indusagi-coding-agent 0.2.4 → 0.2.8

package/dist/types/boot/runners/server-mode.d.ts

@@ -1,71 +0,0 @@
-/**
- * Boot helper: decide whether a provider runs in **server mode** (Case B).
- *
- * A model turn takes one of three paths (see LOGIN_GATEWAY_PLAN.md §1):
- *   - **A. Local key** — a usable key for the provider is stored in the on-disk
- *     auth vault (or exported in the environment). The framework calls the
- *     provider directly; behaviour is unchanged and this module returns
- *     `{ serverMode: false }`.
- *   - **B. Server tier** — the provider is gateway-eligible, the user has **no**
- *     usable local key, and they hold a **valid server token**. The session token
- *     is vended as the provider "key" and the model is re-routed through the indus
- *     gateway. This module returns `{ serverMode: true, token }`.
- *   - **C. Blocked** — no local key and no valid token: `{ serverMode: false }`
- *     (the resolver then falls through to the framework's own env lookup, which
- *     surfaces the usual "no API key" guidance pointing at `indus login`).
- *
- * The two consumers in {@link file://./session.ts} call this with the SAME
- * `(ctx, provider, vault)` triple so the key-resolver fallback and the
- * gateway-base-url computation always agree on whether server mode is active.
- */
-import type { BootContext } from "../contract";
-import type { AuthVault } from "../../launch/contract";
-/**
- * The outcome of {@link resolveServerMode}: whether the provider should route
- * through the gateway this run, and (when so) the session token to hand back as
- * the provider api key.
- */
-export interface ServerModeResult {
-    /** `true` => bind the gateway base url and use {@link token} as the key. */
-    serverMode: boolean;
-    /** The session token (`access_token`) to vend as the key, when `serverMode`. */
-    token?: string;
-}
-/**
- * Whether `provider` may be routed through the indus gateway. Excludes the
- * non-portable providers (vertex / bedrock / codex) and the deferred opencode
- * `anthropic-messages` api per the §B.4 caveat.
- */
-export declare function isGatewayEligibleProvider(provider: string): boolean;
-/** The server-tier provider slugs (for default-model selection / listing). */
-export declare function serverTierProviders(): readonly string[];
-/**
- * Decide whether `provider` runs in server mode for this session.
- *
- * Server mode is active when ALL hold:
- *   1. {@link isGatewayEligibleProvider}(provider) — excludes vertex/bedrock/codex
- *      and the deferred opencode `anthropic-messages` api (§B.4);
- *   2. no EXPLICIT local key — the vault holds no usable key for the provider
- *      (an ambient env var is intentionally ignored for server-tier providers);
- *   3. {@link hasValidServerToken}() — a stored, non-expired server token exists.
- *
- * Returns `{ serverMode: false }` whenever any condition fails, so the
- * local-key (Case A) path is preserved byte-for-byte: the resolver then returns
- * `undefined` and no gateway base url is bound.
- *
- * @param _ctx the boot context (reserved for future per-run policy; the vault is
- *   passed explicitly so callers share one instance)
- * @param provider the framework provider slug to evaluate
- * @param vault the on-disk credential vault to probe for a local key
- */
-export declare function resolveServerMode(_ctx: BootContext, provider: string, vault: AuthVault): Promise<ServerModeResult>;
-/**
- * Build the per-provider gateway base-url map for THIS session: for every
- * gateway-eligible provider currently in server mode (no explicit local key +
- * valid token), map `provider -> ${INDUS_SERVER_URL}/gateway/${provider}`.
- *
- * The conductor consults this map at EVERY model bind — including a runtime
- * `/model` switch — so selecting ANY server-tier model (not just the one the
- * session launched on) routes through the gateway. Empty when nothing qualifies.
- */
-export declare function resolveServerGatewayUrls(ctx: BootContext, vault: AuthVault): Promise<Record<string, string>>;

package/dist/types/boot/runners/session-persist.test.d.ts

@@ -1,10 +0,0 @@
-/**
- * Integration test for session persistence + resume.
- *
- * Proves the loop that `-r` / `-c` depend on: a conductor built with a
- * `sessionsDir` writes the transcript to a cwd-scoped `.ndjson` on disk, the
- * {@link SessionLibrary} (what the resume flags read) finds it, and a fresh
- * conductor can `resume` it by id. Before this wiring the conductor defaulted to
- * an in-memory store, so nothing was ever saved and resume found nothing.
- */
-export {};

package/dist/types/boot/runners/session.d.ts

@@ -1,88 +0,0 @@
-/**
- * Boot helper: assemble a {@link SessionConductor} for a non-interactive runner.
- *
- * Both the oneshot and the link runners drive a live conductor; this module owns
- * the one place that turns a {@link BootContext} into one, so the two runners do
- * not each re-derive the model id and session options. The model is taken from
- * the invocation when supplied, else resolved to the catalog default through the
- * {@link ModelMatcher}; the conductor itself is built lazily so no framework agent
- * is constructed until the first turn runs.
- */
-import { type AgentTool, type ApprovalResolver, type CanUseToolFn, type PermissionMode, type PermissionRule, type SessionConductor } from "../../conductor";
-import { type MemoryStore } from "../../capability-deck";
-import { type DelegateRunner } from "../../capability-deck/cards/task-card";
-import type { WorkflowAgentRunner } from "../../workflow-engine";
-import { type CheckpointStore } from "./checkpoint";
-import { type ContextDoc, type SkillCard } from "../../briefing";
-import type { BootContext, Invocation } from "../contract";
-/**
- * Resolve the model id for this run.
- *
- * Precedence: an explicit `--model` selector wins; otherwise a current model of a
- * provider the user has authenticated for (so a fresh launch lands on a model the
- * stored key can actually call); otherwise the catalog default.
- *
- * @param ctx the boot context carrying the parsed invocation
- * @returns the canonical model id to bind the session to
- */
-export declare function resolveModelId(ctx: BootContext): string;
-/**
- * Gather the on-disk skill cards the model may invoke this run: walk the project
- * and user `.indusagi/skills` roots and drop any card flagged
- * `disable-model-invocation` (those stay loadable explicitly, but the model is
- * not told about them). A filesystem walk error degrades to an empty list so a
- * bad/unreadable skills dir never sinks the session.
- */
-export declare function gatherModelSkills(cwd: string): SkillCard[];
-export declare function selectTools(cwd: string, inv: Invocation, runner?: DelegateRunner, memoryStore?: MemoryStore, checkpoint?: CheckpointStore, workflowRunner?: WorkflowAgentRunner): AgentTool[];
-/**
- * Compose the run's system prompt: `--system` replaces the built-in briefing,
- * `--append-system` adds a trailing block, and both compose (override then
- * append). With neither, it is the tool-aware built-in briefing.
- */
-export declare function composeSystem(tools: AgentTool[], inv: Invocation, cwd: string, skills?: readonly SkillCard[], memoryDoc?: ContextDoc): string;
-/**
- * The cwd-scoped session directory under the workspace `sessions/` root.
- *
- * Sessions are partitioned per working directory (so `--continue` means "the most
- * recent session in THIS directory"). The cwd is slugged — every non-alphanumeric
- * run collapsed to a single dash — and wrapped in `--…--` markers, matching the
- * on-disk layout. Both the conductor (writer) and {@link SessionLibrary} (reader)
- * must agree on this, so it lives here and is shared by the repl runner.
- *
- * @param sessionsRoot the workspace `sessions/` directory
- * @param cwd          the run's working directory
- */
-export declare function sessionScopeDir(sessionsRoot: string, cwd: string): string;
-/**
- * Build the `canUseTool` gate factory for a boot run.
- *
- * The factory receives a getter onto the conductor's LIVE permission mode plus the
- * conductor's stable approval delegate, and returns the gate that reads them. The
- * delegate is threaded straight into `requestApproval`: on a NON-interactive boot
- * (oneshot / link) no resolver is ever installed, so the delegate denies and an
- * `ask` decision deterministically denies with an actionable message. The
- * interactive (React) console installs its overlay resolver via the conductor's
- * `setApprovalResolver` AFTER mount, at which point the SAME delegate begins
- * routing `ask` decisions to the overlay — no rebuild, fully additive.
- *
- * `rules` is the session's LIVE mutable rule list: the gate re-scans it on every
- * call, and an `allow-always` approval appends into it (via `appendAllowRule`
- * below), so the approval is remembered for the remainder of the session — and
- * ONLY the session; nothing is ever written back to settings. Every gate the
- * factory mints (and every sub-agent gate built over the same array) sees the
- * appended rules immediately.
- *
- * Exported for the boot tests; product callers go through
- * {@link buildSessionConductor}.
- */
-export declare function buildPermissionGate(rules: PermissionRule[], mode: PermissionMode, tools: readonly AgentTool[], planReachable?: boolean): ((currentMode: () => PermissionMode, requestApproval?: ApprovalResolver) => CanUseToolFn) | undefined;
-export declare function buildSessionConductor(ctx: BootContext): Promise<SessionConductor>;
-/**
- * The prompts a oneshot run submits: the positional first prompt when present,
- * plus any pass-through tokens that survived flag parsing. Empty when the
- * invocation carried no request text (the caller decides what to do then).
- *
- * @param ctx the boot context carrying the parsed invocation
- */
-export declare function oneshotPrompts(ctx: BootContext): string[];

package/dist/types/boot/runners/session.test.d.ts

@@ -1,15 +0,0 @@
-/**
- * Skills-surface wiring (#7 / fixes #11) + the boot permission-gate factory.
- *
- * Proves the chain that makes on-disk `SKILL.md` cards visible to the model:
- * `gatherModelSkills` walks `cwd/.indusagi/skills`, drops any card flagged
- * `disable-model-invocation`, and the survivors render into the briefing's
- * `<available_skills>` block via `composeSystem`. A `--system` override must NOT
- * carry the skills block (it replaces the whole prompt).
- *
- * `buildPermissionGate` is pinned here too: default mode ALWAYS builds a gate
- * (only a rule-less bypass boot with plan unreachable goes gate-free), and the
- * factory wires `appendAllowRule` into the live rule list so an `allow-always`
- * approval is remembered for the remainder of the session (B2).
- */
-export {};

package/dist/types/boot/server-token.d.ts

@@ -1,97 +0,0 @@
-/**
- * Server-token store — the boot-layer persistence for the indus device-login
- * session token. This is the app side of the login + model-gateway contract: a
- * successful `indus login` device flow writes the better-auth session token
- * here, and the key resolver later reads it back to drive "server mode" (Case B
- * — no local provider key, but a valid server session, so requests are routed
- * through the indus-server gateway with the session token as the api key).
- *
- * The token lives in a single JSON file under the app's profile directory
- * (`~/.indusagi/agent/server-token.json`) — deliberately NOT the framework's
- * `~/.better-auth` location, so the CLI session is isolated from any other
- * tooling. As with the credential vault, the file is tiny and access is
- * interactive, so we read / write the whole file each time and tolerate a
- * missing or malformed file as "no token".
- *
- * Ported from supercli `server/src/lib/token.ts`; the load-bearing detail is the
- * `expires_in` (seconds, from the device-flow response) → `expires_at` (absolute
- * ISO timestamp, on disk) conversion, which lets {@link isServerTokenExpired}
- * decide freshness without re-deriving the clock offset.
- */
-/**
- * Root of the indus-server. Used to build the gateway base URL and the
- * device-login endpoints. Any trailing slash(es) are stripped so callers can
- * append paths with a single separator.
- */
-export declare const INDUS_SERVER_URL: string;
-/** The app profile directory that holds the server session token. */
-export declare const CONFIG_DIR: string;
-/** Absolute path of the JSON file the session token is persisted to. */
-export declare const TOKEN_FILE: string;
-/** On-disk token shape (what {@link storeServerToken} writes / {@link getServerToken} returns). */
-export interface TokenData {
-    /** The better-auth session token, used as the gateway api key in server mode. */
-    access_token: string;
-    /** Optional refresh token, when the device flow returns one. */
-    refresh_token?: string;
-    /** Token scheme; defaults to `"Bearer"`. */
-    token_type: string;
-    /** Optional granted scope string. */
-    scope?: string;
-    /** Absolute expiry as an ISO string, or null when the token has no expiry. */
-    expires_at: string | null;
-    /** When this record was written, as an ISO string. */
-    created_at: string;
-}
-/** Device-flow response shape accepted by {@link storeServerToken} (`expires_in` → `expires_at`). */
-export interface ServerTokenInput {
-    /** The better-auth session token. */
-    access_token: string;
-    /** Optional refresh token. */
-    refresh_token?: string;
-    /** Token scheme; defaults to `"Bearer"` when omitted. */
-    token_type?: string;
-    /** Optional granted scope string. */
-    scope?: string;
-    /** Lifetime in seconds, relative to now; converted to an absolute `expires_at`. */
-    expires_in?: number;
-}
-/**
- * Read the stored session token, tolerating a missing or malformed file as
- * "no token".
- *
- * @returns the parsed {@link TokenData}, or `null` when nothing is stored.
- */
-export declare function getServerToken(): Promise<TokenData | null>;
-/**
- * Persist a session token from a device-flow response, converting the relative
- * `expires_in` (seconds) into an absolute `expires_at` ISO timestamp and
- * defaulting `token_type` to `"Bearer"`. Creates the profile directory if
- * needed and writes the file with owner-only permissions.
- *
- * @param token the device-flow token payload.
- * @returns `true` on success, `false` if the write failed.
- */
-export declare function storeServerToken(token: ServerTokenInput): Promise<boolean>;
-/**
- * Remove the stored session token (used by `indus logout`). A missing file is
- * treated as nothing-to-do.
- *
- * @returns `true` when a file was deleted, `false` when none existed / removal failed.
- */
-export declare function clearServerToken(): Promise<boolean>;
-/**
- * Decide whether a token is expired. A token counts as expired when it is
- * absent, has no `expires_at`, or has under 5 minutes of life remaining (the
- * margin keeps a long turn from racing the expiry boundary).
- *
- * @param token the token to inspect (or `null`).
- * @returns `true` when the token is missing or stale.
- */
-export declare function isServerTokenExpired(token: TokenData | null): boolean;
-/**
- * Convenience predicate: there is a stored token and it is not expired.
- *
- * @returns `true` when a usable (fresh) session token is on disk.
- */
-export declare function hasValidServerToken(): Promise<boolean>;

package/dist/types/boot/stages.d.ts

@@ -1,92 +0,0 @@
-/**
- * Boot stage pipeline — the ordered list of {@link Stage} transforms that turn a
- * bare {@link BootContext} (argv + workspace + brand) into a fully-resolved one
- * (parsed invocation, materialised directories, applied upgrades, resolved
- * startup resources, selected runner).
- *
- * The pipeline is data, not control flow: {@link STAGES} lists each step in order,
- * and {@link runStages} folds an *immutable* context through them — every stage
- * receives a context and returns its successor (built by spreading, never by
- * mutating). A stage may be async; the fold awaits each in turn so ordering and
- * side-effect sequencing are deterministic.
- *
- * Stage order and intent:
- *   1. `locate-workspace`  — materialise the resolved {@link Workspace} on disk
- *      (`createWorkspace` + `ensureDirs`). Pure path computation already happened
- *      when the initial context was built; this stage only `mkdir`s.
- *   2. `apply-upgrades`    — fold the idempotent {@link applyUpgrades} registry
- *      over the workspace (a no-op on an already-current profile).
- *   3. `build-invocation`  — parse `argv` into the typed {@link Invocation}.
- *   4. `resolve-resources` — best-effort construct the framework
- *      settings/auth/model graph; degrade to a minimal object if the framework
- *      pieces are unavailable.
- *   5. `select-runner`     — no-op transform that exists for symmetry and tracing
- *      (the actual dispatch happens in {@link "./boot"} after the pipeline, so the
- *      selected runner can own the exit code). Kept in the list so the ordered
- *      pipeline reads as the full launch sequence.
- */
-import type { BootContext, Stage } from "./contract";
-/**
- * Materialise the resolved workspace directories on disk.
- *
- * The {@link BootContext.workspace} was already computed (pure) when the initial
- * context was assembled; this stage only ensures the directory subset exists so
- * later stages and runners can write into it. Returns the same context (the
- * workspace record is unchanged — only the filesystem side-effects happen here).
- */
-declare const locateWorkspace: Stage;
-/**
- * Run any pending one-time profile upgrades, idempotently.
- *
- * Folds the upgrade registry over the workspace. The driver is non-fatal: a step
- * that fails is reported and retried on a later launch, never aborting boot. The
- * context is returned unchanged (upgrades touch the filesystem, not the context).
- */
-declare const upgrade: Stage;
-/**
- * Parse `argv` into the typed {@link Invocation} and thread it onto the context.
- *
- * The initial context carries a placeholder invocation (the bootstrapper cannot
- * know the mode before parsing); this stage replaces it with the real parse.
- */
-declare const buildInvocation: Stage;
-/**
- * Best-effort assembly of the startup resource graph.
- *
- * Where the rebuilt framework owns a concept, the field is constructed from it:
- * {@link StartupResources.settings} from the framework's `DEFAULT_SETTINGS`, and
- * {@link StartupResources.models} from the framework's `ModelRegistry`. The
- * credential graph has no framework type yet, so it is an empty placeholder until
- * Phase 2. If a framework piece cannot be loaded, the stage degrades to a minimal
- * resources object built from empty literals rather than failing the boot — the
- * shape is what later phases depend on, and they fill it in.
- */
-declare const resolveResources: Stage;
-/**
- * Marker / tracing stage for runner selection.
- *
- * The real dispatch is performed by {@link "./boot"} after the pipeline so the
- * chosen runner can own the process exit code; this stage exists to keep the
- * ordered pipeline a faithful description of the launch sequence and to give the
- * selection step a name for tracing. It returns the context unchanged.
- */
-declare const selectRunnerStage: Stage;
-/**
- * The launch pipeline, in execution order. Folded by {@link runStages}.
- */
-export declare const STAGES: readonly Stage[];
-/**
- * Fold an ordered list of {@link Stage} transforms over an immutable
- * {@link BootContext}.
- *
- * Each stage receives the current context and returns its successor; the result
- * of one stage is the input to the next. Awaits every stage so async ordering is
- * deterministic. The input `initial` is never mutated — stages produce new
- * contexts by spreading.
- *
- * @param initial The seed context (argv + workspace + brand + placeholder fields).
- * @param stages  The ordered transforms to apply; defaults to {@link STAGES}.
- * @returns The fully-resolved context after every stage has run.
- */
-export declare function runStages(initial: BootContext, stages?: readonly Stage[]): Promise<BootContext>;
-export { locateWorkspace, upgrade, buildInvocation, resolveResources, selectRunnerStage, };

package/dist/types/boot/upgrade/apply.d.ts

@@ -1,45 +0,0 @@
-/**
- * Upgrade driver — folds the ordered {@link UPGRADES} registry over a
- * {@link Workspace}, exactly once per step.
- *
- * The driver is the only place that knows about the *marker file*: a small JSON
- * record under the profile directory listing the ids of upgrades that have
- * already run. Each registry step is skipped if its id is present in the marker;
- * otherwise it is applied and, on success, its id is appended and the marker is
- * persisted. A step that throws is *not* recorded (so it is retried next launch)
- * and is reported as a warning rather than aborting the remaining steps — one
- * bad migration must never wedge startup.
- *
- * The result is purely informational: {@link UpgradeReport.applied} lists ids run
- * *this* invocation (empty on an already-current profile), and
- * {@link UpgradeReport.warnings} carries human-readable notes for any step that
- * failed. Callers typically log both and continue.
- */
-import type { Workspace } from "../contract";
-/**
- * The outcome of an {@link applyUpgrades} pass.
- *
- *   - `applied`  — ids of upgrades that ran successfully *this* invocation, in
- *     apply order. Empty when the profile was already current.
- *   - `warnings` — one entry per step that threw, naming the step and its error.
- *     Non-fatal: applying continues past a failed step.
- */
-export interface UpgradeReport {
-    /** Ids successfully applied during this call, in order. */
-    readonly applied: string[];
-    /** Human-readable notes for steps that failed (non-fatal). */
-    readonly warnings: string[];
-}
-/**
- * Apply every not-yet-applied upgrade in {@link UPGRADES}, in registry order,
- * recording each success in the marker file so it never runs again.
- *
- * Steps already named in the marker are skipped. A step that throws is recorded
- * as a warning, left unmarked (so it is retried on a later launch), and does not
- * block the remaining steps. The marker is rewritten after each success, so a
- * crash mid-pass still preserves the progress made so far.
- *
- * @param ws The resolved, absolute on-disk layout to upgrade.
- * @returns The ids applied this pass and any non-fatal warnings.
- */
-export declare function applyUpgrades(ws: Workspace): Promise<UpgradeReport>;

package/dist/types/boot/upgrade/index.d.ts

@@ -1,13 +0,0 @@
-/**
- * Upgrade subsystem — public barrel.
- *
- * Surfaces the ordered, idempotent profile-upgrade registry and its driver.
- * Boot consumers import {@link applyUpgrades} to run pending one-time migrations
- * and the {@link UPGRADES} registry / {@link Upgrade} type for inspection and
- * testing. The marker-file bookkeeping is an internal detail of the driver and
- * is not re-exported.
- */
-export type { Upgrade } from "./upgrades";
-export { UPGRADES, foldCredentials, reshelveTranscripts, relocateBinaries, renamePromptDir, projectTranscriptDirName, } from "./upgrades";
-export type { UpgradeReport } from "./apply";
-export { applyUpgrades } from "./apply";

package/dist/types/boot/upgrade/upgrades.d.ts

@@ -1,126 +0,0 @@
-/**
- * Upgrade registry — the ordered, idempotent catalog of one-time profile
- * migrations.
- *
- * This module replaces a bag of magic constants and inlined `try/catch`
- * migration blocks with a *registry*: an explicit, ordered list of named
- * {@link Upgrade} steps. Each step owns a stable {@link Upgrade.id}, a one-line
- * {@link Upgrade.describe}, and an idempotent {@link Upgrade.apply}. The driver
- * ({@link "./apply"}) folds over the list in order, recording the ids it has run
- * in a marker file so a step never runs twice — re-running the whole registry on
- * an already-upgraded profile is a no-op.
- *
- * Idempotence contract (every step must honor it):
- *   - Detect "already done" cheaply and return early without side effects.
- *   - Treat a *missing* source (the thing being migrated from) as success — the
- *     profile is either fresh or already past this point.
- *   - Never destroy data: relocations move-or-skip, never overwrite a live
- *     destination; the legacy source is suffixed, not deleted.
- *
- * The seeded steps fold the legacy on-disk layout into the current one:
- *   1. {@link foldCredentials}   — legacy split auth → one secure `auth.json`.
- *   2. {@link reshelveTranscripts} — loose session files → per-cwd `sessions/`.
- *   3. {@link relocateBinaries}  — managed `fd`/`rg` helpers → the `bin/` dir.
- *   4. {@link renamePromptDir}   — legacy `commands/` dir → `prompts/`.
- *
- * Session-directory encoding note: step 2 must place a transcript under the
- * *same* per-cwd directory name the framework's session manager would compute.
- * The framework publishes no standalone encoder for that name (the encoding is
- * private to its session manager), so this module uses a clearly-named local
- * helper, {@link projectTranscriptDirName}, rather than re-deriving the
- * framework's private per-cwd directory encoding. If the framework later exports
- * an encoder, swap the helper for the import without touching the step logic.
- */
-import type { Workspace } from "../contract";
-/**
- * One ordered, idempotent profile-layout upgrade.
- *
- * An upgrade is pure data plus one async effect. The registry order is the
- * apply order; the {@link id} is the durable key recorded in the marker file
- * once {@link apply} completes, so it must be stable across releases (renaming an
- * id re-runs the step). {@link apply} must be safe to invoke against a profile in
- * any state — fresh, partially-migrated, or fully-migrated.
- */
-export interface Upgrade {
-    /** Durable identifier recorded once this step has run. Never rename. */
-    readonly id: string;
-    /** One-line human summary for logs and `--verbose` output. */
-    readonly describe: string;
-    /**
-     * Perform the upgrade against the resolved {@link Workspace}. Must be
-     * idempotent: detect "already applied" and return without side effects.
-     *
-     * @param ws The resolved, absolute on-disk layout.
-     */
-    apply(ws: Workspace): Promise<void>;
-}
-/**
- * Compute the per-project transcript sub-directory *name* for a working
- * directory.
- *
- * This deliberately does not reproduce the framework session manager's private
- * encoding character-for-character; the framework exposes no public encoder to
- * import, so this is the documented local fallback. It produces a single,
- * filesystem-safe directory leaf that is stable for a given absolute `cwd`:
- * path separators, drive colons, and any other non-portable characters collapse
- * to a single token, and a short content hash is appended so two distinct paths
- * that happen to fold to the same token never collide.
- *
- * The output is used only when *relocating a loose legacy transcript* into the
- * sessions tree; live sessions are always created by the framework itself, so
- * this helper never competes with the framework for the canonical name.
- *
- * @param cwd Absolute working directory the transcript belongs to.
- * @returns A safe directory leaf such as `proj-Users-me-app-1a2b3c4d`.
- */
-export declare function projectTranscriptDirName(cwd: string): string;
-/**
- * Fold a legacy split credential layout — a standalone `oauth.json` plus an
- * `apiKeys` block embedded in `settings.json` — into the single consolidated
- * `auth.json`, written with owner-only (`0o600`-equivalent) permissions.
- *
- * Idempotent: if `auth.json` already exists, nothing is touched. After a
- * successful fold the legacy `oauth.json` is suffixed (`oauth.json.retired`) and
- * the `apiKeys` block is removed from `settings.json`, so a second run finds no
- * legacy sources and the existing `auth.json` short-circuits it regardless.
- */
-export declare const foldCredentials: Upgrade;
-/**
- * Relocate loose `*.jsonl` transcripts that were written directly under the
- * profile root (a legacy layout) into the structured per-cwd sessions tree:
- * `sessions/<projectDirName>/<file>`.
- *
- * A loose file is recognized as a transcript by a first-line header of
- * `type: "session"`. The destination project directory is derived from the
- * header's recorded `cwd` via {@link projectTranscriptDirName} (the framework
- * owns no public encoder to delegate to — see this module's header). Each move
- * is skip-on-clobber, so re-running never overwrites an already-relocated
- * transcript, and once no loose transcripts remain the step is a pure no-op.
- */
-export declare const reshelveTranscripts: Upgrade;
-/**
- * Relocate the managed native helper binaries (`fd`, `rg`, and their Windows
- * `.exe` forms) from the legacy `tools/` directory into the canonical managed
- * `bin/` directory ({@link Workspace.binDir}).
- *
- * Each binary is moved skip-on-clobber and independently, so a partially-moved
- * state self-heals on the next run and an already-relocated layout (or a fresh
- * install with no legacy `tools/`) is a no-op.
- */
-export declare const relocateBinaries: Upgrade;
-/**
- * Rename the legacy command-template directory (`commands/`) to the current
- * prompt-template directory ({@link Workspace.promptsDir}).
- *
- * Idempotent: if the destination already exists the rename is skipped (the
- * profile is already on the current layout), and if the legacy directory is
- * absent there is nothing to do. The rename is whole-directory and
- * non-destructive — a live `prompts/` is never replaced.
- */
-export declare const renamePromptDir: Upgrade;
-/**
- * The ordered list of upgrades. Apply order is array order; ids are the durable
- * marker keys. Append new steps to the end — never reorder or rename existing
- * ids, as that would re-run already-applied migrations.
- */
-export declare const UPGRADES: readonly Upgrade[];

package/dist/types/briefing/briefing.test.d.ts

@@ -1,15 +0,0 @@
-/**
- * Briefing subsystem — Phase 9 behavioral tests.
- *
- * Three concerns, exercised purely (the only I/O is one temp `SKILL.md`):
- *   1. {@link composeBriefing} — the declarative section pipeline emits the
- *      ordered sections rendered in this rebuild's OWN voice (we assert on our
- *      section headings and re-authored guidance, never on any carried-over
- *      upstream sentence).
- *   2. {@link scanMacroBody} / {@link applyMacros} — the single-pass `$arg`
- *      scanner substitutes `$name` and `${name}` forms in one left-to-right scan
- *      and leaves unknown tokens as literal text.
- *   3. {@link loadSkillCards} — a sample `SKILL.md` under a tmpdir parses into a
- *      validated CapabilityCard.
- */
-export {};

package/dist/types/briefing/compose.d.ts

@@ -1,37 +0,0 @@
-/**
- * Briefing composer — the declarative system-prompt pipeline.
- *
- * The system prompt is assembled from an ordered list of {@link BriefingSection}
- * descriptors, not a string template with `{{TOKEN}}` holes. Each section decides
- * for itself whether it contributes to a given {@link BriefingContext} (its
- * `applies` predicate) and renders its own fragment (its `render`). The composer
- * is a small reducer: it walks the recipe in order, keeps the applicable
- * sections, renders them, drops empties, and joins with blank-line gaps. Adding,
- * removing, or reordering a section is a data edit to {@link BRIEFING_SECTIONS},
- * never a change to the composer.
- *
- * Every guideline, tool note, and heading below is authored for this rebuild.
- * The *set* of sections (role, tools, working guidance, task tracking, delegates,
- * connectors, project context, skills, footer) follows the well-known coding-
- * agent shape; the wording is the briefing's own.
- */
-import type { Briefing, BriefingContext, BriefingInputs } from "./contract";
-/**
- * The default briefing recipe, in render order. Swap or reorder entries to
- * reshape the prompt without touching {@link composeBriefing}.
- */
-export declare const BRIEFING_SECTIONS: Briefing;
-/**
- * Fold a section recipe and a context into the final briefing string.
- *
- * Accepts either a plain {@link BriefingContext} (using the default
- * {@link BRIEFING_SECTIONS} recipe) or a full {@link BriefingInputs} bundle that
- * names its own sections and optional `prelude` / `append` text. The composer
- * keeps each section whose `applies` predicate is satisfied (or absent), renders
- * it, discards empty fragments, and joins the rest with blank-line gaps. Optional
- * `prelude` and `append` bracket the rendered sections.
- *
- * @param input either the render context, or a full inputs bundle
- * @returns the assembled system-prompt string
- */
-export declare function composeBriefing(input: BriefingContext | BriefingInputs): string;

package/dist/types/briefing/context-docs.d.ts

@@ -1,38 +0,0 @@
-/**
- * Project-context document loader — gathers repository convention files
- * (CLAUDE.md / AGENTS.md and brand variants) into {@link ContextDoc}s that the
- * briefing's `PROJECT_CONTEXT_SECTION` inlines under `# Project context`.
- *
- * The walk runs the ancestor chain from the filesystem root down to the cwd, so
- * the cwd's own files land LAST in the returned array — and since the renderer
- * treats array order as priority order, the closest (most specific) file wins.
- * The home directory is scanned after the chain as a global fallback. Each file
- * may pull additional files inline via `@import` references (bounded to a depth
- * of {@link DEFAULT_MAX_IMPORT_DEPTH} with a per-walk realpath guard so cycles
- * and symlink loops cannot recurse or hang).
- *
- * The whole body is wrapped so that a permissions error on one ancestor, a
- * binary file, or a malformed tree degrades to `[]` rather than crashing boot —
- * repo conventions are a best-effort enrichment, never a hard dependency.
- */
-import type { ContextDoc } from "./contract";
-/** Options for {@link gatherContextDocs}. Every field is optional. */
-export interface GatherContextDocsOptions {
-    /** Maximum `@import` recursion depth. Defaults to {@link DEFAULT_MAX_IMPORT_DEPTH}. */
-    readonly maxImportDepth?: number;
-    /** Maximum bytes retained per document body (post-trim). Defaults to {@link DEFAULT_MAX_BYTES_PER_DOC}. */
-    readonly maxBytesPerDoc?: number;
-}
-/**
- * Gather the repository's project-context documents into an ordered
- * {@link ContextDoc} array for the briefing.
- *
- * Order: the ancestor chain from root → cwd (so cwd's files land last = highest
- * priority), then the home directory as a global fallback. Within each directory
- * the {@link CANDIDATE_FILES} are read in their listed order. Each file may pull
- * `@import` children inline (depth-bounded, cycle-guarded). De-duplication is by
- * realpath, so a file reachable through two roots is inlined once.
- *
- * Never throws: any failure in the walk yields the docs gathered so far (or `[]`).
- */
-export declare function gatherContextDocs(cwd: string, home: string, opts?: GatherContextDocsOptions): readonly ContextDoc[];