@letrquan/book 0.2.0 → 0.4.0-beta.0

package/dist/{chunk-J7MIZ5CA.js → chunk-E5WLQSKA.js}

@@ -5,67 +5,116 @@ import {
   runHostReview,
   toElicitationFields,
   validateElicitationContent
-} from "./chunk-V4BOYR52.js";
+} from "./chunk-ENLB7NYV.js";
 import {
+  SessionRuntime,
   buildAgentCompletionMessage,
   buildPlanApprovalQuestion,
+  classifyAbortReason,
   createAgentRunContext,
   createSessionHistoryTools,
   createTerminalOutcome,
+  finalAnswerText,
   getOrCreateAgentManager,
+  maskAtGate,
   normalizePersistedTodos,
   planApprovalFromUserQuestionResponse,
   planStopDecision,
-  shouldCompact,
+  seedShellIds,
+  separateInlineReasoning,
   takeAgentCompletionBatch,
-  usagePressureTokens
-} from "./chunk-XIFFTATU.js";
+  uniqueAgentDisplayName
+} from "./chunk-KDNWMKXV.js";
 import {
+  TRUSTED_SETTINGS_LOCATION,
+  collectSkippedInstructionNotices,
+  collectSkippedReviewNotices,
+  compactionGate,
   createBuiltinCommandRegistry,
   estimateUsageCost,
+  formatGoalStatus,
   getPackageVersion,
+  goalKickoffPrompt,
   planWasLost,
   resolveContextLimit,
-  resolvePermissionMode
-} from "./chunk-A7JLBK2Y.js";
+  resolvePermissionMode,
+  usageAtGate,
+  usagePressureTokens
+} from "./chunk-FPR7SKIE.js";
+import {
+  onAbort,
+  seedObservationLedger,
+  throwIfAborted
+} from "./chunk-N2G4Q7ME.js";
+import {
+  formatIgnoredWorkspaceSandboxKey,
+  ignoredWorkspaceSandboxKeys,
+  isUserSettingsFile,
+  loadSettingsFile,
+  settingsLayerPaths,
+  workspaceLayerThatEnabledSandbox
+} from "./chunk-UCFJ43OS.js";
 import {
+  collectSkippedCommandNotices,
   commandEnforcementContext,
   discoverCommands,
   parseSlashInput,
   resolveCommandBody
-} from "./chunk-E75IPST5.js";
+} from "./chunk-AJZWLKLQ.js";
 import {
   consoleMcpDiagnosticSink,
   resolveMcpServerList
-} from "./chunk-3U5IBM24.js";
+} from "./chunk-MEOB2DZA.js";
+import {
+  isProcessAlive
+} from "./chunk-32WBCUAN.js";
+import {
+  buildChildEnv
+} from "./chunk-XHAO3K7I.js";
+import {
+  collectDeclaredDirectories,
+  partitionProjectDirectories
+} from "./chunk-4DKHLZRI.js";
 import {
-  observationKey,
+  getPrimaryArg,
   toolFailure,
+  toolResultErrorMessage,
   toolSuccess
-} from "./chunk-5GDZ22YP.js";
-import {
-  loadSettingsFile
-} from "./chunk-BTZZUCLI.js";
+} from "./chunk-YIL6HTJX.js";
 import {
   partitionProjectAllowRules
-} from "./chunk-WKBO5R4O.js";
+} from "./chunk-MV5PQNIA.js";
+import {
+  LEGACY_BASE_URL_ID,
+  describeApiKeyDeclaration,
+  describeDroppedOverride,
+  describeOrigin,
+  describeReservedProvider,
+  describeUnaffectedSelection,
+  describeWithheldSelection,
+  providerTrustCommand
+} from "./chunk-B5FC3MYZ.js";
 import {
   collectDeclaredHooks,
-  partitionProjectHooks
-} from "./chunk-ANSJPYGI.js";
+  partitionProjectHooks,
+  renderUntrustedText
+} from "./chunk-WV3O5PGX.js";
 import {
   resolveBookHome
-} from "./chunk-24AXE6SP.js";
+} from "./chunk-ZPSZZUWF.js";
 
 // src/run-status.ts
 import {
   closeSync,
   mkdirSync,
   openSync,
+  readdirSync,
   readFileSync,
   renameSync,
   rmSync,
   statfsSync,
+  statSync,
+  unlinkSync,
   writeSync
 } from "fs";
 import { join } from "path";
@@ -115,6 +164,43 @@ function readRunStatus(sessionId, home = resolveBookHome()) {
     return void 0;
   }
 }
+var RUN_RECORD_NAME = /\.json$/;
+var RUN_TEMP_NAME = /\.json\..+\.tmp$/;
+function recordsLiveRun(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object") return false;
+    const record = parsed;
+    if (record.terminal || record.crash) return false;
+    const pid = record.pid;
+    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return false;
+    return isProcessAlive(pid);
+  } catch {
+    return false;
+  }
+}
+function cleanupRunStatus(days, home = resolveBookHome(), now = Date.now()) {
+  const cutoff = now - Math.max(1, days) * 864e5;
+  const directory = runStatusDir(home);
+  let removed = 0;
+  try {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (!entry.isFile()) continue;
+      const isRecord = RUN_RECORD_NAME.test(entry.name);
+      if (!isRecord && !RUN_TEMP_NAME.test(entry.name)) continue;
+      const path = join(directory, entry.name);
+      try {
+        if (statSync(path).mtimeMs >= cutoff) continue;
+        if (isRecord && recordsLiveRun(path)) continue;
+        unlinkSync(path);
+        removed++;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return removed;
+}
 var RunStatusWriter = class {
   seed;
   last;
@@ -249,6 +335,10 @@ async function performPrintReview(effect, env, command) {
     // Every reviewer, lens and verifier agent is spawned under the host's run,
     // so the whole pipeline is billed and budgeted as one root.
     runner: reviewRunnerFor(env.agents.manager(), {
+      // The stored session the run belongs to, as the TUI passes its own. Without it
+      // each agent's tool-use records carry a made-up `agent:<id>` session id that
+      // matches no session file, and `book tool-stats` counts every one separately.
+      parentSessionId: env.agents.runContext.sessionId,
       rootRunId: env.agents.runContext.rootRunId,
       parentRunId: env.agents.runContext.runId
     })
@@ -265,12 +355,40 @@ function createPrintEffectRegistry() {
   return new PrintEffectRegistry().register("send-prompt", (effect) => ({
     kind: "prompt",
     prompt: effect.prompt,
-    commandContext: effect.context
+    commandContext: effect.context,
+    projectCommand: effect.projectCommand
   })).register("local-message", (effect, _env, command) => {
     if (effect.isError) throw new PrintCommandUsageError(command, effect.content);
     return { kind: "handled", command, output: effect.content };
-  }).register("review", performPrintReview);
+  }).register("review", performPrintReview).register("set-goal", (effect, env, command) => {
+    if (!env.goal) throw new UnsupportedPrintCommandError(command, GOAL_REFUSAL);
+    env.goal.set(effect.condition);
+    const kickoff = goalKickoffPrompt(effect.condition);
+    return {
+      kind: "prompt",
+      prompt: kickoff,
+      commandContext: {
+        command: {
+          name: "goal",
+          description: "Set a goal Book checks before stopping",
+          body: kickoff,
+          source: "project"
+        },
+        resolvedBody: kickoff
+      },
+      sessionNameSource: effect.condition
+    };
+  }).register("clear-goal", (_effect, env, command) => {
+    if (!env.goal) throw new UnsupportedPrintCommandError(command, GOAL_REFUSAL);
+    const cleared = env.goal.clear();
+    return {
+      kind: "handled",
+      command,
+      output: cleared ? formatGoalStatus({ state: "cleared", condition: cleared.condition }) : "No goal set"
+    };
+  });
 }
+var GOAL_REFUSAL = "\u2715 /goal needs a host that checks goals; this one does not.";
 function printBuiltinContext(env, commands) {
   return {
     workspace: env.config.workspace,
@@ -283,6 +401,7 @@ function printBuiltinContext(env, commands) {
     runtimeConfig: env.config,
     mode: env.mode,
     usage: null,
+    activeGoal: env.goal?.get(),
     turnDurationMs: 0,
     contextHistory: [],
     compactBoundaries: [],
@@ -299,6 +418,9 @@ function supportedCommandHelp(builtins, commands) {
   const lines = ["Commands supported in print mode:"];
   for (const definition of builtins.getDefinitions()) {
     if (definition.nonInteractive) lines.push(`  /${definition.name} \u2014 ${definition.description}`);
+    for (const subcommand of definition.nonInteractiveSubcommands ?? []) {
+      lines.push(`  /${definition.name} ${subcommand} \u2014 ${definition.description}`);
+    }
   }
   const custom = commands.map((command) => `/${command.name}`);
   lines.push(
@@ -326,8 +448,10 @@ async function resolvePrintCommand(input, env, deps = {}) {
   const commands = deps.commands ?? discoverCommands(env.config.workspace);
   const context = printBuiltinContext(env, commands);
   const resolved = builtins.resolve(parsed.name, context);
-  if (resolved) {
-    if (!resolved.definition.nonInteractive) {
+  if (resolved && !resolved.definition.tuiOnly) {
+    const subcommand = parsed.rawArguments.trim().split(/\s+/)[0] ?? "";
+    const allowedHere = resolved.definition.nonInteractive || (resolved.definition.nonInteractiveSubcommands?.includes(subcommand) ?? false);
+    if (!allowedHere) {
       throw unsupported(
         parsed.name,
         "needs an interactive session: it changes host state instead of producing a prompt.",
@@ -356,7 +480,8 @@ async function resolvePrintCommand(input, env, deps = {}) {
         commands
       );
     }
-    return dispatch.kind === "handled" ? { ...dispatch, command: parsed.name } : dispatch;
+    if (dispatch.kind === "handled") return { ...dispatch, command: parsed.name };
+    return dispatch.kind === "prompt" ? { ...dispatch, sessionNameSource: dispatch.sessionNameSource ?? input.trim() } : dispatch;
   }
   const custom = commands.find((command) => command.name === parsed.name);
   if (!custom) return { kind: "passthrough", prompt: input };
@@ -375,7 +500,9 @@ async function resolvePrintCommand(input, env, deps = {}) {
     kind: "prompt",
     prompt: body,
     commandContext: commandEnforcementContext(custom, body),
-    shellErrors
+    sessionNameSource: input.trim(),
+    shellErrors,
+    projectCommand: custom.source === "project"
   };
 }
 
@@ -406,12 +533,17 @@ var EVENT_TYPES = /* @__PURE__ */ new Set([
   "agent_message",
   "agent_completion",
   "agent_permission",
+  "agent_notice",
   "evidence_update",
+  "attempt_discarded",
+  "retry",
   "agent_apply",
   "hook_event",
   "mode_change",
   "plan_approval",
+  "command_result",
   "prompt_suggestions",
+  "notice",
   "error",
   "result",
   "done"
@@ -490,11 +622,71 @@ function createStreamParser(onEvent, options = {}) {
   };
 }
 
+// src/reader-gone.ts
+import { Writable } from "stream";
+var READER_GONE_CODES = /* @__PURE__ */ new Set([
+  "EPIPE",
+  "EOF",
+  "ERR_STREAM_DESTROYED",
+  "ECONNRESET"
+]);
+function isReaderGoneError(error) {
+  const code = error?.code;
+  return code !== void 0 && READER_GONE_CODES.has(code);
+}
+var READER_FLUSH_CAP_MS = 1e3;
+function createReaderFlush(stdout, options = {}) {
+  if (!(stdout instanceof Writable)) return void 0;
+  const capMs = options.capMs ?? READER_FLUSH_CAP_MS;
+  const controller = new AbortController();
+  let pending = 0;
+  let slow = false;
+  const waiters = /* @__PURE__ */ new Set();
+  const drained = () => {
+    if (pending > 0) return;
+    slow = false;
+    for (const release of [...waiters]) release();
+    waiters.clear();
+  };
+  return {
+    signal: controller.signal,
+    write(line) {
+      pending++;
+      stdout.write(line, (error) => {
+        if (error && isReaderGoneError(error)) controller.abort();
+        pending--;
+        drained();
+      });
+    },
+    hold(signal) {
+      if (pending === 0 || slow || signal?.aborted) return Promise.resolve();
+      return new Promise((resolve) => {
+        let settled = false;
+        const finish = () => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          signal?.removeEventListener("abort", finish);
+          waiters.delete(finish);
+          resolve();
+        };
+        const timer = setTimeout(() => {
+          slow = true;
+          finish();
+        }, capMs);
+        waiters.add(finish);
+        signal?.addEventListener("abort", finish, { once: true });
+        if (signal?.aborted) finish();
+      });
+    }
+  };
+}
+
 // src/headless.ts
 function carriedCostUsd(usage, models) {
   let worst = null;
   for (const model of models) {
-    const quote = estimateUsageCost(model, usage);
+    const quote = estimateUsageCost(model, usage, "pool");
     if (quote.status !== "known") return null;
     worst = worst === null ? quote.costUsd : Math.max(worst, quote.costUsd);
   }
@@ -509,26 +701,69 @@ async function readPipedPrompt(stream) {
   const prompt = chunks.join("").trim();
   return prompt || void 0;
 }
+function destroyOnAbort(stream, signal) {
+  if (!signal) return () => {
+  };
+  return onAbort(signal, () => {
+    const reason = signal.reason instanceof Error ? signal.reason : new Error("Aborted");
+    stream.destroy?.(reason);
+  });
+}
+async function raceAbort(promise, signal) {
+  if (!signal) {
+    await promise;
+    return true;
+  }
+  if (signal.aborted) return false;
+  let release;
+  const aborted = new Promise((resolve) => {
+    release = onAbort(signal, () => resolve(false));
+  });
+  try {
+    return await Promise.race([promise.then(() => true), aborted]);
+  } finally {
+    release?.();
+  }
+}
 async function runHeadless(config, registry, opts) {
   const mode = resolvePermissionMode(config.settings, opts.mode);
   const stdout = opts.stdout ?? process.stdout;
+  const flush = opts.outputFormat === "stream-json" ? createReaderFlush(stdout) : void 0;
+  const runSignal = flush && opts.signal ? AbortSignal.any([opts.signal, flush.signal]) : flush?.signal ?? opts.signal;
   const emit = (obj) => {
     if (obj && typeof obj === "object" && "type" in obj) {
       opts.onEvent?.(obj);
     }
-    stdout.write(JSON.stringify(obj) + "\n");
+    const line = JSON.stringify(obj) + "\n";
+    if (flush) flush.write(line);
+    else stdout.write(line);
+  };
+  const eventState = {
+    childLabels: /* @__PURE__ */ new Map(),
+    errorReported: false
   };
   let disposeCrashHandlers;
-  const agentSession = new AgentSession();
+  let sessionDisposed = false;
+  let startedSessionId;
+  const agentSession = new AgentSession({
+    runtime: new SessionRuntime()
+  });
+  const disposeSession = () => {
+    if (sessionDisposed) return;
+    sessionDisposed = true;
+    agentSession.dispose("headless_complete");
+  };
   const runtime = agentSession.getRuntime();
   runtime.todos.push(...normalizePersistedTodos(opts.plan?.todos));
   if (opts.plan?.tasks?.length) runtime.tasks.push(...opts.plan.tasks);
+  agentSession.restoreGoal(opts.goal);
   runtime.planUnrestored = planWasLost({
     planRecordExisted: opts.plan !== void 0,
     priorMessages: opts.history.length,
     todos: runtime.todos.length,
     tasks: runtime.tasks.length
   });
+  seedShellIds(runtime.backgroundShells, opts.transcript ?? opts.history, opts.history);
   try {
     if (opts.outputFormat === "stream-json") {
       emit({ type: "system", model: config.model, cwd: config.workspace });
@@ -544,7 +779,11 @@ async function runHeadless(config, registry, opts) {
     let sessionName = opts.sessionName;
     let sessionCreated = opts.sessionCreated === true;
     if (store && !sessionId) {
-      sessionId = store.create({ cwd: config.workspace, name: sessionName });
+      sessionId = store.create({
+        cwd: config.workspace,
+        name: sessionName,
+        driver: config.sessionDriver
+      });
       sessionCreated = true;
     }
     if (store && sessionId && !sessionName) {
@@ -567,6 +806,7 @@ async function runHeadless(config, registry, opts) {
           onHookEvent: createHookEventHandler(opts, emit)
         }
       );
+      startedSessionId = sessionId;
     }
     const runtimeSessionId = sessionId ?? crypto.randomUUID();
     const statusWriter = new RunStatusWriter({
@@ -577,7 +817,10 @@ async function runHeadless(config, registry, opts) {
       startedAt: Date.now()
     });
     disposeCrashHandlers = statusWriter.installCrashHandlers();
-    const permissionRequired = async () => "deny";
+    const permissionRequired = async () => ({
+      result: "deny",
+      reason: "no_approver"
+    });
     const userQuestionStatus = opts.onUserQuestionRequired ? "pending" : "unavailable";
     const askUser = async (request, context) => {
       try {
@@ -596,14 +839,26 @@ async function runHeadless(config, registry, opts) {
       if (mode === "bypassPermissions") return "approve";
       if (!opts.onUserQuestionRequired) return planStopDecision("approval_unavailable");
       const request = buildPlanApprovalQuestion(plan, crypto.randomUUID());
-      emitAgentEvent({ type: "user_question", request, status: userQuestionStatus }, opts, emit);
-      const response = await askUser(request, { signal: opts.signal });
-      emitAgentEvent({ type: "user_question_result", requestId: request.id, response }, opts, emit);
+      emitAgentEvent(
+        { type: "user_question", request, status: userQuestionStatus },
+        opts,
+        emit,
+        eventState
+      );
+      const response = await askUser(request, { signal: runSignal });
+      emitAgentEvent(
+        { type: "user_question_result", requestId: request.id, response },
+        opts,
+        emit,
+        eventState
+      );
       return planApprovalFromUserQuestionResponse(request, response);
     };
     const planNotApplied = {};
     let lastUsage = null;
     let lastOutcome = null;
+    let mayReclassify = true;
+    let finalRunOpeningId;
     const runResults = [];
     const recordRunResult = (result2) => {
       const existing = runResults.findIndex(
@@ -668,15 +923,7 @@ async function runHeadless(config, registry, opts) {
     const contextHistory = [...opts.history];
     const transcript = [...opts.transcript ?? opts.history];
     const compactBoundaries = [...opts.compactBoundaries ?? []];
-    for (const message of transcript) {
-      for (const observation of message.fileObservations ?? []) {
-        const key = observationKey(observation.workspaceId, observation.path);
-        const current = runtime.fileObservationLedger.get(key);
-        if (!current || current.timestamp <= observation.timestamp) {
-          runtime.fileObservationLedger.set(key, observation);
-        }
-      }
-    }
+    seedObservationLedger(runtime.fileObservationLedger, transcript);
     const loopConfig = {
       ...config,
       maxTurns: opts.maxTurns ?? config.maxTurns
@@ -688,7 +935,7 @@ async function runHeadless(config, registry, opts) {
           lastOutcome = event.outcome;
           onOutcome(event.outcome);
         }
-        emitAgentEvent(event, opts, emit);
+        emitAgentEvent(event, opts, emit, eventState);
       },
       // No header rewrite at turn boundaries: load() derives updatedAt from
       // the last appended record, so the on-disk header is never authoritative.
@@ -702,6 +949,15 @@ async function runHeadless(config, registry, opts) {
           emit({ type: "mode_change", mode: newMode });
         }
       },
+      /**
+       * The hold at a tool boundary. The `tool_use` records for the calls about
+       * to run have been written by now, so waiting for them to be taken is
+       * what turns a reader that has gone into an abort BEFORE the call runs
+       * (#340) instead of one call later. Free when the reader has caught up,
+       * bounded when it has not, and absent — so a no-op — for every other
+       * output format and for a host sink with no callback to answer.
+       */
+      beforeToolExecution: flush ? () => flush.hold(runSignal) : void 0,
       onPlanApprovalRequired: async (plan) => {
         const decision = await decidePlanApproval(plan);
         if (typeof decision === "object" && decision.decision === "stop") {
@@ -719,6 +975,24 @@ async function runHeadless(config, registry, opts) {
       },
       onUserQuestionRequired: askUser,
       userQuestionStatus,
+      onRetry: (phase, attempt, max, delayMs, reason) => {
+        const limit = max < 0 ? null : max;
+        if (opts.outputFormat === "stream-json") {
+          emit({
+            type: "retry",
+            phase,
+            attempt,
+            max: limit,
+            delay_ms: delayMs,
+            ...reason ? { reason } : {}
+          });
+        } else if (opts.quiet !== true) {
+          process.stderr.write(
+            `retry: ${phase} attempt ${attempt}${limit !== null ? `/${limit}` : ""} in ${Math.round(delayMs / 1e3)}s${reason ? ` (${reason})` : ""}
+`
+          );
+        }
+      },
       onHookEvent: createHookEventHandler(opts, emit),
       onUsage: (nextUsage) => {
         lastUsage = nextUsage;
@@ -739,7 +1013,50 @@ async function runHeadless(config, registry, opts) {
             ...hints,
             trigger: "auto",
             preContextTokens: usage ? usagePressureTokens(usage) : void 0,
-            signal: opts.signal,
+            signal: runSignal,
+            onHookEvent: createHookEventHandler(opts, emit)
+          }
+        });
+        if (outcome2.result.status === "compacted") {
+          emitCompactBoundary(opts.outputFormat, emit, outcome2.result);
+          lastUsage = null;
+        }
+        return outcome2.result;
+      },
+      // Deferred compaction (plans/async-compaction-plan.md): same plumbing,
+      // reducer on the snapshot first, judge and record at the next boundary.
+      prepareCompact: async (snapshot, usage, hints) => {
+        const outcome2 = await agentSession.prepareCompact({
+          config,
+          history: snapshot,
+          compactBoundaries,
+          sessionId,
+          transcriptOrdinal: transcript.length,
+          runContext,
+          runtime,
+          options: {
+            ...hints,
+            trigger: "auto",
+            preContextTokens: usage ? usagePressureTokens(usage) : void 0,
+            signal: hints?.signal ?? runSignal,
+            onHookEvent: createHookEventHandler(opts, emit)
+          }
+        });
+        return outcome2.status === "prepared" ? outcome2.prepared : outcome2.result;
+      },
+      commitCompact: async (prepared, history, hints) => {
+        const outcome2 = await agentSession.commitCompact({
+          prepared,
+          history,
+          config,
+          sessionId,
+          transcriptOrdinal: transcript.length,
+          runContext,
+          runtime,
+          timelineStore: store,
+          onCommitted: (_result, boundary) => compactBoundaries.push(boundary),
+          options: {
+            signal: hints?.signal ?? runSignal,
             onHookEvent: createHookEventHandler(opts, emit)
           }
         });
@@ -752,12 +1069,19 @@ async function runHeadless(config, registry, opts) {
       onAssistantMessageComplete: (message) => {
         if (!transcript.some((item) => item.id === message.id)) transcript.push(message);
         if (opts.outputFormat === "stream-json" && message.content) {
-          emit({ type: "assistant", text: message.content, complete: true });
+          emit({
+            type: "assistant",
+            text: message.content,
+            complete: true,
+            ...message.hostNotice ? { host_notice: true } : {}
+          });
         }
       }
     });
-    const runParentTurn = async (prompt, displayMessage, userMessage, runContext, commandContext) => {
+    const runParentTurn = async (prompt, displayMessage, userMessage, runContext, commandContext, typedText) => {
+      eventState.errorReported = false;
       let runOutcome;
+      finalRunOpeningId = userMessage.id;
       lastUsage = null;
       let updated;
       try {
@@ -770,7 +1094,7 @@ async function runHeadless(config, registry, opts) {
           mode,
           sessionId: runtimeSessionId,
           timelineStore: store,
-          signal: opts.signal,
+          signal: runSignal,
           callbacks: createRunCallbacks(runContext, (outcome2) => {
             runOutcome = outcome2;
           }),
@@ -783,6 +1107,9 @@ async function runHeadless(config, registry, opts) {
             userFileObservations: userMessage.fileObservations,
             userAttachments: userMessage.attachments,
             userMessageKind: userMessage.kind,
+            // The answer walk is bounded by `openingMessageId`, so a derived opening
+            // message no longer lets it walk past the run.
+            userMessageDerived: userMessage.derivedContent,
             manageSessionHooks: sessionId ? false : void 0,
             // Completion messages are host-generated notifications, not user
             // prompts. Keep UserPromptSubmit hooks from rewriting or blocking them.
@@ -790,6 +1117,8 @@ async function runHeadless(config, registry, opts) {
             parentSessionId: runtimeSessionId,
             runContext,
             runtime,
+            // Only what the user typed invokes a skill by `$name`, as in the TUI.
+            typedText,
             // Command frontmatter enforcement, exactly as the TUI passes it.
             allowedTools: commandContext?.allowedTools,
             modelOverride: commandContext?.modelOverride,
@@ -832,7 +1161,7 @@ async function runHeadless(config, registry, opts) {
       config,
       mode,
       sessionId: runtimeSessionId,
-      signal: opts.signal,
+      signal: runSignal,
       agents: {
         // Built only when an agent-backed command (`/review`) asks for it,
         // and attached to this session's runtime so it is disposed with the
@@ -843,18 +1172,39 @@ async function runHeadless(config, registry, opts) {
           permissionMode: mode,
           eventSink: (event) => {
             if (event.type === "agent_result") recordManagedRunResult(event.agent);
-            emitAgentEvent(event, opts, emit);
+            emitAgentEvent(event, opts, emit, eventState);
           },
           hookEventSink: createHookEventHandler(opts, emit)
         }),
         runContext
+      },
+      goal: {
+        get: () => agentSession.getGoal(),
+        set: (condition) => {
+          agentSession.setGoal(condition, goalTarget());
+        },
+        clear: () => agentSession.clearGoal(goalTarget())
       }
     });
+    const goalTarget = () => ({
+      sessionId,
+      timelineStore: store && sessionId ? store : void 0
+    });
     const commandResults = [];
     let commandUsage = null;
     const prompts = [];
     if (opts.inputFormat === "text") {
-      const prompt = opts.prompt ?? await readPipedPrompt(opts.stdin ?? process.stdin);
+      let prompt = opts.prompt;
+      if (prompt === void 0) {
+        const stream = opts.stdin ?? process.stdin;
+        const release = destroyOnAbort(stream, runSignal);
+        try {
+          prompt = await readPipedPrompt(stream);
+        } finally {
+          release();
+        }
+        throwIfAborted(runSignal);
+      }
       if (!prompt) {
         throw new Error(
           "print mode requires a prompt: pass one to -p, pipe one on stdin, or use --input-format stream-json"
@@ -873,9 +1223,15 @@ async function runHeadless(config, registry, opts) {
           onDiagnostic: (diagnostic) => diagnostics.push(diagnostic)
         }
       );
-      for await (const chunk of stream) {
-        parser.feed(chunk);
+      const release = destroyOnAbort(stream, runSignal);
+      try {
+        for await (const chunk of stream) {
+          parser.feed(chunk);
+        }
+      } finally {
+        release();
       }
+      throwIfAborted(runSignal);
       parser.flush();
       if (diagnostics.length > 0) throw new Error(diagnostics[0]?.message);
       if (opts.prompt) prompts.unshift(opts.prompt);
@@ -896,6 +1252,9 @@ async function runHeadless(config, registry, opts) {
         resumedFromRunId: runResults.length === 0 ? opts.resumedFromRunId ?? (opts.history.length > 0 ? [...opts.history].reverse().find((message) => message.role === "user")?.id : void 0) : void 0
       });
       runtime.runAccounting.startRoot(runContext, opts.maxBudgetUsd);
+      if (store && sessionId) {
+        agentSession.trackRunUsage(runContext.rootRunId, { sessionId, timelineStore: store });
+      }
       if (carriedSpend) {
         runtime.runAccounting.seedRoot(runContext.rootRunId, carriedSpend);
       }
@@ -932,6 +1291,12 @@ async function runHeadless(config, registry, opts) {
         } else if (opts.outputFormat === "stream-json" && (dispatch.output !== void 0 || dispatch.data !== void 0)) {
           emit({ type: "command_result", ...handled });
         }
+        carriedSpend = {
+          usage: accounting.inclusiveUsage,
+          costUsd: accounting.inclusiveCostUsd,
+          persistedUsage: runtime.runAccounting.persistedUsage(runContext.rootRunId),
+          fromRootRunId: runContext.rootRunId
+        };
         continue;
       }
       const prompt = dispatch.prompt;
@@ -948,9 +1313,19 @@ async function runHeadless(config, registry, opts) {
         kind: "conversation",
         timestamp: Date.now()
       };
+      if (config.autoCompactEnabled !== false && usageAtGate(lastUsage, config)) {
+        const pressure = usagePressureTokens(lastUsage);
+        const gate = compactionGate(config);
+        const masked = maskAtGate(contextHistory, gate, pressure, gate);
+        if (masked.maskedCount > 0) {
+          contextHistory.length = 0;
+          contextHistory.push(...masked.history);
+          if (masked.underLine) lastUsage = null;
+        }
+      }
       const contextLimit = resolveContextLimit(config);
       const hostCompactAttemptKey = `${usagePressureTokens(lastUsage)}:${contextHistory.length}`;
-      if (config.autoCompactEnabled !== false && contextLimit != null && shouldCompact(lastUsage, contextLimit) && lastHostCompactAttemptKey !== hostCompactAttemptKey) {
+      if (config.autoCompactEnabled !== false && contextLimit != null && usageAtGate(lastUsage, config) && lastHostCompactAttemptKey !== hostCompactAttemptKey) {
         lastHostCompactAttemptKey = hostCompactAttemptKey;
         try {
           const outcome2 = await agentSession.compact({
@@ -971,7 +1346,7 @@ async function runHeadless(config, registry, opts) {
             options: {
               trigger: "auto",
               preContextTokens: usagePressureTokens(lastUsage),
-              signal: opts.signal,
+              signal: runSignal,
               upcomingUserIntent: prompt,
               onHookEvent: createHookEventHandler(opts, emit)
             }
@@ -988,20 +1363,38 @@ async function runHeadless(config, registry, opts) {
         displayMessage: prompt,
         userMessage,
         sessionName,
+        sessionNameSource: dispatch.kind === "prompt" ? dispatch.sessionNameSource : void 0,
         timelineStore: store && sessionId ? store : void 0,
         expandShellInput: false,
+        projectCommand: dispatch.kind === "prompt" ? dispatch.projectCommand : void 0,
         runtime,
-        signal: opts.signal
+        signal: runSignal
       });
+      for (const notice of recorded.mentionNotices) process.stderr.write(`${notice}
+`);
       sessionName = recorded.sessionName;
       const contextMessage = recorded.contextMessage;
       transcript.push(userMessage);
       rootContexts.set(runContext.rootRunId, runContext);
-      await runParentTurn(contextMessage, prompt, userMessage, runContext, commandContext);
+      await runParentTurn(
+        contextMessage,
+        prompt,
+        userMessage,
+        runContext,
+        commandContext,
+        // What the user typed is the line they submitted, whatever it resolved to: a command's
+        // body or a built-in command's prompt is not.
+        submitted
+      );
       const spentSoFar = runtime.runAccounting.snapshotRoot(runContext.rootRunId);
       carriedSpend = {
         usage: spentSoFar.inclusiveUsage,
-        costUsd: spentSoFar.inclusiveCostUsd
+        costUsd: spentSoFar.inclusiveCostUsd,
+        persistedUsage: runtime.runAccounting.persistedUsage(runContext.rootRunId),
+        // Naming the root the totals came from: the next root's first record
+        // carries this one's remainder, so this one is closed rather than left to
+        // write the same tokens a second time at the end of the session (#336).
+        fromRootRunId: runContext.rootRunId
       };
       if (planNotApplied.outcome) break;
     }
@@ -1013,7 +1406,11 @@ async function runHeadless(config, registry, opts) {
         )
       );
       while (true) {
-        await managedAgentManager.waitForIdle();
+        const idle = !runSignal?.aborted && await raceAbort(managedAgentManager.waitForIdle(), runSignal);
+        if (!idle) {
+          if (mayReclassify) lastOutcome = classifyAbortReason(runSignal?.reason, true);
+          break;
+        }
         const pending = (await managedAgentManager.listPendingCompletions()).filter(
           (notification) => notification.parentSessionId === runtimeSessionId
         );
@@ -1052,10 +1449,13 @@ async function runHeadless(config, registry, opts) {
           displayMessage,
           contextMessage: userMessage.contextContent,
           userMessage,
+          // The local name is deliberately not reassigned from the result: a
+          // notification never names the session (#446).
+          sessionName,
           timelineStore: store && sessionId ? store : void 0,
           expandShellInput: false,
           runtime,
-          signal: opts.signal
+          signal: runSignal
         });
         transcript.push(userMessage);
         const parentContext = batch[0]?.rootRunId ? rootContexts.get(batch[0].rootRunId) : void 0;
@@ -1079,6 +1479,10 @@ async function runHeadless(config, registry, opts) {
     }));
     runResults.sort((left, right) => left.context.startedAt - right.context.startedAt);
     const reportedUsage = lastUsage ?? commandUsage;
+    mayReclassify = lastOutcome?.status !== "failed";
+    const lastText = finalRunOpeningId === void 0 ? "" : finalAnswerText(contextHistory, finalRunOpeningId);
+    const inline = separateInlineReasoning(lastText);
+    const answer = inline.found ? inline.content.trimEnd() : lastText;
     const result = {
       messages: contextHistory,
       transcript,
@@ -1089,12 +1493,12 @@ async function runHeadless(config, registry, opts) {
       runs: runResults,
       sessionId,
       plan: planNotApplied.outcome,
-      commandResults
+      commandResults,
+      answer
     };
     if (opts.jsonSchema) {
-      const text = lastAssistantText(contextHistory);
       try {
-        result.structured = JSON.parse(text);
+        result.structured = JSON.parse(answer);
       } catch {
         result.structuredError = "Failed to parse JSON from assistant output";
       }
@@ -1105,7 +1509,7 @@ async function runHeadless(config, registry, opts) {
           config,
           registry,
           contextHistory,
-          opts.signal,
+          runSignal,
           store?.readImageAttachment ? (attachment) => store.readImageAttachment(runtimeSessionId, attachment) : void 0
         );
         if (suggestions.length > 0) {
@@ -1122,8 +1526,7 @@ async function runHeadless(config, registry, opts) {
 ${stopped.message}
 `);
       } else {
-        const last = lastAssistantText(contextHistory);
-        if (last) stdout.write(last + "\n");
+        if (answer) stdout.write(answer + "\n");
       }
     } else if (opts.outputFormat === "json") {
       emit({
@@ -1137,15 +1540,25 @@ ${stopped.message}
           structured: result.structured,
           structuredError: result.structuredError,
           plan: result.plan,
-          commandResults
+          commandResults,
+          answer
         }
       });
     } else if (opts.outputFormat === "stream-json") {
       emit({
         type: "result",
+        // At the top level, beside `stopReason`, because that is where a
+        // supervised loop reads the outcome from: `jq -e 'select(.type=="result")
+        // | .outcome.reason=="objective_complete"'` was written against this
+        // record and read a null. `result.outcome` stays for hosts already
+        // reading it there.
         stopReason: outcome.reason,
+        outcome,
         result: {
-          messages: contextHistory,
+          // Off by default: a long run's conversation is half a megabyte of JSONL
+          // on one line, which every reader has to buffer before it can look at
+          // the field it came for. `--include-result-messages` asks for it back.
+          ...opts.includeResultMessages ? { messages: contextHistory } : {},
           usage: reportedUsage,
           accounting: result.accounting,
           outcome,
@@ -1154,28 +1567,42 @@ ${stopped.message}
           structured: result.structured,
           structuredError: result.structuredError,
           plan: result.plan,
-          commandResults
+          commandResults,
+          answer
         }
       });
     }
+    if (opts.outputFormat !== "stream-json" && opts.runSource !== "sdk" && outcome.status === "failed" && outcome.message && !answer && !planNotApplied.outcome && !eventState.errorReported) {
+      process.stderr.write(`error: ${outcome.message}
+`);
+    }
     if (sessionId) {
-      await agentSession.endLifecycle(config, sessionId, "completion", {
-        onHookEvent: createHookEventHandler(opts, emit)
+      const sessionEndReason = outcome.status === "completed" ? "completion" : outcome.status === "failed" ? "error" : outcome.status === "cancelled" || runSignal?.aborted ? "aborted" : "completion";
+      disposeSession();
+      await agentSession.endLifecycle(config, sessionId, sessionEndReason, {
+        onHookEvent: createHookEventHandler(opts, emit),
+        endOutcome: outcome
       });
     }
     return result;
+  } catch (error) {
+    if (startedSessionId) {
+      disposeSession();
+      await agentSession.endLifecycle(config, startedSessionId, runSignal?.aborted ? "aborted" : "error", {
+        onHookEvent: createHookEventHandler(opts, emit),
+        endOutcome: runSignal?.aborted ? classifyAbortReason(runSignal.reason, false) : createTerminalOutcome("failed", "runtime_error", { partialOutput: false })
+      }).catch((hookError) => {
+        console.warn(
+          `SessionEnd hook failed: ${hookError instanceof Error ? hookError.message : String(hookError)}`
+        );
+      });
+    }
+    throw error;
   } finally {
     disposeCrashHandlers?.();
-    agentSession.dispose("headless_complete");
+    disposeSession();
   }
 }
-function lastAssistantText(history) {
-  for (let i = history.length - 1; i >= 0; i--) {
-    const m = history[i];
-    if (m.role === "assistant" && m.content) return m.content;
-  }
-  return "";
-}
 function planApprovalStatus(decision) {
   return typeof decision === "string" ? decision : decision.decision;
 }
@@ -1183,16 +1610,45 @@ function createHookEventHandler(opts, emit) {
   if (!opts.includeHookEvents || opts.outputFormat !== "stream-json") return void 0;
   return (event, payload) => emit({ type: "hook_event", event, ...payload });
 }
-function emitAgentEvent(event, opts, emit) {
+function emitAgentEvent(event, opts, emit, state) {
   if (event.type === "terminal") return;
   if (event.type === "agent_text_delta" && opts.forwardSubagentText !== true) return;
   opts.onAgentEvent?.(event);
+  if (event.type === "notice") {
+    if (opts.outputFormat === "stream-json") emit({ type: "notice", message: event.message });
+    else console.warn(event.message);
+    return;
+  }
+  if (event.type === "goal_status") {
+    const endsRunFailed = event.event.state === "failed" || event.event.state === "paused";
+    if (opts.outputFormat === "stream-json") emit({ type: "goal_status", ...event.event });
+    else if (opts.outputFormat === "text" && opts.runSource !== "sdk" && (opts.quiet !== true || endsRunFailed)) {
+      process.stderr.write(
+        `goal: ${progressLine(formatGoalStatus(event.event), PROGRESS_NOTICE_MAX)}
+`
+      );
+    }
+    return;
+  }
+  if (event.type === "agent_notice") {
+    if (opts.outputFormat === "stream-json") {
+      emit({ type: "agent_notice", agentId: event.agentId, message: event.message });
+    } else {
+      process.stderr.write(`notice: ${progressLine(event.message, PROGRESS_NOTICE_MAX)}
+`);
+    }
+    return;
+  }
   if (event.type === "error") {
+    state.errorReported = true;
     if (opts.outputFormat === "stream-json") emit({ type: "error", error: event.error });
     else process.stderr.write(`error: ${event.error}
 `);
     return;
   }
+  if (opts.outputFormat === "text" && opts.quiet !== true) {
+    writeTextProgress(event, opts, state);
+  }
   if (opts.outputFormat !== "stream-json") return;
   switch (event.type) {
     case "run_started":
@@ -1249,6 +1705,67 @@ function emitAgentEvent(event, opts, emit) {
       break;
   }
 }
+var PROGRESS_ARG_MAX = 120;
+var PROGRESS_ERROR_MAX = 160;
+var PROGRESS_NOTICE_MAX = 400;
+function progressLine(text, max) {
+  const first = text.trim().split(/\r?\n/, 1)[0];
+  const printable = Array.from(first, (char) => {
+    const code = char.codePointAt(0) ?? 0;
+    const control = code < 32 || code >= 127 && code <= 159 || code === 1564 || code === 8206 || code === 8207 || code >= 8232 && code <= 8238 || code >= 8294 && code <= 8297;
+    return control ? " " : char;
+  }).join("").trimEnd();
+  const chars = Array.from(printable);
+  return chars.length > max ? `${chars.slice(0, max - 1).join("")}\u2026` : printable;
+}
+function writeTextProgress(event, opts, state) {
+  if (event.type === "tool_use") {
+    process.stderr.write(`${toolCallProgress(event.toolCall)}
+`);
+    return;
+  }
+  if (event.type === "tool_result" && opts.verbose === true) {
+    process.stderr.write(`  ${toolResultProgress(event.toolResult)}
+`);
+    return;
+  }
+  if (event.type === "agent_start") {
+    if (!state.childLabels.has(event.agent.id)) {
+      state.childLabels.set(
+        event.agent.id,
+        uniqueAgentDisplayName(event.agent.profile ?? event.agent.name, state.childLabels.values())
+      );
+    }
+    return;
+  }
+  if (event.type === "agent_activity") {
+    writeChildToolProgress(event.agentId, event.activity, opts, state);
+  }
+}
+function writeChildToolProgress(agentId, activity, opts, state) {
+  if (activity.kind !== "tool" || !activity.toolCall) return;
+  if (activity.status === "running") {
+    const child = progressLine(state.childLabels.get(agentId) ?? "agent", PROGRESS_ARG_MAX);
+    process.stderr.write(`  [${child}] ${toolCallProgress(activity.toolCall)}
+`);
+    return;
+  }
+  if (opts.verbose === true && activity.result) {
+    process.stderr.write(`    ${toolResultProgress(activity.result)}
+`);
+  }
+}
+function toolCallProgress(call) {
+  const arg = progressLine(getPrimaryArg(call.arguments), PROGRESS_ARG_MAX);
+  return `[${progressLine(call.name, PROGRESS_ARG_MAX)}]${arg ? ` ${arg}` : ""}`;
+}
+function toolResultProgress(result) {
+  const duration = result.metrics?.durationMs;
+  const target = progressLine(result.presentation?.target ?? "", PROGRESS_ARG_MAX);
+  const error = result.status === "success" ? "" : progressLine(toolResultErrorMessage(result) ?? "", PROGRESS_ERROR_MAX);
+  const detail = [target, error].filter(Boolean).join(": ");
+  return `\u2192 ${result.status}${duration !== void 0 ? ` ${Math.round(duration)}ms` : ""}${detail ? ` ${detail}` : ""}`;
+}
 function emitCompactBoundary(outputFormat, emit, result) {
   if (outputFormat !== "stream-json") return;
   emit({
@@ -1260,6 +1777,7 @@ function emitCompactBoundary(outputFormat, emit, result) {
     generation: result.generation,
     pre_messages: result.preMessageCount,
     post_messages: result.replacementHistory.length,
+    carried_messages: result.carriedCount,
     post_tokens: result.postContextTokens,
     checkpoint_version: 2,
     strategy: result.strategy,
@@ -1269,12 +1787,17 @@ function emitCompactBoundary(outputFormat, emit, result) {
     // This generation's status above; the conversation's accumulated one here.
     coverage_lifetime_status: result.checkpoint.coverage?.lifetime?.status ?? "complete",
     coverage: result.checkpoint.coverage,
-    warning: result.warning
+    warning: result.warning,
+    // The reducer audit, when the host has something to report: suspect inputs
+    // found in the summarized span and inherited constraints the reducer let go of.
+    ...result.checkpoint.audit ? { audit: result.checkpoint.audit } : {},
+    // Deferred compaction: the judge's verdict on the steps taken while the reducer ran.
+    ...result.judge ? { judge: result.judge } : {}
   });
 }
 async function generatePromptSuggestions(config, _registry, history, signal, resolveAttachment) {
-  const { chatCompletionStream } = await import("./openai-compatible-RHZUBHV6.js");
-  const { buildMessages } = await import("./context-ZC5IFEAX.js");
+  const { chatCompletionStream } = await import("./openai-compatible-IPUNBJ53.js");
+  const { buildMessages } = await import("./context-C3RAP6K5.js");
   const suggestionMessages = await buildMessages(
     config,
     [
@@ -1398,7 +1921,7 @@ var StdioProcessTransport = class {
       return Promise.reject(new Error(`MCP server ${this.name} is not a stdio server`));
     }
     const child = spawn(this.config.command, this.config.args ?? [], {
-      env: { ...process.env, ...this.config.env },
+      env: buildChildEnv(process.env, this.config.env),
       cwd: this.config.cwd,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -1433,7 +1956,6 @@ var StdioProcessTransport = class {
       child.stdout?.removeListener("data", onStdoutData);
       child.stderr?.removeListener("data", onStderrData);
       child.removeListener("error", onChildError);
-      child.stdin?.removeListener("error", onStdinError);
       child.removeListener("exit", onExit);
       child.removeListener("close", onClose);
       this.cleanupListeners = () => {
@@ -1653,7 +2175,7 @@ function registerElicitationHandler(client, name, options) {
     }
   );
 }
-async function connectMcpServer(name, cfg, options) {
+async function connectMcpServer(name, cfg, options, failure) {
   let handle;
   let liveConnection;
   let transportClosed = false;
@@ -1741,6 +2263,7 @@ async function connectMcpServer(name, cfg, options) {
     }
     return conn;
   } catch (error) {
+    if (failure) failure.error = error;
     const message = redact(error instanceof Error ? error.message : String(error));
     options.onDiagnostic({
       level: "warn",
@@ -1758,6 +2281,23 @@ async function connectMcpServer(name, cfg, options) {
     return null;
   }
 }
+function rejectedStreamableHttp(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /\b(404|405)\b|Not Found|Method Not Allowed/i.test(message);
+}
+async function connectRemoteWithSseFallback(name, cfg, options) {
+  const eligible = isRemoteConfig(cfg) && cfg.type !== "sse";
+  if (!eligible) return connectMcpServer(name, cfg, options);
+  const failure = {};
+  const connection = await connectMcpServer(name, cfg, options, failure);
+  if (connection || !rejectedStreamableHttp(failure.error)) return connection;
+  options.onDiagnostic({
+    level: "warn",
+    message: `MCP server "${name}" rejected Streamable HTTP; retrying as legacy SSE. Set "type": "sse" to skip this.`,
+    server: name
+  });
+  return connectMcpServer(name, { ...cfg, type: "sse" }, options);
+}
 function buildToolDefinition(conn, tool, requestTimeoutMs) {
   const prefixedName = `mcp__${conn.name}__${tool.name}`;
   const live = conn;
@@ -1836,7 +2376,7 @@ async function connectMcpServers(workspace, options = {}) {
     servers = declared.filter((server) => server.source === "user");
   }
   const results = await Promise.allSettled(
-    servers.map(({ name, config }) => connectMcpServer(name, config, resolved))
+    servers.map(({ name, config }) => connectRemoteWithSseFallback(name, config, resolved))
   );
   const connections = [];
   for (const [index, result] of results.entries()) {
@@ -1866,9 +2406,51 @@ async function disconnectMcpServers(connections) {
 
 // src/project-approval-notices.ts
 import { join as join2 } from "path";
+function collectWithheldProviderNotices(gate, workspace) {
+  const notices = [];
+  const approveCommand = (id) => {
+    const { command, note } = providerTrustCommand(workspace, id);
+    return `\`${command}\`${note}`;
+  };
+  for (const dropped of gate.droppedOverrides) {
+    notices.push(`\u26A0  ${describeDroppedOverride(dropped)}`);
+  }
+  for (const entry of gate.partition.reserved) {
+    notices.push(`\u26A0  ${describeReservedProvider(entry)}`);
+  }
+  const pendingIds = new Set(gate.partition.pending.map((entry) => entry.id));
+  for (const entry of gate.partition.pending) {
+    const id = renderUntrustedText(entry.id, 64);
+    const origin = entry.declaration.baseURL ?? entry.declaration.baseUrl;
+    notices.push(
+      `\u26A0  Ignoring workspace-declared provider "${id}" (${describeOrigin(origin)}, key: ${describeApiKeyDeclaration(
+        entry.declaration.apiKey,
+        workspace
+      )}) from ${entry.layers.map((layer) => renderUntrustedText(layer)).join(", ")}: it requires approval. Run ${approveCommand(entry.id)} to review and approve it.`
+    );
+  }
+  for (const selection of gate.withheldSelections) {
+    if (!pendingIds.has(selection.providerId)) continue;
+    notices.push(
+      `\u26A0  ${describeWithheldSelection(selection)} Run ${approveCommand(selection.providerId)} to approve it.`
+    );
+  }
+  for (const selection of gate.unaffectedSelections) {
+    if (!pendingIds.has(selection.providerId)) continue;
+    notices.push(`\u26A0  ${describeUnaffectedSelection(selection)}`);
+  }
+  if (gate.legacyBaseUrl?.state === "pending") {
+    notices.push(
+      `\u26A0  Ignoring baseUrl "${renderUntrustedText(gate.legacyBaseUrl.baseUrl)}" from ${LEGACY_BASE_URL_ID}: it would receive BOOK_API_KEY, so it requires approval. Run ${approveCommand(LEGACY_BASE_URL_ID)} to review and approve it.`
+    );
+  }
+  return notices;
+}
 function collectWithheldProjectNotices(input) {
-  if (!input.settingsEnabled) return [];
-  const projectSettings = loadSettingsFile(join2(input.workspace, ".book", "settings.json"));
+  const providerNotices = input.providerGate ? collectWithheldProviderNotices(input.providerGate, input.workspace) : [];
+  if (!input.settingsEnabled) return providerNotices;
+  const projectPath = join2(input.workspace, ".book", "settings.json");
+  const projectSettings = isUserSettingsFile(projectPath) ? null : loadSettingsFile(projectPath);
   const notices = [];
   const allow = partitionProjectAllowRules(
     projectSettings?.permissions?.allow ?? [],
@@ -1893,15 +2475,63 @@ function collectWithheldProjectNotices(input) {
       `\u26A0  Ignoring ${hooks.pending.length} project-declared hook(s) (${summary}): hooks require approval. Run \`book doctor\` to approve them.`
     );
   }
-  return notices;
+  const directories = partitionProjectDirectories(
+    collectDeclaredDirectories(input.workspace, projectSettings?.additionalDirectories ?? []),
+    input.settings.projectDirectories
+  );
+  for (const directory of directories.pending) {
+    notices.push(
+      `\u26A0  Ignoring project-declared additionalDirectories entry "${directory.declared}" (really ${directory.realPath}): it requires approval. Run \`book doctor\` to see how to grant it.`
+    );
+  }
+  const ignoredSandboxKeys = ignoredWorkspaceSandboxKeys(projectSettings ?? {});
+  if (ignoredSandboxKeys.length > 0) {
+    const listed = ignoredSandboxKeys.map(formatIgnoredWorkspaceSandboxKey).join(", ");
+    notices.push(
+      `\u26A0  Ignoring sandbox settings declared by ${projectPath}: ${listed}. A file inside the workspace may turn the sandbox on and add deny entries, but not loosen it. ` + TRUSTED_SETTINGS_LOCATION
+    );
+  }
+  const localPath = join2(input.workspace, ".book", "settings.local.json");
+  const localSettings = loadSettingsFile(localPath);
+  const ignoredLocalSandboxKeys = ignoredWorkspaceSandboxKeys(localSettings ?? {});
+  if (ignoredLocalSandboxKeys.length > 0) {
+    const listed = ignoredLocalSandboxKeys.map(formatIgnoredWorkspaceSandboxKey).join(", ");
+    notices.push(
+      `\u26A0  Ignoring sandbox settings declared by ${localPath}: ${listed}. A file inside the workspace may turn the sandbox on and add deny entries, but not loosen it. ` + TRUSTED_SETTINGS_LOCATION
+    );
+  }
+  const userPath = settingsLayerPaths(input.workspace)[0];
+  const activation = workspaceLayerThatEnabledSandbox([
+    { path: userPath, trust: "trusted", document: loadSettingsFile(userPath) },
+    { path: projectPath, trust: "repository", document: projectSettings },
+    { path: localPath, trust: "local", document: localSettings }
+  ]);
+  if (activation) {
+    notices.push(
+      `\u26A0  ${activation} declared sandbox.enabled=true, so sandbox.autoAllowBashIfSandboxed is false for this session: no Bash command is auto-approved. ${TRUSTED_SETTINGS_LOCATION}`
+    );
+  }
+  return [...notices, ...providerNotices];
+}
+function collectSkippedProjectFileNotices(workspace) {
+  return [
+    ...collectSkippedInstructionNotices(workspace),
+    ...collectSkippedReviewNotices(workspace),
+    ...collectSkippedCommandNotices(workspace)
+  ];
 }
 
 export {
+  runStatusPath,
   readRunStatus,
+  cleanupRunStatus,
+  isReaderGoneError,
   runHeadless,
   buildMcpToolDefinitions,
   connectMcpServers,
   disconnectMcpServers,
-  collectWithheldProjectNotices
+  collectWithheldProviderNotices,
+  collectWithheldProjectNotices,
+  collectSkippedProjectFileNotices
 };
-//# sourceMappingURL=chunk-J7MIZ5CA.js.map
+//# sourceMappingURL=chunk-E5WLQSKA.js.map