indusagi-coding-agent 0.2.12 → 0.2.14

package/src/console/reducer.ts

@@ -11,6 +11,8 @@
  */
 import { EMPTY_CONSOLE_STATE, NO_MODAL, transitionModal, type ConsoleEvent, type ConsoleState } from "./contract.js";
 
+import { previousGrapheme, nextGrapheme, moveGrapheme, snapGrapheme } from "./input/graphemes.js";
+
 function clamp(offset: number, max: number) {
   if (offset < 0) return 0;
   if (offset > max) return max;
@@ -38,14 +40,15 @@ function insertBuffer(state: ConsoleState, text: string) {
 function erasePrev(state: ConsoleState) {
   const at = clamp(state.caret, state.buffer.length);
   if (at === 0) return state;
-  const next = state.buffer.slice(0, at - 1) + state.buffer.slice(at);
-  return withBuffer(state, next, at - 1);
+  const previous = previousGrapheme(state.buffer, at);
+  const next = state.buffer.slice(0, previous) + state.buffer.slice(at);
+  return withBuffer(state, next, previous);
 }
 
 function eraseNext(state: ConsoleState) {
   const at = clamp(state.caret, state.buffer.length);
   if (at >= state.buffer.length) return state;
-  const next = state.buffer.slice(0, at) + state.buffer.slice(at + 1);
+  const next = state.buffer.slice(0, at) + state.buffer.slice(nextGrapheme(state.buffer, at));
   return withBuffer(state, next, at);
 }
 
@@ -97,6 +100,10 @@ function patchRow(state: ConsoleState, id: string, text: string) {
  */
 export function consoleReducer(state: ConsoleState, event: ConsoleEvent): ConsoleState {
   switch (event.type) {
+    case "view:reset":
+      return { ...state, rows: [], blocks: [], buffer: "", caret: 0, historyAt: null, stash: "", modal: NO_MODAL, busy: false };
+    case "display:set":
+      return { ...state, [event.key]: event.value };
     // Composer buffer & caret
     case "buffer:set":
       return setBuffer(state, event.text);
@@ -119,9 +126,9 @@ export function consoleReducer(state: ConsoleState, event: ConsoleEvent): Consol
     case "buffer:eraseNext":
       return eraseNext(state);
     case "caret:move":
-      return { ...state, caret: clamp(state.caret + event.delta, state.buffer.length) };
+      return { ...state, caret: moveGrapheme(state.buffer, state.caret, event.delta) };
     case "caret:jump":
-      return { ...state, caret: clamp(event.offset, state.buffer.length) };
+      return { ...state, caret: snapGrapheme(state.buffer, event.offset) };
     // History ring
     case "history:push":
       return pushHistory(state, event.text);

package/src/console/slash/builtins.ts

@@ -4,6 +4,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { gatherSkillCards, loadMacros } from "../../briefing/index.js";
+import type { SkillCard, Macro } from "../../briefing/index.js";
 import type { SlashCommand } from "../contract.js";
 import { FAMILY } from "./commands/shared.js";
 import { buildDynamicCommands } from "./commands/dynamic.js";
@@ -30,16 +31,16 @@ function dynamicRoots() {
 
 function discoverDynamicSources() {
   const roots = dynamicRoots();
-  let skills: Array<{ name: string; location: string }> = [];
+  let skills: SkillCard[] = [];
   try {
     skills = gatherSkillCards(roots.skills).cards.slice();
   } catch {
     skills = [];
   }
-  const templates: Array<{ name: string; source: string }> = [];
+  const templates: Macro[] = [];
   const claimed = new Set<string>();
   for (const root of roots.macros) {
-    let loaded: Array<{ name: string; source: string }> = [];
+    let loaded: Macro[] = [];
     try {
       loaded = loadMacros(root.dir, { origin: root.origin, label: root.label });
     } catch {

package/src/console/slash/commands/integrations.ts

@@ -3,6 +3,7 @@
  * clipboard / export / share I/O verbs.
  */
 import { spawnSync } from "node:child_process";
+import { getEnvApiKey } from "indusagi/ai";
 import { readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
@@ -10,6 +11,7 @@ import { createMCPAgentToolFactory, loadMCPConfig, MCPClientPool } from "indusag
 import { createComposioGateway } from "indusagi/connectors-saas";
 import type { SlashCommand, SlashContext } from "../../contract.js";
 import { FAMILY, HANDLED, familyRunner, info, warn, splitVerb } from "./shared.js";
+import type { TranscriptEntry } from "../../../transcript-export/publish.js";
 import { publishTranscript } from "../../../transcript-export/index.js";
 import { APP_NOVEL_CARDS, memoryCard } from "../../../capability-deck/index.js";
 import { getServerToken, hasValidServerToken, INDUS_SERVER_URL } from "../../../boot/server-token.js";
@@ -48,7 +50,7 @@ function writeClipboard(text: string): boolean {
   return false;
 }
 
-function lastAssistantText(messages: any[]): string {
+function lastAssistantText(messages: readonly any[]): string {
   for (let i = messages.length - 1; i >= 0; i--) {
     const message = messages[i];
     if (message.role !== "assistant") continue;
@@ -66,11 +68,12 @@ function lastAssistantText(messages: any[]): string {
   return "";
 }
 
-function toPublishRole(role: string): string {
-  return PUBLISH_ROLES.has(role) ? role : "note";
+function toPublishRole(role: string): TranscriptEntry["role"] {
+  if (role === "toolResult") return "tool";
+  return PUBLISH_ROLES.has(role) ? role as TranscriptEntry["role"] : "note";
 }
 
-function toPublishEntries(messages: any[]) {
+function toPublishEntries(messages: readonly any[]) {
   return messages.map((message) => {
     const m = message;
     return {
@@ -541,16 +544,12 @@ function runLogin(ctx: SlashContext) {
   return HANDLED;
 }
 
-function hasLocalProviderKey(provider: string) {
-  if (provider.length === 0) return false;
+async function hasLocalProviderKey(provider: string, ctx: SlashContext) {
+  if (!provider) return false;
   try {
-    const file = join(homedir(), ".indusagi", "agent", "auth.json");
-    const vault = JSON.parse(readFileSync(file, "utf8"));
-    const entry = vault[provider];
-    return entry !== null && typeof entry === "object" && Object.keys(entry).length > 0;
-  } catch {
-    return false;
-  }
+    if (getEnvApiKey(provider)) return true;
+    return (await ctx.services?.vault.listAccounts(provider) ?? []).length > 0;
+  } catch { return false; }
 }
 
 function runStatus(ctx: SlashContext) {
@@ -564,7 +563,7 @@ function runStatus(ctx: SlashContext) {
       signedIn = false;
     }
     const eligible = isGatewayEligibleProvider(provider);
-    const localKey = hasLocalProviderKey(provider);
+    const localKey = await hasLocalProviderKey(provider, ctx);
     const viaServer = signedIn && eligible && !localKey;
     if (viaServer) {
       ctx.setStatus(info(`● server tier — ${modelId} routing via ${INDUS_SERVER_URL} (signed in)`));

package/src/console/slash/commands/transcript.ts

@@ -69,12 +69,7 @@ const compactCommand: SlashCommand = {
     ctx.setStatus({ kind: "busy", text: busyText });
     void (async () => {
       try {
-        if (instructions.length > 0) {
-          await ctx.conductor.executeBash(
-            `printf '%s' ${JSON.stringify(`Compaction guidance: ${instructions}`)}`
-          );
-        }
-        switch (await ctx.conductor.condense()) {
+        switch (await ctx.conductor.condense(instructions || undefined)) {
           case "condensed":
             ctx.setStatus(
               info(
@@ -123,7 +118,7 @@ const sessionCommand: SlashCommand = {
     const name = ctx.conductor.sessionName();
     const block = {
       id: `session-stats-${Date.now().toString(36)}`,
-      kind: "changelog",
+      kind: "changelog" as const,
       title: name ? `Session: ${name}` : "Session statistics",
       markdown: statsMarkdown(stats, name),
       timestamp: Date.now()
@@ -155,7 +150,7 @@ const costCommand: SlashCommand = {
 ${rows.map(([k, v]) => `| ${k} | ${v} |`).join("\n")}`;
     const block = {
       id: `session-cost-${Date.now().toString(36)}`,
-      kind: "changelog",
+      kind: "changelog" as const,
       title: "Session cost",
       markdown,
       timestamp: Date.now()

package/src/console/slash/commands/workbench.ts

@@ -11,7 +11,7 @@ import { FAMILY, HANDLED, familyRunner, info, warn } from "./shared.js";
 function block(slug: string, title: string, markdown: string) {
   return {
     id: `${slug}-${Date.now().toString(36)}`,
-    kind: "changelog",
+    kind: "changelog" as const,
     title,
     markdown,
     timestamp: Date.now()
@@ -147,7 +147,7 @@ const HOTKEYS: Array<[string, string]> = [
   ["Tab", "Accept the highlighted completion"],
   ["Ctrl+C", "Interrupt the running turn"],
   ["Ctrl+T", "Toggle reasoning / thinking rows"],
-  ["/thinking", "Cycle thinking effort level (off → low → medium)"],
+  ["/thinking", "Cycle the selected model's supported reasoning efforts"],
   ["Ctrl+V", "Attach an image from the clipboard"],
   ["Ctrl+G", "Edit the composer in your external editor"],
   ["Ctrl+O", "Expand or collapse full tool output"],
@@ -222,7 +222,7 @@ export const workbenchCommands: SlashCommand[] = [
   {
     name: "whats-new",
     summary: "Show what changed in this build",
-    aliases: ["changelog"],
+    aliases: ["changelog", "release-notes"],
     run: runChangelog
   },
   {
@@ -232,7 +232,7 @@ export const workbenchCommands: SlashCommand[] = [
   },
   {
     name: "thinking",
-    summary: "Cycle thinking effort level (off → low → medium → off)",
+    summary: "Cycle reasoning effort using the selected model's supported levels",
     run: (ctx) => {
       ctx.conductor.cycleThinkingLevel();
       return HANDLED;

package/src/console/test-support.ts

@@ -0,0 +1,48 @@
+import { Writable, PassThrough } from 'node:stream';
+import React from 'indusagi/react-host';
+import { render } from 'indusagi/react-host/ink';
+import stripAnsi from 'strip-ansi';
+import { TerminalConsole } from './components/TerminalConsole.js';
+import { resolveTheme } from './theme/resolve.js';
+import { DEFAULT_SLASH_REGISTRY } from './slash/index.js';
+import { DEFAULT_PREFERENCES } from '../settings/contract.js';
+export const settle = (ms=55) => new Promise<void>(r=>setTimeout(r,ms));
+export function fixtureConductor() {
+  let handler=(signal:any)=>{}, phase='idle', messages:any[]=[], queue:any[]=[], sessionId='fixture';
+  const model={id:'test-model',provider:'fixture',contextWindow:200000,name:'Fixture',reasoning:true};
+  const submissions:string[]=[];
+  const c:any={snapshot:()=>({phase,contextTokens:0,head:{sessionId,leaf:null},modelId:'fixture/test-model'}),model:()=>model,
+    stats:()=>({sessionId,userMessages:0,assistantMessages:0,toolCalls:0,toolResults:0,totalMessages:messages.length,tokens:{input:0,output:0,cacheRead:0,cacheWrite:0,total:0},cost:0}),
+    pendingCount:()=>queue.length,pendingInputs:()=>queue,thinkingLevel:()=> 'off',sessionName:()=>undefined,availableModels:()=>[model],messages:()=>messages,isBusy:()=>phase!=='idle',
+    permissionMode:()=> 'default',setApprovalResolver:(r:any)=>{c.approvalResolver=r},subscribe:(fn:any)=>{handler=fn;return()=>{handler=()=>{}}},
+    submit:async(text:string)=>{submissions.push(text);if(phase==='streaming'){queue.push({text,mode:'followUp'});handler({kind:'queue',count:queue.length})}else{phase='streaming'}},
+    emit:(sig:any)=>handler(sig),setMessages:(m:any[])=>{messages=m},setPhase:(p:string)=>{phase=p},submissions,
+    abort:()=>{c.aborted=(c.aborted??0)+1;phase='idle';handler({kind:'idle'})},
+    cyclePermissionMode:()=> 'acceptEdits',cycleThinkingLevel:()=> 'low',dequeueLast:()=>queue.pop()?.text,steerNow:()=>false,
+    newSession:async()=>{messages=[];phase='idle';sessionId+='-new';handler({kind:'idle'})},executeBash:async()=>({exitCode:0,output:'SHELL_SENTINEL'})};
+  return c;
+}
+export function fixtureServices(c:any, overrides:any={}) {
+  const values:any={...DEFAULT_PREFERENCES,quietStartup:true,lastSeenVersion:'0.2.14',defaultProvider:'fixture',...overrides};
+  return {conductor:c,settings:{get:(k:string)=>values[k],set:(k:string,v:any)=>{values[k]=v},save:()=>{}},vault:{defaultAccount:async()=>undefined,listAccounts:async()=>['fixture-account']},listLoginProviders:()=>[{id:'fixture',label:'Fixture',authKind:'apiKey'}],values};
+}
+export async function renderTest(element:any,columns=80,rows=24) {
+  const frames:string[]=[];
+  const stdout=new Writable({write(chunk,_enc,cb){frames.push(String(chunk));cb()}});
+  Object.assign(stdout,{columns,rows,isTTY:true});
+  const stdin=new PassThrough();Object.assign(stdin,{isTTY:true,setRawMode:()=>{},ref:()=>{},unref:()=>{}});
+  const app=render(element,{stdout:stdout as unknown as NodeJS.WriteStream,stdin:stdin as unknown as NodeJS.ReadStream,stderr:stdout as unknown as NodeJS.WriteStream,debug:true,patchConsole:false,exitOnCtrlC:false});
+  let exited=false;void app.waitUntilExit().then(()=>{exited=true});
+  await settle(80);
+  return {app,frames,stdout,stdin,exited:()=>exited,
+    last:()=>stripAnsi(frames.filter(f=>f.length>10).at(-1)||''),raw:()=>frames.filter(f=>f.length>10).at(-1)||'',
+    key:async(text:string)=>{stdin.write(text);await settle()},
+    resize:async(cols:number,r:number)=>{Object.assign(stdout,{columns:cols,rows:r});stdout.emit('resize');await settle()},
+    close:()=>{app.unmount();app.cleanup();stdin.destroy();stdout.destroy()}};
+}
+export async function consoleTest(options:any={}) {
+  const c=options.conductor??fixtureConductor();
+  const svc=options.services===false?undefined:(options.services??fixtureServices(c,options.settings));
+  const view=await renderTest(React.createElement(TerminalConsole,{conductor:c,theme:resolveTheme('saffron'),slash:DEFAULT_SLASH_REGISTRY,services:svc,...options.props}),options.columns??80,options.rows??24);
+  return {...view,c,svc};
+}

package/src/index.ts

@@ -15,4 +15,5 @@ export * as addons from "./addons/index.js";
 export * as channels from "./channels/index.js";
 export * as runtimeBridge from "./runtime-bridge/index.js";
 export * as insight from "./insight/index.js";
+export * as reviewAgent from "./review-agent/index.js";
 export { VERSION } from "./workspace/index.js";

package/src/integrations/sarvam/config.ts

@@ -12,20 +12,22 @@
  * prefer env / CLI to avoid committing secrets.
  */
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import type { SarvamHostConfig } from "./types.js";
+import { atomicWritePrivateFileSync, readPrivateFileSync } from "../../security/private-state.js";
 
 const ENV_KEY = "SARVAM_API_KEY";
 const ENV_DISABLE = "SARVAM_DISABLED";
 const ENV_BASE_URL = "SARVAM_API_BASE_URL";
 const ENV_BASE_PATH = "SARVAM_MCP_BASE_PATH";
 
-function readJsonFile(path: string): Record<string, unknown> | undefined {
+function readJsonFile(path: string, sensitive = false): Record<string, unknown> | undefined {
   try {
-    if (!existsSync(path)) return undefined;
-    const raw = readFileSync(path, "utf8");
+    if (!sensitive && !existsSync(path)) return undefined;
+    const raw = sensitive ? readPrivateFileSync(path) : readFileSync(path, "utf8");
+    if (raw === null) return undefined;
     const parsed = JSON.parse(raw) as unknown;
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       return undefined;
@@ -36,11 +38,11 @@ function readJsonFile(path: string): Record<string, unknown> | undefined {
   }
 }
 
-function configFromRecord(rec: Record<string, unknown> | undefined): SarvamHostConfig | undefined {
+function configFromRecord(rec: Record<string, unknown> | undefined, includeApiKey = true): SarvamHostConfig | undefined {
   if (!rec) return undefined;
   const enabled = rec.enabled === false ? false : true;
   const id = typeof rec.id === "string" && rec.id.trim() ? rec.id.trim() : "sarvam";
-  const apiKey = typeof rec.apiKey === "string" ? rec.apiKey.trim() : undefined;
+  const apiKey = includeApiKey && typeof rec.apiKey === "string" ? rec.apiKey.trim() : undefined;
   const baseUrl = typeof rec.baseUrl === "string" ? rec.baseUrl.trim() : undefined;
   const basePath = typeof rec.basePath === "string" ? rec.basePath.trim() : undefined;
   const command = typeof rec.command === "string" ? rec.command.trim() : undefined;
@@ -73,9 +75,9 @@ export function saveSarvamConfig(
   config: SarvamHostConfig,
   where: "profile" | "project" = "profile",
   cwd = process.cwd(),
+  home = homedir(),
 ): string {
-  const path = where === "project" ? projectSarvamPath(cwd) : profileSarvamPath();
-  mkdirSync(dirname(path), { recursive: true });
+  const path = where === "project" ? projectSarvamPath(cwd) : profileSarvamPath(home);
   const body: Record<string, unknown> = {
     id: config.id ?? "sarvam",
     enabled: config.enabled !== false,
@@ -84,8 +86,8 @@ export function saveSarvamConfig(
   if (config.baseUrl) body.baseUrl = config.baseUrl;
   if (config.command) body.command = config.command;
   // Only persist key if caller intentionally set it (e.g. interactive connect with key arg).
-  if (config.apiKey) body.apiKey = config.apiKey;
-  writeFileSync(path, JSON.stringify(body, null, 2) + "\n", "utf8");
+  if (where === "profile" && config.apiKey) body.apiKey = config.apiKey;
+  atomicWritePrivateFileSync(path, JSON.stringify(body, null, 2) + "\n");
   return path;
 }
 
@@ -118,9 +120,9 @@ export function resolveSarvamConfig(opts: ResolveSarvamOptions = {}): SarvamHost
 
   const fromArgKey = opts.apiKey?.trim();
   const fromEnvKey = env[ENV_KEY]?.trim();
-  const fromProject = configFromRecord(readJsonFile(projectSarvamPath(cwd)));
+  const fromProject = configFromRecord(readJsonFile(projectSarvamPath(cwd)), false);
   const fromProfile = configFromRecord(
-    readJsonFile(profileSarvamPath(opts.home ?? homedir())),
+    readJsonFile(profileSarvamPath(opts.home ?? homedir()), true),
   );
 
   const fileBase = fromProject ?? fromProfile;

package/src/kit/external-editor.ts

@@ -9,7 +9,13 @@ import { join } from "node:path";
 
 const FALLBACK_EDITOR = "vi";
 
+export interface TerminalHandoff {
+  stdin: { isRaw?: boolean; setRawMode?: (enabled: boolean) => unknown };
+  stdout: { isTTY?: boolean; write: (text: string) => unknown };
+}
+
 export interface ExternalEditorOptions {
+  readonly terminal?: TerminalHandoff;
   readonly env?: NodeJS.ProcessEnv;
   readonly dir?: string;
 }
@@ -33,7 +39,17 @@ export function openInExternalEditor(
   const [editor, ...editorArgs] = resolveEditor(env);
   try {
     writeFileSync(path, buffer, "utf8");
-    const result = spawnSync(editor, [...editorArgs, path], { stdio: "inherit" });
+    const terminal = options.terminal ?? {stdin:process.stdin,stdout:process.stdout};
+    const wasRaw = terminal.stdin.isRaw === true;
+    let result: ReturnType<typeof spawnSync>;
+    try {
+      terminal.stdin.setRawMode?.(false);
+      if (terminal.stdout.isTTY) terminal.stdout.write("\x1b[?1049h\x1b[?25h");
+      result = spawnSync(editor, [...editorArgs, path], { stdio: "inherit" });
+    } finally {
+      if (terminal.stdout.isTTY) terminal.stdout.write("\x1b[?1049l\x1b[?25l");
+      terminal.stdin.setRawMode?.(wasRaw);
+    }
     if (result.error || result.status !== 0) return null;
     return readFileSync(path, "utf8").replace(/\n$/, "");
   } catch {

package/src/kit/run-shell.ts

@@ -0,0 +1,31 @@
+import { spawn } from 'node:child_process';
+
+/** Execute an explicitly requested shell command with bounded output and cancellation. */
+export function runShell(command: string, cwd: string, signal?: AbortSignal): Promise<{output:string;exitCode:number}> {
+  if (signal?.aborted) return Promise.resolve({output:'Command cancelled.',exitCode:130});
+  return new Promise(resolve => {
+    let output='', truncated=false, settled=false;
+    let forceKill:ReturnType<typeof setTimeout> | undefined;
+    const child=spawn(command,{cwd,shell:true,detached:process.platform!=='win32'});
+    const capture=(chunk:Buffer|string)=>{
+      output+=String(chunk);
+      if (output.length>1024*1024) {output=output.slice(-1024*1024);truncated=true;}
+    };
+    const kill=(signalName:NodeJS.Signals)=>{
+      try { if (process.platform!=='win32' && child.pid) process.kill(-child.pid,signalName); else child.kill(signalName); }
+      catch { try { child.kill(signalName); } catch { /* already exited */ } }
+    };
+    const abort=()=>{kill('SIGTERM');forceKill=setTimeout(()=>kill('SIGKILL'),1000);forceKill.unref();};
+    const finish=(exitCode:number)=>{
+      if (settled) return;settled=true;
+      signal?.removeEventListener('abort',abort);
+      if (forceKill) clearTimeout(forceKill);
+      resolve({output:(truncated?'[older output truncated]\n':'')+output,exitCode:signal?.aborted?130:exitCode});
+    };
+    child.stdout?.on('data',capture);child.stderr?.on('data',capture);
+    child.once('error',error=>{capture(error.message);finish(1)});
+    child.once('close',code=>finish(code??1));
+    signal?.addEventListener('abort',abort,{once:true});
+    if (signal?.aborted) abort();
+  });
+}

package/src/launch/catalog.ts

@@ -3,6 +3,7 @@
  */
 import { ModelRegistry, type KnownProvider, type Model } from "indusagi/ai";
 import type { CatalogFilter } from "./contract.js";
+import { applyCodingAgentModelOverlay } from "../models.js";
 
 export interface CatalogIo {
   print(line: string): void;
@@ -22,10 +23,11 @@ export interface CatalogModelSource {
 }
 
 export function registrySource(registry: ModelRegistry = new ModelRegistry()): CatalogModelSource {
+  const overlaid = applyCodingAgentModelOverlay(registry);
   return {
-    providers: (): readonly (KnownProvider | string)[] => registry.getProviders(),
+    providers: (): readonly (KnownProvider | string)[] => overlaid.getProviders(),
     models: (provider: string): readonly Model<Model<string>["api"]>[] =>
-      registry.getModels(provider),
+      overlaid.getModels(provider),
   };
 }
 

package/src/launch/contract.ts

@@ -33,6 +33,7 @@ export const THINKING_EFFORTS = [
   "medium",
   "high",
   "xhigh",
+  "max",
 ] as const;
 
 export type ThinkingEffort = (typeof THINKING_EFFORTS)[number];

package/src/launch/invocation/flags.ts

@@ -20,7 +20,7 @@ export const FLAG_GROUPS: readonly { readonly id: FlagGroup; readonly title: str
   { id: "meta", title: "Meta" },
 ];
 
-const THINKING_CHOICES = ["off", "minimal", "low", "medium", "high", "xhigh"];
+const THINKING_CHOICES = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 
 export const FLAG_SPECS: readonly GroupedFlagSpec[] = [
   /* ---- Output ---------------------------------------------------------- */
@@ -110,6 +110,18 @@ export const FLAG_SPECS: readonly GroupedFlagSpec[] = [
     group: "context",
     describe: "Continue the most recent session in this directory.",
   },
+  {
+    name: "--trust-project-addons",
+    kind: "boolean",
+    group: "context",
+    describe: "Trust executable project addons for the canonical workspace and their current content digest.",
+  },
+  {
+    name: "--allow-context-import",
+    kind: "list",
+    group: "context",
+    describe: "Explicitly approve an exact external context file (comma-separated or repeated). Secret-like files remain blocked.",
+  },
   /* ---- Tools ----------------------------------------------------------- */
   {
     name: "--tools",

package/src/launch/invocation/read.ts

@@ -9,6 +9,7 @@ import {
   isToolName,
 } from "../contract.js";
 import { FLAG_SPECS, type GroupedFlagSpec } from "./flags.js";
+import { isReasoningEffortSupported } from "../../models.js";
 
 interface ParseState {
   flags: Record<string, FlagValue>;
@@ -159,9 +160,9 @@ function deriveMode(flags: Record<string, FlagValue>): Invocation["mode"] {
   return "text";
 }
 
-function resolveThinking(flags: Record<string, FlagValue>): Invocation["thinking"] {
+function resolveThinking(flags: Record<string, FlagValue>, modelId: string | undefined): Invocation["thinking"] {
   const raw = readString(flags, "thinking");
-  return raw !== undefined && isThinkingEffort(raw) ? raw : undefined;
+  return raw !== undefined && isThinkingEffort(raw) && isReasoningEffortSupported(modelId, raw) ? raw : undefined;
 }
 
 function resolveTools(flags: Record<string, FlagValue>): Invocation["tools"] {
@@ -215,7 +216,7 @@ export function readInvocation(argv: readonly string[]): Invocation {
   const cwd = readString(flags, "cwd");
   const system = readString(flags, "system");
   const appendSystem = readString(flags, "append-system");
-  const thinking = resolveThinking(flags);
+  const thinking = resolveThinking(flags, model);
   const tools = resolveTools(flags);
   return {
     mode,

package/src/launch/login.ts

@@ -6,6 +6,8 @@
  * model turns through the server gateway.
  */
 import { createInterface } from "node:readline/promises";
+import { setTimeout as delay } from "node:timers/promises";
+import type { ServerTokenInput } from "../boot/server-token.js";
 import chalk from "chalk";
 import type { OAuthLoginCallbacks } from "indusagi/ai";
 import type { BootContext } from "../boot/contract.js";
@@ -37,11 +39,15 @@ function err(line: string): void {
   process.stderr.write(`${line}\n`);
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function sleep(ms: number, signal?: AbortSignal): Promise<void> {
+  return delay(ms, undefined, {signal});
 }
 
 interface DeviceCodeResponse {
+  access_token?: string;
+  refresh_token?: string;
+  token_type?: string;
+  scope?: string;
   device_code?: string;
   user_code?: string;
   verification_uri?: string;
@@ -56,6 +62,7 @@ interface DeviceCodeResponse {
 async function postJson(
   url: string,
   body: Record<string, unknown>,
+  signal?: AbortSignal,
 ): Promise<{ status: number; data: DeviceCodeResponse }> {
   const res = await fetch(url, {
     method: "POST",
@@ -65,6 +72,7 @@ async function postJson(
       "user-agent": USER_AGENT,
     },
     body: JSON.stringify(body),
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(30000)]) : AbortSignal.timeout(30000),
   });
   const data = (await res.json().catch(() => ({}))) as DeviceCodeResponse;
   return { status: res.status, data };
@@ -112,11 +120,12 @@ async function confirm(prompt: string, defaultValue: boolean): Promise<boolean>
 async function requestDeviceCode(
   serverUrl: string,
   clientId: string,
+  signal?: AbortSignal,
 ): Promise<DeviceCodeResponse> {
   const { status, data } = await postJson(`${serverUrl}/api/auth/device/code`, {
     client_id: clientId,
     scope: DEVICE_SCOPE,
-  });
+  }, signal);
   if (status >= 400 || typeof data.device_code !== "string") {
     throw new LoginError(
       `Authorization request failed: ${data.error_description ?? data.error ?? data.message ?? `HTTP ${status}`}`,
@@ -129,18 +138,19 @@ async function pollForToken(
   serverUrl: string,
   clientId: string,
   device: DeviceCodeResponse,
-): Promise<DeviceCodeResponse> {
+  signal?: AbortSignal,
+): Promise<ServerTokenInput> {
   let intervalMs = Math.max(1, device.interval ?? 5) * 1000;
   const deadline = Date.now() + (device.expires_in ?? 0) * 1000;
   while (Date.now() < deadline) {
-    await sleep(intervalMs);
+    await sleep(intervalMs, signal);
     const { data } = await postJson(`${serverUrl}/api/auth/device/token`, {
       grant_type: DEVICE_GRANT_TYPE,
       device_code: device.device_code,
       client_id: clientId,
-    });
+    }, signal);
     if (typeof data.access_token === "string") {
-      return data;
+      return {...data, access_token:data.access_token};
     }
     const code = data.error;
     switch (code) {
@@ -172,14 +182,17 @@ export async function runServerTierLogin(
   serverUrl: string = INDUS_SERVER_URL,
   clientId: string = INDUS_CLIENT_ID,
 ): Promise<void> {
-  const device = await requestDeviceCode(serverUrl, clientId);
+  callbacks.signal?.throwIfAborted();
+  const device = await requestDeviceCode(serverUrl, clientId, callbacks.signal);
+  callbacks.signal?.throwIfAborted();
   callbacks.onAuth({
     url: device.verification_uri_complete ?? device.verification_uri ?? "",
     instructions: `Enter code ${device.user_code} to authorize this device.`,
   });
   callbacks.onProgress?.("Waiting for authorization...");
-  const token = await pollForToken(serverUrl, clientId, device);
-  await storeServerToken(token);
+  const token = await pollForToken(serverUrl, clientId, device, callbacks.signal);
+  callbacks.signal?.throwIfAborted();
+  if (!await storeServerToken(token)) throw new LoginError("Could not save the server token.");
   callbacks.onProgress?.("Server sign-in complete.");
 }
 

package/src/launch/oauth.ts

@@ -195,8 +195,11 @@ export async function startOAuthLogin(
       envVar !== undefined ? `set ${envVar} and restart` : "configure its OAuth client id";
     throw new Error(`Browser sign-in for "${providerId}" is not configured: ${hint}.`);
   }
+  callbacks.signal?.throwIfAborted();
   const credentials = await provider.login(callbacks);
+  callbacks.signal?.throwIfAborted();
   const existing = await vault.listAccounts(providerId);
+  callbacks.signal?.throwIfAborted();
   const madeDefault = existing.length === 0;
   await vault.putOAuth(providerId, account, credentials, madeDefault);
   return { provider: providerId, account, madeDefault };