indusagi-coding-agent 0.1.62 → 0.2.1

package/dist/types/console/overlays/index.d.ts

@@ -11,3 +11,5 @@ export { OverlayHost, type OverlayHostProps } from "./host";
 export { PickerOverlays, type OverlayGroupProps } from "./pickers";
 export { SessionOverlays } from "./sessions";
 export { AuthOverlays } from "./auth";
+export { ApprovalOverlays, choiceFromId, readApprovalPayload, summarizeInput, APPROVAL_CHOICES, DISMISS_CHOICE, type ApprovalRequest, type ApprovalPayload, } from "./approval";
+export { approvalQueueReducer, activeApproval, EMPTY_APPROVAL_QUEUE, type ApprovalEntry, type ApprovalQueueState, type ApprovalQueueEvent, } from "./approval-queue";

package/dist/types/guardrails.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Thin guardrails entry — the headless, library-consumable surface of the
+ * indusagi coding agent.
+ *
+ * This barrel re-exports ONLY the deterministic guardrail primitives (the
+ * permission rule engine, the bash blocklist, prompt assembly, deck
+ * provisioning, and the read-before-edit / checkpoint stores). It deliberately
+ * imports from the LEAF modules — never the root `src/index.ts` barrel — so a
+ * consumer can pull in the guardrails without dragging in the Ink/React console
+ * tree (`export * as consoleUi from "./console"` lives only on the root barrel).
+ *
+ * Reachable from a published install as `indusagi-coding-agent/guardrails`.
+ */
+export { resolveRuleDecision, makeRule, createPermissionGate, READ_ONLY_TOOL_NAMES, EDIT_TOOL_NAMES, } from "./conductor/permissions";
+export type { PermissionRule, PermissionMode, PermissionBehavior, PermissionDecision, } from "./conductor/permissions";
+export { evaluateCatastrophic, bashSubcommandSubjects } from "./conductor/bash-guard";
+export { composeBriefing } from "./briefing/compose";
+export { gatherContextDocs } from "./briefing/context-docs";
+export type { AgentTool, BriefingContext, ContextDoc } from "./briefing/contract";
+export { provisionDeck } from "./capability-deck/provision";
+export { createReadStateStore, READ_STATE_HANDLE_KEY, ReadStateStore } from "./boot/runners/read-state";
+export { createCheckpointStore, CHECKPOINT_HANDLE_KEY, CheckpointStore } from "./boot/runners/checkpoint";
+/**
+ * The byte-stable refusal emitted when an edit/write is attempted on a file the
+ * agent has not read this session.
+ *
+ * Surfaced here as the guardrails contract for consumers (e.g. eval fixtures)
+ * that assert the refusal verbatim. The literal is intentionally duplicated
+ * rather than re-exported because the upstream message lives only as a private
+ * module-local const in the framework's read-state gate — it is not part of any
+ * public barrel. A reword on either side must update both sites, by design.
+ */
+export declare const READ_BEFORE_EDIT_MESSAGE = "File has not been read yet. Read it first before writing to it.";

package/dist/types/launch/contract.d.ts

@@ -171,6 +171,8 @@ export interface Invocation {
     readonly attachments?: Attachments;
     /** Explicit model selector (`--model` / `-m`), provider-qualified or bare. */
     readonly model?: string;
+    /** Model to fall back to when the selected model is overloaded mid-turn (`--fallback-model`). */
+    readonly fallbackModel?: string;
     /** Named credential account to authenticate the run with (`--account`). */
     readonly account?: string;
     /** Working directory the run is scoped to (`--cwd`); absent means process cwd. */

package/dist/types/launch/index.d.ts

@@ -20,7 +20,7 @@ export { runPackageCommand, defaultPackageIo, PACKAGE_COMMANDS, } from "./packag
 export type { PackageCommand, PackageIo, PackageCommandOptions, PackageResult, } from "./packages";
 export { runCredentialCommand, defaultCredentialIo, formatCredentialFault, validateApiKey, validateAccountName, findProvider, isOAuthCapable, asSigninMethod, PROVIDER_DIRECTORY, } from "./credentials";
 export type { CredentialIo, CredentialResult, SigninMethod } from "./credentials";
-export { registerBuiltInOAuthProviders, listLoginProviders, startOAuthLogin, openLoginUrl, } from "./oauth";
+export { registerBuiltInOAuthProviders, listLoginProviders, startOAuthLogin, openLoginUrl, hasRegisteredOAuthClientId, } from "./oauth";
 export type { AuthKind, LoginProvider, OAuthLoginResult, } from "./oauth";
 export { printModelCatalog, defaultCatalogIo, registrySource } from "./catalog";
 export type { CatalogIo, CatalogModelSource } from "./catalog";

package/dist/types/launch/oauth.d.ts

@@ -29,6 +29,19 @@ import type { AuthVault } from "./contract";
  * that are registered after the call, for callers that want to confirm the set.
  */
 export declare function registerBuiltInOAuthProviders(): string[];
+/**
+ * Whether a registered sign-in provider has a *real* OAuth client id wired in
+ * (its env var is set to something other than the framework's sentinel), so its
+ * browser sign-in can actually complete.
+ *
+ * Reads the env var live (not at import time) so a deployer that exports the id
+ * before launching `/login` is honored. A provider with no known client-id
+ * wiring (i.e. not one of the three sentinel-shipped framework providers) is
+ * treated as registered — we only gate the providers we know ship a sentinel.
+ *
+ * @param providerId the registered sign-in provider id
+ */
+export declare function hasRegisteredOAuthClientId(providerId: string): boolean;
 /** How a provider authenticates in the merged sign-in directory. */
 export type AuthKind = "oauth" | "apiKey";
 /** One row of the merged sign-in directory. */

package/dist/types/settings/contract.d.ts

@@ -48,6 +48,46 @@ export type DeliveryMode = "all" | "one-at-a-time";
 export declare const DELIVERY_MODES: readonly DeliveryMode[];
 /** Narrow an arbitrary value to a known {@link DeliveryMode}. */
 export declare function isDeliveryMode(value: unknown): value is DeliveryMode;
+/**
+ * How aggressively the per-tool permission gate auto-allows tool calls before it
+ * falls back to asking (or denying):
+ *
+ *   - `default`      — consult the allow/ask/deny rules; read-only tools are
+ *                      auto-allowed, anything else with no matching allow rule
+ *                      falls through to `ask`.
+ *   - `acceptEdits`  — additionally auto-allow filesystem edits/writes (the
+ *                      mutating edit/write/multiedit tools), leaving everything
+ *                      else on the `default` path.
+ *   - `bypass`       — allow every tool with no prompt (the unsafe "trust all"
+ *                      mode; `bypassPermissions` is accepted as an alias).
+ *   - `plan`         — deny every mutating tool outright (read-only research only)
+ *                      so the agent can plan without touching the workspace.
+ */
+export type PermissionMode = "default" | "acceptEdits" | "bypass" | "plan" | "bypassPermissions";
+/** The canonical {@link PermissionMode} values, as a frozen tuple for menus/guards. */
+export declare const PERMISSION_MODES: readonly PermissionMode[];
+/** Narrow an arbitrary value to a known {@link PermissionMode} (folds the alias). */
+export declare function isPermissionMode(value: unknown): value is PermissionMode;
+/**
+ * The declarative permission policy a session reads at startup.
+ *
+ * `allow`/`ask`/`deny` are ordered lists of induscode-style rule strings — a bare
+ * tool name (`"Bash"`) or a tool name with an argument specifier
+ * (`"Bash(npm run test:*)"`). Across tiers the three lists are concatenated, and
+ * `deny` wins over `ask` wins over `allow`. `defaultMode` seeds the session's
+ * permission mode when no flag overrides it. Every field is optional so an empty
+ * `{}` (or an absent `permissions` key) keeps today's allow-all behavior.
+ */
+export interface PermissionSettings {
+    /** Rule strings that auto-allow a matching tool call (lowest precedence). */
+    allow?: string[];
+    /** Rule strings that force a matching tool call to prompt for approval. */
+    ask?: string[];
+    /** Rule strings that hard-block a matching tool call (highest precedence). */
+    deny?: string[];
+    /** The permission mode the session opens in when no flag overrides it. */
+    defaultMode?: PermissionMode;
+}
 /**
  * Every preference an interactive coding-agent session reads, as one flat,
  * fully-optional record.
@@ -111,6 +151,13 @@ export interface Preferences {
     doubleEscapeAction?: EscapeAction;
     /** Extension-package sources the launcher installs and loads (npm / git / local). */
     extensionPackages?: string[];
+    /**
+     * The declarative tool-permission policy: ordered allow/ask/deny rule lists and
+     * the opening permission mode. Across the project/global tiers the rule lists
+     * are concatenated (not overridden) and `deny > ask > allow` decides; an absent
+     * value (or an empty object) preserves today's allow-all behavior.
+     */
+    permissions?: PermissionSettings;
 }
 /** The set of legal preference keys, derived from {@link Preferences}. */
 export type SettingKey = keyof Preferences;

package/dist/types/settings/index.d.ts

@@ -7,7 +7,7 @@
  * {@link PreferenceStore} reader/writer. Console surfaces and boot stages depend
  * on this module rather than reaching into the individual files.
  */
-export type { Preferences, SettingKey, EscapeAction, DeliveryMode, ThinkingLevel, } from "./contract";
-export { DEFAULT_PREFERENCES, SETTING_KEYS, ESCAPE_ACTIONS, isEscapeAction, DELIVERY_MODES, isDeliveryMode, } from "./contract";
+export type { Preferences, SettingKey, EscapeAction, DeliveryMode, ThinkingLevel, PermissionMode, PermissionSettings, } from "./contract";
+export { DEFAULT_PREFERENCES, SETTING_KEYS, ESCAPE_ACTIONS, isEscapeAction, DELIVERY_MODES, isDeliveryMode, PERMISSION_MODES, isPermissionMode, } from "./contract";
 export { PreferenceStore } from "./manager";
 export type { PreferenceLocations } from "./manager";

package/dist/types/window-budget/condenser.d.ts

@@ -28,8 +28,22 @@
  * matching session-scope entrypoint. Both are re-exported here so callers can
  * summarize a slice directly without building a full {@link Condenser}.
  */
-import type { AgentMessage, CondenserDeps, Condenser, Summary } from "./contract.js";
+import type { AgentMessage, BudgetPolicy, CondenserDeps, Condenser, Summary } from "./contract.js";
 import { condenseScope, type SummarizeDeps } from "./summarize/index.js";
+/**
+ * The fallback {@link BudgetPolicy} when the caller supplies none. These are
+ * ordinary configuration defaults — a window-relative ratio plus a token tail —
+ * computed from the model's own context window rather than fixed magic numbers.
+ *   - `triggerRatio` 0.75 — condense once ~three-quarters of the window is used.
+ *   - `keepRecent`   6000 — keep roughly the last 6k tokens of turns verbatim.
+ *   - `reserveTokens` 2048 — carve a little headroom off the window first.
+ *
+ * Exported as {@link AUTO_CONDENSE_POLICY} so the conductor's token gate and the
+ * session runner's slice planner share **one** policy — the value the auto-path
+ * trigger ({@link isOverBudget}) compares against must equal the value the slice
+ * planner ({@link planSlice}) cuts with, or the gate and the cut disagree.
+ */
+export declare const AUTO_CONDENSE_POLICY: BudgetPolicy;
 /**
  * Build a {@link Condenser} from a {@link CondenserDeps} bundle. The result plugs
  * straight into the conductor's `CondenseFn` seam.

package/dist/types/window-budget/index.d.ts

@@ -12,4 +12,6 @@ export type { AgentMessage, BudgetPolicy, CompleteFn, CondensePlan, Condenser, C
 export { budgetLimit, estimateMessageTokens, estimateTokens, isOverBudget, planSlice, prefixTokens, } from "./budget/index.js";
 export { buildSummaryPrompt, CONDENSER_BRIEF, flattenTranscript, summarize, } from "./summarize/index.js";
 export type { SummarizeDeps } from "./summarize/index.js";
-export { condense, condenseScope, createCondenser } from "./condenser.js";
+export { AUTO_CONDENSE_POLICY, condense, condenseScope, createCondenser } from "./condenser.js";
+export { CLEARED_TOOL_RESULT, clearStaleToolResults, COMPACTABLE_TOOL_NAMES, } from "./microcompact.js";
+export { rehydrateRecentReads, RESTORED_FILE_PREFIX } from "./rehydrate.js";

package/dist/types/window-budget/microcompact.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Window-budget / microcompact — clear stale tool-result bodies in place.
+ *
+ * The cheapest token to reclaim is one that is already dead weight: the verbatim
+ * body of a tool result the model has long since acted on. Once an agent has
+ * read a file, run a search, or executed a command and moved several turns past
+ * it, the full body of that result rarely needs to stay in the window — the
+ * model's subsequent reasoning already captured what mattered. Yet those bodies
+ * (a 2,000-line `read`, a noisy `bash` log, a wide `grep`) dominate the token
+ * budget.
+ *
+ * **Microcompaction** runs *before* a full {@link condense}: it walks the
+ * transcript, keeps the last few tool results verbatim (the model may still be
+ * working with them), and replaces the body of every older compactable tool
+ * result with a short sentinel. This reclaims tokens for free — no model call,
+ * no summary round-trip — and often defers (or shrinks the input to) the real
+ * condense.
+ *
+ * Shape note (this rebuild): a tool result is its OWN top-level
+ * {@link ToolResultMessage} (`role: 'toolResult'`), not a block nested inside a
+ * user message. Clearing one therefore means replacing *that message's*
+ * `content` array with a single sentinel text block — never editing a sub-block
+ * of some other message. We only clear results whose owning assistant `toolCall`
+ * named a compactable tool, so structural/control results stay intact.
+ *
+ * Behavior-preserving by construction: when there is nothing to clear (no
+ * compactable results, or every one is within the keep window) the *same input
+ * reference* is returned, so a caller can cheaply detect a no-op.
+ */
+import type { AgentMessage } from "./contract.js";
+/**
+ * The placeholder spliced in where a stale tool-result body used to be. Kept
+ * short on purpose — the whole point is to reclaim the tokens the original body
+ * occupied — while still signalling to the model (and to a human reading the
+ * transcript) that real content was elided rather than lost.
+ */
+export declare const CLEARED_TOOL_RESULT = "[Old tool result content cleared]";
+/**
+ * The wire names of tools whose results are safe to clear once stale.
+ *
+ * These are the read-mostly / output-heavy tools whose bodies are reconstructable
+ * (re-read the file, re-run the search) and whose stale content the model has
+ * already digested. Control/state tools (todo, memory, task) are deliberately
+ * absent — their results can carry standing instructions the model still needs.
+ */
+export declare const COMPACTABLE_TOOL_NAMES: ReadonlySet<string>;
+/**
+ * Clear the bodies of stale compactable tool results, keeping the most recent
+ * `keepRecent` of them verbatim.
+ *
+ * Walks the transcript, identifies every `role:'toolResult'` message that
+ * belongs to a compactable tool call, keeps the last `keepRecent` (floored at 1
+ * — `slice(-0)` would keep everything), and replaces each older one's `content`
+ * with a single `{ type:'text', text: CLEARED_TOOL_RESULT }` block. Non-tool
+ * messages, control-tool results, and already-cleared results are left exactly
+ * as they were.
+ *
+ * Returns the **same input array reference** when nothing was cleared, so the
+ * caller can detect a no-op by identity. Otherwise returns a new array; cleared
+ * messages are fresh objects (the originals are not mutated).
+ *
+ * @param messages the active transcript, oldest-first
+ * @param opts.keepRecent how many most-recent compactable results to keep
+ *   verbatim (default {@link DEFAULT_KEEP_RECENT}, floored at 1)
+ */
+export declare function clearStaleToolResults(messages: AgentMessage[], opts?: {
+    keepRecent?: number;
+}): AgentMessage[];

package/dist/types/window-budget/microcompact.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Window-budget / microcompact + rehydrate — unit tests for item #18.
+ *
+ * Three layers ride the condense path:
+ *   1. microcompact ({@link clearStaleToolResults}) — blank older completed
+ *      tool-result bodies to a sentinel, keeping the last N verbatim; no-op
+ *      (same reference) otherwise.
+ *   2. rehydration ({@link rehydrateRecentReads}) — re-attach the most-recently
+ *      dropped file reads as synthetic user messages, deduped against the kept
+ *      tail, honoring maxFiles / tokenBudget.
+ *   3. circuit breaker — covered in the conductor suite (3 throwing condense
+ *      calls stop further attempts, a success resets).
+ *
+ * Pure + network-free: no model is bound anywhere here.
+ */
+export {};

package/dist/types/window-budget/rehydrate.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Window-budget / rehydrate — re-attach recently-read files after a condense.
+ *
+ * A full {@link condense} folds the dropped head of the transcript into one
+ * summary message. That digest captures *what happened*, but it necessarily
+ * loses the verbatim bodies of files the agent had just read — and those bodies
+ * are often exactly the working context the next turn needs (the file it was
+ * mid-edit on, the config it was reasoning about). Re-reading them costs a tool
+ * round-trip and, worse, the model may not realize it needs to.
+ *
+ * **Post-compact rehydration** softens that cliff: after the slice is dropped,
+ * it scans the *dropped* messages for `read` results, takes the most-recent
+ * handful that aren't already visible in the kept tail, and re-attaches their
+ * bodies as synthetic user messages ("[Restored file after compaction] …") under
+ * a token budget. The model keeps its working files without a re-read, while the
+ * older surrounding chatter still gets compressed away.
+ *
+ * Shape note (this rebuild): a read's *body* lives in its own top-level
+ * {@link ToolResultMessage} (`role:'toolResult'`), and the read's *path* lives in
+ * the owning assistant `toolCall.arguments.path` (the read tool's arg is `path`,
+ * not `file_path`). We pair each dropped `read` call with its result by
+ * `toolCallId`, dedup against paths still visible in the kept tail, and emit the
+ * most-recent survivors under a token cap.
+ *
+ * Behavior-preserving by construction: returns an empty array whenever there is
+ * nothing to restore (no dropped reads, all already visible, or the budget is
+ * exhausted), so the caller can splice the result unconditionally.
+ */
+import type { AgentMessage } from "./contract.js";
+/** Prefix marking a synthetic message that restores a file body post-compaction. */
+export declare const RESTORED_FILE_PREFIX = "[Restored file after compaction]";
+/**
+ * Build the synthetic user messages that re-attach the most-recently-read files
+ * dropped by a condense.
+ *
+ * Scans `dropped` for `read` calls + result bodies, drops any path still visible
+ * in `kept`, sorts the survivors most-recent-first, takes up to `maxFiles`, and
+ * emits each as a `user` message of the form
+ * `"[Restored file after compaction] <path>\n<body>"` — stopping once the running
+ * token estimate would exceed `tokenBudget`. The returned messages are ordered
+ * oldest-restored-first so they read naturally when spliced after the summary.
+ *
+ * Returns an **empty array** when nothing is restorable, so the caller can splice
+ * the result unconditionally (`[summary, ...restored, ...kept]`).
+ *
+ * @param dropped the condensed-away head slice (original bodies, pre-summary)
+ * @param kept    the verbatim tail that survives the condense
+ * @param opts.maxFiles    cap on restored files (default {@link DEFAULT_MAX_FILES})
+ * @param opts.tokenBudget token ceiling for the restored block (default {@link DEFAULT_TOKEN_BUDGET})
+ * @param opts.readToolName wire name of the read tool (default `"read"`)
+ */
+export declare function rehydrateRecentReads(dropped: AgentMessage[], kept: AgentMessage[], opts?: {
+    maxFiles?: number;
+    tokenBudget?: number;
+    readToolName?: string;
+}): AgentMessage[];

package/dist/types/workspace/brand.d.ts

@@ -23,4 +23,4 @@ export declare const BRAND: Brand;
  * Single source of truth: bump this one line per release. Co-located with the
  * brand so `boot` reads it without importing the index barrel.
  */
-export declare const VERSION = "0.1.62";
+export declare const VERSION = "0.2.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "indusagi-coding-agent",
-  "version": "0.1.62",
+  "version": "0.2.1",
   "description": "Indusagi coding agent — a terminal-first AI coding agent, built from scratch on the indusagi framework.",
   "author": "Varun Israni",
   "license": "MIT",
@@ -22,12 +22,23 @@
   "engines": {
     "node": ">=20"
   },
-  "main": "./dist/entry.js",
+  "main": "./dist/index.js",
   "types": "./dist/types/index.d.ts",
   "bin": {
     "indus": "dist/entry.js",
     "indusagi": "dist/entry.js"
   },
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./guardrails": {
+      "types": "./dist/types/guardrails.d.ts",
+      "import": "./dist/guardrails.js"
+    },
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist",
     "CHANGELOG.md",
@@ -46,7 +57,7 @@
     "@sinclair/typebox": "^0.34.49",
     "chalk": "^5.6.2",
     "highlight.js": "^11.11.1",
-    "indusagi": "^0.12.34",
+    "indusagi": "^0.13.0",
     "ink": "^5.2.1",
     "jiti": "^2.7.0",
     "marked": "^18.0.4",