@namzu/cli 12.1.0 → 14.0.0

package/dist/tui/agent.js

@@ -20,17 +20,214 @@
  * `emptySession()` whose `send()` yields a single error event so the UI
  * renders an actionable hint rather than crashing.
  */
-import { BOOT_EVENT_NAMES, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, ProviderRegistry, SearchToolsTool, ToolRegistry, asProjectId, asRunId, asSessionId, asTenantId, asTopicId, buildMemoryTools, createMemoryPromoter, createToolPresenter, genericLabel, getBuiltinTools, isTrustedReadOnly, query, resumeRun, } from '@namzu/sdk';
+import { BOOT_EVENT_NAMES, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, SearchToolsTool, ToolRegistry, asProjectId, asRunId, asSessionId, asTenantId, asTopicId, buildMemoryTools, buildSessionGoalTools, compactNow, createMemoryPromoter, createToolPresenter, genericLabel, getBuiltinTools, isTrustedReadOnly, query, resumeRun, withProviderFallback, } from '@namzu/sdk';
 import { join } from 'node:path';
 import { probeCapabilities } from '../context/capabilities.js';
 import { composeEnvironmentPrompt, readEnvironmentFacts } from '../context/environment.js';
-import { loadProjectInstructions } from '../context/project.js';
+import { ProjectInstructionTracker } from '../context/project-tracker.js';
 import { resolveSandbox, sandboxResolvedSeverity, } from '../context/sandbox.js';
 import { connectMcpServers, } from '../integrations/mcp/servers.js';
-import { PROVIDER_REGISTRY, chainCapabilityDisagreements, chainPositionName, describeAcceptedMismatch, describeCapabilityRefusal, discoverProviders, ensureFreshAnthropicToken, ensureRegistered, findDetected, isAnthropicOAuthToken, isRegistered, missingCredentialMessage, primaryProvider, readPreferences, readSubscriptionCredential, resolveChainCapabilities, unresolvedMembers, unsupportedProviderMessage, } from '../integrations/providers/index.js';
+import { createCliPluginRuntime } from '../integrations/plugins/runtime.js';
+import { CredentialRefreshRejectedError, CredentialWithdrawnError, PROVIDER_REGISTRY, chainCapabilityDisagreements, chainPositionName, describeAcceptedMismatch, describeCapabilityRefusal, discoverProviders, ensureFreshAnthropicToken, ensureFreshStoredCodexCredential, ensureRegistered, findDetected, isAnthropicOAuthToken, isRegistered, missingCredentialMessage, primaryProvider, readCodexCredentialFile, readPreferences, readSubscriptionCredential, resolveChainCapabilities, sameOAuthCredential, unresolvedMembers, unsupportedProviderMessage, } from '../integrations/providers/index.js';
 import { createSubagentRuntime } from '../integrations/subagents/runtime.js';
 import { cliLogger } from '../logging.js';
 import { composeMemoryPrompt, readMemory } from '../memory/store.js';
+import { projectRunConversation } from './conversation-history.js';
+/**
+ * Let one caller stop waiting without cutting a shared queue in the middle.
+ *
+ * The queued operation remains chained and owns its own signal. This observer
+ * only settles the caller promptly; releasing a queue slot here would allow a
+ * later owner to overlap the operation still ahead of it.
+ */
+async function observeWithSignal(operation, signal) {
+    signal.throwIfAborted();
+    let rejectAbort = () => { };
+    const aborted = new Promise((_resolve, reject) => {
+        rejectAbort = reject;
+    });
+    const onAbort = () => rejectAbort(signal.reason);
+    signal.addEventListener('abort', onAbort, { once: true });
+    if (signal.aborted)
+        onAbort();
+    try {
+        return await Promise.race([operation, aborted]);
+    }
+    finally {
+        signal.removeEventListener('abort', onAbort);
+    }
+}
+/**
+ * Own every asynchronous operation that can still touch a session resource.
+ *
+ * A caller-owned signal remains caller-owned: closing the session aborts the
+ * fused operation signal, never the controller the caller passed. Streams are
+ * registered when handed out rather than when first pulled, so a consumer that
+ * abandons one between yields cannot leave the session's provider/tool owners
+ * alive past `close()`.
+ */
+export class SessionOperationOwner {
+    cleanup;
+    lifetime = new AbortController();
+    active = new Set();
+    streamClosers = new Set();
+    closeReason = new DOMException('Agent session closed.', 'AbortError');
+    closed = false;
+    closePromise;
+    constructor(cleanup) {
+        this.cleanup = cleanup;
+    }
+    promise(callerSignal, start) {
+        let signal;
+        try {
+            signal = this.operationSignal(callerSignal);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        const operation = Promise.resolve().then(() => {
+            signal.throwIfAborted();
+            return start(signal);
+        });
+        this.track(operation);
+        return operation;
+    }
+    stream(callerSignal, start) {
+        let signal;
+        try {
+            signal = this.operationSignal(callerSignal);
+        }
+        catch (error) {
+            return {
+                [Symbol.asyncIterator]() {
+                    return {
+                        next: () => Promise.reject(error),
+                    };
+                },
+            };
+        }
+        const source = (async function* () {
+            signal.throwIfAborted();
+            yield* start(signal);
+        })()[Symbol.asyncIterator]();
+        let settled = false;
+        let settle;
+        const settlement = new Promise((resolve) => {
+            settle = resolve;
+        });
+        let operationTail = Promise.resolve();
+        let returnStarted = false;
+        let closeStreamPromise;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            this.streamClosers.delete(closeStream);
+            settle();
+        };
+        const enqueue = (operation) => {
+            const result = operationTail.then(operation);
+            operationTail = result.then(() => { }, () => { });
+            return result;
+        };
+        const observe = async (operation) => {
+            try {
+                const result = await enqueue(operation);
+                if (result.done)
+                    finish();
+                return result;
+            }
+            catch (error) {
+                finish();
+                throw error;
+            }
+        };
+        const requestReturn = (value) => {
+            return observe(async () => {
+                returnStarted = true;
+                return source.return
+                    ? await source.return(value)
+                    : { done: true, value };
+            });
+        };
+        const closeStream = () => {
+            if (closeStreamPromise)
+                return closeStreamPromise;
+            closeStreamPromise = (async () => {
+                try {
+                    await enqueue(async () => {
+                        if (settled)
+                            return;
+                        let result;
+                        if (returnStarted) {
+                            result = await source.next();
+                        }
+                        else if (source.return) {
+                            returnStarted = true;
+                            result = await source.return(undefined);
+                        }
+                        else {
+                            return;
+                        }
+                        while (!result.done)
+                            result = await source.next();
+                    });
+                }
+                finally {
+                    finish();
+                }
+            })();
+            return closeStreamPromise;
+        };
+        const managed = {
+            next: (value) => observe(() => source.next(value)),
+            return: requestReturn,
+            throw: (error) => observe(async () => {
+                if (source.throw)
+                    return await source.throw(error);
+                throw error;
+            }),
+            [Symbol.asyncIterator]() {
+                return this;
+            },
+        };
+        this.streamClosers.add(closeStream);
+        this.track(settlement);
+        return managed;
+    }
+    close() {
+        if (this.closePromise)
+            return this.closePromise;
+        this.closed = true;
+        this.lifetime.abort(this.closeReason);
+        this.closePromise = this.finishClose();
+        return this.closePromise;
+    }
+    operationSignal(callerSignal) {
+        if (this.closed)
+            throw this.closeReason;
+        return callerSignal
+            ? AbortSignal.any([callerSignal, this.lifetime.signal])
+            : this.lifetime.signal;
+    }
+    track(operation) {
+        const settlement = Promise.resolve(operation).then(() => { }, () => { });
+        this.active.add(settlement);
+        void settlement.then(() => this.active.delete(settlement));
+    }
+    async finishClose() {
+        await Promise.allSettled([...this.streamClosers].map((close) => close()));
+        await Promise.allSettled([...this.active]);
+        await this.cleanup();
+    }
+}
+async function drainIterator(iterator) {
+    if (!iterator.return)
+        return;
+    let result = await iterator.return(undefined);
+    while (!result.done)
+        result = await iterator.next();
+}
 /**
  * Read preferences + run discovery once. Returned context drives the
  * App's lifecycle decision: ready / picker / unhealthy.
@@ -47,7 +244,12 @@ export async function probeAgentSession() {
                 credentialGap: credentialGap(read.prefs, detected),
             };
         case 'missing':
-            return { preferences: null, needsRepickReason: null, detected, credentialGap: null };
+            return {
+                preferences: null,
+                needsRepickReason: null,
+                detected,
+                credentialGap: null,
+            };
         case 'needs-repick':
             return {
                 preferences: null,
@@ -124,7 +326,10 @@ function buildToolRegistry(cwd) {
     // why it sat on the no-prompt list; it writes into the user's project.
     // Separate from the user-curated MEMORY.md that is injected into the prompt.
     const memoryStore = new DiskMemoryStore({ baseDir: join(cwd, '.namzu') });
-    registry.register(buildMemoryTools(memoryStore, memoryStore.getIndex()));
+    // Search through the store's async boundary. Its concrete index is lazy:
+    // handing `getIndex()` to the synchronous overload before the first store
+    // read makes a new process report every persisted memory as absent.
+    registry.register(buildMemoryTools(memoryStore));
     // `search_tools` is deliberately NOT registered here. It is only useful
     // where deferred tools exist, and that differs between this function's two
     // callers: the session below passes a `taskStore`, so query() registers the
@@ -135,6 +340,13 @@ function buildToolRegistry(cwd) {
     // caller's decision, made where the roster is known.
     return { registry, memoryStore };
 }
+/** Refresh plugin skill metadata before each provider operation. */
+async function currentPluginSkills(registry) {
+    const names = registry.list().map((skill) => skill.metadata.name);
+    for (const name of names)
+        await registry.load(name, 'metadata');
+    return registry.list();
+}
 export async function createAgentSession(prefs, detected, options = {}) {
     const scope = options.scope ?? mintScope();
     const cwd = options.cwd ?? process.cwd();
@@ -201,7 +413,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
         'namzu.provider.skipped_count': fallbackPlan.notices.length,
     });
     for (const notice of fallbackPlan.notices) {
-        cliLogger().warn(notice, { [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.PROVIDER_RESOLVED });
+        cliLogger().warn(notice, {
+            [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.PROVIDER_RESOLVED,
+        });
     }
     let provider;
     try {
@@ -218,29 +432,70 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // changed. Gated on `det.oauth` so env / secrets credentials are never
     // touched.
     //
-    // `origin` decides WHICH store, and travels with the credential from
-    // discovery rather than being assumed here: namzu's own store and the
-    // borrowed Keychain entry both produce a refreshable credential, and reading
-    // one while writing the other would refresh forever without ever landing.
-    const subscriptionRefresh = primary.id === 'anthropic' && Boolean(det?.oauth);
+    // `origin` decides WHICH publication rule applies, and travels with the
+    // credential from discovery rather than being assumed here: namzu's own
+    // store can be conditionally replaced; the borrowed Keychain entry is
+    // read-only and a refreshed value may live only in this session.
+    const subscriptionRefresh = primary.id === 'anthropic' && det?.oauth?.origin === 'stored';
+    const borrowedAnthropic = primary.id === 'anthropic' &&
+        (det?.oauth?.origin === 'claude-file' || det?.oauth?.origin === 'keychain');
+    const borrowedCodexPath = primary.id === 'codex' && det?.source.kind === 'codex-file' ? det.source.path : undefined;
+    const storedCodex = primary.id === 'codex' && det?.codex?.origin === 'stored';
     const credentialOrigin = det?.oauth?.origin ?? 'keychain';
     let currentToken = det?.apiKey;
-    const refreshTokenIfNeeded = async () => {
-        if (!subscriptionRefresh)
-            return;
+    let currentCodexAccount = det?.codex?.accountId;
+    let credentialTail = Promise.resolve();
+    let rejectedRefresh;
+    const performRefresh = async (signal) => {
+        signal?.throwIfAborted();
+        // Read only after this owner reaches the head. A sibling may have rotated
+        // the durable credential while we waited; reading before the queue would
+        // make its success invisible and permit a stale-token downgrade.
         const cred = readSubscriptionCredential(credentialOrigin);
+        // This store is the authority for the whole session. Its absence is a
+        // credential withdrawal, not permission to keep using the client object
+        // that happens to remain in memory after logout or another process's clear.
         if (!cred)
-            return;
-        const fresh = await ensureFreshAnthropicToken(cred.accessToken, {
-            refreshToken: cred.refreshToken,
-            expiresAt: cred.expiresAt,
-            origin: credentialOrigin,
-        });
+            throw new CredentialWithdrawnError();
+        if (rejectedRefresh && sameOAuthCredential(rejectedRefresh.credential, cred)) {
+            throw rejectedRefresh.error;
+        }
+        // A different non-null credential is an external winner (usually a fresh
+        // login). The old grant's refusal says nothing about this one.
+        rejectedRefresh = undefined;
+        let fresh;
+        try {
+            fresh = await ensureFreshAnthropicToken(cred.accessToken, {
+                refreshToken: cred.refreshToken,
+                expiresAt: cred.expiresAt,
+                scopes: cred.scopes,
+                origin: credentialOrigin,
+            }, signal);
+        }
+        catch (error) {
+            if (error instanceof CredentialRefreshRejectedError) {
+                // Cache only if the same credential is still authoritative after the
+                // network wait. A concurrent login must not inherit the old grant's
+                // permanent classification.
+                signal?.throwIfAborted();
+                const current = readSubscriptionCredential(credentialOrigin);
+                if (!current)
+                    throw new CredentialWithdrawnError();
+                if (sameOAuthCredential(current, cred)) {
+                    rejectedRefresh = { credential: cred, error };
+                }
+            }
+            throw error;
+        }
+        signal?.throwIfAborted();
         if (fresh === currentToken)
             return;
-        currentToken = fresh;
         try {
-            provider = constructProvider('anthropic', { ...det, apiKey: fresh }, model);
+            const refreshedProvider = constructProvider('anthropic', { ...det, apiKey: fresh }, model);
+            // Publish the pair together. If construction fails, both old values
+            // remain live and the next operation can retry against the stored token.
+            provider = refreshedProvider;
+            currentToken = fresh;
         }
         catch (err) {
             // Keep the previous client; the turn may still 401 but won't crash.
@@ -251,16 +506,93 @@ export async function createAgentSession(prefs, detected, options = {}) {
             cliLogger().warn('provider client rebuild after token refresh failed', exceptionAttributes(err));
         }
     };
-    // Read ONCE, here, rather than per turn the way memory is.
-    //
-    // Memory is re-read every turn because `/remember` writes to it mid-session,
-    // so a stale read would drop a fact the user just saved. Nothing in namzu
-    // writes an instructions file, and reading once buys a property worth more
-    // than the freshness: `instructionFiles` is then exactly the set whose text
-    // went into the prompt, for the whole life of the session. Re-reading per
-    // turn would make the line a surface prints at connect time a claim about
-    // the past. An edited file takes effect on the next session.
-    const projectInstructions = loadProjectInstructions(cwd);
+    const rereadBorrowedCodex = (signal) => {
+        signal?.throwIfAborted();
+        if (!borrowedCodexPath)
+            return;
+        const credential = readCodexCredentialFile(borrowedCodexPath);
+        if (!credential) {
+            throw new CredentialWithdrawnError('The Codex session Namzu borrowed is no longer available. Run `codex login` or choose another provider.');
+        }
+        if (credential.expiresAt !== undefined && credential.expiresAt - Date.now() <= 60_000) {
+            throw new CredentialWithdrawnError('The Codex session on this device has expired. Run `codex login` to let its owner refresh the session, then retry in Namzu.');
+        }
+        if (credential.accessToken === currentToken && credential.accountId === currentCodexAccount) {
+            return;
+        }
+        const refreshedProvider = constructProvider('codex', {
+            ...det,
+            apiKey: credential.accessToken,
+            codex: {
+                accountId: credential.accountId,
+                expiresAt: credential.expiresAt,
+                origin: 'codex-file',
+            },
+        }, model);
+        provider = refreshedProvider;
+        currentToken = credential.accessToken;
+        currentCodexAccount = credential.accountId;
+    };
+    const rereadBorrowedAnthropic = (signal) => {
+        signal?.throwIfAborted();
+        if (!borrowedAnthropic)
+            return;
+        const credential = readSubscriptionCredential(credentialOrigin);
+        if (!credential) {
+            throw new CredentialWithdrawnError('The Claude session Namzu borrowed is no longer available. Run `claude login` or choose another provider.');
+        }
+        if (credential.expiresAt !== undefined && credential.expiresAt - Date.now() <= 60_000) {
+            throw new CredentialWithdrawnError('The Claude session on this device has expired. Run `claude login` to let its owner refresh the session, then retry in Namzu.');
+        }
+        if (credential.accessToken === currentToken)
+            return;
+        provider = constructProvider('anthropic', { ...det, apiKey: credential.accessToken }, model);
+        currentToken = credential.accessToken;
+    };
+    const refreshStoredCodex = async (signal) => {
+        const credential = await ensureFreshStoredCodexCredential(signal);
+        if (credential.accessToken === currentToken && credential.accountId === currentCodexAccount) {
+            return;
+        }
+        const refreshedProvider = constructProvider('codex', {
+            ...det,
+            apiKey: credential.accessToken,
+            codex: {
+                accountId: credential.accountId,
+                expiresAt: credential.expiresAt,
+                origin: 'stored',
+            },
+        }, model);
+        provider = refreshedProvider;
+        currentToken = credential.accessToken;
+        currentCodexAccount = credential.accountId;
+    };
+    const prepareProviderCredential = (signal) => {
+        if (!subscriptionRefresh && !borrowedAnthropic && !borrowedCodexPath && !storedCodex) {
+            signal?.throwIfAborted();
+            return Promise.resolve();
+        }
+        signal?.throwIfAborted();
+        const queued = credentialTail.then(async () => {
+            if (subscriptionRefresh)
+                await performRefresh(signal);
+            else if (borrowedAnthropic)
+                rereadBorrowedAnthropic(signal);
+            else if (storedCodex)
+                await refreshStoredCodex(signal);
+            else
+                rereadBorrowedCodex(signal);
+        });
+        // Keep later owners behind this slot even if its caller stops observing it.
+        // The catch makes the private tail non-rejecting without changing the
+        // exact outcome returned to the owner below.
+        credentialTail = queued.catch(() => { });
+        return signal ? observeWithSignal(queued, signal) : queued;
+    };
+    // Session-owned discovery with one drain cursor per run. A child shares the
+    // discovered scopes without being able to consume the parent's update, and
+    // an edit takes effect in this session rather than only after reconnecting.
+    const projectInstructions = new ProjectInstructionTracker(cwd);
     // Before the registry, because a `requireIsolation` this machine cannot
     // meet throws here — and failing before the session is built is the
     // difference between "namzu refused to start" and a half-constructed
@@ -302,17 +634,23 @@ export async function createAgentSession(prefs, detected, options = {}) {
         'namzu.sandbox.unconfined': sandbox.unconfined,
     });
     const { registry, memoryStore } = buildToolRegistry(cwd);
+    // Registered only on the main session path. Sub-agents call
+    // `buildToolRegistry` directly below, so they never receive these tools.
+    // Per-send denial further keeps the schemas out of ordinary human turns.
+    const goalAuthorities = new Map();
+    const goalToolNames = new Set(SESSION_GOAL_TOOL_NAMES);
+    if (options.sessionGoals) {
+        registry.register(buildSessionGoalTools(options.sessionGoals, (runId) => goalAuthorities.get(runId)));
+    }
     // External tool servers, before the roster is counted, so `toolNames` and
     // the `/tools` list a user reads include what they configured. Connecting
     // after the count would report a session smaller than the one that runs.
     const mcp = await connectMcpServers(options.mcpServers, { cwd });
     if (mcp.tools.length > 0)
         registry.register([...mcp.tools]);
-    // Connectors are the one discovery source THIS function performs —
-    // plugins and skills are loaded elsewhere (`run-flags.ts`'s
-    // `loadSkillsContext`, per turn) and neither is wired to the boot path
-    // yet, so a fabricated "plugins 0 · skills 0" here would claim a
-    // measurement that was never taken. This reports only what was.
+    // External connector discovery is reported separately from executable
+    // plugin discovery. Folding both counts together would make a failed server
+    // indistinguishable from a plugin that never enabled.
     cliLogger().info('discovery complete', {
         [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.DISCOVERY_COMPLETED,
         'namzu.discovery.kind': 'connector',
@@ -362,12 +700,16 @@ export async function createAgentSession(prefs, detected, options = {}) {
         const sub = await createSubagentRuntime({
             cwd,
             model,
+            ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
+            ...(options.sandbox?.teardownTimeoutMs !== undefined
+                ? { sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs }
+                : {}),
             // A sub-agent works in the same repository and writes the same code,
             // so it is bound by the same instructions. Without this the parent
             // honours the project's rules and every task it delegates quietly
             // does not — the worse half of the feature, because the delegating
             // turn reports success either way.
-            ...(projectInstructions.prompt ? { projectInstructions: projectInstructions.prompt } : {}),
+            projectInstructionContext: () => projectInstructions.createRunContext(),
             // Same argument as the instructions, one step further: a sub-agent that
             // does not know what day it is dates a changelog entry from a training
             // cut-off, and the parent reports the delegation as successful.
@@ -447,6 +789,27 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // settle — is what this repository has been doing all along by accident.
     // A run that learned nothing still writes nothing.
     const promoteMemory = createMemoryPromoter({ store: memoryStore });
+    // Plugins are the last fallible startup resource. The ordering is ownership:
+    // a malformed MCP entry cannot strand imported plugin hooks, and a plugin
+    // refusal closes the MCP processes already opened for this candidate before
+    // returning an inert session. Sub-agents were built above from their own
+    // registries, so executable plugins remain a top-level-session capability.
+    let pluginRuntime;
+    try {
+        pluginRuntime = await createCliPluginRuntime(options.plugins, registry, cwd);
+    }
+    catch (error) {
+        await mcp.close();
+        return emptySession(describeError(error));
+    }
+    if (pluginRuntime) {
+        cliLogger().info('discovery complete', {
+            [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.DISCOVERY_COMPLETED,
+            'namzu.discovery.kind': 'plugin',
+            'namzu.discovery.count': pluginRuntime.pluginCount,
+            'namzu.discovery.skill_count': pluginRuntime.skills.size,
+        });
+    }
     // The one terminal POSITIVE event on this path, emitted exactly once —
     // every early return above goes through `emptySession`, which emits
     // `namzu.boot.refused` instead, and the `resolveSandbox` throw path above
@@ -457,109 +820,208 @@ export async function createAgentSession(prefs, detected, options = {}) {
     cliLogger().info('agent session ready', {
         [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.BOOT_READY,
     });
+    const operations = new SessionOperationOwner(async () => {
+        const results = await Promise.allSettled([pluginRuntime?.close(), mcp.close()]);
+        const failures = results
+            .filter((result) => result.status === 'rejected')
+            .map((result) => result.reason);
+        if (failures.length > 0)
+            throw new AggregateError(failures, 'Session cleanup failed.');
+    });
+    let reasoningEffortLevels;
+    let effortNotice;
+    try {
+        const capabilityView = withProviderFallback([
+            { provider, model },
+            ...fallbackPlan.build(currentToken),
+        ]);
+        const offered = capabilityView.reasoningEffortLevelsFor
+            ? capabilityView.reasoningEffortLevelsFor(model)
+            : capabilityView.effortLevelsFor?.(model);
+        reasoningEffortLevels = offered === undefined ? undefined : Object.freeze([...offered]);
+    }
+    catch (error) {
+        effortNotice = `Reasoning effort levels could not be established for this session: ${describeError(error)}.`;
+    }
     return {
         hasProvider: true,
+        sandbox: {
+            unconfined: sandbox.unconfined,
+            ...(sandbox.environment ? { environment: sandbox.environment } : {}),
+            enforced: sandbox.enforced,
+            required: sandbox.required,
+        },
         providerSummary: entry.label,
         modelSummary: model,
+        reasoningEffortLevels,
+        compact: (messages) => operations.promise(undefined, async (signal) => {
+            await prepareProviderCredential(signal);
+            return compactNow({
+                messages,
+                config: COMPACTION_CONFIG,
+                provider,
+                model,
+                signal,
+            });
+        }),
         // Reads the same registry object the deferred registration mutates, at
         // call time — the pair of `promptExemptTools` below, and for the same
         // reason.
-        toolNames: () => registry.getCallableTools().map((t) => t.name),
+        toolNames: () => registry
+            .getCallableTools()
+            .map((t) => t.name)
+            .filter((name) => !goalToolNames.has(name)),
         agentIds: allowedAgentIds,
-        instructionFiles: projectInstructions.files.map((f) => f.path),
-        skippedInstructionFiles: projectInstructions.skipped,
+        get instructionFiles() {
+            return projectInstructions.instructionFiles;
+        },
+        get skippedInstructionFiles() {
+            return projectInstructions.skippedInstructionFiles;
+        },
         mcpConnected: mcp.connected,
         mcpFailed: mcp.failed,
         configNotices: [
             ...(capabilityNotice ? [capabilityNotice] : []),
+            ...(effortNotice ? [effortNotice] : []),
             ...unresolvedNotice.map((line) => `Provider chain: capabilities could not be established for ${line}.`),
             ...fallbackPlan.notices,
         ],
-        close: () => mcp.close(),
+        close: () => operations.close(),
         errorHint: null,
         errorKind: null,
         // Reads the same object the handler mutates, at call time.
         approvalLatched: () => approval.all,
-        promptExemptTools: () => promptExemptToolNames(registry),
-        send: async function* (messages, opts) {
+        resetApprovalLatch: () => {
+            approval.all = false;
+        },
+        promptExemptTools: () => promptExemptToolNames(registry).filter((name) => !goalToolNames.has(name)),
+        send: (messages, opts) => operations.stream(opts?.signal, (signal) => (async function* () {
             // Renew a lapsed OAuth token before the turn runs (no-op for valid
-            // tokens and non-keychain credentials).
-            await refreshTokenIfNeeded();
+            // tokens and non-subscription credentials).
+            await prepareProviderCredential(signal);
             // namzu identity first (so it establishes who the agent is even when
             // the credential layer prepends whatever prefix its token requires),
-            // then memory read fresh each turn, then the project's own
-            // instructions, then per-turn extra (active skills).
+            // then memory and per-turn extra context. Project instructions are a
+            // separate retained user-context snapshot prepared by the controller;
+            // that is what lets nested scopes be replaced and persisted safely.
             //
-            // Project instructions sit AFTER the identity block deliberately, and
-            // the order is the containment: they are text off the disk of
-            // whatever directory the agent was pointed at, so the rules they must
-            // not be able to rewrite are established before they are read.
-            //
-            // The environment block is read fresh every turn, unlike the project
-            // instructions, because both facts in it can change WHILE the session
+            // The environment block is read fresh every turn because both facts in it
+            // can change WHILE the session
             // runs — midnight passes, and the agent checks out a branch itself.
             // Its text only changes when a fact changes, so it costs a prompt-cache
             // miss exactly when a hit would have been a stale claim.
+            const pluginSkills = pluginRuntime
+                ? await currentPluginSkills(pluginRuntime.skills)
+                : undefined;
             const memoryPrompt = composeMemoryPrompt(readMemory());
             const environmentPrompt = composeEnvironmentPrompt(await readEnvironmentFacts(cwd));
-            const systemPrompt = [
-                NAMZU_IDENTITY,
-                environmentPrompt,
-                memoryPrompt,
-                projectInstructions.prompt,
-                opts?.extraSystem,
-            ]
+            const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt, opts?.extraSystem]
                 .filter((s) => Boolean(s))
                 .join('\n\n') || undefined;
-            yield* runTurn({
-                provider,
-                // Constructed HERE, per turn, and that is not an optimisation to
-                // undo. `refreshTokenIfNeeded` above replaces the head's client
-                // object when an OAuth token rotates, so a member list built once at
-                // session creation would hand the kernel a client holding a token
-                // that expired hours ago — and a chain whose own members are stale
-                // is a fallback that fails for the reason the fallback exists to
-                // survive. Building a driver is a client object, not a request.
-                fallbackProviders: fallbackPlan.build(currentToken),
-                model,
-                tools: registry,
-                scope,
-                workingDirectory: cwd,
-                rules: options.rules,
-                permissionMode: options.permissionMode,
-                reviewAnswer: options.reviewAnswer,
-                maxAnswerReviews: options.maxAnswerReviews,
-                promoteMemory,
-                approval,
-                taskStore,
-                systemPrompt,
-                messages,
-                opts,
-                taskGateway: subagentGateway,
-                onRunEvent: options.onRunEvent,
-                childSteps,
-                ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
-            });
-        },
-        resumeDurable: async ({ entry, checkpointStore, claimFence, signal }) => {
+            let capturedAuthority;
+            if (opts?.goalRound) {
+                if (!opts.runId)
+                    throw new Error('A goal round requires a caller-reserved runId.');
+                if (!options.sessionGoals)
+                    throw new Error('This session has no durable goal store.');
+                if (opts.goalRound.sessionId !== scope.sessionId ||
+                    opts.goalRound.tenantId !== scope.tenantId) {
+                    throw new Error('Goal-round authority does not belong to this agent session scope.');
+                }
+                const current = await options.sessionGoals.getGoal(scope.sessionId, scope.tenantId);
+                if (!current ||
+                    current.phase !== 'active' ||
+                    current.id !== opts.goalRound.id ||
+                    current.revision !== opts.goalRound.revision ||
+                    current.objective !== opts.goalRound.objective ||
+                    current.roundsAdmitted !== opts.goalRound.round ||
+                    current.maxGoalRounds !== opts.goalRound.maxGoalRounds) {
+                    throw new Error('Goal-round authority is stale or does not match the durable goal.');
+                }
+                if (goalAuthorities.has(opts.runId)) {
+                    throw new Error(`Run ${opts.runId} already owns goal-round authority.`);
+                }
+                capturedAuthority = Object.freeze({ ...opts.goalRound });
+                goalAuthorities.set(opts.runId, capturedAuthority);
+            }
+            try {
+                yield* runTurn({
+                    provider,
+                    // Constructed HERE, per turn, and that is not an optimisation to
+                    // undo. `refreshTokenIfNeeded` above replaces the head's client
+                    // object when an OAuth token rotates, so a member list built once at
+                    // session creation would hand the kernel a client holding a token
+                    // that expired hours ago — and a chain whose own members are stale
+                    // is a fallback that fails for the reason the fallback exists to
+                    // survive. Building a driver is a client object, not a request.
+                    fallbackProviders: fallbackPlan.build(currentToken),
+                    model,
+                    tools: registry,
+                    pluginManager: pluginRuntime?.manager,
+                    skillRegistry: pluginRuntime?.skills,
+                    skills: pluginSkills,
+                    scope,
+                    workingDirectory: cwd,
+                    rules: options.rules,
+                    permissionMode: opts?.permissionMode ?? options.permissionMode,
+                    reviewAnswer: options.reviewAnswer,
+                    maxAnswerReviews: options.maxAnswerReviews,
+                    promoteMemory,
+                    approval,
+                    taskStore,
+                    systemPrompt,
+                    messages,
+                    projectInstructionContext: projectInstructions.createRunContext(),
+                    opts: { ...opts, signal },
+                    taskGateway: subagentGateway,
+                    onRunEvent: options.onRunEvent,
+                    childSteps,
+                    ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
+                    ...(options.sandbox?.teardownTimeoutMs !== undefined
+                        ? {
+                            sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs,
+                        }
+                        : {}),
+                });
+            }
+            finally {
+                if (opts?.runId &&
+                    capturedAuthority &&
+                    goalAuthorities.get(opts.runId) === capturedAuthority) {
+                    goalAuthorities.delete(opts.runId);
+                }
+            }
+        })()),
+        resumeDurable: ({ entry, checkpointStore, claimFence, signal }) => operations.promise(signal, async (ownedSignal) => {
             // The same prelude a turn runs, and for the same reasons: a lapsed
             // OAuth token has to be renewed before the provider is used, and the
             // fallback chain has to be built AFTER that so its members do not
             // hold a client the refresh just replaced.
-            await refreshTokenIfNeeded();
+            await prepareProviderCredential(ownedSignal);
+            const pluginSkills = pluginRuntime
+                ? await currentPluginSkills(pluginRuntime.skills)
+                : undefined;
             const memoryPrompt = composeMemoryPrompt(readMemory());
             const environmentPrompt = composeEnvironmentPrompt(await readEnvironmentFacts(cwd));
-            const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt, projectInstructions.prompt]
+            const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt]
                 .filter((s) => Boolean(s))
                 .join('\n\n') || undefined;
             return resumeRun({
                 provider,
                 fallbackProviders: fallbackPlan.build(currentToken),
                 tools: registry,
+                pluginManager: pluginRuntime?.manager,
+                skillRegistry: pluginRuntime?.skills,
+                skills: pluginSkills,
                 taskStore,
                 ...(subagentGateway ? { taskGateway: subagentGateway } : {}),
                 authorizationGate: gateFor(options.rules),
                 compactionConfig: COMPACTION_CONFIG,
+                projectInstructionContext: projectInstructions.createRunContext(),
+                ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
+                ...(options.sandbox?.teardownTimeoutMs !== undefined
+                    ? { sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs }
+                    : {}),
                 // NOT `emergencySave`, unlike a turn. The manager is a singleton
                 // whose `attach` detaches whoever held it before, so a caller
                 // resuming several runs in one process would leave only the last
@@ -585,7 +1047,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 // forced presentation to be name matching: `toAgentEvent` was pure
                 // over a `RunEvent` and could not ask a tool anything.
                 resumeHandler: makeResumeHandler(approval, undefined, options.permissionMode, (n, i) => isPromptExempt(registry, n, i)),
-                ...(signal ? { signal } : {}),
+                signal: ownedSignal,
                 // Attribution comes from the ENTRY, not from this session: the run
                 // belongs to whoever started it, and stamping the drainer's ids onto
                 // it would file another tenant's work under this one.
@@ -600,7 +1062,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 checkpointStore,
                 ...(claimFence !== undefined ? { claimFence } : {}),
             });
-        },
+        }),
     };
 }
 function planFallbacks(members, detected) {
@@ -682,6 +1144,19 @@ export function constructProvider(id, det, model) {
             });
             return provider;
         }
+        case 'codex': {
+            if (!det?.codex?.accountId) {
+                throw new Error('Codex subscription credentials require ChatGPT account routing. Sign in with Codex again or choose the OpenAI API-key provider.');
+            }
+            const { provider } = ProviderRegistry.create({
+                type: 'codex',
+                accessToken: det.apiKey ?? '',
+                accountId: det.codex.accountId,
+                baseURL: det.baseUrl,
+                model,
+            });
+            return provider;
+        }
         case 'deepseek': {
             const { provider } = ProviderRegistry.create({
                 type: 'deepseek',
@@ -711,50 +1186,101 @@ export function constructProvider(id, det, model) {
             throw new Error(unsupportedProviderMessage(id));
     }
 }
+const PICKER_PROVIDER_DEADLINE_MS = 3_000;
+class PickerProviderTimeoutError extends Error {
+    constructor() {
+        super(`The provider did not answer within ${PICKER_PROVIDER_DEADLINE_MS}ms.`);
+        this.name = 'PickerProviderTimeoutError';
+    }
+}
+/** Bound a picker side-call even when a third-party provider ignores abort. */
+async function runPickerProviderOperation(signal, operation) {
+    signal?.throwIfAborted();
+    const controller = new AbortController();
+    const timeoutCause = new PickerProviderTimeoutError();
+    let rejectBoundary = () => { };
+    const boundary = new Promise((_resolve, reject) => {
+        rejectBoundary = reject;
+    });
+    const onCallerAbort = () => {
+        controller.abort(signal?.reason);
+        rejectBoundary(signal?.reason);
+    };
+    signal?.addEventListener('abort', onCallerAbort, { once: true });
+    const timer = setTimeout(() => {
+        controller.abort(timeoutCause);
+        rejectBoundary(timeoutCause);
+    }, PICKER_PROVIDER_DEADLINE_MS);
+    try {
+        return await Promise.race([operation(controller.signal), boundary]);
+    }
+    catch (error) {
+        // Cooperative transports may replace the owner cause with AbortError.
+        if (signal?.aborted)
+            throw signal.reason;
+        if (controller.signal.aborted && controller.signal.reason === timeoutCause)
+            throw timeoutCause;
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', onCallerAbort);
+    }
+}
 /**
  * Ask a detected provider what models it has.
  *
  * Instantiates the provider and calls its optional `listModels()`, inside a 3s
  * race so a wedged local server or a slow catalog cannot stall the UI.
  */
-export async function describeProviderModels(id, det) {
+export async function describeProviderModels(id, det, signal) {
     try {
+        signal?.throwIfAborted();
         // constructProvider calls ProviderRegistry.create, which throws
         // "Unsupported provider type" until the vendor package has registered
         // itself. The run path registers lazily via ensureRegistered; the
         // listing path must do the same or every provider returns nothing.
         await ensureRegistered(id);
+        signal?.throwIfAborted();
         const provider = constructProvider(id, det, det.entry.defaultModel);
         if (typeof provider.listModels !== 'function')
             return { kind: 'unsupported' };
-        const TIMEOUT = Symbol('timeout');
-        const timeout = new Promise((resolve) => setTimeout(() => resolve(TIMEOUT), 3000));
-        const models = await Promise.race([provider.listModels(), timeout]);
-        if (models === TIMEOUT)
-            return { kind: 'timeout' };
-        return { kind: 'ok', models: models.map((m) => ({ id: m.id, name: m.name || m.id })) };
+        const models = await runPickerProviderOperation(signal, (operationSignal) => provider.listModels?.(operationSignal) ?? Promise.resolve([]));
+        return {
+            kind: 'ok',
+            models: models.map((m) => ({ id: m.id, name: m.name || m.id })),
+        };
     }
     catch (err) {
-        return { kind: 'failed', reason: err instanceof Error ? err.message : String(err) };
+        if (signal?.aborted)
+            throw signal.reason;
+        if (err instanceof PickerProviderTimeoutError)
+            return { kind: 'timeout' };
+        return {
+            kind: 'failed',
+            reason: err instanceof Error ? err.message : String(err),
+        };
     }
 }
 /**
  * Check a key the operator just typed, without spending a turn.
  *
- * Uses the provider's own `listModels` where it has one: a successful listing
- * is proof the credential authenticates, and it costs nothing. A driver without
+ * Uses the provider's declared `probeCredential` operation. A driver without
  * one cannot be checked cheaply, and that is reported as `unverifiable` rather
  * than dressed up as success — claiming a check that did not happen is the
- * failure this whole surface is built to avoid.
+ * failure this whole surface is built to avoid. A model catalogue is
+ * deliberately not substituted: a menu is not evidence that a key worked.
  *
  * The key never appears in the returned reason. Provider errors are passed
  * through, and a driver that echoes a credential into its own error message
  * would defeat this; that is a driver bug and not one this can paper over, so
  * the reason is also truncated.
  */
-export async function verifyCredential(id, det) {
+export async function verifyCredential(id, det, signal) {
     try {
+        signal?.throwIfAborted();
         await ensureRegistered(id);
+        signal?.throwIfAborted();
         const provider = constructProvider(id, det, det.entry.defaultModel);
         // Declared, never inferred. A driver without a probe is unverifiable —
         // including one added years from now by someone who never reads this.
@@ -764,10 +1290,14 @@ export async function verifyCredential(id, det) {
         // not authenticate at all.
         if (typeof provider.probeCredential !== 'function')
             return { kind: 'unverifiable' };
-        await provider.probeCredential();
+        await runPickerProviderOperation(signal, (operationSignal) => provider.probeCredential?.(operationSignal) ?? Promise.resolve());
         return { kind: 'verified' };
     }
     catch (err) {
+        if (signal?.aborted)
+            throw signal.reason;
+        if (err instanceof PickerProviderTimeoutError)
+            return { kind: 'unverifiable' };
         // The server answered and said no, versus nothing was learned. Collapsing
         // these would tell an operator on broken wifi to rotate a key that is fine.
         if (isCredentialRejection(err)) {
@@ -887,7 +1417,7 @@ const COMPACTION_CONFIG = {
     maxCharsPerRequirement: 300,
     maxCharsPerTask: 400,
 };
-async function* runTurn({ provider, fallbackProviders, model, tools, scope, workingDirectory, rules, permissionMode, reviewAnswer, maxAnswerReviews, promoteMemory, approval, taskStore, systemPrompt, messages, opts, taskGateway, childSteps, sandboxProvider, onRunEvent, }) {
+async function* runTurn({ provider, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, workingDirectory, rules, permissionMode, reviewAnswer, maxAnswerReviews, promoteMemory, approval, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, childSteps, sandboxProvider, sandboxTeardownTimeoutMs, onRunEvent, }) {
     const signal = opts?.signal;
     // One presenter for the whole stream, built from the registry this scope
     // already holds. Its absence HERE is what forced presentation to be name
@@ -897,11 +1427,18 @@ async function* runTurn({ provider, fallbackProviders, model, tools, scope, work
     try {
         const events = query({
             provider,
+            ...(opts?.runId ? { runId: opts.runId } : {}),
             // Omitted rather than empty when there is no tail. `query` treats the
             // two the same, but an absent option reads as "this run has no chain"
             // where `[]` reads as "this run has a chain with nothing in it".
             ...(fallbackProviders.length > 0 ? { fallbackProviders } : {}),
             tools,
+            ...(pluginManager ? { pluginManager } : {}),
+            ...(skillRegistry ? { skillRegistry } : {}),
+            ...(skills ? { skills } : {}),
+            // Withheld at both provider and executor boundaries on every ordinary
+            // turn. An admitted send owns the exact run-scoped authority above.
+            ...(!opts?.goalRound ? { deniedTools: SESSION_GOAL_TOOL_NAMES } : {}),
             taskStore,
             ...(taskGateway ? { taskGateway } : {}),
             // `gateFor`, not the bare default: the default's `rules` is a hardcoded
@@ -909,6 +1446,7 @@ async function* runTurn({ provider, fallbackProviders, model, tools, scope, work
             // path that runs every top-level turn. The sub-agent path called
             // `gateFor` and this one did not.
             ...(sandboxProvider ? { sandboxProvider } : {}),
+            ...(sandboxTeardownTimeoutMs !== undefined ? { sandboxTeardownTimeoutMs } : {}),
             authorizationGate: gateFor(rules),
             compactionConfig: COMPACTION_CONFIG,
             // The CLI owns its process end to end, so it can safely hand the
@@ -917,6 +1455,7 @@ async function* runTurn({ provider, fallbackProviders, model, tools, scope, work
             emergencySave: true,
             runConfig: {
                 model,
+                ...(opts?.effort !== undefined ? { effort: opts.effort } : {}),
                 timeoutMs: 600_000,
                 tokenBudget: 1_000_000,
                 maxIterations: 50,
@@ -936,6 +1475,7 @@ async function* runTurn({ provider, fallbackProviders, model, tools, scope, work
             agentId: 'namzu',
             agentName: 'namzu',
             ...(systemPrompt ? { systemPrompt } : {}),
+            projectInstructionContext,
             messages: [...messages],
             workingDirectory,
             // The exemption reads `tools` at decision time, so it sees the task
@@ -945,34 +1485,58 @@ async function* runTurn({ provider, fallbackProviders, model, tools, scope, work
             signal,
             ...scope,
         });
-        for await (const event of events) {
-            // Before the abort check and before `toAgentEvent`: a session
-            // cancelled mid-turn still produced the events up to that point, and
-            // they are the interesting ones. Every event, not just the ones the
-            // TUI renders — an export that only saw what the screen showed would
-            // be a recording of the interface rather than of the session.
-            onRunEvent?.(event);
-            if (signal?.aborted) {
-                yield { kind: 'error', message: 'aborted' };
-                return;
-            }
-            const mapped = toAgentEvent(event, presenter);
-            if (!mapped)
-                continue;
-            // On an `Agent` delegation finishing, attach the sub-agent's tool
-            // steps (collected via the gateway while the call blocked) as a
-            // `├─/└─` tree under its result, then reset for the next delegation.
-            // (Don't clear on tool_executing: the parent's events can be buffered
-            // and pulled only after the child already ran, which would wipe it.)
-            if (event.type === 'tool_completed' &&
-                event.toolName === 'Agent' &&
-                childSteps.length > 0 &&
-                mapped.kind === 'tool-end') {
-                yield { ...mapped, detail: [...(mapped.detail ?? []), ...asTree(childSteps)] };
-                childSteps.length = 0;
-                continue;
+        let settled = false;
+        try {
+            while (true) {
+                const next = await events.next();
+                if (next.done) {
+                    settled = true;
+                    // A Run contains its fresh static/dynamic system floor as well as the
+                    // conversation. Only the latter crosses this host seam. Compaction
+                    // summaries survive because they ARE conversation state; arbitrary
+                    // system prompts are rebuilt fresh on every send and stay private to it.
+                    opts?.onConversationMessages?.(projectRunConversation(next.value.messages));
+                    return;
+                }
+                const event = next.value;
+                // Before the abort check and before `toAgentEvent`: a session
+                // cancelled mid-turn still produced the events up to that point, and
+                // they are the interesting ones. Every event, not just the ones the
+                // TUI renders — an export that only saw what the screen showed would
+                // be a recording of the interface rather than of the session.
+                onRunEvent?.(event);
+                if (signal?.aborted) {
+                    yield { kind: 'error', message: 'aborted' };
+                    return;
+                }
+                const mapped = toAgentEvent(event, presenter);
+                if (!mapped)
+                    continue;
+                // On an `Agent` delegation finishing, attach the sub-agent's tool
+                // steps (collected via the gateway while the call blocked) as a
+                // `├─/└─` tree under its result, then reset for the next delegation.
+                // (Don't clear on tool_executing: the parent's events can be buffered
+                // and pulled only after the child already ran, which would wipe it.)
+                if (event.type === 'tool_completed' &&
+                    event.toolName === 'Agent' &&
+                    childSteps.length > 0 &&
+                    mapped.kind === 'tool-end') {
+                    yield {
+                        ...mapped,
+                        detail: [...(mapped.detail ?? []), ...asTree(childSteps)],
+                    };
+                    childSteps.length = 0;
+                    continue;
+                }
+                yield mapped;
             }
-            yield mapped;
+        }
+        finally {
+            // Manual iteration is what exposes the generator's Run return value.
+            // Preserve `for await`'s other guarantee too: a consumer that stops
+            // early must close the live query instead of abandoning its transport.
+            if (!settled)
+                await drainIterator(events);
         }
     }
     catch (err) {
@@ -1080,7 +1644,7 @@ presenter = GENERIC_PRESENTER) {
  * survives the process, into the user's own repository, is not read-only under
  * any reading, and it now prompts.
  */
-const PROMPT_EXEMPT_WRITES = new Set(['task_create', 'task_update']);
+const PROMPT_EXEMPT_WRITES = new Set(['task_create', 'task_update', 'update_goal']);
 /**
  * Whether a call runs without asking: it declares itself read-only, or it is a
  * named exemption above.
@@ -1190,6 +1754,30 @@ export function toAgentEvent(event, presenter) {
             };
         case 'provider_fallback':
             return { kind: 'provider-fallback', text: describeFallback(event) };
+        case 'capability_warning':
+            return {
+                kind: 'capability-warning',
+                capability: event.capability,
+                text: event.message,
+            };
+        case 'message_history_repaired': {
+            const changes = [
+                event.duplicateToolResultsRemoved > 0
+                    ? `${event.duplicateToolResultsRemoved} duplicate result${event.duplicateToolResultsRemoved === 1 ? '' : 's'} removed`
+                    : null,
+                event.orphanedToolResultsRemoved > 0
+                    ? `${event.orphanedToolResultsRemoved} orphaned result${event.orphanedToolResultsRemoved === 1 ? '' : 's'} removed`
+                    : null,
+                event.syntheticToolResultsInserted > 0
+                    ? `${event.syntheticToolResultsInserted} interrupted call${event.syntheticToolResultsInserted === 1 ? '' : 's'} closed with unknown outcome`
+                    : null,
+            ].filter((part) => part !== null);
+            return {
+                kind: 'history-repair',
+                source: event.source,
+                text: `Tool history repaired before the model call: ${changes.join('; ')}. Verify external state before retrying non-idempotent tools.`,
+            };
+        }
         case 'task_created':
             return { kind: 'task', subject: event.subject, status: event.status };
         case 'task_updated':
@@ -1204,7 +1792,10 @@ export function toAgentEvent(event, presenter) {
             // timeout, a cancellation and a blocked output guardrail arrive. A
             // consumer that reads this as success reports one for a run whose
             // answer was refused.
-            return { kind: 'done', ...(event.stopReason ? { stopReason: event.stopReason } : {}) };
+            return {
+                kind: 'done',
+                ...(event.stopReason ? { stopReason: event.stopReason } : {}),
+            };
         case 'run_failed':
             // The classification is now carried on the event rather than
             // having been flattened away upstream. Shown because "rate
@@ -1229,7 +1820,11 @@ export function toAgentEvent(event, presenter) {
                 shed: true,
             };
         case 'compaction_failed':
-            return { kind: 'context', text: describeCompactionFailure(event), shed: false };
+            return {
+                kind: 'context',
+                text: describeCompactionFailure(event),
+                shed: false,
+            };
         default:
             return null;
     }
@@ -1333,8 +1928,14 @@ function asTree(steps) {
  * the four deleted functions did for every tool.
  */
 const GENERIC_PRESENTER = {
-    presentCall: (_name, input) => ({ kind: 'generic', label: genericLabel(input) }),
-    presentResult: (_name, _input, result) => ({ kind: 'terminal', output: result.output ?? '' }),
+    presentCall: (_name, input) => ({
+        kind: 'generic',
+        label: genericLabel(input),
+    }),
+    presentResult: (_name, _input, result) => ({
+        kind: 'terminal',
+        output: result.output ?? '',
+    }),
 };
 /**
  * The one presentation function this host keeps.
@@ -1513,7 +2114,9 @@ function logCapabilities(probes) {
     const summary = probes
         .map((p) => `${p.specifier.split('/').pop()} ${p.state === 'present' ? 'yes' : 'no'}`)
         .join(' · ');
-    log.info(summary, { [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.CAPABILITY_DETECTED });
+    log.info(summary, {
+        [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.CAPABILITY_DETECTED,
+    });
     for (const probe of probes) {
         if (probe.state === 'broken') {
             log.error('Capability probe failed to load', {
@@ -1545,6 +2148,15 @@ function emptySession(errorHint, errorKind = 'environment') {
     });
     return {
         hasProvider: false,
+        // A refused session ran nothing, so there is nothing confining anything.
+        // Reporting an enforced control here would be a claim about a sandbox
+        // this path never built.
+        sandbox: { unconfined: true, enforced: [], required: [] },
+        // No provider, so no summary can be built. Refusing is the honest
+        // answer; returning `null` would say "nothing to shed".
+        compact: async () => {
+            throw new Error('No provider: pick one with /model before compacting.');
+        },
         errorKind,
         providerSummary: null,
         modelSummary: null,
@@ -1563,6 +2175,7 @@ function emptySession(errorHint, errorKind = 'environment') {
         errorHint,
         // No turn can run here, so no prompt can have been answered.
         approvalLatched: () => false,
+        resetApprovalLatch: () => { },
         // No registry was built, so there is no roster to report on.
         promptExemptTools: () => [],
         send: async function* () {