@bojackduy/opencode-loopd 1.10.4 → 1.11.2

package/dist/server.js

@@ -576,10 +576,16 @@ function tailLastBytes(text, maxBytes = MAX_AWAIT_TAIL_BYTES) {
     return text;
   return buf.subarray(buf.length - maxBytes).toString("utf8");
 }
+function safeCommandText(text) {
+  return text.replace(/\x1b\[[0-?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b[PX^_][\s\S]*?\x1b\\|\x1b[\x20-\x2f]*[\x30-\x7e]/g, "").replace(/\r\n?/g, `
+`).replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, "").replace(/\n{3,}/g, `
+
+`);
+}
 function formatAwaitEvidence(input) {
-  const short = input.commandID.slice(0, 8);
-  const header = `[command "${input.title}" (${input.argv.join(" ") || input.title}) ${input.status}` + ` ${short}... exitCode=${input.exitCode ?? "unknown"} signal=${input.signal ?? "none"}]`;
-  const tail = tailLastBytes(input.tail);
+  const short = safeCommandText(input.commandID.slice(0, 8));
+  const header = `[command "${safeCommandText(input.title)}" (${safeCommandText(input.argv.join(" ") || input.title)}) ${input.status}` + ` ${short}... exitCode=${input.exitCode ?? "unknown"} signal=${safeCommandText(input.signal ?? "none")}]`;
+  const tail = tailLastBytes(safeCommandText(input.tail));
   return tail ? `${header}
 ${tail}` : header;
 }
@@ -1020,13 +1026,13 @@ async function fireUntilAwaits(directory, commandID, lines) {
       continue;
     }
     const short = commandID.slice(0, 8);
-    const header = `[command "${cmd.title}" (${[cmd.command, ...cmd.args].join(" ") || cmd.title}) ${cmd.status}` + ` ${short}... watch-until "${pattern}" matched]`;
-    const matchedText = tailLastBytes(matched.slice(0, 20).join(`
-`), MAX_AWAIT_TAIL_BYTES);
+    const header = `[command "${safeCommandText(cmd.title)}" (${safeCommandText([cmd.command, ...cmd.args].join(" ") || cmd.title)}) ${cmd.status}` + ` ${short}... watch-until "${safeCommandText(pattern)}" matched]`;
+    const matchedText = tailLastBytes(safeCommandText(matched.slice(0, 20).join(`
+`)), MAX_AWAIT_TAIL_BYTES);
     const evidence = tail ? `${header}
 ${matchedText}
 --- tail ---
-${tail}` : `${header}
+${tailLastBytes(safeCommandText(tail))}` : `${header}
 ${matchedText}`;
     await appendGoalInbox(directory, a.goalID, "worker", evidence);
     await appendEvent(directory, ledgerEvent({
@@ -1539,6 +1545,64 @@ function createControlWorker(options) {
         };
         break;
       }
+      case "switch_goal_model": {
+        if (!request.goalID) {
+          response = { ...base, ok: false, message: "goalID is required", errorCode: "bad_request" };
+          break;
+        }
+        const args = request.args;
+        const model = args?.model;
+        if (typeof model !== "string" || model.trim().length === 0) {
+          response = { ...base, ok: false, message: "model (providerID/modelID) is required", errorCode: "bad_request" };
+          break;
+        }
+        const ownerForSwitch = (await readState(directory)).goals.find((g) => g.id === request.goalID)?.ownerSessionID ?? "";
+        const result = await goalSvc.switchModel(directory, request.goalID, ownerForSwitch, model.trim(), { resume: args?.resume === true });
+        const state = await readState(directory);
+        const outcomeMessage = {
+          applied: `Model switched to ${result.model} on the same worker/session.`,
+          deferred: `Worker busy \u2014 switch to ${result.model} queued; applies on the next turn.`,
+          unsupported: `Model switch unsupported on this host (see loopd_list_models). Goal/session retained.`
+        };
+        response = {
+          ...base,
+          ok: result.outcome !== "unsupported",
+          message: outcomeMessage[result.outcome] ?? `Model switch ${result.outcome}.`,
+          stateRevision: state.revision
+        };
+        break;
+      }
+      case "list_models": {
+        const catalog = await goalSvc.listModels();
+        const state = await readState(directory);
+        response = {
+          ...base,
+          ok: catalog.capability !== "unavailable",
+          message: `Models: ${catalog.models.length} across ${catalog.providers.length} provider(s) [${catalog.capability}/${catalog.switching}]. Quota: ${catalog.quota.status} \u2014 ${catalog.quota.limitation}`,
+          stateRevision: state.revision
+        };
+        break;
+      }
+      case "set_interactive": {
+        if (!request.goalID) {
+          response = { ...base, ok: false, message: "goalID is required", errorCode: "bad_request" };
+          break;
+        }
+        const interactive = request.args?.interactive;
+        if (typeof interactive !== "boolean") {
+          response = { ...base, ok: false, message: "interactive (boolean) is required", errorCode: "bad_request" };
+          break;
+        }
+        const result = await goalSvc.setInteractive(directory, request.goalID, interactive);
+        const state = await readState(directory);
+        response = {
+          ...base,
+          ok: result.ok,
+          message: result.message,
+          stateRevision: state.revision
+        };
+        break;
+      }
       case "send": {
         const args = request.args;
         const text = String(args.message || "").trim();
@@ -1687,6 +1751,8 @@ function createControlWorker(options) {
       case "cmd_write":
       case "cmd_interrupt":
       case "cmd_terminate":
+      case "cmd_kill":
+      case "cmd_restart":
       case "cmd_remove":
       case "cmd_resize":
       case "cmd_watch": {
@@ -1739,6 +1805,14 @@ function createControlWorker(options) {
               const r = await cmdSvc.terminate(directory, id, ownerSessionID);
               const state = await readState(directory);
               response = { ...base, ok: r.ok, message: r.message, stateRevision: state.revision };
+            } else if (request.command === "cmd_kill") {
+              const r = await cmdSvc.kill(directory, id, ownerSessionID);
+              const state = await readState(directory);
+              response = { ...base, ok: r.ok, message: r.message, stateRevision: state.revision };
+            } else if (request.command === "cmd_restart") {
+              const r = await cmdSvc.restart(directory, id, ownerSessionID);
+              const state = await readState(directory);
+              response = { ...base, ok: r.ok, message: r.message, stateRevision: state.revision };
             } else if (request.command === "cmd_remove") {
               const r = await cmdSvc.remove(directory, id, ownerSessionID);
               const state = await readState(directory);
@@ -1941,6 +2015,8 @@ function createLoopEngine(options) {
       knownWorkerSessions.add(goal.workerSessionID);
     if (goal.status !== "active")
       return false;
+    if (goal.interactive === true && type === "session.idle")
+      return false;
     switch (type) {
       case "session.idle":
         return await handleSessionIdle(state, goal);
@@ -2329,6 +2405,7 @@ function createLoopEngine(options) {
       revision: newState.revision
     });
     const updatedGoal = newState.goals.find((g) => g.id === goal.id);
+    await goalService.observeProviderError(directory, goal.id, error, "session-error", goal.config.model);
     if (updatedGoal?.status === "blocked") {
       await appendEvent(directory, {
         version: 1,
@@ -2437,7 +2514,7 @@ function createLoopEngine(options) {
       revision: state.revision
     });
     try {
-      await host.compactSession(goal.workerSessionID);
+      await goalService.compact(directory, goal.id);
     } catch {}
     await mutateState(directory, `compact.end:${goal.id}`, async (s) => {
       const rt = s.runtimes.find((r) => r.goalID === goal.id);
@@ -2552,7 +2629,8 @@ function createLoopEngine(options) {
         if (stopped)
           continue;
       }
-      if (runtime.phase === "waiting_retry" && runtime.retryAfter) {
+      const manual = goal.interactive === true;
+      if (!manual && runtime.phase === "waiting_retry" && runtime.retryAfter) {
         if (Date.now() >= Date.parse(runtime.retryAfter)) {
           await mutateState(directory, `retry-ready:${goal.id}`, async (s) => {
             const rt = s.runtimes.find((r) => r.goalID === goal.id);
@@ -2565,7 +2643,7 @@ function createLoopEngine(options) {
           goalService.continueTurn(directory, goal.id).catch(() => {});
         }
       }
-      if ((runtime.phase === "running" || runtime.phase === "idle") && goal.workerSessionID) {
+      if (!manual && (runtime.phase === "running" || runtime.phase === "idle") && goal.workerSessionID) {
         if (runtime.phase === "idle" && runtime.activeRunID) {
           await mutateState(directory, `maintenance.clear-stale-run:${goal.id}`, async (s) => {
             const rt = s.runtimes.find((r) => r.goalID === goal.id);
@@ -2870,6 +2948,92 @@ var nativeRpcDefinition = {
   }
 };
 
+// src/server/model-catalog.ts
+function emptyCatalog(source, switching, capability = "unsupported") {
+  const observedAt = new Date().toISOString();
+  return {
+    capability,
+    source,
+    observedAt,
+    switching,
+    providers: [],
+    models: [],
+    quota: {
+      status: "unknown",
+      capability: "unsupported",
+      source,
+      observedAt,
+      limitation: "Host catalog does not report remaining quota or reset time. Connected/enabled does not prove remaining balance; local rate-limit observations are not balance data."
+    }
+  };
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function model(raw, providerID, usable) {
+  const value = record(raw);
+  if (typeof value.id !== "string" || !value.id)
+    return;
+  const limit = record(value.limit);
+  return {
+    providerID,
+    modelID: value.id,
+    name: typeof value.name === "string" ? value.name : value.id,
+    usable,
+    ...typeof limit.context === "number" && Number.isFinite(limit.context) ? { contextLimit: limit.context } : {},
+    ...typeof limit.output === "number" && Number.isFinite(limit.output) ? { outputLimit: limit.output } : {}
+  };
+}
+function normalizeV1Catalog(raw) {
+  const result = emptyCatalog("v1 provider.list", "next-prompt", "unavailable");
+  const value = record(raw);
+  if (!Array.isArray(value.all) || !Array.isArray(value.connected))
+    return result;
+  result.capability = "supported";
+  const connected = new Set(value.connected.filter((id) => typeof id === "string"));
+  for (const rawProvider of value.all) {
+    const p = record(rawProvider);
+    if (typeof p.id !== "string")
+      continue;
+    const available = connected.has(p.id);
+    result.providers.push({ providerID: p.id, name: typeof p.name === "string" ? p.name : p.id, connected: available });
+    for (const rawModel of Object.values(record(p.models))) {
+      const m = model(rawModel, p.id, available);
+      if (m)
+        result.models.push(m);
+    }
+  }
+  return result;
+}
+function normalizeV2Catalog(rawProviders, rawModels) {
+  const result = emptyCatalog("v2 provider.list + model.list", "session", "unavailable");
+  const providers = record(rawProviders).data;
+  const models = record(rawModels).data;
+  if (!Array.isArray(providers) || !Array.isArray(models))
+    return result;
+  result.capability = "supported";
+  const disabled = new Set;
+  for (const rawProvider of providers) {
+    const p = record(rawProvider);
+    if (typeof p.id !== "string")
+      continue;
+    if (p.activation === "disabled")
+      disabled.add(p.id);
+    result.providers.push({ providerID: p.id, name: typeof p.name === "string" ? p.name : p.id, connected: "unknown" });
+  }
+  const knownProviders = new Set(result.providers.map((p) => p.providerID));
+  for (const rawModel of models) {
+    const value = record(rawModel);
+    if (typeof value.providerID !== "string" || !knownProviders.has(value.providerID))
+      continue;
+    const usable = disabled.has(value.providerID) || value.enabled === false ? false : value.enabled === true ? true : "unknown";
+    const m = model(value, value.providerID, usable);
+    if (m)
+      result.models.push(m);
+  }
+  return result;
+}
+
 // src/server/host-adapter.ts
 function parseModelRef(value) {
   if (value === undefined)
@@ -2901,7 +3065,6 @@ function shouldDedupParentNotify(ownerSessionID, message) {
   const last = recentParentNotifies.get(key);
   if (last !== undefined && now - last < 60000)
     return true;
-  recentParentNotifies.set(key, now);
   if (recentParentNotifies.size > 200) {
     for (const [k, t] of recentParentNotifies.entries())
       if (now - t > 60000)
@@ -2909,8 +3072,26 @@ function shouldDedupParentNotify(ownerSessionID, message) {
   }
   return false;
 }
+function markParentNotified2(ownerSessionID, message) {
+  recentParentNotifies.set(`${ownerSessionID}:${message.slice(0, 200)}`, Date.now());
+}
 function createRealHost(client, directory) {
   return {
+    async listModels() {
+      if (typeof client.provider?.list !== "function")
+        return emptyCatalog("v1 provider.list", "next-prompt");
+      try {
+        const result = await withTimeout(client.provider.list({ query: { directory } }), 1e4, "OpenCode provider.list");
+        if (result?.error)
+          return emptyCatalog("v1 provider.list", "next-prompt", "unavailable");
+        return normalizeV1Catalog(result?.data);
+      } catch {
+        return emptyCatalog("v1 provider.list", "next-prompt", "unavailable");
+      }
+    },
+    async switchSessionModel() {
+      return "next-prompt";
+    },
     async createWorker({ parentID, title, agent, model }) {
       try {
         const body = { parentID, title };
@@ -2953,7 +3134,7 @@ function createRealHost(client, directory) {
       if (result?.error) {
         const detail = describeError(result.error);
         await logServerEvent(directory, "worker.prompt.failed", { sessionID, detail });
-        throw new Error(`OpenCode session.promptAsync failed for worker "${sessionID}": ${detail}`);
+        throw new Error(`OpenCode session.promptAsync failed for worker "${sessionID}": ${detail}`, { cause: result.error });
       }
       await logServerEvent(directory, "worker.prompted", { sessionID });
       return { messageID: result?.data?.messageID };
@@ -3046,15 +3227,18 @@ function createRealHost(client, directory) {
         return [];
       }
     },
-    async compactSession(sessionID) {
+    async compactSession(sessionID, model) {
       try {
-        await client.session.compact({ sessionID });
+        const identity = model ?? (await this.readSession(sessionID))?.model;
+        if (!identity || typeof client.session.summarize !== "function")
+          return;
+        await client.session.summarize({ path: { id: sessionID }, body: identity });
       } catch {}
     },
     async notifyOwner(ownerSessionID, message, agent) {
       if (shouldDedupParentNotify(ownerSessionID, message)) {
         await logServerEvent(directory, "parent.notify.deduped", { ownerSessionID, preview: message.slice(0, 160) });
-        return;
+        return true;
       }
       let resolvedAgent = agent?.trim() || undefined;
       if (!resolvedAgent) {
@@ -3075,11 +3259,15 @@ function createRealHost(client, directory) {
         }), 1e4, "OpenCode parent notify");
         if (result?.error) {
           await logServerEvent(directory, "parent.notify.failed", { ownerSessionID, detail: describeError(result.error) });
+          return false;
         } else {
+          markParentNotified2(ownerSessionID, message);
           await logServerEvent(directory, "parent.notified", { ownerSessionID, preview: message.slice(0, 160) });
+          return true;
         }
       } catch (error) {
         await logServerEvent(directory, "parent.notify.failed", { ownerSessionID, detail: describeError(error) });
+        return false;
       }
     }
   };
@@ -3090,6 +3278,29 @@ function toWorkerCreation(result) {
 function createV2Host(context, statuses, options = {}) {
   const directory = context.location.directory;
   return {
+    async listModels() {
+      if (typeof context.provider?.list !== "function" || typeof context.model?.list !== "function") {
+        return emptyCatalog("v2 provider.list + model.list", typeof context.session.switchModel === "function" ? "session" : "unsupported");
+      }
+      try {
+        const [providers, models] = await Promise.all([
+          context.provider.list({ location: { directory } }),
+          context.model.list({ location: { directory } })
+        ]);
+        const catalog = normalizeV2Catalog(providers, models);
+        if (typeof context.session.switchModel !== "function")
+          catalog.switching = "unsupported";
+        return catalog;
+      } catch {
+        return emptyCatalog("v2 provider.list + model.list", typeof context.session.switchModel === "function" ? "session" : "unsupported", "unavailable");
+      }
+    },
+    async switchSessionModel(sessionID, model) {
+      if (typeof context.session.switchModel !== "function")
+        return "unsupported";
+      await context.session.switchModel({ sessionID, model: { id: model.modelID, providerID: model.providerID } });
+      return "applied";
+    },
     async createWorker({ parentID, title, agent, model, goalID }) {
       if (options.native) {
         let outcome;
@@ -3244,8 +3455,13 @@ function createV2Host(context, statuses, options = {}) {
         return [];
       }
     },
-    async compactSession(sessionID) {
+    async compactSession(sessionID, model) {
       try {
+        if (model) {
+          if (typeof context.session.switchModel !== "function")
+            return;
+          await context.session.switchModel({ sessionID, model: { id: model.modelID, providerID: model.providerID } });
+        }
         await context.session.command({ sessionID, name: "compact", text: "" });
       } catch {}
     },
@@ -3253,8 +3469,10 @@ function createV2Host(context, statuses, options = {}) {
       try {
         await context.session.prompt({ sessionID: ownerSessionID, text: message });
         await logServerEvent(directory, "parent.notified", { ownerSessionID, preview: message.slice(0, 160) });
+        return true;
       } catch (error) {
         await logServerEvent(directory, "parent.notify.failed", { ownerSessionID, detail: describeError(error) });
+        return false;
       }
     }
   };
@@ -3274,6 +3492,40 @@ async function withTimeout(promise, timeoutMs, operation) {
   }
 }
 
+// src/domain/provider-limit.ts
+function object(value) {
+  return value !== null && typeof value === "object" ? value : {};
+}
+function observeProviderLimit(error, source, model) {
+  const wrapper = object(error);
+  const root = wrapper.cause ? object(wrapper.cause) : wrapper;
+  const data = object(root.data);
+  const status = root.statusCode ?? root.status ?? data.statusCode ?? data.status;
+  const statusCode = typeof status === "number" ? status : undefined;
+  const code = root.code ?? data.code;
+  const message = [root.message, data.message, typeof error === "string" ? error : undefined].filter((s) => typeof s === "string").join(" ");
+  if (statusCode === 401 || statusCode === 403 || /context.{0,20}(length|window|overflow)|maximum context|invalid.{0,10}(key|token)|unauthori[sz]ed|authentication|network|ECONN|ENOTFOUND|max.?turn|cost.?budget|budget.?limit/i.test(message))
+    return;
+  const quota = code === "insufficient_quota" || code === "quota_exceeded" || /\b(insufficient quota|quota (exceeded|exhausted)|exceeded.{0,20}quota|usage limit reached|credit balance.{0,20}(low|exhausted|insufficient))\b/i.test(message);
+  const rate = statusCode === 429 || code === "rate_limit_exceeded" || /\b(rate[ -]limit(ed| exceeded| reached| hit)|too many requests)\b/i.test(message);
+  if (!quota && !rate)
+    return;
+  const observedAt = new Date().toISOString();
+  const headers = object(root.responseHeaders ?? data.responseHeaders);
+  const retryAfter = root.retryAfter ?? data.retryAfter ?? headers["retry-after"];
+  let retryAt;
+  if (typeof retryAfter === "number" && Number.isFinite(retryAfter) && retryAfter >= 0) {
+    retryAt = new Date(Date.now() + Math.min(retryAfter, 31536000) * 1000).toISOString();
+  } else if (typeof retryAfter === "string") {
+    if (/^\d+(\.\d+)?$/.test(retryAfter)) {
+      retryAt = new Date(Date.now() + Math.min(Number(retryAfter), 31536000) * 1000).toISOString();
+    } else if (Number.isFinite(Date.parse(retryAfter))) {
+      retryAt = new Date(retryAfter).toISOString();
+    }
+  }
+  return { kind: quota ? "quota" : "rate-limit", source, observedAt, ...model ? { model } : {}, ...statusCode !== undefined ? { statusCode } : {}, ...retryAt ? { retryAt } : {} };
+}
+
 // src/server/worker-session.ts
 function createWorkerManager(host) {
   return {
@@ -3457,6 +3709,217 @@ function createGoalService(host) {
       throw new Error(`Workspace-writing goal "${activeWriter.name}" (${activeWriter.id}) is already active` + (ownedElsewhere ? ` (owned by session ${activeWriter.ownerSessionID}, not this session)` : "") + ". Pause, block, complete, or clear it before activating another workspace-writing goal." + (ownedElsewhere ? " Note: list_background_goals shows only this session's goals; clear/pause it from its owning session." : ""));
     }
   }
+  async function listModels() {
+    return host.listModels ? host.listModels() : emptyCatalog("host catalog capability absent", "unsupported");
+  }
+  async function validateModel(value) {
+    const ref = parseModelRef(value);
+    if (!ref)
+      throw new Error("Model is required: providerID/modelID.");
+    const model = `${ref.providerID}/${ref.modelID}`;
+    const catalog = await listModels();
+    if (catalog.capability !== "supported" || catalog.switching === "unsupported" || !host.switchSessionModel) {
+      return { model, catalog };
+    }
+    if (!catalog.models.some((m) => m.providerID === ref.providerID && m.modelID === ref.modelID && m.usable === true)) {
+      throw new Error("Model is unavailable or not positively known usable. Discover models with loopd_list_models first.");
+    }
+    return { model, catalog };
+  }
+  async function applyModel(directory, goal, model, reason) {
+    if (!goal.workerSessionID || !host.switchSessionModel)
+      return "unsupported";
+    const previousModel = parseModelRef(goal.config.model) ?? (await host.readSession(goal.workerSessionID))?.model;
+    const outcome = await host.switchSessionModel(goal.workerSessionID, parseModelRef(model));
+    if (outcome === "unsupported")
+      return outcome;
+    try {
+      await mutateState(directory, `goal.model-switch:${goal.id}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goal.id);
+        if (!current)
+          throw new Error("Goal removed during model switch.");
+        current.config.model = model;
+        current.modelSwitch = {
+          ...current.modelSwitch,
+          pending: undefined,
+          lastFailure: undefined,
+          last: { from: goal.config.model, to: model, at: new Date().toISOString(), outcome, reason }
+        };
+        current.updatedAt = new Date().toISOString();
+        return s;
+      });
+    } catch (error) {
+      if (outcome === "applied") {
+        if (!previousModel)
+          throw new Error("Host accepted model switch but persistence failed; previous host model unknown, rollback unavailable.");
+        await host.switchSessionModel(goal.workerSessionID, previousModel);
+      }
+      throw error;
+    }
+    await logServerEvent(directory, "goal.model-switched", { goalID: goal.id, workerSessionID: goal.workerSessionID, from: goal.config.model, to: model, reason, outcome });
+    return outcome;
+  }
+  function switchModel(directory, goalID, ownerSessionID, value, opts) {
+    return withGoalOperation(goalID, async () => {
+      const state = await readState(directory);
+      const goal = state.goals.find((g) => g.id === goalID);
+      if (!goal || !ownerSessionID || goal.ownerSessionID !== ownerSessionID)
+        throw new Error("Goal not found or not owned by this session.");
+      if (goal.status === "complete")
+        throw new Error("Cannot switch a completed goal.");
+      if (opts?.resume && (goal.status !== "blocked" || goal.blocker?.kind !== "provider-limit")) {
+        throw new Error("resume is only valid for a provider-limit-blocked goal.");
+      }
+      if (opts?.resume)
+        assertWorkspaceWriteAvailable(state, goal, ownerSessionID);
+      const { model, catalog } = await validateModel(value);
+      if (catalog.capability !== "supported" || catalog.switching === "unsupported" || !host.switchSessionModel || !goal.workerSessionID) {
+        return { outcome: "unsupported", model };
+      }
+      const runtime = state.runtimes.find((r) => r.goalID === goalID);
+      const status = await host.sessionStatus(goal.workerSessionID);
+      if (status !== "idle" || runtime?.phase === "running" && leaseIsValid(runtime)) {
+        await mutateState(directory, `goal.model-deferred:${goalID}`, async (s) => {
+          const current = s.goals.find((g) => g.id === goalID);
+          if (current) {
+            current.modelSwitch = { ...current.modelSwitch, pending: { model, requestedAt: new Date().toISOString(), reason: "owner" } };
+            current.updatedAt = new Date().toISOString();
+          }
+          return s;
+        });
+        return { outcome: "deferred", model };
+      }
+      const applied = await applyModel(directory, goal, model, "owner");
+      if (opts?.resume && applied !== "unsupported") {
+        await mutateState(directory, `goal.model-resume:${goalID}`, async (s) => {
+          const g = s.goals.find((g) => g.id === goalID);
+          if (g?.status === "blocked" && g.blocker?.kind === "provider-limit") {
+            assertWorkspaceWriteAvailable(s, g, ownerSessionID);
+            g.status = "active";
+            g.blocker = undefined;
+            g.updatedAt = new Date().toISOString();
+          }
+          return s;
+        });
+        await continueTurnUnlocked(directory, goalID);
+      }
+      return { outcome: applied === "next-prompt" ? "deferred" : applied, model, ...opts?.resume && applied !== "unsupported" ? { resumed: true } : {} };
+    });
+  }
+  async function applyPendingModel(directory, goal) {
+    const pending = goal.modelSwitch?.pending;
+    if (!pending)
+      return;
+    let reason = "catalog-unavailable";
+    try {
+      const { catalog } = await validateModel(pending.model);
+      if (catalog.capability !== "supported" || catalog.switching === "unsupported")
+        throw new Error("Pending model switch catalog unavailable.");
+      reason = "host-rejected";
+      const result = await applyModel(directory, goal, pending.model, pending.reason);
+      if (result === "unsupported")
+        throw new Error("Pending model switching unsupported by host.");
+    } catch {
+      await mutateState(directory, `goal.model-switch-failed:${goal.id}`, async (s) => {
+        const g = s.goals.find((g) => g.id === goal.id);
+        const rt = s.runtimes.find((r) => r.goalID === goal.id);
+        if (g) {
+          g.modelSwitch = { ...g.modelSwitch, pending: undefined, lastFailure: { at: new Date().toISOString(), reason } };
+          if (g.status === "active") {
+            g.status = "blocked";
+            g.blocker = { reason: "Pending model switch was not accepted.", needed: "Discover available models, switch the same goal explicitly, then retry when safe.", at: new Date().toISOString() };
+          }
+          g.updatedAt = new Date().toISOString();
+        }
+        if (rt) {
+          Object.assign(rt, releaseLease(rt));
+          rt.retryAfter = undefined;
+        }
+        return s;
+      });
+      throw new Error("Pending model switch was not accepted; goal blocked without replacing its worker.");
+    }
+  }
+  async function observeProviderErrorUnlocked(directory, goalID, error, source, expectedModel) {
+    const state = await readState(directory);
+    const goal = state.goals.find((g) => g.id === goalID);
+    if (!goal)
+      return;
+    const observation = observeProviderLimit(error, source, expectedModel ?? goal.config.model);
+    if (!observation)
+      return;
+    const fallbackModels = goal.config.fallbackModels ?? [];
+    const attempted = new Set(goal.modelFallback?.attempted ?? []);
+    if (goal.config.model)
+      attempted.add(goal.config.model);
+    let pending;
+    let status = "disabled";
+    const runtime = state.runtimes.find((r) => r.goalID === goalID);
+    const quotaBlocked = goal.status === "blocked" && runtime?.lastError === describeError(error);
+    const sameModel = expectedModel === undefined || expectedModel === goal.config.model;
+    const eligible = sameModel && (goal.status === "active" || quotaBlocked) && (!goal.modelSwitch?.pending || goal.modelSwitch.pending.reason === "quota");
+    if (eligible && goal.modelSwitch?.pending?.reason === "quota") {
+      pending = { ...goal.modelSwitch.pending, reason: "quota" };
+      status = "prepared";
+    } else if (eligible && fallbackModels.length) {
+      const catalog = await listModels();
+      if (catalog.capability === "unsupported" || catalog.switching === "unsupported" || !host.switchSessionModel)
+        status = "unsupported";
+      else if (catalog.capability !== "supported")
+        status = "unavailable";
+      else {
+        status = "exhausted";
+        for (const value of fallbackModels) {
+          if (attempted.has(value))
+            continue;
+          attempted.add(value);
+          const ref = parseModelRef(value);
+          if (ref && catalog.models.some((m) => m.providerID === ref.providerID && m.modelID === ref.modelID && m.usable === true)) {
+            pending = { model: value, requestedAt: new Date().toISOString(), reason: "quota" };
+            status = "prepared";
+            break;
+          }
+        }
+      }
+    }
+    await mutateState(directory, `goal.provider-limit:${goalID}`, async (s) => {
+      const g = s.goals.find((g) => g.id === goalID);
+      const rt = s.runtimes.find((r) => r.goalID === goalID);
+      if (!g)
+        return s;
+      g.lastProviderLimit = observation;
+      if (sameModel && g.status === "blocked" && g.blocker && rt?.lastError === describeError(error))
+        g.blocker.kind = "provider-limit";
+      if (eligible) {
+        g.modelFallback = { attempted: [...attempted], status };
+        if (pending && (!g.modelSwitch?.pending || g.modelSwitch.pending.reason === "quota")) {
+          g.modelSwitch = { ...g.modelSwitch, pending };
+        }
+      }
+      if (rt?.phase === "waiting_retry" && observation.retryAt && Date.parse(observation.retryAt) > Date.parse(rt.retryAfter ?? ""))
+        rt.retryAfter = observation.retryAt;
+      g.updatedAt = new Date().toISOString();
+      return s;
+    });
+    await logServerEvent(directory, "goal.provider-limit", { goalID, model: goal.config.model, kind: observation.kind, source, fallbackStatus: status, to: pending?.model });
+  }
+  function observeProviderError(directory, goalID, error, source, expectedModel) {
+    return withGoalOperation(goalID, () => observeProviderErrorUnlocked(directory, goalID, error, source, expectedModel));
+  }
+  function compact(directory, goalID) {
+    return withGoalOperation(goalID, async () => {
+      const state = await readState(directory);
+      const goal = state.goals.find((g) => g.id === goalID);
+      if (!goal?.workerSessionID || goal.status !== "active")
+        return;
+      if (await host.sessionStatus(goal.workerSessionID) !== "idle")
+        return;
+      await applyPendingModel(directory, goal);
+      const fresh = (await readState(directory)).goals.find((g) => g.id === goalID);
+      if (fresh?.workerSessionID)
+        await host.compactSession(fresh.workerSessionID, parseModelRef(fresh.config.model));
+    });
+  }
   async function recordPromptFailure(directory, goalID, error, blockImmediately = false) {
     const detail = describeError(error);
     let runID = "unknown";
@@ -3515,6 +3978,7 @@ function createGoalService(host) {
         revision: state.revision
       });
     }
+    await observeProviderErrorUnlocked(directory, goalID, error, "prompt-delivery");
   }
   async function ensureWorkerSession(directory, goal) {
     let session = sessions.get(goal.id);
@@ -3549,6 +4013,20 @@ function createGoalService(host) {
     return withGoalOperation(id, () => startUnlocked(directory, input, id));
   }
   async function startUnlocked(directory, input, id) {
+    if (input.config?.fallbackModels?.length) {
+      if (input.config.fallbackModels.length > 16)
+        throw new Error("At most 16 ordered fallback models are allowed.");
+      const catalog = await listModels();
+      for (const value of input.config.fallbackModels) {
+        const ref = parseModelRef(value);
+        if (!ref)
+          throw new Error("Fallback model must be providerID/modelID.");
+        if (catalog.capability === "supported" && !catalog.models.some((m) => m.providerID === ref.providerID && m.modelID === ref.modelID && m.usable === true)) {
+          throw new Error("Fallback model is unavailable or not positively known usable.");
+        }
+      }
+      input.config.fallbackModels = [...new Set(input.config.fallbackModels.map((m) => m.trim()))];
+    }
     let parentAgent = input.parentAgent;
     let parentModel = input.parentModel;
     if ((!parentAgent || !parentModel) && host.readSession) {
@@ -3574,6 +4052,8 @@ function createGoalService(host) {
     });
     if (typeof input.costBudget === "number")
       goal.costBudget = input.costBudget;
+    if (input.interactive === true)
+      goal.interactive = true;
     if (parentAgent)
       goal.parentAgent = parentAgent;
     if (parentModel)
@@ -3776,6 +4256,11 @@ function createGoalService(host) {
       return;
     if (!opts?.force && !await workers.isIdle(session.workerSessionID))
       return;
+    if (goal.modelSwitch?.pending) {
+      if (await host.sessionStatus(session.workerSessionID) !== "idle")
+        return;
+      await applyPendingModel(directory, goal);
+    }
     let acquired = false;
     const state = await mutateState(directory, `turn.acquire:${goalID}`, async (s) => {
       const g = s.goals.find((item) => item.id === goalID);
@@ -3878,6 +4363,38 @@ function createGoalService(host) {
       throw error;
     }
   }
+  async function setInteractiveUnlocked(directory, goalID, interactive) {
+    const state = await mutateState(directory, `goal.interactive:${goalID}`, async (s) => {
+      const g = s.goals.find((item) => item.id === goalID);
+      if (!g)
+        return s;
+      if (interactive)
+        g.interactive = true;
+      else
+        delete g.interactive;
+      g.updatedAt = new Date().toISOString();
+      return s;
+    });
+    const goal = state.goals.find((g) => g.id === goalID);
+    if (!goal)
+      return { ok: false, message: "Goal not found." };
+    await appendEvent(directory, {
+      version: 1,
+      eventID: randomUUID5(),
+      goalID,
+      type: "goal.interactive_changed",
+      interactive,
+      timestamp: new Date().toISOString(),
+      revision: state.revision
+    }).catch(() => {});
+    return {
+      ok: true,
+      message: interactive ? `Goal "${goal.name}" is now manual: the engine will not start turns \u2014 steer it with :send/nudge.` : `Goal "${goal.name}" is back on auto: the engine resumes idle recovery and retries.`
+    };
+  }
+  function setInteractive(directory, goalID, interactive) {
+    return withGoalOperation(goalID, () => setInteractiveUnlocked(directory, goalID, interactive));
+  }
   async function pauseUnlocked(directory, goalID) {
     const preState = await readState(directory);
     const goal = preState.goals.find((g) => g.id === goalID);
@@ -4240,7 +4757,7 @@ function createGoalService(host) {
   function accountUsage(directory, goalID) {
     return withGoalOperation(goalID, () => accountUsageUnlocked(directory, goalID));
   }
-  return { start, continueTurn, nudge, pause, resume, retry, clear, getWorker, getActiveWorkers, reconcile, accountUsage, abortWorker, sendUserMessage };
+  return { start, continueTurn, nudge, pause, resume, retry, clear, getWorker, getActiveWorkers, reconcile, accountUsage, abortWorker, sendUserMessage, setInteractive, listModels, switchModel, observeProviderError, compact };
 }
 
 // src/application/schedule-worker.ts
@@ -4808,6 +5325,7 @@ function createCommandSession(input) {
     ownerSessionID: input.ownerSessionID,
     goalID: input.goalID,
     notifyOnExit: input.notifyOnExit,
+    notifySuccessfulExit: input.notifySuccessfulExit,
     status: "running",
     pid: input.pid,
     cols: input.cols,
@@ -4839,6 +5357,8 @@ function shouldNotifyOwnerOnExit(session) {
     return false;
   if (session.exitCode !== undefined && session.exitCode !== 0)
     return true;
+  if (session.notifySuccessfulExit === true)
+    return true;
   const started = Date.parse(session.createdAt);
   const ended = session.endedAt ? Date.parse(session.endedAt) : Date.now();
   if (!Number.isFinite(started) || !Number.isFinite(ended))
@@ -5066,6 +5586,28 @@ function createCommandService(host, opts) {
   const commandDirs = new Map;
   const timeouts = new Map;
   const timeoutOwners = new Map;
+  const notifyInFlight = new Set;
+  const notifyRetries = new Map;
+  const notifyAttempts = new Map;
+  function clearNotifyRetry(id) {
+    const timer = notifyRetries.get(id);
+    if (timer)
+      clearTimeout(timer);
+    notifyRetries.delete(id);
+    notifyAttempts.delete(id);
+  }
+  function retryOwnerNotification(directory, id) {
+    const attempt = (notifyAttempts.get(id) ?? 0) + 1;
+    notifyAttempts.set(id, attempt);
+    if (attempt > 3 || notifyRetries.has(id))
+      return;
+    const timer = setTimeout(() => {
+      notifyRetries.delete(id);
+      notifyOwnerIfNeeded(directory, id);
+    }, 1000 * 2 ** (attempt - 1));
+    timer.unref?.();
+    notifyRetries.set(id, timer);
+  }
   const watchers = new Map;
   const watchTimers = new Map;
   const awaitAsm = new Map;
@@ -5214,23 +5756,12 @@ function createCommandService(host, opts) {
     } catch {}
   }
   async function notifyOwnerIfNeeded(directory, id) {
+    if (!opts?.onOwnerNotify || notifyInFlight.has(id))
+      return;
+    notifyInFlight.add(id);
     try {
-      let target;
-      await mutateState(directory, `cmd.notify-claim:${id}`, async (s) => {
-        const c = (s.commands ?? []).find((x) => x.id === id);
-        if (!c)
-          return s;
-        if (c.ownerNotifiedAt)
-          return s;
-        if (!isTerminalCommandStatus(c.status))
-          return s;
-        if (!shouldNotifyOwnerOnExit(c))
-          return s;
-        c.ownerNotifiedAt = new Date().toISOString();
-        target = { ...c };
-        return s;
-      });
-      if (!target)
+      const target = (await readState(directory)).commands?.find((c) => c.id === id);
+      if (!target || target.ownerNotifiedAt || !isTerminalCommandStatus(target.status) || !shouldNotifyOwnerOnExit(target))
         return;
       const tail = await readBoundedTail(directory, id);
       const message = formatAwaitEvidence({
@@ -5242,8 +5773,25 @@ function createCommandService(host, opts) {
         signal: target.signal,
         tail
       });
-      await opts?.onOwnerNotify?.(directory, target.ownerSessionID, message);
-    } catch {}
+      const accepted = await opts.onOwnerNotify(directory, target.ownerSessionID, message);
+      if (accepted === false)
+        throw new Error("host did not accept owner prompt");
+      await mutateState(directory, `cmd.notify-delivered:${id}`, async (s) => {
+        const c = (s.commands ?? []).find((x) => x.id === id);
+        if (c && !c.ownerNotifiedAt)
+          c.ownerNotifiedAt = new Date().toISOString();
+        return s;
+      });
+      clearNotifyRetry(id);
+    } catch (error) {
+      await logServerEvent(directory, "command.owner-notify-failed", {
+        commandID: id,
+        detail: error instanceof Error ? error.message : String(error)
+      }).catch(() => {});
+      retryOwnerNotification(directory, id);
+    } finally {
+      notifyInFlight.delete(id);
+    }
   }
   async function flushWatch(directory, id) {
     const watcher = watchers.get(id);
@@ -5650,6 +6198,7 @@ function createCommandService(host, opts) {
         ownerSessionID: input.ownerSessionID,
         goalID: input.goalID,
         notifyOnExit: input.notifyOnExit,
+        notifySuccessfulExit: true,
         pid: handle.pid,
         cols: input.cols,
         rows: input.rows,
@@ -5931,6 +6480,104 @@ function createCommandService(host, opts) {
       }
       return { ok: true, message: `Command "${session.title}" ${status}.` };
     },
+    async kill(directory, id, ownerSessionID) {
+      rememberDir(id, directory);
+      const session = await service.get(directory, id, ownerSessionID);
+      if (!session)
+        return { ok: false, message: "Command not found." };
+      if (session.status !== "running") {
+        return { ok: false, message: `Command is ${session.status}; nothing to kill.` };
+      }
+      await mutateState(directory, `cmd.kill-claim:${id}`, async (s) => {
+        const c = (s.commands ?? []).find((x) => x.id === id);
+        if (c && c.ownerSessionID === ownerSessionID && c.status === "running") {
+          c.signal = "SIGKILL";
+          c.updatedAt = new Date().toISOString();
+        }
+        return s;
+      }).catch(() => {});
+      try {
+        const claimed = await readState(directory).then((st) => (st.commands ?? []).find((x) => x.id === id));
+        if (claimed)
+          emitBroker(id, { type: "status", command: claimed });
+      } catch {}
+      const entry = live.get(id);
+      if (entry) {
+        if (entry.handle.isAlive())
+          entry.handle.kill();
+        try {
+          await entry.handle.exited();
+        } catch {}
+        live.delete(id);
+      }
+      clearCommandTimeout(id);
+      clearWatchTimer(id);
+      await mutateState(directory, `cmd.kill:${id}`, async (s) => {
+        const c = (s.commands ?? []).find((x) => x.id === id);
+        if (!c || c.ownerSessionID !== ownerSessionID)
+          return s;
+        if (c.status === "running") {
+          c.status = "terminated";
+          if (c.endReason !== "timeout")
+            c.endReason = "terminate";
+          c.exitCode = c.exitCode ?? 137;
+          c.signal = c.signal ?? "SIGKILL";
+          c.endedAt = new Date().toISOString();
+          c.updatedAt = c.endedAt;
+        } else if (c.status === "terminated" && !c.endedAt) {
+          if (c.endReason !== "timeout" && !c.endReason)
+            c.endReason = "terminate";
+          c.exitCode = c.exitCode ?? 137;
+          c.endedAt = new Date().toISOString();
+          c.updatedAt = c.endedAt;
+        }
+        return s;
+      });
+      try {
+        const fresh = await readState(directory).then((st) => (st.commands ?? []).find((x) => x.id === id));
+        if (fresh)
+          emitBroker(id, { type: "status", command: fresh });
+      } catch {}
+      await fireAwaits(directory, id);
+      await notifyOwnerIfNeeded(directory, id);
+      return { ok: true, message: `Command "${session.title}" killed (SIGKILL).` };
+    },
+    async restart(directory, id, ownerSessionID) {
+      rememberDir(id, directory);
+      const session = await service.get(directory, id, ownerSessionID);
+      if (!session)
+        return { ok: false, message: "Command not found." };
+      const spec = {
+        title: session.title,
+        command: session.command,
+        args: [...session.args],
+        cwd: session.cwd,
+        ownerSessionID,
+        ...session.goalID !== undefined ? { goalID: session.goalID } : {},
+        ...session.notifyOnExit !== undefined ? { notifyOnExit: session.notifyOnExit } : {},
+        ...session.cols !== undefined ? { cols: session.cols } : {},
+        ...session.rows !== undefined ? { rows: session.rows } : {},
+        ...session.shell !== undefined ? { shell: session.shell } : {},
+        ...session.timeoutSeconds !== undefined ? { timeoutSeconds: session.timeoutSeconds } : {},
+        ...session.watchFilter !== undefined ? { watchFilter: session.watchFilter } : {},
+        ...session.watchUntil !== undefined ? { watchUntil: session.watchUntil } : {},
+        ...session.watchIgnoreCase !== undefined ? { watchIgnoreCase: session.watchIgnoreCase } : {},
+        ...session.watchUntilAction !== undefined ? { watchUntilAction: session.watchUntilAction } : {}
+      };
+      if (session.status === "running") {
+        const stopped = await service.terminate(directory, id, ownerSessionID);
+        if (!stopped.ok) {
+          return { ok: false, message: `Restart aborted: could not stop "${session.title}": ${stopped.message}` };
+        }
+      }
+      const next = await service.start(directory, spec);
+      const envNote = (session.envKeys?.length ?? 0) > 0 ? ` (env ${session.envKeys.join(",")} NOT restored \u2014 values are never persisted)` : "";
+      return {
+        ok: true,
+        message: `Command "${session.title}" restarted as ${next.id.slice(0, 8)}...${envNote}`,
+        command: next
+      };
+    },
     async remove(directory, id, ownerSessionID) {
       rememberDir(id, directory);
       const session = await service.get(directory, id, ownerSessionID);
@@ -5939,6 +6586,7 @@ function createCommandService(host, opts) {
       if (session.status === "running") {
         return { ok: false, message: `Command "${session.title}" is still running \u2014 terminate it first (terminate \u2260 remove).` };
       }
+      clearNotifyRetry(id);
       deleteWatch(id);
       const lastKnown = { ...session };
       await mutateState(directory, `cmd.remove:${id}`, async (s) => {
@@ -6037,8 +6685,11 @@ function createCommandService(host, opts) {
         rememberDir(c.id, directory);
       let markedMissing = 0;
       for (const c of cmds) {
-        if (c.status !== "running")
+        if (c.status !== "running") {
+          if ((c.notifySuccessfulExit === true || c.notifyOnExit === true) && !c.ownerNotifiedAt)
+            await notifyOwnerIfNeeded(directory, c.id);
           continue;
+        }
         const entry = live.get(c.id);
         if (entry) {
           if (!entry.handle.isAlive()) {
@@ -6091,6 +6742,8 @@ function createCommandService(host, opts) {
       return { markedMissing };
     },
     async dispose(directory) {
+      for (const id of [...notifyRetries.keys()])
+        clearNotifyRetry(id);
       for (const id of [...watchTimers.keys()])
         clearWatchTimer(id);
       watchers.clear();
@@ -6114,6 +6767,8 @@ function createCommandService(host, opts) {
       }));
       for (const id of [...timeouts.keys()])
         clearCommandTimeout(id);
+      for (const id of [...notifyRetries.keys()])
+        clearNotifyRetry(id);
     }
   };
   return service;
@@ -6625,12 +7280,13 @@ var execAsync = promisify(execChild);
 function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
   return {
     loopd_create_goal: tool({
-      description: "Create a new background loop GOAL: an autonomous AI worker that loops turn-by-turn on a multi-step objective until deterministic checks pass or it needs you (contract: objective + checks + agent/model + workspaceWrite). " + "The engine spawns a dedicated worker session that does the work autonomously \u2014 it never runs in this chat. " + "Use this for AI reasoning work spanning multiple turns (implement a feature, fix a failing suite, research and write a report) \u2014 NOT for running a single process you just want to start, watch, and type into. " + "For that (dev servers, `npm test --watch`, REPLs, log tails, one-off scripts, interactive shells with a fullscreen terminal UI), use loopd_command_start instead: it is lighter-weight, has no agent/checks/turn loop, and is a raw OS process, not an AI worker. " + "Call this after clarifying the contract with the user. " + "Worker identity is free-form: agent is any OpenCode agent name (built-in, ~/.config/opencode/agents/*.md, or opencode.jsonc agent.* \u2014 discover with `opencode agent list`), " + 'model is any "providerID/modelID" (discover with `opencode models [provider]`). When omitted, both inherit the CALLING session\'s live agent/model (read at creation), then plugin defaultAgent/defaultModel. ' + "Host is the acceptance authority: checks must pass for complete_goal (free retry if rejected <3, blocked after 3). " + "Workspace-writing goals are serialized (only one active writer) and require checks. " + "Monitor with the /loop dashboard's Goals tab (Tab/h to switch there if Commands is focused).",
+      description: "Create a new background loop GOAL: an autonomous AI worker that loops turn-by-turn on a multi-step objective until deterministic checks pass or it needs you (contract: objective + checks + agent/model + workspaceWrite). " + "The engine spawns a dedicated worker session that does the work autonomously \u2014 it never runs in this chat. " + "Use this for AI reasoning work spanning multiple turns (implement a feature, fix a failing suite, research and write a report) \u2014 NOT for running a single process you just want to start, watch, and type into. " + "For that (dev servers, `npm test --watch`, REPLs, log tails, one-off scripts, interactive shells with a fullscreen terminal UI), use loopd_command_start instead: it is lighter-weight, has no agent/checks/turn loop, and is a raw OS process, not an AI worker. " + "Call this after clarifying the contract with the user. " + "Worker identity is free-form: agent is any OpenCode agent name (built-in, ~/.config/opencode/agents/*.md, or opencode.jsonc agent.* \u2014 discover with `opencode agent list`), " + 'model is any "providerID/modelID" (discover with `opencode models [provider]`). Omit both by default \u2014 when omitted, both inherit the CALLING session\'s live agent/model (read at creation), then plugin defaultAgent/defaultModel. ' + "Only pass agent/model when the caller explicitly requests a different identity or the task needs it; explicit values freeze identity and break session upgrades. " + "Host is the acceptance authority: checks must pass for complete_goal (free retry if rejected <3, blocked after 3). " + "Workspace-writing goals are serialized (only one active writer) and require checks. " + "Monitor with the /loop dashboard's Goals tab (Tab/h to switch there if Commands is focused).",
       args: {
         name: tool.schema.string().describe("Short goal name (used in the dashboard)."),
         objective: tool.schema.string().describe("What the goal should accomplish, in detail."),
-        agent: tool.schema.string().optional().describe(`Agent to run the worker as (e.g. "researcher", "smart-agent"). Optional \u2014 inherits the calling session's agent if omitted, else plugin defaultAgent.`),
-        model: tool.schema.string().optional().describe(`Model to run the worker as, as "providerID/modelID" (e.g. "openai/gpt-5.6-sol", "ollama/qwen3.8:27b"). Optional \u2014 inherits the calling session's live model if omitted, else plugin defaultModel.`),
+        agent: tool.schema.string().optional().describe(`Agent to run the worker as (e.g. "researcher", "smart-agent"). Prefer omit \u2014 inherits the calling session's agent if omitted, else plugin defaultAgent. Only pass when explicitly requested.`),
+        model: tool.schema.string().optional().describe(`Model to run the worker as, as "providerID/modelID" (e.g. "openai/gpt-5.6-sol", "ollama/qwen3.8:27b"). Prefer omit \u2014 inherits the calling session's live model if omitted, else plugin defaultModel. Only pass when explicitly requested.`),
+        fallbackModels: tool.schema.array(tool.schema.string()).optional().describe("Explicit ordered providerID/modelID alternatives for provider quota/rate-limit failures only. Default empty: no automatic paid/provider switch. Discover with loopd_list_models; same worker/session retained. Interactive goals never auto-wake."),
         costBudget: tool.schema.number().optional().describe("Max provider cost in dollars before the engine stops the goal as budget_limited (e.g. 0.5). Optional \u2014 unlimited if omitted."),
         checks: tool.schema.array(tool.schema.string()).optional().describe('Shell commands that must pass for completion to be accepted. E.g. ["npm test"].'),
         checkCwd: tool.schema.string().optional().describe("Directory where completion checks run. Workspace-writing goals default to the project root."),
@@ -6642,7 +7298,8 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
         compactEvery: tool.schema.number().optional().describe("Compact the worker session every N turns."),
         timeoutMs: tool.schema.number().optional().describe("Per-turn timeout in ms."),
         scheduleEveryMs: tool.schema.number().optional().describe("Interval in ms to auto-requeue the same goal after each completion. Minimum 1000. Enables repetitive dialogue reduction."),
-        scheduleMaxRuns: tool.schema.number().optional().describe("Maximum total runs including the initial run. Undefined = unlimited. Requires scheduleEveryMs.")
+        scheduleMaxRuns: tool.schema.number().optional().describe("Maximum total runs including the initial run. Undefined = unlimited. Requires scheduleEveryMs."),
+        interactive: tool.schema.boolean().optional().describe("Manual mode: the engine never starts turns on its own (no idle recovery, no retries). Every turn comes from explicit steering (:send, nudge, resume, retry). Use for interactive tasks where the worker stops and waits for the next input \u2014 the tick forcing a turn there wastes tokens and breaks the wait. Toggleable later via the dashboard :interactive command.")
       },
       execute: async (args, context) => {
         const sessionID = context?.sessionID || hostSessionID;
@@ -6662,6 +7319,8 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
           config.agent = args.agent;
         if (args.model)
           config.model = args.model;
+        if (args.fallbackModels)
+          config.fallbackModels = args.fallbackModels;
         if (args.checks)
           config.checks = args.checks;
         if (args.checkCwd)
@@ -6737,7 +7396,8 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
             config: resolution.config,
             costBudget,
             parentAgent: parentDefaults.parentAgent,
-            parentModel: parentDefaults.parentModel
+            parentModel: parentDefaults.parentModel,
+            ...args.interactive === true ? { interactive: true } : {}
           });
           return {
             title: "Goal created",
@@ -6751,6 +7411,7 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
               agent: resolution.config.agent,
               model: resolution.config.model,
               costBudget: goal.costBudget,
+              interactive: goal.interactive === true,
               checks: resolution.config.checks || [],
               workspaceWrite: resolution.config.workspaceWrite,
               defaultsApplied: resolution.defaultsApplied,
@@ -7295,6 +7956,53 @@ function withTimeout2(promise, ms) {
 function ownerTools(options) {
   const { directory, host, goalService } = options;
   return {
+    loopd_list_models: tool2({
+      description: "Discover host providers/models usable by this agent and inspect quota limitations plus assigned identities of this session's existing goals. " + "Remaining quota is unknown unless a supported integration reports it; connected/enabled is not remaining balance. " + "Workflow: discover -> inspect_background_goal for last local quota error -> switch_goal_model on the SAME goal, never create a duplicate to change provider. No secrets/auth data are returned.",
+      args: {},
+      execute: async (_args, context) => {
+        if (!context?.sessionID)
+          return { title: "No session", output: JSON.stringify({ ok: false, message: "No session context available." }) };
+        const [catalog, state] = await Promise.all([goalService.listModels(), readState(directory)]);
+        return {
+          title: "Provider/model capabilities",
+          output: JSON.stringify({
+            ok: true,
+            ...catalog,
+            assignedGoals: state.goals.filter((g) => g.ownerSessionID === context.sessionID).map((g) => ({
+              id: g.id,
+              model: g.config.model,
+              workerSessionID: g.workerSessionID,
+              modelSwitch: g.modelSwitch,
+              modelFallback: g.modelFallback,
+              fallbackModels: g.config.fallbackModels ?? [],
+              lastProviderLimit: g.lastProviderLimit
+            }))
+          }, null, 2)
+        };
+      }
+    }),
+    switch_goal_model: tool2({
+      description: "Switch provider/model for an EXISTING goal owned by this session, preserving goal ID, worker session, transcript, checks and budgets. " + "First discover usable models with loopd_list_models, then inspect_background_goal for quota/error information. " + "Busy workers defer to the next safe turn; v1 changes apply on the next prompt. No abort, duplicate worker, budget reset, unpause or interactive wake. " + "Returns applied/deferred/unsupported honestly; an unsupported catalog cannot validate a switch. resume=true explicitly resumes ONLY a provider-limit-blocked goal and requests its next turn (including interactive); never resets budgets.",
+      args: {
+        goal_id: tool2.schema.string().describe("Existing owned goal ID; never create a replacement goal to switch models."),
+        model: tool2.schema.string().describe("Available providerID/modelID from loopd_list_models."),
+        resume: tool2.schema.boolean().optional().describe("Explicitly resume only a quota/rate-limit-blocked goal after a safe switch. Default false. Paused/budget-limited/unrelated-blocked goals are not resumed.")
+      },
+      execute: async (args, context) => {
+        if (!context?.sessionID)
+          return { title: "No session", output: JSON.stringify({ ok: false, message: "No session context available." }) };
+        const state = await readState(directory);
+        if (!state.goals.some((g) => g.id === args.goal_id && g.ownerSessionID === context.sessionID)) {
+          return { title: "Switch denied", output: JSON.stringify({ ok: false, message: "Goal not found or not owned by this session." }) };
+        }
+        try {
+          const result = await goalService.switchModel(directory, args.goal_id, context.sessionID, args.model, { resume: args.resume });
+          return { title: `Model switch: ${result.outcome}`, output: JSON.stringify({ ok: result.outcome !== "unsupported", ...result, goalID: args.goal_id, message: "Same goal and worker retained. Deferred requests require the next permitted turn; no automatic interactive wake." }) };
+        } catch {
+          return { title: "Model switch failed", output: JSON.stringify({ ok: false, message: "Switch rejected: verify ownership, model availability and host capability with loopd_list_models and inspect_background_goal. Existing goal/session retained." }) };
+        }
+      }
+    }),
     list_background_goals: tool2({
       description: "List all active background goals owned by this session. Shows contract (name, status, phase, turn, last progress, blocker) \u2014 only goals with your ownerSessionID appear.",
       args: {},
@@ -7336,6 +8044,11 @@ function ownerTools(options) {
             maxTurns: g.config.maxTurns,
             agent: g.config.agent,
             model: g.config.model,
+            modelSwitch: g.modelSwitch,
+            modelFallback: g.modelFallback,
+            lastProviderLimit: g.lastProviderLimit,
+            fallbackModels: g.config.fallbackModels ?? [],
+            quotaLimitation: "Remaining provider quota unknown; connected/enabled is not balance data. See loopd_list_models.",
             lastProgress: g.lastProgress?.summary?.slice(0, 120),
             lastProgressAt: g.lastProgress?.at,
             blocker: g.blocker?.reason?.slice(0, 120),
@@ -7432,11 +8145,16 @@ function ownerTools(options) {
               workspaceWrite: goal.config.workspaceWrite,
               agent: goal.config.agent,
               model: goal.config.model,
+              fallbackModels: goal.config.fallbackModels ?? [],
               parentAgent: goal.parentAgent,
               parentModel: goal.parentModel,
               schedule: goal.config.schedule
             },
             lastProgress: goal.lastProgress,
+            modelSwitch: goal.modelSwitch,
+            modelFallback: goal.modelFallback,
+            lastProviderLimit: goal.lastProviderLimit,
+            quotaLimitation: "Remaining provider quota unknown; local quota errors are observations, not balance data. See loopd_list_models.",
             completionEvidence: goal.completionEvidence,
             blocker: goal.blocker,
             tokensUsed: goal.tokensUsed,
@@ -7918,14 +8636,14 @@ function commandTools(options) {
   const sizeNote = capabilities.resize ? "applied live to the PTY winsize" : "stored; resize is unsupported by the pipe host";
   return {
     loopd_command_start: tool3({
-      description: "Start a standalone interactive OS process (arbitrary shell command) in the background \u2014 a dev server, `npm test --watch`, a REPL, a log tail, a build, or a one-off script. This is a raw process, NOT an AI worker: no agent, no checks, no turn loop. For multi-turn autonomous AI work with completion criteria, use loopd_create_goal instead. " + "Returns a command_id for loopd_command_get (read output)/loopd_command_write (send stdin)/loopd_command_interrupt (Ctrl+C)/loopd_command_terminate (kill)/loopd_command_remove (delete). " + "The user can also open it live: /loop or /commands \u2192 Tab/l to the Commands tab \u2192 select it \u2192 `o` opens a fullscreen interactive terminal page (type directly, Ctrl+C interrupts, Ctrl+] detaches without stopping it). " + "Independent from goals: an optional goal_id is display-only metadata and never couples lifecycles \u2014 pausing/clearing a goal never touches the command, and terminating a command never touches the goal. " + "To make a specific goal wake up when this command finishes, call loopd_command_await separately after starting it (linking alone does not wake anything). " + "The OWNER session (you) gets pushed a real message when the command reaches a terminal status \u2014 no polling required to find out: by default (auto) that fires on a non-zero exit, on 'missing' (host restarted mid-run), on 'timeout' (timeout_seconds deadline reached \u2014 always notifies), or once total runtime crosses ~2 minutes (the long-running/monitor case); quick successful commands stay silent. Override with notify_on_exit.",
+      description: "PREFER THIS over the built-in shell/bash tool whenever a command might take a while or never return: installs (npm/pip/brew/cargo...), builds, test suites, downloads, migrations, dev servers, watchers, log tails, REPLs, or anything interactive. The built-in shell BLOCKS your whole turn until the process exits \u2014 a long install freezes you (and can time out); this returns immediately with a command_id and pushes you a message on exit or pattern match, so you stay responsive and can do other work meanwhile. Only use the built-in shell for quick one-shots (ls, git status, a single fast test) that finish in seconds. " + "Start a standalone interactive OS process (arbitrary shell command) in the background \u2014 a dev server, `npm test --watch`, a REPL, a log tail, a build, or a one-off script. This is a raw process, NOT an AI worker: no agent, no checks, no turn loop. For multi-turn autonomous AI work with completion criteria, use loopd_create_goal instead. " + "Returns a command_id for loopd_command_get (read output)/loopd_command_write (send stdin)/loopd_command_interrupt (Ctrl+C)/loopd_command_terminate (kill)/loopd_command_remove (delete). " + "The user can also open it live: /loop or /commands \u2192 Tab/l to the Commands tab \u2192 select it \u2192 `o` opens a fullscreen interactive terminal page (type directly, Ctrl+C interrupts, Ctrl+] detaches without stopping it). " + "Independent from goals: an optional goal_id is display-only metadata and never couples lifecycles \u2014 pausing/clearing a goal never touches the command, and terminating a command never touches the goal. " + "To make a specific goal wake up when this command finishes, call loopd_command_await separately after starting it (linking alone does not wake anything). " + "The OWNER session gets a notification on natural exit (including code 0), missing process, or timeout \u2014 no polling required for completion. Manual terminate stays silent by default. Raw PTY output stays in the log; any short tail included in the notification is sanitized for chat. Set notify_on_exit:false to suppress owner exit notifications.",
       args: {
         title: tool3.schema.string().describe("Short human label for the session."),
         command: tool3.schema.string().describe('Executable to spawn (e.g. "bun", "python3").'),
         args: tool3.schema.array(tool3.schema.string()).optional().describe("Arguments for the command."),
         cwd: tool3.schema.string().optional().describe("Working directory. Defaults to the project root."),
         goal_id: tool3.schema.string().optional().describe("Optional goal linkage (display only \u2014 no lifecycle coupling)."),
-        notify_on_exit: tool3.schema.boolean().optional().describe("Owner-exit-notification override. true = always push a message to you when this command finishes. false = never (dashboard/loopd_command_get only). Omit for auto (failure, lost-host, timeout, or long-running success)."),
+        notify_on_exit: tool3.schema.boolean().optional().describe("Owner-exit-notification override. Omit to notify on natural exits (including quick success), missing or timeout; manual terminate stays silent. true also notifies on manual terminate; false disables owner exit notifications."),
         cols: tool3.schema.number().optional().describe(`Requested terminal width (${sizeNote}).`),
         rows: tool3.schema.number().optional().describe(`Requested terminal height (${sizeNote}).`),
         env: tool3.schema.record(tool3.schema.string(), tool3.schema.string()).optional().describe("Extra environment variables for the child. Values are passed to the host but never persisted \u2014 only names appear as envKeys in summaries."),
@@ -8179,7 +8897,7 @@ function commandTools(options) {
 // src/server/plugin.ts
 init_state_repository();
 // package.json
-var version = "1.10.4";
+var version = "1.11.2";
 
 // src/server/plugin.ts
 var PLUGIN_ID = "opencode-loopd.server";
@@ -8208,10 +8926,15 @@ function createServerHooks(directory, host, defaults) {
       }
     },
     onOwnerNotify: async (dir, ownerSessionID, message) => {
-      await host.notifyOwner(ownerSessionID, message).catch((error) => logServerEvent(dir, "command.owner-notify-failed", {
-        ownerSessionID,
-        detail: describeError(error)
-      }));
+      try {
+        return await host.notifyOwner(ownerSessionID, message) !== false;
+      } catch (error) {
+        await logServerEvent(dir, "command.owner-notify-failed", {
+          ownerSessionID,
+          detail: describeError(error)
+        });
+        return false;
+      }
     },
     onWatchNotify: async (dir, ownerSessionID, message) => {
       await host.notifyOwner(ownerSessionID, message).catch((error) => logServerEvent(dir, "command.watch-notify-failed", {