@milpa/comal 0.1.6 → 0.2.0

package/src/tool-packs.mjs

@@ -6,7 +6,7 @@ import { searchToolCatalog } from './tool-catalog.mjs';
 const BROWSER = ['new_page','list_pages','navigate_page','list_console_messages','list_network_requests','take_snapshot'];
 const CAPTURE = ['take_screenshot'];
 const ADMIN = ['WorkSnapshot','AuditStatus','HouseSnapshot','OperationCatalog'];
-const SCOPED = {'sessions.peers':['ListAgents','SendMessage'],'provider.features':['ProviderCapabilities','ProviderSearch','AnalyzeMedia'],'workspace.inspect':['ListDirectory','FileInfo']};
+const SCOPED = {'workspace.source':['SourceDraft','SourceRetain','SourceRead','SourcePublish'],'sessions.peers':['ListAgents','SendMessage'],'provider.features':['ProviderCapabilities','ProviderSearch','AnalyzeMedia'],'workspace.inspect':['ListDirectory','FileInfo'],'workspace.git':['GitInspect','GitIntegrationPrepare','GitIntegrationRevise','GitIntegrationVerify','GitIntegrationApply','GitIntegrationStatus','GitIntegrationEvidence']};
 const TEMPORARY=new Set([...ADMIN,...Object.values(SCOPED).flat()]);
 // Native artifact binding needs the tiny metadata/hash contract on the initial
 // surface. Search/acquire may still describe it; a lease never grants permission.
@@ -26,7 +26,7 @@ export class ToolPacks {
     return [{ id: 'browser.verify', available: browser.length === BROWSER.length, count: browser.length, purpose: 'DOM, console, network and navigation; execution still judged.' },
       { id: 'browser.capture', available: all.some(op => op.name === 'mcp__chrome-devtools__take_screenshot'), count: all.filter(op => this.inPack(op,'browser.capture')).length, purpose: 'Screenshot pixels in accepted receipts. Vision adapter sends only to a capable model; capture is not a visual verdict. Omit filePath to request inline image content.' },
       { id: 'house.audit', available: all.some(op=>ADMIN.includes(op.name)), count: all.filter(op=>ADMIN.includes(op.name)).length, purpose: 'Full forensic views; projected state and EvidenceRead already suffice for normal work.' },
-      ...Object.entries(SCOPED).map(([id,names])=>({id,available:all.some(op=>names.includes(op.name)),count:all.filter(op=>names.includes(op.name)).length,purpose:id==='sessions.peers'?'Discover/message live sessions by provider capability; no authority transfer.':id==='workspace.inspect'?'List directory and inspect file size/media signature without shell.':'Current provider native search/image/video tools where supported.'})),
+      ...Object.entries(SCOPED).map(([id,names])=>({id,available:all.some(op=>names.includes(op.name)),count:all.filter(op=>names.includes(op.name)).length,purpose:id==='workspace.source'?'Retain rejected source or append plan-free data, inspect it, then publish via native Write/Edit with frozen versions and current permissions. No authority from storage.':id==='sessions.peers'?'Discover/message live sessions by provider capability; no authority transfer.':id==='workspace.inspect'?'List directory and inspect file size/media signature without shell.':id==='workspace.git'?'Inspect source and, where registered, combine owned Agent offers, verify declared checks and CAS reserved refs. Native permissions still apply; human checkout preserved.':'Current provider native search/image/video tools where supported.'})),
       ...[...servers].map(([server, tools]) => ({ id: 'mcp:' + server, available: true, count: tools.length, purpose: 'Search or select up to 12 exact names with ToolPack; omit tools only when count <=12.' })),
       ...[...plugins].map(([id, tools]) => ({ id: 'plugin:' + id, available: true, count: tools.length, purpose: tools[0].origin.discovery?.description || 'Search or select deferred plugin operations; acquisition grants no permission.' }))];
   }
@@ -39,7 +39,7 @@ export class ToolPacks {
       if (row.type !== 'tool_pack_lease' || row.source !== 'capability_host' || row.actor?.id !== actor.id || row.actor?.kind !== actor.kind) continue;
       if (row.action === 'release') leases.delete(row.pack); else leases.set(row.pack, row);
     }
-    const pinned = new Set(this.pinned().filter(name=>byName.has(name))), visible = new Set(pinned), tokens = new Map([...pinned].map(name=>[name,'pinned'])), active = [], expired = [], expiredDetails = [];
+    const pinned = new Set(this.pinned(sessionId,actor).filter(name=>byName.has(name))), visible = new Set(pinned), tokens = new Map([...pinned].map(name=>[name,'pinned'])), active = [], expired = [], expiredDetails = [];
     for (const lease of leases.values()) {
       const originPlan = lease.task_id ? session.rows.findLast(row => ['work_plan_set','work_checks_repaired'].includes(row.type) && row.source === 'work_host' && row.version === lease.plan_version) : null;
       const generation = lease.work_digest || workDigest(originPlan?.tasks.find(task => task.id === lease.task_id));
@@ -48,7 +48,7 @@ export class ToolPacks {
       if (!scopeValid || !contractValid) { expired.push(lease.pack); expiredDetails.push({pack:lease.pack,task_id:lease.task_id || null,reason:!scopeValid?'scope_changed':'contracts_changed'}); continue; }
       lease.tools.forEach(tool => { visible.add(tool.name); if(!pinned.has(tool.name)) tokens.set(tool.name,(tokens.get(tool.name)||'')+':'+lease.audit.sha256); }); active.push({ id: lease.pack, tools: lease.tools.map(tool => tool.name), task_id: lease.task_id || null });
     }
-    const view = { visible, tokens, turn, work, state: { offers: this.offers(actor), required: work?.current?.capabilities || [], active, pinned: this.pinned().filter(name => byName.has(name)), expired, expired_details:expiredDetails, acquisition_grants_permission: false } };
+    const view = { visible, tokens, turn, work, state: { offers: this.offers(actor), required: work?.current?.capabilities || [], active, pinned: this.pinned(sessionId,actor).filter(name => byName.has(name)), expired, expired_details:expiredDetails, acquisition_grants_permission: false } };
     this.views.set(this.key(sessionId,actor), view); return view.state;
   }
   recoveryCall(operation, actor) {
@@ -125,7 +125,7 @@ export class ToolPacks {
     return { ...searchToolCatalog(this.catalogue(options.actor), { ...input, inPack: (op, pack) => this.inPack(op, pack), acquireCall: name => this.recoveryCall(name, options.actor) }), servers: states().filter(item => !selected || item.name === selected).slice(0, 12), ...(refresh ? { refresh } : {}) };
   }
   definition() {
-    return { name: 'ToolPack', description: 'Discover/acquire/release temporary schemas (browser.verify, browser.capture, mcp:SERVER, plugin:ID, house.audit, sessions.peers, provider.features, workspace.inspect). search with query returns <=5 ranked canonical tools and exact acquire_call; search does not acquire. list with pack returns its tool names; list without pack returns offers only. browser.capture supplies inline screenshots; browser.verify supplies navigation/DOM snapshot/console/network ONLY. For interaction acquire mcp:chrome-devtools with tools:["mcp__chrome-devtools__click"] or ["mcp__chrome-devtools__evaluate_script"] before use. Acquired schemas appear NEXT request. Select <=12 canonical names or unique short tool names scoped to that pack; the host returns canonical names. Missing server uses separate MCP config/connection judgment. No permission grant.',
+    return { name: 'ToolPack', description: 'Discover/acquire/release temporary schemas (browser.verify, browser.capture, mcp:SERVER, plugin:ID, house.audit, sessions.peers, provider.features, workspace.inspect, workspace.git). search with query returns <=5 ranked canonical tools and exact acquire_call; search does not acquire. list with pack returns its tool names; list without pack returns offers only. browser.capture supplies inline screenshots; browser.verify supplies navigation/DOM snapshot/console/network ONLY. For interaction acquire mcp:chrome-devtools with tools:["mcp__chrome-devtools__click"] or ["mcp__chrome-devtools__evaluate_script"] before use. Acquired schemas appear NEXT request. Select <=12 canonical names or unique short tool names scoped to that pack; the host returns canonical names. Missing server uses separate MCP config/connection judgment. No permission grant.',
       effects: packEffects,
       input_schema: { type: 'object', properties: { action: { type: 'string', enum: ['list','search','acquire','release'] }, query: { type: 'string', minLength: 1, maxLength: 500 }, max_results: { type: 'integer', minimum: 1, maximum: 5 }, pack: { type: 'string', maxLength: 100 }, tools: { type: 'array', minItems: 1, maxItems: 12, uniqueItems: true, items: { type: 'string', maxLength: 128 } } }, required: ['action'], additionalProperties: false },
       run: async (input, options) => {

package/src/tools.mjs

@@ -1,4 +1,4 @@
-import { readFile, writeFile, rename, unlink, mkdir, realpath, stat, readdir, opendir, open } from 'node:fs/promises';
+import { readFile, writeFile, rename, link, unlink, mkdir, realpath, stat, lstat, readdir, opendir, open } from 'node:fs/promises';
 import { constants } from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
@@ -8,20 +8,27 @@ import { readOnlyBashCheck } from './read-only-check.mjs';
 import { auditExecution } from './audit.mjs';
 import { digest } from './operations.mjs';
 import { recoverFileEffects } from './file-recovery.mjs';
+import { SourceOwnership } from './source-ownership.mjs';
+import { bindChromeSourceSyntax, chromeSourceSyntaxAdvice } from './chrome-source-syntax.mjs';
+import {SourceProposals,sourceDefinitions} from './source-proposals.mjs';
+import { registerNativeSourceRequests, nativeSourceRequestCapability, consumeNativeSourceRequest, settleNativeSourceRequest } from './source-requests.mjs';
+const nativeOperations=new WeakSet();
 
 const LIMIT = 64 * 1024, FILE_LIMIT = 1024 * 1024;
 const HASH_LIMIT = 256 * 1024 * 1024, HASH_CHUNK = 128 * 1024, HASH_TIMEOUT = 10000;
 const hash = text => createHash('sha256').update(text).digest('hex');
 const schema = (name, description, properties, required) => ({ name, description, input_schema: { type: 'object', properties, required, additionalProperties: false } });
 const str = description => ({ type: 'string', description });
+const sourceVersion = {type:'string',pattern:'^(?:absent|[a-f0-9]{64})$',description:'Optional frozen precondition: SHA-256 of the inspected bytes, or absent for create-only. Checked under native source ownership; never refreshed automatically.'};
 export const toolDefinitions = [
   schema('Read', 'Read missing/outdated UTF-8 file ranges with line numbers. Verified file_working_set pages already provide inspection: do not reread covered code just to satisfy an edit prerequisite.', { file_path: str('Workspace-relative or absolute path'), offset: { type: 'integer', minimum: 1 }, limit: { type: 'integer', minimum: 1, maximum: 2000 } }, ['file_path']),
-  schema('Write', 'Create/replace a UTF-8 file. Inspect existing bytes via Read or verified file_working_set. The host checks own read/write evidence against live bytes before replacing.', { file_path: str('File path'), content: str('Complete new content') }, ['file_path', 'content']),
-  schema('Edit', 'Replace an exact string in inspected code (Read or verified file_working_set). Own receipt and live hash are checked by the host. Must be unique unless replace_all is true.', { file_path: str('File path'), old_string: str('Exact nonempty text'), new_string: str('Replacement'), replace_all: { type: 'boolean' } }, ['file_path', 'old_string', 'new_string']),
+  schema('Write', 'Create/replace a UTF-8 file. Inspect existing bytes via Read or verified file_working_set. Native ownership lasts through the durable outcome. Live read proof and optional expected_sha256 are checked before replacing.', { file_path: str('File path'), content: str('Complete new content'), expected_sha256:sourceVersion }, ['file_path', 'content']),
+  schema('Edit', 'Replace an exact string in inspected code (Read or verified file_working_set). Native ownership, own receipt, live hash and optional expected_sha256 are checked. Must be unique unless replace_all is true.', { file_path: str('File path'), old_string: str('Exact nonempty text'), new_string: str('Replacement'), replace_all: { type: 'boolean' }, expected_sha256:sourceVersion }, ['file_path', 'old_string', 'new_string']),
   schema('Glob', 'List workspace files matching *, ** or ?; omits .git, .comal, .harness, .analysis and node_modules.', { pattern: str('Example: src/**/*.mjs') }, ['pattern']),
   schema('Grep', 'Search workspace text with ripgrep regular expressions.', { pattern: str('Regular expression'), path: str('Workspace path; defaults to .'), glob: str('Optional file glob') }, ['pattern']),
   schema('ListDirectory', 'List one workspace directory without shell. Returns bounded names/types, not file contents; omits internal state. Use Glob for recursive matches.', { path: str('Workspace directory; defaults to .'), limit: { type: 'integer', minimum: 1, maximum: 1000 } }, []),
-  schema('FileInfo', 'Inspect workspace file size/type and media signature without shell. By default reads at most 32 signature bytes. Set hash:true for bounded binary-safe full-file SHA-256 evidence (up to 256 MiB, 10 seconds); emits a file_read observation but grants no text inspection for editing. Does not decode media: send images/video directly to AnalyzeMedia.', { file_path: str('Workspace-relative or absolute path'), hash: { type: 'boolean', description: 'Stream the complete regular file to compute SHA-256 without returning contents.' } }, ['file_path']),
+  schema('FileInfo', 'Inspect workspace file size/type and media signature without shell. By default reads at most 32 signature bytes. Set hash:true for bounded binary-safe full-file SHA-256 evidence (up to 256 MiB, 10 seconds); emits a file_read observation but grants no text inspection for editing. Does not decode media: send images/video directly to AnalyzeMedia.', { file_path: str('Workspace-relative or absolute path'), hash: { type: 'boolean', description: 'Stream the complete regular file to compute SHA-256 without returning contents.' }, allow_missing:{type:'boolean',description:'Return explicit absent metadata for a missing safe path; never treat a dangling symbolic link as absence.'}, max_bytes:{type:'integer',minimum:1,maximum:268435456,description:'Optional stricter hash byte limit; never increases the 256 MiB bound.'} }, ['file_path']),
+  ...sourceDefinitions,
   schema('Bash', 'Run a shell command from the workspace after permission. This is NOT an OS sandbox.', { command: str('Shell command'), timeout: { type: 'integer', minimum: 1, maximum: 120000 } }, ['command']),
 ];
 
@@ -40,18 +47,31 @@ function validate(name, input) {
 }
 
 export class WorkspaceTools {
-  constructor({ cwd, policy, store, onPermission = () => {}, house = new House({ cwd }), actor = { id: 'local-agent', kind: 'agent' }, sessionId, record, select, frontier, capture, unavailable }) {
+  constructor({ cwd, policy, store, onPermission = () => {}, house = new House({ cwd }), actor = { id: 'local-agent', kind: 'agent' }, sessionId, record, select, frontier, capture, unavailable, sourceLockDirectory, nativeSourceRequests = false }) {
     this.cwd = cwd; this.policy = policy; this.onPermission = onPermission; this.reads = new Map(); this.house = house;
     this.store = store;
-    for (const definition of toolDefinitions) if (!house.registry.get(definition.name)) house.registry.add({ ...definition, run: (input, options) => (options.workspace || this).#run(definition.name, input, options) });
+    this.sourceOwnership = new SourceOwnership({cwd,store,directory:sourceLockDirectory});
+    this.sourceProposals=new SourceProposals(this);this.nativeSettlers=new Set();
+    for (const definition of toolDefinitions) if (!house.registry.get(definition.name)) nativeOperations.add(house.registry.add({ ...definition, run: (input, options) => sourceDefinitions.some(d=>d.name===definition.name)?(options.workspace||this).sourceProposals.execute(definition.name,input,options):(options.workspace || this).#run(definition.name, input, options) }));
+    registerNativeSourceRequests(this, { enabled: nativeSourceRequests, isNative: name => nativeOperations.has(house.registry.get(name)) });
     this.executor = house.bind({ actor, sessionId, policy, onPermission, record, resources: { workspace: this }, select, frontier, capture, unavailable });
     this.executor.recoverInterrupted = options => this.recoverInterrupted(options);
+    this.executor.bindSourceScope = (id,accept) => this.sourceProposals.bindScope(id,accept);
+    this.executor.bindChromeSourceSyntax = (id, facts) => bindChromeSourceSyntax(this, id, facts);
+    this.executor.isNativeOperation = name => this.isNativeOperation(name);
+    this.executor.nativeSourceRequestCapability = name => nativeSourceRequestCapability(this, name, this.executor.catalogue());
+    const snapshot = this.executor.snapshot;
+    this.executor.snapshot = () => { const frame = snapshot(), catalogue = frame.catalogue(); return { ...frame, nativeSourceRequestCapability: name => nativeSourceRequestCapability(this, name, catalogue) }; };
     this.recoverySessionId = sessionId; this.recoveryActor = actor;
   }
   setContext(context) { this.executor.setContext(context); }
   getMode() { return this.executor.getMode(); }
   snapshot() { return this.executor.snapshot(); }
   execute(name, input, options) { return this.executor.execute(name, input, options); }
+  isNativeOperation(name){return nativeOperations.has(this.house.registry.get(name));}
+  nativeSourceRequestCapability(name){return this.executor.nativeSourceRequestCapability(name);}
+  registerSettlement(handler){this.nativeSettlers.add(handler);return()=>this.nativeSettlers.delete(handler);}
+  async settleOperation(outcome) { const results=await Promise.allSettled([settleNativeSourceRequest(this,outcome),this.sourceOwnership.settle(outcome),this.sourceProposals.settle(outcome),...[...this.nativeSettlers].map(fn=>fn(outcome))]);const failed=results.find(r=>r.status==='rejected');if(failed)throw failed.reason; }
   recoverInterrupted({signal,session}={}) { return this.store && this.house.hasRecorder ? recoverFileEffects({store:this.store,house:this.house,executor:this.executor,sessionId:typeof this.recoverySessionId==='function'?this.recoverySessionId():this.recoverySessionId,actor:this.recoveryActor,signal,session}) : undefined; }
   inside(file) { const relative = path.relative(this.cwd, file); return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative)); }
   async resolve(file, { create = false } = {}) {
@@ -69,6 +89,7 @@ export class WorkspaceTools {
       }
     }
     if (!this.inside(canonical)) throw new Error('The symbolic link leaves the workspace.');
+    if (this.sourceOwnership.contains(canonical)) throw new Error('Native source ownership state is protected.');
     const first = path.relative(this.cwd, canonical).split(path.sep)[0];
     if (['.comal', '.harness'].includes(first)) throw new Error('Comal internal state is protected.');
     return canonical;
@@ -82,17 +103,36 @@ export class WorkspaceTools {
     catch(error){throw Object.assign(new Error('The file is not UTF-8 text; Read does not decode images or video. This does not deny AnalyzeMedia permission.'),{code:'READ_BINARY',cause:error});}
   }
   async atomicWrite(file, content) {
+    const transaction=this.sourceOwnership.transaction(file);
+    await transaction?.revalidate?.();
     await mkdir(path.dirname(file), { recursive: true });
     // Recheck the canonical parent after creating directories.
     const target = await this.resolve(file, { create: true });
     if (target !== file) throw new Error('The path changed during the operation.');
     let mode = 0o644; try { mode = (await stat(file)).mode & 0o777; } catch (e) { if (e.code !== 'ENOENT') throw e; }
     const temp = path.join(path.dirname(file), `.comal-write-${randomUUID()}`);
-    try { await writeFile(temp, content, { flag: 'wx', mode }); await rename(temp, file); }
+    try {
+      await writeFile(temp, content, { flag: 'wx', mode });
+      if(transaction)await this.assertSourceVersion(file,transaction.beforeHash);
+      await transaction?.revalidate?.();
+      transaction?.signal?.throwIfAborted();
+      if(transaction)transaction.replacementStarted=true;
+      if(transaction?.createOnly){
+        // Link a complete temp file without replacing any existing entry. A
+        // racing nonparticipant cannot turn explicit create-only into overwrite.
+        try{await link(temp,file);}catch(error){if(error.code==='EEXIST')throw Object.assign(new Error('Create-only source appeared before publication; it was preserved.'),{code:'SOURCE_CHANGED'});throw error;}
+      }else await rename(temp, file);
+    }
     finally { await unlink(temp).catch(() => {}); }
     this.reads.set(file, hash(content));
   }
-  async #run(name, input, { signal, actor, sessionId, observe = () => {}, recordWork = async () => {} } = {}) {
+  async assertSourceVersion(file,expected){
+    let current=null;
+    try{current=hash(await this.text(file));}catch(error){if(error.code!=='ENOENT')throw error;}
+    if(current!==expected)throw Object.assign(new Error('The source changed after preparation. No replacement was started. Inspect the new bytes and propose a new explicit change.'),{code:'SOURCE_CHANGED'});
+    if(await this.resolve(file,{create:true})!==file)throw Object.assign(new Error('The canonical destination changed during preparation.'),{code:'SOURCE_CHANGED'});
+  }
+  async #run(name, input, { signal, actor, sessionId, invocation_id, revalidate, nativeSourceRequest, observe = () => {}, recordWork = async () => {} } = {}) {
     validate(name, input); signal?.throwIfAborted();
     if (name === 'ListDirectory') {
       const dir = await this.resolve(input.path || '.'), entries = []; let truncated = false, bytes = 0;
@@ -110,9 +150,17 @@ export class WorkspaceTools {
       return JSON.stringify({ path: relative, entries, truncated });
     }
     if (name === 'FileInfo') {
-      const file = await this.resolve(input.file_path), info = await stat(file, input.hash ? { bigint: true } : undefined);
+      const file = await this.resolve(input.file_path,{create:Boolean(input.allow_missing)});let info;
+      try{info=await stat(file,input.hash?{bigint:true}:undefined);}catch(error){
+        if(error.code!=='ENOENT'||!input.allow_missing)throw error;
+        // ENOENT through a dangling link is not an absent entry.
+        try{await lstat(file);throw Object.assign(new Error('A dangling source link is not an absent destination.'),{code:'SOURCE_CHANGED'});}catch(named){if(named.code!=='ENOENT')throw named;}
+        for(let ancestor=path.dirname(file);ancestor!==this.cwd&&this.inside(ancestor);ancestor=path.dirname(ancestor)){try{const entry=await lstat(ancestor);if(entry.isSymbolicLink())throw Object.assign(new Error('An unresolved ancestor link is not an absent source path.'),{code:'SOURCE_CHANGED'});}catch(named){if(named.code!=='ENOENT')throw named;}}
+        if(await this.resolve(input.file_path,{create:true})!==file)throw Object.assign(new Error('The absent destination changed.'),{code:'SOURCE_CHANGED'});
+        const result={file_path:path.relative(this.cwd,file),type:'absent',exists:false,sha256:null};observe({kind:'file_absent',...result});return JSON.stringify(result);
+      }
       if (input.hash) {
-        const hashed = await hashWorkspaceFile(file, { signal, expected: info, verifyPath: async () => {
+        const hashed = await hashWorkspaceFile(file, { signal, expected: info, maxBytes:input.max_bytes??HASH_LIMIT, verifyPath: async () => {
           if (await this.resolve(input.file_path) !== file) throw fileHashError('The file path changed while hashing. Retry FileInfo.', 'FILE_HASH_CHANGED');
         } });
         const result = { file_path: path.relative(this.cwd, file), type: 'file', bytes: hashed.bytes,
@@ -143,9 +191,19 @@ export class WorkspaceTools {
       return text.split('\n').slice(offset - 1, offset - 1 + count).map((line, i) => `${offset + i}\t${line}`).join('\n').slice(0, LIMIT);
     }
     if (name === 'Write' || name === 'Edit') {
+      const request = consumeNativeSourceRequest(this, nativeSourceRequest, { operation: name, input, invocation_id, actor, sessionId });
+      if (request) await request.validate();
+      let transaction;
+      try {
       const file = await this.resolve(input.file_path, { create: name === 'Write' });
+      transaction=await this.sourceOwnership.acquire(file,{invocation_id,sessionId,actor,operation:name,signal,recordWork});
       let before = null;
       try { before = await this.text(file); } catch (e) { if (e.code !== 'ENOENT' || name === 'Edit') throw e; }
+      transaction.revalidate=request ? async () => { await request.revalidate(); await revalidate?.(); await request.revalidate(); } : revalidate;
+      transaction.beforeHash=before===null?null:hash(before);
+      transaction.createOnly=input.expected_sha256==='absent'||request?.expected_sha256==='absent';
+      if (request) { if (file !== request.file) throw Object.assign(new Error('The original source-request target changed.'),{code:'SOURCE_CHANGED'}); await request.validate(transaction.beforeHash); }
+      if(input.expected_sha256!==undefined&&input.expected_sha256!==(transaction.beforeHash??'absent'))throw Object.assign(new Error('Source precondition changed; the original expected_sha256 was not replaced by a newer inspection. No replacement was started.'),{code:'SOURCE_CHANGED'});
       if (before !== null && this.reads.get(file) !== hash(before) && this.store && sessionId) {
         const audit = auditExecution(await this.store.load(sessionId), this.house.stateContext()), relative = path.relative(this.cwd, file), currentHash = hash(before);
         // Recover only this actor's own read/write proof, still matched against
@@ -162,17 +220,26 @@ export class WorkspaceTools {
         after = input.replace_all ? before.split(input.old_string).join(input.new_string) : before.replace(input.old_string, () => input.new_string);
       }
       if (Buffer.byteLength(after) > FILE_LIMIT) throw new Error('The result exceeds 1 MiB.');
-      const output=JSON.stringify({ file_path: path.relative(this.cwd, file), status: before === null ? 'created' : 'updated', bytes: Buffer.byteLength(after), before_sha256: before === null ? null : hash(before), after_sha256: hash(after), ...(name === 'Edit' ? { removed: input.old_string.slice(0, 1000), added: input.new_string.slice(0, 1000) } : {}) });
+      const syntaxAdvice = await chromeSourceSyntaxAdvice(this, { sessionId, file, source: after });
+      const output=JSON.stringify({ file_path: path.relative(this.cwd, file), status: before === null ? 'created' : 'updated', bytes: Buffer.byteLength(after), before_sha256: before === null ? null : hash(before), after_sha256: hash(after), ...(name === 'Edit' ? { removed: input.old_string.slice(0, 1000), added: input.new_string.slice(0, 1000) } : {}), ...(syntaxAdvice ? { syntax_advice: syntaxAdvice } : {}) });
       // Durable preparation is a prerequisite of the replacement, not a receipt
       // claiming that the handler returned. Recovery can only observe its target.
-      const preparation={mechanism:'workspace-file-v1',operation:name,arguments_digest:digest(input),file_path:path.relative(this.cwd,file),before_sha256:before===null?null:hash(before),after_sha256:hash(after),output};
+      const preparation={mechanism:'workspace-file-v1',operation:name,arguments_digest:digest(input),file_path:path.relative(this.cwd,file),before_sha256:before===null?null:hash(before),after_sha256:hash(after),output,...(request?{source_request_id:request.request_id,source_request_digest:request.request_digest}:{})};
       await recordWork({type:'file_effect_prepared',source:'workspace_host',preparation,preparation_digest:digest(preparation)});
+      signal?.throwIfAborted();
+      await transaction.revalidate?.();
+      await this.assertSourceVersion(file,transaction.beforeHash);
+      signal?.throwIfAborted();
       await this.atomicWrite(file, after);
       // Read back independently; a handler return value is not a verified write.
       const observed = await this.text(file);
       observe({ kind: 'file_write', file_path: path.relative(this.cwd, file), before_sha256: before === null ? null : hash(before), after_sha256: hash(observed), matches_requested: observed === after });
       await recordWork({type:'file_effect_observed',source:'workspace_host',preparation_digest:digest(preparation),sha256:hash(observed),matches_requested:observed===after});
       return output;
+      } catch(error) {
+        if(!transaction?.replacementStarted)observe({kind:'native_file_no_replacement',mechanism:'workspace-file-v1',phase:'before_destination_dispatch',destination_replaced:false,auxiliary_effects:'possible_directories_or_temporary_files'});
+        throw error;
+      }
     }
     if (name === 'Bash') {
       const check = readOnlyBashCheck(input.command);
@@ -218,7 +285,7 @@ export class WorkspaceTools {
 
 const fileHashError = (message, code) => Object.assign(new Error(message), { code });
 const sameFileVersion = (left, right) => ['dev', 'ino', 'size', 'mtimeNs', 'ctimeNs'].every(key => left[key] === right[key]);
-async function hashWorkspaceFile(file, { signal, expected, verifyPath }) {
+async function hashWorkspaceFile(file, { signal, expected, verifyPath, maxBytes=HASH_LIMIT }) {
   const deadline = AbortSignal.timeout(HASH_TIMEOUT), combined = signal ? AbortSignal.any([signal, deadline]) : deadline;
   const check = () => {
     signal?.throwIfAborted();
@@ -230,7 +297,7 @@ async function hashWorkspaceFile(file, { signal, expected, verifyPath }) {
     handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
     const before = await handle.stat({ bigint: true });
     if (!before.isFile()) throw fileHashError('Hashing requires a regular file.', 'FILE_HASH_TYPE');
-    if (before.size > BigInt(HASH_LIMIT)) throw fileHashError('File hashing supports at most 256 MiB.', 'FILE_HASH_LIMIT');
+    if (before.size > BigInt(maxBytes)) throw fileHashError(`File hashing exceeds its ${maxBytes} byte limit.`, 'FILE_HASH_LIMIT');
     if (before.dev !== BigInt(expected.dev) || before.ino !== BigInt(expected.ino)) throw fileHashError('The file changed before hashing. Retry FileInfo.', 'FILE_HASH_CHANGED');
     await verifyPath();
     if (!sameFileVersion(before, await stat(file, { bigint: true }))) throw fileHashError('The file changed before hashing. Retry FileInfo.', 'FILE_HASH_CHANGED');
@@ -238,7 +305,7 @@ async function hashWorkspaceFile(file, { signal, expected, verifyPath }) {
     stream = handle.createReadStream({ highWaterMark: HASH_CHUNK, autoClose: false, signal: combined });
     for await (const chunk of stream) {
       check(); bytes += chunk.length;
-      if (bytes > HASH_LIMIT) throw fileHashError('File hashing supports at most 256 MiB.', 'FILE_HASH_LIMIT');
+      if (bytes > maxBytes) throw fileHashError(`File hashing exceeds its ${maxBytes} byte limit.`, 'FILE_HASH_LIMIT');
       if (signature.length < 32) signature = Buffer.concat([signature, chunk.subarray(0, 32 - signature.length)]);
       digest.update(chunk);
     }

package/src/trusted-context.mjs

@@ -9,10 +9,14 @@ const historicalInput = (name, input) => {
   return { ...Object.fromEntries(Object.entries(input || {}).filter(([key]) => !fields.includes(key))), ...metadata };
 };
 
+export const isHumanIntentRecord = row => row.type === 'intent' && !row.source && typeof row.text === 'string';
+
 export function trustedContext(rows) {
   const intentions = [], actions = [];
   for (const row of rows) {
-    if (row.type === 'intent') intentions.push(row.text);
+    // Direct human/goal intents are unsourced. Workflow and classifier records
+    // cannot become human authority, including in previously affected journals.
+    if (isHumanIntentRecord(row)) intentions.push(row.text);
     // Legacy sessions predating intent records used only direct user prompts.
     if (row.type === 'message' && !row.source && row.message.role === 'user' && typeof row.message.content === 'string') intentions.push(row.message.content);
     if (row.type === 'message' && row.message.role === 'assistant') for (const block of Array.isArray(row.message.content) ? row.message.content : []) {

package/src/tui/connection-transition.mjs

@@ -29,7 +29,7 @@ function action(value) {
   const argument = value.argument.trim();
   if (!argument || argument.length > 512 || /[\x00-\x1f\x7f-\x9f]/.test(argument)) throw new TypeError('Invalid connection argument.');
   if (['model', 'effort'].includes(value.command) && /\s/.test(argument)) throw new TypeError('Connection selection must be one identifier.');
-  if (['login', 'logout'].includes(value.command) && !/^[a-z][a-z0-9_-]*(?: --api-key-env [A-Za-z_][A-Za-z0-9_]*)?$/.test(argument)) throw new TypeError('Invalid credential control action.');
+  if (['login', 'logout'].includes(value.command) && !/^[a-z][a-z0-9_-]*(?: --api-key-env [A-Za-z_][A-Za-z0-9_]*| --key)?$/.test(argument)) throw new TypeError('Invalid credential control action.');
   return {command: value.command, argument};
 }
 

package/src/tui/controller.mjs

@@ -13,7 +13,7 @@ import { randomUUID } from 'node:crypto';
 import { connectionOptions } from './connection-options.mjs';
 import { ConnectionTransitions, connectionAction, connectionFailureReason } from './connection-transition.mjs';
 
-const IMMEDIATE = new Set(['cloud', 'remote-control', 'rc', 'help', 'copy', 'select', 'status', 'context', 'tools', 'house', 'state', 'audit', 'board', 'tasks', 'work', 'operations', 'plugins', 'sessions', 'resume', 'clear', 'model', 'models', 'effort', 'capabilities', 'login', 'logout', 'permissions', 'rename', 'table', 'queue', 'agents', 'mcp','list-agents','inbox','providers','provider', 'exit', 'quit']);
+const IMMEDIATE = new Set(['raw', 'cloud', 'remote-control', 'rc', 'help', 'copy', 'select', 'status', 'context', 'tools', 'house', 'state', 'audit', 'board', 'tasks', 'work', 'operations', 'plugins', 'sessions', 'resume', 'clear', 'model', 'models', 'effort', 'capabilities', 'login', 'logout', 'permissions', 'autonomy', 'rename', 'table', 'queue', 'agents', 'mcp','list-agents','inbox','providers','provider','config','max-tokens','context-window', 'exit', 'quit']);
 
 export class InteractiveController {
   constructor(ui, backend) { this.ui = ui; this.backend = backend; this.closed = false; this.switching = false; this.draftTimer = null; this.pendingDraft = null; }
@@ -143,7 +143,7 @@ export class InteractiveController {
     const mcpMutation = match?.[1] === 'mcp' && match[2] && !/^(?:status|list|config)(?:\s|$)/.test(match[2]);
     const workResume = match?.[1] === 'work' && match[2]?.trim() === 'resume';
     const pluginMutation = match?.[1] === 'plugins' && match[2] && !/^(?:status|list)(?:\s|$)/.test(match[2]);
-    const modelMutation = match && (['model', 'effort', 'provider'].includes(match[1]) && match[2]?.trim() || ['login', 'logout'].includes(match[1]) && match[2]?.trim());
+    const modelMutation = match && (['model', 'effort', 'provider', 'max-tokens', 'context-window'].includes(match[1]) && match[2]?.trim() || ['login', 'logout'].includes(match[1]) && match[2]?.trim() || match[1] === 'config' && /^(?:set|save)\b/.test(match[2]?.trim() || ''));
     const modelBusy = modelMutation && (this.peerProcessing || this.ui.busy || this.queue.running || this.runner.processing);
     if (match && IMMEDIATE.has(match[1]) && !mcpMutation && !pluginMutation && !workResume && !modelBusy) { await this.command(match[1], match[2] || ''); return; }
     if (match?.[1] === 'goal' && (!match[2] || ['status', 'pause', 'clear', 'stop', 'off', 'reset', 'none', 'cancel'].includes(match[2].trim().toLowerCase()))) {
@@ -171,6 +171,7 @@ export class InteractiveController {
     }
     if (['rc','remote-control'].includes(command) && ['', 'start'].includes(arg.trim()))await this.requireIdle();
     if (command === 'help') { this.ui.showHelp(); return; }
+    if (command === 'raw') { if (arg.trim()) throw new Error(t('Use /raw without arguments.')); this.ui.toggleRaw?.(); return; }
     if (command==='models' || ['model','login','provider','effort'].includes(command) && !arg.trim()) return this.chooseConnection(command,arg);
     if (command === 'sessions' || (command === 'resume' && !arg)) { this.ui.showSessions(await this.backend.listSessions()); return; }
     if (command === 'resume' || command === 'clear') {
@@ -188,19 +189,22 @@ export class InteractiveController {
       else throw new Error(t("Use /queue, /queue pause|resume|clear or /queue edit N."));
       this.syncQueue(); return;
     }
-    if(command==='work'&&(arg.trim()==='recover'||arg.trim().startsWith('review '))){await this.requireIdle();const output=await this.backend.control(command,arg);if(output)this.ui.notice(output);return;}
+    if(command==='work'&&(arg.trim()==='recover'||arg.trim().startsWith('review '))){await this.requireIdle();const output=await this.backend.control(command,arg);if(output)this.showOutput(command,arg,output);return;}
     if (['board', 'tasks', 'work'].includes(command)) { this.ui.showBoard(JSON.parse(await this.backend.control('board', ''))); return; }
     if(connectionAction(`/${command} ${arg}`)){await this.requireIdle();return this.connectionControl(command,arg);}
     if (['cloud', 'model', 'effort', 'provider', 'login', 'logout'].includes(command) && (arg.trim() || ['login', 'logout'].includes(command))) await this.requireIdle();
+    if (['max-tokens', 'context-window'].includes(command) && arg.trim() || command === 'config' && /^(?:set|save)\b/.test(arg.trim())) await this.requireIdle();
     if (command === 'table') { if (!arg) throw new Error(t("Use /table file.csv|tsv|json|md.")); const table = await this.backend.readTable(arg); this.ui.addTable(table.text, table.format, arg); return; }
     const changing=(['cloud','model','effort','provider','login','logout'].includes(command) && (arg.trim() || ['login','logout'].includes(command))) || (['rc','remote-control'].includes(command) && ['', 'start'].includes(arg.trim()));
     if(changing)this.switching=true;
     try {
-      const output=await this.backend.control(command,arg);if(output)this.ui.notice(output);
+      const output=await this.backend.control(command,arg);if(output)this.showOutput(command,arg,output);
       this.ui.updateMetadata(this.backend.metadata()); this.refreshDiscovery();
     } finally {if(changing){this.switching=false;this.runner.kick();}}
 
   }
+  // Salida de comando legible si la pantalla sabe presentarla; si no, aviso como antes.
+  showOutput(command,arg,output){if(this.ui.commandResult)this.ui.commandResult(command,arg,output);else this.ui.notice(output);}
   connectionIdentity() {
     const meta=this.backend.metadata();return JSON.stringify(['provider','authProvider','profile','model','effort'].map(key=>meta[key] || null));
   }

package/src/tui/discovery.mjs

@@ -1,4 +1,5 @@
-import { t } from '../i18n/index.mjs';
+import { t, languageInfo } from '../i18n/index.mjs';
+import { BYPASS_PERMISSION_MODE, BYPASS_LOCKED_MESSAGE } from '../permissions.mjs';
 // Presentation-only discovery: supplied snapshots in, suggestions out. Never
 // reads a workspace, contacts a provider, executes tools, or changes authority.
 import { graphemes, safeText } from './text.mjs';
@@ -11,6 +12,7 @@ const COMMANDS = [
   ['operations', '', "Contracts and effects of operations"], ['sessions', '', "Open the session selector"],
   ['resume', 'UUID', "Resume a saved session"], ['clear', '', "Create a new conversation"],
   ['copy', '', "Copy the last complete response"], ['select', '', "Select text with the terminal"],
+  ['raw', '', "Toggle the exact JSON of results and permissions"],
   ['compact', '', "Derive ledger state without an LLM"], ['context', '', "Check the context budget"],
   ['state', '', "Request and current job status"], ['audit', '', "Verify ledger integrity"],
   ['board', '', "Open the task board"], ['work', 'resume|recover|review', "Continue work, recover Chrome or review a native failure locally"],
@@ -18,15 +20,17 @@ const COMMANDS = [
   ['models', '', "Choose a model from the current provider"],
   ['effort', "LEVEL", "Check or change the effort announced by the model"],
   ['capabilities', '[refresh]', "Support and provenance of capabilities"],
-  ['permissions', "MODE", "Change the permissions mode"], ['goal', "[condition|status|pause|resume|clear]", "Define or control a persistent goal"],
+  ['permissions', "[MODE|allow|ask|deny|remove RULE]", "Show or change the permission mode and saved rules"], ['autonomy', "[observe|assist|edit|autonomous]", "Show or set the autonomy level"], ['goal', "[condition|status|pause|resume|clear]", "Define or control a persistent goal"],
   ['queue', '[pause|resume|clear|edit N]', "Manage queued messages"],
   ['rename', "NAME", "Change the visible name of this session"], ['table', "FILE", "Display a CSV, TSV, JSON, or Markdown table"],
-  ['mcp', "[action]", "View or configure MCP servers"], ['plugins', "[action]", "View plugins and control their lifecycle"],
+  ['mcp', "[action]", "View or configure MCP servers"], ['plugins', "[action]", "View plugins and control their lifecycle"], ['chrome-workflow', '[auto|raw]', 'Chrome entry workflow saved for this project'],
   ['agent', "[explore|general|background] TASK", "Delegate a task to a subagent"], ['agents', '[UUID|status|wait|stop|resume|background|continue] [RUN]', "View and control child runs"],
   ['search', "QUERY", "Search the web"], ['list-agents', '', "Discover other live sessions"],
   ['send', "ID_OR_NAME TEXT", "Send a message to another session"], ['inbox', "[action]", "Control the mailbox between sessions"],
   ['providers', '', "View profiles and login providers"], ['provider', "PROFILE", "Switch to the configured profile"],
-  ['login', "PROVIDER", "Authenticate a provider without pasting keys"], ['logout', "PROVIDER", "Remove Comal credentials"],
+  ['login', "PROVIDER [--key]", "Authenticate a provider; keys go in a hidden field"], ['logout', "PROVIDER", "Remove Comal credentials"],
+  ['config', '[set KEY VALUE|save]', "Connection, limits, permissions and config files"],
+  ['max-tokens', 'N', "Output reserve for this and later sessions"], ['context-window', 'auto|N', "Context window for this and later sessions"],
   ['exit', '', "Save and exit"], ['quit', '', "Save and exit"],
 ].map(([name, args, description]) => Object.freeze({ name, args, description }));
 export const COMMAND_CATALOG = Object.freeze(COMMANDS);
@@ -120,9 +124,10 @@ function argumentItems(command, args, context) {
   if (position === 0) {
     if (command === 'rc' || command === 'remote-control')return named(['start','status','stop'],'Remote session projection; local tools and permissions');
     if (command === 'cloud') return named(['login','status','logout'],'Comal account; separate from the model provider');
-    if (command === 'permissions') return named(['default', 'plan', 'acceptEdits', 'auto'], t("Permissions mode; does not change the model"));
+    if (command === 'permissions') return context.mode === BYPASS_PERMISSION_MODE ? [] : [...named(['default', 'plan', 'acceptEdits', 'auto'], t("Permissions mode; does not change the model")), ...named(['allow', 'ask', 'deny', 'remove'], t("Saved permission rule; deny wins"))];
+    if (command === 'autonomy') return context.mode === BYPASS_PERMISSION_MODE ? [] : named(languageInfo().language === 'es' ? ['observar', 'asistir', 'editar', 'autonomo'] : ['observe', 'assist', 'edit', 'autonomous'], t("Autonomy level; never enables the startup bypass"));
     if (command === 'effort') return named(context.effortLevels || context.capabilities?.effort?.levels || ['auto'], t("Level announced by the current model"));
-    if (command === 'provider') return [...entries(context.profiles), ...entries(context.authProviders || ['codex', 'kimi', 'minimax', 'grok'], 'id')];
+    if (command === 'provider') return [...entries(context.profiles), ...entries(context.authProviders || ['codex', 'kimi', 'minimax', 'grok', 'ollama'], 'id')];
     if (command === 'model' || command === 'models') return entries(context.models, 'id');
     if (command === 'resume') return entries(context.sessions, 'id');
     if (command === 'agents') return [...named(['status','wait','stop','resume','background','continue'],t("Child run controls")),...entries(context.agents,'id')];
@@ -132,20 +137,24 @@ function argumentItems(command, args, context) {
     if (command === 'goal') return named(['status', 'pause', 'resume', 'clear'], t("Target control; you can also write a condition"));
     if (command === 'queue') return named(['pause', 'resume', 'clear', 'edit'], t("Action on the queue"));
     if (command === 'mcp') return named(['status', 'list', 'config', 'reload', 'reconnect', 'add', 'remove'], t("Action on MCP servers"));
-    if (command === 'plugins') return named(['status', 'list', 'enable', 'disable', 'reload', 'run'], t("Action on plugins"));
+    if (command === 'plugins') return named(['status', 'list', 'available', 'add', 'config', 'enable', 'disable', 'reload', 'run', 'allow', 'trust', 'untrust', 'remove'], t("Action on plugins"));
+    if (command === 'chrome-workflow') return named(['auto', 'raw'], 'Saved per project; applies to the entry of this session');
     if (command === 'agent') return named(['explore', 'general','background'], t("Subagent type; complete the task afterwards"));
     if (command === 'inbox') return named(['status', 'accept', 'hold', 'refuse', 'release'], t("Mailbox control between sessions"));
-    if (command === 'login' || command === 'logout') return [...(command === 'login' ? named(['status'], t("Check login status")) : []), ...entries(context.authProviders || ['codex', 'kimi', 'minimax', 'grok'], 'id')];
+    if (command === 'login' || command === 'logout') return [...(command === 'login' ? named(['status'], t("Check login status")) : []), ...entries(context.authProviders || ['codex', 'kimi', 'minimax', 'grok', 'ollama'], 'id')];
   }
   if (position === 1) {
     if(command==='agents' && ['status','wait','stop','resume','background'].includes(first))return entries(context.agents,'id');
     if (command === 'mcp' && ['reconnect', 'remove'].includes(first)) return entries(context.mcpServers);
-    if (command === 'plugins' && ['enable', 'disable', 'reload', 'run'].includes(first)) return entries(context.plugins, 'id');
+    if (command === 'plugins' && ['enable', 'disable', 'reload', 'run', 'config', 'allow', 'untrust', 'remove'].includes(first)) return entries(context.plugins, 'id');
+    if (command === 'plugins' && first === 'add') return named(['chrome-lab', 'open-relay'], 'Plugin bundled with Comal');
     if (command === 'inbox' && first === 'release') return named(['all'], t("Release held messages; does not change hold mode"));
     if (command === 'queue' && first === 'edit') return named((context.queue?.items || []).map((_, index) => String(index + 1)), t("Edit this pending message"));
-    if (command === 'login' && first === 'status') return entries(context.authProviders || ['codex', 'kimi', 'minimax', 'grok'], 'id');
-    if (command === 'login' && first !== 'status') return named(['--api-key-env'], t("Environment variable name, never the key"));
+    if (command === 'login' && first === 'status') return entries(context.authProviders || ['codex', 'kimi', 'minimax', 'grok', 'ollama'], 'id');
+    if (command === 'login' && first !== 'status') return [...(first === 'codex' ? [] : named(['--key'], t("Hidden field for the key; never the composer"))), ...named(['--api-key-env'], t("Environment variable name, never the key"))];
   }
+  if (position === 2 && command === 'permissions' && ['allow', 'ask', 'deny', 'remove'].includes(first)) return named(languageInfo().language === 'es' ? ['--proyecto', '--usuario', '--sesion'] : ['--project', '--user', '--session'], t("Rule scope; the default is --project"));
+  if (position === 2 && command === 'plugins' && first === 'allow') return named(['observe', 'all', 'none'], 'Saved permissions; explicit denials still win');
   if (position === 2 && command === 'plugins' && first === 'run') {
     const plugin = (context.plugins || []).find(plugin => plugin.id === args[1]);
     const prefix = `plugin__${args[1]}__`;
@@ -158,10 +167,12 @@ function argumentItems(command, args, context) {
 }
 
 function syntaxHint(command, context) {
+  if (command === 'permissions' && context.mode === BYPASS_PERMISSION_MODE) return t(BYPASS_LOCKED_MESSAGE);
+  if (command === 'permissions') return t("/permissions allow|ask|deny RULE [--project|--user|--session] · RULE: Tool, Bash(git commit:*), Edit(src/**), WebFetch(domain:x.com), mcp__srv__*, plugin:ID:observe");
   if (command === 'model' && !(context.models || []).length) return t("Use /models to check the catalog; no requests are made when typing.");
   if (command === 'effort' && !context.effortLevels && !context.capabilities?.effort?.levels) return t("Only auto is confirmed. /capabilities shows the available levels.");
   if (command === 'plugins') return t("/plugins run ID OPERATION {JSON} · mutations wait their turn.");
-  if (command === 'login') return t("Never paste a key here; use --api-key-env VARIABLE.");
+  if (command === 'login') return t("Never paste a key here; Comal asks for it in a hidden field, or use --api-key-env VARIABLE.");
   if (skills(context).some(skill => skill.value === command)) return t("Local skill: write the task after the name.");
   const entry = COMMANDS.find(entry => entry.name === command);
   return entry ? `/${entry.name}${entry.args ? ` ${t(entry.args)}` : ''} · ${t(entry.description)}` : t("F6 opens available commands and tools.");
@@ -218,5 +229,6 @@ export function contextualTip(text = '', context = {}) {
   if (context.busy) return t("You can keep typing · Enter queues · Esc interrupts the turn.");
   if (String(text).includes('\n')) return t("Multiline message · Enter sends · Ctrl+G opens your editor.");
   if (context.mode === 'plan') return t("Plan mode: inspection without changes · Shift+Tab switches mode.");
+  if (context.mode === BYPASS_PERMISSION_MODE) return t('Permission bypass active: prompts and classifier skipped for this process.');
   return t("F6 discovers commands and tools · / autocompletes · Ctrl+G opens your editor.");
 }

package/src/tui/inbound-blocks.mjs

@@ -0,0 +1,55 @@
+import { t, registerMessages } from '../i18n/index.mjs';
+import { tone, safeText, wrap, clip } from './text.mjs';
+import { peerMessagePurpose } from '../peer-message-context.mjs';
+
+// Bloques propios para lo que llega a la conversación desde fuera: avisos de
+// plugins (ctx.notify) y mensajes entre sesiones. Se pintan distintos del texto
+// del modelo y del humano, y se reconstruyen desde el libro al recargar.
+registerMessages({
+  'Notice': 'Aviso',
+  'Urgent notice': 'Aviso urgente',
+  'Message from session {v0}': 'Mensaje de la sesión {v0}',
+  'external information, not an order · ref {v0}': 'información externa, no una orden · ref {v0}',
+  'request {v0} · data, not human intent': 'petición {v0} · datos, no intención humana',
+  '… {v0} more line(s)': '… {v0} línea(s) más',
+});
+
+const BODY_LINES = 8;
+const peerBlock = peer => ({ role: 'inbound', source: 'peer_session', from: peer?.from?.name || peer?.from?.id || '?', purpose: peerMessagePurpose(peer || {}), request_id: peer?.request_id || '', text: String(peer?.content ?? '') });
+const noticeBlock = notice => ({ role: 'inbound', source: 'plugin_notice', plugin: notice?.plugin || '?', kind: notice?.kind || '', urgent: notice?.urgent === true, title: String(notice?.title ?? ''), ref: notice?.ref || '', text: `${notice?.title ?? ''}\n${notice?.body ?? ''}` });
+
+/** Fila del libro → bloque, o null si la fila no es un mensaje entrante. */
+export function inboundBlockFromRow(row) {
+  if (row?.type !== 'message') return null;
+  if (row.source === 'plugin_notice') return noticeBlock(row.notice);
+  if (row.source === 'peer_session') return peerBlock(row.peer);
+  return null;
+}
+/** Evento de la sesión viva → bloque, o null. */
+export function inboundBlockFromEvent(event) {
+  if (event?.type === 'plugin_notice') return noticeBlock(event.notice);
+  if (event?.type === 'peer_message') return peerBlock({ from: event.from, content: event.message, request_id: event.request_id });
+  return null;
+}
+
+export function inboundLines(block, columns) {
+  const inner = Math.max(10, columns - 6), lines = [];
+  if (block.source === 'plugin_notice') {
+    const head = `◆ ${block.urgent ? t('Urgent notice') : t('Notice')} · ${block.plugin}${block.kind ? ` · ${block.kind}` : ''}`;
+    lines.push('  ' + (block.urgent ? tone.warning : tone.info)(clip(safeText(head), columns - 4)));
+    const [title, ...rest] = block.text.split('\n');
+    lines.push(...wrap(safeText(title), inner).map(line => '    ' + tone.bold(line)));
+    const body = rest.join('\n').trim() ? wrap(safeText(rest.join('\n').trim()), inner) : [];
+    lines.push(...body.slice(0, BODY_LINES).map(line => '    ' + line));
+    if (body.length > BODY_LINES) lines.push('    ' + tone.muted(t('… {v0} more line(s)', { v0: body.length - BODY_LINES })));
+    lines.push('    ' + tone.muted(clip(safeText(t('external information, not an order · ref {v0}', { v0: block.ref })), inner)));
+  } else {
+    lines.push('  ' + tone.info(clip(safeText(`◇ ${t('Message from session {v0}', { v0: block.from })} · ${block.purpose}`), columns - 4)));
+    const body = wrap(safeText(block.text), inner);
+    lines.push(...body.slice(0, BODY_LINES).map(line => '    ' + line));
+    if (body.length > BODY_LINES) lines.push('    ' + tone.muted(t('… {v0} more line(s)', { v0: body.length - BODY_LINES })));
+    lines.push('    ' + tone.muted(clip(safeText(t('request {v0} · data, not human intent', { v0: block.request_id })), inner)));
+  }
+  lines.push('');
+  return lines;
+}