@iowarp/clio-coder 0.3.8 → 0.4.0

package/src/interactive/renderers/worker-entry.ts

@@ -21,10 +21,16 @@
  * Pure: no I/O, no module-level mutable state beyond the shared theme handle.
  */
 
+import { parseJsonObjectPayload } from "../../core/json-payload.js";
 import { truncateToWidth, visibleWidth, wrapTextWithAnsi } from "../../engine/tui.js";
 import { formatFooterTokens } from "../footer-panel.js";
 import { type ClioToken, clioTheme, fitUnits, formatCompactMs, GLYPH } from "../theme/index.js";
-import { type WorkerEntryState, type WorkerReceiptSummary, workerAskedByModel } from "../worker-stream.js";
+import {
+	type WorkerEntryState,
+	type WorkerPresentedResultContract,
+	type WorkerReceiptSummary,
+	workerAskedByModel,
+} from "../worker-stream.js";
 
 const theme = clioTheme();
 const dim = (text: string): string => theme.fg("dim", text);
@@ -110,7 +116,7 @@ function isPending(entry: WorkerEntryState): boolean {
  * rendered as zero: an ACP peer reports no tokens at all, so its footer names
  * the tool calls it mediated instead of claiming it spent nothing.
  */
-function footerUnits(receipt: WorkerReceiptSummary): string[] {
+function footerUnits(entry: WorkerEntryState, receipt: WorkerReceiptSummary): string[] {
 	const units = [outcomeUnit(receipt, true)];
 	if (receipt.exitCode !== undefined && receipt.exitCode !== 0) {
 		units.push(theme.fg("error", `exit=${receipt.exitCode}`));
@@ -122,6 +128,8 @@ function footerUnits(receipt: WorkerReceiptSummary): string[] {
 	}
 	if (receipt.durationMs !== undefined) units.push(dim(formatCompactMs(receipt.durationMs)));
 	if (receipt.contract !== undefined) units.push(dim(`contract ${receipt.contract}`));
+	const presentation = presentedContractAnswer(entry);
+	if (presentation?.footer !== undefined) units.push(dim(presentation.footer));
 	if (receipt.abandonedDetail !== undefined) units.push(theme.fg("warning", receipt.abandonedDetail));
 	else if (receipt.receiptUnavailable === true) units.push(theme.fg("warning", "receipt unavailable"));
 	return units;
@@ -133,23 +141,120 @@ function railLines(text: string, token: ClioToken, width: number): string[] {
 	return wrapTextWithAnsi(text, contentWidth).map((row) => `${dim(RAIL)}${theme.fg(token, row)}`);
 }
 
-/** A worker's terminal answer when it is one JSON object, as a structured result contract asks for. */
+/** A worker's terminal JSON payload, using the same tolerant reader as its result contract. */
 function structuredAnswer(text: string): Record<string, unknown> | null {
-	const trimmed = text.trim();
-	if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return null;
-	try {
-		const parsed: unknown = JSON.parse(trimmed);
-		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
-			? (parsed as Record<string, unknown>)
-			: null;
-	} catch {
-		return null;
-	}
+	const parsed = parseJsonObjectPayload(text);
+	return parsed.ok ? parsed.value : null;
 }
 
 const isStringArray = (value: unknown): value is string[] =>
 	Array.isArray(value) && value.every((entry) => typeof entry === "string");
 
+function reportString(value: unknown): string | null {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+interface PresentedContractAnswer {
+	lines: string[];
+	footer?: string;
+}
+
+function debuggerReport(value: Record<string, unknown>): PresentedContractAnswer | null {
+	const diagnosis = reportString(value.diagnosis);
+	const reproduction = value.reproduction;
+	if (
+		diagnosis === null ||
+		(reproduction !== "reproduced" && reproduction !== "not-reproduced" && reproduction !== "unknown") ||
+		!isStringArray(value.evidence)
+	) {
+		return null;
+	}
+	return {
+		lines: [
+			diagnosis,
+			...(value.evidence.length === 0 ? ["Evidence: none"] : ["Evidence:", ...value.evidence.map((item) => `- ${item}`)]),
+		],
+		footer: `reproduction ${reproduction}`,
+	};
+}
+
+function verifierReport(value: Record<string, unknown>): PresentedContractAnswer | null {
+	if ((value.verdict !== "pass" && value.verdict !== "fail") || !Array.isArray(value.checks)) return null;
+	const lines: string[] = [];
+	for (const raw of value.checks) {
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+		const check = raw as Record<string, unknown>;
+		const name = reportString(check.name);
+		const evidence = reportString(check.evidence);
+		if (name === null || evidence === null || typeof check.passed !== "boolean") return null;
+		lines.push(`${check.passed ? GLYPH.ok : GLYPH.error} ${name}: ${evidence}`);
+	}
+	return { lines: lines.length === 0 ? ["No checks reported."] : lines, footer: `verdict ${value.verdict}` };
+}
+
+function researchReport(value: Record<string, unknown>): PresentedContractAnswer | null {
+	if ((value.source !== "local" && value.source !== "external") || !Array.isArray(value.findings)) return null;
+	const lines: string[] = [];
+	for (const raw of value.findings) {
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+		const finding = raw as Record<string, unknown>;
+		const claim = reportString(finding.claim);
+		const evidence = reportString(finding.evidence);
+		if (claim === null || evidence === null) return null;
+		lines.push(`- ${claim}`, `  citation: ${evidence}`);
+	}
+	return { lines: lines.length === 0 ? ["No findings reported."] : lines, footer: `source ${value.source}` };
+}
+
+function scoutReport(value: Record<string, unknown>): PresentedContractAnswer | null {
+	if (!Array.isArray(value.findings) || typeof value.needsSplit !== "boolean") return null;
+	const lines: string[] = [];
+	for (const raw of value.findings) {
+		if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+		const finding = raw as Record<string, unknown>;
+		const claim = reportString(finding.claim);
+		if (claim === null) return null;
+		const path = reportString(finding.path);
+		const line = typeof finding.line === "number" && Number.isSafeInteger(finding.line) ? finding.line : null;
+		lines.push(path !== null && line !== null ? `- ${claim} — ${path}:${line}` : `- ${claim} (ungrounded lead)`);
+	}
+	if (value.needsSplit) {
+		if (!Array.isArray(value.proposedSubtasks)) return null;
+		lines.push("Split recommended:");
+		for (const raw of value.proposedSubtasks) {
+			if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+			const subtask = raw as Record<string, unknown>;
+			const task = reportString(subtask.task);
+			const id = reportString(subtask.id);
+			if (task === null || id === null) return null;
+			lines.push(`- ${id}: ${task}`);
+		}
+	}
+	return {
+		lines: lines.length === 0 ? ["No findings reported."] : lines,
+		footer: value.needsSplit ? "split needed" : "no split needed",
+	};
+}
+
+function presentedContractAnswer(entry: WorkerEntryState): PresentedContractAnswer | null {
+	if (entry.receipt?.contract !== "pass" || entry.receipt.contractKind === undefined || entry.droppedLines !== 0) {
+		return null;
+	}
+	const value = structuredAnswer(entry.text);
+	if (value === null) return null;
+	const kind: WorkerPresentedResultContract = entry.receipt.contractKind;
+	switch (kind) {
+		case "debugger-report":
+			return debuggerReport(value);
+		case "verifier-report":
+			return verifierReport(value);
+		case "research-report":
+			return researchReport(value);
+		case "scout-report":
+			return scoutReport(value);
+	}
+}
+
 /**
  * A mutation report as prose: the paths it changed, each validation with its
  * verdict and evidence, then the summary and commit line. Null when the object
@@ -184,6 +289,8 @@ function mutationReportLines(value: Record<string, unknown>): string[] | null {
 function bodySourceLines(entry: WorkerEntryState): string[] {
 	const structured = entry.droppedLines === 0 ? structuredAnswer(entry.text) : null;
 	if (structured === null) return entry.text.split("\n");
+	const presented = presentedContractAnswer(entry);
+	if (presented !== null) return presented.lines;
 	return mutationReportLines(structured) ?? JSON.stringify(structured, null, 2).split("\n");
 }
 
@@ -236,7 +343,8 @@ function failureLines(entry: WorkerEntryState, width: number): string[] {
 
 /** The receipt line, whole units only; a unit that would not fit is dropped behind a dim ellipsis. */
 function footerLine(entry: WorkerEntryState, width: number): string {
-	const units = isPending(entry) || entry.receipt === undefined ? [pendingUnit(entry)] : footerUnits(entry.receipt);
+	const units =
+		isPending(entry) || entry.receipt === undefined ? [pendingUnit(entry)] : footerUnits(entry, entry.receipt);
 	return fitUnits(theme, dim(FOOTER), units, width);
 }
 

package/src/interactive/side-question.ts

@@ -13,7 +13,13 @@
  * machine without adding an engine seam of its own. Tools are never sent.
  */
 
+import {
+	isResponseSchemaRejection,
+	type ResponseSchemaDialect,
+	responseSchemaDialectFor,
+} from "../core/response-schema.js";
 import { stream } from "../engine/ai.js";
+import { patchResponseSchemaPayloadForDialect } from "../engine/provider-payload.js";
 import type { AgentMessage, EngineModel, Usage } from "../engine/types.js";
 
 /**
@@ -67,6 +73,18 @@ export interface OutOfTurnRoundInput extends Omit<SideQuestionInput, "question">
 	systemPrompt: string;
 	/** The one message appended to the read-only copy of the history. */
 	userText: string;
+	/**
+	 * Bind the answer to a JSON schema on the wire, where the runtime takes one.
+	 *
+	 * A round that asked for a schema in prose and bound nothing is what made
+	 * `/handoff` refuse on local targets: the model answered with prose around
+	 * the object, or with no object at all, and the parser had nothing to work
+	 * with (issue #223). Absent, or on a runtime with no dialect, the request
+	 * goes out exactly as before and the prompt-level instruction carries it.
+	 */
+	responseSchema?: { name: string; schema: Record<string, unknown> };
+	/** Resolved runtime id, which is what decides the wire dialect. */
+	runtimeId?: string;
 }
 
 export interface SideQuestionResult {
@@ -80,7 +98,12 @@ function positive(value: unknown): number {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
 }
 
-function sideQuestionUsage(raw: unknown): SideQuestionUsage | null {
+/**
+ * Normalize one provider usage object into the shape `/cost` and the
+ * out-of-turn usage store take. Shared with the session pre-warm, which is
+ * another call billed beside the session rather than inside it.
+ */
+export function sideQuestionUsage(raw: unknown): SideQuestionUsage | null {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const usage = raw as Partial<Usage> & { reasoning?: number };
 	const input = positive(usage.input);
@@ -128,11 +151,45 @@ export async function runSideQuestion(input: SideQuestionInput): Promise<SideQue
 	return runOutOfTurnRound({ ...rest, systemPrompt: SIDE_QUESTION_SYSTEM_PROMPT, userText: question });
 }
 
+interface SchemaBinding {
+	dialect: ResponseSchemaDialect;
+	name: string;
+	schema: Record<string, unknown>;
+}
+
+/** The schema binding for this round, or null when nothing can be bound on the wire. */
+function schemaBindingFor(input: OutOfTurnRoundInput): SchemaBinding | null {
+	if (input.responseSchema === undefined || input.runtimeId === undefined) return null;
+	const dialect = responseSchemaDialectFor(input.runtimeId);
+	return dialect === null ? null : { dialect, ...input.responseSchema };
+}
+
 /** The shared round. See {@link OutOfTurnRoundInput}. */
 export async function runOutOfTurnRound(input: OutOfTurnRoundInput): Promise<SideQuestionResult> {
+	const binding = schemaBindingFor(input);
+	if (binding === null) return runRound(input, null);
+	try {
+		return await runRound(input, binding);
+	} catch (error) {
+		// Native enforcement is an optimization here, never a precondition. A
+		// server that refuses the constrained request answers with the same 400
+		// the worker seam already recognizes, and the round is worth more
+		// unconstrained than not at all. Anything else is a real failure and
+		// rejects, so a broken target still costs exactly one round.
+		if (input.signal?.aborted === true) throw error;
+		if (!isResponseSchemaRejection(error instanceof Error ? error.message : String(error))) throw error;
+		return runRound(input, null);
+	}
+}
+
+async function runRound(input: OutOfTurnRoundInput, binding: SchemaBinding | null): Promise<SideQuestionResult> {
 	const options: Record<string, unknown> = { maxTokens: input.maxTokens ?? SIDE_QUESTION_MAX_TOKENS };
 	if (input.apiKey !== undefined) options.apiKey = input.apiKey;
 	if (input.signal !== undefined) options.signal = input.signal;
+	if (binding !== null) {
+		options.onPayload = (payload: unknown): unknown | undefined =>
+			patchResponseSchemaPayloadForDialect(payload, binding.dialect, binding.schema, binding.name);
+	}
 
 	const context = {
 		systemPrompt: input.systemPrompt,

package/src/interactive/slash-commands.ts

@@ -4,6 +4,7 @@ import type { SafeEventBus } from "../core/event-bus.js";
 import { parseCouncilReport, parseOracleResult } from "../domains/agents/index.js";
 import type { AgentSpec } from "../domains/agents/spec.js";
 import type { ContextInitOptions } from "../domains/context/init-options.js";
+import { AdmissionCanceledError } from "../domains/dispatch/admission-error.js";
 import type { DispatchContract, DispatchRequest } from "../domains/dispatch/contract.js";
 import { type AgentRoleFactsResolver, requestExecutionRole } from "../domains/dispatch/execution-role.js";
 import type { RunReceipt } from "../domains/dispatch/types.js";
@@ -11,6 +12,14 @@ import type { JobThinkingLevel } from "../domains/dispatch/validation.js";
 import type { ReceiptIntegrityOutcome } from "../domains/evidence/trust-status.js";
 import type { InstalledExtension } from "../domains/extensions/index.js";
 import type { InteropAgentId, InteropProposal, InteropReport } from "../domains/interop/index.js";
+import {
+	isPanesPresetId,
+	PANES_PRESET_IDS,
+	PANES_PRESETS,
+	type PanesOperations,
+	type PanesPresetId,
+	type PanesStatus,
+} from "../domains/mux/operations.js";
 import type { ProvidersContract, ResolvedModelRef } from "../domains/providers/index.js";
 import { resolveModelReference } from "../domains/providers/index.js";
 import type {
@@ -27,13 +36,13 @@ import type { NoticeLevel } from "./command-output.js";
 import {
 	buildCouncilDispatchArgs,
 	COUNCIL_MAX_ROUNDS,
+	COUNCIL_SYNTHESIS_LABEL,
 	COUNCIL_SYNTHESIS_MODES,
 	type CouncilCommandOptions,
 	type CouncilRosters,
 	isCouncilSynthesisMode,
 	resolveCouncilRoster,
 } from "./council.js";
-import { COUNCIL_SYNTHESIS_LABEL } from "./council-grid.js";
 import {
 	formatOracleAnswer,
 	ORACLE_AGENT_ID,
@@ -41,8 +50,9 @@ import {
 	type OracleDigestSources,
 	packOracleDigest,
 } from "./oracle.js";
-import { SETTINGS_SECTIONS, type SettingsCenterRowId, type SettingsSectionId } from "./overlays/settings.js";
-import { isLibraryTab, LIBRARY_TABS } from "./overlays/skills-hub.js";
+import { isLibraryTab, LIBRARY_TABS } from "./overlays/library-tabs.js";
+import type { SettingsCenterRowId } from "./overlays/settings.js";
+import { SETTINGS_SECTIONS, type SettingsSectionId } from "./overlays/settings-sections.js";
 import type { CommandArgsSpec, CommandPositionalSpec, ParsedArgs } from "./slash-spec.js";
 import { matchFromSpec, usageLine } from "./slash-spec.js";
 import {
@@ -60,6 +70,25 @@ import type { WorkerEntryState } from "./worker-stream.js";
  * one user-facing slash command: how it parses, which SlashCommand kinds it
  * produces, and how those kinds execute. Adding a new command is one entry
  * rather than extending two parallel switches.
+ *
+ * This module is a CLI seam, which constrains what it may import.
+ * `src/cli/run.ts` reaches `parseSlashCommand` here so a headless
+ * `clio-coder run "/typo"` refuses the token by the same shape test and the same
+ * registry membership the editor uses; a second copy of the parser would drift
+ * from this one on the first command added. That makes the CLI a reacher of
+ * everything this file statically imports, so nothing here may reach the
+ * interactive render graph: no theme, no overlay frame, no overlay module, no
+ * `../engine/tui.js`. Those modules share one bundle chunk with the instant
+ * shell's Stage 0 closure, and a second, disjoint reacher makes esbuild split
+ * it, which is a startup-latency regression rather than a style problem. The
+ * parse-time data tables the registry needs live in leaves for that reason:
+ * `./overlays/settings-sections.js`, `./overlays/library-tabs.js`, and
+ * `COUNCIL_SYNTHESIS_LABEL` in `./council.js`. Import from those, not from the
+ * overlays that re-export them.
+ *
+ * Boundaries rule6 in `tests/boundaries/check-boundaries.ts` refuses a violation
+ * at lint time; `tests/contracts/instant-shell-import-graph.test.ts` is the
+ * measurement it protects.
  */
 
 type ShareCommandVariant =
@@ -116,6 +145,13 @@ type SlashCommandVariant =
 	| { kind: "view"; filter?: string }
 	| { kind: "view-verify"; runId: string }
 	| { kind: "view-usage" }
+	/** `/panes`: mode, health, pane inventory, effective settings. */
+	| { kind: "panes" }
+	| { kind: "panes-show"; target: string }
+	/** A preset the model may also ask for, or operator-only argv. Never both. */
+	| { kind: "panes-open"; preset?: PanesPresetId; argv?: ReadonlyArray<string>; once?: boolean }
+	| { kind: "panes-close"; target: string }
+	| { kind: "panes-usage"; reason?: string }
 	| { kind: "thinking-set"; level: string }
 	| { kind: "output-set"; verbosity: string }
 	| { kind: "model" }
@@ -258,14 +294,20 @@ async function runAttributed(
 			progressBus?.emit(BusChannels.DispatchProgress, { runId: handle.runId, agentId: request.agentId, event });
 		}
 		const receipt = await handle.finalPromise;
-		if (receipt.exitCode !== 0 || receipt.failureMessage) {
+		if (receipt.outcome === "canceled") {
+			notice("warn", `${command} aborted: ${receipt.outcomeDetail ?? "operator abort"}`);
+		} else if (receipt.exitCode !== 0 || receipt.failureMessage) {
 			const failure = receipt.failureMessage ? ` ${receipt.failureMessage}` : "";
 			notice("error", `${command} failed: exit=${receipt.exitCode}${failure}`);
 		}
 		if (share) shareReceipt(request.agentId, receipt, deps);
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
-		notice("error", `${command} failed: ${msg}`);
+		if (err instanceof AdmissionCanceledError) {
+			notice("warn", `${command} aborted: ${msg.replace(/^dispatch:\s*/u, "")}`);
+		} else {
+			notice("error", `${command} failed: ${msg}`);
+		}
 	}
 }
 
@@ -629,6 +671,14 @@ export interface SlashCommandContext {
 	seedTaskMemory?: () => TaskMemorySeedCommandResult;
 	/** Open `/view`, the full observability artifact viewer. */
 	openView: (filter?: string) => void;
+	/**
+	 * The pane layer's operator surface. It remains present when mux resolves to
+	 * `none` because the Yazi preset can borrow the terminal for one selection;
+	 * absent only when the host did not compose pane operations at all.
+	 */
+	panes?: PanesOperations;
+	/** Serialize a local async command so the next admitted slash command observes its committed state. */
+	runLocalOperation?: (operation: () => Promise<void>) => void;
 	/**
 	 * Apply a thinking level named on the command line. Returns why it was
 	 * refused so the caller can say so, because the level the operator typed may
@@ -640,8 +690,12 @@ export interface SlashCommandContext {
 	openModel: () => void;
 	/** Live providers contract used by `/model <pattern>` to resolve directly. */
 	providers: ProvidersContract;
-	/** Apply a resolved model reference to settings (and optionally thinking level). */
-	applyModelRef: (ref: ResolvedModelRef) => void;
+	/**
+	 * Apply a resolved model reference, or hand it to the scope dialog. "pending"
+	 * means the operator has yet to choose session or global and nothing has
+	 * changed; the dialog reports the outcome itself.
+	 */
+	applyModelRef: (ref: ResolvedModelRef) => "applied" | "pending";
 	openSettings: (section?: SettingsSectionId, rowId?: SettingsCenterRowId) => void;
 	openResume: () => void;
 	startNewSession: () => void;
@@ -662,10 +716,16 @@ export interface SlashCommandContext {
 	runCompact: (instructions: string | undefined) => void;
 	/**
 	 * Escape hatch for the `view verify` entry: verify a receipt file on disk
-	 * and emit a single status line. Kept on the context so the registry does
+	 * and emit an actionable verification block. Kept on the context so the registry does
 	 * not import the overlay module.
 	 */
-	verifyReceipt: (runId: string) => ReceiptIntegrityOutcome;
+	verifyReceipt: (runId: string) => ReceiptIntegrityOutcome & {
+		receiptPath?: string;
+		sealedDigest?: string | null;
+		trustSummary?: string | null;
+		compromised?: boolean;
+		checks?: ReadonlyArray<{ name: string; ok: boolean; evidence: string }>;
+	};
 	/**
 	 * Handles the "unknown" case: append the text to the chat panel as a user
 	 * turn, submit to the chat loop, and schedule a re-render. Handlers for
@@ -677,6 +737,24 @@ export interface SlashCommandContext {
 	render: () => void;
 }
 
+type SlashReceiptVerification = ReturnType<SlashCommandContext["verifyReceipt"]>;
+
+/** Compact multiline receipt verification for the composer notice surface. */
+export function formatReceiptVerificationBlock(runId: string, result: SlashReceiptVerification): string {
+	const status = result.ok ? (result.compromised ? "compromised" : "ok") : result.retired ? "retired" : "fail";
+	const lines = [
+		`verify ${status} ${runId}`,
+		`receipt  ${result.receiptPath ?? "unavailable"}`,
+		`digest   ${result.sealedDigest ?? "unavailable"}`,
+		`evidence ${result.trustSummary ?? (!result.ok ? result.reason : "trust status unavailable")}`,
+	];
+	if (result.checks && result.checks.length > 0) {
+		lines.push("checks");
+		for (const check of result.checks) lines.push(`  ${check.ok ? "✓" : "✗"} ${check.name}: ${check.evidence}`);
+	}
+	return lines.join("\n");
+}
+
 /** The one operator-authored turn used by slash and overlay handoff paths. */
 export function formatUserTaskHandoff(task: Pick<UserTask, "id" | "title" | "note">): string {
 	const note = task.note ? ` ${task.note}.` : "";
@@ -765,6 +843,35 @@ function usageNotice(entry: BuiltinSlashCommand, subcommand?: string): string {
 	return usageLine(entry, subcommand).trim();
 }
 
+/**
+ * `/panes` output, as plain lines. Pure so the contract test asserts the text
+ * an operator reads rather than the object behind it, and so the registry keeps
+ * its promise not to reach a renderer.
+ */
+export function formatPanesStatus(status: PanesStatus): ReadonlyArray<string> {
+	const server = status.server ? `pane host ${status.server.version}, protocol ${status.server.protocol}` : "no server";
+	const lines = [
+		`panes: mode=${status.mode} ${status.available ? "available" : "unavailable"} (${server})`,
+		`  ${status.reason}`,
+		...(status.socketPath ? [`  socket ${status.socketPath}`] : []),
+		`  settings: enabled=${status.settings.enabled} notifications=${status.settings.notifications} journal=${status.settings.journal}`,
+		`  files: enabled=${status.settings.yazi.enabled} mode=${status.settings.yazi.mode} profile=${status.settings.yazi.profile} followCwd=${status.settings.yazi.followCwd}`,
+		`  file pane: mode=${status.yazi.mode} pane=${status.yazi.paneId ?? "none"} cwd=${status.yazi.paneCwd ?? "unknown"} lastLine=${status.yazi.lastLineAt === null ? "never" : new Date(status.yazi.lastLineAt).toISOString()} dropped=${status.yazi.droppedLines}`,
+	];
+	if (status.panes.length === 0) {
+		lines.push("  no Clio-owned panes");
+	} else {
+		lines.push(`  ${status.panes.length} Clio-owned pane(s):`);
+		for (const pane of status.panes) {
+			const adopted = pane.adopted ? " adopted" : "";
+			const pending = pane.pending ? " opening" : "";
+			lines.push(`    ${pane.paneId} ${pane.purpose} ${pane.label}${adopted}${pending}`);
+		}
+	}
+	lines.push(`  presets: ${PANES_PRESETS.map((preset) => `${preset.id} (${preset.summary})`).join(", ")}`);
+	return lines;
+}
+
 export const BUILTIN_SLASH_COMMANDS: ReadonlyArray<BuiltinSlashCommand> = [
 	{
 		name: "quit",
@@ -1505,16 +1612,141 @@ export const BUILTIN_SLASH_COMMANDS: ReadonlyArray<BuiltinSlashCommand> = [
 			}
 			if (command.kind !== "view-verify") return;
 			const result = ctx.verifyReceipt(command.runId);
+			const block = formatReceiptVerificationBlock(command.runId, result);
 			if (result.ok) {
-				ctx.notice("success", `verify ok ${command.runId}`);
+				ctx.notice(result.compromised ? "warn" : "success", block);
 			} else if (result.retired !== undefined) {
 				// A retired seal is the expected state of a run from the previous
 				// release, so it is a warning that names the versions, never the
 				// failure a tampered receipt gets.
-				ctx.notice("warn", `verify retired ${command.runId} ${result.reason}`);
+				ctx.notice("warn", block);
 			} else {
-				ctx.notice("error", `verify fail ${command.runId} ${result.reason}`);
+				ctx.notice("error", block);
+			}
+		},
+	},
+	{
+		name: "panes",
+		description: "Inspect the pane layer, watch a live run in a pane, or open a utility pane",
+		group: "Inspect",
+		kinds: ["panes", "panes-show", "panes-open", "panes-close", "panes-usage"],
+		args: {
+			subcommands: {
+				show: { positionals: [{ name: "run-or-agent", required: true }] },
+				// A rest positional, so an argv pane keeps its own flags: the parser
+				// would otherwise refuse `--follow` as an unknown flag of `/panes`.
+				open: { positionals: [{ name: "preset-or-argv", required: true, rest: true }] },
+				close: { positionals: [{ name: "target", required: false }] },
+			},
+		},
+		subcommandDescriptions: {
+			show: "watch a live run or agent in the watch pane",
+			open: `open a utility pane (${PANES_PRESET_IDS.join(", ")}, or a command)`,
+			close: "close a Clio-owned pane, or all of them",
+		},
+		fromArgs(parsed) {
+			if (parsed.error) return { kind: "panes-usage", reason: parsed.error };
+			if (parsed.subcommand === "show") {
+				return { kind: "panes-show", target: parsed.positionals[0] ?? "" };
+			}
+			if (parsed.subcommand === "open") {
+				const rest = (parsed.rest ?? "").trim();
+				if (rest.length === 0) return { kind: "panes-usage", reason: "Missing required argument: preset-or-argv" };
+				const argv = rest.split(/\s+/).filter((token) => token.length > 0);
+				const first = argv[0] ?? "";
+				// A bare preset name is a preset; anything else is operator argv,
+				// which the tool surface deliberately cannot ask for.
+				if (argv.length === 1 && isPanesPresetId(first)) return { kind: "panes-open", preset: first };
+				if (argv.length === 2 && first === "yazi" && argv[1] === "--once") {
+					return { kind: "panes-open", preset: "yazi", once: true };
+				}
+				return { kind: "panes-open", argv };
+			}
+			if (parsed.subcommand === "close") {
+				return { kind: "panes-close", target: parsed.positionals[0] ?? "all" };
+			}
+			if (parsed.positionals.length > 0) {
+				return { kind: "panes-usage", reason: `Unexpected argument: ${parsed.positionals[0]}` };
+			}
+			return { kind: "panes" };
+		},
+		handle(command, ctx) {
+			const entry = BUILTIN_SLASH_COMMANDS.find((candidate) => candidate.name === "panes");
+			if (command.kind === "panes-usage") {
+				// usageNotice trims the leading newline usageLine carries, so the reason
+				// and the usage line need their own separator or they run together as
+				// `Missing required argument: run-or-agentusage: /panes show ...`.
+				if (entry) ctx.notice("info", command.reason ? `${command.reason}\n${usageNotice(entry)}` : usageNotice(entry));
+				return;
+			}
+			const panes = ctx.panes;
+			if (!panes) {
+				// Inactive by choice, not unavailable: the operations object exists in
+				// every `--with-panes` session, even one where no pane host answered.
+				ctx.notice(
+					"info",
+					"panes are inactive: this session started without them. Restart with `clio-coder --with-panes`, or set panes.enabled=auto",
+				);
+				return;
+			}
+			const runLocal = ctx.runLocalOperation ?? ((operation: () => Promise<void>) => void operation());
+			if (command.kind === "panes") {
+				runLocal(async () => {
+					for (const line of formatPanesStatus(panes.status())) ctx.io.stdout(`${line}\n`);
+					ctx.render();
+				});
+				return;
+			}
+			if (command.kind === "panes-show") {
+				runLocal(async () => {
+					const result = await panes.show(command.target);
+					if (result.status === "watching") {
+						ctx.notice("success", `watching ${result.agentId} (${result.runId})${result.opened ? " in a new pane" : ""}`);
+					} else if (result.status === "not-found") {
+						const known = result.candidates.length > 0 ? `; live runs: ${result.candidates.join(", ")}` : "";
+						ctx.notice("warn", `no live run matches ${result.target}${known}`);
+					} else {
+						ctx.notice("warn", result.reason);
+					}
+				});
+				return;
 			}
+			if (command.kind === "panes-open") {
+				runLocal(async () => {
+					const result = await panes.open({
+						...(command.preset ? { preset: command.preset } : {}),
+						...(command.argv ? { argv: command.argv } : {}),
+						...(command.once ? { once: true } : {}),
+					});
+					if (result.status === "opened") {
+						// The in-terminal chooser has already restored the TUI by the
+						// time this resolves. A pick emitted its composer notice; an empty
+						// chooser was cancellation and deliberately stays silent.
+						if (result.paneId !== null) ctx.notice("success", `opened pane ${result.label} (${result.paneId})`);
+					} else if (result.status === "missing-binary") {
+						// This is a synchronous slash-surface line, not a transient pane-host
+						// notification. It remains visible when no pane was ever created and
+						// reuses the exact doctor/tools diagnostic including the install hint.
+						ctx.io.stdout(`${result.detail}\n`);
+						ctx.render();
+					} else {
+						ctx.notice("warn", result.reason);
+					}
+				});
+				return;
+			}
+			if (command.kind !== "panes-close") return;
+			runLocal(async () => {
+				const result = await panes.close(command.target);
+				if (result.status === "closed") {
+					const what = result.labels.length > 0 ? `: ${result.labels.join(", ")}` : "";
+					ctx.notice(result.closed > 0 ? "success" : "info", `closed ${result.closed} pane(s)${what}`);
+				} else if (result.status === "not-found") {
+					ctx.notice("warn", `no Clio-owned pane matches ${result.target}`);
+				} else {
+					ctx.notice("warn", result.reason);
+				}
+			});
 		},
 	},
 	{
@@ -1604,9 +1836,13 @@ export const BUILTIN_SLASH_COMMANDS: ReadonlyArray<BuiltinSlashCommand> = [
 					return;
 				}
 				if (result.warning) ctx.notice("warn", result.warning);
-				ctx.applyModelRef(result.ref);
-				const suffix = result.ref.thinkingLevel ? ` thinking=${result.ref.thinkingLevel}` : "";
-				ctx.notice("success", `active: ${result.ref.target}/${result.ref.model}${suffix}`);
+				// "pending" means the scope dialog is up: it says what landed and
+				// where, so announcing a swap here would be announcing a choice the
+				// operator has not made yet.
+				if (ctx.applyModelRef(result.ref) === "applied") {
+					const suffix = result.ref.thinkingLevel ? ` thinking=${result.ref.thinkingLevel}` : "";
+					ctx.notice("success", `active this session: ${result.ref.target}/${result.ref.model}${suffix}`);
+				}
 				ctx.render();
 			})();
 		},