talos-code 0.0.1 → 0.2.0

package/dist/i18n/kernel-map.js

@@ -0,0 +1,139 @@
+/*
+ * R2 lane E (gate E4, E5, E15): the kernel's identifiers → the CLI's English. The kernel is not edited in R2 (Q-R2-8), and it
+ * speaks Italian; what crosses into the CLI and is stable is mapped here and nowhere else.
+ *
+ * ⛔ Two exact-text tables exist because the kernel DROPS the structured fields at the RunError boundary: the public
+ *   provider error carries `classe`/`stato` (`runtime-owner-adapter.mjs:717-727`), but `agent-service.mjs:1991` forwards only
+ *   `{message, code}`, so the CLI sees `PROVIDER_REQUEST_ERROR` plus one of eight fixed sentences. Those sentences are kernel
+ *   CONSTANTS, compared whole (never searched for a word), and `test/i18n/errors-view.test.ts` pins every one of them
+ *   against the kernel source, as `brokered-executor.ts` pins its three markers: a reworded kernel turns the test red
+ *   instead of silently falling back to the generic words.
+ */
+import { t, tn } from "./index.js";
+/** `erroreFornitorePubblico` (runtime-owner-adapter.mjs:718-725): the eight public sentences and the class each one names. */
+export const KERNEL_PROVIDER_MESSAGES = Object.freeze({
+    'Troppo traffico presso il fornitore.': 'rate-limited',
+    'Credenziale rifiutata dal fornitore.': 'credential',
+    'Credito non disponibile presso il fornitore.': 'credit',
+    'Connessione con il fornitore interrotta.': 'network',
+    'Il fornitore ha superato il tempo massimo.': 'timeout',
+    'Il fornitore non risponde.': 'server-error',
+    'La risposta del fornitore si è interrotta.': 'stream-cut',
+    'Il fornitore non ha accettato la richiesta.': 'not-accepted',
+});
+/** The kernel's `classe` values (research-orchestrator.mjs `classificaErroreDiCorsa`), for errors that still carry them. */
+export const KERNEL_CLASSES = Object.freeze({
+    traffico: 'rate-limited', credenziale: 'credential', credito: 'credit', rete: 'network', 'timeout-fornitore': 'timeout',
+    'guasto-fornitore': 'server-error', 'flusso-interrotto': 'stream-cut', 'richiesta-non-valida': 'not-accepted', contesto: 'context', ignoto: 'not-accepted',
+});
+/** Transport codes the kernel names itself (runtime-owner-adapter.mjs:769-774, :705) and Node's undici codes. */
+export const TRANSPORT_CODES = Object.freeze({
+    PROVIDER_NETWORK_ERROR: 'network', PROVIDER_SILENCE: 'network', UND_ERR_BODY_TIMEOUT: 'network', UND_ERR_SOCKET: 'network',
+    ECONNRESET: 'network', ECONNREFUSED: 'network', ENOTFOUND: 'network', EAI_AGAIN: 'network',
+    PROVIDER_FIRST_RESPONSE_TIMEOUT: 'timeout', UND_ERR_HEADERS_TIMEOUT: 'timeout', UND_ERR_CONNECT_TIMEOUT: 'timeout',
+});
+/** RunError codes that are task OUTCOMES (agent-service.mjs:160-185), not service failures. */
+export const RUN_OUTCOMES = Object.freeze({ fermato: 'stopped', 'giri-esauriti': 'turns-exhausted', ripetizione: 'repetition', 'premesse-negate': 'premise-denied' });
+/** The kernel's lowercase outcome codes are Italian words; the screen shows these English codes instead (D-05). The JSON
+ *  envelope keeps the kernel's code unchanged (v1 frozen, gate E11). */
+export const DISPLAY_CODES = Object.freeze({
+    fermato: 'INTERRUPTED', 'giri-esauriti': 'TURNS_EXHAUSTED', ripetizione: 'REPEATED_TOOL_CALL', 'premesse-negate': 'PREMISE_DENIED', 'internal-error': 'INTERNAL_ERROR',
+    /* Kernel codes spelled in Italian (plugin-registry.mjs:460-665, http-app.mjs:89-90): a code on screen is a word on screen. */
+    PLUGIN_COMANDO_ESEGUE_CODICE: 'PLUGIN_COMMAND_RUNS_CODE', PLUGIN_COMANDO_FUORI_DAL_PACCHETTO: 'PLUGIN_COMMAND_OUTSIDE_PACKAGE',
+    PLUGIN_COMANDO_NON_LEGGIBILE: 'PLUGIN_COMMAND_UNREADABLE', PLUGIN_ID_AMBIGUO: 'PLUGIN_ID_AMBIGUOUS', DOVE_NON_VALIDO: 'LOCATION_INVALID',
+    SCELTA_NON_VALIDA: 'CHOICE_INVALID',
+});
+/** Kernel run texts compared whole. `fermato` covers both the person's stop and a generation that stopped by itself
+ *  (talosHarness.mjs:1472 vs :10207); only this constant tells the second apart. */
+export const KERNEL_RUN_TEXT = Object.freeze({
+    stoppedWithoutAnswer: '⛔ la generazione si e fermata senza risposta e senza esaurire i giri.',
+});
+/*
+ * Kernel notices sent as a whole assistant chat message, not as an event with a code (`agent-service.mjs:1926-1930`
+ * `onAvviso`, `:1938-1940` provider switch): `runtime-owner-adapter.mjs:857, 968-969`. Matched only as the WHOLE message
+ * against the kernel template (anchored, the provider labels as the only variables), pinned by errors-view.test.ts; a
+ * model's own answer in Italian never matches and is never rewritten.
+ */
+export const KERNEL_NOTICES = Object.freeze([
+    { pattern: /^Una chiave di (?<provider>.+?) è stata rifiutata: controlla Fornitori e accessi\.$/u, id: 'error.notice.keyRefused', fragment: 'è stata rifiutata: controlla Fornitori e accessi.' },
+    { pattern: /^Il fornitore (?<from>.+?) limita il traffico: continuo con (?<to>.+?) · modello (?<model>.+)$/u, id: 'error.notice.switchRateLimited', fragment: 'limita il traffico: continuo con' },
+    { pattern: /^Il fornitore (?<from>.+?) non risponde: continuo con (?<to>.+?) · modello (?<model>.+)$/u, id: 'error.notice.switchNotAnswering', fragment: 'non risponde: continuo con' },
+]);
+/** Permission `via` of a refused tool receipt (talosHarness.mjs:6512-8597) → the dictionary id of its English. The five
+ *  "asked" vias (`viaRichiesta`, :6608) refused mean the person said no. */
+export const REFUSAL_VIA = Object.freeze({
+    'segreto-forza-conferma': 'notApproved', 'attrezzo-sempre-da-confermare': 'notApproved', 'trifecta-forza-conferma': 'notApproved',
+    'livello-su-richiesta': 'notApproved', 'permesso-per-attrezzo-chiedi': 'notApproved',
+    'permesso-per-attrezzo-nega': 'toolOff', 'livello-lettura': 'readOnly', 'livello-ricerca': 'research', 'livello-scrittura-area': 'workspaceWrite',
+    'fermato-su-richiesta': 'stopped', 'floor-comando-senza-recupero': 'noRecovery', 'pre-mutation-guard': 'checkpoint',
+});
+export const KERNEL_REFUSAL_REASONS = Object.freeze([
+    { pattern: /^l'owner non ha approvato questa azione\.$/u, id: 'error.refusalReason.notApproved', fragment: "motivo: 'l\\'owner non ha approvato questa azione.'" },
+    { pattern: /^la sessione è in sola lettura: nessuna scrittura, comando o documento è permesso in questo momento\.$/u, id: 'error.refusalReason.readOnly', fragment: "la sessione è in sola lettura: nessuna scrittura, comando o documento è permesso in questo momento." },
+    { pattern: /^l'attrezzo "(?<tool>[^"]+)" è disattivato per questa sessione \(permesso per-attrezzo: nega\)\.$/u, id: 'error.refusalReason.toolOff', fragment: '" è disattivato per questa sessione (permesso per-attrezzo: nega).' },
+    { pattern: /^questa è una ricerca approfondita: può leggere, cercare e navigare, ma l'unica scrittura permessa è il deposito del proprio rapporto con "research_deposit" — "(?<tool>[^"]+)" resta negato\.$/u, id: 'error.refusalReason.research', fragment: `questa è una ricerca approfondita: può leggere, cercare e navigare, ma l'unica scrittura permessa è il deposito del proprio rapporto con "research_deposit" — "` },
+    { pattern: /^il rapporto di una ricerca si deposita solo nella cartella di quella ricerca: "(?<path>[^"]*)" non ci risolve dentro\.$/u, id: 'error.refusalReason.researchPath', fragment: 'il rapporto di una ricerca si deposita solo nella cartella di quella ricerca: "' },
+    { pattern: /^la sessione è limitata alla scrittura nel workspace: "(?<tool>[^"]+)" resta negato \(solo "scrivi" e "file_edit", che portano un percorso verificabile, sono ammessi a questo livello\)\.$/u, id: 'error.refusalReason.workspaceTool', fragment: '" resta negato (solo "scrivi" e "file_edit", che portano un percorso verificabile, sono ammessi a questo livello).' },
+    { pattern: /^"(?<path>[^"]*)" non risolve dentro il workspace corrente: la sessione è limitata alla scrittura nel workspace\.$/u, id: 'error.refusalReason.workspacePath', fragment: '" non risolve dentro il workspace corrente: la sessione è limitata alla scrittura nel workspace.' },
+    { pattern: /^l'attrezzo "(?<tool>[^"]+)" richiede approvazione \(.+\), ma questa sessione non ha un canale di approvazione attivo\.$/u, id: 'error.refusalReason.noChannel', fragment: '), ma questa sessione non ha un canale di approvazione attivo.' },
+    { pattern: /^fermato su richiesta mentre aspettavo la tua approvazione per "(?<tool>[^"]+)"\.$/u, id: 'error.refusalReason.stoppedAsking', fragment: "const MOTIVO_FERMATO_CHIEDENDO = 'fermato su richiesta mentre aspettavo la tua approvazione'" },
+]);
+/*
+ * The display guard of Q-R2-2: a message with no mapping may appear on the default lines ONLY when it is not kernel prose.
+ * The kernel writes Italian; the CLI writes English. This decides nothing about MEANING (that is the code's job, E4): it only
+ * keeps an untranslated sentence off the screen, where D-05 forbids it, and sends it to `raw` (expanded detail and the log).
+ * One Italian-only word (`è` included) or two short Italian function words mark it; English words that look alike
+ * ("non-interactive", "per request") are not in either list. An accent alone does not: "café" or a name is not Italian.
+ */
+const ITALIAN_ONLY = new Set([
+    'della', 'delle', 'dello', 'degli', 'nella', 'nelle', 'nello', 'negli', 'dalla', 'dalle', 'questo', 'questa', 'questi', 'queste', 'nessun', 'nessuna',
+    'nessuno', 'fornitore', 'fornitori', 'chiave', 'chiavi', 'richiesta', 'sessione', 'giro', 'giri', 'attrezzo', 'attrezzi', 'modello', 'modelli',
+    'cartella', 'percorso', 'comando', 'interrotto', 'interrotta', 'rifiutata', 'rifiutato', 'approvato', 'agente', 'esterno', 'esterna', 'sono',
+    'manca', 'mancano', 'controlla', 'riprova', 'inserisci', 'trovato', 'trovata', 'valido', 'valida', 'raggiungere', 'risposta', 'disponibile',
+    'impossibile', 'errore', 'ancora', 'anche', 'ambiguo', 'ambigua', 'scelta', 'fuori', 'pacchetto', 'leggibile', 'codice', 'esegue', 'perché', 'quando', 'dopo', 'prima', 'ogni', 'senza', 'traffico', 'credenziale', 'catalogo', 'è', 'già', 'può', 'più',
+    /* CE alignment (2026-09-25): the Context Engine's own words; «Preparazione del contesto non riuscita.» passed as English. */
+    'contesto', 'preparazione', 'riuscita', 'riuscito', 'sintesi', 'compattazione', 'compattare', 'finestra',
+]);
+const ITALIAN_SHORT = new Set(['il', 'lo', 'la', 'le', 'gli', 'di', 'del', 'al', 'alla', 'che', 'una', 'uno', 'con', 'ha', 'hai', 'sei', 'è', 'e']);
+export function looksItalian(text) {
+    const value = String(text);
+    const words = value.toLowerCase().split(/[^\p{L}']+/u).map(word => word.replace(/^(?:l|un|dell|all|nell|dall|sull)'/u, '')).filter(Boolean);
+    if (words.some(word => ITALIAN_ONLY.has(word)))
+        return true;
+    return words.filter(word => ITALIAN_SHORT.has(word) && word !== 'e').length >= 2;
+}
+export const KERNEL_PROBE_REASONS = Object.freeze([
+    { pattern: /^(?<provider>.+?): catalogo raggiunto, (?<count>\d+) modelli visibili nella prima pagina\. La generazione non è stata provata\.$/u, id: 'firstrun.probe.catalogFirstPage', plural: true, fragment: " nella prima pagina' : ''}. La generazione non è stata provata." },
+    { pattern: /^(?<provider>.+?): catalogo raggiunto, (?<count>\d+) modelli visibili\. La generazione non è stata provata\.$/u, id: 'firstrun.probe.catalog', plural: true, fragment: ': catalogo raggiunto, ' },
+    { pattern: /^(?<provider>.+?): catalogo pubblico raggiunto, (?<count>\d+) modelli visibili; chiave non verificata\. La generazione non è stata provata\.$/u, id: 'firstrun.probe.publicCatalog', plural: true, fragment: ' modelli visibili; chiave non verificata. La generazione non è stata provata.' },
+    { pattern: /^(?<provider>.+?): credenziale accettata\.$/u, id: 'firstrun.probe.keyAccepted', fragment: ': credenziale accettata.' },
+    { pattern: /^Non è stato possibile raggiungere (?<provider>.+?)\.$/u, id: 'firstrun.probe.unreachable', fragment: 'Non è stato possibile raggiungere ' },
+    { pattern: /^(?<provider>.+?): nessuna risposta entro (?<seconds>\d+) secondi\.$/u, id: 'firstrun.probe.timeout', fragment: ': nessuna risposta entro ' },
+    { pattern: /^(?<provider>.+?): la risposta rinvia a un altro indirizzo, e non lo seguiamo\. Controlla l'indirizzo impostato per questo fornitore\.$/u, id: 'firstrun.probe.redirect', fragment: ": la risposta rinvia a un altro indirizzo, e non lo seguiamo. Controlla l'indirizzo impostato per questo fornitore." },
+    { pattern: /^(?<provider>.+?) ha rifiutato la credenziale \(HTTP (?<status>\d+)\)\.$/u, id: 'firstrun.probe.keyRefused', fragment: ' ha rifiutato la credenziale (HTTP ' },
+    { pattern: /^(?<provider>.+?): credenziale non accettata \(HTTP 401\)\.$/u, id: 'firstrun.probe.keyNotAccepted', fragment: ': credenziale non accettata (HTTP 401).' },
+    { pattern: /^(?<provider>.+?): accesso negato \(HTTP 403\); controlla i permessi\.$/u, id: 'firstrun.probe.accessDenied', fragment: ': accesso negato (HTTP 403); controlla i permessi.' },
+    { pattern: /^(?<provider>.+?) ha risposto HTTP (?<status>\d+)\.$/u, id: 'firstrun.probe.httpStatus', fragment: ' ha risposto HTTP ' },
+    { pattern: /^(?<provider>.+?): elenco modelli non trovato \(HTTP 404\)\. La validità della chiave non è verificata da questa risposta\.$/u, id: 'firstrun.probe.listNotFound', fragment: ': elenco modelli non trovato (HTTP 404). La validità della chiave non è verificata da questa risposta.' },
+    { pattern: /^Manca l'indirizzo di (?<provider>.+?)\.$/u, id: 'firstrun.probe.noAddress', fragment: "Manca l'indirizzo di " },
+    { pattern: /^Nessuna chiave salvata per (?<provider>.+?)\.$/u, id: 'firstrun.probe.noKey', fragment: 'Nessuna chiave salvata per ' },
+    { pattern: /^(?<provider>.+?): richiesta minima di generazione riuscita; elenco modelli non verificato\.$/u, id: 'firstrun.probe.minimalOk', fragment: ': richiesta minima di generazione riuscita; elenco modelli non verificato.' },
+    { pattern: /^(?<provider>.+?): risposta HTTP (?<status>\d+) senza un elenco modelli valido; credenziale non verificata\.$/u, id: 'firstrun.probe.invalidList', fragment: ' senza un elenco modelli valido; credenziale non verificata.' },
+    { pattern: /^(?<provider>.+?): risposta HTTP (?<status>\d+) senza un messaggio valido; credenziale non verificata\.$/u, id: 'firstrun.probe.invalidMessage', fragment: ' senza un messaggio valido; credenziale non verificata.' },
+    { pattern: /^(?<provider>.+?): la risposta dichiara un errore, quindi la chiave non è confermata\.$/u, id: 'firstrun.probe.declaredError', fragment: ': la risposta dichiara un errore, quindi la chiave non è confermata.' },
+]);
+/** The kernel probe's sentence in English, or null when no template matches it WHOLE (then nothing is printed). `label`, when
+ *  given, replaces the kernel's label (the kernel's registry still has Italian labels, R2 §1.4). */
+export function kernelProbeDetail(detail, { label } = {}) {
+    const text = String(detail ?? '').trim();
+    for (const row of KERNEL_PROBE_REASONS) {
+        const match = row.pattern.exec(text);
+        if (!match)
+            continue;
+        const groups = match.groups ?? {};
+        const provider = label ?? groups.provider ?? '';
+        const params = { provider, ...(groups.status ? { status: groups.status } : {}), ...(groups.seconds ? { seconds: groups.seconds } : {}) };
+        return row.plural ? tn(row.id, Number(groups.count), params) : t(`${row.id}`, params);
+    }
+    return null;
+}

package/dist/io.js

@@ -0,0 +1,45 @@
+export const MAX_STDIN_BYTES = 16 * 1024 * 1024;
+export async function readStreamLimited(stream, maxBytes = MAX_STDIN_BYTES) {
+    const chunks = [];
+    let total = 0;
+    for await (const c of stream) {
+        const chunk = Buffer.isBuffer(c) ? c : Buffer.from(c);
+        total += chunk.byteLength;
+        if (total > maxBytes)
+            throw Object.assign(new Error(`STDIN_TOO_LARGE:${maxBytes}`), { code: 'STDIN_TOO_LARGE' });
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks, total).toString('utf8');
+}
+async function readAllStdin() { return readStreamLimited(process.stdin); }
+async function readSecretTty(prompt) { if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== 'function')
+    throw new Error('SECRET_INPUT_REQUIRES_TTY'); process.stderr.write(prompt); return new Promise((resolve, reject) => { let value = ''; const done = (error) => { process.stdin.off('data', onData); try {
+    process.stdin.setRawMode(false);
+}
+catch { } process.stdin.pause(); process.stderr.write('\n'); if (error)
+    reject(error);
+else
+    resolve(value); }; const onData = (buf) => { for (const b of buf) {
+    if (b === 3) {
+        done(Object.assign(new Error('INTERRUPTED'), { code: 'INTERRUPTED' }));
+        return;
+    }
+    if (b === 13 || b === 10) {
+        done();
+        return;
+    }
+    if (b === 8 || b === 127) {
+        value = value.slice(0, -1);
+        continue;
+    }
+    if (b >= 32)
+        value += Buffer.from([b]).toString('utf8');
+} }; try {
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.on('data', onData);
+}
+catch (e) {
+    done(e);
+} }); }
+export const stdio = { writeOut: s => process.stdout.write(s), writeErr: s => process.stderr.write(s), stdinIsTTY: Boolean(process.stdin.isTTY), stdoutIsTTY: Boolean(process.stdout.isTTY), readStdin: readAllStdin, readSecret: readSecretTty };

package/dist/main.js

@@ -0,0 +1,331 @@
+#!/usr/bin/env node
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { pathToFileURL } from 'node:url';
+import { stdio } from "./io.js";
+import { parseCliArgs } from "./args.js";
+import { CLI_VERSION } from "./version.js";
+import { resolveCliPaths, ensureCliPaths } from "./paths.js";
+import { loadEffectiveConfig, readConfigScope } from "./config/load.js";
+import { createSessionFacade } from "./runtime/session-facade.js";
+import { collectHeadlessFork, collectHeadlessResume, collectHeadlessRun } from "./headless/run.js";
+import { renderJson, renderText, exitCodeForResult, withRunWarnings } from "./headless/result.js";
+import { createLocalAutoClassifier } from "./security/auto-classifier.js";
+import { abortIsolationChecks, cliShellIsolation } from "./security/execution-backends.js";
+import { inertTerminalText, renderSafeTalosFailure } from "./errors.js";
+import { registerActiveRun } from "./runtime/active-run.js";
+import { isFirstLaunch } from "./tui/launch-state.js"; /* P17: the first launch's trust question is step 1 of the setup */
+import { initializeDevelopmentLogging, developmentLog, developmentLogError, closeDevelopmentLogging, developmentTextEvidence } from "./diagnostics/development-log.js";
+import { assessProjectTrust, assertProjectTrusted, needsTrustQuestion, nestedRepositoriesForProjectTrust, projectTrustFailure, trustProjectAssessment } from "./security/project-trust-gate.js";
+import { findTalosRepoRoot, importTalosModule } from "./runtime/repo.js";
+import { providerOfModel } from "./provider/environment-keys.js";
+import { assertValidKeymap } from "./tui/keymap-resolver.js";
+import { createV2FailureEvent, createV2RunResultAccumulator, createV2SyntheticEvent, withV2RunWarnings } from "./protocol/v2/events.js";
+import { encodeV2Event, encodeV2Result, exitCodeForV2Result } from "./protocol/v2/codec.js";
+/* R3 Q-R3-8b: the first Ctrl+C of `talos -p` stops the run and lets it print a complete interrupted result (exit 130);
+   a second one exits at once with 130. Injected so tests never touch the real process signal. */
+function defaultOnInterrupt(handler) { process.on('SIGINT', handler); return () => { process.off('SIGINT', handler); }; }
+async function defaultCreateRuntime(x) { const { createCliRuntime } = await import("./runtime/create-runtime.js"); return createCliRuntime(x); }
+async function defaultCreateRuntimeContext(x) { const { createCliRuntimeContext } = await import("./runtime/create-runtime.js"); return createCliRuntimeContext(x); }
+async function defaultRunTui(x) { const { runInkTui } = await import("./tui/run.js"); return runInkTui(x); }
+async function defaultPromptProjectTrust(x) { const { runProjectTrustPrompt } = await import("./tui/project-trust-prompt.js"); return runProjectTrustPrompt(x); }
+/* R4 Q-R4-13 (`Loaded AGENTS.md`): the instruction files the kernel reads for this folder, found by the kernel's own function
+   (AGENTS.md or CLAUDE.md, one per folder, from the repository root down), named relative to that root. Read only after
+   trust is settled (E1); a failure only means nothing is announced. */
+async function defaultLoadedFiles(projectRoot) {
+    const m = await importTalosModule(findTalosRepoRoot(process.cwd()), 'istruzioni-di-progetto.mjs');
+    const found = await m.trovaIstruzioniDiProgetto(projectRoot);
+    return Array.isArray(found) ? found.map((row) => String(row?.etichetta ?? '')).filter(Boolean) : [];
+}
+/* R4 Q-R4-1/2: which folder decision a choice saves. The home folder and a drive root save none (session only). */
+function folderTargetFor(choice, assessment) {
+    if (assessment.folder?.sessionOnly)
+        return 'none';
+    return choice === 'trust-parent' ? 'parent' : 'this';
+}
+function help() { return `TALOS CLI ${CLI_VERSION}\nUsage:\n  talos [prompt...]\n  talos -p "prompt" [--json|--output-format stream-json]\n  talos --resume <id|last> [-p "prompt"]\n  talos --fork <id> [-p "prompt"]\n  talos <project|config|provider|model|session|mcp|hook|plugin|command|memory|notes|tasks|library|research|automation|forge|checkpoint|doctor|logs|diagnostic|update|init> ...\n\nGlobal options:\n  --project PATH  --model PROVIDER:MODEL  --permission-mode MODE\n  --protocol v1|v2  --resume ID  --fork ID  --timeout SECONDS  --verbose  --no-color\n`; }
+async function sessionId(runtime, id) { if (id !== 'last')
+    return id; const rows = await runtime.listSessions(); const first = rows.at(-1); if (!first?.sessionId)
+    throw Object.assign(new Error('SESSION_NOT_FOUND'), { code: 'SESSION_NOT_FOUND' }); return String(first.sessionId); }
+function outputFormatHint(argv) {
+    let format = argv.includes('--json') ? 'json' : 'text';
+    for (let i = 0; i < argv.length; i++) {
+        const token = argv[i];
+        const inline = token.startsWith('--output-format=') ? token.slice('--output-format='.length) : undefined;
+        const value = inline ?? (token === '--output-format' ? argv[i + 1] : undefined);
+        if (value === 'text' || value === 'json' || value === 'stream-json')
+            format = value;
+        if (token === '--output-format')
+            i += 1;
+    }
+    return format;
+}
+function protocolVersionHint(argv) {
+    for (let i = 0; i < argv.length; i++) {
+        const token = argv[i];
+        const inline = token.startsWith('--protocol=') ? token.slice('--protocol='.length) : undefined;
+        const value = inline ?? (token === '--protocol' ? argv[i + 1] : undefined);
+        if (value === 'v2')
+            return 'v2';
+        if (token === '--protocol')
+            i += 1;
+    }
+    return 'v1';
+}
+function renderFailureForProtocol(format, protocolVersion, error, notices = [], verbose = false) {
+    if (protocolVersion === 'v2' && format !== 'text') {
+        const accumulator = createV2RunResultAccumulator();
+        const events = notices.map((notice, index) => createV2SyntheticEvent({
+            sessionId: '',
+            eventId: 'talos:none:config-notice:' + (index + 1),
+            type: 'warning',
+            data: { code: notice.code, message: notice.message }
+        }));
+        for (const event of events)
+            accumulator.add(event);
+        const failed = createV2FailureEvent({ sessionId: '', error, component: 'cli' });
+        accumulator.add(failed);
+        const result = accumulator.result();
+        return {
+            toStderr: false,
+            text: format === 'stream-json' ? [...events, failed].map(encodeV2Event).join('') : encodeV2Result(result),
+            exitCode: exitCodeForV2Result(result)
+        };
+    }
+    return renderSafeTalosFailure(format, error, { component: 'cli', notices, verbose }); /* R2 E6: trace id only with --verbose (or JSON) */
+}
+async function resolveReasoningDefault(catalog, model, configured) {
+    if (configured === undefined)
+        return { effort: null, notice: null };
+    if (!catalog || typeof catalog.listModels !== 'function')
+        return { effort: null, notice: { code: 'REASONING_EFFORT_CAPABILITY_UNKNOWN', message: `Configured reasoning effort "${configured}" was not applied because TALOS could not verify ${model} capabilities; using model default.` } };
+    try {
+        const provider = providerOfModel(model);
+        const rows = await catalog.listModels(provider ? { provider } : {});
+        const row = rows.find((candidate) => candidate?.id === model);
+        if (row?.reasoning === true && Array.isArray(row.reasoningEfforts) && row.reasoningEfforts.includes(configured))
+            return { effort: configured, notice: null };
+        return { effort: null, notice: { code: 'REASONING_EFFORT_UNSUPPORTED', message: `Configured reasoning effort "${configured}" is not affirmed for ${model}; using model default and sending no effort override.` } };
+    }
+    catch {
+        return { effort: null, notice: { code: 'REASONING_EFFORT_CAPABILITY_UNKNOWN', message: `Configured reasoning effort "${configured}" was not applied because ${model} capabilities could not be read; using model default.` } };
+    }
+}
+function configNoticeEvent(sessionId, seq, notice) { return { schema: 'talos.cli.event.v1', seq, ts: new Date().toISOString(), sessionId, type: 'warning', data: { code: notice.code, message: notice.message } }; }
+function output(io, format, protocolVersion, collected) { if (format === 'json')
+    io.writeOut(protocolVersion === 'v2' ? encodeV2Result(collected.result) : renderJson(collected.result));
+else if (format !== 'stream-json')
+    io.writeOut(renderText(collected.result)); return protocolVersion === 'v2' ? exitCodeForV2Result(collected.result) : exitCodeForResult(collected.result); }
+/* R5b D4 (Q-R5-14): the trust question is drawn in the person's theme. It is asked before the folder is trusted, so only the
+   USER configuration is read here (migrated, as every read is); a theme in the folder's own config is not. Unreadable: Calm. */
+async function userThemeForTrust(paths, projectRoot) {
+    try {
+        const theme = (await readConfigScope({ paths, projectRoot, scope: 'user' })).ui?.theme;
+        return theme ? { theme } : {};
+    }
+    catch {
+        return {};
+    }
+}
+export async function main(argv, deps = {}) {
+    const io = deps.io ?? stdio;
+    initializeDevelopmentLogging({ ...(process.env.TALOS_CLI_DEV_LOG_DIR ? { logDir: process.env.TALOS_CLI_DEV_LOG_DIR } : {}), argv, component: 'cli-main' });
+    developmentLog('cli.main.enter', { argv: argv.map(developmentTextEvidence) });
+    let inv;
+    try {
+        inv = parseCliArgs(argv);
+    }
+    catch (error) {
+        developmentLogError('cli.args.failure', error, { argv: argv.map(developmentTextEvidence) }, 'cli-main');
+        const format = outputFormatHint(argv);
+        const failure = renderFailureForProtocol(format, format === 'text' ? 'v1' : protocolVersionHint(argv), error);
+        if (failure.toStderr)
+            io.writeErr(failure.text);
+        else
+            io.writeOut(failure.text);
+        closeDevelopmentLogging({ exitCode: failure.exitCode, reason: 'args' });
+        return failure.exitCode;
+    }
+    if (inv.command === 'version') {
+        io.writeOut(`${CLI_VERSION}\n`);
+        closeDevelopmentLogging({ exitCode: 0, reason: 'version' });
+        return 0;
+    }
+    if (inv.command === 'help') {
+        io.writeOut(help());
+        closeDevelopmentLogging({ exitCode: 0, reason: 'help' });
+        return 0;
+    }
+    if (inv.command === 'subcommand') {
+        const { runSubcommand } = await import("./subcommands.js");
+        const code = await runSubcommand(inv, { io, createRuntimeContext: deps.createRuntimeContext ?? defaultCreateRuntimeContext });
+        closeDevelopmentLogging({ exitCode: code, reason: 'subcommand' });
+        return code;
+    }
+    let runtime = null;
+    let releaseActiveRun = null;
+    let releaseInterrupt = null;
+    let notices = [];
+    let noticesStreamed = false;
+    try {
+        const projectRoot = resolve(inv.project ?? process.cwd());
+        const paths = resolveCliPaths(process.env, process.platform, homedir());
+        await ensureCliPaths(paths);
+        initializeDevelopmentLogging({ paths, projectRoot, argv, component: 'cli-main' });
+        developmentLog('cli.paths.ready', { projectRoot, paths }, 'info', 'cli-main');
+        const interactive = inv.interactive && io.stdinIsTTY && io.stdoutIsTTY;
+        const injectedRuntime = Boolean(deps.createRuntime || deps.createRuntimeContext);
+        const trustInjected = Boolean(deps.assertProjectTrusted || deps.assessProjectTrust || deps.trustProjectAssessment || deps.promptProjectTrust);
+        if (trustInjected || !injectedRuntime) {
+            const trustInput = { projectRoot, trustRoot: paths.trust.projects };
+            if (interactive) {
+                const assessment = await (deps.assessProjectTrust ?? assessProjectTrust)(trustInput); /* R4 Q-R4-1: every folder with no saved decision is asked, with or without project files; headless keeps its rule (E3). */
+                if (needsTrustQuestion(assessment)) {
+                    const nestedRepositories = await nestedRepositoriesForProjectTrust(assessment);
+                    const choice = await (deps.promptProjectTrust ?? defaultPromptProjectTrust)({ assessment, nestedRepositories, color: inv.color !== false, ...await userThemeForTrust(paths, projectRoot), ...(isFirstLaunch(paths.dataRoot) ? { setupStep: true } : {}) });
+                    if (choice !== 'trust' && choice !== 'trust-parent')
+                        throw projectTrustFailure(assessment);
+                    const folder = folderTargetFor(choice, assessment); /* Session only with nothing to trust: nothing is written. */
+                    if (!assessment.trusted || folder !== 'none')
+                        await (deps.trustProjectAssessment ?? trustProjectAssessment)({ assessment, trustRoot: paths.trust.projects, nestedRepositories, ...(assessment.folder ? { folder } : {}), /* Q-R4-17: the home folder's grant is for this process only. */ ...(assessment.folder?.sessionOnly ? { sessionOnly: true } : {}) });
+                }
+            }
+            else
+                await (deps.assertProjectTrusted ?? assertProjectTrusted)(trustInput);
+        }
+        const effective = await loadEffectiveConfig({ paths, projectRoot, cli: { ...(inv.model ? { model: inv.model } : {}), ...(inv.permissionMode ? { permissionMode: inv.permissionMode } : {}) } });
+        const selectedModel = effective.value.model ?? 'openai:gpt-5-mini';
+        const selectedMode = inv.permissionMode ?? effective.value.permissionMode ?? 'default';
+        const rules = effective.value.permissions ?? { allow: [], ask: [], deny: [] };
+        const effectiveKeymap = interactive ? assertValidKeymap(effective.value.ui?.keymap) : undefined;
+        notices = effective.ignored.map(({ code, message }) => ({ code, message }));
+        if (interactive || inv.outputFormat === 'text')
+            for (const notice of notices)
+                io.writeErr(`Warning: ${inertTerminalText(notice.message)}\n`);
+        let prompt = inv.prompt;
+        if (!prompt && !interactive && !io.stdinIsTTY)
+            prompt = (await io.readStdin()).trim();
+        let activeRuntime;
+        let catalog = undefined;
+        let liveRegistry = undefined;
+        if (interactive) {
+            const contextFactory = deps.createRuntimeContext ?? defaultCreateRuntimeContext;
+            const context = await contextFactory({ projectRoot, paths, model: selectedModel, trustVerified: true, environmentKeys: 'consent' });
+            activeRuntime = context.runtime;
+            catalog = context.tuiCatalog;
+            liveRegistry = context.registry;
+        }
+        else if (effective.value.reasoningEffort !== undefined && (!deps.createRuntime || deps.createRuntimeContext)) {
+            const contextFactory = deps.createRuntimeContext ?? defaultCreateRuntimeContext;
+            const context = await contextFactory({ projectRoot, paths, model: selectedModel, trustVerified: true, environmentKeys: 'use' });
+            activeRuntime = context.runtime;
+            catalog = context.tuiCatalog;
+        }
+        else {
+            const factory = deps.createRuntime ?? defaultCreateRuntime; /* B1 slice 18: the entry decides. The screen asks before using an environment key; -p uses it and states its origin. */
+            const raw = await factory({ projectRoot, paths, model: selectedModel, trustVerified: true, environmentKeys: 'use' });
+            activeRuntime = (raw && typeof raw.start === 'function') ? raw : createSessionFacade(raw.registry, { model: selectedModel });
+        }
+        const reasoningDefault = await resolveReasoningDefault(catalog, selectedModel, effective.value.reasoningEffort);
+        let appliedReasoningEffort = reasoningDefault.effort;
+        let reasoningNotice = reasoningDefault.notice;
+        if (typeof activeRuntime.setDefaultReasoningEffort === 'function')
+            activeRuntime.setDefaultReasoningEffort(appliedReasoningEffort);
+        else if (appliedReasoningEffort !== null) {
+            appliedReasoningEffort = null;
+            reasoningNotice = { code: 'REASONING_EFFORT_RUNTIME_UNAVAILABLE', message: `Configured reasoning effort could not be applied by this runtime; using model default.` };
+        }
+        if (reasoningNotice) {
+            notices = [...notices, reasoningNotice];
+            if (interactive || inv.outputFormat === 'text')
+                io.writeErr(`Warning: ${inertTerminalText(reasoningNotice.message)}\n`);
+        }
+        runtime = activeRuntime;
+        releaseActiveRun = await registerActiveRun(paths, { projectRoot });
+        if (interactive) { /* R4 Q-R4-13: what the first frame says was loaded (lane N renders it through onboardingSteps). */
+            let loadedFiles = [];
+            try {
+                loadedFiles = await (deps.loadedFiles ?? defaultLoadedFiles)(projectRoot);
+            }
+            catch (error) {
+                developmentLogError('cli.loaded_files.failure', error, {}, 'cli-main');
+            }
+            await (deps.runTui ?? defaultRunTui)({ loadedFiles, runtime: activeRuntime, registry: liveRegistry, catalog, invocation: { ...inv, model: selectedModel, permissionMode: selectedMode }, projectRoot, paths, permissionRules: rules, keymap: effectiveKeymap, uiTheme: effective.value.ui?.theme, exitOutput: effective.value.ui?.exitOutput, initialReasoningEffort: appliedReasoningEffort, autoClassifier: selectedMode === 'auto' ? createLocalAutoClassifier({ shellIsolation: cliShellIsolation({ paths: { cacheRoot: paths.cacheRoot } }) }) : undefined, shellIsolation: cliShellIsolation({ paths: { cacheRoot: paths.cacheRoot } }), initialPrompt: prompt });
+            return 0;
+        } /* R3 Q-R3-13: the TUI asks the same shared probe once after the boot (No sandbox, (unsandboxed)). */
+        const machineProtocol = inv.outputFormat === 'text' ? 'v1' : (inv.protocolVersion ?? 'v1');
+        const headlessStop = new AbortController();
+        releaseInterrupt = (deps.onInterrupt ?? defaultOnInterrupt)(() => { if (headlessStop.signal.aborted)
+            process.exit(130); headlessStop.abort(); });
+        const common = { projectRoot, model: selectedModel, permissionMode: selectedMode, permissionRules: rules, ...(paths.checkpointsRoot ? { checkpointsRoot: paths.checkpointsRoot } : {}), protocolVersion: machineProtocol, ...(inv.timeoutSeconds !== undefined ? { timeoutSeconds: inv.timeoutSeconds } : {}), ...(selectedMode === 'auto' ? { autoClassifier: createLocalAutoClassifier({ shellIsolation: cliShellIsolation({ paths: { cacheRoot: paths.cacheRoot } }) }) } : {}), signal: headlessStop.signal };
+        const streamNotices = (sessionId) => { if (noticesStreamed)
+            return; noticesStreamed = true; notices.forEach((notice, index) => { if (machineProtocol === 'v2')
+            io.writeOut(encodeV2Event(createV2SyntheticEvent({ sessionId, eventId: 'talos:' + encodeURIComponent(sessionId || 'none') + ':config-notice:' + (index + 1), type: 'warning', data: { code: notice.code, message: notice.message } })));
+        else
+            io.writeOut(JSON.stringify(configNoticeEvent(sessionId, index + 1, notice)) + '\n'); }); };
+        const onStreamEvent = inv.outputFormat === 'stream-json' ? (event) => { streamNotices(String(event?.sessionId ?? '')); if (machineProtocol === 'v2')
+            io.writeOut(encodeV2Event(event));
+        else
+            io.writeOut(JSON.stringify(notices.length ? { ...event, seq: Number(event.seq) + notices.length } : event) + '\n'); } : undefined;
+        let collected;
+        if (inv.resume) {
+            await activeRuntime.restore();
+            const id = await sessionId(activeRuntime, inv.resume);
+            const previous = activeRuntime.export(id);
+            const from = Array.isArray(previous?.eventi) ? previous.eventi.length : Array.isArray(previous?.events) ? previous.events.length : 0;
+            collected = await collectHeadlessResume(activeRuntime, id, prompt, { ...common, from }, onStreamEvent);
+        }
+        else if (inv.fork) {
+            await activeRuntime.restore();
+            const id = await sessionId(activeRuntime, inv.fork);
+            collected = await collectHeadlessFork(activeRuntime, id, prompt, { ...common, from: 0 }, onStreamEvent);
+        }
+        else {
+            if (!prompt)
+                throw Object.assign(new Error('A prompt is required for headless mode'), { code: 'CLI_USAGE_ERROR' });
+            collected = await collectHeadlessRun(activeRuntime, { ...common, prompt }, onStreamEvent);
+        }
+        if (inv.outputFormat === 'stream-json')
+            streamNotices(String(collected.result.sessionId ?? ''));
+        const result = notices.length ? (machineProtocol === 'v2' ? withV2RunWarnings(collected.result, [...notices.map(notice => notice.message), ...collected.result.warnings]) : withRunWarnings(collected.result, [...notices.map(notice => notice.message), ...collected.result.warnings])) : collected.result;
+        return output(io, inv.outputFormat, machineProtocol, { ...collected, result });
+    }
+    catch (error) {
+        developmentLogError('cli.main.failure', error, { notices }, 'cli-main');
+        const protocol = inv.outputFormat === 'text' ? 'v1' : (inv.protocolVersion ?? 'v1');
+        const failure = renderFailureForProtocol(inv.outputFormat, protocol, error, inv.outputFormat === 'json' || (inv.outputFormat === 'stream-json' && !noticesStreamed) ? notices : [], inv.verbose);
+        if (failure.toStderr)
+            io.writeErr(failure.text);
+        else
+            io.writeOut(failure.text);
+        return failure.exitCode;
+    }
+    finally { /* R3 (owner, 2026-09-24): quitting aborts a sandbox check still running (the TUI's startup check or the broker's first probe); it ends what it started and leaves no verdict. */
+        try {
+            const left = await abortIsolationChecks(); /* ⛔ R3: a process a check could not prove its own was left running, never ended on trust: stated here. */
+            if (left.length > 0)
+                developmentLog('cli.isolation.left_running', { pids: left, why: 'the sandbox check could not prove at kill time that these pids were its own processes, so it did not end them' }, 'warning', 'cli-main');
+        }
+        catch { }
+        try {
+            await runtime?.close();
+        }
+        catch (error) {
+            developmentLogError('cli.runtime.close.failure', error, {}, 'cli-main');
+        }
+        try {
+            releaseInterrupt?.();
+        }
+        catch { /* the handler is gone with the process */ }
+        try {
+            await releaseActiveRun?.();
+        }
+        catch (error) {
+            developmentLogError('cli.active_run.release.failure', error, {}, 'cli-main');
+        }
+        closeDevelopmentLogging({ runtimeClosed: true });
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    main(process.argv.slice(2)).then(c => { process.exitCode = c; }, e => { developmentLogError('cli.process.fatal', e, {}, 'cli-main'); console.error(e); process.exitCode = 70; });
+}

package/dist/paths.js

@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto';
+import { mkdir } from 'node:fs/promises';
+import path from 'node:path';
+export class CliPathError extends Error {
+    code;
+    constructor(code) { super(code); this.name = 'CliPathError'; this.code = code; }
+}
+export function resolveCliPaths(env, platform, home) {
+    if (platform === 'win32') {
+        if (!env.APPDATA || !env.LOCALAPPDATA)
+            throw new CliPathError('PROFILE_PATH_UNAVAILABLE');
+        const w = path.win32;
+        const configRoot = w.join(env.APPDATA, 'TALOS-CLI');
+        const dataRoot = w.join(env.LOCALAPPDATA, 'TALOS-CLI');
+        const cacheRoot = w.join(dataRoot, 'cache');
+        return { configRoot, dataRoot, cacheRoot, sessionsRoot: w.join(dataRoot, 'sessions'), logsRoot: w.join(dataRoot, 'logs'), projectOverridesRoot: w.join(dataRoot, 'projects'), queueRoot: w.join(dataRoot, 'queues'), checkpointsRoot: w.join(dataRoot, 'checkpoints'), trust: { hooks: w.join(dataRoot, 'trust', 'hooks'), mcp: w.join(dataRoot, 'trust', 'mcp'), plugins: w.join(dataRoot, 'trust', 'plugins'), projects: w.join(dataRoot, 'trust', 'projects') } };
+    }
+    if (!home)
+        throw new CliPathError('PROFILE_PATH_UNAVAILABLE');
+    const p = path.posix;
+    const configRoot = env.XDG_CONFIG_HOME || p.join(home, '.config', 'talos-cli');
+    const dataRoot = env.XDG_STATE_HOME || p.join(home, '.local', 'state', 'talos-cli');
+    const cacheRoot = env.XDG_CACHE_HOME || p.join(home, '.cache', 'talos-cli');
+    return { configRoot, dataRoot, cacheRoot, sessionsRoot: p.join(dataRoot, 'sessions'), logsRoot: p.join(dataRoot, 'logs'), projectOverridesRoot: p.join(dataRoot, 'projects'), queueRoot: p.join(dataRoot, 'queues'), checkpointsRoot: p.join(dataRoot, 'checkpoints'), trust: { hooks: p.join(dataRoot, 'trust', 'hooks'), mcp: p.join(dataRoot, 'trust', 'mcp'), plugins: p.join(dataRoot, 'trust', 'plugins'), projects: p.join(dataRoot, 'trust', 'projects') } };
+}
+export function normalizeProjectRoot(root, platform = process.platform) {
+    const api = platform === 'win32' ? path.win32 : path.posix;
+    let normalized = api.normalize(root);
+    const parsed = api.parse(normalized);
+    while (normalized.length > parsed.root.length && normalized.endsWith(api.sep))
+        normalized = normalized.slice(0, -1);
+    if (platform === 'win32')
+        normalized = normalized.replace(/^([A-Z]):/u, (_, d) => `${d.toLowerCase()}:`).toLowerCase();
+    return normalized;
+}
+export function projectId(root, platform = process.platform) { return createHash('sha256').update(normalizeProjectRoot(root, platform)).digest('hex').slice(0, 32); }
+export async function ensureCliPaths(paths) {
+    const dirs = [paths.configRoot, paths.dataRoot, paths.cacheRoot, paths.sessionsRoot, paths.logsRoot, paths.projectOverridesRoot, paths.queueRoot, ...(paths.checkpointsRoot ? [paths.checkpointsRoot] : []), ...Object.values(paths.trust)];
+    for (const dir of dirs)
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+}

package/dist/protocol/v2/codec.js

@@ -0,0 +1,9 @@
+import { exitCodeForEnvelope } from "../../errors.js";
+export function encodeV2Event(event) { return JSON.stringify(event) + '\n'; }
+export function encodeV2Stream(events) {
+    return events.length ? events.map(encodeV2Event).join('') : '';
+}
+export function encodeV2Result(result) { return JSON.stringify(result) + '\n'; }
+export function exitCodeForV2Result(result) {
+    return result.ok ? 0 : exitCodeForEnvelope(result.error?.envelope ?? { code: result.outcome === 'cancelled' ? 'CANCELLED' : 'INTERNAL_ERROR' });
+}