@iowarp/clio-coder 0.4.7 → 0.4.9

package/src/engine/session.ts

@@ -1,5 +1,5 @@
 /**
- * Clio session JSONL writer + reader (Phase 3 slice 1).
+ * Clio session JSONL writer + reader.
  *
  * On-disk layout under `clioStateDir()`:
  *   sessions/<cwdHash>/<sessionId>/
@@ -9,7 +9,7 @@
  *
  * Atomicity:
  *   - Appends go to an O_APPEND fd held for the writer's lifetime; each line
- *     is one write(2). fsync is debounced after appends and forced on
+ *     uses complete byte writes. fsync is debounced after appends and forced on
  *     checkpoint (`persistTree`) and `close`. A torn last line from a crash
  *     is tolerated by the reader (skipped with a warning).
  *   - `replaceEntries` rewrites current.jsonl via `writeJsonlFileAtomic`
@@ -28,6 +28,7 @@ import {
 	constants as fsConstants,
 	fstatSync,
 	fsyncSync,
+	ftruncateSync,
 	mkdirSync,
 	openSync,
 	readdirSync,
@@ -35,6 +36,7 @@ import {
 	readSync,
 	renameSync,
 	statSync,
+	unlinkSync,
 	writeSync,
 } from "node:fs";
 import { dirname, join, resolve } from "node:path";
@@ -197,6 +199,31 @@ function serializeJsonl(entries: ReadonlyArray<unknown>): string {
 	return `${lines.join("\n")}\n`;
 }
 
+/** Complete UTF-8 bytes even when write(2) makes only partial progress. */
+function writeAll(fd: number, bytes: Buffer): void {
+	let offset = 0;
+	while (offset < bytes.length) {
+		const written = writeSync(fd, bytes, offset, bytes.length - offset);
+		if (written <= 0) throw new Error(`session JSONL write made no progress after ${offset} of ${bytes.length} bytes`);
+		offset += written;
+	}
+}
+
+/** Roll back a failed append so a retry cannot fuse onto its partial record. */
+function appendAll(fd: number, bytes: Buffer): void {
+	const size = fstatSync(fd).size;
+	try {
+		writeAll(fd, bytes);
+	} catch (error) {
+		try {
+			ftruncateSync(fd, size);
+		} catch (rollbackError) {
+			throw new AggregateError([error, rollbackError], "session JSONL append and rollback failed; reopen to recover");
+		}
+		throw error;
+	}
+}
+
 /**
  * Rewrite a JSONL file through `<target>.tmp` and rename over the target.
  * A crash or interruption before the rename leaves the original target
@@ -213,10 +240,21 @@ function writeJsonlFileAtomic(
 	const tmp = `${targetPath}.tmp`;
 	const fd = openSync(tmp, "w");
 	try {
-		writeSync(fd, body);
-		fsyncSync(fd);
-	} finally {
-		closeSync(fd);
+		try {
+			writeAll(fd, Buffer.from(body, "utf8"));
+			fsyncSync(fd);
+		} finally {
+			closeSync(fd);
+		}
+	} catch (error) {
+		// A missing target can recover from .tmp, so an incomplete write
+		// must not leave a candidate that recovery could promote.
+		try {
+			unlinkSync(tmp);
+		} catch (cleanupError) {
+			throw new AggregateError([error, cleanupError], "session JSONL write and temporary cleanup failed");
+		}
+		throw error;
 	}
 	options.beforeRename?.(tmp, targetPath);
 	renameSync(tmp, targetPath);
@@ -633,10 +671,7 @@ export function appendSessionFileEntry(targetPath: string, entry: unknown): void
 	const line = Buffer.from(`${endsWithNewline(appendPath) ? "" : "\n"}${serialized}\n`, "utf8");
 	const fd = openSync(appendPath, fsConstants.O_WRONLY | fsConstants.O_APPEND);
 	try {
-		const written = writeSync(fd, line);
-		if (written !== line.length) {
-			throw new Error(`short session JSONL append: wrote ${written} of ${line.length} bytes`);
-		}
+		appendAll(fd, line);
 		fsyncSync(fd);
 	} finally {
 		closeSync(fd);
@@ -655,6 +690,9 @@ function createWriter(
 	let closed = false;
 	let appendFd: number | null = null;
 	let fsyncTimer: NodeJS.Timeout | null = null;
+	// Descriptor cleanup must not discard accepted bytes or rollback changes
+	// still owed to the next debounce, checkpoint, flush, or close.
+	let pendingFsync = false;
 
 	// One-time normalization for resumes of pre-header files: rewrite once so
 	// fd-appended lines land after a header. Disk and memory match from here on.
@@ -668,7 +706,10 @@ function createWriter(
 		appendFd = openSync(paths.current, "a");
 		// Terminating the fragment keeps the reader's torn-tail behavior:
 		// it skips exactly one invalid line with a warning.
-		if (tornTail) writeSync(appendFd, "\n");
+		if (tornTail) {
+			pendingFsync = true;
+			appendAll(appendFd, Buffer.from("\n"));
+		}
 		return appendFd;
 	}
 
@@ -676,28 +717,52 @@ function createWriter(
 		if (fsyncTimer !== null) return;
 		fsyncTimer = setTimeout(() => {
 			fsyncTimer = null;
-			if (appendFd === null) return;
 			try {
-				fsyncSync(appendFd);
+				flushPendingAppends();
 			} catch {
-				// A concurrent close already flushed and released the fd.
+				// Keep the obligation pending. Explicit flush/checkpoint/close
+				// retries and reports an error if storage is still unavailable.
 			}
 		}, APPEND_FSYNC_DEBOUNCE_MS);
 		fsyncTimer.unref?.();
 	}
 
+	function flushPendingAppends(): void {
+		if (appendFd !== null) {
+			fsyncSync(appendFd);
+			pendingFsync = false;
+			return;
+		}
+		if (!pendingFsync || stateRootRemoved()) return;
+		// Reopen without O_CREAT or tail normalization: flushing after a failed
+		// append must neither recreate removed state nor alter retained bytes.
+		const fd = openSync(paths.current, fsConstants.O_WRONLY | fsConstants.O_APPEND);
+		try {
+			fsyncSync(fd);
+		} catch (error) {
+			try {
+				closeSync(fd);
+			} catch (closeError) {
+				throw new AggregateError([error, closeError], "session JSONL flush and close failed");
+			}
+			throw error;
+		}
+		closeSync(fd);
+		pendingFsync = false;
+	}
+
 	function closeAppendFd(opts: { flush: boolean }): void {
+		if (opts.flush) flushPendingAppends();
 		if (fsyncTimer !== null) {
 			clearTimeout(fsyncTimer);
 			fsyncTimer = null;
 		}
 		if (appendFd === null) return;
-		try {
-			if (opts.flush) fsyncSync(appendFd);
-		} finally {
-			closeSync(appendFd);
-			appendFd = null;
-		}
+		const fd = appendFd;
+		// A failed close can already have released the OS descriptor. Never
+		// retain that ambiguous number for a later append or duplicate close.
+		appendFd = null;
+		closeSync(fd);
 	}
 
 	function appendLine(entry: unknown): void {
@@ -705,7 +770,21 @@ function createWriter(
 		if (serialized === undefined) {
 			throw new Error("session JSONL entry is not serializable");
 		}
-		writeSync(openAppendFd(), `${serialized}\n`);
+		try {
+			const fd = openAppendFd();
+			pendingFsync = true;
+			appendAll(fd, Buffer.from(`${serialized}\n`, "utf8"));
+		} catch (error) {
+			// Reopening rechecks the tail even if rollback itself failed.
+			try {
+				closeAppendFd({ flush: false });
+			} catch (closeError) {
+				throw new AggregateError([error, closeError], "session JSONL append and close failed");
+			} finally {
+				scheduleFsync();
+			}
+			throw error;
+		}
 		scheduleFsync();
 	}
 
@@ -747,7 +826,7 @@ function createWriter(
 		},
 		async persistTree(): Promise<void> {
 			// Checkpoint: make appended lines durable alongside the tree.
-			if (appendFd !== null) fsyncSync(appendFd);
+			flushPendingAppends();
 			// `paths` was resolved at construction, but atomicWrite mkdirs the
 			// session directory again, so an uninstall that has already removed the
 			// state root would be undone here. Fsyncing the held fd first is safe
@@ -756,7 +835,7 @@ function createWriter(
 			atomicWrite(paths.tree, JSON.stringify(tree, null, 2));
 		},
 		flushAppends(): void {
-			if (appendFd !== null) fsyncSync(appendFd);
+			flushPendingAppends();
 		},
 		async close(): Promise<void> {
 			if (closed) return;
@@ -827,7 +906,10 @@ export function openSession(id: string): ClioSessionReader {
 	};
 }
 
-export function resumeSession(id: string): {
+export function resumeSession(
+	id: string,
+	options: { sessionFormatVersion?: number } = {},
+): {
 	meta: ClioSessionMeta;
 	writer: ClioSessionWriter;
 	tree: ReadonlyArray<SessionTreeNode>;
@@ -835,13 +917,20 @@ export function resumeSession(id: string): {
 	const dir = findSessionDir(id);
 	const metaPath = join(dir, "meta.json");
 	const meta = readMetaFile(metaPath);
-	// resume reopens an active session; clear endedAt if it was set by a prior close
-	if (meta.endedAt !== null) {
-		meta.endedAt = null;
-		atomicWrite(metaPath, JSON.stringify(meta, null, 2));
-	}
 	const existingFileEntries = readSessionFileEntries(join(dir, "current.jsonl"));
 	const existingTree = recoverTreeFromJsonl(readTreeFile(join(dir, "tree.json")), existingFileEntries);
 	const writer = createWriter(meta, existingTree, existingFileEntries);
+	// Prepare headerless ledgers before publishing that a closed session has
+	// reopened. A failed normalization must preserve its prior ended state.
+	// Reopening and a migration restamp are one atomic publication: a refused
+	// resume can never leave the session marked open under its old version.
+	const restamp = options.sessionFormatVersion;
+	const restamped = restamp !== undefined && meta.sessionFormatVersion !== restamp;
+	if (meta.endedAt !== null || restamped) {
+		const reopened = { ...meta, endedAt: null, ...(restamped ? { sessionFormatVersion: restamp } : {}) };
+		atomicWrite(metaPath, JSON.stringify(reopened, null, 2));
+		meta.endedAt = null;
+		if (restamped) meta.sessionFormatVersion = restamp;
+	}
 	return { meta, writer, tree: existingTree };
 }

package/src/engine/worker-runtime.ts

@@ -621,6 +621,9 @@ export function startWorkerRun(input: WorkerRunInput, emit: WorkerEventEmit): Wo
 			correlationId: `worker-model-round-${workerModelRound}`,
 			toolResultMaxBytes: workerSettings.context.toolResultMaxBytes,
 			supportsImages: model.input.includes("image"),
+			// The admitted capability list, so the gateway calls only what the
+			// recipe declared: the same bound the attached schemas already honor.
+			allowedTools: input.allowedTools,
 			...(agentSkillPolicy ? { pendingSkillPolicy: agentSkillPolicy } : {}),
 		}),
 	});

package/src/entry/boot-options.ts

@@ -28,6 +28,8 @@ export interface BootOptions {
 	startupSettings?: Readonly<ClioSettings>;
 	/** `--with-panes` / `--no-panes`. The flag beats `panes.enabled` in both directions. */
 	panes?: "with" | "without";
+	/** Global `--autonomy <level>`: a one-session override for the interactive app; settings.yaml is untouched. */
+	autonomy?: AutonomyLevel;
 	headless?: {
 		prompt: string;
 		images?: ReadonlyArray<ImageContent>;

package/src/entry/orchestrator.ts

@@ -36,7 +36,7 @@ import {
 import { getSharedBus } from "../core/shared-bus.js";
 import { isSkillActivation } from "../core/skill-activation.js";
 import { StartupTimer } from "../core/startup-timer.js";
-import { getTerminationCoordinator } from "../core/termination.js";
+import { getTerminationCoordinator, resolveShutdownHookBudgetMs } from "../core/termination.js";
 import { captureProjectSurface, projectSurfaceTrustNotice } from "../core/workspace-trust.js";
 import { clioDataDir, clioStateDir } from "../core/xdg.js";
 import { renderAgentCatalogSectionsFromSpecs } from "../domains/agents/catalog.js";
@@ -120,6 +120,7 @@ import {
 	isOrchestratorEligibleRuntime,
 	normalizeCostProvenance,
 	ProvidersDomainModule,
+	probeCapabilitiesForModel,
 	refineRuntimeTargetWithModelHints,
 	registerForegroundStream,
 	resolveEndpointCapacities,
@@ -603,6 +604,17 @@ function agentRoleToolWarnings(providers: ProvidersContract, settings: Readonly<
 			if (!status) continue;
 			const capabilities = resolveModelCapabilities(status, wireModelId, providers.knowledgeBase);
 			if (supportsAgentRoleTools(capabilities)) continue;
+			// A target that was never probed has reported nothing about this model:
+			// the flag is only the runtime's conservative floor. Dispatch admission
+			// probes the route itself before it refuses a worker.
+			const declared =
+				status.target.capabilities?.tools ?? providers.knowledgeBase?.lookup(wireModelId)?.entry.capabilities?.tools;
+			if (
+				declared === undefined &&
+				status.health.lastCheckAt === null &&
+				probeCapabilitiesForModel(status, wireModelId) === null
+			)
+				continue;
 			warnings.push(
 				`${role.label} model '${wireModelId}' on target '${targetId}' ${AGENT_ROLE_TOOLS_REQUIRED_REASON}. ` +
 					`Pick another model, or state the correction in a model-catalog.d entry if the provider's flag is wrong.`,
@@ -1184,7 +1196,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			createDispatchDomainModule({
 				getSettings: () => effectiveSettingsForDispatch?.(),
 				getProtectedArtifactState: () => protectedArtifactStateForDispatch?.() ?? { artifacts: [] },
-				autonomyOverride: options.headless?.autonomy !== undefined,
+				autonomyOverride: (options.headless?.autonomy ?? options.autonomy) !== undefined,
 				// The domain owns the durable journal here, not the dispatch
 				// tool's event registry: `/run`, a watchdog run, and a model
 				// dispatch all have to leave the same transcript behind, and only
@@ -1203,8 +1215,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 			await dispatch.drain();
 		});
 	}
-	termination.onPersist(async () => {
-		await result.stop();
+	// The loader caps each domain separately. The outer hook must allow the
+	// whole sequence to finish, including cleanup after a timed-out domain.
+	termination.onPersist(() => result.stop(), {
+		timeoutMs: Math.min(2 ** 31 - 1, (result.loaded.length + 1) * resolveShutdownHookBudgetMs()),
 	});
 
 	bus.emit(BusChannels.SessionStart, { at: Date.now() });
@@ -1373,12 +1387,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// this boot projection below.
 	configureRunEventJournal(resolvedSettings.fleet.history.journal);
 
-	// Guard registrations on the middleware contract, in order: loop guard,
-	// protected artifacts (last among guards so it absorbs protect_path effects
-	// from everything before it), dispatch dedup. Workers register their own
-	// loop guard and protected-artifacts instances inside their subprocess in
-	// worker-runtime.ts; the orchestrator instances carry the bus and the
-	// session persistence sink.
+	// Register the loop and dispatch guards first. The protected-artifact guard
+	// is constructed here but registered after user hooks below, so it can
+	// absorb their protect_path effects. Workers register their own guards in
+	// worker-runtime.ts; these instances carry the bus and session persistence.
 	middleware.registerHook(
 		createLoopGuardRegistration({
 			safety,
@@ -1427,7 +1439,6 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		}
 		return protectedArtifactsGuard.state();
 	};
-	middleware.registerHook(protectedArtifactsGuard);
 	middleware.registerHook(createDispatchDedupRegistration());
 	// Observers run after the guards; they emit no effects and their sinks are
 	// best-effort (session ledger, codewiki refresh).
@@ -1525,9 +1536,9 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	}
 	// User-defined hooks: extensions and the project (.clio-coder/hooks.yaml,
 	// .clio-coder/hooks.local.yaml) declare a conservative, receipted hook set on the
-	// same effect machinery. They register after the guards, so safety stays
-	// authoritative: a hook may add effects (including request block_tool) but
-	// cannot grant a permission safety would deny. Loading is best-effort.
+	// same effect machinery. A hook may add effects (including request block_tool)
+	// but cannot grant a permission safety would deny. The protected-artifact
+	// guard follows them to consume protect_path before tool execution.
 	// The coordinator is the only writer of the "user-hooks" owner and the only
 	// caller of the extensions reload; it publishes the extension generation
 	// and the hook registrations with two adjacent assignments on one stack
@@ -1535,7 +1546,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// published here too (the extensions bundle publishes nothing at start),
 	// so no consumer ever sees extension resources paired with hooks from a
 	// different generation. The owner slot is anchored here, so user hooks
-	// keep evaluating after the guards and before the assessors below.
+	// keep evaluating before the protection consumer and assessors below.
 	const hookReceiptLog = createHookReceiptLog({ persistPath: join(clioStateDir(), "hook-receipts.json") });
 	let bootHookNotices = true;
 	const reloadPlugins = () =>
@@ -1556,6 +1567,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 		},
 	});
 	extensionReload.applyBoot();
+	middleware.registerHook(protectedArtifactsGuard);
 	bootHookNotices = false;
 	termination.onDrain(() => hookReceiptLog.flush());
 	// Autonomy is hot-reloaded for interactive and headless admissions. ACP
@@ -1568,6 +1580,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	const resolveBaselineAutonomy = (): AutonomyLevel =>
 		effectiveSettingsForDispatch?.().safety.autonomy ??
 		options.headless?.autonomy ??
+		options.autonomy ??
 		(config?.get() ?? readSettings()).safety.autonomy ??
 		"auto-edit";
 	const resolveEffectiveAutonomy = (): AutonomyLevel => activeAcpSessionAutonomy ?? resolveBaselineAutonomy();
@@ -1726,6 +1739,7 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 				})
 			: null;
 	registerAllTools(toolRegistry, {
+		termination,
 		captureWorkerContext: () => chat.captureWorkerContext?.() ?? null,
 		...(session
 			? {
@@ -1788,8 +1802,10 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// flag was keyed by the bare word, which wrote a top-level `autonomy` key
 	// nothing reads, so `run --autonomy full-auto` compiled and admitted at
 	// whatever settings.yaml said.
+	// The interactive `clio-coder --autonomy <level>` seeds the same override.
+	const startupAutonomy = options.headless?.autonomy ?? options.autonomy;
 	const sessionOverrides: SessionOverrides = new Map(
-		options.headless?.autonomy === undefined ? [] : [["safety.autonomy", options.headless.autonomy]],
+		startupAutonomy === undefined ? [] : [["safety.autonomy", startupAutonomy]],
 	);
 	// The effective view is derived by deep-cloning the saved snapshot, and it
 	// is read on the tool-admission hot path (every call resolves autonomy
@@ -1836,8 +1852,12 @@ export async function bootOrchestrator(options: BootOptions = {}): Promise<BootR
 	// The config bundle publishes saved values on reload; session-scoped
 	// overrides must win, so re-derive every process-local projection from the
 	// effective session view after it.
-	const unsubscribeSettingsProjectionSync = bus.on(BusChannels.ConfigHotReload, () => bumpSessionState());
-	termination.onDrain(() => unsubscribeSettingsProjectionSync());
+	const unsubscribeSettingsProjectionSync = [BusChannels.ConfigHotReload, BusChannels.ConfigNextTurn].map((channel) =>
+		bus.on(channel, () => bumpSessionState()),
+	);
+	termination.onDrain(() => {
+		for (const unsubscribe of unsubscribeSettingsProjectionSync) unsubscribe();
+	});
 	const getTaskMemorySeedOffer = (): { source: string; count: number } | null => {
 		return taskMemoryHandoffSeedOffer(process.cwd(), getCurrentSettings().context.memory.enabled);
 	};

package/src/interactive/chat-loop-messages.ts

@@ -362,6 +362,7 @@ export interface RunUsageSummary {
 	output: number;
 	cacheRead: number;
 	cacheWrite: number;
+	cacheWrite1h?: number;
 	reasoning: number;
 	apiCalls: number;
 	hadReasoning: boolean;
@@ -407,6 +408,7 @@ export function sumRunUsage(messages: ReadonlyArray<AgentMessage>): RunUsageSumm
 						output?: unknown;
 						cacheRead?: unknown;
 						cacheWrite?: unknown;
+						cacheWrite1h?: unknown;
 						totalTokens?: unknown;
 						cost?: { total?: unknown };
 					};
@@ -432,6 +434,7 @@ export function sumRunUsage(messages: ReadonlyArray<AgentMessage>): RunUsageSumm
 		summary.output += output;
 		summary.cacheRead += cacheRead;
 		summary.cacheWrite += cacheWrite;
+		if (typeof usage.cacheWrite1h === "number") summary.cacheWrite1h = (summary.cacheWrite1h ?? 0) + usage.cacheWrite1h;
 		const reasoning = extractReasoningTokens(usage);
 		if (reasoning !== null) {
 			summary.reasoning += reasoning;

package/src/interactive/chat-loop-policy.ts

@@ -14,5 +14,6 @@ export function normalizeRetrySettings(raw: RawRetrySettings): RetrySettings {
 		baseDelayMs: normalizeNonNegativeInteger(raw?.baseDelayMs, DEFAULT_RETRY_SETTINGS.baseDelayMs),
 		maxDelayMs: normalizeNonNegativeInteger(raw?.maxDelayMs, DEFAULT_RETRY_SETTINGS.maxDelayMs),
 		streamStallMs: normalizeNonNegativeInteger(raw?.streamStallMs, DEFAULT_RETRY_SETTINGS.streamStallMs),
+		firstTokenStallMs: normalizeNonNegativeInteger(raw?.firstTokenStallMs, DEFAULT_RETRY_SETTINGS.firstTokenStallMs),
 	};
 }

package/src/interactive/chat-loop.ts

@@ -345,8 +345,8 @@ export interface ChatLoop {
 	 * in-memory `state.messages` for a single bridge message carrying the
 	 * summary, and emit the standard summary notice. Used by `/context compact`
 	 * slash command so the next user turn ships only the bridge plus the new
-	 * text to the provider (slice 12.5b bug 4). Silent no-op when no session
-	 * or no compaction deps are wired; in both cases emits a user-visible
+	 * text to the provider. When no session or compaction dependencies are
+	 * wired, it skips compaction and emits a user-visible
 	 * notice so the `/context compact` handler does not have to mirror the logic.
 	 */
 	compact(instructions?: string): Promise<void>;
@@ -686,10 +686,13 @@ export function createChatLoop(deps: CreateChatLoopDeps): ChatLoop {
 				(policy?.requests.length ?? 0) > 0)
 		) {
 			const entries = filterEntriesToActivePath(deps.readSessionEntries?.() ?? [], state.lastTurnId ?? undefined);
+			// A loaded skill that declares no tool narrowing arms no surface, yet its
+			// instructions are in context. Record it from the loading policy: an
+			// unknown selection would block every later compaction of this session.
 			const selection = next
 				? mainSkillContextState(entries, next)
-				: (policy?.loadedSkillNames.size ?? 0) > 0
-					? null
+				: policy !== undefined && policy.loadedSkillNames.size > 0
+					? mainSkillContextState(entries, policy)
 					: { version: 1 as const, activationRefs: [] };
 			const data = selection ?? { version: 1 as const, activationRefs: [], unknown: true as const };
 			if (JSON.stringify(data) !== JSON.stringify(latestSkillContextState(entries))) {
@@ -862,13 +865,6 @@ export function createChatLoop(deps: CreateChatLoopDeps): ChatLoop {
 		deps.bus?.on(BusChannels.ConfigHotReload, () => {
 			context.invalidateSessionPromptCache();
 		}) ?? null;
-	// A committed extension generation with new content can change the skill
-	// and prompt inputs the session prompt compiles from; same invalidation.
-	const unsubscribeExtensionsReload =
-		deps.bus?.on(BusChannels.ExtensionsReloaded, (payload) => {
-			if (payload.changed) context.invalidateSessionPromptCache();
-		}) ?? null;
-
 	const unsubscribePluginsReload =
 		deps.bus?.on(BusChannels.PluginsReloaded, () => {
 			context.invalidateSessionPromptCache();
@@ -981,6 +977,7 @@ export function createChatLoop(deps: CreateChatLoopDeps): ChatLoop {
 				output: usage.output,
 				cacheRead: usage.cacheRead,
 				cacheWrite: usage.cacheWrite,
+				...(usage.cacheWrite1h === undefined ? {} : { cacheWrite1h: usage.cacheWrite1h }),
 				reasoningTokens: usage.reasoning,
 				totalTokens: usage.totalTokens,
 				apiCalls: 1,
@@ -1004,6 +1001,7 @@ export function createChatLoop(deps: CreateChatLoopDeps): ChatLoop {
 				output: usage.output,
 				cacheRead: usage.cacheRead,
 				cacheWrite: usage.cacheWrite,
+				...(usage.cacheWrite1h === undefined ? {} : { cacheWrite1h: usage.cacheWrite1h }),
 				reasoning: usage.reasoning,
 				totalTokens: usage.totalTokens,
 				costUsd: usage.costUsd,
@@ -1294,6 +1292,7 @@ export function createChatLoop(deps: CreateChatLoopDeps): ChatLoop {
 				images,
 				options.requestContinuation === true,
 				text,
+				options.display?.text,
 			);
 			// An interrupt was submitted while a run was active, so no caller drew
 			// it in the transcript; render it here, after the cancel notice and the
@@ -1572,7 +1571,6 @@ export function createChatLoop(deps: CreateChatLoopDeps): ChatLoop {
 
 		dispose(): void {
 			unsubscribeConfigReload?.();
-			unsubscribeExtensionsReload?.();
 			unsubscribePluginsReload?.();
 			unsubscribeSynthesisLock?.();
 			unsubscribePrewarmCompaction();

package/src/interactive/chat-panel.ts

@@ -12,7 +12,8 @@ import { codeInk } from "./renderers/code-ink.js";
 import { createMermaidMarkdownTransform } from "./renderers/mermaid.js";
 import { styleTaggedNotice } from "./renderers/notice.js";
 import { previewBudget, previewRows } from "./renderers/preview.js";
-import { formatRetryStatus } from "./renderers/retry-status.js";
+import { presentProviderError, providerErrorEvidence } from "./renderers/provider-error.js";
+import { renderRetryStatus } from "./renderers/retry-status.js";
 import {
 	canGroupObservation,
 	renderToolAwaitingApproval,
@@ -223,7 +224,12 @@ type AssistantSegment = TextSegment | ToolSegment | ErrorSegment | ThinkingSegme
  * A caller-rendered block receives the frame's transcript detail policy so a
  * block such as the operator's `!` bash row follows the same preset as the panel. Blocks that ignore it are unaffected.
  */
-type ReplayBlockRenderer = (width: number, detail: TranscriptDetailPolicy, unbounded?: boolean) => string[];
+type ReplayBlockRenderer = (
+	width: number,
+	detail: TranscriptDetailPolicy,
+	unbounded?: boolean,
+	terminalRows?: number,
+) => string[];
 
 type TranscriptEntry =
 	| { role: "user"; text: string; status?: () => UserTurnStatus }
@@ -460,7 +466,7 @@ function scopeTerminalErrorAfterSuccessfulTool(
 	const reason = terminalError.slice("[error] ".length);
 	const timedOut = /\b(?:timed?\s*out|timeout)\b/i.test(reason);
 	const modelFailure = timedOut
-		? "main model response timed out after successful tool result"
+		? `main model response timed out after successful tool result: ${reason}`
 		: `main model response failed after successful tool result: ${reason}`;
 	const detachedDispatchSucceeded = successfulTools.some(
 		(segment) =>
@@ -604,9 +610,9 @@ function renderTextSegmentLines(seg: TextSegment, width: number): string[] {
  * message text rather than plain markdown, so a failed turn is visibly a
  * failure. Each source line wraps to width and carries the error color.
  */
-function renderErrorSegmentLines(seg: ErrorSegment, width: number): string[] {
+function renderErrorSegmentLines(seg: ErrorSegment, width: number, unbounded: boolean): string[] {
 	const out: string[] = [];
-	for (const line of seg.text.split("\n")) {
+	for (const line of (unbounded ? providerErrorEvidence(seg.text) : presentProviderError(seg.text)).split("\n")) {
 		for (const wrapped of wrapTextWithAnsi(line, width)) {
 			out.push(`${RED_CRIT}${wrapped}${RESET}`);
 		}
@@ -813,7 +819,7 @@ function renderEntryLines(
 	terminalRows: number,
 ): string[] {
 	if (entry.role === "replayBlock") {
-		return entry.renderBlock(width, detail);
+		return entry.renderBlock(width, detail, unboundedToolBodies, terminalRows);
 	}
 	if (entry.role === "user") {
 		const contentWidth = Math.max(1, width - PROSE_GUTTER_WIDTH);
@@ -827,7 +833,7 @@ function renderEntryLines(
 		return rendered;
 	}
 	if (entry.role === "retryStatus") {
-		return wrapTextWithAnsi(formatRetryStatus(entry.status), width);
+		return renderRetryStatus(entry.status, width, detail, unboundedToolBodies, terminalRows);
 	}
 	if (entry.role === "worker") {
 		return renderWorkerEntryLines(entry.state, width, { detail, terminalRows, unbounded: unboundedToolBodies });
@@ -888,8 +894,13 @@ function renderEntryLines(
 			labeled = true;
 			continue;
 		}
-		const rendered =
-			seg.kind === "text" ? renderTextSegmentLines(seg, proseWidth) : renderErrorSegmentLines(seg, proseWidth);
+		let rendered =
+			seg.kind === "text"
+				? renderTextSegmentLines(seg, proseWidth)
+				: renderErrorSegmentLines(seg, proseWidth, unboundedToolBodies);
+		if (seg.kind === "error" && !unboundedToolBodies) {
+			rendered = previewRows(rendered, previewBudget(detail.errorRows, terminalRows), proseWidth);
+		}
 		if (rendered.length === 0) continue;
 		const isSkillSuggestion = seg.kind === "text" && findSkillSuggestionLine(seg) !== null;
 		if (!labeled && !isSkillSuggestion) {
@@ -1331,6 +1342,7 @@ export function createChatPanel(options: ChatPanelOptions = {}): ChatPanel {
 			for (const entry of transcript) {
 				if (entry.role === "assistant") {
 					for (const seg of entry.segments) {
+						if (seg.kind === "error") add("Provider or terminal error", () => providerErrorEvidence(seg.text).split("\n"));
 						if (seg.kind === "thinking" && seg.text) add("Thinking · supplied reasoning", () => seg.text.split("\n"));
 						if (seg.kind === "tool")
 							add(`${seg.name} · ${seg.id}`, () =>
@@ -1350,6 +1362,8 @@ export function createChatPanel(options: ChatPanelOptions = {}): ChatPanel {
 								),
 							);
 					}
+				} else if (entry.role === "retryStatus" && entry.status.errorMessage) {
+					add("Provider retry diagnostic", () => providerErrorEvidence(entry.status.errorMessage ?? "").split("\n"));
 				} else if (entry.role === "worker") {
 					add(`${entry.state.agentId} · worker ${entry.state.runId}`, () =>
 						renderWorkerEntryLines(entry.state, 120, { unbounded: true }),