@jskit-ai/assistant-core 0.1.236 → 0.1.238

package/examples/conversation/README.md

@@ -29,9 +29,12 @@ The example uses JSKIT's existing `ai` integration configuration and authorized
 connection resolver. To call the explicitly selected model in `integrations.json`:
 
 ```sh
-ASSISTANT_INTEGRATIONS=./integrations.json npm run server
+APP_AI_API_KEY=... ASSISTANT_INTEGRATIONS=./integrations.json npm run server
 ```
 
+The sample selects Z.AI's GLM-4.7-Flash, which needs a regular Z.AI API key in
+`APP_AI_API_KEY`. Choose your own provider, model and key; none is preselected.
+
 Edit that portable configuration through JSKIT's integration editor or its JSON
 contract. Shared keys use `env:NAME` references; the key stays in the server's
 normal environment. The example binds authorization to its one local user.

package/examples/conversation/integrations.json

@@ -7,10 +7,11 @@
       "accountMode": "shared",
       "scopes": [],
       "settings": {
-        "model": "opencode/big-pickle"
+        "model": "zai/glm-4.7-flash"
       },
       "authentication": {
-        "method": "none"
+        "method": "api-key",
+        "secretRef": "env:APP_AI_API_KEY"
       }
     },
     "suggestions": {
@@ -18,10 +19,11 @@
       "accountMode": "shared",
       "scopes": [],
       "settings": {
-        "model": "opencode/big-pickle"
+        "model": "zai/glm-4.7-flash"
       },
       "authentication": {
-        "method": "none"
+        "method": "api-key",
+        "secretRef": "env:APP_AI_API_KEY"
       }
     }
   }

package/examples/conversation/package.json

@@ -8,17 +8,17 @@
     "build": "vite build"
   },
   "dependencies": {
-    "@jskit-ai/assistant-core": "0.1.236",
+    "@jskit-ai/assistant-core": "0.1.238",
     "@jskit-ai/http-runtime": "0.1.242",
     "@jskit-ai/kernel": "0.1.244",
     "@mdi/js": "^7.4.47",
     "vue": "^3.5.13",
     "vuetify": "^4.0.0",
     "@jskit-ai/connectors-core": "0.1.61",
-    "@jskit-ai/connectors-catalog": "0.1.61"
+    "@jskit-ai/connectors-catalog": "0.1.62"
   },
   "devDependencies": {
     "@vitejs/plugin-vue": "^6.0.7",
-    "vite": "^8.2.1"
+    "vite": "^8.2.4"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/assistant-core",
-  "version": "0.1.236",
+  "version": "0.1.238",
   "type": "module",
   "scripts": {
     "test": "node --test --test-concurrency=1"

package/src/client/conversation/messageDelivery.js

@@ -59,7 +59,7 @@ function createAssistantMessageDelivery({ deliver: defaultDeliver } = {}) {
   }
 
   function turns(savedTurns = []) {
-    return [
+    const shown = [
       ...savedTurns.map(turn => {
         const message = state.messages.find(message => message.status !== "accepted" &&
           turnMatchesOptimisticMessage(turn, message) &&
@@ -67,9 +67,19 @@ function createAssistantMessageDelivery({ deliver: defaultDeliver } = {}) {
         if (!message) return turn;
         const pending = optimisticTurn(message);
         return { ...turn, optimistic: pending.optimistic, ...(pending.system ? { system: pending.system } : {}) };
-      }),
-      ...unmatchedOptimisticMessages(savedTurns, state.messages).map(optimisticTurn)
+      })
     ];
+    // Pending and uncertain messages follow the saved history. A failed message
+    // never reached the conversation, so it keeps its own time: newer saved turns
+    // and the working indicator stay below it instead of looking blocked by it.
+    for (const message of unmatchedOptimisticMessages(savedTurns, state.messages)) {
+      const turn = optimisticTurn(message);
+      const later = message.status !== "failed" ? -1 : shown.findIndex(saved => !saved.optimistic &&
+        Date.parse((saved.user || saved.system)?.at || "") > message.createdAtMs);
+      if (later < 0) shown.push(turn);
+      else shown.splice(later, 0, turn);
+    }
+    return shown;
   }
 
   function optimisticTurn(message) {

package/src/server/conversation/claudeTurn.js

@@ -593,21 +593,18 @@ export function createClaudeConversationOwner({
     deliveryTiming?.("process-ready");
     if (command && !command.steering) command.signal.throwIfAborted();
     const steering = command ? command.steering === true : Boolean(entry.turn?.active);
-    const sendNow = steering && native.client.supportsSendNow?.() === true;
     if (input.signal?.aborted) throw Object.assign(createError("The goal command was stopped before delivery."), { delivery: "not-sent" });
     if (steering) {
       if (command) {
         await command.beforeDispatch({ threadId: entry.id });
         command.signal.throwIfAborted();
       }
-      try {
-        await entry.nativeTurn.interruptGeneration(command ? entry.process.client : native.client,
-          { ...(command ? { timeoutMs: command.timeoutMs } : {}), sendNow });
-        if (command) command.interrupted = !sendNow;
-      } catch (error) {
+      // A mid-turn message is never an interrupt: Claude Code queues it and
+      // reads it after the running tool call. Only explicit Stop interrupts.
+      try { await entry.nativeTurn.prepareSteering(); }
+      catch (error) {
         if (!command) await entry.nativeTurn.stopProcess(error.message);
-        // Interruption precedes this input's pipe write. Preserve that definite
-        // non-delivery so a failed interrupt cannot strand an attempted receipt.
+        // This precedes the input's pipe write: a refused steer is definitely not sent.
         throw Object.assign(error, { delivery: "not-sent" });
       }
     }
@@ -688,7 +685,7 @@ export function createClaudeConversationOwner({
       else await input.onPromptSending?.({ threadId: entry.id, displayAttachments: input.displayAttachments, turnMetadata: actorMetadata });
       if (input.signal?.aborted) throw Object.assign(createError("The goal command was stopped before delivery."), { delivery: "not-sent" });
       await entry.nativeTurn.send(command ? entry.process.client : native.client, command ? preparation.message(entry, input) : prompt,
-        { messageId: uuid, accept, sendNow, ...(command ? { timeoutMs: command.timeoutMs } : {}) });
+        { messageId: uuid, accept, ...(command ? { timeoutMs: command.timeoutMs } : {}) });
     } catch (error) {
       if (!command) await entry.nativeTurn.stopProcess(error.message);
       throw error;
@@ -1026,11 +1023,11 @@ export function createClaudeConversationOwner({
     active.steer = async ({ input, beforeDispatch, accept, onNativeReceipt, onReceiptPersisted, deliveryTiming }) => {
       await ready.promise;
       const nativeDispatch = { active, signal, beforeDispatch, accept, onNativeReceipt, onReceiptPersisted, deliveryTiming,
-        timeoutMs, steering: true, interrupted: false, attempted: false, admitted: false };
+        timeoutMs, steering: true, attempted: false, admitted: false };
       try { await dispatch(control, { input, context, signal }, { acquire, entry, dispatch: nativeDispatch }); }
       catch (error) {
         if (nativeDispatch.attempted && !nativeDispatch.admitted && error.delivery !== "not-sent") error.delivery = "uncertain";
-        if (nativeDispatch.interrupted || nativeDispatch.attempted) completion.reject(error);
+        if (nativeDispatch.attempted) completion.reject(error);
         throw error;
       }
     };
@@ -1142,6 +1139,9 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
   const assistantRoles = new Map();
   const admissions = new Map();
   const inFlight = new Set();
+  // Inputs Claude has begun reading. A queued steer joins the running loop, so
+  // one result can finish several of them; queued-only input stays in flight.
+  const startedInputs = new Set();
   const tasks = new Set();
   let turnId = "";
   let messageId = "";
@@ -1153,7 +1153,6 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
   let generation = 0;
   let stopped = false;
   let cancelling = false;
-  let steering;
   let maximumOutput = 4 * 1024 * 1024;
   let inputOwner = null;
   let acceptedInput = null;
@@ -1418,11 +1417,13 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
       if (frame.type === "user" && !inFlight.has(uuid) && !admissions.has(uuid)) return;
       // Native notifications have their own lifecycle UUIDs, including work
       // folded into this input. They must not steal its receipt/result owner.
-      if ((frame.state === "started" || frame.type === "user") && inFlight.has(uuid)) currentCommandId = uuid;
-      if (frame.state === "completed") inFlight.delete(uuid);
-      if (frame.state === "cancelled" && steering) {
+      if ((frame.state === "started" || frame.type === "user") && inFlight.has(uuid)) {
+        currentCommandId = uuid;
+        startedInputs.add(uuid);
+      }
+      if (frame.state === "completed") {
         inFlight.delete(uuid);
-        steering.resolve();
+        startedInputs.delete(uuid);
       }
       if (frame.state === "queued" || frame.type === "user") {
         const pending = admissions.get(uuid);
@@ -1559,10 +1560,8 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
           } : {}) });
       }
       inFlight.delete(currentCommandId);
-      if (steering) {
-        steering.resolve();
-        return;
-      }
+      for (const uuid of startedInputs) inFlight.delete(uuid);
+      startedInputs.clear();
       if (cancelling) return;
       outcome = { status: interrupted ? "interrupted" : failed ? "failed" : "completed", error: message };
       // The reply is final, but native background tasks still own the turn
@@ -1601,6 +1600,7 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
     }
     admissions.clear();
     inFlight.clear();
+    startedInputs.clear();
     tasks.clear();
     // Verified process cleanup can precede Claude's terminal generation frame.
     // Retain already displayed text for the existing transcript reader, with
@@ -1616,7 +1616,6 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
     }
     pendingAssistantMessages.clear();
     assistantRoles.clear();
-    steering?.reject(failure(reason));
     if (active) outcome = { status: "interrupted", error: reason };
     active = false;
     phase = "";
@@ -1670,7 +1669,7 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
       acceptedInput = null;
       clearFinalAssistantResult();
     },
-    async send(client, message, { messageId: uuid, accept, timeoutMs = 30_000, sendNow = false } = {}) {
+    async send(client, message, { messageId: uuid, accept, timeoutMs = 30_000 } = {}) {
       if (!active || stopped || cancelling) throw Object.assign(
         failure("Claude has no active turn for this message.", !active && !stopped && !cancelling
           ? "conversation_steer_turn_finished" : "assistant_claude_turn_failed"),
@@ -1691,7 +1690,7 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
       )), timeoutMs);
       admissions.set(uuid, { ...admitted, accept, timer, receiptOwner });
       try {
-        await Promise.all([client.send(message, { messageId: uuid, sessionId: conversationId, ...(sendNow ? { sendNow: true } : {}) }), admitted.promise]);
+        await Promise.all([client.send(message, { messageId: uuid, sessionId: conversationId }), admitted.promise]);
       } catch (error) {
         if (inputOwner === receiptOwner) invalidateFinalAssistantResult();
         throw error;
@@ -1699,49 +1698,22 @@ export function createClaudeConversationTurn({ conversationId, onEvent = async (
         clearTimeout(timer);
       }
     },
-    async interruptGeneration(client, { timeoutMs = 30_000, sendNow = false } = {}) {
-      if (!active || steering || cancelling) {
-        const completed = !active && !steering && !stopped && !cancelling && outcome?.status === "completed";
+    async prepareSteering() {
+      if (!active || cancelling) {
+        const completed = !active && !stopped && !cancelling && outcome?.status === "completed";
         throw Object.assign(failure("This Claude turn cannot accept steering now.", completed
           ? "conversation_steer_turn_finished" : "assistant_claude_turn_failed"),
         { delivery: "not-sent", ...(completed ? { statusCode: 409 } : {}) });
       }
-      // Targeted Send now admits the new input before asking the native loop to
-      // make way; unlike plain Stop it preserves background agents. A completed
-      // main loop also has no further interruption result to wait for.
-      if (sendNow || outcome && inFlight.size === 0) {
-        // The next input owns completion now. A task finishing during host
-        // preparation must not settle this turn using the previous result.
-        outcome = null;
-        acceptedInput = null;
-        clearFinalAssistantResult();
-        await publish({ type: "diagnostic", stage: sendNow ? "steering_send_now" : "steering_background_only", backgroundTasks: tasks.size });
-        return;
-      }
-      // Streaming user input otherwise queues behind the entire running turn.
-      // Claude's supported steering path interrupts generation, then continues
-      // the same native history with the new instruction.
+      // Claude Code acknowledges streamed input as queued and folds it into the
+      // running turn after the current tool call, or starts it once the main
+      // loop is idle. Interrupting instead would kill a running foreground tool.
+      // The next input owns completion now: a result or task finishing before
+      // it starts must not settle this turn with the previous answer.
+      outcome = null;
       acceptedInput = null;
       clearFinalAssistantResult();
-      steering = Promise.withResolvers();
-      let timer;
-      try {
-        await publish({ type: "diagnostic", stage: "steering_requested", pendingCommands: inFlight.size, backgroundTasks: tasks.size });
-        await Promise.all([client.interrupt(), Promise.race([
-          steering.promise,
-          new Promise((_, reject) => {
-            timer = setTimeout(() => reject(Object.assign(failure(
-              "Claude did not confirm the interrupted generation. This instruction was not sent; retry after reconnecting.",
-              "assistant_claude_interrupt_timeout"
-            ), { statusCode: 503 })), timeoutMs);
-          })
-        ])]);
-        await publish({ type: "diagnostic", stage: "steering_confirmed", pendingCommands: inFlight.size, backgroundTasks: tasks.size });
-      } catch (error) {
-        await publish({ type: "diagnostic", stage: "steering_failed", pendingCommands: inFlight.size, backgroundTasks: tasks.size });
-        throw error;
-      }
-      finally { clearTimeout(timer); steering = null; }
+      await publish({ type: "diagnostic", stage: "steering_queued", pendingCommands: inFlight.size, backgroundTasks: tasks.size });
     },
     async cancel(client, stopProcess) {
       try {

package/src/server/conversation/codexProcess.js

@@ -572,18 +572,23 @@ export function createCodexAppServerRuntime({ execution, credentials, configurat
     return acquireCodexRuntimeLock(runtimeDir, { ...options, busyCode: `${errorPrefix}codex_app_server_runtime_busy` });
   }
 
-  const CODEX_APP_SERVER_MANAGED_UMASK = umask;
+  // An empty or null umask inherits the host's own; hosts that share files set one.
+  const startupUmask = normalizeText(umask);
+  if (startupUmask && !/^[0-7]{3,4}$/u.test(startupUmask)) {
+    throw new TypeError(`Codex app-server umask must be octal, not ${JSON.stringify(startupUmask)}.`);
+  }
+  const CODEX_APP_SERVER_UMASK_LINES = startupUmask ? [`umask ${startupUmask}`] : [];
 
   const CODEX_APP_SERVER_MANAGED_SHELL = "/bin/sh";
 
   const CODEX_APP_SERVER_MANAGED_STARTUP_SCRIPT = [
-    `umask ${CODEX_APP_SERVER_MANAGED_UMASK}`,
+    ...CODEX_APP_SERVER_UMASK_LINES,
     `unset ${[...CODEX_APP_SERVER_DESKTOP_BUS_ENV_NAMES].join(" ")}`,
     'exec "$@"'
   ].join("\n");
 
   const CODEX_APP_SERVER_HELPER_STARTUP_SCRIPT = [
-    `umask ${CODEX_APP_SERVER_MANAGED_UMASK}`,
+    ...CODEX_APP_SERVER_UMASK_LINES,
     "exec /usr/bin/env -i \\",
     '  HOME="$HOME" LOGNAME="$LOGNAME" USER="$USER" PATH="$PATH" \\',
     '  CODEX_HOME="$CODEX_HOME" LANG="$LANG" LC_ALL="$LC_ALL" LC_CTYPE="$LC_CTYPE" \\',

package/src/server/conversation/localExecution.js

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { closeSync, openSync } from "node:fs";
 import { mkdtemp, open, readFile, readdir, rm } from "node:fs/promises";
@@ -6,6 +6,18 @@ import { isPlainObject, normalizeText } from "./normalize.js";
 import { isAbsolute, join } from "node:path";
 import { tmpdir } from "node:os";
 import { setTimeout as delay } from "node:timers/promises";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+// Fixed locale and zone make `lstart` parseable and stable across restarts.
+async function runPs(args) {
+  const { stdout } = await execFileAsync("ps", args, {
+    env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
+    maxBuffer: 64 * 1024 * 1024
+  });
+  return stdout;
+}
 
 /** Owned POSIX process groups for a trusted, single-user application.
  * Managed hosts replace this facility to enforce resource and identity policy.
@@ -170,12 +182,16 @@ export function createConversationProcessIdentity({
   runtimeTokenEnvironmentName = "JSKIT_EXECUTION_RUNTIME_TOKEN",
   commandHashEnvironmentName = "JSKIT_EXECUTION_COMMAND_HASH",
   label = "Native",
-  unavailableCode = "native_process_identity_unavailable"
+  unavailableCode = "native_process_identity_unavailable",
+  platform = process.platform,
+  ps = runPs
 } = {}) {
   const PROCESS_IDENTITY_SETTLE_TIMEOUT_MS = 1000;
-  const PROCESS_IDENTITY_SETTLE_POLL_MS = 25;
+  // Darwin inspection spawns ps instead of reading /proc, so it polls less often.
+  const PROCESS_IDENTITY_SETTLE_POLL_MS = platform === "darwin" ? 100 : 25;
   const PROCESS_IDENTITY_VERSION = 1;
-  const PROCESS_IDENTITY_PLATFORM = "linux-proc";
+  const PROCESS_IDENTITY_PLATFORMS = Object.freeze({ linux: "linux-proc", darwin: "darwin" });
+  const hostIdentityPlatform = PROCESS_IDENTITY_PLATFORMS[platform] || "";
   const PROCESS_STATE = Object.freeze({ RUNNING: "running", STOPPED: "stopped" });
   const PROCESS_IDENTITY_STATUS = Object.freeze({
     ABSENT: "absent", AMBIGUOUS: "ambiguous", EXACT: "exact", INVALID: "invalid", MISMATCH: "mismatch"
@@ -281,21 +297,17 @@ export function createConversationProcessIdentity({
     const identity = normalizeProcessIdentity(value);
     return Boolean(
       identity.version === PROCESS_IDENTITY_VERSION &&
-      identity.platform === PROCESS_IDENTITY_PLATFORM &&
+      Object.values(PROCESS_IDENTITY_PLATFORMS).includes(identity.platform) &&
       /^[a-f0-9]{12}$/u.test(identity.commandHash) &&
       /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(identity.runtimeToken) &&
       /^\d+$/u.test(identity.startTimeTicks)
     );
   }
 
-  function linuxProcessEnvironmentValue(buffer = Buffer.alloc(0), name = "") {
-    const prefix = `${name}=`;
-    for (const entry of buffer.toString("utf8").split("\0")) {
-      if (entry.startsWith(prefix)) {
-        return entry.slice(prefix.length);
-      }
-    }
-    return "";
+  /** The value of `name` in a list of NAME=value environment entries. */
+  function environmentValue(entries = [], name = "") {
+    const entry = entries.find((assignment) => assignment.startsWith(`${name}=`));
+    return entry ? entry.slice(name.length + 1) : "";
   }
 
   async function linuxProcessRecords() {
@@ -323,11 +335,80 @@ export function createConversationProcessIdentity({
         }
         environmentReadable = false;
       }
+      const entries = environmentReadable ? environment.toString("utf8").split("\0") : [];
       records.push({
         ...processStat,
-        environment,
+        commandHash: environmentValue(entries, commandHashEnvironmentName),
         environmentReadable,
-        pid
+        pid,
+        runtimeToken: environmentValue(entries, runtimeTokenEnvironmentName)
+      });
+    }
+    return records;
+  }
+
+  const DARWIN_MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+
+  /** `ps -o lstart=` in the C locale and UTC, as whole epoch seconds. */
+  function darwinStartTime(value = "") {
+    const match = /^\w{3}\s+(\w{3})\s+(\d{1,2})\s+(\d{2}):(\d{2}):(\d{2})\s+(\d{4})$/u.exec(String(value).trim());
+    const month = match ? DARWIN_MONTHS.indexOf(match[1]) : -1;
+    if (month < 0) {
+      return "";
+    }
+    const [, , day, hours, minutes, seconds, year] = match.map(Number);
+    return String(Date.UTC(year, month, day, hours, minutes, seconds) / 1000);
+  }
+
+  function darwinCommandsByPid(output = "") {
+    const commands = new Map();
+    for (const line of String(output).split("\n")) {
+      const match = /^\s*(\d+) (.*)$/u.exec(line);
+      if (match) {
+        commands.set(Number(match[1]), match[2]);
+      }
+    }
+    return commands;
+  }
+
+  /** The `ps -E` text after the argument list, as its assignments, or null when no environment is shown. */
+  function darwinEnvironment(command, commandWithEnvironment) {
+    if (command === undefined || !commandWithEnvironment?.startsWith(command)) {
+      return null;
+    }
+    const assignments = commandWithEnvironment.slice(command.length).split(/\s+/u).filter((entry) => /^[^=\s]+=/u.test(entry));
+    return assignments.length ? assignments : null;
+  }
+
+  /** The darwin counterpart of the /proc scan. Only the current user's environments are readable;
+   * a listing without a separate environment section stays unreadable so inspection degrades to ambiguous. */
+  async function darwinProcessRecords() {
+    const currentUid = process.getuid();
+    const ownProcesses = ["-x", "-U", String(currentUid), "-ww", "-o", "pid=,command="];
+    const [table, commandOutput, environmentOutput] = await Promise.all([
+      ps(["-ax", "-o", "pid=,pgid=,uid=,stat=,lstart="]),
+      ps(ownProcesses),
+      ps(["-E", ...ownProcesses])
+    ]);
+    const commands = darwinCommandsByPid(commandOutput);
+    const commandsWithEnvironment = darwinCommandsByPid(environmentOutput);
+    const records = [];
+    for (const line of String(table).split("\n")) {
+      const match = /^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+[\d:]{8}\s+\d{4})\s*$/u.exec(line);
+      if (!match || match[4].startsWith("Z")) {
+        continue;
+      }
+      const pid = Number(match[1]);
+      const environment = Number(match[3]) === currentUid
+        ? darwinEnvironment(commands.get(pid), commandsWithEnvironment.get(pid))
+        : null;
+      records.push({
+        commandHash: environmentValue(environment || [], commandHashEnvironmentName),
+        environmentReadable: Boolean(environment),
+        pid,
+        processGroupId: Number(match[2]),
+        runtimeToken: environmentValue(environment || [], runtimeTokenEnvironmentName),
+        startTimeTicks: darwinStartTime(match[5])
       });
     }
     return records;
@@ -347,7 +428,7 @@ export function createConversationProcessIdentity({
     };
   }
 
-  async function inspectLinuxProcessIdentity(metadata = {}) {
+  async function inspectHostProcessIdentity(metadata = {}) {
     if (!processMetadataIsIdentifiable(metadata)) {
       return {
         processGroupIds: [],
@@ -360,14 +441,18 @@ export function createConversationProcessIdentity({
         status: PROCESS_IDENTITY_STATUS.ABSENT
       };
     }
-    if (process.platform !== "linux") {
+    const identity = metadata.processIdentity;
+    const records = identity.platform !== hostIdentityPlatform
+      ? null
+      : platform === "darwin"
+        ? await darwinProcessRecords().catch(() => null)
+        : await linuxProcessRecords();
+    if (!records) {
       return {
         processGroupIds: [],
         status: PROCESS_IDENTITY_STATUS.AMBIGUOUS
       };
     }
-    const identity = metadata.processIdentity;
-    const records = await linuxProcessRecords();
     const rootProcessGroupId = Number(metadata.pid);
     const rootGroupMembers = records.filter(({ processGroupId }) => processGroupId === rootProcessGroupId);
     const exactRecords = [];
@@ -376,15 +461,7 @@ export function createConversationProcessIdentity({
       if (!record.environmentReadable) {
         continue;
       }
-      const runtimeToken = linuxProcessEnvironmentValue(
-        record.environment,
-        runtimeTokenEnvironmentName
-      );
-      const commandHash = linuxProcessEnvironmentValue(
-        record.environment,
-        commandHashEnvironmentName
-      );
-      if (runtimeToken === identity.runtimeToken && commandHash === identity.commandHash) {
+      if (record.runtimeToken === identity.runtimeToken && record.commandHash === identity.commandHash) {
         exactRecords.push(record);
       }
     }
@@ -438,7 +515,7 @@ export function createConversationProcessIdentity({
   async function inspectProcessIdentity(metadata = {}, options = {}) {
     const inspector = typeof options.processIdentityInspector === "function"
       ? options.processIdentityInspector
-      : inspectLinuxProcessIdentity;
+      : inspectHostProcessIdentity;
     return normalizeProcessIdentityInspection(await inspector(metadata));
   }
 
@@ -610,6 +687,15 @@ export function createConversationProcessIdentity({
     };
   }
 
+  async function captureProcessStart(pid) {
+    if (platform !== "darwin") {
+      return linuxProcessStat(await readFile(`/proc/${pid}/stat`, "utf8").catch(() => ""));
+    }
+    const output = String(await ps(["-o", "pgid=,lstart=", "-p", String(pid)]).catch(() => ""));
+    const match = /^\s*(\d+)\s+(.+?)\s*$/u.exec(output);
+    return match ? { processGroupId: Number(match[1]), startTimeTicks: darwinStartTime(match[2]) } : null;
+  }
+
   async function captureProcessIdentity({
     commandHash = "",
     pid = null,
@@ -627,26 +713,17 @@ export function createConversationProcessIdentity({
       return reported;
     }
     const normalizedPid = Number(pid);
-    if (
-      process.platform !== "linux" ||
-      !Number.isSafeInteger(normalizedPid) ||
-      normalizedPid <= 0
-    ) {
-      const error = new Error(`${label} process identity could not be captured.`);
-      error.code = unavailableCode;
-      throw error;
-    }
-    const processStat = linuxProcessStat(
-      await readFile(`/proc/${normalizedPid}/stat`, "utf8").catch(() => "")
-    );
-    if (!processStat || processStat.processGroupId !== normalizedPid) {
+    const processStat = hostIdentityPlatform && Number.isSafeInteger(normalizedPid) && normalizedPid > 0
+      ? await captureProcessStart(normalizedPid)
+      : null;
+    if (!processStat?.startTimeTicks || processStat.processGroupId !== normalizedPid) {
       const error = new Error(`${label} process identity could not be captured.`);
       error.code = unavailableCode;
       throw error;
     }
     return {
       commandHash: expectedCommandHash,
-      platform: PROCESS_IDENTITY_PLATFORM,
+      platform: hostIdentityPlatform,
       runtimeToken: expectedRuntimeToken,
       startTimeTicks: processStat.startTimeTicks,
       version: PROCESS_IDENTITY_VERSION

package/src/server/conversation/openCodePlugin.js

@@ -1,5 +1,6 @@
 import { createOpenCodeConversationAdapter } from "./providers/opencode.js";
 import { wrapNativeCommand } from "./commandWrapper.js";
+import { OPENCODE_REFUSED_TOOL_ERROR } from "./openCodeTurn.js";
 import { readOpenCodeEnvironments, openCodeEnvironmentForSession, openCodeEnvironmentForDirectory,
   assertOpenCodeModelProvider, limitOpenCodeModelOutput } from "./openCodeRuntime.js";
 
@@ -44,7 +45,7 @@ export default async function conversationInstructions({ client, registryPath =
         ? conversation?.tools?.schemas.some(({ function: definition }) => definition.name === tool)
         : conversation?.nativeTools;
       if (!allowed) {
-        throw new Error("This conversation has no authorization for that native tool.");
+        throw new Error(OPENCODE_REFUSED_TOOL_ERROR);
       }
       if (tool === "bash" && conversation.commandWrapper) {
         output.args.command = wrapNativeCommand(conversation.commandWrapper, output.args.command);
@@ -70,7 +71,7 @@ export default async function conversationInstructions({ client, registryPath =
         }
         const connection = (await readBinding(context.sessionID)).conversation?.tools;
         if (!connection?.schemas.some(({ function: definition }) => definition.name === name)) {
-          throw new Error("This conversation has no authorization for that native tool.");
+          throw new Error(OPENCODE_REFUSED_TOOL_ERROR);
         }
         const response = await fetch(connection.url, { method: "POST", signal: context.abort,
           headers: { authorization: `Bearer ${connection.token}`, "content-type": "application/json" },

package/src/server/conversation/openCodeProcess.js

@@ -118,7 +118,7 @@ async function waitForOpenCodeReady({
   throw error;
 }
 
-const actionPermission = Object.fromEntries(DISCOVERY_TOOL_DESCRIPTORS.map(tool => [tool.name, "allow"]));
+const actionPermission = action => Object.fromEntries(DISCOVERY_TOOL_DESCRIPTORS.map(tool => [tool.name, action]));
 const nativePermission = { bash: "allow", read: "allow", write: "allow", edit: "allow",
   glob: "allow", grep: "allow", list: "allow", patch: "allow", apply_patch: "allow", todoread: "allow", todowrite: "allow" };
 export const openCodeApplicationToolSchemas = DISCOVERY_TOOL_DESCRIPTORS.map(({ name, description, parameters }) => ({
@@ -136,12 +136,20 @@ export function openCodeConversationAgents({ sessionEnvironmentRegistry = "" } =
       hidden: true, mode: "primary",
       // Keep native definitions behind approval, as in the original host agents.
       // The registered plugin rejects every ungranted native call before execution.
-      permission: nativeTools || tools || guarded ? { "*": !nativeTools && guarded ? "ask" : "deny",
-        ...(nativeTools ? nativePermission : {}), ...(tools ? actionPermission : {}) } : "deny"
+      permission: nativeTools || tools || guarded ? agentPermission(!nativeTools && guarded, nativeTools, tools) : "deny"
     }
   ])));
 }
 
+// OpenCode applies an agent's last matching rule, so its "*": "ask" overrides the
+// global policy. Restate two denials after it: application tools the agent does not
+// own are not offered to the model, and the repeated-call check does not wait for
+// an approval that no unattended conversation can give.
+function agentPermission(ask, nativeTools, tools) {
+  return { "*": ask ? "ask" : "deny", ...(nativeTools ? nativePermission : {}),
+    ...(tools ? actionPermission("allow") : ask ? actionPermission("deny") : {}), ...(ask ? { doom_loop: "deny" } : {}) };
+}
+
 /** Shared conversation configuration around the extracted server lifecycle. */
 export async function createOpenCodeConversationServer({
   command = "opencode", execution = createLocalConversationExecution(), env = process.env,