@gajae-code/coding-agent 0.14.0 → 0.14.1

package/src/session/agent-session.ts

@@ -7562,6 +7562,15 @@ export class AgentSession {
 			disposeVmContextsByOwner(kernelOwnerId).catch((error: unknown) =>
 				logger.warn("signal teardown: disposeVmContextsByOwner failed", { error }),
 			),
+			// Tool-owned resources (e.g. an autoresearch mission's persistent Python
+			// kernel) register their own disposer and are keyed by an owner id that is
+			// NOT #evalKernelOwnerId, so the two disposals above never reach them. Drain
+			// them here inside the same budget: without this a signal exit orphans the
+			// subprocess. #runToolSessionCleanups already clears the set, so the graceful
+			// dispose path running first makes this a no-op rather than a double free.
+			this.#runToolSessionCleanups().catch((error: unknown) =>
+				logger.warn("signal teardown: tool session cleanups failed", { error }),
+			),
 		]);
 		await Promise.race([work, Bun.sleep(timeoutMs)]);
 	}

package/src/session/blob-store.ts

@@ -43,9 +43,18 @@ const ownedResidentCacheInstanceDirs = new Set<string>();
 const activeResidentCacheRootSweeps = new Set<string>();
 let ownResidentCacheProcessStartTimeMs: number | null | undefined;
 
+/** Marks `startTimeMs` as an absolute instant parsed from a UTC-pinned `ps` render. */
+const RESIDENT_CACHE_START_TIME_BASIS = "utc";
+
 interface ResidentCacheOwnerToken {
 	readonly pid: number;
 	readonly startTimeMs: number | null;
+	/**
+	 * Absent on tokens written before the start time was pinned to UTC. Such a
+	 * value is a wall clock in the writer's zone, so comparing it against an
+	 * absolute one proves nothing about PID reuse and must not imply staleness.
+	 */
+	readonly startTimeBasis?: string;
 	readonly nonce: string;
 	readonly createdAt?: number;
 }
@@ -87,6 +96,16 @@ export class BlobCorruptError extends Error {
  * memory before retrying the triggering write.
  */
 export class ResidentCacheTrustError extends Error {
+	/**
+	 * errno of the OS failure this rejection wrapped (`ENOENT`, `EMFILE`, `EACCES`, …),
+	 * or `undefined` when the rejection was a pure policy decision with no cause.
+	 * `reason` alone names the *step* that failed; only this names *why*, so a
+	 * demotion is diagnosable from a log line instead of requiring a debugger.
+	 */
+	readonly causeCode: string | undefined;
+	/** Bounded one-line rendering of the wrapped cause for logs that must not serialize an arbitrary thrown value. */
+	readonly causeSummary: string | undefined;
+
 	constructor(
 		readonly reason: string,
 		readonly path: string,
@@ -94,7 +113,27 @@ export class ResidentCacheTrustError extends Error {
 	) {
 		super(`Resident cache trust validation failed (${reason}): ${path}`, options);
 		this.name = "ResidentCacheTrustError";
+		this.causeCode = errorCode(options?.cause);
+		this.causeSummary = summarizeResidentCacheTrustCause(options?.cause);
+	}
+}
+
+const RESIDENT_CACHE_CAUSE_SUMMARY_MAX_CHARS = 200;
+
+function summarizeResidentCacheTrustCause(cause: unknown): string | undefined {
+	if (cause === undefined) return undefined;
+	let text: string;
+	try {
+		text = cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
+	} catch {
+		// A cause whose own stringification throws must not turn a demotion into a crash.
+		return "<uninspectable cause>";
 	}
+	text = text.replace(/\s+/g, " ").trim();
+	if (!text) return undefined;
+	return text.length > RESIDENT_CACHE_CAUSE_SUMMARY_MAX_CHARS
+		? `${text.slice(0, RESIDENT_CACHE_CAUSE_SUMMARY_MAX_CHARS - 1)}…`
+		: text;
 }
 
 function residentCacheTrustError(reason: string, pathname: string, cause?: unknown): ResidentCacheTrustError {
@@ -201,17 +240,25 @@ function residentCacheProcessStartTimeMs(pid: number): number | null {
 		return ownResidentCacheProcessStartTimeMs;
 	}
 
-	// Mirror file-lock's `ps`-based process incarnation probe, but pin the
-	// locale so its `lstart` output can be represented as a stable epoch value.
+	// Mirror file-lock's `ps`-based process incarnation probe, but pin the locale
+	// AND the zone. `lstart` is a zoneless local wall clock rendered by `ps` from
+	// /etc/localtime, while `Date.parse` of a zoneless string binds it to the JS
+	// runtime's own zone. Those are two independent resolutions, so a reader whose
+	// runtime resolves UTC while `ps` renders UTC+9 derives an epoch nine hours off
+	// for the very same live process — and this value's only job is to detect PID
+	// reuse, so a disagreeing reader reports every live owner as reused and the GC
+	// reaps a running session's cache. Pinning TZ on the child fixes the rendering
+	// side; the explicit GMT suffix fixes the parsing side.
 	let startTimeMs: number | null = null;
 	try {
 		const result = Bun.spawnSync(["ps", "-o", "lstart=", "-p", String(pid)], {
 			stdout: "pipe",
 			stderr: "ignore",
-			env: { ...process.env, LC_ALL: "C", LANG: "C" },
+			env: { ...process.env, LC_ALL: "C", LANG: "C", TZ: "UTC" },
 		});
 		if (result.exitCode === 0) {
-			const parsed = Date.parse(new TextDecoder().decode(result.stdout).trim());
+			const rendered = new TextDecoder().decode(result.stdout).trim();
+			const parsed = rendered ? Date.parse(`${rendered} GMT`) : Number.NaN;
 			if (Number.isFinite(parsed)) startTimeMs = parsed;
 		}
 	} catch {
@@ -255,9 +302,10 @@ function parseResidentCacheOwnerToken(text: string): ResidentCacheOwnerToken | n
 		return null;
 	}
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
-	const { pid, startTimeMs, nonce, createdAt } = parsed as {
+	const { pid, startTimeMs, startTimeBasis, nonce, createdAt } = parsed as {
 		pid?: unknown;
 		startTimeMs?: unknown;
+		startTimeBasis?: unknown;
 		nonce?: unknown;
 		createdAt?: unknown;
 	};
@@ -266,17 +314,30 @@ function parseResidentCacheOwnerToken(text: string): ResidentCacheOwnerToken | n
 		!Number.isInteger(pid) ||
 		pid <= 0 ||
 		(startTimeMs !== null && (typeof startTimeMs !== "number" || !Number.isFinite(startTimeMs))) ||
+		(startTimeBasis !== undefined && typeof startTimeBasis !== "string") ||
 		typeof nonce !== "string" ||
 		nonce.length === 0 ||
 		(createdAt !== undefined && (typeof createdAt !== "number" || !Number.isFinite(createdAt)))
 	) {
 		return null;
 	}
-	return createdAt === undefined ? { pid, startTimeMs, nonce } : { pid, startTimeMs, nonce, createdAt };
+	return {
+		pid,
+		startTimeMs,
+		...(startTimeBasis === undefined ? {} : { startTimeBasis }),
+		nonce,
+		...(createdAt === undefined ? {} : { createdAt }),
+	};
 }
 
 function sameResidentCacheOwnerToken(a: ResidentCacheOwnerToken, b: ResidentCacheOwnerToken): boolean {
-	return a.pid === b.pid && a.startTimeMs === b.startTimeMs && a.nonce === b.nonce && a.createdAt === b.createdAt;
+	return (
+		a.pid === b.pid &&
+		a.startTimeMs === b.startTimeMs &&
+		a.startTimeBasis === b.startTimeBasis &&
+		a.nonce === b.nonce &&
+		a.createdAt === b.createdAt
+	);
 }
 
 function readResidentCacheOwnerSnapshot(instanceDir: string, uid: number): ResidentCacheOwnerSnapshot | null {
@@ -313,6 +374,7 @@ function writeResidentCacheOwnerToken(instanceDir: string, uid: number): void {
 	const owner: ResidentCacheOwnerToken = {
 		pid: process.pid,
 		startTimeMs: residentCacheProcessStartTimeMs(process.pid),
+		startTimeBasis: RESIDENT_CACHE_START_TIME_BASIS,
 		nonce,
 		createdAt: Date.now(),
 	};
@@ -526,6 +588,10 @@ function residentCacheOwnerIsStale(
 	const liveness = residentCacheOwnerLiveness(owner.pid);
 	if (liveness === "dead") return true;
 	if (liveness !== "alive" || owner.startTimeMs === null) return false;
+	// A token from before the UTC pin carries a zone-dependent wall clock. Comparing
+	// it against an absolute instant would read an ordinary timezone offset as PID
+	// reuse and reap a live owner, so an unlabelled basis leaves reuse unproven.
+	if (owner.startTimeBasis !== RESIDENT_CACHE_START_TIME_BASIS) return false;
 	const currentStartTimeMs = cachedResidentCacheProcessStartTimeMs(owner.pid, startTimeCache);
 	return currentStartTimeMs !== null && currentStartTimeMs !== owner.startTimeMs;
 }

package/src/session/session-manager.ts

@@ -33,6 +33,7 @@ import {
 	getTerminalSessionsDir,
 	hasFsCode,
 	isEnoent,
+	isFsError,
 	logger,
 	parseJsonlLenient,
 	pathIsWithin,
@@ -288,6 +289,7 @@ type ResidentTransitionSource =
 				textStore: BlobStore | null;
 				imageStore: BlobStore;
 				textFallback?: (hash: string) => Buffer | null;
+				onResidentBlobMissing?: (kind: ResidentBlobKind, hash: string) => void;
 			};
 			missingPolicy?: ResidentBlobMissingPolicy;
 	  }
@@ -371,7 +373,7 @@ interface FreshSessionState {
 	readonly adoptsLifecycleId: boolean;
 }
 
-type ResidentCacheDegradedStore = BlobStore & { degradedReason?: string };
+type ResidentCacheDegradedStore = BlobStore & { degradedReason?: string; degradedCauseCode?: string };
 
 const RESIDENT_CACHE_WRITE_FAILURE_REASONS = new Set([
 	"root_create_failed",
@@ -452,6 +454,8 @@ export interface SessionManagerObservabilityStats {
 	residentCacheTrustRejectCount: number;
 	residentCacheWin32FallbackCount: number;
 	residentCacheDegradedReason?: string;
+	residentCacheDegradedCauseCode?: string;
+	residentBlobPlaceholderCount: number;
 	publicMaterializerCallCount: number;
 	getEntryMaterializerCallCount: number;
 	getBranchMaterializerCallCount: number;
@@ -4528,7 +4532,7 @@ async function getSortedSessions(
 						)
 							return undefined;
 						if (typeof header.version === "number" && header.version >= 4) {
-							for (const patch of await readSessionListTrailingPatches(candidate.path, storage, buffer)) {
+							for (const patch of await readSessionListTrailingPatches(candidate.path, storage)) {
 								applySessionListHeaderPatch(header as unknown as SessionListHeader, patch);
 							}
 						}
@@ -4964,6 +4968,8 @@ interface ResidentBlobStores {
 	sessionId?: string;
 	sessionFile?: string;
 	onResidentBlobRead?: (kind: ResidentBlobKind) => void;
+	/** Fired when `missingPolicy: "placeholder"` substitutes for content that is gone for good. */
+	onResidentBlobMissing?: (kind: ResidentBlobKind, hash: string) => void;
 }
 
 function residentBlobMissingPlaceholder(error: ResidentBlobMissingError): string {
@@ -5048,6 +5054,7 @@ function materializeResidentValueSync(
 		} catch (err) {
 			if (missingPolicy === "placeholder" && err instanceof ResidentBlobMissingError) {
 				resolved = residentBlobMissingPlaceholder(err);
+				stores.onResidentBlobMissing?.(err.kind, err.hash);
 			} else {
 				throw err;
 			}
@@ -5569,6 +5576,48 @@ function rehydrateColdSpillValue(
 	return Object.fromEntries(entries);
 }
 
+/**
+ * Enforce the provider-facing invariant that a tool call's `arguments` is an
+ * object, after cold-spill rehydration has had its say.
+ *
+ * `rehydrateColdSpillRef` reports an unrecoverable payload by returning the
+ * human-readable `coldSpillUnavailable(...)` sentence, and a blob holding a
+ * non-object JSON value rehydrates as that value. Either outcome lands a
+ * non-object on `toolCall.arguments`, which every provider then forwards
+ * verbatim — Anthropic serializes it straight into `tool_use.input` and the
+ * request fails with `tool_use.input: Input should be a valid dictionary`.
+ * That rejection is fatal for the whole transcript, so one missing blob makes
+ * a session permanently unresumable with no actionable diagnostic.
+ *
+ * Degrade to the existing malformed-arguments contract instead: the recovered
+ * text is preserved under `recoveryNotice` for the reader, and the agent loop
+ * rejects just that call with reason-specific, retryable guidance rather than
+ * letting the provider reject the entire request.
+ */
+function enforceToolCallArgumentObjects(message: AgentMessage): AgentMessage {
+	if (message.role !== "assistant" || !Array.isArray(message.content)) return message;
+	let changed = false;
+	const content = message.content.map(block => {
+		if (block.type !== "toolCall" || isRecord(block.arguments)) return block;
+		changed = true;
+		const recovered = block.arguments;
+		return {
+			...block,
+			arguments: {
+				recoveryNotice:
+					typeof recovered === "string"
+						? recovered
+						: `[Cold-spill payload for this tool call rehydrated as ${
+								recovered === null ? "null" : typeof recovered
+							}, not an object]`,
+			},
+			incompleteArguments: true,
+			incompleteArgumentsReason: "malformed" as const,
+		};
+	});
+	return changed ? ({ ...message, content } as AgentMessage) : message;
+}
+
 function rehydrateColdSpillEntry(
 	entry: SessionEntry,
 	blobStore: BlobStore,
@@ -5576,13 +5625,9 @@ function rehydrateColdSpillEntry(
 ): SessionEntry {
 	if (entry.type === "message") {
 		const marker = entry.evictedContent;
-		const message = rehydrateColdSpillValue(
-			entry.message,
-			marker,
-			blobStore,
-			"message",
-			residentStores,
-		) as AgentMessage;
+		const message = enforceToolCallArgumentObjects(
+			rehydrateColdSpillValue(entry.message, marker, blobStore, "message", residentStores) as AgentMessage,
+		);
 		return { ...entry, message };
 	}
 	if (entry.type === "custom_message") {
@@ -6276,7 +6321,13 @@ function extractTextFromContent(content: Message["content"]): string {
 }
 
 const SESSION_LIST_PREFIX_BYTES = 4096;
-const SESSION_LIST_TRAILING_PATCH_BYTES = 4096;
+// Reverse-scan chunk for trailing header patches. Sized independently of the
+// 4 KiB prefix buffer: the scan walks back to BOF whenever a field stays
+// unresolved (#3633), which is the common case because most transcripts carry
+// no header_patch at all. A 4 KiB chunk turned that walk into one read syscall
+// per 4 KiB of transcript and defeated OS readahead, so listing cost scaled
+// with total transcript bytes on every resume.
+const SESSION_LIST_TRAILING_PATCH_BYTES = 64 * 1024;
 const SESSION_NAME_MAX_CHARS = 1_000;
 const SESSION_LIST_PARALLEL_THRESHOLD = 64;
 const SESSION_LIST_MAX_WORKERS = 16;
@@ -6299,7 +6350,6 @@ async function readSessionListPrefix(file: string, storage: SessionStorage, buff
 async function readSessionListTrailingPatches(
 	file: string,
 	storage: SessionStorage,
-	buffer: Buffer,
 ): Promise<HeaderPatchRecord["patch"][]> {
 	if (!(storage instanceof FileSessionStorage)) {
 		const content = await storage.readText(file);
@@ -6317,8 +6367,15 @@ async function readSessionListTrailingPatches(
 	// window when a field is still missing so a buried but canonically valid
 	// header_patch remains listable without a full sequential JSONL parse (#3633).
 	// Chunks that cannot contain a header_patch marker skip JSON parsing.
+	//
+	// The scan owns its buffer instead of borrowing the caller's 4 KiB prefix
+	// buffer. A transcript with no header_patch at all — the common case, since
+	// only /rename and workspace moves emit one — cannot be recognized without
+	// reaching BOF, so the chunk size sets how many read syscalls a resume costs
+	// per transcript byte.
 	let trailingFragment = Buffer.alloc(0);
-	const chunkSize = Math.min(buffer.byteLength, SESSION_LIST_TRAILING_PATCH_BYTES);
+	const chunkSize = Math.min(size, SESSION_LIST_TRAILING_PATCH_BYTES);
+	const buffer = Buffer.allocUnsafe(chunkSize);
 	const headerPatchMarker = Buffer.from("header_patch");
 	const handle = await fs.promises.open(file, "r");
 	try {
@@ -6518,7 +6575,7 @@ async function collectSessionFromFile(
 		const header = parseSessionListHeader(content, entries);
 		if (!header) return undefined;
 		if (typeof header.version === "number" && header.version >= 4 && header.version <= CURRENT_SESSION_VERSION) {
-			for (const patch of await readSessionListTrailingPatches(file, storage, buffer)) {
+			for (const patch of await readSessionListTrailingPatches(file, storage)) {
 				applySessionListHeaderPatch(header, patch);
 			}
 		}
@@ -7089,6 +7146,7 @@ export class SessionManager {
 	#residentImageReadCount = 0;
 	#residentCacheAdoptFallbackCount = 0;
 	#residentCacheTrustRejectCount = 0;
+	#residentBlobPlaceholderCount = 0;
 	#residentCacheWin32FallbackCount = 0;
 	#publicMaterializerCallCount = 0;
 	#getEntryMaterializerCallCount = 0;
@@ -7337,6 +7395,7 @@ export class SessionManager {
 				textStore: sourceTextStore,
 				imageStore: source.sourceStores.imageStore,
 				textFallback: source.sourceStores.textFallback,
+				onResidentBlobMissing: source.sourceStores.onResidentBlobMissing,
 			},
 
 			source.missingPolicy,
@@ -7595,11 +7654,14 @@ export class SessionManager {
 	#demoteResidentTextStoreAfterTrustReject(error: ResidentCacheTrustError): void {
 		const predecessor = this.#residentTextBlobStore;
 		(predecessor as ResidentCacheDegradedStore).degradedReason = error.reason;
+		(predecessor as ResidentCacheDegradedStore).degradedCauseCode = error.causeCode;
 		this.#residentCacheTrustRejectCount++;
 		logger.warn("Resident cache trust rejection; demoting resident text store", {
 			sessionId: this.#sessionId,
 			sessionFile: this.#sessionFile,
 			reason: error.reason,
+			causeCode: error.causeCode,
+			cause: error.causeSummary,
 		});
 		const persistedTextFallback =
 			predecessor instanceof EphemeralBlobStore ? this.#createPersistedResidentTextFallback() : undefined;
@@ -7618,12 +7680,30 @@ export class SessionManager {
 							predecessor instanceof EphemeralBlobStore
 								? hash => predecessor.getBufferedSync(hash) ?? persistedTextFallback?.(hash) ?? null
 								: undefined,
+						onResidentBlobMissing: (kind, hash) => {
+							this.#residentBlobPlaceholderCount++;
+							logger.warn("Resident blob unrecoverable; substituted a placeholder", {
+								sessionId: this.#sessionId,
+								kind,
+								hash,
+								reason: error.reason,
+								causeCode: error.causeCode,
+							});
+						},
 					},
+					// This transition IS the salvage after the cache already failed, so it runs
+					// against a store that is by definition missing blobs. Inheriting the default
+					// fail-closed policy makes the recovery throw on the very entry it exists to
+					// rescue, which leaves the demotion uncommitted and repeats it every turn.
+					// The placeholder never emits a `blob:sha256:` ref, so the fail-closed
+					// invariant that policy protects is preserved.
+					missingPolicy: "placeholder",
 				},
 			},
 			"memory-only",
 		);
 		(prepared.store as ResidentCacheDegradedStore).degradedReason = error.reason;
+		(prepared.store as ResidentCacheDegradedStore).degradedCauseCode = error.causeCode;
 		this.#commitResidentTextStoreTransition(prepared);
 	}
 
@@ -11065,9 +11145,16 @@ export class SessionManager {
 				pending.dispose();
 				this.#managedSidecarCleanupStores.delete(pending);
 			} catch (error) {
-				const candidate = error instanceof ResidentCacheTrustError ? error.reason : "";
+				const trustError = error instanceof ResidentCacheTrustError ? error : undefined;
+				const candidate = trustError?.reason ?? "";
 				const reason = /^[a-z0-9_]{1,64}$/.test(candidate) ? candidate : "cleanup_failed";
-				logger.warn("Failed to dispose the managed sidecar resident cache; retained for retry", { reason });
+				// An errno is path-free, so it can join `reason` here; the cause *summary*
+				// cannot, because fs messages embed the sidecar cache path this record withholds.
+				const causeCode = trustError?.causeCode ?? (isFsError(error) ? error.code : undefined);
+				logger.warn("Failed to dispose the managed sidecar resident cache; retained for retry", {
+					reason,
+					...(causeCode === undefined ? {} : { causeCode }),
+				});
 			}
 		}
 	}
@@ -17121,6 +17208,8 @@ export class SessionManager {
 			residentCacheTrustRejectCount: this.#residentCacheTrustRejectCount,
 			residentCacheWin32FallbackCount: this.#residentCacheWin32FallbackCount,
 			residentCacheDegradedReason: (this.#residentTextBlobStore as ResidentCacheDegradedStore).degradedReason,
+			residentCacheDegradedCauseCode: (this.#residentTextBlobStore as ResidentCacheDegradedStore).degradedCauseCode,
+			residentBlobPlaceholderCount: this.#residentBlobPlaceholderCount,
 			publicMaterializerCallCount: this.#publicMaterializerCallCount,
 			getEntryMaterializerCallCount: this.#getEntryMaterializerCallCount,
 			getBranchMaterializerCallCount: this.#getBranchMaterializerCallCount,

package/src/slash-commands/builtin-registry.ts

@@ -50,7 +50,7 @@ import { buildFastStatusReport } from "./helpers/fast-status-report";
 import { formatDuration } from "./helpers/format";
 import { commandConsumed, errorMessage, parseSlashCommand, parseSubcommand, usage } from "./helpers/parse";
 import { handleSshAcp } from "./helpers/ssh";
-import { buildUsageReportText } from "./helpers/usage-report";
+import { buildUsageReportText, collectCachedUsageReports } from "./helpers/usage-report";
 import type {
 	BuiltinSlashCommand,
 	ParsedSlashCommand,
@@ -1348,7 +1348,16 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 				runtime.ctx.showError("Usage: /usage [check]");
 			} else {
 				const adapted = toSlashCommandRuntime(runtime);
-				await adapted.output(await buildUsageReportText(adapted, { check: args === "check" }));
+				// Plain `/usage` renders the graphical panel from the cache-only
+				// inventory snapshot — same data the text view reads, no fetch or
+				// probe. `/usage check` stays on the text path because its value is
+				// the per-credential health verdict, not the bars.
+				const cached = args === "" ? collectCachedUsageReports(adapted) : [];
+				if (cached.length > 0) {
+					await runtime.ctx.handleUsageCommand(cached);
+				} else {
+					await adapted.output(await buildUsageReportText(adapted, { check: args === "check" }));
+				}
 			}
 			runtime.ctx.editor.setText("");
 		},

package/src/slash-commands/helpers/usage-report.ts

@@ -1,4 +1,4 @@
-import type { UsageLimit } from "@gajae-code/ai/core";
+import type { UsageLimit, UsageReport } from "@gajae-code/ai/core";
 import { sanitizeText } from "@gajae-code/utils";
 import {
 	type AccountInventoryRow,
@@ -34,6 +34,60 @@ function healthLabel(row: AccountInventoryRow): string {
 	return "unknown";
 }
 
+/**
+ * Reset detail for one limit. The account rows dropped every reset signal when
+ * the panel was replaced, which left `/usage` unable to answer the question it
+ * exists for: how long until the quota comes back. Two-unit precision, because
+ * a single rounded unit reads `7d` at both 6.6 and 7.4 days remaining.
+ */
+function formatLimitReset(limit: UsageLimit, nowMs: number): string {
+	const resetsAt = limit.window?.resetsAt;
+	if (resetsAt === undefined || !Number.isFinite(resetsAt) || resetsAt <= nowMs) return "";
+	const totalMinutes = Math.floor((resetsAt - nowMs) / 60_000);
+	const totalHours = Math.floor(totalMinutes / 60);
+	let countdown: string;
+	if (totalMinutes < 1) countdown = "<1m";
+	else if (totalMinutes < 60) countdown = `${totalMinutes}m`;
+	else if (totalHours < 48) {
+		const minutes = totalMinutes % 60;
+		countdown = minutes > 0 ? `${totalHours}h ${minutes}m` : `${totalHours}h`;
+	} else {
+		const days = Math.floor(totalHours / 24);
+		const hours = totalHours % 24;
+		countdown = hours > 0 ? `${days}d ${hours}h` : `${days}d`;
+	}
+	const withinADay = resetsAt - nowMs < 24 * 3_600_000;
+	const at = new Date(resetsAt).toLocaleString(undefined, {
+		month: withinADay ? undefined : "short",
+		day: withinADay ? undefined : "numeric",
+		hour: "2-digit",
+		minute: "2-digit",
+	});
+	return `, resets in ${countdown} (${at})`;
+}
+
+/** One limit line: how much is left, and when it comes back. */
+export function formatLimitDetail(limit: UsageLimit, nowMs: number): string {
+	return `${formatUsageAmount(limit)}${formatLimitReset(limit, nowMs)}`;
+}
+
+/**
+ * Cache-only usage reports for the interactive panel. Mirrors the plain
+ * `/usage` contract exactly — reads the account inventory snapshot, never
+ * fetches or probes — so the graphical view can be restored without
+ * reintroducing the network call that motivated replacing it.
+ */
+export function collectCachedUsageReports(runtime: SlashCommandRuntime): UsageReport[] {
+	const session = runtime.session;
+	const modelRegistry = session.modelRegistry;
+	const snapshot = buildAccountInventorySnapshot({
+		authStorage: modelRegistry.authStorage,
+		modelRegistry,
+		sessionId: session.credentialSessionId ?? session.sessionId,
+	});
+	return snapshot.rows.flatMap(row => (row.usage ? [row.usage.report] : []));
+}
+
 function renderAccountRows(rows: AccountInventoryRow[], nowMs: number, checked: boolean): string {
 	const lines = [`Accounts${checked ? " (checked)" : " (cache only)"}`];
 	if (rows.length === 0) {
@@ -52,7 +106,7 @@ function renderAccountRows(rows: AccountInventoryRow[], nowMs: number, checked:
 		);
 		if (row.usage?.report.limits.length) {
 			for (const limit of row.usage.report.limits.slice(0, 8)) {
-				lines.push(`  ${sanitizeText(limit.label)}: ${formatUsageAmount(limit)}`);
+				lines.push(`  ${sanitizeText(limit.label)}: ${formatLimitDetail(limit, nowMs)}`);
 			}
 		}
 	}

package/src/tools/ask-contract.ts

@@ -99,7 +99,7 @@ const DeepInterviewMetadata = z.object({
 });
 
 const DeepInterviewTopologyMeta = DeepInterviewMetadata.extend({
-	round: z.literal(0).describe("Round 0 topology confirmation"),
+	round: z.number().int().min(0).max(0).describe("Round 0 topology confirmation"),
 	component: z.literal("review-topology"),
 	dimension: z.literal("topology"),
 	intent_contract: DeepInterviewIntentContract.describe("required Round 0 locked-intent contract"),

package/src/tools/computer.enforcement.test.ts

@@ -153,7 +153,15 @@ describe("computer enforcement red-team probes", () => {
 				observed: `code=${resultCode(permission)} message=${resultMessage(permission)} nativeScreenshotCalls=${permissionCalls}`,
 				verdict:
 					resultCode(permission) === "COMPUTER_PERMISSION_REQUIRED" &&
-					resultMessage(permission).includes("Screen & System Audio Recording or Accessibility")
+					// Assert the substance of the guidance contract -- the hint must name
+					// both required macOS permissions -- rather than one exact sentence.
+					// A literal pin is what rotted here before: the previous literal
+					// ("screen-recording or accessibility permission") went stale when the
+					// hint was reworded, silently failing this probe. Matching on the two
+					// permission names still fails if either is dropped, without
+					// re-arming that trap on the next rewording.
+					/recording/i.test(resultMessage(permission)) &&
+					/accessibility/i.test(resultMessage(permission))
 						? "passed"
 						: "failed",
 			});