indusagi-coding-agent 0.2.3 → 0.2.4

package/dist/types/boot/heap.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Heap headroom guard.
+ *
+ * Node's default old-space cap (~2 GB on 64-bit builds) is too small for heavy
+ * runs — most acutely a burst of parallel sub-agents whose combined transcripts
+ * push the resident heap past the default and abort the whole process with a V8
+ * "JavaScript heap out of memory" fatal (the exact crash this guards against).
+ *
+ * `--max-old-space-size` can only be set at process launch, so before any real
+ * work begins we re-exec the *same* program once with a raised cap, inherit its
+ * stdio (so the interactive TUI runs unchanged in the child), and adopt its exit
+ * code. The re-exec is one level deep: the child carries `INDUS_HEAP_BOOSTED=1`
+ * so it skips the guard and runs the agent directly.
+ *
+ * Controlled by env:
+ *   INDUS_MAX_HEAP_MB   target old-space size in MB (default 4096; 0 disables
+ *                       the guard entirely and runs in-process).
+ *   INDUS_HEAP_BOOSTED  set internally on the child; never set this yourself.
+ *
+ * If the re-exec cannot spawn (a locked-down sandbox, a missing argv[1]) the
+ * guard silently falls back to running in the current, un-boosted process rather
+ * than failing to start.
+ */
+/**
+ * Ensure the process has heap headroom, re-execing once if it does not.
+ *
+ * Returns normally in three cases: the guard is disabled, the cap is already
+ * raised, or the re-exec could not be spawned. Otherwise it does NOT return —
+ * it runs the boosted child to completion and exits with the child's status.
+ */
+export declare function ensureHeapHeadroom(): void;

package/dist/types/boot/runners/delegate-runner.d.ts

@@ -25,7 +25,7 @@
  * The `spawn`/`tools` options are pure test seams — they let a unit test drive
  * the runner with an in-memory fake instead of a real network round-trip.
  */
-import { type AgentMessage } from "../../conductor";
+import { type AgentMessage, type SessionPermissionPolicy } from "../../conductor";
 import { type AgentTool } from "../../capability-deck";
 import type { DelegateRunner } from "../../capability-deck/cards/task-card";
 /**
@@ -75,6 +75,26 @@ export interface DelegateRunnerOptions {
      * `task` card — the recursion guard).
      */
     readonly tools?: () => AgentTool[];
+    /**
+     * Resolve the current server-tier gateway routing map (provider -> gateway
+     * base url). Called FRESH on every `run()` — never cached — so a mid-session
+     * `/login` (to "Indus Server"), including one that lands after this runner was
+     * constructed but before a given delegated call, is always picked up. This
+     * mirrors {@link getApiKey}, which is likewise invoked per-request rather than
+     * resolved once at construction.
+     */
+    readonly getGatewayBaseUrls?: () => Promise<Record<string, string>>;
+    /**
+     * The parent session's live permission policy: the SAME mutable rule list the
+     * parent gate reads plus a live getter onto the conductor's current mode. When
+     * present, every spawned sub-agent runs under a RESOLVER-LESS gate built from
+     * it — deny/ask rules, plan-mode enforcement, and the catastrophic-bash
+     * blocklist apply per inner tool call, and a mid-run mode switch (Shift+Tab)
+     * retargets the very next delegated tool call. A sub-agent cannot prompt, so
+     * an `ask` decision deterministically denies with an actionable message.
+     * Absent (a bare test construction), the sub-agent runs ungated as before.
+     */
+    readonly permissionPolicy?: SessionPermissionPolicy;
 }
 /**
  * Build a live {@link DelegateRunner} the host wires into the deck context.

package/dist/types/boot/runners/server-mode.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Boot helper: decide whether a provider runs in **server mode** (Case B).
+ *
+ * A model turn takes one of three paths (see LOGIN_GATEWAY_PLAN.md §1):
+ *   - **A. Local key** — a usable key for the provider is stored in the on-disk
+ *     auth vault (or exported in the environment). The framework calls the
+ *     provider directly; behaviour is unchanged and this module returns
+ *     `{ serverMode: false }`.
+ *   - **B. Server tier** — the provider is gateway-eligible, the user has **no**
+ *     usable local key, and they hold a **valid server token**. The session token
+ *     is vended as the provider "key" and the model is re-routed through the indus
+ *     gateway. This module returns `{ serverMode: true, token }`.
+ *   - **C. Blocked** — no local key and no valid token: `{ serverMode: false }`
+ *     (the resolver then falls through to the framework's own env lookup, which
+ *     surfaces the usual "no API key" guidance pointing at `indus login`).
+ *
+ * The two consumers in {@link file://./session.ts} call this with the SAME
+ * `(ctx, provider, vault)` triple so the key-resolver fallback and the
+ * gateway-base-url computation always agree on whether server mode is active.
+ */
+import type { BootContext } from "../contract";
+import type { AuthVault } from "../../launch/contract";
+/**
+ * The outcome of {@link resolveServerMode}: whether the provider should route
+ * through the gateway this run, and (when so) the session token to hand back as
+ * the provider api key.
+ */
+export interface ServerModeResult {
+    /** `true` => bind the gateway base url and use {@link token} as the key. */
+    serverMode: boolean;
+    /** The session token (`access_token`) to vend as the key, when `serverMode`. */
+    token?: string;
+}
+/**
+ * Whether `provider` may be routed through the indus gateway. Excludes the
+ * non-portable providers (vertex / bedrock / codex) and the deferred opencode
+ * `anthropic-messages` api per the §B.4 caveat.
+ */
+export declare function isGatewayEligibleProvider(provider: string): boolean;
+/** The server-tier provider slugs (for default-model selection / listing). */
+export declare function serverTierProviders(): readonly string[];
+/**
+ * Decide whether `provider` runs in server mode for this session.
+ *
+ * Server mode is active when ALL hold:
+ *   1. {@link isGatewayEligibleProvider}(provider) — excludes vertex/bedrock/codex
+ *      and the deferred opencode `anthropic-messages` api (§B.4);
+ *   2. no EXPLICIT local key — the vault holds no usable key for the provider
+ *      (an ambient env var is intentionally ignored for server-tier providers);
+ *   3. {@link hasValidServerToken}() — a stored, non-expired server token exists.
+ *
+ * Returns `{ serverMode: false }` whenever any condition fails, so the
+ * local-key (Case A) path is preserved byte-for-byte: the resolver then returns
+ * `undefined` and no gateway base url is bound.
+ *
+ * @param _ctx the boot context (reserved for future per-run policy; the vault is
+ *   passed explicitly so callers share one instance)
+ * @param provider the framework provider slug to evaluate
+ * @param vault the on-disk credential vault to probe for a local key
+ */
+export declare function resolveServerMode(_ctx: BootContext, provider: string, vault: AuthVault): Promise<ServerModeResult>;
+/**
+ * Build the per-provider gateway base-url map for THIS session: for every
+ * gateway-eligible provider currently in server mode (no explicit local key +
+ * valid token), map `provider -> ${INDUS_SERVER_URL}/gateway/${provider}`.
+ *
+ * The conductor consults this map at EVERY model bind — including a runtime
+ * `/model` switch — so selecting ANY server-tier model (not just the one the
+ * session launched on) routes through the gateway. Empty when nothing qualifies.
+ */
+export declare function resolveServerGatewayUrls(ctx: BootContext, vault: AuthVault): Promise<Record<string, string>>;

package/dist/types/boot/runners/session.d.ts

@@ -8,7 +8,7 @@
  * {@link ModelMatcher}; the conductor itself is built lazily so no framework agent
  * is constructed until the first turn runs.
  */
-import { type AgentTool, type SessionConductor } from "../../conductor";
+import { type AgentTool, type ApprovalResolver, type CanUseToolFn, type PermissionMode, type PermissionRule, type SessionConductor } from "../../conductor";
 import { type MemoryStore } from "../../capability-deck";
 import { type DelegateRunner } from "../../capability-deck/cards/task-card";
 import type { WorkflowAgentRunner } from "../../workflow-engine";
@@ -54,6 +54,29 @@ export declare function composeSystem(tools: AgentTool[], inv: Invocation, cwd:
  * @param cwd          the run's working directory
  */
 export declare function sessionScopeDir(sessionsRoot: string, cwd: string): string;
+/**
+ * Build the `canUseTool` gate factory for a boot run.
+ *
+ * The factory receives a getter onto the conductor's LIVE permission mode plus the
+ * conductor's stable approval delegate, and returns the gate that reads them. The
+ * delegate is threaded straight into `requestApproval`: on a NON-interactive boot
+ * (oneshot / link) no resolver is ever installed, so the delegate denies and an
+ * `ask` decision deterministically denies with an actionable message. The
+ * interactive (React) console installs its overlay resolver via the conductor's
+ * `setApprovalResolver` AFTER mount, at which point the SAME delegate begins
+ * routing `ask` decisions to the overlay — no rebuild, fully additive.
+ *
+ * `rules` is the session's LIVE mutable rule list: the gate re-scans it on every
+ * call, and an `allow-always` approval appends into it (via `appendAllowRule`
+ * below), so the approval is remembered for the remainder of the session — and
+ * ONLY the session; nothing is ever written back to settings. Every gate the
+ * factory mints (and every sub-agent gate built over the same array) sees the
+ * appended rules immediately.
+ *
+ * Exported for the boot tests; product callers go through
+ * {@link buildSessionConductor}.
+ */
+export declare function buildPermissionGate(rules: PermissionRule[], mode: PermissionMode, tools: readonly AgentTool[], planReachable?: boolean): ((currentMode: () => PermissionMode, requestApproval?: ApprovalResolver) => CanUseToolFn) | undefined;
 export declare function buildSessionConductor(ctx: BootContext): Promise<SessionConductor>;
 /**
  * The prompts a oneshot run submits: the positional first prompt when present,

package/dist/types/boot/runners/session.test.d.ts

@@ -1,10 +1,15 @@
 /**
- * Skills-surface wiring (#7 / fixes #11).
+ * Skills-surface wiring (#7 / fixes #11) + the boot permission-gate factory.
  *
  * Proves the chain that makes on-disk `SKILL.md` cards visible to the model:
  * `gatherModelSkills` walks `cwd/.indusagi/skills`, drops any card flagged
  * `disable-model-invocation`, and the survivors render into the briefing's
  * `<available_skills>` block via `composeSystem`. A `--system` override must NOT
  * carry the skills block (it replaces the whole prompt).
+ *
+ * `buildPermissionGate` is pinned here too: default mode ALWAYS builds a gate
+ * (only a rule-less bypass boot with plan unreachable goes gate-free), and the
+ * factory wires `appendAllowRule` into the live rule list so an `allow-always`
+ * approval is remembered for the remainder of the session (B2).
  */
 export {};

package/dist/types/boot/server-token.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Server-token store — the boot-layer persistence for the indus device-login
+ * session token. This is the app side of the login + model-gateway contract: a
+ * successful `indus login` device flow writes the better-auth session token
+ * here, and the key resolver later reads it back to drive "server mode" (Case B
+ * — no local provider key, but a valid server session, so requests are routed
+ * through the indus-server gateway with the session token as the api key).
+ *
+ * The token lives in a single JSON file under the app's profile directory
+ * (`~/.indusagi/agent/server-token.json`) — deliberately NOT the framework's
+ * `~/.better-auth` location, so the CLI session is isolated from any other
+ * tooling. As with the credential vault, the file is tiny and access is
+ * interactive, so we read / write the whole file each time and tolerate a
+ * missing or malformed file as "no token".
+ *
+ * Ported from supercli `server/src/lib/token.ts`; the load-bearing detail is the
+ * `expires_in` (seconds, from the device-flow response) → `expires_at` (absolute
+ * ISO timestamp, on disk) conversion, which lets {@link isServerTokenExpired}
+ * decide freshness without re-deriving the clock offset.
+ */
+/**
+ * Root of the indus-server. Used to build the gateway base URL and the
+ * device-login endpoints. Any trailing slash(es) are stripped so callers can
+ * append paths with a single separator.
+ */
+export declare const INDUS_SERVER_URL: string;
+/** The app profile directory that holds the server session token. */
+export declare const CONFIG_DIR: string;
+/** Absolute path of the JSON file the session token is persisted to. */
+export declare const TOKEN_FILE: string;
+/** On-disk token shape (what {@link storeServerToken} writes / {@link getServerToken} returns). */
+export interface TokenData {
+    /** The better-auth session token, used as the gateway api key in server mode. */
+    access_token: string;
+    /** Optional refresh token, when the device flow returns one. */
+    refresh_token?: string;
+    /** Token scheme; defaults to `"Bearer"`. */
+    token_type: string;
+    /** Optional granted scope string. */
+    scope?: string;
+    /** Absolute expiry as an ISO string, or null when the token has no expiry. */
+    expires_at: string | null;
+    /** When this record was written, as an ISO string. */
+    created_at: string;
+}
+/** Device-flow response shape accepted by {@link storeServerToken} (`expires_in` → `expires_at`). */
+export interface ServerTokenInput {
+    /** The better-auth session token. */
+    access_token: string;
+    /** Optional refresh token. */
+    refresh_token?: string;
+    /** Token scheme; defaults to `"Bearer"` when omitted. */
+    token_type?: string;
+    /** Optional granted scope string. */
+    scope?: string;
+    /** Lifetime in seconds, relative to now; converted to an absolute `expires_at`. */
+    expires_in?: number;
+}
+/**
+ * Read the stored session token, tolerating a missing or malformed file as
+ * "no token".
+ *
+ * @returns the parsed {@link TokenData}, or `null` when nothing is stored.
+ */
+export declare function getServerToken(): Promise<TokenData | null>;
+/**
+ * Persist a session token from a device-flow response, converting the relative
+ * `expires_in` (seconds) into an absolute `expires_at` ISO timestamp and
+ * defaulting `token_type` to `"Bearer"`. Creates the profile directory if
+ * needed and writes the file with owner-only permissions.
+ *
+ * @param token the device-flow token payload.
+ * @returns `true` on success, `false` if the write failed.
+ */
+export declare function storeServerToken(token: ServerTokenInput): Promise<boolean>;
+/**
+ * Remove the stored session token (used by `indus logout`). A missing file is
+ * treated as nothing-to-do.
+ *
+ * @returns `true` when a file was deleted, `false` when none existed / removal failed.
+ */
+export declare function clearServerToken(): Promise<boolean>;
+/**
+ * Decide whether a token is expired. A token counts as expired when it is
+ * absent, has no `expires_at`, or has under 5 minutes of life remaining (the
+ * margin keeps a long turn from racing the expiry boundary).
+ *
+ * @param token the token to inspect (or `null`).
+ * @returns `true` when the token is missing or stale.
+ */
+export declare function isServerTokenExpired(token: TokenData | null): boolean;
+/**
+ * Convenience predicate: there is a stored token and it is not expired.
+ *
+ * @returns `true` when a usable (fresh) session token is on disk.
+ */
+export declare function hasValidServerToken(): Promise<boolean>;

package/dist/types/capability-deck/contract.d.ts

@@ -124,12 +124,13 @@ export type CardProfiles = readonly DeckProfile[];
  * The named capability sets a session can be provisioned with — the profile
  * table that replaces a trio of near-identical build functions.
  *
- *   - `authoring` — the full mutating set: read/write/edit/ls + search + shell +
- *     web + checklist + delegate + background processes + SaaS actions. The
- *     default for an interactive coding session.
- *   - `survey`    — observe-only: read/ls/search/web/checklist. No filesystem
- *     mutation and no shell. Safe when the agent must not change the workspace.
- *   - `all`       — every registered capability, nothing withheld.
+ *   - `authoring` — the READ-ONLY built-in subset: read/ls/search/web/
+ *     checklist-read. No filesystem mutation, no shell, no app-novel cards —
+ *     the deck sub-agents (task/workflow) are provisioned with (see
+ *     {@link "./provision"}'s PROFILE_TABLE, the authoritative mapping).
+ *   - `survey`    — every built-in (mutating ones included), no app-novel cards.
+ *   - `all`       — every registered capability, nothing withheld. What an
+ *     interactive coding session runs with.
  */
 export type DeckProfile = "authoring" | "survey" | "all";
 /**

package/dist/types/conductor/conductor.d.ts

@@ -89,6 +89,18 @@ export interface CondenseOpts {
     readonly force?: boolean;
     readonly model?: Model<any>;
     readonly contextTokens?: number;
+    /**
+     * Cancellation for a manual `/compact`. A hook MAY honor it mid-summarization;
+     * the conductor always checks it after the hook returns and discards the
+     * result when aborted, so even a hook that ignores the signal cancels cleanly.
+     */
+    readonly signal?: AbortSignal;
+    /**
+     * The bound model's credential, resolved through the session's per-call key
+     * resolver. Forwarded so the summarizer authenticates exactly like a turn —
+     * server-tier sessions have no env-var fallback for this.
+     */
+    readonly apiKey?: string;
 }
 /**
  * The pluggable condense hook. Given the active branch's messages (and an options
@@ -186,4 +198,16 @@ export declare function reduceState(prev: ConductorState, action: StateAction):
  * @param deps    injectable collaborators; all optional, live defaults supplied
  */
 export declare function createSessionConductor(options: SessionConductorOptions, deps?: ConductorDeps): SessionConductor;
+/**
+ * Return the framework model unchanged, or — when a gateway base URL is set
+ * ("server mode") — a CLONE with its `baseUrl` swapped to the gateway so the
+ * request flows through the quota-enforcing indus-server. Never mutates the
+ * shared catalog card (always spreads into a fresh object). When
+ * `gatewayBaseUrl` is `undefined` the model is returned by reference, keeping
+ * the local-key path byte-for-byte unchanged.
+ */
+export declare function withGatewayBaseUrl<M extends {
+    baseUrl: string;
+    provider: string;
+}>(model: M, gatewayBaseUrls: Record<string, string> | undefined): M;
 export {};

package/dist/types/conductor/contract.d.ts

@@ -103,8 +103,14 @@ export declare function conductorFault(kind: FaultKind, message: string, cause?:
  *   - `tool_end`  — a tool invocation finished (`ok` = no error).
  *   - `turn_end`  — the assistant turn settled; `usage` reports token spend.
  *   - `persisted` — the latest node was committed to the transcript (`entryId`).
- *   - `compacted` — the transcript was condensed to fit the context window.
- *   - `fault`     — a typed {@link ConductorFault} occurred.
+ *   - `compacted` — the transcript WAS condensed (emitted on completion, not at
+ *     the start). `manual` marks a user-driven `/compact` — a view may then
+ *     reset its visible transcript — versus mid-turn auto-compaction, where the
+ *     display must keep the in-flight exchange on screen.
+ *   - `fault`     — a typed {@link ConductorFault} occurred. `transient` marks a
+ *     fault surfaced purely as an in-turn notice (e.g. a fallback-model swap on
+ *     provider overload) — the turn keeps running, so a consumer must NOT treat
+ *     it as the turn's end (must not clear a busy/in-flight indicator on it).
  *   - `queue`     — the pending-input queue changed; `count` is its new depth.
  *   - `idle`      — the conductor has no in-flight work and is ready for input.
  */
@@ -138,9 +144,11 @@ export type SessionSignal = {
     readonly entryId: string;
 } | {
     readonly kind: "compacted";
+    readonly manual?: boolean;
 } | {
     readonly kind: "fault";
     readonly fault: ConductorFault;
+    readonly transient?: boolean;
 } | {
     readonly kind: "queue";
     readonly count: number;
@@ -428,6 +436,18 @@ export interface SessionConductorOptions {
      * the swap entirely (behavior-preserving default).
      */
     readonly fallbackModelId?: string;
+    /**
+     * Per-provider indus-gateway base URLs ("server mode"), keyed by provider slug
+     * (e.g. `{ minimax: "http://host/gateway/minimax", sarvam: "…/gateway/sarvam" }`).
+     * Set by the session runner for every gateway-eligible provider the user has no
+     * local key for but holds a valid server token. At EVERY model bind (including a
+     * runtime `/model` switch) the conductor looks up the BOUND model's provider in
+     * this map and, when present, binds a CLONE of the framework model with its
+     * `baseUrl` swapped to that URL — so any server-tier model routes through the
+     * quota-enforcing server while the session token (via {@link getApiKey})
+     * authenticates it. A provider absent from the map keeps the direct path.
+     */
+    readonly gatewayBaseUrls?: Record<string, string>;
     /** Working directory the session is scoped to (defaults to process cwd). */
     readonly workspace?: string;
     /**
@@ -496,6 +516,11 @@ export interface SessionConductorOptions {
      */
     readonly checkpoint?: CheckpointPort;
 }
+/**
+ * What a manual {@link SessionConductor.condense} run amounted to — the honest
+ * completion vocabulary `/compact` reports from (see the method doc).
+ */
+export type CondenseOutcome = "condensed" | "nothing" | "cancelled" | "failed" | "busy";
 /**
  * The conductor of a single coding-agent session.
  *
@@ -537,6 +562,15 @@ export interface SessionConductor {
     pendingInputs(): readonly QueuedInput[];
     /** Discard every queued input. Emits a `{ kind: "queue" }` signal. */
     clearQueue(): void;
+    /**
+     * Promote the NEWEST queued input to run immediately: the in-flight turn (if
+     * any) is aborted — its work stops — while the rest of the queue is kept, and
+     * the promoted input runs as the very next turn. The user-facing "run my new
+     * message NOW" affordance for a long/stuck turn (issue #19), distinct from
+     * {@link abort} (which stops everything and clears the queue). Returns `false`
+     * when no input is queued.
+     */
+    steerNow(): boolean;
     /**
      * Remove and return the text of the most-recently queued input, or `undefined`
      * when the queue is empty. Lets a UI pop the last entry back into its prompt.
@@ -570,6 +604,20 @@ export interface SessionConductor {
      * @param id canonical id of the model to switch to
      */
     selectModel(id: string): void;
+    /**
+     * Replace the server-tier gateway routing map and immediately re-bind the
+     * currently selected model against it (without changing which model is
+     * selected). Lets an interactive mid-session sign-in (see `/login` ->
+     * "Indus Server") take effect right away: the gateway base-url map is
+     * otherwise frozen at conductor construction, so a login that happens after
+     * boot would silently never route the bound model through the gateway even
+     * though the per-request key resolver already started vending the fresh
+     * session token as the provider key.
+     *
+     * @param map provider id -> gateway base URL, as produced by
+     *   `resolveServerGatewayUrls` for the current vault/token state
+     */
+    updateGatewayBaseUrls(map: Record<string, string>): void;
     /**
      * Replace the agent's tool deck for subsequent turns.
      *
@@ -584,11 +632,27 @@ export interface SessionConductor {
      */
     registerTools(tools: AgentTool[]): void;
     /**
-     * Manually run the same transcript-condense path the auto-compactor uses,
-     * emitting the existing `compacted` signal. Safe to call when idle; a no-op
-     * when the condense hook returns the branch unchanged.
-     */
-    condense(): Promise<void>;
+     * Manually run the transcript-condense path (`/compact`) and report what
+     * happened, so the caller can give honest feedback instead of announcing
+     * "condensed" regardless:
+     *   - `"condensed"` — the branch shrank and was rebound (emits `compacted`).
+     *   - `"nothing"`   — nothing older to fold (single-turn session, or already
+     *                     compacted); the transcript is untouched.
+     *   - `"cancelled"` — {@link cancelCondense} fired mid-run; the digest was
+     *                     discarded and the transcript is untouched.
+     *   - `"failed"`    — the condense hook threw; a typed fault was emitted.
+     *   - `"busy"`      — a turn is in flight; compact after it settles (or abort
+     *                     it first).
+     * While the condense runs, {@link submit} queues instead of racing it, and the
+     * queue drains once the condense settles.
+     */
+    condense(): Promise<CondenseOutcome>;
+    /**
+     * Cancel an in-flight manual {@link condense} (the `/compact` Esc affordance).
+     * The summarizer's result is discarded and the transcript stays untouched; a
+     * no-op when no manual condense is running.
+     */
+    cancelCondense(): void;
     /**
      * Branch the transcript from a prior node. A new branch is opened whose parent
      * is `entryId`; the agent's message list is rebound to that branch's root→leaf

package/dist/types/conductor/index.d.ts

@@ -14,13 +14,13 @@
  * land; consumers import the conductor surface from `src/conductor` rather than
  * reaching into individual modules.
  */
-export type { FaultKind, ConductorFault, SessionSignal, SignalKind, SignalOf, SignalHandler, TranscriptSchema, TranscriptRole, TranscriptEntry, SessionHead, ModelCardRef, MatchQuery, ConductorPhase, ConductorState, QueueMode, QueuedInput, SessionStats, ExecuteBashOptions, BashOutcome, SessionConductor, SessionConductorOptions, AgentMessage, AgentTool, CanUseToolFn, ThinkingLevel, Model, Usage, KnownProvider, PermissionMode, } from "./contract";
+export type { FaultKind, ConductorFault, SessionSignal, SignalKind, SignalOf, SignalHandler, TranscriptSchema, TranscriptRole, TranscriptEntry, SessionHead, ModelCardRef, MatchQuery, ConductorPhase, ConductorState, QueueMode, QueuedInput, SessionStats, ExecuteBashOptions, BashOutcome, SessionConductor, SessionConductorOptions, CondenseOutcome, AgentMessage, AgentTool, CanUseToolFn, ThinkingLevel, Model, Usage, KnownProvider, PermissionMode, } from "./contract";
 export { conductorFault, TRANSCRIPT_SCHEMA } from "./contract";
-export { createSessionConductor, reduceState, noopCondense, type AgentLike, type ConductorDeps, type CondenseFn, type RetryPolicy, } from "./conductor";
+export { createSessionConductor, reduceState, noopCondense, withGatewayBaseUrl, type AgentLike, type ConductorDeps, type CondenseFn, type RetryPolicy, } from "./conductor";
 export { SignalHub, translateAgentEvent, type SignalHubOptions } from "./signal-hub";
 export { ModelCatalog, ModelMatcher, canonicalId, toCardRef, type CatalogCard, type CatalogSource, type ResolveInput, } from "./catalog";
 export { TranscriptStore, memoryBackend, fsBackend, replay, type TranscriptBackend, type TranscriptState, type TranscriptClock, type TranscriptStoreOptions, } from "./transcript-store";
 export { parseSkillInvocation, type SkillInvocation } from "./skill-parse";
-export { resolveRuleDecision, parseRule, makeRule, toolMatchesRule, createPermissionGate, isReadOnlyToolName, isEditToolName, READ_ONLY_TOOL_NAMES, EDIT_TOOL_NAMES, type PermissionBehavior, type PermissionRule, type PermissionDecision, type CanUseToolFn as PermissionCanUseToolFn, type ApprovalChoice, type ApprovalResolver, type PermissionGateConfig, } from "./permissions";
+export { resolveRuleDecision, parseRule, makeRule, toolMatchesRule, createPermissionGate, createSubagentPermissionGate, collectReadOnlyToolNames, allowAlwaysRuleStrings, isReadOnlyToolName, isEditToolName, READ_ONLY_TOOL_NAMES, EDIT_TOOL_NAMES, type PermissionBehavior, type PermissionRule, type PermissionDecision, type CanUseToolFn as PermissionCanUseToolFn, type ApprovalChoice, type ApprovalOutcome, type ApprovalResolver, type PermissionGateConfig, type SessionPermissionPolicy, } from "./permissions";
 export { parseBashCommand, catastrophicReason, isCatastrophicCommand, evaluateCatastrophic, bashSubcommandSubjects, type ParsedCommand, } from "./bash-guard";
 export { DiagnosticsEngine, createDiagnosticKey, deduplicateAndCap, formatDiagnosticsSummary, getSeveritySymbol, parseTscOutput, parseEslintOutput, runTscDiagnostics, runEslintDiagnostics, hasTsConfig, hasEslintConfig, isTypeScriptOrJs, areDiagnosticsEqual, MAX_PER_FILE, MAX_TOTAL, MAX_SUMMARY_CHARS, type Diagnostic, type DiagnosticFile, type DiagnosticSeverity, type DiagnosticsConfig, type DiagnosticRunner, type DedupOptions, type Position, } from "./diagnostics";

package/dist/types/conductor/permissions.d.ts

@@ -74,16 +74,29 @@ export type CanUseToolFn = (toolName: string, input: unknown, opts: {
  *   - `deny`         — block this call.
  */
 export type ApprovalChoice = "allow-once" | "allow-always" | "deny";
+/**
+ * What an {@link ApprovalResolver} may resolve to: a user's {@link ApprovalChoice},
+ * or `"unavailable"` — the conductor's stable delegate answers that when NO
+ * interactive resolver is installed behind it (a headless boot, or the console not
+ * yet mounted). The gate maps `"unavailable"` to the actionable "requires
+ * approval" deny (pointing at `--permission-mode` / settings allow rules) rather
+ * than the "denied by the user" message, which would be false when no user ever
+ * saw a prompt.
+ */
+export type ApprovalOutcome = ApprovalChoice | "unavailable";
 /**
  * The OPTIONAL host approval resolver. When present, an `ask` decision awaits it;
  * the host (an interactive overlay) returns the user's choice. It MUST resolve to
  * `"deny"` on abort so a cancelled turn never hangs on a pending prompt. When the
  * resolver is absent (non-interactive boot / oneshot / link), an `ask` decision
- * deterministically denies.
+ * deterministically denies. A stable pass-through delegate (the conductor's)
+ * resolves `"unavailable"` while no real resolver is installed behind it, so the
+ * gate can surface the actionable non-interactive deny message instead of a
+ * fictitious user denial.
  */
 export type ApprovalResolver = (toolName: string, input: unknown, opts: {
     signal?: AbortSignal;
-}) => Promise<ApprovalChoice>;
+}) => Promise<ApprovalOutcome>;
 /**
  * Tool names known to only inspect state (never mutate). Mirrors the framework's
  * `READ_ONLY_TOOL_NAMES`; matched case-insensitively. A tool the framework marks
@@ -172,6 +185,22 @@ export declare function toolMatchesRule(toolName: string, input: unknown, rule:
  * Pure and total: no I/O, no async, deterministic for a given input.
  */
 export declare function resolveRuleDecision(toolName: string, input: unknown, rules: readonly PermissionRule[], mode: PermissionMode, readOnlyExtra?: ReadonlySet<string>): PermissionBehavior;
+/**
+ * The rule strings an `allow-always` approval mints — i.e. what the session will
+ * REMEMBER for this tool call.
+ *
+ * For the shell tool the remembered rules are scoped to the command: one
+ * `Bash(<sub-command>)` rule per constituent sub-command (so approving
+ * `git status && npm test` remembers both halves, and re-running either — or the
+ * same compound — auto-allows), but approving one command never whitelists the
+ * whole shell. Every other tool remembers the bare tool name (`Edit`), matching
+ * the prompt's "remember the tool for this session" copy.
+ *
+ * Exported so the approval overlay can show the user exactly what "Allow always"
+ * will remember (the `suggestions` line), and so the gate and the UI can never
+ * disagree about it.
+ */
+export declare function allowAlwaysRuleStrings(toolName: string, input: unknown): string[];
 /** Configuration for {@link createPermissionGate}. */
 export interface PermissionGateConfig {
     /**
@@ -188,8 +217,11 @@ export interface PermissionGateConfig {
     readonly requestApproval?: ApprovalResolver;
     /**
      * Append a session-scoped allow rule when the host returns `allow-always`. The
-     * conductor owns the mutable rule list and passes a setter here so the new rule
-     * is visible to subsequent calls within the session.
+     * boot layer owns the mutable rule list (the SAME array instance `rules` refers
+     * to) and passes a push here, so the appended rule is visible to every
+     * subsequent gate consultation within the session — and to every other gate
+     * built over the same list (sub-agent gates included). Session-scoped only:
+     * the rule is never persisted to settings.
      */
     readonly appendAllowRule?: (rule: PermissionRule) => void;
     /**
@@ -215,3 +247,41 @@ export interface PermissionGateConfig {
  * The result is assignable to `indusagi/agent`'s `CanUseToolFn`.
  */
 export declare function createPermissionGate(config: PermissionGateConfig): CanUseToolFn;
+/**
+ * The live permission policy a session shares with its sub-agent runners (the
+ * `task` and `workflow` tools): the SAME mutable rule list the parent gate reads
+ * — so a session-scoped `allow-always` rule and the settings deny/ask rules are
+ * enforced inside delegations too — plus a live getter onto the parent
+ * conductor's permission mode, so a mid-run Shift+Tab (bypass → default, plan,
+ * back to bypass, …) retargets the very next sub-agent tool call.
+ */
+export interface SessionPermissionPolicy {
+    /** The session's ordered rule list — the live array, never a snapshot. */
+    readonly rules: readonly PermissionRule[];
+    /** Live getter onto the parent session's current permission mode. */
+    readonly mode: () => PermissionMode;
+}
+/**
+ * Collect the names of every tool flagged `readOnly: true` (structurally probed,
+ * so any deck/framework/MCP tool shape works). These names are auto-allowed by
+ * the gate in `default`/`acceptEdits`/`plan` beyond the static
+ * {@link READ_ONLY_TOOL_NAMES}.
+ */
+export declare function collectReadOnlyToolNames(tools: ReadonlyArray<{
+    readonly name: string;
+}>): ReadonlySet<string>;
+/**
+ * Build the RESOLVER-LESS gate a sub-agent runs under.
+ *
+ * A sub-agent cannot prompt the user, so no {@link ApprovalResolver} is wired:
+ * an `ask` decision deterministically denies with an actionable message, while
+ * deny rules, plan-mode enforcement, the catastrophic-bash blocklist, read-only
+ * auto-allow, and bypass/acceptEdits behaviour all apply per inner tool call —
+ * against the LIVE parent mode, so mid-run mode switches reach delegations too.
+ *
+ * @param policy the session's shared rules + live mode getter
+ * @param tools  the sub-agent's actual deck, probed for `readOnly: true` flags
+ */
+export declare function createSubagentPermissionGate(policy: SessionPermissionPolicy, tools: ReadonlyArray<{
+    readonly name: string;
+}>): CanUseToolFn;

package/dist/types/conductor/post-edit-diagnostics.test.d.ts

@@ -6,8 +6,13 @@
  * over a scripted in-memory runner (no real tsc spawn). Verifies:
  *   - a turn that introduces a NEW diagnostic enqueues the summary follow-up;
  *   - a clean edit (no new diagnostics) enqueues nothing;
- *   - re-editing a file re-surfaces a previously-cleared diagnostic;
- *   - a non-TS edit never triggers the checker;
- *   - the injected follow-up turn (which edits nothing) does not loop.
+ *   - a still-unfixed diagnostic is delivered AT MOST ONCE per session — a
+ *     follow-up turn whose "fix" edits fail to eliminate the same error must
+ *     NOT be re-prompted with it (the endless self-continuation of issue #15);
+ *   - even genuinely NEW errors per fix attempt stop re-prompting at the
+ *     consecutive follow-up cap, and a fresh user prompt re-arms the budget;
+ *   - `idle` is not emitted between a turn and its auto-drained follow-up (the
+ *     spinner must not drop while the agent keeps working);
+ *   - a non-TS edit never triggers the checker.
  */
 export {};