indusagi-coding-agent 0.2.12 → 0.2.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "indusagi-coding-agent",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Indusagi coding agent — a terminal-first AI coding agent, built from scratch on the indusagi framework.",
   "author": "Varun Israni",
   "license": "AGPL-3.0",
@@ -24,7 +24,8 @@
   "main": "./dist/index.js",
   "bin": {
     "indus": "dist/entry.js",
-    "indusagi": "dist/entry.js"
+    "indusagi": "dist/entry.js",
+    "indusagi-review": "dist/review-server.js"
   },
   "exports": {
     ".": {
@@ -33,35 +34,46 @@
     "./guardrails": {
       "import": "./dist/guardrails.js"
     },
+    "./review-agent": {
+      "import": "./dist/review-agent.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [
     "dist",
     "src",
+    "supabase",
+    ".env.review.example",
     "CHANGELOG.md",
     "CREDITS.md",
     "NOTICE",
-    "README.md"
+    "README.md",
+    "REVIEW_AGENT.md"
   ],
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "build": "node build.mjs",
     "test": "vitest --run",
     "test:watch": "vitest",
+    "test:tui": "vitest run src/console src/conductor/tui-controls.test.ts src/kit/external-editor.test.ts src/launch/login-cancellation.test.ts",
+    "test:tui:loop": "node scripts/test-tui-loop.mjs",
+    "test:tui:pty": "python3 scripts/test-tui-pty.py",
     "prepublishOnly": "npm test && npm run build",
     "start": "node dist/entry.js",
-    "start:help": "node dist/entry.js --help"
+    "start:help": "node dist/entry.js --help",
+    "review:server": "node dist/review-server.js"
   },
   "dependencies": {
     "@sinclair/typebox": "^0.34.49",
     "chalk": "^5.6.2",
     "highlight.js": "^11.11.1",
-    "indusagi": "^0.13.10",
+    "indusagi": "0.13.12",
     "ink": "^5.2.1",
     "jiti": "^2.7.0",
     "marked": "^18.0.4",
     "react": "^18.3.1",
     "strip-ansi": "^7.2.0",
+    "string-width": "^7.2.0",
     "ulid": "^3.0.2",
     "zod": "^4.4.3"
   },
@@ -70,6 +82,11 @@
     "@types/react": "^18.3.12",
     "esbuild": "^0.28.0",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.11"
+  },
+  "overrides": {
+    "fast-uri": "3.1.6",
+    "hono": "4.13.5",
+    "qs": "6.16.0"
   }
-}
+}

package/src/boot/auth-vault.ts

@@ -20,13 +20,12 @@
  * launch wiring needs. When the concrete multi-account vault arrives it replaces
  * this adapter at the one call site in {@link "./boot"}.
  */
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
 import {
   ensureFreshOAuthCredentials,
   getOAuthProvider,
 } from "indusagi/ai";
 import type { AuthVault } from "../launch.js";
+import { atomicWritePrivateFileSync, readPrivateFileSync } from "../security/private-state.js";
 
 interface OAuthRecord {
   access: string;
@@ -68,8 +67,9 @@ function normaliseRecord(value: unknown): NormalisedRecord | undefined {
 }
 
 function readAuthFile(filePath: string): Record<string, Record<string, NormalisedRecord>> {
+  const text = readPrivateFileSync(filePath);
+  if (text === null) return {};
   try {
-    const text = readFileSync(filePath, "utf8");
     const parsed = JSON.parse(text);
     if (parsed === null || typeof parsed !== "object") return {};
     const file: Record<string, Record<string, NormalisedRecord>> = {};
@@ -92,8 +92,7 @@ function writeAuthFile(
   filePath: string,
   data: Record<string, Record<string, NormalisedRecord>>,
 ): void {
-  mkdirSync(dirname(filePath), { recursive: true });
-  writeFileSync(filePath, `${JSON.stringify(data, null, 2)}\n`, { mode: 384 });
+  atomicWritePrivateFileSync(filePath, `${JSON.stringify(data, null, 2)}\n`);
 }
 
 function toCredentials(record: OAuthStoredRecord): OAuthRecord {

package/src/boot/contract.ts

@@ -131,7 +131,7 @@ export interface Invocation {
     readonly cwd?: string;
     /** Named credential account to authenticate with (`--account`). */
     readonly account?: string;
-    /** Reasoning effort (`--thinking`): off / minimal / low / medium / high / xhigh. */
+    /** Reasoning effort (`--thinking`): off / minimal / low / medium / high / xhigh / max (model-dependent). */
     readonly thinking?: string;
     /** Replacement system prompt (`--system`); a path is read as a file, else literal text. */
     readonly system?: string;

package/src/boot/runners/addon-wiring.ts

@@ -35,8 +35,82 @@ import {
   type InterceptorChain,
   createAddonHost,
 } from "../../addons/index.js";
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { atomicWritePrivateFileSync, readPrivateFileSync } from "../../security/private-state.js";
 import type { BootContext } from "../contract.js";
 
+interface AddonTrustRecord {
+  readonly root: string;
+  readonly digest: string;
+  readonly approvedAt: string;
+}
+
+interface AddonTrustStore {
+  readonly version: 1;
+  readonly projects: readonly AddonTrustRecord[];
+}
+
+const TRUST_FILE = "addon-trust.json";
+
+function hashAddonTree(addonsDir: string): string | null {
+  let root: string;
+  try {
+    const rootStat = lstatSync(addonsDir);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) return null;
+    root = realpathSync(addonsDir);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+  const files: string[] = [];
+  const visit = (dir: string): void => {
+    for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const path = join(dir, entry.name);
+      const info = lstatSync(path);
+      if (info.isSymbolicLink()) throw new Error(`Refusing symlink in project addon tree: ${path}`);
+      if (info.isDirectory()) visit(path);
+      else if (info.isFile()) files.push(path);
+      else throw new Error(`Refusing special file in project addon tree: ${path}`);
+    }
+  };
+  visit(root);
+  const hash = createHash("sha256");
+  for (const file of files) {
+    hash.update(relative(root, file));
+    hash.update("\0");
+    hash.update(readFileSync(file));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+function readTrustStore(path: string): AddonTrustStore {
+  const raw = readPrivateFileSync(path);
+  if (raw === null) return { version: 1, projects: [] };
+  try {
+    const parsed = JSON.parse(raw) as Partial<AddonTrustStore>;
+    if (parsed.version !== 1 || !Array.isArray(parsed.projects)) return { version: 1, projects: [] };
+    return {
+      version: 1,
+      projects: parsed.projects.filter((record): record is AddonTrustRecord =>
+        typeof record?.root === "string" &&
+        typeof record?.digest === "string" &&
+        typeof record?.approvedAt === "string"),
+    };
+  } catch {
+    return { version: 1, projects: [] };
+  }
+}
+
+function persistTrust(path: string, root: string, digest: string): void {
+  const store = readTrustStore(path);
+  const projects = store.projects.filter((record) => record.root !== root);
+  projects.push({ root, digest, approvedAt: new Date().toISOString() });
+  atomicWritePrivateFileSync(path, `${JSON.stringify({ version: 1, projects }, null, 2)}\n`);
+}
+
 /**
  * Build and populate the addon host for a run, returning its wired
  * {@link AddonSurfaceBundle}.
@@ -54,10 +128,44 @@ import type { BootContext } from "../contract.js";
  */
 export async function buildAddonHost(ctx: BootContext): Promise<AddonSurfaceBundle> {
   const host = createAddonHost({ handles: {} });
-  host.onFault(() => {
-    // swallow addon load faults so a broken addon cannot sink the session
+  host.onFault((fault) => {
+    process.stderr.write(`Addon ${fault.kind} fault: ${fault.message}\n`);
   });
-  return host.loadAll({ workspace: ctx.invocation.cwd ?? process.cwd() });
+  const workspace = resolve(ctx.invocation.cwd ?? process.cwd());
+  const addonsDir = join(workspace, ".indus", "addons");
+  let canonicalRoot: string;
+  let digest: string | null;
+  try {
+    canonicalRoot = realpathSync(workspace);
+    digest = hashAddonTree(addonsDir);
+  } catch (error) {
+    process.stderr.write(`Project addons blocked: ${error instanceof Error ? error.message : String(error)}\n`);
+    return host.loadAll({ explicitPaths: [] });
+  }
+  if (digest === null) return host.loadAll({ explicitPaths: [] });
+
+  const trustPath = join(ctx.workspace.profileDir, TRUST_FILE);
+  const approvedNow = ctx.invocation.flags["trust-project-addons"] === true;
+  let trusted = false;
+  try {
+    const store = readTrustStore(trustPath);
+    trusted = store.projects.some((record) => record.root === canonicalRoot && record.digest === digest);
+    if (!trusted && approvedNow) {
+      persistTrust(trustPath, canonicalRoot, digest);
+      trusted = true;
+    }
+  } catch (error) {
+    process.stderr.write(`Project addons blocked: ${error instanceof Error ? error.message : String(error)}\n`);
+    return host.loadAll({ explicitPaths: [] });
+  }
+
+  if (!trusted) {
+    process.stderr.write(
+      `Project addons are disabled until explicitly trusted for this exact content. Re-run with --trust-project-addons to approve ${canonicalRoot}.\n`,
+    );
+    return host.loadAll({ explicitPaths: [] });
+  }
+  return host.loadAll({ workspace: canonicalRoot });
 }
 
 /**

package/src/boot/runners/benchmark-integrity.ts

@@ -0,0 +1,107 @@
+import { appendFileSync } from "node:fs";
+import path from "node:path";
+import type { AgentTool } from "../../addons/index.js";
+
+type BenchmarkEnv = Readonly<Record<string, string | undefined>>;
+
+const GUARDED_TOOLS = new Set(["read", "write", "edit", "grep", "find", "ls", "bash"]);
+const PATH_KEYS = new Set(["path", "file", "file_path", "directory", "dir", "cwd", "search_path"]);
+const FORBIDDEN_ABSOLUTE = [
+  "/tests",
+  "/solution",
+  "/solutions",
+  "/reference",
+  "/reference_solution",
+  "/reference-solutions",
+  "/reward.txt",
+  "/rewards",
+  "/grader",
+  "/verifier",
+];
+const FORBIDDEN_BASENAMES = new Set([
+  "solution.sh",
+  "solve.sh",
+  "reward.txt",
+  "expected_answer.txt",
+  "expected_output.txt",
+]);
+
+function normalizeCandidate(value: string, cwd: string): string {
+  return path.resolve(cwd, value);
+}
+
+function forbiddenPath(value: string, cwd: string): boolean {
+  const resolved = normalizeCandidate(value, cwd);
+  const base = path.basename(resolved).toLowerCase();
+  if (FORBIDDEN_BASENAMES.has(base)) return true;
+  return FORBIDDEN_ABSOLUTE.some((prefix) => resolved === prefix || resolved.startsWith(`${prefix}/`));
+}
+
+function pathValues(args: unknown): string[] {
+  if (args === null || typeof args !== "object" || Array.isArray(args)) return [];
+  const values: string[] = [];
+  for (const [key, value] of Object.entries(args as Record<string, unknown>)) {
+    if (PATH_KEYS.has(key) && typeof value === "string") values.push(value);
+  }
+  return values;
+}
+
+function forbiddenShell(command: string, cwd: string): boolean {
+  const lower = command.toLowerCase();
+  if ([...FORBIDDEN_BASENAMES].some((name) => lower.includes(name))) return true;
+  if (FORBIDDEN_ABSOLUTE.some((prefix) => new RegExp(`(^|[\\s'\"=])${prefix.replaceAll("/", "\\/")}(?:[/\\s'\";|&]|$)`, "i").test(command))) return true;
+  if (/(^|[\s'"=])\.\.\/(?:tests|solutions?|reference(?:[-_]solutions?)?|grader|verifier)(?:[/\s'";|&]|$)/i.test(command)) return true;
+  if (/\b(?:find|ls|grep|rg)\s+(?:-[^\s]+\s+)*\/(?:\s|$)/i.test(command)) return true;
+  const retrievesOnline = /\b(?:curl|wget|git\s+clone|gh\s+repo\s+clone)\b/i.test(command);
+  const benchmarkMaterial = /terminal[-_ ]bench|reference[-_ ]solution|solution\.sh|solve\.sh|benchmark[-_ ]solution/i.test(command);
+  if (retrievesOnline && benchmarkMaterial) return true;
+  return false;
+}
+
+function denialReason(tool: string, args: unknown, cwd: string): string | undefined {
+  if (tool === "bash") {
+    const command = typeof (args as { command?: unknown } | null)?.command === "string"
+      ? (args as { command: string }).command
+      : "";
+    if (forbiddenShell(command, cwd)) return "Terminal-Bench integrity guard blocked benchmark-owned or solution material.";
+    return undefined;
+  }
+  if (pathValues(args).some((candidate) => forbiddenPath(candidate, cwd))) {
+    return "Terminal-Bench integrity guard blocked benchmark-owned or solution material.";
+  }
+  return undefined;
+}
+
+function recordDenial(tool: string, callId: string, reason: string, env: BenchmarkEnv): void {
+  const auditPath = env.INDUSAGI_BENCHMARK_AUDIT_LOG ?? "/logs/agent/integrity-denials.jsonl";
+  try {
+    appendFileSync(auditPath, `${JSON.stringify({ type: "integrity_denial", tool, call_id: callId, reason })}\n`, { encoding: "utf8" });
+  } catch {
+    // Blocking must remain fail-closed even if the optional audit sink is unavailable.
+  }
+}
+
+function wrapOne(tool: AgentTool, cwd: string, env: BenchmarkEnv): AgentTool {
+  const execute = tool.execute.bind(tool);
+  return {
+    ...tool,
+    async execute(callId: string, args: unknown, signal?: AbortSignal, onUpdate?: unknown) {
+      const reason = denialReason(tool.name, args, cwd);
+      if (reason !== undefined) {
+        recordDenial(tool.name, callId, reason, env);
+        return {
+          content: [{ type: "text" as const, text: reason }],
+          details: undefined,
+          isError: true,
+        };
+      }
+      return execute(callId, args as never, signal as never, onUpdate as never);
+    },
+  };
+}
+
+/** Apply fail-closed Terminal-Bench integrity checks at every enabled tool boundary. */
+export function wrapToolsForTerminalBench(tools: AgentTool[], cwd: string, env: BenchmarkEnv = process.env): AgentTool[] {
+  if (env.INDUSAGI_BENCHMARK_PROFILE !== "terminal-bench") return tools;
+  return tools.map((tool) => GUARDED_TOOLS.has(tool.name) ? wrapOne(tool, cwd, env) : tool);
+}

package/src/boot/runners/repl-runner.ts

@@ -14,6 +14,7 @@ import { SessionLibrary } from "../../sessions/library.js";
 import { PreferenceStore } from "../../settings/manager.js";
 import { sessionScopeDir } from "./session.js";
 import { createAuthVault } from "../auth-vault.js";
+import type { SessionConductor } from "../../conductor/contract.js";
 import type { BootContext, Runner } from "../contract.js";
 import { buildSessionConductor } from "./session.js";
 import { resolveServerGatewayUrls } from "./server-mode.js";
@@ -28,7 +29,7 @@ const EXIT_OK = 0;
  * wired here from the boot-layer pieces so the conductor and the UI share one
  * credential store and one gateway-base-url mapping.
  */
-export function buildOverlayServices(ctx: BootContext, conductor: { updateGatewayBaseUrls(map: Record<string, string>): void }) {
+export function buildOverlayServices(ctx: BootContext, conductor: SessionConductor) {
   const cwd = ctx.invocation.cwd ?? process.cwd();
   const vault = createAuthVault(ctx.workspace.authPath);
   return {

package/src/boot/runners/session.ts

@@ -9,7 +9,7 @@
  * is constructed until the first turn runs.
  */
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { isAbsolute, join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { createMCPAgentToolFactory, loadMCPConfig, MCPClientPool } from "indusagi/mcp";
 import {
@@ -58,8 +58,12 @@ import { createAuthVault } from "../auth-vault.js";
 import { TOKEN_FILE, hasValidServerToken, getServerToken } from "../server-token.js";
 import { resolveServerMode, resolveServerGatewayUrls, serverTierProviders } from "./server-mode.js";
 import { DiskMemoryStore, memoryDirFor, loadMemoryDoc } from "./memdir.js";
+import { isReasoningEffortSupported } from "../../models.js";
+import type { CodingAgentThinkingLevel } from "../../conductor/contract.js";
 import { buildAddonHost, wrapToolsWithAddons, concatAddonTools } from "./addon-wiring.js";
+import { wrapToolsForTerminalBench } from "./benchmark-integrity.js";
 import type { BootContext, Invocation } from "../contract.js";
+import { readPrivateFileSync } from "../../security/private-state.js";
 
 interface AuthFileData {
   [provider: string]: unknown;
@@ -68,8 +72,9 @@ interface AuthFileData {
 function authenticatedProviders(ctx: BootContext): string[] {
   try {
     const path = ctx.workspace.authPath;
-    if (!existsSync(path)) return [];
-    const data = JSON.parse(readFileSync(path, "utf8")) as AuthFileData;
+    const raw = readPrivateFileSync(path);
+    if (raw === null) return [];
+    const data = JSON.parse(raw) as AuthFileData;
     return Object.keys(data).filter((id) => {
       const accounts = data[id];
       return id.length > 0 && accounts !== null && typeof accounts === "object" && Object.keys(accounts as object).length > 0;
@@ -219,10 +224,12 @@ function buildKeyResolver(
   };
 }
 
-const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh"]);
+const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
 
-function resolveThinkingLevel(raw: string | undefined): string | undefined {
-  return raw !== undefined && THINKING_LEVELS.has(raw) ? raw : undefined;
+export function resolveThinkingLevel(raw: string | undefined, modelId?: string): CodingAgentThinkingLevel | undefined {
+  return raw !== undefined && THINKING_LEVELS.has(raw) && isReasoningEffortSupported(modelId, raw)
+    ? raw as CodingAgentThinkingLevel
+    : undefined;
 }
 
 function resolveText(value: string): string {
@@ -299,8 +306,11 @@ export function composeSystem(
   skills: readonly SkillCard[] = [],
   memoryDoc?: ContextDoc,
 ): string {
+  const approvedExternalPaths = Array.isArray(inv.flags["allow-context-import"])
+    ? inv.flags["allow-context-import"].filter((path): path is string => typeof path === "string").map((path) => isAbsolute(path) ? path : resolve(cwd, path))
+    : [];
   const contextDocs = [
-    ...gatherContextDocs(cwd, homedir()),
+    ...gatherContextDocs(cwd, homedir(), { approvedExternalPaths }),
     ...memoryDoc ? [memoryDoc] : [],
   ];
   let base = inv.system !== undefined ? resolveText(inv.system) : composeBriefing({ tools, contextDocs, skills });
@@ -427,13 +437,14 @@ function lastUserTurnStart(messages: Array<{ role: string }>): number {
 
 const condenseTranscript = async (
   messages: Array<{ role: string }>,
-  opts?: { model?: unknown; apiKey?: string; signal?: AbortSignal; force?: boolean },
+  opts?: { model?: unknown; apiKey?: string; signal?: AbortSignal; force?: boolean; instructions?: string },
 ): Promise<Array<{ role: string }>> => {
   const model = opts?.model;
   const deps = model ? {
     model,
     ...opts?.apiKey !== undefined ? { apiKey: opts.apiKey } : {},
     ...opts?.signal !== undefined ? { signal: opts.signal } : {},
+    ...opts?.instructions !== undefined ? { instructions: opts.instructions } : {},
   } : {};
   const cleared = clearStaleToolResults(messages as never) as Array<{ role: string }>;
   if (opts?.force) {
@@ -471,12 +482,12 @@ function gatherPermissionRules(store: PreferenceStore): PermissionRule[] {
   return rules;
 }
 
-function resolveDefaultMode(store: PreferenceStore): PermissionMode {
+export function resolveDefaultMode(store: PreferenceStore): PermissionMode {
   for (const tier of [store.projectOverrides(), store.globalDefaults()]) {
     const mode = tier.permissions?.defaultMode;
     if (mode !== undefined && isPermissionMode(mode)) return mode;
   }
-  return "default";
+  return "acceptEdits";
 }
 
 function readOnlyNamesFromDeck(tools: AgentTool[]): Set<string> {
@@ -594,10 +605,13 @@ export async function buildSessionConductor(ctx: BootContext) {
       basePath: typeof inv.sarvamBasePath === "string" ? inv.sarvamBasePath : typeof inv.flags?.["sarvam-base-path"] === "string" ? inv.flags["sarvam-base-path"] : undefined,
     })),
   ];
-  const tools = wrapToolsWithAddons(concatAddonTools(deck, addons), addons);
+  const tools = wrapToolsForTerminalBench(
+    wrapToolsWithAddons(concatAddonTools(deck, addons), addons),
+    cwd,
+  );
   const skills = gatherModelSkills(cwd);
   const system = composeSystem(tools, inv, cwd, skills, memoryDoc);
-  const thinking = resolveThinkingLevel(inv.thinking);
+  const thinking = resolveThinkingLevel(inv.thinking, modelId);
   const fallbackModelId = inv.fallbackModelId;
   const planReachable = inv.mode === "repl";
   const canUseTool = buildPermissionGate(permissionRules, permissionMode, tools, planReachable);

package/src/boot/server-token.ts

@@ -18,9 +18,10 @@
  * ISO timestamp, on disk) conversion, which lets {@link isServerTokenExpired}
  * decide freshness without re-deriving the clock offset.
  */
-import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { unlink } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { atomicWritePrivateFileSync, readPrivateFileSync } from "../security/private-state.js";
 
 /** Root of the indus-server. Used to build the gateway base URL and the device-login endpoints. Any trailing slash(es) are stripped so callers can append paths with a single separator. */
 export const INDUS_SERVER_URL: string = process.env.INDUS_SERVER_URL?.replace(/\/+$/, "") ?? "https://indus-server.vercel.app";
@@ -29,6 +30,16 @@ export const CONFIG_DIR: string = path.join(os.homedir(), ".indusagi", "agent");
 /** Absolute path of the JSON file the session token is persisted to. */
 export const TOKEN_FILE: string = path.join(CONFIG_DIR, "server-token.json");
 
+export interface ServerTokenPaths {
+  readonly configDir?: string;
+  readonly tokenFile?: string;
+}
+
+function resolveTokenPaths(paths: ServerTokenPaths = {}): { configDir: string; tokenFile: string } {
+  const configDir = paths.configDir ?? CONFIG_DIR;
+  return { configDir, tokenFile: paths.tokenFile ?? path.join(configDir, "server-token.json") };
+}
+
 /** On-disk token shape (what {@link storeServerToken} writes / {@link getServerToken} returns). */
 export interface TokenData {
   /** The better-auth session token, used as the gateway api key in server mode. */
@@ -65,9 +76,10 @@ export interface ServerTokenInput {
  *
  * @returns the parsed {@link TokenData}, or `null` when nothing is stored.
  */
-export async function getServerToken(): Promise<TokenData | null> {
+export async function getServerToken(paths: ServerTokenPaths = {}): Promise<TokenData | null> {
   try {
-    const data = await readFile(TOKEN_FILE, "utf8");
+    const data = readPrivateFileSync(resolveTokenPaths(paths).tokenFile);
+    if (data === null) return null;
     return JSON.parse(data);
   } catch {
     return null;
@@ -83,9 +95,9 @@ export async function getServerToken(): Promise<TokenData | null> {
  * @param token the device-flow token payload.
  * @returns `true` on success, `false` if the write failed.
  */
-export async function storeServerToken(token: ServerTokenInput): Promise<boolean> {
+export async function storeServerToken(token: ServerTokenInput, paths: ServerTokenPaths = {}): Promise<boolean> {
   try {
-    await mkdir(CONFIG_DIR, { recursive: true });
+    const { tokenFile } = resolveTokenPaths(paths);
     const tokenData = {
       access_token: token.access_token,
       refresh_token: token.refresh_token,
@@ -94,10 +106,7 @@ export async function storeServerToken(token: ServerTokenInput): Promise<boolean
       expires_at: token.expires_in !== undefined ? new Date(Date.now() + token.expires_in * 1000).toISOString() : null,
       created_at: new Date().toISOString(),
     };
-    await writeFile(TOKEN_FILE, `${JSON.stringify(tokenData, null, 2)}\n`, {
-      encoding: "utf8",
-      mode: 384,
-    });
+    atomicWritePrivateFileSync(tokenFile, `${JSON.stringify(tokenData, null, 2)}\n`);
     return true;
   } catch (error) {
     console.error("Failed to store server token:", (error as Error).message);
@@ -111,9 +120,9 @@ export async function storeServerToken(token: ServerTokenInput): Promise<boolean
  *
  * @returns `true` when a file was deleted, `false` when none existed / removal failed.
  */
-export async function clearServerToken(): Promise<boolean> {
+export async function clearServerToken(paths: ServerTokenPaths = {}): Promise<boolean> {
   try {
-    await unlink(TOKEN_FILE);
+    await unlink(resolveTokenPaths(paths).tokenFile);
     return true;
   } catch {
     return false;

package/src/boot/stages.ts

@@ -29,6 +29,7 @@ import { tokenizeInvocation } from "./invocation.js";
 import { applyUpgrades } from "./upgrade/apply.js";
 import { ensureDirs } from "../workspace/locator.js";
 import type { BootContext, Stage } from "./contract.js";
+import { createCodingAgentModelRegistry } from "../models.js";
 
 /**
  * Materialise the resolved workspace directories on disk.
@@ -110,11 +111,7 @@ async function loadDefaultSettings(): Promise<unknown> {
 }
 
 async function loadModelRegistry(): Promise<unknown> {
-  const mod = (await import("indusagi/ai")) as { ModelRegistry?: unknown; modelRegistry?: unknown };
-  if (typeof mod.ModelRegistry === "function") {
-    return new (mod.ModelRegistry as new () => unknown)();
-  }
-  return mod.modelRegistry;
+  return createCodingAgentModelRegistry();
 }
 
 /**
@@ -164,4 +161,4 @@ export async function runStages(initial: BootContext, stages: readonly Stage[] =
   return ctx;
 }
 
-export { locateWorkspace, upgrade, buildInvocation, resolveResources, selectRunnerStage };
+export { locateWorkspace, upgrade, buildInvocation, resolveResources, selectRunnerStage, loadModelRegistry };