kritya 0.8.2-beta

package/dist/config/config.js

@@ -0,0 +1,214 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { hardenWindowsDir } from "./winAcl.js";
+import { debugLog } from "./debug.js";
+export const CONFIG_DIR = path.join(os.homedir(), ".kritya");
+const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+export const NVIDIA_BASE_URL = "https://integrate.api.nvidia.com/v1";
+/**
+ * Built-in OpenAI-compatible providers. Users select one with `provider` in
+ * config (or --provider) and supply the key via the named env var or a .env
+ * file. Entries in config.providers override these by name.
+ */
+export const BUILTIN_PROVIDERS = {
+    nvidia: { baseUrl: NVIDIA_BASE_URL, apiKeyEnv: "NVIDIA_API_KEY" },
+    openai: { baseUrl: "https://api.openai.com/v1", apiKeyEnv: "OPENAI_API_KEY" },
+    openrouter: { baseUrl: "https://openrouter.ai/api/v1", apiKeyEnv: "OPENROUTER_API_KEY" },
+    groq: { baseUrl: "https://api.groq.com/openai/v1", apiKeyEnv: "GROQ_API_KEY" },
+    deepseek: { baseUrl: "https://api.deepseek.com", apiKeyEnv: "DEEPSEEK_API_KEY" },
+    mistral: { baseUrl: "https://api.mistral.ai/v1", apiKeyEnv: "MISTRAL_API_KEY" },
+    together: { baseUrl: "https://api.together.xyz/v1", apiKeyEnv: "TOGETHER_API_KEY" },
+    ollama: { baseUrl: "http://localhost:11434/v1", apiKey: "ollama" },
+    // Anthropic and Google both expose OpenAI-compatible endpoints, so they ride
+    // the same ProviderClient path as the rest — no native SDK required.
+    anthropic: { baseUrl: "https://api.anthropic.com/v1/", apiKeyEnv: "ANTHROPIC_API_KEY" },
+    gemini: {
+        baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai/",
+        apiKeyEnv: "GEMINI_API_KEY",
+    },
+    // Not a real network target: `baseUrl` here is a placeholder. The actual
+    // client is built by createSwitchyardClient (switchyardClient.ts), which
+    // launches a local switchyard-server sidecar on a free port and points at
+    // that instead. Needs NVIDIA_API_KEY — the sidecar's own outbound calls
+    // and kritya's cross-model fallback both use it directly.
+    switchyard: { baseUrl: "http://127.0.0.1/v1", apiKeyEnv: "NVIDIA_API_KEY" },
+};
+/**
+ * Resolve the active provider's base URL and API key. Precedence for the
+ * provider name: explicit override (--provider) > config.provider > "nvidia".
+ * Legacy top-level apiKey/baseUrl and NVIDIA_API_KEY continue to work for the
+ * default nvidia provider.
+ */
+export function resolveProvider(config, override) {
+    const name = override || config.provider || "nvidia";
+    const merged = {
+        ...BUILTIN_PROVIDERS[name],
+        ...config.providers?.[name],
+    };
+    let baseUrl = merged.baseUrl;
+    if (name === "nvidia" && config.baseUrl)
+        baseUrl = config.baseUrl;
+    if (!baseUrl)
+        baseUrl = NVIDIA_BASE_URL;
+    let apiKey;
+    if (merged.apiKeyEnv)
+        apiKey = process.env[merged.apiKeyEnv];
+    if (!apiKey)
+        apiKey = merged.apiKey;
+    if (!apiKey && name === "nvidia")
+        apiKey = process.env.NVIDIA_API_KEY || config.apiKey;
+    return {
+        name,
+        baseUrl,
+        apiKey,
+        temperature: merged.temperature,
+        topP: merged.topP,
+        maxTokens: merged.maxTokens,
+    };
+}
+/**
+ * The legacy top-level `config.model`, but only for the provider it was
+ * actually chosen on.
+ *
+ * That field predates per-provider models and is shared by every provider, so
+ * a value saved while (say) nvidia was active would otherwise be applied to
+ * every other provider too — which is how an nvidia model id ends up
+ * bypassing switchyard's routing and 404-ing. `config.provider` records which
+ * provider was active when it was written, so scoping it there keeps existing
+ * configs working for their own provider without leaking anywhere else.
+ * Returns undefined for every other provider, letting them fall through to
+ * their own default.
+ */
+export function legacyGlobalModel(config, providerName) {
+    const savedUnder = config.provider || "nvidia";
+    return providerName === savedUnder ? config.model : undefined;
+}
+/**
+ * All providers kritya knows about — builtins plus anything named under
+ * `config.providers` — with whether each currently resolves to a usable API
+ * key. This is the fallback chain offered when the active provider's
+ * requests keep failing (see RetryExhaustedError / the /provider command):
+ * only entries with `hasKey: true` are actually switchable right now.
+ */
+export function listProviders(config) {
+    const names = new Set([
+        ...Object.keys(BUILTIN_PROVIDERS),
+        ...Object.keys(config.providers ?? {}),
+    ]);
+    return [...names]
+        .sort()
+        .map((name) => ({ name, hasKey: !!resolveProvider(config, name).apiKey }));
+}
+export function loadConfig() {
+    try {
+        const raw = fs.readFileSync(CONFIG_FILE, "utf8");
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        // A missing file is normal on first run; a malformed one is worth being
+        // able to see when someone reports "my config isn't taking effect".
+        debugLog(`loadConfig(${CONFIG_FILE})`, err);
+        return {};
+    }
+}
+/**
+ * Persist `model` as the default for one provider, leaving every other
+ * provider's entry — and that provider's own other fields (apiKey, baseUrl…)
+ * — intact. Merges against what's currently on disk rather than an in-memory
+ * snapshot, so a provider added to config.json after startup isn't dropped.
+ *
+ * This is the per-provider replacement for writing the top-level
+ * `config.model`, which every provider shared; see legacyGlobalModel.
+ */
+export function saveProviderModel(providerName, model) {
+    const providers = loadConfig().providers ?? {};
+    saveConfig({
+        providers: {
+            ...providers,
+            [providerName]: { ...providers[providerName], model },
+        },
+    });
+}
+export function saveConfig(patch) {
+    const current = loadConfig();
+    const next = { ...current, ...patch };
+    // config.json can hold a literal apiKey — keep it readable only by the owner.
+    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    hardenWindowsDir(CONFIG_DIR);
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+    // `mode` on writeFileSync only applies when creating a new file; enforce it
+    // even if config.json pre-existed with looser permissions.
+    try {
+        fs.chmodSync(CONFIG_FILE, 0o600);
+    }
+    catch (err) {
+        debugLog(`saveConfig chmod(${CONFIG_FILE})`, err);
+    }
+}
+/**
+ * A copy of process.env with kritya-managed secrets removed. Every built-in
+ * provider key and the web-search key end in _API_KEY; commands the agent runs
+ * (and user hooks) have no business reading them, and under prompt injection
+ * an approved-looking shell command is an easy exfiltration channel. Commands
+ * that genuinely need such a key must receive it explicitly (e.g. inline in
+ * the command), same as MCP servers declare theirs via `env`.
+ */
+// Provider credentials (and anything shaped like a credential) that shell
+// commands and background processes must not inherit. Beyond the provider
+// *_API_KEY vars this always covered, this also strips *_TOKEN, *_SECRET,
+// *_PASSWORD (common CI/CD and package-registry credential shapes — GitHub,
+// npm, Docker Hub tokens; DB passwords) and the AWS credential trio, which
+// were previously passed through intact. AWS_REGION/AWS_PROFILE etc. are
+// left alone — they're not secrets and ordinary `aws` CLI calls need them.
+const SCRUBBED_ENV_RE = /_(API_KEY|TOKEN|SECRET|PASSWORD)$/i;
+const SCRUBBED_AWS_ENV_RE = /^AWS_(ACCESS_KEY_ID|SECRET_ACCESS_KEY|SESSION_TOKEN|SECURITY_TOKEN)$/i;
+export function scrubbedShellEnv() {
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (SCRUBBED_ENV_RE.test(key))
+            continue;
+        if (SCRUBBED_AWS_ENV_RE.test(key))
+            continue;
+        env[key] = value;
+    }
+    return env;
+}
+/** Parse simple KEY=VALUE lines; ignores comments, blanks, and export prefixes. */
+export function parseDotEnv(raw) {
+    const vars = {};
+    for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(trimmed);
+        if (!match)
+            continue;
+        let value = match[2].trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        vars[match[1]] = value;
+    }
+    return vars;
+}
+/**
+ * Load .env files into process.env without overriding variables that are
+ * already set. Missing files are skipped silently.
+ */
+export function loadDotEnv(paths) {
+    for (const p of paths) {
+        let raw;
+        try {
+            raw = fs.readFileSync(p, "utf8");
+        }
+        catch {
+            continue;
+        }
+        for (const [key, value] of Object.entries(parseDotEnv(raw))) {
+            if (process.env[key] === undefined)
+                process.env[key] = value;
+        }
+    }
+}

package/dist/config/debug.js

@@ -0,0 +1,19 @@
+/**
+ * Most best-effort persistence (session/audit/telemetry writes, config and
+ * trust-file reads, hook loading, …) deliberately swallows its own errors —
+ * a failed log write must never crash a turn. That's the right default, but
+ * it also means those failures are normally invisible even when you're
+ * trying to track one down. Set KRITYA_DEBUG=1 to print them to stderr
+ * instead of silently dropping them; unset (the default) costs nothing.
+ */
+export function debugLog(context, err) {
+    if ((process.env.KRITYA_DEBUG ?? "").toLowerCase() !== "1" && process.env.KRITYA_DEBUG !== "true")
+        return;
+    const message = err instanceof Error ? (err.stack ?? err.message) : String(err);
+    try {
+        process.stderr.write(`[kritya debug] ${context}: ${message}\n`);
+    }
+    catch {
+        // stderr itself failing isn't something debug logging can do anything about
+    }
+}

package/dist/config/models.js

@@ -0,0 +1,82 @@
+/** Fallback context window when neither config nor the registry knows the model. */
+export const DEFAULT_CONTEXT_WINDOW = 120_000;
+/**
+ * Curated models on build.nvidia.com known to handle tool calling well.
+ * Verified against the live /v1/models catalog on 2026-07-16. IDs change over
+ * time — add newer ones via `customModels` in ~/.kritya/config.json rather
+ * than editing this file.
+ */
+export const CURATED_MODELS = [
+    {
+        id: "nvidia/nemotron-3.5-lightning-30b-a3b",
+        label: "Nemotron 3.5 Lightning 30B",
+        note: "default",
+        contextWindow: 128_000,
+    },
+    {
+        id: "nvidia/nemotron-3-super-120b-a12b",
+        label: "Nemotron 3 Super 120B",
+        contextWindow: 128_000,
+    },
+    {
+        id: "nvidia/nemotron-3-ultra-550b-a55b",
+        label: "Nemotron 3 Ultra 550B",
+        contextWindow: 128_000,
+    },
+    {
+        id: "meta/muse-glimmer-30b",
+        label: "Muse Glimmer 30B",
+        contextWindow: 128_000,
+    },
+    { id: "thinkingmachines/inkling", label: "Inkling", contextWindow: 128_000 },
+    { id: "z-ai/glm-5.2", label: "GLM 5.2", note: "strong agentic coder", contextWindow: 200_000 },
+    {
+        id: "qwen/qwen3.5-397b-a17b",
+        label: "Qwen3.5 397B",
+        note: "strong coding + tool use",
+        contextWindow: 256_000,
+    },
+    {
+        id: "moonshotai/kimi-k2.6",
+        label: "Kimi K2.6",
+        note: "strong agentic tool use",
+        contextWindow: 256_000,
+    },
+    { id: "deepseek-ai/deepseek-v4-pro", label: "DeepSeek V4 Pro", contextWindow: 128_000 },
+    {
+        id: "deepseek-ai/deepseek-v4-flash-0731",
+        label: "DeepSeek V4 Flash",
+        note: "fast + cheap",
+        contextWindow: 128_000,
+    },
+];
+export const DEFAULT_MODEL = CURATED_MODELS[0].id;
+/**
+ * Context window for a model. Explicit config.contextWindow always wins; then
+ * the curated registry; then the default. Custom models can carry a window via
+ * config.pricing? no — via the registry lookup falling back to the default.
+ */
+export function contextWindowFor(modelId, config) {
+    if (config.contextWindow)
+        return config.contextWindow;
+    const known = CURATED_MODELS.find((m) => m.id === modelId)?.contextWindow;
+    return known ?? DEFAULT_CONTEXT_WINDOW;
+}
+/**
+ * A short display form of a model id for status-line use — the provider
+ * prefix plus a slugified curated label, size/param suffix (30B, 550B, …)
+ * dropped. Falls back to the raw id for anything not in the curated list
+ * (custom models), since there's no label to slugify.
+ */
+export function modelDisplaySlug(modelId) {
+    const curated = CURATED_MODELS.find((m) => m.id === modelId);
+    if (!curated)
+        return modelId;
+    const prefix = modelId.includes("/") ? modelId.slice(0, modelId.indexOf("/") + 1) : "";
+    const slug = curated.label
+        .replace(/\s+\d+B$/i, "")
+        .toLowerCase()
+        .replace(/[^a-z0-9.]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return `${prefix}${slug}`;
+}

package/dist/config/retention.js

@@ -0,0 +1,24 @@
+/**
+ * Default days to keep session transcripts, audit logs, and telemetry
+ * before auto-deleting them. Chosen deliberately short: these can carry
+ * secrets that passed through tool output, so there's no reason to keep
+ * them around by default longer than a couple of work weeks.
+ */
+export const DEFAULT_RETENTION_DAYS = 15;
+/**
+ * Resolves the retention window: KRITYA_RETENTION_DAYS env var wins if set,
+ * then config.retentionDays, then the 15-day default. 0 or negative means
+ * "keep forever" — auto-delete is disabled, not scheduled for "never".
+ */
+export function retentionDaysFor(config) {
+    const envVal = process.env.KRITYA_RETENTION_DAYS;
+    if (envVal !== undefined && envVal.trim() !== "") {
+        const n = Number(envVal);
+        if (Number.isFinite(n))
+            return n;
+    }
+    if (typeof config.retentionDays === "number" && Number.isFinite(config.retentionDays)) {
+        return config.retentionDays;
+    }
+    return DEFAULT_RETENTION_DAYS;
+}

package/dist/config/winAcl.js

@@ -0,0 +1,38 @@
+import { spawnSync } from "node:child_process";
+import os from "node:os";
+/**
+ * chmod's 0o600/0o700 modes are no-ops on NTFS — Windows access control
+ * lives in ACLs, not POSIX mode bits — so on Windows the secrets under
+ * CONFIG_DIR (config.json, trusted.json, mcp-trusted.json, session
+ * transcripts) would otherwise rely solely on the default per-user-profile
+ * ACL, giving no equivalent of the chmod-based owner-only isolation used on
+ * Linux/macOS. This strips inherited ACEs from the directory and grants full
+ * control, inheritable to everything created under it afterward, to only the
+ * current user and SYSTEM.
+ *
+ * Cached per-path per-process: the inheritable grant covers files and
+ * subdirectories created later, so this only needs to run once per directory
+ * per run rather than on every write.
+ */
+const hardenedDirs = new Set();
+function currentUserAccount() {
+    if (process.env.USERDOMAIN && process.env.USERNAME) {
+        return `${process.env.USERDOMAIN}\\${process.env.USERNAME}`;
+    }
+    return os.userInfo().username;
+}
+export function hardenWindowsDir(dirPath) {
+    if (os.platform() !== "win32")
+        return;
+    if (hardenedDirs.has(dirPath))
+        return;
+    hardenedDirs.add(dirPath);
+    try {
+        const user = currentUserAccount();
+        spawnSync("icacls", [dirPath, "/inheritance:r", "/grant:r", `${user}:(OI)(CI)F`, "/grant:r", "SYSTEM:(OI)(CI)F"], { stdio: "ignore", windowsHide: true });
+    }
+    catch {
+        // Best-effort — if icacls is unavailable, isolation still falls back to
+        // the default user-profile ACLs.
+    }
+}

package/dist/crash.js

@@ -0,0 +1,102 @@
+/**
+ * Last-resort handlers for an error that escaped every other guard.
+ *
+ * Without these, an unhandled rejection anywhere — an Ink render error, an MCP
+ * callback, a filesystem watcher edge case — terminates the process *without*
+ * firing the "exit" event, which is where every cleanup path in kritya hangs
+ * off. The visible cost is orphaned children: background dev servers, MCP
+ * stdio processes, and LSP servers all outlive the session that started them.
+ * The less visible cost is the terminal, which Ink leaves in raw mode with the
+ * cursor hidden, so the shell the user drops back into is unusable until they
+ * blind-type `reset`.
+ *
+ * A crash handler cannot make the crash not have happened. What it can do is
+ * make it survivable: release the machine's resources, hand the terminal back
+ * in a usable state, and tell the user where the transcript is so the session
+ * can be resumed rather than retyped.
+ */
+let installed = false;
+let handling = false;
+/**
+ * Put the terminal back the way we found it: raw mode off (or the shell reads
+ * keystrokes one at a time), cursor visible again (Ink hides it while
+ * rendering), and any alternate screen exited.
+ */
+function restoreTerminal() {
+    try {
+        if (process.stdin.isTTY && process.stdin.setRawMode)
+            process.stdin.setRawMode(false);
+    }
+    catch {
+        // Nothing to do — we're already on the failure path.
+    }
+    try {
+        if (process.stdout.isTTY)
+            process.stdout.write("\x1b[?25h\x1b[?1049l\x1b[0m");
+    }
+    catch {
+        // ditto
+    }
+}
+function describe(err) {
+    if (err instanceof Error)
+        return err.stack || `${err.name}: ${err.message}`;
+    return String(err);
+}
+/**
+ * Install `uncaughtException` / `unhandledRejection` handlers. Idempotent, and
+ * re-entrancy-safe: a second crash raised *while* handling the first exits
+ * immediately rather than recursing through cleanup again.
+ */
+export function installCrashHandlers(opts) {
+    if (installed)
+        return;
+    installed = true;
+    const onCrash = (err, kind) => {
+        if (handling) {
+            // Something in the crash path itself threw. Take the exit and go.
+            process.exit(1);
+        }
+        handling = true;
+        try {
+            opts.unmountUi?.();
+        }
+        catch {
+            // The UI is what crashed, quite possibly.
+        }
+        if (opts.restoreTerminal)
+            restoreTerminal();
+        try {
+            opts.cleanup();
+        }
+        catch {
+            // Best-effort by definition — we're exiting either way.
+        }
+        const lines = [
+            "",
+            `kritya crashed (${kind}). Background processes and MCP servers were shut down.`,
+            describe(err),
+        ];
+        try {
+            lines.push(...(opts.details?.() ?? []));
+        }
+        catch {
+            // A details() that throws must not cost us the error report above.
+        }
+        lines.push("", "This is a bug in kritya — the trace above is what a report needs.");
+        try {
+            process.stderr.write(lines.join("\n") + "\n");
+        }
+        catch {
+            // stderr is gone; nothing further to try.
+        }
+        process.exit(1);
+    };
+    process.on("uncaughtException", (err) => onCrash(err, "uncaught exception"));
+    process.on("unhandledRejection", (reason) => onCrash(reason, "unhandled rejection"));
+}
+/** Test seam: forget that handlers were installed. */
+export function resetCrashHandlersForTest() {
+    installed = false;
+    handling = false;
+}

package/dist/engine.js

@@ -0,0 +1,113 @@
+import path from "node:path";
+import { Agent } from "./agent/loop.js";
+import { CONFIG_DIR, legacyGlobalModel, loadConfig, loadDotEnv, resolveProvider, } from "./config/config.js";
+import { DEFAULT_MODEL, contextWindowFor } from "./config/models.js";
+import { PermissionManager } from "./permissions/permissions.js";
+import { loadRules } from "./permissions/rules.js";
+import { ProviderClient } from "./provider/client.js";
+import { createSwitchyardClient } from "./provider/switchyardClient.js";
+import { SWITCHYARD_ROUTE_ID, resolveEffectiveModel, stopSwitchyardSidecar, } from "./provider/switchyardSidecar.js";
+import { SessionStore } from "./session/store.js";
+import { AuditLog } from "./audit/audit.js";
+import { createTracer, cleanupOldTelemetry } from "./telemetry/tracer.js";
+import { createMeter } from "./telemetry/metrics.js";
+import { retentionDaysFor } from "./config/retention.js";
+import { backgroundManager } from "./shell/background.js";
+import { lspManager } from "./lsp/manager.js";
+import { ALL_TOOLS } from "./tools/index.js";
+import { loadHooks, HookRunner } from "./hooks/hooks.js";
+import { gatedContentHash, isTrusted } from "./trust/trust.js";
+import { installCrashHandlers } from "./crash.js";
+import { defaultSandboxMode } from "./shell/sandbox.js";
+/**
+ * Frontend-agnostic session bootstrap shared by every UI that drives the
+ * agent core (the Ink CLI builds its own richer version of this in
+ * index.tsx for trust/MCP prompts; headless.ts has its own one-shot
+ * variant). This is the version non-terminal frontends (e.g. the Electron
+ * app) should call instead of duplicating the setup — a change to how
+ * Agent is constructed or tools are wired only needs to happen here.
+ */
+export async function createEngineSession(dir, opts = {}) {
+    const workspace = path.resolve(dir);
+    loadDotEnv([path.join(CONFIG_DIR, ".env")]);
+    const hash = gatedContentHash(workspace);
+    const trustWorkspace = !hash || isTrusted(workspace, hash);
+    if (trustWorkspace)
+        loadDotEnv([path.join(workspace, ".env")]);
+    const config = loadConfig();
+    const provider = resolveProvider(config, opts.provider);
+    if (!provider.apiKey) {
+        throw new Error(`No API key found for provider "${provider.name}". Set it via env var, a .env file, or ~/.kritya/config.json.`);
+    }
+    const providerDefaultModel = config.providers?.[provider.name]?.model;
+    let currentModel = resolveEffectiveModel(provider.name, [opts.model, providerDefaultModel, legacyGlobalModel(config, provider.name)], provider.name === "switchyard" ? SWITCHYARD_ROUTE_ID : DEFAULT_MODEL);
+    const sampling = {
+        temperature: provider.temperature,
+        topP: provider.topP,
+        maxTokens: provider.maxTokens,
+    };
+    const client = provider.name === "switchyard"
+        ? await createSwitchyardClient(provider.apiKey, sampling)
+        : new ProviderClient(provider.apiKey, provider.baseUrl, sampling);
+    const session = new SessionStore(workspace);
+    session.start([]);
+    const sessionMeter = createMeter(session.id, config.otel);
+    // The crash path is fire-and-forget best-effort by Node's own constraints
+    // (a crash handler can't reliably await async work), so this uses the
+    // synchronous flush() rather than flushAndWait().
+    installCrashHandlers({
+        cleanup: () => {
+            backgroundManager.killAll();
+            lspManager.disposeAll();
+            sessionMeter.flush();
+            sessionMeter.stop();
+        },
+        details: () => (session.path ? ["", `Transcript: ${session.path}`] : []),
+    });
+    const retentionDays = retentionDaysFor(config);
+    SessionStore.cleanupOldSessions(retentionDays);
+    AuditLog.cleanupOld(retentionDays);
+    cleanupOldTelemetry(retentionDays);
+    const permissions = new PermissionManager(loadRules(workspace, trustWorkspace));
+    const agent = new Agent(client, () => currentModel, ALL_TOOLS, { workspace, sandboxMode: config.sandboxExec ?? defaultSandboxMode(), trustWorkspace }, permissions, session, []);
+    agent.contextWindow = contextWindowFor(currentModel, config);
+    if (config.maxSteps && config.maxSteps > 0)
+        agent.maxSteps = config.maxSteps;
+    if (config.toolTimeoutSeconds !== undefined) {
+        agent.toolTimeoutMs = config.toolTimeoutSeconds * 1000;
+    }
+    if (trustWorkspace) {
+        agent.hooks = new HookRunner(loadHooks(workspace, trustWorkspace), workspace);
+    }
+    agent.audit = AuditLog.forSession(session.id, config.audit);
+    agent.tracer = createTracer(session.id, config.otel);
+    agent.meter = sessionMeter;
+    if (agent.hooks)
+        agent.hooks.tracer = agent.tracer;
+    return {
+        agent,
+        session,
+        workspace,
+        provider: provider.name,
+        get model() {
+            return currentModel;
+        },
+        setModel(next) {
+            currentModel = next;
+            agent.contextWindow = contextWindowFor(next, config);
+        },
+        async dispose() {
+            backgroundManager.killAll();
+            lspManager.disposeAll();
+            if (provider.name === "switchyard")
+                stopSwitchyardSidecar();
+            // Normal (non-crash) shutdown: give the final metrics export a real
+            // chance to land, capped so a hung collector can't stall dispose().
+            await Promise.race([
+                sessionMeter.flushAndWait(),
+                new Promise((resolve) => setTimeout(resolve, 2000).unref()),
+            ]);
+            sessionMeter.stop();
+        },
+    };
+}

package/dist/git/git.js

@@ -0,0 +1,46 @@
+import { execFileSync } from "node:child_process";
+function git(cwd, args) {
+    try {
+        return execFileSync("git", args, {
+            cwd,
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 3000,
+        })
+            .toString()
+            .trimEnd();
+    }
+    catch {
+        return null; // not a repo, or git missing
+    }
+}
+export function gitBranch(cwd) {
+    const out = git(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    return out || null;
+}
+/** Branch + working-tree status, capped at 30 lines; null outside a repo. */
+export function gitStatusShort(cwd) {
+    const out = git(cwd, ["status", "--porcelain", "-b"]);
+    if (out === null)
+        return null;
+    const lines = out.split("\n");
+    return lines.length > 30
+        ? [...lines.slice(0, 30), `… (${lines.length - 30} more changed files)`].join("\n")
+        : out;
+}
+/**
+ * A summary of uncommitted changes: the diffstat plus a capped unified diff of
+ * both staged and unstaged work. Null outside a repo; empty string if clean.
+ */
+export function gitDiffStat(cwd, maxLines = 200) {
+    const stat = git(cwd, ["diff", "HEAD", "--stat"]);
+    if (stat === null)
+        return null;
+    if (!stat.trim())
+        return "";
+    const diff = git(cwd, ["diff", "HEAD"]) ?? "";
+    const lines = diff.split("\n");
+    const capped = lines.length > maxLines
+        ? [...lines.slice(0, maxLines), `… (${lines.length - maxLines} more diff lines)`].join("\n")
+        : diff;
+    return `${stat}\n\n${capped}`;
+}