@kingcrab/pi-imessage 1.1.0 → 1.2.0

package/dist/extensions/final-text.js

@@ -1,3 +1,15 @@
+/** Text written next to tool calls in one assistant message: the model's interim update. */
+export function interimText(message) {
+    if (message?.role !== "assistant" || message.stopReason !== "toolUse")
+        return;
+    if (!message.content.some((part) => part.type === "toolCall"))
+        return;
+    const text = message.content
+        .map((part) => (part.type === "text" ? part.text : ""))
+        .join("\n")
+        .trim();
+    return text || undefined;
+}
 /** The same final-only projection is used for transport and the model's delivery facts. */
 export function finalReplyText(message) {
     if (message?.role !== "assistant" || !["stop", "length"].includes(message.stopReason))

package/dist/extensions/schedules.js

@@ -8,7 +8,7 @@ export const ScheduledOutbox = defineDoc({
     checkpointWhen: () => false,
 });
 export function validateSchedules(extensions) {
-    const ids = new Set(["compact-chats"]);
+    const ids = new Set();
     const requestIds = new Set();
     for (const extension of extensions) {
         for (const schedule of extension.schedules ?? []) {

package/dist/extensions/subagent.js

@@ -6,28 +6,19 @@ export const Subagent = defineExtension({
     tools: [
         defineTool({
             name: "subagent",
-            description: "Run a foreground read-only subagent with a separate context. Returns its result here.",
+            description: "Run a foreground subagent with a separate context and the same tools as you. Returns its result here.",
             parameters: Type.Object({ task: Type.String() }),
             replay: "safe",
             async execute(args, api, context) {
-                const parent = await api.agent(context);
                 const childId = await api.commit(async (tx) => {
                     const existing = (await tx.scanConversations({ ownerTaskId: api.taskId }, 1)).items[0];
                     if (existing)
                         return existing.id;
                     const child = await tx.createConversation({ ownership: { kind: "task", taskId: api.taskId } });
-                    const permitted = [
-                        "read",
-                        "search_memory",
-                        "load_memory",
-                        "web_search",
-                        "fetch_content",
-                        "get_search_results",
-                    ];
+                    // The child has every tool its parent has, deferred ones included; only nesting another subagent is left out.
                     await configure(tx, child.id, {
                         extensions: { remove: [Subagent] },
-                        tools: parent.tools.filter((tool) => permitted.includes(tool.name)),
-                        instructions: "Complete only the delegated task. You are read-only. Do not send messages or launch background work.",
+                        instructions: "Complete only the delegated task and return its result; do not take on other work.",
                     });
                     return child.id;
                 }, context);

package/dist/extensions/workspace.js

@@ -2,7 +2,8 @@ import { readdir, readFile, realpath } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { join, sep } from "node:path";
 import { Type } from "@earendil-works/pi-ai";
-import { configure, defineDoc, defineExtension, defineTask, defineTool, section, } from "@earendil-works/pi-durable";
+import * as durable from "@earendil-works/pi-durable";
+import { configure, defineDoc, defineExtension, defineTask, defineTool, GenerationTask, hook, section, } from "@earendil-works/pi-durable";
 import { ScheduledOutbox, validateSchedules, } from "./schedules.js";
 const loadModule = createRequire(import.meta.url);
 /** A chat assistant can apply its own workspace changes through the existing host owner. */
@@ -22,7 +23,7 @@ export function workspaceExtension(reload) {
         ],
     });
 }
-/** Scan only direct workspace extension directories; never skills or attachments (ADR 0035). */
+/** Scan only direct workspace extension directories; never skills or attachments. */
 export async function loadWorkspaceExtensions(workingDir) {
     const extensions = [];
     const root = join(workingDir, "extensions");
@@ -69,6 +70,9 @@ export async function loadWorkspaceExtensions(workingDir) {
             configure,
             ScheduledOutbox,
             section,
+            hook,
+            GenerationTask,
+            durable,
         });
         if (!extension ||
             typeof extension !== "object" ||

package/dist/main.js

@@ -1,10 +1,10 @@
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { SettingsManager } from "@earendil-works/pi-coding-agent";
 import { createRegistry } from "@earendil-works/pi-durable";
+import { createToolSearchExtension } from "@earendil-works/pi-durable/tool-search";
 import { CodingTools } from "@earendil-works/pi-durable/tools";
 import { Chats, chatConversation, submitMessage, WatchCursor, } from "./agent/chats.js";
 import { compactionReply, isCommand, runCommand } from "./agent/commands.js";
-import { compactChats } from "./agent/compaction.js";
 import { deliverReplies, recoverSending } from "./agent/deliver.js";
 import { deliverDirect } from "./agent/direct-send.js";
 import { openHarness } from "./agent/harness.js";
@@ -16,10 +16,10 @@ import { Runs, runRecord } from "./agent/run.js";
 import { deliverScheduled, EXECUTION_KIND, Schedules, schedulingExtension } from "./agent/scheduling.js";
 import { isReplyEnabled, readSettings } from "./config/settings.js";
 import { createBrowser } from "./extensions/browser.js";
+import { createCodemode } from "./extensions/codemode.js";
 import { memoryExtension } from "./extensions/memory.js";
 import { messageExtension } from "./extensions/message.js";
 import { ImageRead } from "./extensions/read-image.js";
-import { launchInTerminal, restartExtension } from "./extensions/restart.js";
 import { validateSchedules } from "./extensions/schedules.js";
 import { Subagent } from "./extensions/subagent.js";
 import { webExtension } from "./extensions/web.js";
@@ -28,6 +28,29 @@ import { archiveAttachments } from "./transport/attachments.js";
 import { openHttpTransport } from "./transport/http.js";
 import { createWatcher } from "./transport/watch.js";
 import { startWeb } from "./web/server.js";
+/** Tools offered upfront; every other built-in or workspace tool waits for tool_search. */
+const OFFERED_TOOLS = new Set([
+    "read",
+    "bash",
+    "edit",
+    "write",
+    "send_message",
+    "search_memory",
+    "load_memory",
+    "save_memory",
+    "web_search",
+    "fetch_content",
+    "tool_search",
+    "codemode",
+]);
+function deferRare(extension) {
+    if (!extension.tools)
+        return extension;
+    return {
+        ...extension,
+        tools: extension.tools.map((tool) => OFFERED_TOOLS.has(tool.name) ? tool : { ...tool, deferred: true }),
+    };
+}
 /** Explicit startup; pass an isolated runtime in tests instead of opening installed auth. */
 export async function startService(options, 
 /** The application owns process HTTP resources; standalone callers retain their transport. */
@@ -45,6 +68,11 @@ reloadHttpTransport) {
     }
     const defaults = { ...runtime.defaults, model: { ...runtime.defaults.model } };
     const browser = await createBrowser(options.workingDir, options.agentDir);
+    const codemode = createCodemode();
+    const closeResources = async () => {
+        await codemode.close();
+        await browser.close();
+    };
     if (!runtime.models.getModel(defaults.model.provider, defaults.model.modelId))
         throw new Error(`Model is unavailable: ${defaults.model.provider}/${defaults.model.modelId}`);
     async function loadExtensions() {
@@ -71,21 +99,16 @@ reloadHttpTransport) {
                 : [
                     CodingTools,
                     ImageRead,
+                    // Durable's own tool_search loads the deferred tools.
+                    createToolSearchExtension(),
                     await memoryExtension(options.workingDir),
                     webExtension(),
                     browser.extension,
+                    codemode.extension,
                     Subagent,
                     workspaceExtension(reload),
-                    // ADR 0052: the service runs from a release directory; the controller starts after the call settles.
-                    restartExtension({
-                        workingDir: options.workingDir,
-                        currentRelease: process.cwd(),
-                        deployRoot: "/tmp",
-                        settled: (taskId) => harness.waitForTask(taskId, BACKGROUND_CONTEXT),
-                        launch: launchInTerminal,
-                    }),
-                ]),
-            ...(await loadWorkspaceExtensions(options.workingDir)),
+                ].map(deferRare)),
+            ...(await loadWorkspaceExtensions(options.workingDir)).map(deferRare),
         ];
         validateSchedules(extensions);
         const names = new Set();
@@ -94,7 +117,7 @@ reloadHttpTransport) {
                 throw new Error(`Duplicate extension name: ${extension.name}`);
             names.add(extension.name);
         }
-        // ADR 0039: an interrupted tool reruns on recovery unless it declares `unsafe`.
+        // An interrupted tool reruns on recovery unless it declares `unsafe`.
         return extensions.map((extension) => extension.tools
             ? { ...extension, tools: extension.tools.map((tool) => ({ ...tool, replay: tool.replay ?? "safe" })) }
             : extension);
@@ -127,7 +150,6 @@ reloadHttpTransport) {
             const jobId = input && typeof input === "object" && !Array.isArray(input) ? input.jobId : undefined;
             const saved = savedSchedules?.items.find((schedule) => schedule.id === jobId);
             if (saved &&
-                saved.id !== "compact-chats" &&
                 !activeExtensions.some((extension) => extension.schedules?.some((schedule) => schedule.id === saved.id)))
                 throw new Error(`Missing extension for unfinished schedule: ${saved.id}`);
         }
@@ -139,7 +161,7 @@ reloadHttpTransport) {
         });
     }
     catch (error) {
-        await owner.close(browser.close);
+        await owner.close(closeResources);
         throw error;
     }
     let reloading = Promise.resolve();
@@ -360,24 +382,6 @@ reloadHttpTransport) {
                 return receipt;
             });
         },
-        /** Admit quiet native compactions; observing their results must not hold shutdown open. */
-        compact() {
-            return track(async () => {
-                const tasks = await compactChats(harness);
-                for (const task of tasks)
-                    void harness
-                        .waitForTask(task, BACKGROUND_CONTEXT)
-                        .then((settled) => {
-                        if (settled.state.outcome.status !== "completed")
-                            console.warn("Scheduled compaction ended", task, settled.state.outcome);
-                    })
-                        .catch((error) => {
-                        if (!closed)
-                            console.warn("Scheduled compaction observation failed", task, error);
-                    });
-                return tasks;
-            });
-        },
         // Explicit host boundary; no model loop, timer or transport runs on import.
         deliver() {
             return track(async () => {
@@ -394,7 +398,7 @@ reloadHttpTransport) {
             closing ??= (async () => {
                 await Promise.allSettled([...operations]);
                 await progress.close();
-                await owner.close(browser.close);
+                await owner.close(closeResources);
             })();
             return closing;
         },

package/dist/transport/watch.js

@@ -62,7 +62,13 @@ export function createWatcher(options) {
                 const attachments = db
                     .prepare(`SELECT a.filename FROM attachment a
 					JOIN message_attachment_join j ON j.attachment_id=a.ROWID WHERE j.message_id=?`)
-                    .all(row.rowid).flatMap(({ filename }) => (filename ? [filename.replace(/^~(?=\/)/, homedir())] : []));
+                    .all(row.rowid).flatMap(({ filename }) => 
+                // Link-preview and iMessage app payload plists carry nothing a model can read; the text already
+                // holds the URL. Messages may record one in a transient transcoder directory and delete the
+                // file, so archiving it would hold this row forever.
+                filename && !filename.endsWith(".pluginPayloadAttachment")
+                    ? [filename.replace(/^~(?=\/)/, homedir())]
+                    : []);
                 const reply = row.replyGuid
                     ? db.prepare("SELECT text,attributedBody FROM message WHERE guid=?").get(row.replyGuid)
                     : undefined;

package/dist/web/app.js

@@ -427,15 +427,18 @@ function renderSettings() {
 
 function renderChatSettings() {
 	const chats = data.chats || [];
-	const overrides = chats.filter((chat) => chat.verbose.chat !== undefined).length;
+	const overrides = chats.filter(
+		(chat) => chat.verbose.chat !== undefined || chat.interim.chat !== undefined,
+	).length;
 	view.replaceChildren(
 		element(
 			"p",
 			[
 				`${chats.length} chats`,
 				`default verbose ${data.defaults?.progressMessages ? "on" : "off"}`,
+				`default interim ${data.defaults?.interimMessages ? "on" : "off"}`,
 				`${overrides} ${overrides === 1 ? "override" : "overrides"}`,
-				"read-only: /verbose and /thinking change a chat, settings.json the default",
+				"read-only: /verbose, /interim and /thinking change a chat, settings.json the default",
 			].join(" · "),
 			"muted",
 		),
@@ -455,7 +458,7 @@ function renderChatSettings() {
 		card.append(header);
 		const table = element("table", undefined, "chat-table");
 		const heading = table.createTHead().insertRow();
-		for (const label of ["Chat", "Replies", "Verbose", "Model", "Thinking", "Last activity"])
+		for (const label of ["Chat", "Replies", "Verbose", "Interim", "Model", "Thinking", "Last activity"])
 			heading.append(element("th", label));
 		const body = table.createTBody();
 		for (const chat of rows) {
@@ -476,6 +479,10 @@ function renderChatSettings() {
 					chat.verbose.effective ? "on" : "off",
 					chat.verbose.chat === undefined ? "default" : "this chat",
 				),
+				stacked(
+					chat.interim.effective ? "on" : "off",
+					chat.interim.chat === undefined ? "default" : "this chat",
+				),
 				stacked(modelId.join("/") || "-", chat.model ? provider : undefined),
 				stacked(chat.thinking || "-"),
 				stacked(activity || "-"),

package/dist/web/server.js

@@ -6,7 +6,7 @@ import { promisify } from "node:util";
 import { gzip } from "node:zlib";
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { LiveDoc, } from "@earendil-works/pi-durable";
-import { Chats, progressEnabled } from "../agent/chats.js";
+import { Chats, interimEnabled, progressEnabled } from "../agent/chats.js";
 import { DirectSends } from "../agent/direct-send.js";
 import { Sessions } from "../agent/health.js";
 import { Deliveries } from "../agent/replies.js";
@@ -113,7 +113,7 @@ export async function startWeb(options) {
             settings: { chatAllowlist: configuration.chatAllowlist },
         };
     }
-    /** One row per chat: reply eligibility, the /verbose choice and the conversation's agent settings. */
+    /** One row per chat: reply eligibility, the /verbose and /interim choices and the conversation's agent settings. */
     async function chatSettings() {
         const [chats, configuration] = await Promise.all([
             options.agent.harness.snapshot(Chats, BACKGROUND_CONTEXT),
@@ -132,6 +132,7 @@ export async function startWeb(options) {
                 updatedAt: entries ? historyActivity(entries) : undefined,
                 replies: isReplyEnabled(configuration, chat.chatGuid),
                 verbose: { chat: chat.progress, effective: progressEnabled(configuration, records, chat.chatGuid) },
+                interim: { chat: chat.interim, effective: interimEnabled(configuration, records, chat.chatGuid) },
                 model: agent?.model ? `${agent.model.provider}/${agent.model.modelId}` : undefined,
                 thinking: agent?.thinkingLevel,
             };
@@ -139,7 +140,10 @@ export async function startWeb(options) {
         rows.sort((a, b) => (b.updatedAt ?? 0) - (a.updatedAt ?? 0) || Number(b.conversationId) - Number(a.conversationId));
         return {
             chats: rows,
-            defaults: { progressMessages: configuration.progressMessages },
+            defaults: {
+                progressMessages: configuration.progressMessages,
+                interimMessages: configuration.interimMessages,
+            },
             revision: viewRevision(),
         };
     }

package/docs/adr/{0004-native-extensions.md → 0003-native-extensions.md}

@@ -1,4 +1,4 @@
-# 0004. Native Durable extensions, not an SDK adapter
+# 0003. Native Durable extensions, not an SDK adapter
 
 Status: accepted (2026-10-04; owner accepted 2026-10-05)
 

package/docs/adr/{0006-jsonl-storage.md → 0004-jsonl-storage.md}

@@ -1,4 +1,4 @@
-# 0006. One JSONL storage, backed up by hand
+# 0004. One JSONL storage, backed up by hand
 
 Status: accepted (2026-10-04; owner accepted 2026-10-05)
 

package/docs/adr/{0007-images-by-path.md → 0005-images-by-path.md}

@@ -1,4 +1,4 @@
-# 0007. Store images as file paths
+# 0005. Store images as file paths
 
 Status: accepted (2026-10-04; owner accepted 2026-10-05)
 

package/docs/adr/{0010-test-budget.md → 0006-test-budget.md}

@@ -1,4 +1,4 @@
-# 0010. About 40 tests, only for our code
+# 0006. About 40 tests, only for our code
 
 Status: accepted (2026-10-04; owner accepted 2026-10-05)
 

package/docs/adr/{0011-reconcile-unsent-answers.md → 0007-reconcile-unsent-answers.md}

@@ -1,8 +1,8 @@
-# 0011. Reconcile unsent answers after intervening input
+# 0007. Reconcile unsent answers after intervening input
 
 Status: accepted (2026-10-04; owner chose reconciliation and explicitly included different senders)
 
-**Context.** Native steer places all selected messages after a tool round when configured with `steeringMode: "all"`. At a final-answer boundary, however, Durable first records the answer and settles that run's inputs; selected new messages start another run. The earlier answer remains eligible for delivery even when a newer message corrects its assumptions. An `onYield` continuation does not change this: it is ignored when the boundary selects user input. See [the state ownership decision](0001-durable-owns-state.md) and [at-most-once replies](0003-replies-at-most-once.md).
+**Context.** Native steer places all selected messages after a tool round when configured with `steeringMode: "all"`. At a final-answer boundary, however, Durable first records the answer and settles that run's inputs; selected new messages start another run. The earlier answer remains eligible for delivery even when a newer message corrects its assumptions. An `onYield` continuation does not change this: it is ignored when the boundary selects user input. See [the state ownership decision](0001-durable-owns-state.md).
 
 **Example.** The model is finishing a two-day itinerary when the user says “three days instead.” Sending both itineraries is confusing. Conversely, blindly dropping the first answer when the new message asks an unrelated question can lose useful work.
 

package/docs/adr/{0012-run-in-owned-conversation.md → 0008-run-in-owned-conversation.md}

@@ -1,8 +1,8 @@
-# 0012. `/run` works in a conversation owned by one task
+# 0008. `/run` works in a conversation owned by one task
 
-Status: accepted (2026-10-04; owner accepted 2026-10-05). Replaces the `/run` part of [0008](0008-compaction-and-run.md); its compaction part stays.
+Status: accepted (2026-10-04; owner accepted 2026-10-05).
 
-**Context.** In 0008, `/run` works inside the chat's own conversation. Stopping it then means telling run work apart from ordinary work: `Conversation.abort()` also withdraws ordinary queued messages, so the draft tracked submission IDs and command receipts by hand. Durable already scopes abort by ownership: aborting a task aborts the conversations and work it owns.
+**Context.** Before this decision, `/run` worked inside the chat's own conversation. Stopping it then means telling run work apart from ordinary work: `Conversation.abort()` also withdraws ordinary queued messages, so the draft tracked submission IDs and command receipts by hand. Durable already scopes abort by ownership: aborting a task aborts the conversations and work it owns.
 
 **Example.** The user sends `/run 30m plan a two-day trip`, then "make it three days". The correction must reach the run. A later `/stop` must end the run without touching anything else.
 
@@ -12,9 +12,9 @@ Status: accepted (2026-10-04; owner accepted 2026-10-05). Replaces the `/run` pa
 - `/run` starts only when the chat conversation is idle. Otherwise it replies that the chat is busy and does nothing: no queueing, no moving of running work. A repeated `/run` during a run updates the deadline; a task text in it is sent to the run like an ordinary message.
 - While a run is active, all ordinary messages of the chat go to the run conversation as steers, with the message GUID as request ID. Commands do not.
 - An `onYield` hook continues the run until the model calls `end_run` (done, or the user is needed) or the deadline passes. The deadline only stops continuation: the current turn finishes, so a run can overrun. Ordinary messages do not extend it. Without unfinished work, the model ends the run instead of inventing a task.
-- Final answers of the run conversation are delivered as they are committed, including those between continuations, under [0003](0003-replies-at-most-once.md) and [0011](0011-reconcile-unsent-answers.md).
+- Final answers of the run conversation are delivered as they are committed, including those between continuations, at most once and under [0007](0007-reconcile-unsent-answers.md).
 - `/stop` aborts the run task. Durable aborts the run's work and withdraws its queued messages; they stay in history, unanswered, and are not resubmitted anywhere. Without an active run, `/stop` replies that nothing is running. There is no `/run-stop`. `/new` also stops the run.
-- A restart does not stop a run. `resume()` continues the run task like any other pending work, with the deadline from our run document; if it passed during the downtime, the current turn finishes and the run ends. Replies interrupted mid-send follow [0003](0003-replies-at-most-once.md).
+- A restart does not stop a run. `resume()` continues the run task like any other pending work, with the deadline from our run document; if it passed during the downtime, the current turn finishes and the run ends. A reply interrupted mid-send becomes `unknown` and is not resent.
 - The chat conversation keeps the record: the run's user messages and sent replies are written to it as passive entries, plus how the run ended. Tool calls and results stay in the run conversation, searchable under `durable/` like other history.
 
 **Consequences.** Stopping needs no submission bookkeeping and no command receipts. During a run, the chat has one place where work happens. Messages still queued in the run when `/stop` arrives are dropped, a narrower promise than before. After the run, the chat conversation knows what was said, not how; the model searches the run conversation when it needs details.

package/docs/adr/{0032-native-background-schedules.md → 0009-native-background-schedules.md}

@@ -1,4 +1,4 @@
-# 0032. Native background schedules and read-only execution history
+# 0009. Native background schedules and read-only execution history
 
 Status: proposed (owner requested native scheduling, compact migration and Web history)
 

package/docs/adr/0010-framework-and-workspace.md

@@ -0,0 +1,27 @@
+# 0010. The framework integrates iMessage and Durable; the workspace owns behavior
+
+Status: accepted (2026-10-31, owner, grilling session)
+
+**Problem.** Personal behavior, preferences and operations crept into the
+framework: a hard-coded idle reset, chat etiquette in the product prompt,
+claw-specific Git, deployment and restart procedures in the repository.
+
+**Decision.**
+
+- The *framework* is this repository and the service it runs. The *workspace*
+  is `WORKING_DIR` (`settings.json`, `AGENTS.md`, `extensions/`, `skills/`).
+- The framework does only the integration of iMessage and Durable: transport,
+  chat-to-conversation mapping, delivery and receipts, scheduling machinery,
+  the extension loader and read-only views. It keeps general tools (web,
+  browser, subagent, memory, images, messages).
+- Every other behavior lives in the workspace: personal tasks, chat etiquette,
+  thresholds such as idle reset, and operations (Git flow, deployment, restart).
+  The framework keeps no default or example for it.
+- The product prompt states only facts of the integration (interim and delivery
+  semantics, different senders are different people). How to behave belongs in
+  workspace `AGENTS.md`.
+- Workspace code is a plain Durable extension built with the framework's pinned
+  Durable SDK; the framework adds no API of its own for it.
+
+**Consequences.** Another deployment gets the integration and nothing personal.
+Changing behavior is a workspace edit and `/reload`, not a release.

package/docs/adr/README.md

@@ -1,54 +1,31 @@
 # Architecture decision records
 
-Accepted ADR files are never edited; this index records which ones are current.
-"Active" means the decision is in force. A replaced ADR points to its successor.
+These are the decisions in force. Accepted ADR files are never edited.
 
-## Current
+| ADR | Decision |
+|---|---|
+| [0001](0001-durable-owns-state.md) | Pi Durable owns all chat state |
+| [0002](0002-module-layering.md) | Modules in strict layers |
+| [0003](0003-native-extensions.md) | Native Durable extensions, not an SDK adapter |
+| [0004](0004-jsonl-storage.md) | One JSONL storage, backed up by hand |
+| [0005](0005-images-by-path.md) | Store images as file paths |
+| [0006](0006-test-budget.md) | About 40 tests |
+| [0007](0007-reconcile-unsent-answers.md) | Reconcile unsent answers |
+| [0008](0008-run-in-owned-conversation.md) | `/run` in an owned conversation |
+| [0009](0009-native-background-schedules.md) | Native background schedules and read-only execution history |
+| [0010](0010-framework-and-workspace.md) | The framework integrates iMessage and Durable; the workspace owns behavior |
 
-| ADR | Decision | Status |
-|---|---|---|
-| [0001](0001-durable-owns-state.md) | Pi Durable owns all chat state | Active |
-| [0002](0002-module-layering.md) | Modules in strict layers | Active |
-| [0003](0003-replies-at-most-once.md) | Replies are sent at most once | Active |
-| [0004](0004-native-extensions.md) | Native Durable extensions, not an SDK adapter | Active; Codex tier clause replaced by 0036 |
-| [0006](0006-jsonl-storage.md) | One JSONL storage, backed up by hand | Active |
-| [0007](0007-images-by-path.md) | Store images as file paths | Active |
-| [0008](0008-compaction-and-run.md) | Six-hour compaction | Active; `/run` clause replaced by 0012 |
-| [0010](0010-test-budget.md) | About 40 tests | Active |
-| [0011](0011-reconcile-unsent-answers.md) | Reconcile unsent answers | Active |
-| [0012](0012-run-in-owned-conversation.md) | `/run` in an owned conversation | Active |
-| [0013](0013-thin-adapters-around-durable.md) | Thin adapters around Durable | Active; scheduler clause replaced by 0042 |
-| [0016](0016-process-http-transport.md) | One process-owned HTTP transport | Active |
-| [0017](0017-browser-cli-owned-scope.md) | Conversation-scoped browser CLI tool | Accepted, to be implemented |
-| [0018](0018-tasks-without-prompt-api.md) | Ordinary `/stop`; no HTTP `/prompt` or `/send` | Active |
-| [0036](0036-workspace-policy-and-neutral-service-id.md) | Workspace policy and neutral service ID | Active |
-| [0040](0040-chat-progress-notices.md) | Chat progress notices | Active; consolidates 0020–0028, 0031 |
-| [0041](0041-restart-and-recovery.md) | Restart and recovery | Active; consolidates 0037–0039; self-restart path added by 0052 |
-| [0042](0042-background-schedules-and-workspace-extensions.md) | Background schedules and workspace extensions | Active; operator-run clause replaced by 0047 |
-| [0043](0043-remove-legacy-migration.md) | Remove the legacy migration code | Active; archived at tag `archive/legacy-migration` |
-| [0044](0044-message-channels.md) | Organize message sources as channels | Proposed |
-| [0045](0045-chat-scheduling-tools.md) | Native chat scheduling tools | Proposed |
+## Adding an ADR
 
-| [0046](0046-selective-command-redaction.md) | Selective command-preview redaction | Proposed; owner-requested implementation in #36 |
-| [0047](0047-one-scheduling-path.md) | One scheduling path for recurring and one-off work | Active |
-| [0048](0048-quiet-attachment-reads.md) | Quiet attachment reads | Proposed; owner-requested implementation in #38 |
-| [0049](0049-per-chat-progress-notices.md) | Per-chat progress notices via `/verbose` | Proposed; owner-requested implementation |
-| [0052](0052-host-owned-self-restart.md) | The host owns its own restart (`restart_service`) | Active; owner accepted on 2026-10-24 (#39) |
+Do not add an ADR on your own initiative. A new ADR, including one that
+reverses a decision above, is written only during a grilling session (the
+`grilling` skill), to record what the owner settled there. Outside such a
+session, describe the change in the GitHub issue, `docs/architecture.md` or
+the code.
 
-## Replaced or rejected
+## Removed ADRs
 
-| ADR | Decision | Replaced by |
-|---|---|---|
-| [0005](0005-history-migration.md) | Import old history once | 0043 (done) |
-| [0009](0009-one-shot-cutover.md) | Switch over in one step | 0043 (done) |
-| [0014](0014-ephemeral-private-storage.md) | Ephemeral private storage | 0018 |
-| [0015](0015-ordinary-stop-keeps-native-inbox.md) | `/stop` keeps the native inbox | 0018 |
-| [0030](0030-shared-web-read-cache.md) | Shared web read cache | Rejected; removed |
-| [0019](0019-remove-scheduled-services.md) | Remove scheduled services | 0042 |
-| [0020](0020-chat-task-progress.md)–[0028](0028-command-preview-120.md) | Progress notice format | 0040 |
-| [0031](0031-quiet-compaction-progress.md) | Quiet six-hour compaction progress | 0040 |
-| [0032](0032-native-background-schedules.md)–[0035](0035-external-business-task-extensions.md) | Native schedules, operator run, local time, workspace extensions | 0042 |
-| [0037](0037-restart-during-in-flight-work.md)–[0039](0039-rerun-interrupted-tools.md) | Restart and tool rerun | 0041 |
-
-Numbers 0029, 0050 and 0051 are not used: 0050 and 0051 were interim stop
-heuristics for #39 that the owner did not accept; 0052 replaced them.
+All other ADRs were removed on 2026-10-31, together with every reference to
+them, and the rest renumbered without gaps. The files are kept, under their old
+numbers, at the annotated tag `archive/adr-pre-prune`
+(`git show archive/adr-pre-prune:docs/adr/<file>`).

package/docs/api.md

@@ -7,7 +7,7 @@ The server has no authentication; do not expose it to untrusted networks.
 
 The pages `/`, `/chat`, `/chats`, `/tasks`, `/scheduled`, `/settings`, `/memory` and `/logs` are read-only.
 The Chats tab (`/chats`, `/chats/data`) lists groups and direct chats, one row
-each: reply eligibility, the `/verbose` choice with its effective value, the
+each: reply eligibility, the `/verbose` and `/interim` choices with their effective values, the
 conversation's model and thinking level, and last activity. Chats that do not
 reply are dimmed. It never shows message text. The message history page in the
 navigation is labelled Messages.
@@ -47,8 +47,7 @@ requests; detail history and its older-page cursors are not reduced to 15
 messages. Existing `/chat/data` and conversation detail responses without these
 view parameters retain their native state shapes.
 
-Every request reads current state directly; there is no server-side read cache
-(ADR 0030 was rejected).
+Every request reads current state directly; there is no server-side read cache.
 
 Pages load once and refresh only through the Refresh button, memory filtering/
 pagination or explicit navigation. There is no browser SSE connection, periodic
@@ -69,10 +68,10 @@ that arbitrary user-written secrets can be identified.
 
 The agent sends files and extra messages with its immediate `send_message`
 tool. HTTP `/prompt` and `/send` remain retired. Legacy cron management,
-reminders and PT Automation routes remain removed and return 404 (ADR 0019).
+reminders and PT Automation routes remain removed and return 404.
 
 `GET /scheduled` and `GET /scheduled/data` expose configured native background
-jobs (ADR 0032), not the retained legacy cron files. The JSON view contains `jobs`
+jobs, not the retained legacy cron files. The JSON view contains `jobs`
 with cadence, enabled state, native scheduler task/conversation IDs, phase and
 `nextAt`, and each job's latest ten execution tasks. `recent` contains the latest
 ten executions across all jobs. Results separate native task outcome from the
@@ -82,7 +81,7 @@ run, pause or resend buttons. Scheduling configuration takes effect at startup.
 Daily slots and learning dates use the service machine's local timezone (or an
 explicit process `TZ`). Each job includes `timezone`; Web deadlines and history
 use it even when the browser is in another timezone. Saved absolute deadlines
-remain unchanged on restart (ADR 0034).
+remain unchanged on restart.
 
 | Endpoint | Description | Example |
 |---|---|---|
@@ -99,6 +98,15 @@ previews. Raw outputs, commands, prompts and document contents stay local.
 Known credential indicators are redacted; arbitrary user-authored secrets cannot
 be guaranteed detectable. Missing or false keeps final-only delivery. The setting
 is reread for each notice; old tasks and unknown sends are not replayed
-([ADR 0040](adr/0040-chat-progress-notices.md)). `/verbose on|off` in a chat
+. `/verbose on|off` in a chat
 overrides this default for that chat only and `/verbose default` removes the
-override ([ADR 0049](adr/0049-per-chat-progress-notices.md)).
+override.
+
+Text the model writes next to a tool call is sent at once as an interim message
+in reply-enabled chats; subagent text stays private. `interimMessages: false` in
+`settings.json` turns this off by default, and `/interim on|off|default` sets it
+for one chat.
+
+`hiddenSkills` in `settings.json` is a list of skill names left out of the
+prompt's skill catalog; their files stay readable by path. It is read at startup
+and on `/reload`.

package/docs/architecture.md

@@ -45,15 +45,27 @@ extensions. Source and configuration reload without interrupting current calls.
 Failed reloads retain old definitions and schedule configuration. Removed task
 code stays in memory for calls that can still admit children; missing required
 code fails explicitly on restart. The assistant's `reload_extensions` tool uses
-the same service owner. See [workspace extensions](workspace-extensions.md),
-ADR 0035 and ADR 0036.
+the same service owner. See [workspace extensions](workspace-extensions.md).
 
 The built-in native `browser` extension wraps the pinned pi-browser CLI with
 host-derived conversation scopes. Browser children get private HOME/cache,
 profile/output and cwd; other coding tools are unchanged. The host owns scoped
 stop/reset/shutdown/restart cleanup, while Durable owns invocation state and
 unsafe replay policy. Read-only contexts do not offer the tool. This is not an
-OS sandbox; see [browser operations and retention](browser.md) and ADR 0017.
+OS sandbox; see [browser operations and retention](browser.md).
+
+The model is offered a fixed core of tools; every other built-in or workspace tool
+is deferred and loaded on demand with Durable's `tool_search`, the same in every
+conversation. The core includes Durable's `codemode` (`extensions/codemode.ts`):
+the model writes a script that calls the conversation's tools in a QuickJS
+sandbox and only the script's output enters the context; `models.*` is off, so
+scripts cannot start model calls, and the prompt section lists callable tools
+within a small token budget.
+
+`/run <duration>` (ADR 0008) treats the duration as time to use: after the
+stated task is done the run keeps verifying and improving within its scope
+until the deadline, and `end_run` ends it early only when blocked, when the
+user is needed or when nothing in scope remains.
 
 
 ### Native schedules
@@ -62,15 +74,14 @@ OS sandbox; see [browser operations and retention](browser.md) and ADR 0017.
 job's dedicated conversation owns a background scheduler, whose checkpoint saves
 the next deadline. Each occurrence is a child execution task delegating to an
 extension's native business task; terminal receipts supply Web history, not a
-parallel UI log. The framework owns daily/interval cadence, non-overlap, recovery
-and quiet six-hour native compaction. Workspace tasks own business policy and
+parallel UI log. The framework owns daily/interval cadence, non-overlap and recovery, and
+defines no schedule of its own: chat context is bounded by Durable's thresholds
+against the window each model advertises. Workspace tasks own business policy and
 documents, and can commit their state and the generic outgoing item atomically.
 The host delivery poll uses existing direct-send receipts and passive chat records.
 `web/schedules.ts` projects these native records, including latest-ten history.
 Daily slots and learning dates use the service machine's local timezone; the Web
-view uses the same timezone. Saved absolute deadlines survive restart. See
-[ADR 0032](adr/0032-native-background-schedules.md) and
-[ADR 0034](adr/0034-machine-local-schedule-time.md).
+view uses the same timezone. Saved absolute deadlines survive restart.
 
 ## 2. Workflow