@cjhyy/code-shell-core 0.8.2 → 0.8.4

package/dist/session/transcript.d.ts

@@ -48,10 +48,18 @@ export declare class Transcript {
     private filePath;
     private currentTurn;
     private readonly writer;
+    private readonly persistent;
     private dirty;
     private lastFlushFailure;
     getFilePath(): string;
-    constructor(filePath: string, writer?: TranscriptWriter);
+    constructor(filePath: string, writer?: TranscriptWriter, options?: {
+        persistent?: boolean;
+    });
+    /** A process-local transcript that never creates or appends a file. */
+    static inMemory(label: string): Transcript;
+    /** Rehydrate a process-local fork without serializing its copied history. */
+    static fromMemoryEvents(label: string, events: readonly TranscriptEvent[]): Transcript;
+    isPersistent(): boolean;
     append(type: TranscriptEventType, data: Record<string, unknown>): TranscriptEvent;
     /**
      * Append a chat message to the transcript.
@@ -116,9 +124,16 @@ export declare class Transcript {
     private errorErrno;
     private errorMessage;
     /**
-     * Repair tool_result pairing issues:
-     * - Orphaned tool_results (no matching tool_use) get removed
-     * - Missing tool_results (tool_use with no result) get synthetic error results
+     * Normalize tool_result pairing in this detached in-memory snapshot:
+     * - orphaned results are removed;
+     * - duplicate results collapse to one, preferring a real result over the
+     *   legacy synthetic interrupted placeholder;
+     * - missing results remain missing. The run-resume boundary patches those
+     *   in its request-local Message[] after it has established ownership.
+     *
+     * This method must never append to the JSONL file. loadFromFile is used by
+     * read-only/background consumers while another run may be waiting for tool
+     * approval; persisting a synthetic result there races the real executor.
      */
     repairToolResultPairs(): void;
     static readEvents(filePath: string): ParsedEvents;
@@ -133,5 +148,6 @@ export declare class Transcript {
      */
     static selectContextRange(events: readonly TranscriptEvent[], range: ContextEventRange): SelectedContextRange;
     static loadFromFile(filePath: string): Transcript;
+    private loadEvents;
 }
 export {};

package/dist/session/transcript.js

@@ -13,24 +13,84 @@ const CONTEXT_EVENT_TYPES = new Set([
     "summary",
     "context_transfer",
 ]);
+const INTERRUPTED_TOOL_RESULT_ERROR = "[Tool result missing due to interrupted session]";
+function isSyntheticInterruptedToolResult(event) {
+    return (event.type === "tool_result" &&
+        event.data.toolName === "unknown" &&
+        event.data.error === INTERRUPTED_TOOL_RESULT_ERROR);
+}
+/**
+ * Choose at most one result for every declared tool call. A real late result
+ * wins over the legacy synthetic "interrupted" placeholder that an older
+ * reader could persist while the tool was merely waiting for approval.
+ */
+function preferredToolResults(events) {
+    const toolUseIds = new Set();
+    for (const event of events) {
+        if (event.type === "tool_use" && typeof event.data.toolCallId === "string") {
+            toolUseIds.add(event.data.toolCallId);
+        }
+        if (event.type === "message" &&
+            event.data.role === "assistant" &&
+            Array.isArray(event.data.content)) {
+            for (const block of event.data.content) {
+                if (block.type === "tool_use" && typeof block.id === "string") {
+                    toolUseIds.add(block.id);
+                }
+            }
+        }
+    }
+    const preferred = new Map();
+    for (const event of events) {
+        if (event.type !== "tool_result")
+            continue;
+        const toolCallId = event.data.toolCallId;
+        if (typeof toolCallId !== "string" || !toolUseIds.has(toolCallId))
+            continue;
+        const current = preferred.get(toolCallId);
+        if (!current ||
+            isSyntheticInterruptedToolResult(current) ||
+            !isSyntheticInterruptedToolResult(event)) {
+            preferred.set(toolCallId, event);
+        }
+    }
+    return preferred;
+}
 export class Transcript {
     events = [];
     filePath;
     currentTurn = 0;
     writer;
+    persistent;
     dirty = false;
     lastFlushFailure;
     getFilePath() {
         return this.filePath;
     }
-    constructor(filePath, writer = appendFileSync) {
+    constructor(filePath, writer = appendFileSync, options = {}) {
         this.filePath = filePath;
         this.writer = writer;
+        this.persistent = options.persistent !== false;
+        if (!this.persistent)
+            return;
         mkdirSync(dirname(filePath), { recursive: true });
         if (!existsSync(filePath)) {
             writeFileSync(filePath, "", "utf-8");
         }
     }
+    /** A process-local transcript that never creates or appends a file. */
+    static inMemory(label) {
+        return new Transcript(`<memory:${label}>`, () => undefined, { persistent: false });
+    }
+    /** Rehydrate a process-local fork without serializing its copied history. */
+    static fromMemoryEvents(label, events) {
+        const transcript = Transcript.inMemory(label);
+        transcript.loadEvents(events);
+        return transcript;
+    }
+    isPersistent() {
+        return this.persistent;
+    }
     append(type, data) {
         const event = {
             id: nanoid(12),
@@ -161,6 +221,7 @@ export class Transcript {
      */
     toMessages() {
         const messages = [];
+        const selectedToolResults = preferredToolResults(this.events);
         for (const event of this.events) {
             switch (event.type) {
                 case "message": {
@@ -174,6 +235,11 @@ export class Transcript {
                     break;
                 }
                 case "tool_result": {
+                    const eventToolCallId = event.data.toolCallId;
+                    if (typeof eventToolCallId !== "string" ||
+                        selectedToolResults.get(eventToolCallId) !== event) {
+                        break;
+                    }
                     const { toolCallId, result, error, contentBlocks } = event.data;
                     // Find if there's already a user message with tool_results to append to
                     const lastMsg = messages[messages.length - 1];
@@ -243,6 +309,8 @@ export class Transcript {
             event.data.clientMessageId === clientMessageId);
     }
     flush(event) {
+        if (!this.persistent)
+            return true;
         const line = JSON.stringify(event) + "\n";
         try {
             this.writer(this.filePath, line, "utf-8");
@@ -290,39 +358,24 @@ export class Transcript {
         return error instanceof Error ? error.message : String(error);
     }
     /**
-     * Repair tool_result pairing issues:
-     * - Orphaned tool_results (no matching tool_use) get removed
-     * - Missing tool_results (tool_use with no result) get synthetic error results
+     * Normalize tool_result pairing in this detached in-memory snapshot:
+     * - orphaned results are removed;
+     * - duplicate results collapse to one, preferring a real result over the
+     *   legacy synthetic interrupted placeholder;
+     * - missing results remain missing. The run-resume boundary patches those
+     *   in its request-local Message[] after it has established ownership.
+     *
+     * This method must never append to the JSONL file. loadFromFile is used by
+     * read-only/background consumers while another run may be waiting for tool
+     * approval; persisting a synthetic result there races the real executor.
      */
     repairToolResultPairs() {
-        const toolUseIds = new Set();
-        const toolResultIds = new Set();
-        for (const event of this.events) {
-            if (event.type === "tool_use") {
-                toolUseIds.add(event.data.toolCallId);
-            }
-            else if (event.type === "tool_result") {
-                toolResultIds.add(event.data.toolCallId);
-            }
-        }
-        // Find tool_use events without matching tool_result
-        for (const id of toolUseIds) {
-            if (!toolResultIds.has(id)) {
-                // Synthesize an error result
-                this.append("tool_result", {
-                    toolCallId: id,
-                    toolName: "unknown",
-                    error: "[Tool result missing due to interrupted session]",
-                });
-            }
-        }
-        // Remove orphaned tool_results (result without matching use)
+        const selectedToolResults = preferredToolResults(this.events);
         this.events = this.events.filter((event) => {
-            if (event.type === "tool_result") {
-                const id = event.data.toolCallId;
-                return toolUseIds.has(id);
-            }
-            return true;
+            if (event.type !== "tool_result")
+                return true;
+            const toolCallId = event.data.toolCallId;
+            return typeof toolCallId === "string" && selectedToolResults.get(toolCallId) === event;
         });
     }
     static readEvents(filePath) {
@@ -436,22 +489,30 @@ export class Transcript {
             return transcript;
         const content = readFileSync(filePath, "utf-8");
         const lines = content.split("\n").filter((l) => l.trim());
+        const events = [];
         for (const line of lines) {
             try {
-                const event = JSON.parse(line);
-                transcript.events.push(event);
-                if (event.type === "turn_boundary") {
-                    transcript.currentTurn = event.data.turnNumber ?? transcript.currentTurn + 1;
-                }
+                events.push(JSON.parse(line));
             }
             catch {
                 // Skip malformed lines
             }
         }
+        transcript.loadEvents(events);
         // Repair pairing on load
         transcript.repairToolResultPairs();
         return transcript;
     }
+    loadEvents(events) {
+        this.events = structuredClone([...events]);
+        this.currentTurn = 0;
+        for (const event of this.events) {
+            if (event.type === "turn_boundary") {
+                this.currentTurn =
+                    typeof event.data.turnNumber === "number" ? event.data.turnNumber : this.currentTurn + 1;
+            }
+        }
+    }
 }
 function isEngineResultReceipt(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))

package/dist/settings/schema.d.ts

@@ -118,14 +118,47 @@ export declare const SettingsSchema: z.ZodObject<{
          * Default on.
          */
         memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Mimi-only presentation and standing preferences. These are injected
+         * only into Pet manager turns; ordinary work Sessions continue to use
+         * the separate agent.* personalization fields above.
+         */
+        personalization: z.ZodOptional<z.ZodObject<{
+            responseLanguage: z.ZodOptional<z.ZodString>;
+            userProfile: z.ZodOptional<z.ZodString>;
+            communicationStyle: z.ZodOptional<z.ZodString>;
+            customInstructions: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         showExternalCodexSessions: boolean;
         showExternalClaudeSessions: boolean;
         memoryAutoExtract: boolean;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }, {
         showExternalCodexSessions?: boolean | undefined;
         showExternalClaudeSessions?: boolean | undefined;
         memoryAutoExtract?: boolean | undefined;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers
@@ -1109,14 +1142,47 @@ export declare const SettingsSchema: z.ZodObject<{
          * Default on.
          */
         memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Mimi-only presentation and standing preferences. These are injected
+         * only into Pet manager turns; ordinary work Sessions continue to use
+         * the separate agent.* personalization fields above.
+         */
+        personalization: z.ZodOptional<z.ZodObject<{
+            responseLanguage: z.ZodOptional<z.ZodString>;
+            userProfile: z.ZodOptional<z.ZodString>;
+            communicationStyle: z.ZodOptional<z.ZodString>;
+            customInstructions: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         showExternalCodexSessions: boolean;
         showExternalClaudeSessions: boolean;
         memoryAutoExtract: boolean;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }, {
         showExternalCodexSessions?: boolean | undefined;
         showExternalClaudeSessions?: boolean | undefined;
         memoryAutoExtract?: boolean | undefined;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers
@@ -2100,14 +2166,47 @@ export declare const SettingsSchema: z.ZodObject<{
          * Default on.
          */
         memoryAutoExtract: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Mimi-only presentation and standing preferences. These are injected
+         * only into Pet manager turns; ordinary work Sessions continue to use
+         * the separate agent.* personalization fields above.
+         */
+        personalization: z.ZodOptional<z.ZodObject<{
+            responseLanguage: z.ZodOptional<z.ZodString>;
+            userProfile: z.ZodOptional<z.ZodString>;
+            communicationStyle: z.ZodOptional<z.ZodString>;
+            customInstructions: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }, {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
         showExternalCodexSessions: boolean;
         showExternalClaudeSessions: boolean;
         memoryAutoExtract: boolean;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }, {
         showExternalCodexSessions?: boolean | undefined;
         showExternalClaudeSessions?: boolean | undefined;
         memoryAutoExtract?: boolean | undefined;
+        personalization?: {
+            responseLanguage?: string | undefined;
+            userProfile?: string | undefined;
+            communicationStyle?: string | undefined;
+            customInstructions?: string | undefined;
+        } | undefined;
     }>>;
     /**
      * Image generation is a general capability, decoupled from LLM providers

package/dist/settings/schema.js

@@ -116,6 +116,19 @@ export const SettingsSchema = z
          * Default on.
          */
         memoryAutoExtract: z.boolean().default(true),
+        /**
+         * Mimi-only presentation and standing preferences. These are injected
+         * only into Pet manager turns; ordinary work Sessions continue to use
+         * the separate agent.* personalization fields above.
+         */
+        personalization: z
+            .object({
+            responseLanguage: z.string().max(120).optional(),
+            userProfile: z.string().max(2_000).optional(),
+            communicationStyle: z.string().max(2_000).optional(),
+            customInstructions: z.string().max(6_000).optional(),
+        })
+            .optional(),
     })
         .default({}),
     /**

package/dist/tool-system/context.d.ts

@@ -225,6 +225,12 @@ export interface ToolRunYieldController {
 export interface ToolContext {
     /** Active working directory for this Engine. */
     cwd: string;
+    /**
+     * True when this call belongs to an external Agent Runtime rather than the
+     * native Engine loop. Async handoff tools use this to keep their result on
+     * the current turn instead of queueing a wake-up only the Engine can consume.
+     */
+    externalRuntime?: boolean;
     /**
      * Active digital-human profile's portable memory root. Present only when
      * the resolved WorkspaceProfile enables portableMemory for this run.

package/dist/tool-system/external-tool-exposure.js

@@ -9,15 +9,10 @@ export const FIRST_PHASE_EXPOSURE_RATIONALE = [
         tool: "Panel",
         kind: "host-loopback",
         status: "exposed",
-        reason: "Only list/open/tools. These are read-or-focus, and they have a broadcast " +
-            "fallback, so they work without an owning window. invoke stays out for now " +
-            "for a DIFFERENT reason than originally recorded: the owner claim it was " +
-            "waiting on now exists and is wired (ExternalRuntimeService claims before " +
-            "the runtime starts), so the blocker is no longer technical. What is still " +
-            "missing is a per-Panel-App risk review — invoke runs third-party Panel App " +
-            "code with whatever arguments the model supplies, and argsPatterns cannot " +
-            "constrain a nested payload. Enabling it is a policy decision, not a wiring " +
-            "one, and it belongs to whoever reviews the first Panel App to be trusted.",
+        reason: "list/open/tools plus invoke for the reviewed job-hunt-hq tool catalog. The " +
+            "invoke exception is constrained by panel id and exact tool name; the Panel " +
+            "App manifest validates the nested payload. Other Panel Apps remain " +
+            "discovery/focus-only until they receive their own review.",
     },
     {
         // NOTE the names: there is no tool called "Browser". The registry exposes
@@ -65,11 +60,10 @@ export const FIRST_PHASE_EXPOSURE_RATIONALE = [
             "external runtime. If that approval is ever made skippable, this entry must " +
             "go back to excluded.",
     },
-    // ── Still excluded, and for a different KIND of reason ───────────
-    // The four below are not held back out of caution — widening the allowlist
-    // does not make them work. Each is excluded by a structural property that
-    // would have to be designed away first, so listing them would produce a tool
-    // that is advertised and then fails or misbehaves.
+    // ── Delegation and state-machine exceptions ──────────────────────
+    // Agent and the two plan-state tools remain structurally excluded. DriveAgent
+    // is the reviewed exception because the external host forces it into a
+    // foreground, one-level handoff with an observable result.
     {
         tool: "Agent",
         kind: "self-contained",
@@ -82,8 +76,21 @@ export const FIRST_PHASE_EXPOSURE_RATIONALE = [
     {
         tool: "DriveAgent",
         kind: "self-contained",
-        status: "excluded",
-        reason: "Same recursion hazard as Agent (§12.5).",
+        status: "exposed",
+        reason: "Delegates one bounded task to an installed Codex/Claude CLI. External " +
+            "sessions force foreground execution and disable automatic background " +
+            "handoff, so the parent turn receives the result instead of losing a wake-up " +
+            "inside the native Engine queue. The child CLI does not inherit this host " +
+            "bridge, which bounds nesting at one level; the outer call still requires " +
+            "the normal DriveAgent approval.",
+    },
+    {
+        tool: "DriveAgentJobs",
+        kind: "self-contained",
+        status: "exposed",
+        reason: "Lets the runtime inspect or cancel retained DriveAgent jobs. New external " +
+            "delegations run in the foreground, but retained jobs from the same Session " +
+            "still need an observable cleanup surface.",
     },
     {
         tool: "EnterPlanMode",
@@ -218,17 +225,32 @@ export const FIRST_PHASE_EXPOSURE_RATIONALE = [
  * This is a second, independent layer from the tool's own
  * `defaultPermissionRules`: those decide allow/ask for a call that IS permitted,
  * while this decides whether the action is reachable from an external runtime at
- * all. Both are narrowed to read-only actions in phase one, and `Panel.invoke`
- * additionally fails closed on owner routing — three independent barriers, by
- * design.
+ * all. `Panel.invoke` additionally fails closed on owner routing. Its exception
+ * here is limited to the reviewed job-hunt-hq panel and exact tool names; write
+ * operations still pass through Panel's schema, owner routing, permission rules,
+ * and approval handling.
  */
+const JOB_HUNT_TOOL_NAMES = [
+    "get_job_search_context",
+    "save_candidate_context",
+    "save_job_opportunities",
+    "save_workflow_progress",
+    "save_job_research",
+    "save_interview_question_set",
+    "save_preparation_plan",
+    "save_interview_debrief",
+    "save_resume_draft",
+].join("|");
+const PANEL_ARGUMENT_PATTERNS = [
+    { action: "list|open|tools" },
+    {
+        action: "invoke",
+        panel_id: "panel-app:job-hunt-hq",
+        tool_name: JOB_HUNT_TOOL_NAMES,
+    },
+];
 const FIRST_PHASE_ARGS_PATTERNS = new Map([
-    // Panel.invoke remains the one action-level restriction. It runs third-party
-    // Panel App code with whatever arguments the model supplies, and argsPatterns
-    // cannot constrain a nested payload — so unlike every tool widened above, the
-    // authorization layer genuinely cannot see what is being authorized. Enabling
-    // it belongs to whoever reviews the first Panel App to be trusted.
-    ["Panel", { action: "list|open|tools" }],
+    ["Panel", PANEL_ARGUMENT_PATTERNS],
 ]);
 /**
  * `ReadonlySet` / `ReadonlyMap` are compile-time only — the underlying `Set` and
@@ -299,6 +321,8 @@ export const FIRST_PHASE_EXPOSURE = Object.freeze({
     toolNames: frozenSet(FIRST_PHASE_EXPOSURE_RATIONALE.filter((entry) => entry.status === "exposed").map((entry) => entry.tool)),
     argsPatterns: frozenMap([...FIRST_PHASE_ARGS_PATTERNS].map(([tool, patterns]) => [
         tool,
-        Object.freeze({ ...patterns }),
+        Array.isArray(patterns)
+            ? Object.freeze(patterns.map((pattern) => Object.freeze({ ...pattern })))
+            : Object.freeze({ ...patterns }),
     ])),
 });

package/dist/tool-system/session-tool-host.d.ts

@@ -61,7 +61,7 @@ export interface ExternalToolExposurePolicy {
      * Panel App) is the tool's own schema validation, not this. Do not treat an
      * `argsPatterns` entry as a sandbox for everything a tool might accept.
      */
-    argsPatterns?: ReadonlyMap<string, Readonly<Record<string, string>>>;
+    argsPatterns?: ReadonlyMap<string, Readonly<Record<string, string>> | readonly Readonly<Record<string, string>>[]>;
 }
 export interface SessionToolHost {
     readonly businessSessionId: string;

package/dist/tool-system/session-tool-host.js

@@ -3,6 +3,7 @@ import { PermissionClassifier } from "./permission.js";
 import { HookRegistry } from "../hooks/registry.js";
 import { buildToolVisibility } from "../engine/run-tooling.js";
 import { composePermissionRules } from "../engine/permission-controller.js";
+import { PLAN_MODE_ALLOWED_TOOLS } from "./plan-mode-allowlist.js";
 const FORBIDDEN_MODES = new Set(["bypassPermissions", "dontAsk"]);
 /**
  * Whole-string match for an exposure pattern.
@@ -27,6 +28,10 @@ function matchesWholeValue(source, value) {
 function argsMatch(patterns, input) {
     if (!patterns)
         return true;
+    const alternatives = Array.isArray(patterns) ? patterns : [patterns];
+    return alternatives.some((alternative) => argsPatternMatches(alternative, input));
+}
+function argsPatternMatches(patterns, input) {
     for (const [key, source] of Object.entries(patterns)) {
         // Read own properties only: a model-supplied JSON body cannot smuggle a
         // match through the prototype chain.
@@ -81,6 +86,7 @@ export function createSessionToolHost(options) {
         // just rejected.
         ...options.contextOverrides,
         sessionId: options.businessSessionId,
+        externalRuntime: true,
         planMode: options.planMode,
         permissionMode: options.permissionMode,
         toolVisibility: buildToolVisibility(options.visibility),
@@ -106,7 +112,12 @@ export function createSessionToolHost(options) {
                 return [];
             return registry
                 .getToolDefinitions()
-                .filter((definition) => exposure.toolNames.has(definition.name));
+                .filter((definition) => exposure.toolNames.has(definition.name))
+                .filter((definition) => !options.planMode || PLAN_MODE_ALLOWED_TOOLS.has(definition.name))
+                .filter((definition) => {
+                const guard = registry.getAvailabilityGuard(definition.name);
+                return !guard || guard(toolCtx.toolVisibility);
+            });
         },
         async execute(call, callSignal) {
             if (disposed) {
@@ -129,6 +140,19 @@ export function createSessionToolHost(options) {
             if (sessionSignal.aborted || callSignal?.aborted) {
                 return failClosed(call.id, call.name, `Tool aborted before execution: ${call.name}`);
             }
+            const emit = async (event) => {
+                try {
+                    await toolCtx.streamCallback?.(event);
+                }
+                catch {
+                    // Stream projection is observational; a broken renderer/recorder must
+                    // not turn an authorized tool execution into an unrelated failure.
+                }
+            };
+            await emit({
+                type: "tool_use_start",
+                toolCall: { id: call.id, toolName: call.name, args: input },
+            });
             // Forward the per-call signal rather than only checking it at entry: an MCP
             // cancellation arriving mid-flight has to actually stop the work.
             //
@@ -139,20 +163,24 @@ export function createSessionToolHost(options) {
             // state. Calls without one use the shared executor unchanged.
             if (!callSignal) {
                 // The one authorized path. Everything above only NARROWS what may reach it.
-                return await executor.executeSingle({
+                const result = await executor.executeSingle({
                     id: call.id,
                     toolName: call.name,
                     args: input,
                 });
+                await emit({ type: "tool_result", result });
+                return result;
             }
             const scoped = new ToolExecutor(registry, permission, hooks);
             scoped.setContext(toolCtx);
             scoped.setSignal(AbortSignal.any([sessionSignal, callSignal]));
-            return await scoped.executeSingle({
+            const result = await scoped.executeSingle({
                 id: call.id,
                 toolName: call.name,
                 args: input,
             });
+            await emit({ type: "tool_result", result });
+            return result;
         },
         async dispose() {
             // Order matters (§13.4): stop accepting new calls, THEN abort in-flight

package/dist/types.d.ts

@@ -298,9 +298,10 @@ export interface SessionState {
     /** User-fork lineage; deliberately separate from sub-agent ownership. */
     forkedFrom?: SessionForkLineage;
     /**
-     * Temporary child sessions are persisted only while their owning surface is
-     * alive. Ordinary resume/session pickers must omit them. Absent on legacy
-     * sessions; desktop also recognizes its historical `qchat-*` namespace.
+     * Temporary child sessions live only in process memory. Ordinary
+     * resume/session pickers omit them, and closing/expiry forgets them instead
+     * of publishing state or transcript files. Absent on legacy sessions;
+     * desktop also recognizes its historical `qchat-*` namespace.
      */
     ephemeral?: boolean;
     /**
@@ -636,6 +637,9 @@ export type StreamEvent = {
     sessionCacheReadTokens?: number;
     sessionCacheCreationTokens?: number;
     sessionPromptTokens?: number;
+    /** Provider-reported completion tokens for the latest and whole thread. */
+    completionTokens?: number;
+    cumulativeCompletionTokens?: number;
     agentId?: string;
 } | {
     type: "background_agent_completed";