indusagi-coding-agent 0.2.2 → 0.2.4

package/dist/types/boot/heap.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Heap headroom guard.
+ *
+ * Node's default old-space cap (~2 GB on 64-bit builds) is too small for heavy
+ * runs — most acutely a burst of parallel sub-agents whose combined transcripts
+ * push the resident heap past the default and abort the whole process with a V8
+ * "JavaScript heap out of memory" fatal (the exact crash this guards against).
+ *
+ * `--max-old-space-size` can only be set at process launch, so before any real
+ * work begins we re-exec the *same* program once with a raised cap, inherit its
+ * stdio (so the interactive TUI runs unchanged in the child), and adopt its exit
+ * code. The re-exec is one level deep: the child carries `INDUS_HEAP_BOOSTED=1`
+ * so it skips the guard and runs the agent directly.
+ *
+ * Controlled by env:
+ *   INDUS_MAX_HEAP_MB   target old-space size in MB (default 4096; 0 disables
+ *                       the guard entirely and runs in-process).
+ *   INDUS_HEAP_BOOSTED  set internally on the child; never set this yourself.
+ *
+ * If the re-exec cannot spawn (a locked-down sandbox, a missing argv[1]) the
+ * guard silently falls back to running in the current, un-boosted process rather
+ * than failing to start.
+ */
+/**
+ * Ensure the process has heap headroom, re-execing once if it does not.
+ *
+ * Returns normally in three cases: the guard is disabled, the cap is already
+ * raised, or the re-exec could not be spawned. Otherwise it does NOT return —
+ * it runs the boosted child to completion and exits with the child's status.
+ */
+export declare function ensureHeapHeadroom(): void;

package/dist/types/boot/runners/delegate-runner.d.ts

@@ -25,7 +25,7 @@
  * The `spawn`/`tools` options are pure test seams — they let a unit test drive
  * the runner with an in-memory fake instead of a real network round-trip.
  */
-import { type AgentMessage } from "../../conductor";
+import { type AgentMessage, type SessionPermissionPolicy } from "../../conductor";
 import { type AgentTool } from "../../capability-deck";
 import type { DelegateRunner } from "../../capability-deck/cards/task-card";
 /**
@@ -43,6 +43,12 @@ export interface DelegateSubAgent {
         messages: readonly AgentMessage[];
         error?: string;
     };
+    /**
+     * Optional event subscription (the real framework `Agent` provides it). The
+     * runner uses it to recompute live token spend as the sub-agent works; a test
+     * fake may omit it, in which case no progress is reported.
+     */
+    subscribe?(listener: () => void): () => void;
 }
 /** Configuration for {@link createDelegateRunner}. */
 export interface DelegateRunnerOptions {
@@ -69,6 +75,26 @@ export interface DelegateRunnerOptions {
      * `task` card — the recursion guard).
      */
     readonly tools?: () => AgentTool[];
+    /**
+     * Resolve the current server-tier gateway routing map (provider -> gateway
+     * base url). Called FRESH on every `run()` — never cached — so a mid-session
+     * `/login` (to "Indus Server"), including one that lands after this runner was
+     * constructed but before a given delegated call, is always picked up. This
+     * mirrors {@link getApiKey}, which is likewise invoked per-request rather than
+     * resolved once at construction.
+     */
+    readonly getGatewayBaseUrls?: () => Promise<Record<string, string>>;
+    /**
+     * The parent session's live permission policy: the SAME mutable rule list the
+     * parent gate reads plus a live getter onto the conductor's current mode. When
+     * present, every spawned sub-agent runs under a RESOLVER-LESS gate built from
+     * it — deny/ask rules, plan-mode enforcement, and the catastrophic-bash
+     * blocklist apply per inner tool call, and a mid-run mode switch (Shift+Tab)
+     * retargets the very next delegated tool call. A sub-agent cannot prompt, so
+     * an `ask` decision deterministically denies with an actionable message.
+     * Absent (a bare test construction), the sub-agent runs ungated as before.
+     */
+    readonly permissionPolicy?: SessionPermissionPolicy;
 }
 /**
  * Build a live {@link DelegateRunner} the host wires into the deck context.

package/dist/types/boot/runners/server-mode.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Boot helper: decide whether a provider runs in **server mode** (Case B).
+ *
+ * A model turn takes one of three paths (see LOGIN_GATEWAY_PLAN.md §1):
+ *   - **A. Local key** — a usable key for the provider is stored in the on-disk
+ *     auth vault (or exported in the environment). The framework calls the
+ *     provider directly; behaviour is unchanged and this module returns
+ *     `{ serverMode: false }`.
+ *   - **B. Server tier** — the provider is gateway-eligible, the user has **no**
+ *     usable local key, and they hold a **valid server token**. The session token
+ *     is vended as the provider "key" and the model is re-routed through the indus
+ *     gateway. This module returns `{ serverMode: true, token }`.
+ *   - **C. Blocked** — no local key and no valid token: `{ serverMode: false }`
+ *     (the resolver then falls through to the framework's own env lookup, which
+ *     surfaces the usual "no API key" guidance pointing at `indus login`).
+ *
+ * The two consumers in {@link file://./session.ts} call this with the SAME
+ * `(ctx, provider, vault)` triple so the key-resolver fallback and the
+ * gateway-base-url computation always agree on whether server mode is active.
+ */
+import type { BootContext } from "../contract";
+import type { AuthVault } from "../../launch/contract";
+/**
+ * The outcome of {@link resolveServerMode}: whether the provider should route
+ * through the gateway this run, and (when so) the session token to hand back as
+ * the provider api key.
+ */
+export interface ServerModeResult {
+    /** `true` => bind the gateway base url and use {@link token} as the key. */
+    serverMode: boolean;
+    /** The session token (`access_token`) to vend as the key, when `serverMode`. */
+    token?: string;
+}
+/**
+ * Whether `provider` may be routed through the indus gateway. Excludes the
+ * non-portable providers (vertex / bedrock / codex) and the deferred opencode
+ * `anthropic-messages` api per the §B.4 caveat.
+ */
+export declare function isGatewayEligibleProvider(provider: string): boolean;
+/** The server-tier provider slugs (for default-model selection / listing). */
+export declare function serverTierProviders(): readonly string[];
+/**
+ * Decide whether `provider` runs in server mode for this session.
+ *
+ * Server mode is active when ALL hold:
+ *   1. {@link isGatewayEligibleProvider}(provider) — excludes vertex/bedrock/codex
+ *      and the deferred opencode `anthropic-messages` api (§B.4);
+ *   2. no EXPLICIT local key — the vault holds no usable key for the provider
+ *      (an ambient env var is intentionally ignored for server-tier providers);
+ *   3. {@link hasValidServerToken}() — a stored, non-expired server token exists.
+ *
+ * Returns `{ serverMode: false }` whenever any condition fails, so the
+ * local-key (Case A) path is preserved byte-for-byte: the resolver then returns
+ * `undefined` and no gateway base url is bound.
+ *
+ * @param _ctx the boot context (reserved for future per-run policy; the vault is
+ *   passed explicitly so callers share one instance)
+ * @param provider the framework provider slug to evaluate
+ * @param vault the on-disk credential vault to probe for a local key
+ */
+export declare function resolveServerMode(_ctx: BootContext, provider: string, vault: AuthVault): Promise<ServerModeResult>;
+/**
+ * Build the per-provider gateway base-url map for THIS session: for every
+ * gateway-eligible provider currently in server mode (no explicit local key +
+ * valid token), map `provider -> ${INDUS_SERVER_URL}/gateway/${provider}`.
+ *
+ * The conductor consults this map at EVERY model bind — including a runtime
+ * `/model` switch — so selecting ANY server-tier model (not just the one the
+ * session launched on) routes through the gateway. Empty when nothing qualifies.
+ */
+export declare function resolveServerGatewayUrls(ctx: BootContext, vault: AuthVault): Promise<Record<string, string>>;

package/dist/types/boot/runners/session.d.ts

@@ -8,9 +8,10 @@
  * {@link ModelMatcher}; the conductor itself is built lazily so no framework agent
  * is constructed until the first turn runs.
  */
-import { type AgentTool, type SessionConductor } from "../../conductor";
+import { type AgentTool, type ApprovalResolver, type CanUseToolFn, type PermissionMode, type PermissionRule, type SessionConductor } from "../../conductor";
 import { type MemoryStore } from "../../capability-deck";
 import { type DelegateRunner } from "../../capability-deck/cards/task-card";
+import type { WorkflowAgentRunner } from "../../workflow-engine";
 import { type CheckpointStore } from "./checkpoint";
 import { type ContextDoc, type SkillCard } from "../../briefing";
 import type { BootContext, Invocation } from "../contract";
@@ -33,23 +34,7 @@ export declare function resolveModelId(ctx: BootContext): string;
  * bad/unreadable skills dir never sinks the session.
  */
 export declare function gatherModelSkills(cwd: string): SkillCard[];
-/**
- * Select the tool deck for the run, honouring `--no-tools` (empty) and `--tools`
- * (allow-list). Tool ids are matched case-insensitively with `_`/`-` stripped, so
- * a `--tools web_fetch,todo_read` request lines up with the deck's `webfetch` /
- * `todoread` ids.
- */
-/**
- * @param runner an optional live sub-agent {@link DelegateRunner}; when present it
- *   is injected under {@link DELEGATE_HANDLE_KEY} so the `task` card delegates for
- *   real instead of returning its `STUB_NOTE`. Omitted by callers that only need
- *   a deck (the card then degrades gracefully).
- * @param checkpoint an optional per-session {@link CheckpointStore}; when present
- *   it is injected under {@link CHECKPOINT_HANDLE_KEY} so the framework's
- *   write/edit tools snapshot a file's pre-mutation content (rewind, #24). Omitted
- *   callers get no checkpointing (the tools no-op the snapshot).
- */
-export declare function selectTools(cwd: string, inv: Invocation, runner?: DelegateRunner, memoryStore?: MemoryStore, checkpoint?: CheckpointStore): AgentTool[];
+export declare function selectTools(cwd: string, inv: Invocation, runner?: DelegateRunner, memoryStore?: MemoryStore, checkpoint?: CheckpointStore, workflowRunner?: WorkflowAgentRunner): AgentTool[];
 /**
  * Compose the run's system prompt: `--system` replaces the built-in briefing,
  * `--append-system` adds a trailing block, and both compose (override then
@@ -69,6 +54,29 @@ export declare function composeSystem(tools: AgentTool[], inv: Invocation, cwd:
  * @param cwd          the run's working directory
  */
 export declare function sessionScopeDir(sessionsRoot: string, cwd: string): string;
+/**
+ * Build the `canUseTool` gate factory for a boot run.
+ *
+ * The factory receives a getter onto the conductor's LIVE permission mode plus the
+ * conductor's stable approval delegate, and returns the gate that reads them. The
+ * delegate is threaded straight into `requestApproval`: on a NON-interactive boot
+ * (oneshot / link) no resolver is ever installed, so the delegate denies and an
+ * `ask` decision deterministically denies with an actionable message. The
+ * interactive (React) console installs its overlay resolver via the conductor's
+ * `setApprovalResolver` AFTER mount, at which point the SAME delegate begins
+ * routing `ask` decisions to the overlay — no rebuild, fully additive.
+ *
+ * `rules` is the session's LIVE mutable rule list: the gate re-scans it on every
+ * call, and an `allow-always` approval appends into it (via `appendAllowRule`
+ * below), so the approval is remembered for the remainder of the session — and
+ * ONLY the session; nothing is ever written back to settings. Every gate the
+ * factory mints (and every sub-agent gate built over the same array) sees the
+ * appended rules immediately.
+ *
+ * Exported for the boot tests; product callers go through
+ * {@link buildSessionConductor}.
+ */
+export declare function buildPermissionGate(rules: PermissionRule[], mode: PermissionMode, tools: readonly AgentTool[], planReachable?: boolean): ((currentMode: () => PermissionMode, requestApproval?: ApprovalResolver) => CanUseToolFn) | undefined;
 export declare function buildSessionConductor(ctx: BootContext): Promise<SessionConductor>;
 /**
  * The prompts a oneshot run submits: the positional first prompt when present,

package/dist/types/boot/runners/session.test.d.ts

@@ -1,10 +1,15 @@
 /**
- * Skills-surface wiring (#7 / fixes #11).
+ * Skills-surface wiring (#7 / fixes #11) + the boot permission-gate factory.
  *
  * Proves the chain that makes on-disk `SKILL.md` cards visible to the model:
  * `gatherModelSkills` walks `cwd/.indusagi/skills`, drops any card flagged
  * `disable-model-invocation`, and the survivors render into the briefing's
  * `<available_skills>` block via `composeSystem`. A `--system` override must NOT
  * carry the skills block (it replaces the whole prompt).
+ *
+ * `buildPermissionGate` is pinned here too: default mode ALWAYS builds a gate
+ * (only a rule-less bypass boot with plan unreachable goes gate-free), and the
+ * factory wires `appendAllowRule` into the live rule list so an `allow-always`
+ * approval is remembered for the remainder of the session (B2).
  */
 export {};

package/dist/types/boot/server-token.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Server-token store — the boot-layer persistence for the indus device-login
+ * session token. This is the app side of the login + model-gateway contract: a
+ * successful `indus login` device flow writes the better-auth session token
+ * here, and the key resolver later reads it back to drive "server mode" (Case B
+ * — no local provider key, but a valid server session, so requests are routed
+ * through the indus-server gateway with the session token as the api key).
+ *
+ * The token lives in a single JSON file under the app's profile directory
+ * (`~/.indusagi/agent/server-token.json`) — deliberately NOT the framework's
+ * `~/.better-auth` location, so the CLI session is isolated from any other
+ * tooling. As with the credential vault, the file is tiny and access is
+ * interactive, so we read / write the whole file each time and tolerate a
+ * missing or malformed file as "no token".
+ *
+ * Ported from supercli `server/src/lib/token.ts`; the load-bearing detail is the
+ * `expires_in` (seconds, from the device-flow response) → `expires_at` (absolute
+ * ISO timestamp, on disk) conversion, which lets {@link isServerTokenExpired}
+ * decide freshness without re-deriving the clock offset.
+ */
+/**
+ * Root of the indus-server. Used to build the gateway base URL and the
+ * device-login endpoints. Any trailing slash(es) are stripped so callers can
+ * append paths with a single separator.
+ */
+export declare const INDUS_SERVER_URL: string;
+/** The app profile directory that holds the server session token. */
+export declare const CONFIG_DIR: string;
+/** Absolute path of the JSON file the session token is persisted to. */
+export declare const TOKEN_FILE: string;
+/** On-disk token shape (what {@link storeServerToken} writes / {@link getServerToken} returns). */
+export interface TokenData {
+    /** The better-auth session token, used as the gateway api key in server mode. */
+    access_token: string;
+    /** Optional refresh token, when the device flow returns one. */
+    refresh_token?: string;
+    /** Token scheme; defaults to `"Bearer"`. */
+    token_type: string;
+    /** Optional granted scope string. */
+    scope?: string;
+    /** Absolute expiry as an ISO string, or null when the token has no expiry. */
+    expires_at: string | null;
+    /** When this record was written, as an ISO string. */
+    created_at: string;
+}
+/** Device-flow response shape accepted by {@link storeServerToken} (`expires_in` → `expires_at`). */
+export interface ServerTokenInput {
+    /** The better-auth session token. */
+    access_token: string;
+    /** Optional refresh token. */
+    refresh_token?: string;
+    /** Token scheme; defaults to `"Bearer"` when omitted. */
+    token_type?: string;
+    /** Optional granted scope string. */
+    scope?: string;
+    /** Lifetime in seconds, relative to now; converted to an absolute `expires_at`. */
+    expires_in?: number;
+}
+/**
+ * Read the stored session token, tolerating a missing or malformed file as
+ * "no token".
+ *
+ * @returns the parsed {@link TokenData}, or `null` when nothing is stored.
+ */
+export declare function getServerToken(): Promise<TokenData | null>;
+/**
+ * Persist a session token from a device-flow response, converting the relative
+ * `expires_in` (seconds) into an absolute `expires_at` ISO timestamp and
+ * defaulting `token_type` to `"Bearer"`. Creates the profile directory if
+ * needed and writes the file with owner-only permissions.
+ *
+ * @param token the device-flow token payload.
+ * @returns `true` on success, `false` if the write failed.
+ */
+export declare function storeServerToken(token: ServerTokenInput): Promise<boolean>;
+/**
+ * Remove the stored session token (used by `indus logout`). A missing file is
+ * treated as nothing-to-do.
+ *
+ * @returns `true` when a file was deleted, `false` when none existed / removal failed.
+ */
+export declare function clearServerToken(): Promise<boolean>;
+/**
+ * Decide whether a token is expired. A token counts as expired when it is
+ * absent, has no `expires_at`, or has under 5 minutes of life remaining (the
+ * margin keeps a long turn from racing the expiry boundary).
+ *
+ * @param token the token to inspect (or `null`).
+ * @returns `true` when the token is missing or stale.
+ */
+export declare function isServerTokenExpired(token: TokenData | null): boolean;
+/**
+ * Convenience predicate: there is a stored token and it is not expired.
+ *
+ * @returns `true` when a usable (fresh) session token is on disk.
+ */
+export declare function hasValidServerToken(): Promise<boolean>;

package/dist/types/capability-deck/cards/index.d.ts

@@ -21,6 +21,7 @@ import type { CapabilityCard } from "../contract";
 export { todoCard, buildTodoCapability, TodoLedger, type TodoItem, type TodoState, type TodoWeight, type TodoParamsType, type TodoDetails, } from "./todo-card";
 export { daemonCard, buildDaemonCapability, DaemonTable, type DaemonState, type DaemonParamsType, type DaemonDetails, } from "./bg-process-card";
 export { taskCard, buildTaskCapability, DELEGATE_HANDLE_KEY, type DelegateRunner, type DelegateRequest, type DelegateResult, type TaskParamsType, type TaskDetails, } from "./task-card";
+export { workflowCard, buildWorkflowCapability, WORKFLOW_HANDLE_KEY, type WorkflowParamsType, type WorkflowDetails, } from "./workflow-card";
 export { saasCard, buildSaasCapability, SAAS_GATEWAY_KEY, type SaasGatewayPort, type RemoteToolSummary, type RemoteExecution, type SaasParamsType, type SaasDetails, } from "./saas-card";
 export { memoryCard, buildMemoryCapability, InMemoryStore, MEMORY_HANDLE_KEY, type MemoryStore, type MemoryParamsType, type MemoryDetails, } from "./memory-card";
 export { enterPlanModeCard, exitPlanModeCard, buildEnterPlanModeCapability, buildExitPlanModeCapability, PLAN_HANDLE_KEY, type PlanController, type EnterPlanParamsType, type EnterPlanDetails, type ExitPlanParamsType, type ExitPlanDetails, } from "./plan-tools";

package/dist/types/capability-deck/cards/task-card.d.ts

@@ -37,6 +37,20 @@ export interface DelegateResult {
     /** The sub-agent's final report, surfaced to the parent agent verbatim. */
     readonly report: string;
 }
+/** One line of a sub-agent's live activity stream (for the drill-in view). */
+export interface ActivityLine {
+    /** What kind of step this is, used to colour it. */
+    readonly tone: "reason" | "tool" | "result";
+    /** The display text (already shortened to a single line). */
+    readonly text: string;
+}
+/** Live progress a running sub-agent streams back while it works. */
+export interface DelegateProgress {
+    /** Cumulative tokens the sub-agent has spent so far (input + output). */
+    readonly tokens: number;
+    /** The sub-agent's recent activity (reasoning + tool steps), newest last. */
+    readonly activity: readonly ActivityLine[];
+}
 /**
  * The contract a host's sub-agent runner must satisfy to be wired in.
  *
@@ -47,8 +61,14 @@ export interface DelegateResult {
 export interface DelegateRunner {
     /** Optional roster of named agent profiles, surfaced in the tool description. */
     listAgents?(): readonly string[];
-    /** Run one delegated objective and resolve with the sub-agent's report. */
-    run(request: DelegateRequest, signal?: AbortSignal): Promise<DelegateResult>;
+    /**
+     * Run one delegated objective and resolve with the sub-agent's report.
+     *
+     * When an `onProgress` callback is supplied the runner streams live metrics
+     * (token spend) as the sub-agent works, so the host can surface them (the
+     * background-agents panel). Optional — a runner may ignore it.
+     */
+    run(request: DelegateRequest, signal?: AbortSignal, onProgress?: (progress: DelegateProgress) => void): Promise<DelegateResult>;
 }
 declare const TaskParams: import("@sinclair/typebox").TObject<{
     objective: import("@sinclair/typebox").TString;
@@ -65,6 +85,10 @@ export interface TaskDetails {
     readonly ok: boolean;
     /** The agent profile that ran, if one was named. */
     readonly agent?: string;
+    /** Cumulative tokens the sub-agent spent — streamed live on progress updates. */
+    readonly tokens?: number;
+    /** The sub-agent's recent activity — streamed live for the drill-in view. */
+    readonly activity?: readonly ActivityLine[];
 }
 /**
  * Build the task/delegate capability.

package/dist/types/capability-deck/cards/workflow-card.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Workflow capability — orchestrate a deterministic fan-out of subagents.
+ *
+ * App-novel wiring, sibling to (and UNRELATED to) the {@link "./task-card"}
+ * delegate card. The `workflow` tool runs a deterministic JavaScript workflow
+ * script that calls `agent()`, `parallel()`, and `pipeline()` to fan work out
+ * across many fresh subagents and fan their results back in, all under a live
+ * `◆ Workflow:` progress tree streamed into the tool result.
+ *
+ * The actual subagent runner is NOT owned by this card — it is a framework /
+ * boot concern injected through {@link DeckContext.framework} under the
+ * {@link WORKFLOW_HANDLE_KEY} key. When that handle is present the capability
+ * really runs the workflow (via the pure {@link runWorkflow} engine); when it is
+ * absent (tests, headless tooling, a host that has not wired the runner) the
+ * capability degrades gracefully to a clearly-typed {@link STUB_NOTE} result
+ * rather than throwing, exactly like the task card's `readDelegateRunner` path.
+ *
+ * Recursion guard: this card is registered all-profile-only in
+ * {@link "../cards/index"} (`APP_NOVEL_CARDS`), so the `'authoring'` deck a
+ * workflow subagent runs against EXCLUDES it — a subagent cannot call `workflow`.
+ *
+ * Live UI: each engine lifecycle callback mutates a {@link WorkflowSnapshot} and
+ * calls the framework `onUpdate` with the snapshot rendered through
+ * {@link renderWorkflowText} (the v1 string renderer). Updates are coalesced to
+ * status transitions (phase / agent start / agent end), not every log line, to
+ * avoid render thrash. The conductor re-projects the framework
+ * `tool_execution_update` event to a `tool_update` product signal (stage 3).
+ */
+import { type Static } from "@sinclair/typebox";
+import type { Capability, CapabilityCard, DeckContext } from "../contract";
+import { type WorkflowSnapshot } from "../../workflow-engine";
+/** Key under which a host wires a live workflow agent runner into the context. */
+export declare const WORKFLOW_HANDLE_KEY: "workflow";
+declare const WorkflowParams: import("@sinclair/typebox").TObject<{
+    script: import("@sinclair/typebox").TString;
+    args: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TAny>;
+}>;
+/** Statically-inferred parameter type the capability's `execute` receives. */
+export type WorkflowParamsType = Static<typeof WorkflowParams>;
+/** Structured detail returned alongside the model-facing content (the snapshot). */
+export type WorkflowDetails = WorkflowSnapshot;
+/**
+ * Build the workflow capability.
+ *
+ * If a {@link WorkflowAgentRunner} is present on the context it is bound and the
+ * tool truly orchestrates; otherwise the tool builds anyway and returns a typed,
+ * non-throwing stub so the deck stays assemblable in every environment.
+ *
+ * @param ctx the deck context; an optional runner is read from
+ *            `ctx.framework[WORKFLOW_HANDLE_KEY]`.
+ */
+export declare function buildWorkflowCapability(ctx: DeckContext): Capability<typeof WorkflowParams, WorkflowDetails>;
+/** Catalog row for the workflow capability. */
+export declare const workflowCard: CapabilityCard;
+export {};

package/dist/types/capability-deck/cards/workflow-card.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Workflow card — focused unit tests.
+ *
+ * The card is a pure capability builder over the pure {@link runWorkflow} engine
+ * (an injected {@link WorkflowAgentRunner} does the spawning). These tests cover:
+ *   - the STUB_NOTE degrade when no runner handle is wired (no throw),
+ *   - a real run with an in-memory fake runner: lifecycle → snapshot,
+ *   - abort flips running agents to skipped,
+ *   - and the deck-assembly guarantee: workflow appears in the `all` profile but
+ *     NOT in the `authoring` subagent profile (the recursion guard).
+ */
+export {};

package/dist/types/capability-deck/contract.d.ts

@@ -124,12 +124,13 @@ export type CardProfiles = readonly DeckProfile[];
  * The named capability sets a session can be provisioned with — the profile
  * table that replaces a trio of near-identical build functions.
  *
- *   - `authoring` — the full mutating set: read/write/edit/ls + search + shell +
- *     web + checklist + delegate + background processes + SaaS actions. The
- *     default for an interactive coding session.
- *   - `survey`    — observe-only: read/ls/search/web/checklist. No filesystem
- *     mutation and no shell. Safe when the agent must not change the workspace.
- *   - `all`       — every registered capability, nothing withheld.
+ *   - `authoring` — the READ-ONLY built-in subset: read/ls/search/web/
+ *     checklist-read. No filesystem mutation, no shell, no app-novel cards —
+ *     the deck sub-agents (task/workflow) are provisioned with (see
+ *     {@link "./provision"}'s PROFILE_TABLE, the authoritative mapping).
+ *   - `survey`    — every built-in (mutating ones included), no app-novel cards.
+ *   - `all`       — every registered capability, nothing withheld. What an
+ *     interactive coding session runs with.
  */
 export type DeckProfile = "authoring" | "survey" | "all";
 /**

package/dist/types/capability-deck/index.d.ts

@@ -31,7 +31,7 @@ export { CAPABILITY_CARDS, CAPABILITY_INDEX, CARD_PROFILES, capabilityIds, hasCa
  * (checklist, background-process proxy, delegate/sub-agent, SaaS connector,
  * working memory) plus their builders, stores, and injection-handle types.
  */
-export { APP_NOVEL_CARDS, todoCard, buildTodoCapability, TodoLedger, type TodoItem, type TodoState, type TodoWeight, type TodoParamsType, type TodoDetails, daemonCard, buildDaemonCapability, DaemonTable, type DaemonState, type DaemonParamsType, type DaemonDetails, taskCard, buildTaskCapability, DELEGATE_HANDLE_KEY, type DelegateRunner, type DelegateRequest, type DelegateResult, type TaskParamsType, type TaskDetails, saasCard, buildSaasCapability, SAAS_GATEWAY_KEY, type SaasGatewayPort, type RemoteToolSummary, type RemoteExecution, type SaasParamsType, type SaasDetails, memoryCard, buildMemoryCapability, InMemoryStore, MEMORY_HANDLE_KEY, type MemoryStore, type MemoryParamsType, type MemoryDetails, enterPlanModeCard, exitPlanModeCard, buildEnterPlanModeCapability, buildExitPlanModeCapability, PLAN_HANDLE_KEY, planSlug, planFilePath, writePlan, readPlan, PLANS_DIRNAME, type PlanController, type EnterPlanParamsType, type EnterPlanDetails, type ExitPlanParamsType, type ExitPlanDetails, } from "./cards/index";
+export { APP_NOVEL_CARDS, todoCard, buildTodoCapability, TodoLedger, type TodoItem, type TodoState, type TodoWeight, type TodoParamsType, type TodoDetails, daemonCard, buildDaemonCapability, DaemonTable, type DaemonState, type DaemonParamsType, type DaemonDetails, taskCard, buildTaskCapability, DELEGATE_HANDLE_KEY, type DelegateRunner, type DelegateRequest, type DelegateResult, type TaskParamsType, type TaskDetails, workflowCard, buildWorkflowCapability, WORKFLOW_HANDLE_KEY, type WorkflowParamsType, type WorkflowDetails, saasCard, buildSaasCapability, SAAS_GATEWAY_KEY, type SaasGatewayPort, type RemoteToolSummary, type RemoteExecution, type SaasParamsType, type SaasDetails, memoryCard, buildMemoryCapability, InMemoryStore, MEMORY_HANDLE_KEY, type MemoryStore, type MemoryParamsType, type MemoryDetails, enterPlanModeCard, exitPlanModeCard, buildEnterPlanModeCapability, buildExitPlanModeCapability, PLAN_HANDLE_KEY, planSlug, planFilePath, writePlan, readPlan, PLANS_DIRNAME, type PlanController, type EnterPlanParamsType, type EnterPlanDetails, type ExitPlanParamsType, type ExitPlanDetails, } from "./cards/index";
 /**
  * Bridge ledger — event-sourced enrollment of dynamically grafted MCP tools:
  * content-hash / ULID key minting, the immutable {@link BridgeLedger} value with

package/dist/types/conductor/conductor.d.ts

@@ -89,6 +89,18 @@ export interface CondenseOpts {
     readonly force?: boolean;
     readonly model?: Model<any>;
     readonly contextTokens?: number;
+    /**
+     * Cancellation for a manual `/compact`. A hook MAY honor it mid-summarization;
+     * the conductor always checks it after the hook returns and discards the
+     * result when aborted, so even a hook that ignores the signal cancels cleanly.
+     */
+    readonly signal?: AbortSignal;
+    /**
+     * The bound model's credential, resolved through the session's per-call key
+     * resolver. Forwarded so the summarizer authenticates exactly like a turn —
+     * server-tier sessions have no env-var fallback for this.
+     */
+    readonly apiKey?: string;
 }
 /**
  * The pluggable condense hook. Given the active branch's messages (and an options
@@ -186,4 +198,16 @@ export declare function reduceState(prev: ConductorState, action: StateAction):
  * @param deps    injectable collaborators; all optional, live defaults supplied
  */
 export declare function createSessionConductor(options: SessionConductorOptions, deps?: ConductorDeps): SessionConductor;
+/**
+ * Return the framework model unchanged, or — when a gateway base URL is set
+ * ("server mode") — a CLONE with its `baseUrl` swapped to the gateway so the
+ * request flows through the quota-enforcing indus-server. Never mutates the
+ * shared catalog card (always spreads into a fresh object). When
+ * `gatewayBaseUrl` is `undefined` the model is returned by reference, keeping
+ * the local-key path byte-for-byte unchanged.
+ */
+export declare function withGatewayBaseUrl<M extends {
+    baseUrl: string;
+    provider: string;
+}>(model: M, gatewayBaseUrls: Record<string, string> | undefined): M;
 export {};