zidane 7.2.4 → 8.0.4

package/dist/turn-operations-DQX5ZZni.d.ts

@@ -0,0 +1,3089 @@
+import { Bp as Settings, Fd as CompletionProvider, Gh as ProviderAuth, Gy as SessionTurn, Id as CompletionReference, Jg as CacheBreakInfo, Kh as ProviderKey, Pp as Owner, Vp as StreamEvent, Wb as SkillConfig, Wd as Command, Xh as ModelInfo, Zb as Session$1, ab as ToolResultContent, by as JsonValue, jp as EditPayload, kp as EditOutcome, mb as TurnUsage, t as Preset, xy as McpServerConfig, yh as EnvironmentConfig, zp as SessionMeta } from "./index-BGe1fQT7.js";
+import { ReactNode } from "react";
+//#region src/chat/color-gradient.d.ts
+/**
+ * Blend two hex colors in HSL space with shortest-path hue interpolation.
+ * `t` ∈ [0, 1]; `t=0` returns `from`, `t=1` returns `to`.
+ */
+declare function blendHsl(from: string, to: string, t: number): string;
+/**
+ * Static gradient ramp of length `n` going from `from` (index 0) to
+ * `to` (index n-1) in HSL space. For the cycling A→B→A→B ramp the
+ * throbber uses, see `buildCycleRamp` in `src/tui/crush-throbber.tsx`.
+ */
+declare function buildLinearRamp(from: string, to: string, n: number): string[];
+//#endregion
+//#region src/chat/completion-chats.d.ts
+declare const CHATS_TRIGGER = "#";
+type ChatReferenceScope = 'project' | 'all';
+interface ChatReferenceEntry {
+  id: string;
+  title: string;
+  turnCount: number;
+  userMessageCount: number;
+  runCount: number;
+  projectRoot?: string;
+  updatedAt: number;
+  /** Optional (store-dependent); shown as a hint when > 0. */
+  artifactCount?: number;
+}
+interface ChatReferenceData {
+  entry: ChatReferenceEntry;
+  token: string;
+}
+declare function createChatsCompletionProvider(opts: {
+  getCatalog: () => readonly ChatReferenceEntry[];
+  getReferenceCatalog?: () => readonly ChatReferenceEntry[];
+  getScope?: () => ChatReferenceScope;
+  ensureCatalog?: () => Promise<readonly ChatReferenceEntry[]>;
+  limit?: number;
+}): CompletionProvider<ChatReferenceData>;
+declare function uniqueChatIdsFromReferences(references: readonly CompletionReference<unknown>[]): string[];
+declare function chatReferenceTokensFromText(text: string): string[];
+//#endregion
+//#region src/chat/completion-commands.d.ts
+/** Trigger character — shared with skills. */
+declare const COMMANDS_TRIGGER = "/";
+/**
+ * Build a commands completion provider against a *live* command list. The
+ * getter is re-evaluated per `suggest` so registry toggles / cwd rebuilds
+ * take effect without re-instantiating the provider.
+ */
+declare function createCommandsCompletionProvider(opts: {
+  getCommands: () => readonly Command[];
+}): CompletionProvider<Command>;
+//#endregion
+//#region src/chat/files-discovery.d.ts
+/**
+ * Project file discovery for the `@`-prefixed files completion provider.
+ *
+ * Primary strategy — `git ls-files --cached --others --exclude-standard`.
+ * Git already understands `.gitignore`, `.git/info/exclude`, and global
+ * excludes, so we get correctness for free + sub-second performance on
+ * even huge monorepos. Falls back to a depth-limited filesystem walk when
+ * git isn't available or the directory isn't a repo.
+ *
+ * Pure: callers cache the returned list (e.g. in App state) and pass it
+ * into the provider's `getCatalog`. The list is a snapshot — refresh on
+ * cwd change or via a user-driven action.
+ */
+/** One row in the project file catalog. `path` is forward-slashed + relative to `cwd`. */
+interface FileEntry {
+  /** Forward-slashed relative path from the discovery cwd. Stable across OSes. No trailing slash for dirs. */
+  path: string;
+  /** Basename — used for prefix ranking in the completion provider. */
+  name: string;
+  /** Source — `git` when listed via `git ls-files`, `fs` from the walk fallback. */
+  source: 'git' | 'fs';
+  /**
+   * Entry kind. Directories are derived from the discovered file paths
+   * (every ancestor of a listed file), so only directories that contain
+   * at least one non-ignored file appear — mirroring `git ls-files`
+   * semantics, which never lists empty or fully-ignored dirs.
+   */
+  kind: 'file' | 'dir';
+}
+/** Options for `listProjectFiles`. */
+interface ListProjectFilesOptions {
+  /** Discovery root. Default: `process.cwd()`. */
+  cwd?: string;
+  /**
+   * Cap on discovered files. Default: 10,000. Bigger lists fall back to
+   * a truncated set. Derived directory entries are appended on top with
+   * their own equal cap, so the returned array can exceed `maxFiles`
+   * (bounded by 2×).
+   */
+  maxFiles?: number;
+  /** Aborts the scan early. Useful when re-running on rapid project switches. */
+  signal?: AbortSignal;
+}
+/**
+ * Discover every non-ignored file under `cwd`, plus the directories that
+ * contain them (derived from the file paths, `kind: 'dir'`). Tries
+ * `git ls-files` first; on failure (no git, not a repo, abort) walks the
+ * fs with a hand-rolled skip list.
+ *
+ * Errors are not thrown — the function always returns an array (possibly
+ * empty). Callers wanting failure diagnostics can opt into them via
+ * `ZIDANE_DEBUG`.
+ */
+declare function listProjectFiles(opts?: ListProjectFilesOptions): Promise<FileEntry[]>;
+/**
+ * File entries (plus their ancestor dirs) from relative paths — what
+ * {@link listProjectFiles} returns, for lists produced elsewhere (a remote
+ * sandbox's `git ls-files`).
+ */
+declare function fileEntriesFromPaths(paths: readonly string[], source?: 'git' | 'fs', maxFiles?: number): FileEntry[];
+//#endregion
+//#region src/chat/completion-files.d.ts
+/** Trigger character — `@` is the conventional file-mention prefix in chat UIs. */
+declare const FILES_TRIGGER = "@";
+/**
+ * Build an `@`-prefixed files completion provider against a *live* catalog.
+ *
+ * The factory captures a getter so the catalog can be re-scanned (cwd
+ * change, manual refresh) without re-instantiating the provider — the
+ * App keeps one provider for the lifetime of the prompt block and just
+ * mutates the underlying state.
+ *
+ * `limit` caps the result list so the popover stays bounded on huge
+ * monorepos. Filtering is substring on `path` + `name`, case-insensitive,
+ * with an fzf-scored basename fuzzy fallback so small typos / omissions
+ * (`lop.ts` → `loop.ts`) still surface results; ranking prefers (in
+ * order): exact name match, name prefix, name substring, path substring,
+ * basename fuzzy match, alphabetical.
+ */
+declare function createFilesCompletionProvider(opts: {
+  /** Live file catalog. Re-evaluated per call so refreshes take effect immediately. */
+  getCatalog: () => readonly FileEntry[];
+  /**
+   * Optional hook called the first time the host needs the catalog —
+   * e.g. when the user opens the `@` popover. Hosts wire this to a
+   * lazy directory walk so boot doesn't pay for it in monorepos
+   * where the popover may never open. Idempotent contract: callers
+   * may invoke it on every `suggest`; the host caches internally.
+   *
+   * When provided, `suggest()` returns a Promise on the very first
+   * invocation if the catalog is still empty — the popover's loading
+   * state surfaces while the walk completes; subsequent calls are
+   * sync because `getCatalog()` then returns the populated state.
+   */
+  ensureCatalog?: () => Promise<readonly FileEntry[]>;
+  /** Max items returned to the popover. Default: 50. */
+  limit?: number;
+  /**
+   * Rewrite the catalog's project-root-relative path into the form
+   * inserted into the prompt + matched by `parseReferences`. Wire this
+   * to `formatPathForCwd` so paths emitted into the buffer line up
+   * with the agent's CWD-resolving tools when the TUI launches from a
+   * project subdirectory. Default: identity.
+   *
+   * Stable identity expected — `parseReferences` calls it once per
+   * catalog entry per keystroke for the highlight pass; pure
+   * pure-function shape keeps the popover responsive on huge repos.
+   */
+  formatPath?: (entry: FileEntry) => string;
+}): CompletionProvider<FileEntry>;
+/**
+ * Walk a reference list and return the deduplicated set of files in
+ * first-mention order — input to "attach these files to the prompt"
+ * downstream logic.
+ */
+declare function uniqueFilesFromReferences(references: readonly CompletionReference<unknown>[]): FileEntry[];
+//#endregion
+//#region src/chat/completion-skills.d.ts
+/** Trigger character — slash-commands convention. */
+declare const SKILLS_TRIGGER = "/";
+/**
+ * Build a slash-command completion provider against a *live* skills
+ * catalog. The factory captures a getter so the catalog can change across
+ * renders (toggles, reload) without re-instantiating the provider.
+ *
+ * Pass `getEnabled` to additionally hide skills the user has toggled off
+ * — when undefined, every catalog entry is offered.
+ */
+declare function createSkillsCompletionProvider(opts: {
+  /** Live catalog. Re-evaluated per call so toggles take effect immediately. */
+  getCatalog: () => readonly SkillConfig[];
+  /** Optional enable-set filter; when undefined every catalog skill is offered. */
+  getEnabled?: () => readonly string[] | undefined;
+  /**
+   * Optional hook called the first time the host needs the catalog —
+   * typically when the user opens the `/` popover. Mirror of the
+   * files provider's `ensureCatalog`; same idempotent contract.
+   *
+   * Hosts wire this to a lazy SKILL.md scan so the boot path stays
+   * free of disk reads in deeply-nested skill trees. Returns a Promise
+   * on the very first `suggest()` call when the catalog is still
+   * empty so the popover surfaces its loading state.
+   */
+  ensureCatalog?: () => Promise<readonly SkillConfig[]>;
+}): CompletionProvider<SkillConfig>;
+/**
+ * Walk a parsed prompt for skill references and return the deduplicated
+ * list of skill names — input to `agent.activateSkill(name)` calls on
+ * submit.
+ */
+declare function uniqueSkillNamesFromReferences(references: readonly CompletionReference<unknown>[]): string[];
+//#endregion
+//#region src/chat/keybinding-spec.d.ts
+/**
+ * The `keybindings.json` spec grammar (`"ctrl+shift+o"`, `"ctrl+w | cmd+w"`),
+ * shared by the TUI (`./keybindings`) and the GUI renderer (through
+ * `zidane/chat/pure`) so one file parses the same on both surfaces. No node
+ * imports: the matchers live with each surface's key-event shape.
+ */
+/** Parsed shape of a `"ctrl+shift+o"` spec. */
+interface ParsedBinding {
+  ctrl: boolean;
+  shift: boolean;
+  alt: boolean;
+  meta: boolean;
+  /** The key name (e.g. `'o'`, `'tab'`, `'escape'`). Always lowercase. */
+  name: string;
+}
+/** A key name as the parser canonicalizes it (`'Enter'` → `'return'`, `'ArrowLeft'` → `'left'`). */
+declare function canonicalKeyName(key: string): string;
+/**
+ * The chords one binding lists. A binding may name several, any of which
+ * fires the action: `"ctrl+w | cmd+w"` (or, in `keybindings.json`, an array).
+ * A `|` right after a `+` / `-` is the key itself (`ctrl+|`).
+ */
+declare function bindingAlternatives(spec: string | undefined | null): string[];
+/** Every chord of `spec` that parses (see {@link bindingAlternatives}). */
+declare function parseBindingSpecs(spec: string | undefined | null): ParsedBinding[];
+/**
+ * The spec's first valid chord (callers that pre-parse one binding). Use
+ * {@link parseBindingSpecs} to honour every alternative.
+ */
+declare function parseBindingSpec(spec: string | undefined | null): ParsedBinding | null;
+//#endregion
+//#region src/chat/turn-selection.d.ts
+/** Tools whose `tool-result` event is suppressed when `showEditDiffs` is on. */
+declare const EDIT_TOOL_NAMES: ReadonlySet<string>;
+/**
+ * Keep turn-selection mode alive after deleting its active row. Prefer the
+ * row that slides into the deleted index; at the tail, select the new last
+ * row. Returns null only when no selectable rows survive.
+ */
+declare function selectionAfterTurnRemoval(before: readonly string[], removedId: string, after: readonly string[]): string | null;
+/**
+ * Recognize a tool-result body as carrying NON-success information so the
+ * renderer doesn't suppress it under `showEditDiffs`. Three categories:
+ *
+ *   - `edit` → "Edit error: …"
+ *   - `write_file` permission errors wrapped by the loop → "Tool failed: …"
+ *   - `multi_edit` → legacy single-line error `multi_edit error: …`, OR
+ *     a result carrying an `<edit-outcomes>…</edit-outcomes>` annotation
+ *     block. The TUI only appends the annotation when at least one hunk
+ *     was NOT applied, so its mere presence is the signal — the result
+ *     body needs to stay visible next to the diff so the user can read
+ *     denial / skip / failure reasons longer than the per-hunk badge.
+ *   - Fully-denied gate emit (`[fully denied] <edit-outcomes>…`) likewise
+ *     stays visible.
+ *
+ * Exported for unit-testability of the visibility matrix.
+ */
+declare function isEditErrorResult(text: string): boolean;
+/**
+ * `callId` prefix minted by the TUI's `!` bash mode (see `runBashMode`
+ * in `src/tui/commands/run-bash-mode.ts`). The prefix is the durable signal — it survives
+ * persistence and replay — that a `shell` tool exchange was USER-initiated,
+ * so renderers can keep it visible even when the tool-display settings
+ * hide model-driven plumbing: the user typed the command and expects to
+ * see it and what it printed.
+ */
+declare const BASH_CALL_ID_PREFIX = "bash_";
+/** Is this event a user-initiated `!` bash exchange (vs. a model-driven shell call)? */
+declare function isUserBashEvent(event: Pick<StreamEvent, 'tool' | 'callId'>): boolean;
+/**
+ * Retro-tag live `user-prompt` events with the id of their persisted turn.
+ *
+ * Live prompt echoes are appended to the stream BEFORE `agent.run()` mints
+ * and persists the user turn, so they carry no `turnId` — which makes them
+ * invisible to select-turn navigation, hover, and click (all keyed on
+ * `turnId`), while the SAME prompt becomes selectable after a session reload
+ * (replay tags every event). Hosts call this when the seeded turns land
+ * (e.g. the `session:turns` hook, which fires right after the prompt turn
+ * persists, before the first model turn).
+ *
+ * Matching rule, per prompt-bearing turn: the NEWEST `user-prompt` event
+ * that has no `turnId` yet and whose text equals one of the turn's text
+ * blocks — or the turn's `display` echo when the caller supplies one
+ * (run-minted prompt turns never carry `display` themselves; the TUI's
+ * command `runAgent` path injects the origin display onto a copy after the
+ * sub-run resolves, since the echo event's text is the short display line,
+ * not the full prompt). A prompt turn qualifies with at least one non-blank
+ * text block, OR — the attachment-only submit — with media blocks
+ * (document/image/audio/video) and no tool plumbing; the latter matches the
+ * newest untagged blank-text event that carries attachment chips. Tool-
+ * result-only user turns contribute nothing and synthetic loop-continue
+ * turns match no untagged event, so both fall through harmlessly.
+ *
+ * Pure — returns the SAME array instance when nothing matched, so hosts
+ * can cheaply skip a re-render.
+ */
+declare function retagUserPromptEvents(events: readonly StreamEvent[], appendedTurns: readonly SessionTurn[]): readonly StreamEvent[];
+/**
+ * Reduce persisted turns to the prompt refs the retag needs, dropping
+ * non-prompt turns (assistant, tool results) entirely.
+ *
+ * Shared by the in-process path and the daemon broadcast so both select the
+ * same turns as "prompts" — a divergence here would make a prompt selectable
+ * on one surface and not the other.
+ */
+declare function promptTurnRefs(turns: readonly SessionTurn[]): PromptTurnRef[];
+/**
+ * The minimum a prompt turn must carry to be matched against its live echo.
+ *
+ * Exists because the daemon has to send this over a wire: a full `SessionTurn`
+ * carries every content block, including base64 image and document payloads,
+ * which would be megabytes per prompt to ship for the sake of attaching an id.
+ */
+interface PromptTurnRef {
+  id: string;
+  /** Text blocks plus the `display` override, if any. */
+  texts: readonly string[];
+  attachmentOnly: boolean;
+}
+/**
+ * Attach persisted turn ids to the live `user-prompt` events they correspond
+ * to, so a just-sent prompt becomes selectable (hover, click, edit, delete)
+ * without waiting for a session reload.
+ *
+ * Matching is newest-first and one-to-one: identical prompt text sent twice
+ * must bind to two different turns, so each ref consumes exactly one untagged
+ * event.
+ */
+declare function retagUserPromptEventsFromRefs(events: readonly StreamEvent[], refs: readonly PromptTurnRef[]): readonly StreamEvent[];
+/**
+ * Per-event visibility — filters honor user toggles and the
+ * `hideSubagentOutput` setting. When subagent output is hidden:
+ *   - Child-agent events are filtered down to the `spawn-start` /
+ *     `spawn-end` markers so the user still sees "🌱 working… 🌳 done".
+ *   - The parent's `tool-result` for `spawn` is hidden too. Its body
+ *     duplicates `spawn-end`'s stats line *and* the parent's next
+ *     markdown turn; showing it again produces an extra
+ *     `┃ [sub-agent child-1] Completed …` block users just want gone.
+ *
+ * Renderer-agnostic — returns plain `boolean` so TUI / GUI consumers
+ * can filter events identically.
+ */
+/** `notice.label` the host stamps on prompt-cache break/expiry rows (`host/notices/index.ts`). */
+declare const CACHE_NOTICE_LABEL = "cache";
+declare function isVisible(event: StreamEvent, settings: Settings): boolean;
+/**
+ * Build the `resultTurnId → owningAssistantTurnId` map used by the select-
+ * turn mode to coalesce a tool-call's surrounding turns into ONE navigation
+ * stop.
+ *
+ * Protocol shape: every `tool_call` block in an assistant turn is closed by
+ * a matching `tool_result` block in the *next* user turn (the agent loop's
+ * history validator depends on this). When the next user turn's only events
+ * are `tool-result`s — i.e. it's pure plumbing for the prior assistant
+ * turn — we map it back to that assistant turn here. The select-turn nav
+ * index ({@link selectableTurnIds}) skips owned turns, and the renderer's
+ * highlight gate ({@link isTurnHighlighted}) extends the selection accent
+ * from the assistant turn to the events of any turn it owns. Net effect:
+ *
+ *   - Navigation never lands the cursor on a result-only turn whose own
+ *     events may be hidden by `showToolResults: false` — the cursor
+ *     wouldn't be visible.
+ *   - Selecting an assistant turn highlights the call AND its result as
+ *     one unit, matching the user's mental model of "one message".
+ *
+ * Owner-lookup is conservative: result-only turns with no matching prior
+ * assistant turn (orphaned — usually because the parent was deleted)
+ * stay selectable so the user can act on them via the turn-details modal.
+ *
+ * Subagent (`childId` set) events are ignored — they live in a separate
+ * conversation tree.
+ */
+declare function turnSelectionOwnership(events: readonly StreamEvent[]): Map<string, string>;
+/**
+ * Render-time check: should `event` paint with the selection accent?
+ *
+ * `true` when the event's own turn is selected, OR when the selected turn
+ * `owns` the event's turn via {@link turnSelectionOwnership} (the call and
+ * its tool-result rows highlight together). `false` when nothing is
+ * selected or the relationship doesn't apply.
+ *
+ * Pure. Renderer-agnostic — the TUI's `<Transcript>` uses it; a GUI's
+ * equivalent walks the same rule.
+ */
+declare function isTurnHighlighted(event: Pick<StreamEvent, 'turnId'>, selectedTurnId: string | null, ownership: ReadonlyMap<string, string>): boolean;
+/**
+ * Ownership for "one selection stop per message": result-only turns fold
+ * into their assistant turn (`turnSelectionOwnership`), and turns that only
+ * did work (thinking, tool calls, worker markers) fold into the answer that
+ * follows them in the same exchange. "Read three files, then answered" is
+ * one stop, so ↑ moves one visible message at a time. An exchange that ends
+ * in work alone stops on its first work turn. Same rule as the GUI's
+ * `computeSelectStops`.
+ */
+declare function messageSelectionOwnership(events: readonly StreamEvent[]): Map<string, string>;
+/**
+ * Deduplicated, in-order list of **parent-conversation** turn ids that appear
+ * in a rendered transcript — the navigation index for the TUI's select-turn
+ * mode. Three classes of turns are deliberately skipped:
+ *
+ *   - **Subagent turns** (`childId` set). Nested execution detail; the
+ *     user's mental model of a "message" is the conversational exchange,
+ *     not each spawn turn. Also filtered out by `isVisible` under
+ *     `hideSubagentOutput: true` — selecting them would highlight nothing.
+ *   - **Result-only turns** — see {@link turnSelectionOwnership}. These get
+ *     coalesced into the assistant turn that emitted their tool_calls.
+ *   - **Settings-hidden turns** (when `settings` is supplied). A turn whose
+ *     every event fails {@link isVisible} would render no rows — landing
+ *     the cursor there hides it from the user entirely. The check is opt-
+ *     in so SDK callers without a Settings object keep the legacy
+ *     "everything visible" behavior.
+ *
+ * Synthetic events (separator, spawn-start, spawn-end) have no `turnId` and
+ * are skipped naturally.
+ */
+declare function selectableTurnIds(events: readonly StreamEvent[], settings?: Settings, visible?: (event: StreamEvent) => boolean, opts?: {
+  byMessage?: boolean;
+}): string[];
+//#endregion
+//#region src/chat/cred-keys.d.ts
+/**
+ * Credential-file key arithmetic, split from `./credentials` so the rules can
+ * be enforced where credentials themselves must not be pulled in.
+ *
+ * `./credentials` reaches the provider registry (and through it the pi-ai
+ * factories) for `credKeyOf`; the extension loader — an edge entrypoint that
+ * validates descriptor keys at registration time — must stay clear of that
+ * graph. This module is string arithmetic with no imports.
+ */
+/**
+ * Separator between a provider's canonical key and a slot qualifier. Every
+ * non-canonical slot (`#alt`, `#account:N`) starts with it, so the character is
+ * reserved in descriptor credential keys outright.
+ */
+declare const CRED_KEY_SLOT_SEPARATOR = "#";
+/**
+ * Reserved suffix marking a provider's SECOND credential slot.
+ *
+ * Not usable as (or as the tail of) a descriptor's credential key: `foo#alt`
+ * holds `foo`'s alternate credential, so a provider claiming that name would
+ * share storage with it.
+ */
+declare const ALTERNATE_CRED_KEY_SUFFIX = "#alt";
+/**
+ * Reserved infix marking one of a provider's ADDITIONAL OAuth accounts:
+ * `foo#account:1`, `foo#account:2`, …
+ */
+declare const ACCOUNT_CRED_KEY_INFIX = "#account:";
+/**
+ * File key holding a provider's second credential, when it has one of each kind.
+ *
+ * The canonical key always holds the credential the user prefers; this sibling
+ * holds the other. That one invariant is what makes preference selection free:
+ * every existing reader (`applyApiKeyEnv`, the harness provider factories)
+ * already resolves the canonical key, so "switch priority" is just moving two
+ * objects between two keys — no precedence flag to interpret, no resolution
+ * order to keep in sync across layers.
+ *
+ * A sibling key rather than a nested field because the canonical entry gets
+ * REPLACED wholesale on token refresh; anything nested inside it would be
+ * dropped by the next rotation. And older zidane versions look credentials up
+ * by `credKeyOf`, so a suffixed key is simply invisible to them — they read the
+ * preferred credential and behave exactly as before, which is why this needs no
+ * migration or schema version.
+ */
+declare function alternateCredKey(fileKey: string): string;
+/**
+ * File key holding one of a provider's non-active OAuth accounts.
+ *
+ * Same sibling-key reasoning as {@link alternateCredKey}: the canonical key is
+ * the active one, so a provider with three OAuth grants stores the active one
+ * canonically and the other two under `#account:N`. `#alt` stays dedicated to
+ * the other-kind (API key) alternate so files written by builds that predate
+ * multi-account keep meaning the same thing.
+ */
+declare function accountCredKey(fileKey: string, n: number): string;
+/** True when `key` is one of `fileKey`'s `#account:N` slots. */
+declare function isAccountCredKey(fileKey: string, key: string): boolean;
+/**
+ * Name shown for an OAuth account that was never given one.
+ *
+ * Also what a first OAuth login is stored under, so a second account has
+ * something to be told apart from. Pre-multi-account files hold unnamed
+ * grants; {@link oauthAccountLabel} makes them read the same.
+ */
+declare const DEFAULT_OAUTH_ACCOUNT_LABEL = "Default";
+/** Trimmed user-given account name, or {@link DEFAULT_OAUTH_ACCOUNT_LABEL}. */
+declare function oauthAccountLabel(credential: {
+  label?: unknown;
+}): string;
+/**
+ * True when a key claims a reserved slot namespace.
+ *
+ * Built-in keys are plain identifiers (`anthropic`, `openai-codex`), but
+ * `ProviderDescriptor.key` / `credentialFileKey` are open strings — so the
+ * reservation is checked, not assumed.
+ */
+declare function isReservedCredKey(fileKey: string): boolean;
+//#endregion
+//#region src/chat/daemon-health.d.ts
+/**
+ * Daemon connection health — the one model behind the status dot in both
+ * clients' footers.
+ *
+ * Three states, because "connected: boolean" cannot express the one users
+ * actually want to see: a daemon that is being spawned or reconnected is not
+ * DOWN, and painting it red for the seconds that takes teaches people to
+ * ignore red. So:
+ *
+ *   - `connected`    — handshake done, signals live.            green (accent)
+ *   - `connecting`   — spawning / reconnecting / first attempt. amber (warn)
+ *   - `disconnected` — reachable daemon absent, last attempt failed. red (error)
+ *
+ * Tones are theme SLOTS, not colors, so the dot recolors with the palette on
+ * both surfaces. Node-free; re-exported from `zidane/chat/pure`.
+ */
+type DaemonHealth = 'connected' | 'connecting' | 'disconnected';
+type DaemonHealthTone = 'accent' | 'warn' | 'error';
+interface DaemonHealthStyle {
+  tone: DaemonHealthTone;
+  /** Tooltip / accessibility text. The dot itself carries no words. */
+  label: string;
+}
+declare const DAEMON_HEALTH_GLYPH = "●";
+declare const DAEMON_HEALTH_STYLE: Readonly<Record<DaemonHealth, DaemonHealthStyle>>;
+//#endregion
+//#region src/chat/safe-mode-context.d.ts
+/**
+ * Outcome of an approval prompt. Four bulk decisions match the original
+ * single-edit modal contract; `partial` is the multi-edit branch — the
+ * user accepted a subset of an `edit` / `multi_edit` / `write_file` call.
+ *
+ * `partial.mask` is 1:1 with the call's hunks (in input order): `true`
+ * means apply, `false` means deny. The gate handler walks the mask to
+ * build per-hunk outcomes; the TUI rebinds `ctx.input.edits` to the
+ * approved subset and the renderer reconstructs the full per-hunk view
+ * from the `<edit-outcomes>` annotation appended to the tool result.
+ */
+type ApprovalDecision = 'accept-once' | 'accept-session' | 'accept-safelist' | 'deny' | {
+  kind: 'partial';
+  mask: readonly boolean[];
+};
+/**
+ * Identifies the caller behind an approval prompt — the parent agent or
+ * a specific subagent (`child-N`). The modal's right-side title pins the
+ * label so the user knows which agent issued the call when subagents
+ * bubble their gates up through the parent's hook bus.
+ */
+type ApprovalOriginator = {
+  kind: 'parent';
+} | {
+  kind: 'child';
+  label: string;
+};
+interface ApprovalRequest {
+  id: string;
+  tool: string;
+  input: Record<string, unknown>;
+  resolve: (decision: ApprovalDecision) => void;
+  /** Caller attribution. Absent ≡ `{ kind: 'parent' }`. */
+  originator?: ApprovalOriginator;
+  /**
+   * Cross-window correlation id (the daemon's approval request id) for
+   * entries surfaced by the daemon runtime. Lets `dropByCorrelation`
+   * retract this entry when ANOTHER window resolves the same shared
+   * approval, without re-sending a decision. Absent for local-runtime
+   * approvals.
+   */
+  correlationId?: string;
+}
+/** Function signature consumed by `tool:gate` handlers + the child-tool wrap. */
+type RequestApproval = (tool: string, input: Record<string, unknown>, originator?: ApprovalOriginator, correlationId?: string) => Promise<ApprovalDecision>;
+interface SafeModeActions {
+  /** Request a decision; resolves once the user picks. */
+  requestApproval: RequestApproval;
+  /** Resolve the head and shift the queue forward. */
+  resolveHead: (decision: ApprovalDecision) => void;
+  /** Resolve all pending with `deny`. Used on abort / hard exit. */
+  denyAll: () => void;
+  /**
+   * Remove the entry whose `correlationId` matches, WITHOUT resolving it
+   * (the daemon already did, in another window). No-op when absent.
+   */
+  dropByCorrelation: (correlationId: string) => void;
+}
+/**
+ * Owns the queue + actions. Splits the value across two contexts so a queue
+ * change doesn't invalidate every callback memo that closes over the actions.
+ */
+declare function SafeModeProvider({ children }: {
+  children: ReactNode;
+}): import("react").JSX.Element;
+declare function useSafeModeQueue(): readonly ApprovalRequest[];
+declare function useSafeModeActions(): SafeModeActions;
+//#endregion
+//#region src/chat/edit-approval.d.ts
+/**
+ * Convert a per-hunk approval mask into an `EditOutcome[]`. `true` →
+ * `applied`; `false` → `denied` with the supplied reason.
+ *
+ * Length is `Math.max(mask.length, fallbackLength)` so callers passing a
+ * shorter mask still get a fully-populated array — missing entries
+ * default to applied, matching the "no decision => keep" convention.
+ */
+declare function maskToOutcomeKinds(mask: readonly boolean[], fallbackLength: number, deniedReason?: string): EditOutcome[];
+/**
+ * Apply an `ApprovalDecision` to a payload, returning the resolved
+ * per-hunk outcomes + the gate-level verdict.
+ *
+ * Pure — does not mutate `input` or `payload`. The TUI's `applyGate`
+ * consumes the result: stashes `outcomes` in the pending-annotation map
+ * (keyed by callId) so `tool:transform` can append the
+ * `<edit-outcomes>` block to the tool result, rebinds `ctx.input.edits`
+ * to the approved subset for `partial`, and emits the `syntheticEvent`
+ * for fully-denied or fully-blocked calls.
+ */
+interface ResolvedApproval {
+  /** Final state of every hunk after the decision (1:1 with payload.hunks). */
+  outcomes: EditOutcome[];
+  /** True when no hunk will be applied — gate should `block` the call. */
+  shouldBlock: boolean;
+  /**
+   * Synthetic `EditPayload` to render in the transcript. Identical to the
+   * incoming payload but with `outcomes` set so the renderer can badge
+   * each hunk. Only meaningful when at least one hunk was denied —
+   * an all-applied decision returns `null` here and the normal
+   * `tool:before` event suffices.
+   */
+  syntheticEvent: EditPayload | null;
+}
+declare function resolveApprovalForPayload(decision: ApprovalDecision, payload: EditPayload): ResolvedApproval;
+/**
+ * Render an `EditOutcome[]` as the wire-format annotation block. Returns
+ * the body to APPEND to a tool result; callers join with a leading
+ * `\n\n` separator. Idempotent on missing reasons — bare `applied` lines
+ * stay terse.
+ */
+declare function buildEditOutcomesAnnotation(outcomes: readonly EditOutcome[]): string;
+/**
+ * Parse an `<edit-outcomes>…</edit-outcomes>` annotation block out of a
+ * tool result body. Returns the outcomes keyed by 1-based hunk index, or
+ * `null` when the block is missing / malformed.
+ *
+ * Anchored on the explicit tag pair so the parser doesn't false-positive
+ * on natural prose that happens to contain `#1 applied`.
+ */
+declare function parseEditOutcomesFromResult(result: string | readonly ToolResultContent[]): EditOutcome[] | null;
+/**
+ * Strip the first `<edit-outcomes>…</edit-outcomes>` block out of a tool
+ * result body, returning the surrounding text. Used by the
+ * `tool:transform` hook to peel a body-emitted annotation before
+ * re-appending the merged (approval ∪ body) version — otherwise the
+ * result would carry two annotation blocks and
+ * {@link parseEditOutcomesFromResult} would only see the first.
+ *
+ * Anchored on the same `\n<edit-outcomes>\n` / start-of-string newline
+ * shape the parser uses, so prose that incidentally mentions
+ * `<edit-outcomes>` (e.g. a model summarizing its own format) isn't
+ * mistakenly stripped. Trims a single leading `\n\n` separator when
+ * present so successive strips don't leave dangling blank lines.
+ * Idempotent on inputs that don't contain a properly-anchored block.
+ */
+declare function stripEditOutcomesAnnotation(text: string): string;
+/**
+ * Merge body-side outcomes (keyed against the approved subset the tool
+ * actually ran on, in subset-position order) into approval-side outcomes
+ * (1:1 with the model's ORIGINAL `edits` list, with `denied` entries for
+ * every hunk the user dropped).
+ *
+ * Algorithm: walk the approval array; every `applied` placeholder
+ * corresponds to one approved hunk that the body ran. Consume body's
+ * outcomes in order against those placeholders. Non-`applied` approval
+ * entries (`denied`, `skipped`) stay untouched — they describe gate-
+ * level decisions the body never saw.
+ *
+ * Pure. Returns a fresh array; never mutates either input.
+ *
+ * Edge cases:
+ *  - `body` is empty / shorter than the approved count → remaining
+ *    approval `applied` placeholders stay as `applied` (the body ran
+ *    happily; absence of a body entry means nothing failed).
+ *  - `body` longer than approved count → trailing body entries are
+ *    ignored. Shouldn't happen in practice (body sees the rebound
+ *    subset), but the guard keeps the merge total-pure.
+ */
+declare function mergeApprovalAndBodyOutcomes(approval: readonly EditOutcome[], body: readonly EditOutcome[] | null): EditOutcome[];
+/**
+ * Rewrite a `multi_edit` body header so the totals reflect the model's
+ * ORIGINAL edit list (the merged outcomes count) instead of the subset
+ * the body actually saw after gate rebinding. Without this, a partially
+ * approved call surfaces a misleading `applied 2 of 2 edits` (subset
+ * counts) on the wire even when the original was `applied 2 of 3`.
+ *
+ * Three body-side shapes are handled (matching `multi_edit`'s emit):
+ *   1. `Edited <path>: applied N edits (R replacements).`
+ *   2. `Edited <path>: applied N of M edits (R replacements).`
+ *   3. `multi_edit error: no edits applied to <path> (M attempted).`
+ *
+ * The replacements count is preserved verbatim — it's a body-side stat
+ * the chat layer can't recompute. When the first line doesn't look like
+ * any of the three shapes (e.g. an unrelated error preamble bubbled up),
+ * the text is returned unchanged.
+ */
+declare function rewriteMultiEditHeader(text: string, merged: readonly EditOutcome[], path: string): string;
+/**
+ * Aggregate counts for the transcript's summary badge (`3 applied · 1
+ * denied · 1 skipped`). Exported so renderers don't reimplement the
+ * tally. Pure / O(n).
+ */
+declare function summarizeOutcomes(outcomes: readonly EditOutcome[] | undefined): {
+  applied: number;
+  denied: number;
+  skipped: number;
+  failed: number;
+  pending: number;
+  total: number;
+};
+//#endregion
+//#region src/tools/edit-utils.d.ts
+/**
+ * Locate the actual substring in `haystack` that corresponds to `needle`,
+ * recovering from typographical mismatch on six escalating fallbacks:
+ *
+ * 1. Exact substring match (the happy path — no transformation).
+ * 2. Curly-quote normalization on both sides — when the model emits straight
+ *    quotes but the file has curly ones (or vice versa), the slice of the
+ *    file at the matched position carries the file's actual typography.
+ * 3. Anthropic-sanitization undo on the needle — the model's `<n>` becomes
+ *    the file's `<name>`, etc.
+ * 4. Combined: desanitize + quote normalization on the needle.
+ * 5. Line-number-prefix strip — when the model pasted a numbered `read_file`
+ *    chunk verbatim into `old_string` and the file carries no such prefix.
+ * 6. Combined: line-number strip + quote normalization — paste-back of a
+ *    numbered chunk against a file whose typography differs from the model's.
+ *
+ * Returns `{ actual, occurrences }` — `actual` is the string that exists in
+ * the file (use this to do the actual replace; preserves the file's
+ * typography). `occurrences` is the count of those matches in the file.
+ *
+ * Fallbacks 3-4 (desanitize-class) only fire when the transformed needle is
+ * UNIQUE in the file — they rewrite the needle's meaning rather than its
+ * typography, so an ambiguous match risks silently retargeting the wrong
+ * text (see the inline comment at step 3).
+ *
+ * Returns `null` when no recovery worked.
+ */
+interface ResolvedMatch {
+  actual: string;
+  occurrences: number;
+  /** Recovery path — `'exact'` when no transformation was applied. */
+  via: 'exact' | 'quotes' | 'desanitize' | 'quotes+desanitize' | 'line-numbers' | 'quotes+line-numbers';
+}
+//#endregion
+//#region src/chat/edit-diff.d.ts
+declare function extractEditPayload(name: string, input: Record<string, unknown>, priorContent?: string): EditPayload | undefined;
+type DiffOp = 'context' | 'add' | 'remove';
+interface DiffLine {
+  op: DiffOp;
+  text: string;
+}
+declare function computeLineDiff(oldString: string, newString: string): DiffLine[];
+/**
+ * Split a string into lines preserving empty lines but dropping the
+ * implicit trailing `""` produced by a final `\n`. Exported only for
+ * its tests — callers should use `computeLineDiff`.
+ */
+declare function splitLines(s: string): string[];
+interface InlineSegment {
+  text: string;
+  changed: boolean;
+}
+interface InlineDiff {
+  oldSegments: InlineSegment[];
+  newSegments: InlineSegment[];
+}
+declare function computeInlineDiff(oldLine: string, newLine: string): InlineDiff;
+/**
+ * Tokenize on word / non-word boundaries. Each run of `\w+` is one
+ * token; each run of `\W+` (whitespace, punctuation) is another. This
+ * gives the right granularity for renames (`oldName` → `newName`) and
+ * for symbol swaps (`+ → -`) without exploding into per-char segments.
+ *
+ * Exported only for its tests.
+ */
+declare function tokenize(s: string): string[];
+/**
+ * Apply the payload's hunks against `priorContent` and return the
+ * resulting file body. Mirrors the agent's tool-side semantics:
+ *   - `replaceAll === true`  → `String.replaceAll`
+ *   - otherwise              → first-occurrence `String.replace`
+ *
+ * Hunks are applied in order — a `multi_edit` later hunk operates on
+ * the output of the earlier ones, just like the actual tool.
+ */
+declare function applyEditPayload(payload: EditPayload, priorContent: string): string;
+/**
+ * Like `buildUnifiedDiff` but operating against the full file content
+ * so the diff carries *real* file line numbers and configurable
+ * surrounding context.
+ *
+ * Strategy:
+ *   1. Apply the payload to `priorContent` → `newContent`.
+ *   2. Run `computeLineDiff` over the whole file.
+ *   3. Group non-context ops into hunks, padding each with up to
+ *      `contextLines` of context above and below. Adjacent hunks
+ *      whose context regions touch are merged so we don't emit two
+ *      `@@` headers separated by zero context lines.
+ *
+ * The output line numbers in the `@@` header are 1-based and reflect
+ * the change's position in the actual file — what the user expects
+ * when reading a diff alongside their editor.
+ *
+ * For `write_file` creating a new file (priorContent === ''), this
+ * falls back to the same `--- /dev/null` convention as
+ * `buildUnifiedDiff`.
+ */
+declare function buildContextualDiff(payload: EditPayload, priorContent: string, contextLines?: number): string;
+interface EditHunkSummary {
+  /** 1-based line number in the new file where the change starts; undefined when unknown (no priorContent). */
+  line?: number;
+  /** Number of lines added in this hunk. */
+  added: number;
+  /** Number of lines removed in this hunk. */
+  removed: number;
+  /** First removed line preview (trimmed, may be empty for pure additions). */
+  firstOld?: string;
+  /** First added line preview (trimmed, may be empty for pure deletions). */
+  firstNew?: string;
+}
+interface EditSummary {
+  totalAdded: number;
+  totalRemoved: number;
+  hunks: EditHunkSummary[];
+}
+/**
+ * Build a per-hunk digest used by the compact diff view.
+ *
+ * Strategy:
+ *  - When `priorContent` is present and the payload describes a real
+ *    file transformation, compute the contextual diff once, then walk
+ *    the LCS ops splitting at runs of `add` / `remove` to anchor each
+ *    summary entry to the **real** file line. This guarantees the
+ *    summary's `L<n>` matches what the user sees in their editor.
+ *  - Otherwise, fall back to per-hunk LCS over the (oldString,
+ *    newString) snippet pair. Line numbers are absent because the
+ *    snippet has no file position.
+ */
+declare function summarizeEditPayload(payload: EditPayload): EditSummary;
+interface HunkResolution {
+  /**
+   * True when the tool body would find this hunk's `old_string` AND apply
+   * it without ambiguity. False when `resolveOldString` returned null OR
+   * the match was ambiguous (multiple occurrences and `replace_all` off).
+   */
+  resolved: boolean;
+  /** Path the resolver took — `'exact'` when no recovery was needed. */
+  via?: ResolvedMatch['via'];
+  /** Match count in the running content for the hunk. */
+  occurrences?: number;
+  /** True when the resolver found >1 match without `replace_all`. */
+  ambiguous?: boolean;
+}
+interface PreviewResult {
+  /** Full unified diff of the (resolvable) hunks against `priorContent`. */
+  diffText: string;
+  /** 1:1 with `payload.hunks`. */
+  resolution: HunkResolution[];
+  /**
+   * Per-hunk isolated diff text rendered against the cumulative content
+   * after applying all earlier resolved hunks. Useful for the modal's
+   * focused-hunk view so hunk #N's preview reflects the state hunks
+   * 1..N-1 will leave the file in (same as the tool's order).
+   */
+  perHunkDiff: string[];
+  /**
+   * Resolved hunks with `oldString` rewritten to the haystack's actual
+   * bytes and `newString` re-styled to preserve curly-quote typography
+   * / line-prefix conventions. Pass this to `buildContextualDiff` to
+   * paint the unified diff.
+   */
+  resolvedPayload: EditPayload;
+}
+declare function previewEditPayload(payload: EditPayload, priorContent: string, contextLines?: number): PreviewResult;
+declare function buildUnifiedDiff(payload: EditPayload): string;
+declare function filetypeFromPath(path: string): string | undefined;
+//#endregion
+//#region src/chat/feature-gate.d.ts
+/**
+ * Opt-in feature gates: an experimental feature is one boolean setting
+ * (default off) plus a kill-switch env var that wins over it.
+ *
+ * The kill switch exists so a bug in the gated path can never lock the user
+ * out: the ungated path is always one flag away, even when the settings UI
+ * itself is unreachable. Each gate names its flag (`--no-daemon`,
+ * `--no-remote`); the CLI's {@link applyKillSwitchFlags} exports the env var
+ * for the process, so child processes inherit the switch too.
+ *
+ * Node-free on purpose (re-exported from `zidane/chat/pure`): the TUI and the
+ * GUI main process share one definition per gate, so both read the same
+ * setting and honor the same kill switch.
+ */
+type Env = Record<string, string | undefined>;
+interface FeatureGateOptions<K extends string> {
+  /** Settings key holding the opt-in. Only a literal `true` enables. */
+  setting: K;
+  /** Env var that disables the feature when set to `'1'`, whatever the setting says. */
+  killSwitchEnv: string;
+  /** The `zidane` flag that sets {@link killSwitchEnv} for the launch (`--no-…`). */
+  flag: string;
+}
+interface FeatureGate<K extends string> {
+  readonly setting: K;
+  readonly killSwitchEnv: string;
+  readonly flag: string;
+  /** The kill-switch env var is set to `'1'`. */
+  isKilled: (env?: Env) => boolean;
+  /** Setting is `true` and the kill switch is not engaged. */
+  isEnabled: (settings: Partial<Record<K, unknown>>, env?: Env) => boolean;
+}
+declare function defineFeatureGate<K extends string>({ setting, killSwitchEnv, flag }: FeatureGateOptions<K>): FeatureGate<K>;
+/**
+ * The shared daemon runtime. `ZIDANE_NO_DAEMON=1` is set by
+ * `zidane --no-daemon`.
+ */
+declare const daemonGate: FeatureGate<"useDaemon">;
+/**
+ * Remote hosts (zidane-server). The setting ("Remote hosts")
+ * gates the saved servers: the Hosts settings, the per-host session groups
+ * and picking a host for a new session. Connecting through an explicit `--host` /
+ * `ZIDANE_HOST_URL` is its own opt-in, but `ZIDANE_NO_REMOTE=1` still wins
+ * over it (`src/tui/host-target.ts`). `ZIDANE_NO_REMOTE=1` is set by
+ * `zidane --no-remote`.
+ */
+declare const remoteHostsGate: FeatureGate<"remoteHosts">;
+/** Every gate, so a client can report which kill switches are engaged. */
+declare const FEATURE_GATES: readonly FeatureGate<string>[];
+/**
+ * The kill-switch env vars engaged in `env`, sorted. The GUI main process
+ * hands this to its renderer (which has no `process.env`) so settings rows
+ * can say why they are inert.
+ */
+declare function engagedKillSwitches(env?: Env): string[];
+/** `name` is set to `'1'` in `env`: the kill-switch test, for a row that only knows the variable. */
+declare function isKillSwitchEngaged(name: string, env?: Env): boolean;
+//#endregion
+//#region src/chat/footer-chips.d.ts
+/**
+ * `warn` = a real cache break (a named dimension changed, so it was
+ * avoidable); `dim` = ordinary TTL expiry, which is not anyone's fault and
+ * should not shout.
+ */
+type CacheChipTone = 'warn' | 'dim';
+interface CacheChipContent {
+  tone: CacheChipTone;
+  /** Leading glyph. Kept out of `label` so a surface can style it separately. */
+  glyph: string;
+  label: string;
+}
+/**
+ * Build the chip for a cache break.
+ *
+ * `costUsd` is OPTIONAL and omitted entirely on a rate miss — never rendered
+ * as `$0.00`. A fabricated zero would read as "this was free", which is the
+ * opposite of what the chip exists to say. When present it is prefixed `~`
+ * because it is an estimate (registry rates × re-billed prefix), and clamped
+ * to `<0.01` rather than rounding a real charge down to nothing.
+ */
+declare function cacheBreakChip(info: CacheBreakInfo & {
+  costUsd?: number;
+}): CacheChipContent;
+/**
+ * Transcript-row text for a persisted cache-break notice. Multi-line, one
+ * fact per line, so both hosts can show a short headline and fold or list
+ * the rest:
+ *
+ *   cache break ↑116.9k tokens ~$0.48
+ *   messagePrefix: message 16 of 41→43 rewritten
+ *   likely compaction or history trimming
+ *
+ * The footer chip stays terse; the row carries the culprit so a break is
+ * diagnosable from the transcript. Only the headline on a TTL / eviction
+ * break (nothing was done wrong).
+ */
+declare function cacheBreakNoticeText(info: CacheBreakInfo & {
+  costUsd?: number;
+}): string;
+/**
+ * Provider-retry label — `retrying 2/5`, or `retrying 2/5 · child-3` when the
+ * stalled stream belongs to a subagent rather than the parent.
+ *
+ * Naming the source matters: with subagents in flight, an unattributed
+ * "retrying" leaves the user unable to tell whether their own turn is stuck or
+ * a delegated worker is.
+ */
+declare function retryLabel(info: {
+  attempt: number;
+  max: number;
+  source: string;
+}): string;
+/**
+ * Footer label while a compaction summary is being generated:
+ * `Compacting...`, then `~12k` once the loop reports a token estimate, then
+ * ` · 8s` once a second has passed. Same rule on every surface so a
+ * minutes-long compaction of a large transcript reads as progress — not a
+ * hang — identically in the TUI and the GUI.
+ *
+ * `now` is injectable so callers driving a 1 Hz tick don't have to re-read
+ * the clock, and so tests are deterministic.
+ */
+/**
+ * The live run readout: `1m 15s · ↓1.2k · 41 tok/s`. Time runs from the
+ * run's start, the count covers the whole run (settled turns plus the one
+ * streaming), and the rate is the honest windowed figure from
+ * `stepStreamRate` (`null` until it has one). `↓~` marks a count that is
+ * still the character heuristic. A tool-only stretch shows just the time.
+ *
+ * `detail` drops the least useful part first when space runs out:
+ * `'full'` → `'count'` (no rate) → `'time'`.
+ */
+declare function runStatusLabel(run: {
+  elapsedSec: number;
+  outputTokens: number;
+  estimated: boolean;
+  rate: number | null;
+}, detail?: 'full' | 'count' | 'time'): string;
+/**
+ * Live counter for one streaming turn: `↓1.2k`, `↓~1.2k` for the character
+ * heuristic, `↓1.2k · 41 tok/s` when an honest rate is passed in (see
+ * `stepStreamRate`; dividing tokens by time since the request counted the
+ * wait for the first token and the estimate correction). Empty until the
+ * first token.
+ */
+declare function streamingLabel(progress: {
+  outputTokens: number;
+  estimated: boolean;
+} | null | undefined, opts?: {
+  rate?: number | null;
+}): string;
+/**
+ * Session cost while a turn streams: settled figure plus the running estimate
+ * for the in-flight turn. `estimated` tells the surface to render it dimmed
+ * (the number will move, then snap to the settled value at turn end). `null`
+ * when there is nothing to show — never `$0.00`.
+ */
+declare function liveSessionCost(settledUsd: number, progress: {
+  estCostUsd?: number;
+} | null | undefined): {
+  usd: number;
+  estimated: boolean;
+} | null;
+declare function compactingLabel(estTokens: number | null | undefined, startedAt: number | null | undefined, now?: number): string;
+//#endregion
+//#region src/chat/history-search.d.ts
+interface HighlightRange {
+  start: number;
+  end: number;
+}
+interface HighlightSegment {
+  text: string;
+  highlighted: boolean;
+}
+interface SearchExcerpt {
+  text: string;
+  highlighted: HighlightRange[];
+}
+interface SearchTurnMatch {
+  turn: SessionTurn;
+  text: string;
+  highlighted: HighlightRange[];
+  excerpts: SearchExcerpt[];
+  score: number;
+  matchKind: 'exact-phrase' | 'exact-terms' | 'fuzzy';
+}
+type SearchTurnResult = SearchTurnMatch;
+interface SearchSessionResult {
+  id: string;
+  score: number;
+  matchKind: 'exact-phrase' | 'exact-terms' | 'fuzzy';
+  turn: SessionTurn;
+  text: string;
+  highlighted: HighlightRange[];
+  excerpts: SearchExcerpt[];
+}
+interface SessionSearchExcerpt extends SearchExcerpt {
+  turnId: string;
+  role: SessionTurn['role'];
+}
+/** Aggregated row-level match used by the conversations list. */
+interface SessionHistoryMatch {
+  score: number;
+  matchedTurnIds: string[];
+  excerpts: SessionSearchExcerpt[];
+}
+interface IndexedSearchTurn {
+  turn: SessionTurn;
+  /** Attachment/base64-free text shown in search results. */
+  text: string;
+  /** Pre-normalized once, reused for every query. */
+  lowerText: string;
+}
+interface SessionSearchIndex {
+  turns: IndexedSearchTurn[];
+}
+declare function buildSessionSearchIndex(turns: readonly SessionTurn[]): SessionSearchIndex;
+/** Yielding index builder for TUI callers — never monopolizes a frame. */
+declare function buildSessionSearchIndexAsync(turns: readonly SessionTurn[], options?: {
+  yieldEvery?: number;
+  onProgress?: (indexed: number, total: number) => void;
+  signal?: AbortSignal;
+}): Promise<SessionSearchIndex>;
+declare function searchSessionIndex(index: SessionSearchIndex, query: string, limit?: number): SearchTurnMatch[];
+/** Yielding matcher for very large indexes; progress is checked per chunk. */
+declare function searchSessionIndexAsync(index: SessionSearchIndex, query: string, options?: {
+  limit?: number;
+  yieldEvery?: number;
+  onProgress?: (searched: number, total: number) => void;
+  signal?: AbortSignal;
+}): Promise<SearchTurnMatch[]>;
+declare function searchTurns(turns: readonly SessionTurn[], query: string, limit?: number): SearchTurnMatch[];
+declare function searchSessionTurns(turns: readonly SessionTurn[], query: string, maxExcerpts?: number): SearchSessionResult[];
+declare function searchSessionHistory(turns: readonly SessionTurn[], query: string, maxExcerpts?: number): SessionHistoryMatch | null;
+declare function searchSessionHistoryIndex(index: SessionSearchIndex, query: string, maxExcerpts?: number): SessionHistoryMatch | null;
+declare function searchSessionHistoryIndexAsync(index: SessionSearchIndex, query: string, maxExcerpts?: number, onProgress?: (searched: number, total: number) => void, signal?: AbortSignal): Promise<SessionHistoryMatch | null>;
+/**
+ * `contentMatches` are keyed by `keyOf(meta)`: the bare id by default, a
+ * (host, id) session key for a list across hosts (twins are two rows).
+ */
+declare function filterSessionSearchCatalog(sessions: readonly SessionMeta[], query: string, contentMatches: ReadonlyMap<string, SessionHistoryMatch>, keyOf?: (meta: SessionMeta) => string): SessionMeta[];
+declare function searchHighlightRanges(text: string, query: string): HighlightRange[];
+declare function highlightSegments(text: string, ranges: readonly HighlightRange[]): HighlightSegment[];
+/**
+ * Search-specific serializer. Unlike `turnAsText`, it never serializes media,
+ * document attachments, encrypted reasoning, or base64-looking payloads.
+ */
+declare function searchableTurnText(turn: SessionTurn): string;
+//#endregion
+//#region src/chat/browser/protocol.d.ts
+/**
+ * The dev browser's automation contract: what the agent's `browser_*` tools
+ * send, what the GUI (the process that owns the page) answers. Plain data
+ * both ways, so it crosses the daemon socket and IPC unchanged.
+ */
+/** A target on the page: a snapshot ref (preferred), a CSS selector / `text=` / `role=` locator, or a point. */
+interface BrowserTarget {
+  ref?: string;
+  selector?: string;
+  x?: number;
+  y?: number;
+}
+type BrowserWaitUntil = 'load' | 'domcontentloaded' | 'none';
+interface BrowserOpInputs {
+  open: {
+    url?: string;
+    show?: boolean;
+  };
+  navigate: {
+    url?: string;
+    action?: 'back' | 'forward' | 'reload';
+    waitUntil?: BrowserWaitUntil;
+    timeoutMs?: number;
+  };
+  snapshot: Record<string, never>;
+  screenshot: {
+    ref?: string;
+  };
+  click: BrowserTarget & {
+    timeoutMs?: number;
+  };
+  type: BrowserTarget & {
+    text: string;
+    clear?: boolean;
+    submit?: boolean;
+    timeoutMs?: number;
+  };
+  press: {
+    key: string;
+    modifiers?: ('Alt' | 'Control' | 'Meta' | 'Shift')[];
+  };
+  scroll: BrowserTarget & {
+    dx?: number;
+    dy?: number;
+  };
+  wait_for: {
+    text?: string;
+    selector?: string;
+    urlIncludes?: string;
+    timeoutMs?: number;
+  };
+  evaluate: {
+    expression: string;
+  };
+  console: {
+    since?: number;
+    level?: 'error' | 'warning' | 'all';
+  };
+}
+type BrowserOp = keyof BrowserOpInputs;
+declare const BROWSER_OPS: readonly ["open", "navigate", "snapshot", "screenshot", "click", "type", "press", "scroll", "wait_for", "evaluate", "console"];
+interface BrowserStatus {
+  url: string;
+  title: string;
+  loading: boolean;
+  viewport?: {
+    width: number;
+    height: number;
+  };
+}
+/** What changed on the page because of an action; the agent reads this instead of re-snapshotting every step. */
+interface BrowserChange {
+  /** The element acted on, by its accessible name (or tag when it has none). */
+  target?: string;
+  url?: string;
+  title?: string;
+  /** A JavaScript dialog the page opened, and what was done with it. */
+  dialog?: {
+    type: string;
+    message: string;
+    handled: 'accepted' | 'dismissed';
+  };
+  /** Console errors and failed requests since the action started. */
+  errors?: string[];
+  /** The page navigated or changed a lot: refs from the last snapshot may be gone. */
+  refsStale?: boolean;
+}
+interface BrowserConsoleEntry {
+  seq: number;
+  level: 'error' | 'warning' | 'info' | 'log' | 'debug';
+  text: string;
+  /** Set for failed network requests. */
+  url?: string;
+}
+interface BrowserSnapshot {
+  status: BrowserStatus;
+  /** One line per interactive or landmark element, `[ref=eN]` on the ones you can act on. */
+  outline: string;
+  /** Elements left out because of the cap. */
+  truncated: number;
+  text: string;
+  errors: string[];
+}
+interface BrowserScreenshot {
+  /** Base64 JPEG. */
+  data: string;
+  mediaType: 'image/jpeg';
+  width: number;
+  height: number;
+  /** Image pixels per CSS pixel: divide image coordinates by this to click. */
+  scale: number;
+}
+interface BrowserOpResults {
+  open: BrowserStatus;
+  navigate: BrowserStatus;
+  snapshot: BrowserSnapshot;
+  screenshot: BrowserScreenshot;
+  click: BrowserChange;
+  type: BrowserChange;
+  press: BrowserChange;
+  scroll: BrowserChange & {
+    scrollX?: number;
+    scrollY?: number;
+  };
+  wait_for: BrowserStatus;
+  evaluate: {
+    value: unknown;
+  };
+  console: {
+    entries: BrowserConsoleEntry[];
+    next: number;
+  };
+}
+type BrowserErrorCode = 'no_browser' | 'no_page' | 'stale_ref' | 'not_found' | 'not_actionable' | 'invalid_url' | 'invalid_input' | 'timeout' | 'interrupted' | 'cancelled' | 'too_large' | 'failed';
+interface BrowserRequest<O extends BrowserOp = BrowserOp> {
+  requestId: string;
+  sessionId: string;
+  op: O;
+  input: BrowserOpInputs[O];
+  timeoutMs: number;
+}
+type BrowserResponse<O extends BrowserOp = BrowserOp> = {
+  ok: true;
+  result: BrowserOpResults[O];
+} | {
+  ok: false;
+  error: {
+    code: BrowserErrorCode;
+    message: string;
+  };
+};
+declare class BrowserOpError extends Error {
+  readonly code: BrowserErrorCode;
+  constructor(code: BrowserErrorCode, message: string);
+}
+/** Default and ceiling for an action's own wait (element to become actionable, text to appear). */
+declare const BROWSER_ACTION_TIMEOUT_MS = 5000;
+declare const BROWSER_WAIT_TIMEOUT_MS = 10000;
+declare const BROWSER_MAX_WAIT_MS = 30000;
+/** How long the host waits for a page to mount and register before `open` gives up. */
+declare const BROWSER_OPEN_MOUNT_MS = 15000;
+/** Transport budget on top of the action's own wait. */
+declare const BROWSER_REQUEST_SLACK_MS = 5000;
+declare const BROWSER_EVALUATE_MAX_BYTES: number;
+declare const BROWSER_OUTLINE_MAX_ELEMENTS = 250;
+declare const BROWSER_TEXT_MAX_CHARS = 8000;
+//#endregion
+//#region src/chat/machine-protocol.d.ts
+/** Bumped on an incompatible change; a host refuses another major. */
+declare const MACHINE_PROTOCOL_VERSION = 1;
+interface MachineRoot {
+  path: string;
+  label?: string;
+}
+interface MachineCapabilities {
+  shell: boolean;
+  terminals: boolean;
+  background: boolean;
+  worktrees: boolean;
+  /** `exec.stream*` (live stdin/stdout: context-scoped MCP servers). Absent on older machines. */
+  stream?: boolean;
+  /** The machine runs every command under its own OS sandbox (its user's `sandbox*` settings). */
+  sandboxed?: boolean;
+}
+interface MachineRegisterParams {
+  machineId: string;
+  name: string;
+  roots: MachineRoot[];
+  capabilities: MachineCapabilities;
+  version: string;
+  protocolVersion: number;
+}
+interface MachineRegisterResult {
+  machineId: string;
+  hostId?: string;
+}
+/** A handle as the host names it: the machine rebuilds an unknown one (it restarted). */
+interface MachineHandleRef {
+  id: string;
+  cwd: string;
+}
+interface MachineListOptions {
+  glob?: boolean;
+  limit?: number;
+  metadata?: boolean;
+  gitignore?: boolean;
+}
+interface MachineTaskHandle {
+  taskId: string;
+  pid: number;
+  outputPath: string;
+}
+/** A machine's worktree, on its filesystem. */
+interface MachineWorktreeRef {
+  path: string;
+  repoRoot: string;
+}
+/** Requests the host sends to a machine: params → result. */
+interface MachineMethods {
+  'machine.ping': {
+    params: Record<string, never>;
+    result: {
+      ok: true;
+    };
+  };
+  'exec.spawn': {
+    params: {
+      handle: MachineHandleRef;
+    };
+    result: {
+      id: string;
+      cwd: string;
+    };
+  };
+  'exec.run': {
+    params: {
+      handle: MachineHandleRef;
+      callId: string;
+      command: string;
+      cwd?: string;
+      env?: Record<string, string>;
+      timeout?: number;
+    };
+    result: {
+      stdout: string;
+      stderr: string;
+      exitCode: number;
+    };
+  };
+  'exec.cancel': {
+    params: {
+      callId: string;
+    };
+    result: {
+      cancelled: boolean;
+    };
+  };
+  'exec.destroy': {
+    params: {
+      handle: MachineHandleRef;
+    };
+    result: {
+      ok: true;
+    };
+  };
+  /** Start a live process; its output comes as `exec.stream.data` / `exec.stream.exit`, `exec.cancel` kills it. */
+  'exec.stream': {
+    params: {
+      handle: MachineHandleRef;
+      callId: string;
+      command: string;
+      cwd?: string;
+      env?: Record<string, string>;
+    };
+    result: {
+      pid: number;
+    };
+  };
+  'exec.stream.write': {
+    params: {
+      callId: string;
+      data: string;
+    };
+    result: {
+      ok: true;
+    };
+  };
+  'fs.read': {
+    params: {
+      handle: MachineHandleRef;
+      path: string;
+      binary?: boolean;
+    };
+    result: {
+      content: string;
+    };
+  };
+  'fs.write': {
+    params: {
+      handle: MachineHandleRef;
+      path: string;
+      content: string;
+    };
+    result: {
+      ok: true;
+    };
+  };
+  'fs.list': {
+    params: {
+      handle: MachineHandleRef;
+      path: string;
+      options?: MachineListOptions;
+    };
+    result: {
+      entries: Array<string | {
+        path: string;
+        size?: number;
+        mtimeMs?: number;
+      }>;
+    };
+  };
+  'fs.size': {
+    params: {
+      handle: MachineHandleRef;
+      path: string;
+    };
+    result: {
+      size: number | null;
+    };
+  };
+  'bg.start': {
+    params: {
+      handle: MachineHandleRef;
+      command: string;
+      cwd?: string;
+      env?: Record<string, string>;
+      maxOutputBytes?: number;
+    };
+    result: MachineTaskHandle;
+  };
+  'bg.list': {
+    params: {
+      handle: MachineHandleRef;
+    };
+    result: {
+      tasks: JsonValue[];
+    };
+  };
+  'bg.kill': {
+    params: {
+      handle: MachineHandleRef;
+      taskId: string;
+    };
+    result: {
+      exit: JsonValue | null;
+    };
+  };
+  'bg.wait': {
+    params: {
+      handle: MachineHandleRef;
+      taskId: string;
+      timeoutMs?: number;
+    };
+    result: {
+      exit: JsonValue | null;
+    };
+  };
+  'terminal.open': {
+    params: {
+      handle: MachineHandleRef;
+      cols: number;
+      rows: number;
+      cwd?: string;
+    };
+    result: {
+      terminalId: string;
+    };
+  };
+  'terminal.attach': {
+    params: {
+      terminalId: string;
+    };
+    result: {
+      attached: boolean;
+      backlog: string;
+      total: number;
+    };
+  };
+  'terminal.write': {
+    params: {
+      terminalId: string;
+      data: string;
+    };
+    result: {
+      ok: true;
+    };
+  };
+  'terminal.resize': {
+    params: {
+      terminalId: string;
+      cols: number;
+      rows: number;
+    };
+    result: {
+      ok: true;
+    };
+  };
+  'terminal.kill': {
+    params: {
+      terminalId: string;
+    };
+    result: {
+      ok: true;
+    };
+  };
+  'terminal.detach': {
+    params: {
+      terminalId: string;
+    };
+    result: {
+      ok: true;
+    };
+  };
+  'env.checkFolder': {
+    params: {
+      cwd: string;
+    };
+    result: {
+      cwd: string;
+    };
+  };
+  'env.prepareWorktree': {
+    params: {
+      cwd: string;
+      branch: string;
+      base?: string;
+      config: EnvironmentConfig;
+    };
+    result: {
+      cwd: string;
+      branch: string;
+      base: string;
+      ref: MachineWorktreeRef;
+    };
+  };
+  'env.teardownWorktree': {
+    params: {
+      ref: MachineWorktreeRef;
+      branch?: string;
+      config: EnvironmentConfig;
+    };
+    result: {
+      removed: boolean;
+      reason?: string;
+    };
+  };
+}
+type MachineMethodName = keyof MachineMethods;
+type MachineParams<M extends MachineMethodName> = MachineMethods[M]['params'];
+type MachineResult<M extends MachineMethodName> = MachineMethods[M]['result'];
+/** Error codes of the machine protocol (JSON-RPC server-error range, apart from `IpcErrorCode`). */
+declare const MachineErrorCode: {
+  /** A machine connection called a client method, or a client a machine one. */
+  readonly MethodNotAllowed: -32040;
+  /** `machine.register` from another major `MACHINE_PROTOCOL_VERSION`. */
+  readonly VersionSkew: -32041;
+  /** The name is held by another machine on this host. */
+  readonly NameTaken: -32042;
+  /** A path or cwd outside the machine's roots, or in its data dir. */
+  readonly OutsideRoots: -32043;
+  /** The machine id is bound to another (live) token, or this token was used by the machine before the host forgot it. */
+  readonly IdBound: -32044;
+  /** No room now (a capacity limit): try again later, unlike a refusal. */
+  readonly Busy: -32045;
+};
+/** A machine as clients see it (`machines.list`, `environments.list`). */
+interface MachineInfo {
+  id: string;
+  name: string;
+  roots: MachineRoot[];
+  status: 'online' | 'offline';
+  lastSeen?: number;
+  version?: string;
+  /** What it registered with (absent: never connected since this host recorded it). */
+  capabilities?: Partial<MachineCapabilities>;
+}
+/** `machine:status` payload. */
+interface MachineStatusChange {
+  machineId: string;
+  name: string;
+  status: 'online' | 'offline';
+}
+/**
+ * What a local host's machine links are doing (`machines.links.status`,
+ * `machine:links`): this computer shared with a saved server (it is the
+ * machine), and saved servers used as machines (`local@<server>`, the
+ * reverse direction over this host's own client connection).
+ */
+type MachineLinkState = 'connecting' | 'connected' | 'reconnecting' | 'offline' | 'auth-refused' | 'identity' | 'refused';
+interface MachineShareStatus {
+  /** The saved server's host id. */
+  hostId: string;
+  /** This computer's name there (`local@<name>`). */
+  name: string;
+  roots: string[];
+  state: MachineLinkState;
+  /** Why it is not connected. Never a token. */
+  detail?: string;
+}
+interface MachineUseStatus {
+  hostId: string;
+  state: MachineLinkState;
+  detail?: string;
+  /** The server's machine name on this host, once attached. */
+  machineName?: string;
+}
+interface MachineLinksStatus {
+  shares: MachineShareStatus[];
+  uses: MachineUseStatus[];
+}
+/** A machine name from a free-form one (a server's display name): the valid characters kept, the rest dashed. */
+declare function toMachineName(raw: string): string;
+/** A machine-qualified environment kind: `<base>@<machine name>`. */
+declare function machineKind(base: 'local' | 'worktree', name: string): string;
+/** `{ base, name }` of a machine-qualified kind, `null` for any other. */
+declare function parseMachineKind(kind: string): {
+  base: 'local' | 'worktree';
+  name: string;
+} | null;
+/** A machine name: one path-safe segment, so `local@<name>` is unambiguous. */
+declare function isValidMachineName(name: string): boolean;
+//#endregion
+//#region src/chat/terminal/protocol.d.ts
+/**
+ * Terminals: the contract between the host that runs them (the daemon) and
+ * the clients that show them (the GUI's drawer and panel tab). Pure types
+ * and limits, safe for a renderer bundle.
+ *
+ * Output travels as text with a running character offset: a client knows
+ * where each chunk starts, drops what it already has, and acknowledges what
+ * it wrote. The host stops sending to clients that fall a window behind and
+ * later resets them from history instead of queueing without end.
+ */
+/** Who started it: the user, or the agent (a background `shell` task). */
+type TerminalOwner = 'user' | 'agent';
+/** Where it runs: the session's environment, or this machine in the project. */
+type TerminalTarget = 'session' | 'local';
+/**
+ * `paused`: not connected right now (the sandbox paused, or the host
+ * restarted) but it can be found again; opening it reconnects.
+ */
+type TerminalStatus = 'starting' | 'running' | 'paused' | 'exited' | 'error';
+interface TerminalInfo {
+  id: string;
+  sessionId: string;
+  /** Stable name ("Terminal 2", or the agent's command). */
+  label: string;
+  /** Title the program set (OSC 0/2), if any. */
+  title?: string;
+  /** The program in the foreground, for terminals on this machine. */
+  program?: string;
+  owner: TerminalOwner;
+  target: TerminalTarget;
+  /** Environment kind it runs in (`local`, `worktree`, `docker`, `e2b`, …). */
+  environment: string;
+  cwd: string;
+  status: TerminalStatus;
+  exitCode?: number;
+  error?: string;
+  cols: number;
+  rows: number;
+  /**
+   * Bumped on every size change: signals and attach replies reach a view by
+   * different routes, so it keeps the newest size, not the last to arrive.
+   */
+  sizeSeq: number;
+  /** The agent's terminal tools skip it. */
+  hiddenFromAgent: boolean;
+  /** The background task it runs (agent terminals). */
+  taskId?: string;
+  createdAt: number;
+  lastActivityAt: number;
+}
+interface TerminalSessionState {
+  /** False when this host can't run terminals (the GUI without the daemon). */
+  available: boolean;
+  /** Why not, when `available` is false. */
+  reason?: string;
+  /** Kind of the session's environment, and whether it runs somewhere else. */
+  environment: {
+    kind: string;
+    remote: boolean;
+  };
+  terminals: TerminalInfo[];
+}
+interface TerminalOpenInput {
+  sessionId: string;
+  target?: TerminalTarget;
+  cols: number;
+  rows: number;
+}
+/** What a client needs to start showing a terminal: its history, and where live output resumes. */
+interface TerminalAttachResult {
+  terminal: TerminalInfo;
+  data: string;
+  offset: number;
+}
+/** The agent's view: plain text lines, with a cursor for the next read. */
+interface TerminalReadResult {
+  terminal: TerminalInfo;
+  text: string;
+  /** Pass as `since` to get only newer lines. */
+  next: number;
+  /** Lines dropped from the front because of the size cap. */
+  truncated: number;
+}
+/** Characters a client may be behind before the host stops sending to it. */
+declare const TERMINAL_OUTPUT_WINDOW: number;
+/** History kept per terminal for new views (characters). */
+declare const TERMINAL_HISTORY_MAX_CHARS: number;
+/** Plain-text lines kept per terminal for the agent. */
+declare const TERMINAL_TEXT_MAX_LINES = 5000;
+/** Most the agent gets from one read (characters). */
+declare const TERMINAL_READ_MAX_CHARS: number;
+/** Terminals a session may have open at once. */
+declare const TERMINAL_MAX_PER_SESSION = 12;
+declare class TerminalError extends Error {
+  readonly code: 'unavailable' | 'not_found' | 'limit' | 'not_running' | 'failed';
+  constructor(code: 'unavailable' | 'not_found' | 'limit' | 'not_running' | 'failed', message: string);
+}
+//#endregion
+//#region src/chat/todo-glyphs.d.ts
+declare const TODO_STATUS_GLYPHS: Readonly<Record<TodoStatus, string>>;
+//#endregion
+//#region src/chat/todos.d.ts
+/** Todos live in session metadata and are memory-only here: any session, store-less snapshots included. */
+type Session = Omit<Session$1, 'save'>;
+declare const TODOWRITE_TOOL = "todowrite";
+declare const TODOREAD_TOOL = "todoread";
+/** True when `name` is one of the todo tool canonical names. */
+declare function isTodoTool(name: string): boolean;
+/** `session.metadata[TODOS_METADATA_KEY]: TodosBag` — see {@link TodosBag}. */
+declare const TODOS_METADATA_KEY = "todos";
+/** `session.metadata[TODO_WRITE_COUNTS_METADATA_KEY]: CountsBag` — mirrors `TodosBag` shape. */
+declare const TODO_WRITE_COUNTS_METADATA_KEY = "todoWriteCounts";
+type TodoStatus = 'pending' | 'in_progress' | 'completed' | 'cancelled';
+interface TodoItem {
+  /** Stable id — the model picks it. Reusing an id replaces that item. */
+  id: string;
+  /** One-line task summary (Markdown allowed; renderers may sanitize). */
+  content: string;
+  status: TodoStatus;
+}
+/**
+ * On-disk shape at `session.metadata[TODOS_METADATA_KEY]`.
+ *
+ * Sub-fields are absent (not empty) when they carry no data — keeps the
+ * persisted metadata clean and lets `JSON.stringify` skip empty bags
+ * entirely on session save.
+ */
+interface TodosBag {
+  /** Top-level slot — shared across runs whose `parentRunId` is unset. */
+  session?: TodoItem[];
+  /** Per-subagent-run slots, keyed by the child run's id. */
+  byRun?: Record<string, TodoItem[]>;
+  /**
+   * Most-recent non-empty list per slot — sidecar for UI surfaces, NOT
+   * visible to `todoread`. Updated on every non-empty write; **preserved**
+   * across the auto-clear path. Lets the modal keep showing "what was just
+   * completed" after a fully-done batch wipes the live slot. Empty writes
+   * never touch the archive — clearing the live list shouldn't erase the
+   * audit trail.
+   */
+  archive?: {
+    session?: TodoItem[];
+    byRun?: Record<string, TodoItem[]>;
+  };
+}
+/**
+ * Default ceiling on a single todo list. Exported so every write boundary caps
+ * identically — a boundary with a different cap would let a list through that
+ * the tool would have truncated.
+ */
+declare const DEFAULT_MAX_TODO_ITEMS = 100;
+interface CreateTodoToolsOptions {
+  /**
+   * Maximum item count per `todowrite`. Excess items are truncated by the
+   * recursive validator and reported back to the model in the tool_result.
+   *
+   * Default: `100`. The default is generous; a planning agent that exceeds
+   * 100 items per call is usually flailing.
+   */
+  maxItems?: number;
+  /**
+   * Per-run cap on `todowrite` calls, plumbed into `behavior.toolBudgets`.
+   * `onMaxWrites` chooses the reaction (steer / block) — see
+   * {@link AgentBehavior.toolBudgets} for the contract.
+   *
+   * **Default: `0` (no cap).** `todowrite` is a state-transition tool —
+   * a legitimate run of an N-item list needs at least `N + 1` calls
+   * (initial plan + one transition per item) to complete, so a hard
+   * cap punishes the legitimate path. The nudges that DO apply are the
+   * `remindAfter` reminder (soft, in-band) and the identical-payload
+   * dedup check (silent, structural). Hosts that want a true hard cap
+   * can opt in by setting `maxWritesPerRun: N`.
+   *
+   * **Counting semantics** (when opted in): the budget counts every
+   * dispatched call, including dedup substitutes (zidane spec). The
+   * {@link remindAfter} counter counts execute-only dispatches —
+   * dedup hits replay the prior result and never reach the tool body.
+   * Use this budget (not the reminder) as the hard limit.
+   */
+  maxWritesPerRun?: number;
+  onMaxWrites?: 'steer' | 'block';
+  /**
+   * Hard stop for **consecutive identical** `todowrite` payloads — the
+   * exact loop the in-body `dedupIdentical` check only *whispers* about
+   * ("No change — N items already tracked"). Plumbs a run-scoped
+   * `behavior.dedupTools.todowrite` entry in `block-after` mode: the
+   * gate replays the unchanged result for the first `N - 1` identical
+   * calls, then refuses the `N`th (and every subsequent identical one)
+   * with a `Blocked: …` tool_result so the model breaks out instead of
+   * re-checkpointing forever.
+   *
+   * This is safe to leave on by default — unlike {@link maxWritesPerRun}
+   * it only ever blocks a payload byte-identical to the one already
+   * tracked, so a legitimate "finish the N-item plan" run (which writes
+   * a *different* list each transition) is never touched. The counter
+   * resets the moment the model writes anything different.
+   *
+   * Run-scoped via `DedupToolConfig.scope: 'run'`, so a parent and a
+   * subagent writing the same list never share the counter — the precise
+   * conflation that kept `todowrite` off `behavior.dedupTools` before.
+   *
+   * Set to `0` to opt out (e.g. a host that installs its own loop
+   * hardening). Default: `5`. Values `< 2` are clamped to `2` by the
+   * dedup middleware (a threshold of 1 would block the first call).
+   */
+  maxIdenticalWrites?: number;
+  /**
+   * Custom refusal text for the {@link maxIdenticalWrites} block. Receives
+   * the 1-indexed identical-call count (including the blocked call). Leave
+   * unset for the built-in "you've written the same list N times in a
+   * row" message.
+   */
+  identicalBlockReason?: (count: number) => string;
+  /**
+   * Append a "you've checkpointed N times — only call this at significant
+   * task transitions" nudge to the tool_result once `todowrite` has fired
+   * this many times in the current run. The nudge rides on the result
+   * string, so the model sees it on its next turn without `system:transform`
+   * plumbing.
+   *
+   * Counts only executed dispatches (dedup hits skip the tool body and so
+   * skip the increment). For a hard cap that also covers dedup hits, use
+   * {@link maxWritesPerRun}.
+   *
+   * Set to `0` to opt out. Default: `3`.
+   */
+  remindAfter?: number;
+  /**
+   * Custom reminder text. Receives the post-call count and the items that
+   * were just written. Return `''` (or `undefined`) to suppress the reminder
+   * for this specific call. Default text nudges towards "back to executing,
+   * not re-planning."
+   */
+  reminderText?: (count: number, items: readonly TodoItem[]) => string | undefined;
+  /**
+   * Short-circuit the tool body when the incoming payload is identical to
+   * the **current slot** (session-shared for top-level runs, per-run for
+   * subagents). The model gets a "No change — N items already tracked."
+   * acknowledgment instead of a fresh "Updated N items." line.
+   * Default: `true`.
+   *
+   * Read `session.metadata.todos` via {@link getTodosForRun} for the
+   * comparison — so the resolution naturally follows the keying rule
+   * (top-level reads the session slot, subagent reads its own). Does
+   * NOT plumb through `behavior.dedupTools`: that cache lives at the
+   * gate, is keyed per session, and would conflate top-level + subagent
+   * re-writes of structurally identical payloads.
+   *
+   * Counter advances on identical re-writes regardless — the model
+   * called the tool, that's a call. Lets the reminder threshold catch
+   * spam. Set `false` to skip the check entirely (every call rewrites
+   * the slot, useful when state-shape comparisons are pointless for
+   * your usage).
+   */
+  dedupIdentical?: boolean;
+  /**
+   * Override the JSON-schema-level descriptions surfaced to the model.
+   * Useful for telemetry experiments. Leave unset to inherit the built-in
+   * doctrine prose.
+   */
+  writeDescription?: string;
+  readDescription?: string;
+}
+/**
+ * Read the active list for `runId`. Top-level runs see the session-shared
+ * slot; subagent runs see their own. Returns a fresh `[]` (not stored in
+ * metadata) when no slot exists — the caller can mutate the result
+ * without affecting state.
+ */
+declare function getTodosForRun(session: Session, runId: string): TodoItem[];
+/**
+ * Replace the active list for `runId`. Routes to the session-shared slot
+ * for top-level runs and to the per-run slot for subagents. Empty arrays
+ * delete the slot entirely so persisted metadata stays clean.
+ *
+ * Side effect: a **non-empty** write also stashes the same list into
+ * `bag.archive` (same routing). Empty writes never touch the archive —
+ * clearing the live list (whether explicitly or via the tool's auto-
+ * clear) preserves the "last shown" snapshot so UI surfaces can keep
+ * rendering what was just completed. See {@link getArchivedTodosForRun}.
+ *
+ * `opts.clearArchive` opts OUT of that preservation, and exists because the
+ * archive is only the right answer for the AUTO-CLEAR path. UI surfaces render
+ * `todos.length > 0 ? todos : archive`, so a user who deletes every todo would
+ * otherwise watch the archive fall straight back into view with the same items
+ * — a destructive action they confirmed, with no visible effect, and the footer
+ * chip still counting the list they just deleted. Pass it for user-initiated
+ * writes; leave it off for the tool.
+ */
+declare function setTodosForRun(session: Session, runId: string, items: readonly TodoItem[], opts?: {
+  clearArchive?: boolean;
+}): void;
+/**
+ * Read the archived (most-recent non-empty) list for `runId`. Same slot
+ * routing as {@link getTodosForRun}, but reads `bag.archive` instead of
+ * the live slot. Returns a fresh `[]` when no archive exists.
+ *
+ * UI surfaces use this to keep showing "what was just completed" after
+ * the live list auto-clears. The model never sees the archive — it's a
+ * read-only sidecar for human-facing rendering.
+ */
+declare function getArchivedTodosForRun(session: Session, runId: string): TodoItem[];
+/**
+ * Reconcile `session.metadata.todos.byRun` (live + archive) against
+ * `session.runs`. Drops subagent slots whose runId isn't in the run
+ * list. The top-level `session` slot is unaffected — it's session-
+ * scoped, not per-run, so there's no orphan to GC.
+ *
+ * Useful after `session.setRuns()` (fork / restore) or to GC stale
+ * metadata mutated by an external caller. Also prunes the parallel
+ * counter bag so the two don't drift.
+ *
+ * `dropped` reports the live-byRun orphans only (archive-only orphans
+ * are silently swept). The live half is the contract callers actually
+ * observe.
+ */
+declare function pruneTodosByRun(session: Session): {
+  dropped: readonly string[];
+};
+/**
+ * Build a `Preset` carrying the `{ todowrite, todoread }` tool pair.
+ *
+ * Loop hardening is layered, soft → hard:
+ *   1. **In-body identical dedup** (`dedupIdentical`, on) — resolves
+ *      against the active slot (session-shared for top-level runs,
+ *      per-run for subagents) and returns "No change — N items already
+ *      tracked." Advisory; the model can ignore it.
+ *   2. **In-band reminder** (`remindAfter`, on) — appends a "you've
+ *      checkpointed N times" nudge to the result. Also advisory.
+ *   3. **Consecutive-identical hard block** (`maxIdenticalWrites`, ON by
+ *      default) — a run-scoped `behavior.dedupTools.todowrite` entry in
+ *      `block-after` mode. After N byte-identical writes in a row the
+ *      gate refuses with `Blocked: …` and the body never runs. This is
+ *      the real loop breaker, and it's safe-by-default precisely because
+ *      it only fires on *identical* payloads — a legitimate N-item plan
+ *      writes a *different* list each step and never trips it.
+ *
+ * By default the preset adds **no** `toolBudgets` entry — a blanket
+ * per-call cap is the wrong abstraction for a state-transition tool (it
+ * punishes the legitimate "finish the N-item plan" path). Hosts that
+ * want a ceiling on *all* writes (not just identical ones) pass
+ * `maxWritesPerRun: N` explicitly; the factory then also plumbs a
+ * `behavior.toolBudgets.todowrite` entry.
+ *
+ * Returning a `Preset` (not a bare tool map) lets the result flow
+ * through {@link composePresets} unchanged. `behavior.dedupTools` and
+ * `behavior.toolBudgets` are tool-name-keyed records that
+ * `composePresets` deep-merges, so a caller's entries for other tools
+ * survive the layering, and a caller's override for `todowrite` itself
+ * wins by being placed later in the chain.
+ *
+ * ```ts
+ * import { basic, composePresets } from 'zidane/presets'
+ * import { createTodoTools } from 'zidane/chat'
+ *
+ * // Default: soft dedup + reminder + a run-scoped hard block after 5
+ * // identical writes in a row.
+ * createAgent({ ...composePresets(basic, createTodoTools()), provider })
+ *
+ * // Tune (or disable) the identical-write block.
+ * createTodoTools({ maxIdenticalWrites: 3 })  // stricter
+ * createTodoTools({ maxIdenticalWrites: 0 })  // off — soft signals only
+ *
+ * // Opt-in blanket cap on *all* writes (counts distinct ones too).
+ * createAgent({
+ *   ...composePresets(basic, createTodoTools({ maxWritesPerRun: 20 })),
+ *   provider,
+ * })
+ * ```
+ *
+ * For the trivial "just add the tools to an existing config" case, plain
+ * spread is also fine — the returned `Preset` sets `tools` plus a
+ * `behavior` block (carrying the default identical-write dedup):
+ *
+ * ```ts
+ * createAgent({ ...basic, ...createTodoTools(), provider })
+ * ```
+ */
+declare function createTodoTools(options?: CreateTodoToolsOptions): Preset;
+/**
+ * Validate an untrusted todo list, dropping malformed rows and capping length.
+ *
+ * The single validator for every write/read boundary: model tool input,
+ * persisted metadata on read, and user edits arriving over IPC. Keeping them on
+ * one implementation is what makes "well-formed" mean the same thing at each —
+ * a boundary that only picked fields (as `normalizeItem` does) would admit an
+ * invalid `status` that the read path then silently drops, so the write appears
+ * to succeed and the row vanishes with nothing reported.
+ */
+declare function sanitizeTodoItems(raw: readonly unknown[], cap?: number): TodoItem[];
+interface TodoTally {
+  pending: number;
+  in_progress: number;
+  completed: number;
+  cancelled: number;
+}
+interface ActiveTodosState {
+  /** Run the slice came from. `null` ⇒ no session / no runs / no active run. */
+  runId: string | null;
+  /**
+   * Live list — what `todoread` would return. Empty when the slot was
+   * cleared (e.g. auto-clear after every item completed) or never
+   * written. Source of truth for the model's view.
+   */
+  todos: readonly TodoItem[];
+  /**
+   * Most-recent non-empty list for the active slot, preserved across
+   * auto-clear. Equals `todos` when the live list is non-empty;
+   * otherwise the last batch that was shown (commonly the all-`completed`
+   * close-out). UI surfaces fall back to this when `todos` is empty so
+   * the user can still glance back at "what was just finished" — until
+   * the model writes a new list. Empty array when no list was ever
+   * written for this slot.
+   */
+  archive: readonly TodoItem[];
+  /**
+   * The first `in_progress` item from `todos` (the **live** list), when
+   * one exists. Drives the inline indicator above the prompt. Always
+   * `null` when the live list is empty — even if the archive carries
+   * an in-progress item, that item is by definition stale.
+   */
+  inProgress: TodoItem | null;
+  /**
+   * Per-status counts. Computed over `todos` when non-empty, else over
+   * `archive`. Zeros only when both are empty. Lets the modal header
+   * show a meaningful tally for the archived "last batch" view.
+   */
+  tally: TodoTally;
+}
+/**
+ * Pick the "active" run for UI surfaces that show one slot at a time
+ * (todos indicator, todos modal, footer ctx indicator). The resolved
+ * runId then routes through {@link getTodosForRun} — top-level runs
+ * land on the session-shared slot, subagent runs on their own.
+ *
+ * - A currently-running run wins (latest-started one if several).
+ * - Otherwise the most recently appended run wins.
+ * - `null` when the session has no runs.
+ *
+ * Mirrors the "most recent thing that mattered" policy that drives
+ * `lastContextSizeFromTurns` — but walks `session.runs` rather than
+ * `session.turns` because the active todo slot is a function of the
+ * run, not of message history.
+ */
+declare function pickActiveRunId(session: Session | null | undefined): string | null;
+/**
+ * Pure selector — derive the active-todos state from a session snapshot.
+ * Used by {@link useActiveTodos} and directly testable without React.
+ *
+ * Resolves both `todos` (live, model-facing) and `archive` (last
+ * non-empty snapshot for UI fallback). The tally folds over whichever
+ * list is non-empty; `inProgress` is sourced strictly from `todos`
+ * because an archived in-progress item is by definition stale.
+ */
+declare function selectActiveTodos(session: Session | null | undefined): ActiveTodosState;
+/**
+ * React hook — active-todos state for the supplied session. Recomputes
+ * on every parent re-render; the work is O(runs + todos), both bounded
+ * by small constants in practice.
+ *
+ * Why no memoization: `Session.runs` is mutated in place by `completeRun`
+ * / `abortRun` (status flips without changing array length or item
+ * identity), so any memo keyed off length / bag identity would silently
+ * return stale state when e.g. a child subagent run completes and the
+ * "active" run should reflow to the parent. The selector is cheap
+ * enough that running it every parent render is the simpler, correct
+ * answer — see `selectActiveTodos` for the O(n) cost.
+ *
+ * The hook lives in `chat/` so a GUI consumer can mount it verbatim.
+ * Renderer-agnostic — no `@opentui/*` imports.
+ */
+declare function useActiveTodos(session: Session | null | undefined): ActiveTodosState;
+//#endregion
+//#region src/chat/hosts/types.d.ts
+/**
+ * The client's host registry, as data: the hosts a window can connect to
+ * besides its own (zidane-servers on other machines). Node-free, re-exported
+ * from `zidane/chat/pure` for the GUI renderer.
+ */
+/** One saved host. Tokens are not here: see `hostCredentialKey`. */
+interface HostEntry {
+  /** The server's `hostId` (`ipc.hello`): `add` verifies the host before saving it. */
+  id: string;
+  /** Display name: the one given at `add` or `rename`, else the server's. */
+  name: string;
+  /** `wss://…`, or `ws://` to loopback. */
+  url: string;
+  /** Epoch ms. */
+  addedAt: number;
+  /** Epoch ms of the last successful `add` / `test`. */
+  lastConnectedAt?: number;
+  hostKind?: 'server';
+  /** The server's own name (`hostName`) at the last successful connect. */
+  serverName?: string;
+  /** The server's zidane version at the last successful connect. */
+  serverVersion?: string;
+}
+/**
+ * Why a host could not be added or tested:
+ * - `invalid-url`: not `wss://`, or `ws://` off loopback; nothing was dialed.
+ * - `invalid-token`: empty.
+ * - `invalid-name`: an empty name.
+ * - `auth`: the server refused the token (401) or the connection (403).
+ * - `unreachable`: nothing answered (refused, DNS, timeout, closed).
+ * - `tls`: the TLS handshake failed (certificate).
+ * - `protocol`: something answered but not a zidane-server this client can
+ *   talk to (protocol version, no host identity, not a server).
+ * - `identity`: a different host answers at the saved URL.
+ * - `unknown-host`: no saved host has this id.
+ */
+type HostErrorCode = 'invalid-url' | 'invalid-token' | 'invalid-name' | 'auth' | 'unreachable' | 'tls' | 'protocol' | 'identity' | 'unknown-host';
+/** The identity a host reports (`hostRefOf(hello)`). */
+interface HostIdentity {
+  id: string;
+  kind: 'in-process' | 'daemon' | 'server';
+  name: string;
+}
+type HostProbeResult = {
+  ok: true;
+  hostRef: HostIdentity;
+  serverVersion?: string;
+  latencyMs: number;
+} | {
+  ok: false;
+  error: HostErrorCode;
+  message: string;
+};
+/** `test(id)`: the probe's answer, checked against the saved entry. */
+type HostTestResult = HostProbeResult;
+/** Connects to `url` with `token`, says who answered (or why it failed), disconnects. Never throws. */
+type HostProbe = (target: {
+  url: string;
+  token: string;
+}) => Promise<HostProbeResult>;
+/** A refused `add` / `rename`; `code` says why. */
+declare class HostRegistryError extends Error {
+  readonly code: HostErrorCode;
+  constructor(code: HostErrorCode, message: string);
+}
+//#endregion
+//#region src/chat/hosts/url.d.ts
+declare class RemoteHostError extends Error {
+  constructor(message: string);
+}
+/** Scheme, host, port and path of a URL (token-looking path segments redacted): what is safe to show or log. */
+declare function displayHostUrl(raw: string): string;
+/** Validate and normalize a host URL (no trailing slash); throws {@link RemoteHostError}. */
+declare function parseRemoteHostUrl(raw: string): string;
+//#endregion
+//#region src/chat/markdown-segments.d.ts
+/**
+ * One block returned by {@link splitMarkdownCodeBlocks}. Prose segments
+ * carry their original markdown (including blank lines that bracketed
+ * the fence) so the surrounding paragraph spacing stays faithful to the
+ * original input. Code segments carry the raw body — fence markers and
+ * info-string stripped — so a "copy code" action lands what the user
+ * actually sees, byte-for-byte.
+ */
+interface MarkdownSegment {
+  kind: 'prose' | 'code';
+  content: string;
+  /** Info-string (e.g. `ts`, `python`). Empty when the fence had none. */
+  lang?: string;
+  /**
+   * `true` on a code segment whose closing fence hasn't arrived yet —
+   * i.e. the trailing block during streaming. Consumers can render this
+   * in "streaming" mode (no copy affordance, partial-highlight pipeline)
+   * until the closer lands and it flips to a regular closed segment.
+   */
+  open?: boolean;
+}
+/**
+ * Split markdown text into alternating prose / fenced-code segments.
+ *
+ * Recognizes both ` ``` ` and `~~~` fences, with arbitrary length ≥ 3,
+ * matching CommonMark's "fence indicator must be at least as long to
+ * close" rule. Info-strings (the bit after the opening fence) are kept
+ * as the `lang` hint; any trailing whitespace is trimmed. Closing
+ * fences are detected on a line of their own (whitespace tolerated).
+ *
+ * Unclosed fences fall back to emitting the would-be-code body as a
+ * trailing prose segment so no content is dropped — finalized markdown
+ * isn't expected to ship one, but the fallback keeps the renderer
+ * truthful when the model produces malformed output.
+ *
+ * Exported for unit tests.
+ */
+declare function splitMarkdownCodeBlocks(text: string): MarkdownSegment[];
+/**
+ * Lift indented fenced code blocks to column 0 while preserving the code
+ * body's relative indentation.
+ *
+ * OpenTUI's markdown renderNode hook only receives top-level code tokens.
+ * A common assistant shape is:
+ *
+ *   - Run this:
+ *     ```bash
+ *     command
+ *     ```
+ *
+ * Marked parses that as code inside a list token, so the TUI loses the
+ * code-panel wrapper and copy affordance. Normalizing just the fence's list
+ * indentation keeps the prose readable while routing the snippet through
+ * the same top-level renderer as ordinary fences.
+ */
+declare function normalizeMarkdownCodeFences(text: string): string;
+/**
+ * Default per-chunk target for {@link chunkMarkdownForRender}. Chosen from
+ * measurement: marked's lexer (which OpenTUI's `<markdown>` runs
+ * internally) is O(n²) over paragraph-heavy input — ~500ms at 64KiB,
+ * ~2s at 128KiB, ~6s at 256KiB on an M-series laptop — while staying
+ * comfortably in the linear zone below ~32KiB (≤ ~200ms). Chunking a
+ * large document into ≤24KiB pieces keeps the total render linear in
+ * document size with a small constant.
+ */
+declare const MARKDOWN_RENDER_CHUNK_TARGET_BYTES = 24576;
+/**
+ * Split a large markdown document into render-safe chunks at blank-line
+ * boundaries outside code fences, each roughly `targetBytes` long.
+ *
+ * Rendering the chunks as SIBLING markdown renderables (with a one-row
+ * gap standing in for the consumed blank line) is visually equivalent to
+ * one renderable, but sidesteps the quadratic lexer cost documented on
+ * {@link MARKDOWN_RENDER_CHUNK_TARGET_BYTES}. Chunk boundaries are
+ * prefix-stable: appending text (streaming) can only ever change the
+ * LAST chunk, so keyed-by-index consumers reconcile cheaply.
+ *
+ * Returns `[text]` untouched for anything at or under the target.
+ */
+declare function chunkMarkdownForRender(text: string, targetBytes?: number): string[];
+//#endregion
+//#region src/chat/mcp-allowlist.d.ts
+/**
+ * Edits to the `enabledMcps` allowlist. Without an explicit list every
+ * server is on, so there is nothing to change. Servers that merely appear
+ * in a config file stay off once a list exists (they don't opt in
+ * silently); a server the user adds in Settings is turned on with it.
+ */
+/** The list with `name` turned on, or `undefined` when it already is. */
+declare function enabledMcpsWith(list: readonly string[] | undefined, name: string): string[] | undefined;
+/** The list without `name`, or `undefined` when it isn't listed. */
+declare function enabledMcpsWithout(list: readonly string[] | undefined, name: string): string[] | undefined;
+//#endregion
+//#region src/chat/mcp-auth-state.d.ts
+/**
+ * Per-server MCP OAuth status tracking, decoupled from the renderer.
+ *
+ * The TUI keeps a `Record<serverName, McpAuthStatus>` so it can render a
+ * "needs-auth" / "authorizing" / "error" badge in the MCP picker. The
+ * status map is driven entirely by hooks fired from the agent's MCP
+ * bootstrap + the interactive `loginMcpServer` flow — the reducer below
+ * is pure, makes no FS or network calls, and is shared between the live
+ * TUI store and the test harness.
+ *
+ * Status lifecycle:
+ *
+ *   idle ──mcp:connect──▶  authed
+ *                         (bootstrap succeeded with stored tokens)
+ *
+ *   idle ──mcp:auth:required──▶ needs-auth
+ *                              (bootstrap saw no/invalid tokens)
+ *
+ *   idle ──401/403, no key of its own──▶ needs-auth (reason 'refused')
+ *   idle ──401/403 on its own header key──▶ key-refused
+ *                              (see `classifyMcpTest`)
+ *
+ *   needs-auth ──login()──▶ authorizing ──mcp:auth:url──▶ authorizing(url)
+ *                                       ──mcp:auth:success──▶ authed
+ *                                       ──mcp:auth:error──▶ error
+ *
+ *   any         ──logout──▶ idle
+ *
+ * Multiple servers progress through the lifecycle independently; the map
+ * is keyed by `McpServerConfig.name`.
+ */
+type McpAuthStatus = {
+  kind: 'idle';
+} | {
+  kind: 'needs-auth';
+  reason: McpNeedsAuthReason;
+} | {
+  kind: 'authorizing';
+  url?: string;
+} | {
+  kind: 'authed';
+} | {
+  kind: 'error';
+  error: string;
+} | {
+  kind: 'bootstrap-error';
+  error: string;
+} | {
+  kind: 'key-refused';
+  error: string;
+};
+type McpNeedsAuthReason = 'no-tokens' | 'auto-promoted' | 'refused';
+/**
+ * The status words both apps show for a server, so the desktop app's badge
+ * and the TUI's read the same. `idle` says nothing.
+ */
+declare const MCP_STATUS_LABEL: Readonly<Record<Exclude<McpAuthStatus['kind'], 'idle'>, string>>;
+/**
+ * Map of server name → status. `idle` is the implicit default for any
+ * server NOT present in the map, so the renderer treats `undefined` as
+ * `{ kind: 'idle' }` and the map can stay sparse.
+ */
+type McpAuthStateMap = Readonly<Record<string, McpAuthStatus>>;
+/**
+ * Events the reducer accepts. Names mirror the agent hooks 1:1 plus two
+ * UI-only verbs (`login:start` / `login:cancel`) so the renderer can
+ * optimistically flip a row to `authorizing` before the SDK has emitted
+ * `mcp:auth:url` — useful when the loopback callback is slow to bind.
+ */
+type McpAuthEvent = {
+  type: 'auth-required';
+  name: string;
+  reason: McpNeedsAuthReason;
+} | {
+  type: 'auth-url';
+  name: string;
+  url: string;
+} | {
+  type: 'auth-success';
+  name: string;
+} | {
+  type: 'auth-error';
+  name: string;
+  error: string;
+} | {
+  type: 'bootstrap-error';
+  name: string;
+  error: string;
+} | {
+  type: 'key-refused';
+  name: string;
+  error: string;
+} | {
+  type: 'connected';
+  name: string;
+} | {
+  type: 'login:start';
+  name: string;
+} | {
+  type: 'login:cancel';
+  name: string;
+} | {
+  type: 'logout';
+  name: string;
+} | {
+  type: 'reset';
+  name: string;
+};
+/**
+ * Apply one event to the state map. Pure, immutable — returns a new map
+ * with only the affected key reassigned.
+ *
+ * State transitions are simple "last write wins"; we don't gate (e.g.) a
+ * `login:start` from overriding `authorizing` because the loop layer
+ * never doubles those up — interactive login is serialized in the TUI.
+ */
+declare function reduceMcpAuth(state: McpAuthStateMap, event: McpAuthEvent): McpAuthStateMap;
+/**
+ * The status a failed connection leaves, from `classifyMcpTest`'s answer
+ * (never called with `ok`: a connection that worked leaves no failure).
+ * A server that asked for OAuth keeps "sign-in failed" for an unexplained
+ * failure (its tokens are the likely cause, and sign-in stays offered).
+ */
+declare function mcpFailureEvent(name: string, outcome: {
+  kind: 'ok' | 'needs-auth' | 'token-rejected' | 'error';
+  message?: string;
+}, oauthTagged: boolean): McpAuthEvent;
+/** Convenience getter — treats `undefined` as `idle`. */
+declare function getMcpAuthStatus(state: McpAuthStateMap, name: string): McpAuthStatus;
+//#endregion
+//#region src/chat/mcp-test-outcome.d.ts
+type McpTestOutcomeKind = 'ok' | 'needs-auth' | 'token-rejected' | 'error';
+interface McpTestResult {
+  kind: McpTestOutcomeKind;
+  tools?: number;
+  message?: string;
+}
+/** What to do about a refused key, under the "Key refused" headline. */
+declare const MCP_KEY_REFUSED_HINT = "Check the headers in mcps.json.";
+/** A refusal for want of credentials: HTTP 401 / 403, however the SDK words it. */
+declare function isMcpAuthRefusal(error: unknown): boolean;
+/** The first line of a failure, never empty. */
+declare function mcpFailureLine(error: unknown): string;
+declare function classifyMcpTest(config: Pick<McpServerConfig, 'transport' | 'headers'>, result: {
+  authRequired: boolean;
+  error?: unknown;
+  tools?: number;
+}): McpTestResult;
+//#endregion
+//#region src/chat/model-catalog.d.ts
+/** A model entry as displayed in the cross-provider picker. */
+interface CatalogEntry {
+  providerKey: ProviderKey;
+  providerLabel: string;
+  model: ModelInfo;
+  /**
+   * The provider does not (or no longer) list this model: the entry was
+   * synthesized from an `include` pair, so `model` is a stub carrying the id
+   * and nothing else. Renderers should say so rather than print stub
+   * metadata as if it were real.
+   */
+  offCatalog?: boolean;
+  /**
+   * Pre-computed lowercase corpus for substring search across the
+   * provider key, label, model id, and display name. Built once at
+   * catalog-assembly time so filtering on every keystroke is
+   * O(catalogSize × queryLength), not O(catalogSize × fieldCount ×
+   * lowercase-overhead × queryLength).
+   */
+  searchCorpus: string;
+}
+/**
+ * Build the unified catalog from a list of available providers.
+ *
+ * Provider order is preserved (callers typically pass the picker order
+ * — alphabetical, auth-detection order, etc.); model order inside each
+ * provider matches whatever `modelsFor` returns. The current selection
+ * (when set) is bubbled to the top of its provider's section so it
+ * shows first without disturbing relative ordering elsewhere.
+ *
+ * `modelsFor` is injected (not imported from `./providers`) so the same
+ * helper works with hosts that supply their own model resolver via
+ * `ResolvedConfig.modelsFor`.
+ *
+ * `include` guarantees a pair is listed even when the provider stopped
+ * serving it. Persisted picks outlive catalogs (a provider retires an id, a
+ * user typed one by hand), and an entry that isn't in the list can't be
+ * selected away from, and the picker would keep re-persisting it. Synthesized
+ * entries carry `offCatalog: true` and a stub `ModelInfo`.
+ */
+declare function buildModelCatalog(opts: {
+  providers: readonly ProviderAuth[];
+  modelsFor: (key: ProviderKey) => readonly ModelInfo[];
+  /** Optional currently-selected pair — promoted to the top of its provider group. */
+  current?: {
+    providerKey: ProviderKey;
+    modelId: string;
+  } | null;
+  /** Pairs that must appear even if unserved, e.g. the active pick + fallback chain. */
+  include?: readonly {
+    providerKey: ProviderKey;
+    modelId: string;
+  }[];
+}): CatalogEntry[];
+/**
+ * Filter `catalog` by a user query. Empty / whitespace-only queries
+ * pass everything through unchanged (`O(1)` short-circuit). Multi-term
+ * queries (space-separated) require EVERY term to appear somewhere in
+ * the entry's search corpus — so `"claude opus"` matches `claude-opus-4`
+ * regardless of how the words are interleaved with provider names.
+ *
+ * Match is case-insensitive (the corpus is pre-lowercased; the query
+ * is lowercased once per call).
+ */
+declare function filterModelCatalog(catalog: readonly CatalogEntry[], query: string): CatalogEntry[];
+/**
+ * Find a catalog entry's index by its `{providerKey, modelId}` tuple.
+ * Returns `-1` when not present. Useful when re-rendering the picker
+ * (a query just narrowed the list, where did the selection land?).
+ */
+declare function indexOfEntry(catalog: readonly CatalogEntry[], target: {
+  providerKey: ProviderKey;
+  modelId: string;
+} | null | undefined): number;
+/**
+ * Read a query that matched nothing as "use this model id anyway".
+ *
+ * A bare id is meaningless without a provider, so the first term is checked
+ * against every provider's key and label (case-insensitive): `xai grok-9` and
+ * `Anthropic claude-next` name their provider explicitly, anything else is
+ * attributed to `fallbackProviderKey` (the picker's current pick). Returns
+ * `null` when nothing usable is left, including when the whole query is just a
+ * provider name.
+ */
+declare function parseCustomModelQuery(query: string, providers: readonly Pick<ProviderAuth, 'key' | 'label'>[], fallbackProviderKey: ProviderKey | null): CustomModelTarget | null;
+interface CustomModelTarget {
+  providerKey: ProviderKey;
+  providerLabel: string;
+  modelId: string;
+  /** The query named this provider (`xai grok-9`). */
+  named?: boolean;
+}
+/**
+ * Every route for a typed model id, one per provider: the provider the query
+ * names first (`xai grok-9`), then `fallbackProviderKey` (the current pick),
+ * then the rest in the given order. Lets a picker offer "use this id via…"
+ * for each signed-in provider instead of guessing one. Empty when the query
+ * names no model id.
+ */
+declare function customModelTargets(query: string, providers: readonly Pick<ProviderAuth, 'key' | 'label'>[], fallbackProviderKey: ProviderKey | null): CustomModelTarget[];
+//#endregion
+//#region src/chat/model-lineup.d.ts
+/** Parsed shape of a model id. Exported for tests and for pickers that want to show a family label. */
+interface ModelIdParts {
+  /** `vendor/` prefix on aggregator ids (`anthropic` in `anthropic/claude-opus-5`), lowercased; '' when absent. */
+  vendor: string;
+  /** The words of the id, lowercased and joined with `-`. */
+  family: string;
+  /** Numeric version segments in order; empty when the id carries none. */
+  version: number[];
+  /** Size tokens joined with `-` (`27b`, `235b-a22b`); '' when absent. */
+  size: string;
+  /** Dated / numbered snapshot (`20251001`, `2024-05-13` → `20240513`, `0731`); '' for the plain alias. */
+  snapshot: string;
+  /** Routing variant after `:` (`batch`, `free`); '' when absent. */
+  variant: string;
+}
+declare function parseModelId(id: string): ModelIdParts;
+/** Numeric, segment by segment; a longer version wins a tie on the shared prefix (`5.5` > `5`). */
+declare function compareModelVersion(a: readonly number[], b: readonly number[]): number;
+interface LineupEntry {
+  providerKey: string;
+  modelId: string;
+}
+/**
+ * Keys (`provider\0model`) of the current models: per provider and family,
+ * the newest version, one entry per size. `keep` entries (the active model,
+ * fallback chain, off-catalog ids) are always included.
+ */
+declare function currentModelKeys(entries: readonly LineupEntry[], keep?: readonly LineupEntry[]): Set<string>;
+/** `entries` in their original order, current models only (see {@link currentModelKeys}). */
+declare function currentModels<T extends LineupEntry>(entries: readonly T[], keep?: readonly LineupEntry[]): T[];
+//#endregion
+//#region src/chat/prompt-segments.d.ts
+/**
+ * Pure string + reference math for rendering a submitted prompt with chip
+ * pills around completion references. Renderer-agnostic — the TUI walks
+ * the segments into OpenTUI `<text>` nodes, a GUI walks them into JSX
+ * spans + `<span class="chip">` pills. No layout engine assumptions.
+ */
+/**
+ * Highlight span — half-open `[start, end)` over the source string.
+ *
+ * Offsets are JS string indices (UTF-16 code units) — the same convention used
+ * everywhere else in the chat layer (`text[i]`, `m.index`, `String.slice`).
+ * Surrogate pairs that straddle a span boundary would render malformed, but
+ * realistic prompts in this surface (terminal text + ASCII triggers) keep that
+ * risk theoretical; callers feeding emoji-heavy content should normalize to
+ * codepoint walks upstream.
+ */
+interface PromptSegmentRef {
+  start: number;
+  end: number;
+  /** Provider id tagging this span (`'skills'`, `'files'`, …). Free-form. */
+  providerId: string;
+}
+/**
+ * One atomic unit emitted by {@link splitPromptSegments}. Plain segments
+ * are word-sized so wraps land cleanly between words; chip segments
+ * carry the source `providerId` (`'skills'`, `'files'`, …) so renderers
+ * can pick per-kind colors without re-walking the ref list.
+ */
+type PromptSegment = {
+  kind: 'plain';
+  text: string;
+} | {
+  kind: 'chip';
+  text: string;
+  providerId: string;
+};
+/**
+ * Split a prompt buffer into word-sized atomic segments suitable for a
+ * flex-row + flex-wrap renderer (TUI) or a `display: inline` flow with
+ * inline-block chips (GUI). Each chip becomes one segment (atomic —
+ * never broken across rows); each plain run is split into "word +
+ * trailing space" units so wraps land at clean word boundaries.
+ *
+ * Robust to:
+ *   - Overlapping refs — sorted by start; later refs that overlap are
+ *     dropped via the first-wins rule.
+ *   - Out-of-bounds refs — dropped entirely when `end > text.length` or
+ *     `start >= text.length`. Partial clipping would silently truncate
+ *     a chip's label; the caller is in a better position to surface the
+ *     mismatch (typically a stale `refs` array referencing a previous text).
+ *   - Whitespace-only plain runs — emitted as their own plain segment
+ *     so chip-adjacent-to-chip cases keep the original spacing.
+ *
+ * Word splitter rationale: `\S+\s*` keeps trailing whitespace attached
+ * to its preceding word so wrap boundaries land between words (cleanly).
+ * A leading-whitespace-only segment is captured by `\s+` so we don't
+ * drop it entirely when the plain run starts with a space.
+ */
+declare function splitPromptSegments(text: string, refs: readonly PromptSegmentRef[]): PromptSegment[];
+/**
+ * File-mention refs recovered from a prompt's text: `@<path>` at the start
+ * or after whitespace, where the path looks like one (has a `/` or a `.`),
+ * trailing punctuation excluded (the files completion's own rule).
+ *
+ * Refs are known only to the client that sent the prompt, which typed the
+ * mention through a completion. The persisted turn and the send echo other
+ * windows receive carry the text alone, so without this a prompt's chips
+ * existed in the sender's live transcript only: gone after a reload, never
+ * shown in another window or the TUI. Replay and the echo fill refs from
+ * this when the event has none, so every client paints the same prompt.
+ * Skills and chats mentions are not inferred: their tokens (`/name`,
+ * `#token`) are ordinary text too often to guess without the catalogs.
+ */
+declare function inferPromptRefs(text: string): PromptSegmentRef[];
+/**
+ * The segments cut into the lines the user typed. A flex-wrap row cannot
+ * break on a newline inside one of its items, so each line renders as its
+ * own row; an empty array is a blank line.
+ */
+declare function promptSegmentLines(segments: readonly PromptSegment[]): PromptSegment[][];
+//#endregion
+//#region src/chat/provider-usage-format.d.ts
+/**
+ * Node-free half of provider usage: the wire types and the two presentation
+ * helpers every surface needs to RENDER a snapshot.
+ *
+ * Split out of `provider-usage.ts` because that module reads
+ * `credentials.json` and so cannot be reached from `zidane/chat/pure`. The
+ * Electron renderer receives snapshots over IPC (main does the fetching) and
+ * must draw them with the same rounding and the same "which window bites
+ * first" rule as the TUI — a renderer that re-derived either would be the
+ * duplication that let the TUI and GUI report different facts about one event.
+ *
+ * `provider-usage.ts` re-exports everything here, so existing importers keep
+ * their single import.
+ */
+/** One rate-limit window on a subscription (e.g. "5h", "weekly"). */
+interface ProviderUsageWindow {
+  /** Stable id from the provider, used as a React / list key. */
+  id: string;
+  /** Human label as the provider names it. */
+  label: string;
+  /** 0..100, may be fractional. */
+  usedPercent: number;
+  /** Epoch ms when the window resets, or `null` when the provider omits it. */
+  resetsAt: number | null;
+}
+/** Remaining credits for pay-as-you-go style providers. */
+interface ProviderUsageCredits {
+  remaining: number;
+  total: number | null;
+}
+type ProviderUsageStatus = 'ok' | 'unauthorized' | 'unavailable';
+interface ProviderUsageSnapshot {
+  /** Registry key (`anthropic`, `openai`, …). */
+  providerKey: string;
+  /** Display label for the provider. */
+  label: string;
+  /**
+   * Credentials-file key of the credential this snapshot was probed with. A
+   * provider holding several OAuth accounts yields one snapshot per account;
+   * this is what tells them apart (and the stable list key).
+   */
+  credentialKey: string;
+  /**
+   * Account name for OAuth-backed snapshots (`Default`, `work`, …); `null` for
+   * API-key probes. Surfaces show it only when the provider has more than one
+   * snapshot, so a single-account provider stays as quiet as before.
+   */
+  account: string | null;
+  /** True when this credential is the one requests use (the canonical slot). */
+  activeCredential: boolean;
+  status: ProviderUsageStatus;
+  /** Plan name when the provider reports one. */
+  plan: string | null;
+  windows: readonly ProviderUsageWindow[];
+  credits: ProviderUsageCredits | null;
+  fetchedAt: number;
+  error: string | null;
+}
+/**
+ * Whether a snapshot should show its account name: only when another snapshot
+ * in the same list belongs to the same provider. One account is the provider.
+ */
+declare function showsAccount(snapshot: ProviderUsageSnapshot, all: readonly ProviderUsageSnapshot[]): boolean;
+/**
+ * The snapshot the footer indicator shows for a provider: the one probed with
+ * the credential requests use, else the first reported. `null` when none.
+ */
+declare function activeSnapshotFor(all: readonly ProviderUsageSnapshot[], providerKey: string): ProviderUsageSnapshot | null;
+/**
+ * The window closest to its ceiling, which is the one that will bite first and
+ * the only one a single-line indicator has room for. `null` when the snapshot
+ * carries no windows.
+ */
+declare function mostConstrainedWindow(snapshot: ProviderUsageSnapshot): ProviderUsageWindow | null;
+/**
+ * Percent for display: integers print bare, fractions keep one decimal (so a
+ * status bar never reads `100%` for `99.9`).
+ */
+declare function formatUsagePercent(usedPercent: number): string;
+/**
+ * Severity tone for a usage percent. `error` ≥ 85, `warn` ≥ 60, else `ok`.
+ * Surfaces map tones to their own palette.
+ */
+type UsageTone = 'ok' | 'warn' | 'error';
+declare function usageTone(usedPercent: number): UsageTone;
+/**
+ * Time to reset, coarsened to whole days past 24h. `null` when the provider
+ * reported no reset, `resetting` once it is due.
+ *
+ * Every step rounds DOWN, like the percent: 36h reads as `1d`, not `2d`.
+ * Overstating the headroom left on a window is the wrong direction to be
+ * wrong in.
+ */
+declare function resetLabel(resetsAt: number | null, now?: number): string | null;
+/**
+ * `updated 12s ago` / `updated 3m ago` for the newest snapshot in a list, so a
+ * refresh that returns identical numbers is still visibly a refresh. `null`
+ * when the list is empty.
+ */
+declare function updatedLabel(snapshots: readonly ProviderUsageSnapshot[], now?: number): string | null;
+/** Balances are dollars for OpenRouter and opaque units elsewhere. */
+declare function formatCredits(value: number): string;
+/** `20.00 / 25.00`, or just the remainder when no total is reported. */
+declare function formatBalance(credits: ProviderUsageCredits): string;
+//#endregion
+//#region src/chat/settings-defaults.d.ts
+declare const DEFAULT_SETTINGS: Settings;
+//#endregion
+//#region src/chat/spawn-tree.d.ts
+/**
+ * Spawn-tree ownership for transcript renderers (TUI partition, GUI
+ * timeline). A nested worker's lifecycle markers name their spawner in
+ * `spawn.parentChildId`; these helpers turn that into "which worker does
+ * this row belong under", so a grandchild's rows nest inside its spawner
+ * instead of reading as a separate worker of the main transcript.
+ *
+ * Generic over the row shape so the GUI's own `Row` type works too.
+ */
+/** What the helpers read off a transcript row / event. */
+interface SpawnTreeRow {
+  kind: string;
+  childId?: string;
+  spawn?: {
+    parentChildId?: string;
+  };
+}
+/** Worker id → the worker that spawned it, from nested spawn markers. */
+declare function spawnParents(rows: Iterable<SpawnTreeRow>): Map<string, string>;
+/**
+ * The worker `childId`'s rows belong under: its outermost ancestor that is
+ * itself one of the `present` workers (the ones owning rows in this view).
+ * A view that already re-based its owner's rows (a worker opened in a fold)
+ * leaves that owner out of `present`, so the owner's direct children become
+ * the lanes there. `childId` itself when no ancestor is present.
+ */
+declare function spawnLane(childId: string, parents: ReadonlyMap<string, string>, present: ReadonlySet<string>): string;
+/**
+ * Lane resolver over one view's rows: precomputes the parent map and the
+ * present-worker set, then maps a row's `childId` to its lane.
+ */
+declare function spawnLaneResolver(rows: readonly SpawnTreeRow[]): (childId: string) => string;
+//#endregion
+//#region src/chat/streaming-pure.d.ts
+declare function ownerOf(event: StreamEvent): Owner;
+/**
+ * Index of the event `owner`'s next delta may coalesce into, or `-1` when the
+ * owner has no open lane at the tail.
+ *
+ * Walks backwards over events owned by OTHER subagents — concurrent siblings
+ * whose rows carry no ordering relation to this owner's output, and which a
+ * per-owner drain interleaves at ~60Hz — and stops at the first event that is
+ * either this owner's or a real ordering boundary (parent output, user
+ * prompts, banners). The caller decides whether the event found is mergeable
+ * for its kind. A tail-only check splits every concurrent child's message
+ * into fragments braided with its siblings'.
+ */
+declare function mergeTargetIndex(events: readonly StreamEvent[], owner: Owner): number;
+/**
+ * Default segment bound for a growing streaming markdown event. Coalescing
+ * copies the ENTIRE accumulated string into fresh state on every drain tick,
+ * so one long streamed message costs O(L²) aggregate — past this threshold
+ * the event is split and the copy re-bounded. The split reuses
+ * {@link chunkMarkdownForRender} (blank-line boundaries outside fences,
+ * unsafe-continuation guard), so the finalized segments are byte-identical
+ * to the chunks the renderer would have produced inside a single event, and
+ * the one-row markdown/markdown margin stands in for the consumed blank line
+ * exactly like the renderer's inter-chunk gap. When no safe boundary exists
+ * (one giant fence/list) the event keeps growing until one arrives.
+ */
+declare const STREAMING_MARKDOWN_SEGMENT_CHARS: number;
+interface MarkdownDeltaOptions {
+  /**
+   * Split threshold for a growing block (default
+   * {@link STREAMING_MARKDOWN_SEGMENT_CHARS}). `Infinity` keeps one event per
+   * streamed message — for a host whose reloaded transcript shows messages
+   * whole and whose renderer chunks long text itself.
+   */
+  segmentChars?: number;
+}
+interface ThinkingDeltaOptions<E> {
+  /** Decorate the first row of a newly opened thinking lane (e.g. stamp its start time). */
+  onLaneOpen?: (row: E) => E;
+}
+/** Coalesce a markdown delta into `owner`'s open streaming block, or open one. */
+declare function appendMarkdownDelta<E extends StreamEvent = StreamEvent>(prev: NoInfer<E>[], delta: string, owner: Owner, depth: number | undefined, turnId: string | undefined, options?: MarkdownDeltaOptions): E[];
+/** Coalesce a thinking delta into `owner`'s open lane, one row per line. */
+declare function appendThinkingLines<E extends StreamEvent = StreamEvent>(prev: NoInfer<E>[], delta: string, owner: Owner, depth: number | undefined, turnId: string | undefined, options?: ThinkingDeltaOptions<E>): E[];
+/** Flip any trailing streaming markdown blocks (any owner) to finalized. */
+declare function finalizeStreamingMarkdown(events: StreamEvent[]): StreamEvent[];
+/** Flip the trailing streaming markdown block for one specific owner. */
+declare function finalizeStreamingMarkdownForOwner(events: StreamEvent[], owner: Owner): StreamEvent[];
+/**
+ * Effective context size for a single turn.
+ *
+ * `usage.input` is misleading on its own when prompt caching is active: providers
+ * (Anthropic, OpenRouter→Anthropic, Gemini) report `input` as the *new uncached*
+ * tokens only — the cached prefix shows up in `cacheRead`, and newly-cached
+ * tokens in `cacheCreation`. The model still saw all three buckets, so the real
+ * context-window utilization is their sum.
+ *
+ * Non-caching providers leave `cacheRead`/`cacheCreation` undefined, so this
+ * collapses to plain `input` for them.
+ */
+declare function turnContextSize(usage: TurnUsage | undefined): number;
+/**
+ * Display-layer transcript bounds. Each rendered event holds live React
+ * fibers + OpenTUI renderables + native text buffers even when scrolled
+ * off-screen — measured at roughly 0.13 MB RSS per markdown-heavy event —
+ * so an uncapped multi-thousand-event session (a normal working day with
+ * tool calls) climbs into the hundreds of MB and eventually OOM/thrash.
+ *
+ * The cap bounds ONLY what is materialized on screen: session turns on
+ * disk are complete, and switching sessions / re-activating replays the
+ * most recent window again. Trimming happens at TURN boundaries so a
+ * turn's rows are never orphaned, and re-caps fold into one cumulative
+ * marker rather than stacking markers.
+ */
+declare const MAX_TRANSCRIPT_EVENTS = 1500;
+/** Post-trim size — the hysteresis gap keeps re-trims O(rare), not per-append. */
+declare const TRANSCRIPT_TRIM_TO_EVENTS = 1200;
+/**
+ * Bound a transcript event array for display. Identity below the cap
+ * (no re-render churn on the hot append path); above it, drops the
+ * oldest events down to {@link TRANSCRIPT_TRIM_TO_EVENTS} — extended to
+ * the next turn boundary — and prepends a cumulative hidden-count
+ * marker. Callers: the stream buffer's drain commit and every
+ * `eventsFromTurns` replay site.
+ */
+declare function capTranscriptEvents(events: StreamEvent[], max?: number, trimTo?: number): StreamEvent[];
+//#endregion
+//#region src/chat/tool-formatters.d.ts
+/**
+ * Per-tool display metadata + one-line formatters consumed by any
+ * surface that renders a `tool` event in `'formatted'` mode (see
+ * `Settings.toolCallDisplay`).
+ *
+ * Each native tool gets a curated entry — a `displayName` verb that
+ * reads in sentence case (e.g. "Read", "Shell") and a `format` callback
+ * that pulls the most informative bits out of the model's raw input to
+ * a single scannable line. Unknown tools (MCP servers, host-added
+ * tools, future zidane additions) fall back to {@link formatToolCall}
+ * returning `null` — the renderer then shows a minimal `↳ <name>` line.
+ *
+ * Renderer-agnostic: returns plain data (`{ target, meta }`) so the
+ * TUI's React/OpenTUI surface and any future GUI consumer can paint
+ * the same shape in their own style. Lives in `zidane/chat` because
+ * it has no rendering concerns; the TUI just consumes it.
+ */
+interface ToolFormatLine {
+  /**
+   * Primary target — typically a path, command, pattern, or
+   * task description. Renderer paints this in the model accent color
+   * so the eye lands on it first.
+   */
+  target?: string;
+  /**
+   * Secondary annotations rendered after the target, joined with
+   * ` · ` separators. Use for line ranges (`L10-25`), limits, flags,
+   * or any short suffix that adds context without bloating the line.
+   */
+  meta?: readonly string[];
+  /**
+   * Optional SECOND line — the payload behind the action (a prompt sent to
+   * another session). Renderers paint it dimmed under the header and clamp
+   * it (two lines in the GUI, one terminal row in the TUI); it is never
+   * squeezed into the header line, which stays single-line.
+   */
+  detail?: string;
+  /**
+   * The session this call targets, when the tool addresses one. `target`
+   * carries the short id as a fallback; a renderer with the session list in
+   * scope shows the session's TITLE instead.
+   */
+  sessionId?: string;
+}
+interface ToolDisplayMeta {
+  /**
+   * Title-case display verb (e.g. `Read`, `Shell`, `Edit`). When the
+   * label depends on an input field (e.g. `skills_use`'s
+   * `mode: 'activate' | 'deactivate'` → `Enable` / `Disable`), supply
+   * a function instead and read the field defensively. The function
+   * form is called whenever {@link displayNameFor} has the call's
+   * input in scope; callers without input fall back to the function's
+   * `input: undefined` branch, which should return a stable default.
+   */
+  displayName: string | ((input: Record<string, unknown> | undefined) => string);
+  /**
+   * Pull a {@link ToolFormatLine} out of the raw model input. Returns
+   * `null` when the shape isn't what the tool expects (typed defensively
+   * — we never want a malformed call to crash the transcript).
+   */
+  format: (input: Record<string, unknown>) => ToolFormatLine | null;
+}
+declare const TOOL_DISPLAY: Readonly<Record<string, ToolDisplayMeta>>;
+/**
+ * Resolve the display verb for a tool. Native tools use their curated
+ * entry from {@link TOOL_DISPLAY}; everything else gets a sentence-case
+ * version of the raw name (`my_host_tool` → `My host tool`) so an MCP /
+ * host tool still reads cleanly in the transcript without shouting
+ * Title Case at every word.
+ *
+ * MCP convention: every tool surfaced by `mcp/connectMcpServers` is
+ * namespaced as `mcp_<server>_<tool>` (see `src/mcp/index.ts`). The
+ * `mcp_` prefix is plumbing — strip it before casing so the label
+ * reads as `Github create issue` instead of `Mcp github create issue`.
+ * The server name leads, which doubles as a free visual grouping
+ * affordance ("everything starting with `Github` came from the github
+ * MCP server").
+ */
+declare function displayNameFor(name: string, input?: Record<string, unknown>): string;
+/**
+ * The source code a tool call runs, for renderers that show it highlighted
+ * instead of the raw JSON input: Codemode's script as JavaScript, a `shell`
+ * / `bash` command as bash (the command alone: the label carries the
+ * description, the rest is plumbing). `null` for
+ * every other tool and for calls without the code field. `language` is a
+ * fence-style name both highlighters accept (Shiki in the GUI, OpenTUI's
+ * tree-sitter in the TUI).
+ */
+declare function toolInputCode(name: string, input: Record<string, unknown> | undefined): {
+  code: string;
+  language: string;
+} | null;
+/**
+ * Run a tool's curated formatter and return the result, or `null` when
+ * no formatter is registered / the input shape doesn't match. Renderer
+ * decides what to do with `null` — typically: show `↳ <displayName>`
+ * with no target / meta tail.
+ */
+declare function formatToolCall(name: string, input: Record<string, unknown>): ToolFormatLine | null;
+//#endregion
+//#region src/chat/turn-operations.d.ts
+/**
+ * Fork — keep every turn up to and including `turnId`, then strip any
+ * `tool_call` blocks left without a matching `tool_result` in the slice.
+ *
+ * Semantics:
+ *   - Include the selected turn ("branch from HERE" mental model — the
+ *     user wants the selected message to be the latest in the fork).
+ *   - If the selected turn is an assistant turn with unresolved
+ *     `tool_call` blocks (their `tool_result`s live in turns AFTER the
+ *     slice), strip those calls. Otherwise the fork would post an
+ *     assistant turn with no matching tool results, breaking the next
+ *     provider call.
+ *   - Drop turns that become empty (all blocks stripped).
+ *
+ * Returns `null` when `turnId` doesn't exist in `turns` — caller should
+ * surface a "turn not found" error rather than silently no-op.
+ */
+declare function truncateTurnsAt(turns: readonly SessionTurn[], turnId: string): SessionTurn[] | null;
+/**
+ * Delete — remove the turn with `turnId` and any tool blocks left
+ * orphaned by the removal. Returns `null` when `turnId` doesn't exist.
+ *
+ * Strategy:
+ *   1. Drop the target turn.
+ *   2. Scan the remaining turns for `tool_call`s without a matching
+ *      `tool_result` (orphaned by removing the user turn that carried
+ *      the result), and `tool_result`s without a matching `tool_call`
+ *      (orphaned by removing the assistant turn that issued the call).
+ *      Strip both sides.
+ *   3. Drop turns whose content is now empty.
+ *
+ * This guarantees the resulting history is protocol-clean — a follow-up
+ * `agent.run()` against the modified session can post turns without the
+ * provider rejecting the history.
+ */
+declare function deleteTurnSafely(turns: readonly SessionTurn[], turnId: string): SessionTurn[] | null;
+/**
+ * Replace a turn's text with `newText`, keeping every non-text block (tool
+ * calls, tool results, thinking, images) where it was. All text blocks
+ * collapse into one, placed where the first text block was; an empty or
+ * whitespace-only `newText` removes the text and keeps the rest.
+ *
+ * Returns `null` when the turn is missing or has no text to edit, so callers
+ * can report it. Untouched turns keep their identity (a store can rewrite
+ * only the edited row).
+ */
+declare function replaceTurnTextBlocks(turns: readonly SessionTurn[], turnId: string, newText: string): SessionTurn[] | null;
+/**
+ * Serialize a turn's content to a clean text representation suited for
+ * the clipboard. Joins text + thinking blocks verbatim; tool calls and
+ * tool results get bracketed labels so the user can paste a readable
+ * record of what happened without losing structure.
+ *
+ * Empty turns return `''`.
+ */
+declare function turnAsText(turn: SessionTurn): string;
+/**
+ * Count turns before / after the one identified by `turnId` in the
+ * given list. Returns `null` when the id is missing. Used to label the
+ * turn-details modal with `N before · M after`.
+ */
+declare function countNeighbors(turnIds: readonly string[], turnId: string): {
+  before: number;
+  after: number;
+} | null;
+//#endregion
+export { currentModels as $, retagUserPromptEventsFromRefs as $i, BrowserOpInputs as $n, InlineSegment as $r, isTodoTool as $t, ProviderUsageCredits as A, DaemonHealth as Ai, MachineResult as An, CacheChipContent as Ar, displayHostUrl as At, resetLabel as B, isReservedCredKey as Bi, BROWSER_EVALUATE_MAX_BYTES as Bn, FeatureGate as Br, CreateTodoToolsOptions as Bt, ownerOf as C, ChatReferenceScope as Ca, RequestApproval as Ci, MachineInfo as Cn, searchSessionHistoryIndex as Cr, enabledMcpsWithout as Ct, spawnLaneResolver as D, blendHsl as Da, useSafeModeQueue as Di, MachineParams as Dn, searchSessionTurns as Dr, normalizeMarkdownCodeFences as Dt, spawnLane as E, uniqueChatIdsFromReferences as Ea, useSafeModeActions as Ei, MachineMethodName as En, searchSessionIndexAsync as Er, chunkMarkdownForRender as Et, activeSnapshotFor as F, CRED_KEY_SLOT_SEPARATOR as Fi, isValidMachineName as Fn, liveSessionCost as Fr, HostProbe as Ft, PromptSegmentRef as G, PromptTurnRef as Gi, BROWSER_REQUEST_SLACK_MS as Gn, isKillSwitchEngaged as Gr, TODO_WRITE_COUNTS_METADATA_KEY as Gt, updatedLabel as H, BASH_CALL_ID_PREFIX as Hi, BROWSER_OPEN_MOUNT_MS as Hn, daemonGate as Hr, TODOREAD_TOOL as Ht, formatBalance as I, DEFAULT_OAUTH_ACCOUNT_LABEL as Ii, machineKind as In, retryLabel as Ir, HostProbeResult as It, splitPromptSegments as J, isUserBashEvent as Ji, BrowserChange as Jn, DiffOp as Jr, TodoTally as Jt, inferPromptRefs as K, isEditErrorResult as Ki, BROWSER_TEXT_MAX_CHARS as Kn, remoteHostsGate as Kr, TodoItem as Kt, formatCredits as L, accountCredKey as Li, parseMachineKind as Ln, runStatusLabel as Lr, HostRegistryError as Lt, ProviderUsageStatus as M, DaemonHealthTone as Mi, MachineShareStatus as Mn, cacheBreakChip as Mr, HostEntry as Mt, ProviderUsageWindow as N, ACCOUNT_CRED_KEY_INFIX as Ni, MachineStatusChange as Nn, cacheBreakNoticeText as Nr, HostErrorCode as Nt, spawnParents as O, buildLinearRamp as Oa, DAEMON_HEALTH_GLYPH as Oi, MachineRegisterParams as On, searchTurns as Or, splitMarkdownCodeBlocks as Ot, UsageTone as P, ALTERNATE_CRED_KEY_SUFFIX as Pi, MachineUseStatus as Pn, compactingLabel as Pr, HostIdentity as Pt, currentModelKeys as Q, retagUserPromptEvents as Qi, BrowserOpError as Qn, InlineDiff as Qr, getTodosForRun as Qt, formatUsagePercent as R, alternateCredKey as Ri, toMachineName as Rn, streamingLabel as Rr, HostTestResult as Rt, mergeTargetIndex as S, ChatReferenceEntry as Sa, ApprovalRequest as Si, MachineErrorCode as Sn, searchSessionHistory as Sr, enabledMcpsWith as St, SpawnTreeRow as T, createChatsCompletionProvider as Ta, SafeModeProvider as Ti, MachineLinksStatus as Tn, searchSessionIndex as Tr, MarkdownSegment as Tt, usageTone as U, CACHE_NOTICE_LABEL as Ui, BROWSER_OPS as Un, defineFeatureGate as Ur, TODOS_METADATA_KEY as Ut, showsAccount as V, oauthAccountLabel as Vi, BROWSER_MAX_WAIT_MS as Vn, FeatureGateOptions as Vr, DEFAULT_MAX_TODO_ITEMS as Vt, PromptSegment as W, EDIT_TOOL_NAMES as Wi, BROWSER_OUTLINE_MAX_ELEMENTS as Wn, engagedKillSwitches as Wr, TODOWRITE_TOOL as Wt, ModelIdParts as X, messageSelectionOwnership as Xi, BrowserErrorCode as Xn, EditSummary as Xr, createTodoTools as Xt, LineupEntry as Y, isVisible as Yi, BrowserConsoleEntry as Yn, EditHunkSummary as Yr, TodosBag as Yt, compareModelVersion as Z, promptTurnRefs as Zi, BrowserOp as Zn, HunkResolution as Zr, getArchivedTodosForRun as Zt, appendMarkdownDelta as _, listProjectFiles as _a, resolveApprovalForPayload as _i, TerminalReadResult as _n, buildSessionSearchIndex as _r, McpAuthStatus as _t, turnAsText as a, canonicalKeyName as aa, computeLineDiff as ai, useActiveTodos as an, BrowserStatus as ar, filterModelCatalog as at, finalizeStreamingMarkdown as b, CHATS_TRIGGER as ba, summarizeOutcomes as bi, TerminalTarget as bn, highlightSegments as br, mcpFailureEvent as bt, ToolFormatLine as c, SKILLS_TRIGGER as ca, previewEditPayload as ci, TERMINAL_MAX_PER_SESSION as cn, HighlightRange as cr, MCP_KEY_REFUSED_HINT as ct, toolInputCode as d, FILES_TRIGGER as da, tokenize as di, TERMINAL_TEXT_MAX_LINES as dn, SearchExcerpt as dr, classifyMcpTest as dt, selectableTurnIds as ea, PreviewResult as ei, pickActiveRunId as en, BrowserOpResults as er, parseModelId as et, MAX_TRANSCRIPT_EVENTS as f, createFilesCompletionProvider as fa, ResolvedApproval as fi, TerminalAttachResult as fn, SearchSessionResult as fr, isMcpAuthRefusal as ft, ThinkingDeltaOptions as g, fileEntriesFromPaths as ga, parseEditOutcomesFromResult as gi, TerminalOwner as gn, SessionSearchIndex as gr, McpAuthStateMap as gt, TRANSCRIPT_TRIM_TO_EVENTS as h, ListProjectFilesOptions as ha, mergeApprovalAndBodyOutcomes as hi, TerminalOpenInput as hn, SessionSearchExcerpt as hr, McpAuthEvent as ht, truncateTurnsAt as i, bindingAlternatives as ia, computeInlineDiff as ii, setTodosForRun as in, BrowserSnapshot as ir, customModelTargets as it, ProviderUsageSnapshot as j, DaemonHealthStyle as ji, MachineRoot as jn, CacheChipTone as jr, parseRemoteHostUrl as jt, DEFAULT_SETTINGS as k, DAEMON_HEALTH_STYLE as ki, MachineRegisterResult as kn, searchableTurnText as kr, RemoteHostError as kt, displayNameFor as l, createSkillsCompletionProvider as la, splitLines as li, TERMINAL_OUTPUT_WINDOW as ln, HighlightSegment as lr, McpTestOutcomeKind as lt, STREAMING_MARKDOWN_SEGMENT_CHARS as m, FileEntry as ma, maskToOutcomeKinds as mi, TerminalInfo as mn, SessionHistoryMatch as mr, MCP_STATUS_LABEL as mt, deleteTurnSafely as n, turnSelectionOwnership as na, buildContextualDiff as ni, sanitizeTodoItems as nn, BrowserResponse as nr, CustomModelTarget as nt, TOOL_DISPLAY as o, parseBindingSpec as oa, extractEditPayload as oi, TODO_STATUS_GLYPHS as on, BrowserTarget as or, indexOfEntry as ot, MarkdownDeltaOptions as p, uniqueFilesFromReferences as pa, buildEditOutcomesAnnotation as pi, TerminalError as pn, SearchTurnResult as pr, mcpFailureLine as pt, promptSegmentLines as q, isTurnHighlighted as qi, BROWSER_WAIT_TIMEOUT_MS as qn, DiffLine as qr, TodoStatus as qt, replaceTurnTextBlocks as r, ParsedBinding as ra, buildUnifiedDiff as ri, selectActiveTodos as rn, BrowserScreenshot as rr, buildModelCatalog as rt, ToolDisplayMeta as s, parseBindingSpecs as sa, filetypeFromPath as si, TERMINAL_HISTORY_MAX_CHARS as sn, BrowserWaitUntil as sr, parseCustomModelQuery as st, countNeighbors as t, selectionAfterTurnRemoval as ta, applyEditPayload as ti, pruneTodosByRun as tn, BrowserRequest as tr, CatalogEntry as tt, formatToolCall as u, uniqueSkillNamesFromReferences as ua, summarizeEditPayload as ui, TERMINAL_READ_MAX_CHARS as un, IndexedSearchTurn as ur, McpTestResult as ut, appendThinkingLines as v, COMMANDS_TRIGGER as va, rewriteMultiEditHeader as vi, TerminalSessionState as vn, buildSessionSearchIndexAsync as vr, McpNeedsAuthReason as vt, turnContextSize as w, chatReferenceTokensFromText as wa, SafeModeActions as wi, MachineLinkState as wn, searchSessionHistoryIndexAsync as wr, MARKDOWN_RENDER_CHUNK_TARGET_BYTES as wt, finalizeStreamingMarkdownForOwner as x, ChatReferenceData as xa, ApprovalDecision as xi, MACHINE_PROTOCOL_VERSION as xn, searchHighlightRanges as xr, reduceMcpAuth as xt, capTranscriptEvents as y, createCommandsCompletionProvider as ya, stripEditOutcomesAnnotation as yi, TerminalStatus as yn, filterSessionSearchCatalog as yr, getMcpAuthStatus as yt, mostConstrainedWindow as z, isAccountCredKey as zi, BROWSER_ACTION_TIMEOUT_MS as zn, FEATURE_GATES as zr, ActiveTodosState as zt };
+//# sourceMappingURL=turn-operations-DQX5ZZni.d.ts.map