@agentprojectcontext/apx 1.80.2 → 1.89.1

package/src/core/constants/channels.js

@@ -12,10 +12,12 @@ export const CHANNELS = Object.freeze({
   API: "api",
   WEB: "web",                 // Web admin big chat
   WEB_SIDEBAR: "web_sidebar", // Web admin docked sidebar
-  WEB_CODE: "web_code",       // Web admin `/m/code` (OpenCode-style)
+  WEB_CODE: "web_code",       // Web admin `/code` (OpenCode-style)
   DECK: "deck",               // Mobile cockpit dashboard
   DESKTOP: "desktop",         // Electron capsule (always voice mode)
   CODE: "code",               // `apx code` — terminal coding session
+  A2A: "a2a",                 // Agent-to-agent relay (project-scoped ledger)
+  LOG: "log",                 // Readable, never delivered (routine abstentions)
   DIRECT: "direct",           // Planned: 1:1 channel that isn't a chat platform
   WHATSAPP: "whatsapp",       // Planned: WhatsApp bot integration
 });

package/src/core/constants/task-categories.js

@@ -0,0 +1,73 @@
+// What KIND of thing a task is — orthogonal to `state` (open/done/dropped),
+// to `status` (pending/running/…), and to `tags`.
+//
+// Tags stay exactly what they were: free-form labels the owner invents. A
+// category is a closed set the SYSTEM can act on, which is the whole point:
+// "this is an errand, at this place" is a fact the daemon can route on without
+// asking a model to read the title and guess. That guess is what a category
+// replaces — a mobility reminder for a categorised task costs no geocoding,
+// no place search and no LLM call.
+//
+// Registry pattern (AGENTS.md): adding a category is one entry here plus its
+// two i18n keys. Nothing else switches on the id.
+export const TASK_CATEGORIES = Object.freeze({
+  // The default. A task that is just a task.
+  general: Object.freeze({ id: "general", icon: "circle-dot", locatable: false }),
+  // Something to do while out — an errand with a place. `locatable` is what
+  // makes the mobility geofence consider it, and what makes the web offer the
+  // place fields.
+  trip: Object.freeze({ id: "trip", icon: "car", locatable: true }),
+});
+
+export const TASK_CATEGORY_IDS = Object.freeze(Object.keys(TASK_CATEGORIES));
+export const DEFAULT_TASK_CATEGORY = "general";
+
+/** Unknown or missing → the default. Never throws: this reads stored data. */
+export function normalizeTaskCategory(value) {
+  const id = String(value || "").trim().toLowerCase();
+  return TASK_CATEGORY_IDS.includes(id) ? id : DEFAULT_TASK_CATEGORY;
+}
+
+/** Can a task of this category carry a place? */
+export function categoryIsLocatable(value) {
+  return TASK_CATEGORIES[normalizeTaskCategory(value)].locatable === true;
+}
+
+function finite(value) {
+  const number = Number(value);
+  return Number.isFinite(number) ? number : null;
+}
+
+function text(value, max) {
+  return typeof value === "string" ? value.trim().slice(0, max) : "";
+}
+
+/**
+ * A task's place, normalized. Returns null when there is nothing usable —
+ * a half-filled location is worse than none, because everything downstream
+ * would treat it as an answer.
+ *
+ * `place` alone is valid: it names somewhere without pinning it, which is
+ * still enough for a reminder to be worth reading. Coordinates are only kept
+ * as a pair, and only when both are in range.
+ */
+export function normalizeTaskLocation(value) {
+  if (!value || typeof value !== "object") return null;
+  const place = text(value.place ?? value.name, 200);
+  const address = text(value.address, 300);
+  const latitude = finite(value.latitude ?? value.lat);
+  const longitude = finite(value.longitude ?? value.lon ?? value.lng);
+  const pinned =
+    latitude != null && longitude != null &&
+    latitude >= -90 && latitude <= 90 &&
+    longitude >= -180 && longitude <= 180;
+  if (!place && !address && !pinned) return null;
+  return {
+    ...(place ? { place } : {}),
+    ...(address ? { address } : {}),
+    ...(pinned ? { latitude, longitude } : {}),
+    // How close counts as "there". Absent means the caller had no opinion and
+    // the mobility default applies.
+    ...(finite(value.radius_m) != null ? { radius_m: finite(value.radius_m) } : {}),
+  };
+}

package/src/core/constants/task-fields.js

@@ -0,0 +1,28 @@
+import { OWNER_ACTOR_ID } from "./actors.js";
+
+export const TASK_PRIORITIES = Object.freeze(["low", "normal", "high", "urgent"]);
+export const DEFAULT_TASK_PRIORITY = "normal";
+
+export const TASK_REMINDER_FREQUENCIES = Object.freeze(["none", "once", "daily", "weekly"]);
+export const DEFAULT_TASK_REMINDER_FREQUENCY = "none";
+
+/** `human` is accepted at every write boundary; storage stays canonical. */
+export function normalizeTaskAssignee(value) {
+  const assignee = typeof value === "string" ? value.trim() : "";
+  if (!assignee) return null;
+  return ["human", OWNER_ACTOR_ID].includes(assignee.toLowerCase())
+    ? OWNER_ACTOR_ID
+    : assignee;
+}
+
+export function normalizeTaskPriority(value) {
+  const priority = String(value || "").trim().toLowerCase();
+  return TASK_PRIORITIES.includes(priority) ? priority : DEFAULT_TASK_PRIORITY;
+}
+
+export function normalizeTaskReminderFrequency(value) {
+  const frequency = String(value || "").trim().toLowerCase();
+  return TASK_REMINDER_FREQUENCIES.includes(frequency)
+    ? frequency
+    : DEFAULT_TASK_REMINDER_FREQUENCY;
+}

package/src/core/engines/_globs.js

@@ -0,0 +1,33 @@
+// Shell-style glob matching for model ids.
+//
+// Several adapters gate a wire-format quirk on WHICH model is answering rather
+// than on which provider it came from: Gemini's thought signatures, DeepSeek's
+// reasoning replay. Declaring those as glob patterns keeps "which models need
+// this" a list an operator can read and a config key can override, instead of
+// a branch buried in the serialiser.
+//
+// Patterns match the bare model id (no `<provider>:` prefix): `*` is any run of
+// characters, `?` a single one. Matching is case-insensitive.
+
+function globToRegExp(pattern) {
+  const escaped = String(pattern).replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^${escaped.replace(/\*/g, ".*").replace(/\?/g, ".")}$`, "i");
+}
+
+/** Does `model` match any of `patterns`? An empty list matches nothing. */
+export function matchesModelGlob(model, patterns) {
+  if (!Array.isArray(patterns) || patterns.length === 0) return false;
+  const id = String(model || "");
+  return patterns.some((p) => globToRegExp(p).test(id));
+}
+
+/**
+ * Resolve "which models use this mechanism" from config, falling back to the
+ * adapter's built-in list.
+ *
+ * A configured array REPLACES the default — it is the whole answer to the
+ * question, so an install can also opt out entirely with an explicit `[]`.
+ */
+export function modelListFromConfig(configured, builtIn) {
+  return Array.isArray(configured) ? configured : builtIn;
+}

package/src/core/engines/anthropic.js

@@ -9,6 +9,24 @@ function getKey(config) {
   return config.api_key || process.env.ANTHROPIC_API_KEY || "";
 }
 
+/** Anthropic multimodal content blocks. Images ride on `m.images` the same
+ *  way Gemini/OpenAI adapters read them — without this, Claude never saw
+ *  photos attached to a turn. */
+function contentForAnthropic(m) {
+  const text = typeof m.content === "string" ? m.content : JSON.stringify(m.content ?? "");
+  const imgs = Array.isArray(m.images)
+    ? m.images.filter((im) => im && im.data && im.mime)
+    : [];
+  if (!imgs.length) return text;
+  return [
+    ...(text ? [{ type: "text", text }] : []),
+    ...imgs.map((im) => ({
+      type: "image",
+      source: { type: "base64", media_type: im.mime, data: im.data },
+    })),
+  ];
+}
+
 export default {
   id: "anthropic",
   needsApiKey: true,
@@ -39,7 +57,7 @@ export default {
       temperature,
       messages: messages.map((m) => ({
         role: m.role === "assistant" ? "assistant" : "user",
-        content: typeof m.content === "string" ? m.content : JSON.stringify(m.content),
+        content: contentForAnthropic(m),
       })),
     };
     if (system) body.system = system;

package/src/core/engines/catalog.js

@@ -3,6 +3,7 @@
 // { error }. Pure transport — no daemon dependencies. Both the daemon HTTP
 // adapter and CLI commands can reuse this.
 import { fetchJsonWithTimeout } from "./_health.js";
+import { ZEN_HEADERS } from "./zen.js";
 
 export const DEFAULT_BASE = {
   openai:     "https://api.openai.com/v1",
@@ -11,6 +12,7 @@ export const DEFAULT_BASE = {
   gemini:     "https://generativelanguage.googleapis.com/v1beta/openai",
   anthropic:  "https://api.anthropic.com/v1",
   ollama:     "http://localhost:11434",
+  zen:        "https://opencode.ai/zen/v1",
 };
 
 // Gemini's native models endpoint returns a much richer catalog than the
@@ -66,6 +68,24 @@ export async function listModels(engine, baseUrl, apiKey) {
     return { models };
   }
 
+  // Zen publishes its catalog without a key, so the model picker can be filled
+  // before the user has one — useful, since choosing a model is how you decide
+  // whether the provider is worth signing up for.
+  if (engine === "zen") {
+    const r = await fetchJsonWithTimeout(`${base || DEFAULT_BASE.zen}/models`, {
+      timeoutMs: 5000,
+      headers: { ...ZEN_HEADERS, ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}) },
+    });
+    if (!r.ok) return { error: r.reason || `HTTP ${r.status}` };
+    const list = Array.isArray(r.json?.data) ? r.json.data : [];
+    const ids = list.map((m) => m?.id).filter(Boolean);
+    // Free-tier ids first. The catalog mixes models that bill at zero with
+    // Claude/GPT/Gemini ones that very much do not, under names that don't say
+    // which is which — so the cheap ones are the ones you scroll to first.
+    const free = (id) => /-free$/.test(id) || id === "big-pickle";
+    return { models: [...ids.filter(free).sort(), ...ids.filter((id) => !free(id)).sort()] };
+  }
+
   // openai-compatible family: openai, groq, openrouter, azure, custom
   if (!apiKey) return { error: "falta api_key" };
   if (!base) return { error: "falta base_url" };

package/src/core/engines/gemini.js

@@ -2,6 +2,8 @@
 // Direct fetch, no SDK. Supports function calling (Gemini's name for tool
 // use) so it can drive the super-agent loop on parity with Groq / OpenAI.
 import { randomUUID } from "node:crypto";
+import { matchesModelGlob, modelListFromConfig } from "./_globs.js";
+import { streamSseDataEvents } from "./_streaming.js";
 
 const API_BASE = "https://generativelanguage.googleapis.com/v1beta/models";
 
@@ -71,6 +73,55 @@ function markExhausted(model, key, now = Date.now()) {
   exhausted.set(cooldownKey(model, key), reset.getTime());
 }
 
+/**
+ * Read a `streamGenerateContent?alt=sse` response and rebuild the single
+ * response object the non-streaming path returns, so everything downstream —
+ * thought filtering, functionCall extraction, thought-signature replay — runs
+ * on one shape and stays unaware that streaming happened.
+ *
+ * Visible text deltas are handed to `onToken` as they arrive. Thought parts are
+ * NOT: they are the model's internal reasoning, and the desktop speaks what it
+ * streams.
+ */
+async function readGeminiStream(response, onToken) {
+  const parts = [];
+  let finishReason = null;
+  let usageMetadata = null;
+
+  const isTextPart = (p) => typeof p?.text === "string" && !(p.functionCall || p.function_call);
+
+  for await (const evt of streamSseDataEvents(response)) {
+    const cand = evt?.candidates?.[0];
+    if (evt?.usageMetadata) usageMetadata = evt.usageMetadata;
+    if (cand?.finishReason) finishReason = cand.finishReason;
+
+    for (const p of cand?.content?.parts || []) {
+      if (isTextPart(p) && !p.thought && p.text) {
+        try { onToken(p.text); } catch { /* a consumer throwing must not kill the turn */ }
+      }
+      // Text arrives in fragments; fold consecutive same-kind text parts back
+      // into one so the replayed model turn matches what a single-shot call
+      // would have produced. functionCall parts always arrive whole.
+      const last = parts[parts.length - 1];
+      if (
+        isTextPart(p) && last && isTextPart(last) &&
+        Boolean(last.thought) === Boolean(p.thought)
+      ) {
+        last.text += p.text || "";
+        const sig = p.thoughtSignature || p.thought_signature;
+        if (sig) last.thoughtSignature = sig;
+        continue;
+      }
+      parts.push({ ...p });
+    }
+  }
+
+  return {
+    candidates: [{ content: { parts }, finishReason }],
+    ...(usageMetadata ? { usageMetadata } : {}),
+  };
+}
+
 /** Did this response mean "this key has no quota left", as opposed to a real error? */
 function isQuotaError(status, json) {
   if (status === 429) return true;
@@ -150,21 +201,13 @@ export const THOUGHT_SIGNATURE_MODELS = [
   "gemini-5*",
 ];
 
-function globToRegExp(pattern) {
-  const escaped = String(pattern).replace(/[.+^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(`^${escaped.replace(/\*/g, ".*").replace(/\?/g, ".")}$`, "i");
-}
-
 // Per-install override, no code change required:
 //   engines.gemini.thought_signature_models: ["gemini-3*", "my-tuned-model*"]
-// A configured list REPLACES the built-in default — it is the whole answer to
-// "which models use this mechanism", so an install can also opt out entirely
-// with an explicit empty list.
 export function modelUsesThoughtSignatures(model, config = {}) {
-  const configured = config?.thought_signature_models;
-  const patterns = Array.isArray(configured) ? configured : THOUGHT_SIGNATURE_MODELS;
-  const id = String(model || "");
-  return patterns.some((p) => globToRegExp(p).test(id));
+  return matchesModelGlob(
+    model,
+    modelListFromConfig(config?.thought_signature_models, THOUGHT_SIGNATURE_MODELS)
+  );
 }
 
 function historyHasSignature(messages) {
@@ -193,7 +236,7 @@ function signaturesRequired(model, messages, config) {
 // their thoughtSignature) that the signing families require in every
 // subsequent turn. Falling back to reconstruction handles messages that came
 // from a non-Gemini engine or were serialised before this field was added.
-function toGeminiContents(messages, { model = "", config = {} } = {}) {
+export function toGeminiContents(messages, { model = "", config = {} } = {}) {
   const requireSignatures = signaturesRequired(model, messages, config);
   const out = [];
   // tool_call ids whose functionCall part we could not replay with a valid
@@ -231,6 +274,16 @@ function toGeminiContents(messages, { model = "", config = {} } = {}) {
       } else {
         out.push({ role: "user", parts: [part] });
       }
+      // A multimodal tool result (view_media) carries images the model should
+      // SEE. A functionResponse can't hold pixels, so the image rides on a
+      // following user turn with a short cue, right after the result.
+      if (Array.isArray(m.images) && m.images.length) {
+        const imgParts = [{ text: `(imagen de ${name})` }];
+        for (const img of m.images) {
+          if (img?.data && img?.mime) imgParts.push({ inlineData: { mimeType: img.mime, data: img.data } });
+        }
+        if (imgParts.length > 1) out.push({ role: "user", parts: imgParts });
+      }
       continue;
     }
 
@@ -334,6 +387,7 @@ export default {
     toolChoice,
     config = {},
     signal,
+    onToken,
   }) {
     const keys = getKeys(config);
     if (!keys.length) throw new Error("gemini: no api_key (set GEMINI_API_KEY or engines.gemini.api_key)");
@@ -366,20 +420,34 @@ export default {
     // request, not the turn.
     const order = fresh.length ? fresh : keys;
 
+    // Streaming is opt-in per call: the caller wants tokens as they land, and
+    // the turn isn't forcing a function call (mode ANY produces a call, not
+    // prose — there'd be nothing to stream). Same request body either way; only
+    // the endpoint and how the response is read differ, so the key rotation and
+    // error handling below stay shared.
+    const wantsStream =
+      typeof onToken === "function" && toolChoice !== "required" && toolChoice !== "any";
+
     let json;
     let lastError = null;
     for (let i = 0; i < order.length; i++) {
       const key = order[i];
-      const url = `${API_BASE}/${encodeURIComponent(model)}:generateContent?key=${key}`;
+      const verb = wantsStream ? "streamGenerateContent?alt=sse&" : "generateContent?";
+      const url = `${API_BASE}/${encodeURIComponent(model)}:${verb}key=${key}`;
       const res = await fetch(url, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify(body),
         signal,
       });
-      const payload = await res.json();
 
-      if (res.ok) { json = payload; break; }
+      // An SSE response body must not be read as JSON, so settle the ok/error
+      // question on the status first and only then choose how to read it.
+      if (res.ok) {
+        json = wantsStream ? await readGeminiStream(res, onToken) : await res.json();
+        break;
+      }
+      const payload = await res.json().catch(() => ({}));
 
       if (isQuotaError(res.status, payload)) {
         markExhausted(model, key);

package/src/core/engines/index.js

@@ -17,9 +17,10 @@ import groq from "./groq.js";
 import openrouter from "./openrouter.js";
 import ollama from "./ollama.js";
 import gemini from "./gemini.js";
+import zen from "./zen.js";
 import mock from "./mock.js";
 
-const ADAPTERS = { anthropic, openai, groq, openrouter, ollama, gemini, mock };
+const ADAPTERS = { anthropic, openai, groq, openrouter, ollama, gemini, zen, mock };
 
 export function resolveProvider(modelId) {
   if (typeof modelId !== "string" || !modelId) {
@@ -38,6 +39,18 @@ export function resolveProvider(modelId) {
   );
 }
 
+/**
+ * The adapter behind a provider *slug*. A slug is not always an adapter id:
+ * a provider named "carlos" running on Ollama is stored as
+ * `engines.carlos = { engine: "ollama", … }`, and "carlos:llama3.2" has to
+ * reach the ollama adapter. Falls back to the slug itself, which is the case
+ * for the stock providers whose slug already is the engine id.
+ */
+export function adapterForSlug(slug, config) {
+  const cfg = (config && config.engines && config.engines[slug]) || {};
+  return getAdapter(cfg.engine || slug);
+}
+
 export function getAdapter(provider) {
   const a = ADAPTERS[provider];
   if (!a) {
@@ -48,10 +61,12 @@ export function getAdapter(provider) {
   return a;
 }
 
-export async function callEngine({ modelId, system, messages, config, temperature, maxTokens, tools, toolChoice, signal, onToken }) {
+export async function callEngine({ modelId, system, messages, config, temperature, maxTokens, tools, toolChoice, signal, onToken, onReasoningToken }) {
   const { provider, model } = resolveProvider(modelId);
-  const adapter = getAdapter(provider);
   const providerCfg = (config && config.engines && config.engines[provider]) || {};
+  // `provider` here is the slug the user configured, which only coincides with
+  // the adapter id for the stock providers.
+  const adapter = getAdapter(providerCfg.engine || provider);
   // The per-provider `default_max_tokens` set in the web admin (Provider modal
   // slider) acts as a floor: callers may ask for more, but never less. This
   // matters for "thinking" models (e.g. Gemini 3.x) whose internal reasoning
@@ -73,6 +88,7 @@ export async function callEngine({ modelId, system, messages, config, temperatur
     config: providerCfg,
     signal,
     onToken,
+    onReasoningToken,
   });
 }
 

package/src/core/engines/mock.js

@@ -10,9 +10,26 @@ export default {
     return { ok: true, soft: true };
   },
 
-  async chat({ system, messages, model = "mock", tools }) {
+  async chat({ system, messages, model = "mock", tools, signal }) {
+    const forcedStatus = String(model).match(/^fail-(\d{3})$/)?.[1];
+    if (forcedStatus) throw new Error(`mock ${forcedStatus}: forced test failure`);
     const last = [...messages].reverse().find((m) => m.role === "user");
     const userText = last?.content || "";
+    // `[mock:slow:<ms>]` → hold each step for <ms> before answering, and honor
+    // the abort signal while holding. A real engine call takes time, and
+    // anything about what happens DURING a turn — cancelling it, interrupting
+    // it, watching it stream — cannot be tested against a mock that finishes a
+    // 400-step loop in under a second. Capped so a typo cannot hang a suite.
+    const slowMs = Math.min(parseInt(userText.match(/\[mock:slow:(\d+)\]/)?.[1] ?? "0", 10) || 0, 5000);
+    if (slowMs) {
+      await new Promise((resolve, reject) => {
+        const t = setTimeout(resolve, slowMs);
+        signal?.addEventListener?.("abort", () => {
+          clearTimeout(t);
+          reject(Object.assign(new Error("aborted"), { name: "AbortError" }));
+        }, { once: true });
+      });
+    }
     // Mirror real engines: tool calls are only possible when the caller offers
     // tools. The loop withholds them on its tool-free wrap-up step, and we must
     // honor that here — otherwise the mock would keep "calling" tools the model
@@ -22,6 +39,16 @@ export default {
     const loopTool = userText.match(/\[mock:loop:([a-z_]+)\]/)?.[1];
     const finishSummary = userText.match(/\[mock:finish:([^\]]*)\]/)?.[1];
     const hasToolResult = messages.some((m) => m.role === "tool");
+    // `[mock:system]` → the whole system prompt comes back as the answer, so a
+    // test can assert what the LOOP actually handed the engine rather than what
+    // the prompt builder returned in isolation.
+    if (/\[mock:system\]/.test(userText)) {
+      return {
+        text: String(system || ""),
+        usage: { input_tokens: userText.length, output_tokens: 0 },
+        raw: { model, mock: true },
+      };
+    }
     // `[mock:empty]` → a dud turn (no text, no tools) to exercise the loop's
     // empty-retry / never-end-silent guard.
     if (/\[mock:empty\]/.test(userText)) {
@@ -84,6 +111,123 @@ export default {
       return mkToolCall(requestedTool, "mock-call-1");
     }
 
+    // `[mock:cutoff]` → prose that hit the output cap: text, no tool calls,
+    // finish_reason "length". Models the turn that composed its work instead of
+    // doing it and ran out of budget. The SECOND time (once the loop has asked
+    // for the action) it calls the tool, so a test can assert the recovery.
+    if (/\[mock:cutoff:([a-z_]+)\]/.test(userText) || messages.some((m) => /\[mock:cutoff:/.test(String(m.content || "")))) {
+      const tool = messages
+        .map((m) => String(m.content || "").match(/\[mock:cutoff:([a-z_]+)\]/)?.[1])
+        .find(Boolean);
+      const nudged = messages.some((m) => /output limit and was cut off/i.test(String(m.content || "")));
+      if (nudged && toolsAvailable) return mkToolCall(tool, "mock-cutoff-1");
+      return {
+        text: "Idea 1: ... Idea 2: ... Idea 3: ... and then the budget ran ou",
+        finish_reason: "length",
+        usage: { input_tokens: userText.length, output_tokens: 512 },
+        raw: { model, mock: true },
+      };
+    }
+
+    // `[mock:prose:<tool>]` → the leak of 2026-08-26: a model that WRITES the
+    // call instead of making it, copying the shape out of its own history,
+    // stale result and all. No tool_calls, so the API considers the turn
+    // finished and the loop is one step from delivering a transcript as the
+    // answer. Once the recovered call has run it answers normally, so a test
+    // can assert both halves: the tool fired, and none of it was spoken.
+    const proseTool =
+      userText.match(/\[mock:prose:([a-z_]+)\]/)?.[1] ||
+      messages.map((m) => String(m.content || "").match(/\[mock:prose:([a-z_]+)\]/)?.[1]).find(Boolean);
+    if (proseTool) {
+      if (hasToolResult) {
+        return {
+          text: "Listo, ya lo miré.",
+          usage: { input_tokens: userText.length, output_tokens: 8 },
+          raw: { model, mock: true },
+        };
+      }
+      return {
+        text: `Reviso eso y te confirmo. [tool ${proseTool}] {"project":"acme"} → ya estaba hecho`,
+        usage: { input_tokens: userText.length, output_tokens: 48 },
+        raw: { model, mock: true },
+      };
+    }
+
+    // `[mock:fabricate:<tool>]` → the leak of 2026-08-29, one copy generation
+    // past `[mock:prose:…]`: a model that writes the whole TRANSCRIPT — several
+    // annotation lines with invented commands and invented output, then a
+    // confident report that the work is done. Nothing here is recoverable (no
+    // structured call, and the name is a paraphrase of the real tool's), so the
+    // only correct move is to refuse the text and ask for the real work. Once
+    // corrected it calls the tool, so a test can assert the recovery.
+    const fabricateTool =
+      userText.match(/\[mock:fabricate:([a-z_]+)\]/)?.[1] ||
+      messages.map((m) => String(m.content || "").match(/\[mock:fabricate:([a-z_]+)\]/)?.[1]).find(Boolean);
+    if (fabricateTool) {
+      const corrected = messages.some((m) =>
+        /written as if tools had run/i.test(String(m.content || "")),
+      );
+      if (corrected && toolsAvailable) return mkToolCall(fabricateTool, "mock-fabricate-1");
+      if (hasToolResult) {
+        return {
+          text: "Listo, ahora sí lo hice.",
+          usage: { input_tokens: userText.length, output_tokens: 8 },
+          raw: { model, mock: true },
+        };
+      }
+      return {
+        text:
+          "[result: shell] adb devices → List of devices attached\n" +
+          "[result: shell] adb shell input keyevent 66 — send pressed\n\n" +
+          "Listo, ya se lo mandé.",
+        usage: { input_tokens: userText.length, output_tokens: 48 },
+        raw: { model, mock: true },
+      };
+    }
+
+    // `[mock:copyomitted]` → the leak of 2026-09-02: the model copies the
+    // history annotation that stands in for a redacted answer and sends it as
+    // its whole reply, so Manu got `[omitted: this turn contained data that may
+    // be stale …]` in Telegram, twice. The reply is markup end to end — there
+    // is no answer inside it to rescue — so the loop must end the turn empty
+    // and let the surface's never-silent floor speak, never pass this on.
+    // Answers the same way every step on purpose: the empty retry re-sends the
+    // conversation unchanged, so a model that produces this once produces it
+    // again, and the loop has to hold anyway.
+    if (/\[mock:copyomitted\]/.test(userText)) {
+      return {
+        text:
+          "[omitted: this turn contained data that may be stale — call the " +
+          "tool again instead of repeating it]",
+        usage: { input_tokens: userText.length, output_tokens: 23 },
+        raw: { model, mock: true },
+      };
+    }
+
+    // `mock:truncated` → a degenerate answer: non-empty, but far too small to
+    // stand in for anything. Models the flaky provider response that used to
+    // get written over a whole conversation as its "summary".
+    if (model === "truncated" || model === "mock:truncated") {
+      return {
+        text: "USER_CONTEXT:\n- Owner",
+        usage: { input_tokens: userText.length, output_tokens: 6 },
+        raw: { model, mock: true },
+      };
+    }
+
+    // `[mock:reply:<text>]` → the model answers with exactly <text>. For tests
+    // about what the LOOP does with an answer rather than about producing one:
+    // the abstention marker is only interesting if the reply starts with it,
+    // and the default echo prefixes everything with "[mock:…] received:".
+    const replyText = userText.match(/\[mock:reply:([^\]]*)\]/)?.[1];
+    if (replyText !== undefined) {
+      return {
+        text: replyText,
+        usage: { input_tokens: userText.length, output_tokens: replyText.length },
+        raw: { model, mock: true },
+      };
+    }
+
     const sysHint = system ? ` (system: ${system.slice(0, 40)}…)` : "";
     return {
       text: `[mock:${model}] received: ${userText}${sysHint}`,