indusagi-coding-agent 0.2.3 → 0.2.5

package/dist/types/conductor/diagnostics.d.ts

@@ -1,183 +0,0 @@
-/**
- * Post-edit live diagnostics — an LSP-free, shell-sourced baseline-diff engine.
- *
- * The full induscode story runs a long-lived LSP and pulls structured
- * diagnostics off the language server. That stack is out of scope for the
- * clean-room product, so this is the **pragmatic shell path**: after a turn that
- * edited TypeScript/JS files, the conductor asks this engine to run a project
- * checker (`tsc --noEmit`, plus `eslint --format json` when an eslint config is
- * present), scoped to the workspace, and diff the result against a *per-session
- * baseline* captured before the edits. Only the diagnostics that are genuinely
- * **new** (not in the baseline, not already delivered in a prior turn) are
- * surfaced, and they are injected into the NEXT agent turn as a follow-up note.
- *
- * Everything here is best-effort and non-fatal:
- *   - the checker spawns its OWN child process (lazy `node:child_process`), so
- *     the module stays importable in a non-Node test context;
- *   - a missing/slow/erroring checker NEVER faults the turn — the run is bounded
- *     by an {@link AbortController} timeout and every failure resolves to `[]`;
- *   - results are deduplicated and volume-capped (10/file, 30 total,
- *     severity-sorted) so a broken project can't dump hundreds of lines into
- *     context;
- *   - it is fully opt-out-able (`DiagnosticsConfig.enabled === false`) and
- *     defaults OFF when the workspace has no `tsconfig.json`.
- *
- * The line/column convention mirrors the LSP `Diagnostic.range`: 0-based.
- * `tsc` reports 1-based positions, so {@link runTscDiagnostics} subtracts 1 and
- * {@link formatDiagnosticsSummary} re-adds 1 when rendering for a human/agent.
- */
-/** Severity rank, ordered most→least urgent for the volume cap's sort. */
-export type DiagnosticSeverity = "Error" | "Warning" | "Info" | "Hint";
-/** A zero-based line/column position. */
-export interface Position {
-    readonly line: number;
-    readonly character: number;
-}
-/** A single diagnostic, shaped after the LSP `Diagnostic` (0-based range). */
-export interface Diagnostic {
-    readonly message: string;
-    readonly severity: DiagnosticSeverity;
-    readonly range: {
-        readonly start: Position;
-        readonly end: Position;
-    };
-    readonly source?: string;
-    readonly code?: string | number;
-}
-/** All diagnostics for one file, keyed by an absolute fs path used as the uri. */
-export interface DiagnosticFile {
-    readonly uri: string;
-    readonly diagnostics: Diagnostic[];
-}
-/** Max diagnostics surfaced for any single file (mirrors the LSP registry cap). */
-export declare const MAX_PER_FILE = 10;
-/** Max diagnostics surfaced across all files in one turn. */
-export declare const MAX_TOTAL = 30;
-/** Char budget for the rendered summary (truncated past this). */
-export declare const MAX_SUMMARY_CHARS = 4000;
-/**
- * A stable identity for one diagnostic: position + code + (trimmed) message.
- * Two diagnostics with the same key are "the same problem" for dedup/baseline
- * purposes even across separate checker runs.
- */
-export declare function createDiagnosticKey(d: Diagnostic): string;
-/** Structural equality over a diagnostic's salient fields (via the dedup key). */
-export declare function areDiagnosticsEqual(a: Diagnostic, b: Diagnostic): boolean;
-/** Options for {@link deduplicateAndCap}. */
-export interface DedupOptions {
-    readonly maxPerFile?: number;
-    readonly maxTotal?: number;
-}
-/**
- * Filter, deduplicate, severity-sort, and volume-cap a batch of diagnostic
- * files against a cross-turn `delivered` ledger.
- *
- *   - drops any diagnostic whose key is already in `delivered[uri]` (already
- *     surfaced in a prior turn — don't nag);
- *   - dedups within a file (identical keys collapse to one);
- *   - sorts each file's diagnostics by severity then position;
- *   - caps to `maxPerFile` per file and `maxTotal` overall (errors win the cap);
- *   - records every diagnostic it RETURNS into `delivered` (FIFO-capped per uri)
- *     so the next turn won't re-surface it.
- *
- * `delivered` is mutated in place. Files that end up empty are dropped.
- */
-export declare function deduplicateAndCap(files: readonly DiagnosticFile[], delivered: Map<string, Set<string>>, opts?: DedupOptions): DiagnosticFile[];
-/** Inline ASCII severity marker (no `figures` dep). */
-export declare function getSeveritySymbol(severity: DiagnosticSeverity): string;
-/**
- * Render a deduped/capped batch into a compact, agent-readable block. Positions
- * are re-converted to 1-based for display (the engine carries 0-based). The
- * output is truncated to `maxChars` so it can never blow up a context window.
- */
-export declare function formatDiagnosticsSummary(files: readonly DiagnosticFile[], maxChars?: number): string;
-/** A diagnostics source: produces files for the workspace, honoring `signal`. */
-export type DiagnosticRunner = (cwd: string, signal?: AbortSignal) => Promise<DiagnosticFile[]>;
-/**
- * Run a project `tsc --noEmit --pretty false` and parse the flat diagnostic
- * lines. Resolves to `[]` on ANY failure (binary missing, abort, non-Node).
- * The local `node_modules/.bin/tsc` is preferred over a global/`npx` install to
- * avoid a version mismatch with the project's own config.
- *
- * tsc lines look like: `src/x.ts(12,5): error TS2322: Type 'a' ...`
- * Positions are 1-based in tsc; we store them 0-based (subtract 1).
- */
-export declare function runTscDiagnostics(cwd: string, signal?: AbortSignal): Promise<DiagnosticFile[]>;
-/** Parse the combined stdout/stderr of a `tsc --pretty false` run. */
-export declare function parseTscOutput(output: string, cwd: string): DiagnosticFile[];
-/**
- * Run a project `eslint --format json` over `files` and parse the result.
- * Resolves to `[]` when eslint is absent, no config is found, or anything else
- * goes wrong. severity 2→Error, 1→Warning. Positions are 1-based; stored 0-based.
- */
-export declare function runEslintDiagnostics(files: readonly string[], cwd: string, signal?: AbortSignal): Promise<DiagnosticFile[]>;
-/** Parse `eslint --format json` output. Resolves config-not-found to `[]`. */
-export declare function parseEslintOutput(output: string, cwd: string): DiagnosticFile[];
-/** Configuration for the {@link DiagnosticsEngine}. */
-export interface DiagnosticsConfig {
-    /** Master switch. When `false` the engine reports nothing (opt-out). */
-    readonly enabled?: boolean;
-    /** The diagnostic sources to run. Defaults to `[runTscDiagnostics]`. */
-    readonly runners?: DiagnosticRunner[];
-    /** Per-run timeout in ms before the checker is aborted (default 30000). */
-    readonly timeoutMs?: number;
-    /** Per-file cap (default {@link MAX_PER_FILE}). */
-    readonly maxPerFile?: number;
-    /** Total cap (default {@link MAX_TOTAL}). */
-    readonly maxTotal?: number;
-}
-/**
- * The post-edit diagnostics engine: runs checkers, diffs against a per-session
- * baseline, and dedups across turns. Stateful and per-session — one instance
- * lives on the conductor for the life of a session.
- */
-export declare class DiagnosticsEngine {
-    #private;
-    constructor(cwd: string, config?: DiagnosticsConfig);
-    /** Whether this engine is active. */
-    get enabled(): boolean;
-    /** Whether the per-session baseline has already been captured. */
-    get hasBaseline(): boolean;
-    /**
-     * Capture the per-session baseline NOW (before any edits land) by running the
-     * checkers once over the current project state. Every diagnostic present is
-     * recorded as pre-existing, so a later {@link newDiagnostics} surfaces only the
-     * problems the session's own edits introduced. Idempotent: a second call is a
-     * no-op once a baseline exists. Best-effort — never throws.
-     *
-     * Prefer calling this at session start (before the agent can edit anything); if
-     * it is never called, {@link newDiagnostics} falls back to seeding the baseline
-     * on its first invocation.
-     */
-    seedBaseline(signal?: AbortSignal): Promise<void>;
-    /**
-     * Run every checker, restrict the results to `editedPaths`, subtract the
-     * per-session baseline, dedup against prior turns, and volume-cap. Returns the
-     * NEW diagnostics for the edited files (empty when nothing new). Best-effort:
-     * never throws, never blocks beyond the configured timeout.
-     *
-     * The first invocation seeds the baseline from the current project state and
-     * returns `[]` (the pre-existing problems are the baseline, not "new").
-     */
-    newDiagnostics(editedPaths: readonly string[], signal?: AbortSignal): Promise<DiagnosticFile[]>;
-    /**
-     * Forget the delivered-key history for one uri so a problem at that file can
-     * re-surface (e.g. the agent edited it again). The baseline is left intact.
-     */
-    clearDeliveredForFile(uri: string): void;
-    /** Drop all cross-turn state and the baseline (re-seeds on the next run). */
-    reset(): void;
-}
-/** Whether a path looks like a TypeScript/JS source file (by extension). */
-export declare function isTypeScriptOrJs(filePath: string): boolean;
-/**
- * Whether the workspace has a `tsconfig.json` at its root — the signal used to
- * default the engine ON. Best-effort + synchronous: a probe failure (or a
- * non-Node context) reports `false` so the engine defaults OFF and stays inert.
- */
-export declare function hasTsConfig(cwd: string): boolean;
-/**
- * Whether the workspace has an eslint config at its root — the signal used to
- * additionally enable the eslint runner. Best-effort + synchronous.
- */
-export declare function hasEslintConfig(cwd: string): boolean;

package/dist/types/conductor/diagnostics.test.d.ts

@@ -1,10 +0,0 @@
-/**
- * Unit tests for the LSP-free post-edit diagnostics engine: the pure keying /
- * dedup / cap / render logic, the tsc + eslint output parsers, and the
- * baseline-diff behavior of {@link DiagnosticsEngine}.
- *
- * No network and no real `tsc`/`eslint` spawn — the engine is driven with
- * scripted in-memory runners so the baseline/diff/dedup logic is exercised
- * deterministically.
- */
-export {};

package/dist/types/conductor/index.d.ts

@@ -1,26 +0,0 @@
-/**
- * Conductor subsystem — public barrel.
- *
- * Re-exports the FROZEN Phase-2 contract: the product-level signal stream
- * ({@link SessionSignal}), the typed fault model ({@link ConductorFault} +
- * {@link conductorFault}), the on-disk transcript schema ({@link TranscriptEntry},
- * {@link SessionHead}, {@link TRANSCRIPT_SCHEMA}), the model catalog/matcher
- * reference types ({@link ModelCardRef}, {@link MatchQuery}), the immutable
- * state snapshot ({@link ConductorState}), and the {@link SessionConductor}
- * interface plus its {@link SessionConductorOptions}.
- *
- * Behavior modules (signal hub, transcript store, model catalog/matcher,
- * conductor factory, the conductor itself) are added to this barrel as they
- * land; consumers import the conductor surface from `src/conductor` rather than
- * reaching into individual modules.
- */
-export type { FaultKind, ConductorFault, SessionSignal, SignalKind, SignalOf, SignalHandler, TranscriptSchema, TranscriptRole, TranscriptEntry, SessionHead, ModelCardRef, MatchQuery, ConductorPhase, ConductorState, QueueMode, QueuedInput, SessionStats, ExecuteBashOptions, BashOutcome, SessionConductor, SessionConductorOptions, AgentMessage, AgentTool, CanUseToolFn, ThinkingLevel, Model, Usage, KnownProvider, PermissionMode, } from "./contract";
-export { conductorFault, TRANSCRIPT_SCHEMA } from "./contract";
-export { createSessionConductor, reduceState, noopCondense, type AgentLike, type ConductorDeps, type CondenseFn, type RetryPolicy, } from "./conductor";
-export { SignalHub, translateAgentEvent, type SignalHubOptions } from "./signal-hub";
-export { ModelCatalog, ModelMatcher, canonicalId, toCardRef, type CatalogCard, type CatalogSource, type ResolveInput, } from "./catalog";
-export { TranscriptStore, memoryBackend, fsBackend, replay, type TranscriptBackend, type TranscriptState, type TranscriptClock, type TranscriptStoreOptions, } from "./transcript-store";
-export { parseSkillInvocation, type SkillInvocation } from "./skill-parse";
-export { resolveRuleDecision, parseRule, makeRule, toolMatchesRule, createPermissionGate, isReadOnlyToolName, isEditToolName, READ_ONLY_TOOL_NAMES, EDIT_TOOL_NAMES, type PermissionBehavior, type PermissionRule, type PermissionDecision, type CanUseToolFn as PermissionCanUseToolFn, type ApprovalChoice, type ApprovalResolver, type PermissionGateConfig, } from "./permissions";
-export { parseBashCommand, catastrophicReason, isCatastrophicCommand, evaluateCatastrophic, bashSubcommandSubjects, type ParsedCommand, } from "./bash-guard";
-export { DiagnosticsEngine, createDiagnosticKey, deduplicateAndCap, formatDiagnosticsSummary, getSeveritySymbol, parseTscOutput, parseEslintOutput, runTscDiagnostics, runEslintDiagnostics, hasTsConfig, hasEslintConfig, isTypeScriptOrJs, areDiagnosticsEqual, MAX_PER_FILE, MAX_TOTAL, MAX_SUMMARY_CHARS, type Diagnostic, type DiagnosticFile, type DiagnosticSeverity, type DiagnosticsConfig, type DiagnosticRunner, type DedupOptions, type Position, } from "./diagnostics";

package/dist/types/conductor/permission-gate.integration.test.d.ts

@@ -1,22 +0,0 @@
-/**
- * Permission gate — integration against the REAL wired framework loop.
- *
- * The point of this suite (vs the pure {@link "./permissions.test"} unit tests) is
- * to prove the gate actually lands where tools execute. It drives a real
- * `indusagi/agent` `Agent` — the exact class the conductor's `makeAgent` wires —
- * with a scripted `streamFn` that has the model request a tool call, and the
- * SAME `createPermissionGate` output the conductor threads in as `canUseTool`.
- *
- * We assert through the framework's own message list (not a mock of an unwired
- * module):
- *   - a **deny** rule blocks the tool: it never executes, and the turn carries an
- *     `isError` tool result with the deny message (an unanswered tool_use would
- *     400 the next call, so the loop must still emit the result);
- *   - an **allow** rule (or read-only auto-allow) lets the tool execute;
- *   - **acceptEdits** auto-allows an edit without a rule;
- *   - **bypass** allows everything;
- *   - **plan** denies a mutating tool;
- *   - an **ask** with no host resolver denies (non-interactive default);
- *   - a live **mode switch** retargets subsequent calls with no agent rebuild.
- */
-export {};

package/dist/types/conductor/permission-wiring.test.d.ts

@@ -1,14 +0,0 @@
-/**
- * Conductor permission wiring — proves `createSessionConductor` threads the gate
- * factory and exposes live `permissionMode()` / `setPermissionMode()`.
- *
- * The end-to-end "gate blocks a real tool" proof lives in
- * {@link "./permission-gate.integration.test"} (it drives the real framework
- * loop). Here we pin the PRODUCT seam: the conductor (a) seeds the mode from
- * options, (b) updates it through `setPermissionMode`, and (c) hands the gate
- * factory a getter that reads the conductor's LIVE mode — so a mode switch after
- * assembly is visible to the gate with no agent rebuild. A scripted fake
- * `AgentLike` keeps it network/disk-free, and a separate check confirms the gate
- * factory IS resolved with a live-mode getter on the real-agent path.
- */
-export {};

package/dist/types/conductor/permissions.d.ts

@@ -1,217 +0,0 @@
-/**
- * Permission rule engine + the `canUseTool` gate seam.
- *
- * This module is the product-side brain of the permission stack. It is split in
- * two layers:
- *
- *   1. **A pure rule engine** — {@link resolveRuleDecision} maps a single tool
- *      call `(toolName, input, mode, rules)` to a {@link PermissionBehavior}
- *      (`allow` / `ask` / `deny`). It is total, synchronous, and side-effect free
- *      so the precedence (deny > ask > mode auto-allow > allow) is exhaustively
- *      unit-testable. Rule strings are induscode-style: a bare tool name
- *      (`"Bash"`) or a tool name with an argument specifier
- *      (`"Bash(npm run test:*)"`).
- *
- *   2. **A gate factory** — {@link createPermissionGate} turns that engine into a
- *      framework {@link CanUseToolFn}: the hard async hook the framework agent
- *      awaits immediately before every tool runs. An `ask` decision is routed to
- *      an OPTIONAL host-supplied approval resolver; when the resolver is absent
- *      (a non-interactive boot) `ask` denies with a clear message. An
- *      `allow-always` approval appends a session-scoped allow rule so later
- *      identical calls auto-allow.
- *
- * Backwards-compatibility: the framework `canUseTool` hook is itself optional, so
- * a session that never builds a gate keeps today's allow-all behavior. A gate
- * built from an empty rule set in `default` mode allows read-only tools and asks
- * for everything else — and, with no resolver, the `ask` denials are explicit
- * rather than silent.
- */
-import type { PermissionMode } from "../settings";
-/** Re-exported so consumers of the engine get the mode vocabulary in one import. */
-export type { PermissionMode };
-/** The verdict the rule engine renders for a single tool call. */
-export type PermissionBehavior = "allow" | "ask" | "deny";
-/**
- * One parsed permission rule: a behavior plus the tool it targets, with an
- * optional argument specifier (`ruleContent`) that further narrows the match.
- */
-export interface PermissionRule {
-    /** What happens when this rule matches a tool call. */
-    readonly ruleBehavior: PermissionBehavior;
-    /** The tool (and optional argument specifier) this rule selects. */
-    readonly ruleValue: {
-        /** The canonical tool name, e.g. `"Bash"` / `"bash"` (matched case-insensitively). */
-        readonly toolName: string;
-        /** An optional argument specifier, e.g. `"npm run test:*"`. Absent = bare match. */
-        readonly ruleContent?: string;
-    };
-}
-/**
- * The framework's tool-permission verdict. Mirrors `indusagi/agent`'s
- * `PermissionDecision`; re-declared here so the product engine never imports the
- * framework just for a structural type (the gate is assignable to the
- * framework's `CanUseToolFn` because the shapes coincide).
- */
-export type PermissionDecision = {
-    behavior: "allow";
-    updatedInput?: unknown;
-} | {
-    behavior: "deny";
-    message: string;
-};
-/**
- * The hard permission gate the framework agent awaits before each tool executes.
- * Structurally identical to `indusagi/agent`'s `CanUseToolFn`, so a value of this
- * type is accepted by `new Agent({ canUseTool })` with no cast.
- */
-export type CanUseToolFn = (toolName: string, input: unknown, opts: {
-    signal?: AbortSignal;
-}) => Promise<PermissionDecision>;
-/**
- * The outcome of the host approval prompt raised for an `ask` decision:
- *   - `allow-once`   — run this single call, do not remember.
- *   - `allow-always` — run it and append a session allow rule for the tool.
- *   - `deny`         — block this call.
- */
-export type ApprovalChoice = "allow-once" | "allow-always" | "deny";
-/**
- * The OPTIONAL host approval resolver. When present, an `ask` decision awaits it;
- * the host (an interactive overlay) returns the user's choice. It MUST resolve to
- * `"deny"` on abort so a cancelled turn never hangs on a pending prompt. When the
- * resolver is absent (non-interactive boot / oneshot / link), an `ask` decision
- * deterministically denies.
- */
-export type ApprovalResolver = (toolName: string, input: unknown, opts: {
-    signal?: AbortSignal;
-}) => Promise<ApprovalChoice>;
-/**
- * Tool names known to only inspect state (never mutate). Mirrors the framework's
- * `READ_ONLY_TOOL_NAMES`; matched case-insensitively. A tool the framework marks
- * `readOnly: true` is also auto-allowed via {@link createPermissionGate}'s
- * `readOnlyToolNames` option, so this set is the static fallback for callers that
- * only know names.
- */
-export declare const READ_ONLY_TOOL_NAMES: ReadonlySet<string>;
-/**
- * Tool names that mutate the workspace by editing or writing files. Auto-allowed
- * under `acceptEdits`, and (together with every other non-read-only tool) denied
- * under `plan`.
- */
-export declare const EDIT_TOOL_NAMES: ReadonlySet<string>;
-/** Whether `toolName` is a statically-known read-only tool. */
-export declare function isReadOnlyToolName(toolName: string, extra?: ReadonlySet<string>): boolean;
-/** Whether `toolName` is an edit/write tool (auto-allowed under `acceptEdits`). */
-export declare function isEditToolName(toolName: string): boolean;
-/**
- * Parse an induscode-style rule string into its tool name and optional argument
- * specifier.
- *
- *   - `"Bash"`                 → `{ toolName: "Bash" }`
- *   - `"Bash(npm run test:*)"` → `{ toolName: "Bash", ruleContent: "npm run test:*" }`
- *   - `"mcp__server"`          → `{ toolName: "mcp__server" }`
- *
- * Whitespace around the tool name is trimmed; an empty argument specifier
- * (`"Bash()"`) is treated as a bare rule.
- */
-export declare function parseRule(raw: string): {
-    toolName: string;
-    ruleContent?: string;
-};
-/**
- * Build a {@link PermissionRule} from a behavior and an induscode-style rule
- * string. The single place a raw settings list entry becomes a typed rule.
- */
-export declare function makeRule(ruleBehavior: PermissionBehavior, raw: string): PermissionRule;
-/**
- * Whether a tool call matches a rule (the ANY-match semantics used for deny/ask).
- *
- * The tool name must match (case-insensitive), with an `mcp__server` rule also
- * matching every `mcp__server__tool` under it (the induscode MCP-wildcard
- * convention). A bare rule (no specifier) matches any arguments.
- *
- * When the rule carries an argument specifier:
- *   - for the **shell** tool the command is split into its constituent
- *     sub-commands and the specifier is tested against EACH — a match on ANY
- *     sub-command counts (so `Bash(rm:*)` denies `git status && rm x`);
- *   - for any other tool the specifier is tested against the single rendered
- *     subject (the command field, or a JSON encoding).
- *
- * The any-match semantics are correct for `deny` and `ask` (a single offending
- * sub-command should trigger them). The `allow` branch needs ALL sub-commands
- * covered instead — see {@link bashAllowCoversAll}.
- */
-export declare function toolMatchesRule(toolName: string, input: unknown, rule: PermissionRule): boolean;
-/**
- * Resolve the behavior for a single tool call against the rule set and mode.
- *
- * Precedence, highest first:
- *   1. **deny rules** — any matching `deny` rule blocks, regardless of mode. Deny
- *      wins across every tier (the caller concatenates the tiers before passing
- *      the list in, and this scans all deny rules first).
- *   2. **plan mode** — denies any mutating (non-read-only) tool outright.
- *   3. **ask rules** — a matching `ask` rule forces a prompt (unless a deny
- *      already fired). Mode auto-allow does NOT override an explicit ask.
- *   4. **bypass mode** — allows everything not already denied/asked.
- *   5. **read-only auto-allow** — a known read-only tool allows in any mode.
- *   6. **acceptEdits mode** — auto-allows edit/write tools.
- *   7. **allow rules** — a matching `allow` rule (or, for the shell tool, the
- *      allow rule SET) allows.
- *   8. **fallthrough** — `ask` (the safe default: prompt, then deny when no
- *      resolver is wired).
- *
- * The catastrophic-command blocklist sits ABOVE all of this (step 0): a shell
- * command on the built-in blocklist (`rm -rf /`, fork bombs, `curl | sh`, …) is
- * denied regardless of rules or mode — even `bypass` cannot run it. See
- * {@link evaluateCatastrophic}.
- *
- * Shell handling threads through the per-sub-command matching: a compound
- * command (`a && b; c | d`) is split into its constituent commands and each rule
- * is evaluated against each — a deny/ask on ANY sub-command fires, while
- * auto-allow requires the allow rule set to cover EVERY sub-command.
- *
- * Pure and total: no I/O, no async, deterministic for a given input.
- */
-export declare function resolveRuleDecision(toolName: string, input: unknown, rules: readonly PermissionRule[], mode: PermissionMode, readOnlyExtra?: ReadonlySet<string>): PermissionBehavior;
-/** Configuration for {@link createPermissionGate}. */
-export interface PermissionGateConfig {
-    /**
-     * The ordered rule set, already concatenated across the project/global tiers.
-     * Deny rules are scanned first so a deny anywhere in the list wins.
-     */
-    readonly rules: readonly PermissionRule[];
-    /** A live getter for the current permission mode (so a mode switch is honored). */
-    readonly mode: () => PermissionMode;
-    /**
-     * The OPTIONAL host approval resolver consulted on an `ask` decision. Absent on
-     * a non-interactive boot — then `ask` deterministically denies.
-     */
-    readonly requestApproval?: ApprovalResolver;
-    /**
-     * Append a session-scoped allow rule when the host returns `allow-always`. The
-     * conductor owns the mutable rule list and passes a setter here so the new rule
-     * is visible to subsequent calls within the session.
-     */
-    readonly appendAllowRule?: (rule: PermissionRule) => void;
-    /**
-     * Tool names (beyond {@link READ_ONLY_TOOL_NAMES}) to treat as read-only —
-     * derived from the deck's `readOnly: true` tool flags so MCP/custom read-only
-     * tools also auto-allow.
-     */
-    readonly readOnlyToolNames?: ReadonlySet<string>;
-}
-/**
- * Build a framework {@link CanUseToolFn} from the rule engine + the current mode.
- *
- * The returned gate:
- *   - resolves the behavior via {@link resolveRuleDecision},
- *   - on `allow` proceeds (the framework keeps the validated args),
- *   - on `deny` short-circuits with a clear message (the framework turns it into
- *     an `isError` tool result so the model sees why),
- *   - on `ask` awaits {@link PermissionGateConfig.requestApproval} when present —
- *     `allow-once` proceeds, `allow-always` proceeds and appends a session allow
- *     rule, `deny` blocks — and DENIES when no resolver is wired (the safe
- *     non-interactive default).
- *
- * The result is assignable to `indusagi/agent`'s `CanUseToolFn`.
- */
-export declare function createPermissionGate(config: PermissionGateConfig): CanUseToolFn;

package/dist/types/conductor/permissions.test.d.ts

@@ -1,12 +0,0 @@
-/**
- * Permission rule engine + gate — unit tests.
- *
- * Exhaustively pins the pure decision ({@link resolveRuleDecision}) precedence
- * (deny > plan-deny > ask > bypass > read-only > acceptEdits > allow > ask
- * fallthrough), the induscode rule parsing/matching ({@link parseRule},
- * {@link toolMatchesRule}, including argument specifiers and the `mcp__` wildcard),
- * the mode behaviors, and the {@link createPermissionGate} `ask` routing — a host
- * resolver returns allow-once / allow-always (which appends a session allow rule)
- * / deny, and an ABSENT resolver denies. No framework, no network.
- */
-export {};

package/dist/types/conductor/plan-mode.integration.test.d.ts

@@ -1,23 +0,0 @@
-/**
- * Plan-mode round-trip — integration across the gate + the conductor handshake.
- *
- * Two proofs, against the REAL wired pieces (the rule engine's gate + the live
- * conductor), not mocks of an unwired module:
- *
- *   1. **The gate denies edits in plan mode.** A `createPermissionGate` whose mode
- *      getter reads the conductor's LIVE `permissionMode()` allows an edit in
- *      `default` mode, denies it once the conductor enters plan mode
- *      (`togglePlanMode(true)` / `setPermissionMode('plan')`), and allows it again
- *      once an approved exit restores the prior mode. This is the exact gate the
- *      conductor threads into the framework `Agent`, so the deny lands where tools
- *      execute.
- *
- *   2. **ExitPlanMode approval restores the mode, persists the plan, and resumes.**
- *      A scripted fake agent emits a `tool_execution_end` carrying the
- *      `{ exitPlan: true, plan }` detail the conductor intercepts. With an approval
- *      resolver installed that approves, a turn run while in plan mode: restores
- *      the captured pre-plan mode, writes the plan to a file under `plansDir`, and
- *      enqueues the approved plan as a follow-up so the model proceeds from it. A
- *      rejecting resolver keeps the session in plan mode and writes nothing.
- */
-export {};

package/dist/types/conductor/post-edit-diagnostics.test.d.ts

@@ -1,13 +0,0 @@
-/**
- * Conductor-integration tests for the post-edit live-diagnostics seam.
- *
- * Drives a scripted {@link AgentLike} that emits a `tool_execution_start` for an
- * `edit`/`write` tool during `prompt`, with an injected {@link DiagnosticsEngine}
- * over a scripted in-memory runner (no real tsc spawn). Verifies:
- *   - a turn that introduces a NEW diagnostic enqueues the summary follow-up;
- *   - a clean edit (no new diagnostics) enqueues nothing;
- *   - re-editing a file re-surfaces a previously-cleared diagnostic;
- *   - a non-TS edit never triggers the checker;
- *   - the injected follow-up turn (which edits nothing) does not loop.
- */
-export {};

package/dist/types/conductor/signal-hub/hub.d.ts

@@ -1,83 +0,0 @@
-/**
- * SignalHub — the conductor's product-event fan-out.
- *
- * A tiny, synchronous publish/subscribe bus over the {@link SessionSignal}
- * stream. The conductor owns one hub per session: behavior modules (the turn
- * loop, the persistence layer, the auto-condense pass) push signals in via
- * {@link SignalHub.emit}, and every registered consumer handler receives them in
- * registration order.
- *
- * Design (deliberately the conductor's own, not the framework's loop emitter):
- *   - Handlers live in an insertion-ordered `Set`, so registration order is the
- *     delivery order and duplicate handler identities collapse to one slot.
- *   - {@link SignalHub.subscribe} returns an unsubscribe thunk; calling it (even
- *     during a dispatch, even more than once) is safe and idempotent.
- *   - {@link SignalHub.emit} fans out over a *snapshot* of the handler set, so a
- *     handler that subscribes or unsubscribes mid-dispatch never corrupts the
- *     in-progress iteration — the change takes effect on the next emit.
- *   - A throwing handler is isolated: its error is routed to the optional
- *     {@link SignalHubOptions.onHandlerError} sink and the remaining handlers
- *     still run. One bad consumer never silences the others.
- *
- * The hub is transport-agnostic: it knows nothing about the framework `Agent`,
- * persistence, or how signals are produced. The {@link module:translate}
- * translator is what turns raw framework events into the {@link SessionSignal}s
- * that flow through here.
- */
-import type { SessionSignal, SignalHandler } from "../contract";
-/** Tuning hooks for a {@link SignalHub}. All optional. */
-export interface SignalHubOptions {
-    /**
-     * Invoked when a subscribed handler throws during {@link SignalHub.emit}.
-     *
-     * Lets the owner observe/log faults in consumer code without aborting the
-     * fan-out. If omitted, handler errors are swallowed so a misbehaving consumer
-     * cannot break signal delivery to the others. This sink is itself guarded —
-     * if it throws, the throw is ignored.
-     *
-     * @param error   the value the handler threw
-     * @param signal  the signal that was being delivered when it threw
-     */
-    readonly onHandlerError?: (error: unknown, signal: SessionSignal) => void;
-}
-/**
- * A synchronous fan-out bus for {@link SessionSignal}s.
- *
- * Construct one per session; subscribe consumers; emit signals. Not a framework
- * type and not wired to one — purely the conductor's own event surface.
- */
-export declare class SignalHub {
-    /** Insertion-ordered live set of subscribed handlers. */
-    private readonly handlers;
-    private readonly onHandlerError?;
-    constructor(options?: SignalHubOptions);
-    /**
-     * Register a handler to receive every subsequently emitted signal.
-     *
-     * Registering the same function reference twice is a no-op (the `Set`
-     * collapses it). The returned thunk removes the handler; it is idempotent and
-     * safe to call during a dispatch.
-     *
-     * @param handler the consumer callback
-     * @returns an unsubscribe function
-     */
-    subscribe(handler: SignalHandler): () => void;
-    /**
-     * Fan a signal out to every currently-subscribed handler, in registration
-     * order.
-     *
-     * Iterates a snapshot of the handler set, so subscribe/unsubscribe performed
-     * by a handler mid-dispatch affects only later emits. A throwing handler is
-     * isolated via {@link SignalHubOptions.onHandlerError}; the remaining handlers
-     * still run.
-     *
-     * @param signal the signal to deliver
-     */
-    emit(signal: SessionSignal): void;
-    /** Number of currently-subscribed handlers. */
-    get size(): number;
-    /** Remove every handler. Subsequent {@link emit} calls deliver to no one. */
-    clear(): void;
-    /** Route a handler error to the sink, guarding the sink itself. */
-    private report;
-}

package/dist/types/conductor/signal-hub/index.d.ts

@@ -1,19 +0,0 @@
-/**
- * signal-hub — the conductor's product-event hub + framework-event translator.
- *
- * Two cooperating pieces sitting between the framework `Agent` loop and the
- * conductor's consumers:
- *
- *   - {@link SignalHub} — a synchronous, insertion-ordered fan-out bus over the
- *     {@link SessionSignal} stream. Behavior modules emit into it; UI/print/RPC
- *     consumers subscribe to it.
- *   - {@link translateAgentEvent} — the pure projection that turns a single
- *     framework {@link AgentEvent} into the zero-or-more {@link SessionSignal}s
- *     that flow through the hub. {@link TRANSLATOR_TABLE} is the underlying,
- *     exhaustiveness-checked dispatch table (exported for inspection/testing).
- *
- * Typical wiring: subscribe the framework loop, run each raw event through
- * `translateAgentEvent`, and `emit` the results on a `SignalHub`.
- */
-export { SignalHub, type SignalHubOptions } from "./hub";
-export { translateAgentEvent, TRANSLATOR_TABLE } from "./translate";