zidane 7.2.5 → 8.0.4

package/dist/{index-C6NEd5y_.d.ts → index-CHABJd-L.d.ts}

@@ -1,12 +1,130 @@
-import { $l as Theme, B as McpCredentialStore, Bv as SkillConfig, Dd as EditOutcome, Dl as SourcedScanPath, Fd as SessionMeta, Id as Settings, Ji as AgentHookMap, Jm as CacheBreakInfo, Ld as StreamEvent, Ms as ExtensionHostRuntimeBridge, Pd as Screen, Pm as ContextBreakdown, Qo as ExtensionRegistry, Rf as ProviderKey, U_ as SessionTurn, Vd as ProjectBrief, Wf as ProviderDescriptor, Wv as SkillsConfig, Wy as SessionArtifact, Xu as CompletionItem, Yi as AgentHooks, Z_ as ThinkingLevel, Zl as SyntaxStyles, Zu as CompletionProvider, Zv as SessionStore, a_ as AgentStats, bf as ModelChainEntry, dv as TurnUsage, eu as ThemeColors, gv as ToolDef, kd as EditPayload, km as ContextSegment, nu as ThemeSurfaces, o_ as AutoCompact, qi as Agent, qv as Session, sh as Provider, tu as ThemeSelect, uv as TurnFinishReason, v_ as JsonValue, vp as InteractionRequest, x_ as McpToolSchema, y_ as McpServerConfig, yo as ExtensionArtifactRow, yp as InteractionResponse, z as McpCredentialEntry } from "./index-BgN1T3lk.js";
-import { Bt as Hint, Tt as KeyBindings, Y as ResolvedConfig, _ as DiscoveredMcp, f as DiscoveredPlugin, v as DiscoveryError } from "./transcript-anchors-BeudMbXx.js";
-import { P as ProviderUsageSnapshot, Wt as FileEntry, _t as PreviewResult, a as ActiveTodosState, h as TodoTally, mt as HunkResolution, p as TodoItem } from "./turn-operations-C8bMBDl_.js";
-import { H as ApprovalRequest, V as ApprovalDecision, dt as PromptTurnRef } from "./tool-formatters-DoRLnfuD.js";
-import { Hookable } from "hookable";
+import { B as McpCredentialStore, Bg as AgentHookMap, Bp as Settings, Cy as McpToolSchema, Dh as EnvironmentProvider, Du as StorageMode, Eg as ContextBreakdown, Fd as CompletionProvider, Fp as Picked, Gh as ProviderAuth, Gp as ProjectBrief, Gy as SessionTurn, Id as CompletionReference, Ip as Screen, Iu as Theme, Jb as SkillsConfig, Jg as CacheBreakInfo, Jx as SessionArtifact, Kh as ProviderKey, Lm as ModelChainEntry, Lp as SessionEnvironmentSummary, Lu as ThemeColors, Md as ActiveTrigger, Mh as EnvironmentVerifyResult, Oc as StoredExtensionConfigItem, Oh as EnvironmentRegistry, Pd as CompletionItem, Ph as SessionEnvironment, Pu as SyntaxStyles, Qb as SessionData, Qd as CommandOutputBlock, Qh as ProviderDescriptor, Rp as SessionHeader, Ru as ThemeSelect, V as McpOAuthProvider, Vg as AgentHooks, Vp as StreamEvent, Vy as SessionContentBlock, Wb as SkillConfig, Wd as Command, Xh as ModelInfo, Yi as Agent, Za as ExtensionMcpHost, Zb as Session, _f as InteractionResponse, _s as ExtensionRegistry, ab as ToolResultContent, ay as AgentStats, bb as ToolDef, by as JsonValue, dl as SubagentOverride, eb as ThinkingLevel, ec as ExtensionHostRuntimeBridge, eh as EnvironmentDescriptor, ex as SessionRun, fl as SubagentRegistry, gc as ExtensionConfigCategory, gf as InteractionRequest, gh as EnvironmentActionSummary, gp as AgentRegistry, hh as EnvironmentActionResult, hu as SourcedScanPath, jh as EnvironmentTeardownResult, jl as LoadedPlugin, jp as EditPayload, kh as EnvironmentRequest, ko as ExtensionArtifactRow, kp as EditOutcome, mb as TurnUsage, nS as McpConnection, nh as EnvironmentSecrets, oy as AutoCompact, pb as TurnFinishReason, s_ as Provider, t as Preset, tx as SessionStore, xg as ContextSegment, xy as McpServerConfig, yh as EnvironmentConfig, z as McpCredentialEntry, zp as SessionMeta, zu as ThemeSurfaces } from "./index-BGe1fQT7.js";
+import { c as BackgroundTerminalOptions, g as ExecutionHandle, h as ExecutionContext, m as ExecResult, v as ListFilesEntry, x as StreamHandle, y as ListFilesOptions } from "./isolation-D9L650W5.js";
+import { $n as BrowserOpInputs, An as MachineResult, Cn as MachineInfo, Dn as MachineParams, En as MachineMethodName, Ft as HostProbe, Gi as PromptTurnRef, Jt as TodoTally, Kt as TodoItem, Mt as HostEntry, Nn as MachineStatusChange, On as MachineRegisterParams, Rt as HostTestResult, Si as ApprovalRequest, Tn as MachineLinksStatus, Zn as BrowserOp, Zr as HunkResolution, _n as TerminalReadResult, ei as PreviewResult, fn as TerminalAttachResult, gt as McpAuthStateMap, hn as TerminalOpenInput, ht as McpAuthEvent, j as ProviderUsageSnapshot, kn as MachineRegisterResult, ma as FileEntry, mn as TerminalInfo, nr as BrowserResponse, ra as ParsedBinding, tr as BrowserRequest, vn as TerminalSessionState, xi as ApprovalDecision, zt as ActiveTodosState } from "./turn-operations-DQX5ZZni.js";
 import { spawn } from "node:child_process";
+import { Hookable } from "hookable";
 import { Dispatch, ReactNode, SetStateAction } from "react";
 import { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
 import { OAuthCredentials, OAuthDeviceCodeInfo, OAuthPrompt, OAuthPrompt as OAuthPrompt$1, OAuthSelectPrompt } from "@earendil-works/pi-ai/oauth";
+import "@modelcontextprotocol/sdk/shared/auth.js";
+//#region src/chat/completion.d.ts
+/** State surface returned by `useCompletion()`. */
+interface CompletionState<TItem = unknown> {
+  /** Active trigger, or null when the cursor doesn't sit in a completable span. */
+  active: ActiveTrigger<TItem> | null;
+  /** Items for the active query. Empty when no trigger is active. */
+  items: readonly CompletionItem<TItem>[];
+  /** True while the provider's `suggest` promise is pending. */
+  loading: boolean;
+  /** Index of the highlighted item inside `items`. */
+  selectedIndex: number;
+  /** Move the highlight. Wraps at the ends. No-op when `items` is empty. */
+  selectNext: () => void;
+  selectPrev: () => void;
+  /**
+   * Commit the highlighted item. Returns the new text + cursor pair, or
+   * `null` when there's nothing to commit (no active trigger, empty list).
+   */
+  commit: () => {
+    text: string;
+    cursor: number;
+  } | null;
+  /** Force-close the popover until the user types again. */
+  dismiss: () => void;
+  /** All references in the current buffer, regardless of provider. */
+  references: readonly CompletionReference<TItem>[];
+}
+/**
+ * Drive a prompt-completion popover from React state.
+ *
+ * Inputs are pull-style — the caller owns `text` + `cursor` (typically
+ * mirroring an `OpenTUI TextareaRenderable` or a `<textarea>` element) and
+ * passes them in each render. Providers are matched by their `trigger`
+ * character; the engine picks at most one active provider per cursor
+ * position.
+ *
+ * Asynchronous suggest calls are aborted when the query changes or the
+ * popover closes, so providers that hit a backend don't leak.
+ */
+declare function useCompletion<TItem = unknown>(input: {
+  text: string;
+  cursor: number;
+}, providers: readonly CompletionProvider<TItem>[], options?: {
+  maxQueryLength?: number;
+}): CompletionState<TItem>;
+//#endregion
+//#region src/markdown-defs/types.d.ts
+/** A non-fatal problem with one markdown definition file. The file may still load. */
+interface MarkdownDefDiagnostic {
+  path: string;
+  kind: 'command' | 'agent';
+  message: string;
+}
+//#endregion
+//#region src/markdown-defs/model-aliases.d.ts
+interface ModelAliasContext {
+  /** Provider name of the parent session, e.g. `'anthropic'`. */
+  parentProvider?: string;
+  /** Model ids the spawn catalog lists, when one was built. */
+  catalogIds?: ReadonlySet<string>;
+}
+//#endregion
+//#region src/markdown-defs/builtin-agents.d.ts
+/**
+ * Claude-trained models emit `subagent_type: 'Explore'` / `'Plan'`. Shipping
+ * both gives those calls a target. No `model`: the `subagentModels` setting
+ * or the parent model applies. A file agent with the same name overrides.
+ */
+declare const BUILTIN_SUBAGENTS: Readonly<SubagentRegistry>;
+//#endregion
+//#region src/markdown-defs/index.d.ts
+interface LoadMarkdownOptions {
+  cwd?: string;
+  home?: string;
+  /** Storage prefix, default `.zidane`. */
+  prefix?: string;
+  /** `settings.importForeignConfigs`. */
+  includeForeign: boolean;
+  /**
+   * Default true. False drops every `source: 'project'` root (native and
+   * foreign). The seam for SDK hosts that open untrusted repos: a project file
+   * writes a prompt (command body, subagent system prompt) the user did not,
+   * so such hosts load user-level files only. Headless sets it false unless
+   * `--project-agents` is passed.
+   */
+  includeProject?: boolean;
+}
+interface LoadMarkdownCommandsOptions extends LoadMarkdownOptions {
+  /**
+   * True when an enabled skill answers `/<name>`. Skills win that name, as in
+   * Claude Code, so the file command is dropped with a diagnostic instead of
+   * silently hiding the skill.
+   */
+  isSkillName?: (name: string) => boolean;
+}
+/** Markdown slash commands, first-wins by name in root order. Never throws. */
+declare function loadMarkdownCommands(opts: LoadMarkdownCommandsOptions): {
+  commands: Command[];
+  diagnostics: MarkdownDefDiagnostic[];
+};
+/**
+ * Builtin Explore/Plan plus markdown agents. Files override builtins;
+ * among files, first-wins by name in root order. Never throws.
+ */
+declare function loadMarkdownAgents(opts: LoadMarkdownOptions & {
+  modelContext: ModelAliasContext;
+}): {
+  subagents: SubagentRegistry;
+  diagnostics: MarkdownDefDiagnostic[];
+};
+/**
+ * Fold markdown/builtin agents into the preset's spawn tool, filling gaps
+ * only: an agent the profile or an extension already registered keeps its
+ * definition. Runs after `composeExtensionPreset`, so precedence is
+ * builtin < file < extension without threading files through composition.
+ */
+declare function applyMarkdownSubagents(preset: Preset, subagents: SubagentRegistry): Preset;
+//#endregion
 //#region src/tools/call-tool.d.ts
 declare const CALL_TOOL_NAME = "call_tool";
 /** The inner call a `call_tool` envelope carries. */
@@ -125,7 +243,7 @@ declare const DOING_TASKS_DOCTRINE = "# Doing tasks\n- Match the verb of the req
  * heavy lifting at the wire level; this prompt nudges the model away from
  * the access patterns that defeat them.
  */
-declare const TOKEN_DISCIPLINE_DOCTRINE = "# Working efficiently\n- Search first (`grep` / `glob`), then `read_file` the specific file. Don't open a 2000-line file for one function.\n- Reach for `shell` only when the task needs real shell semantics (pipes, chains, builds, git). For plain searches and reads the dedicated tools honor .gitignore, clip runaway lines, and have no quoting pitfalls.\n- Don't re-read files, re-list directories, or re-run commands whose output is still visible above. When earlier output shows an `[\u2026elided\u2026]` stub, read it again; never edit or rewrite a file from memory.\n- Prefer `edit` / `multi_edit` over `write_file` for changes to existing files.\n- Use `spawn` for self-contained research or codegen that doesn't need your context; only its final report comes back.\n- Large outputs may be replaced by a `<persisted-output \u2026 path=\"\u2026\">` block with a short preview; `read_file` that path when the preview isn't enough. Copy load-bearing data into your response text before it scrolls away.";
+declare const TOKEN_DISCIPLINE_DOCTRINE = "# Working efficiently\n- Search first (`grep` / `glob`), then `read_file` the specific file. Don't open a 2000-line file for one function.\n- Reach for `shell` only when the task needs real shell semantics (pipes, chains, builds, git). For plain searches and reads the dedicated tools honor .gitignore, clip runaway lines, and have no quoting pitfalls.\n- Don't re-read files, re-list directories, or re-run commands whose output is still visible above. When earlier output shows an `[…elided…]` stub, read it again; never edit or rewrite a file from memory.\n- Prefer `edit` / `multi_edit` over `write_file` for changes to existing files.\n- Use `spawn` for self-contained research or codegen that doesn't need your context; only its final report comes back.\n- Large outputs may be replaced by a `<persisted-output … path=\"…\">` block with a short preview; `read_file` that path when the preview isn't enough. Copy load-bearing data into your response text before it scrolls away.";
 /**
  * User-facing communication style. Lifted from claude-code's
  * `# Communicating with the user` + `# Tone and style` sections (~404-442).
@@ -836,6 +954,87 @@ interface RunUpdateCommandResult {
  */
 declare function runUpdateCommand(options: RunUpdateCommandOptions): Promise<RunUpdateCommandResult>;
 //#endregion
+//#region src/chat/hints.d.ts
+/**
+ * Single hint entry — `<key> <label>`, optionally followed by an inline
+ * secondary chord (`<key><extra.key> <label> <extra.label>`) for compound
+ * shortcuts like `ctrl+m/n model effort`.
+ *
+ * Colour fields are advisory hex strings (resolved against the active
+ * theme by the renderer); leaving them undefined lets the renderer pick
+ * its conventional fallback (e.g. `warn` for keys, `dim` for labels,
+ * `mute` for secondary).
+ */
+interface Hint {
+  key: string;
+  label: string;
+  /** Optional override for the key color. Renderer default: warn. */
+  keyColor?: string;
+  /** Optional override for the label color. Renderer default: dim. */
+  labelColor?: string;
+  /**
+   * Optional secondary chord + value rendered inline after the primary
+   * pair: `<key><extra.key> <label> <extra.label>`. Lets one hint advertise
+   * a compound shortcut (e.g. `ctrl+m/n model effort`) without forcing
+   * callers into a parallel struct or a custom renderer.
+   */
+  extra?: {
+    key: string;
+    label: string;
+    /**
+     * Dispatchable binding spec behind `extra.key` when the displayed
+     * chord is an abbreviation (`/l` for `ctrl+l` — see `shortChord`).
+     * The abbreviation itself doesn't parse as a keypress, so a renderer
+     * that makes the secondary chord independently clickable needs the
+     * full spec. Defaults to `extra.key` when omitted.
+     */
+    keySpec?: string;
+    /** Defaults to mute on the renderer side. */
+    keyColor?: string;
+    /** Defaults to dim on the renderer side. */
+    labelColor?: string;
+  };
+}
+/**
+ * Truncate `text` to at most `max` characters, replacing the trailing
+ * overflow with `…`. Edge cases:
+ *   - `max <= 0` → empty string (no room to render at all).
+ *   - `max === 1` → just the ellipsis glyph.
+ *   - `text.length <= max` → unchanged.
+ *
+ * Trailing-style truncation matches the natural read order of titles:
+ * the prefix carries enough signal to identify the surface.
+ */
+declare function truncateTrailing(text: string, max: number): string;
+/**
+ * Plain-text width estimate for a list of {@link Hint}s rendered as
+ * `<key> <label> · <key> <label> · …`. Exported so prompt-box overlays
+ * can run the same responsive math as the bottom-bar footer when
+ * deciding whether trigger hints fit. Pure / total.
+ */
+declare function hintsLength(hints: readonly Hint[]): number;
+/**
+ * Stable empty list so callers can compare by reference. Exported so
+ * any consumer that needs to feed "no primary hints" into the same
+ * `clipHintsToWidth` / `renderHintSpans` pipeline (e.g. the TUI's
+ * minimal UI mode, where the prompt overlay shows only `@` / `/`
+ * triggers) reuses the same frozen array instead of allocating a new
+ * one each render.
+ */
+declare const EMPTY_HINTS: readonly Hint[];
+/**
+ * Return the longest prefix of `hints` whose rendered width fits within
+ * `budget`. Used to degrade hint rows gracefully at narrow terminal
+ * widths instead of letting an absolutely-positioned hint row wrap
+ * mid-segment (which paints the overflow over surrounding borders and
+ * looks like garbled glyphs in a TUI).
+ *
+ * Prefix-only (no reordering, no last-hint priority) so the survivors
+ * keep their authored order — the user's muscle memory for "leftmost
+ * hint = primary action" stays intact as the terminal shrinks.
+ */
+declare function clipHintsToWidth(hints: readonly Hint[], budget: number): readonly Hint[];
+//#endregion
 //#region src/chat/auto-update-hook.d.ts
 interface UseUpdateCheckOptions {
   /** npm package name. e.g. `'zidane-tui'`. */
@@ -1075,16 +1274,44 @@ interface ClaudeCopyResult {
   duplicates?: string[];
 }
 interface ClaudeImportSummary {
+  /**
+   * Where the import landed: always this computer (its session store and
+   * its `.zidane` files). Claude Code's data is read from this machine, so
+   * the import never targets a remote host.
+   */
+  target: 'this-computer';
   sessions?: ClaudeSessionImportResult;
   mcps?: ClaudeCopyResult;
   skills?: ClaudeCopyResult;
+  commands?: ClaudeCopyResult;
+  agents?: ClaudeCopyResult;
   /** What is deliberately NOT imported, spelled out for the UI. */
   notes: string[];
 }
+/** The host a window is using, as far as the import note cares. */
+interface ClaudeImportActiveHost {
+  kind: 'in-process' | 'daemon' | 'server';
+  name: string;
+}
+/**
+ * What to tell the user when the window's sessions live on a remote host:
+ * the import went to this computer, so the host's list won't show it.
+ * `null` for a host on this machine (it shares the store).
+ */
+declare function claudeImportHostNote(activeHost: ClaudeImportActiveHost | null | undefined): string | null;
+/**
+ * Import Claude Code data from THIS machine into THIS machine: `store` must
+ * be the local session store (never a remote host's), MCP servers, skills,
+ * commands and subagents go to this machine's `.zidane` files. Pass `activeHost` (the
+ * window's host) to get the remote-host note in `notes`.
+ */
 declare function importFromClaudeCode(store: SessionStore, opts?: ClaudeImportOptions & {
   sessions?: boolean;
   mcps?: boolean;
   skills?: boolean;
+  commands?: boolean;
+  agents?: boolean;
+  activeHost?: ClaudeImportActiveHost | null;
 }): Promise<ClaudeImportSummary>;
 //#endregion
 //#region src/chat/completion-artifacts.d.ts
@@ -1108,164 +1335,1644 @@ declare function createArtifactsCompletionProvider(opts: {
   limit?: number;
 }): CompletionProvider<ArtifactReferenceData>;
 //#endregion
-//#region src/chat/config-context.d.ts
-declare function ConfigProvider({
-  config,
-  children
-}: {
-  config: ResolvedConfig;
-  children: ReactNode;
-}): import("react").JSX.Element;
-declare function useConfig(): ResolvedConfig;
+//#region src/start/shared-options.d.ts
+declare const startProviderNames: readonly ["anthropic", "openai", "openrouter", "cerebras", "xai", "arcee", "baseten", "local", "openai-compat"];
+type StartProviderName = typeof startProviderNames[number];
+declare const startPresetNames: readonly ["basic"];
+type StartPresetName = typeof startPresetNames[number];
+declare const startFormatNames: readonly ["zidane", "provider"];
+type StartFormatName = typeof startFormatNames[number];
+interface StartLocalOptions {
+  system?: string;
+  prompt: string;
+  model?: string;
+  baseURL?: string;
+  apiKeyEnv?: string;
+  headersEnv?: string;
+  extraHeaders?: Record<string, string>;
+  vision?: boolean;
+  imageInToolResult?: boolean;
+  temperature?: number;
+  seed?: number;
+  preset: StartPresetName;
+  thinking: ThinkingLevel;
+  provider: StartProviderName;
+  context: string;
+  image?: string;
+  cwd?: string;
+  env?: Record<string, string>;
+  pregame?: {
+    name: string;
+    content: string;
+  };
+  sandboxId?: string;
+  sandboxOnDestroy?: 'kill' | 'pause' | 'leave';
+  mcp?: McpServerConfig[];
+  sessionDb?: string;
+  sessionId?: string;
+  schema?: Record<string, unknown>;
+  json: boolean;
+  streamJson: boolean;
+  format: StartFormatName;
+}
 //#endregion
-//#region src/chat/discovery-context.d.ts
-interface DiscoveryContextValue {
-  /** Parsed `SkillConfig[]` from project + user scan paths. */
-  skillsCatalog: readonly SkillConfig[];
-  /**
-   * Agent Plugins loaded from `.agents/plugins` / `.{prefix}/plugins`
-   * (project + user). Includes rejected plugins — they render as read-only
-   * diagnostics rather than vanishing.
-   */
-  pluginsCatalog: readonly DiscoveredPlugin[];
-  /** Parsed `mcps.json` entries. */
-  mcpsCatalog: readonly DiscoveredMcp[];
-  /** Non-fatal parse errors from `mcps.json` lookups. */
-  mcpsErrors: readonly DiscoveryError[];
-  /**
-   * Per-server full tool catalog from the on-disk cache (see
-   * `chat/mcp-tools-cache.ts`). Updated as MCP servers bootstrap and
-   * fire the `mcp:tools:list` hook. Missing key → no cache yet; the
-   * settings UI surfaces an empty-state row under the expanded server.
-   */
-  mcpToolsByServer: Record<string, readonly McpToolSchema[]>;
-  /** Current file walk results — empty until lazy-load lands. */
-  filesCatalog: readonly FileEntry[];
-  /** Force a fresh skills rescan. Resolves once state is committed. */
-  refreshSkills: () => Promise<void>;
-  /** Force a fresh plugin rescan. Resolves once state is committed. */
-  refreshPlugins: () => Promise<void>;
+//#region src/chat/keybindings.d.ts
+/**
+ * Every action the keybindings system can drive. Adding a new action
+ * here forces every consumer (TUI keyboard handler, hint rows, settings
+ * UI) to handle it, and ships a default that the user can override.
+ */
+type KeyAction = 'openSettings' | 'openSessionDetails' | 'newSession' | 'openModelPicker' | 'openEffortPicker' | 'openTodos' | 'openArtifacts' | 'panelNext' | 'panelPrev' | 'openContextPanel' | 'openMainSession' | 'openUsagePanel' | 'openKeybindings' | 'openPalette' | 'cycleAgent' | 'enterSelectTurnMode' | 'cancelToolCall' | 'abortRun' | 'changeCwd' | 'attachClipboardImage' | 'openExternalEditor' | 'enterQueueSelection' | 'pushQueuedMessage' | 'dropQueuedMessage' | 'turnFork' | 'turnDelete' | 'turnCopy' | 'turnEdit' | 'sessionDelete' | 'sessionCopyId' | 'sessionGenerateTitle' | 'sessionExportMarkdown' | 'sessionExportJson' | 'sessionCompact';
+/** Resolved keybindings — every action has a current spec string. */
+type KeyBindings = Record<KeyAction, string>;
+/**
+ * Resolved spec string for one extension-contributed keybinding. Same
+ * shape as a built-in {@link KeyBindings} entry but the `id` is
+ * extension-owned (no `KeyAction` union member). The TUI dispatcher
+ * iterates these alongside the built-ins; user overrides flow through
+ * the same `keybindings.json` file by matching on `id`.
+ */
+interface ResolvedExtensionKeybinding {
+  /** Extension-owned id (matches `ExtensionKeybinding.id`). */
+  id: string;
+  /** Active spec string — user override when present, default otherwise. May be empty (= unbound). */
+  spec: string;
+}
+/**
+ * Logical grouping for one action — used by the keybindings panel to
+ * render section headers. Stable strings (not an enum) so future
+ * groups can be added without churning every existing entry.
+ */
+type KeyBindingGroup = 'Global' | 'Message queue' | 'Turn details' | 'Session details';
+/** Static metadata for one action — used by the loader, hint rows, settings UI. */
+interface KeyBindingDef {
+  /** Stable identifier — JSON key + TS union member. */
+  action: KeyAction;
+  /** Default trigger spec (e.g. `'ctrl+o'`). */
+  default: string;
+  /** Short label used in shortcut hint rows. */
+  label: string;
+  /** Longer description for the settings UI and the annotated JSON file. */
+  description: string;
   /**
-   * Re-parse `mcps.json`. Sync-shaped under the hood, async for symmetry.
-   * Resolves `true` when the catalog actually changed (a publish that
-   * schedules downstream agent rebuilds), `false` on a fingerprint no-op
-   * or scan failure — callers that arm rebuild-coupled state (e.g. the
-   * add-MCP auto-login) disarm on `false`.
+   * Group label rendered as a section header in the keybindings panel.
+   * Items are listed in {@link KEYBINDING_DEFS} order; the panel just
+   * inserts a header whenever this field changes between adjacent
+   * entries — so groups stay contiguous and the order here is the
+   * order on screen.
    */
-  refreshMcps: () => Promise<boolean>;
-  /** Force a fresh file walk. Wired into a future "refresh files" affordance. */
-  refreshFiles: () => Promise<void>;
-  /** Idempotent first-load trigger for skills (used by `/` popover + modal mount). */
-  ensureSkills: () => Promise<readonly SkillConfig[]>;
-  /** Idempotent first-load trigger for files (used by `@` popover). */
-  ensureFiles: () => Promise<readonly FileEntry[]>;
+  group: KeyBindingGroup;
 }
-declare function DiscoveryProvider({
-  value,
-  children
-}: {
-  value: DiscoveryContextValue;
-  children: ReactNode;
-}): import("react").JSX.Element;
 /**
- * Read live discovery state + actions. Throws if used outside a
- * `<DiscoveryProvider>` — discovery is a load-bearing dependency for
- * settings + completion popovers; bailing loud here surfaces wiring
- * mistakes at mount instead of producing empty catalogs at first
- * keystroke.
+ * The canonical action catalog. Order is the source of truth for the
+ * generated keybindings file and the settings UI.
  */
-declare function useDiscovery(): DiscoveryContextValue;
+declare const KEYBINDING_DEFS: readonly KeyBindingDef[];
+/** Index by action for O(1) lookup of label / description / default. */
+declare const KEYBINDING_DEF_BY_ACTION: Readonly<Record<KeyAction, KeyBindingDef>>;
+/** Defaults, derived from {@link KEYBINDING_DEFS} so the two never drift. */
+declare const DEFAULT_KEYBINDINGS: KeyBindings;
 /**
- * Non-throwing variant — returns `null` when no provider is mounted.
- * Used by composable modals (`<SettingsModal>`, …) that accept catalog
- * props as a fallback for embedders who don't wire the full TUI
- * shell. The in-app flow always mounts `<DiscoveryProvider>` so the
- * modal sees live state; standalone embeds get the prop snapshot.
+ * Test a KeyEvent against a parsed-or-string binding. Accepts either
+ * form so callers can pre-parse (hot path) or pass the raw spec for
+ * one-off checks.
+ *
+ * Modifier semantics: ALL declared modifiers must be pressed AND no
+ * extra modifiers may be pressed. So `'o'` does NOT match `ctrl+o`,
+ * and `'ctrl+o'` does NOT match `ctrl+shift+o`. This avoids surprises
+ * where a binding that should be specific accidentally fires for a
+ * superset of key combinations.
  */
-declare function useDiscoveryOptional(): DiscoveryContextValue | null;
-//#endregion
-//#region src/chat/discovery-slot.d.ts
+declare function matchesBinding(event: {
+  name?: string;
+  ctrl?: boolean;
+  shift?: boolean;
+  meta?: boolean;
+  option?: boolean;
+  alt?: boolean;
+}, spec: string | ParsedBinding): boolean;
+/**
+ * Render a binding spec (`"ctrl+return"`, `"backspace"`, `"delete"`) as a
+ * compact display string the user recognizes at a glance. Substitutes
+ * arrow / enter / backspace glyphs for their verbose names so the hint
+ * row stays narrow; modifier names + plain keys pass through unchanged.
+ *
+ * Empty / missing specs return an empty string — callers decide whether
+ * to render a placeholder (e.g. `'—'` for an unbound action in the
+ * keybindings panel) or hide the surface entirely (e.g. hint rows that
+ * fall back to a different chord when the binding is empty).
+ */
+declare function formatBindingForDisplay(spec: string | null | undefined): string;
+/**
+ * Merge a partial map of user overrides into the defaults. Unknown
+ * action keys are dropped (a future TUI version may have retired the
+ * action); invalid spec strings (parse fails) fall back to the default
+ * for that action.
+ */
+declare function mergeKeybindings(overrides: Readonly<Record<string, unknown>> | null | undefined): KeyBindings;
+/**
+ * A `keybindings.json` value as one spec: a string, or an array of chords
+ * (`["ctrl+w", "cmd+w"]`) joined as alternatives. Chords that don't parse
+ * are dropped; `null` when none is left.
+ */
+declare function normalizeBindingValue(raw: unknown): string | null;
+/** Path of the user-level keybindings file. */
+declare function keybindingsPath(userDir: string): string;
+/**
+ * One contiguous section of the catalog — every action in a single
+ * `group` rendered together with the section header inserted once.
+ * Adjacent sections with the same group are NOT merged: catalog order
+ * wins so the on-screen story matches the on-disk file.
+ *
+ * `rows` may carry built-in `KeyBindingDef`s (the common case) or
+ * extension-owned ones (when an extension contributes a keybinding).
+ * Both share label / description / spec — see {@link KeyBindingRow}.
+ */
+interface KeyBindingSection {
+  group: string;
+  rows: ReadonlyArray<KeyBindingRow>;
+}
 /**
- * Stale-while-revalidate catalog slot.
+ * One row in the keybindings catalog. Either a built-in action (with
+ * its `def`) or an extension-contributed one (with `id` instead). The
+ * renderer reads `label` / `description` / `spec` uniformly and only
+ * needs the `kind` discriminator when offering action-specific UI
+ * (e.g. "edit in keybindings.json" by action name).
+ */
+type KeyBindingRow = {
+  kind: 'builtin';
+  def: KeyBindingDef;
+  spec: string;
+} | {
+  kind: 'extension';
+  id: string;
+  label: string;
+  description: string;
+  spec: string;
+};
+/**
+ * Walk {@link KEYBINDING_DEFS} in order and bucket rows into contiguous
+ * sections by `group`. Shared between the standalone `KeybindingsModal`
+ * and the `Keybindings` tab inside `SettingsModal` so both surfaces
+ * render the same catalog with the same ordering rules.
  *
- * One slot per (catalog kind, projectDir) pin. Holds the first-load
- * promise + a `lastScannedAt` timestamp + an in-flight `refreshing`
- * promise. Idempotent across concurrent callers, safe to rotate when
- * the project changes (the slot's `abort` controller cancels in-flight
- * walks and the `.then` guards drop stale results).
+ * Pass `extensionRows` (resolved extension keybindings paired with
+ * their definitions) to append an "Extensions" section at the end so
+ * extension-contributed shortcuts are discoverable in the same UI.
+ */
+declare function groupBindings(bindings: KeyBindings, extensionRows?: readonly {
+  id: string;
+  label: string;
+  description: string;
+  spec: string;
+}[]): readonly KeyBindingSection[];
+/**
+ * Width (in cells) of the fixed key column used by every binding-row
+ * renderer. Derived once from {@link KEYBINDING_DEFS} so a new action
+ * with a wider default spec (`ctrl+shift+x`, …) automatically grows
+ * the column instead of truncating the label.
+ */
+declare const KEYBINDING_KEY_COL_WIDTH: number;
+/**
+ * Load + merge the user's keybindings file (when present). Always
+ * returns a fully-resolved {@link KeyBindings} — defaults fill in for
+ * any missing / invalid entries so consumers can treat the result as
+ * total.
  *
- * Renderer-agnostic. AppShell wraps it in React refs so React closures
- * stay stable; a non-TUI shell can use it directly against its own
- * state propagation.
+ * Failure modes (all tolerated, all fall back to defaults):
+ *   - File missing
+ *   - File not valid JSON / JSONC (after comment stripping)
+ *   - Top-level is not an object
+ *   - Individual entries have invalid spec strings
+ */
+declare function readKeybindings(userDir: string): KeyBindings;
+/**
+ * Create the user-level `keybindings.json` if it doesn't exist,
+ * prefilled with every default. Returns the absolute file path either
+ * way so the caller can open it in `$EDITOR`. Idempotent: an existing
+ * user file is NEVER overwritten — the user's customizations are
+ * sacred.
+ */
+declare function ensureKeybindingsFile(userDir: string): string;
+/**
+ * Read the raw on-disk JSON object from `keybindings.json` after the
+ * JSONC stripper. Used by extension-keybinding resolution so the
+ * user's overrides for extension-owned ids flow through the same file
+ * the built-in actions use.
  *
- * Contract:
- *   - `ensure()` — kick the first load if not started; return the
- *     cached promise. On subsequent calls, if `Date.now() -
- *     lastScannedAt >= throttleMs` and no refresh is in flight, kick
- *     a background revalidate that calls `onLoad(fresh)` when it
- *     resolves. The original first-load promise still resolves with
- *     the first walk's contents — consumers reading live state
- *     elsewhere (React state) see the refreshed catalog.
- *   - `refresh()` — force a rescan now, bypassing the throttle.
- *     De-duplicates: if a refresh is already in flight, returns the
- *     same promise.
- *   - `abort()` — cancel any in-flight walk and detach. After this
- *     the slot is dead; callers should rotate to a new slot.
- *   - `dispose()` — alias of `abort()`, named for symmetry with
- *     cleanup callbacks.
+ * Returns an empty object on missing / malformed / non-object files
+ * — same fault-tolerance contract as {@link readKeybindings}.
+ */
+declare function readKeybindingsRaw(userDir: string): Readonly<Record<string, unknown>>;
+/**
+ * Resolve the live spec string for each extension-contributed
+ * keybinding. The user's `keybindings.json` is consulted for an
+ * override on the binding's `id`; absent / invalid entries fall back
+ * to the binding's `default`.
  *
- * No state is exposed except through promises + the host's `onLoad`
- * callback; the slot doesn't try to be a store, only a coordinator.
+ * Pass the raw object (from {@link readKeybindingsRaw}) — passing
+ * `KeyBindings` here wouldn't help because the typed map only carries
+ * built-in `KeyAction` entries.
+ *
+ * Returns one entry per input binding, in source order. Empty `spec`
+ * (binding declared `default: ''` and the user didn't bind it) is a
+ * legitimate "unbound" state — the dispatcher never matches an empty
+ * spec, so the action stays accessible via re-binding through
+ * `keybindings.json`.
  */
-/** Walk function — takes an abort signal, returns the discovered list. */
-type Walk<T> = (signal: AbortSignal) => Promise<readonly T[]>;
-/** Notification: a fresh walk has resolved. Host is expected to commit to its own state store. */
-type Commit<T> = (items: readonly T[]) => void;
-interface DiscoverySlotOptions<T> {
-  /** Discover function — runs the actual FS / network walk. */
-  walk: Walk<T>;
-  /** Commit hook — receives every successful walk's result (first + refreshes). */
-  onLoad: Commit<T>;
+declare function resolveExtensionKeybindings(bindings: readonly {
+  id: string;
+  default: string;
+}[], raw: Readonly<Record<string, unknown>>): ResolvedExtensionKeybinding[];
+/**
+ * Strip `//` line comments and `/* … *\/` block comments from a JSONC
+ * source string. Stays out of string literals so a `"foo // bar"` value
+ * keeps its slashes. Exported for unit-tests; the only runtime caller
+ * is {@link readKeybindings}.
+ *
+ * Trade-off: this is a tiny state-machine, not a full JSONC parser. It
+ * doesn't understand `\\` outside strings (irrelevant for JSON) and
+ * doesn't track line numbers in error messages. Good enough for a
+ * config file — corruption in production gracefully falls back to the
+ * defaults via the try/catch in `readKeybindings`.
+ */
+declare function stripJsonComments(input: string): string;
+//#endregion
+//#region src/chat/store.d.ts
+interface TuiState {
+  lastProvider?: ProviderKey;
+  lastSessionId?: string;
   /**
-   * Min interval between background refreshes triggered by `ensure()`.
-   * Default: 3_000ms. `refresh()` ignores this — it's the user's
-   * explicit-intent path.
+   * The host key of the saved server `lastSessionId` lives on (for a server,
+   * its host id: `src/chat/hosts/session-key`), absent for a session on this
+   * computer. Resume reopens it there, and only with remote hosts on. A
+   * `--host` session writes neither field (see `lastSessionId`).
+   * Read from the older `lastSessionHostId` too ({@link loadState}).
    */
-  throttleMs?: number;
-  /** Optional error sink. Defaults to no-op; useful for `debugLog`. */
-  onError?: (err: unknown, phase: 'first-load' | 'refresh') => void;
+  lastSessionHostKey?: string;
+  /** Per-provider last-used model id. */
+  lastModelByProvider?: Partial<Record<ProviderKey, string>>;
+  /**
+   * Last-applied model fallback chain (entry 0 = primary, mirroring
+   * `lastProvider` + `lastModelByProvider`; entries 1+ = fallbacks).
+   * Additive — absent for single-model users and older state files.
+   * Restored on launch only when entry 0 still matches the resolved
+   * primary; entries are re-validated against the live registry.
+   */
+  lastModelChain?: ModelChainEntry[];
+  /**
+   * Per-model last-picked reasoning effort. Keyed by model id (not provider)
+   * so switching the same model across providers preserves the user's
+   * intent. Models without reasoning support are absent from the map.
+   */
+  lastEffortByModel?: Record<string, ThinkingLevel>;
+  /**
+   * Per-model last-picked custom options (e.g. `{ fast: true }`). Keyed by
+   * model id like {@link lastEffortByModel}, so a toggle follows the model
+   * across providers. Models with no options are absent from the map.
+   */
+  lastModelOptionsByModel?: Record<string, Record<string, boolean>>;
+  /**
+   * Last-active agent profile id (see {@link AgentRegistry}). Resumed on
+   * launch so a returning user lands back in the same mode (Build / Plan /
+   * a host profile). Falls back to the host's `defaultAgent` then the first
+   * registry key if the id is no longer registered.
+   */
+  /**
+   * @deprecated No longer read: the agent profile is per-session and fresh
+   * sessions always start in the default. Kept so older state files parse.
+   */
+  lastAgent?: string;
+  /** User-toggled transcript filters. Persisted so they outlive a launch. */
+  settings?: Partial<Settings>;
 }
-interface DiscoverySlot<T> {
+interface StateStoreApi {
+  load: () => TuiState;
+  save: (state: TuiState) => void;
+}
+declare function createStateStore(path: string): StateStoreApi;
+declare function loadState(path: string): TuiState;
+declare function saveState(path: string, state: TuiState): void;
+/**
+ * Load every session and project it to the compact `SessionMeta` shape used by
+ * the picker. Sorted by recency via the underlying store's `list()` contract
+ * (sqlite store returns by `updated_at DESC`).
+ *
+ * Robust to per-row failures: `Promise.allSettled` so a single corrupt or
+ * unreadable row (malformed JSON, partial write, transient I/O error)
+ * doesn't take down the entire picker. Failed rows are silently skipped;
+ * a stderr line is emitted under `ZIDANE_DEBUG` for diagnosis.
+ */
+declare function listSessionMeta(store: SessionStore, filter?: {
   /**
-   * Kick the first load (idempotent). Returns the first-load promise
-   * once it exists. Schedules a background refresh if past throttle.
+   * Restrict to sessions belonging to this project. Omit to ignore
+   * the axis; pass `null` to ask for untagged (legacy) sessions
+   * specifically. The TUI defaults to passing the current git root /
+   * cwd here so each project sees only its own conversations.
    */
-  ensure: () => Promise<readonly T[]>;
-  /** Force-refresh now. De-duped across concurrent callers. */
-  refresh: () => Promise<void>;
-  /** True if a refresh is currently running. */
-  isRefreshing: () => boolean;
-  /** Cancel in-flight work + detach. Idempotent. */
-  abort: () => void;
+  projectRoot?: string | null;
+}): Promise<SessionMeta[]>;
+/** The environment summary for list rows — omitted for local sessions (the common case). */
+declare function sessionEnvironmentSummary(metadata: Record<string, unknown> | undefined): SessionEnvironmentSummary | undefined;
+/** {@link SessionHeader} of a fully materialized session. */
+declare function headerFromData(data: SessionData): SessionHeader;
+/**
+ * One session's header, without reading its turns when the store keeps a
+ * header index (`getMeta`). A full load when it doesn't, or when the title
+ * still has to be derived from the first message.
+ */
+declare function getSessionHeader(store: SessionStore, id: string): Promise<SessionHeader | null>;
+/** Derive a short title from the first user message — returns null when empty. */
+declare function titleFromTurns(turns: SessionTurn[]): string | null;
+/**
+ * Display title for a session — preferred sources, in order:
+ *
+ *   1. `metadata.title` if it's a non-empty string (typically set by
+ *      the session-details modal's "generate title" action).
+ *   2. {@link titleFromTurns} — the first user message, one-line + clipped.
+ *   3. {@link DEFAULT_SESSION_TITLE} (`'New session'`).
+ *
+ * Total / pure / defensive on non-string metadata values.
+ */
+declare function deriveSessionTitle(turns: SessionTurn[], metadata?: Record<string, unknown>): string;
+/**
+ * Replay persisted turns as a viewable transcript. Mirrors the event shape
+ * produced live by the agent hooks so loaded and streaming history render
+ * identically — including subagent ancestry when `runs` is supplied.
+ *
+ * Subagent reconstruction:
+ *   - Every turn carries a `runId`. We look that up in `runs` to get the
+ *     run's `depth` and tag the resulting events with `{ depth, childId }`
+ *     — the same shape the live `child:*` bubble hooks produce.
+ *   - We synthesize `spawn-start` / `spawn-end` markers at each child-run
+ *     boundary so the transcript reads the same as a live run did
+ *     (`🌱 [run-id] task` … child events … `🌳 [run-id] done · tokens`).
+ *   - For child runs (`depth > 0`), the user-role "task" text is suppressed
+ *     because `spawn-start` already shows it.
+ *
+ * Without `runs` (legacy callers / tests), the function falls back to the
+ * old behavior: depth-0 events with no subagent grouping.
+ */
+/**
+ * Map a `compact-summary` content block to its `compact-summary` StreamEvent —
+ * the single source of truth for the compaction boundary card. Used by
+ * {@link eventsFromTurns} (reload / TUI live repaint) AND by chat hosts that
+ * surface the boundary live without a full reload (the GUI broadcasts this
+ * from the loop's `compact:end` hook), so the live card and the reloaded card
+ * are byte-identical regardless of who created the marker (manual, the old
+ * host trigger, or loop-native auto-compaction — all share this block shape).
+ */
+declare function compactSummaryEvent(block: Extract<SessionContentBlock, {
+  type: 'compact-summary';
+}>, turnId?: string): StreamEvent;
+declare function eventsFromTurns(turns: SessionTurn[], runs?: readonly SessionRun[]): StreamEvent[];
+/**
+ * The whole replay, and where each turn's events start in it
+ * (`turnStarts[turns.length]` = the end). A page of turns `[from, to)` is
+ * `events.slice(turnStarts[from], turnStarts[to])`: consecutive pages
+ * concatenate to exactly {@link eventsFromTurns} (exchange separators, run
+ * receipts, subagent markers, tool names and command state as the whole
+ * replay has them), because what a run or the turn before decides lands in
+ * the page of the turn whose replay emitted it.
+ */
+declare function replayTurns(turns: SessionTurn[], runs: readonly SessionRun[]): {
+  events: StreamEvent[];
+  turnStarts: number[];
+};
+declare function toolCallPreview(name: string, input: Record<string, unknown>): string;
+/**
+ * Update the trailing `'tool'` event matching `callId` so its
+ * `edit.outcomes` reflects the canonical merged outcomes the chat
+ * layer's `tool:transform` hook just computed. Without this, the live
+ * diff badges stay frozen at whatever the gate set (approval-side
+ * outcomes) and never reflect body-side failures from `multi_edit`'s
+ * best-effort run — only a session reload re-attaches the merged
+ * outcomes via {@link eventsFromTurns}.
+ *
+ * Walks back-to-front because the matching event is overwhelmingly the
+ * most recent (we're updating right after the body returned). Returns
+ * the same reference when no match is found (or the event already
+ * carries the target outcomes), so React skips the re-render.
+ */
+declare function updateToolEventOutcomes(events: readonly StreamEvent[], callId: string, outcomes: readonly EditOutcome[]): StreamEvent[];
+/** Render tool output as plain text, whether it's a string or structured content. */
+declare function toolResultText(output: string | ToolResultContent[]): string;
+/**
+ * Strip the `Tokens: …` line from a spawn tool-result. The spawn-end marker
+ * displayed right above already shows the same stats; keeping the line in the
+ * rendered tool-result body just produces a visible duplicate (and, on
+ * reloaded pre-fix sessions, an *inconsistent* duplicate — the persisted line
+ * uses the old `13 in / 4075 out` shape while the freshly synthesized
+ * spawn-end uses the cache-aware `in 92615 (cache 92602) / 4075 out` shape).
+ *
+ * Display-only: the persisted tool_result content is untouched, so the LLM
+ * still sees the full string in its context window. Anchored to start-of-line
+ * and matches both `Tokens: 13 in / 4075 out` (legacy) and `Tokens: in 13 …`
+ * (post-`formatTokenUsage`) shapes.
+ */
+declare function stripSpawnTokensLine(text: string): string;
+/**
+ * Resolve the top margin (in rows) for an event given the one rendered
+ * just before it. Context-aware rules:
+ *
+ *   - A `tool` / `tool-result` event right after another
+ *     `tool` / `tool-result` collapses to a tight list — call→result
+ *     pairs and back-to-back calls read as one logical block.
+ *   - Consecutive `task-notification` banners stack tight — a burst of
+ *     background-task completions reads as one log column rather than
+ *     scattered banners.
+ *
+ * NB: parent-level events (`depth === 0`) following a subagent block
+ * (`depth > 0`) get their normal default margin. An earlier revision
+ * collapsed this transition to 0 on the assumption that the subagent's
+ * `🌳` end-marker provided enough visual separation — it didn't. A
+ * 2-cell emoji on the same row as the close marker doesn't create a
+ * vertical break, and in hide-subagent-output mode the SubagentBlock
+ * box isn't rendered either, so the parent's follow-up markdown was
+ * glued directly against the close line. Subagents should READ like
+ * tool calls: open with breathing room, close tight inside, and open
+ * a clean gap before the parent's next thought — that's the contract
+ * the tool-call → markdown transition uses, mirrored here.
+ *
+ * Renderer-agnostic — TUI uses it as Yoga `marginTop`; a CSS host can
+ * use the same number as the row's top margin in `em` / `rem`.
+ */
+declare function marginTopFor(event: StreamEvent, previous: StreamEvent | undefined): number;
+/** Effective context size of the most recent assistant turn — drives the footer indicator. */
+/**
+ * Walk from the end of `turns` and return the cache-aware input-token total
+ * of the most recent **parent** (depth-0) assistant turn. Subagent turns
+ * are skipped because their context window is the child's, not the parent's
+ * — surfacing a subagent's `usage.input` as the footer's "context used"
+ * after a session ends mid-spawn would be misleading. The next prompt
+ * feeds the parent, so the parent's last view is what matters.
+ *
+ * Zero-context placeholder turns are also skipped. `executeTurn`
+ * synthesizes an assistant turn with `usage: { input: 0, output: 0 }`
+ * when the provider stream throws / aborts before any usage is reported
+ * (see `src/loop.ts`'s catch path) — that turn is purely a shape
+ * contract for resume, not a real context-window measurement. Without
+ * the skip, an abort mid-stream shadows the prior real turn and the
+ * footer reads `ctx 0` on the next session load even though earlier
+ * turns accumulated meaningful context (and `run.cost`).
+ *
+ * `runs` is optional for backwards compatibility (older call sites and
+ * tests that don't have ancestry info). Without it, this falls back to the
+ * pre-fix behavior — depth is unknown so every assistant turn qualifies.
+ */
+declare function lastContextSizeFromTurns(turns: SessionTurn[], runs?: readonly SessionRun[]): number;
+/**
+ * Sum provider-reported USD cost across every run in a session. Used to
+ * seed the live cost indicator on session activation. Returns 0 when no
+ * run carries a `cost` (most providers — only OpenRouter reports today).
+ */
+declare function sumRunCosts(runs: readonly SessionRun[]): number;
+/** Per-model token/spend totals across a session — see {@link usageByModel}. */
+interface ModelUsageSummary {
+  /** Provider-echoed model id, or `"unknown"` for turns that never recorded one. */
+  modelId: string;
+  turns: number;
+  /** Fresh (uncached) input tokens. */
+  input: number;
+  output: number;
+  cacheRead: number;
+  cacheCreation: number;
+  /** Summed USD cost across turns that carried one (provider-reported or estimated). */
+  cost: number;
+  /**
+   * `false` when at least one turn had no cost figure (no published rate
+   * for the model) — `cost` is then a floor, not a total.
+   */
+  costComplete: boolean;
 }
-declare function createDiscoverySlot<T>(options: DiscoverySlotOptions<T>): DiscoverySlot<T>;
+/**
+ * Aggregate per-model token + spend totals across every run in a session.
+ * Parent and subagent runs alike: each turn carries its own `modelId`, so
+ * cost-tiered delegation (cheap spawn workers) shows up as separate rows
+ * priced at their own rates. Sorted by cost (desc), then total tokens, so
+ * the biggest spender reads first.
+ */
+declare function usageByModel(runs: readonly SessionRun[]): ModelUsageSummary[];
 //#endregion
-//#region src/chat/editor-command.d.ts
+//#region src/chat/config.d.ts
 /**
- * `$EDITOR` / `$VISUAL` command parsing.
- *
- * These variables conventionally hold a command LINE, not a bare executable —
- * `code --wait`, `cursor --wait`, `subl -w`, `emacsclient -nw` are all normal
- * values. Spawning the whole string as argv[0] looks for a file literally named
- * `cursor --wait` and fails with ENOENT, so the flags have to be split off.
- *
- * Kept separate from `app.tsx` (and free of `node:child_process`) so the
- * tokenizer is unit-testable without pulling in the TUI.
+ * Provider registry — a map keyed by `descriptor.key`. Passed verbatim to the
+ * chat engine; there is no implicit merge with built-ins. Hosts that want the
+ * four default providers spread {@link BUILTIN_PROVIDERS}; hosts that only
+ * want their own pass exactly their own.
  */
+type ProviderRegistry = Readonly<Record<string, ProviderDescriptor>>;
 /**
- * Split an editor command line into `[executable, ...args]`.
- *
- * Whitespace-separated, with single and double quotes honored so an editor
+ * Options accepted by `resolveConfig()` (and, transitively, by `runTui()` and
+ * any future GUI launcher). Every field is optional — defaults boot a working
+ * chat against the built-in providers with sessions stored under `~/.zidane/`.
+ */
+interface ChatOptions {
+  /**
+   * Directory name used under `storageDir` for sessions + state.
+   * Default: `'.zidane'` → `~/.zidane/sessions.db` + `~/.zidane/state.json`.
+   * Pass e.g. `'.myapp'` for `~/.myapp/...`, or `'myapp'` for a visible dir.
+   */
+  prefix?: string;
+  /**
+   * Storage root. Defaults to the user's home directory. Combined with
+   * `prefix` to form the data directory.
+   */
+  storageDir?: string;
+  /**
+   * Provider registry. Each value is a {@link ProviderDescriptor} carrying
+   * label + factory + credential metadata. **No automatic merge** — hosts
+   * pass exactly what they want.
+   *
+   * - Omitted → {@link BUILTIN_PROVIDERS} (anthropic + openai + openrouter + cerebras).
+   * - `providers: BUILTIN_PROVIDERS` → same as omitted, but explicit.
+   * - `providers: { anthropic: anthropicDescriptor }` → only Anthropic.
+   * - `providers: { ...BUILTIN_PROVIDERS, mine: customDescriptor }` → built-ins + custom.
+   * - `providers: { mine: customDescriptor }` → custom-only, **no built-ins**.
+   */
+  providers?: ProviderRegistry;
+  /**
+   * Legacy single-agent preset (tools, system prompt, behavior). When set
+   * **without** {@link ChatOptions.agents}, the resolver wraps this preset
+   * into a one-entry {@link AgentRegistry} keyed `default` so existing
+   * callers keep working and the picker is effectively hidden.
+   *
+   * Prefer `agents` for any multi-profile setup. Passing both throws.
+   */
+  preset?: Preset;
+  /**
+   * Agent profile registry — keyed by `profile.id`. Each profile bundles a
+   * preset with display metadata (label, description, accent). The TUI
+   * shows a picker (Ctrl+A) when more than one profile is registered.
+   *
+   * - Omitted (and `preset` omitted) → {@link BUILTIN_AGENTS} (Build + Plan).
+   * - Omitted but `preset` provided → single-entry registry around the preset.
+   * - Provided → host owns the registry; pass exactly what you want.
+   *
+   * Hosts mixing built-ins with their own typically spread:
+   * `agents: { ...BUILTIN_AGENTS, debug: myDebugProfile }`.
+   */
+  agents?: AgentRegistry;
+  /**
+   * Id of the profile every fresh session (and the initial launch) starts
+   * in. Resolved against `agents`; unknown ids fall through to
+   * `DEFAULT_AGENT_ID`, then the registry's first key. Sessions remember
+   * the profile they were created with; this is never overridden by a
+   * previously picked profile.
+   */
+  defaultAgent?: string;
+  /**
+   * Session store — either an instance or a factory called with the
+   * resolved storage paths. **Required** at the chat layer so this module
+   * stays platform-agnostic (no `bun:sqlite` baked in). Terminal hosts use
+   * `createTuiStore` from `zidane/session/sqlite`; a future GUI host can
+   * supply a different adapter (IndexedDB, remote API, in-memory) without
+   * touching this layer.
+   *
+   * ```ts
+   * import { createTuiStore } from 'zidane/session/sqlite'
+   *
+   * // Either pass a factory…
+   * resolveConfig({ store: paths => createTuiStore(paths.db) })
+   *
+   * // …or an instance built ahead of time.
+   * const store = createTuiStore('/path/to/sessions.db')
+   * resolveConfig({ store })
+   * ```
+   */
+  store: SessionStore | ((paths: ResolvedPaths) => SessionStore);
+  /**
+   * Project-scoped session storage. Off by default; when it resolves
+   * to `true` and the launch happens inside a git repo, zidane
+   * auto-creates `<git-root>/.{prefix}/` and stores `sessions.db` +
+   * `state.json` there — so sessions, mcps.json, and skills all live
+   * alongside the project they belong to. Credentials and the
+   * cross-project safelist stay at `~/.{prefix}/` regardless.
+   *
+   * Precedence (most → least specific): `options.projectDb` >
+   * `ZIDANE_PROJECT_DB` env var (`0`/`false`/`off`/`no` → off,
+   * `1`/`true`/`on`/`yes` → on) > `~/.{prefix}/config.json`
+   * `projectDb` > `false`. Note the host option beats the env var —
+   * setting `ZIDANE_PROJECT_DB` has no effect when the host passes an
+   * explicit `projectDb`.
+   *
+   * When it resolves to `false`, OR when not inside a git repo,
+   * everything lives at `~/.{prefix}/` — the classic single-store
+   * layout.
+   */
+  projectDb?: boolean;
+  /**
+   * Override for the project root. Defaults to `process.cwd()`. Hosts
+   * embedding the TUI from a non-CLI context (tests, daemons) can pin
+   * the cwd here so the git-root walk produces a stable result. Has no
+   * effect when `projectDb` resolves to `false`.
+   */
+  cwd?: string;
+  /**
+   * Optional one-shot launch request used by CLI shells such as `zidane run`.
+   * The TUI opens/creates the requested session and submits the prompt after
+   * the first provider/session activation, while keeping the normal renderer
+   * and persistence behavior.
+   */
+  launch?: StartLocalOptions;
+  /**
+   * Auto-update wiring. When set, the App quietly checks the npm registry
+   * for a newer release of `packageName` (matching the host's package),
+   * caches the result for a day under `userDir/`, and surfaces a passive
+   * `↑ vX.Y.Z` chip in the footer when one is available.
+   *
+   * Consumers wrapping `runTui` for their own CLI inline their own
+   * `package.json` version at build time and pass it here. The bundled
+   * `zidane-tui` binary wires this automatically in `tui/src/cli.ts`.
+   *
+   * Defaults to `null` — no auto-update plumbing, no network calls,
+   * no chip.
+   */
+  autoUpdate?: AutoUpdateConfig | null;
+  /**
+   * Pre-built {@link ExtensionRegistry}. The `resolveConfig` surface is
+   * synchronous; extension `setup()` can be async, so the host must
+   * build the registry ahead of time and pass it here verbatim.
+   *
+   * Typical wiring (matches `runTui`):
+   *
+   * ```ts
+   * import {
+   *   buildExtensionRegistry,
+   *   discoverExtensions,
+   *   inlineLoadedExtension,
+   *   resolveConfig,
+   * } from 'zidane'
+   *
+   * const registry = await buildExtensionRegistry([
+   *   // Project-scoped extensions run arbitrary local code — they stay
+   *   // off unless the host establishes trust explicitly (or the user
+   *   // sets ZIDANE_TRUST_PROJECT_EXTENSIONS=1).
+   *   ...await discoverExtensions({ cwd, prefix, trustProjectExtensions: hostTrustsProject }),
+   *   ...inlineDefinitions.map(inlineLoadedExtension),
+   * ])
+   * const config = resolveConfig({ ...opts, extensionRegistry: registry })
+   * ```
+   *
+   * Omitted → empty registry (no contributions).
+   */
+  extensionRegistry?: ExtensionRegistry;
+  /**
+   * Extra extension scan roots the host used (or wants runtime re-discovery
+   * to use). Each path is a root containing extension dirs/packages:
+   * `<root>/<name>/index.ts`. `runTui` wires this from
+   * `ZIDANE_EXTENSION_DIRS` when omitted.
+   */
+  extensionScanPaths?: readonly string[];
+  /**
+   * Extra Agent Plugin scan roots. Each path is a root containing plugin
+   * directories: `<root>/<name>/plugin.json`. `runTui` wires this from
+   * `ZIDANE_PLUGIN_DIRS` when omitted.
+   *
+   * Appended after the four default roots, so a project or user plugin still
+   * wins a name collision against a dev root.
+   */
+  pluginScanPaths?: readonly string[];
+  /**
+   * Whether project-scoped extensions are trusted to run their (arbitrary,
+   * local) code. Off by default unless the embedding host has established
+   * project trust; falls back to `ZIDANE_TRUST_PROJECT_EXTENSIONS=1`.
+   *
+   * Surfaced on {@link ResolvedConfig.trustProjectExtensions} so a host
+   * that re-discovers extensions at runtime (e.g. the TUI on a working-
+   * directory change) reuses the same trust decision as boot.
+   */
+  trustProjectExtensions?: boolean;
+}
+/**
+ * Host-supplied auto-update settings. The check itself is gated on
+ * `Settings.checkForUpdates`; passing a config wires the React plumbing.
+ *
+ * Hosts that want to publish their own consumer-facing package can pass
+ * different values without forking anything — the registry / channel /
+ * platform-package-prefix are all knobs.
+ */
+interface AutoUpdateConfig {
+  /** Top-level npm package the user installs (`zidane-tui`, `my-app`, …). */
+  packageName: string;
+  /** Inlined at build time — usually `pkg.version`. */
+  currentVersion: string;
+  /** dist-tag. Defaults to `'latest'`. */
+  channel?: string;
+  /** Registry base URL. Defaults to `'https://registry.npmjs.org'`. */
+  registry?: string;
+  /**
+   * Override the read-through cache lifetime in ms for the in-TUI hook.
+   * Defaults to `0` — every TUI launch fetches fresh, so the chip
+   * never lies. Pass a positive value (e.g. `3_600_000` for 1 h) to
+   * throttle the registry-poll rate at the cost of staleness.
+   *
+   * The on-disk cache is always WRITTEN, regardless of this value, so
+   * `zidane upgrade` and other tooling read paths benefit immediately.
+   */
+  cacheTtlMs?: number;
+  /**
+   * Platform-package prefix used by the in-place self-update flow when
+   * resolving the per-arch tarball name. Defaults to `'<packageName>-'`
+   * (i.e. `zidane-tui-darwin-arm64` when `packageName === 'zidane-tui'`).
+   * Override only when your platform packages don't follow the `<name>-<key>`
+   * convention.
+   */
+  platformPackagePrefix?: string;
+  /**
+   * Executable name on PATH for `packageName`, used to probe the version
+   * installed on disk (the `↻ vX` "restart to update" chip). Defaults to
+   * `packageName`; the TUI passes `'zidane'` for `zidane-tui`.
+   */
+  binName?: string;
+}
+/** Resolved on-disk layout produced by {@link resolveConfig}. */
+interface ResolvedPaths {
+  /**
+   * Effective data root — equals `userDir` (configDir) when project
+   * mode is off, `projectDir` when it's on. Kept for callers that
+   * wrote against the pre-project-db API; new code should reference
+   * the explicit slots (`configDir` / `dataDir` / `cacheDir` /
+   * `stateDir`) or `projectDir` / `db` / `state` instead.
+   */
+  dir: string;
+  /**
+   * User-scoped config root — credentials, mcp-credentials, keybindings,
+   * `config.json`, `mcps.json`, skills. Legacy alias for `configDir`;
+   * existing call sites still reference `userDir`. In XDG mode this
+   * lands at `$XDG_CONFIG_HOME/zidane`; in legacy mode the four slots
+   * (config / data / state / cache) collapse to a single
+   * `<storageDir>/<prefix>` directory.
+   */
+  userDir: string;
+  /**
+   * Project-scoped data root. Set to `<git-root>/<prefix>` when project
+   * mode resolved to ON and a git root was found. `null` otherwise.
+   */
+  projectDir: string | null;
+  /** Resolved `sessions.db` path. Lives under `projectDir` when active, else `dataDir`. */
+  db: string;
+  /** Resolved `state.json` path. Lives under `projectDir` when active, else `stateDir`. */
+  state: string;
+  /**
+   * XDG config slot — `$XDG_CONFIG_HOME/zidane` on a fresh Linux install,
+   * `<storageDir>/<prefix>` (e.g. `~/.zidane/`) in legacy mode. Holds
+   * user-editable surface (`credentials.json`, `mcps.json`, …).
+   */
+  configDir: string;
+  /**
+   * XDG data slot — `$XDG_DATA_HOME/zidane` on Linux, single-dir
+   * elsewhere. Holds long-lived chat history (`sessions.db`).
+   */
+  dataDir: string;
+  /**
+   * XDG state slot — `$XDG_STATE_HOME/zidane` on Linux, single-dir
+   * elsewhere. Holds per-machine UI bookkeeping (`state.json`).
+   */
+  stateDir: string;
+  /**
+   * XDG cache slot — `$XDG_CACHE_HOME/zidane` on Linux, single-dir
+   * elsewhere. Holds regenerable data: persisted tool results,
+   * background-task logs, auto-update registry cache.
+   */
+  cacheDir: string;
+  /**
+   * Which resolution branch produced the layout. `'xdg'` when split
+   * across the four XDG dirs; one of `'legacy-explicit'`,
+   * `'legacy-existing'`, or `'default'` when the slots collapse to a
+   * single directory. Surfaced for diagnostics + tests.
+   */
+  storageMode: StorageMode;
+}
+interface ResolvedConfig {
+  prefix: string;
+  storageDir: string;
+  paths: ResolvedPaths;
+  providers: ProviderRegistry;
+  /**
+   * Resolved profile registry. Always non-empty; the resolver throws when
+   * the host passes an empty `agents` map (same contract as `providers`).
+   */
+  agents: AgentRegistry;
+  /** Id of the profile to activate on mount. Guaranteed to key into `agents`. */
+  initialAgentId: string;
+  store: SessionStore;
+  stateStore: StateStoreApi;
+  /** Lookup by `ProviderKey` returning the available models for the picker. */
+  modelsFor: (key: ProviderKey) => readonly ModelInfo[];
+  initialState: TuiState;
+  initialSettings: Partial<Settings>;
+  resumeProvider: ProviderAuth | null;
+  initialPicked: Picked | null;
+  /**
+   * Effective keybindings — defaults merged with the user-level
+   * `<userDir>/keybindings.json` (when present). Always fully-resolved
+   * so consumers can treat the record as total. See `./keybindings.ts`
+   * for the action catalog + spec format.
+   */
+  keybindings: KeyBindings;
+  /**
+   * Resolved extension-contributed keybindings. Each entry pairs the
+   * extension's binding definition with the user's effective spec
+   * (override from `keybindings.json` when present, default
+   * otherwise). The TUI dispatcher iterates these alongside the
+   * built-in action catalog; the GUI host can do the same.
+   *
+   * Empty when no extension contributed a keybinding.
+   */
+  extensionKeybindings: readonly ResolvedExtensionKeybinding[];
+  /**
+   * Resolved auto-update knobs (forwarded verbatim from `ChatOptions.autoUpdate`)
+   * — `null` when the host didn't wire one. The TUI feeds this into
+   * `useUpdateCheck` so the footer chip + the `zidane upgrade` subcommand
+   * share a single source of truth.
+   */
+  autoUpdate: AutoUpdateConfig | null;
+  /**
+   * Merged extension contributions — the registry passed via
+   * {@link ChatOptions.extensionRegistry}, returned verbatim, or
+   * {@link EMPTY_EXTENSION_REGISTRY} when the host didn't pass one.
+   * `resolveConfig` is synchronous, so it never runs `setup()` itself;
+   * the host pre-builds the registry with `buildExtensionRegistry`.
+   *
+   * Renderer-side wiring reads `tuiContributions` / `guiContributions`
+   * to mount keybindings / footer hints / modals / panels. The
+   * `extensionPreset` field below carries the agent-side surface
+   * (tools / hooks / mcpServers / skills) ready to spread.
+   */
+  extensions: ExtensionRegistry;
+  /**
+   * Extra extension scan roots used at boot. Runtime re-discovery (TUI cwd
+   * changes, future hosts) feeds these back into the shared discovery helper so
+   * local/dev package roots stay active after the initial launch.
+   */
+  extensionScanPaths: readonly string[];
+  /**
+   * Extra Agent Plugin scan roots used at boot. Threaded into the discovery
+   * shell so a dev root stays active across project/cwd changes, same as
+   * {@link ResolvedConfig.extensionScanPaths}.
+   */
+  pluginScanPaths: readonly string[];
+  /**
+   * Single {@link Preset} folded together from every extension's
+   * agent-side contributions. Hosts spread it into `createAgent()`
+   * alongside the active profile's preset:
+   *
+   * ```ts
+   * const profile = composePresets(extensionPreset, agentProfile.preset)
+   * const agent = createAgent({ ...profile, provider })
+   * ```
+   *
+   * Extension hooks are bucketed per event so every handler fires;
+   * tools and mcpServers compose with profile contributions via the
+   * usual `composePresets` rules. System-prompt fragments land as a
+   * trailing block on `preset.system` (host profiles that re-derive
+   * `system` per session — Build / Plan — append the fragments via
+   * the `system:transform` hook so the live system always carries
+   * them).
+   */
+  extensionPreset: Preset;
+  /**
+   * System-prompt fragments contributed by extensions, in registration
+   * order. Surfaced separately from {@link extensionPreset} so hosts
+   * that re-derive `system` per session (Build / Plan in the TUI) can
+   * append them on `system:transform` instead of trying to merge two
+   * `preset.system` strings.
+   */
+  extensionSystemFragments: readonly string[];
+  /**
+   * Spawnable subagents (adds) contributed by extensions, keyed by name.
+   * Surfaced separately from {@link extensionPreset} (like
+   * {@link extensionSystemFragments}) because subagents don't ride the
+   * preset path — the host merges them onto the spawn tool's base
+   * registry via `spawn.withSubagents(...)` at agent build time.
+   */
+  extensionSubagents: SubagentRegistry;
+  /**
+   * Subagent edits contributed by extensions, keyed by target name and
+   * composed in registration order. Applied (after the adds above) by
+   * the host's `spawn.withSubagents(...)` call so extensions can edit or
+   * delete host- / extension-provided subagents by name.
+   */
+  extensionSubagentOverrides: Record<string, SubagentOverride>;
+  /**
+   * Merged extension-contributed config categories, keyed by category id.
+   * Surfaced (alongside {@link extensionConfigItems}) so the TUI can read
+   * the schema in-process — same way it reads `extensions.themes` — and
+   * the GUI's `extensions:configSchema` IPC can serialize it.
+   */
+  extensionConfigCategories: Readonly<Record<string, ExtensionConfigCategory>>;
+  /**
+   * Merged extension-contributed config items, namespaced
+   * `extName → itemKey → item`. Each item carries its resolved
+   * `category`; values are read default-first via the core resolver.
+   */
+  extensionConfigItems: Readonly<Record<string, Readonly<Record<string, StoredExtensionConfigItem>>>>;
+  /**
+   * Resolved project-extension trust decision (option + env fallback).
+   * Hosts that re-discover extensions at runtime feed this back into
+   * {@link discoverAndBuildExtensionRegistry} so the rebuild trusts the
+   * same scopes boot did.
+   */
+  trustProjectExtensions: boolean;
+  /**
+   * Raw user `keybindings.json` object (post-JSONC-strip). Surfaced so a
+   * host re-resolving {@link extensionKeybindings} at runtime (after an
+   * extension registry rebuild) can reuse the same override source
+   * without a second disk read.
+   */
+  rawKeybindings: Readonly<Record<string, unknown>>;
+  /** One-shot launch request forwarded from {@link ChatOptions.launch}. */
+  launch: StartLocalOptions | null;
+}
+/**
+ * Resolve user options into a fully-bound runtime config.
+ *
+ * NOT pure: besides disk reads, this mutates `process.env` so the harness
+ * providers pick up the chat engine's credential store — it sets
+ * `ZIDANE_CREDENTIALS_PATH` and reconciles stored API keys / OAuth entries
+ * into env via `applyApiKeyEnv` (which can overwrite or delete ambient keys
+ * like `ANTHROPIC_API_KEY`; see its JSDoc for the precedence rationale).
+ */
+declare function resolveConfig(options: ChatOptions): ResolvedConfig;
+/**
+ * Compute the on-disk layout for a single TUI session. Public so hosts
+ * (CLI tools, tests, scripted bootstraps) can ask "where will sessions
+ * land?" without going through `resolveConfig`'s full machinery.
+ *
+ * Storage-slot resolution (config / data / state / cache) is delegated
+ * to {@link resolveStorageDirs}. In legacy modes the four slots collapse
+ * to a single `<storageDir>/<prefix>` directory; in XDG mode they fan
+ * out into `$XDG_CONFIG_HOME/zidane`, `$XDG_DATA_HOME/zidane`,
+ * `$XDG_STATE_HOME/zidane`, `$XDG_CACHE_HOME/zidane`. See the module
+ * doc on `./xdg.ts` for the full precedence chain.
+ *
+ * Decision logic for project mode (least → most specific):
+ *
+ *   1. Default: OFF — sessions live in the user-scoped `dataDir`
+ *      and get scoped per-project via the `SessionData.projectRoot` tag.
+ *   2. `<configDir>/config.json` `projectDb` flag (when present).
+ *   3. `ZIDANE_PROJECT_DB` env var (`'0'` / `'false'` / `'off'` → off,
+ *      anything else true if set).
+ *   4. `options.projectDb` (host call site).
+ *
+ * Project mode activates only when the resolution above lands on
+ * `true` AND a git repo is found above `cwd`. Outside git or with the
+ * flag off, sessions + state stay at the user-scoped slots.
+ *
+ * Auto-creates the project `.{prefix}/` directory when mode resolves
+ * to ON (silent — mirrors `ensureStateDir`). User slots are created
+ * lazily by the state-store + credentials writers; we don't pre-touch
+ * them here so a read-only invocation stays read-only.
+ */
+declare function resolveStoragePaths(opts: {
+  prefix: string;
+  /** Explicit storage root. When set, forces legacy-explicit mode. */
+  storageDir?: string;
+  cwd: string;
+  /** Host override for project mode. Beats the user-config + env-var sources. */
+  projectDb?: boolean;
+}): ResolvedPaths;
+//#endregion
+//#region src/chat/config-context.d.ts
+declare function ConfigProvider({ config, children }: {
+  config: ResolvedConfig;
+  children: ReactNode;
+}): import("react").JSX.Element;
+declare function useConfig(): ResolvedConfig;
+//#endregion
+//#region src/chat/credentials.d.ts
+interface ApiKeyCredential {
+  kind: 'apikey';
+  /**
+   * Bearer API key. May be empty when the descriptor has no `envKey` and
+   * authenticates entirely via {@link customFields} (e.g. the `local`
+   * provider, where the auth signal is the configured base URL).
+   */
+  value: string;
+  /**
+   * Free-form fields collected by the wizard from the descriptor's
+   * `customFields` definitions. Keys match the descriptor field's `key`.
+   * Mirrored into `process.env[field.envVar]` by `applyApiKeyEnv` so the
+   * provider's factory can read them via the existing env-var convention.
+   */
+  customFields?: Record<string, string>;
+}
+interface OAuthCredential {
+  kind: 'oauth';
+  access: string;
+  refresh?: string;
+  expires?: number;
+  /**
+   * User-given account name ("work", "personal"). Optional — absent reads as
+   * `DEFAULT_OAUTH_ACCOUNT_LABEL` (see `oauthAccountLabel`). Survives token
+   * refresh because the refresh path spreads the stored entry into the rotated
+   * one (see `resolveOAuthApiKey`).
+   */
+  label?: string;
+  /** Provider-specific extras (e.g. OpenAI Codex `accountId`). */
+  [extra: string]: unknown;
+}
+type ProviderCredential = ApiKeyCredential | OAuthCredential;
+/** One stored credential of a provider, addressed by the file key it lives at. */
+interface StoredCredential {
+  /** File key — the selection identity for promote / remove / relabel. */
+  key: string;
+  credential: ProviderCredential;
+  /** True for the canonical slot, i.e. the credential readers resolve. */
+  active: boolean;
+}
+/** Top-level shape of `credentials.json` — keys are credential-file keys. */
+type CredentialsFile = Record<string, ProviderCredential>;
+/**
+ * Resolve the credentials file path given the resolved TUI data directory
+ * (typically `~/.zidane`, i.e. `config.paths.dir`).
+ *
+ * Matches the convention used elsewhere in the TUI (sessions.db, state.json)
+ * so a single `ZIDANE_STORAGE_DIR` override moves the entire data root.
+ */
+declare function credentialsPath(dataDir: string): string;
+/**
+ * Read credentials from disk.
+ *
+ * Returns `{}` when the file is missing or corrupt (last-ditch tolerance —
+ * a hand-edit gone wrong shouldn't lock the user out of re-authing). On first
+ * call with no file present, attempts a migration from `cwd/.credentials.json`
+ * (the legacy location used by `bun run auth`).
+ */
+declare function readCredentials(dataDir: string): CredentialsFile;
+/** Read a single provider's credential (translating via the descriptor). */
+declare function readProviderCredential(dataDir: string, descriptor: ProviderDescriptor): ProviderCredential | undefined;
+/**
+ * Both stored credentials for a provider: `active` is the one every reader
+ * resolves, `alternate` is the stored-but-not-preferred one (if any).
+ *
+ * Predates multi-account and only sees the `#alt` slot; use
+ * {@link readProviderCredentials} to list every stored account.
+ */
+declare function readProviderCredentialPair(dataDir: string, descriptor: ProviderDescriptor): {
+  active?: ProviderCredential;
+  alternate?: ProviderCredential;
+};
+/**
+ * Every stored credential of a provider, active first.
+ *
+ * Tolerant of any kind in any slot: `#alt` is meant for the API key and
+ * `#account:N` for OAuth accounts, but a file written by an older build (which
+ * parked the OAuth alternate in `#alt`) must still list everything it holds.
+ */
+declare function readProviderCredentials(dataDir: string, descriptor: ProviderDescriptor): StoredCredential[];
+/** Pure form of {@link readProviderCredentials} over an already-read file. */
+declare function storedCredentialsOf(all: CredentialsFile, fileKey: string): StoredCredential[];
+/**
+ * Write credentials atomically (write-then-rename) with mode 0o600.
+ *
+ * Atomic on the same filesystem — readers either see the previous file or the
+ * new one, never a half-written intermediate. Creates the parent dir if needed
+ * (first launch on a fresh machine: `~/.zidane/` may not exist yet).
+ */
+declare function writeCredentials(dataDir: string, creds: CredentialsFile): void;
+interface SetProviderCredentialOptions {
+  /**
+   * File key of the stored credential this one REPLACES (a re-auth of a known
+   * account). The slot keeps its position — replacing the active one keeps it
+   * active. When the key is no longer stored (removed from another window
+   * mid-login), the credential is added as a new active account instead.
+   */
+  replaceKey?: string;
+}
+/**
+ * Store a credential as the provider's preferred one.
+ *
+ * The previous active credential is demoted, not destroyed: authenticating
+ * with OAuth used to silently delete a working API key (and vice versa), and a
+ * second OAuth login used to overwrite the first account. An API key moves to
+ * {@link alternateCredKey}; an OAuth grant moves to the next free account slot.
+ * Replacing an API key with an API key is a plain overwrite — there is only
+ * ever one — and so is an OAuth login that names its predecessor via
+ * `replaceKey`.
+ */
+declare function setProviderCredential(dataDir: string, descriptor: ProviderDescriptor, cred: ProviderCredential, opts?: SetProviderCredentialOptions): void;
+/**
+ * Outcome of {@link setPreferredCredential}.
+ *
+ * Three states rather than a boolean because the two non-promoting cases need
+ * opposite handling: `already-active` is a harmless idempotent call (the UI
+ * repaints and moves on), while `not-stored` means the caller asked for a
+ * credential that does not exist and should say so.
+ */
+type PreferCredentialResult = 'promoted' | 'already-active' | 'not-stored';
+/**
+ * What {@link setPreferredCredential} promotes: a stored credential by file
+ * key (from {@link readProviderCredentials} / `AuthMethod.key`), or the first
+ * stored credential of a kind — the pre-multi-account form, still right when
+ * the caller only knows "switch to the API key".
+ */
+type PreferredCredentialTarget = ProviderCredential['kind'] | {
+  key: string;
+};
+/**
+ * Make one of the provider's stored credentials the preferred one.
+ *
+ * Swaps the target into the canonical slot and parks the previous active one
+ * (see {@link parkDemoted}). Returns which of the three outcomes happened so a
+ * caller cannot report a swap that provably did not occur — the write is
+ * silent either way, and a success-shaped `void` was a trap for any caller that
+ * trusted it instead of refetching.
+ */
+declare function setPreferredCredential(dataDir: string, descriptor: ProviderDescriptor, target: PreferredCredentialTarget): PreferCredentialResult;
+/**
+ * Drop ONE stored credential. Removing the active one promotes a survivor —
+ * another credential of the same kind when there is one (a second OAuth
+ * account), else whatever is left — so the provider does not go dark while it
+ * still holds a working credential. Returns false when `key` was not stored.
+ */
+declare function removeStoredCredential(dataDir: string, descriptor: ProviderDescriptor, key: string): boolean;
+/**
+ * Name a stored OAuth account. An empty label drops the field, which reads
+ * back as {@link DEFAULT_OAUTH_ACCOUNT_LABEL}. Returns false when `key` holds
+ * no OAuth credential.
+ */
+declare function setCredentialLabel(dataDir: string, descriptor: ProviderDescriptor, key: string, label: string): boolean;
+/**
+ * Sign a provider out — drops EVERY stored credential.
+ *
+ * "Signed out" has to mean the provider resolves nothing afterwards, which is
+ * what this has always guaranteed and what callers named it for; promoting a
+ * survivor instead would silently leave the provider authenticated through
+ * another source. Callers that want that behavior use
+ * {@link removeStoredCredential} on the one slot they mean.
+ */
+declare function removeProviderCredential(dataDir: string, descriptor: ProviderDescriptor): void;
+/**
+ * Reconcile `process.env` with the stored credentials so the harness providers
+ * pick up the wizard's output via their existing env-var resolution. Called
+ * once at TUI launch after the credentials file has been resolved.
+ *
+ * **Precedence: stored credential > ambient env.** When the user has run the
+ * auth wizard, that's an explicit, recent action — it MUST win over whatever
+ * ambient value is already in `process.env`. Otherwise an upgrade reliably
+ * breaks for anyone whose cwd happens to contain a stale `.env`: Bun
+ * auto-loads `.env` from cwd into `process.env` before our code runs, the
+ * legacy `bun run auth` used to upsert tokens into `cwd/.env`, and even a
+ * one-off `export ANTHROPIC_API_KEY=…` from months ago in the user's shell rc
+ * can outlive its usefulness. None of those should override a key the user
+ * just typed into the wizard.
+ *
+ * Three cases per registered provider with an `envKey`:
+ *
+ *   1. Stored `kind: 'apikey'` → overwrite env with the stored value. Wizard
+ *      wins. A debug log fires when this clobbers a different ambient value.
+ *   2. Stored `kind: 'oauth'`  → DELETE env, so {@link resolveOAuthApiKey}
+ *      falls through to the file-read + refresh path. A stale OAuth token
+ *      in env would otherwise short-circuit refresh and get rejected.
+ *   3. No stored entry → leave env alone. Env-only setups (no wizard run yet,
+ *      hosts driving zidane purely from secrets management) keep working.
+ *
+ * To opt out and force ambient env to win again, the user signs the provider
+ * out via the wizard (which deletes the stored entry → case 3 above).
+ *
+ * Descriptors without an `envKey` (OAuth-only providers, custom providers
+ * that bypass env-var resolution) are skipped silently.
+ */
+declare function applyApiKeyEnv(dataDir: string, registry: Readonly<Record<string, ProviderDescriptor>>, opts?: {
+  log?: (message: string) => void;
+}): void;
+//#endregion
+//#region src/chat/mcps-discovery.d.ts
+/**
+ * One entry in the discovered list. `path` is the source file (one of
+ * the `mcp(s).json` variants under `.agents/` or `.{prefix}/`) so a
+ * Settings picker can show "Defined in ~/.zidane/mcp.json" tooltips
+ * and the user can tell which file declared what.
+ */
+interface DiscoveredMcp {
+  config: McpServerConfig;
+  source: 'project' | 'user';
+  path: string;
+}
+/**
+ * Search order for MCP config files — see {@link projectUserPaths}.
+ *
+ * Both `mcps.json` (zidane's canonical name) and `mcp.json` (Cursor /
+ * common ecosystem alias) are picked up from every search root. The
+ * canonical name wins within the same directory; across files the
+ * usual first-found-by-name dedup applies, so `mcp.json` effectively
+ * merges its non-overlapping entries on top of `mcps.json`.
+ *
+ * Order per scope (project beats user):
+ *   1. `{project}/.agents/mcps.json`
+ *   2. `{project}/.agents/mcp.json`
+ *   3. `{project}/.{prefix}/mcps.json`
+ *   4. `{project}/.{prefix}/mcp.json`
+ *   5. `~/.agents/mcps.json`
+ *   6. `~/.agents/mcp.json`
+ *   7. `~/.{prefix}/mcps.json`
+ *   8. `~/.{prefix}/mcp.json`
+ *
+ * Non-existent files are skipped without error.
+ */
+declare function defaultMcpsConfigPaths(opts?: {
+  cwd?: string;
+  home?: string;
+  prefix?: string;
+}): {
+  path: string;
+  source: 'project' | 'user';
+}[];
+/**
+ * Parse one `mcps.json` file. Canonical zidane shape is a flat array; the
+ * other shapes exist for copy-paste from neighboring tools:
+ *
+ *   - `McpServerConfig[]` — flat array (recommended).
+ *   - `{ name: {...} }` — name-keyed map.
+ *   - `{ "mcpServers": { name: {...} } }` — Claude Desktop / Claude Code /
+ *     Cursor wrapper. Unwrapped before normalization (otherwise
+ *     `normalizeMcpServers` would treat the whole wrapper as a single server).
+ *
+ * Per-entry `enabled: false` (Cursor runtime state) drops the entry — same
+ * intent as the source tool. Use the TUI toggle list for "show but disabled".
+ *
+ * Tolerant to common copy-paste artifacts: when strict `JSON.parse` fails,
+ * retries after normalizing invisible whitespace that's valid Unicode but
+ * not valid JSON whitespace (BOM, NBSP, zero-width spaces, line/paragraph
+ * separators) — only OUTSIDE string literals, so user data isn't mutated.
+ * If the sanitized version still fails, throws the original error with a
+ * targeted hint when NBSPs are present.
+ *
+ * Validation flows through `normalizeMcpServers` so the result matches
+ * what `createAgent` accepts. Throws on truly malformed JSON; the caller
+ * decides whether to surface or swallow.
+ */
+declare function parseMcpsFile(text: string): McpServerConfig[];
+/**
+ * Per-file failure surfaced from {@link discoverProjectMcps}. The TUI shows
+ * these in the MCP settings empty / preamble state so a malformed
+ * `mcps.json` doesn't look identical to a missing one.
+ */
+interface DiscoveryError {
+  path: string;
+  source: 'project' | 'user';
+  message: string;
+  /**
+   * A deliberate, documented behavior being reported (e.g. the ruler stdio
+   * security carve-out) rather than a failure. Hosts should style these as
+   * info, not error — crying wolf over a working default trains users to
+   * ignore the channel that also carries real parse failures.
+   */
+  informational?: boolean;
+}
+/**
+ * Result of {@link discoverProjectMcps}. `servers` is the per-source-priority
+ * merged list (project beats user, first-found wins on name collision).
+ * `errors` is one entry per file that existed but failed to parse, plus
+ * informational entries for servers a security gate skipped (ruler stdio
+ * without the foreign-agent opt-in) — empty on the happy path.
+ */
+interface DiscoveryResult {
+  servers: DiscoveredMcp[];
+  errors: DiscoveryError[];
+}
+/**
+ * Walk the default config paths, parse every file that exists, and return
+ * `{ servers, errors }` in source-priority order. Project entries appear
+ * before user entries; first occurrence of a `name` wins (later
+ * duplicates dropped).
+ *
+ * Parse failures are captured into `errors` rather than thrown — the picker
+ * surfaces them while still showing whatever DID parse. A `ZIDANE_DEBUG`
+ * log line is also emitted for ops visibility.
+ */
+declare function discoverProjectMcps(opts?: {
+  cwd?: string;
+  home?: string;
+  prefix?: string;
+  /**
+   * Also read MCP configs other agents maintain (Claude Code, Codex,
+   * Pi) — see `foreign-configs.ts`. Mirrors the `importForeignConfigs`
+   * setting; native locations always win name collisions, and project
+   * beats user within each group.
+   */
+  foreignAgents?: boolean;
+  /**
+   * Also read Ruler MCP configs (`.ruler/ruler.toml` + `mcp.json`,
+   * project and XDG-global) — see `ruler-configs.ts`. Mirrors the
+   * `importRulerConfigs` setting; same collision rules as above.
+   */
+  ruler?: boolean;
+}): DiscoveryResult;
+/**
+ * Map a user-toggled enable list onto the `mcpServers` array the agent
+ * receives. Conventions match `buildSkillsConfig`:
+ *
+ *   - `enabled === undefined` → every discovered server enabled (default).
+ *   - `enabled === []`        → no servers (the agent runs MCP-less).
+ *   - `enabled === [names]`   → allowlist; servers not in the list are
+ *                               dropped.
+ *
+ * `disabledTools` is the per-server tool deny-list from
+ * `Settings.disabledMcpTools`. For each server that survives the
+ * server-level enable filter, the per-tool names are merged into
+ * `McpServerConfig.disabledTools` via **union** with anything the JSON
+ * file already pinned — a tool listed in either source is dropped.
+ * Union (not override) keeps JSON-side policy stable: a server file
+ * that pins `disabledTools: ['dangerous_tool']` can't be re-enabled
+ * via the UI by accident.
+ *
+ * `enabledTools` (JSON-side allowlist) takes precedence over the
+ * UI-side deny-list when both are set on the same server — the
+ * allowlist's "only these" semantics would be meaningless if a UI
+ * deny-list could subtract from it again. We don't emit `disabledTools`
+ * when `enabledTools` is present.
+ *
+ * Returns a fresh array — callers can mutate without affecting the
+ * underlying discovery list. Per-server config objects are also fresh
+ * copies (shallow), so the merged `disabledTools` doesn't leak back
+ * onto the discovery catalog.
+ */
+declare function buildMcpServers(opts: {
+  discovered: readonly DiscoveredMcp[];
+  enabled?: readonly string[];
+  disabledTools?: Record<string, readonly string[]>;
+}): McpServerConfig[];
+/**
+ * Dedup a merged MCP-server list by `name`. First entry wins.
+ *
+ * Applied at agent build across every source that can contribute a server —
+ * `mcps.json`, Agent Plugins, launch options, extensions — so the earliest
+ * source in that order takes precedence.
+ *
+ * Drops are REPORTED rather than silent, via `onDropped`. A plugin shipping a
+ * `github` server loses to a `github` in `mcps.json`, and nothing downstream
+ * says so: the plugin's settings row still counts the server it shipped,
+ * because the row renders what the PACKAGE declares and only this merge knows
+ * what survived. That mirrors how the skills side reports the same class of
+ * event — `resolveSkills` emits `name-collision-shadowed` on the winner rather
+ * than annotating the loser.
+ *
+ * The reporter is injected rather than calling a logger directly so this stays
+ * a pure function of its input, testable without a logging shim. It lives here
+ * beside {@link buildMcpServers} rather than in the TUI because merge
+ * precedence is a config concern, not a rendering one.
+ */
+declare function dedupMcpServersByName<T extends {
+  name: string;
+}>(servers: readonly T[], onDropped?: (names: readonly string[]) => void): T[];
+//#endregion
+//#region src/chat/project-user-paths.d.ts
+/**
+ * Shared search-path builder for project + user config discovery.
+ *
+ * Both Skills (`skills/<name>/SKILL.md`) and MCP servers (`mcps.json`)
+ * follow the same first-found-wins order:
+ *
+ *   1. `{project-root}/.agents/<sub>`   — project, agnostic convention
+ *   2. `{project-root}/.{prefix}/<sub>` — project, zidane (`.zidane` default)
+ *   3. `~/.agents/<sub>`                — user, agnostic
+ *   4. `~/.{prefix}/<sub>`              — user, zidane
+ *
+ * `{project-root}` is the git root walked up from `cwd` when present,
+ * else `cwd` itself. This pairs with the project-scoped session
+ * storage (`resolveStoragePaths`) so all three project-aware surfaces
+ * — sessions, mcps, skills — anchor at the same `.{prefix}/`.
+ *
+ * Centralizing the pattern keeps the four paths in one place — a third
+ * discovery surface (hooks, rules, …) gets the same convention for free
+ * and stays in lock-step on a prefix bump.
+ */
+/** A discovered path tagged with whether it lives in the project or the user dir. */
+interface ProjectUserPath {
+  path: string;
+  source: 'project' | 'user';
+}
+/**
+ * Resolve the four search paths for a given subdirectory (`skills`,
+ * `mcps.json`, …). Returns absolute paths regardless of whether they
+ * exist — the caller chooses to `existsSync`-filter or feed straight
+ * into a tolerant discovery routine.
+ */
+declare function projectUserPaths(opts: {
+  /** Subdirectory or filename relative to each search root. E.g. `'skills'`, `'mcps.json'`. */
+  subPath: string;
+  /** Discovery cwd. Default: `process.cwd()`. */
+  cwd?: string;
+  /** User home directory. Default: `os.homedir()`. */
+  home?: string;
+  /** Storage prefix. Leading dot tolerated. Default: `'.zidane'`. */
+  prefix?: string;
+}): ProjectUserPath[];
+//#endregion
+//#region src/chat/plugins-discovery.d.ts
+/** One plugin found on disk, loaded (successfully or not). */
+interface DiscoveredPlugin {
+  /**
+   * Identity for dedup + the enabled allowlist. The manifest's `name` when
+   * the plugin loaded; the directory basename when it didn't, so a rejected
+   * plugin still has something stable to key a row and a toggle on.
+   */
+  name: string;
+  /** Load result. Check `ok` before trusting `manifest`. */
+  plugin: LoadedPlugin;
+  /** Which search root it came from. */
+  source: 'project' | 'user';
+  /** Plugin root directory, as discovered. */
+  path: string;
+}
+/**
+ * Load every plugin reachable from the default search roots.
+ *
+ * Each immediate child directory of a root is one plugin — the same
+ * depth-1 rule the spec applies inside `skills/`. A child that isn't a
+ * directory, or that holds no `plugin.json`, is silently skipped: dropping a
+ * README next to your plugins is not an error.
+ *
+ * Dedup is by plugin NAME, not directory name, because the manifest owns
+ * identity — two directories called `tools/` shipping different plugins are
+ * two plugins, and one plugin vendored at two scopes is one plugin.
+ */
+declare function discoverProjectPlugins(opts?: {
+  cwd?: string;
+  home?: string;
+  prefix?: string;
+  /**
+   * Extra scan roots appended AFTER the four defaults — typically from
+   * {@link parsePluginScanPathEnv}. Ordered last so a real project or user
+   * plugin always wins a name collision against a dev/host-provided root.
+   *
+   * Scoped `'project'`: they're supplied by whoever launched the process, the
+   * same trust level as a plugin sitting in the working tree.
+   */
+  extraRoots?: readonly string[];
+  signal?: AbortSignal;
+}): Promise<{
+  plugins: DiscoveredPlugin[];
+  errors: DiscoveryError[];
+}>;
+/**
+ * Map the user's enabled-plugin list onto the contributions a host merges
+ * into the agent.
+ *
+ * Conventions match `enabledSkills` / `enabledMcps`:
+ *   - `undefined` → every discovered plugin is enabled (default)
+ *   - `[]`        → all off
+ *   - `[names]`   → allowlist
+ *
+ * A plugin that failed to load contributes nothing regardless of the
+ * allowlist — `ok: false` means components were never discovered.
+ */
+declare function buildPluginContributions(opts: {
+  discovered: readonly DiscoveredPlugin[];
+  enabled?: readonly string[];
+}): {
+  skills: SkillConfig[];
+  mcpServers: McpServerConfig[];
+};
+//#endregion
+//#region src/chat/discovery-context.d.ts
+interface DiscoveryContextValue {
+  /** Parsed `SkillConfig[]` from project + user scan paths. */
+  skillsCatalog: readonly SkillConfig[];
+  /**
+   * Agent Plugins loaded from `.agents/plugins` / `.{prefix}/plugins`
+   * (project + user). Includes rejected plugins — they render as read-only
+   * diagnostics rather than vanishing.
+   */
+  pluginsCatalog: readonly DiscoveredPlugin[];
+  /** Parsed `mcps.json` entries. */
+  mcpsCatalog: readonly DiscoveredMcp[];
+  /** Non-fatal parse errors from `mcps.json` lookups. */
+  mcpsErrors: readonly DiscoveryError[];
+  /**
+   * Per-server full tool catalog from the on-disk cache (see
+   * `chat/mcp-tools-cache.ts`). Updated as MCP servers bootstrap and
+   * fire the `mcp:tools:list` hook. Missing key → no cache yet; the
+   * settings UI surfaces an empty-state row under the expanded server.
+   */
+  mcpToolsByServer: Record<string, readonly McpToolSchema[]>;
+  /** Current file walk results — empty until lazy-load lands. */
+  filesCatalog: readonly FileEntry[];
+  /** Force a fresh skills rescan. Resolves once state is committed. */
+  refreshSkills: () => Promise<void>;
+  /** Force a fresh plugin rescan. Resolves once state is committed. */
+  refreshPlugins: () => Promise<void>;
+  /**
+   * Re-parse `mcps.json`. Sync-shaped under the hood, async for symmetry.
+   * Resolves `true` when the catalog actually changed (a publish that
+   * schedules downstream agent rebuilds), `false` on a fingerprint no-op
+   * or scan failure — callers that arm rebuild-coupled state (e.g. the
+   * add-MCP auto-login) disarm on `false`.
+   */
+  refreshMcps: () => Promise<boolean>;
+  /** Force a fresh file walk. Wired into a future "refresh files" affordance. */
+  refreshFiles: () => Promise<void>;
+  /** Idempotent first-load trigger for skills (used by `/` popover + modal mount). */
+  ensureSkills: () => Promise<readonly SkillConfig[]>;
+  /** Idempotent first-load trigger for files (used by `@` popover). */
+  ensureFiles: () => Promise<readonly FileEntry[]>;
+}
+declare function DiscoveryProvider({ value, children }: {
+  value: DiscoveryContextValue;
+  children: ReactNode;
+}): import("react").JSX.Element;
+/**
+ * Read live discovery state + actions. Throws if used outside a
+ * `<DiscoveryProvider>` — discovery is a load-bearing dependency for
+ * settings + completion popovers; bailing loud here surfaces wiring
+ * mistakes at mount instead of producing empty catalogs at first
+ * keystroke.
+ */
+declare function useDiscovery(): DiscoveryContextValue;
+/**
+ * Non-throwing variant — returns `null` when no provider is mounted.
+ * Used by composable modals (`<SettingsModal>`, …) that accept catalog
+ * props as a fallback for embedders who don't wire the full TUI
+ * shell. The in-app flow always mounts `<DiscoveryProvider>` so the
+ * modal sees live state; standalone embeds get the prop snapshot.
+ */
+declare function useDiscoveryOptional(): DiscoveryContextValue | null;
+//#endregion
+//#region src/chat/discovery-slot.d.ts
+/**
+ * Stale-while-revalidate catalog slot.
+ *
+ * One slot per (catalog kind, projectDir) pin. Holds the first-load
+ * promise + a `lastScannedAt` timestamp + an in-flight `refreshing`
+ * promise. Idempotent across concurrent callers, safe to rotate when
+ * the project changes (the slot's `abort` controller cancels in-flight
+ * walks and the `.then` guards drop stale results).
+ *
+ * Renderer-agnostic. AppShell wraps it in React refs so React closures
+ * stay stable; a non-TUI shell can use it directly against its own
+ * state propagation.
+ *
+ * Contract:
+ *   - `ensure()` — kick the first load if not started; return the
+ *     cached promise. On subsequent calls, if `Date.now() -
+ *     lastScannedAt >= throttleMs` and no refresh is in flight, kick
+ *     a background revalidate that calls `onLoad(fresh)` when it
+ *     resolves. The original first-load promise still resolves with
+ *     the first walk's contents — consumers reading live state
+ *     elsewhere (React state) see the refreshed catalog.
+ *   - `refresh()` — force a rescan now, bypassing the throttle.
+ *     De-duplicates: if a refresh is already in flight, returns the
+ *     same promise.
+ *   - `abort()` — cancel any in-flight walk and detach. After this
+ *     the slot is dead; callers should rotate to a new slot.
+ *   - `dispose()` — alias of `abort()`, named for symmetry with
+ *     cleanup callbacks.
+ *
+ * No state is exposed except through promises + the host's `onLoad`
+ * callback; the slot doesn't try to be a store, only a coordinator.
+ */
+/** Walk function — takes an abort signal, returns the discovered list. */
+type Walk<T> = (signal: AbortSignal) => Promise<readonly T[]>;
+/** Notification: a fresh walk has resolved. Host is expected to commit to its own state store. */
+type Commit<T> = (items: readonly T[]) => void;
+interface DiscoverySlotOptions<T> {
+  /** Discover function — runs the actual FS / network walk. */
+  walk: Walk<T>;
+  /** Commit hook — receives every successful walk's result (first + refreshes). */
+  onLoad: Commit<T>;
+  /**
+   * Min interval between background refreshes triggered by `ensure()`.
+   * Default: 3_000ms. `refresh()` ignores this — it's the user's
+   * explicit-intent path.
+   */
+  throttleMs?: number;
+  /** Optional error sink. Defaults to no-op; useful for `debugLog`. */
+  onError?: (err: unknown, phase: 'first-load' | 'refresh') => void;
+}
+interface DiscoverySlot<T> {
+  /**
+   * Kick the first load (idempotent). Returns the first-load promise
+   * once it exists. Schedules a background refresh if past throttle.
+   */
+  ensure: () => Promise<readonly T[]>;
+  /** Force-refresh now. De-duped across concurrent callers. */
+  refresh: () => Promise<void>;
+  /** True if a refresh is currently running. */
+  isRefreshing: () => boolean;
+  /** Cancel in-flight work + detach. Idempotent. */
+  abort: () => void;
+}
+declare function createDiscoverySlot<T>(options: DiscoverySlotOptions<T>): DiscoverySlot<T>;
+//#endregion
+//#region src/chat/editor-command.d.ts
+/**
+ * `$EDITOR` / `$VISUAL` command parsing.
+ *
+ * These variables conventionally hold a command LINE, not a bare executable —
+ * `code --wait`, `cursor --wait`, `subl -w`, `emacsclient -nw` are all normal
+ * values. Spawning the whole string as argv[0] looks for a file literally named
+ * `cursor --wait` and fails with ENOENT, so the flags have to be split off.
+ *
+ * Kept out of the TUI (and free of `node:child_process`) so the
+ * tokenizer is unit-testable without pulling in the TUI.
+ */
+/**
+ * Split an editor command line into `[executable, ...args]`.
+ *
+ * Whitespace-separated, with single and double quotes honored so an editor
  * living under a path with spaces still works
  * (`"/Applications/My App/bin/ed" -w`). Quotes group and are stripped;
  * backslash escaping is deliberately NOT implemented, because on Windows
@@ -1306,6 +3013,174 @@ declare function parseEditorCommand(spec: string): string[];
  */
 declare function quoteForShell(token: string): string;
 //#endregion
+//#region src/chat/enabled-toggle-set.d.ts
+/**
+ * Renderer-agnostic state machine for an "enabled allowlist" — the shape
+ * used by `settings.enabledSkills` / `settings.enabledMcps` (and any future
+ * `enabledX` toggle backed by a `Settings` field).
+ *
+ * Semantics, kept identical across all three call sites:
+ *   - `undefined`  → every catalog entry is enabled (default — user has
+ *                    never opened the picker; new entries flow in).
+ *   - `[]`         → the whole subsystem is off.
+ *   - `[names]`    → explicit allowlist; the persisted shape stays a
+ *                    concrete array once the user has toggled anything.
+ *
+ * The hook exposes a live `enabledSet` (Set<string>) + a `toggle(name)`
+ * callback that persists the result through `useSettings().setSetting`.
+ * The first toggle seeds the persisted allowlist from the current catalog
+ * so newly-added entries don't silently drop on the next launch.
+ *
+ * Renderer-neutral: works for the TUI's `<ToggleListModal>`, a GUI
+ * checkbox list, a CLI flag tool. Hook tests live alongside the chat
+ * suite; the rendering layer is tested where it lives.
+ */
+/** Settings keys whose value type is `readonly string[] | undefined`. */
+type EnabledAllowlistKey = 'enabledSkills' | 'enabledMcps' | 'enabledExtensions' | 'enabledPlugins';
+interface EnabledToggleSet {
+  /** Live set of enabled names — `Set` for O(1) `has`. */
+  enabledSet: ReadonlySet<string>;
+  /** Toggle one name on/off; persists immediately via `setSetting`. */
+  toggle: (name: string) => void;
+}
+/**
+ * Bind an "enabled allowlist" setting to a discovered catalog.
+ *
+ * `keyOf` extracts the persisted identity from a catalog entry (skill name,
+ * MCP server name, …). Pass a stable, collision-free key — the persisted
+ * allowlist is keyed against it forever.
+ */
+declare function useEnabledToggleSet<T>(opts: {
+  catalog: readonly T[];
+  keyOf: (entry: T) => string;
+  settingKey: EnabledAllowlistKey;
+  /**
+   * Names that survive the persisted-allowlist GC even when absent from
+   * `catalog`. Use when the catalog deliberately hides entries that are
+   * still known to exist — e.g. errored / untrusted extensions are kept
+   * out of the toggle list but must not be dropped from the allowlist
+   * by an unrelated toggle. Defaults to the catalog keys.
+   */
+  gcKeys?: readonly string[];
+}): EnabledToggleSet;
+//#endregion
+//#region src/chat/environment-credentials.d.ts
+declare function environmentCredentialsPath(dataDir: string): string;
+declare function createFileEnvironmentSecrets(dataDir: string): EnvironmentSecrets;
+/** In-memory secrets — tests and hosts without a data dir. */
+declare function createMemoryEnvironmentSecrets(initial?: Record<string, Record<string, string>>): EnvironmentSecrets;
+//#endregion
+//#region src/chat/environment-provisioning.d.ts
+interface ProvisionSessionEnvironmentInput {
+  sessionId: string;
+  /** The session as persisted now. */
+  load: () => Promise<SessionData | null>;
+  registry: EnvironmentRegistry;
+  config: (kind: string) => EnvironmentConfig;
+  /** Persist a metadata patch and announce it; `false` when the session no longer exists, throws on other write errors. */
+  persist: (patch: Record<string, unknown>) => Promise<boolean>;
+  signal?: AbortSignal;
+}
+interface ProvisionSessionEnvironmentResult {
+  /** The attempt tore down what it prepared (aborted, or the session vanished). */
+  tornDown: boolean;
+  /** The environment as it ended — absent when there was nothing to provision. */
+  environment?: SessionEnvironment;
+}
+declare function provisionSessionEnvironment(input: ProvisionSessionEnvironmentInput): Promise<ProvisionSessionEnvironmentResult>;
+//#endregion
+//#region src/chat/environments/local.d.ts
+declare const localEnvironmentProvider: EnvironmentProvider;
+//#endregion
+//#region src/chat/environments/worktree.d.ts
+declare const WORKTREE_ENVIRONMENT_KIND = "worktree";
+/** Provider-owned state on `environment.ref`. */
+interface WorktreeRef {
+  /** The worktree's directory. */
+  path: string;
+  /** The main checkout it belongs to. */
+  repoRoot: string;
+}
+declare function createWorktreeEnvironmentProvider(options: {
+  dataDir: string;
+}): EnvironmentProvider;
+//#endregion
+//#region src/chat/environments/index.d.ts
+interface BuiltinEnvironmentOptions {
+  /** Host data dir (`~/.zidane`) — default home of worktrees. */
+  dataDir: string;
+}
+declare function builtinEnvironmentProviders(options: BuiltinEnvironmentOptions): EnvironmentProvider[];
+//#endregion
+//#region src/chat/execution-cache.d.ts
+interface SessionExecution {
+  /** The session's execution context — pass as `AgentOptions.execution`. */
+  context: ExecutionContext;
+  /** Host-owned handle, spawned on first use — pass as `AgentOptions.handle`. */
+  handle: () => Promise<ExecutionHandle>;
+}
+interface SessionExecutionCache {
+  /**
+   * The session's execution, created with `create()` on first use and
+   * reused while `key` matches. A different `key` replaces it (the previous
+   * context is released in the background).
+   */
+  acquire: (sessionId: string, key: string, create: () => ExecutionContext) => SessionExecution;
+  /**
+   * The session's current execution, whatever its key — for side work
+   * (environment actions) that must run where the agent runs without
+   * re-deriving the key (a mismatch would replace the live context).
+   */
+  peek: (sessionId: string) => SessionExecution | undefined;
+  /**
+   * Hand the session's still-running background tasks to a newly built
+   * agent: rebind their exit/stall callbacks to `hooks` and fire
+   * `background:adopt` per task. Returns how many were adopted.
+   */
+  adopt: (sessionId: string, hooks: Agent['hooks']) => Promise<number>;
+  /** True while any background task on the session's handle is running. */
+  hasRunningTasks: (sessionId: string) => Promise<boolean>;
+  /**
+   * Destroy the session's handle (killing its tasks) and forget it. Resolves
+   * once the destroy has finished — including one already started by an
+   * earlier release or a key replacement — so a caller can rely on the
+   * session's processes being gone (e.g. before removing its worktree).
+   */
+  release: (sessionId: string) => Promise<void>;
+  /**
+   * {@link release} unless tasks are still running; resolves whether it
+   * released. `stillIdle` is re-checked after the (async) task listing,
+   * right before destroying — hosts pass "no agent was rebuilt for this
+   * session meanwhile", so an eviction can't pull the handle out from
+   * under a build that just acquired it.
+   */
+  releaseIfIdle: (sessionId: string, stillIdle?: () => boolean) => Promise<boolean>;
+  /** Release every session — host shutdown. */
+  releaseAll: () => Promise<void>;
+  /** Sessions currently holding an execution. */
+  sessions: () => string[];
+}
+declare function createSessionExecutionCache(): SessionExecutionCache;
+//#endregion
+//#region src/chat/extension-mcp-host.d.ts
+interface CreateExtensionMcpHostOptions {
+  /** Storage prefix (`.zidane`) the discovery reads `mcps.json` under. */
+  prefix: string;
+  /** Live settings: the allowlist (`enabledMcps`) and import toggles. */
+  readSettings: () => Partial<Settings> | undefined;
+  /** Stored MCP OAuth credentials; omitted → OAuth servers can't connect. */
+  credentialStore?: () => McpCredentialStore;
+  /** Close a connection after this long without a call. Default 60 s. */
+  idleMs?: number;
+  /** How long a cwd's server list is reused. Default 10 s. */
+  serversTtlMs?: number;
+  /** Test seam: replaces `connectMcpServers`. */
+  connect?: (configs: McpServerConfig[], opts: {
+    buildAuthProvider?: (config: McpServerConfig) => McpOAuthProvider | undefined;
+  }) => Promise<McpConnection>;
+}
+declare function createExtensionMcpHost(options: CreateExtensionMcpHostOptions): ExtensionMcpHost;
+//#endregion
 //#region src/chat/footer-hints.d.ts
 /**
  * Options bag for {@link buildHints}. Flat shape so call sites read as a
@@ -1458,13 +3333,7 @@ interface GenerateSessionTitleOptions {
  * Output is trimmed, single-line, with surrounding quotes / trailing
  * punctuation stripped, and truncated to `TITLE_MAX_CHARS`.
  */
-declare function generateSessionTitle({
-  provider,
-  model,
-  turns,
-  maxTurns,
-  signal
-}: GenerateSessionTitleOptions): Promise<string>;
+declare function generateSessionTitle({ provider, model, turns, maxTurns, signal }: GenerateSessionTitleOptions): Promise<string>;
 /**
  * Decide whether a session is ready for one-shot automatic titling.
  *
@@ -1495,10 +3364,129 @@ declare function shouldAutoGenerateTitle(turns: readonly SessionTurn[], metadata
  *     without it.
  *   - Truncate to `TITLE_MAX_CHARS` with a trailing `…` when over.
  *
- * Exported as `cleanTitle` so tests can pin the normalization rules
- * without going through a mock provider.
+ * Exported as `cleanTitle` so tests can pin the normalization rules
+ * without going through a mock provider.
+ */
+declare function cleanTitle(raw: string): string;
+//#endregion
+//#region src/chat/host-scoped-settings.d.ts
+/**
+ * Settings that belong to the window even while a host owns the settings
+ * file (daemon or remote mode): which host the next launch uses.
+ */
+declare const WINDOW_LOCAL_SETTINGS: readonly ["useDaemon", "remoteHosts"];
+declare function isWindowOnlySetting(key: keyof Settings | string): boolean;
+/** The allowlists a host leaving them unset means "everything enabled" for. */
+declare const HOST_ENABLED_LISTS: readonly ["enabledSkills", "enabledMcps", "enabledExtensions", "enabledPlugins", "disabledMcpTools"];
+/** `local` with the host's values for every key the host owns. */
+declare function overlayHostSettings<S extends Settings>(local: S, host: Partial<Settings>): S;
+/** Split a settings patch into the window's part and the host's part. */
+declare function splitHostSettingsPatch<S extends Partial<Settings>>(patch: S): {
+  window: Partial<S>;
+  host: Partial<S>;
+};
+//#endregion
+//#region src/chat/system-md.d.ts
+/** A discovered `SYSTEM.md`. */
+interface SystemMdFile {
+  path: string;
+  source: 'project' | 'user';
+  contents: string;
+}
+/** Result of {@link discoverSystemMd}. */
+interface SystemMdResult {
+  /**
+   * The winning override, or `null` when no `SYSTEM.md` exists (the built-in
+   * doctrine then applies unchanged).
+   */
+  file: SystemMdFile | null;
+  /**
+   * Files that exist but lost to `file` on precedence. Non-empty only when the
+   * user has both a project and a user `SYSTEM.md`. Surfaced so the UI can mark
+   * them as inactive instead of leaving the user wondering why edits to one of
+   * them changed nothing.
+   */
+  shadowed: readonly SystemMdFile[];
+}
+interface DiscoverSystemMdOptions {
+  /** Discovery cwd. Default: `process.cwd()`. */
+  cwd?: string;
+  /** User home directory. Default: `os.homedir()`. */
+  home?: string;
+  /** Storage prefix. Leading dot tolerated. Default: `'.zidane'`. */
+  prefix?: string;
+  /**
+   * Which scopes may contribute an override — the same
+   * {@link AgentsMdScope} the host applies to `AGENTS.md`, so one setting
+   * governs both surfaces:
+   *   - `'none'`    — no override, ever. Short-circuits before any FS probe.
+   *   - `'user'`   — only `~/.{prefix}/SYSTEM.md`. The repo's file is IGNORED,
+   *                   which is the whole point of the setting: it is how a user
+   *                   says "do not trust this checkout".
+   *   - `'project'` — only `<root>/SYSTEM.md`.
+   *   - `'both'`   — union, project winning (default).
+   *
+   * Previously a boolean that only implemented `'none'`, so `'user'` still let a
+   * repo-root `SYSTEM.md` replace the entire doctrine — exactly the case the
+   * setting exists to prevent.
+   */
+  scope?: AgentsMdScope;
+}
+/**
+ * Absolute path of the USER-scope `SYSTEM.md` — the file the TUI creates when
+ * the user asks for an override and none exists yet.
+ *
+ * Exported so the host doesn't hardcode the layout and can't drift from what
+ * discovery actually reads.
+ */
+declare function userSystemMdPath(opts?: {
+  home?: string;
+  prefix?: string;
+}): string;
+/**
+ * Whether a USER-scope `SYSTEM.md` would be loaded under `scope`.
+ *
+ * Mirrors the candidate filter in {@link discoverSystemMd} so a host can ask
+ * "would writing `~/.{prefix}/SYSTEM.md` accomplish anything?" without
+ * re-deriving the rule and drifting from it. `'project'` excludes the user
+ * candidate and `'none'` skips discovery altogether, so under either setting
+ * creating that file is a silent no-op.
+ */
+declare function userScopeOverridesLoad(scope: AgentsMdScope | undefined): boolean;
+/**
+ * Find the active `SYSTEM.md` override, if any.
+ *
+ * Project paths anchor at the git root when one exists above `cwd`, else at
+ * `cwd` — the same anchor as skills / mcps / AGENTS.md discovery, so all four
+ * surfaces agree on what "this project" means.
+ *
+ * Tolerant: an unreadable or empty file is treated as absent (logged under
+ * `ZIDANE_DEBUG`) and the next candidate gets its turn. Never throws — this
+ * runs on the session-activation path.
+ *
+ * Candidates are filtered by {@link DiscoverSystemMdOptions.scope}, mirroring
+ * how `discoverAgentsMd` builds its own list.
+ */
+declare function discoverSystemMd(opts?: DiscoverSystemMdOptions): SystemMdResult;
+/**
+ * Seed contents for a freshly created `SYSTEM.md` override, built from the
+ * built-in doctrine.
+ *
+ * Seeding with the real doctrine (rather than an empty file) means creating the
+ * override is a behavioral no-op until the user edits it. An empty seed would
+ * silently delete every line of doctrine the moment the file appeared, making
+ * the agent measurably worse with no visible cause.
+ *
+ * `currentSystem` should be DOCTRINE ONLY — callers pass
+ * `splitSystemPrompt(doctrineOnlySystem()).static`, which excludes both the
+ * generated `<env>` block (rebuilt per turn) and the `AGENTS.md` block. Baking
+ * the latter in would duplicate it, since it is re-appended below the override
+ * on every compose.
+ *
+ * `scope` is the active `userInstructionsScope`; it decides whether the seed's
+ * precedence note is true — see {@link projectScopeOverridesLoad}.
  */
-declare function cleanTitle(raw: string): string;
+declare function renderSystemMdSeed(currentSystem: string, scope?: AgentsMdScope): string;
 //#endregion
 //#region src/chat/host/provider-diagnostic.d.ts
 type ProviderDiagnostic = Pick<Parameters<AgentHooks['provider:diagnostic']>[0], 'requestId' | 'stage' | 'event' | 'elapsedMs' | 'stageElapsedMs' | 'attempt' | 'runId' | 'turnId' | 'httpStatus' | 'upstreamRequestId' | 'transportAttempt' | 'networkCode' | 'retryAfter'>;
@@ -1592,6 +3580,12 @@ interface SendOptions {
    * and a silent prose send is indistinguishable from a broken command.
    */
   asCommand?: string;
+  /**
+   * Sent from outside the composer (Continue, Retry, a palette prompt): the
+   * shared draft was not consumed, so the daemon leaves it alone instead of
+   * clearing it in every other window.
+   */
+  keepDraft?: boolean;
 }
 /**
  * Wire-safe summary of an extension-contributed `/` command — the
@@ -1683,27 +3677,27 @@ type HostSignal = {
   runId: string;
   ok: boolean;
   error?: string;
-}
+} |
 /**
  * A turn finished. `usage` carries the loop-reported token/cost figures
  * that drive footer gauges (context size = prompt-side tokens of the
  * LAST parent turn; cost accrues across parent + child turns).
  */
-| {
+{
   kind: 'turn:end';
   sessionId: string;
   turnId: string;
   childId?: string;
   depth?: number;
   usage?: TurnUsage;
-}
+} |
 /**
  * `echo: true` marks host-generated SEND/STEER echoes of the user's own
  * message. Clients that already render the prompt locally (the GUI's
  * enriched append) drop echo-tagged signals; command-module
  * user-prompts are never echoes and always render.
  */
-| {
+{
   kind: 'event';
   sessionId: string;
   event: StreamEvent;
@@ -1711,7 +3705,7 @@ type HostSignal = {
 } | {
   kind: 'compacting:start';
   sessionId: string;
-}
+} |
 /**
  * Live token estimate for an in-flight compaction summary. Throttled by the
  * loop, so this is a low-rate progress tick rather than a stream.
@@ -1720,11 +3714,11 @@ type HostSignal = {
  * indication of progress — a compaction of a large transcript can run for
  * minutes, which is indistinguishable from a hang.
  */
-| {
+{
   kind: 'compacting:progress';
   sessionId: string;
   estOutputTokens: number;
-}
+} |
 /**
  * Live counters for the parent turn currently streaming — the loop's
  * `stream:progress` (throttled ~4/s, one final tick before `stream:end`).
@@ -1734,10 +3728,10 @@ type HostSignal = {
  * session figure while streaming and drop it when the matching `turn:end`
  * brings the real `usage.cost`.
  */
-| ({
+({
   kind: 'stream:progress';
   sessionId: string;
-} & StreamProgressInfo)
+} & StreamProgressInfo) |
 /**
  * Prompt turns that just persisted, reduced to the fields needed to bind a
  * live `user-prompt` event to its turn id (see {@link PromptTurnRef}).
@@ -1748,17 +3742,17 @@ type HostSignal = {
  * daemon-attached window is unselectable — no hover, edit, or delete — until
  * the run-end transcript replace.
  */
-| {
+{
   kind: 'prompt-turns';
   sessionId: string;
   refs: readonly PromptTurnRef[];
-}
+} |
 /**
  * `effectiveTokens` (success only) is the loop's post-compact context
  * estimate — windows drop their footer ctx gauge to it immediately
  * instead of waiting for the next turn's usage.
  */
-| {
+{
   kind: 'compacting:end';
   sessionId: string;
   ok: boolean;
@@ -1782,23 +3776,23 @@ type HostSignal = {
   kind: 'todos:snapshot';
   sessionId: string;
   snapshot: TodosSnapshot;
-}
+} |
 /**
  * The session recorded an artifact (PR, branch, commit, file, extension
  * kind — see `session/artifacts.ts`). Carries the stored row so a window
  * can badge / list without a round-trip; `sessions.artifacts` is the
  * authoritative query. Additive — older clients ignore unknown kinds.
  */
-| {
+{
   kind: 'artifact:recorded';
   sessionId: string;
   artifact: SessionArtifact;
-}
+} |
 /**
  * An artifact was removed or refreshed through the host (`artifacts.delete`
  * / `artifacts.upsert`) — windows re-query. Carries the row for `upsert`.
  */
-| {
+{
   kind: 'artifact:changed';
   sessionId: string;
   op: 'delete' | 'upsert';
@@ -1813,16 +3807,88 @@ type HostSignal = {
   kind: 'interaction:resolved';
   sessionId: string;
   requestId: string;
+} |
+/**
+ * Dev browser (`browser.ts` hub): a tool call for the page, addressed to
+ * the registered browser host (`hostId`); other clients ignore it. The
+ * host answers through `browser.respond`. `browser:cancel` withdraws it.
+ */
+{
+  kind: 'browser:request';
+  sessionId: string;
+  hostId: string;
+  request: BrowserRequest;
+} | {
+  kind: 'browser:cancel';
+  sessionId: string;
+  hostId: string;
+  requestId: string;
+} |
+/**
+ * Terminals (`terminal.ts` manager). `changed` carries the session's full
+ * list; `output` is a batch starting at `offset` (clients drop what they
+ * already have and `terminal.ack` what they wrote); `reset` replaces a
+ * view's content with history after a client fell too far behind.
+ */
+{
+  kind: 'terminal:changed';
+  sessionId: string;
+  terminals: TerminalInfo[];
+} | {
+  kind: 'terminal:output';
+  sessionId: string;
+  terminalId: string;
+  offset: number;
+  data: string;
+} | {
+  kind: 'terminal:reset';
+  sessionId: string;
+  terminalId: string;
+  offset: number;
+  data: string;
+} |
+/**
+ * A streamed workspace command (`sessions.workspaceExecStream`): its output
+ * in arrival order, then exactly one `exit`. Sent to the connection that
+ * started it only, never fanned out or replayed. `code` is `null` and
+ * `signal` set when the host killed it (`cancelled`: the client asked;
+ * `truncated`: the output cap was reached).
+ */
+{
+  kind: 'workspace:exec:data';
+  execId: string;
+  stream: 'stdout' | 'stderr';
+  chunk: string;
+} | {
+  kind: 'workspace:exec:exit';
+  execId: string;
+  code: number | null;
+  signal: string | null;
+  truncated?: true;
+  cancelled?: true;
+} |
+/**
+ * A client installed, updated or removed something on the host
+ * (`catalog.install` / `remove` / `update`, `mcp.upsert` / `remove`): every
+ * window re-reads that catalog.
+ */
+{
+  kind: 'catalog:changed';
+  catalog: 'skills' | 'mcps' | 'extensions' | 'plugins';
+} |
+/** A server's settings-sync record changed (a claim, a push, an override, a reset): settings UIs re-read `sync.status`. */
+{
+  kind: 'sync:changed';
 } | {
   kind: 'approval:request';
   request: WireApprovalRequest;
-}
+} |
 /**
  * An approval left the pending queue (answered or denied in bulk) — every
  * OTHER window clears its surface. The window that resolved it already
  * knows; the signal makes the queue converge everywhere else.
  */
-| {
+{
   kind: 'approval:resolved';
   sessionId: string;
   requestId: string;
@@ -1831,17 +3897,17 @@ type HostSignal = {
   kind: 'sessions:changed';
   op: 'create' | 'update' | 'delete';
   sessionId: string;
-}
+} |
 /**
  * Settings were written through the host (`settings.set`) — every window
  * applies the new state so settings UIs converge without a restart.
  * Windows that persist settings themselves must treat this as
  * authoritative for the delivered snapshot.
  */
-| {
+{
   kind: 'settings:changed';
   settings: HostSettings;
-}
+} |
 /**
  * Another window edited the session's shared prompt draft. The daemon
  * EXCLUDES the originating peer from this fan-out, so applying it can
@@ -1849,34 +3915,34 @@ type HostSignal = {
  * (last-writer-wins whole-text replacement). Empty `text` clears the
  * draft (broadcast when any window submits the prompt).
  */
-| {
+{
   kind: 'draft:changed';
   sessionId: string;
   text: string;
   shell?: boolean;
-}
+} |
 /**
  * The shared draft's composing ATTACHMENTS changed (paste/drop/remove in
  * any window). Payloads ride along so a remote window can submit the
  * shared draft attachments-and-all. Same origin-exclusion as text.
  */
-| {
+{
   kind: 'draft:attachments';
   sessionId: string;
   attachments: PromptAttachment[];
-}
+} |
 /**
  * The session's shared transcript-search state changed (mode entered /
  * exited, query edited) in another window. Same origin-exclusion and
  * last-writer-wins contract as the draft — every window on the session
  * shows the same filtered transcript.
  */
-| {
+{
   kind: 'search:changed';
   sessionId: string;
   active: boolean;
   query: string;
-}
+} |
 /**
  * The daemon resolved another window's inline-autocomplete query
  * (`suggest.resolve`). Excludes the requesting peer (it already has
@@ -1884,7 +3950,7 @@ type HostSignal = {
  * when their live buffer still equals `basis` — the standard
  * staleness guard; otherwise discard.
  */
-| {
+{
   kind: 'suggest:changed';
   sessionId: string;
   seq: number;
@@ -1892,41 +3958,71 @@ type HostSignal = {
   caret: number;
   suggestion: string | null;
   candidates?: string[];
-}
+} |
 /**
  * The daemon-side agent's active-skill set changed (`skills_use` /
  * run-end deactivation). Windows mirror it into their skill chips.
  */
-| {
+{
   kind: 'skills:snapshot';
   sessionId: string;
   active: string[];
-}
+} |
 /**
  * A daemon-side MCP server needs (re-)authentication. Windows surface
  * the badge; the interactive login flow itself runs in whichever window
  * the user triggers it from (tokens land in the shared credential
  * store; the daemon reconnects on the next agent rebuild).
  */
-| {
+{
   kind: 'mcp:auth';
   sessionId: string;
   name: string;
   reason: string;
-}
+} |
+/**
+ * The session agent's MCP bootstrap finished: every server has its
+ * outcome (`mcp:status` / `mcp:auth` came first). A window's deadline for
+ * the one-shot auto-login it arms when the user adds a server.
+ */
+{
+  kind: 'mcp:settled';
+  sessionId: string;
+} |
+/**
+ * A host-side MCP server connected, or failed to. Windows feed it to the
+ * same status reducer the in-process path uses (badges: connected, signed
+ * in, needs sign-in, key refused, couldn't connect). `error` is the
+ * failure's message and `code` its HTTP-ish code when it had one, enough
+ * for the shared classifier (`classifyMcpTest`) to read it the same way.
+ */
+{
+  kind: 'mcp:status';
+  sessionId: string;
+  name: string;
+  status: 'connected';
+} | {
+  kind: 'mcp:status';
+  sessionId: string;
+  name: string;
+  status: 'failed';
+  transport: string;
+  error: string;
+  code?: number;
+} |
 /**
  * Provider retry in progress (rate-limit / overload / silent stall) —
  * drives the footer's "retrying n/m" indicator. `source` is `'parent'`
  * or the retrying child's id; the indicator clears when that source
  * streams again or the run ends.
  */
-| {
+{
   kind: 'stream:retry';
   sessionId: string;
   attempt: number;
   max: number;
   source: string;
-}
+} |
 /**
  * A retried stream reached a terminal state for `source` (`'parent'` or a
  * child id) — clear that source's retry indicator.
@@ -1936,11 +4032,11 @@ type HostSignal = {
  * this exists for the mid-run case, where a subagent's stream fails while
  * the parent run continues and the indicator would otherwise stick.
  */
-| {
+{
   kind: 'stream:retry:cleared';
   sessionId: string;
   source: string;
-}
+} |
 /**
  * Which `SYSTEM.md` override (if any) the host folded into this session's
  * system prompt, emitted at agent-build time.
@@ -1953,12 +4049,12 @@ type HostSignal = {
  * doctrine they think they replaced. `shadowed` carries precedence losers
  * so the Instructions surface can mark them inactive.
  */
-| {
+{
   kind: 'system-md';
   sessionId: string;
   file: SystemMdFile | null;
   shadowed: readonly SystemMdFile[];
-}
+} |
 /**
  * A cache-prefix break was detected for this session's last request — the
  * footer chip names the culprit dimension and the re-billed prefix size.
@@ -1966,7 +4062,7 @@ type HostSignal = {
  * only the daemon can observe it. Cost pricing stays window-side (it needs
  * only the provider key and the token count).
  */
-| {
+{
   kind: 'cache:break';
   sessionId: string;
   info: CacheBreakInfo;
@@ -1974,46 +4070,68 @@ type HostSignal = {
   kind: 'provider:diagnostic';
   sessionId: string;
   diagnostic: ProviderDiagnostic;
-}
+} |
 /**
  * Presence snapshot — recomputed and fanned out whenever a window
  * attaches/detaches or any tracked session's run/HITL state changes.
  * Full snapshot (the set is small: only live sessions appear).
  */
-| {
+{
   kind: 'presence:changed';
   sessions: SessionPresence[];
-}
+} |
+/** A machine of this host came online or went offline (`docs/MACHINES.md`). */
+({
+  kind: 'machine:status';
+} & MachineStatusChange) |
+/** This local host's machine links changed (`machines.links.status`): shares of this computer, servers used as machines. */
+{
+  kind: 'machine:links';
+  links: MachineLinksStatus;
+} |
+/**
+ * A server lending itself as a machine to the local host on this
+ * connection (`machine.attach`): one of its machine notifications
+ * (`terminal.data`, `task.exit`, `exec.stream.*`). Sent to that
+ * connection only, never broadcast.
+ */
+{
+  kind: 'machine:notification';
+  method: string;
+  params: JsonValue;
+} |
 /**
  * Daemon-side extension HUD snapshot (status lines + banners). Extension
  * hooks run in the daemon in daemon mode, so their `ctx.tui.setStatus` /
  * `setBanner` writes happen there — windows overlay this state under
  * their local HUD (local entries win per extension name).
  */
-| {
+{
   kind: 'hud:state';
   statuses: Record<string, {
     text: string;
     loader: boolean;
   }>;
   banners: Record<string, string[]>;
-} /** Daemon-side extension `ctx.tui.notify` — a one-shot transcript line. */ | {
+} |
+/** Daemon-side extension `ctx.tui.notify` — a one-shot transcript line. */
+{
   kind: 'hud:notify';
   extension: string;
   text: string;
   tone: 'info' | 'warn' | 'error';
-}
+} |
 /**
  * The session's type-ahead queue changed (message queued while a run is
  * in flight, drained by the host on run end, pushed early, or dropped).
  * Broadcast to EVERY peer including the origin — the queue box is shared
  * state and all windows render the same list.
  */
-| {
+{
   kind: 'queue:changed';
   sessionId: string;
   items: QueuedItem[];
-}
+} |
 /**
  * Extension bus message (`ctx.bus.emit`, `'ipc'` permission). PRIVATE
  * per `extensionId`: receivers re-inject into the SAME extension's local
@@ -2026,7 +4144,7 @@ type HostSignal = {
  * is the emitter's per-process random id (additive — absent from older
  * peers, which dedupe on seq alone).
  */
-| {
+{
   kind: 'extension:signal';
   extensionId: string;
   sessionId?: string;
@@ -2079,14 +4197,66 @@ interface ChatHostEnvironment {
   hostRuntime?: ExtensionHostRuntimeBridge;
   /** Base user-data directory (`~/.zidane`) — safelist, tool-result blobs. */
   userDataDir: () => string;
+  /**
+   * Root of the per-session artifact tree (`<dir>/sessions/<id>/`): persisted
+   * tool outputs, background-task logs, MCP warning logs. Forks re-home and
+   * deletes clean there. Defaults to {@link userDataDir}.
+   */
+  cacheDir?: () => string;
   /** Re-apply provider auth env right before building a provider. */
   applyAuthEnv?: () => void;
   /** OAuth credential store for MCP servers, when the host supports MCP auth. */
   mcpCredentialStore?: () => McpCredentialStore;
   /** Durable pending-approval persistence. Defaults to in-memory only. */
   approvalsPersistence?: PendingApprovalsStore;
+  /**
+   * Session environment providers (`chat/environment.ts`). Defaults to the
+   * built-ins (`local`). Hosts add kinds here (worktree, docker, sandboxes).
+   */
+  environments?: EnvironmentRegistry;
+  /** Environment secret store. Defaults to `<userDataDir>/environment-credentials.json`. */
+  environmentSecrets?: () => EnvironmentSecrets;
+  /** How often idle environments are checked against their kind's `idleSuspendMinutes`. Default 60 s (tests shorten it). */
+  environmentIdleSweepMs?: number;
   /** Opt-in verbose stream logging to the host console. */
   debugStream?: boolean;
+  /**
+   * Confine the host to these folders (a zidane-server's `workspaceRoots`;
+   * they must exist). The host checks them at every entry point that takes
+   * a folder or a path (`ChatHost.workspace`, `../workspace-confinement`):
+   * session creation (the wire, orchestration workers), folder changes,
+   * launch-override `cwd`s (dropped), command / environment scans, and the
+   * workspace file and exec methods, which also never reach the data dir
+   * (`userDataDir`). A session without a folder works in the first root.
+   * Unset (local hosts): unconfined.
+   */
+  workspaceRoots?: readonly string[];
+  /**
+   * Set by a zidane-server: it takes machines whatever its `remoteHosts`
+   * setting (a server is remote by nature). Unset (local hosts): machines
+   * exist only while remote hosts are on; off, `machines.json` is never read
+   * and no machine kind resolves. `principalLive` answers whether a machine
+   * token is still valid: a machine id is bound to the token that first
+   * registered it until that token is revoked (`docs/MACHINES.md` § Security model).
+   */
+  machineHost?: {
+    principalLive?: (principal: string) => boolean;
+  };
+  /**
+   * Whether this host has a surface that can show terminals (the GUI).
+   * `false` (a host in the TUI's own process) turns the terminal feature off
+   * for its agents: no terminal tools, background tasks on plain pipes.
+   * Default `true`; the `terminal*` settings still apply on top.
+   */
+  terminals?: boolean;
+  /**
+   * Called with every agent the host builds (rebuilds included), before its
+   * first run. The embedder's own instrumentation, such as lifecycle logging
+   * into the TUI's Logs tab for a host in the TUI's process.
+   */
+  instrumentAgent?: (agent: Agent, context: {
+    sessionId: string;
+  }) => void;
 }
 //#endregion
 //#region src/chat/host/approvals.d.ts
@@ -2099,6 +4269,8 @@ interface ApprovalRequestInput {
   priorContent?: string | null;
   preview?: SerializedPreview;
   originator?: ApprovalOriginator;
+  /** Skip the persisted safelist and offer nothing to remember: the prompt must show every time. */
+  alwaysAsk?: boolean;
 }
 interface ApprovalHub {
   request: (input: ApprovalRequestInput) => Promise<ApprovalDecision>;
@@ -2111,29 +4283,12 @@ interface ApprovalHub {
 /** In-memory fallback when the host doesn't provide durable persistence. */
 declare function createMemoryApprovalsStore(): PendingApprovalsStore;
 declare function createApprovalHub(options: {
-  broadcast: (signal: HostSignal) => void; /** Base dir for the shared `projects.json` safelist (`~/.zidane`). */
+  broadcast: (signal: HostSignal) => void;
+  /** Base dir for the shared `projects.json` safelist (`~/.zidane`). */
   userDataDir: () => string;
   persistence?: PendingApprovalsStore;
 }): ApprovalHub;
 //#endregion
-//#region src/chat/host/compaction.d.ts
-interface CompactionEntry {
-  sessionId: string;
-  cwd: string;
-  agent: Agent;
-  providerKey: ProviderKey;
-  providerDescriptor?: ProviderDescriptor;
-  model: string;
-  compactionController?: AbortController;
-}
-/**
- * Run `compactConversation` against the session's current turns, persist
- * the resulting summary as a new turn, and emit a compact-summary stream
- * event. Brackets the in-flight window with `compacting:start` /
- * `compacting:end` signals.
- */
-declare function runCompaction(entry: CompactionEntry, broadcast: (signal: HostSignal) => void, store: SessionStore): Promise<void>;
-//#endregion
 //#region src/chat/host/edit-outcome-ledger.d.ts
 interface PendingAnnotation {
   outcomes: readonly EditOutcome[];
@@ -2153,6 +4308,184 @@ declare class EditOutcomeLedger {
   clear(): void;
 }
 //#endregion
+//#region src/chat/model-chain-metadata.d.ts
+interface ModelFallbackTarget {
+  providerKey: ProviderKey;
+  modelId: string;
+}
+/**
+ * Assemble the `metadata.modelChain` value for a model pick — the full
+ * canonical chain when at least one valid fallback survives filtering,
+ * `undefined` for a single-model pick (metadata merges JSON-serialize,
+ * so `undefined` REMOVES a previously persisted chain).
+ */
+declare function modelChainMetadata(providerKey: ProviderKey, modelId: string, fallbacks: readonly ModelFallbackTarget[] | undefined): ModelChainEntry[] | undefined;
+/**
+ * Validated fallback tail for list rows/pickers — head-matched against
+ * the session's persisted primary, unregistered providers kept (the
+ * caller filters against its own registry when it has one).
+ */
+declare function sessionModelFallbacks(metadata: Record<string, unknown> | undefined): ModelFallbackTarget[] | undefined;
+//#endregion
+//#region src/chat/session-factory.d.ts
+interface CreateSessionInStoreParams {
+  /**
+   * Tool-execution directory; `projectRoot` is derived from it. `''` creates a
+   * DIRECTORY-LESS session (the GUI's "Chats" bucket): no project, and
+   * `resolveSessionCwd` anchors tool execution at the user's HOME at run time.
+   */
+  cwd: string;
+  /** Explicit id. Omitted → the store's generator, else a random UUID. */
+  id?: string;
+  title?: string;
+  /** Profile the session starts in. Defaults to `DEFAULT_AGENT_ID` (`build`). */
+  agentId?: string;
+  providerKey?: string;
+  modelId?: string;
+  fallbacks?: readonly ModelFallbackTarget[];
+  /** Mark as an extension-authoring session (auto-activates the docs skill). */
+  extensionEdit?: boolean;
+  /** Mark as a skill-authoring session for the named skill (dir = `cwd`). */
+  skillEdit?: {
+    name: string;
+  };
+  /**
+   * Where the session's work happens (see `environment.ts`) — resolved by the
+   * host (`initialEnvironment`), which also provisions it. Omitted or local +
+   * ready → nothing is stamped: an absent environment IS the local one.
+   */
+  environment?: SessionEnvironment;
+  /**
+   * Extra host-specific metadata (e.g. a pinned-skills seed). Applied FIRST,
+   * so every canonical key stamped here wins on collision.
+   */
+  metadata?: Record<string, unknown>;
+}
+/**
+ * Build a new, UNSAVED session with every creation-time field stamped:
+ * `projectRoot` (git root of `cwd`), `cwd`, `agentId`, `title`, the model and
+ * its fallback chain, the authoring markers, and the environment.
+ *
+ * Unsaved on purpose: the TUI's local runtime creates the session when a chat
+ * opens but only persists it on the first run, so opening and abandoning
+ * `/new` never leaves an empty row behind. Everyone else wants
+ * {@link createSessionInStore}.
+ *
+ * `store` may be `undefined` for an in-memory-only session (ACP without a
+ * store): same stamping, no persistence.
+ */
+declare function newSession(store: SessionStore | undefined, params: CreateSessionInStoreParams): Promise<Session>;
+/** Create and persist a session; returns its id. */
+declare function createSessionInStore(store: SessionStore, params: CreateSessionInStoreParams): Promise<string>;
+/**
+ * Create the orchestration main session; returns its id.
+ *
+ * Directory-less on purpose. The main is GLOBAL — one per store, orchestrating
+ * sessions in many directories — so binding it to whichever cwd happened to be
+ * active when the toggle flipped put it in that project's group and hid it
+ * from every other project's list. With no cwd it sits in the "Chats" bucket
+ * and its own tools run from HOME, which is the only directory that is always
+ * the user's and never a project's.
+ */
+declare function createMainSession(store: SessionStore): Promise<string>;
+/** What a fork reads from its parent — satisfied by `SessionData` and a live `Session`. */
+type ForkSource = Pick<SessionData, 'id' | 'turns' | 'runs' | 'metadata' | 'agentId' | 'projectRoot'>;
+interface ForkSessionParams {
+  /**
+   * Parent session — an id to load from `store`, or the parent itself (a
+   * host holding the live `Session` passes it so unsaved turns fork too).
+   */
+  source: ForkSource | string;
+  /** Last turn the fork keeps (inclusive); the prefix is made protocol-clean. */
+  turnId: string;
+  /**
+   * Root of the per-session artifact tree (`<userDir>/sessions/<id>/`) that
+   * the parent's persisted-output stubs point into. The fork gets its own
+   * copies so deleting the parent can't strand the fork's content.
+   */
+  userDir: string;
+  /** Title override. Default: the parent's explicit title, if any. */
+  title?: string;
+}
+type ForkSessionResult = {
+  ok: true;
+  id: string;
+} | {
+  ok: false;
+  reason: 'source-not-found' | 'turn-not-found' | 'environment-not-ready';
+};
+/** The error a user sees when a fork is refused, the same on every surface. */
+declare function describeForkFailure(reason: Extract<ForkSessionResult, {
+  ok: false;
+}>['reason'], sessionId: string, turnId: string): string;
+/**
+ * Create and persist a new session whose history is the parent's turns up to
+ * and including `turnId`. The parent is untouched.
+ *
+ * Carries: the protocol-clean turn prefix, the run records those turns
+ * reference (so run stats survive and the next run can't re-mint `run_1`
+ * over an existing reference), persisted-output blobs (copied and re-pointed),
+ * `projectRoot` (a fork belongs to its parent's project, wherever it was
+ * forked from), `agentId`, {@link FORK_INHERITED_METADATA_KEYS}, and the
+ * parent's environment — marked not-owned: the fork runs in the same
+ * worktree / sandbox but deleting it never tears that down. Refused while
+ * the parent's environment isn't `ready`: nothing would provision the fork's
+ * copy, and provisioning it would mint an environment nobody owns.
+ */
+declare function forkSession(store: SessionStore, params: ForkSessionParams): Promise<ForkSessionResult>;
+/**
+ * Delete a session's persisted data: the store row, then every on-disk
+ * artifact it owns — the session-first tree (`<userDir>/sessions/<id>/`:
+ * blobs, task logs, MCP warnings) plus the two pre-session-first locations
+ * migration leaves behind. Blob cleanup is best-effort and never throws; it
+ * runs AFTER the row delete so a cleanup failure can't leave a live row
+ * pointing at removed blobs.
+ *
+ * Does NOT stop a live agent — hosts must retire it first (see
+ * `ChatHost.deleteSession`), or its next save resurrects the row.
+ */
+declare function deleteSessionData(store: SessionStore, sessionId: string, opts: {
+  userDir: string;
+}): Promise<void>;
+//#endregion
+//#region src/chat/workspace-confinement.d.ts
+interface WorkspaceConfinement {
+  readonly confined: boolean;
+  /** Real paths: the workspace roots, or the user's home when unconfined. */
+  readonly roots: readonly string[];
+  /** The real path of `path` when it is a folder inside the roots; throws otherwise. */
+  resolveFolder: (path: string) => string;
+  /** A folder a session runs in or a scan reads: checked when confined (real path returned); `''` (no folder) passes. */
+  checkFolder: (cwd: string) => string;
+  /** A new session's folder from a client: `cwd` checked when confined, the first root when confined and empty. */
+  sessionFolder: (cwd: string) => string;
+  /** Where a session without a folder works on a confined host (the first root); `undefined` when unconfined. */
+  folderlessCwd: () => string | undefined;
+  /**
+   * A file or folder a workspace entry point reads or writes, on this
+   * machine's filesystem: when confined, its real path (the nearest existing
+   * ancestor's, for a file not written yet) must be inside the roots and not
+   * in the data dir, or inside `environmentRoot` (a folder the host made for
+   * the session, such as a worktree under the data dir). Throws otherwise;
+   * a no-op when unconfined.
+   */
+  checkPath: (path: string, environmentRoot?: string) => void;
+}
+//#endregion
+//#region src/chat/host/browser.d.ts
+interface BrowserHub {
+  registerHost: (hostId: string) => void;
+  unregisterHost: (hostId: string) => void;
+  hasHost: () => boolean;
+  /** Fires when the first host arrives or the last one leaves. */
+  onAvailabilityChange: (listener: (available: boolean) => void) => () => void;
+  request: <O extends BrowserOp>(sessionId: string, op: O, input: BrowserOpInputs[O], signal: AbortSignal) => Promise<BrowserResponse<O>>;
+  /** `fromHosts`: when given, only a request addressed to one of these hosts is answered. */
+  respond: (requestId: string, response: BrowserResponse, fromHosts?: ReadonlySet<string>) => {
+    ok: boolean;
+  };
+}
+//#endregion
 //#region src/chat/host/interactions.d.ts
 interface InteractionHub {
   /** Build the `requestInteraction` callback bound to one session. */
@@ -2198,7 +4531,144 @@ declare function createInteractionHub(options: {
   onPlanRejected?: (sessionId: string) => void;
 }): InteractionHub;
 //#endregion
-//#region src/chat/host/orchestration.d.ts
+//#region src/chat/host/launch-overrides.d.ts
+/** `zidane run --context …`: the execution this launch runs in, overriding the session's environment. */
+interface LaunchExecution {
+  /** Execution context kind (`docker`, `e2b`, `daytona`). `process` is the default and not an override. */
+  context: string;
+  image?: string;
+  env?: Record<string, string>;
+  pregame?: {
+    name: string;
+    content: string;
+  };
+  sandboxId?: string;
+  sandboxOnDestroy?: 'kill' | 'pause' | 'leave';
+}
+/** `ChatHost.setLaunchOverrides`: what the window overrides on a session's agent. */
+interface SessionLaunchOverrides {
+  /** Replaces the base system prompt (extension fragments still append). */
+  system?: string;
+  /** Extra MCP servers, after the discovered and plugin ones (which win a name collision). */
+  mcp?: readonly McpServerConfig[];
+  execution?: LaunchExecution;
+  /**
+   * Working directory picked mid-session (the TUI's cwd picker), instead of
+   * the session's folder: the live agent's tools move at once, its prompt on
+   * the next turn, and later builds use it. Not persisted.
+   */
+  cwd?: string;
+}
+/**
+ * The overrides that shape an agent, or `null` when none do (no `system`,
+ * no MCP server, no non-`process` context, no cwd). The one rule for "are launch
+ * overrides set", shared by the host, the daemon dispatcher, and the TUI.
+ */
+declare function normalizeLaunchOverrides(overrides: SessionLaunchOverrides | null | undefined): SessionLaunchOverrides | null;
+//#endregion
+//#region src/chat/host/machines/folders.d.ts
+interface ResolvedFolder {
+  cwd: string;
+  /** Set when the folder is a machine's: its name and its `local@` kind. */
+  machine?: {
+    name: string;
+    kind: string;
+  };
+}
+type FolderResolver = (cwd: string, kind?: string) => ResolvedFolder;
+//#endregion
+//#region src/chat/host/machines/project-files.d.ts
+interface MachineProject {
+  /** The project root on the machine: its git root when inside the roots, else the session folder. */
+  root: string;
+  /** Project-scope `AGENTS.md` / `CLAUDE.md`, in the order the local discovery loads them. */
+  agentsMd: AgentsMdFile[];
+  /** `<root>/SYSTEM.md`, when present. */
+  systemMd: SystemMdFile | null;
+  skills: SkillConfig[];
+  /** Stdio servers, context-scoped, placeholders resolved. */
+  mcps: DiscoveredMcp[];
+  /** What was left out, for the session's notices. */
+  notices: string[];
+}
+//#endregion
+//#region src/chat/host/machines/link.d.ts
+/** The transport's side of a live machine connection (`src/ipc/daemon/machine-gateway.ts`). */
+interface MachineConnection {
+  /** Rejects with {@link MachineLinkLostError} when the connection drops before the reply. */
+  request: (method: string, params: unknown) => Promise<unknown>;
+  notify: (method: string, params: unknown) => void;
+  close: (reason: string) => void;
+}
+interface MachineCallOptions {
+  /** The session the call is for: its notices, its give-up. */
+  sessionId?: string;
+  signal?: AbortSignal;
+  /** Called once when `signal` aborts a call already sent (cancel it machine-side). */
+  onAbort?: () => void;
+  /** `false`: fail at once when offline instead of waiting (teardown, terminal keystrokes). */
+  wait?: boolean;
+}
+interface TerminalListener {
+  onData: (data: Uint8Array) => void;
+  exit: (code: number) => void;
+  /** Bytes received so far: a reattach replays only what came after. */
+  seen: number;
+}
+/** A live `exec.stream` process, as the host side hears it. */
+interface StreamListener {
+  data: (stream: 'stdout' | 'stderr', bytes: Uint8Array) => void;
+  exit: (code: number) => void;
+}
+interface MachineLink {
+  readonly machineId: string;
+  name: () => string;
+  online: () => boolean;
+  call: <M extends MachineMethodName>(method: M, params: MachineParams<M>, options?: MachineCallOptions) => Promise<MachineResult<M>>;
+  /** Fire-and-forget; dropped while offline. */
+  notify: (method: string, params: unknown) => void;
+  /** Background task exits by task id (the machine sends `task.exit`). */
+  tasks: Map<string, (exit: unknown) => void>;
+  /** Live terminals by id (the machine sends `terminal.data` / `terminal.exit`). */
+  terminals: Map<string, TerminalListener>;
+  /** Live streams by call id (`exec.stream.data` / `exec.stream.exit`); a dropped link ends them (exit -1). */
+  streams: Map<string, StreamListener>;
+  /** A notification from the machine. */
+  deliver: (method: string, params: unknown) => void;
+  /** The registry swaps the connection (`null`: offline). */
+  setConnection: (connection: MachineConnection | null) => void;
+  connection: () => MachineConnection | null;
+  /** The host is closing: fail every waiting call, and wait no more. */
+  shutdown: () => void;
+}
+//#endregion
+//#region src/chat/host/machines/registry.d.ts
+/** One registered connection, as the transport drives it. */
+interface AttachedMachine {
+  result: MachineRegisterResult;
+  /** A notification the machine sent. */
+  notification: (method: string, params: unknown) => void;
+  /** Its connection closed. */
+  closed: () => void;
+}
+interface MachineRegistry {
+  list: () => MachineInfo[];
+  get: (machineId: string) => MachineInfo | undefined;
+  link: (machineId: string) => MachineLink | undefined;
+  attach: (params: MachineRegisterParams, connection: MachineConnection, meta?: {
+    principal?: string;
+  }) => AttachedMachine;
+  /** Forget a machine (it disconnects; its environments stop resolving). */
+  forget: (machineId: string) => boolean;
+  /** A notification for `machineId`'s link (tests drive it directly). */
+  deliver: (machineId: string, method: string, params: unknown) => void;
+  /** The host is draining: calls waiting for an offline machine fail now instead of holding the drain. */
+  close: () => void;
+  /** Run `fn` when the host drains (what keeps links to machines open stops with it). */
+  onClose: (fn: () => void) => void;
+}
+//#endregion
+//#region src/chat/host/orchestration/types.d.ts
 interface CreateWorkerParams {
   /** Directory the worker runs in — the headline use case. */
   cwd: string;
@@ -2272,7 +4742,98 @@ interface Orchestration {
   transcript: (mainId: string, sessionId: string, limit?: number) => Promise<string>;
 }
 //#endregion
-//#region src/chat/host/engine.d.ts
+//#region src/chat/host/session-title.d.ts
+/** The window's pick, honored when this host has that provider. */
+interface SessionTitleHint {
+  providerKey?: string;
+  model?: string;
+}
+//#endregion
+//#region src/chat/host/terminal/types.d.ts
+interface AgentTaskTerminal {
+  /** Pass as `execBackground`'s `terminal` option. */
+  options: BackgroundTerminalOptions;
+  /** The task started; `kill` ends it (closing the tab), `terminal` says whether it got a PTY. */
+  started: (task: {
+    taskId: string;
+    terminal: boolean;
+    kill: () => Promise<void>;
+  }) => void;
+  /** The task ended (or failed to start). */
+  exited: (exitCode: number | null) => void;
+}
+interface TerminalManager {
+  state: (sessionId: string) => Promise<TerminalSessionState>;
+  open: (input: TerminalOpenInput) => Promise<TerminalInfo>;
+  attach: (terminalId: string, clientId: string) => Promise<TerminalAttachResult>;
+  detach: (terminalId: string, clientId: string) => void;
+  /** Forget a client everywhere (its connection dropped). */
+  detachClient: (clientId: string) => void;
+  /** `from.response`: a reply the view's emulator generated, not typing (see the implementation). */
+  write: (terminalId: string, data: string, from?: {
+    clientId: string;
+    response?: boolean;
+  }) => Promise<void>;
+  resize: (terminalId: string, clientId: string, cols: number, rows: number, claim?: boolean) => void;
+  ack: (terminalId: string, clientId: string, offset: number) => void;
+  restart: (terminalId: string) => Promise<TerminalInfo>;
+  close: (terminalId: string) => Promise<void>;
+  setHidden: (terminalId: string, hidden: boolean) => void;
+  /** Who opened a terminal (`undefined` when unknown): approvals always ask before typing into a user's. */
+  ownerOf: (terminalId: string) => TerminalInfo['owner'] | undefined;
+  /** The agent's list of the session's terminals (skips hidden ones). */
+  list: (sessionId: string, opts?: {
+    includeHidden?: boolean;
+  }) => Promise<TerminalInfo[]>;
+  read: (sessionId: string, terminalId: string, opts?: {
+    since?: number;
+    lines?: number;
+  }) => Promise<TerminalReadResult>;
+  /** Resolves once output has been quiet for `quietMs` (or `maxMs` passed). */
+  settle: (terminalId: string, opts?: {
+    quietMs?: number;
+    maxMs?: number;
+    signal?: AbortSignal;
+  }) => Promise<void>;
+  /** A terminal for an agent background task, shown as an agent tab. */
+  agentTask: (sessionId: string, input: {
+    command: string;
+    cwd: string;
+    environment: string;
+  }) => AgentTaskTerminal;
+  /** Used recently (input or output), or running an agent task: keep the environment awake. */
+  busy: (sessionId: string, withinMs?: number) => boolean;
+  /** A user terminal runs in the session's execution and can't reconnect: releasing the execution would kill it. */
+  holdsExecution: (sessionId: string) => boolean;
+  /** Any user terminal that ends with this host (local PTYs) is running. */
+  hasRunningLocal: () => boolean;
+  /** The environment is pausing: let go of remote terminals (they reconnect later). */
+  suspendSession: (sessionId: string) => Promise<void>;
+  /** The session is gone: end its terminals and forget them. */
+  closeSession: (sessionId: string) => Promise<void>;
+  /**
+   * Terminals were turned off: end every terminal a user opened. Agent task
+   * terminals are left to their tasks (killing a running dev server over a
+   * settings switch would be worse than letting it finish).
+   */
+  closeUserTerminals: () => Promise<void>;
+  /** Host exit: end local terminals, let go of remote ones. */
+  shutdown: () => Promise<void>;
+  /**
+   * Clients that can SHOW terminals (the desktop app on the daemon). Only
+   * then does the agent get terminal tools: a TUI window, `zidane attach`, or
+   * the desktop app's in-process host has no terminal panel, so tools there
+   * would point the model at terminals nobody can see. Same contract as the
+   * browser hub's hosts.
+   */
+  registerViewer: (viewerId: string) => void;
+  unregisterViewer: (viewerId: string) => void;
+  hasViewer: () => boolean;
+  /** Fires when the first viewer arrives or the last one leaves. */
+  onViewerChange: (listener: (available: boolean) => void) => () => void;
+}
+//#endregion
+//#region src/chat/host/host-api.d.ts
 /**
  * Instructions-tab payload. Mirrors the TUI's `getContextSegments` contract so
  * both settings surfaces render identical rows and identical explanations for
@@ -2289,6 +4850,15 @@ interface ContextSegmentsReport {
   /** A `SYSTEM.md` on disk that lost precedence — surfaced so edits to it don't look ignored for no reason. */
   shadowedSystemPath?: string;
 }
+/** `ChatHost.workspaceExec` options: the execution contexts' own, minus the (process-local) abort signal. */
+interface WorkspaceExecOptions {
+  /** Working directory, resolved against the workspace root like any path. */
+  cwd?: string;
+  env?: Record<string, string>;
+  timeoutSeconds?: number;
+}
+/** `ChatHost.workspaceListFiles` options: `ListFilesOptions` minus the abort signal. */
+type WorkspaceListFilesOptions = Omit<ListFilesOptions, 'signal'>;
 /** Everything a model pick carries — see `ChatHost.setSessionModel`. */
 interface SessionModelPick {
   providerKey: ProviderKey;
@@ -2300,39 +4870,87 @@ interface SessionModelPick {
   /** Enabled model options for the new model; omitted clears them. */
   modelOptions?: Record<string, boolean>;
 }
+/** `ChatHost.createSession` input: the factory params, with the environment as a request the host resolves. */
+type CreateSessionRequest = Omit<CreateSessionInStoreParams, 'environment'> & {
+  /** Where the session's work happens. Omitted → local. */
+  environment?: EnvironmentRequest;
+};
 interface ChatHost {
   /** HITL hubs — exposed so transports can route respond/list/rehydrate calls. */
   interactions: InteractionHub;
   approvals: ApprovalHub;
+  /** Dev browser hub: the GUI registers as the host of the pages the `browser_*` tools drive. */
+  browser: BrowserHub;
+  /** The sessions' terminals (run in their environments; shown by the GUI, read by the agent). */
+  terminals: TerminalManager;
   sendPrompt: (opts: SendOptions) => Promise<{
     runId: string;
   }>;
   interrupt: (sessionId: string) => void;
-  steer: (sessionId: string, message: string) => void;
-  followUp: (sessionId: string, message: string) => void;
+  /** `false` when no run was live to take the message (it was dropped, not queued). */
+  steer: (sessionId: string, message: string) => boolean;
+  /** `false` when no run was live to take the message (it was dropped, not queued). */
+  followUp: (sessionId: string, message: string) => boolean;
   /** Steer when a run is active, start a fresh run otherwise. */
   pushQueued: (sessionId: string, message: string, activatedSkills?: string[]) => Promise<{
     delivered: 'steer' | 'send' | 'command' | 'queued';
   }>;
-  /** Wire-safe `/` command catalog for a client's completion popover. */
-  listCommands: (cwd: string) => Promise<CommandSummary[]>;
+  /**
+   * Where sessions may work: a server's workspace roots (`confined`), or
+   * unconfined on a local host. The host checks it itself at every entry
+   * point taking a folder or a path; embedders read it for listings.
+   */
+  workspace: WorkspaceConfinement;
+  /** Machines lending this host their execution (`docs/MACHINES.md`). */
+  machines: MachineRegistry;
+  /**
+   * Whose folder `cwd` is (`docs/MACHINES.md` § Folders): a machine kind's
+   * (`kind`, or the machine whose roots hold it when this host refuses it),
+   * checked against that machine's roots; else this host's, checked by its
+   * confinement. Throws when neither takes it.
+   */
+  resolveFolder: FolderResolver;
+  /** {@link resolveFolder}, then a machine folder checked on the machine (real path, exists). */
+  verifyFolder: (cwd: string, kind?: string) => Promise<ResolvedFolder>;
+  /**
+   * What to scan for a folder's catalogs: this host's folder, or for a
+   * machine's, a folder of this host's for the user scope plus the project
+   * files read on the machine.
+   */
+  folderCatalog: (cwd: string, kind?: string, prefix?: string) => Promise<{
+    discoveryCwd: string;
+    project?: MachineProject;
+  }>;
+  /** Wire-safe `/` command catalog for a client's completion popover. `kind`: the session's environment (a machine's folder). */
+  listCommands: (cwd: string, kind?: string) => Promise<CommandSummary[]>;
   /** Argument suggestions for `/name <prefix>` — best-effort, empty on failure. */
-  completeCommandArgs: (cwd: string, name: string, argsPrefix: string) => Promise<CommandArgSuggestionSummary[]>;
+  completeCommandArgs: (cwd: string, name: string, argsPrefix: string, kind?: string) => Promise<CommandArgSuggestionSummary[]>;
   /**
    * Shared type-ahead queue — host-owned so every window renders and
    * manipulates the same list (`queue:changed` fan-out). `queueAdd`
-   * queues while a run is in flight and sends immediately otherwise;
-   * the host drains FIFO at run end.
+   * queues while a run is in flight — or while this host is still
+   * provisioning the session's environment — and sends immediately
+   * otherwise; the host drains FIFO at run end and when provisioning settles.
    */
-  queueAdd: (sessionId: string, text: string, activatedSkills?: string[], attachments?: PromptAttachment[], /** See `SendOptions.asCommand`. */
-
+  queueAdd: (sessionId: string, text: string, activatedSkills?: string[], attachments?: PromptAttachment[],
+  /** See `SendOptions.asCommand`. */
   asCommand?: string) => Promise<{
-    delivered: 'queued' | 'sent';
+    delivered: 'queued' | 'sent' | 'steer';
   }>;
   queueRemove: (sessionId: string, id: string) => boolean;
-  /** Edit a queued entry's text in place (keeps its position). `false` when the id is gone. */
-  queueUpdate: (sessionId: string, id: string, text: string) => boolean;
+  /**
+   * Edit a queued entry in place (keeps its position). `attachments`, when
+   * given, replaces the entry's list (`[]` removes them all). `false` when
+   * the id is gone.
+   */
+  queueUpdate: (sessionId: string, id: string, text: string, attachments?: PromptAttachment[]) => boolean;
   queueList: (sessionId: string) => QueuedItem[];
+  /**
+   * A queued entry's attachments WITH their bytes, which `queueList` and
+   * `queue:changed` leave out, for a window that previews or edits them.
+   * `null` when the id is gone.
+   */
+  queueAttachments: (sessionId: string, id: string) => PromptAttachment[] | null;
   /**
    * The `SYSTEM.md` override composing this session's prompt, for windows
    * attaching to an ALREADY-WARM agent (the `system-md` signal only fires at
@@ -2344,7 +4962,7 @@ interface ChatHost {
     shadowed: readonly SystemMdFile[];
   } | null;
   queuePushNow: (sessionId: string, id: string) => Promise<{
-    delivered: 'steer' | 'send' | 'missing';
+    delivered: 'steer' | 'send' | 'queued' | 'missing';
   }>;
   isSessionRunning: (sessionId: string) => boolean;
   /** Sessions with a live in-memory agent, with their run state (presence). */
@@ -2366,7 +4984,7 @@ interface ChatHost {
    * in-memory snapshot didn't see. Not wire-exposable.
    */
   getLiveSession: (sessionId: string) => Session | null;
-  /** True when ANY session has a live run, in-flight compaction, or tracked work. */
+  /** True when ANY session has a live run, in-flight compaction, tracked work, or a running local terminal. */
   hasActiveWork: () => boolean;
   listRunningWork: (sessionId: string) => RunningWorkItem[];
   cancelRunningWork: (sessionId: string, id: string | 'all', reason?: string) => Promise<boolean>;
@@ -2378,18 +4996,114 @@ interface ChatHost {
    */
   setTodos: (sessionId: string, items: readonly TodoItem[]) => Promise<ActiveTodosState | null>;
   /**
-   * Create a session in the shared store and return its id. The one factory
-   * shared by the daemon, the embedded GUI host, and orchestration.
+   * Create a session in the shared store and return its id. The shared
+   * lifecycle factory (`session-factory.ts`) bound to this host's store —
+   * used by the daemon, the embedded GUI host, and orchestration.
+   *
+   * `environment` picks where the session's work happens (default: local).
+   * A kind that needs provisioning returns immediately with the session in
+   * `provisioning`; it becomes `ready` / `failed` in the background, each
+   * transition announced as `sessions:changed`. Throws for an unknown or
+   * unavailable kind.
    */
-  createSession: (params: {
-    cwd: string;
-    title?: string;
-    agentId?: string;
-    providerKey?: string;
-    modelId?: string;
-    fallbacks?: readonly ModelFallbackTarget[];
-    extensionEdit?: boolean;
-  }) => Promise<string>;
+  createSession: (params: CreateSessionRequest) => Promise<string>;
+  /**
+   * Provision the session's environment again — after a failure, or when a
+   * host restart left it `provisioning` with nothing running. No-op while
+   * this host is already provisioning it or when it is ready. With
+   * `background`, resolves once the row shows `provisioning` instead of when
+   * the attempt ends — so a caller polling the row never reads the old failure.
+   */
+  retryEnvironment: (sessionId: string, opts?: {
+    background?: boolean;
+  }) => Promise<void>;
+  /** Environment kinds this host can create and run. */
+  environments: EnvironmentRegistry;
+  /** Where this host keeps environment secrets (settings writes go through it). */
+  environmentSecrets: EnvironmentSecrets;
+  /**
+   * Every registered kind described for a new session in `cwd` — enabled,
+   * default, availability (with the reason), branch suggestion, options
+   * (secrets only as "configured"). What pickers and settings render.
+   */
+  listEnvironments: (cwd: string, kind?: string) => Promise<EnvironmentDescriptor[]>;
+  /** "Test connection" for `kind` with its current options. */
+  verifyEnvironment: (kind: string) => Promise<EnvironmentVerifyResult>;
+  /** The per-session commands the session's environment offers right now (push, open PR, …). */
+  listEnvironmentActions: (sessionId: string) => Promise<EnvironmentActionSummary[]>;
+  /**
+   * Run one of {@link listEnvironmentActions} — in the session's environment,
+   * resuming it when suspended. Throws with a user-facing message on failure.
+   */
+  runEnvironmentAction: (sessionId: string, actionId: string) => Promise<EnvironmentActionResult>;
+  /**
+   * The session's workspace: shell + file operations in the session's own
+   * execution context (the one its agent's tools use), for any session.
+   * The root is `environment.execCwd` when the files live inside the
+   * environment (a sandbox's clone), else the session's cwd on this machine.
+   * What the GUI's Files panel, mentions, `!` and diffs use for sandboxed
+   * sessions, and what window-side extension code reaches as
+   * `ctx.workspace` in the TUI's daemon mode.
+   *
+   * Paths (and exec `cwd`) resolve against the root exactly as the execution
+   * context resolves them ({@link workspacePath}); containment is the
+   * context's own (sandboxes confine, the local process context doesn't).
+   * Exec `timeoutSeconds` defaults to 30, like the execution contexts.
+   */
+  workspaceExec: (sessionId: string, command: string, options?: WorkspaceExecOptions) => Promise<ExecResult>;
+  /**
+   * The same command as a live process (`ExecutionContext.execStream`, a
+   * machine's included): its output as it comes, `kill()` ends its process
+   * group. `null` when the session's context can't stream (callers fall back
+   * to {@link workspaceExec}). Same `cwd` rules; no timeout: the caller owns it.
+   */
+  workspaceExecStream: (sessionId: string, command: string, options?: Omit<WorkspaceExecOptions, 'timeoutSeconds'>) => Promise<StreamHandle | null>;
+  workspaceReadFile: (sessionId: string, path: string) => Promise<string>;
+  workspaceWriteFile: (sessionId: string, path: string, content: string) => Promise<void>;
+  /** `ListFilesOptions` semantics (`glob: true` treats `path` as a pattern under the root). */
+  workspaceListFiles: (sessionId: string, path: string, options?: WorkspaceListFilesOptions) => Promise<ListFilesEntry[]>;
+  /** Byte size of a file, or `null` when missing or unknowable. */
+  workspaceFileSize: (sessionId: string, path: string) => Promise<number | null>;
+  /**
+   * Fork a session at a turn into a new persisted session (see
+   * `forkSession` in `session-factory.ts`); blobs are rehomed under this
+   * host's user dir.
+   */
+  forkSession: (params: Omit<ForkSessionParams, 'userDir'>) => Promise<ForkSessionResult>;
+  /**
+   * History edits. Both refuse while the session runs (in this host, or by
+   * its fresh run marker in another process): the run's saves would erase
+   * the edit, and its context would keep the old turn anyway, so the user
+   * stops the run first. The write is atomic when the store offers
+   * `mutateTurns`; the cached agent is retired so the next run reads the
+   * edited history, and `sessions:changed` tells every window.
+   */
+  deleteTurn: (sessionId: string, turnId: string) => Promise<void>;
+  /** Replace a turn's text, keeping its non-text blocks (see `replaceTurnTextBlocks`). */
+  editTurnText: (sessionId: string, turnId: string, text: string) => Promise<void>;
+  /**
+   * Bind a session to a folder (`cwd`), or back to a plain chat (`''`):
+   * `metadata.cwd` plus the derived project root. Refused while running,
+   * like history edits; the Main session can't be bound.
+   */
+  setSessionFolder: (sessionId: string, cwd: string) => Promise<void>;
+  /**
+   * Append turns written outside a run (the `!` shell's output). Through the
+   * live session when one exists, so its next save keeps them; to the store
+   * otherwise. Announced with `sessions:changed`.
+   */
+  appendTurns: (sessionId: string, turns: SessionTurn[]) => Promise<void>;
+  /**
+   * THE session delete: retire the live agent + pending HITL state, end its
+   * execution (background tasks included), tear down the environment it
+   * owns, then remove the row and every on-disk artifact. Every surface's
+   * delete must end here (the daemon RPC, the embedded GUI host). Resolves
+   * with what happened to the environment (a provider may keep it, e.g. a
+   * dirty worktree).
+   */
+  deleteSession: (sessionId: string) => Promise<{
+    environment: EnvironmentTeardownResult;
+  }>;
   /** Main-session orchestration — see `./orchestration.ts`. */
   orchestration: Orchestration;
   /**
@@ -2410,6 +5124,14 @@ interface ChatHost {
   patchSessionMeta: (sessionId: string, patch: Record<string, unknown>, opts?: {
     bumpUpdatedAt?: boolean;
   }) => Promise<void>;
+  /**
+   * Title the session with THIS host's providers and credentials (never the
+   * window's: a server session's transcript stays with the server's
+   * provider), write it as a rename (no recency bump) and return it. `hint`:
+   * the window's provider/model, used when this host has that provider;
+   * otherwise the session's own. Refuses the Main session.
+   */
+  generateSessionTitle: (sessionId: string, hint?: SessionTitleHint) => Promise<string>;
   /**
    * THE model-swap contract, shared by every surface: persists
    * `providerKey` / `modelId`, replaces `modelChain` (cleared when
@@ -2429,13 +5151,47 @@ interface ChatHost {
    */
   setLiveSessionAgentId: (sessionId: string, agentId: string) => Promise<boolean>;
   /**
-   * Retire the live agent so the next run rebuilds on freshly-patched
-   * metadata (model / agent swap). Deferred to run end while a run is in
-   * flight, so a swap never aborts a run mid-stream for other windows.
+   * Retire the live agent so the next run rebuilds on freshly-patched
+   * metadata (model / agent swap). Deferred to run end while a run is in
+   * flight, so a swap never aborts a run mid-stream for other windows.
+   */
+  disposeAgentForRebuild: (sessionId: string) => void;
+  /**
+   * Launch-time overrides for one session's agent (`zidane run --system /
+   * --mcp` on a host-backed window): what the local TUI applies to every
+   * agent it builds, applied here to this session's. In memory only, never
+   * persisted; they survive agent rebuilds and are dropped on `null`, on
+   * session delete, or (daemon) when the client that set them disconnects.
+   * A change retires the live agent like a model swap (deferred to run end),
+   * except a cwd-only change, which moves the live agent in place.
+   */
+  setLaunchOverrides: (sessionId: string, overrides: SessionLaunchOverrides | null) => void;
+  /**
+   * `ctx.appendNote` outside a run (an extension's timer, a HUD action): a
+   * display-only `command` turn, broadcast live and persisted under the same
+   * id. A built agent's session takes it (so its later saves keep it);
+   * otherwise it is appended in the store. False for an unknown session or
+   * an empty note.
+   */
+  appendNote: (sessionId: string, blocks: readonly CommandOutputBlock[]) => Promise<boolean>;
+  /**
+   * `disposeAgentForRebuild` for every session with a live agent (extension
+   * reload, agent-shaping settings). Resolves once every one of them has
+   * actually been retired: immediately for idle sessions, at run end for
+   * busy ones, so no run is aborted. `rediscover` also drops the discovery
+   * caches (plugin catalogs), so the rebuilt agents re-walk the disk.
+   */
+  rebuildAllAgents: (options?: {
+    rediscover?: boolean;
+  }) => Promise<void>;
+  /**
+   * A settings write changed a key that shapes what agents are BUILT with
+   * (terminal switches, `subagentModels`, `interactionMode` into or out of
+   * `disabled`): agents are rebuilt (at run end when busy, no run aborted) so
+   * their tools match, and turning terminals off closes the user's. Every
+   * settings write path calls it with the before/after pair.
    */
-  disposeAgentForRebuild: (sessionId: string) => void;
-  /** `disposeAgentForRebuild` for every session with a live agent (extension reload). */
-  rebuildAllAgents: () => void;
+  applyAgentSettings: (before: HostSettings, next: HostSettings) => void;
   getContextBreakdown: (sessionId: string) => Promise<ContextBreakdown | null>;
   /**
    * Every chunk of text in the session's system prompt, with provenance — the
@@ -2456,7 +5212,12 @@ interface ChatHost {
     path: string;
     created: boolean;
   }>;
-  compactSessionNow: (sessionId: string) => Promise<void>;
+  /**
+   * Compact the session now (any session: its agent is built if none is
+   * live). Resolves what was done, `null` when nothing was (cancelled or
+   * failed, both also announced as transcript events).
+   */
+  compactSessionNow: (sessionId: string) => Promise<CompactionReport | null>;
   /** Tear down one session's live agent + pending HITL state. */
   disposeSession: (sessionId: string) => void;
   /** Drain every session — call before process exit or config invalidation. */
@@ -2464,6 +5225,49 @@ interface ChatHost {
   /** Permanently refuse dispatch, abort work, and await setup, runs, and settlement. */
   drain: () => Promise<void>;
 }
+//#endregion
+//#region src/chat/host/compaction/run.d.ts
+/** What a compaction did, for the caller's confirmation (the TUI's "compacted N turns" banner). */
+interface CompactionReport {
+  /** Turns absorbed into the summary. */
+  replacedCount: number;
+  /** Turns the prompt-too-long retry had to drop without summarizing (context lost). */
+  droppedCount: number;
+  /** Recently-read files and active skills re-injected after the summary. */
+  restoredFiles: number;
+  restoredSkills: number;
+  model: string;
+  inputTokens: number;
+  outputTokens: number;
+  /** Estimated context size on the next turn: the summary plus the restored content. */
+  effectiveTokens: number;
+}
+interface CompactionEntry {
+  sessionId: string;
+  cwd: string;
+  agent: Agent;
+  providerKey: ProviderKey;
+  providerDescriptor?: ProviderDescriptor;
+  model: string;
+  compactionController?: AbortController;
+}
+/**
+ * Run `compactConversation` against the session's current turns, persist
+ * the resulting summary as a new turn, and emit a compact-summary stream
+ * event. Brackets the in-flight window with `compacting:start` /
+ * `compacting:end` signals. Resolves what it did, or `null` when nothing
+ * was compacted (no session, cancelled, failed: reported as an event).
+ */
+declare function runCompaction(entry: CompactionEntry, broadcast: (signal: HostSignal) => void, store: SessionStore): Promise<CompactionReport | null>;
+//#endregion
+//#region src/chat/host/engine.d.ts
+/**
+ * The composition root: creates the shared host state (`context.ts`) and the
+ * feature modules, wires them to each other, and assembles the `ChatHost`.
+ * Features never import this module. Where a feature needs one built after
+ * it, it gets one of the hoisted forwarders at the bottom of this function
+ * (only ever called at runtime, after construction).
+ */
 declare function createChatHost(env: ChatHostEnvironment): ChatHost;
 //#endregion
 //#region src/chat/host/helpers.d.ts
@@ -2485,118 +5289,44 @@ declare function extractEditPayloadForGate(name: string, input: Record<string, u
  */
 declare function serializePreview(preview: PreviewResult): SerializedPreview;
 //#endregion
-//#region src/chat/mcp-auth-state.d.ts
-/**
- * Per-server MCP OAuth status tracking, decoupled from the renderer.
- *
- * The TUI keeps a `Record<serverName, McpAuthStatus>` so it can render a
- * "needs-auth" / "authorizing" / "error" badge in the MCP picker. The
- * status map is driven entirely by hooks fired from the agent's MCP
- * bootstrap + the interactive `loginMcpServer` flow — the reducer below
- * is pure, makes no FS or network calls, and is shared between the live
- * TUI store and the test harness.
- *
- * Status lifecycle:
- *
- *   idle ──mcp:connect──▶  authed
- *                         (bootstrap succeeded with stored tokens)
- *
- *   idle ──mcp:auth:required──▶ needs-auth
- *                              (bootstrap saw no/invalid tokens)
- *
- *   needs-auth ──login()──▶ authorizing ──mcp:auth:url──▶ authorizing(url)
- *                                       ──mcp:auth:success──▶ authed
- *                                       ──mcp:auth:error──▶ error
- *
- *   any         ──logout──▶ idle
- *
- * Multiple servers progress through the lifecycle independently; the map
- * is keyed by `McpServerConfig.name`.
- */
-type McpAuthStatus = {
-  kind: 'idle';
-} | {
-  kind: 'needs-auth';
-  reason: 'no-tokens' | 'auto-promoted';
-} | {
-  kind: 'authorizing';
-  url?: string;
-} | {
-  kind: 'authed';
-} | {
-  kind: 'error';
-  error: string;
-} | {
-  kind: 'bootstrap-error';
-  error: string;
-};
-/**
- * Map of server name → status. `idle` is the implicit default for any
- * server NOT present in the map, so the renderer treats `undefined` as
- * `{ kind: 'idle' }` and the map can stay sparse.
- */
-type McpAuthStateMap = Readonly<Record<string, McpAuthStatus>>;
-/**
- * Events the reducer accepts. Names mirror the agent hooks 1:1 plus two
- * UI-only verbs (`login:start` / `login:cancel`) so the renderer can
- * optimistically flip a row to `authorizing` before the SDK has emitted
- * `mcp:auth:url` — useful when the loopback callback is slow to bind.
- */
-type McpAuthEvent = {
-  type: 'auth-required';
-  name: string;
-  reason: 'no-tokens' | 'auto-promoted';
-} | {
-  type: 'auth-url';
-  name: string;
-  url: string;
-} | {
-  type: 'auth-success';
-  name: string;
-} | {
-  type: 'auth-error';
-  name: string;
-  error: string;
-} | {
-  type: 'bootstrap-error';
-  name: string;
-  error: string;
-} | {
-  type: 'connected';
-  name: string;
-} | {
-  type: 'login:start';
-  name: string;
-} | {
-  type: 'login:cancel';
-  name: string;
-} | {
-  type: 'logout';
-  name: string;
-} | {
-  type: 'reset';
-  name: string;
-};
-/**
- * Apply one event to the state map. Pure, immutable — returns a new map
- * with only the affected key reassigned.
- *
- * State transitions are simple "last write wins"; we don't gate (e.g.) a
- * `login:start` from overriding `authorizing` because the loop layer
- * never doubles those up — interactive login is serialized in the TUI.
- */
-declare function reduceMcpAuth(state: McpAuthStateMap, event: McpAuthEvent): McpAuthStateMap;
-/** Convenience getter — treats `undefined` as `idle`. */
-declare function getMcpAuthStatus(state: McpAuthStateMap, name: string): McpAuthStatus;
+//#region src/chat/hosts/registry.d.ts
+declare function hostsFilePath(dataDir: string): string;
+/** Where a host's token lives in the credentials store. */
+declare function hostCredentialKey(id: string): string;
+interface HostRegistry {
+  list: () => HostEntry[];
+  get: (id: string) => HostEntry | undefined;
+  /**
+   * Verify the host (it must answer as a zidane-server with this token),
+   * then save it and its token. Adding a host already saved (same server
+   * id) updates its URL and token in place, keeping its name unless one is
+   * given. Throws {@link HostRegistryError}.
+   */
+  add: (input: {
+    url: string;
+    token: string;
+    name?: string;
+  }) => Promise<HostEntry>;
+  /** Forget the entry and its token; `false` when it wasn't saved. */
+  remove: (id: string) => boolean;
+  rename: (id: string, name: string) => HostEntry;
+  /** Connect with the saved token and say who answered; refreshes `lastConnectedAt` on success. */
+  test: (id: string) => Promise<HostTestResult>;
+  /** The saved token, for transports. Never display it. */
+  token: (id: string) => string | undefined;
+}
+declare function createHostRegistry(options: {
+  dataDir: string;
+  probe: HostProbe;
+  now?: () => number;
+}): HostRegistry;
 //#endregion
 //#region src/chat/mcp-auth-context.d.ts
 /**
  * Mount once near the top of the React tree (above `ModalRoot`). Children
  * use `useMcpAuthState()` to read and `useMcpAuthDispatch()` to fire events.
  */
-declare function McpAuthProvider({
-  children
-}: {
+declare function McpAuthProvider({ children }: {
   children: ReactNode;
 }): import("react").JSX.Element;
 declare function useMcpAuthState(): McpAuthStateMap;
@@ -2911,25 +5641,6 @@ interface RemoveMcpResult {
  */
 declare function removeMcpServer(filePath: string, name: string): RemoveMcpResult;
 //#endregion
-//#region src/chat/model-chain-metadata.d.ts
-interface ModelFallbackTarget {
-  providerKey: ProviderKey;
-  modelId: string;
-}
-/**
- * Assemble the `metadata.modelChain` value for a model pick — the full
- * canonical chain when at least one valid fallback survives filtering,
- * `undefined` for a single-model pick (metadata merges JSON-serialize,
- * so `undefined` REMOVES a previously persisted chain).
- */
-declare function modelChainMetadata(providerKey: ProviderKey, modelId: string, fallbacks: readonly ModelFallbackTarget[] | undefined): ModelChainEntry[] | undefined;
-/**
- * Validated fallback tail for list rows/pickers — head-matched against
- * the session's persisted primary, unregistered providers kept (the
- * caller filters against its own registry when it has one).
- */
-declare function sessionModelFallbacks(metadata: Record<string, unknown> | undefined): ModelFallbackTarget[] | undefined;
-//#endregion
 //#region src/chat/oauth.d.ts
 declare function supportsOAuth(descriptor: ProviderDescriptor): boolean;
 /** True when the provider's OAuth flow needs the user to paste a code back into the TUI (no loopback callback). */
@@ -2962,6 +5673,16 @@ interface OAuthFlowOptions {
   onProgress?: (message: string) => void;
   /** Abort the in-flight login (e.g. user pressed esc). */
   signal?: AbortSignal;
+  /** The redirect URL (or a pasted code), racing the loopback listener (pi-ai's `onManualCodeInput`). */
+  onManualCodeInput?: () => Promise<string>;
+  /**
+   * `false`: the browser is on another machine (a client of a remote host).
+   * zidane's providers bind no loopback listener here and read the redirect
+   * from {@link onManualCodeInput}.
+   */
+  callbackServer?: false;
+  /** `false`: never launch a browser on this machine. Default true. */
+  openBrowser?: boolean;
 }
 /**
  * Run the OAuth login flow for a provider.
@@ -3112,11 +5833,22 @@ declare function formatPathForCwd(projectRelativePath: string, projectRoot: stri
 //#endregion
 //#region src/chat/project-root.d.ts
 /**
- * Git root detection — walks parents from `cwd` looking for a `.git`
- * entry, returning the absolute path of the repo root or `null` when
- * the search reaches the filesystem root.
+ * Git location — two different questions with two different answers once
+ * linked worktrees exist:
+ *
+ *   - **Checkout root** ({@link findGitRoot}): the working tree `cwd` sits
+ *     in — where its files are. Discovery reads here (`AGENTS.md`, skills,
+ *     MCP configs, file completion): a worktree on another branch has its
+ *     own copies, and those are the ones the agent works against.
+ *   - **Project root** ({@link findProjectRoot} / {@link projectRootOf}):
+ *     which project a session BELONGS to — the main checkout, for a linked
+ *     worktree. Identity keys here: `SessionData.projectRoot`, session
+ *     lists and grouping, the safelist, artifact scope, the project DB.
+ *     Every worktree of a repo is one project.
  *
- * Why parent-walk over `git rev-parse --show-toplevel`:
+ * For a plain checkout the two are the same directory.
+ *
+ * Why parent-walk + file reads over `git rev-parse`:
  *
  *   - Zero dependencies (no shell-out, no git binary requirement,
  *     works even when `git` is missing from `PATH`).
@@ -3134,13 +5866,58 @@ declare function formatPathForCwd(projectRelativePath: string, projectRoot: stri
  */
 /**
  * Walk parents of `cwd` looking for a `.git` entry. Returns the
- * absolute path of the directory containing `.git`, or `null` when no
- * git repo is found above `cwd`.
+ * absolute path of the directory containing `.git` — the CHECKOUT root
+ * (a linked worktree's own dir, not its main checkout) — or `null` when
+ * no git repo is found above `cwd`.
  *
  * Stops at the filesystem root (`/`) — no infinite loop on `dirname`'s
  * idempotent root case (`dirname('/')` returns `/`).
  */
 declare function findGitRoot(cwd?: string): string | null;
+/**
+ * The main checkout a LINKED WORKTREE belongs to, or `null` when
+ * `checkoutRoot` is not one. Does not walk: `checkoutRoot` must be a
+ * checkout root (what {@link findGitRoot} returns).
+ *
+ * A linked worktree's `.git` is a file (`gitdir: <main>/.git/worktrees/<name>`)
+ * and that gitdir holds a `commondir` file pointing back at the shared
+ * `<main>/.git`. Everything else resolves to `null` and stays its own
+ * project:
+ *
+ *   - a regular checkout (`.git` is a directory);
+ *   - a submodule (its gitdir has no `commondir` — a submodule IS a
+ *     separate repo);
+ *   - a worktree of a bare repo or of a `--separate-git-dir` repo (the
+ *     common dir isn't a `.git` inside a working tree, so there is no main
+ *     checkout to belong to);
+ *   - anything unreadable or malformed.
+ */
+declare function mainCheckoutRoot(checkoutRoot: string): string | null;
+/**
+ * The project `cwd` belongs to: the main checkout for a linked worktree,
+ * the checkout root otherwise, `null` outside git. See the module header
+ * for when to use this vs {@link findGitRoot}.
+ */
+declare function findProjectRoot(cwd?: string): string | null;
+/**
+ * {@link findProjectRoot} with the historical fallback: outside git, a
+ * directory is its own project. The value to stamp as
+ * `SessionData.projectRoot` and to key per-project state on.
+ */
+declare function projectRootOf(cwd: string): string;
+/**
+ * For persisted project roots that predate worktree-aware identity: the
+ * `{ from, to }` pairs where a stored root is a linked worktree's checkout
+ * root and should be its main checkout's. Only exact linked-worktree roots
+ * remap — a plain directory that later ended up inside some repo keeps its
+ * own identity (no parent walk here). Stores apply the pairs as a bulk
+ * column update at open; idempotent, so a row reverted by a stale
+ * full-document save converges on the next open.
+ */
+declare function planWorktreeProjectRootRemaps(roots: Iterable<string>): Array<{
+  from: string;
+  to: string;
+}>;
 //#endregion
 //#region src/chat/provider-usage.d.ts
 /** How long a snapshot stays fresh. Usage windows move in minutes, not seconds. */
@@ -3229,6 +6006,13 @@ declare function runEndNotice(reason: TurnFinishReason | undefined): RunEndNotic
  * A short list of read-only tools is **implicitly safe** without being
  * persisted — see {@link IMPLICITLY_SAFE_TOOLS}.
  */
+/**
+ * The `projects.json` key for a working directory: its project root (the
+ * main checkout for a linked worktree; the dir itself outside git) — the
+ * same "project" the TUI scopes its safelist to, so a subdirectory session,
+ * every worktree of the repo, and every host share one safelist.
+ */
+declare function safelistProjectKey(cwd: string): string;
 interface ProjectEntry {
   safelist?: string[];
 }
@@ -3247,6 +6031,20 @@ declare function writeProjects(dataDir: string, file: ProjectsFile): void;
 declare function addToSafelist(dataDir: string, projectDir: string, entries: string | readonly string[]): readonly string[];
 /** Read the safelist for one project. Returns `[]` for unknown projects. */
 declare function getSafelist(dataDir: string, projectDir: string): readonly string[];
+/**
+ * The safelist in effect for a working directory — what every host's gate
+ * must read. The project's entries ({@link safelistProjectKey}), plus
+ * entries saved under older keys for the same place, still honored but never
+ * written again:
+ *
+ *   - the CHECKOUT root — the TUI keyed a linked worktree by its own dir
+ *     before worktrees resolved to their main checkout;
+ *   - the exact `cwd` — the daemon/GUI keyed by raw cwd before keys were
+ *     normalized to the project.
+ */
+declare function getSafelistForCwd(dataDir: string, cwd: string): readonly string[];
+/** {@link addToSafelist} under the project key for `cwd` — the write every host's gate uses. */
+declare function addToSafelistForCwd(dataDir: string, cwd: string, entries: string | readonly string[]): readonly string[];
 /**
  * Tools that always pass without prompting. Four categories:
  *
@@ -3286,6 +6084,8 @@ declare const IMPLICITLY_SAFE_TOOLS: readonly string[];
  *   - `"<tool>"` — broad match on tool name.
  *   - `"<tool>:<token>:*"` — match when the primary arg's first token
  *     equals `<token>`.
+ *   - `"browser_open:<host>"` / `"browser_navigate:<host>"` — match a
+ *     load of that host (port included).
  *
  * This function matches a **single command** against a **single entry**.
  * For shell commands that chain multiple programs (`&&`, `||`, `;`,
@@ -3320,6 +6120,8 @@ declare function isOnSafelist(entries: readonly string[], tool: string, input: R
  *     would fail on `cat` and re-prompt forever.
  *   - `shell` with an unparseable / empty command → first-token heuristic,
  *     else the bare tool name.
+ *   - `browser_open` / `browser_navigate` to a non-loopback address →
+ *     `<tool>:<host>`: approving one site does not approve the web.
  *   - anything else → bare tool name (broad).
  *
  * Always returns a non-empty list so the UI has a concrete set to render
@@ -3350,20 +6152,115 @@ declare function resolveSessionCwd(row: {
  */
 declare function scopeCwd(cwd: string): string;
 //#endregion
+//#region src/chat/session-export.d.ts
+/** File format supported by the exporter. */
+type SessionExportFormat = 'markdown' | 'json';
+/**
+ * Anchor for the resolved destination directory:
+ *   - `project` — the nearest enclosing git repository (`<repoRoot>/.{prefix}/sessions`)
+ *   - `home`    — fallback when no repo was found (`<dataDir>/sessions`; `~/.{prefix}/sessions`
+ *                 outside an XDG layout)
+ */
+type SessionExportAnchor = 'project' | 'home';
+/** Resolved file destination for a session export. */
+interface SessionExportTarget {
+  /** Absolute directory holding the file. May not exist yet — `writeSessionExport` creates it on demand. */
+  dir: string;
+  /** Absolute path of the file (`dir/{id}.{ext}`). */
+  filepath: string;
+  /** Where the destination was anchored. */
+  anchor: SessionExportAnchor;
+}
+/** Options shared by every resolve / write entry-point. */
+interface ResolveOptions {
+  /** Discovery cwd. Defaults to `process.cwd()`. */
+  cwd?: string;
+  /** User home directory. Defaults to `os.homedir()`. */
+  home?: string;
+  /**
+   * Storage prefix. Leading dot tolerated (`zidane` and `.zidane` are
+   * equivalent). Defaults to `'.zidane'`.
+   */
+  prefix?: string;
+  /**
+   * User storage data dir; home-anchored exports land in `<dataDir>/sessions`.
+   * Defaults to `resolveStorageDirs({ prefix, home }).dataDir`. Never a literal
+   * `~/.{prefix}`: writing there would flip an XDG install to legacy storage.
+   */
+  dataDir?: string;
+}
+/**
+ * Resolve the export target for a session id + format. Pure: no fs
+ * write happens here, the caller decides whether to `existsSync` the
+ * directory or hand the path to `writeSessionExport`.
+ *
+ * Anchor selection walks upward from `cwd` looking for a `.git` entry;
+ * the first hit anchors to that repo's root (`project`). When the walk
+ * exits without finding `.git`, the destination anchors to `home`: the
+ * user's storage data dir.
+ *
+ * @throws RangeError when `sessionId` would resolve to an empty / `..`
+ *   filename — defensive guard against malicious or buggy callers
+ *   crossing into a sibling directory via the id.
+ */
+declare function resolveSessionExportTarget(opts: {
+  sessionId: string;
+  format: SessionExportFormat;
+} & ResolveOptions): SessionExportTarget;
+/**
+ * Render a session into a string in the requested format.
+ *
+ * `markdown` produces a human-readable transcript: a YAML-free header
+ * block with the title and a one-line `id · created · turns` summary,
+ * a stats section (turns / runs / tokens / cost / status), then a
+ * `## Conversation` block where each turn renders as `### N. role ·
+ * run_X · ISO-date` with text, thinking, tool calls, and tool results
+ * formatted as appropriate fenced blocks. Useful for sharing a session
+ * with a teammate or pasting into an issue tracker.
+ *
+ * `json` returns a 2-space-indented, deterministic dump of the full
+ * `SessionData` blob. Useful for re-importing into the store or for
+ * post-hoc analysis tooling.
+ */
+declare function renderSession(session: SessionData, format: SessionExportFormat): string;
+/**
+ * Render `session` and write the resulting bytes to disk. Returns the
+ * resolved target so the caller can show the user where the file
+ * landed. The parent directory is created on demand (`recursive: true`)
+ * — first-time exports don't need any pre-flight setup.
+ */
+declare function writeSessionExport(opts: {
+  session: SessionData;
+  format: SessionExportFormat;
+} & ResolveOptions): Promise<SessionExportTarget>;
+//#endregion
 //#region src/chat/settings-context.d.ts
-declare const DEFAULT_SETTINGS: Settings;
 interface SettingsContextValue {
   settings: Settings;
   /** Flip a boolean setting in place. Restricted at the type level to boolean-valued keys. */
   toggle: (key: BooleanSettingKey) => void;
   /** Write any setting key to a new value. Used by string-valued choice rows. */
   setSetting: <K extends keyof Settings>(key: K, value: Settings[K]) => void;
+  /** One line the Settings modal shows (a server refused the last write); cleared by the next change. */
+  status?: string | null;
+  /**
+   * Settings sync markers, while the modal edits a server another computer
+   * syncs to (`docs/SERVER.md` § Settings sync): which setting came from
+   * which device, which was edited on the server since (an override), and
+   * dropping an override. Absent elsewhere.
+   */
+  sync?: SettingsSyncMarks;
+}
+/** A setting's sync state on the server the modal edits. */
+interface SettingsSyncMarks {
+  marker: (key: string) => {
+    kind: 'synced' | 'override';
+    device: string;
+  } | null;
+  /** Drop the override on `key`; false when it has none. */
+  reset: (key: string) => boolean;
 }
-declare function SettingsProvider({
-  initial,
-  onChange,
-  children
-}: {
+declare function SettingsProvider({ initial, onChange, children }: {
   initial: Settings;
   onChange?: (settings: Settings) => void;
   children: ReactNode;
@@ -3379,7 +6276,7 @@ declare function useSettings(): SettingsContextValue;
  * silently broaden into `T | undefined` and short-circuit the `extends
  * boolean` check via `undefined`.
  */
-type BooleanSettingKey = { [K in keyof Settings]-?: Settings[K] extends boolean ? K : never }[keyof Settings];
+type BooleanSettingKey = { [K in keyof Settings]-?: Settings[K] extends boolean ? K : never; }[keyof Settings];
 /**
  * Setting categories — drives the tab grouping in the TUI's
  * `SettingsModal` and, more importantly, gives any embedder (GUI,
@@ -3426,6 +6323,17 @@ interface SettingsToggle {
    * while the requirement is `false`, whichever client or file wrote it.
    */
   requires?: BooleanSettingKey;
+  /**
+   * The setting drives something only the desktop app shows (its browser,
+   * its terminals). The TUI still lets you change it, and says so.
+   */
+  desktopOnly?: true;
+  /**
+   * Env var of the feature gate's kill switch (`FEATURE_GATES`). While it is
+   * `'1'` the feature is off whatever the setting says, so renderers grey the
+   * row out and name the variable.
+   */
+  killSwitchEnv?: string;
 }
 declare const SETTINGS_TOGGLES: readonly SettingsToggle[];
 /**
@@ -3448,7 +6356,7 @@ declare const SETTINGS_TOGGLES: readonly SettingsToggle[];
  * the result type — it would let `expect(next.x).toBe(false)` fail to compile
  * against a value that is, in fact, `false`.
  */
-type WithInvariants<T> = { [K in keyof T]: K extends BooleanSettingKey ? boolean : T[K] };
+type WithInvariants<T> = { [K in keyof T]: K extends BooleanSettingKey ? boolean : T[K]; };
 declare function enforceSettingsInvariants<T extends Partial<Settings>>(settings: T): WithInvariants<T>;
 /**
  * String-valued settings that pick between a known set of options. The
@@ -3476,7 +6384,7 @@ declare const SETTINGS_CHOICES: readonly SettingsChoice[];
  * toggle table — a free-text row can only point at a string-valued
  * setting.
  */
-type StringSettingKey = { [K in keyof Settings]-?: Settings[K] extends string ? K : never }[keyof Settings];
+type StringSettingKey = { [K in keyof Settings]-?: Settings[K] extends string ? K : never; }[keyof Settings];
 /**
  * Free-text settings edited via a single-line input. The `SettingsModal`
  * renders these as a row showing the current value (or `placeholder` when
@@ -3537,8 +6445,10 @@ declare function defaultSkillScanPaths(opts?: {
 declare function discoverProjectSkills(opts?: {
   cwd?: string;
   home?: string;
-  prefix?: string; /** See {@link defaultSkillScanPaths}. */
-  foreignAgents?: boolean; /** See {@link defaultSkillScanPaths}. */
+  prefix?: string;
+  /** See {@link defaultSkillScanPaths}. */
+  foreignAgents?: boolean;
+  /** See {@link defaultSkillScanPaths}. */
   ruler?: boolean;
   signal?: AbortSignal;
 }): Promise<SkillConfig[]>;
@@ -3583,9 +6493,11 @@ interface SpawnStartRecord {
 declare function buildSpawnStartEvent(ctx: {
   id: string;
   task: string;
+  callId?: string;
   depth?: number;
   model?: string;
   resumesChildId?: string;
+  parentChildId?: string;
 }, startedAt: number): StreamEvent;
 /**
  * `spawn-end` marker: ` · `-joined optional segments — elapsed wall-clock
@@ -3599,6 +6511,7 @@ declare function buildSpawnEndEvent(ctx: {
   depth?: number;
   status?: 'completed' | 'aborted' | 'timeout' | 'error';
   stats: AgentStats;
+  parentChildId?: string;
 }, started: SpawnStartRecord | undefined, now?: number): StreamEvent;
 //#endregion
 //#region src/chat/streaming.d.ts
@@ -3661,123 +6574,26 @@ interface StreamBufferOptions {
    * a host that renders a virtualized list or exports events verbatim.
    */
   maxTranscriptEvents?: number | null;
-}
-declare function useStreamBuffer(setEvents: Dispatch<SetStateAction<StreamEvent[]>>, options?: StreamBufferOptions): StreamBuffer;
-//#endregion
-//#region src/chat/system-md.d.ts
-/** A discovered `SYSTEM.md`. */
-interface SystemMdFile {
-  path: string;
-  source: 'project' | 'user';
-  contents: string;
-}
-/** Result of {@link discoverSystemMd}. */
-interface SystemMdResult {
-  /**
-   * The winning override, or `null` when no `SYSTEM.md` exists (the built-in
-   * doctrine then applies unchanged).
-   */
-  file: SystemMdFile | null;
-  /**
-   * Files that exist but lost to `file` on precedence. Non-empty only when the
-   * user has both a project and a user `SYSTEM.md`. Surfaced so the UI can mark
-   * them as inactive instead of leaving the user wondering why edits to one of
-   * them changed nothing.
-   */
-  shadowed: readonly SystemMdFile[];
-}
-interface DiscoverSystemMdOptions {
-  /** Discovery cwd. Default: `process.cwd()`. */
-  cwd?: string;
-  /** User home directory. Default: `os.homedir()`. */
-  home?: string;
-  /** Storage prefix. Leading dot tolerated. Default: `'.zidane'`. */
-  prefix?: string;
   /**
-   * Which scopes may contribute an override — the same
-   * {@link AgentsMdScope} the host applies to `AGENTS.md`, so one setting
-   * governs both surfaces:
-   *   - `'none'`    — no override, ever. Short-circuits before any FS probe.
-   *   - `'user'`   — only `~/.{prefix}/SYSTEM.md`. The repo's file is IGNORED,
-   *                   which is the whole point of the setting: it is how a user
-   *                   says "do not trust this checkout".
-   *   - `'project'` — only `<root>/SYSTEM.md`.
-   *   - `'both'`   — union, project winning (default).
-   *
-   * Previously a boolean that only implemented `'none'`, so `'user'` still let a
-   * repo-root `SYSTEM.md` replace the entire doctrine — exactly the case the
-   * setting exists to prevent.
+   * Live override of {@link maxTranscriptEvents}, read inside each drain
+   * commit. Use it when the cap changes between renders: a pending drain
+   * updater runs during the host's next `useState` evaluation, BEFORE this
+   * hook re-mirrors the option, so a render-mirrored value is one commit
+   * stale (a history reveal would be re-trimmed by that commit).
    */
-  scope?: AgentsMdScope;
+  getMaxTranscriptEvents?: () => number | null | undefined;
 }
-/**
- * Absolute path of the USER-scope `SYSTEM.md` — the file the TUI creates when
- * the user asks for an override and none exists yet.
- *
- * Exported so the host doesn't hardcode the layout and can't drift from what
- * discovery actually reads.
- */
-declare function userSystemMdPath(opts?: {
-  home?: string;
-  prefix?: string;
-}): string;
-/**
- * Whether a USER-scope `SYSTEM.md` would be loaded under `scope`.
- *
- * Mirrors the candidate filter in {@link discoverSystemMd} so a host can ask
- * "would writing `~/.{prefix}/SYSTEM.md` accomplish anything?" without
- * re-deriving the rule and drifting from it. `'project'` excludes the user
- * candidate and `'none'` skips discovery altogether, so under either setting
- * creating that file is a silent no-op.
- */
-declare function userScopeOverridesLoad(scope: AgentsMdScope | undefined): boolean;
-/**
- * Find the active `SYSTEM.md` override, if any.
- *
- * Project paths anchor at the git root when one exists above `cwd`, else at
- * `cwd` — the same anchor as skills / mcps / AGENTS.md discovery, so all four
- * surfaces agree on what "this project" means.
- *
- * Tolerant: an unreadable or empty file is treated as absent (logged under
- * `ZIDANE_DEBUG`) and the next candidate gets its turn. Never throws — this
- * runs on the session-activation path.
- *
- * Candidates are filtered by {@link DiscoverSystemMdOptions.scope}, mirroring
- * how `discoverAgentsMd` builds its own list.
- */
-declare function discoverSystemMd(opts?: DiscoverSystemMdOptions): SystemMdResult;
-/**
- * Seed contents for a freshly created `SYSTEM.md` override, built from the
- * built-in doctrine.
- *
- * Seeding with the real doctrine (rather than an empty file) means creating the
- * override is a behavioral no-op until the user edits it. An empty seed would
- * silently delete every line of doctrine the moment the file appeared, making
- * the agent measurably worse with no visible cause.
- *
- * `currentSystem` should be DOCTRINE ONLY — callers pass
- * `splitSystemPrompt(doctrineOnlySystem()).static`, which excludes both the
- * generated `<env>` block (rebuilt per turn) and the `AGENTS.md` block. Baking
- * the latter in would duplicate it, since it is re-appended below the override
- * on every compose.
- *
- * `scope` is the active `userInstructionsScope`; it decides whether the seed's
- * precedence note is true — see {@link projectScopeOverridesLoad}.
- */
-declare function renderSystemMdSeed(currentSystem: string, scope?: AgentsMdScope): string;
+declare function useStreamBuffer(setEvents: Dispatch<SetStateAction<StreamEvent[]>>, options?: StreamBufferOptions): StreamBuffer;
 //#endregion
 //#region src/chat/theme-context.d.ts
-declare function ThemeProvider({
-  theme,
-  children
-}: {
+declare function ThemeProvider({ theme, children }: {
   theme: Theme;
   children: ReactNode;
 }): import("react").JSX.Element;
 declare function useTheme(): Theme;
 /** Color palette only — equivalent to `useTheme().colors`. */
 declare function useColors(): ThemeColors;
-/** Select-row styling — equivalent to `useTheme().select`. */
+/** Select-row styling — equivalent to `useTheme().select`: the `▶` marker and accent text carry the cursor. */
 declare function useSelectStyle(): ThemeSelect;
 /** Panel / surface backgrounds — equivalent to `useTheme().surfaces`. */
 declare function useSurfaces(): ThemeSurfaces;
@@ -3839,5 +6655,73 @@ declare function renderActiveTodoAnchor(todos: readonly TodoItem[], options?: Ac
  */
 declare function createActiveTodoAnchorHooks(options?: ActiveTodoAnchorOptions): AgentHookMap;
 //#endregion
-export { ProjectsFile as $, ChatTurnsReadToolOptions as $i, shouldAutoGenerateTitle as $n, updateAppliedMarkerPath as $r, parentServerName as $t, buildSkillsConfig as A, ArtifactViewRow as Ai, createMemoryApprovalsStore as An, bootTick as Ar, modelChainMetadata as At, SettingsCategoryDescriptor as B, COMMUNICATION_DOCTRINE as Bi, QueuedAttachment as Bn, useUpdateCheck as Br, clearMcpToolsCache as Bt, userSystemMdPath as C, performInPlaceSelfUpdate as Ci, EditOutcomeLedger as Cn, ClaudeImportSummary as Cr, redirectUriFromAuthUrl as Ct, SpawnStartRecord as D, chatWindowBehavior as Di, ApprovalHub as Dn, importFromClaudeCode as Dr, runOAuthLogin as Dt, useStreamBuffer as E, chatAutoCompactBehavior as Ei, runCompaction as En, hasClaudeCodeSetup as Er, oauthUsesManualCodePaste as Et, SETTINGS_CATEGORIES as F, DiscoverAgentsMdOptions as Fi, CommandSummary as Fn, upgradeInstalledPackages as Fr, mcpsWritePath as Ft, StringSettingKey as G, INTERACTION_GUIDANCE_NO_PROMPTS as Gi, SessionPresence as Gn, InstalledVersionWatcher as Gr, subscribeMcpToolsCache as Gt, SettingsInput as H, EnvSectionOptions as Hi, RunningWorkItem as Hn, RunUpdateCommandResult as Hr, mcpToolsCachePath as Ht, SETTINGS_CHOICES as I, discoverAgentsMd as Ii, HostSettings as In, BuildUpdateHintOptions as Ir, removeMcpServer as It, folderlessCwd as J, SUBAGENT_GUIDANCE as Ji, WireApprovalRequest as Jn, UseRestartRequiredOptions as Jr, useMcpToolToggleMap as Jt, enforceSettingsInvariants as K, PLAN_MODE_DOCTRINE as Ki, StreamProgressInfo as Kn, UPDATE_APPLIED_MARKER as Kr, McpToolToggleSet as Kt, SETTINGS_INPUTS as L, renderAgentsMdBlock as Li, HostSignal as Ln, UseUpdateCheckOptions as Lr, upsertMcpServer as Lt, discoverProjectSkills as M, summarizeArtifactCounts as Mi, PendingApprovalsStore as Mn, UpgradePackageResult as Mr, McpConfigScope as Mt, BooleanSettingKey as N, AgentsMdFile as Ni, ApprovalOriginator as Nn, UpgradeProgressEvent as Nr, RemoveMcpResult as Nt, buildSpawnEndEvent as O, ArtifactScope as Oi, ApprovalRequestInput as On, tryOpenBrowser as Or, supportsOAuth as Ot, DEFAULT_SETTINGS as P, AgentsMdResult as Pi, CommandArgSuggestionSummary as Pn, UpgradeReport as Pr, UpsertMcpResult as Pt, ProjectEntry as Q, envSection as Qi, generateSessionTitle as Qn, readUpdateAppliedMarker as Qr, indexOfServerRow as Qt, SETTINGS_TOGGLES as R, ACTIONS_WITH_CARE_DOCTRINE as Ri, PendingInteraction as Rn, buildRestartHint as Rr, CachedMcpToolList as Rt, userScopeOverridesLoad as S, parseSemver as Si, createInteractionHub as Sn, ClaudeImportOptions as Sr, normalizeRedirectPaste as St, StreamSource as T, resolvePlatformPackage as Ti, CompactionEntry as Tn, countClaudeSessionFiles as Tr, OAuthPrompt$1 as Tt, SettingsProvider as U, IDENTITY_PREFIX as Ui, SendOptions as Un, runUpdateCommand as Ur, refreshMcpToolsCatalog as Ut, SettingsChoice as V, DOING_TASKS_DOCTRINE as Vi, QueuedItem as Vn, RunUpdateCommandOptions as Vr, loadMcpToolsCache as Vt, SettingsToggle as W, INTERACTION_GUIDANCE as Wi, SerializedPreview as Wn, InstalledVersionState as Wr, saveMcpToolsCache as Wt, scopeCwd as X, buildBuildSystem as Xi, GenerateSessionTitleOptions as Xn, hasUpdateAppliedMarker as Xr, VisibleMcpRow as Xt, resolveSessionCwd as Y, TOKEN_DISCIPLINE_DOCTRINE as Yi, toTodosSnapshot as Yn, WatchInstalledVersionOptions as Yr, useMcpToolToggleSet as Yt, IMPLICITLY_SAFE_TOOLS as Z, buildPlanSystem as Zi, cleanTitle as Zn, probeInstalledVersion as Zr, buildVisibleMcpRows as Zt, DiscoverSystemMdOptions as _, checkForUpdate as _i, createChatHost as _n, ArtifactReferenceData as _r, usageSourceFor as _t, GRUVBOX_DARK as a, findInstalledCompanion as ai, useMcpAuthState as an, Commit as ar, readProjects as at, discoverSystemMd as b, detectLibc as bi, WorkerSummary as bn, scoreArtifacts as br, FetchOAuthRedirectResult as bt, CATPPUCCIN_LATTE as c, InPlaceUpdateResult as ci, McpAuthStatus as cn, Walk as cr, runEndNotice as ct, ThemeProvider as d, PerformInPlaceUpdateOptions as di, extractEditPayloadForGate as dn, DiscoveryProvider as dr, clearProviderUsageCache as dt, chatReferenceTokensForPrompt as ea, useRestartRequired as ei, createFileMcpCredentialStore as en, BuildHintsOptions as er, addToSafelist as et, useColors as f, PerformSelfUpdateOptions as fi, readFileSafe as fn, useDiscovery as fr, fetchAllProviderUsage as ft, useTheme as g, UpdateStatus as gi, ContextSegmentsReport as gn, ARTIFACTS_COMPLETION_PROVIDER_ID as gr, usageChecksOptedOut as gt, useSyntaxStyles as h, TarballAvailabilityOptions as hi, ChatHost as hn, useConfig as hr, providerUsageSupported as ht, VAPORWAVE_THEME as i, unwrapCallTool as ia, InstalledCompanion as ii, useMcpAuthDispatch as in, quoteForShell as ir, projectsFilePath as it, defaultSkillScanPaths as j, groupArtifacts as ji, ChatHostEnvironment as jn, UpgradeInstalledPackagesOptions as jr, sessionModelFallbacks as jt, buildSpawnStartEvent as k, ArtifactViewGroup as ki, createApprovalHub as kn, bootProfileEnabled as kr, ModelFallbackTarget as kt, CATPPUCCIN_MACCHIATO as l, PackageManagerCommand as li, getMcpAuthStatus as ln, createDiscoverySlot as lr, FetchProviderUsageOptions as lt, useSurfaces as m, SelfUpdateResult as mi, serializePreview as mn, ConfigProvider as mr, fetchProviderUsageAccounts as mt, createActiveTodoAnchorHooks as n, CALL_TOOL_NAME as na, writeUpdateAppliedMarker as ni, patchMcpCredential as nn, shortChord as nr, isOnSafelist as nt, GRUVBOX_LIGHT as o, CheckForUpdateOptions as oi, McpAuthEvent as on, DiscoverySlot as or, suggestSafelistEntries as ot, useSelectStyle as p, PlatformTarballOptions as pi, resolveCwdPath as pn, useDiscoveryOptional as pr, fetchProviderUsage as pt, useSettings as q, PLAN_MODE_DOCTRINE_NO_PROMPTS as qi, TodosSnapshot as qn, UpdateAppliedMarker as qr, buildToolToggle as qt, renderActiveTodoAnchor as r, UnwrappedToolCall as ra, CompanionSpec as ri, McpAuthProvider as rn, parseEditorCommand as rr, matchesSafelistEntry as rt, CATPPUCCIN_FRAPPE as s, DetectPackageManagerOptions as si, McpAuthStateMap as sn, DiscoverySlotOptions as sr, writeProjects as st, ActiveTodoAnchorOptions as t, createChatTurnsReadTool as ta, watchInstalledVersion as ti, mcpCredentialsPath as tn, buildHints as tr, getSafelist as tt, CATPPUCCIN_MOCHA as u, PackageManagerId as ui, reduceMcpAuth as un, DiscoveryContextValue as ur, USAGE_CACHE_TTL_MS as ut, SystemMdFile as v, checkTarballAvailable as vi, CreateWorkerParams as vn, ArtifactReferenceEntry as vr, findGitRoot as vt, StreamBuffer as w, performSelfUpdate as wi, PendingAnnotation as wn, ClaudeSessionImportResult as wr, OAuthFlowOptions as wt, renderSystemMdSeed as x, detectPackageManager as xi, InteractionHub as xn, ClaudeCopyResult as xr, fetchOAuthRedirect as xt, SystemMdResult as y, compareSemver as yi, WorkerRow as yn, createArtifactsCompletionProvider as yr, formatPathForCwd as yt, SettingsCategory as z, BuildSystemOptions as zi, PromptAttachment as zn, buildUpdateHint as zr, McpToolsCache as zt };
-//# sourceMappingURL=index-C6NEd5y_.d.ts.map
+//#region src/chat/transcript-anchors.d.ts
+/**
+ * One entry in the partitioned transcript-row list. Single events
+ * render as a normal row; a `child-run` groups ONE subagent's events
+ * from a consecutive run of subagent output into one bordered box
+ * (concurrent siblings get a `child-run` each, so their rows never
+ * braid together inside a shared frame); `tool-group`s
+ * collect ALL parent-owned tool/tool-result events of one exchange
+ * into a single collapsible summary row (`Settings.groupToolCalls`);
+ * an `exchange-fold` goes further (`Settings.transcriptDensity:
+ * 'compact'`) and takes every thinking, tool and worker event of the
+ * exchange, leaving only the prompt and the assistant's prose in place.
+ * `key` is stable across re-partitions of the same stream (derived
+ * from the first grouped event) so expand state survives appends.
+ *
+ * Currently produced by the TUI's `partitionTranscript`; a GUI shell
+ * grouping subagent runs the same way can produce the same shape.
+ */
+type TranscriptItem = {
+  kind: 'event';
+  event: StreamEvent;
+  previous?: StreamEvent;
+} | {
+  kind: 'child-run';
+  events: StreamEvent[];
+  previous?: StreamEvent;
+} | {
+  kind: 'tool-group';
+  key: string;
+  events: StreamEvent[];
+  previous?: StreamEvent;
+} | {
+  kind: 'exchange-fold';
+  key: string;
+  events: StreamEvent[];
+  previous?: StreamEvent;
+} |
+/** Compact density: an exchange's earlier messages, ahead of its last one. */
+{
+  kind: 'message-group';
+  key: string;
+  events: StreamEvent[];
+  previous?: StreamEvent;
+};
+/**
+ * Per-item anchor ids for auto-scroll. Walks `items` in render order
+ * and, for each event, returns either:
+ *   - `'turn-anchor-<turnId>'` — the first event of this turn (the
+ *     scroll target).
+ *   - `undefined` — later event of an already-tagged turn (or a
+ *     synthetic event with no `turnId`).
+ *
+ * `ids[i]` is a tuple per item: length 1 for plain events, length N
+ * for subagent runs (one entry per inner event). `idByTurn` is the
+ * inverse lookup used by the scroll effect. `lastTurnId` is the
+ * most-recently-rendered turn — the scroll effect special-cases it to
+ * snap to bottom rather than scroll the anchor into view (which would
+ * stop short of the actual tail).
+ *
+ * Exported so the anchor-tagging matrix can be unit-tested without
+ * rendering anything.
+ */
+declare function computeTurnAnchors(items: readonly TranscriptItem[]): {
+  idByTurn: ReadonlyMap<string, string>;
+  ids: readonly (readonly (string | undefined)[])[];
+  lastTurnId: string | undefined;
+};
+//#endregion
+export { ProjectsFile as $, ClaudeImportSummary as $a, ResolvedPaths as $i, PendingApprovalsStore as $n, checkForUpdate as $o, EnabledAllowlistKey as $r, useMcpToolToggleSet as $t, SETTINGS_CHOICES as A, KeyBindingDef as Aa, PreferredCredentialTarget as Ai, normalizeLaunchOverrides as An, UseRestartRequiredOptions as Ao, cleanTitle as Ar, SUBAGENT_GUIDANCE as As, redirectUriFromAuthUrl as At, enforceSettingsInvariants as B, normalizeBindingValue as Ba, removeProviderCredential as Bi, describeForkFailure as Bn, InstalledCompanion as Bo, createSessionExecutionCache as Br, unwrapCallTool as Bs, removeMcpServer as Bt, buildSpawnEndEvent as C, updateToolEventOutcomes as Ca, defaultMcpsConfigPaths as Ci, ContextSegmentsReport as Cn, RunUpdateCommandOptions as Co, userSystemMdPath as Cr, DOING_TASKS_DOCTRINE as Cs, mainCheckoutRoot as Ct, discoverProjectSkills as D, KEYBINDING_DEF_BY_ACTION as Da, CredentialsFile as Di, WorkerRow as Dn, InstalledVersionWatcher as Do, overlayHostSettings as Dr, INTERACTION_GUIDANCE_NO_PROMPTS as Ds, FetchOAuthRedirectResult as Dt, defaultSkillScanPaths as E, KEYBINDING_DEFS as Ea, ApiKeyCredential as Ei, CreateWorkerParams as En, InstalledVersionState as Eo, isWindowOnlySetting as Er, INTERACTION_GUIDANCE as Es, formatPathForCwd as Et, SettingsChoice as F, formatBindingForDisplay as Fa, credentialsPath as Fi, ForkSessionResult as Fn, updateAppliedMarkerPath as Fo, shortChord as Fr, ChatTurnsReadToolOptions as Fs, supportsOAuth as Ft, renderSession as G, ARTIFACTS_COMPLETION_PROVIDER_ID as Ga, storedCredentialsOf as Gi, sessionModelFallbacks as Gn, PackageManagerCommand as Go, createWorktreeEnvironmentProvider as Gr, ModelAliasContext as Gs, loadMcpToolsCache as Gt, SessionExportAnchor as H, readKeybindingsRaw as Ha, setCredentialLabel as Hi, newSession as Hn, CheckForUpdateOptions as Ho, builtinEnvironmentProviders as Hr, loadMarkdownAgents as Hs, CachedMcpToolList as Ht, SettingsInput as I, groupBindings as Ia, readCredentials as Ii, ForkSource as In, useRestartRequired as Io, CreateExtensionMcpHostOptions as Ir, chatReferenceTokensForPrompt as Is, McpConfigScope as It, folderlessCwd as J, createArtifactsCompletionProvider as Ja, useConfig as Ji, ApprovalHub as Jn, PerformSelfUpdateOptions as Jo, ProvisionSessionEnvironmentResult as Jr, useCompletion as Js, saveMcpToolsCache as Jt, resolveSessionExportTarget as K, ArtifactReferenceData as Ka, writeCredentials as Ki, EditOutcomeLedger as Kn, PackageManagerId as Ko, localEnvironmentProvider as Kr, MarkdownDefDiagnostic as Ks, mcpToolsCachePath as Kt, SettingsProvider as L, keybindingsPath as La, readProviderCredential as Li, createMainSession as Ln, watchInstalledVersion as Lo, createExtensionMcpHost as Lr, createChatTurnsReadTool as Ls, RemoveMcpResult as Lt, SETTINGS_TOGGLES as M, KeyBindings as Ma, SetProviderCredentialOptions as Mi, createInteractionHub as Mn, hasUpdateAppliedMarker as Mo, shouldAutoGenerateTitle as Mr, buildBuildSystem as Ms, OAuthPrompt$1 as Mt, SettingsCategory as N, ResolvedExtensionKeybinding as Na, StoredCredential as Ni, CreateSessionInStoreParams as Nn, probeInstalledVersion as No, BuildHintsOptions as Nr, buildPlanSystem as Ns, oauthUsesManualCodePaste as Nt, BooleanSettingKey as O, KEYBINDING_KEY_COL_WIDTH as Oa, OAuthCredential as Oi, WorkerSummary as On, UPDATE_APPLIED_MARKER as Oo, splitHostSettingsPatch as Or, PLAN_MODE_DOCTRINE as Os, fetchOAuthRedirect as Ot, SettingsCategoryDescriptor as P, ensureKeybindingsFile as Pa, applyApiKeyEnv as Pi, ForkSessionParams as Pn, readUpdateAppliedMarker as Po, buildHints as Pr, envSection as Ps, runOAuthLogin as Pt, ProjectEntry as Q, ClaudeImportOptions as Qa, ResolvedConfig as Qi, ChatHostEnvironment as Qn, UpdateStatus as Qo, environmentCredentialsPath as Qr, useMcpToolToggleMap as Qt, SettingsToggle as R, matchesBinding as Ra, readProviderCredentialPair as Ri, createSessionInStore as Rn, writeUpdateAppliedMarker as Ro, SessionExecution as Rr, CALL_TOOL_NAME as Rs, UpsertMcpResult as Rt, SpawnStartRecord as S, toolResultText as Sa, dedupMcpServersByName as Si, ChatHost as Sn, truncateTrailing as So, userScopeOverridesLoad as Sr, COMMUNICATION_DOCTRINE as Ss, findProjectRoot as St, buildSkillsConfig as T, DEFAULT_KEYBINDINGS as Ta, parseMcpsFile as Ti, WorkspaceListFilesOptions as Tn, runUpdateCommand as To, WINDOW_LOCAL_SETTINGS as Tr, IDENTITY_PREFIX as Ts, projectRootOf as Tt, SessionExportFormat as U, resolveExtensionKeybindings as Ua, setPreferredCredential as Ui, ModelFallbackTarget as Un, DetectPackageManagerOptions as Uo, WORKTREE_ENVIRONMENT_KIND as Ur, loadMarkdownCommands as Us, McpToolsCache as Ut, useSettings as V, readKeybindings as Va, removeStoredCredential as Vi, forkSession as Vn, findInstalledCompanion as Vo, BuiltinEnvironmentOptions as Vr, applyMarkdownSubagents as Vs, upsertMcpServer as Vt, SessionExportTarget as W, stripJsonComments as Wa, setProviderCredential as Wi, modelChainMetadata as Wn, InPlaceUpdateResult as Wo, WorktreeRef as Wr, BUILTIN_SUBAGENTS as Ws, clearMcpToolsCache as Wt, scopeCwd as X, ClaudeCopyResult as Xa, ChatOptions as Xi, createApprovalHub as Xn, SelfUpdateResult as Xo, createFileEnvironmentSecrets as Xr, McpToolToggleSet as Xt, resolveSessionCwd as Y, scoreArtifacts as Ya, AutoUpdateConfig as Yi, ApprovalRequestInput as Yn, PlatformTarballOptions as Yo, provisionSessionEnvironment as Yr, subscribeMcpToolsCache as Yt, IMPLICITLY_SAFE_TOOLS as Z, ClaudeImportActiveHost as Za, ProviderRegistry as Zi, createMemoryApprovalsStore as Zn, TarballAvailabilityOptions as Zo, createMemoryEnvironmentSecrets as Zr, buildToolToggle as Zt, useSyntaxStyles as _, sessionEnvironmentSummary as _a, projectUserPaths as _i, serializePreview as _n, useUpdateCheck as _o, DiscoverSystemMdOptions as _r, DiscoverAgentsMdOptions as _s, fetchProviderUsageAccounts as _t, renderActiveTodoAnchor as a, compactSummaryEvent as aa, DiscoverySlot as ai, mcpCredentialsPath as an, tryOpenBrowser as ao, PendingInteraction as ar, performInPlaceSelfUpdate as as, matchesSafelistEntry as at, StreamSource as b, titleFromTurns as ba, DiscoveryResult as bi, CompactionReport as bn, clipHintsToWidth as bo, discoverSystemMd as br, ACTIONS_WITH_CARE_DOCTRINE as bs, usageSourceFor as bt, GRUVBOX_LIGHT as c, eventsFromTurns as ca, createDiscoverySlot as ci, useMcpAuthDispatch as cn, UpgradeInstalledPackagesOptions as co, QueuedItem as cr, chatAutoCompactBehavior as cs, safelistProjectKey as ct, CATPPUCCIN_MACCHIATO as d, lastContextSizeFromTurns as da, useDiscovery as di, createHostRegistry as dn, UpgradeReport as do, SerializedPreview as dr, ArtifactViewGroup as ds, runEndNotice as dt, resolveConfig as ea, EnabledToggleSet as ei, VisibleMcpRow as en, ClaudeSessionImportResult as eo, ApprovalOriginator as er, checkTarballAvailable as es, addToSafelist as et, CATPPUCCIN_MOCHA as f, listSessionMeta as fa, useDiscoveryOptional as fi, hostCredentialKey as fn, upgradeInstalledPackages as fo, SessionPresence as fr, ArtifactViewRow as fs, FetchProviderUsageOptions as ft, useSurfaces as g, saveState as ga, ProjectUserPath as gi, resolveCwdPath as gn, buildUpdateHint as go, toTodosSnapshot as gr, AgentsMdResult as gs, fetchProviderUsage as gt, useSelectStyle as h, replayTurns as ha, discoverProjectPlugins as hi, readFileSafe as hn, buildRestartHint as ho, WireApprovalRequest as hr, AgentsMdFile as hs, fetchAllProviderUsage as ht, createActiveTodoAnchorHooks as i, TuiState as ia, Commit as ii, createFileMcpCredentialStore as in, importFromClaudeCode as io, HostSignal as ir, parseSemver as is, isOnSafelist as it, SETTINGS_INPUTS as j, KeyBindingSection as ja, ProviderCredential as ji, InteractionHub as jn, WatchInstalledVersionOptions as jo, generateSessionTitle as jr, TOKEN_DISCIPLINE_DOCTRINE as js, OAuthFlowOptions as jt, SETTINGS_CATEGORIES as k, KeyAction as ka, PreferCredentialResult as ki, SessionLaunchOverrides as kn, UpdateAppliedMarker as ko, GenerateSessionTitleOptions as kr, PLAN_MODE_DOCTRINE_NO_PROMPTS as ks, normalizeRedirectPaste as kt, CATPPUCCIN_FRAPPE as l, getSessionHeader as la, DiscoveryContextValue as li, useMcpAuthState as ln, UpgradePackageResult as lo, RunningWorkItem as lr, chatWindowBehavior as ls, suggestSafelistEntries as lt, useColors as m, marginTopFor as ma, buildPluginContributions as mi, extractEditPayloadForGate as mn, UseUpdateCheckOptions as mo, TodosSnapshot as mr, summarizeArtifactCounts as ms, clearProviderUsageCache as mt, computeTurnAnchors as n, ModelUsageSummary as na, parseEditorCommand as ni, indexOfServerRow as nn, countClaudeSessionFiles as no, CommandSummary as nr, detectLibc as ns, getSafelist as nt, VAPORWAVE_THEME as o, createStateStore as oa, DiscoverySlotOptions as oi, patchMcpCredential as on, bootProfileEnabled as oo, PromptAttachment as or, performSelfUpdate as os, projectsFilePath as ot, ThemeProvider as p, loadState as pa, DiscoveredPlugin as pi, hostsFilePath as pn, BuildUpdateHintOptions as po, StreamProgressInfo as pr, groupArtifacts as ps, USAGE_CACHE_TTL_MS as pt, writeSessionExport as q, ArtifactReferenceEntry as qa, ConfigProvider as qi, PendingAnnotation as qn, PerformInPlaceUpdateOptions as qo, ProvisionSessionEnvironmentInput as qr, CompletionState as qs, refreshMcpToolsCatalog as qt, ActiveTodoAnchorOptions as r, StateStoreApi as ra, quoteForShell as ri, parentServerName as rn, hasClaudeCodeSetup as ro, HostSettings as rr, detectPackageManager as rs, getSafelistForCwd as rt, GRUVBOX_DARK as s, deriveSessionTitle as sa, Walk as si, McpAuthProvider as sn, bootTick as so, QueuedAttachment as sr, resolvePlatformPackage as ss, readProjects as st, TranscriptItem as t, resolveStoragePaths as ta, useEnabledToggleSet as ti, buildVisibleMcpRows as tn, claudeImportHostNote as to, CommandArgSuggestionSummary as tr, compareSemver as ts, addToSafelistForCwd as tt, CATPPUCCIN_LATTE as u, headerFromData as ua, DiscoveryProvider as ui, HostRegistry as un, UpgradeProgressEvent as uo, SendOptions as ur, ArtifactScope as us, writeProjects as ut, useTheme as v, stripSpawnTokensLine as va, DiscoveredMcp as vi, createChatHost as vn, EMPTY_HINTS as vo, SystemMdFile as vr, discoverAgentsMd as vs, providerUsageSupported as vt, buildSpawnStartEvent as w, usageByModel as wa, discoverProjectMcps as wi, CreateSessionRequest as wn, RunUpdateCommandResult as wo, HOST_ENABLED_LISTS as wr, EnvSectionOptions as ws, planWorktreeProjectRootRemaps as wt, useStreamBuffer as x, toolCallPreview as xa, buildMcpServers as xi, runCompaction as xn, hintsLength as xo, renderSystemMdSeed as xr, BuildSystemOptions as xs, findGitRoot as xt, StreamBuffer as y, sumRunCosts as ya, DiscoveryError as yi, CompactionEntry as yn, Hint as yo, SystemMdResult as yr, renderAgentsMdBlock as ys, usageChecksOptedOut as yt, StringSettingKey as z, mergeKeybindings as za, readProviderCredentials as zi, deleteSessionData as zn, CompanionSpec as zo, SessionExecutionCache as zr, UnwrappedToolCall as zs, mcpsWritePath as zt };
+//# sourceMappingURL=index-CHABJd-L.d.ts.map