kritya 0.8.22-beta → 0.8.24-beta

package/dist/tools/document/pdf.js

@@ -9,6 +9,15 @@ import { validateBlocks } from "./types.js";
 // fileURLToPath yields backslash-separated paths — normalize to forward
 // slashes, which fs.readFile accepts on every platform.
 const STANDARD_FONT_DATA_URL = fileURLToPath(new URL("../../../node_modules/pdfjs-dist/standard_fonts/", import.meta.url)).replace(/\\/g, "/");
+/**
+ * A hostile or corrupt PDF can declare an enormous page count, or pack a
+ * huge amount of text into a single page; without a cap, extracting text
+ * page-by-page has no upper bound on how long it runs or how much memory the
+ * accumulated text consumes. Both caps stop the extraction early rather than
+ * failing outright — the caller gets whatever was read so far, plus a note.
+ */
+const MAX_PDF_PAGES = 5_000;
+const MAX_PDF_TEXT_CHARS = 5_000_000;
 export async function readPdf(buf) {
     const loadingTask = getDocument({
         data: new Uint8Array(buf),
@@ -16,16 +25,27 @@ export async function readPdf(buf) {
     });
     const doc = await loadingTask.promise;
     const pageTexts = [];
-    for (let i = 1; i <= doc.numPages; i++) {
+    let totalChars = 0;
+    let truncated = false;
+    const pageCount = Math.min(doc.numPages, MAX_PDF_PAGES);
+    for (let i = 1; i <= pageCount; i++) {
         const page = await doc.getPage(i);
         const content = await page.getTextContent();
         const text = content.items
             .map((item) => ("str" in item ? item.str : ""))
             .join(" ");
         pageTexts.push(text);
+        totalChars += text.length;
+        if (totalChars > MAX_PDF_TEXT_CHARS) {
+            truncated = true;
+            break;
+        }
     }
     await loadingTask.destroy();
-    return pageTexts.join("\n\n");
+    if (pageCount < doc.numPages)
+        truncated = true;
+    return (pageTexts.join("\n\n") +
+        (truncated ? `\n\n... [truncated: read ${pageTexts.length} of ${doc.numPages} page(s)]` : ""));
 }
 const PAGE_WIDTH = 612; // US Letter, points
 const PAGE_HEIGHT = 792;

package/dist/tools/document/pptx.js

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import JSZip from "jszip";
+import { loadSafeZip } from "./zipSafety.js";
 // pptxgenjs is CommonJS-only and its bundled types don't resolve cleanly
 // under NodeNext + esModuleInterop (the default import type-checks as the
 // module namespace, not the constructor). Load it via require and type the
@@ -9,7 +9,10 @@ const PptxGenJS = require("pptxgenjs");
 // Matches text runs inside slide XML, e.g. <a:t>Hello</a:t>.
 const TEXT_RUN_RE = /<a:t>([^<]*)<\/a:t>/g;
 export async function readPptx(buf) {
-    const zip = await JSZip.loadAsync(buf);
+    // .pptx is a zip container; same decompression-bomb exposure as .xlsx/.docx
+    // (see zipSafety.ts) — validate declared uncompressed size before reading
+    // any entry's content.
+    const zip = await loadSafeZip(buf);
     const slideFiles = Object.keys(zip.files)
         .filter((name) => /^ppt\/slides\/slide\d+\.xml$/.test(name))
         .sort((a, b) => slideNumber(a) - slideNumber(b));

package/dist/tools/document/xlsx.js

@@ -1,27 +1,12 @@
 import ExcelJS from "exceljs";
-import JSZip from "jszip";
+import { loadSafeZip } from "./zipSafety.js";
 const CELL_REF_RE = /^[A-Za-z]{1,3}[1-9][0-9]*$/;
 // exceljs's xlsx loader decompresses every entry of the .xlsx zip with no
-// size limit (CVE-2026-78206, unpatched upstream as of this writing) — a
-// small file whose declared uncompressed size is huge can exhaust memory
-// before exceljs itself ever runs. JSZip.loadAsync only reads the central
-// directory (cheap, no inflation), so summing each entry's *declared*
-// uncompressed size here rejects a bomb before handing the buffer to exceljs.
-const MAX_XLSX_UNCOMPRESSED_BYTES = 200 * 1024 * 1024;
+// size limit (CVE-2026-78206, unpatched upstream as of this writing) — see
+// zipSafety.ts for why checking declared sizes up front (via JSZip, which
+// doesn't inflate) catches this before exceljs itself ever runs.
 async function assertSafeXlsxSize(buf) {
-    const zip = await JSZip.loadAsync(buf);
-    let total = 0;
-    for (const entry of Object.values(zip.files)) {
-        // `_data` is JSZip's internal CompressedObject; there is no public API
-        // for a zip entry's declared (pre-inflation) uncompressed size.
-        total +=
-            entry._data?.uncompressedSize ?? 0;
-        if (total > MAX_XLSX_UNCOMPRESSED_BYTES) {
-            throw new Error(`This .xlsx file's declared uncompressed size exceeds ` +
-                `${MAX_XLSX_UNCOMPRESSED_BYTES / (1024 * 1024)}MB and was refused ` +
-                `as a likely decompression bomb rather than risk exhausting memory.`);
-        }
-    }
+    await loadSafeZip(buf);
 }
 export async function readXlsx(buf) {
     await assertSafeXlsxSize(buf);

package/dist/tools/document/zipSafety.js

@@ -0,0 +1,34 @@
+import JSZip from "jszip";
+/**
+ * .docx, .xlsx, and .pptx are all zip containers, and every library that
+ * reads them (exceljs, mammoth, and this codebase's own pptx reader via
+ * JSZip directly) decompresses each entry with no size limit — a small file
+ * whose declared uncompressed size is huge can exhaust memory before the
+ * library that actually parses the format ever runs (see CVE-2026-78206 for
+ * exceljs specifically; mammoth uses the same unbounded JSZip decompression
+ * path). Loading with JSZip first only reads the central directory (cheap,
+ * no inflation) so summing each entry's *declared* uncompressed size rejects
+ * a bomb before any real parsing starts.
+ */
+const MAX_ZIP_UNCOMPRESSED_BYTES = 200 * 1024 * 1024;
+/** Throws if `zip`'s entries declare more than `maxBytes` of uncompressed data combined. */
+export function assertSafeZipEntries(zip, maxBytes = MAX_ZIP_UNCOMPRESSED_BYTES) {
+    let total = 0;
+    for (const entry of Object.values(zip.files)) {
+        // `_data` is JSZip's internal CompressedObject; there is no public API
+        // for a zip entry's declared (pre-inflation) uncompressed size.
+        total +=
+            entry._data?.uncompressedSize ?? 0;
+        if (total > maxBytes) {
+            throw new Error(`This file's declared uncompressed size exceeds ` +
+                `${maxBytes / (1024 * 1024)}MB and was refused as a likely decompression bomb ` +
+                `rather than risk exhausting memory.`);
+        }
+    }
+}
+/** Loads `buf` as a zip and validates its declared uncompressed size, returning the loaded zip for reuse. */
+export async function loadSafeZip(buf, maxBytes = MAX_ZIP_UNCOMPRESSED_BYTES) {
+    const zip = await JSZip.loadAsync(buf);
+    assertSafeZipEntries(zip, maxBytes);
+    return zip;
+}

package/dist/tools/document.js

@@ -7,6 +7,13 @@ import { readXlsx, writeXlsx, editXlsx } from "./document/xlsx.js";
 import { readPptx, writePptx } from "./document/pptx.js";
 import { readPdf, writePdf, editPdf } from "./document/pdf.js";
 const READABLE_EXTENSIONS = [".docx", ".xlsx", ".pptx", ".pdf"];
+/**
+ * Bound the raw file read before it's dispatched to any format-specific
+ * reader. Each reader has its own internal limits (zip decompression caps,
+ * PDF page/text caps), but those only kick in once parsing has started —
+ * this stops an absurdly large file from being buffered into memory at all.
+ */
+const MAX_DOCUMENT_FILE_BYTES = 200 * 1024 * 1024;
 const BLOCK_SCHEMA = {
     type: "array",
     description: "Flowed content blocks, in document order.",
@@ -39,6 +46,11 @@ export const readDocumentTool = {
         const relPath = String(args.path);
         const abs = resolveSafe(ctx.workspace, relPath);
         const ext = path.extname(abs).toLowerCase();
+        const { size } = await fs.stat(abs);
+        if (size > MAX_DOCUMENT_FILE_BYTES) {
+            throw new Error(`${relPath} is ${Math.round(size / (1024 * 1024))}MB, over the ` +
+                `${MAX_DOCUMENT_FILE_BYTES / (1024 * 1024)}MB limit for read_document.`);
+        }
         const buf = await fs.readFile(abs);
         switch (ext) {
             case ".docx":

package/dist/tools/fetchUrl.js

@@ -1,7 +1,6 @@
 import { lookup as dnsLookup } from "node:dns/promises";
-import { Agent } from "undici";
 import { truncateResult } from "./common.js";
-import { isPrivateOrLoopbackHost } from "../net/urlSafety.js";
+import { isPrivateOrLoopbackHost, pinnedDispatcher, } from "../net/urlSafety.js";
 /** Cap on how much text a single fetch returns, unless the caller asks for less. */
 const DEFAULT_MAX_CHARS = 20_000;
 /** Give up on a slow or hanging server rather than blocking the whole turn. */
@@ -67,41 +66,6 @@ export async function hostResolvesToPrivateAddress(hostname, lookupFn = dnsLooku
 }
 /** Refuse to keep chasing redirects forever. */
 const MAX_REDIRECTS = 5;
-/**
- * The actual SSRF boundary: a connect-time `lookup` on a dedicated undici
- * Agent, so the address that gets validated is the exact address the socket
- * connects to — one DNS answer, not two. Checking the hostname up front and
- * then letting `fetch` re-resolve it independently (the previous approach)
- * left a TOCTOU window: attacker-controlled or short-TTL DNS can answer
- * differently the second time (classic DNS rebinding). Pinning the lookup
- * closes that regardless of hop, hostname, or TTL.
- */
-const pinnedDispatcher = new Agent({
-    connect: {
-        lookup(hostname, options, callback) {
-            dnsLookup(hostname, { all: true })
-                .then((addresses) => {
-                if (addresses.length === 0) {
-                    callback(new Error(`Could not resolve ${hostname}`), []);
-                    return;
-                }
-                const bad = addresses.find((a) => isPrivateOrLoopbackHost(a.address));
-                if (bad) {
-                    callback(new Error(`Refusing to connect to ${hostname}: resolves to private/internal address ${bad.address}`), []);
-                    return;
-                }
-                if (options.all) {
-                    callback(null, addresses);
-                }
-                else {
-                    const chosen = addresses[0];
-                    callback(null, chosen.address, chosen.family);
-                }
-            })
-                .catch((err) => callback(err, []));
-        },
-    },
-});
 /**
  * Fetch `url`, following redirects manually so every hop — not just the
  * original URL — is checked against assertPublicUrl before the (DNS-pinned)

package/dist/tools/notebook.js

@@ -56,7 +56,20 @@ function summarizeOutputs(outputs) {
     return (text.slice(0, MAX_OUTPUT_CHARS) +
         `\n... [output truncated, ${text.length - MAX_OUTPUT_CHARS} more characters]`);
 }
+/**
+ * Cell *output* text is already capped post-parse (MAX_OUTPUT_CHARS above),
+ * but nothing bounded the input file itself — a pathologically large
+ * .ipynb (corrupt, or a runaway export) would otherwise be read and
+ * JSON.parse'd whole regardless of size. Real notebooks are nowhere near
+ * this large even with heavy output.
+ */
+const MAX_NOTEBOOK_FILE_BYTES = 50 * 1024 * 1024;
 async function loadNotebook(abs) {
+    const { size } = await fs.stat(abs);
+    if (size > MAX_NOTEBOOK_FILE_BYTES) {
+        throw new Error(`Notebook file is ${Math.round(size / (1024 * 1024))}MB, over the ` +
+            `${MAX_NOTEBOOK_FILE_BYTES / (1024 * 1024)}MB limit for reading a .ipynb file.`);
+    }
     const text = await fs.readFile(abs, "utf8");
     let nb;
     try {

package/dist/tools/shell.js

@@ -38,7 +38,12 @@ export const shellTool = {
     // background command returns immediately. A second, shorter cap from the
     // agent loop would cut off commands the user explicitly asked to run longer.
     timeoutMs: 0,
-    summarize: (args) => `Run${args.background ? " in background" : ""}: ${args.command}`,
+    // The summary is what lands in the audit log and telemetry spans (see
+    // toolExecutor's `kritya.summary` attribute), so it needs the same
+    // redaction as the background-start echo below — otherwise a credential
+    // embedded in the command (e.g. a curl Authorization header) gets
+    // persisted in plain text on every ordinary foreground call.
+    summarize: (args) => `Run${args.background ? " in background" : ""}: ${redactSecrets(String(args.command ?? "")).redacted}`,
     // A command that printed nothing needs no preview to say so — but every
     // other command's output is the answer, so keep it (null = show the preview).
     resultSummary: (output) => (output.trim() === "(no output)" ? "no output" : null),

package/dist/ui/App.js

@@ -30,7 +30,7 @@ const IMAGE_RE = /\.(png|jpe?g|gif|webp|bmp)$/i;
 // Erase screen + scrollback, then home the cursor (same sequence Ink itself
 // uses for its own "content taller than the terminal" clear path).
 const CLEAR_TERMINAL = "\x1b[2J\x1b[3J\x1b[H";
-export function App({ agent, workspace, modelRef, providerRef, config, resumedCount, initialTasks, undoStack, uiBridge, resumeSessions, customCommands = [], mcpToolCount = 0, onSwitchClient, onRequestPermissionReady, onRequestElicitationReady, }) {
+export function App({ agent, workspace, modelRef, providerRef, config, resumedCount, initialTasks, undoStack, uiBridge, resumeSessions, customCommands = [], mcpToolCount = 0, onSwitchClient, onRequestPermissionReady, onRequestElicitationReady, privacyMode, }) {
     const { exit } = useApp();
     const { stdout } = useStdout();
     const [input, setInput] = useState("");
@@ -125,7 +125,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             .catch(() => { });
     }, [workspace]);
     useEffect(refreshFileList, [refreshFileList]);
-    const { items, addItem, phase, setPhase, stream, thinking, activity, setActivity, runningPhase, setRunningPhase, workflow, refreshWorkflow, permission, elicitation, inFlight, model, provider, servedModel, totalUsage, totalCost, tasks, setTasks, ctxPct, setCtxPct, tokenBudget, budgetPct, budgetUsed, budgetStopped, resetBudget, setBudgetLimit, branch, planMode, setPlanMode, dryRunMode, killed, killReason, engageKill, releaseKill, acceptEdits, setAcceptEdits, autoApprovedCount, cycleMode, onAcceptEditsConfirm, abortRef, setModelEverywhere, setProviderEverywhere, costReport, runAgent, runWebSearch, onPermissionDecision, onElicitationDecision, onResumeSelect, requestPermission, requestElicitation, } = useAgent({
+    const { items, addItem, phase, setPhase, stream, thinking, activity, setActivity, runningPhase, setRunningPhase, workflow, refreshWorkflow, permission, elicitation, inFlight, model, provider, servedModel, totalUsage, totalCost, tasks, setTasks, ctxPct, setCtxPct, tokenBudget, budgetPct, budgetUsed, budgetStopped, resetBudget, setBudgetLimit, branch, planMode, setPlanMode, dryRunMode, killed, killReason, engageKill, releaseKill, acceptEdits, setAcceptEdits, autoApprovedCount, cycleMode, onAcceptEditsConfirm, abortRef, setModelEverywhere, setProviderEverywhere, costReport, runAgent, runWebSearch, onPermissionDecision, onElicitationDecision, onResumeSelect, requestPermission, requestElicitation, persistenceWarningCount, } = useAgent({
         agent,
         workspace,
         modelRef,
@@ -195,6 +195,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             return;
         }
         if (key.escape && phase === "working") {
+            setActivity("cancelling…");
             abortRef.current?.abort();
         }
         // Ctrl+O toggles showing full tool output.
@@ -444,7 +445,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
                                     setInput((prev) => (isCtrlEcho(prev, v) ? prev : v.replace(/\t/g, "")));
                                     setCmdIndex(0);
                                     setFileIndex(0);
-                                }, onSubmit: handleSubmit }, inputKey)] }), suggestions.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [suggestions.map((c, i) => (_jsxs(Text, { color: i === selectedCmd ? "cyan" : undefined, children: [i === selectedCmd ? "❯ " : "  ", _jsx(Text, { bold: i === selectedCmd, children: c.name }), _jsxs(Text, { dimColor: true, children: [" \u2014 ", c.description] })] }, c.name))), _jsx(Text, { dimColor: true, children: "\u2191\u2193 select \u00B7 Tab/Enter select \u00B7 Enter again to run" })] })), fileSuggestions.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [fileSuggestions.map((f, i) => (_jsxs(Text, { color: i === selectedFile ? "cyan" : undefined, children: [i === selectedFile ? "❯ " : "  ", f] }, f))), _jsx(Text, { dimColor: true, children: "\u2191\u2193 select \u00B7 Tab/Enter attach file" })] }))] })), _jsx(Box, { children: _jsx(StatusLine, { killed: killed, killReason: killReason, dryRunMode: dryRunMode, planMode: planMode, acceptEdits: acceptEdits, autoApprovedCount: autoApprovedCount, model: servedModel && servedModel !== model
+                                }, onSubmit: handleSubmit }, inputKey)] }), suggestions.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [suggestions.map((c, i) => (_jsxs(Text, { color: i === selectedCmd ? "cyan" : undefined, children: [i === selectedCmd ? "❯ " : "  ", _jsx(Text, { bold: i === selectedCmd, children: c.name }), _jsxs(Text, { dimColor: true, children: [" \u2014 ", c.description] })] }, c.name))), _jsx(Text, { dimColor: true, children: "\u2191\u2193 select \u00B7 Tab/Enter select \u00B7 Enter again to run" })] })), fileSuggestions.length > 0 && (_jsxs(Box, { flexDirection: "column", paddingLeft: 2, children: [fileSuggestions.map((f, i) => (_jsxs(Text, { color: i === selectedFile ? "cyan" : undefined, children: [i === selectedFile ? "❯ " : "  ", f] }, f))), _jsx(Text, { dimColor: true, children: "\u2191\u2193 select \u00B7 Tab/Enter attach file" })] }))] })), _jsx(Box, { children: _jsx(StatusLine, { killed: killed, killReason: killReason, dryRunMode: dryRunMode, planMode: planMode, acceptEdits: acceptEdits, autoApprovedCount: autoApprovedCount, provider: provider, model: servedModel && servedModel !== model
                         ? `${model}-${modelDisplaySlug(servedModel)}`
-                        : model, workflow: workflow, branch: branch, tasks: tasks, ctxPct: ctxPct, budgetPct: budgetPct, budgetStopped: budgetStopped, phase: phase, elapsed: elapsed, totalUsage: totalUsage, totalCost: totalCost, verbose: verbose, workspace: workspace, sandboxActive: (config.sandboxExec ?? defaultSandboxMode()) !== "off" && sandboxAvailable() }) })] }));
+                        : model, workflow: workflow, branch: branch, tasks: tasks, ctxPct: ctxPct, budgetPct: budgetPct, budgetStopped: budgetStopped, phase: phase, elapsed: elapsed, totalUsage: totalUsage, totalCost: totalCost, verbose: verbose, workspace: workspace, sandboxActive: (config.sandboxExec ?? defaultSandboxMode()) !== "off" && sandboxAvailable(), persistenceWarningCount: persistenceWarningCount, privacyMode: privacyMode }) })] }));
 }

package/dist/ui/StatusLine.js

@@ -1,11 +1,16 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { Text } from "ink";
-import path from "node:path";
 /** The single dim status bar pinned to the bottom of the screen. */
-export function StatusLine({ killed, killReason, dryRunMode, planMode, acceptEdits, autoApprovedCount, model, workflow, branch, tasks, ctxPct, budgetPct, budgetStopped, phase, elapsed, totalUsage, totalCost, verbose, workspace, sandboxActive, }) {
-    return (_jsxs(Text, { dimColor: true, children: [killed ? (_jsxs(Text, { bold: true, color: "red", children: ["\u26D4 KILLED", killReason ? ` (${killReason})` : "", " \u00B7", " "] })) : (""), dryRunMode ? (_jsx(Text, { color: "cyan", children: "dry-run \u00B7 " })) : planMode ? (_jsx(Text, { color: "cyan", children: "plan \u00B7 " })) : acceptEdits ? (_jsxs(Text, { color: "green", children: ["accept edits (", autoApprovedCount, " auto-approved) \u00B7 "] })) : (""), model, _jsxs(Text, { color: sandboxActive ? "green" : "red", children: [" ", "\u00B7 ", sandboxActive ? "🔒 sandbox:active" : "🔓 sandbox:inactive"] }), workflow ? (_jsxs(Text, { color: "magenta", children: [" ", "\u00B7 \u2691 ", workflow.name, ":", workflow.phase] })) : (""), branch ? ` · ⎇ ${branch}` : "", tasks.length > 0
+export function StatusLine({ killed, killReason, dryRunMode, planMode, acceptEdits, autoApprovedCount, provider, model, workflow, branch, tasks, ctxPct, budgetPct, budgetStopped, phase, elapsed, totalUsage, totalCost, verbose, workspace, sandboxActive, persistenceWarningCount, privacyMode, }) {
+    return (_jsxs(Text, { dimColor: true, children: [killed ? (_jsxs(Text, { bold: true, color: "red", children: ["\u26D4 KILLED", killReason ? ` (${killReason})` : "", " \u00B7", " "] })) : (""), _jsxs(Text, { color: dryRunMode || planMode ? "cyan" : acceptEdits ? "green" : undefined, children: ["mode:", " ", dryRunMode
+                        ? "dry-run"
+                        : planMode
+                            ? "plan"
+                            : acceptEdits
+                                ? `accept-edits (${autoApprovedCount} auto)`
+                                : "default", " · "] }), provider, "/", model, _jsxs(Text, { color: sandboxActive ? "green" : "red", children: [" ", "\u00B7 ", sandboxActive ? "🔒 sandbox:active" : "🔓 sandbox:inactive"] }), workflow ? (_jsxs(Text, { color: "magenta", children: [" ", "\u00B7 \u2691 ", workflow.name, ":", workflow.phase] })) : (""), branch ? ` · ⎇ ${branch}` : "", tasks.length > 0
                 ? ` · tasks ${tasks.filter((t) => t.status === "done").length}/${tasks.length}`
-                : "", ctxPct > 0 ? ` · ctx ${ctxPct}%` : "", budgetPct > 0 ? (_jsxs(Text, { color: budgetStopped ? "red" : budgetPct >= 80 ? "yellow" : undefined, children: [" ", "\u00B7 budget ", budgetPct, "%"] })) : (""), phase === "working" && elapsed > 0 ? ` · ${elapsed}s` : "", " \u00B7", " ", totalUsage.estimated ? "~" : "", totalUsage.promptTokens.toLocaleString(), " in", (totalUsage.cachedPromptTokens ?? 0) > 0
+                : "", ctxPct > 0 ? ` · ctx ${ctxPct}%` : "", budgetPct > 0 ? (_jsxs(Text, { color: budgetStopped ? "red" : budgetPct >= 80 ? "yellow" : undefined, children: [" ", "\u00B7 budget ", budgetPct, "%"] })) : (""), phase === "working" && elapsed > 0 ? ` · ${elapsed}s` : "", " \u00B7", " ", totalUsage.estimated ? "~" : "", "tokens: ", totalUsage.promptTokens.toLocaleString(), " in", (totalUsage.cachedPromptTokens ?? 0) > 0
                 ? ` (${Math.round(((totalUsage.cachedPromptTokens ?? 0) / totalUsage.promptTokens) * 100)}% cached)`
-                : "", " ", "/ ", totalUsage.completionTokens.toLocaleString(), " out", totalCost > 0 ? ` · $${totalCost.toFixed(4)}` : "", verbose ? " · verbose" : "", " \u00B7 ", path.basename(workspace)] }));
+                : "", " ", "/ ", totalUsage.completionTokens.toLocaleString(), " out", totalCost > 0 ? ` · $${totalCost.toFixed(4)}` : "", persistenceWarningCount > 0 ? (_jsxs(Text, { color: "yellow", children: [" \u00B7 \u26A0 persistence warnings: ", persistenceWarningCount] })) : (""), privacyMode ? _jsx(Text, { color: "cyan", children: " \u00B7 privacy:on" }) : "", verbose ? " · verbose" : "", " \u00B7 workspace: ", workspace] }));
 }

package/dist/ui/useAgent.js

@@ -12,6 +12,18 @@ import { tavilySearch } from "../tools/webSearch.js";
 import { killActiveNotice, useKillSwitch } from "./useKillSwitch.js";
 import { useUsageBudget } from "./useUsageBudget.js";
 import { useSessionResume } from "./useSessionResume.js";
+import { activePersistenceWarnings, onPersistenceWarning } from "../config/debug.js";
+function initialToolStatus(name) {
+    if (name.startsWith("mcp_"))
+        return "contacting MCP server…";
+    if (name.startsWith("lsp_"))
+        return "querying language server…";
+    if (name.includes("document"))
+        return "processing document…";
+    if (name.includes("notebook"))
+        return "processing notebook…";
+    return undefined;
+}
 /**
  * Owns everything tied to running agent turns: the transcript, streaming and
  * permission state, usage/cost tracking, and session resume. Input handling
@@ -44,6 +56,21 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
     const [stream, setStream] = useState("");
     const [thinking, setThinking] = useState(false);
     const [activity, setActivity] = useState(null);
+    const [persistenceWarningCount, setPersistenceWarningCount] = useState(() => activePersistenceWarnings().length);
+    useEffect(() => onPersistenceWarning((warnings) => setPersistenceWarningCount(warnings.length)), []);
+    /**
+     * Compaction calls the model directly and can take a while, so without this
+     * the spinner would sit frozen on whatever it showed before compaction
+     * started until onToolEnd's after-the-fact "compact" record appears.
+     */
+    useEffect(() => {
+        agent.onCompactStart = () => setActivity("compacting context…");
+        agent.onCompactEnd = () => setActivity(null);
+        return () => {
+            agent.onCompactStart = undefined;
+            agent.onCompactEnd = undefined;
+        };
+    }, [agent]);
     /**
      * Which workflow phase the *current turn* is running. Turn-scoped and cleared
      * when the turn ends, unlike `workflow` below — `activity` can't carry this,
@@ -355,6 +382,7 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
             return;
         }
         setPhase("working");
+        setActivity(`Calling ${provider}/${model}…`);
         const ac = new AbortController();
         abortRef.current = ac;
         setInFlight([]);
@@ -372,7 +400,10 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
                 },
                 onToolStart: (id, name, summary) => {
                     setStream("");
-                    setInFlight((prev) => [...prev, { id, name, summary }]);
+                    setInFlight((prev) => [
+                        ...prev,
+                        { id, name, summary, status: initialToolStatus(name) },
+                    ]);
                 },
                 onToolEnd: (id, name, summary, preview, isError, resultSummary) => {
                     setInFlight((prev) => prev.filter((t) => t.id !== id));
@@ -397,6 +428,10 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
                     setStream("");
                     setActivity(`Provider error${status ? ` (${status})` : ""} — retrying (attempt ${attempt})…`);
                 },
+                onFallback: (from, to) => {
+                    setStream("");
+                    setActivity(`${from} unavailable — trying fallback model ${to}…`);
+                },
                 onUsage: (usage) => {
                     if (usage.servedModel)
                         setServedModel(usage.servedModel);
@@ -498,6 +533,7 @@ export function useAgent({ agent, workspace, modelRef, providerRef, config, uiBr
         totalCost,
         tasks,
         setTasks,
+        persistenceWarningCount,
         ctxPct,
         setCtxPct,
         tokenBudget,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.22-beta",
+  "version": "0.8.24-beta",
   "description": "Kritya — a lean, provider-agnostic terminal coding agent (NVIDIA, OpenAI, OpenRouter, Groq, Ollama, and more)",
   "type": "module",
   "publishConfig": {