@jskit-ai/assistant-core 0.1.235 → 0.1.237

package/examples/conversation/README.md

@@ -29,9 +29,12 @@ The example uses JSKIT's existing `ai` integration configuration and authorized
 connection resolver. To call the explicitly selected model in `integrations.json`:
 
 ```sh
-ASSISTANT_INTEGRATIONS=./integrations.json npm run server
+APP_AI_API_KEY=... ASSISTANT_INTEGRATIONS=./integrations.json npm run server
 ```
 
+The sample selects Z.AI's GLM-4.7-Flash, which needs a regular Z.AI API key in
+`APP_AI_API_KEY`. Choose your own provider, model and key; none is preselected.
+
 Edit that portable configuration through JSKIT's integration editor or its JSON
 contract. Shared keys use `env:NAME` references; the key stays in the server's
 normal environment. The example binds authorization to its one local user.

package/examples/conversation/integrations.json

@@ -7,10 +7,11 @@
       "accountMode": "shared",
       "scopes": [],
       "settings": {
-        "model": "opencode/big-pickle"
+        "model": "zai/glm-4.7-flash"
       },
       "authentication": {
-        "method": "none"
+        "method": "api-key",
+        "secretRef": "env:APP_AI_API_KEY"
       }
     },
     "suggestions": {
@@ -18,10 +19,11 @@
       "accountMode": "shared",
       "scopes": [],
       "settings": {
-        "model": "opencode/big-pickle"
+        "model": "zai/glm-4.7-flash"
       },
       "authentication": {
-        "method": "none"
+        "method": "api-key",
+        "secretRef": "env:APP_AI_API_KEY"
       }
     }
   }

package/examples/conversation/package.json

@@ -8,17 +8,17 @@
     "build": "vite build"
   },
   "dependencies": {
-    "@jskit-ai/assistant-core": "0.1.235",
+    "@jskit-ai/assistant-core": "0.1.237",
     "@jskit-ai/http-runtime": "0.1.242",
     "@jskit-ai/kernel": "0.1.244",
     "@mdi/js": "^7.4.47",
     "vue": "^3.5.13",
     "vuetify": "^4.0.0",
     "@jskit-ai/connectors-core": "0.1.61",
-    "@jskit-ai/connectors-catalog": "0.1.61"
+    "@jskit-ai/connectors-catalog": "0.1.62"
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "^6.0.7",
-    "vite": "^8.2.1"
+    "vite": "^8.2.4"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/assistant-core",
-  "version": "0.1.235",
+  "version": "0.1.237",
   "type": "module",
   "scripts": {
     "test": "node --test --test-concurrency=1"

package/src/client/conversation/messageDelivery.js

@@ -59,7 +59,7 @@ function createAssistantMessageDelivery({ deliver: defaultDeliver } = {}) {
   }
 
   function turns(savedTurns = []) {
-    return [
+    const shown = [
       ...savedTurns.map(turn => {
         const message = state.messages.find(message => message.status !== "accepted" &&
           turnMatchesOptimisticMessage(turn, message) &&
@@ -67,9 +67,19 @@ function createAssistantMessageDelivery({ deliver: defaultDeliver } = {}) {
         if (!message) return turn;
         const pending = optimisticTurn(message);
         return { ...turn, optimistic: pending.optimistic, ...(pending.system ? { system: pending.system } : {}) };
-      }),
-      ...unmatchedOptimisticMessages(savedTurns, state.messages).map(optimisticTurn)
+      })
     ];
+    // Pending and uncertain messages follow the saved history. A failed message
+    // never reached the conversation, so it keeps its own time: newer saved turns
+    // and the working indicator stay below it instead of looking blocked by it.
+    for (const message of unmatchedOptimisticMessages(savedTurns, state.messages)) {
+      const turn = optimisticTurn(message);
+      const later = message.status !== "failed" ? -1 : shown.findIndex(saved => !saved.optimistic &&
+        Date.parse((saved.user || saved.system)?.at || "") > message.createdAtMs);
+      if (later < 0) shown.push(turn);
+      else shown.splice(later, 0, turn);
+    }
+    return shown;
   }
 
   function optimisticTurn(message) {

package/src/server/conversation/codexProcess.js

@@ -572,18 +572,23 @@ export function createCodexAppServerRuntime({ execution, credentials, configurat
     return acquireCodexRuntimeLock(runtimeDir, { ...options, busyCode: `${errorPrefix}codex_app_server_runtime_busy` });
   }
 
-  const CODEX_APP_SERVER_MANAGED_UMASK = umask;
+  // An empty or null umask inherits the host's own; hosts that share files set one.
+  const startupUmask = normalizeText(umask);
+  if (startupUmask && !/^[0-7]{3,4}$/u.test(startupUmask)) {
+    throw new TypeError(`Codex app-server umask must be octal, not ${JSON.stringify(startupUmask)}.`);
+  }
+  const CODEX_APP_SERVER_UMASK_LINES = startupUmask ? [`umask ${startupUmask}`] : [];
 
   const CODEX_APP_SERVER_MANAGED_SHELL = "/bin/sh";
 
   const CODEX_APP_SERVER_MANAGED_STARTUP_SCRIPT = [
-    `umask ${CODEX_APP_SERVER_MANAGED_UMASK}`,
+    ...CODEX_APP_SERVER_UMASK_LINES,
     `unset ${[...CODEX_APP_SERVER_DESKTOP_BUS_ENV_NAMES].join(" ")}`,
     'exec "$@"'
   ].join("\n");
 
   const CODEX_APP_SERVER_HELPER_STARTUP_SCRIPT = [
-    `umask ${CODEX_APP_SERVER_MANAGED_UMASK}`,
+    ...CODEX_APP_SERVER_UMASK_LINES,
     "exec /usr/bin/env -i \\",
     '  HOME="$HOME" LOGNAME="$LOGNAME" USER="$USER" PATH="$PATH" \\',
     '  CODEX_HOME="$CODEX_HOME" LANG="$LANG" LC_ALL="$LC_ALL" LC_CTYPE="$LC_CTYPE" \\',

package/src/server/conversation/localExecution.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { closeSync, openSync } from "node:fs";
 import { mkdtemp, open, readFile, readdir, rm } from "node:fs/promises";
@@ -6,6 +6,18 @@ import { isPlainObject, normalizeText } from "./normalize.js";
 import { isAbsolute, join } from "node:path";
 import { tmpdir } from "node:os";
 import { setTimeout as delay } from "node:timers/promises";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+// Fixed locale and zone make `lstart` parseable and stable across restarts.
+async function runPs(args) {
+  const { stdout } = await execFileAsync("ps", args, {
+    env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
+    maxBuffer: 64 * 1024 * 1024
+  });
+  return stdout;
+}
 
 /** Owned POSIX process groups for a trusted, single-user application.
  * Managed hosts replace this facility to enforce resource and identity policy.
@@ -170,12 +182,16 @@ export function createConversationProcessIdentity({
   runtimeTokenEnvironmentName = "JSKIT_EXECUTION_RUNTIME_TOKEN",
   commandHashEnvironmentName = "JSKIT_EXECUTION_COMMAND_HASH",
   label = "Native",
-  unavailableCode = "native_process_identity_unavailable"
+  unavailableCode = "native_process_identity_unavailable",
+  platform = process.platform,
+  ps = runPs
 } = {}) {
   const PROCESS_IDENTITY_SETTLE_TIMEOUT_MS = 1000;
-  const PROCESS_IDENTITY_SETTLE_POLL_MS = 25;
+  // Darwin inspection spawns ps instead of reading /proc, so it polls less often.
+  const PROCESS_IDENTITY_SETTLE_POLL_MS = platform === "darwin" ? 100 : 25;
   const PROCESS_IDENTITY_VERSION = 1;
-  const PROCESS_IDENTITY_PLATFORM = "linux-proc";
+  const PROCESS_IDENTITY_PLATFORMS = Object.freeze({ linux: "linux-proc", darwin: "darwin" });
+  const hostIdentityPlatform = PROCESS_IDENTITY_PLATFORMS[platform] || "";
   const PROCESS_STATE = Object.freeze({ RUNNING: "running", STOPPED: "stopped" });
   const PROCESS_IDENTITY_STATUS = Object.freeze({
     ABSENT: "absent", AMBIGUOUS: "ambiguous", EXACT: "exact", INVALID: "invalid", MISMATCH: "mismatch"
@@ -281,21 +297,17 @@ export function createConversationProcessIdentity({
     const identity = normalizeProcessIdentity(value);
     return Boolean(
       identity.version === PROCESS_IDENTITY_VERSION &&
-      identity.platform === PROCESS_IDENTITY_PLATFORM &&
+      Object.values(PROCESS_IDENTITY_PLATFORMS).includes(identity.platform) &&
       /^[a-f0-9]{12}$/u.test(identity.commandHash) &&
       /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(identity.runtimeToken) &&
       /^\d+$/u.test(identity.startTimeTicks)
     );
   }
 
-  function linuxProcessEnvironmentValue(buffer = Buffer.alloc(0), name = "") {
-    const prefix = `${name}=`;
-    for (const entry of buffer.toString("utf8").split("\0")) {
-      if (entry.startsWith(prefix)) {
-        return entry.slice(prefix.length);
-      }
-    }
-    return "";
+  /** The value of `name` in a list of NAME=value environment entries. */
+  function environmentValue(entries = [], name = "") {
+    const entry = entries.find((assignment) => assignment.startsWith(`${name}=`));
+    return entry ? entry.slice(name.length + 1) : "";
   }
 
   async function linuxProcessRecords() {
@@ -323,11 +335,80 @@ export function createConversationProcessIdentity({
         }
         environmentReadable = false;
       }
+      const entries = environmentReadable ? environment.toString("utf8").split("\0") : [];
       records.push({
         ...processStat,
-        environment,
+        commandHash: environmentValue(entries, commandHashEnvironmentName),
         environmentReadable,
-        pid
+        pid,
+        runtimeToken: environmentValue(entries, runtimeTokenEnvironmentName)
+      });
+    }
+    return records;
+  }
+
+  const DARWIN_MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+
+  /** `ps -o lstart=` in the C locale and UTC, as whole epoch seconds. */
+  function darwinStartTime(value = "") {
+    const match = /^\w{3}\s+(\w{3})\s+(\d{1,2})\s+(\d{2}):(\d{2}):(\d{2})\s+(\d{4})$/u.exec(String(value).trim());
+    const month = match ? DARWIN_MONTHS.indexOf(match[1]) : -1;
+    if (month < 0) {
+      return "";
+    }
+    const [, , day, hours, minutes, seconds, year] = match.map(Number);
+    return String(Date.UTC(year, month, day, hours, minutes, seconds) / 1000);
+  }
+
+  function darwinCommandsByPid(output = "") {
+    const commands = new Map();
+    for (const line of String(output).split("\n")) {
+      const match = /^\s*(\d+) (.*)$/u.exec(line);
+      if (match) {
+        commands.set(Number(match[1]), match[2]);
+      }
+    }
+    return commands;
+  }
+
+  /** The `ps -E` text after the argument list, as its assignments, or null when no environment is shown. */
+  function darwinEnvironment(command, commandWithEnvironment) {
+    if (command === undefined || !commandWithEnvironment?.startsWith(command)) {
+      return null;
+    }
+    const assignments = commandWithEnvironment.slice(command.length).split(/\s+/u).filter((entry) => /^[^=\s]+=/u.test(entry));
+    return assignments.length ? assignments : null;
+  }
+
+  /** The darwin counterpart of the /proc scan. Only the current user's environments are readable;
+   * a listing without a separate environment section stays unreadable so inspection degrades to ambiguous. */
+  async function darwinProcessRecords() {
+    const currentUid = process.getuid();
+    const ownProcesses = ["-x", "-U", String(currentUid), "-ww", "-o", "pid=,command="];
+    const [table, commandOutput, environmentOutput] = await Promise.all([
+      ps(["-ax", "-o", "pid=,pgid=,uid=,stat=,lstart="]),
+      ps(ownProcesses),
+      ps(["-E", ...ownProcesses])
+    ]);
+    const commands = darwinCommandsByPid(commandOutput);
+    const commandsWithEnvironment = darwinCommandsByPid(environmentOutput);
+    const records = [];
+    for (const line of String(table).split("\n")) {
+      const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+[\d:]{8}\s+\d{4})\s*$/u.exec(line);
+      if (!match || match[4].startsWith("Z")) {
+        continue;
+      }
+      const pid = Number(match[1]);
+      const environment = Number(match[3]) === currentUid
+        ? darwinEnvironment(commands.get(pid), commandsWithEnvironment.get(pid))
+        : null;
+      records.push({
+        commandHash: environmentValue(environment || [], commandHashEnvironmentName),
+        environmentReadable: Boolean(environment),
+        pid,
+        processGroupId: Number(match[2]),
+        runtimeToken: environmentValue(environment || [], runtimeTokenEnvironmentName),
+        startTimeTicks: darwinStartTime(match[5])
       });
     }
     return records;
@@ -347,7 +428,7 @@ export function createConversationProcessIdentity({
     };
   }
 
-  async function inspectLinuxProcessIdentity(metadata = {}) {
+  async function inspectHostProcessIdentity(metadata = {}) {
     if (!processMetadataIsIdentifiable(metadata)) {
       return {
         processGroupIds: [],
@@ -360,14 +441,18 @@ export function createConversationProcessIdentity({
         status: PROCESS_IDENTITY_STATUS.ABSENT
       };
     }
-    if (process.platform !== "linux") {
+    const identity = metadata.processIdentity;
+    const records = identity.platform !== hostIdentityPlatform
+      ? null
+      : platform === "darwin"
+        ? await darwinProcessRecords().catch(() => null)
+        : await linuxProcessRecords();
+    if (!records) {
       return {
         processGroupIds: [],
         status: PROCESS_IDENTITY_STATUS.AMBIGUOUS
       };
     }
-    const identity = metadata.processIdentity;
-    const records = await linuxProcessRecords();
     const rootProcessGroupId = Number(metadata.pid);
     const rootGroupMembers = records.filter(({ processGroupId }) => processGroupId === rootProcessGroupId);
     const exactRecords = [];
@@ -376,15 +461,7 @@ export function createConversationProcessIdentity({
       if (!record.environmentReadable) {
         continue;
       }
-      const runtimeToken = linuxProcessEnvironmentValue(
-        record.environment,
-        runtimeTokenEnvironmentName
-      );
-      const commandHash = linuxProcessEnvironmentValue(
-        record.environment,
-        commandHashEnvironmentName
-      );
-      if (runtimeToken === identity.runtimeToken && commandHash === identity.commandHash) {
+      if (record.runtimeToken === identity.runtimeToken && record.commandHash === identity.commandHash) {
         exactRecords.push(record);
       }
     }
@@ -438,7 +515,7 @@ export function createConversationProcessIdentity({
   async function inspectProcessIdentity(metadata = {}, options = {}) {
     const inspector = typeof options.processIdentityInspector === "function"
       ? options.processIdentityInspector
-      : inspectLinuxProcessIdentity;
+      : inspectHostProcessIdentity;
     return normalizeProcessIdentityInspection(await inspector(metadata));
   }
 
@@ -610,6 +687,15 @@ export function createConversationProcessIdentity({
     };
   }
 
+  async function captureProcessStart(pid) {
+    if (platform !== "darwin") {
+      return linuxProcessStat(await readFile(`/proc/${pid}/stat`, "utf8").catch(() => ""));
+    }
+    const output = String(await ps(["-o", "pgid=,lstart=", "-p", String(pid)]).catch(() => ""));
+    const match = /^\s*(\d+)\s+(.+?)\s*$/u.exec(output);
+    return match ? { processGroupId: Number(match[1]), startTimeTicks: darwinStartTime(match[2]) } : null;
+  }
+
   async function captureProcessIdentity({
     commandHash = "",
     pid = null,
@@ -627,26 +713,17 @@ export function createConversationProcessIdentity({
       return reported;
     }
     const normalizedPid = Number(pid);
-    if (
-      process.platform !== "linux" ||
-      !Number.isSafeInteger(normalizedPid) ||
-      normalizedPid <= 0
-    ) {
-      const error = new Error(`${label} process identity could not be captured.`);
-      error.code = unavailableCode;
-      throw error;
-    }
-    const processStat = linuxProcessStat(
-      await readFile(`/proc/${normalizedPid}/stat`, "utf8").catch(() => "")
-    );
-    if (!processStat || processStat.processGroupId !== normalizedPid) {
+    const processStat = hostIdentityPlatform && Number.isSafeInteger(normalizedPid) && normalizedPid > 0
+      ? await captureProcessStart(normalizedPid)
+      : null;
+    if (!processStat?.startTimeTicks || processStat.processGroupId !== normalizedPid) {
       const error = new Error(`${label} process identity could not be captured.`);
       error.code = unavailableCode;
       throw error;
     }
     return {
       commandHash: expectedCommandHash,
-      platform: PROCESS_IDENTITY_PLATFORM,
+      platform: hostIdentityPlatform,
       runtimeToken: expectedRuntimeToken,
       startTimeTicks: processStat.startTimeTicks,
       version: PROCESS_IDENTITY_VERSION

package/src/server/conversation/openCodePlugin.js

@@ -1,5 +1,6 @@
 import { createOpenCodeConversationAdapter } from "./providers/opencode.js";
 import { wrapNativeCommand } from "./commandWrapper.js";
+import { OPENCODE_REFUSED_TOOL_ERROR } from "./openCodeTurn.js";
 import { readOpenCodeEnvironments, openCodeEnvironmentForSession, openCodeEnvironmentForDirectory,
   assertOpenCodeModelProvider, limitOpenCodeModelOutput } from "./openCodeRuntime.js";
 
@@ -44,7 +45,7 @@ export default async function conversationInstructions({ client, registryPath =
         ? conversation?.tools?.schemas.some(({ function: definition }) => definition.name === tool)
         : conversation?.nativeTools;
       if (!allowed) {
-        throw new Error("This conversation has no authorization for that native tool.");
+        throw new Error(OPENCODE_REFUSED_TOOL_ERROR);
       }
       if (tool === "bash" && conversation.commandWrapper) {
         output.args.command = wrapNativeCommand(conversation.commandWrapper, output.args.command);
@@ -70,7 +71,7 @@ export default async function conversationInstructions({ client, registryPath =
         }
         const connection = (await readBinding(context.sessionID)).conversation?.tools;
         if (!connection?.schemas.some(({ function: definition }) => definition.name === name)) {
-          throw new Error("This conversation has no authorization for that native tool.");
+          throw new Error(OPENCODE_REFUSED_TOOL_ERROR);
         }
         const response = await fetch(connection.url, { method: "POST", signal: context.abort,
           headers: { authorization: `Bearer ${connection.token}`, "content-type": "application/json" },

package/src/server/conversation/openCodeProcess.js

@@ -118,7 +118,7 @@ async function waitForOpenCodeReady({
   throw error;
 }
 
-const actionPermission = Object.fromEntries(DISCOVERY_TOOL_DESCRIPTORS.map(tool => [tool.name, "allow"]));
+const actionPermission = action => Object.fromEntries(DISCOVERY_TOOL_DESCRIPTORS.map(tool => [tool.name, action]));
 const nativePermission = { bash: "allow", read: "allow", write: "allow", edit: "allow",
   glob: "allow", grep: "allow", list: "allow", patch: "allow", apply_patch: "allow", todoread: "allow", todowrite: "allow" };
 export const openCodeApplicationToolSchemas = DISCOVERY_TOOL_DESCRIPTORS.map(({ name, description, parameters }) => ({
@@ -136,12 +136,20 @@ export function openCodeConversationAgents({ sessionEnvironmentRegistry = "" } =
       hidden: true, mode: "primary",
       // Keep native definitions behind approval, as in the original host agents.
       // The registered plugin rejects every ungranted native call before execution.
-      permission: nativeTools || tools || guarded ? { "*": !nativeTools && guarded ? "ask" : "deny",
-        ...(nativeTools ? nativePermission : {}), ...(tools ? actionPermission : {}) } : "deny"
+      permission: nativeTools || tools || guarded ? agentPermission(!nativeTools && guarded, nativeTools, tools) : "deny"
     }
   ])));
 }
 
+// OpenCode applies an agent's last matching rule, so its "*": "ask" overrides the
+// global policy. Restate two denials after it: application tools the agent does not
+// own are not offered to the model, and the repeated-call check does not wait for
+// an approval that no unattended conversation can give.
+function agentPermission(ask, nativeTools, tools) {
+  return { "*": ask ? "ask" : "deny", ...(nativeTools ? nativePermission : {}),
+    ...(tools ? actionPermission("allow") : ask ? actionPermission("deny") : {}), ...(ask ? { doom_loop: "deny" } : {}) };
+}
+
 /** Shared conversation configuration around the extracted server lifecycle. */
 export async function createOpenCodeConversationServer({
   command = "opencode", execution = createLocalConversationExecution(), env = process.env,

package/src/server/conversation/openCodeTurn.js

@@ -223,10 +223,21 @@ export function openCodePersistentConversationMessages(rows, conversationMessage
   });
 }
 
+// The plugin refuses every native call this conversation was not granted. OpenCode
+// returns each refusal to the model, which can keep retrying without ever answering.
+export const OPENCODE_REFUSED_TOOL_ERROR = "This conversation has no authorization for that native tool.";
+const OPENCODE_REFUSED_TOOL_LIMIT = 5;
+
 export async function projectOpenCodeConversationMessages(messages, expectedId, {
   maximumOutput, outputSchema, previous, onMessage
 }) {
-  for (const message of openCodeRowsForInput(messages, expectedId)) {
+  const rows = openCodeRowsForInput(messages, expectedId);
+  const refused = rows.flatMap(message => message.content || []).filter(part =>
+    part.type === "tool" && part.state?.status === "error" && part.state.error === OPENCODE_REFUSED_TOOL_ERROR).length;
+  if (refused >= OPENCODE_REFUSED_TOOL_LIMIT) {
+    throw new Error("The model kept calling tools that this conversation does not provide and gave no answer. No tool ran. Your message is kept; retry or choose another model.");
+  }
+  for (const message of rows) {
     if (message.type !== "assistant" || message.summary || message.error) continue;
     const text = assistantMessageText(message);
     const thinking = (message.content || []).filter(part => part.type === "reasoning").map(part => part.text || "").join("\n\n");
@@ -243,7 +254,7 @@ export async function projectOpenCodeConversationMessages(messages, expectedId,
       }
     }
   }
-  const result = openCodeLastAssistantResult(openCodeRowsForInput(messages, expectedId));
+  const result = openCodeLastAssistantResult(rows);
   return { failure: result.error, providerApiFailure: text(result.message?.error?.name) === "APIError" };
 }
 

package/src/server/conversation/runtime.js

@@ -442,13 +442,19 @@ export function createConversationRuntime({ engine: defaultEngine = "api", defau
         : Math.max(0, initialWindow - (request?.input.origin === "user" ? 1 : 0)),
       maximumInitialMessageCharacters: limits.maxInitialNativeHistoryMessageCharacters,
       ...(budget ? { maximumHistoryBytes: async options => {
-        await access(context, entry.id, request.operation, entry);
-        signal.throwIfAborted();
-        // A host may free native context first; show that as compacting.
-        const bytes = await budget({ ...options, context, signal,
-          setPhase: phase => setPhase(entry, phase === "compacting" ? "compacting" : "preparing") });
-        signal.throwIfAborted();
-        return bytes;
+        try {
+          await access(context, entry.id, request.operation, entry);
+          signal.throwIfAborted();
+          // A host may free native context first; show that as compacting.
+          const bytes = await budget({ ...options, context, signal,
+            setPhase: phase => setPhase(entry, phase === "compacting" ? "compacting" : "preparing") });
+          signal.throwIfAborted();
+          return bytes;
+        } catch (error) {
+          // Sizing missed history precedes native dispatch, so this message
+          // was definitely not sent. Hosts and clients report it as such.
+          throw Object.assign(error, { delivery: "not-sent" });
+        }
       } } : {}),
       presentation: entry.conversation?.presentation || { unconfirmedCode: "conversation_delivery_uncertain",
         unconfirmedMessage: "The previous submission has uncertain delivery. Retry this message to check its native receipt; it will not be resent automatically." },

package/test/aiConnectionClient.test.js

@@ -4,7 +4,7 @@ import { createAiConnectionResolver } from "../../connectors-catalog/src/server/
 import { createAiConnectionClient } from "../src/server/lib/aiConnectionClient.js";
 import { createAiClient } from "../src/server/lib/aiClient.js";
 
-function publicConnection(model = "opencode/big-pickle") {
+function publicConnection(model = "opencode/mimo-v2.5-free") {
   return createAiConnectionResolver({
     configuration: { schemaVersion: 1, registrations: {}, integrations: {
       assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model } }
@@ -28,7 +28,7 @@ test("the configured public AI integration streams its first chunk before comple
       assert.equal(String(url), "https://opencode.ai/zen/v1/chat/completions");
       assert.equal(new Headers(options.headers).get("authorization"), "Bearer public");
       const body = JSON.parse(options.body);
-      assert.equal(body.model, "big-pickle");
+      assert.equal(body.model, "mimo-v2.5-free");
       assert.equal(body.stream, true);
       return new Response(source.readable, { headers: { "content-type": "text/event-stream" } });
     }

package/test/claudeTurn.test.js

@@ -2361,7 +2361,8 @@ test("bound Main cannot dispatch or retain a pending prompt when its history bud
   f.binding.transcript.history = async () => [{ id: "earlier", version: "v1", role: "user", text: "Earlier work." }];
   await f.binding.state.write({ lastEngine: "codex", engines: { codex: { seen: {} } } });
   f.binding.maximumHistoryBytes = async () => { throw new Error("Current native context usage unavailable"); };
-  await assert.rejects(f.conversation.send({ messageId: "no-budget", text: "Continue" }), /Current native context usage unavailable/u);
+  await assert.rejects(f.conversation.send({ messageId: "no-budget", text: "Continue" }), error =>
+    /Current native context usage unavailable/u.test(error.message) && error.delivery === "not-sent");
   assert.equal(f.processes.length, 0);
   assert.equal(f.messages.length, 0);
   assert.equal((await f.binding.state.read())?.engines?.claude?.pending, undefined);

package/test/codexConversationSession.test.js

@@ -842,7 +842,7 @@ test("Codex receives authorized image content and retains receipts through uncer
 
 function apiOptions() {
   return { connections: createAiConnectionResolver({ configuration: { schemaVersion: 1, registrations: {}, integrations: {
-    assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model: "opencode/big-pickle" } }
+    assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model: "opencode/mimo-v2.5-free" } }
   } }, authorize: () => ({ applicationId: "test", subjectId: "owner" }) }), fetch: async () => {
     const chunk = { choices: [{ index: 0, delta: { content: "API answer" }, finish_reason: "stop" }] };
     return new Response(`data: ${JSON.stringify(chunk)}\n\n`, { headers: { "content-type": "text/event-stream" } });
@@ -1998,7 +1998,7 @@ test("a failed write while recording rejected steering can be recovered when the
 test("one logical conversation switches between Codex and API across restart without duplicating the displayed history", async t => {
   const requests = [];
   const connections = createAiConnectionResolver({ configuration: { schemaVersion: 1, registrations: {}, integrations: {
-    assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model: "opencode/big-pickle" } }
+    assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model: "opencode/mimo-v2.5-free" } }
   } }, authorize: () => ({ applicationId: "test", subjectId: "owner" }) });
   const f = await fixture(t, { connections, fetch: async (_url, init) => {
     requests.push(JSON.parse(init.body));

package/test/codexProcess.test.js

@@ -0,0 +1,51 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { createCodexAppServerRuntime } from "../src/server/conversation/codexProcess.js";
+
+/** Starts a runtime whose execution host records the launch and reports failure. */
+async function launchRequest(t, configuration, executionMode = "interactive") {
+  const runtimeDir = await mkdtemp(join(tmpdir(), "jskit-codex-"));
+  t.after(() => rm(runtimeDir, { recursive: true, force: true }));
+  let request;
+  const runtime = createCodexAppServerRuntime({
+    configuration,
+    credentials: { identity: async () => "account", generation: async () => "generation", assertCurrent: async () => {} },
+    execution: {
+      async run(value) {
+        request = value;
+        return { ok: false, output: "recorded launch" };
+      }
+    }
+  });
+  await assert.rejects(runtime.start({ codexCommand: process.execPath, executionMode, runtimeDir }), /recorded launch/);
+  return request;
+}
+
+test("the default startup script keeps the shared-file umask in launch and process profile", async (t) => {
+  for (const executionMode of ["interactive", "helper"]) {
+    const request = await launchRequest(t, {}, executionMode);
+    assert.match(request.args[1], /^umask 0007\n/);
+    assert.equal(request.processProfile.startup, request.args[1]);
+  }
+});
+
+test("an empty umask inherits the host's own and emits no umask line", async (t) => {
+  for (const executionMode of ["interactive", "helper"]) {
+    const request = await launchRequest(t, { umask: "" }, executionMode);
+    assert.doesNotMatch(request.args[1], /umask/);
+    assert.equal(request.processProfile.startup, request.args[1]);
+  }
+  assert.doesNotMatch((await launchRequest(t, { umask: null })).args[1], /umask/);
+  assert.match((await launchRequest(t, { umask: "0022" })).args[1], /^umask 0022\n/);
+});
+
+test("a non-octal umask is refused before it reaches the startup script", () => {
+  assert.throws(() => createCodexAppServerRuntime({
+    configuration: { umask: "0007; touch /tmp/x" },
+    credentials: {},
+    execution: {}
+  }), /umask must be octal/);
+});

package/test/conversationReplacement.test.js

@@ -9,7 +9,7 @@ import { createAiConnectionResolver } from "../../connectors-catalog/src/server/
 const configuration = { systemPrompt: "Answer the current question.", integrationId: "assistant" };
 const connections = createAiConnectionResolver({
   configuration: { schemaVersion: 1, registrations: {}, integrations: {
-    assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model: "opencode/big-pickle" } }
+    assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model: "opencode/mimo-v2.5-free" } }
   } }, authorize: () => ({ applicationId: "test", subjectId: "owner" })
 });
 

package/test/conversationSession.test.js

@@ -21,7 +21,7 @@ async function fixture(t, options = {}) {
   const storage = options.storage || createMemoryConversationStorage();
   const connections = createAiConnectionResolver({
     configuration: { schemaVersion: 1, registrations: {}, integrations: {
-      assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model: "opencode/big-pickle" } }
+      assistant: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, settings: { model: "opencode/mimo-v2.5-free" } }
     } },
     authorize: actor => actor === context && state.modelAllowed ? actor : null
   });
@@ -96,10 +96,10 @@ test("saved history and current instructions use the existing authorized model c
 
 test("API configuration uses the common model and effort fields without overriding the authorized selection", async t => {
   const f = await fixture(t);
-  await f.conversation.configure({ model: "big-pickle", effort: "high" });
+  await f.conversation.configure({ model: "mimo-v2.5-free", effort: "high" });
   await f.conversation.send(input);
   assert.equal((await f.conversation.wait()).conversationLog[0].metadata.runtime.status, "complete");
-  assert.equal(f.requests[0].model, "big-pickle");
+  assert.equal(f.requests[0].model, "mimo-v2.5-free");
   assert.equal(f.requests[0].reasoning_effort, "high");
   await assert.rejects(f.conversation.configure({ effort: "arbitrary" }), /does not support/);
   await assert.rejects(f.conversation.configure({ systemPrompt: "a".repeat(128001) }), /configuration requires/);

package/test/localExecution.test.js

@@ -0,0 +1,150 @@
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { test } from "node:test";
+import { createConversationProcessIdentity } from "../src/server/conversation/localExecution.js";
+
+const TOKEN_ENV = "JSKIT_EXECUTION_RUNTIME_TOKEN";
+const HASH_ENV = "JSKIT_EXECUTION_COMMAND_HASH";
+const runtimeToken = "0b6c8f8e-3f7a-4c1e-9d2b-5a4e6f7a8b9c";
+const commandHash = "abcdef012345";
+// Process-group ids far above any live pid, so liveness probes find nothing.
+const LEADER = 9_000_001;
+const CHILD = 9_000_002;
+const STARTED = "Wed Oct 21 10:00:00 2026";
+const STARTED_SECONDS = String(Date.UTC(2026, 9, 21, 10, 0, 0) / 1000);
+const uid = process.getuid?.() ?? 0;
+
+const IDENTITY_ENV = `PATH=/usr/bin ${TOKEN_ENV}=${runtimeToken} ${HASH_ENV}=${commandHash}`;
+
+function row(pid, pgid, { owner = uid, stat = "Ss", started = STARTED, args = "/usr/bin/codex app-server", env = IDENTITY_ENV } = {}) {
+  return { pid, pgid, owner, stat, started, args, env };
+}
+
+/** Renders the three darwin listings: every process, then the user's commands without and with `-E`. */
+function psListing(rows, args) {
+  if (args[0] === "-ax") {
+    return rows.map(({ pid, pgid, owner, stat, started }) =>
+      `${String(pid).padStart(7)} ${String(pgid).padStart(7)} ${String(owner).padStart(5)} ${stat.padEnd(4)} ${started}`).join("\n");
+  }
+  const withEnvironment = args[0] === "-E";
+  return rows.filter(({ owner }) => owner === uid).map(({ pid, args: command, env }) =>
+    `${String(pid).padStart(7)} ${command}${withEnvironment && env ? ` ${env}` : ""}`).join("\n");
+}
+
+function darwinIdentity(table, captureOutput = `${LEADER} ${STARTED}`) {
+  const calls = [];
+  const identity = createConversationProcessIdentity({
+    platform: "darwin",
+    async ps(args) {
+      calls.push(args);
+      if (args.includes("-p")) return captureOutput;
+      if (table instanceof Error) throw table;
+      return psListing(table, args);
+    }
+  });
+  return { calls, identity };
+}
+
+const metadata = (overrides = {}) => ({
+  pid: LEADER,
+  processState: "running",
+  processIdentity: { commandHash, platform: "darwin", runtimeToken, startTimeTicks: STARTED_SECONDS, version: 1, ...overrides }
+});
+
+test("darwin capture records the group leader's ps start time as epoch seconds", async () => {
+  const { calls, identity } = darwinIdentity([]);
+  const captured = await identity.capture({ commandHash, pid: LEADER, runtimeToken });
+  assert.deepEqual(captured, { commandHash, platform: "darwin", runtimeToken, startTimeTicks: STARTED_SECONDS, version: 1 });
+  assert.deepEqual(calls, [["-o", "pgid=,lstart=", "-p", String(LEADER)]]);
+  assert.equal(identity.isValid(captured), true);
+});
+
+test("darwin capture parses the padded BSD ps `pgid= lstart=` line", async () => {
+  // BSD ps prints lstart with strftime("%c"), which space-pads single-digit days in the C locale.
+  const { identity } = darwinIdentity([], `   ${LEADER} Tue Oct  7 09:05:03 2026\n`);
+  const captured = await identity.capture({ commandHash, pid: LEADER, runtimeToken });
+  assert.equal(captured.startTimeTicks, String(Date.UTC(2026, 9, 7, 9, 5, 3) / 1000));
+});
+
+test("darwin capture refuses a non-leader, an unparsable line or a failed ps", async (t) => {
+  for (const [name, output] of [
+    ["another group", `${CHILD} ${STARTED}`],
+    ["a non-numeric group", `pgid ${STARTED}`],
+    ["an unknown start format", `${LEADER} 2026-10-21T10:00:00Z`],
+    ["empty output", ""]
+  ]) {
+    await t.test(name, async () => {
+      const { identity } = darwinIdentity([], output);
+      await assert.rejects(identity.capture({ commandHash, pid: LEADER, runtimeToken }),
+        { code: "native_process_identity_unavailable" });
+    });
+  }
+});
+
+test("darwin inspection is exact only when every group member carries the identity", async () => {
+  const { calls, identity } = darwinIdentity([
+    row(LEADER, LEADER),
+    row(CHILD, CHILD),
+    row(9_000_003, 9_000_003, { env: "" })
+  ]);
+  assert.deepEqual(await identity.inspect(metadata()), { processGroupIds: [LEADER, CHILD], status: "exact" });
+  assert.deepEqual(calls, [
+    ["-ax", "-o", "pid=,pgid=,uid=,stat=,lstart="],
+    ["-x", "-U", String(uid), "-ww", "-o", "pid=,command="],
+    ["-E", "-x", "-U", String(uid), "-ww", "-o", "pid=,command="]
+  ]);
+});
+
+test("darwin inspection keeps the absent, mismatch and ambiguous outcomes", async (t) => {
+  const cases = [
+    ["no process in the group", [], {}, "absent"],
+    ["zombies are ignored", [row(LEADER, LEADER, { stat: "Z" })], {}, "absent"],
+    ["an unrelated process reuses the group", [row(LEADER, LEADER, { env: "PATH=/usr/bin" })], {}, "mismatch"],
+    ["the token only in the arguments", [row(LEADER, LEADER, {
+      args: `/usr/bin/env -i ${TOKEN_ENV}=${runtimeToken} ${HASH_ENV}=${commandHash} codex`, env: "PATH=/usr/bin"
+    })], {}, "mismatch"],
+    ["a hidden environment", [row(LEADER, LEADER, { env: "" })], {}, "ambiguous"],
+    ["the token only in the arguments of a hidden environment", [row(LEADER, LEADER, {
+      args: `/usr/bin/env ${TOKEN_ENV}=${runtimeToken} ${HASH_ENV}=${commandHash} codex`, env: ""
+    })], {}, "ambiguous"],
+    ["another runtime token", [row(LEADER, LEADER)], { runtimeToken: randomUUID() }, "mismatch"],
+    ["the leader restarted", [row(LEADER, LEADER, { started: "Wed Oct 21 10:00:01 2026" })], {}, "ambiguous"],
+    ["another user's process shares the group", [row(LEADER, LEADER), row(CHILD, LEADER, { owner: uid + 1 })], {}, "ambiguous"],
+    ["another user's environment is not trusted", [row(LEADER, LEADER, { owner: uid + 1 })], {}, "ambiguous"],
+    ["an unmarked member shares the group", [row(LEADER, LEADER), row(CHILD, LEADER, { env: "PATH=/usr/bin" })], {}, "ambiguous"],
+    ["ps fails", new Error("ps unavailable"), {}, "ambiguous"],
+    ["a Linux identity", [row(LEADER, LEADER)], { platform: "linux-proc" }, "ambiguous"]
+  ];
+  for (const [name, table, overrides, status] of cases) {
+    await t.test(name, async () => {
+      const { identity } = darwinIdentity(table);
+      assert.equal((await identity.inspect(metadata(overrides))).status, status);
+    });
+  }
+});
+
+async function liveGroup(t, env) {
+  const child = spawn(process.execPath, ["-e", "setInterval(() => {}, 1000)"], {
+    detached: true, stdio: "ignore", env: { ...process.env, ...env }
+  });
+  await new Promise((resolve, reject) => { child.once("spawn", resolve); child.once("error", reject); });
+  t.after(() => { try { process.kill(-child.pid, "SIGKILL"); } catch {} });
+  return child;
+}
+
+const nativePlatform = { linux: "linux-proc", darwin: "darwin" }[process.platform];
+
+test("the host platform captures, inspects and stops a real owned process group", { skip: !nativePlatform }, async (t) => {
+  const token = randomUUID();
+  const child = await liveGroup(t, { [TOKEN_ENV]: token, [HASH_ENV]: commandHash });
+  const identity = createConversationProcessIdentity();
+  const captured = await identity.capture({ commandHash, pid: child.pid, runtimeToken: token });
+  assert.equal(captured.platform, nativePlatform);
+  const owned = { pid: child.pid, processState: "running", processIdentity: captured };
+  assert.deepEqual(await identity.inspect(owned), { processGroupIds: [child.pid], status: "exact" });
+  assert.equal((await identity.inspect({ ...owned, processIdentity: { ...captured, runtimeToken: randomUUID() } })).status, "mismatch");
+  const stopped = await identity.stop(owned, { termTimeoutMs: 2000 });
+  assert.equal(stopped.processExitVerified, true);
+  assert.deepEqual(stopped.signaledProcessGroups, [child.pid]);
+});

package/test/messageDelivery.test.js

@@ -146,6 +146,23 @@ test("a failed message retains its retry identity while later guidance is pendin
   assert.equal(delivery.state.sending, false);
 });
 
+test("a failed client-only message keeps its time while newer saved turns and pending messages follow it", async () => {
+  const delivery = createAssistantMessageDelivery({ deliver: async () => ({ ok: false, error: "Unavailable" }) });
+  await delivery.send({ message: "Lost" }, { messageId: "lost" });
+  const sentAt = delivery.find("lost").createdAtMs;
+  const earlier = { turnId: "1", user: { messageId: "earlier", text: "Earlier", at: new Date(sentAt - 1000).toISOString() } };
+  const newer = { turnId: "2", user: { messageId: "newer", text: "Newer", at: new Date(sentAt + 1000).toISOString() }, pending: true };
+  assert.deepEqual(delivery.turns([earlier, newer]).map(turn => turn.turnId), ["1", "lost", "2"]);
+  assert.deepEqual(delivery.turns([earlier]).map(turn => turn.turnId), ["1", "lost"]);
+  const waiting = Promise.withResolvers();
+  const queued = createAssistantMessageDelivery({ deliver: () => waiting.promise });
+  const sending = queued.send({ message: "Queued" }, { messageId: "queued" });
+  assert.deepEqual(queued.turns([{ ...newer, user: { ...newer.user, at: new Date(Date.now() + 60000).toISOString() } }])
+    .map(turn => turn.turnId), ["2", "queued"]);
+  waiting.resolve({ ok: true });
+  await sending;
+});
+
 test("reset discards queued delivery without waiting for the old transport", async () => {
   const request = Promise.withResolvers();
   const sent = [];

package/test/openCodeTools.test.js

@@ -242,6 +242,16 @@ test("non-project common OpenCode tools stay behind approval and require the exe
   const guarded = openCodeConversationAgents({ sessionEnvironmentRegistry: "/private/sessions.json" });
   assert.equal(guarded["jskit-assistant"].permission["*"], "ask");
   assert.equal(guarded["jskit-assistant-actions"].permission["*"], "ask");
+  // OpenCode applies the agent's last matching rule: an agent without application
+  // tools must not be offered them, and no agent waits on a repeated-call approval.
+  for (const name of ["assistant_action_search", "assistant_action_contract", "assistant_action_execute"]) {
+    assert.equal(guarded["jskit-assistant"].permission[name], "deny");
+    assert.equal(guarded["jskit-assistant-actions"].permission[name], "allow");
+    assert.equal(Object.keys(guarded["jskit-assistant"].permission).indexOf(name) > 0, true);
+  }
+  assert.equal(guarded["jskit-assistant"].permission.doom_loop, "deny");
+  assert.equal(guarded["jskit-assistant-actions"].permission.doom_loop, "deny");
+  assert.equal(guarded["jskit-assistant-coding"].permission["*"], "deny");
 });
 
 test("common non-project OpenCode calls retain the original fail-closed execution guard", async t => {

package/test/opencodeConversationSession.test.js

@@ -194,6 +194,18 @@ async function fixture(t, options = {}) {
             session.messages.push(row("assistant", randomUUID(), [], { error: { data: { message: error.message } } })); save(); return;
           }
         }
+        if (text === "refused-tools") {
+          // A model that keeps retrying an ungranted native tool and never answers.
+          while (busy.has(session.id)) {
+            const part = { type: "tool", callID: randomUUID(), tool: "assistant_action_search", state: { status: "running", input: {} } };
+            session.messages.push(row("assistant", randomUUID(), [part], { parentID: body.messageID, finish: "tool-calls" }));
+            try { await hooks["tool.execute.before"]({ tool: part.tool, sessionID: session.id }, { args: {} }); }
+            catch (error) { part.state = { ...part.state, status: "error", error: error.message }; }
+            save();
+            await new Promise(resolve => setTimeout(resolve, 20));
+          }
+          return;
+        }
         if (text === "compact") {
           session.messages.push(row("user", randomUUID(), [{ type: "compaction", auto: true }]));
           session.messages.push(row("assistant", randomUUID(), [{ type: "text", text: "Native summary" }], { summary: true, finish: "stop" }));
@@ -327,7 +339,8 @@ test("OpenCode admits once, streams and saves native reasoning through the commo
   assert.equal(trace.find(item => item.url === "/api/session").body.model.id, "test-model");
   assert.equal(trace.find(item => item.url?.endsWith("/prompt_async")).body.model.modelID, "test-model");
   assert.equal(trace[0].inheritedSecret, null);
-  assert.deepEqual(trace[0].configuration.agent[trace.find(item => item.url?.endsWith("/prompt_async")).body.agent].permission, { "*": "ask" });
+  assert.deepEqual(trace[0].configuration.agent[trace.find(item => item.url?.endsWith("/prompt_async")).body.agent].permission, { "*": "ask",
+    assistant_action_search: "deny", assistant_action_contract: "deny", assistant_action_execute: "deny", doom_loop: "deny" });
   assert.match(trace[0].configuration.plugin[0], /openCodePlugin\.js$/u);
   assert.deepEqual(trace[0].configuration.provider.test.models["test-model"].limit, { context: 32000, output: 4000 });
   assert.equal(trace[0].configuration.provider.test.models["test-model"].id, "test-model");
@@ -423,6 +436,17 @@ test("the production recovery stops after two reasoning-only completions through
   assert.equal(state.conversationLog[0].assistant, null);
 });
 
+test("a model that keeps calling refused native tools fails visibly and stops its native turn", async t => {
+  const f = await fixture(t);
+  await f.conversation.send({ messageId: "client-message-refused-tools", text: "refused-tools" });
+  const state = await f.conversation.wait();
+  assert.equal(state.conversationLog.length, 1);
+  assert.equal(state.conversationLog[0].metadata.runtime.status, "failed");
+  assert.equal(state.error, "The model kept calling tools that this conversation does not provide and gave no answer. No tool ran. Your message is kept; retry or choose another model.");
+  assert.equal(state.conversationLog[0].assistant, null);
+  assert.ok((await f.trace()).some(row => row.url?.endsWith("/abort")), "The refused native loop is stopped");
+});
+
 test("OpenCode steering follows the newly admitted input in the same native conversation", async t => {
   const f = await fixture(t);
   const started = Promise.withResolvers();
@@ -520,7 +544,7 @@ test("OpenCode shares discovery, saved results and current permissions across na
   assert.equal(executions, 1);
   const trace = await f.trace();
   assert.deepEqual(trace[0].configuration.agent[trace.find(item => item.url?.endsWith("/prompt_async")).body.agent].permission, { "*": "ask", assistant_action_search: "allow",
-    assistant_action_contract: "allow", assistant_action_execute: "allow" });
+    assistant_action_contract: "allow", assistant_action_execute: "allow", doom_loop: "deny" });
   const original = await f.binding();
   await f.first.close();
   const resumed = await f.runtime().open({ id: "conversation", context });
@@ -1625,7 +1649,8 @@ test("completed OpenCode caller markers preserve ordinary native discovery witho
     assert.equal(ordinaryPrompt.body.agent, "jskit-assistant-actions");
     assert.match(ordinaryPrompt.body.parts[0].text, /\[Application data\]/);
     assert.deepEqual(initialTrace[0].configuration.agent[ordinaryPrompt.body.agent].permission, {
-      "*": "ask", assistant_action_search: "allow", assistant_action_contract: "allow", assistant_action_execute: "allow"
+      "*": "ask", assistant_action_search: "allow", assistant_action_contract: "allow", assistant_action_execute: "allow",
+      doom_loop: "deny"
     });
     await assert.rejects(f.prepare({ messageId: "ordinary-opencode", turnId: receipt.turnId }), /no current verified receipt/);
     // The original native fixture invokes discovery only for exact plain tools.