@namzu/cli 10.0.0 → 12.0.0

package/dist/tui/agent.js

@@ -20,10 +20,12 @@
  * `emptySession()` whose `send()` yields a single error event so the UI
  * renders an actionable hint rather than crashing.
  */
-import { DiskMemoryStore, DiskTaskStore, ProviderRegistry, SearchToolsTool, ToolRegistry, buildMemoryTools, createMemoryPromoter, getBuiltinTools, query, resumeRun, } from '@namzu/sdk';
+import { BOOT_EVENT_NAMES, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, ProviderRegistry, SearchToolsTool, ToolRegistry, asProjectId, asRunId, asSessionId, asTenantId, asTopicId, buildMemoryTools, createMemoryPromoter, createToolPresenter, genericLabel, getBuiltinTools, getRootLogger, isTrustedReadOnly, query, resumeRun, } from '@namzu/sdk';
 import { join } from 'node:path';
+import { probeCapabilities } from '../context/capabilities.js';
 import { composeEnvironmentPrompt, readEnvironmentFacts } from '../context/environment.js';
 import { loadProjectInstructions } from '../context/project.js';
+import { resolveSandbox, sandboxResolvedSeverity, } from '../context/sandbox.js';
 import { connectMcpServers, } from '../integrations/mcp/servers.js';
 import { PROVIDER_REGISTRY, chainCapabilityDisagreements, chainPositionName, describeAcceptedMismatch, describeCapabilityRefusal, discoverProviders, ensureFreshAnthropicToken, ensureRegistered, findDetected, isAnthropicOAuthToken, isRegistered, missingCredentialMessage, primaryProvider, readPreferences, readSubscriptionCredential, resolveChainCapabilities, unresolvedMembers, unsupportedProviderMessage, } from '../integrations/providers/index.js';
 import { createSubagentRuntime } from '../integrations/subagents/runtime.js';
@@ -185,6 +187,21 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // credential rejection for a provider they never configured.
     const fallbackPlan = planFallbacks(prefs.providers, detected);
     const model = primary.model ?? entry.defaultModel;
+    // One line naming the head and how many declared fallbacks are usable —
+    // `fallbackPlan.notices` already carries WHY each skipped member did (no
+    // credential, unknown id, not registered); this promotes that same
+    // information from a UI notice string to a boot record rather than
+    // computing it a second time.
+    getRootLogger().info('provider chain resolved', {
+        [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.PROVIDER_RESOLVED,
+        'gen_ai.request.model': model,
+        'namzu.provider.id': primary.id,
+        'namzu.provider.chain_length': prefs.providers.length,
+        'namzu.provider.skipped_count': fallbackPlan.notices.length,
+    });
+    for (const notice of fallbackPlan.notices) {
+        getRootLogger().warn(notice, { [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.PROVIDER_RESOLVED });
+    }
     let provider;
     try {
         provider = constructProvider(primary.id, det, model);
@@ -224,8 +241,13 @@ export async function createAgentSession(prefs, detected, options = {}) {
         try {
             provider = constructProvider('anthropic', { ...det, apiKey: fresh }, model);
         }
-        catch {
+        catch (err) {
             // Keep the previous client; the turn may still 401 but won't crash.
+            // Silent until now — a client rebuild failing after a token refresh
+            // had no trace anywhere, so the first sign of it was a live 401 an
+            // operator had no way to connect back to "the refresh happened, the
+            // rebuild didn't."
+            getRootLogger().warn('provider client rebuild after token refresh failed', exceptionAttributes(err));
         }
     };
     // Read ONCE, here, rather than per turn the way memory is.
@@ -238,6 +260,46 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // turn would make the line a surface prints at connect time a claim about
     // the past. An edited file takes effect on the next session.
     const projectInstructions = loadProjectInstructions(cwd);
+    // Before the registry, because a `requireIsolation` this machine cannot
+    // meet throws here — and failing before the session is built is the
+    // difference between "namzu refused to start" and a half-constructed
+    // session reporting a tool error on the first command. Ordering is load
+    // bearing on BOTH sides of this block: `resolveSandbox` stays BEFORE
+    // `buildToolRegistry` below (unchanged), and the emit two statements down
+    // stays strictly AFTER `resolveSandbox` returns — logging "attempting to
+    // resolve the sandbox" ahead of the call would say nothing `resolveSandbox`
+    // itself doesn't already say better, for a narrative that is supposed to
+    // report facts, not attempts.
+    let sandbox;
+    try {
+        sandbox = resolveSandbox(getRootLogger(), options.sandbox);
+    }
+    catch (err) {
+        // The one refusal in this function that does not go through
+        // `emptySession(...)`: `resolveSandbox` THROWS rather than degrading
+        // when `sandbox.requireIsolation` names a control this host cannot
+        // meet (see that function's own doc comment), and a caller half-built
+        // at that point has nothing to return a session FROM. Logged here,
+        // then re-thrown unchanged — `runCli`'s own top-level catch (already
+        // in place, untouched by this change) is what turns the throw into a
+        // non-zero exit; this is only responsible for the record existing
+        // before that happens.
+        getRootLogger().error(err instanceof Error ? err.message : String(err), {
+            [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.BOOT_REFUSED,
+            'namzu.refusal.kind': 'environment',
+        });
+        throw err;
+    }
+    // AFTER resolveSandbox returns — the honest report of what THIS run got,
+    // never what was attempted. `unconfined` decides the severity: per the
+    // design, this is "the single highest-value line in the whole design,
+    // today computed and thrown away" — an operator reading default `info`
+    // output must see it specifically when nothing is enforced, not only
+    // under `--verbose`.
+    getRootLogger()[sandboxResolvedSeverity(sandbox)](sandbox.notice, {
+        [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.SANDBOX_RESOLVED,
+        'namzu.sandbox.unconfined': sandbox.unconfined,
+    });
     const { registry, memoryStore } = buildToolRegistry(cwd);
     // External tool servers, before the roster is counted, so `toolNames` and
     // the `/tools` list a user reads include what they configured. Connecting
@@ -245,6 +307,39 @@ export async function createAgentSession(prefs, detected, options = {}) {
     const mcp = await connectMcpServers(options.mcpServers, { cwd });
     if (mcp.tools.length > 0)
         registry.register([...mcp.tools]);
+    // Connectors are the one discovery source THIS function performs —
+    // plugins and skills are loaded elsewhere (`run-flags.ts`'s
+    // `loadSkillsContext`, per turn) and neither is wired to the boot path
+    // yet, so a fabricated "plugins 0 · skills 0" here would claim a
+    // measurement that was never taken. This reports only what was.
+    getRootLogger().info('discovery complete', {
+        [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.DISCOVERY_COMPLETED,
+        'namzu.discovery.kind': 'connector',
+        'namzu.discovery.count': mcp.connected.length,
+        'namzu.discovery.tool_count': mcp.tools.length,
+        'namzu.discovery.failed_count': mcp.failed.length,
+    });
+    for (const server of mcp.connected) {
+        getRootLogger().debug('connector discovered', {
+            [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.DISCOVERY_COMPLETED,
+            'namzu.discovery.kind': 'connector',
+            'namzu.connector.name': server.name,
+            'namzu.connector.tool_count': server.toolCount,
+        });
+    }
+    for (const server of mcp.failed) {
+        getRootLogger().debug('connector failed to connect', {
+            [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.DISCOVERY_COMPLETED,
+            'namzu.discovery.kind': 'connector',
+            'namzu.connector.name': server.name,
+        });
+    }
+    // Detected once per session, not per capability check an operator might
+    // separately run via `namzu doctor` — same probe, same three-state
+    // answer, so the boot narrative and the doctor report can never disagree
+    // about whether @namzu/sandbox loaded.
+    const capabilities = await probeCapabilities();
+    logCapabilities(capabilities);
     // This session passes a `taskStore` to query() below, which registers the
     // task tools deferred — so `search_tools` has something to find here.
     registry.register([SearchToolsTool]);
@@ -305,7 +400,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             verificationGate: gateFor(options.rules),
             onEvent: (e) => {
                 if (e.type === 'tool_executing') {
-                    childSteps.push(`${e.toolName}(${summarizeToolInput(e.input)})`);
+                    childSteps.push(`${e.toolName}(${genericLabel(e.input)})`);
                 }
             },
         });
@@ -313,8 +408,12 @@ export async function createAgentSession(prefs, detected, options = {}) {
         subagentGateway = sub.gateway;
         allowedAgentIds = sub.allowedAgentIds;
     }
-    catch {
-        // Sub-agents unavailable this session — non-fatal.
+    catch (err) {
+        // Sub-agents unavailable this session — non-fatal: `allowedAgentIds`
+        // stays empty and the chat still works. Silent until now, which was
+        // the wrong kind of non-fatal — an operator who expected delegation
+        // and got none had nothing on stderr to say why.
+        getRootLogger().warn('sub-agent runtime unavailable this session', exceptionAttributes(err));
     }
     // Task store → query registers task_create / task_update / task_list as
     // DEFERRED tools and emits task_created/task_updated, so the agent can track
@@ -330,7 +429,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // changes is that asking again later gets a later answer.
     const taskStore = new DiskTaskStore({
         baseDir: join(cwd, '.namzu'),
-        defaultRunId: 'run_namzu-cli',
+        defaultRunId: asRunId('run_namzu-cli'),
         tenantId: scope.tenantId,
     });
     // Persists across turns: once the user picks "approve all", later tool
@@ -347,6 +446,16 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // settle — is what this repository has been doing all along by accident.
     // A run that learned nothing still writes nothing.
     const promoteMemory = createMemoryPromoter({ store: memoryStore });
+    // The one terminal POSITIVE event on this path, emitted exactly once —
+    // every early return above goes through `emptySession`, which emits
+    // `namzu.boot.refused` instead, and the `resolveSandbox` throw path above
+    // emits its own `boot.refused` and never reaches this line at all. No
+    // boolean readiness field anywhere in the record: systemd's own `READY=1`
+    // has no `READY=0` counterpart, for the same reason — a field that CAN
+    // say "not ready" is a field some unaudited path can wrongly set true.
+    getRootLogger().info('agent session ready', {
+        [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.BOOT_READY,
+    });
     return {
         hasProvider: true,
         providerSummary: entry.label,
@@ -426,7 +535,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 messages,
                 opts,
                 taskGateway: subagentGateway,
+                onRunEvent: options.onRunEvent,
                 childSteps,
+                ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
             });
         },
         resumeDurable: async ({ entry, checkpointStore, claimFence, signal }) => {
@@ -468,6 +579,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 // No `onPermission`: there is nobody at a drainer's terminal, so a
                 // prompt would block the pass forever on a run nobody is watching.
                 // The gate's deny rules still apply.
+                // One presenter for the whole stream, built from the registry this
+                // scope already holds. It was the absence of the registry HERE that
+                // forced presentation to be name matching: `toAgentEvent` was pure
+                // over a `RunEvent` and could not ask a tool anything.
                 resumeHandler: makeResumeHandler(approval, undefined, options.permissionMode, (n, i) => isPromptExempt(registry, n, i)),
                 ...(signal ? { signal } : {}),
                 // Attribution comes from the ENTRY, not from this session: the run
@@ -476,11 +591,11 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 tenantId: entry.tenantId,
                 projectId: entry.projectId,
                 sessionId: entry.sessionId,
-                // …except the thread, which no checkpoint records — see
+                // …except the topic, which no checkpoint records — see
                 // `RunStateScope`. This one is the drainer's, and honestly so:
                 // supplied here rather than pretended to have been recovered.
-                threadId: scope.threadId,
-                scope: { ...entry, threadId: scope.threadId },
+                topicId: scope.topicId,
+                scope: { ...entry, topicId: scope.topicId },
                 checkpointStore,
                 ...(claimFence !== undefined ? { claimFence } : {}),
             });
@@ -686,11 +801,15 @@ export async function listProviderModels(id, det) {
 /** One scope per launched TUI session; runId is minted fresh per turn by the SDK. */
 function mintScope() {
     const suffix = `tui-${Date.now().toString(36)}`;
+    // Through the constructors rather than as four bare template literals.
+    // One suffix shared by four ids is exactly the shape a typo hides in —
+    // `top_` and `tnt_` differ by two characters, and the types accept either
+    // spelling for either field while they are still structural.
     return {
-        sessionId: `ses_${suffix}`,
-        threadId: `thd_${suffix}`,
-        projectId: `prj_${suffix}`,
-        tenantId: `tnt_${suffix}`,
+        sessionId: asSessionId(`ses_${suffix}`),
+        topicId: asTopicId(`top_${suffix}`),
+        projectId: asProjectId(`prj_${suffix}`),
+        tenantId: asTenantId(`tnt_${suffix}`),
     };
 }
 // Pre-execution safety gate: hard-deny catastrophic shell patterns
@@ -730,6 +849,11 @@ function gateFor(rules) {
 // a number here would fix one window across every model the CLI can talk to.
 const COMPACTION_CONFIG = {
     strategy: 'structured',
+    // On, and this is the CLI making a choice rather than taking a default.
+    // A local session's transcript is the only record of what was compacted
+    // away, and `<cwd>/.namzu` is the operator's own disk — the size trade
+    // this costs is theirs to see and theirs to turn off.
+    recordShedHistory: true,
     triggerThreshold: 0.7,
     resetThreshold: 0.4,
     keepRecentMessages: 6,
@@ -753,8 +877,13 @@ const COMPACTION_CONFIG = {
     maxCharsPerRequirement: 300,
     maxCharsPerTask: 400,
 };
-async function* runTurn({ provider, fallbackProviders, model, tools, scope, workingDirectory, rules, permissionMode, reviewAnswer, maxAnswerReviews, promoteMemory, approval, taskStore, systemPrompt, messages, opts, taskGateway, childSteps, }) {
+async function* runTurn({ provider, fallbackProviders, model, tools, scope, workingDirectory, rules, permissionMode, reviewAnswer, maxAnswerReviews, promoteMemory, approval, taskStore, systemPrompt, messages, opts, taskGateway, childSteps, sandboxProvider, onRunEvent, }) {
     const signal = opts?.signal;
+    // One presenter for the whole stream, built from the registry this scope
+    // already holds. Its absence HERE is what forced presentation to be name
+    // matching in the first place: `toAgentEvent` is pure over a `RunEvent`
+    // and could not ask a tool anything, so the host guessed from the name.
+    const presenter = createToolPresenter(tools);
     try {
         const events = query({
             provider,
@@ -769,6 +898,7 @@ async function* runTurn({ provider, fallbackProviders, model, tools, scope, work
             // empty array, so passing it here discarded the operator's rules on the
             // path that runs every top-level turn. The sub-agent path called
             // `gateFor` and this one did not.
+            ...(sandboxProvider ? { sandboxProvider } : {}),
             verificationGate: gateFor(rules),
             compactionConfig: COMPACTION_CONFIG,
             // The CLI owns its process end to end, so it can safely hand the
@@ -801,16 +931,22 @@ async function* runTurn({ provider, fallbackProviders, model, tools, scope, work
             // The exemption reads `tools` at decision time, so it sees the task
             // tools `query()` registers deferred below and any tool server that
             // connected after this session was built.
-            resumeHandler: makeResumeHandler(approval, opts?.onPermission, permissionMode, (name, input) => isPromptExempt(tools, name, input)),
+            resumeHandler: makeResumeHandler(approval, opts?.onPermission, permissionMode, (name, input) => isPromptExempt(tools, name, input), presenter),
             signal,
             ...scope,
         });
         for await (const event of events) {
+            // Before the abort check and before `toAgentEvent`: a session
+            // cancelled mid-turn still produced the events up to that point, and
+            // they are the interesting ones. Every event, not just the ones the
+            // TUI renders — an export that only saw what the screen showed would
+            // be a recording of the interface rather than of the session.
+            onRunEvent?.(event);
             if (signal?.aborted) {
                 yield { kind: 'error', message: 'aborted' };
                 return;
             }
-            const mapped = toAgentEvent(event);
+            const mapped = toAgentEvent(event, presenter);
             if (!mapped)
                 continue;
             // On an `Agent` delegation finishing, attach the sub-agent's tool
@@ -849,7 +985,14 @@ export function makeResumeHandler(approval, onPermission, mode = onPermission ?
  * handler stays testable without a registry — and so the answer comes from
  * the live roster at the moment of the call.
  */
-exempt = () => false) {
+exempt = () => false, 
+/**
+ * How a prompted call is described. Injected for the same reason
+ * `exempt` is — this handler is unit-tested without a registry — and
+ * defaulted to the generic view so a caller that has no registry still
+ * gets the label the tool's arguments imply, rather than nothing.
+ */
+presenter = GENERIC_PRESENTER) {
     return async (request) => {
         if (request.type !== 'tool_review') {
             return request.type === 'plan_approval' ? { action: 'approve_plan' } : { action: 'continue' };
@@ -875,9 +1018,11 @@ exempt = () => false) {
             toolCalls: request.toolCalls.map((tc) => ({
                 id: tc.id,
                 name: tc.name,
-                summary: summarizeToolInput(tc.input),
+                ...(() => {
+                    const view = presenter.presentCall(tc.name, tc.input);
+                    return { summary: viewToSummary(view), preview: viewToPreview(view) };
+                })(),
                 isDestructive: tc.isDestructive,
-                preview: previewToolInput(tc.name, tc.input),
             })),
         });
         switch (decision.kind) {
@@ -949,7 +1094,11 @@ export function isPromptExempt(registry, name, input) {
     if (PROMPT_EXEMPT_WRITES.has(name.toLowerCase()))
         return true;
     const tool = registry.get(name) ?? registry.get(name.toLowerCase());
-    return tool?.isReadOnly?.(input) ?? false;
+    // A connected server's own claim about its own tool cannot skip the
+    // prompt. Same predicate the kernel gate and plan mode use -- three
+    // doors, one rule, because fixing two would close the issue and leave
+    // the boundary open.
+    return isTrustedReadOnly(tool, input);
 }
 /** The exempt roster, sorted, for the surface that has to NAME it. */
 export function promptExemptToolNames(registry) {
@@ -971,17 +1120,24 @@ export function batchNeedsPrompt(toolCalls, exempt) {
  * `null` for events the chat surface doesn't render (iteration markers,
  * token usage, checkpoints, plan/task lifecycle, …). Pure — unit-tested.
  */
-export function toAgentEvent(event) {
+export function toAgentEvent(event, presenter) {
     switch (event.type) {
         case 'text_delta':
-            return { kind: 'delta', text: event.text };
+            return {
+                kind: 'delta',
+                text: event.text,
+                ...(event.messageId ? { messageId: event.messageId } : {}),
+                ...(event.runId ? { runId: event.runId } : {}),
+            };
         case 'tool_executing':
             return {
                 kind: 'tool-start',
                 toolUseId: event.toolUseId,
                 toolName: event.toolName,
-                summary: summarizeToolInput(event.input),
-                detail: toolStartDetail(event.toolName, event.input),
+                ...(() => {
+                    const view = presenter.presentCall(event.toolName, event.input);
+                    return { summary: viewToSummary(view), detail: viewToLines(view) };
+                })(),
             };
         case 'tool_completed':
             return {
@@ -990,7 +1146,16 @@ export function toAgentEvent(event) {
                 toolName: event.toolName,
                 isError: event.isError,
                 summary: firstLine(event.result),
-                detail: toolEndDetail(event.toolName, event.result),
+                // `tool_completed` carries no input, so the presenter gets an
+                // empty one. A tool whose result rendering depends on its
+                // arguments would need the executing event's input threaded
+                // through; none does yet, and inventing the plumbing for a
+                // caller that does not exist is the declaration this repo
+                // keeps deleting.
+                detail: viewToLines(presenter.presentResult(event.toolName, {}, {
+                    success: !event.isError,
+                    output: event.result,
+                })),
             };
         case 'token_usage_updated':
             // The context figures are forwarded, not recomputed. They were
@@ -1041,6 +1206,18 @@ export function toAgentEvent(event) {
             };
         case 'compaction_completed':
             return { kind: 'context', text: describeCompaction(event), shed: true };
+        case 'compaction_tool_results_cleared':
+            // `shed: true` on both branches: the tool-result bodies are gone
+            // either way. `reliefWasEnough: false` additionally means a
+            // summarization followed, and the reader will see its own line —
+            // so this one says what IT cost rather than claiming the total.
+            return {
+                kind: 'context',
+                text: `cleared ${event.clearedCount} oversized tool result${event.clearedCount === 1 ? '' : 's'}` +
+                    ` (~${event.reclaimedTokens.toLocaleString()} tokens)` +
+                    (event.reliefWasEnough ? '' : ' — not enough, compacting'),
+                shed: true,
+            };
         case 'compaction_failed':
             return { kind: 'context', text: describeCompactionFailure(event), shed: false };
         default:
@@ -1136,65 +1313,97 @@ function asTree(steps) {
     return steps.map((s, i) => `${i === steps.length - 1 ? '└─' : '├─'} ${s}`);
 }
 /** Short, human-readable one-liner for a tool call (e.g. `ls -la`, path). */
-function summarizeToolInput(input) {
-    if (input && typeof input === 'object') {
-        const obj = input;
-        const pick = (k) => (typeof obj[k] === 'string' ? obj[k] : undefined);
-        const primary = pick('command') ??
-            pick('path') ??
-            pick('file_path') ??
-            pick('pattern') ??
-            pick('query') ??
-            // Last, so it only speaks for a tool none of the above describe.
-            // Those tools were falling through to a truncated `JSON.stringify`
-            // — which is how `Agent` came to show a blob of its own arguments
-            // while requiring the model to write a label nothing then read.
-            // Every input named `description` in this tree is a short
-            // human-facing label, so it is a summary by construction.
-            pick('description');
-        if (primary)
-            return truncate(primary, 120);
+/**
+ * The presenter a caller with no registry gets.
+ *
+ * `makeResumeHandler` is unit-tested without one, and a handler that
+ * described every prompted call as an empty string would make those tests
+ * pass while telling a real user nothing. This is the same fallback the
+ * registry-backed presenter uses when a tool has no opinion, which is what
+ * the four deleted functions did for every tool.
+ */
+const GENERIC_PRESENTER = {
+    presentCall: (_name, input) => ({ kind: 'generic', label: genericLabel(input) }),
+    presentResult: (_name, _input, result) => ({ kind: 'terminal', output: result.output ?? '' }),
+};
+/**
+ * The one presentation function this host keeps.
+ *
+ * There used to be four, and each switched on a lowercased tool NAME:
+ * `name === 'write'` and `name === 'edit'` got a diff, everything else got
+ * a truncated string. So a tool this host had never heard of — an MCP
+ * server's, a plugin's — could not get a diff no matter what it did.
+ *
+ * The tool now says which of three shapes it wants, and this decides what
+ * that looks like in a terminal. Clamping and the `STDOUT:`/`STDERR:`
+ * cleanup stay here on purpose: how many rows fit and how a shell labels
+ * its streams are properties of this surface, not of the tool.
+ */
+export function viewToLines(view) {
+    switch (view.kind) {
+        case 'generic':
+            // The label IS the summary row. Repeating it underneath adds a
+            // line that says what the line above it already said.
+            return undefined;
+        case 'diff': {
+            // An empty `before` is a whole-file write, not a patch: there is
+            // nothing to contrast against, so the content reads plainly. `edit`
+            // never produces this — it returns no view at all for an insert,
+            // rather than claim the file was empty.
+            if (view.before === '') {
+                const lines = clampLines(view.after);
+                return lines.length > 0 ? lines : undefined;
+            }
+            const lines = [];
+            for (const line of clampLines(view.before))
+                lines.push(`- ${line}`);
+            for (const line of clampLines(view.after))
+                lines.push(`+ ${line}`);
+            return lines.length > 0 ? lines : undefined;
+        }
+        case 'terminal': {
+            if (view.output.trim().length === 0)
+                return undefined;
+            const lines = resultToLines(view.output);
+            // A single short line is already the summary — no need to repeat it.
+            return lines.length <= 1 ? undefined : lines;
+        }
     }
-    if (typeof input === 'string')
-        return truncate(input, 120);
-    return truncate(JSON.stringify(input ?? {}), 120);
 }
-function truncate(value, max) {
-    const oneLine = value.replace(/\s+/g, ' ');
-    return oneLine.length > max ? `${oneLine.slice(0, max - 1)}…` : oneLine;
+/** The `⏺` row: one line naming what the call is about. */
+export function viewToSummary(view) {
+    switch (view.kind) {
+        case 'generic':
+            return truncate(view.label, 120);
+        case 'diff':
+            return truncate(view.path ?? view.after.split('\n')[0] ?? '', 120);
+        case 'terminal':
+            return truncate(view.command ?? view.output.split('\n')[0] ?? '', 120);
+    }
 }
 /**
- * Multi-line preview of a mutating tool's effect, shown in the permission
- * overlay so the user approves with sight of what changes. `write` shows
- * the leading content lines; `edit` shows a minimal -old / +new diff;
- * everything else has no preview (the one-line summary suffices). Pure —
- * unit-tested.
+ * The permission overlay's preview: the same shapes, cut shorter.
+ *
+ * A user approving a call needs enough to recognise it, not the whole
+ * file — the transcript shows that once it has run.
  */
-export function previewToolInput(toolName, input) {
-    if (!input || typeof input !== 'object')
+export function viewToPreview(view) {
+    if (view.kind !== 'diff')
         return undefined;
-    const obj = input;
-    const str = (k) => (typeof obj[k] === 'string' ? obj[k] : undefined);
-    const name = toolName.toLowerCase();
-    if (name === 'write') {
-        const content = str('content');
-        if (content !== undefined)
-            return previewLines(content, 8);
-    }
-    if (name === 'edit') {
-        const oldString = str('old_string');
-        const newString = str('new_string');
-        const lines = [];
-        if (oldString)
-            for (const line of previewLines(oldString, 4))
-                lines.push(`- ${line}`);
-        if (newString)
-            for (const line of previewLines(newString, 4))
-                lines.push(`+ ${line}`);
-        if (lines.length > 0)
-            return lines;
+    if (view.before === '') {
+        const lines = previewLines(view.after, 8);
+        return lines.length > 0 ? lines : undefined;
     }
-    return undefined;
+    const lines = [];
+    for (const line of previewLines(view.before, 4))
+        lines.push(`- ${line}`);
+    for (const line of previewLines(view.after, 4))
+        lines.push(`+ ${line}`);
+    return lines.length > 0 ? lines : undefined;
+}
+function truncate(value, max) {
+    const oneLine = value.replace(/\s+/g, ' ');
+    return oneLine.length > max ? `${oneLine.slice(0, max - 1)}…` : oneLine;
 }
 function previewLines(value, max) {
     const lines = value.split('\n');
@@ -1208,35 +1417,6 @@ function clampLines(value) {
     const lines = value.replace(/\s+$/, '').split('\n');
     return lines.length > MAX_DETAIL_LINES ? lines.slice(0, MAX_DETAIL_LINES) : lines;
 }
-/**
- * Diff / content shown under a tool CALL (`⏺`): an `edit` renders a
- * `- old` / `+ new` diff, a `write` renders the content. Other tools show
- * nothing at call time (their output appears under the result instead).
- */
-export function toolStartDetail(toolName, input) {
-    if (!input || typeof input !== 'object')
-        return undefined;
-    const obj = input;
-    const str = (k) => (typeof obj[k] === 'string' ? obj[k] : undefined);
-    const name = toolName.toLowerCase();
-    if (name === 'write') {
-        const content = str('content');
-        return content !== undefined ? clampLines(content) : undefined;
-    }
-    if (name === 'edit') {
-        const oldString = str('old_string');
-        const newString = str('new_string');
-        const lines = [];
-        if (oldString)
-            for (const line of clampLines(oldString))
-                lines.push(`- ${line}`);
-        if (newString)
-            for (const line of clampLines(newString))
-                lines.push(`+ ${line}`);
-        return lines.length > 0 ? lines : undefined;
-    }
-    return undefined;
-}
 /** Parse a string as a JSON object, or null. Connector tools return JSON. */
 function parseJsonObject(s) {
     const t = s.trim();
@@ -1283,22 +1463,6 @@ function resultToLines(result) {
         return clampLines(JSON.stringify(obj, null, 2));
     return clampLines(cleanToolText(result.trim()));
 }
-/**
- * Output shown under a tool RESULT (`⎿`). For `edit`/`write` the diff was
- * already shown at call time, so the result stays a one-line confirmation;
- * every other tool (read/bash/grep/…) shows its captured output here — JSON
- * results are pretty-printed / unwrapped so they don't read as a raw blob.
- */
-export function toolEndDetail(toolName, result) {
-    const name = toolName.toLowerCase();
-    if (name === 'edit' || name === 'write')
-        return undefined;
-    if (result.trim().length === 0)
-        return undefined;
-    const lines = resultToLines(result);
-    // A single short line is already the summary — no need to repeat it.
-    return lines.length <= 1 ? undefined : lines;
-}
 /** Concise one-line summary of a tool result for the `⎿` line. */
 function firstLine(result) {
     const payload = payloadString(result);
@@ -1317,7 +1481,58 @@ function firstLine(result) {
     const cleaned = cleanToolText(result.trim());
     return truncate(cleaned.split('\n').find((l) => l.trim().length > 0) ?? '', 120);
 }
+function exceptionAttributes(err) {
+    const error = err instanceof Error ? err : new Error(String(err));
+    return {
+        'exception.type': error.constructor?.name ?? 'Error',
+        'exception.message': error.message,
+    };
+}
+/**
+ * `namzu.capability.detected` per package at `debug`, one aggregate summary
+ * at `info` (the design's §6.3 `capability sandbox yes · files yes · …`
+ * line), and `namzu.capability.broken` at `error` for any package that
+ * resolved and failed to load. Never refuses the boot: nothing in
+ * `NamzuCliConfig` marks a capability required yet, so `broken` here is
+ * always the "not required by config" case §6.5 describes — an optional
+ * capability's failure degrades what this line SAYS, never whether
+ * `namzu.boot.ready` fires.
+ */
+function logCapabilities(probes) {
+    const log = getRootLogger();
+    const summary = probes
+        .map((p) => `${p.specifier.split('/').pop()} ${p.state === 'present' ? 'yes' : 'no'}`)
+        .join(' · ');
+    log.info(summary, { [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.CAPABILITY_DETECTED });
+    for (const probe of probes) {
+        if (probe.state === 'broken') {
+            log.error('Capability probe failed to load', {
+                [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.CAPABILITY_BROKEN,
+                'namzu.capability.name': probe.specifier,
+                ...exceptionAttributes(probe.error),
+            });
+            continue;
+        }
+        log.debug('Capability probe completed', {
+            [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.CAPABILITY_DETECTED,
+            'namzu.capability.name': probe.specifier,
+            'namzu.capability.state': probe.state,
+            'namzu.capability.present': probe.state === 'present',
+            ...(probe.state === 'present' ? { 'namzu.capability.version': probe.version } : {}),
+        });
+    }
+}
 function emptySession(errorHint, errorKind = 'environment') {
+    // Every path into this function is a boot refusal — `createAgentSession`
+    // is the whole extent of the session-construction half of the boot
+    // narrative, and every one of its early returns comes through here. One
+    // emission point instead of five call-site ones is what keeps that true
+    // instead of "true until the sixth `emptySession(...)` someone adds
+    // forgets it."
+    getRootLogger().error(errorHint, {
+        [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.BOOT_REFUSED,
+        'namzu.refusal.kind': errorKind,
+    });
     return {
         hasProvider: false,
         errorKind,