@code-yeongyu/senpi 2026.11.10-1 → 2026.11.10-3

package/dist/core/agent-session.js

@@ -96,7 +96,7 @@ import { deliveryIdOf, ExternalAdmission } from "./external-admission.js";
 import { HELD_INPUT_ENTRY, HeldInputs, heldInputHistory } from "./held-inputs.js";
 import { shouldWarnHighReasoning } from "./high-reasoning-warning.js";
 import { customTurnOrigin, inputAttributionOf, inputOriginOf } from "./input-origin.js";
-import { copyInputTurnMark, hasInputTurnMark, inputTurnMark, markInputTurnOrigin, noteRunStart, noteUserMessageStart, } from "./turn-origin.js";
+import { copyInputTurnMark, endTurnContinuation, hasInputTurnMark, inputTurnMark, markInputTurnOrigin, noteRunStart, noteTurnContinuation, recordIsDelegated, noteUserMessageStart, } from "./turn-origin.js";
 import { releaseDecisionPreset } from "./permission-decision.js";
 import { markInterrupted } from "./interrupted-tool-result.js";
 import { deliveredReceipts, itemNoticeMessage, QueuedDeliveryCleared, } from "./itemized-send.js";
@@ -134,6 +134,7 @@ import { followProviderAccountChanges, RetryFallbackController, } from "./retry-
 import { SelectorCooldowns } from "./retry-fallback/cooldown.js";
 import { classifyRateLimitedWait, degradeWithoutFallback, nextInTurnDelayMs, probeBackSchedule, } from "./retry-fallback/hint-policy.js";
 import { createFallbackLogger } from "./retry-fallback/log.js";
+import { redactAssistantErrorText } from "./assistant-error-redaction.js";
 import { createModelConfigErrorReporter, isModelConfigFailure, } from "./retry-fallback/model-config-error.js";
 import { ProbeBackScheduler } from "./retry-fallback/probe-scheduler.js";
 import { REQUEST_SHAPE_FAILURE_TEXT, REQUEST_SHAPE_RECOVERY_ENTRY_TYPE, REQUEST_SHAPE_RECOVERY_NOTE, RequestShapeRecovery, } from "./retry-fallback/request-shape.js";
@@ -619,8 +620,9 @@ export class AgentSession {
         this._abortDuringBeforeSettle = false;
         this._baseToolDefinitions = new Map();
         this._toolChildHostTargets = new Map();
-        /** Settles once dispose() has stopped the tool child, swept what it launched, and closed its in-process offload jobs. */
+        /** Settles once dispose() has stopped the tool child, swept what it launched, closed its in-process offload jobs, and the fallback log's first-start removal has finished. */
         this._toolChildClosed = Promise.resolve();
+        this._fallbackLogSettled = Promise.resolve();
         this._usesDefaultTools = false;
         /** Policy tools withheld from the model, retained so disarming can restore direct access. */
         this._withheldEvalOnlyToolNames = new Set();
@@ -669,6 +671,7 @@ export class AgentSession {
         this._endSelectedModels = new WeakMap();
         /** Internal handler for agent events - shared by subscribe and reconnect */
         this._handleAgentEvent = (event, signal) => {
+            redactAssistantErrorText(event);
             let queuedEvent = event;
             let pendingMessage;
             // Lifecycle events this event raises are delivered just before it, in the same queue (LifecycleEventSequencer).
@@ -844,6 +847,7 @@ export class AgentSession {
         this._modelRegistry = config.modelRegistry ?? new ModelRegistry(modelRuntime);
         this._agentDir = config.agentDir ?? getAgentDir();
         const fallbackLogger = createFallbackLogger(this._agentDir);
+        this._fallbackLogSettled = fallbackLogger.settled();
         this._modelConfigErrors = createModelConfigErrorReporter(fallbackLogger, (event) => this._emit(event));
         this._sessionLogger = createSessionLogger(this._agentDir, {
             context: () => ({
@@ -2064,7 +2068,7 @@ export class AgentSession {
     get agentDir() {
         return this._agentDir;
     }
-    /** Resolves after dispose() once the tool child has exited and its launched groups are swept; awaited by disposers. */
+    /** Resolves after dispose() once the tool child has exited, its launched groups are swept and the fallback log has stopped writing; awaited by disposers. */
     whenToolChildClosed() {
         return this._toolChildClosed;
     }
@@ -3519,7 +3523,7 @@ export class AgentSession {
             ?.close()
             .catch((error) => this._sessionLogger.warn("tool_child_close_failed", { error: String(error) })) ??
             Promise.resolve();
-        this._toolChildClosed = Promise.all([inProcessClosed, childClosed]).then(() => undefined);
+        this._toolChildClosed = Promise.all([inProcessClosed, childClosed, this._fallbackLogSettled]).then(() => undefined);
         this._disconnectFromAgent();
         this._unsubscribeSettingsSource?.();
         this._unsubscribeSettingsSource = undefined;
@@ -5510,6 +5514,8 @@ export class AgentSession {
         // Restored input with no source keeps no mark: an unmarked turn is engine work, never a trusted origin.
         if (input.source !== undefined)
             markInputTurnOrigin(message, inputTurnMark(input));
+        else if (recordIsDelegated())
+            markInputTurnOrigin(message, "delegated");
         if (input.inputId !== undefined)
             this._queuedInputDispositions.track(message, input.inputId);
         this._queuedMessages.set(queuedId, message);
@@ -5900,6 +5906,10 @@ export class AgentSession {
         };
         // A delivery that found a run already streaming becomes a steer or follow-up: it keeps the origin it was admitted with.
         copyInputTurnMark(message, appMessage);
+        // senpi#6342: a custom message a cross-account record's own handling sends carries that origin wherever it waits
+        // (joining a streaming run, parked behind a compaction, held for the next turn), so the turn it opens still asks.
+        if (!hasInputTurnMark(appMessage) && recordIsDelegated())
+            markInputTurnOrigin(appMessage, "delegated");
         if (this._sizesOnlyStartup && options?.triggerTurn === true) {
             // Size inspection makes no model call (#3483): keep the message for a turn that never starts.
             this._pendingNextTurnMessages.push(appMessage);
@@ -6574,7 +6584,7 @@ export class AgentSession {
         }
     }
     /**
-     * A refused engine turn still records its message and settles a cross-session delivery it carries. A delivery
+     * A refused engine turn still records its message and settles a cross-session delivery it carries. A message
      * whose entry the file refuses leaves the context too: its sender redelivers it, and it must not appear twice.
      */
     _recordRefusedEngineTurnMessage(appMessage) {
@@ -6583,12 +6593,17 @@ export class AgentSession {
             this.externalAdmission.observePersisted(appMessage);
         }
         catch (error) {
-            if (deliveryIdOf(appMessage) !== undefined) {
-                const index = this.agent.state.messages.lastIndexOf(appMessage);
-                if (index >= 0)
-                    this.agent.state.messages.splice(index, 1);
-            }
-            this.externalAdmission.observeRefused(appMessage, error instanceof Error ? error.message : String(error));
+            // The session file refused the entry: the message leaves the context too, so the context matches the
+            // file, and the failure follows the same contract as the main persistence path — it is recorded,
+            // logged, and emitted (senpi#2972). This holds for non-delivery messages as well as deliveries.
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const index = this.agent.state.messages.lastIndexOf(appMessage);
+            if (index >= 0)
+                this.agent.state.messages.splice(index, 1);
+            this._transcriptWriteFailures.record(appMessage, error);
+            this._sessionLogger.warn("transcript_write_failed", { role: appMessage.role, error: errorMessage });
+            this._emit({ type: "transcript_write_failed", role: appMessage.role, errorMessage });
+            this.externalAdmission.observeRefused(appMessage, errorMessage);
             this._takePersistWatcher(appMessage)?.failed(error);
         }
     }
@@ -6674,12 +6689,27 @@ export class AgentSession {
         const start = { type: "message_start", message: appMessage };
         this._recoveryIdentity?.observe(start);
         const entryId = this.sessionManager.appendCustomMessageEntry(appMessage.customType, appMessage.content, appMessage.display, appMessage.details, { recoveryOwner: recoveryCarrier(start) });
-        this._emitEntryAppended(entryId);
+        // The entry is written: only a failure of the write itself counts as refused. Bookkeeping (ticket,
+        // watcher settlement, revision) runs before any notification, and each notification is guarded on its
+        // own, so a throwing listener can neither leave a persisted delivery unsettled nor suppress a later
+        // notification (senpi#2972).
         this._recordWrittenTicket(appMessage, entryId);
         this._takePersistWatcher(appMessage)?.persisted(entryId);
         this._incrementMessageRevision();
-        this._emit(start);
-        this._emit({ type: "message_end", message: appMessage });
+        const notify = (emit) => {
+            try {
+                emit();
+            }
+            catch (error) {
+                this._sessionLogger.warn("custom_message_listener_failed", {
+                    customType: appMessage.customType,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        };
+        notify(() => this._emitEntryAppended(entryId));
+        notify(() => this._emit(start));
+        notify(() => this._emit({ type: "message_end", message: appMessage }));
     }
     _flushPendingCustomMessages() {
         const pending = this._pendingCustomMessages;
@@ -9357,7 +9387,7 @@ export class AgentSession {
         }
         this._scheduledContinuationRecompacted = true;
     }
-    async _continueAgentAfterCurrentRun(options = {}, retryTimeoutMs) {
+    async _continueAgentAfterCurrentRun(options = {}, retryTimeoutMs, keepsTurnOrigin = false) {
         await this.agent.waitForIdle();
         try {
             if (this.agent.state.isStreaming)
@@ -9384,6 +9414,8 @@ export class AgentSession {
                 this._transcriptWriteFailures.startRun();
             await runBoundedRetryContinuation({
                 continueRun: async () => {
+                    if (keepsTurnOrigin)
+                        noteTurnContinuation(this.sessionManager);
                     if (this._continueWithQueuedInput) {
                         // Joined input of a start that never ran: the transcript tail may be anything, even empty.
                         this._continueWithQueuedInput = false;
@@ -9428,6 +9460,7 @@ export class AgentSession {
             throw error;
         }
         finally {
+            endTurnContinuation(this.sessionManager);
             this._scheduledContinuationRecompacted = false;
             this._continueWithQueuedInput = false;
         }
@@ -9459,13 +9492,13 @@ export class AgentSession {
         this._continueWithQueuedInput = true;
         this._scheduleContinuationAfterCurrentEvent();
     }
-    _scheduleContinuationAfterCurrentEvent(options = {}, retryContinuation = false, retryTimeoutMs) {
+    _scheduleContinuationAfterCurrentEvent(options = {}, retryContinuation = false, retryTimeoutMs, keepsTurnOrigin = retryContinuation) {
         // Tool hooks wait for queued message persistence, so continue() cannot run inside this event promise.
         const currentEventQueue = this._agentEventQueue;
         const finishContinuationWork = this._sessionWorkBarrier.begin();
         const continueAfterEvent = async () => {
             try {
-                const outcome = await this._continueAgentAfterCurrentRun(options, retryTimeoutMs);
+                const outcome = await this._continueAgentAfterCurrentRun(options, retryTimeoutMs, keepsTurnOrigin);
                 if (retryContinuation && outcome === "taken-over") {
                     DEFERRED_RETRY_QUEUE_OWNERS.delete(this);
                 }
@@ -9607,7 +9640,8 @@ export class AgentSession {
                 // kept tail still covers (one per rung climbed so far); the retry must
                 // continue from the turn they failed to answer, so strip the whole run.
                 this._stripTrailingFailedAssistants();
-                this._scheduleContinuationAfterCurrentEvent();
+                // The recovery run repeats this turn, so it keeps the turn's origin.
+                this._scheduleContinuationAfterCurrentEvent({}, false, undefined, true);
                 return true;
             }
             else if (this.pendingMessageCount > 0) {
@@ -11947,8 +11981,45 @@ export class AgentSession {
         const estimate = branchEntries.some((entry) => entry.type === "context_edit")
             ? estimateProjectedContextTokens(this.sessionManager.buildSessionProjection(), branchEntries)
             : estimateContextTokens(messages);
+        // A model switch after the last reported usage invalidates that usage: it was
+        // counted with the previous model's tokenizer, so showing it against the new
+        // model's window misstates the context (oh-my-openagent#11684). Fall back to
+        // the content estimate, like the compaction and context-edit paths above.
+        if (estimate.lastUsageIndex !== null && this._isUsageStaleAfterModelChange(branchEntries)) {
+            return { tokens: messages.reduce((sum, message) => sum + estimateTokens(message), 0), reported: false };
+        }
         return { tokens: estimate.tokens, reported: estimate.usageTokens > 0 };
     }
+    /**
+     * Whether the latest reported usage predates the latest model switch: no
+     * assistant message after the switch reported usage, so the last reported
+     * figure belongs to the previous model's tokenizer. Assistant messages are
+     * appended to the branch only once they stop streaming (a pending assistant
+     * message is rejected), so a switch that lands mid-turn still precedes the
+     * message entry carrying the new model's usage.
+     */
+    _isUsageStaleAfterModelChange(branchEntries) {
+        let latestModelChangeIndex = -1;
+        for (let i = branchEntries.length - 1; i >= 0; i--) {
+            if (branchEntries[i].type === "model_change") {
+                latestModelChangeIndex = i;
+                break;
+            }
+        }
+        if (latestModelChangeIndex === -1)
+            return false;
+        for (let i = branchEntries.length - 1; i > latestModelChangeIndex; i--) {
+            const entry = branchEntries[i];
+            if (entry.type === "message" && entry.message.role === "assistant") {
+                const assistant = entry.message;
+                if (assistant.stopReason !== "aborted" && assistant.stopReason !== "error") {
+                    if (calculateContextTokens(assistant.usage) > 0)
+                        return false;
+                }
+            }
+        }
+        return true;
+    }
     /**
      * Export session to HTML.
      * @param outputPath Optional output path (defaults to session directory)

package/dist/core/assistant-error-redaction.d.ts

@@ -0,0 +1,9 @@
+import type { AgentEvent } from "@earendil-works/pi-agent-core";
+/**
+ * Provider error text can echo a value a config reference resolved to (omo#12965). An assistant message carries that
+ * text from its first streamed partial to its final form, and the final object is the one agent state keeps and the
+ * transcript persists, so every message event is redacted in place before a listener, the transcript or the state
+ * reads it.
+ */
+export declare function redactAssistantErrorText(event: AgentEvent): void;
+//# sourceMappingURL=assistant-error-redaction.d.ts.map

package/dist/core/assistant-error-redaction.js

@@ -0,0 +1,27 @@
+import { redactSensitiveTokenValues } from "./sensitive-output.js";
+function redactErrorText(message) {
+    if (message.role === "assistant" && message.errorMessage) {
+        message.errorMessage = redactSensitiveTokenValues(message.errorMessage);
+    }
+}
+/**
+ * Provider error text can echo a value a config reference resolved to (omo#12965). An assistant message carries that
+ * text from its first streamed partial to its final form, and the final object is the one agent state keeps and the
+ * transcript persists, so every message event is redacted in place before a listener, the transcript or the state
+ * reads it.
+ */
+export function redactAssistantErrorText(event) {
+    if (event.type !== "message_start" && event.type !== "message_update" && event.type !== "message_end")
+        return;
+    redactErrorText(event.message);
+    if (event.type !== "message_update")
+        return;
+    const update = event.assistantMessageEvent;
+    if ("partial" in update)
+        redactErrorText(update.partial);
+    else if (update.type === "done")
+        redactErrorText(update.message);
+    else
+        redactErrorText(update.error);
+}
+//# sourceMappingURL=assistant-error-redaction.js.map

package/dist/core/config-reference-redaction.js

@@ -1,21 +1,101 @@
+/**
+ * Resolved-value registry shared by every copy of this module in one JavaScript realm (omo#12965).
+ *
+ * A process can evaluate this module more than once (the bundle's shared chunk, its self-contained session-worker
+ * entry, and the SDK graph an in-process child loads), so the values are not kept in a module-local set: the first
+ * copy pins a frozen registry on `globalThis` under `SLOT_KEY` (non-writable, non-configurable, non-enumerable) and
+ * every later copy adopts it. The backing `Set` lives only in the installing copy's closure; the registry offers no
+ * delete, clear or setter, so in-realm code cannot remove a value, replace the slot or turn redaction off. Any
+ * in-realm code can `add` a string, which can only over-redact. This is a stopgap until one engine instance serves
+ * the whole process; other realms (workers, `vm` contexts, child processes) keep their own registry.
+ *
+ * Compatibility contract, permanent: the key string never changes. The v1 members `version` (1), `add(value)`,
+ * `size` (an accessor reporting the live count) and `values()` (a fresh array) are never removed or repurposed; a
+ * later contract keeps writing through this same slot and only adds members, and adopters ignore members they do not
+ * know. A copy adopts only a slot pinned the way `pin` pins it, frozen, with those four members; anything else (a
+ * slot planted before the first copy loaded, an accessor, another version) makes the import throw
+ * `ConfigReferenceRedactionSlotError`, because a copy running with a private set is the leak this registry removes.
+ */
+const SLOT_KEY_NAME = "@code-yeongyu/senpi/config-reference-redaction/v1";
+const SLOT_KEY = Symbol.for(SLOT_KEY_NAME);
 const MIN_REDACTED_LENGTH = 4;
-const resolvedValues = new Set();
-let redactionForms;
+/** The largest `$file` reference value (`config-reference-file.ts`); longer strings are never remembered. */
+const MAX_REMEMBERED_LENGTH = 65_536;
+class ConfigReferenceRedactionSlotError extends Error {
+    constructor(cause) {
+        super(`The process-wide redaction registry ${SLOT_KEY_NAME} was not installed by senpi or is incompatible; restart the process.`, cause === undefined ? undefined : { cause });
+        this.name = "ConfigReferenceRedactionSlotError";
+        this.code = "SENPI_REDACTION_SLOT_INCOMPATIBLE";
+    }
+}
+function createRegistry() {
+    const values = new Set();
+    return Object.freeze({
+        version: 1,
+        add(value) {
+            if (typeof value !== "string" || value.length < MIN_REDACTED_LENGTH || value.length > MAX_REMEMBERED_LENGTH)
+                return;
+            values.add(value);
+        },
+        get size() {
+            return values.size;
+        },
+        values: () => [...values],
+    });
+}
+function isFrozenV1Registry(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        Object.isFrozen(value) &&
+        Reflect.get(value, "version") === 1 &&
+        typeof Reflect.get(value, "add") === "function" &&
+        typeof Reflect.get(value, "values") === "function" &&
+        typeof Reflect.get(value, "size") === "number");
+}
+function pin(registry) {
+    try {
+        Object.defineProperty(globalThis, SLOT_KEY, {
+            value: registry,
+            writable: false,
+            configurable: false,
+            enumerable: false,
+        });
+    }
+    catch (error) {
+        throw new ConfigReferenceRedactionSlotError(error);
+    }
+    return registry;
+}
+function sharedRegistry() {
+    const slot = Reflect.getOwnPropertyDescriptor(globalThis, SLOT_KEY);
+    if (slot === undefined)
+        return pin(createRegistry());
+    const value = slot.value;
+    if (slot.writable !== false || slot.configurable !== false || !isFrozenV1Registry(value)) {
+        throw new ConfigReferenceRedactionSlotError();
+    }
+    return value;
+}
+const registry = sharedRegistry();
+let redactionForms = [];
+let formsSize = 0;
 /** Every value a reference resolves to is kept for the process lifetime, including rotated ones: no cap, no eviction. */
 export function rememberResolvedReferenceValue(value) {
-    if (value.length < MIN_REDACTED_LENGTH || resolvedValues.has(value))
-        return;
-    resolvedValues.add(value);
-    redactionForms = undefined;
+    registry.add(value);
 }
 function encodings(value) {
     const form = new URLSearchParams([["", value]]).toString().slice(1);
     return [value, JSON.stringify(value).slice(1, -1), encodeURIComponent(value), encodeURI(value), form];
 }
+/** The registry is append-only, so a changed size is the only way its content can change. */
 function forms() {
-    redactionForms ??= [...new Set([...resolvedValues].flatMap(encodings))]
-        .filter((form) => form.length >= MIN_REDACTED_LENGTH)
-        .sort((left, right) => right.length - left.length);
+    const size = registry.size;
+    if (size !== formsSize) {
+        redactionForms = [...new Set(registry.values().flatMap(encodings))]
+            .filter((form) => form.length >= MIN_REDACTED_LENGTH)
+            .sort((left, right) => right.length - left.length);
+        formsSize = size;
+    }
     return redactionForms;
 }
 /** Replaces every resolved reference value, raw or encoded, before text reaches a sink outside the process. */
@@ -134,7 +214,7 @@ function isProtocolValue(key, value) {
     return Object.hasOwn(PROTOCOL_VALUES, key) && PROTOCOL_VALUES[key]?.has(value) === true;
 }
 export function redactResolvedReferenceData(value) {
-    if (resolvedValues.size === 0)
+    if (registry.size === 0)
         return value;
     const copies = new WeakMap();
     const pending = [];

package/dist/core/context-files.d.ts

@@ -16,6 +16,16 @@ export type ContextFiles = ContextFile[] & {
 export interface ContextFileLimits {
     maxBytesPerFile?: number;
     maxTotalBytes?: number;
+    /**
+     * The global (user-scope) context file to load instead of the agent-dir probe (senpi#5567).
+     * Honored from the user's own settings only (`SettingsManager.getGlobalContextFilePath`); a
+     * project's settings never set it. A leading `~` is expanded; a relative path resolves against
+     * the agent dir, like other paths in global settings; a directory runs the same candidate probe
+     * as the agent dir. Unset or blank keeps the agent-dir file. A path that is set but missing,
+     * unreadable, a special file, or a directory with no candidate falls back to the agent-dir probe
+     * and reports one warning diagnostic instead of erroring.
+     */
+    globalPath?: string;
 }
 export declare const DEFAULT_CONTEXT_FILE_MAX_BYTES: number;
 export declare const DEFAULT_CONTEXT_FILES_MAX_TOTAL_BYTES: number;

package/dist/core/context-files.js

@@ -29,6 +29,47 @@ function loadContextFileFromDir(dir) {
     }
     return null;
 }
+/**
+ * The global user-scope context file (senpi#5567). `contextFiles.globalPath` names a file (or a
+ * directory to probe for the usual candidates) to load in place of the agent-dir file. Precedence
+ * is defined and never errors: a blank or unset path keeps the agent-dir probe silently; a
+ * configured target that is missing, unreadable, a special file, or a directory with no candidates
+ * falls back to the agent-dir probe and returns one warning naming the configured path.
+ */
+function loadGlobalContextFile(agentDir, globalPath) {
+    const explicit = typeof globalPath === "string" ? globalPath.trim() : "";
+    if (explicit === "")
+        return { file: loadContextFileFromDir(agentDir) };
+    const resolved = resolvePath(explicit, agentDir);
+    const fallBack = (problem) => ({
+        file: loadContextFileFromDir(agentDir),
+        diagnostic: {
+            type: "warning",
+            path: resolved,
+            message: `contextFiles.globalPath ${problem}; using the global context file from ${agentDir} instead.`,
+        },
+    });
+    let stats;
+    try {
+        stats = statSync(resolved);
+    }
+    catch (error) {
+        const code = error.code;
+        return fallBack(code === "ENOENT" || code === "ENOTDIR" ? "does not exist" : `could not be read (${String(error)})`);
+    }
+    if (stats.isDirectory()) {
+        const file = loadContextFileFromDir(resolved);
+        return file ? { file } : fallBack("is a directory with no AGENTS.md or CLAUDE.md");
+    }
+    if (!stats.isFile())
+        return fallBack("is not a regular file or directory");
+    try {
+        return { file: { path: resolved, content: stripBom(readFileSync(resolved, "utf-8")) } };
+    }
+    catch (error) {
+        return fallBack(`could not be read (${String(error)})`);
+    }
+}
 /**
  * The main repo's context file that a nested linked worktree's own copy shadows: both
  * occupy the same logical repository scope, so loading both applies that context twice. Returns
@@ -142,21 +183,22 @@ function applyContextFileLimits(files, limits) {
     }
     return Object.assign(kept, { diagnostics });
 }
-/** Compares directories by their real path, ignoring case where the filesystem does (Windows). */
-function directoryKey(dir) {
-    const real = canonicalizePath(resolvePath(dir));
+/** Compares files and directories by their real path, ignoring case where the filesystem does (Windows). */
+function pathKey(path) {
+    const real = canonicalizePath(resolvePath(path));
     return process.platform === "win32" ? real.toLowerCase() : real;
 }
 export function loadProjectContextFiles(options) {
     const resolvedCwd = resolvePath(options.cwd);
     const resolvedAgentDir = resolvePath(options.agentDir);
-    const homeKey = directoryKey(options.homeDir ?? homedir());
+    const homeKey = pathKey(options.homeDir ?? homedir());
     const contextFiles = [];
+    // Real-path keys: a symlinked ancestor file that points at an already loaded file is the same file.
     const seenPaths = new Set();
-    const globalContext = loadContextFileFromDir(resolvedAgentDir);
-    if (globalContext) {
-        contextFiles.push({ ...globalContext, scope: "user" });
-        seenPaths.add(globalContext.path);
+    const globalContext = loadGlobalContextFile(resolvedAgentDir, options.globalPath);
+    if (globalContext.file) {
+        contextFiles.push({ ...globalContext.file, scope: "user" });
+        seenPaths.add(pathKey(globalContext.file.path));
     }
     const ancestorContextFiles = [];
     const shadowedContextFile = findShadowedContextFile(resolvedCwd);
@@ -164,9 +206,10 @@ export function loadProjectContextFiles(options) {
     while (true) {
         const contextFile = loadContextFileFromDir(currentDir);
         const isShadowed = shadowedContextFile !== undefined && canonicalizePath(contextFile?.path ?? "") === shadowedContextFile;
-        if (contextFile && !isShadowed && !seenPaths.has(contextFile.path)) {
-            ancestorContextFiles.unshift(directoryKey(currentDir) === homeKey ? { ...contextFile, scope: "user" } : contextFile);
-            seenPaths.add(contextFile.path);
+        const contextFileKey = contextFile ? pathKey(contextFile.path) : undefined;
+        if (contextFile && contextFileKey !== undefined && !isShadowed && !seenPaths.has(contextFileKey)) {
+            ancestorContextFiles.unshift(pathKey(currentDir) === homeKey ? { ...contextFile, scope: "user" } : contextFile);
+            seenPaths.add(contextFileKey);
         }
         const parentDir = dirname(currentDir);
         if (parentDir === currentDir)
@@ -174,6 +217,9 @@ export function loadProjectContextFiles(options) {
         currentDir = parentDir;
     }
     contextFiles.push(...ancestorContextFiles);
-    return applyContextFileLimits(contextFiles, options);
+    const limited = applyContextFileLimits(contextFiles, options);
+    if (globalContext.diagnostic)
+        limited.diagnostics.unshift(globalContext.diagnostic);
+    return limited;
 }
 //# sourceMappingURL=context-files.js.map

package/dist/core/egress/wire.d.ts

@@ -168,11 +168,24 @@ export interface HookModelRequest {
     readonly claim: SignedPlacementClaim;
     readonly input: HookModelRequestInput;
 }
+/** A user hook's failure on the hand: reported with the reply, as a fused session reports it, never thrown. */
+export interface HookFailure {
+    readonly extensionPath: string;
+    readonly event: string;
+    readonly error: string;
+}
 export interface HookModelRequestReply {
     readonly t: "hook.model_request.reply";
     readonly sessionId: string;
     readonly stepId: string;
     readonly output: HookModelRequestInput;
+    /** The hooks that failed; `output` is what the others produced. Absent: none failed. */
+    readonly errors?: readonly HookFailure[];
+    /** The messages and notices the hooks sent during the call, as on every loop-hook reply (S33). Absent: none. */
+    readonly sent?: readonly WireJson[];
+    readonly notices?: readonly WireJson[];
+    /** Late messages and notices the hand dropped past its per-session bound. Absent: none. */
+    readonly droppedLate?: number;
 }
 export interface HandSessionAdvertisement {
     readonly t: "hand.session.advertise";

package/dist/core/extensions/builtin/config-reload/change-groups.js

@@ -7,8 +7,12 @@ export function groupChangedPaths(paths, targets, rearmedContainers) {
             if (!targetMatchesPath(activeTarget.target, path))
                 continue;
             matched = true;
-            // The project container only rearms discovery; newly discovered config files carry the change.
-            if (activeTarget.target.id === "builtin-project-presence" && rearmedContainers.includes(resolve(path)))
+            // Discovery containers only rearm their watches; discovered files carry the change.
+            // An extensions directory may contain only runtime state (e.g. a park's goal/no-session).
+            if (rearmedContainers.includes(resolve(path)) &&
+                (activeTarget.target.id === "builtin-project-presence" ||
+                    activeTarget.target.id === "builtin-global-extensions" ||
+                    activeTarget.target.id === "builtin-project-extensions"))
                 continue;
             const group = groups.get(activeTarget.registrationId) ?? [];
             if (!group.includes(path))

package/dist/core/extensions/builtin/mcp/auth/catalog-identity.js

@@ -1,15 +1,22 @@
 import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { Type } from "typebox";
+import { Check } from "typebox/value";
 import { keyedIdentity } from "../config-identity-key.js";
 import { resolveAuthMode } from "./context.js";
+import { oauthGrantIdentity } from "./oauth-grant.js";
 import { McpTokenStore } from "./token-store.js";
 /** Local snapshot only: never migrates credentials, acquires a lock, or refreshes authentication. */
 export function mcpCredentialIdentity(config, serverName, agentDir, env) {
     const material = credentialMaterial(config, serverName, agentDir, env);
-    return material === undefined || material === "none" ? material : keyedIdentity(agentDir, material);
+    return material === undefined || material === "none" || resolveAuthMode(config) === "oauth"
+        ? material
+        : keyedIdentity(agentDir, material);
 }
 /** The unkeyed identity earlier builds persisted; read only to adopt a cache entry for the same credential. */
 export function legacyMcpCredentialIdentity(config, serverName, agentDir, env) {
+    if (resolveAuthMode(config) === "oauth")
+        return undefined;
     const material = credentialMaterial(config, serverName, agentDir, env);
     return material === undefined || material === "none"
         ? material
@@ -31,14 +38,15 @@ function credentialMaterial(config, serverName, agentDir, env) {
     try {
         const store = new McpTokenStore({ serverName, serverUrl: config.url ?? "", agentDir });
         const value = JSON.parse(readFileSync(store.tokensPath, "utf8"));
-        if (typeof value !== "object" || value === null || !("accessToken" in value))
-            return undefined;
-        if (typeof value.accessToken !== "string" || value.accessToken.length === 0)
-            return undefined;
-        const refreshToken = "refreshToken" in value ? value.refreshToken : undefined;
-        if (refreshToken !== undefined && typeof refreshToken !== "string")
+        if (!Check(storedGrantSchema, value))
             return undefined;
-        return JSON.stringify(["mcp-catalog-oauth", value.accessToken, refreshToken]);
+        return oauthGrantIdentity(value, {
+            serverName,
+            serverUrl: store.serverUrl,
+            agentDir: store.agentDir,
+            clientId: config.oauth?.clientId,
+            clientMetadataUrl: config.oauth?.clientMetadataUrl,
+        });
     }
     catch (error) {
         if (error instanceof Error)
@@ -46,4 +54,20 @@ function credentialMaterial(config, serverName, agentDir, env) {
         throw error;
     }
 }
+// Parse exactly the stored fields the identity reader consumes; authorization is parsed by its proof owner.
+const storedGrantSchema = Type.Object({
+    accessToken: Type.String({ minLength: 1 }),
+    refreshToken: Type.Optional(Type.String()),
+    issuer: Type.Optional(Type.String()),
+    resource: Type.Optional(Type.String()),
+    scope: Type.Optional(Type.String()),
+    refreshScope: Type.Optional(Type.String()),
+    clientInfo: Type.Optional(Type.Object({
+        client_id: Type.String(),
+        client_secret: Type.Optional(Type.String()),
+        token_endpoint_auth_method: Type.Optional(Type.String()),
+        issuer: Type.Optional(Type.String()),
+    })),
+    discoveryState: Type.Optional(Type.Object({ authorizationServerUrl: Type.String() })),
+});
 //# sourceMappingURL=catalog-identity.js.map