@moxxy/core 0.4.0 → 0.5.1

package/src/registries/commands.ts

@@ -22,25 +22,42 @@ export class CommandRegistry {
     if (this.aliases.has(cmd.name)) {
       throw new Error(`Command name already in use as an alias: /${cmd.name}`);
     }
-    this.commands.set(cmd.name, cmd);
+    // Validate EVERY alias up front, before mutating any state, so a collision
+    // on the second alias can't leave the command half-registered (def set +
+    // some aliases) — the registry stays atomic on a throw.
     for (const alias of cmd.aliases ?? []) {
       if (this.aliases.has(alias) || this.commands.has(alias)) {
         throw new Error(`Command alias already in use: /${alias}`);
       }
-      this.aliases.set(alias, cmd.name);
     }
+    this.commands.set(cmd.name, cmd);
+    for (const alias of cmd.aliases ?? []) this.aliases.set(alias, cmd.name);
   }
 
   replace(cmd: CommandDef): void {
-    // Clean up any aliases of the prior definition before re-adding.
     const prior = this.commands.get(cmd.name);
-    if (prior) {
-      for (const alias of prior.aliases ?? []) this.aliases.delete(alias);
-    }
-    this.commands.set(cmd.name, cmd);
+    const priorAliases = new Set(prior?.aliases ?? []);
+    // Validate the new aliases BEFORE mutating anything, mirroring register()'s
+    // guards so replace() can't silently hijack an alias owned by a different
+    // command or shadow another command's primary name. Validating first (rather
+    // than deleting the prior aliases then re-adding) keeps replace() atomic: a
+    // collision on a later alias must not have already destroyed the prior
+    // definition's aliases. An alias the prior def itself owned is exempt (it's
+    // about to be re-added under the same name).
     for (const alias of cmd.aliases ?? []) {
-      this.aliases.set(alias, cmd.name);
+      const owner = this.aliases.get(alias);
+      if (owner && owner !== cmd.name && !priorAliases.has(alias)) {
+        throw new Error(`Command alias already in use: /${alias}`);
+      }
+      if (this.commands.has(alias) && alias !== cmd.name) {
+        throw new Error(`Command alias already in use as a command name: /${alias}`);
+      }
     }
+    // All validated — now mutate. Clean up the prior definition's aliases, then
+    // install the new def + its aliases.
+    for (const alias of priorAliases) this.aliases.delete(alias);
+    this.commands.set(cmd.name, cmd);
+    for (const alias of cmd.aliases ?? []) this.aliases.set(alias, cmd.name);
   }
 
   unregister(name: string): void {

package/src/registries/isolators.test.ts

@@ -32,6 +32,43 @@ describe('IsolatorRegistry (core contribution collection)', () => {
     expect(reg.get('worker')).toBe(second);
   });
 
+  it('refuses to let a discovered (untrusted) isolator shadow a trusted builtin', () => {
+    const reg = new IsolatorRegistry();
+    const trusted = fakeIsolator('worker');
+    const rogue = fakeIsolator('worker');
+    // Static builtins register as trusted (default).
+    expect(reg.register(trusted, { trusted: true })).toBe(true);
+    // A discovered plugin contributing the SAME name must not swap the impl the
+    // security layer resolves by config — the trusted one stays. register()
+    // returns false so the host knows the registration never took effect (and
+    // must not track it for rollback / unload).
+    expect(reg.register(rogue, { trusted: false })).toBe(false);
+    expect(reg.get('worker')).toBe(trusted);
+    expect(reg.list()).toHaveLength(1);
+  });
+
+  it('returns true when a registration actually takes effect', () => {
+    const reg = new IsolatorRegistry();
+    expect(reg.register(fakeIsolator('docker'), { trusted: false })).toBe(true);
+    expect(reg.register(fakeIsolator('docker'), { trusted: false })).toBe(true); // overwrite still applied
+  });
+
+  it('lets a trusted registration still overwrite (builtin re-register / bundled+discovered same role)', () => {
+    const reg = new IsolatorRegistry();
+    const a = fakeIsolator('subprocess');
+    const b = fakeIsolator('subprocess');
+    reg.register(a, { trusted: true });
+    reg.register(b, { trusted: true });
+    expect(reg.get('subprocess')).toBe(b);
+  });
+
+  it('allows a discovered isolator with a brand-new name', () => {
+    const reg = new IsolatorRegistry();
+    const novel = fakeIsolator('docker');
+    reg.register(novel, { trusted: false });
+    expect(reg.get('docker')).toBe(novel);
+  });
+
   it('has no concept of an active isolator (selection stays with the security layer)', () => {
     const reg = new IsolatorRegistry();
     reg.register(fakeIsolator('wasm'));

package/src/registries/isolators.ts

@@ -1,4 +1,15 @@
 import type { Isolator } from '@moxxy/sdk';
+import type { Logger } from '../logger.js';
+
+export interface IsolatorRegisterOptions {
+  /**
+   * True when the isolator comes from a statically-registered (trusted)
+   * builtin, false for a discovered (untrusted) plugin. A discovered isolator
+   * is never allowed to shadow a name already claimed by a trusted one.
+   */
+  readonly trusted?: boolean;
+  readonly logger?: Logger;
+}
 
 /**
  * Collection of capability isolators contributed by plugins via
@@ -10,18 +21,54 @@ import type { Isolator } from '@moxxy/sdk';
  * A contributed isolator is therefore NEVER auto-activated: registration only
  * makes it available; the user must opt in by name, so a rogue plugin can't
  * silently weaken isolation just by being installed.
+ *
+ * This is the one registry where "last wins" crosses a trust boundary: a
+ * discovered plugin contributing an isolator whose name matches a trusted
+ * builtin would silently swap the implementation the security layer resolves by
+ * `security.isolator`. So a discovered registration may NEVER overwrite a name
+ * a trusted registration already claimed; it's refused with a warning.
  */
 export class IsolatorRegistry {
   private readonly impls = new Map<string, Isolator>();
+  /** Names registered by a trusted (static) source — these are never shadowed. */
+  private readonly trustedNames = new Set<string>();
 
-  register(iso: Isolator): void {
+  /**
+   * Register an isolator by name. Returns `true` when the impl was stored,
+   * `false` when the registration was REFUSED (a discovered plugin trying to
+   * shadow a trusted name). The boolean lets the PluginHost avoid tracking a
+   * refused registration for rollback — otherwise a later mid-`applyPlugin`
+   * failure would `unregister(name)` and delete the very trusted isolator the
+   * refusal protected.
+   */
+  register(iso: Isolator, opts: IsolatorRegisterOptions = {}): boolean {
+    const trusted = opts.trusted ?? true;
+    if (!trusted && this.trustedNames.has(iso.name)) {
+      // A discovered plugin must not shadow a trusted isolator: that would let
+      // it silently weaken an isolation boundary the user already opted into.
+      opts.logger?.warn(
+        'IsolatorRegistry: refusing to let a discovered plugin shadow a trusted isolator',
+        { name: iso.name },
+      );
+      return false;
+    }
+    if (this.impls.has(iso.name) && !trusted) {
+      // Replacing an existing (untrusted) entry from another discovered copy:
+      // allowed (same name → same role) but surfaced so it isn't silent.
+      opts.logger?.warn('IsolatorRegistry: a discovered isolator overwrote an existing name', {
+        name: iso.name,
+      });
+    }
     // Overwrite by name: an isolator may arrive via more than one path (a
     // bundled built-in AND a discovered copy). Same name → same role; last wins.
     this.impls.set(iso.name, iso);
+    if (trusted) this.trustedNames.add(iso.name);
+    return true;
   }
 
   unregister(name: string): void {
     this.impls.delete(name);
+    this.trustedNames.delete(name);
   }
 
   get(name: string): Isolator | undefined {

package/src/registries/modes.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import { defineMode } from '@moxxy/sdk';
 import { ModeRegistry } from './modes.js';
 
@@ -63,4 +63,24 @@ describe('ModeRegistry legacy-name migration', () => {
     reg.replace(mode('goal')); // not the active mode
     expect(fired).toBe(0);
   });
+
+  it('isolates a throwing change listener so register/setActive never aborts', () => {
+    const reg = new ModeRegistry();
+    const after = vi.fn();
+    reg.onActiveChange(() => {
+      throw new Error('observer down (e.g. dead socket on InfoChanged)');
+    });
+    reg.onActiveChange(after);
+    // A throwing observer must NOT abort the remaining listeners nor unwind into
+    // the registration that triggered the notification.
+    expect(() => reg.register(mode('default'))).not.toThrow();
+    expect(after).toHaveBeenCalledTimes(1);
+    expect(reg.getActive().name).toBe('default');
+
+    // Same isolation on an explicit setActive (mode switch).
+    reg.register(mode('goal'));
+    after.mockClear();
+    expect(() => reg.setActive('goal')).not.toThrow();
+    expect(after).toHaveBeenCalledTimes(1);
+  });
 });

package/src/registries/modes.ts

@@ -37,7 +37,7 @@ export class ModeRegistry {
       // active behaviour changed under them, or remote clients keep driving the
       // stale def. `activate()` would early-return on the name match, so notify
       // directly.
-      for (const fn of this.changeListeners) fn();
+      this.notifyChange();
     }
   }
 
@@ -75,6 +75,19 @@ export class ModeRegistry {
   private activate(mode: ModeDef): void {
     if (this.active === mode.name) return;
     this.active = mode.name;
-    for (const fn of this.changeListeners) fn();
+    this.notifyChange();
+  }
+
+  /** Fan out to change listeners, isolating each fault so a single throwing
+   *  observer (e.g. the runner's InfoChanged broadcast hitting a dead socket)
+   *  can't abort the rest or unwind into register()/replace()/setActive(). */
+  private notifyChange(): void {
+    for (const fn of this.changeListeners) {
+      try {
+        fn();
+      } catch {
+        // Swallow: an observer fault must not break mode activation.
+      }
+    }
   }
 }

package/src/registries/providers.ts

@@ -69,6 +69,14 @@ export class ProviderRegistry {
     return !this.disabled.has(name);
   }
 
+  /**
+   * Activate a provider, building its client on first activation. NOTE: once an
+   * instance is cached, a later `setActive(name, newConfig)` REUSES the cached
+   * instance and DROPS `newConfig` — re-config requires `replace()` first
+   * (which clears the cache), the flow the sole production caller follows.
+   * Reconfiguring by rebuilding here is intentionally avoided so callers don't
+   * silently lose instance identity / in-flight state on a redundant activate.
+   */
   setActive(name: string, config?: Record<string, unknown>): LLMProvider {
     const def = this.defs.get(name);
     if (!def) throw new Error(`Provider not registered: ${name}`);

package/src/registries/semantics.test.ts

@@ -1,5 +1,6 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import type { CompactorDef, ModeDef, ProviderDef } from '@moxxy/sdk';
+import { silentLogger } from '../logger.js';
 import { ProviderRegistry } from './providers.js';
 import { ModeRegistry } from './modes.js';
 import { CompactorRegistry } from './compactors.js';
@@ -114,4 +115,35 @@ describe('Registry consistency (PR3-1)', () => {
     expect(r.byName('bar')?.body).toBe('two');
     expect(r.list()).toHaveLength(1);
   });
+
+  it('SkillRegistryImpl: warns (not silent) when two distinct skills share a frontmatter name', () => {
+    const warn = vi.fn();
+    const r = new SkillRegistryImpl({ logger: { ...silentLogger, warn } });
+    const a = {
+      id: 'project/a' as never,
+      path: '/a.md',
+      scope: 'project' as const,
+      frontmatter: { name: 'dupe', description: 'd' },
+      body: 'a',
+    };
+    const b = { ...a, id: 'project/b' as never, path: '/b.md', body: 'b' };
+    r.register(a);
+    r.register(b); // same frontmatter.name, different id → must warn
+    expect(warn).toHaveBeenCalledTimes(1);
+    // Last-wins by name is preserved, but no longer silent.
+    expect(r.byName('dupe')?.id).toBe('project/b');
+    // Both are still reachable by id.
+    expect(r.list()).toHaveLength(2);
+  });
+
+  it('SkillRegistryImpl: replaceAll warns on a frontmatter-name collision within the batch', () => {
+    const warn = vi.fn();
+    const r = new SkillRegistryImpl({ logger: { ...silentLogger, warn } });
+    r.replaceAll([
+      { id: 'p/a' as never, path: '/a.md', scope: 'project' as const, frontmatter: { name: 'n', description: 'd' }, body: 'a' },
+      { id: 'p/b' as never, path: '/b.md', scope: 'project' as const, frontmatter: { name: 'n', description: 'd' }, body: 'b' },
+    ]);
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(r.byName('n')?.id).toBe('p/b');
+  });
 });

package/src/registries/skills.ts

@@ -1,8 +1,28 @@
 import type { Skill, SkillRegistry } from '@moxxy/sdk';
+import type { Logger } from '../logger.js';
 
 export class SkillRegistryImpl implements SkillRegistry {
   private readonly byId = new Map<string, Skill>();
   private readonly byNameIdx = new Map<string, Skill>();
+  private readonly logger?: Logger;
+
+  constructor(opts: { logger?: Logger } = {}) {
+    this.logger = opts.logger;
+  }
+
+  /** Warn (don't silently last-wins) when two distinct skills fight over one
+   *  frontmatter.name — otherwise byName() is non-deterministic by load order
+   *  and the first skill becomes unreachable by name. */
+  private warnNameCollision(name: string, incomingId: string): void {
+    const existing = this.byNameIdx.get(name);
+    if (existing && existing.id !== incomingId) {
+      this.logger?.warn('SkillRegistry: two skills share a frontmatter name; last one wins by name', {
+        name,
+        existingId: existing.id,
+        incomingId,
+      });
+    }
+  }
 
   list(): ReadonlyArray<Skill> {
     return [...this.byId.values()];
@@ -34,6 +54,7 @@ export class SkillRegistryImpl implements SkillRegistry {
     if (this.byId.has(skill.id)) {
       throw new Error(`Skill already registered: ${skill.id}`);
     }
+    this.warnNameCollision(skill.frontmatter.name, skill.id);
     this.byId.set(skill.id, skill);
     this.byNameIdx.set(skill.frontmatter.name, skill);
   }
@@ -74,6 +95,13 @@ export class SkillRegistryImpl implements SkillRegistry {
     const nextByName = new Map<string, Skill>();
     for (const s of skills) {
       nextById.set(s.id, s);
+      const priorForName = nextByName.get(s.frontmatter.name);
+      if (priorForName && priorForName.id !== s.id) {
+        this.logger?.warn(
+          'SkillRegistry: two skills share a frontmatter name; last one wins by name',
+          { name: s.frontmatter.name, existingId: priorForName.id, incomingId: s.id },
+        );
+      }
       nextByName.set(s.frontmatter.name, s);
     }
     // Synchronous swap: callers between these lines still see the OLD

package/src/registries/transcribers.test.ts

@@ -67,4 +67,17 @@ describe('TranscriberRegistry', () => {
       expect(r.text).toBe('new');
     });
   });
+
+  it('replacing the ACTIVE def eagerly rebuilds so getActive() never strands (non-buildOnRead)', async () => {
+    const reg = new TranscriberRegistry();
+    reg.register(fake('whisper', 'old'));
+    reg.setActive('whisper');
+    // A hot-reloaded plugin re-registers via replace() WITHOUT calling setActive
+    // again. For a non-buildOnRead registry, getActive() reads the cached
+    // instance directly; dropping it must not leave getActive() throwing.
+    reg.replace(fake('whisper', 'new'));
+    const active = reg.getActive(); // must NOT throw "has no instance"
+    const out = await active.transcribe(new Uint8Array());
+    expect(out.text).toBe('new'); // and it's the NEW def, not the stale one
+  });
 });

package/src/requirements.test.ts

@@ -87,6 +87,41 @@ describe('RequirementRegistry', () => {
     expect(check.issues[0]).toMatchObject({ code: 'not_ready' });
   });
 
+  it('does not report version_mismatch for a non-plugin kind carrying a version', () => {
+    // `version` is only resolvable for the plugin kind. A version on any other
+    // kind used to compare against an always-undefined target.version and emit a
+    // permanent spurious version_mismatch ("(unknown)") even though the target
+    // was present and active.
+    const { requirements, providers } = makeRequirements();
+    providers.register(
+      defineProvider({
+        name: 'openai-codex',
+        models: [],
+        createClient: () => ({ name: 'openai-codex', models: [], stream: async function* () {}, countTokens: async () => 0 }),
+      }),
+    );
+    providers.setActive('openai-codex');
+
+    const check = requirements.check([
+      { kind: 'provider', name: 'openai-codex', state: 'active', version: '1.0.0' },
+    ]);
+
+    expect(check.ready).toBe(true);
+    expect(check.issues).toEqual([]);
+  });
+
+  it('still honors a version mismatch for the plugin kind', () => {
+    const { requirements } = makeRequirements();
+    requirements.registerPlugin('@moxxy/plugin-example', '2.0.0');
+
+    const check = requirements.check([
+      { kind: 'plugin', name: '@moxxy/plugin-example', version: '1.0.0' },
+    ]);
+
+    expect(check.ready).toBe(false);
+    expect(check.issues[0]).toMatchObject({ code: 'version_mismatch' });
+  });
+
   it('isReady checks a single named target without composing per-def requirements', () => {
     const { requirements, transcribers } = makeRequirements();
     transcribers.register(

package/src/requirements.ts

@@ -141,7 +141,13 @@ export class RequirementRegistry {
       return issue(requirement, 'missing', `Required ${label(requirement.kind)} is not registered: ${requirement.name}`);
     }
 
-    if (requirement.version && target.version !== requirement.version) {
+    // `version` is only resolvable for the `plugin` kind (the sole kind whose
+    // `targetInfo` populates a version — see {@link targetInfo}). The SDK type
+    // permits `version` on every kind, so without this gate a `version` on any
+    // non-plugin kind would compare against an always-undefined `target.version`
+    // and report a permanent, spurious `version_mismatch` (target shown as
+    // `(unknown)`) even though the target is present and active.
+    if (requirement.kind === 'plugin' && requirement.version && target.version !== requirement.version) {
       return issue(
         requirement,
         'version_mismatch',

package/src/run-turn.test.ts

@@ -176,3 +176,222 @@ describe('runTurn threads real cwd/env into onToolCall hooks', () => {
     expect(captured.envFoo).toBe(process.env.PATH);
   });
 });
+
+describe('runTurn worst-case hardening', () => {
+  it('aborting iteration early aborts the strategy promptly (no full background run)', async () => {
+    let observedAbort = false;
+    // A mode that loops indefinitely until its signal aborts. If the consumer's
+    // early `break` did NOT abort the turn, this would run forever and the
+    // generator's `finally` would hang awaiting it.
+    const foreverMode = defineMode({
+      name: 'forever',
+      run: async function* (ctx: ModeContext): AsyncIterable<MoxxyEvent> {
+        for (let i = 0; ; i++) {
+          if (ctx.signal.aborted) {
+            observedAbort = true;
+            return;
+          }
+          await ctx.emit({
+            type: 'assistant_message',
+            sessionId: ctx.sessionId,
+            turnId: ctx.turnId,
+            source: 'assistant',
+            text: `tick-${i}`,
+          });
+          await new Promise((r) => setTimeout(r, 5));
+        }
+      },
+    });
+
+    const session = new Session({ cwd: '/tmp', silent: true });
+    session.pluginHost.registerStatic(
+      definePlugin({
+        name: 'forever-plugin',
+        version: '0.0.0',
+        providers: [makeNoopProvider()],
+        modes: [foreverMode],
+      }),
+    );
+    session.providers.setActive('noop');
+    session.modes.setActive('forever');
+
+    // Break out after the first event — the generator must abort the strategy
+    // in its finally and return promptly (this await would never resolve if the
+    // turn ran to its non-existent completion in the background).
+    for await (const event of runTurn(session, 'go')) {
+      if (event.type === 'assistant_message') break;
+    }
+
+    expect(observedAbort).toBe(true);
+    expect(session.signal.aborted).toBe(false); // session-level signal untouched
+  });
+
+  it('an abandoned turn does NOT apply a mode switch it requested before being abandoned', async () => {
+    // A mode that immediately requests a hand-off, then loops until aborted and
+    // returns CLEANLY (no throw) on `signal.aborted` — so strategyError stays
+    // null. If the post-turn switch were gated only on `!strategyError`, an
+    // abandoned (consumer-broke-early) turn would silently flip the session into
+    // 'other' behind the user's back. It must stay on the original mode.
+    const requestThenLoop = defineMode({
+      name: 'requester',
+      run: async function* (ctx: ModeContext): AsyncIterable<MoxxyEvent> {
+        ctx.requestModeSwitch('other');
+        for (let i = 0; ; i++) {
+          if (ctx.signal.aborted) return; // clean return on abandonment
+          await ctx.emit({
+            type: 'assistant_message',
+            sessionId: ctx.sessionId,
+            turnId: ctx.turnId,
+            source: 'assistant',
+            text: `tick-${i}`,
+          });
+          await new Promise((r) => setTimeout(r, 5));
+        }
+      },
+    });
+
+    const session = new Session({ cwd: '/tmp', silent: true });
+    session.pluginHost.registerStatic(
+      definePlugin({
+        name: 'switch-on-abandon',
+        version: '0.0.0',
+        providers: [makeNoopProvider()],
+        modes: [requestThenLoop, defineMode({ name: 'other', run: async function* () {} })],
+      }),
+    );
+    session.providers.setActive('noop');
+    session.modes.setActive('requester');
+
+    // Abandon after the first event — the strategy aborts and returns cleanly.
+    for await (const event of runTurn(session, 'go')) {
+      if (event.type === 'assistant_message') break;
+    }
+
+    // The requested switch must be DROPPED because the turn was abandoned.
+    expect(session.modes.getActive().name).toBe('requester');
+  });
+
+  it('a completed turn still applies a requested mode switch', async () => {
+    // The positive case: a mode that requests a switch and completes normally
+    // hands off as before — the abandonment gate must not regress this.
+    const requestThenDone = defineMode({
+      name: 'handoff',
+      run: async function* (ctx: ModeContext): AsyncIterable<MoxxyEvent> {
+        ctx.requestModeSwitch('target');
+      },
+    });
+    const session = new Session({ cwd: '/tmp', silent: true });
+    session.pluginHost.registerStatic(
+      definePlugin({
+        name: 'switch-on-complete',
+        version: '0.0.0',
+        providers: [makeNoopProvider()],
+        modes: [requestThenDone, defineMode({ name: 'target', run: async function* () {} })],
+      }),
+    );
+    session.providers.setActive('noop');
+    session.modes.setActive('handoff');
+
+    await collectTurn(session, 'go');
+    expect(session.modes.getActive().name).toBe('target');
+  });
+
+  it('fires turnEnd even when the strategy throws (paired with turnStart)', async () => {
+    const calls: string[] = [];
+    const throwingMode = defineMode({
+      name: 'throws',
+      run: async function* (): AsyncIterable<MoxxyEvent> {
+        throw new Error('strategy boom');
+      },
+    });
+
+    const session = new Session({ cwd: '/tmp', silent: true });
+    session.pluginHost.registerStatic(
+      definePlugin({
+        name: 'lifecycle-probe',
+        version: '0.0.0',
+        providers: [makeNoopProvider()],
+        modes: [throwingMode],
+        hooks: {
+          onTurnStart: () => {
+            calls.push('start');
+          },
+          onTurnEnd: () => {
+            calls.push('end');
+          },
+        },
+      }),
+    );
+    session.providers.setActive('noop');
+    session.modes.setActive('throws');
+
+    let threw = false;
+    try {
+      await collectTurn(session, 'go');
+    } catch {
+      threw = true;
+    }
+    expect(threw).toBe(true);
+    // turnEnd must pair with turnStart even on the error path — no leaked
+    // turn-scoped plugin state.
+    expect(calls).toEqual(['start', 'end']);
+  });
+
+  it('a missing active provider records the prompt + a structured error, then rejects', async () => {
+    const session = new Session({ cwd: '/tmp', silent: true });
+    // No provider registered/active — getActive() throws.
+    session.pluginHost.registerStatic(
+      definePlugin({
+        name: 'mode-only',
+        version: '0.0.0',
+        modes: [makeMarkerLoop('marker', 1)],
+      }),
+    );
+    session.modes.setActive('marker');
+
+    let threw = false;
+    try {
+      await collectTurn(session, 'remember me');
+    } catch {
+      threw = true;
+    }
+    expect(threw).toBe(true);
+
+    // The user prompt is preserved (not silently discarded) and a structured
+    // error event was logged so channels see a normal failed turn.
+    const events = session.log.slice();
+    const prompt = events.find((e) => e.type === 'user_prompt');
+    expect((prompt as { text?: string } | undefined)?.text).toBe('remember me');
+    const error = events.find((e) => e.type === 'error');
+    expect(error).toBeDefined();
+    expect((error as { kind?: string }).kind).toBe('fatal');
+  });
+
+  it('a provider advertising no models fails fast (no opaque "default" model id)', async () => {
+    const emptyModelsProvider = defineProvider({
+      name: 'empty',
+      models: [],
+      createClient: () => ({
+        name: 'empty',
+        models: [],
+        stream: async function* () {},
+        countTokens: async () => 0,
+      }),
+    });
+    const session = new Session({ cwd: '/tmp', silent: true });
+    session.pluginHost.registerStatic(
+      definePlugin({
+        name: 'empty-models',
+        version: '0.0.0',
+        providers: [emptyModelsProvider],
+        modes: [makeMarkerLoop('marker', 1)],
+      }),
+    );
+    session.providers.setActive('empty');
+    session.modes.setActive('marker');
+
+    await expect(collectTurn(session, 'go')).rejects.toThrow(/no models configured/i);
+    // lastResolvedModel never gets the bogus sentinel.
+    expect(session.lastResolvedModel).toBeNull();
+  });
+});