiagnosticRunner[];
+    /** Per-run timeout in ms before the checker is aborted (default 30000). */
+    readonly timeoutMs?: number;
+    /** Per-file cap (default {@link MAX_PER_FILE}). */
+    readonly maxPerFile?: number;
+    /** Total cap (default {@link MAX_TOTAL}). */
+    readonly maxTotal?: number;
+}
+/**
+ * The post-edit diagnostics engine: runs checkers, diffs against a per-session
+ * baseline, and dedups across turns. Stateful and per-session — one instance
+ * lives on the conductor for the life of a session.
+ */
+export declare class DiagnosticsEngine {
+    #private;
+    constructor(cwd: string, config?: DiagnosticsConfig);
+    /** Whether this engine is active. */
+    get enabled(): boolean;
+    /** Whether the per-session baseline has already been captured. */
+    get hasBaseline(): boolean;
+    /**
+     * Capture the per-session baseline NOW (before any edits land) by running the
+     * checkers once over the current project state. Every diagnostic present is
+     * recorded as pre-existing, so a later {@link newDiagnostics} surfaces only the
+     * problems the session's own edits introduced. Idempotent: a second call is a
+     * no-op once a baseline exists. Best-effort — never throws.
+     *
+     * Prefer calling this at session start (before the agent can edit anything); if
+     * it is never called, {@link newDiagnostics} falls back to seeding the baseline
+     * on its first invocation.
+     */
+    seedBaseline(signal?: AbortSignal): Promise<void>;
+    /**
+     * Run every checker, restrict the results to `editedPaths`, subtract the
+     * per-session baseline, dedup against prior turns, and volume-cap. Returns the
+     * NEW diagnostics for the edited files (empty when nothing new). Best-effort:
+     * never throws, never blocks beyond the configured timeout.
+     *
+     * The first invocation seeds the baseline from the current project state and
+     * returns `[]` (the pre-existing problems are the baseline, not "new").
+     */
+    newDiagnostics(editedPaths: readonly string[], signal?: AbortSignal): Promise<DiagnosticFile[]>;
+    /**
+     * Forget the delivered-key history for one uri so a problem at that file can
+     * re-surface (e.g. the agent edited it again). The baseline is left intact.
+     */
+    clearDeliveredForFile(uri: string): void;
+    /** Drop all cross-turn state and the baseline (re-seeds on the next run). */
+    reset(): void;
+}
+/** Whether a path looks like a TypeScript/JS source file (by extension). */
+export declare function isTypeScriptOrJs(filePath: string): boolean;
+/**
+ * Whether the workspace has a `tsconfig.json` at its root — the signal used to
+ * default the engine ON. Best-effort + synchronous: a probe failure (or a
+ * non-Node context) reports `false` so the engine defaults OFF and stays inert.
+ */
+export declare function hasTsConfig(cwd: string): boolean;
+/**
+ * Whether the workspace has an eslint config at its root — the signal used to
+ * additionally enable the eslint runner. Best-effort + synchronous.
+ */
+export declare function hasEslintConfig(cwd: string): boolean;

package/dist/types/conductor/diagnostics.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Unit tests for the LSP-free post-edit diagnostics engine: the pure keying /
+ * dedup / cap / render logic, the tsc + eslint output parsers, and the
+ * baseline-diff behavior of {@link DiagnosticsEngine}.
+ *
+ * No network and no real `tsc`/`eslint` spawn — the engine is driven with
+ * scripted in-memory runners so the baseline/diff/dedup logic is exercised
+ * deterministically.
+ */
+export {};

package/dist/types/conductor/index.d.ts

@@ -14,10 +14,13 @@
  * land; consumers import the conductor surface from `src/conductor` rather than
  * reaching into individual modules.
  */
-export type { FaultKind, ConductorFault, SessionSignal, SignalKind, SignalOf, SignalHandler, TranscriptSchema, TranscriptRole, TranscriptEntry, SessionHead, ModelCardRef, MatchQuery, ConductorPhase, ConductorState, QueueMode, QueuedInput, SessionStats, ExecuteBashOptions, BashOutcome, SessionConductor, SessionConductorOptions, AgentMessage, AgentTool, ThinkingLevel, Model, Usage, KnownProvider, } from "./contract";
+export type { FaultKind, ConductorFault, SessionSignal, SignalKind, SignalOf, SignalHandler, TranscriptSchema, TranscriptRole, TranscriptEntry, SessionHead, ModelCardRef, MatchQuery, ConductorPhase, ConductorState, QueueMode, QueuedInput, SessionStats, ExecuteBashOptions, BashOutcome, SessionConductor, SessionConductorOptions, AgentMessage, AgentTool, CanUseToolFn, ThinkingLevel, Model, Usage, KnownProvider, PermissionMode, } from "./contract";
 export { conductorFault, TRANSCRIPT_SCHEMA } from "./contract";
 export { createSessionConductor, reduceState, noopCondense, type AgentLike, type ConductorDeps, type CondenseFn, type RetryPolicy, } from "./conductor";
 export { SignalHub, translateAgentEvent, type SignalHubOptions } from "./signal-hub";
 export { ModelCatalog, ModelMatcher, canonicalId, toCardRef, type CatalogCard, type CatalogSource, type ResolveInput, } from "./catalog";
 export { TranscriptStore, memoryBackend, fsBackend, replay, type TranscriptBackend, type TranscriptState, type TranscriptClock, type TranscriptStoreOptions, } from "./transcript-store";
 export { parseSkillInvocation, type SkillInvocation } from "./skill-parse";
+export { resolveRuleDecision, parseRule, makeRule, toolMatchesRule, createPermissionGate, isReadOnlyToolName, isEditToolName, READ_ONLY_TOOL_NAMES, EDIT_TOOL_NAMES, type PermissionBehavior, type PermissionRule, type PermissionDecision, type CanUseToolFn as PermissionCanUseToolFn, type ApprovalChoice, type ApprovalResolver, type PermissionGateConfig, } from "./permissions";
+export { parseBashCommand, catastrophicReason, isCatastrophicCommand, evaluateCatastrophic, bashSubcommandSubjects, type ParsedCommand, } from "./bash-guard";
+export { DiagnosticsEngine, createDiagnosticKey, deduplicateAndCap, formatDiagnosticsSummary, getSeveritySymbol, parseTscOutput, parseEslintOutput, runTscDiagnostics, runEslintDiagnostics, hasTsConfig, hasEslintConfig, isTypeScriptOrJs, areDiagnosticsEqual, MAX_PER_FILE, MAX_TOTAL, MAX_SUMMARY_CHARS, type Diagnostic, type DiagnosticFile, type DiagnosticSeverity, type DiagnosticsConfig, type DiagnosticRunner, type DedupOptions, type Position, } from "./diagnostics";

package/dist/types/conductor/permission-gate.integration.test.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Permission gate — integration against the REAL wired framework loop.
+ *
+ * The point of this suite (vs the pure {@link "./permissions.test"} unit tests) is
+ * to prove the gate actually lands where tools execute. It drives a real
+ * `indusagi/agent` `Agent` — the exact class the conductor's `makeAgent` wires —
+ * with a scripted `streamFn` that has the model request a tool call, and the
+ * SAME `createPermissionGate` output the conductor threads in as `canUseTool`.
+ *
+ * We assert through the framework's own message list (not a mock of an unwired
+ * module):
+ *   - a **deny** rule blocks the tool: it never executes, and the turn carries an
+ *     `isError` tool result with the deny message (an unanswered tool_use would
+ *     400 the next call, so the loop must still emit the result);
+ *   - an **allow** rule (or read-only auto-allow) lets the tool execute;
+ *   - **acceptEdits** auto-allows an edit without a rule;
+ *   - **bypass** allows everything;
+ *   - **plan** denies a mutating tool;
+ *   - an **ask** with no host resolver denies (non-interactive default);
+ *   - a live **mode switch** retargets subsequent calls with no agent rebuild.
+ */
+export {};

package/dist/types/conductor/permission-wiring.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Conductor permission wiring — proves `createSessionConductor` threads the gate
+ * factory and exposes live `permissionMode()` / `setPermissionMode()`.
+ *
+ * The end-to-end "gate blocks a real tool" proof lives in
+ * {@link "./permission-gate.integration.test"} (it drives the real framework
+ * loop). Here we pin the PRODUCT seam: the conductor (a) seeds the mode from
+ * options, (b) updates it through `setPermissionMode`, and (c) hands the gate
+ * factory a getter that reads the conductor's LIVE mode — so a mode switch after
+ * assembly is visible to the gate with no agent rebuild. A scripted fake
+ * `AgentLike` keeps it network/disk-free, and a separate check confirms the gate
+ * factory IS resolved with a live-mode getter on the real-agent path.
+ */
+export {};