indusagi 0.12.34 → 0.13.0

package/dist/types/facade/bot/actions/write.d.ts

@@ -1,4 +1,6 @@
 import type { AgentTool } from "../types.js";
+import { type CheckpointHandle } from "./checkpoint.js";
+import { type ReadStateHandle } from "./read-state.js";
 declare const writeSchema: import("@sinclair/typebox").TObject<{
     path: import("@sinclair/typebox").TString;
     content: import("@sinclair/typebox").TString;
@@ -20,6 +22,19 @@ export interface WriteToolOptions {
     operations?: WriteOperations;
     /** If set, duplicate any existing file to a sibling .bak before it is overwritten. */
     createBackup?: boolean;
+    /**
+     * Optional read-before-edit gate store. When present, overwriting an EXISTING
+     * file is refused unless it was read this session and has not drifted on disk;
+     * brand-new files (not yet on disk) are exempt. Absent → no gate (no-op).
+     */
+    readState?: ReadStateHandle;
+    /**
+     * Optional file-checkpoint sink. When present, the file's pre-mutation
+     * on-disk content (or `null` when it did not exist) is captured exactly once
+     * before the overwrite, so a later rewind can roll the working tree back.
+     * Absent → no snapshot (no-op).
+     */
+    checkpoint?: CheckpointHandle;
 }
 export declare function createWriteTool(cwd: string, options?: WriteToolOptions): AgentTool<typeof writeSchema>;
 /** Ready-to-use write tool bound to the current working directory. */

package/dist/types/facade/bot/agent-loop.d.ts

@@ -8,6 +8,16 @@
  */
 import { EventStream } from "../ml/index.js";
 import type { AgentContext, AgentEvent, AgentLoopConfig, AgentMessage, StreamFn } from "./types.js";
+/**
+ * Conservative static allow-list of tools that only read state, never mutate
+ * it. Consecutive runs of these within a single assistant turn are safe to
+ * dispatch concurrently. Anything not on this list — mutating tools (edit,
+ * write, bash), and every dynamic / MCP / composio tool whose behavior the
+ * loop can't statically vouch for — runs serially in request order.
+ *
+ * Callers can supply their own set through `AgentLoopConfig.readOnlyToolNames`.
+ */
+export declare const READ_ONLY_TOOL_NAMES: ReadonlySet<string>;
 /**
  * Begin a brand-new run. The supplied prompt messages are appended to the
  * conversation up front, then the turn cycle starts.

package/dist/types/facade/bot/agent-loop.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/facade/bot/agent.d.ts

@@ -5,7 +5,7 @@
  * default the model is reached through streamSimple.
  */
 import { type ImageContent, type Message, type Model, type ThinkingBudgets } from "../ml/index.js";
-import type { AgentEvent, AgentMessage, AgentState, AgentTool, StreamFn, ThinkingLevel } from "./types.js";
+import type { AgentEvent, AgentMessage, AgentState, AgentTool, CanUseToolFn, StreamFn, ThinkingLevel } from "./types.js";
 type QueueMode = "all" | "one-at-a-time";
 export interface AgentOptions {
     initialState?: Partial<AgentState>;
@@ -46,6 +46,13 @@ export interface AgentOptions {
      * expire, such as short-lived OAuth access tokens.
      */
     getApiKey?: (provider: string) => Promise<string | undefined> | string | undefined;
+    /**
+     * Hard permission gate consulted before each tool runs. A host supplies it to
+     * enforce an allow/ask/deny policy; the loop awaits it on the validated args
+     * and either proceeds (optionally with substituted input) or short-circuits
+     * to an isError result. Omit it to allow every tool — today's behavior.
+     */
+    canUseTool?: CanUseToolFn;
     /**
      * Per-level token allowances for thinking; only meaningful for providers
      * whose reasoning effort is expressed as a token budget.
@@ -63,6 +70,7 @@ export declare class Agent {
     streamFn: StreamFn;
     private _sessionId?;
     getApiKey?: (provider: string) => Promise<string | undefined> | string | undefined;
+    canUseTool?: CanUseToolFn;
     private runningPrompt?;
     private resolveRunningPrompt?;
     private _thinkingBudgets?;

package/dist/types/facade/bot/permission-gate.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/facade/bot/types.d.ts

@@ -38,8 +38,41 @@ export interface AgentToolResult<T> {
 }
 export interface AgentTool<TParameters extends TSchema = TSchema, TDetails = any> extends Tool<TParameters> {
     label: string;
+    /**
+     * Marks a tool that only inspects state and never mutates it (read/ls/grep/
+     * find/websearch/webfetch/todoread). Hosts can lean on this to auto-allow
+     * such tools in a permission policy without re-deriving the read-only set by
+     * name. Optional and defaults to undefined → treated as "not known read-only".
+     */
+    readOnly?: boolean;
     execute: (toolCallId: string, params: Static<TParameters>, signal?: AbortSignal, onUpdate?: AgentToolUpdateCallback<TDetails>) => Promise<AgentToolResult<TDetails>>;
 }
+/**
+ * The verdict a {@link CanUseToolFn} returns for a single tool call.
+ *
+ * - `allow` proceeds with execution; an optional `updatedInput` replaces the
+ *   validated arguments before the tool runs (e.g. a sanitized command).
+ * - `deny` short-circuits: the tool never executes and `message` is surfaced as
+ *   an `isError` tool result so the model sees why it was blocked.
+ */
+export type PermissionDecision = {
+    behavior: "allow";
+    updatedInput?: unknown;
+} | {
+    behavior: "deny";
+    message: string;
+};
+/**
+ * Hard permission gate consulted immediately before a tool executes. Hosts
+ * supply it to enforce an allow/ask/deny policy; the loop awaits it (passing the
+ * abort signal so a pending prompt can be cancelled) and acts on the verdict.
+ *
+ * Entirely optional — when omitted the loop allows every tool, preserving
+ * today's behavior.
+ */
+export type CanUseToolFn = (toolName: string, input: unknown, opts: {
+    signal?: AbortSignal;
+}) => Promise<PermissionDecision>;
 export interface AgentContext {
     systemPrompt: string;
     messages: AgentMessage[];
@@ -116,6 +149,15 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
      * while a slow stretch of tool calls is still running.
      */
     getApiKey?: (provider: string) => Promise<string | undefined> | string | undefined;
+    /**
+     * Hard permission gate consulted right before each tool executes. When set,
+     * the loop awaits it with the tool name and its VALIDATED arguments; a `deny`
+     * verdict short-circuits to an `isError` tool result (the tool never runs),
+     * while an `allow` verdict proceeds — substituting `updatedInput` when given.
+     *
+     * Omit it to allow every tool, i.e. exactly today's behavior.
+     */
+    canUseTool?: CanUseToolFn;
     /**
      * Yields steering messages to splice into the run while it is in flight.
      *
@@ -135,6 +177,24 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
      * Use it for input that should wait until the current work wraps up.
      */
     getFollowUpMessages?: () => Promise<AgentMessage[]>;
+    /**
+     * Names of tools that are safe to run concurrently because they only read
+     * (never mutate) state. Consecutive runs of such calls within one assistant
+     * turn are dispatched in parallel (bounded by {@link maxToolConcurrency});
+     * everything else still runs one-at-a-time in request order.
+     *
+     * When omitted the loop falls back to a conservative built-in set
+     * (`read`/`ls`/`grep`/`find`/`websearch`/`webfetch`/`todoread`). Tools that
+     * aren't on the list — including dynamic/MCP/composio tools — always run
+     * serially, preserving today's behavior.
+     */
+    readOnlyToolNames?: ReadonlySet<string>;
+    /**
+     * Upper bound on how many read-only tool calls run at once. Defaults to the
+     * `CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY` / `INDUS_MAX_TOOL_CONCURRENCY`
+     * environment override, or 10. Set to 1 to force fully-sequential dispatch.
+     */
+    maxToolConcurrency?: number;
 }
 type AgentLifecycleEvent = {
     type: "agent_start";

package/dist/types/facade/mcp-core/client.d.ts

@@ -4,7 +4,18 @@
  * Manages connection to one MCP server and provides
  * methods to list/call tools, read resources, etc.
  *
- * Reference: MCP client implementation patterns.
+ * Transport is provided by the official `@modelcontextprotocol/sdk`:
+ *   - stdio  → subprocess JSON-RPC over stdin/stdout
+ *   - http   → Streamable HTTP (POST for client→server, plus a server→client
+ *              push channel — the SDK opens the SSE stream and a standalone GET
+ *              SSE for server-initiated messages, and handles reconnect/
+ *              session-expiry by re-using the session id)
+ *   - sse    → legacy HTTP+SSE transport (when `transport: "sse"` is requested)
+ *
+ * The SDK gives us a real persistent connection, a server→client push channel,
+ * dispatch of server NOTIFICATIONS, answering of server REQUESTS (elicitation,
+ * roots/list, sampling, ping), and bounded reconnect on a dropped stream /
+ * expired session — none of which the hand-rolled POST-only transport did.
  */
 import type { MCPServerConfig, MCPToolDefinition, MCPResource, MCPPrompt, MCPToolCallResult, MCPLogHandler, MCPProgressHandler, MCPElicitationHandler, MCPRoot } from "./types.js";
 /**
@@ -29,7 +40,7 @@ export interface MCPClientOptions {
 /**
  * MCP Client - manages connection to a single MCP server.
  *
- * Supports stdio transport (subprocess communication).
+ * Supports stdio (subprocess) and HTTP (Streamable HTTP / legacy SSE) transports.
  * Provides methods to list tools, call tools, read resources, etc.
  *
  * @example
@@ -50,10 +61,8 @@ export interface MCPClientOptions {
  */
 export declare class MCPClient {
     private options;
-    private process?;
-    private buffer;
-    private messageId;
-    private pendingRequests;
+    private client?;
+    private transport?;
     private isConnected;
     private connectionPromise;
     private serverCapabilities?;
@@ -61,6 +70,13 @@ export declare class MCPClient {
     private enableServerLogs;
     private enableProgressTracking;
     private _roots;
+    private elicitationHandler?;
+    private samplingHandler?;
+    private resourceUpdatedHandler?;
+    private resourceListChangedHandler?;
+    private toolListChangedHandler?;
+    private promptListChangedHandler?;
+    private progressHandler?;
     /** Server name */
     readonly serverName: string;
     /** Server config */
@@ -74,10 +90,37 @@ export declare class MCPClient {
      */
     connect(): Promise<void>;
     private doConnect;
-    private connectHttp;
-    private connectStdio;
+    /**
+     * Build the SDK transport for the configured server.
+     *
+     *  - stdio: `StdioClientTransport` (inherits the parent env, merges config.env).
+     *  - http:  `StreamableHTTPClientTransport` (POST + server-push SSE channel,
+     *           reconnect + session-expiry handled by the SDK), unless the config
+     *           asks for the legacy `SSEClientTransport`.
+     */
+    private createTransport;
+    /**
+     * Register handlers for server-initiated REQUESTS and NOTIFICATIONS.
+     *
+     * REQUESTS (have both `.method` AND `.id`) must be ANSWERED with a JSON-RPC
+     * RESPONSE carrying the matching id — the SDK does this automatically for the
+     * value a request handler returns (or rejects). The previous hand-rolled
+     * transport routed these into the notification path, so they were never
+     * answered (bug #13).
+     *
+     * Defaults:
+     *   - ping              → {}
+     *   - roots/list        → the configured roots
+     *   - elicitation/create→ decline ({action:"cancel"}) unless a host handler is set
+     *   - sampling          → reject "Method not found" unless a host handler is set
+     */
+    private registerServerHandlers;
     /**
      * Disconnect from the MCP server.
+     *
+     * The SDK's `client.close()` closes the transport and rejects any pending
+     * requests — a clean teardown for both stdio (graceful subprocess shutdown)
+     * and HTTP (close the push channel / end the session).
      */
     disconnect(): Promise<void>;
     /**
@@ -134,24 +177,37 @@ export declare class MCPClient {
      * Set a handler for resource list changed notifications.
      */
     setResourceListChangedHandler(handler: () => void): void;
+    /**
+     * Set a handler for tool list changed notifications.
+     */
+    setToolListChangedHandler(handler: () => void): void;
     /**
      * Set a handler for prompt list changed notifications.
      */
     setPromptListChangedHandler(handler: () => void): void;
     /**
-     * Set a handler for elicitation requests.
+     * Set a handler for elicitation requests. When set, the server's
+     * `elicitation/create` REQUEST is answered with the host's decision; when
+     * unset the request is declined ({action:"cancel"}).
      */
     setElicitationHandler(handler: MCPElicitationHandler): void;
+    /**
+     * Set a handler for sampling (`sampling/createMessage`) requests. When set,
+     * the server request is answered with the host's result; when unset the
+     * request is rejected with "Method not found".
+     */
+    setSamplingHandler(handler: (params: unknown) => Promise<unknown>): void;
     /**
      * Set a handler for progress notifications.
      */
     setProgressHandler(handler: MCPProgressHandler): void;
     private ensureConnected;
-    private sendRequest;
-    private sendHttpRequest;
-    private sendNotification;
-    private processBuffer;
-    private handleMessage;
-    private handleNotification;
+    /**
+     * Normalize an SDK/transport error into an MCPError. Session-expiry style
+     * failures (404 session / -32001) are surfaced as SESSION_ERROR so callers
+     * (the pool) can decide to reconnect; the SDK's StreamableHTTP transport
+     * already attempts a bounded reconnect re-using the session id before this.
+     */
+    private wrapError;
     private log;
 }

package/dist/types/facade/mcp-core/client.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * MCP client transport tests (#23 / bug #13).
+ *
+ * These verify the server→client directions that the old hand-rolled,
+ * POST-only transport never handled:
+ *   1. A server-initiated REQUEST (`elicitation/create`) is ANSWERED with a
+ *      JSON-RPC RESPONSE carrying the matching id (not silently dropped into a
+ *      notification path).
+ *   2. A server-initiated NOTIFICATION (`notifications/tools/list_changed`)
+ *      fires the host-registered handler.
+ *   3. The HTTP path builds a real Streamable-HTTP transport with a server-push
+ *      channel, and an SSE-framed server message off that channel is parsed and
+ *      dispatched to the right handler.
+ *
+ * A `MockTransport` (implementing the SDK `Transport` interface) drives the
+ * client without a live MCP server.
+ */
+export {};

package/dist/types/facade/mcp-core/types.d.ts

@@ -27,6 +27,12 @@ export interface HttpServerConfig {
     url: URL;
     /** Optional headers for HTTP requests */
     headers?: Record<string, string>;
+    /**
+     * Which HTTP transport to use.
+     *  - "http" (default): Streamable HTTP (single endpoint, server-push channel)
+     *  - "sse": legacy HTTP+SSE transport
+     */
+    transport?: "http" | "sse";
     /** Custom fetch implementation */
     fetch?: typeof fetch;
 }
@@ -166,6 +172,8 @@ export interface MCPServerConfigEntry {
     url?: string;
     /** Headers for HTTP transport */
     headers?: Record<string, string>;
+    /** HTTP transport flavor ("http" = Streamable HTTP default, "sse" = legacy) */
+    transport?: "http" | "sse";
     /** Timeout in milliseconds */
     timeout?: number;
     /** Whether this server is enabled (default: true) */
@@ -185,6 +193,8 @@ export interface MCPServerConfigValue {
     url?: string;
     /** Headers for HTTP transport */
     headers?: Record<string, string>;
+    /** HTTP transport flavor ("http" = Streamable HTTP default, "sse" = legacy) */
+    transport?: "http" | "sse";
     /** Timeout in milliseconds */
     timeout?: number;
     /** Whether this server is enabled (default: true) */

package/dist/types/facade/ml/adapters/anthropic-retry.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/facade/ml/adapters/anthropic.d.ts

@@ -57,5 +57,22 @@ export declare class AnthropicStreamHandler extends BaseStreamHandler {
      */
     process(anthropicStream: AsyncIterable<unknown>, onEvent: (event: any) => void): Promise<void>;
 }
+/**
+ * Reads a `Retry-After` header off an Anthropic APIError and converts it to a
+ * delay in milliseconds. The header is the integer-seconds form per the
+ * Anthropic API; a missing/non-numeric value yields `null` so callers fall
+ * back to exponential backoff.
+ */
+export declare function parseAnthropicRetryAfterMs(error: unknown): number | null;
+/**
+ * Classifies an Anthropic failure as worth retrying. Mirrors
+ * `kit/provider-errors.ts:isRetryableError`: transient HTTP statuses (408/409/
+ * 429/529/5xx) and an `overloaded_error` body are retryable; auth/validation
+ * (401/403/4xx) are not. Generic errors fall back to a message sniff covering
+ * network/timeout/overload conditions. The `_attempt` is accepted to satisfy
+ * the RetryPolicy.shouldRetry contract but unused here (the loop already caps
+ * attempts).
+ */
+export declare function shouldRetryAnthropic(error: unknown, _attempt: number): boolean;
 export declare const streamAnthropic: StreamFunction<"anthropic-messages", AnthropicOptions>;
 export declare const streamSimpleAnthropic: StreamFunction<"anthropic-messages", SimpleStreamOptions>;

package/dist/types/facade/ml/adapters/simple-options.d.ts

@@ -8,7 +8,20 @@ export interface RetryPolicy {
     maxAttempts: number;
     baseDelayMs: number;
     maxDelayMs?: number;
+    /**
+     * When present, abort is checked between attempts and before each backoff
+     * sleep. A live request is short-circuited the moment its signal fires —
+     * but the presence of a signal no longer suppresses transient retries.
+     */
+    signal?: AbortSignal;
     shouldRetry?: (error: unknown, attempt: number) => boolean;
+    /**
+     * Returns the server-requested cooldown (e.g. a parsed `Retry-After`
+     * header) in milliseconds, or `null` when the error carries no such hint.
+     * When provided, it takes priority over exponential backoff (still clamped
+     * by `maxDelayMs`).
+     */
+    getRetryAfterMs?: (error: unknown) => number | null;
 }
 export declare class SimpleOptionsProviderError extends Error {
     readonly code: "rate_limit" | "timeout" | "network" | "validation" | "auth" | "unknown";

package/dist/types/facade/ml/adapters/simple-options.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/react-ink/components/StatusLine.d.ts

@@ -4,6 +4,15 @@ interface StatusLineProps {
     theme: InkThemeAdapter;
     status?: StatusMessage;
     snapshot: SessionSnapshot;
+    /**
+     * Whether this line draws its own "Agent working..." / "Running bash..." /
+     * "Compacting..." busy fallbacks. Defaults to `true` (legacy behaviour). A host
+     * that renders its own live progress affordance (e.g. an animated working
+     * indicator on a separate row) passes `false` so the busy state is shown in ONE
+     * place only — this line then carries just the explicit transient toast (and a
+     * hard error), and never competes with the host's indicator.
+     */
+    showBusyText?: boolean;
 }
-export declare function StatusLine({ snapshot, status, theme }: StatusLineProps): JSX.Element | null;
+export declare function StatusLine({ snapshot, status, theme, showBusyText }: StatusLineProps): JSX.Element | null;
 export {};

package/dist/types/react-ink/components/ToolEventBlock.d.ts

@@ -20,5 +20,6 @@ interface ToolEventBlockProps {
      */
     preformatted?: boolean;
 }
-export declare function ToolEventBlock({ detail, emptyText, indent, marginBottom, maxContentLines, preformatted, showSummaryInline, showTitle, status, summary, theme: _theme, title, }: ToolEventBlockProps): JSX.Element;
+export declare function statusColorKey(status: ToolEventStatus): string;
+export declare function ToolEventBlock({ detail, emptyText, indent, marginBottom, maxContentLines, preformatted, showSummaryInline, showTitle, status, summary, theme, title, }: ToolEventBlockProps): JSX.Element;
 export {};

package/dist/types/react-ink/components/ToolEventBlock.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "indusagi",
-  "version": "0.12.34",
+  "version": "0.13.0",
   "description": "Indusagi — a terminal-first AI coding agent framework. Clean-room implementation.",
   "author": "Varun Israni",
   "license": "MIT",