@code-yeongyu/senpi 2026.11.2-3 → 2026.11.3-1

package/dist/core/extensions/builtin/bash-timeout/index.js

@@ -1,8 +1,5 @@
-import { isAnthropicBashEnabled } from "../anthropic-bash/index.js";
-import { isEvalOnlyRouting } from "../eval-only-routing.js";
-import { resolveForegroundWindowSeconds } from "../terminal/tools/foreground-window.js";
-import { applyBashTimeout, buildBashTimeoutPrompt, resolveBashTimeoutDefaults, } from "./timeout.js";
-export { applyBashTimeout, BASH_DEFAULT_TIMEOUT_SECONDS, BASH_MAX_TIMEOUT_SECONDS, buildBashTimeoutPrompt, resolveBashTimeoutDefaults, } from "./timeout.js";
+import { applyBashTimeout, resolveBashTimeoutDefaults } from "./timeout.js";
+export { applyBashTimeout, BASH_DEFAULT_TIMEOUT_SECONDS, resolveBashTimeoutDefaults } from "./timeout.js";
 export default function bashTimeoutExtension(pi) {
     const env = typeof process !== "undefined" ? process.env : {};
     const defaults = resolveBashTimeoutDefaults(env);
@@ -17,28 +14,6 @@ export default function bashTimeoutExtension(pi) {
                 input.timeout = timeout;
         }
     });
-    /**
-     * Native Anthropic bash replaces the PTY `bash` tool and the terminal
-     * extension steps aside with it, so nothing implements the auto-detach the
-     * policy would otherwise advertise.
-     */
-    const resolveWindow = (ctx) => {
-        if (isAnthropicBashEnabled() && ctx?.model?.api === "anthropic-messages")
-            return undefined;
-        return resolveForegroundWindowSeconds(env);
-    };
-    pi.on("before_agent_start", async (event, ctx) => {
-        // A session with no `bash` tool has nothing this policy can describe. A host that exposes
-        // only the handler surface (no getAllTools) keeps the policy, as the terminal section does.
-        if (typeof pi.getAllTools === "function" && !pi.getAllTools().some((tool) => tool.name === "bash")) {
-            return undefined;
-        }
-        const foregroundWindowSeconds = resolveWindow(ctx);
-        const prompt = buildBashTimeoutPrompt(defaults, {
-            ...(foregroundWindowSeconds === undefined ? {} : { foregroundWindowSeconds }),
-            evalOnly: isEvalOnlyRouting(pi),
-        });
-        return { systemPrompt: `${event.systemPrompt}${prompt}` };
-    }, { previewSafe: true });
+    // The timeout facts reach the model through the terminal section (senpi#5335); this extension adds no prompt text.
 }
 //# sourceMappingURL=index.js.map

package/dist/core/extensions/builtin/bash-timeout/timeout.d.ts

@@ -12,16 +12,5 @@ export interface BashToolInputLike {
     [key: string]: unknown;
 }
 export declare function applyBashTimeout<TInput extends BashToolInputLike>(input: TInput, defaults: BashTimeoutDefaults): TInput;
-export interface BashTimeoutPromptOptions {
-    /**
-     * `undefined` when no PTY bash tool is live (native Anthropic bash replaces
-     * it). Nothing implements auto-detach then, so the policy must not promise
-     * it — a prompt that describes impossible behavior is worse than a silent one.
-     */
-    readonly foregroundWindowSeconds?: number;
-    /** True when the session routes shell tools through eval cells, so the call shape must be `tool.bash(`. */
-    readonly evalOnly?: boolean;
-}
-export declare function buildBashTimeoutPrompt(defaults: BashTimeoutDefaults, options?: BashTimeoutPromptOptions): string;
 export {};
 //# sourceMappingURL=timeout.d.ts.map

package/dist/core/extensions/builtin/bash-timeout/timeout.js

@@ -22,15 +22,4 @@ export function applyBashTimeout(input, defaults) {
     }
     return input;
 }
-export function buildBashTimeoutPrompt(defaults, options = {}) {
-    const { foregroundWindowSeconds, evalOnly = false } = options;
-    const subject = evalOnly
-        ? "Shell commands run from an eval cell as `tool.bash({ command, timeout })`; its `timeout` parameter"
-        : "The `bash` tool's `timeout` parameter";
-    const minutes = (seconds) => (seconds % 60 === 0 ? `${seconds / 60} min` : `${seconds}s`);
-    const detachRules = foregroundWindowSeconds === undefined
-        ? ""
-        : `\n- Foreground blocking stops at the ~${foregroundWindowSeconds}s window. A command still running then auto-detaches alive to a background session with a \`bash_id\` and keeps running until it exits or hits the kill deadline; the session tools in the terminal section steer or stop it.`;
-    return `\n## Bash Tool Timeout Policy\n\n${subject} is the process kill deadline, not how long you wait for output: the command is killed when it reaches the deadline.\n\n- Default timeout: ${defaults.defaultSeconds}s (${minutes(defaults.defaultSeconds)}). Applied automatically when you do not set \`timeout\`.\n- Recommended maximum timeout: ${defaults.maxSeconds}s (${minutes(defaults.maxSeconds)}). Explicit \`timeout\` values are preserved because different hosts may use different timeout units.${detachRules}`;
-}
 //# sourceMappingURL=timeout.js.map

package/dist/core/extensions/builtin/imagegen/index.d.ts

@@ -1,5 +1,4 @@
 import type { ExtensionAPI } from "../../types.ts";
-export declare const IMAGE_GEN_SECTION = "\n## Image Generation\n\nWhen image generation tooling is present, read the gpt-image-gen skill before generating.\nUse the image generation tool currently available in this session.\n";
 export declare function registerImageGenExtension(pi: ExtensionAPI, baseDir?: string): void;
 export default function imageGenExtension(pi: ExtensionAPI): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/core/extensions/builtin/imagegen/index.js

@@ -7,12 +7,6 @@ import { imageGenRegistryOverride } from "./state.js";
 import { generateImageTool } from "./tool.js";
 const IMAGEGEN_BASE_DIR = dirname(fileURLToPath(import.meta.url));
 let loggedMissingSkill = false;
-export const IMAGE_GEN_SECTION = `
-## Image Generation
-
-When image generation tooling is present, read the gpt-image-gen skill before generating.
-Use the image generation tool currently available in this session.
-`;
 async function isImageGenActive(ctx) {
     const auth = await resolveImageGenAuth({ modelRegistry: imageGenRegistryOverride() ?? ctx.modelRegistry });
     return auth.kind !== "none";
@@ -54,11 +48,6 @@ export function registerImageGenExtension(pi, baseDir = IMAGEGEN_BASE_DIR) {
         const skillPath = await bundledSkillPath(baseDir);
         return skillPath === undefined ? undefined : { skillPaths: [skillPath] };
     });
-    pi.on("before_agent_start", async (event, ctx) => {
-        if (!(await isImageGenActive(ctx)))
-            return undefined;
-        return { systemPrompt: `${event.systemPrompt}\n${IMAGE_GEN_SECTION}` };
-    }, { previewSafe: true });
 }
 export default function imageGenExtension(pi) {
     registerImageGenExtension(pi);

package/dist/core/extensions/builtin/prompt-preset/execution-tooling.d.ts

@@ -10,28 +10,28 @@ export declare const EXECUTION_TOOLING_RULES: readonly [{
     readonly id: "eval-routing-decision";
     readonly concern: "code-cell-routing";
     readonly directive: {
-        readonly claude: "Sort a multi-call step before you write it: independent reads, searches, symbol lookups, and probes go into ONE `eval` cell together via `parallel(thunks)` - an extra read-only call in that wave is nearly free, a stale assumption costs the turn - while edits, side-effecting commands, deploys, approvals, and any call whose input is a result you have not seen yet run one at a time, each observed before the next.";
+        readonly claude: "Sort each multi-call step first: independent reads/searches/symbol lookups/probes -> ONE `eval` cell via `parallel(thunks)`. Edits, side effects, deploys, approvals, any call fed by an unseen result -> one at a time, observe each before next.";
         readonly kimi: "Sort a multi-call step before you write it: put independent reads, searches, symbol lookups, and probes into one `eval` cell together with `parallel(thunks)`, and run edits, side-effecting commands, deploys, approvals, and any call that depends on a result you have not seen yet one at a time, looking at each result before the next.";
     };
 }, {
     readonly id: "eval-evidence-return";
     readonly concern: "code-cell-routing";
     readonly directive: {
-        readonly claude: "Name the state a cell should produce before running it; when it returns, COMPARE the returned evidence with that state, and for a cell that changed something also check that nothing changed beyond it. A result that hides a failed item or a truncated tail is not evidence.";
-        readonly kimi: "Name the state a cell should produce before running it; when it returns, compare the returned evidence with that state, and for a cell that changed something also check that nothing changed beyond it. A result that hides a failed item or a truncated tail is not evidence.";
+        readonly claude: "Name expected state before running a cell; on return COMPARE evidence to it; for a mutating cell also confirm nothing changed beyond it.";
+        readonly kimi: "Name the state a cell should produce before running it; when it returns, compare the returned evidence with that state, and for a cell that changed something also check that nothing changed beyond it.";
     };
 }, {
     readonly id: "perceived-state-loop";
     readonly concern: "code-cell-routing";
     readonly directive: {
-        readonly claude: "When the result must be SEEN rather than read - a page, a component, an image, a 3D scene, a layout - make one change, render or screenshot it, look, then make the next; check a 3D scene from several angles and a page at desktop and mobile widths. Compare what you see with the reference or the stated intent, and ask only where two readings of that intent diverge.";
+        readonly claude: "Result must be SEEN (page, component, image, 3D scene, layout): one change -> render/screenshot -> look -> next. 3D: several angles. Page: desktop + mobile widths. Compare to reference or stated intent; ask only where two readings of intent diverge.";
         readonly kimi: "When the result must be seen rather than read - a page, a component, an image, a 3D scene, a layout - make one change, render or screenshot it, look, then make the next; check a 3D scene from several angles and a page at desktop and mobile widths. Compare what you see with the reference or the stated intent, and ask only where two readings of that intent diverge.";
     };
 }, {
     readonly id: "eval-stay-direct";
     readonly concern: "code-cell-routing";
     readonly directive: {
-        readonly claude: "Call a tool directly only when one call is enough, the result decides the next call, semantic judgment sits between calls, or the action needs approval.";
+        readonly claude: "Direct tool call only when: one call suffices, result decides next call, semantic judgment sits between calls, or action needs approval.";
         readonly kimi: "Use a direct tool call when one call is enough, when each result decides the next call, or when the action needs approval - then stop deliberating and make it.";
     };
 }];

package/dist/core/extensions/builtin/prompt-preset/execution-tooling.js

@@ -29,7 +29,7 @@ export const EXECUTION_TOOLING_RULES = [
         id: "eval-routing-decision",
         concern: "code-cell-routing",
         directive: {
-            claude: "Sort a multi-call step before you write it: independent reads, searches, symbol lookups, and probes go into ONE `eval` cell together via `parallel(thunks)` - an extra read-only call in that wave is nearly free, a stale assumption costs the turn - while edits, side-effecting commands, deploys, approvals, and any call whose input is a result you have not seen yet run one at a time, each observed before the next.",
+            claude: "Sort each multi-call step first: independent reads/searches/symbol lookups/probes -> ONE `eval` cell via `parallel(thunks)`. Edits, side effects, deploys, approvals, any call fed by an unseen result -> one at a time, observe each before next.",
             kimi: "Sort a multi-call step before you write it: put independent reads, searches, symbol lookups, and probes into one `eval` cell together with `parallel(thunks)`, and run edits, side-effecting commands, deploys, approvals, and any call that depends on a result you have not seen yet one at a time, looking at each result before the next.",
         },
     },
@@ -37,15 +37,15 @@ export const EXECUTION_TOOLING_RULES = [
         id: "eval-evidence-return",
         concern: "code-cell-routing",
         directive: {
-            claude: "Name the state a cell should produce before running it; when it returns, COMPARE the returned evidence with that state, and for a cell that changed something also check that nothing changed beyond it. A result that hides a failed item or a truncated tail is not evidence.",
-            kimi: "Name the state a cell should produce before running it; when it returns, compare the returned evidence with that state, and for a cell that changed something also check that nothing changed beyond it. A result that hides a failed item or a truncated tail is not evidence.",
+            claude: "Name expected state before running a cell; on return COMPARE evidence to it; for a mutating cell also confirm nothing changed beyond it.",
+            kimi: "Name the state a cell should produce before running it; when it returns, compare the returned evidence with that state, and for a cell that changed something also check that nothing changed beyond it.",
         },
     },
     {
         id: "perceived-state-loop",
         concern: "code-cell-routing",
         directive: {
-            claude: "When the result must be SEEN rather than read - a page, a component, an image, a 3D scene, a layout - make one change, render or screenshot it, look, then make the next; check a 3D scene from several angles and a page at desktop and mobile widths. Compare what you see with the reference or the stated intent, and ask only where two readings of that intent diverge.",
+            claude: "Result must be SEEN (page, component, image, 3D scene, layout): one change -> render/screenshot -> look -> next. 3D: several angles. Page: desktop + mobile widths. Compare to reference or stated intent; ask only where two readings of intent diverge.",
             kimi: "When the result must be seen rather than read - a page, a component, an image, a 3D scene, a layout - make one change, render or screenshot it, look, then make the next; check a 3D scene from several angles and a page at desktop and mobile widths. Compare what you see with the reference or the stated intent, and ask only where two readings of that intent diverge.",
         },
     },
@@ -53,7 +53,7 @@ export const EXECUTION_TOOLING_RULES = [
         id: "eval-stay-direct",
         concern: "code-cell-routing",
         directive: {
-            claude: "Call a tool directly only when one call is enough, the result decides the next call, semantic judgment sits between calls, or the action needs approval.",
+            claude: "Direct tool call only when: one call suffices, result decides next call, semantic judgment sits between calls, or action needs approval.",
             kimi: "Use a direct tool call when one call is enough, when each result decides the next call, or when the action needs approval - then stop deliberating and make it.",
         },
     },

package/dist/core/extensions/builtin/prompt-preset/glm-5.d.ts

@@ -1,4 +1,4 @@
 import { type BuildDynamicSystemPromptOptions } from "../../../dynamic-prompt/build.ts";
-export declare const GLM5_TUNING = "A cheap tool call beats long internal debate: when reading, running, or searching can settle a question, do that and reason over the result. Work in short act-inspect-verify loops so an early mistake surfaces before later steps build on it; when only the user can settle a question, ask through ask_user_question when it is available (waitForAnswer true when the next step depends on the answer).";
+export declare const GLM5_TUNING = "Cheap tool call beats long internal debate: reading/running/searching can settle it -> do that, reason over result. Short act-inspect-verify loops so early mistakes surface before later steps build on them. Only the user can settle it -> ask_user_question when available.";
 export declare function buildGlm5Prompt(options: BuildDynamicSystemPromptOptions): string;
 //# sourceMappingURL=glm-5.d.ts.map

package/dist/core/extensions/builtin/prompt-preset/glm-5.js

@@ -1,6 +1,6 @@
 import { buildDynamicSystemPrompt } from "../../../dynamic-prompt/build.js";
 import { buildExecutionToolingSection } from "./execution-tooling.js";
-export const GLM5_TUNING = "A cheap tool call beats long internal debate: when reading, running, or searching can settle a question, do that and reason over the result. Work in short act-inspect-verify loops so an early mistake surfaces before later steps build on it; when only the user can settle a question, ask through ask_user_question when it is available (waitForAnswer true when the next step depends on the answer).";
+export const GLM5_TUNING = "Cheap tool call beats long internal debate: reading/running/searching can settle it -> do that, reason over result. Short act-inspect-verify loops so early mistakes surface before later steps build on them. Only the user can settle it -> ask_user_question when available.";
 export function buildGlm5Prompt(options) {
     return buildDynamicSystemPrompt({
         ...options,

package/dist/core/extensions/builtin/terminal/extension.js

@@ -2,6 +2,7 @@ import { join } from "node:path";
 import { encodedSessionId } from "../../../session-sidecar-store.js";
 import { SettingsManager } from "../../../settings-manager.js";
 import { isAnthropicBashEnabled } from "../anthropic-bash/index.js";
+import { resolveBashTimeoutDefaults } from "../bash-timeout/timeout.js";
 import { isEvalOnlyRouting } from "../eval-only-routing.js";
 import { buildToolContext, bundleSinks, createBundle, sessionKeyOf, } from "./extension-state.js";
 import { currentLeaseToken, releaseTerminalLease, retireLeaseToken } from "./manifest-lease.js";
@@ -24,6 +25,7 @@ import { createBashOutputTool } from "./tools/bash-output.js";
 import { createBashResizeTool } from "./tools/bash-resize.js";
 import { TERMINAL_CHILD_JOB_KINDS, terminalChildJob } from "./tools/child-placement.js";
 import { createKillBashTool } from "./tools/kill-bash.js";
+import { resolveForegroundWindowSeconds } from "./tools/foreground-window.js";
 import { bindTerminalManifestWriter, createMonitorTool } from "./tools/monitor.js";
 /**
  * Only paced (persistent command) watches of a session with a durable state dir get an overflow file.
@@ -218,7 +220,12 @@ export function registerTerminalExtension(pi) {
     });
     pi.on("before_agent_start", async (event) => {
         return {
-            systemPrompt: `${event.systemPrompt}\n${buildTerminalPromptSection({ evalOnly: isEvalOnlyRouting(pi), ptyBash: !state.steppedAside })}`,
+            systemPrompt: `${event.systemPrompt}\n${buildTerminalPromptSection({
+                evalOnly: isEvalOnlyRouting(pi),
+                ptyBash: !state.steppedAside,
+                foregroundWindowSeconds: resolveForegroundWindowSeconds(process.env),
+                defaultTimeoutSeconds: resolveBashTimeoutDefaults(process.env).defaultSeconds,
+            })}`,
         };
     }, { previewSafe: true });
     pi.on("session_shutdown", async (event, ctx) => {

package/dist/core/extensions/builtin/terminal/notify.js

@@ -1,3 +1,4 @@
+import { annotateShellTrust } from "../../../../engine-trust/shell-trust.js";
 import { withTerminalContext } from "./context-lifetime.js";
 import { sanitizeTerminalOutput } from "./output-format.js";
 import { describeExit } from "./tools/spawn.js";
@@ -26,7 +27,7 @@ export function getTerminalNotificationDelivery(deps, customType = TERMINAL_NOTI
         }),
     };
 }
-function buildNotice(id, runtime) {
+function buildNotice(id, runtime, trustText) {
     const status = describeExit(runtime) ?? "exited";
     const code = runtime.exitResult?.exitCode;
     const codeText = code === null || code === undefined ? "" : ` (exit code ${code})`;
@@ -40,7 +41,8 @@ function buildNotice(id, runtime) {
             : "";
         tailSection = `\nFinal output:\n${shown}${note}`;
     }
-    return `<system-reminder>Background terminal session ${id} finished: ${status}${codeText}.${tailSection}</system-reminder>`;
+    const trustSection = trustText === undefined ? "" : `\n${trustText}`;
+    return `<system-reminder>Background terminal session ${id} finished: ${status}${codeText}.${tailSection}${trustSection}</system-reminder>`;
 }
 /**
  * Notifies an interactive agent once when a background session completes.
@@ -68,7 +70,11 @@ export class TerminalNotifier {
         if (!delivery)
             return;
         this.notified.add(id);
-        delivery.send(buildNotice(id, runtime));
+        const annotation = annotateShellTrust({
+            exitCode: runtime.exitResult?.exitCode ?? null,
+            output: runtime.fullOutput(),
+        });
+        delivery.send(buildNotice(id, runtime, annotation?.text), annotation === undefined ? undefined : { details: { trust: annotation.trust } });
     }
 }
 //# sourceMappingURL=notify.js.map

package/dist/core/extensions/builtin/terminal/prompt.d.ts

@@ -3,6 +3,10 @@ export interface TerminalPromptOptions {
     readonly evalOnly: boolean;
     /** Native bash replaces PTY bash, but monitor and its terminal companions remain available. */
     readonly ptyBash?: boolean;
+    /** Seconds a foreground `bash` call blocks before it auto-detaches (`PI_BASH_FOREGROUND_SECONDS`). */
+    readonly foregroundWindowSeconds?: number;
+    /** `timeout` applied when a `bash` call sets none (`PI_BASH_DEFAULT_TIMEOUT_SECONDS`). */
+    readonly defaultTimeoutSeconds?: number;
 }
 /**
  * System-prompt guidance for the persistent-terminal tool suite (CC-close, snake_case).
@@ -11,7 +15,9 @@ export interface TerminalPromptOptions {
  * `eval` tool, so their call shapes are rendered per branch: a hardcoded direct shape
  * would teach a call the model cannot make. The steering companions
  * (`bash_output`/`bash_input`/`bash_resize`/`kill_bash`) stay callable by name in both; `bash_input` and
- * `bash_resize` are search-exposed and activate on that first call (senpi#4446).
+ * `bash_resize` are search-exposed and activate on that first call (senpi#4446). This section is also
+ * the one home of the bash timeout facts (kill deadline, default, foreground auto-detach); the separate
+ * timeout policy section folded into it (senpi#5335).
  */
 export declare function buildTerminalPromptSection(options: TerminalPromptOptions): string;
 //# sourceMappingURL=prompt.d.ts.map

package/dist/core/extensions/builtin/terminal/prompt.js

@@ -1,3 +1,5 @@
+import { BASH_DEFAULT_TIMEOUT_SECONDS } from "../bash-timeout/timeout.js";
+import { DEFAULT_FOREGROUND_WINDOW_SECONDS } from "./tools/foreground-window.js";
 /**
  * System-prompt guidance for the persistent-terminal tool suite (CC-close, snake_case).
  *
@@ -5,74 +7,39 @@
  * `eval` tool, so their call shapes are rendered per branch: a hardcoded direct shape
  * would teach a call the model cannot make. The steering companions
  * (`bash_output`/`bash_input`/`bash_resize`/`kill_bash`) stay callable by name in both; `bash_input` and
- * `bash_resize` are search-exposed and activate on that first call (senpi#4446).
+ * `bash_resize` are search-exposed and activate on that first call (senpi#4446). This section is also
+ * the one home of the bash timeout facts (kill deadline, default, foreground auto-detach); the separate
+ * timeout policy section folded into it (senpi#5335).
  */
 export function buildTerminalPromptSection(options) {
+    const ptyBash = options.ptyBash !== false;
     const bash = options.evalOnly ? "tool.bash" : "bash";
     const monitor = options.evalOnly ? "tool.monitor" : "monitor";
-    const bashGuidance = options.ptyBash === false
+    const window = options.foregroundWindowSeconds ?? DEFAULT_FOREGROUND_WINDOW_SECONDS;
+    const defaultTimeout = options.defaultTimeoutSeconds ?? BASH_DEFAULT_TIMEOUT_SECONDS;
+    const evalOnlyReach = !options.evalOnly
         ? ""
-        : `The \`bash\` tool is PTY-backed. For long-running or interactive work, do NOT use tmux or
-manual \`&\` backgrounding; use the built-in session tools:
-
-- \`${bash}({ command, run_in_background: true })\` starts a persistent session and returns a
-  \`bash_id\` immediately. Foreground calls still block and return output; their \`timeout\`
-  (seconds) is a kill deadline. Background sessions ignore \`timeout\` and live until they
-  exit or you call \`kill_bash\`. Backgrounding is not a session: a plain \`&\` job dies with the
-  call's PTY hangup (native backend), \`nohup\` at best leaves an untracked orphan (no \`bash_id\`,
-  no log) that the call's timeout still group-kills; only \`run_in_background\` creates a
-  session that outlives the call.
-`;
+        : ptyBash
+            ? '`bash`, `monitor`: eval-only, call as `tool.bash({ command })` / `tool.monitor(...)`; params via `tool_schema("bash")` / `tool_schema("monitor")`. '
+            : '`monitor`: eval-only, call as `tool.monitor(...)`; params via `tool_schema("monitor")`. ';
+    const bashGuidance = ptyBash
+        ? `\`bash\` = PTY. Never tmux, plain \`&\`, or \`nohup\` (PTY hangup or call timeout kills them). Only \`${bash}({ command, run_in_background: true })\` -> session outliving the call, returns \`bash_id\`. Foreground call blocks ~${window}s then auto-detaches alive to background. \`timeout\` (seconds, default ${defaultTimeout}) = process kill deadline, not output wait; background sessions ignore it.`
+        : "";
+    const opening = `${evalOnlyReach}${bashGuidance}`.trimEnd();
+    const longerJob = ptyBash
+        ? "longer job: `run_in_background` + watch only"
+        : "longer job: `persistent: true` + stop via `kill_bash`";
     return `
 ## Persistent terminal sessions
 
-${bashGuidance}- \`bash_output({ bash_id, filter, view })\` peeks at a session without blocking: new output
-  since the last read, the status line, or a rendered full-screen snapshot of TUIs via
-  \`view: "screen"\`. Completion arrives as a notification carrying the exit code and output
-  tail: peeking is for steering, never for waiting.
-- For observable state (CI checks, builds, log patterns, deploys, files or other sessions),
-  register \`${monitor}\` and keep working instead of foreground sleeping/polling or repeatedly
-  calling \`bash_output\`. Sleep loops belong inside the monitor command.
-- \`${monitor}\` subscribes you to a change. Pass exactly one source (\`command\`, \`path\` or
-  \`target\`; one branch per call, never two):
-  - \`${monitor}({ description, command, filter?, timeout_ms?, persistent? })\` watches a command:
-    newline-terminated PTY output lines (stderr included) matching \`filter\` arrive as injected
-    events while you keep working; command exit always delivers a summary. \`timeout_ms\` is
-    that watch's own deadline: it KILLS the watched command when it fires (the summary says
-    \`killed at deadline\`); ${options.ptyBash === false
-        ? "for longer jobs, set `persistent: true` and stop with `kill_bash`."
-        : "for longer jobs, start with `run_in_background` and only watch them."} One-shot gate: wait
-    inside the command and print one sentinel (\`until <cond>; do sleep 1; done;
-    printf 'READY\\n'\`) with \`filter: "^READY$"\`. Stream: \`tail -n 0 -F <log> | grep --line-buffered <pat>\`
-    with \`persistent: true\`. Filter noise at the
-    source and stop with \`kill_bash\`. Persistent command watches are re-run after a restart with
-    \`SENPI_MONITOR_RESTORED=1\`; keep any baseline in \`$SENPI_MONITOR_STATE_DIR\` so a move during
-    downtime (at most \`$SENPI_MONITOR_DOWNTIME_MS\` ms) is still reported:
-    \`b="$SENPI_MONITOR_STATE_DIR/base"; p=$(cat "$b" 2>/dev/null || git rev-parse origin/main | tee "$b"); while sleep 30; do git fetch -q || true; n=$(git rev-parse origin/main); [ "$n" != "$p" ] && { echo "MOVED $p..$n"; p=$n; echo "$p" > "$b"; }; done\`.
-    A watch whose command exits is not restarted, so keep failures inside the loop non-fatal.
-  - \`${monitor}({ description, path, event?, persistent? })\` natively watches one regular file and
-    fires once: prefer it over a shell poll loop. \`"create"\` (the default) fires only when the file
-    appears after registration, so watch an already-existing file with \`"modify"\`; registration needs
-    the parent directory to exist already, so poll with a \`command\` when the run creates that
-    directory too. This branch takes no \`filter\`.
-  - \`${monitor}({ type: "rpc", target, description, events?, exclude?, filter?, persistent? })\` watches other
-    sessions over every RPC host and terminal: \`target: "children"\` (sessions you spawned, including
-    later ones), \`"all"\`, or one session id, path or \`st_\` task id. The result lists each matched
-    session as it is now; then each status change (\`rpc <label> status running -> idle ...\`) and
-    effect receipt arrives as an event. \`events: "all"\` adds their content, streaming collapsed to one
-    line per 2 s; \`exclude\` drops kinds. Watching never attaches to a session.
-  A standing watch is marked \`persistent: true\`: it has no deadline, survives a session restart
-  (the file is rescanned and any change missed while detached reported), expires 7 days after
-  creation, has no per-session cap unless the \`terminal.maxDurableMonitors\` setting sets one,
-  and is accounted for in one restart-report line on session start.
-  Identical updates are deduped; repeated monitor-only wakes pause the noisy monitor(s) that
-  caused them, not all monitors. Completion still wakes the session, and
-  \`${monitor}({ action: "rearm", bash_id })\` resumes one while \`${monitor}({ action: "rearm" })\`
-  resumes all paused monitors; real user input also resumes paused monitors.
-- \`bash_input({ bash_id, input, keys, submit })\` sends stdin or named keys (e.g.
-  \`["ctrl+c"]\`, \`["enter"]\`) to steer a REPL or interrupt a process.
-- \`bash_resize({ bash_id, cols, rows })\` resizes the PTY so full-screen programs reflow.
-- \`kill_bash({ bash_id })\` (or \`{ all: true }\`) tears the session tree down with no orphans.
+${opening ? `${opening}\n\n` : ""}- \`bash_output({ bash_id, filter, view })\`: non-blocking peek (new output / status line / \`view: "screen"\` for TUI). Completion = notification with exit code + tail. Peek to steer, never to wait.
+- Waiting on observable state (CI, build, log pattern, deploy, file, other session): register \`${monitor}\`, keep working. No sleep/poll in cells, no repeated \`bash_output\`; sleep loops live inside monitor command. Exactly one source per call:
+  - \`${monitor}({ description, command, filter?, timeout_ms?, persistent? })\`: lines matching \`filter\` -> events; exit -> summary. \`timeout_ms\` KILLS watched command; ${longerJob}. One-shot gate: \`until <cond>; do sleep 1; done; printf 'READY\\n'\` + \`filter: "^READY$"\`. Stream: \`tail -n 0 -F <log> | grep --line-buffered <pat>\` + \`persistent: true\`. Filter noise at source; stop via \`kill_bash\`.
+  - \`${monitor}({ description, path, event?, persistent? })\`: one regular file, parent dir must exist, fires once, no \`filter\`. \`"create"\` (default) fires only for a file that appears after registration; existing file -> \`event: "modify"\`; run creates the dir too -> \`command\` poll.
+  - \`${monitor}({ type: "rpc", target, description, events?, exclude?, filter?, persistent? })\`: \`target\` = \`"children"\` / \`"all"\` / one session id, path, \`st_\` id. Status changes + effect receipts -> events; \`events: "all"\` adds content; \`exclude\` drops kinds.
+- \`persistent: true\`: no deadline, survives restart (command re-run with \`SENPI_MONITOR_RESTORED=1\`, file rescanned), expires 7 days. Baseline in \`$SENPI_MONITOR_STATE_DIR\` so a move during downtime (<= \`$SENPI_MONITOR_DOWNTIME_MS\` ms) still reported. Loop failures non-fatal: exited watch not restarted.
+- Repeated monitor-only wakes pause that noisy monitor only. \`${monitor}({ action: "rearm", bash_id })\` resumes one; \`${monitor}({ action: "rearm" })\` all. Completion and real user input also resume.
+- \`bash_input({ bash_id, input, keys, submit })\`: stdin or keys (\`["ctrl+c"]\`, \`["enter"]\`). \`bash_resize({ bash_id, cols, rows })\`: reflow TUI. \`kill_bash({ bash_id })\` / \`{ all: true }\`: tear down session tree.
 `;
 }
 //# sourceMappingURL=prompt.js.map

package/dist/core/extensions/builtin/terminal/tools/bash.js

@@ -1,4 +1,5 @@
 import { Type } from "typebox";
+import { annotateShellTrust } from "../../../../../engine-trust/shell-trust.js";
 import { formatTerminalToolOutput } from "../output-format.js";
 import { BACKGROUND_START_GRACE_MS, DEFAULT_COLS, DEFAULT_ROWS, FOREGROUND_ENV_OVERRIDES, KILLED_SESSION_EXIT_GRACE_MS, TERMINAL_BASH_TOOL, } from "../shared.js";
 import { errorResult, noticedResult, textResult, } from "./context.js";
@@ -317,7 +318,14 @@ async function runForeground(ctx, input, cols, rows, signal, cwd, onUpdate, exec
     }
     const status = describeExit(runtime);
     if (exit && exit.exitCode !== 0 && exit.exitCode !== null) {
-        return errorResult(`${output ? `${output}\n\n` : ""}Command exited with code ${exit.exitCode}`);
+        const text = `${output ? `${output}\n\n` : ""}Command exited with code ${exit.exitCode}`;
+        const annotation = annotateShellTrust({ exitCode: exit.exitCode, output: runtime.fullOutput() });
+        if (annotation === undefined)
+            return errorResult(text);
+        return textResult(annotation.text === undefined ? text : `${text}\n\n${annotation.text}`, {
+            details: { trust: annotation.trust },
+            isError: true,
+        });
     }
     return noticedResult(output || "(no output)", [formatted.marker], {
         details: {
@@ -357,7 +365,7 @@ export function createPtyBashTool(ctx) {
         label: "bash",
         description: "Execute a shell command in a persistent PTY-backed session. Set run_in_background:true for long-lived or interactive sessions; steer them with bash_input, snapshot with bash_output, tear down with kill_bash. To wait on observable state (a build finishing, a server coming up, a log line), never run sleep or poll loops: subscribe with the monitor tool instead. Foreground blocking stops at the ~60s window and a still-running command auto-detaches to a live background session; `timeout` is the process kill deadline in seconds.",
         promptSnippet: "Run shell commands; run_in_background:true for long-lived/interactive PTY sessions",
-        promptGuidelines: ["You can inspect PI_* environment variables for current model and session details."],
+        promptGuidelines: ["PI_* env vars = current model + session details."],
         parameters: ptyBashSchema,
         async execute(_toolCallId, input, signal, onUpdate, execCtx) {
             const cols = resolveDimension(input.cols, ctx.defaultCols || DEFAULT_COLS);

package/dist/core/extensions/builtin/todotools/normalize.d.ts

@@ -1,10 +1,27 @@
-import type { TodoOpEntry, TodoPhase } from "./todo-types.ts";
+import { type TodoOpEntry, type TodoPhase } from "./todo-types.ts";
 export type TodoNormalization = {
     entry?: TodoOpEntry;
     corrections: string[];
     error?: string;
 };
-/** The todo tool's `prepareArguments`: returns the arguments with `list` unwrapped to its canonical shape. */
-export declare function prepareTodoArguments(args: unknown): unknown;
+/**
+ * The todo tool's `prepareArguments`: rewrites near-canonical shapes (senpi#5148 wrappers,
+ * senpi#5332 list/op corrections) to the canonical one before schema validation. Any call a
+ * rule does not correct is returned as the SAME reference, and a correction that would leave
+ * `list` empty is abandoned entirely so the malformed call still fails validation instead of
+ * clearing the todo list. A caller-sent `TODO_PREPARED_CORRECTIONS_KEY` is never trusted
+ * (senpi#5332): it is dropped on a copy before any rule runs, and when that removal is the
+ * only change the stripped copy is returned instead of the same reference.
+ */
+export declare function prepareTodoArguments(input: unknown): unknown;
+/**
+ * Splits the prepare-time correction notices off prepared arguments (see
+ * `TODO_PREPARED_CORRECTIONS_KEY`): the arguments without the reserved key, plus the notices
+ * to prepend to `normalizeTodoParams`'s own corrections.
+ */
+export declare function splitPreparedCorrections(args: Record<string, unknown>): {
+    args: Record<string, unknown>;
+    corrections: string[];
+};
 export declare function normalizeTodoParams(raw: Record<string, unknown>, currentPhases: readonly TodoPhase[]): TodoNormalization;
 //# sourceMappingURL=normalize.d.ts.map