@bojackduy/opencode-loopd 1.10.5 → 1.12.2

package/dist/server.js

@@ -129,6 +129,7 @@ var PARENT_NOTIFY_DEDUPE_MS = 60000;
 import { promises as fs } from "fs";
 import path from "path";
 import os from "os";
+import { createHash } from "crypto";
 function emptyState() {
   return { version: CURRENT_VERSION, revision: 0, goals: [], runtimes: [], commandLedger: [], commands: [] };
 }
@@ -142,23 +143,32 @@ function eventsFile(directory) {
   return path.join(loopDir(directory), "events.ndjson");
 }
 function lockDir(directory) {
-  const projectHash = Buffer.from(directory).toString("base64url").slice(0, 32);
+  const projectHash = createHash("sha256").update(path.resolve(directory)).digest("hex");
   return path.join(os.tmpdir(), "loopd-locks", projectHash);
 }
 function lockFile(directory, key) {
   return path.join(lockDir(directory), `${key}.lock`);
 }
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
 async function acquireLock(directory, key, operation) {
   const dir = lockDir(directory);
   await fs.mkdir(dir, { recursive: true });
   const lockPath = lockFile(directory, key);
-  for (let attempt = 0;attempt < 10; attempt++) {
+  const deadline = performance.now() + LOCK_TIMEOUT_MS;
+  for (let attempt = 0;performance.now() < deadline; attempt++) {
     try {
       try {
         const raw = await fs.readFile(lockPath, "utf8");
         const meta = JSON.parse(raw);
         const age = Date.now() - Date.parse(meta.acquiredAt);
-        if (age > LOCK_STALE_MS) {
+        if (age > LOCK_STALE_MS && !processIsAlive(meta.pid)) {
           await fs.rm(lockPath, { force: true });
         }
       } catch {}
@@ -178,17 +188,16 @@ async function acquireLock(directory, key, operation) {
         throw error;
       }
     }
-    await delay(25 * (attempt + 1));
+    await delay(Math.min(25 * (attempt + 1), 250, Math.max(0, deadline - performance.now())));
   }
-  throw new Error(`failed to acquire lock "${key}" for "${operation}" after retries`);
+  throw new Error(`failed to acquire lock "${key}" for "${operation}" after ${LOCK_TIMEOUT_MS}ms`);
 }
 async function releaseLock(directory, key) {
   const lockPath = lockFile(directory, key);
   try {
     const raw = await fs.readFile(lockPath, "utf8");
     const meta = JSON.parse(raw);
-    const age = Date.now() - Date.parse(meta.acquiredAt);
-    const shouldRelease = meta.pid === process.pid || age > LOCK_STALE_MS;
+    const shouldRelease = meta.pid === process.pid;
     if (!shouldRelease)
       return;
     try {
@@ -563,7 +572,7 @@ async function removeCommandLog(directory, commandID) {
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-var CURRENT_VERSION = 9, LOCK_STALE_MS = 1e4;
+var CURRENT_VERSION = 9, LOCK_TIMEOUT_MS = 30000, LOCK_STALE_MS = 1e4;
 var init_state_repository = () => {};
 
 // src/domain/command-await.ts
@@ -1545,6 +1554,69 @@ function createControlWorker(options) {
         };
         break;
       }
+      case "list_agents": {
+        const catalog = await goalSvc.listAgents();
+        const state = await readState(directory);
+        response = { ...base, ok: catalog.capability === "supported", stateRevision: state.revision, message: `Agents [${catalog.capability}/${catalog.switching}]: ${catalog.agents.map((a) => `${a.name} (${a.mode})`).join(", ") || "none"}` };
+        break;
+      }
+      case "switch_goal_identity": {
+        if (!request.goalID) {
+          response = { ...base, ok: false, message: "goalID is required", errorCode: "bad_request" };
+          break;
+        }
+        const args = request.args;
+        if (args?.model === undefined && args?.agent === undefined || args?.model !== undefined && (typeof args.model !== "string" || !args.model.trim()) || args?.agent !== undefined && (typeof args.agent !== "string" || !args.agent.trim())) {
+          response = { ...base, ok: false, message: "At least one of model (providerID/modelID) or agent is required; provided fields must be non-empty strings.", errorCode: "bad_request" };
+          break;
+        }
+        const ownerForSwitch = (await readState(directory)).goals.find((g) => g.id === request.goalID)?.ownerSessionID ?? "";
+        const result = await goalSvc.switchIdentity(directory, request.goalID, ownerForSwitch, { model: args?.model, agent: args?.agent, resume: args?.resume === true });
+        const state = await readState(directory);
+        const outcomeMessage = {
+          applied: `Identity switched to ${[result.model, result.agent].filter(Boolean).join(" / ")} on the same worker/session.`,
+          deferred: `Identity switch deferred until the next permitted idle turn/prompt; no implicit wake.`,
+          unsupported: `Identity switch unsupported on this host (see loopd_list_models). Goal/session retained.`
+        };
+        response = {
+          ...base,
+          ok: result.outcome !== "unsupported",
+          message: outcomeMessage[result.outcome] ?? `Identity switch ${result.outcome}.`,
+          stateRevision: state.revision
+        };
+        break;
+      }
+      case "list_models": {
+        const catalog = await goalSvc.listModels();
+        const state = await readState(directory);
+        response = {
+          ...base,
+          ok: catalog.capability !== "unavailable",
+          message: `Models: ${catalog.models.length} across ${catalog.providers.length} provider(s) [${catalog.capability}/${catalog.switching}]. Quota: ${catalog.quota.status} \u2014 ${catalog.quota.limitation}`,
+          stateRevision: state.revision
+        };
+        break;
+      }
+      case "set_interactive": {
+        if (!request.goalID) {
+          response = { ...base, ok: false, message: "goalID is required", errorCode: "bad_request" };
+          break;
+        }
+        const interactive = request.args?.interactive;
+        if (typeof interactive !== "boolean") {
+          response = { ...base, ok: false, message: "interactive (boolean) is required", errorCode: "bad_request" };
+          break;
+        }
+        const result = await goalSvc.setInteractive(directory, request.goalID, interactive);
+        const state = await readState(directory);
+        response = {
+          ...base,
+          ok: result.ok,
+          message: result.message,
+          stateRevision: state.revision
+        };
+        break;
+      }
       case "send": {
         const args = request.args;
         const text = String(args.message || "").trim();
@@ -1957,6 +2029,8 @@ function createLoopEngine(options) {
       knownWorkerSessions.add(goal.workerSessionID);
     if (goal.status !== "active")
       return false;
+    if (goal.interactive === true && type === "session.idle")
+      return false;
     switch (type) {
       case "session.idle":
         return await handleSessionIdle(state, goal);
@@ -2345,6 +2419,7 @@ function createLoopEngine(options) {
       revision: newState.revision
     });
     const updatedGoal = newState.goals.find((g) => g.id === goal.id);
+    await goalService.observeProviderError(directory, goal.id, error, "session-error", goal.config.model);
     if (updatedGoal?.status === "blocked") {
       await appendEvent(directory, {
         version: 1,
@@ -2453,7 +2528,7 @@ function createLoopEngine(options) {
       revision: state.revision
     });
     try {
-      await host.compactSession(goal.workerSessionID);
+      await goalService.compact(directory, goal.id);
     } catch {}
     await mutateState(directory, `compact.end:${goal.id}`, async (s) => {
       const rt = s.runtimes.find((r) => r.goalID === goal.id);
@@ -2568,7 +2643,8 @@ function createLoopEngine(options) {
         if (stopped)
           continue;
       }
-      if (runtime.phase === "waiting_retry" && runtime.retryAfter) {
+      const manual = goal.interactive === true;
+      if (!manual && runtime.phase === "waiting_retry" && runtime.retryAfter) {
         if (Date.now() >= Date.parse(runtime.retryAfter)) {
           await mutateState(directory, `retry-ready:${goal.id}`, async (s) => {
             const rt = s.runtimes.find((r) => r.goalID === goal.id);
@@ -2581,7 +2657,7 @@ function createLoopEngine(options) {
           goalService.continueTurn(directory, goal.id).catch(() => {});
         }
       }
-      if ((runtime.phase === "running" || runtime.phase === "idle") && goal.workerSessionID) {
+      if (!manual && (runtime.phase === "running" || runtime.phase === "idle") && goal.workerSessionID) {
         if (runtime.phase === "idle" && runtime.activeRunID) {
           await mutateState(directory, `maintenance.clear-stale-run:${goal.id}`, async (s) => {
             const rt = s.runtimes.find((r) => r.goalID === goal.id);
@@ -2886,6 +2962,111 @@ var nativeRpcDefinition = {
   }
 };
 
+// src/server/model-catalog.ts
+function emptyCatalog(source, switching, capability = "unsupported") {
+  const observedAt = new Date().toISOString();
+  return {
+    capability,
+    source,
+    observedAt,
+    switching,
+    providers: [],
+    models: [],
+    quota: {
+      status: "unknown",
+      capability: "unsupported",
+      source,
+      observedAt,
+      limitation: "Host catalog does not report remaining quota or reset time. Connected/enabled does not prove remaining balance; local rate-limit observations are not balance data."
+    }
+  };
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function model(raw, providerID, usable) {
+  const value = record(raw);
+  if (typeof value.id !== "string" || !value.id)
+    return;
+  const limit = record(value.limit);
+  return {
+    providerID,
+    modelID: value.id,
+    name: typeof value.name === "string" ? value.name : value.id,
+    usable,
+    ...typeof limit.context === "number" && Number.isFinite(limit.context) ? { contextLimit: limit.context } : {},
+    ...typeof limit.output === "number" && Number.isFinite(limit.output) ? { outputLimit: limit.output } : {}
+  };
+}
+function normalizeV1Catalog(raw) {
+  const result = emptyCatalog("v1 provider.list", "next-prompt", "unavailable");
+  const value = record(raw);
+  if (!Array.isArray(value.all) || !Array.isArray(value.connected))
+    return result;
+  result.capability = "supported";
+  const connected = new Set(value.connected.filter((id) => typeof id === "string"));
+  for (const rawProvider of value.all) {
+    const p = record(rawProvider);
+    if (typeof p.id !== "string")
+      continue;
+    const available = connected.has(p.id);
+    result.providers.push({ providerID: p.id, name: typeof p.name === "string" ? p.name : p.id, connected: available });
+    for (const rawModel of Object.values(record(p.models))) {
+      const m = model(rawModel, p.id, available);
+      if (m)
+        result.models.push(m);
+    }
+  }
+  return result;
+}
+function normalizeV2Catalog(rawProviders, rawModels) {
+  const result = emptyCatalog("v2 provider.list + model.list", "session", "unavailable");
+  const providers = record(rawProviders).data;
+  const models = record(rawModels).data;
+  if (!Array.isArray(providers) || !Array.isArray(models))
+    return result;
+  result.capability = "supported";
+  const disabled = new Set;
+  for (const rawProvider of providers) {
+    const p = record(rawProvider);
+    if (typeof p.id !== "string")
+      continue;
+    if (p.activation === "disabled")
+      disabled.add(p.id);
+    result.providers.push({ providerID: p.id, name: typeof p.name === "string" ? p.name : p.id, connected: "unknown" });
+  }
+  const knownProviders = new Set(result.providers.map((p) => p.providerID));
+  for (const rawModel of models) {
+    const value = record(rawModel);
+    if (typeof value.providerID !== "string" || !knownProviders.has(value.providerID))
+      continue;
+    const usable = disabled.has(value.providerID) || value.enabled === false ? false : value.enabled === true ? true : "unknown";
+    const m = model(value, value.providerID, usable);
+    if (m)
+      result.models.push(m);
+  }
+  return result;
+}
+
+// src/server/agent-catalog.ts
+function emptyAgentCatalog(source, switching, capability = "unsupported") {
+  return { capability, source, observedAt: new Date().toISOString(), switching, agents: [] };
+}
+function normalizeAgentCatalog(raw, source, switching) {
+  const result = emptyAgentCatalog(source, switching, "unavailable");
+  if (!Array.isArray(raw))
+    return result;
+  result.capability = "supported";
+  for (const value of raw) {
+    if (!value || typeof value !== "object" || typeof value.name !== "string" || !value.name.trim())
+      continue;
+    if (value.mode !== "primary" && value.mode !== "subagent" && value.mode !== "all")
+      continue;
+    result.agents.push({ name: value.name, mode: value.mode, ...typeof value.description === "string" ? { description: value.description } : {} });
+  }
+  return result;
+}
+
 // src/server/host-adapter.ts
 function parseModelRef(value) {
   if (value === undefined)
@@ -2929,6 +3110,42 @@ function markParentNotified2(ownerSessionID, message) {
 }
 function createRealHost(client, directory) {
   return {
+    async listAgents() {
+      const switching = typeof client.session?.switchAgent === "function" ? "session" : "next-prompt";
+      if (typeof client.agent?.list !== "function")
+        return emptyAgentCatalog("v1 agent.list", switching);
+      try {
+        const result = await withTimeout(client.agent.list({ query: { directory } }), 1e4, "OpenCode agent.list");
+        if (result?.error)
+          return emptyAgentCatalog("v1 agent.list", switching, "unavailable");
+        return normalizeAgentCatalog(result?.data, "v1 agent.list", switching);
+      } catch {
+        return emptyAgentCatalog("v1 agent.list", switching, "unavailable");
+      }
+    },
+    async switchSessionAgent(sessionID, agent) {
+      if (typeof client.session?.switchAgent !== "function")
+        return "next-prompt";
+      const result = await withTimeout(client.session.switchAgent({ path: { id: sessionID }, body: { agent } }), 1e4, "OpenCode session.switchAgent");
+      if (result?.error)
+        throw new Error("OpenCode session.switchAgent rejected the agent.");
+      return "applied";
+    },
+    async listModels() {
+      if (typeof client.provider?.list !== "function")
+        return emptyCatalog("v1 provider.list", "next-prompt");
+      try {
+        const result = await withTimeout(client.provider.list({ query: { directory } }), 1e4, "OpenCode provider.list");
+        if (result?.error)
+          return emptyCatalog("v1 provider.list", "next-prompt", "unavailable");
+        return normalizeV1Catalog(result?.data);
+      } catch {
+        return emptyCatalog("v1 provider.list", "next-prompt", "unavailable");
+      }
+    },
+    async switchSessionModel() {
+      return "next-prompt";
+    },
     async createWorker({ parentID, title, agent, model }) {
       try {
         const body = { parentID, title };
@@ -2971,7 +3188,7 @@ function createRealHost(client, directory) {
       if (result?.error) {
         const detail = describeError(result.error);
         await logServerEvent(directory, "worker.prompt.failed", { sessionID, detail });
-        throw new Error(`OpenCode session.promptAsync failed for worker "${sessionID}": ${detail}`);
+        throw new Error(`OpenCode session.promptAsync failed for worker "${sessionID}": ${detail}`, { cause: result.error });
       }
       await logServerEvent(directory, "worker.prompted", { sessionID });
       return { messageID: result?.data?.messageID };
@@ -3064,9 +3281,12 @@ function createRealHost(client, directory) {
         return [];
       }
     },
-    async compactSession(sessionID) {
+    async compactSession(sessionID, model) {
       try {
-        await client.session.compact({ sessionID });
+        const identity = model ?? (await this.readSession(sessionID))?.model;
+        if (!identity || typeof client.session.summarize !== "function")
+          return;
+        await client.session.summarize({ path: { id: sessionID }, body: identity });
       } catch {}
     },
     async notifyOwner(ownerSessionID, message, agent) {
@@ -3112,6 +3332,46 @@ function toWorkerCreation(result) {
 function createV2Host(context, statuses, options = {}) {
   const directory = context.location.directory;
   return {
+    async listAgents() {
+      const switching = typeof context.session.switchAgent === "function" ? "session" : "unsupported";
+      if (typeof context.agent?.list !== "function")
+        return emptyAgentCatalog("v2 agent.list", switching);
+      try {
+        const result = await context.agent.list({ location: { directory } });
+        return normalizeAgentCatalog(result.data, "v2 agent.list", switching);
+      } catch {
+        return emptyAgentCatalog("v2 agent.list", switching, "unavailable");
+      }
+    },
+    async switchSessionAgent(sessionID, agent) {
+      if (typeof context.session.switchAgent !== "function")
+        return "unsupported";
+      await context.session.switchAgent({ sessionID, agent });
+      return "applied";
+    },
+    async listModels() {
+      if (typeof context.provider?.list !== "function" || typeof context.model?.list !== "function") {
+        return emptyCatalog("v2 provider.list + model.list", typeof context.session.switchModel === "function" ? "session" : "unsupported");
+      }
+      try {
+        const [providers, models] = await Promise.all([
+          context.provider.list({ location: { directory } }),
+          context.model.list({ location: { directory } })
+        ]);
+        const catalog = normalizeV2Catalog(providers, models);
+        if (typeof context.session.switchModel !== "function")
+          catalog.switching = "unsupported";
+        return catalog;
+      } catch {
+        return emptyCatalog("v2 provider.list + model.list", typeof context.session.switchModel === "function" ? "session" : "unsupported", "unavailable");
+      }
+    },
+    async switchSessionModel(sessionID, model) {
+      if (typeof context.session.switchModel !== "function")
+        return "unsupported";
+      await context.session.switchModel({ sessionID, model: { id: model.modelID, providerID: model.providerID } });
+      return "applied";
+    },
     async createWorker({ parentID, title, agent, model, goalID }) {
       if (options.native) {
         let outcome;
@@ -3266,8 +3526,13 @@ function createV2Host(context, statuses, options = {}) {
         return [];
       }
     },
-    async compactSession(sessionID) {
+    async compactSession(sessionID, model) {
       try {
+        if (model) {
+          if (typeof context.session.switchModel !== "function")
+            return;
+          await context.session.switchModel({ sessionID, model: { id: model.modelID, providerID: model.providerID } });
+        }
         await context.session.command({ sessionID, name: "compact", text: "" });
       } catch {}
     },
@@ -3298,6 +3563,40 @@ async function withTimeout(promise, timeoutMs, operation) {
   }
 }
 
+// src/domain/provider-limit.ts
+function object(value) {
+  return value !== null && typeof value === "object" ? value : {};
+}
+function observeProviderLimit(error, source, model) {
+  const wrapper = object(error);
+  const root = wrapper.cause ? object(wrapper.cause) : wrapper;
+  const data = object(root.data);
+  const status = root.statusCode ?? root.status ?? data.statusCode ?? data.status;
+  const statusCode = typeof status === "number" ? status : undefined;
+  const code = root.code ?? data.code;
+  const message = [root.message, data.message, typeof error === "string" ? error : undefined].filter((s) => typeof s === "string").join(" ");
+  if (statusCode === 401 || statusCode === 403 || /context.{0,20}(length|window|overflow)|maximum context|invalid.{0,10}(key|token)|unauthori[sz]ed|authentication|network|ECONN|ENOTFOUND|max.?turn|cost.?budget|budget.?limit/i.test(message))
+    return;
+  const quota = code === "insufficient_quota" || code === "quota_exceeded" || /\b(insufficient quota|quota (exceeded|exhausted)|exceeded.{0,20}quota|usage limit reached|credit balance.{0,20}(low|exhausted|insufficient))\b/i.test(message);
+  const rate = statusCode === 429 || code === "rate_limit_exceeded" || /\b(rate[ -]limit(ed| exceeded| reached| hit)|too many requests)\b/i.test(message);
+  if (!quota && !rate)
+    return;
+  const observedAt = new Date().toISOString();
+  const headers = object(root.responseHeaders ?? data.responseHeaders);
+  const retryAfter = root.retryAfter ?? data.retryAfter ?? headers["retry-after"];
+  let retryAt;
+  if (typeof retryAfter === "number" && Number.isFinite(retryAfter) && retryAfter >= 0) {
+    retryAt = new Date(Date.now() + Math.min(retryAfter, 31536000) * 1000).toISOString();
+  } else if (typeof retryAfter === "string") {
+    if (/^\d+(\.\d+)?$/.test(retryAfter)) {
+      retryAt = new Date(Date.now() + Math.min(Number(retryAfter), 31536000) * 1000).toISOString();
+    } else if (Number.isFinite(Date.parse(retryAfter))) {
+      retryAt = new Date(retryAfter).toISOString();
+    }
+  }
+  return { kind: quota ? "quota" : "rate-limit", source, observedAt, ...model ? { model } : {}, ...statusCode !== undefined ? { statusCode } : {}, ...retryAt ? { retryAt } : {} };
+}
+
 // src/server/worker-session.ts
 function createWorkerManager(host) {
   return {
@@ -3481,6 +3780,466 @@ function createGoalService(host) {
       throw new Error(`Workspace-writing goal "${activeWriter.name}" (${activeWriter.id}) is already active` + (ownedElsewhere ? ` (owned by session ${activeWriter.ownerSessionID}, not this session)` : "") + ". Pause, block, complete, or clear it before activating another workspace-writing goal." + (ownedElsewhere ? " Note: list_background_goals shows only this session's goals; clear/pause it from its owning session." : ""));
     }
   }
+  async function listModels() {
+    return host.listModels ? host.listModels() : emptyCatalog("host catalog capability absent", "unsupported");
+  }
+  async function listAgents() {
+    return host.listAgents ? host.listAgents() : emptyAgentCatalog("host agent catalog capability absent", "unsupported");
+  }
+  async function validateAgent(value) {
+    const agent = value.trim();
+    if (!agent)
+      throw new Error("Agent name is required.");
+    const catalog = await listAgents();
+    if (catalog.capability === "supported" && !catalog.agents.some((a) => a.name === agent)) {
+      throw new Error("Agent is unavailable. Discover agents with loopd_list_models first.");
+    }
+    return { agent, catalog };
+  }
+  async function applyAgent(directory, goal, agent, persist = true) {
+    if (!goal.workerSessionID || !host.switchSessionAgent)
+      return "unsupported";
+    const previousAgent = goal.config.agent ?? (await host.readSession(goal.workerSessionID))?.agent;
+    const outcome = await host.switchSessionAgent(goal.workerSessionID, agent);
+    if (outcome === "unsupported")
+      return outcome;
+    if (!persist)
+      return outcome;
+    try {
+      await mutateState(directory, `goal.agent-switch:${goal.id}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goal.id);
+        if (!current)
+          throw new Error("Goal removed during agent switch.");
+        current.config.agent = agent;
+        current.agentSwitch = { pending: undefined, lastFailure: undefined, last: { from: goal.config.agent, to: agent, at: new Date().toISOString(), outcome } };
+        current.updatedAt = new Date().toISOString();
+        return s;
+      });
+    } catch (error) {
+      if (outcome === "applied") {
+        if (!previousAgent)
+          throw new Error("Host accepted agent switch but persistence failed; previous host agent unknown, rollback unavailable.");
+        await host.switchSessionAgent(goal.workerSessionID, previousAgent);
+      }
+      throw error;
+    }
+    await logServerEvent(directory, "goal.agent-switched", { goalID: goal.id, workerSessionID: goal.workerSessionID, from: goal.config.agent, to: agent, outcome });
+    return outcome;
+  }
+  function switchAgent(directory, goalID, ownerSessionID, value, opts) {
+    return withGoalOperation(goalID, () => switchAgentUnlocked(directory, goalID, ownerSessionID, value, opts));
+  }
+  async function switchAgentUnlocked(directory, goalID, ownerSessionID, value, opts) {
+    const state = await readState(directory);
+    const goal = state.goals.find((g) => g.id === goalID);
+    if (!goal || !ownerSessionID || goal.ownerSessionID !== ownerSessionID)
+      throw new Error("Goal not found or not owned by this session.");
+    if (goal.status === "complete")
+      throw new Error("Cannot switch a completed goal.");
+    if (opts?.resume && goal.status !== "blocked")
+      throw new Error("resume is only valid for a blocked goal.");
+    if (opts?.resume)
+      assertWorkspaceWriteAvailable(state, goal, ownerSessionID);
+    const { agent, catalog } = await validateAgent(value);
+    if (catalog.capability !== "supported" || catalog.switching === "unsupported" || !host.switchSessionAgent || !goal.workerSessionID) {
+      return { outcome: "unsupported", agent };
+    }
+    const runtime = state.runtimes.find((r) => r.goalID === goalID);
+    if (await host.sessionStatus(goal.workerSessionID) !== "idle" || runtime?.phase === "running" && leaseIsValid(runtime)) {
+      if (opts?.persist === false)
+        throw new Error("Worker became busy during identity switch.");
+      await mutateState(directory, `goal.agent-deferred:${goalID}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goalID);
+        if (current) {
+          current.agentSwitch = { ...current.agentSwitch, pending: { agent, requestedAt: new Date().toISOString() } };
+          current.updatedAt = new Date().toISOString();
+        }
+        return s;
+      });
+      return { outcome: "deferred", agent };
+    }
+    const applied = await applyAgent(directory, goal, agent, opts?.persist !== false);
+    if (opts?.resume && applied !== "unsupported") {
+      await mutateState(directory, `goal.agent-resume:${goalID}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goalID);
+        if (current?.status === "blocked") {
+          assertWorkspaceWriteAvailable(s, current, ownerSessionID);
+          current.status = "active";
+          current.blocker = undefined;
+          current.updatedAt = new Date().toISOString();
+        }
+        return s;
+      });
+      await continueTurnUnlocked(directory, goalID);
+    }
+    return { outcome: applied === "next-prompt" ? "deferred" : applied, agent, ...opts?.resume && applied !== "unsupported" ? { resumed: true } : {} };
+  }
+  async function applyPendingAgent(directory, goal) {
+    const pending = goal.agentSwitch?.pending;
+    if (!pending)
+      return;
+    let reason = "catalog-unavailable";
+    try {
+      const { catalog } = await validateAgent(pending.agent);
+      if (catalog.capability !== "supported" || catalog.switching === "unsupported")
+        throw new Error("Agent catalog unavailable.");
+      reason = "host-rejected";
+      if (await applyAgent(directory, goal, pending.agent) === "unsupported")
+        throw new Error("Agent switching unsupported.");
+    } catch {
+      await mutateState(directory, `goal.agent-switch-failed:${goal.id}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goal.id);
+        const runtime = s.runtimes.find((r) => r.goalID === goal.id);
+        if (current) {
+          current.agentSwitch = { ...current.agentSwitch, pending: undefined, lastFailure: { at: new Date().toISOString(), reason } };
+          if (current.status === "active") {
+            current.status = "blocked";
+            current.blocker = { reason: "Pending agent switch was not accepted.", needed: "Discover agents, switch the same goal explicitly, then retry when safe.", at: new Date().toISOString() };
+          }
+          current.updatedAt = new Date().toISOString();
+        }
+        if (runtime) {
+          Object.assign(runtime, releaseLease(runtime));
+          runtime.retryAfter = undefined;
+        }
+        return s;
+      });
+      throw new Error("Pending agent switch was not accepted; goal blocked without replacing its worker.");
+    }
+  }
+  async function validateModel(value) {
+    const ref = parseModelRef(value);
+    if (!ref)
+      throw new Error("Model is required: providerID/modelID.");
+    const model = `${ref.providerID}/${ref.modelID}`;
+    const catalog = await listModels();
+    if (catalog.capability !== "supported" || catalog.switching === "unsupported" || !host.switchSessionModel) {
+      return { model, catalog };
+    }
+    if (!catalog.models.some((m) => m.providerID === ref.providerID && m.modelID === ref.modelID && m.usable === true)) {
+      throw new Error("Model is unavailable or not positively known usable. Discover models with loopd_list_models first.");
+    }
+    return { model, catalog };
+  }
+  async function applyModel(directory, goal, model, reason, persist = true) {
+    if (!goal.workerSessionID || !host.switchSessionModel)
+      return "unsupported";
+    const previousModel = parseModelRef(goal.config.model) ?? (await host.readSession(goal.workerSessionID))?.model;
+    const outcome = await host.switchSessionModel(goal.workerSessionID, parseModelRef(model));
+    if (outcome === "unsupported")
+      return outcome;
+    if (!persist)
+      return outcome;
+    try {
+      await mutateState(directory, `goal.model-switch:${goal.id}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goal.id);
+        if (!current)
+          throw new Error("Goal removed during model switch.");
+        current.config.model = model;
+        current.modelSwitch = {
+          ...current.modelSwitch,
+          pending: undefined,
+          lastFailure: undefined,
+          last: { from: goal.config.model, to: model, at: new Date().toISOString(), outcome, reason }
+        };
+        current.updatedAt = new Date().toISOString();
+        return s;
+      });
+    } catch (error) {
+      if (outcome === "applied") {
+        if (!previousModel)
+          throw new Error("Host accepted model switch but persistence failed; previous host model unknown, rollback unavailable.");
+        await host.switchSessionModel(goal.workerSessionID, previousModel);
+      }
+      throw error;
+    }
+    await logServerEvent(directory, "goal.model-switched", { goalID: goal.id, workerSessionID: goal.workerSessionID, from: goal.config.model, to: model, reason, outcome });
+    return outcome;
+  }
+  function switchModel(directory, goalID, ownerSessionID, value, opts) {
+    return withGoalOperation(goalID, () => switchModelUnlocked(directory, goalID, ownerSessionID, value, opts));
+  }
+  async function switchModelUnlocked(directory, goalID, ownerSessionID, value, opts) {
+    const state = await readState(directory);
+    const goal = state.goals.find((g) => g.id === goalID);
+    if (!goal || !ownerSessionID || goal.ownerSessionID !== ownerSessionID)
+      throw new Error("Goal not found or not owned by this session.");
+    if (goal.status === "complete")
+      throw new Error("Cannot switch a completed goal.");
+    if (opts?.resume && (goal.status !== "blocked" || goal.blocker?.kind !== "provider-limit")) {
+      throw new Error("resume is only valid for a provider-limit-blocked goal.");
+    }
+    if (opts?.resume)
+      assertWorkspaceWriteAvailable(state, goal, ownerSessionID);
+    const { model, catalog } = await validateModel(value);
+    if (catalog.capability !== "supported" || catalog.switching === "unsupported" || !host.switchSessionModel || !goal.workerSessionID) {
+      return { outcome: "unsupported", model };
+    }
+    const runtime = state.runtimes.find((r) => r.goalID === goalID);
+    const status = await host.sessionStatus(goal.workerSessionID);
+    if (status !== "idle" || runtime?.phase === "running" && leaseIsValid(runtime)) {
+      if (opts?.persist === false)
+        throw new Error("Worker became busy during identity switch.");
+      await mutateState(directory, `goal.model-deferred:${goalID}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goalID);
+        if (current) {
+          current.modelSwitch = { ...current.modelSwitch, pending: { model, requestedAt: new Date().toISOString(), reason: "owner" } };
+          current.updatedAt = new Date().toISOString();
+        }
+        return s;
+      });
+      return { outcome: "deferred", model };
+    }
+    const applied = await applyModel(directory, goal, model, "owner", opts?.persist !== false);
+    if (opts?.resume && applied !== "unsupported") {
+      await mutateState(directory, `goal.model-resume:${goalID}`, async (s) => {
+        const g = s.goals.find((g) => g.id === goalID);
+        if (g?.status === "blocked" && g.blocker?.kind === "provider-limit") {
+          assertWorkspaceWriteAvailable(s, g, ownerSessionID);
+          g.status = "active";
+          g.blocker = undefined;
+          g.updatedAt = new Date().toISOString();
+        }
+        return s;
+      });
+      await continueTurnUnlocked(directory, goalID);
+    }
+    return { outcome: applied === "next-prompt" ? "deferred" : applied, model, ...opts?.resume && applied !== "unsupported" ? { resumed: true } : {} };
+  }
+  function switchIdentity(directory, goalID, ownerSessionID, opts) {
+    return withGoalOperation(goalID, () => switchIdentityUnlocked(directory, goalID, ownerSessionID, opts));
+  }
+  async function switchIdentityUnlocked(directory, goalID, ownerSessionID, opts) {
+    if (opts.model === undefined && opts.agent === undefined)
+      throw new Error("At least one of model or agent is required.");
+    const pending = (await readState(directory)).goals.find((g) => g.id === goalID)?.pendingIdentity;
+    if (pending)
+      opts = { model: opts.model ?? pending.model, agent: opts.agent ?? pending.agent, resume: opts.resume };
+    if (opts.agent === undefined)
+      return switchModelUnlocked(directory, goalID, ownerSessionID, opts.model, opts);
+    if (opts.model === undefined)
+      return switchAgentUnlocked(directory, goalID, ownerSessionID, opts.agent, opts);
+    const state = await readState(directory);
+    const goal = state.goals.find((g) => g.id === goalID);
+    if (!goal || !ownerSessionID || goal.ownerSessionID !== ownerSessionID)
+      throw new Error("Goal not found or not owned by this session.");
+    if (goal.status === "complete")
+      throw new Error("Cannot switch a completed goal.");
+    if (opts.resume && goal.status !== "blocked")
+      throw new Error("resume is only valid for a blocked goal.");
+    if (opts.resume)
+      assertWorkspaceWriteAvailable(state, goal, ownerSessionID);
+    const { model, catalog: models } = await validateModel(opts.model);
+    const { agent, catalog: agents } = await validateAgent(opts.agent);
+    if (models.capability !== "supported" || models.switching === "unsupported" || agents.capability !== "supported" || agents.switching === "unsupported" || !host.switchSessionModel || !host.switchSessionAgent || !goal.workerSessionID) {
+      return { outcome: "unsupported", model, agent };
+    }
+    const runtime = state.runtimes.find((r) => r.goalID === goalID);
+    if (await host.sessionStatus(goal.workerSessionID) !== "idle" || runtime?.phase === "running" && leaseIsValid(runtime)) {
+      await mutateState(directory, `goal.identity-deferred:${goalID}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goalID);
+        current.pendingIdentity = { model, agent };
+        current.modelSwitch = { ...current.modelSwitch, pending: undefined };
+        current.agentSwitch = { ...current.agentSwitch, pending: undefined };
+        current.updatedAt = new Date().toISOString();
+        return s;
+      });
+      return { outcome: "deferred", model, agent };
+    }
+    const live = await host.readSession(goal.workerSessionID);
+    const previousModel = parseModelRef(goal.config.model) ?? live?.model;
+    const previousAgent = goal.config.agent ?? live?.agent;
+    if (!previousModel || !previousAgent)
+      throw new Error("Combined switch requires a known previous identity for rollback.");
+    let modelChanged = false;
+    let agentChanged = false;
+    let outcome = "applied";
+    try {
+      const changedModel = await switchModelUnlocked(directory, goalID, ownerSessionID, model, { persist: false });
+      if (changedModel.outcome === "unsupported")
+        return { outcome: "unsupported", model, agent };
+      modelChanged = true;
+      const changedAgent = await switchAgentUnlocked(directory, goalID, ownerSessionID, agent, { persist: false });
+      if (changedAgent.outcome === "unsupported")
+        throw new Error("Agent switch unsupported after model switch.");
+      agentChanged = true;
+      if (changedModel.outcome === "deferred" || changedAgent.outcome === "deferred")
+        outcome = "deferred";
+      await mutateState(directory, `goal.identity-switched:${goalID}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goalID);
+        const at = new Date().toISOString();
+        current.config.model = model;
+        current.config.agent = agent;
+        current.modelSwitch = { ...current.modelSwitch, pending: undefined, lastFailure: undefined, last: { from: goal.config.model, to: model, at, outcome: changedModel.outcome === "deferred" ? "next-prompt" : "applied", reason: "owner" } };
+        current.agentSwitch = { pending: undefined, lastFailure: undefined, last: { from: goal.config.agent, to: agent, at, outcome: changedAgent.outcome === "deferred" ? "next-prompt" : "applied" } };
+        current.pendingIdentity = undefined;
+        current.updatedAt = at;
+        return s;
+      });
+    } catch (error) {
+      const rollbacks = await Promise.allSettled([
+        ...agentChanged ? [host.switchSessionAgent(goal.workerSessionID, previousAgent)] : [],
+        ...modelChanged ? [host.switchSessionModel(goal.workerSessionID, previousModel)] : []
+      ]);
+      if (rollbacks.some((result) => result.status === "rejected" || result.value === "unsupported")) {
+        throw new Error("Identity switch failed and host rollback failed; inspect the existing session before retrying.");
+      }
+      throw error;
+    }
+    if (opts.resume) {
+      await mutateState(directory, `goal.identity-resume:${goalID}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goalID);
+        assertWorkspaceWriteAvailable(s, current, ownerSessionID);
+        current.status = "active";
+        current.blocker = undefined;
+        current.updatedAt = new Date().toISOString();
+        return s;
+      });
+      await continueTurnUnlocked(directory, goalID);
+    }
+    return { outcome, model, agent, ...opts.resume ? { resumed: true } : {} };
+  }
+  async function applyPendingIdentity(directory, goal) {
+    if (!goal.pendingIdentity)
+      return;
+    try {
+      const result = await switchIdentityUnlocked(directory, goal.id, goal.ownerSessionID, goal.pendingIdentity);
+      if (result.outcome === "unsupported")
+        throw new Error("Identity switching unsupported.");
+    } catch {
+      await mutateState(directory, `goal.identity-switch-failed:${goal.id}`, async (s) => {
+        const current = s.goals.find((g) => g.id === goal.id);
+        current.pendingIdentity = undefined;
+        if (current.status === "active") {
+          current.status = "blocked";
+          current.blocker = { reason: "Pending identity switch was not accepted.", needed: "Inspect the existing session, switch identity explicitly, then retry when safe.", at: new Date().toISOString() };
+        }
+        const runtime = s.runtimes.find((r) => r.goalID === goal.id);
+        if (runtime) {
+          Object.assign(runtime, releaseLease(runtime));
+          runtime.retryAfter = undefined;
+        }
+        return s;
+      });
+      throw new Error("Pending identity switch was not accepted; goal blocked without replacing its worker.");
+    }
+  }
+  async function applyPendingModel(directory, goal) {
+    const pending = goal.modelSwitch?.pending;
+    if (!pending)
+      return;
+    let reason = "catalog-unavailable";
+    try {
+      const { catalog } = await validateModel(pending.model);
+      if (catalog.capability !== "supported" || catalog.switching === "unsupported")
+        throw new Error("Pending model switch catalog unavailable.");
+      reason = "host-rejected";
+      const result = await applyModel(directory, goal, pending.model, pending.reason);
+      if (result === "unsupported")
+        throw new Error("Pending model switching unsupported by host.");
+    } catch {
+      await mutateState(directory, `goal.model-switch-failed:${goal.id}`, async (s) => {
+        const g = s.goals.find((g) => g.id === goal.id);
+        const rt = s.runtimes.find((r) => r.goalID === goal.id);
+        if (g) {
+          g.modelSwitch = { ...g.modelSwitch, pending: undefined, lastFailure: { at: new Date().toISOString(), reason } };
+          if (g.status === "active") {
+            g.status = "blocked";
+            g.blocker = { reason: "Pending model switch was not accepted.", needed: "Discover available models, switch the same goal explicitly, then retry when safe.", at: new Date().toISOString() };
+          }
+          g.updatedAt = new Date().toISOString();
+        }
+        if (rt) {
+          Object.assign(rt, releaseLease(rt));
+          rt.retryAfter = undefined;
+        }
+        return s;
+      });
+      throw new Error("Pending model switch was not accepted; goal blocked without replacing its worker.");
+    }
+  }
+  async function observeProviderErrorUnlocked(directory, goalID, error, source, expectedModel) {
+    const state = await readState(directory);
+    const goal = state.goals.find((g) => g.id === goalID);
+    if (!goal)
+      return;
+    const observation = observeProviderLimit(error, source, expectedModel ?? goal.config.model);
+    if (!observation)
+      return;
+    const fallbackModels = goal.config.fallbackModels ?? [];
+    const attempted = new Set(goal.modelFallback?.attempted ?? []);
+    if (goal.config.model)
+      attempted.add(goal.config.model);
+    let pending;
+    let status = "disabled";
+    const runtime = state.runtimes.find((r) => r.goalID === goalID);
+    const quotaBlocked = goal.status === "blocked" && runtime?.lastError === describeError(error);
+    const sameModel = expectedModel === undefined || expectedModel === goal.config.model;
+    const eligible = sameModel && !goal.pendingIdentity && (goal.status === "active" || quotaBlocked) && (!goal.modelSwitch?.pending || goal.modelSwitch.pending.reason === "quota");
+    if (eligible && goal.modelSwitch?.pending?.reason === "quota") {
+      pending = { ...goal.modelSwitch.pending, reason: "quota" };
+      status = "prepared";
+    } else if (eligible && fallbackModels.length) {
+      const catalog = await listModels();
+      if (catalog.capability === "unsupported" || catalog.switching === "unsupported" || !host.switchSessionModel)
+        status = "unsupported";
+      else if (catalog.capability !== "supported")
+        status = "unavailable";
+      else {
+        status = "exhausted";
+        for (const value of fallbackModels) {
+          if (attempted.has(value))
+            continue;
+          attempted.add(value);
+          const ref = parseModelRef(value);
+          if (ref && catalog.models.some((m) => m.providerID === ref.providerID && m.modelID === ref.modelID && m.usable === true)) {
+            pending = { model: value, requestedAt: new Date().toISOString(), reason: "quota" };
+            status = "prepared";
+            break;
+          }
+        }
+      }
+    }
+    await mutateState(directory, `goal.provider-limit:${goalID}`, async (s) => {
+      const g = s.goals.find((g) => g.id === goalID);
+      const rt = s.runtimes.find((r) => r.goalID === goalID);
+      if (!g)
+        return s;
+      g.lastProviderLimit = observation;
+      if (sameModel && g.status === "blocked" && g.blocker && rt?.lastError === describeError(error))
+        g.blocker.kind = "provider-limit";
+      if (eligible) {
+        g.modelFallback = { attempted: [...attempted], status };
+        if (pending && (!g.modelSwitch?.pending || g.modelSwitch.pending.reason === "quota")) {
+          g.modelSwitch = { ...g.modelSwitch, pending };
+        }
+      }
+      if (rt?.phase === "waiting_retry" && observation.retryAt && Date.parse(observation.retryAt) > Date.parse(rt.retryAfter ?? ""))
+        rt.retryAfter = observation.retryAt;
+      g.updatedAt = new Date().toISOString();
+      return s;
+    });
+    await logServerEvent(directory, "goal.provider-limit", { goalID, model: goal.config.model, kind: observation.kind, source, fallbackStatus: status, to: pending?.model });
+  }
+  function observeProviderError(directory, goalID, error, source, expectedModel) {
+    return withGoalOperation(goalID, () => observeProviderErrorUnlocked(directory, goalID, error, source, expectedModel));
+  }
+  function compact(directory, goalID) {
+    return withGoalOperation(goalID, async () => {
+      const state = await readState(directory);
+      const goal = state.goals.find((g) => g.id === goalID);
+      if (!goal?.workerSessionID || goal.status !== "active")
+        return;
+      if (await host.sessionStatus(goal.workerSessionID) !== "idle")
+        return;
+      await applyPendingIdentity(directory, goal);
+      await applyPendingModel(directory, goal);
+      await applyPendingAgent(directory, goal);
+      const fresh = (await readState(directory)).goals.find((g) => g.id === goalID);
+      if (fresh?.workerSessionID)
+        await host.compactSession(fresh.workerSessionID, parseModelRef(fresh.config.model));
+    });
+  }
   async function recordPromptFailure(directory, goalID, error, blockImmediately = false) {
     const detail = describeError(error);
     let runID = "unknown";
@@ -3539,6 +4298,7 @@ function createGoalService(host) {
         revision: state.revision
       });
     }
+    await observeProviderErrorUnlocked(directory, goalID, error, "prompt-delivery");
   }
   async function ensureWorkerSession(directory, goal) {
     let session = sessions.get(goal.id);
@@ -3573,6 +4333,20 @@ function createGoalService(host) {
     return withGoalOperation(id, () => startUnlocked(directory, input, id));
   }
   async function startUnlocked(directory, input, id) {
+    if (input.config?.fallbackModels?.length) {
+      if (input.config.fallbackModels.length > 16)
+        throw new Error("At most 16 ordered fallback models are allowed.");
+      const catalog = await listModels();
+      for (const value of input.config.fallbackModels) {
+        const ref = parseModelRef(value);
+        if (!ref)
+          throw new Error("Fallback model must be providerID/modelID.");
+        if (catalog.capability === "supported" && !catalog.models.some((m) => m.providerID === ref.providerID && m.modelID === ref.modelID && m.usable === true)) {
+          throw new Error("Fallback model is unavailable or not positively known usable.");
+        }
+      }
+      input.config.fallbackModels = [...new Set(input.config.fallbackModels.map((m) => m.trim()))];
+    }
     let parentAgent = input.parentAgent;
     let parentModel = input.parentModel;
     if ((!parentAgent || !parentModel) && host.readSession) {
@@ -3598,6 +4372,8 @@ function createGoalService(host) {
     });
     if (typeof input.costBudget === "number")
       goal.costBudget = input.costBudget;
+    if (input.interactive === true)
+      goal.interactive = true;
     if (parentAgent)
       goal.parentAgent = parentAgent;
     if (parentModel)
@@ -3800,6 +4576,13 @@ function createGoalService(host) {
       return;
     if (!opts?.force && !await workers.isIdle(session.workerSessionID))
       return;
+    if (goal.pendingIdentity || goal.modelSwitch?.pending || goal.agentSwitch?.pending) {
+      if (await host.sessionStatus(session.workerSessionID) !== "idle")
+        return;
+      await applyPendingIdentity(directory, goal);
+      await applyPendingModel(directory, goal);
+      await applyPendingAgent(directory, goal);
+    }
     let acquired = false;
     const state = await mutateState(directory, `turn.acquire:${goalID}`, async (s) => {
       const g = s.goals.find((item) => item.id === goalID);
@@ -3902,6 +4685,38 @@ function createGoalService(host) {
       throw error;
     }
   }
+  async function setInteractiveUnlocked(directory, goalID, interactive) {
+    const state = await mutateState(directory, `goal.interactive:${goalID}`, async (s) => {
+      const g = s.goals.find((item) => item.id === goalID);
+      if (!g)
+        return s;
+      if (interactive)
+        g.interactive = true;
+      else
+        delete g.interactive;
+      g.updatedAt = new Date().toISOString();
+      return s;
+    });
+    const goal = state.goals.find((g) => g.id === goalID);
+    if (!goal)
+      return { ok: false, message: "Goal not found." };
+    await appendEvent(directory, {
+      version: 1,
+      eventID: randomUUID5(),
+      goalID,
+      type: "goal.interactive_changed",
+      interactive,
+      timestamp: new Date().toISOString(),
+      revision: state.revision
+    }).catch(() => {});
+    return {
+      ok: true,
+      message: interactive ? `Goal "${goal.name}" is now manual: the engine will not start turns \u2014 steer it with :send/nudge.` : `Goal "${goal.name}" is back on auto: the engine resumes idle recovery and retries.`
+    };
+  }
+  function setInteractive(directory, goalID, interactive) {
+    return withGoalOperation(goalID, () => setInteractiveUnlocked(directory, goalID, interactive));
+  }
   async function pauseUnlocked(directory, goalID) {
     const preState = await readState(directory);
     const goal = preState.goals.find((g) => g.id === goalID);
@@ -4264,7 +5079,7 @@ function createGoalService(host) {
   function accountUsage(directory, goalID) {
     return withGoalOperation(goalID, () => accountUsageUnlocked(directory, goalID));
   }
-  return { start, continueTurn, nudge, pause, resume, retry, clear, getWorker, getActiveWorkers, reconcile, accountUsage, abortWorker, sendUserMessage };
+  return { start, continueTurn, nudge, pause, resume, retry, clear, getWorker, getActiveWorkers, reconcile, accountUsage, abortWorker, sendUserMessage, setInteractive, listModels, switchModel, listAgents, switchAgent, switchIdentity, observeProviderError, compact };
 }
 
 // src/application/schedule-worker.ts
@@ -5621,7 +6436,8 @@ function createCommandService(host, opts) {
       c.exitCode = info.exitCode;
       if (info.signal && (c.signal === "SIGKILL" || c.signal === "SIGTERM")) {
         c.status = "terminated";
-        c.endReason = "terminate";
+        if (c.endReason !== "until")
+          c.endReason = "terminate";
       } else {
         c.status = "exited";
         c.endReason = "exit";
@@ -5917,6 +6733,9 @@ function createCommandService(host, opts) {
         const c = (s.commands ?? []).find((x) => x.id === id);
         if (c && c.ownerSessionID === ownerSessionID && c.status === "running") {
           c.signal = "SIGTERM";
+          if (c.endReason !== "timeout" && c.watchState?.state === "until-matched" && c.watchUntilAction === "stop") {
+            c.endReason = "until";
+          }
           c.updatedAt = new Date().toISOString();
         }
         return s;
@@ -5955,8 +6774,9 @@ function createCommandService(host, opts) {
           return s;
         if (c.status === "running") {
           c.status = status;
-          if (c.endReason !== "timeout")
-            c.endReason = status === "terminated" ? "terminate" : "exit";
+          if (c.endReason !== "timeout") {
+            c.endReason = status === "terminated" ? c.endReason === "until" ? "until" : "terminate" : "exit";
+          }
           if (exitCode !== undefined)
             c.exitCode = c.exitCode ?? exitCode;
           c.signal = c.signal ?? "SIGTERM";
@@ -6793,6 +7613,7 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
         objective: tool.schema.string().describe("What the goal should accomplish, in detail."),
         agent: tool.schema.string().optional().describe(`Agent to run the worker as (e.g. "researcher", "smart-agent"). Prefer omit \u2014 inherits the calling session's agent if omitted, else plugin defaultAgent. Only pass when explicitly requested.`),
         model: tool.schema.string().optional().describe(`Model to run the worker as, as "providerID/modelID" (e.g. "openai/gpt-5.6-sol", "ollama/qwen3.8:27b"). Prefer omit \u2014 inherits the calling session's live model if omitted, else plugin defaultModel. Only pass when explicitly requested.`),
+        fallbackModels: tool.schema.array(tool.schema.string()).optional().describe("Explicit ordered providerID/modelID alternatives for provider quota/rate-limit failures only. Default empty: no automatic paid/provider switch. Discover with loopd_list_models; same worker/session retained. Interactive goals never auto-wake."),
         costBudget: tool.schema.number().optional().describe("Max provider cost in dollars before the engine stops the goal as budget_limited (e.g. 0.5). Optional \u2014 unlimited if omitted."),
         checks: tool.schema.array(tool.schema.string()).optional().describe('Shell commands that must pass for completion to be accepted. E.g. ["npm test"].'),
         checkCwd: tool.schema.string().optional().describe("Directory where completion checks run. Workspace-writing goals default to the project root."),
@@ -6804,7 +7625,8 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
         compactEvery: tool.schema.number().optional().describe("Compact the worker session every N turns."),
         timeoutMs: tool.schema.number().optional().describe("Per-turn timeout in ms."),
         scheduleEveryMs: tool.schema.number().optional().describe("Interval in ms to auto-requeue the same goal after each completion. Minimum 1000. Enables repetitive dialogue reduction."),
-        scheduleMaxRuns: tool.schema.number().optional().describe("Maximum total runs including the initial run. Undefined = unlimited. Requires scheduleEveryMs.")
+        scheduleMaxRuns: tool.schema.number().optional().describe("Maximum total runs including the initial run. Undefined = unlimited. Requires scheduleEveryMs."),
+        interactive: tool.schema.boolean().optional().describe("Manual mode: the engine never starts turns on its own (no idle recovery, no retries). Every turn comes from explicit steering (:send, nudge, resume, retry). Use for interactive tasks where the worker stops and waits for the next input \u2014 the tick forcing a turn there wastes tokens and breaks the wait. Toggleable later via the dashboard :interactive command.")
       },
       execute: async (args, context) => {
         const sessionID = context?.sessionID || hostSessionID;
@@ -6824,6 +7646,8 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
           config.agent = args.agent;
         if (args.model)
           config.model = args.model;
+        if (args.fallbackModels)
+          config.fallbackModels = args.fallbackModels;
         if (args.checks)
           config.checks = args.checks;
         if (args.checkCwd)
@@ -6899,7 +7723,8 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
             config: resolution.config,
             costBudget,
             parentAgent: parentDefaults.parentAgent,
-            parentModel: parentDefaults.parentModel
+            parentModel: parentDefaults.parentModel,
+            ...args.interactive === true ? { interactive: true } : {}
           });
           return {
             title: "Goal created",
@@ -6913,6 +7738,7 @@ function goalTools(dir, goalService, hostSessionID, defaults = {}, host) {
               agent: resolution.config.agent,
               model: resolution.config.model,
               costBudget: goal.costBudget,
+              interactive: goal.interactive === true,
               checks: resolution.config.checks || [],
               workspaceWrite: resolution.config.workspaceWrite,
               defaultsApplied: resolution.defaultsApplied,
@@ -7457,6 +8283,61 @@ function withTimeout2(promise, ms) {
 function ownerTools(options) {
   const { directory, host, goalService } = options;
   return {
+    loopd_list_models: tool2({
+      description: "Discover host providers/models and available OpenCode agents, inspect quota limitations plus assigned identities of this session's existing goals. " + "Remaining quota is unknown unless a supported integration reports it; connected/enabled is not remaining balance. " + "Workflow: discover -> inspect_background_goal for last local quota error -> switch_goal_identity on the SAME goal, never create a duplicate to change provider. No secrets/auth data are returned.",
+      args: {},
+      execute: async (_args, context) => {
+        if (!context?.sessionID)
+          return { title: "No session", output: JSON.stringify({ ok: false, message: "No session context available." }) };
+        const [catalog, agentCatalog, state] = await Promise.all([goalService.listModels(), goalService.listAgents(), readState(directory)]);
+        return {
+          title: "Provider/model capabilities",
+          output: JSON.stringify({
+            ok: true,
+            ...catalog,
+            agents: agentCatalog.agents,
+            agentCatalog,
+            assignedGoals: state.goals.filter((g) => g.ownerSessionID === context.sessionID).map((g) => ({
+              id: g.id,
+              model: g.config.model,
+              agent: g.config.agent,
+              agentSwitch: g.agentSwitch,
+              pendingIdentity: g.pendingIdentity,
+              workerSessionID: g.workerSessionID,
+              modelSwitch: g.modelSwitch,
+              modelFallback: g.modelFallback,
+              fallbackModels: g.config.fallbackModels ?? [],
+              lastProviderLimit: g.lastProviderLimit
+            }))
+          }, null, 2)
+        };
+      }
+    }),
+    switch_goal_identity: tool2({
+      description: "Switch an EXISTING owned goal's model, agent, or both atomically, preserving the same worker/session, transcript, progress, inbox, checks, budgets and topology. At least one of model or agent is required. Discover identities with loopd_list_models first. Busy workers defer until the next permitted idle turn; legacy hosts apply on the next prompt. No implicit unpause or interactive wake. resume=true explicitly resumes only a blocked goal after a safe switch (model-only requires a provider-limit blocker); busy requests remain blocked until explicitly retried/resumed when idle. Combined host failures roll back successful changes; rollback failure requires inspecting the existing session.",
+      args: {
+        goal_id: tool2.schema.string().describe("Existing owned goal ID."),
+        agent: tool2.schema.string().optional().describe("Available agent name from loopd_list_models."),
+        model: tool2.schema.string().optional().describe("Available providerID/modelID from loopd_list_models. Provide model, agent, or both."),
+        resume: tool2.schema.boolean().optional().describe("Explicitly resume a blocked goal after a safe switch. Default false.")
+      },
+      execute: async (args, context) => {
+        if (!context?.sessionID)
+          return { title: "No session", output: JSON.stringify({ ok: false, message: "No session context available." }) };
+        if (args.model === undefined && args.agent === undefined)
+          return { title: "Identity switch failed", output: JSON.stringify({ ok: false, message: "At least one of model or agent is required." }) };
+        const state = await readState(directory);
+        if (!state.goals.some((g) => g.id === args.goal_id && g.ownerSessionID === context.sessionID)) {
+          return { title: "Switch denied", output: JSON.stringify({ ok: false, message: "Goal not found or not owned by this session." }) };
+        }
+        try {
+          const result = await goalService.switchIdentity(directory, args.goal_id, context.sessionID, args);
+          return { title: `Identity switch: ${result.outcome}`, output: JSON.stringify({ ok: result.outcome !== "unsupported", ...result, goalID: args.goal_id, message: "Same goal and worker retained. Deferred requests require the next permitted idle turn; no automatic interactive wake." }) };
+        } catch {
+          return { title: "Identity switch failed", output: JSON.stringify({ ok: false, message: "Switch rejected: verify ownership, identity availability, resume eligibility and host capability with loopd_list_models and inspect_background_goal. Existing goal/session retained. Inspect live session identity before retrying if host rollback failed." }) };
+        }
+      }
+    }),
     list_background_goals: tool2({
       description: "List all active background goals owned by this session. Shows contract (name, status, phase, turn, last progress, blocker) \u2014 only goals with your ownerSessionID appear.",
       args: {},
@@ -7498,6 +8379,13 @@ function ownerTools(options) {
             maxTurns: g.config.maxTurns,
             agent: g.config.agent,
             model: g.config.model,
+            modelSwitch: g.modelSwitch,
+            agentSwitch: g.agentSwitch,
+            pendingIdentity: g.pendingIdentity,
+            modelFallback: g.modelFallback,
+            lastProviderLimit: g.lastProviderLimit,
+            fallbackModels: g.config.fallbackModels ?? [],
+            quotaLimitation: "Remaining provider quota unknown; connected/enabled is not balance data. See loopd_list_models.",
             lastProgress: g.lastProgress?.summary?.slice(0, 120),
             lastProgressAt: g.lastProgress?.at,
             blocker: g.blocker?.reason?.slice(0, 120),
@@ -7594,11 +8482,18 @@ function ownerTools(options) {
               workspaceWrite: goal.config.workspaceWrite,
               agent: goal.config.agent,
               model: goal.config.model,
+              fallbackModels: goal.config.fallbackModels ?? [],
               parentAgent: goal.parentAgent,
               parentModel: goal.parentModel,
               schedule: goal.config.schedule
             },
             lastProgress: goal.lastProgress,
+            modelSwitch: goal.modelSwitch,
+            agentSwitch: goal.agentSwitch,
+            pendingIdentity: goal.pendingIdentity,
+            modelFallback: goal.modelFallback,
+            lastProviderLimit: goal.lastProviderLimit,
+            quotaLimitation: "Remaining provider quota unknown; local quota errors are observations, not balance data. See loopd_list_models.",
             completionEvidence: goal.completionEvidence,
             blocker: goal.blocker,
             tokensUsed: goal.tokensUsed,
@@ -8080,7 +8975,7 @@ function commandTools(options) {
   const sizeNote = capabilities.resize ? "applied live to the PTY winsize" : "stored; resize is unsupported by the pipe host";
   return {
     loopd_command_start: tool3({
-      description: "PREFER THIS over the built-in shell/bash tool whenever a command might take a while or never return: installs (npm/pip/brew/cargo...), builds, test suites, downloads, migrations, dev servers, watchers, log tails, REPLs, or anything interactive. The built-in shell BLOCKS your whole turn until the process exits \u2014 a long install freezes you (and can time out); this returns immediately with a command_id and pushes you a message on exit or pattern match, so you stay responsive and can do other work meanwhile. Only use the built-in shell for quick one-shots (ls, git status, a single fast test) that finish in seconds. " + "Start a standalone interactive OS process (arbitrary shell command) in the background \u2014 a dev server, `npm test --watch`, a REPL, a log tail, a build, or a one-off script. This is a raw process, NOT an AI worker: no agent, no checks, no turn loop. For multi-turn autonomous AI work with completion criteria, use loopd_create_goal instead. " + "Returns a command_id for loopd_command_get (read output)/loopd_command_write (send stdin)/loopd_command_interrupt (Ctrl+C)/loopd_command_terminate (kill)/loopd_command_remove (delete). " + "The user can also open it live: /loop or /commands \u2192 Tab/l to the Commands tab \u2192 select it \u2192 `o` opens a fullscreen interactive terminal page (type directly, Ctrl+C interrupts, Ctrl+] detaches without stopping it). " + "Independent from goals: an optional goal_id is display-only metadata and never couples lifecycles \u2014 pausing/clearing a goal never touches the command, and terminating a command never touches the goal. " + "To make a specific goal wake up when this command finishes, call loopd_command_await separately after starting it (linking alone does not wake anything). " + "The OWNER session gets a notification on natural exit (including code 0), missing process, or timeout \u2014 no polling required for completion. Manual terminate stays silent by default. Raw PTY output stays in the log; any short tail included in the notification is sanitized for chat. Set notify_on_exit:false to suppress owner exit notifications.",
+      description: "PREFER THIS over the built-in shell/bash tool whenever a command might take a while or never return: installs (npm/pip/brew/cargo...), builds, test suites, downloads, migrations, dev servers, watchers, log tails, REPLs, or anything interactive. The built-in shell BLOCKS your whole turn until the process exits \u2014 a long install freezes you (and can time out); this returns immediately with a command_id and pushes you a message on exit or pattern match, so you stay responsive and can do other work meanwhile. Only use the built-in shell for quick one-shots (ls, git status, a single fast test) that finish in seconds. " + "Start a standalone interactive OS process (arbitrary shell command) in the background \u2014 a dev server, `npm test --watch`, a REPL, a log tail, a build, or a one-off script. This is a raw process, NOT an AI worker: no agent, no checks, no turn loop. For multi-turn autonomous AI work with completion criteria, use loopd_create_goal instead. " + "Returns a command_id for loopd_command_get (read output)/loopd_command_write (send stdin)/loopd_command_interrupt (Ctrl+C)/loopd_command_terminate (kill)/loopd_command_remove (delete). " + "The user can also open it live: /loop or /commands \u2192 Tab/l to the Commands tab \u2192 select it \u2192 `o` opens a fullscreen interactive terminal page (type directly, Ctrl+C interrupts, Ctrl+] detaches without stopping it). " + "Independent from goals: an optional goal_id is display-only metadata and never couples lifecycles \u2014 pausing/clearing a goal never touches the command, and terminating a command never touches the goal. " + "To make a specific goal wake up when this command finishes, call loopd_command_await separately after starting it (linking alone does not wake anything). " + "The OWNER session gets a notification on natural exit (including code 0), missing process, or timeout \u2014 no polling required for completion. Manual terminate stays silent by default. Raw PTY output stays in the log; any short tail included in the notification is sanitized for chat. Set notify_on_exit:false to suppress owner exit notifications." + " HOW TO WAIT \u2014 declare your wake upfront, then go do other work; you will be pushed. Never poll loopd_command_get in a loop and never sleep-then-read: quick one-shot finishing in seconds \u2192 built-in bash, or start here and read once. " + "Minutes-long or never-exiting where only FINISHING matters \u2192 just start it; the automatic exit/timeout notification is your wake. " + "Never-exiting where a LINE appearing matters (dev-server READY, deploy COMPLETED) \u2192 pass watch_until (+ watch_filter to cut noise); stop (default) ends the command with exactly one message, keep lets it run on. " + "A GOAL worker that must block until that happens \u2192 call loopd_command_await (passing goal_id alone never wakes anything). " + "Polling the WORLD inside the command (a shell loop curling an endpoint until it flips) is fine and costs no turns; polling loopd from YOUR side is the forbidden pattern \u2014 one mid-run peek is fine, a timer loop is not. " + "Emit a printed marker line for EVERY outcome (DONE and FAILED), or a silent failure wakes nobody. " + "Watches longer than ~30min are fragile (in-memory only, die on restart) \u2014 prefer a scheduled goal that checks state and completes.",
       args: {
         title: tool3.schema.string().describe("Short human label for the session."),
         command: tool3.schema.string().describe('Executable to spawn (e.g. "bun", "python3").'),
@@ -8341,7 +9236,7 @@ function commandTools(options) {
 // src/server/plugin.ts
 init_state_repository();
 // package.json
-var version = "1.10.5";
+var version = "1.12.2";
 
 // src/server/plugin.ts
 var PLUGIN_ID = "opencode-loopd.server";