indusagi-coding-agent 0.2.4 → 0.2.5

package/dist/types/conductor/diagnostics.d.ts

@@ -1,183 +0,0 @@
-/**
- * Post-edit live diagnostics — an LSP-free, shell-sourced baseline-diff engine.
- *
- * The full induscode story runs a long-lived LSP and pulls structured
- * diagnostics off the language server. That stack is out of scope for the
- * clean-room product, so this is the **pragmatic shell path**: after a turn that
- * edited TypeScript/JS files, the conductor asks this engine to run a project
- * checker (`tsc --noEmit`, plus `eslint --format json` when an eslint config is
- * present), scoped to the workspace, and diff the result against a *per-session
- * baseline* captured before the edits. Only the diagnostics that are genuinely
- * **new** (not in the baseline, not already delivered in a prior turn) are
- * surfaced, and they are injected into the NEXT agent turn as a follow-up note.
- *
- * Everything here is best-effort and non-fatal:
- *   - the checker spawns its OWN child process (lazy `node:child_process`), so
- *     the module stays importable in a non-Node test context;
- *   - a missing/slow/erroring checker NEVER faults the turn — the run is bounded
- *     by an {@link AbortController} timeout and every failure resolves to `[]`;
- *   - results are deduplicated and volume-capped (10/file, 30 total,
- *     severity-sorted) so a broken project can't dump hundreds of lines into
- *     context;
- *   - it is fully opt-out-able (`DiagnosticsConfig.enabled === false`) and
- *     defaults OFF when the workspace has no `tsconfig.json`.
- *
- * The line/column convention mirrors the LSP `Diagnostic.range`: 0-based.
- * `tsc` reports 1-based positions, so {@link runTscDiagnostics} subtracts 1 and
- * {@link formatDiagnosticsSummary} re-adds 1 when rendering for a human/agent.
- */
-/** Severity rank, ordered most→least urgent for the volume cap's sort. */
-export type DiagnosticSeverity = "Error" | "Warning" | "Info" | "Hint";
-/** A zero-based line/column position. */
-export interface Position {
-    readonly line: number;
-    readonly character: number;
-}
-/** A single diagnostic, shaped after the LSP `Diagnostic` (0-based range). */
-export interface Diagnostic {
-    readonly message: string;
-    readonly severity: DiagnosticSeverity;
-    readonly range: {
-        readonly start: Position;
-        readonly end: Position;
-    };
-    readonly source?: string;
-    readonly code?: string | number;
-}
-/** All diagnostics for one file, keyed by an absolute fs path used as the uri. */
-export interface DiagnosticFile {
-    readonly uri: string;
-    readonly diagnostics: Diagnostic[];
-}
-/** Max diagnostics surfaced for any single file (mirrors the LSP registry cap). */
-export declare const MAX_PER_FILE = 10;
-/** Max diagnostics surfaced across all files in one turn. */
-export declare const MAX_TOTAL = 30;
-/** Char budget for the rendered summary (truncated past this). */
-export declare const MAX_SUMMARY_CHARS = 4000;
-/**
- * A stable identity for one diagnostic: position + code + (trimmed) message.
- * Two diagnostics with the same key are "the same problem" for dedup/baseline
- * purposes even across separate checker runs.
- */
-export declare function createDiagnosticKey(d: Diagnostic): string;
-/** Structural equality over a diagnostic's salient fields (via the dedup key). */
-export declare function areDiagnosticsEqual(a: Diagnostic, b: Diagnostic): boolean;
-/** Options for {@link deduplicateAndCap}. */
-export interface DedupOptions {
-    readonly maxPerFile?: number;
-    readonly maxTotal?: number;
-}
-/**
- * Filter, deduplicate, severity-sort, and volume-cap a batch of diagnostic
- * files against a cross-turn `delivered` ledger.
- *
- *   - drops any diagnostic whose key is already in `delivered[uri]` (already
- *     surfaced in a prior turn — don't nag);
- *   - dedups within a file (identical keys collapse to one);
- *   - sorts each file's diagnostics by severity then position;
- *   - caps to `maxPerFile` per file and `maxTotal` overall (errors win the cap);
- *   - records every diagnostic it RETURNS into `delivered` (FIFO-capped per uri)
- *     so the next turn won't re-surface it.
- *
- * `delivered` is mutated in place. Files that end up empty are dropped.
- */
-export declare function deduplicateAndCap(files: readonly DiagnosticFile[], delivered: Map<string, Set<string>>, opts?: DedupOptions): DiagnosticFile[];
-/** Inline ASCII severity marker (no `figures` dep). */
-export declare function getSeveritySymbol(severity: DiagnosticSeverity): string;
-/**
- * Render a deduped/capped batch into a compact, agent-readable block. Positions
- * are re-converted to 1-based for display (the engine carries 0-based). The
- * output is truncated to `maxChars` so it can never blow up a context window.
- */
-export declare function formatDiagnosticsSummary(files: readonly DiagnosticFile[], maxChars?: number): string;
-/** A diagnostics source: produces files for the workspace, honoring `signal`. */
-export type DiagnosticRunner = (cwd: string, signal?: AbortSignal) => Promise<DiagnosticFile[]>;
-/**
- * Run a project `tsc --noEmit --pretty false` and parse the flat diagnostic
- * lines. Resolves to `[]` on ANY failure (binary missing, abort, non-Node).
- * The local `node_modules/.bin/tsc` is preferred over a global/`npx` install to
- * avoid a version mismatch with the project's own config.
- *
- * tsc lines look like: `src/x.ts(12,5): error TS2322: Type 'a' ...`
- * Positions are 1-based in tsc; we store them 0-based (subtract 1).
- */
-export declare function runTscDiagnostics(cwd: string, signal?: AbortSignal): Promise<DiagnosticFile[]>;
-/** Parse the combined stdout/stderr of a `tsc --pretty false` run. */
-export declare function parseTscOutput(output: string, cwd: string): DiagnosticFile[];
-/**
- * Run a project `eslint --format json` over `files` and parse the result.
- * Resolves to `[]` when eslint is absent, no config is found, or anything else
- * goes wrong. severity 2→Error, 1→Warning. Positions are 1-based; stored 0-based.
- */
-export declare function runEslintDiagnostics(files: readonly string[], cwd: string, signal?: AbortSignal): Promise<DiagnosticFile[]>;
-/** Parse `eslint --format json` output. Resolves config-not-found to `[]`. */
-export declare function parseEslintOutput(output: string, cwd: string): DiagnosticFile[];
-/** Configuration for the {@link DiagnosticsEngine}. */
-export interface DiagnosticsConfig {
-    /** Master switch. When `false` the engine reports nothing (opt-out). */
-    readonly enabled?: boolean;
-    /** The diagnostic sources to run. Defaults to `[runTscDiagnostics]`. */
-    readonly runners?: DiagnosticRunner[];
-    /** Per-run timeout in ms before the checker is aborted (default 30000). */
-    readonly timeoutMs?: number;
-    /** Per-file cap (default {@link MAX_PER_FILE}). */
-    readonly maxPerFile?: number;
-    /** Total cap (default {@link MAX_TOTAL}). */
-    readonly maxTotal?: number;
-}
-/**
- * The post-edit diagnostics engine: runs checkers, diffs against a per-session
- * baseline, and dedups across turns. Stateful and per-session — one instance
- * lives on the conductor for the life of a session.
- */
-export declare class DiagnosticsEngine {
-    #private;
-    constructor(cwd: string, config?: DiagnosticsConfig);
-    /** Whether this engine is active. */
-    get enabled(): boolean;
-    /** Whether the per-session baseline has already been captured. */
-    get hasBaseline(): boolean;
-    /**
-     * Capture the per-session baseline NOW (before any edits land) by running the
-     * checkers once over the current project state. Every diagnostic present is
-     * recorded as pre-existing, so a later {@link newDiagnostics} surfaces only the
-     * problems the session's own edits introduced. Idempotent: a second call is a
-     * no-op once a baseline exists. Best-effort — never throws.
-     *
-     * Prefer calling this at session start (before the agent can edit anything); if
-     * it is never called, {@link newDiagnostics} falls back to seeding the baseline
-     * on its first invocation.
-     */
-    seedBaseline(signal?: AbortSignal): Promise<void>;
-    /**
-     * Run every checker, restrict the results to `editedPaths`, subtract the
-     * per-session baseline, dedup against prior turns, and volume-cap. Returns the
-     * NEW diagnostics for the edited files (empty when nothing new). Best-effort:
-     * never throws, never blocks beyond the configured timeout.
-     *
-     * The first invocation seeds the baseline from the current project state and
-     * returns `[]` (the pre-existing problems are the baseline, not "new").
-     */
-    newDiagnostics(editedPaths: readonly string[], signal?: AbortSignal): Promise<DiagnosticFile[]>;
-    /**
-     * Forget the delivered-key history for one uri so a problem at that file can
-     * re-surface (e.g. the agent edited it again). The baseline is left intact.
-     */
-    clearDeliveredForFile(uri: string): void;
-    /** Drop all cross-turn state and the baseline (re-seeds on the next run). */
-    reset(): void;
-}
-/** Whether a path looks like a TypeScript/JS source file (by extension). */
-export declare function isTypeScriptOrJs(filePath: string): boolean;
-/**
- * Whether the workspace has a `tsconfig.json` at its root — the signal used to
- * default the engine ON. Best-effort + synchronous: a probe failure (or a
- * non-Node context) reports `false` so the engine defaults OFF and stays inert.
- */
-export declare function hasTsConfig(cwd: string): boolean;
-/**
- * Whether the workspace has an eslint config at its root — the signal used to
- * additionally enable the eslint runner. Best-effort + synchronous.
- */
-export declare function hasEslintConfig(cwd: string): boolean;

package/dist/types/conductor/diagnostics.test.d.ts

@@ -1,10 +0,0 @@
-/**
- * Unit tests for the LSP-free post-edit diagnostics engine: the pure keying /
- * dedup / cap / render logic, the tsc + eslint output parsers, and the
- * baseline-diff behavior of {@link DiagnosticsEngine}.
- *
- * No network and no real `tsc`/`eslint` spawn — the engine is driven with
- * scripted in-memory runners so the baseline/diff/dedup logic is exercised
- * deterministically.
- */
-export {};

package/dist/types/conductor/index.d.ts

@@ -1,26 +0,0 @@
-/**
- * Conductor subsystem — public barrel.
- *
- * Re-exports the FROZEN Phase-2 contract: the product-level signal stream
- * ({@link SessionSignal}), the typed fault model ({@link ConductorFault} +
- * {@link conductorFault}), the on-disk transcript schema ({@link TranscriptEntry},
- * {@link SessionHead}, {@link TRANSCRIPT_SCHEMA}), the model catalog/matcher
- * reference types ({@link ModelCardRef}, {@link MatchQuery}), the immutable
- * state snapshot ({@link ConductorState}), and the {@link SessionConductor}
- * interface plus its {@link SessionConductorOptions}.
- *
- * Behavior modules (signal hub, transcript store, model catalog/matcher,
- * conductor factory, the conductor itself) are added to this barrel as they
- * land; consumers import the conductor surface from `src/conductor` rather than
- * reaching into individual modules.
- */
-export type { FaultKind, ConductorFault, SessionSignal, SignalKind, SignalOf, SignalHandler, TranscriptSchema, TranscriptRole, TranscriptEntry, SessionHead, ModelCardRef, MatchQuery, ConductorPhase, ConductorState, QueueMode, QueuedInput, SessionStats, ExecuteBashOptions, BashOutcome, SessionConductor, SessionConductorOptions, CondenseOutcome, AgentMessage, AgentTool, CanUseToolFn, ThinkingLevel, Model, Usage, KnownProvider, PermissionMode, } from "./contract";
-export { conductorFault, TRANSCRIPT_SCHEMA } from "./contract";
-export { createSessionConductor, reduceState, noopCondense, withGatewayBaseUrl, type AgentLike, type ConductorDeps, type CondenseFn, type RetryPolicy, } from "./conductor";
-export { SignalHub, translateAgentEvent, type SignalHubOptions } from "./signal-hub";
-export { ModelCatalog, ModelMatcher, canonicalId, toCardRef, type CatalogCard, type CatalogSource, type ResolveInput, } from "./catalog";
-export { TranscriptStore, memoryBackend, fsBackend, replay, type TranscriptBackend, type TranscriptState, type TranscriptClock, type TranscriptStoreOptions, } from "./transcript-store";
-export { parseSkillInvocation, type SkillInvocation } from "./skill-parse";
-export { resolveRuleDecision, parseRule, makeRule, toolMatchesRule, createPermissionGate, createSubagentPermissionGate, collectReadOnlyToolNames, allowAlwaysRuleStrings, isReadOnlyToolName, isEditToolName, READ_ONLY_TOOL_NAMES, EDIT_TOOL_NAMES, type PermissionBehavior, type PermissionRule, type PermissionDecision, type CanUseToolFn as PermissionCanUseToolFn, type ApprovalChoice, type ApprovalOutcome, type ApprovalResolver, type PermissionGateConfig, type SessionPermissionPolicy, } from "./permissions";
-export { parseBashCommand, catastrophicReason, isCatastrophicCommand, evaluateCatastrophic, bashSubcommandSubjects, type ParsedCommand, } from "./bash-guard";
-export { DiagnosticsEngine, createDiagnosticKey, deduplicateAndCap, formatDiagnosticsSummary, getSeveritySymbol, parseTscOutput, parseEslintOutput, runTscDiagnostics, runEslintDiagnostics, hasTsConfig, hasEslintConfig, isTypeScriptOrJs, areDiagnosticsEqual, MAX_PER_FILE, MAX_TOTAL, MAX_SUMMARY_CHARS, type Diagnostic, type DiagnosticFile, type DiagnosticSeverity, type DiagnosticsConfig, type DiagnosticRunner, type DedupOptions, type Position, } from "./diagnostics";

package/dist/types/conductor/permission-gate.integration.test.d.ts

@@ -1,22 +0,0 @@
-/**
- * Permission gate — integration against the REAL wired framework loop.
- *
- * The point of this suite (vs the pure {@link "./permissions.test"} unit tests) is
- * to prove the gate actually lands where tools execute. It drives a real
- * `indusagi/agent` `Agent` — the exact class the conductor's `makeAgent` wires —
- * with a scripted `streamFn` that has the model request a tool call, and the
- * SAME `createPermissionGate` output the conductor threads in as `canUseTool`.
- *
- * We assert through the framework's own message list (not a mock of an unwired
- * module):
- *   - a **deny** rule blocks the tool: it never executes, and the turn carries an
- *     `isError` tool result with the deny message (an unanswered tool_use would
- *     400 the next call, so the loop must still emit the result);
- *   - an **allow** rule (or read-only auto-allow) lets the tool execute;
- *   - **acceptEdits** auto-allows an edit without a rule;
- *   - **bypass** allows everything;
- *   - **plan** denies a mutating tool;
- *   - an **ask** with no host resolver denies (non-interactive default);
- *   - a live **mode switch** retargets subsequent calls with no agent rebuild.
- */
-export {};

package/dist/types/conductor/permission-wiring.test.d.ts

@@ -1,14 +0,0 @@
-/**
- * Conductor permission wiring — proves `createSessionConductor` threads the gate
- * factory and exposes live `permissionMode()` / `setPermissionMode()`.
- *
- * The end-to-end "gate blocks a real tool" proof lives in
- * {@link "./permission-gate.integration.test"} (it drives the real framework
- * loop). Here we pin the PRODUCT seam: the conductor (a) seeds the mode from
- * options, (b) updates it through `setPermissionMode`, and (c) hands the gate
- * factory a getter that reads the conductor's LIVE mode — so a mode switch after
- * assembly is visible to the gate with no agent rebuild. A scripted fake
- * `AgentLike` keeps it network/disk-free, and a separate check confirms the gate
- * factory IS resolved with a live-mode getter on the real-agent path.
- */
-export {};

package/dist/types/conductor/permissions.d.ts

@@ -1,287 +0,0 @@
-/**
- * Permission rule engine + the `canUseTool` gate seam.
- *
- * This module is the product-side brain of the permission stack. It is split in
- * two layers:
- *
- *   1. **A pure rule engine** — {@link resolveRuleDecision} maps a single tool
- *      call `(toolName, input, mode, rules)` to a {@link PermissionBehavior}
- *      (`allow` / `ask` / `deny`). It is total, synchronous, and side-effect free
- *      so the precedence (deny > ask > mode auto-allow > allow) is exhaustively
- *      unit-testable. Rule strings are induscode-style: a bare tool name
- *      (`"Bash"`) or a tool name with an argument specifier
- *      (`"Bash(npm run test:*)"`).
- *
- *   2. **A gate factory** — {@link createPermissionGate} turns that engine into a
- *      framework {@link CanUseToolFn}: the hard async hook the framework agent
- *      awaits immediately before every tool runs. An `ask` decision is routed to
- *      an OPTIONAL host-supplied approval resolver; when the resolver is absent
- *      (a non-interactive boot) `ask` denies with a clear message. An
- *      `allow-always` approval appends a session-scoped allow rule so later
- *      identical calls auto-allow.
- *
- * Backwards-compatibility: the framework `canUseTool` hook is itself optional, so
- * a session that never builds a gate keeps today's allow-all behavior. A gate
- * built from an empty rule set in `default` mode allows read-only tools and asks
- * for everything else — and, with no resolver, the `ask` denials are explicit
- * rather than silent.
- */
-import type { PermissionMode } from "../settings";
-/** Re-exported so consumers of the engine get the mode vocabulary in one import. */
-export type { PermissionMode };
-/** The verdict the rule engine renders for a single tool call. */
-export type PermissionBehavior = "allow" | "ask" | "deny";
-/**
- * One parsed permission rule: a behavior plus the tool it targets, with an
- * optional argument specifier (`ruleContent`) that further narrows the match.
- */
-export interface PermissionRule {
-    /** What happens when this rule matches a tool call. */
-    readonly ruleBehavior: PermissionBehavior;
-    /** The tool (and optional argument specifier) this rule selects. */
-    readonly ruleValue: {
-        /** The canonical tool name, e.g. `"Bash"` / `"bash"` (matched case-insensitively). */
-        readonly toolName: string;
-        /** An optional argument specifier, e.g. `"npm run test:*"`. Absent = bare match. */
-        readonly ruleContent?: string;
-    };
-}
-/**
- * The framework's tool-permission verdict. Mirrors `indusagi/agent`'s
- * `PermissionDecision`; re-declared here so the product engine never imports the
- * framework just for a structural type (the gate is assignable to the
- * framework's `CanUseToolFn` because the shapes coincide).
- */
-export type PermissionDecision = {
-    behavior: "allow";
-    updatedInput?: unknown;
-} | {
-    behavior: "deny";
-    message: string;
-};
-/**
- * The hard permission gate the framework agent awaits before each tool executes.
- * Structurally identical to `indusagi/agent`'s `CanUseToolFn`, so a value of this
- * type is accepted by `new Agent({ canUseTool })` with no cast.
- */
-export type CanUseToolFn = (toolName: string, input: unknown, opts: {
-    signal?: AbortSignal;
-}) => Promise<PermissionDecision>;
-/**
- * The outcome of the host approval prompt raised for an `ask` decision:
- *   - `allow-once`   — run this single call, do not remember.
- *   - `allow-always` — run it and append a session allow rule for the tool.
- *   - `deny`         — block this call.
- */
-export type ApprovalChoice = "allow-once" | "allow-always" | "deny";
-/**
- * What an {@link ApprovalResolver} may resolve to: a user's {@link ApprovalChoice},
- * or `"unavailable"` — the conductor's stable delegate answers that when NO
- * interactive resolver is installed behind it (a headless boot, or the console not
- * yet mounted). The gate maps `"unavailable"` to the actionable "requires
- * approval" deny (pointing at `--permission-mode` / settings allow rules) rather
- * than the "denied by the user" message, which would be false when no user ever
- * saw a prompt.
- */
-export type ApprovalOutcome = ApprovalChoice | "unavailable";
-/**
- * The OPTIONAL host approval resolver. When present, an `ask` decision awaits it;
- * the host (an interactive overlay) returns the user's choice. It MUST resolve to
- * `"deny"` on abort so a cancelled turn never hangs on a pending prompt. When the
- * resolver is absent (non-interactive boot / oneshot / link), an `ask` decision
- * deterministically denies. A stable pass-through delegate (the conductor's)
- * resolves `"unavailable"` while no real resolver is installed behind it, so the
- * gate can surface the actionable non-interactive deny message instead of a
- * fictitious user denial.
- */
-export type ApprovalResolver = (toolName: string, input: unknown, opts: {
-    signal?: AbortSignal;
-}) => Promise<ApprovalOutcome>;
-/**
- * Tool names known to only inspect state (never mutate). Mirrors the framework's
- * `READ_ONLY_TOOL_NAMES`; matched case-insensitively. A tool the framework marks
- * `readOnly: true` is also auto-allowed via {@link createPermissionGate}'s
- * `readOnlyToolNames` option, so this set is the static fallback for callers that
- * only know names.
- */
-export declare const READ_ONLY_TOOL_NAMES: ReadonlySet<string>;
-/**
- * Tool names that mutate the workspace by editing or writing files. Auto-allowed
- * under `acceptEdits`, and (together with every other non-read-only tool) denied
- * under `plan`.
- */
-export declare const EDIT_TOOL_NAMES: ReadonlySet<string>;
-/** Whether `toolName` is a statically-known read-only tool. */
-export declare function isReadOnlyToolName(toolName: string, extra?: ReadonlySet<string>): boolean;
-/** Whether `toolName` is an edit/write tool (auto-allowed under `acceptEdits`). */
-export declare function isEditToolName(toolName: string): boolean;
-/**
- * Parse an induscode-style rule string into its tool name and optional argument
- * specifier.
- *
- *   - `"Bash"`                 → `{ toolName: "Bash" }`
- *   - `"Bash(npm run test:*)"` → `{ toolName: "Bash", ruleContent: "npm run test:*" }`
- *   - `"mcp__server"`          → `{ toolName: "mcp__server" }`
- *
- * Whitespace around the tool name is trimmed; an empty argument specifier
- * (`"Bash()"`) is treated as a bare rule.
- */
-export declare function parseRule(raw: string): {
-    toolName: string;
-    ruleContent?: string;
-};
-/**
- * Build a {@link PermissionRule} from a behavior and an induscode-style rule
- * string. The single place a raw settings list entry becomes a typed rule.
- */
-export declare function makeRule(ruleBehavior: PermissionBehavior, raw: string): PermissionRule;
-/**
- * Whether a tool call matches a rule (the ANY-match semantics used for deny/ask).
- *
- * The tool name must match (case-insensitive), with an `mcp__server` rule also
- * matching every `mcp__server__tool` under it (the induscode MCP-wildcard
- * convention). A bare rule (no specifier) matches any arguments.
- *
- * When the rule carries an argument specifier:
- *   - for the **shell** tool the command is split into its constituent
- *     sub-commands and the specifier is tested against EACH — a match on ANY
- *     sub-command counts (so `Bash(rm:*)` denies `git status && rm x`);
- *   - for any other tool the specifier is tested against the single rendered
- *     subject (the command field, or a JSON encoding).
- *
- * The any-match semantics are correct for `deny` and `ask` (a single offending
- * sub-command should trigger them). The `allow` branch needs ALL sub-commands
- * covered instead — see {@link bashAllowCoversAll}.
- */
-export declare function toolMatchesRule(toolName: string, input: unknown, rule: PermissionRule): boolean;
-/**
- * Resolve the behavior for a single tool call against the rule set and mode.
- *
- * Precedence, highest first:
- *   1. **deny rules** — any matching `deny` rule blocks, regardless of mode. Deny
- *      wins across every tier (the caller concatenates the tiers before passing
- *      the list in, and this scans all deny rules first).
- *   2. **plan mode** — denies any mutating (non-read-only) tool outright.
- *   3. **ask rules** — a matching `ask` rule forces a prompt (unless a deny
- *      already fired). Mode auto-allow does NOT override an explicit ask.
- *   4. **bypass mode** — allows everything not already denied/asked.
- *   5. **read-only auto-allow** — a known read-only tool allows in any mode.
- *   6. **acceptEdits mode** — auto-allows edit/write tools.
- *   7. **allow rules** — a matching `allow` rule (or, for the shell tool, the
- *      allow rule SET) allows.
- *   8. **fallthrough** — `ask` (the safe default: prompt, then deny when no
- *      resolver is wired).
- *
- * The catastrophic-command blocklist sits ABOVE all of this (step 0): a shell
- * command on the built-in blocklist (`rm -rf /`, fork bombs, `curl | sh`, …) is
- * denied regardless of rules or mode — even `bypass` cannot run it. See
- * {@link evaluateCatastrophic}.
- *
- * Shell handling threads through the per-sub-command matching: a compound
- * command (`a && b; c | d`) is split into its constituent commands and each rule
- * is evaluated against each — a deny/ask on ANY sub-command fires, while
- * auto-allow requires the allow rule set to cover EVERY sub-command.
- *
- * Pure and total: no I/O, no async, deterministic for a given input.
- */
-export declare function resolveRuleDecision(toolName: string, input: unknown, rules: readonly PermissionRule[], mode: PermissionMode, readOnlyExtra?: ReadonlySet<string>): PermissionBehavior;
-/**
- * The rule strings an `allow-always` approval mints — i.e. what the session will
- * REMEMBER for this tool call.
- *
- * For the shell tool the remembered rules are scoped to the command: one
- * `Bash(<sub-command>)` rule per constituent sub-command (so approving
- * `git status && npm test` remembers both halves, and re-running either — or the
- * same compound — auto-allows), but approving one command never whitelists the
- * whole shell. Every other tool remembers the bare tool name (`Edit`), matching
- * the prompt's "remember the tool for this session" copy.
- *
- * Exported so the approval overlay can show the user exactly what "Allow always"
- * will remember (the `suggestions` line), and so the gate and the UI can never
- * disagree about it.
- */
-export declare function allowAlwaysRuleStrings(toolName: string, input: unknown): string[];
-/** Configuration for {@link createPermissionGate}. */
-export interface PermissionGateConfig {
-    /**
-     * The ordered rule set, already concatenated across the project/global tiers.
-     * Deny rules are scanned first so a deny anywhere in the list wins.
-     */
-    readonly rules: readonly PermissionRule[];
-    /** A live getter for the current permission mode (so a mode switch is honored). */
-    readonly mode: () => PermissionMode;
-    /**
-     * The OPTIONAL host approval resolver consulted on an `ask` decision. Absent on
-     * a non-interactive boot — then `ask` deterministically denies.
-     */
-    readonly requestApproval?: ApprovalResolver;
-    /**
-     * Append a session-scoped allow rule when the host returns `allow-always`. The
-     * boot layer owns the mutable rule list (the SAME array instance `rules` refers
-     * to) and passes a push here, so the appended rule is visible to every
-     * subsequent gate consultation within the session — and to every other gate
-     * built over the same list (sub-agent gates included). Session-scoped only:
-     * the rule is never persisted to settings.
-     */
-    readonly appendAllowRule?: (rule: PermissionRule) => void;
-    /**
-     * Tool names (beyond {@link READ_ONLY_TOOL_NAMES}) to treat as read-only —
-     * derived from the deck's `readOnly: true` tool flags so MCP/custom read-only
-     * tools also auto-allow.
-     */
-    readonly readOnlyToolNames?: ReadonlySet<string>;
-}
-/**
- * Build a framework {@link CanUseToolFn} from the rule engine + the current mode.
- *
- * The returned gate:
- *   - resolves the behavior via {@link resolveRuleDecision},
- *   - on `allow` proceeds (the framework keeps the validated args),
- *   - on `deny` short-circuits with a clear message (the framework turns it into
- *     an `isError` tool result so the model sees why),
- *   - on `ask` awaits {@link PermissionGateConfig.requestApproval} when present —
- *     `allow-once` proceeds, `allow-always` proceeds and appends a session allow
- *     rule, `deny` blocks — and DENIES when no resolver is wired (the safe
- *     non-interactive default).
- *
- * The result is assignable to `indusagi/agent`'s `CanUseToolFn`.
- */
-export declare function createPermissionGate(config: PermissionGateConfig): CanUseToolFn;
-/**
- * The live permission policy a session shares with its sub-agent runners (the
- * `task` and `workflow` tools): the SAME mutable rule list the parent gate reads
- * — so a session-scoped `allow-always` rule and the settings deny/ask rules are
- * enforced inside delegations too — plus a live getter onto the parent
- * conductor's permission mode, so a mid-run Shift+Tab (bypass → default, plan,
- * back to bypass, …) retargets the very next sub-agent tool call.
- */
-export interface SessionPermissionPolicy {
-    /** The session's ordered rule list — the live array, never a snapshot. */
-    readonly rules: readonly PermissionRule[];
-    /** Live getter onto the parent session's current permission mode. */
-    readonly mode: () => PermissionMode;
-}
-/**
- * Collect the names of every tool flagged `readOnly: true` (structurally probed,
- * so any deck/framework/MCP tool shape works). These names are auto-allowed by
- * the gate in `default`/`acceptEdits`/`plan` beyond the static
- * {@link READ_ONLY_TOOL_NAMES}.
- */
-export declare function collectReadOnlyToolNames(tools: ReadonlyArray<{
-    readonly name: string;
-}>): ReadonlySet<string>;
-/**
- * Build the RESOLVER-LESS gate a sub-agent runs under.
- *
- * A sub-agent cannot prompt the user, so no {@link ApprovalResolver} is wired:
- * an `ask` decision deterministically denies with an actionable message, while
- * deny rules, plan-mode enforcement, the catastrophic-bash blocklist, read-only
- * auto-allow, and bypass/acceptEdits behaviour all apply per inner tool call —
- * against the LIVE parent mode, so mid-run mode switches reach delegations too.
- *
- * @param policy the session's shared rules + live mode getter
- * @param tools  the sub-agent's actual deck, probed for `readOnly: true` flags
- */
-export declare function createSubagentPermissionGate(policy: SessionPermissionPolicy, tools: ReadonlyArray<{
-    readonly name: string;
-}>): CanUseToolFn;

package/dist/types/conductor/permissions.test.d.ts

@@ -1,12 +0,0 @@
-/**
- * Permission rule engine + gate — unit tests.
- *
- * Exhaustively pins the pure decision ({@link resolveRuleDecision}) precedence
- * (deny > plan-deny > ask > bypass > read-only > acceptEdits > allow > ask
- * fallthrough), the induscode rule parsing/matching ({@link parseRule},
- * {@link toolMatchesRule}, including argument specifiers and the `mcp__` wildcard),
- * the mode behaviors, and the {@link createPermissionGate} `ask` routing — a host
- * resolver returns allow-once / allow-always (which appends a session allow rule)
- * / deny, and an ABSENT resolver denies. No framework, no network.
- */
-export {};

package/dist/types/conductor/plan-mode.integration.test.d.ts

@@ -1,23 +0,0 @@
-/**
- * Plan-mode round-trip — integration across the gate + the conductor handshake.
- *
- * Two proofs, against the REAL wired pieces (the rule engine's gate + the live
- * conductor), not mocks of an unwired module:
- *
- *   1. **The gate denies edits in plan mode.** A `createPermissionGate` whose mode
- *      getter reads the conductor's LIVE `permissionMode()` allows an edit in
- *      `default` mode, denies it once the conductor enters plan mode
- *      (`togglePlanMode(true)` / `setPermissionMode('plan')`), and allows it again
- *      once an approved exit restores the prior mode. This is the exact gate the
- *      conductor threads into the framework `Agent`, so the deny lands where tools
- *      execute.
- *
- *   2. **ExitPlanMode approval restores the mode, persists the plan, and resumes.**
- *      A scripted fake agent emits a `tool_execution_end` carrying the
- *      `{ exitPlan: true, plan }` detail the conductor intercepts. With an approval
- *      resolver installed that approves, a turn run while in plan mode: restores
- *      the captured pre-plan mode, writes the plan to a file under `plansDir`, and
- *      enqueues the approved plan as a follow-up so the model proceeds from it. A
- *      rejecting resolver keeps the session in plan mode and writes nothing.
- */
-export {};

package/dist/types/conductor/post-edit-diagnostics.test.d.ts

@@ -1,18 +0,0 @@
-/**
- * Conductor-integration tests for the post-edit live-diagnostics seam.
- *
- * Drives a scripted {@link AgentLike} that emits a `tool_execution_start` for an
- * `edit`/`write` tool during `prompt`, with an injected {@link DiagnosticsEngine}
- * over a scripted in-memory runner (no real tsc spawn). Verifies:
- *   - a turn that introduces a NEW diagnostic enqueues the summary follow-up;
- *   - a clean edit (no new diagnostics) enqueues nothing;
- *   - a still-unfixed diagnostic is delivered AT MOST ONCE per session — a
- *     follow-up turn whose "fix" edits fail to eliminate the same error must
- *     NOT be re-prompted with it (the endless self-continuation of issue #15);
- *   - even genuinely NEW errors per fix attempt stop re-prompting at the
- *     consecutive follow-up cap, and a fresh user prompt re-arms the budget;
- *   - `idle` is not emitted between a turn and its auto-drained follow-up (the
- *     spinner must not drop while the agent keeps working);
- *   - a non-TS edit never triggers the checker.
- */
-export {};

package/dist/types/conductor/quota-error.d.ts

@@ -1,35 +0,0 @@
-/**
- * quota-error.ts — maps the indus model-gateway's usage-limit response into a
- * friendly, user-facing fault message.
- *
- * When a no-local-key, logged-in user runs a turn, the framework adapter is
- * pointed at `${INDUS_SERVER_URL}/gateway/<provider>` (see the conductor's
- * baseUrl rewrite). If that user is over their monthly token allowance, the
- * server replies — *before* forwarding upstream — with:
- *
- *   HTTP/1.1 429 Too Many Requests
- *   Content-Type: application/json
- *
- *   { "error": "quota_exceeded", "used": <number>, "limit": <number> }
- *
- * The provider SDK / raw-fetch adapter turns that 429 into a thrown error. By
- * the time it reaches the conductor it may be wrapped (an SDK `APIError`, a
- * generic `Error`, a nested `cause` chain, or a plain string), so detection must
- * be tolerant and walk the whole error chain rather than trust a single shape.
- *
- * This module is intentionally transport-agnostic and dependency-free so it can
- * be unit-tested in isolation and imported from the conductor's retry chokepoint
- * without pulling in any network/runtime modules.
- */
-/** Detects the gateway's 429 quota body anywhere in the error chain. */
-export declare function isQuotaFault(error: unknown): boolean;
-/**
- * Friendly user-facing text; `undefined` if `error` is not a quota fault.
- *
- * Includes the `<used>/<limit>` parenthetical when both numbers are parseable,
- * and otherwise falls back to the same sentence without it. The `indus signin
- * <provider>` hint steers the user toward supplying their own key (which takes
- * the direct, un-metered local-key path), and the upgrade hint covers raising
- * the server-side allowance.
- */
-export declare function quotaErrorMessage(error: unknown): string | undefined;