@bivy/bivy 0.6.0 → 0.7.0-staging.101

package/dist/runtime/index.js

@@ -40,6 +40,21 @@ import { ensureCodexAuth } from "./codex-auth.js";
 import { parserFactoryFor } from "./cli-parsers.js";
 import { sandboxTier, sandboxArgsFor, codexSandboxPolicy } from "../harness/sandbox.js";
 import { ProtocolRuntime, protocolRuntimeFromEnv, protocolCommandsFromEnv } from "./protocol.js";
+import { codexSlashCommands, opencodeSlashCommands } from "./slash-commands.js";
+/**
+ * On-disk slash commands (custom prompts/commands) for the CLI agents that keep
+ * them as markdown on the node — Codex's `$CODEX_HOME/prompts`, opencode's
+ * global + project `command` dirs. Populates their composer menu and makes an
+ * invoked `/name` actually run (see SlashCommandProvider). Any other agent has no
+ * such directory convention, so it returns undefined (no agent-native commands).
+ */
+function cliSlashCommands(id) {
+    if (id === "codex")
+        return codexSlashCommands();
+    if (id === "opencode")
+        return opencodeSlashCommands();
+    return undefined;
+}
 export * from "./types.js";
 export { NodeCredentialResolver, createCredentialStore } from "./credentials.js";
 const PI_CAPABILITIES = {
@@ -164,7 +179,11 @@ const CLI_AGENT_SPECS = {
         // reply to stdout (the TUI needs a real TTY and would hang over a pipe).
         args: ["run"],
         promptMode: "argv",
-        supportTier: "beta",
+        // Supported tier: OpenCode runs on the governed ACP path by default (per-tool
+        // Approve/Deny + session/load resume + a real model picker), the same bar Pi,
+        // Claude Code, and Codex clear. See `acp` below for the version fallback.
+        supportTier: "supported",
+        testedVersion: "1.18.13",
         blurb: "The most widely used open-source coding harness (OpenCode CLI).",
         // `opencode run -s <id> "<prompt>"` continues a prior session by its own id
         // (`-s, --session  session id to continue`, per `opencode run --help`).
@@ -180,11 +199,14 @@ const CLI_AGENT_SPECS = {
                 { id: "google/gemini-2.5-pro", name: "Gemini 2.5 Pro", provider: "google" },
             ],
         },
-        // OpenCode ships a native ACP server (`opencode acp`, per opencode.ai/docs/acp),
-        // so it can be driven through the governed ProtocolRuntime instead of the pipe —
-        // per-tool approvals + streaming + resume. Opt in with BIVY_OPENCODE_ACP=1 (or
-        // global BIVY_PREFER_ACP=1); off by default until validated for your version.
-        acp: { args: ["acp"] },
+        // `opencode acp` ("start ACP (Agent Client Protocol) server") drives OpenCode
+        // through the governed ProtocolRuntime instead of the one-shot pipe: per-tool
+        // Approve/Deny, streaming, `session/load` resume, and `session/set_model`.
+        // Validated against opencode 1.18.13, so it is ON by default (`preferred`) —
+        // gated on the binary actually listing the `acp` subcommand, so an older
+        // OpenCode falls back to the pipe path rather than opening a dead session.
+        // Force the pipe path back with BIVY_OPENCODE_ACP=0.
+        acp: { args: ["acp"], helpToken: "acp", preferred: true },
         install: { kind: "npm", pkg: "opencode-ai" },
     },
     aider: {
@@ -697,6 +719,9 @@ export function cliAgentManifest() {
             label: spec.displayName,
             command: spec.command,
             hidden: Boolean(spec.hidden),
+            supportTier: spec.supportTier ?? "beta",
+            certification: spec.testedVersion ? "release-tested" : (spec.supportTier ?? "beta") === "beta" ? "adapter-tested" : "unverified",
+            ...(spec.testedVersion ? { testedVersion: spec.testedVersion } : {}),
             headlessFlags: [...headless].filter((a) => !a.includes("{")),
             install: spec.install ?? null,
         };
@@ -839,10 +864,28 @@ function cliThinkingConfig(id) {
 // installed binary doesn't actually mention. It never UPGRADES — adding a
 // capability needs the exact arg template, which help text can't safely supply — so
 // probing can only make the catalog MORE honest, never invent a no-op control.
+/**
+ * Absolute path of a command on the current PATH, or null when it isn't there.
+ * Used to key the help-probe cache: caching by the bare NAME would keep serving a
+ * stale answer after the binary behind that name changed (a CLI upgraded or
+ * installed while the daemon is running, or a different PATH entry winning).
+ */
+function resolveCommandPath(command) {
+    if (!command.trim())
+        return null;
+    const res = spawnSync(process.platform === "win32" ? "where" : "command", process.platform === "win32" ? [command] : ["-v", command], {
+        shell: process.platform !== "win32",
+        encoding: "utf8",
+    });
+    if (res.status !== 0)
+        return null;
+    return (res.stdout ?? "").split(/\r?\n/)[0]?.trim() || null;
+}
 const HELP_PROBE_CACHE = new Map();
 function probeHelpText(command) {
-    if (HELP_PROBE_CACHE.has(command))
-        return HELP_PROBE_CACHE.get(command) ?? null;
+    const key = resolveCommandPath(command) ?? command;
+    if (HELP_PROBE_CACHE.has(key))
+        return HELP_PROBE_CACHE.get(key) ?? null;
     let text = null;
     try {
         const res = spawnSync(command, ["--help"], { encoding: "utf8", timeout: 4000 });
@@ -852,7 +895,7 @@ function probeHelpText(command) {
     catch {
         text = null;
     }
-    HELP_PROBE_CACHE.set(command, text);
+    HELP_PROBE_CACHE.set(key, text);
     return text;
 }
 // A resume template mixes launch flags (`-p`, `--force`) with the resume-specific
@@ -945,9 +988,14 @@ function cliAgentInfo(id) {
         // src/harness/mcp-inject.ts + governMcpCall in src/server.ts.
         capabilities: { toolInterception: acpActive, mcpToolApprovals: acpActive || Boolean(process.env.BIVY_MCP_PROXY), modelSelection, resume, packages: false, fork: false, usageReporting, sessionDiscovery: id === "codex" },
         supportTier: spec.supportTier ?? (id === "codex" ? "supported" : "experimental"),
+        testedVersion: spec.testedVersion,
         authOwner: spec.authOwner ?? "agent",
         notes: installed
-            ? `Available on PATH. This process adapter ${spec.parserId && !spec.parserUnverified ? "parses its native JSON stream into a structured transcript" : spec.parserId ? "streams stdout/stderr (a structured JSON parser is available; opt in with BIVY_AGENT_STRUCTURED=1 once validated for your version)" : "streams stdout/stderr"}; Bivy governs its filesystem/exec/MCP effects at the sandbox tier rather than intercepting each tool call. Override its launch flags with BIVY_${id.toUpperCase()}_ARGS if your CLI version differs.`
+            ? acpActive
+                // Promoted to ACP: the description must match the governed path actually in
+                // use, not the pipe path this agent would otherwise take.
+                ? `Available on PATH, driven through its Agent Client Protocol server (\`${spec.command} ${spec.acp?.args.join(" ")}\`): each tool call is gated by Bivy's Approve/Deny before it runs, and sessions resume natively. Force the plain stdout pipe with BIVY_${id.toUpperCase()}_ACP=0.`
+                : `Available on PATH. This process adapter ${spec.parserId && !spec.parserUnverified ? "parses its native JSON stream into a structured transcript" : spec.parserId ? "streams stdout/stderr (a structured JSON parser is available; opt in with BIVY_AGENT_STRUCTURED=1 once validated for your version)" : "streams stdout/stderr"}; Bivy governs its filesystem/exec/MCP effects at the sandbox tier rather than intercepting each tool call. Override its launch flags with BIVY_${id.toUpperCase()}_ARGS if your CLI version differs.`
             : `${spec.command} was not found on PATH. Install it on this node, then select this agent again.`,
         install: installed || !installCommand ? undefined : {
             label: `Install ${spec.displayName}`,
@@ -962,6 +1010,13 @@ function cliAgentInfo(id) {
 // Approve/Deny card via guardianInterceptor, AND it resumes a prior thread by its
 // rollout id (thread/resume). Governed + resumable in one runtime supersedes the
 // exec path, which stays runnable via `BIVY_RUNTIME=codex` for a no-approval flow.
+/**
+ * The Codex CLI release this adapter was last certified against. Unlike Pi and the
+ * Claude Agent SDK, Codex is an external binary rather than a pinned npm dependency,
+ * so there is no lockfile entry to derive this from — it is bumped deliberately when
+ * the app-server shim is re-validated against a new Codex release.
+ */
+const CODEX_TESTED_VERSION = "0.145.0";
 function codexApprovalsInfo() {
     const installed = commandAvailable("codex");
     return {
@@ -979,6 +1034,11 @@ function codexApprovalsInfo() {
             packages: false,
             fork: false,
             sessionDiscovery: true,
+            // getUsage() returns the shim's real token/cost snapshot, and `codex resume
+            // <id>` reopens the thread in Codex's TUI — advertise both so the catalog
+            // (and the pre-session picker) match what the session actually backs.
+            usageReporting: true,
+            interactiveTui: installed,
             // The governed/resumable Codex variant is the one that owns native
             // discovery+adoption (issue #156) — not the plain exec runtime below —
             // so an adopted session gets per-tool approvals from the moment it's
@@ -986,7 +1046,12 @@ function codexApprovalsInfo() {
             nativeSessionDiscovery: true,
             nativeSessionAdoption: true,
         },
-        supportTier: "beta",
+        // Supported tier: the app-server shim already clears the same bar as Pi and
+        // Claude Code — per-tool Approve/Deny, model selection, thread resume, usage
+        // reporting, and native session discovery/adoption — all over a bidirectional
+        // protocol rather than a one-shot pipe.
+        supportTier: "supported",
+        testedVersion: CODEX_TESTED_VERSION,
         authOwner: "agent",
         notes: installed
             ? "Drives Codex's experimental app-server so tool calls surface as in-chat approval cards, and resumes a prior thread by its rollout id (thread/resume). Governance AND resume in one runtime."
@@ -1095,7 +1160,12 @@ function codexAppServerRuntime(credsDir, tier) {
                 ],
             },
         ],
-        capabilities: { toolInterception: true, modelSelection: true, resume: true, nativeSessionDiscovery: true, nativeSessionAdoption: true },
+        // usageReporting: ProtocolSession.getUsage() already returns the shim's real
+        // token/cost snapshot — advertise it so the catalog matches what's backed.
+        // interactiveTui: `codex resume <rolloutId>` reopens the exact thread in
+        // Codex's own TUI (the same verified command as native discovery/takeover),
+        // gated on the codex binary being present — mirrors Claude's interactiveTui.
+        capabilities: { toolInterception: true, modelSelection: true, resume: true, usageReporting: true, interactiveTui: commandAvailable("codex"), nativeSessionDiscovery: true, nativeSessionAdoption: true },
         // Resume: the shim reconnects a prior thread via thread/resume by its rollout
         // id, and history preloads from the same on-disk rollout the exec path reads —
         // so takeover/reopen continues a governed session. (Validated on codex-cli
@@ -1112,6 +1182,15 @@ function codexAppServerRuntime(credsDir, tier) {
         // Bivy didn't start, so a pre-existing `codex` session can be adopted here
         // (the governed variant), never the plain exec runtime below.
         discoverNativeSessions: () => discoverNativeCodexSessions(),
+        // Codex custom prompts ($CODEX_HOME/prompts/*.md) → composer slash menu; an
+        // invoked one is expanded and sent as the turn (the app-server doesn't expand
+        // /prompt names itself). resolveCodexHome() matches the prepare'd CODEX_HOME.
+        slashCommands: codexSlashCommands(),
+        // "Continue in terminal": resume this exact thread in Codex's TUI by its
+        // rollout id. `codex resume <id>` is the same command native discovery and
+        // takeover already use (server.ts RESUME/NATIVE_RESUME maps); `env` carries
+        // the minted CODEX_HOME so the TUI reads the same auth.json chat did.
+        interactiveTui: ({ sessionRef, env }) => (sessionRef ? { command: "codex", args: ["resume", sessionRef], env } : null),
     });
 }
 // --- #2: the GENERAL ACP adapter (Agent Client Protocol) --------------------
@@ -1132,6 +1211,7 @@ function acpShimPath() {
  * ACP promotion path so both wrap agents identically.
  */
 function acpRuntimeOptions(opts) {
+    const slashCommands = cliSlashCommands(opts.id);
     return {
         id: opts.id,
         displayName: opts.displayName,
@@ -1141,6 +1221,9 @@ function acpRuntimeOptions(opts) {
         // the FIRST session (before the shim's hello lands); the hello confirms them.
         capabilities: { toolInterception: true, resume: true },
         resumable: true,
+        // An ACP-promoted opencode still surfaces/expands its on-disk commands (the
+        // ACP handshake doesn't carry them); a bare ACP agent has none.
+        ...(slashCommands ? { slashCommands } : {}),
         ...(opts.credsDir ? { credentials: createCredentialStore(opts.credsDir) } : {}),
     };
 }
@@ -1161,15 +1244,50 @@ function acpRuntimeFromEnv(credsDir) {
     return acpRuntimeOptions({ id: "acp", displayName: process.env.BIVY_ACP_NAME?.trim() || "ACP Agent", command, agentArgs, credsDir });
 }
 /**
- * Whether a CLI agent should be driven through ACP rather than the one-shot pipe:
- * it declares an `acp` mode AND ACP is preferred for it (per-agent `BIVY_<ID>_ACP=1`
- * or global `BIVY_PREFER_ACP=1`). This is the data-driven "promote an agent to the
- * high-capability path" switch — no per-agent code, just a spec field + a flag.
+ * Does the INSTALLED binary actually evidence the agent's ACP mode? A default-on
+ * promotion must never be taken on faith: ACP is a hard switch (the pipe path is
+ * unreachable once a session opens), so a CLI too old to have the subcommand would
+ * otherwise hang and die instead of degrading. We reuse the same cached `--help`
+ * probe the opt-in capability refinement uses, and fail CLOSED — a missing binary
+ * or unreadable help keeps the agent on the honest pipe path.
+ */
+function acpSupportedByBinary(id) {
+    const spec = CLI_AGENT_SPECS[id];
+    if (!spec.acp)
+        return false;
+    if (!commandAvailable(spec.command))
+        return false;
+    const help = probeHelpText(spec.command);
+    if (!help)
+        return false;
+    const token = (spec.acp.helpToken ?? spec.acp.args[0] ?? "acp").toLowerCase();
+    return help.includes(token);
+}
+/**
+ * Whether a CLI agent should be driven through ACP rather than the one-shot pipe.
+ * Three ways in, in precedence order:
+ *   - `BIVY_<ID>_ACP=0` — operator forces the pipe path back (escape hatch).
+ *   - `BIVY_<ID>_ACP=1` / `BIVY_PREFER_ACP=1` — operator forces ACP, no probe (they
+ *     know their binary; an explicit request shouldn't be second-guessed).
+ *   - `spec.acp.preferred` — validated agents are promoted by DEFAULT, but only
+ *     when the installed binary evidences the ACP mode (see acpSupportedByBinary).
+ * Still no per-agent code: a spec field plus a flag.
+ *
+ * Both the catalog (cliAgentInfo) and the launch path (makeCliRuntime) call this,
+ * so what the picker advertises and what actually starts cannot disagree.
  */
 function prefersAcp(id) {
-    if (!CLI_AGENT_SPECS[id].acp)
+    const spec = CLI_AGENT_SPECS[id];
+    if (!spec.acp)
+        return false;
+    const override = process.env[`BIVY_${id.toUpperCase()}_ACP`];
+    if (override === "0")
+        return false;
+    if (override === "1" || process.env.BIVY_PREFER_ACP === "1")
+        return true;
+    if (!spec.acp.preferred)
         return false;
-    return process.env.BIVY_PREFER_ACP === "1" || process.env[`BIVY_${id.toUpperCase()}_ACP`] === "1";
+    return acpSupportedByBinary(id);
 }
 /**
  * Resolve the communication mode for a CLI agent. This is deliberately pure so
@@ -1450,6 +1568,45 @@ const PICKER_RUNTIME_IDS = new Set([
     ...NON_CLI_PICKER_IDS,
     ...CLI_AGENT_IDS.filter((id) => !CLI_AGENT_SPECS[id].hidden),
 ]);
+function runtimeCertification(runtime) {
+    if (runtime.id === "pi")
+        return { certification: "release-tested", testedVersion: "0.83.0" };
+    if (runtime.id === "claude-code-sdk")
+        return { certification: "release-tested", testedVersion: "0.3.220" };
+    if (runtime.testedVersion)
+        return { certification: "release-tested", testedVersion: runtime.testedVersion };
+    return { certification: runtime.supportTier === "beta" ? "adapter-tested" : "unverified" };
+}
+function runtimeProtection(runtime) {
+    // Native SDK/CLI sandboxes receive the requested read-only/workspace/full tier
+    // in their own process boundary. The governed Codex path has both native
+    // sandbox flags and Bivy interception; label the stronger containment source.
+    const nativeSandbox = runtime.id === "claude-code-sdk" || runtime.id === "codex-approvals"
+        || (isCliAgentId(runtime.id) && Boolean(CLI_AGENT_SPECS[runtime.id].composeArgs));
+    if (nativeSandbox)
+        return {
+            protectionLevel: "native-sandbox",
+            protectionLabel: "Native sandbox",
+            protectionDetail: "This agent enforces Bivy's selected access tier in its native sandbox. Bivy tool controls may add approvals, but are not an OS jail of their own.",
+        };
+    if (runtime.capabilities.toolInterception)
+        return {
+            protectionLevel: "tool-controls",
+            protectionLabel: "Bivy tool controls",
+            protectionDetail: "Structured tool calls pass through Bivy policy and approvals. Shell heuristics prevent accidents, not adversarial escape.",
+        };
+    if (runtime.capabilities.mcpToolApprovals)
+        return {
+            protectionLevel: "mcp-controls",
+            protectionLabel: "MCP tools only",
+            protectionDetail: "Bivy governs MCP tool calls, but the agent's built-in shell and file operations still run with your user permissions.",
+        };
+    return {
+        protectionLevel: "user-permissions",
+        protectionLabel: "Runs as your user",
+        protectionDetail: "No Bivy-owned isolation or complete tool interception. Use a container/VM for unattended or untrusted work.",
+    };
+}
 export function listRuntimes(currentId) {
     return RUNTIME_CATALOG
         // Keep the current runtime visible even if hidden, so a session pinned to a
@@ -1472,7 +1629,7 @@ export function listRuntimes(currentId) {
         if (runtime.id === "acp")
             return acpInfo();
         return runtime;
-    }).map((runtime) => ({ ...runtime, current: runtime.id === currentId }));
+    }).map((runtime) => ({ ...runtime, ...runtimeProtection(runtime), ...runtimeCertification(runtime), current: runtime.id === currentId }));
 }
 export function makeRuntime(options) {
     const id = (options.runtime ?? process.env.BIVY_RUNTIME ?? "pi").toLowerCase();
@@ -1616,5 +1773,5 @@ function makeCliRuntime(id, options) {
                     : [a.replace(/\{id\}/g, sessionId).replace(/\{tier\}/g, tier)]),
             }
             : {};
-    return new ProcessRuntime({ id, displayName: spec.displayName, command: spec.command, args: runArgs, promptMode: spec.promptMode, credentials: createCredentialStore(options.credsDir), parserFactory: parserFactoryFor(parserId), preflight, prepare, model: cliModelConfig(id), thinking: cliThinkingConfig(id), usageReporting: cliUsageReporting(id), ...resumeOpts });
+    return new ProcessRuntime({ id, displayName: spec.displayName, command: spec.command, args: runArgs, promptMode: spec.promptMode, credentials: createCredentialStore(options.credsDir), parserFactory: parserFactoryFor(parserId), preflight, prepare, model: cliModelConfig(id), thinking: cliThinkingConfig(id), usageReporting: cliUsageReporting(id), slashCommands: cliSlashCommands(id), ...resumeOpts });
 }

package/dist/runtime/oauth/model-oauth.js

@@ -63,14 +63,15 @@ function tokensFrom(provider, payload, prev) {
     const rotated = typeof payload.refresh_token === "string" ? payload.refresh_token : "";
     const refresh = rotated || prev?.refresh || "";
     const expiresIn = Number(payload.expires_in) || 3600;
-    const expires = Date.now() + expiresIn * 1000 - provider.refreshSkewMs;
+    const now = Date.now();
+    const expires = now + expiresIn * 1000 - provider.refreshSkewMs;
     let accountId = prev?.accountId;
     if (provider.accountIdClaim) {
         accountId = jwtClaim(access, provider.accountIdClaim.path, provider.accountIdClaim.field) ?? accountId;
         if (!accountId)
             throw new Error(`Could not extract account id for "${provider.id}" from the OAuth token`);
     }
-    return { access, refresh, expires, ...(accountId ? { accountId } : {}) };
+    return { access, refresh, expires, refreshedAt: now, ...(accountId ? { accountId } : {}) };
 }
 // --- Authorization-code flow (browser + callback server + manual paste) ------
 function buildAuthorizeUrl(provider, opts) {
@@ -282,7 +283,7 @@ export async function loginModelOAuth(credsDir, providerId, interaction) {
     if (!provider)
         throw new Error(`Provider "${providerId}" does not support subscription login`);
     const tokens = provider.flow === "device_code" ? await loginDeviceCode(provider, interaction) : await loginAuthCode(provider, interaction);
-    const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
+    const credential = { type: "oauth", access: tokens.access, refresh: tokens.refresh, expires: tokens.expires, refreshedAt: tokens.refreshedAt, ...(tokens.accountId ? { accountId: tokens.accountId } : {}) };
     await createCredentialVault(credsDir).modify(providerId, async () => credential);
 }
 /** Exchange the refresh token for a fresh credential (network call; throws on failure). */
@@ -318,7 +319,7 @@ export async function refreshModelOAuth(credsDir, providerId) {
         if (Number(current.expires) > Date.now())
             return current;
         const fresh = await refreshTokens(provider, current);
-        return { type: "oauth", access: fresh.access, refresh: fresh.refresh, expires: fresh.expires, ...(fresh.accountId ? { accountId: fresh.accountId } : {}) };
+        return { type: "oauth", access: fresh.access, refresh: fresh.refresh, expires: fresh.expires, refreshedAt: fresh.refreshedAt, ...(fresh.accountId ? { accountId: fresh.accountId } : {}) };
     });
     return result?.type === "oauth" ? result.access : undefined;
 }

package/dist/runtime/process.js

@@ -5,7 +5,7 @@ import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { stripAnsi } from "./ansi.js";
 import { buildAgentCredentialEnv } from "./credentials.js";
-import { egressEnv } from "../harness/egress.js";
+import { egressEnv, sessionEgressEnv } from "../harness/egress.js";
 import { depCacheEnv } from "../harness/dep-cache.js";
 import { bivySessionEnv } from "./session-env.js";
 /**
@@ -193,6 +193,17 @@ class ProcessSession {
     setName(name) {
         this.name = name;
     }
+    /** The agent's on-disk slash commands for this workspace (Codex prompts,
+     *  opencode commands). Best-effort and display-only: any read failure yields an
+     *  empty menu, never a throw. */
+    getCommands() {
+        try {
+            return this.runtimeOptions.slashCommands?.list(this.cwd) ?? [];
+        }
+        catch {
+            return [];
+        }
+    }
     async suggestName() {
         // The generic CLI "dumb-pipe" runtime has no model of its own to name a
         // session with. Returning a raw 60-char truncation of the first message here
@@ -216,6 +227,17 @@ class ProcessSession {
         const prompt = text.trim();
         if (!prompt)
             return;
+        // A `/name args` line that matches an on-disk command runs the command by
+        // sending its expanded body to the agent; the transcript still shows what the
+        // user typed. Any non-command line (incl. a leading slash that isn't one)
+        // passes through untouched. Best-effort — a read failure sends the raw line.
+        let promptToSend;
+        try {
+            promptToSend = this.runtimeOptions.slashCommands?.expand(this.cwd, prompt) ?? prompt;
+        }
+        catch {
+            promptToSend = prompt;
+        }
         this.messages.push({ role: "user", content: prompt, timestamp: Date.now() });
         this.streaming = true;
         this.emit({ type: "agent_start" });
@@ -244,7 +266,7 @@ class ProcessSession {
             const idx = Math.min(Math.max(at, 0), argsWithFlags.length);
             argsWithFlags = [...argsWithFlags.slice(0, idx), ...inject, ...argsWithFlags.slice(idx)];
         }
-        const args = this.runtimeOptions.promptMode === "argv" ? [...argsWithFlags, prompt] : argsWithFlags;
+        const args = this.runtimeOptions.promptMode === "argv" ? [...argsWithFlags, promptToSend] : argsWithFlags;
         // Resolve credentials per prompt so freshly-refreshed OAuth tokens (and keys
         // added after this session started) reach the agent. The vault wins over any
         // ambient key so Bivy's shared sign-in is authoritative.
@@ -278,12 +300,14 @@ class ProcessSession {
         // src/harness/sandbox.ts). Bivy no longer wraps the process in an OS jail.
         const child = spawn(this.runtimeOptions.command, args, {
             cwd: this.cwd,
-            // egressEnv() routes this agent's outbound traffic through the harness
-            // network broker when BIVY_EGRESS_PROXY is enabled (else it's {}).
-            // bivySessionEnv() lets the agent's own shell resolve its session for
-            // `bivy attach <path>` (see session-env.ts); spread last so it can never
-            // be shadowed by an operator-configured env var of the same name.
-            env: { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv, ...egressEnv(), ...bivySessionEnv(this.id) },
+            // Route this agent's outbound traffic through an egress proxy: this
+            // session's OWN proxy if it has one (a per-session sandbox/workflow network
+            // policy — sessionEgressEnv), else the node-global broker when
+            // BIVY_EGRESS_PROXY is enabled (else {}). bivySessionEnv() lets the agent's
+            // own shell resolve its session for `bivy attach <path>` (see
+            // session-env.ts); spread last so it can never be shadowed by an operator-
+            // configured env var of the same name.
+            env: { ...process.env, ...depCacheEnv(), ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv, ...(sessionEgressEnv(this.id) ?? egressEnv()), ...bivySessionEnv(this.id) },
             stdio: "pipe",
             // Detached so the child becomes the leader of its own process group
             // (POSIX) — see killProcessGroup() / abort() below, which kill that whole
@@ -380,7 +404,7 @@ class ProcessSession {
             this.emit({ type: "agent_end", code, signal });
         });
         if (this.runtimeOptions.promptMode !== "argv") {
-            child.stdin.end(`${prompt}\n`);
+            child.stdin.end(`${promptToSend}\n`);
         }
         else {
             // Prompt is already in argv. Still close stdin so agents that also read it

package/dist/runtime/protocol.js

@@ -5,6 +5,7 @@ import { randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { buildAgentCredentialEnv } from "./credentials.js";
 import { bivySessionEnv } from "./session-env.js";
+import { mergeAgentCommands } from "./slash-commands.js";
 import { extractTokenUsage } from "./cli-parsers.js";
 /** A protocol `usage` message → UsageSnapshot (reuses the CLI token-key scan). */
 function parseProtocolUsage(raw) {
@@ -247,6 +248,42 @@ class ProtocolSession {
         await this.open();
         await this.command("command.invoke", { sessionId: this.id, runtimeSessionRef: this.runtimeSessionRef, name, args: args ?? "" });
     }
+    /** The session's slash commands: on-disk custom prompts (Codex/opencode) merged
+     *  with whatever the shim advertised in its hello, disk winning a collision.
+     *  Best-effort and display-only — a read failure just drops the on-disk set. */
+    getCommands() {
+        let disk;
+        try {
+            disk = this.runtimeOptions.slashCommands?.list(this.cwd);
+        }
+        catch {
+            disk = undefined;
+        }
+        return mergeAgentCommands(disk, this.capabilitiesRef.commands);
+    }
+    /**
+     * Resume this session in the agent's own interactive TUI (see the runtimeOptions
+     * hook). Resolves the same launch env a turn would — `prepare` (e.g. Codex
+     * mints CODEX_HOME + auth.json) then credentials — so the TUI opens with the
+     * identical auth as chat. Returns null when the runtime has no TUI hook or there
+     * is no session ref to resume yet (the daemon then surfaces "no TUI available").
+     */
+    async interactiveTuiCommand() {
+        const hook = this.runtimeOptions.interactiveTui;
+        if (!hook)
+            return null;
+        const credentialEnv = this.runtimeOptions.credentials
+            ? await buildAgentCredentialEnv(this.runtimeOptions.credentials, undefined, this.currentModelProvider).catch(() => ({}))
+            : {};
+        let prepareEnv = this.prepareEnv;
+        if (this.runtimeOptions.prepare) {
+            prepareEnv =
+                (await Promise.resolve(this.runtimeOptions.prepare({ ...process.env, ...this.runtimeOptions.env, ...credentialEnv })).catch(() => undefined)) ??
+                    prepareEnv;
+        }
+        const env = { ...this.runtimeOptions.env, ...credentialEnv, ...prepareEnv };
+        return hook({ sessionRef: this.runtimeSessionRef ?? this.resumeRef, cwd: this.cwd, env });
+    }
     getName() { return this.name; }
     setName(name) { this.name = name; }
     async suggestName(firstPrompt) {
@@ -373,6 +410,21 @@ class ProtocolSession {
                 this.runtimeSessionRef = msg.runtimeSessionRef;
             return;
         }
+        // Late-arriving model registry. A shim that knows its models up front puts them
+        // in `hello`; one whose list is only knowable per session — an ACP agent's
+        // models depend on which providers the user has authenticated, and arrive with
+        // session/new — publishes them here instead. Same contract as the hello path: a
+        // picker backed by a real `model.set` the shim answers, never a claimed one.
+        if (type === "runtime.models") {
+            const models = parseModels(msg.models);
+            if (models.length) {
+                this.models = models;
+                this.capabilitiesRef.modelSelection = true;
+                if (typeof msg.currentModel === "string")
+                    this.currentModelId = msg.currentModel;
+            }
+            return;
+        }
         if (type === "message.delta") {
             const text = String(msg.text ?? "");
             if (!this.assistantText)
@@ -556,6 +608,17 @@ class ProtocolSession {
         const images = (options?.images ?? []).map((img) => ({ type: "image", data: img.data, mimeType: img.mimeType }));
         if (!prompt && !images.length)
             return;
+        // A `/name args` line matching an on-disk custom prompt runs the command by
+        // sending its expanded body; the transcript still shows what the user typed.
+        // Non-command lines pass through untouched. Best-effort — a read failure sends
+        // the raw line.
+        let textToSend;
+        try {
+            textToSend = this.runtimeOptions.slashCommands?.expand(this.cwd, prompt) ?? prompt;
+        }
+        catch {
+            textToSend = prompt;
+        }
         this.messages.push({ role: "user", content: prompt, timestamp: Date.now() });
         this.streaming = true;
         this.assistantText = "";
@@ -566,7 +629,7 @@ class ProtocolSession {
         await this.command("chat.send", {
             sessionId: this.id,
             runtimeSessionRef: this.runtimeSessionRef,
-            text: prompt,
+            text: textToSend,
             // Optional multimodal + streaming hints. Present only when the caller
             // supplied them, so a text-only turn keeps the exact payload it always had.
             ...(images.length ? { images } : {}),