@namzu/cli 24.0.0 → 25.0.1

package/dist/tui/agent.js

@@ -1,4 +1,5 @@
 import { createCurrentCredentialReader } from '../integrations/providers/current-credential.js';
+import { CliPathBuilder } from '../integrations/sessions/paths.js';
 import { createWebSearchTool, resolveWebSearch, webSearchLabel, } from '../integrations/web/search.js';
 /**
  * TUI agent session — provider-direct, tool-enabled.
@@ -22,12 +23,13 @@ import { createWebSearchTool, resolveWebSearch, webSearchLabel, } from '../integ
  * `emptySession()` whose `send()` yields a single error event so the UI
  * renders an actionable hint rather than crashing.
  */
-import { BOOT_EVENT_NAMES, BackgroundJobRegistry, DefaultPathBuilder, DiskCheckpointStore, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, GuardedFetchProvider, PromptContributionRegistry, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, ToolRegistry, WebFetchTool, batchNeedsReview, buildAskUserQuestionTool, buildMemoryTools, buildSessionGoalTools, compactNow, createComputerUseTool, createFileReadTracker, createMemoryPromoter, createMemoryRecallStep, createResidentStepContributions, createReviewHandler, createToolPresenter, generateProjectId, generateRunId, generateSessionId, generateTenantId, generateTopicId, getBuiltinTools, isReviewExempt, query, resumeRun, webGuidanceContribution, withProviderFallback, } from '@namzu/sdk';
+import { BOOT_EVENT_NAMES, BackgroundJobRegistry, DiskCheckpointStore, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, GuardedFetchProvider, PromptContributionRegistry, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, ToolRegistry, WebFetchTool, asRunId, batchNeedsReview, buildAskUserQuestionTool, buildMemoryTools, buildResidentHistoryTools, buildResidentToolEvidenceTools, buildSessionGoalTools, compactNow, createComputerUseTool, createFileReadTracker, createMemoryPromoter, createMemoryRecallStep, createResidentStepContext, createResidentStepContributions, createReviewHandler, createToolPresenter, generateProjectId, generateRunId, generateSessionId, generateTenantId, generateTopicId, getBuiltinTools, isReviewExempt, query, resumeRun, seedObservationLedger, webGuidanceContribution, withProviderFallback, } from '@namzu/sdk';
 import { SubprocessComputerUseHost } from '@namzu/computer-use';
 import { realpath, stat } from 'node:fs/promises';
 import { join, parse, resolve } from 'node:path';
 import { FileCheckpointStore } from '../checkpoints/store.js';
 import { CHECKPOINTED_TOOLS, withCheckpoints } from '../checkpoints/wrap.js';
+import { readStoredRunGuards, resolveRunGuards } from '../config/run-limits.js';
 import { probeCapabilities } from '../context/capabilities.js';
 import { NAMZU_DELEGATION_DOCTRINE, NAMZU_PLAN_MODE_DOCTRINE, NAMZU_WORKING_DOCTRINE, } from '../context/doctrine.js';
 import { composeEnvironmentPrompt, readEnvironmentFacts } from '../context/environment.js';
@@ -41,15 +43,16 @@ import { canSelectModel } from '../integrations/providers/access.js';
 import { createGeminiAccessTokenResolver } from '../integrations/providers/gemini-credentials.js';
 import { CredentialRefreshRejectedError, CredentialWithdrawnError, PROVIDER_REGISTRY, chainCapabilityDisagreements, chainPositionName, describeAcceptedMismatch, describeCapabilityRefusal, discoverProviders, ensureFreshAnthropicToken, ensureFreshStoredCodexCredential, ensureRegistered, findDetected, isAnthropicOAuthToken, isRegistered, missingCredentialMessage, primaryProvider, readCodexCredentialFile, readPreferences, readSubscriptionCredential, resolveChainCapabilities, sameOAuthCredential, unresolvedMembers, unsupportedProviderMessage, } from '../integrations/providers/index.js';
 import { modelReasoningView } from '../integrations/providers/model-reasoning.js';
+import { retainManualCompaction } from '../integrations/sessions/compaction-evidence.js';
 import { createContextInventoryStep } from '../integrations/sessions/context-inventory.js';
-import { buildConversationReadTool, buildConversationSearchTool, } from '../integrations/sessions/conversation-search.js';
+import { CONVERSATION_EVIDENCE_GUIDANCE, buildConversationReadTool, buildConversationSearchTool, releaseConversationEvidence, } from '../integrations/sessions/conversation-search.js';
+import { createConversationEvidenceRecall } from '../integrations/sessions/evidence-recall.js';
 import { createTaskContextStep } from '../integrations/sessions/task-context.js';
 import { ensurePrivateStateDirectory } from '../integrations/state/private-directory.js';
 import { discoverAgentDefinitions } from '../integrations/subagents/definitions.js';
 import { createDelegationHistoryStep } from '../integrations/subagents/history.js';
 import { prepareDelegatedEffort } from '../integrations/subagents/model-effort.js';
 import { SubagentPathBuilder, resolveSubagentParent } from '../integrations/subagents/parent.js';
-import { CLI_INTERACTIVE_RUN_TIMEOUT_MS } from '../integrations/subagents/policy.js';
 import { createSubagentRuntime } from '../integrations/subagents/runtime.js';
 import { cliLogger } from '../logging.js';
 import { formatMemoryDiagnostics } from '../memory/presentation.js';
@@ -97,10 +100,22 @@ export class SessionOperationOwner {
     streamClosers = new Set();
     closeReason = new DOMException('Agent session closed.', 'AbortError');
     closed = false;
+    exclusiveOperation = false;
     closePromise;
     constructor(cleanup) {
         this.cleanup = cleanup;
     }
+    /** Change shared session resources only when no invocation can still use them. */
+    exclusive(start) {
+        if (this.active.size > 0 || this.exclusiveOperation) {
+            return Promise.reject(new Error('Wait for the active session operation to finish before changing plugins.'));
+        }
+        const operation = this.promise(undefined, start);
+        this.exclusiveOperation = true;
+        return operation.finally(() => {
+            this.exclusiveOperation = false;
+        });
+    }
     promise(callerSignal, start) {
         let signal;
         try {
@@ -230,14 +245,18 @@ export class SessionOperationOwner {
     operationSignal(callerSignal) {
         if (this.closed)
             throw this.closeReason;
+        if (this.exclusiveOperation)
+            throw new Error('A plugin change is in progress; try again when it finishes.');
         return callerSignal
             ? AbortSignal.any([callerSignal, this.lifetime.signal])
             : this.lifetime.signal;
     }
     track(operation) {
-        const settlement = Promise.resolve(operation).then(() => { }, () => { });
+        const release = () => {
+            this.active.delete(settlement);
+        };
+        const settlement = Promise.resolve(operation).then(release, release);
         this.active.add(settlement);
-        void settlement.then(() => this.active.delete(settlement));
     }
     async finishClose() {
         await Promise.allSettled([...this.streamClosers].map((close) => close()));
@@ -340,8 +359,15 @@ const EAGER_TOOLS_WHEN_DEFERRED = [
     'edit',
     'bash',
     'job',
+    'wait_for_job',
     'web_search',
     'web_fetch',
+    'search_conversation',
+    'read_conversation',
+    'search_resident_history',
+    'read_resident_history',
+    'search_resident_tools',
+    'read_resident_tool',
     // query mounts discovery when absent; an existing discovery tool must stay ready.
     'search_tools',
 ];
@@ -402,12 +428,14 @@ function builtinTools(backgroundJobs) {
             : source;
         if (backgroundJobs)
             return [tool];
-        if (tool.name === 'job')
+        // `wait_for_job` is as useless as `job` itself with no registry to
+        // back it — both refuse every call, so neither ships.
+        if (tool.name === 'job' || tool.name === 'wait_for_job')
             return [];
         return [tool.name === 'bash' ? foregroundOnlyBash(tool) : tool];
     });
 }
-function buildToolRegistry(cwd, projectStateRoot = join(cwd, '.namzu'), backgroundJobs = true, checkpoints) {
+function buildToolRegistry(cwd, projectStateRoot = join(cwd, '.namzu'), backgroundJobs = true, checkpoints, projectId) {
     const registry = new ToolRegistry();
     registry.register(builtinTools(backgroundJobs));
     // The file tools take a checkpoint before they write, so `/restore` can
@@ -427,8 +455,9 @@ function buildToolRegistry(cwd, projectStateRoot = join(cwd, '.namzu'), backgrou
     // surfaces inject the central application-home hierarchy; embedded callers
     // that omit it retain the historical `<cwd>/.namzu` layout.
     // Separate from the user-curated MEMORY.md that is injected into the prompt.
-    ensurePrivateStateDirectory(projectStateRoot, 'memory');
-    const memoryStore = new DiskMemoryStore({ baseDir: projectStateRoot });
+    const memoryRoot = ensurePrivateStateDirectory(projectStateRoot, 'memory');
+    const directory = projectId ? ensurePrivateStateDirectory(memoryRoot, projectId) : memoryRoot;
+    const memoryStore = new DiskMemoryStore({ baseDir: projectStateRoot, directory });
     // Search through the store's async boundary. Its concrete index is lazy:
     // handing `getIndex()` to the synchronous overload before the first store
     // read makes a new process report every persisted memory as absent.
@@ -447,13 +476,54 @@ async function currentPluginSkills(registry) {
 export async function createAgentSession(prefs, detected, options = {}) {
     const scope = options.scope ?? mintScope();
     const fileObservations = new Map();
-    const observationsFor = (id) => {
-        let tracker = fileObservations.get(id);
-        if (!tracker) {
-            tracker = createFileReadTracker();
-            fileObservations.set(id, tracker);
+    /**
+     * This process's observation ledger for one conversation, seeded from that
+     * conversation's own history the first time it is asked for.
+     *
+     * The ledger is memory, and a resumed conversation used to get an empty one:
+     * the agent re-read files it had written in full before the session closed,
+     * every time. `prior` is the history the caller is about to send, so a
+     * resumed session seeds from what it restored and a forked one from its own
+     * copied messages — never from the conversation it was branched out of.
+     *
+     * Keyed on first use of a session id rather than on process start, because
+     * the TUI switches ids mid-process: `/resume` and a new conversation both
+     * arrive as an id this map has not seen. The map holds the seeding itself
+     * rather than its result, so the entry is in place before the first `await`
+     * inside it: a second turn that starts while the first is still seeding
+     * waits for that same ledger instead of building a second one.
+     */
+    const observationsFor = (id, prior) => {
+        let seeded = fileObservations.get(id);
+        if (!seeded) {
+            seeded = (async () => {
+                const tracker = createFileReadTracker();
+                try {
+                    const report = await seedObservationLedger(prior, tracker, {
+                        workingDirectory: cwd,
+                        ...(directories.length > 0 ? { additionalDirectories: [...directories] } : {}),
+                        sandboxed: sandbox.provider !== undefined,
+                    });
+                    cliLogger().debug('file observation ledger rebuilt', {
+                        'namzu.files.witnessed': report.pathsWitnessed,
+                        'namzu.files.seen': report.pathsSeen,
+                        'namzu.files.replayed_units': report.unitsReplayed,
+                    });
+                }
+                catch (error) {
+                    // A ledger that could not be rebuilt is the empty one every resume
+                    // used to get, so the turn proceeds without its witnesses — but it
+                    // says so, because a seeding that failed and one that found nothing
+                    // are otherwise the same silence.
+                    cliLogger().debug('file observation ledger not rebuilt', {
+                        'namzu.files.error': error instanceof Error ? error.message : String(error),
+                    });
+                }
+                return tracker;
+            })();
+            fileObservations.set(id, seeded);
         }
-        return tracker;
+        return seeded;
     };
     const requestedCwd = resolve(options.cwd ?? process.cwd());
     let cwd;
@@ -474,13 +544,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
         return emptySession(`Working-directory sandboxing refuses filesystem root ${cwd}; choose a project directory so confinement has a boundary, or explicitly select an ephemeral workspace.`, 'invocation');
     }
     const hierarchyRoot = resolve(options.stateRoot ?? join(cwd, '.namzu'));
-    const pathBuilder = new DefaultPathBuilder(hierarchyRoot);
-    let projectStateRoot = hierarchyRoot;
+    const pathBuilder = new CliPathBuilder(hierarchyRoot);
+    const projectStateRoot = hierarchyRoot;
     try {
-        if (options.stateRoot) {
-            const projectsRoot = ensurePrivateStateDirectory(hierarchyRoot, 'projects');
-            projectStateRoot = ensurePrivateStateDirectory(projectsRoot, scope.projectId);
-        }
+        ensurePrivateStateDirectory(hierarchyRoot, 'sessions');
         // Refuse an aliased or otherwise unsafe generated-state root before any
         // provider, sandbox or plugin runtime is constructed. Project-authored
         // `.namzu` content may coexist here, but generated memory must never be
@@ -833,7 +900,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
         },
     };
     const checkpoints = new FileCheckpointStore(join(ensurePrivateStateDirectory(projectStateRoot, 'checkpoints'), scope.sessionId), cwd);
-    const { registry, memoryStore } = buildToolRegistry(cwd, projectStateRoot, backgroundJobs, checkpoints);
+    const { registry, memoryStore } = buildToolRegistry(cwd, projectStateRoot, backgroundJobs, checkpoints, options.stateRoot ? scope.projectId : undefined);
     // Package presence is not tool reachability. The CLI used to probe and
     // report @namzu/computer-use without ever constructing its host or mounting
     // SDK's computer_use definition, so even an installed, healthy package was
@@ -954,7 +1021,37 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // delegate a self-contained task to a fresh sub-agent (own context window).
     // Best-effort — if the runtime can't stand up, the chat still works.
     const delegationScopes = new Map();
+    const delegationLimits = new Map();
     const delegatedInputWaiters = new Map();
+    if (options.residentHistory) {
+        const history = options.residentHistory;
+        const historyOwner = { ...scope };
+        registry.register(buildResidentHistoryTools((context) => {
+            const owner = delegationScopes.get(context.runId);
+            if (!owner ||
+                owner.sessionId !== historyOwner.sessionId ||
+                owner.projectId !== historyOwner.projectId ||
+                owner.tenantId !== historyOwner.tenantId ||
+                owner.tenantId !== history.scope.tenantId)
+                throw new Error('The requesting run does not own this resident history.');
+            return history;
+        }));
+    }
+    if (options.residentToolEvidence) {
+        const evidence = options.residentToolEvidence;
+        const evidenceOwner = { ...scope };
+        registry.register(buildResidentToolEvidenceTools((context) => {
+            const owner = delegationScopes.get(context.runId);
+            if (!owner ||
+                owner.sessionId !== evidenceOwner.sessionId ||
+                owner.projectId !== evidenceOwner.projectId ||
+                owner.tenantId !== evidenceOwner.tenantId ||
+                owner.projectId !== evidence.scope.projectId ||
+                owner.tenantId !== evidence.scope.tenantId)
+                throw new Error('The requesting run does not own this resident tool evidence.');
+            return evidence;
+        }));
+    }
     if (options.conversationSessions) {
         const sessions = options.conversationSessions;
         for (const build of [buildConversationSearchTool, buildConversationReadTool])
@@ -967,6 +1064,25 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 return { sessions, sessionId: owner.sessionId };
             }));
     }
+    const evidenceRecallSteps = new Map();
+    const evidenceRecallFor = (sessionId) => {
+        const sessions = options.conversationSessions;
+        if (!sessions || options.compaction?.recallEvidence === false)
+            return [];
+        let step = evidenceRecallSteps.get(sessionId);
+        if (!step) {
+            step = createConversationEvidenceRecall(sessions, sessionId, (runId) => {
+                const owner = delegationScopes.get(asRunId(runId));
+                if (!owner ||
+                    owner.sessionId !== sessionId ||
+                    owner.tenantId !== sessions.tenantId ||
+                    owner.projectId !== sessions.projectId)
+                    throw new Error('The requesting run no longer owns this conversation.');
+            }, options.compaction?.resolveEvidenceQueries !== false);
+            evidenceRecallSteps.set(sessionId, step);
+        }
+        return [step];
+    };
     let subagentRuntime;
     // Stays empty when the runtime below throws, which is the honest answer: the
     // catch is non-fatal and the session then genuinely has no delegate to
@@ -989,6 +1105,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
             cwd,
             model,
             tokenBudget: options.limits?.tokenBudget,
+            maxIterations: options.limits?.maxIterations,
+            resolveLimits: (runId) => delegationLimits.get(runId),
+            timeoutMs: options.limits?.timeoutMs,
             definitions: discovered.definitions,
             pathBuilder: new SubagentPathBuilder(projectStateRoot, scope.projectId),
             resolveParent: async (runId) => {
@@ -1110,7 +1229,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 // delegation, and a parent that delegated six times would leave
                 // seven accounts of one piece of work for the next run to read.
                 // The parent's settle is the one that speaks for the whole task.
-                const childTools = buildToolRegistry(cwd, projectStateRoot, backgroundJobs).registry;
+                const childTools = buildToolRegistry(cwd, projectStateRoot, backgroundJobs, undefined, options.stateRoot ? scope.projectId : undefined).registry;
                 // Search owns its provider connection per call, so it is safe to share
                 // with a child. Preserve the parent's configured backend/off choice.
                 const search = registry.get('web_search');
@@ -1320,6 +1439,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
     });
     const operations = new SessionOperationOwner(async () => {
         const results = await Promise.allSettled([
+            options.conversationSessions
+                ? releaseConversationEvidence(options.conversationSessions, scope.sessionId)
+                : undefined,
             subagentRuntime?.close?.(),
             sessionPlugins
                 ? sessionPlugins.manager
@@ -1396,6 +1518,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
      */
     const kernelResume = ({ entry, checkpointStore, claimFence, signal, checkpointId, listener, }) => operations.promise(signal, async (ownedSignal) => {
         const selectTaskStore = beginTaskStoreReadout();
+        const resumedLimits = (await readStoredRunGuards(join(pathBuilder.runDir(entry.projectId, entry.sessionId, entry.runId), 'run.json'), entry)) ?? resolveRunGuards(options.limits);
         // The same prelude a turn runs, and for the same reasons: a lapsed
         // OAuth token has to be renewed before the provider is used, and the
         // fallback chain has to be built AFTER that so its members do not
@@ -1416,6 +1539,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             NAMZU_IDENTITY,
             NAMZU_WORKING_DOCTRINE,
             NAMZU_DELEGATION_DOCTRINE,
+            options.conversationSessions ? CONVERSATION_EVIDENCE_GUIDANCE : undefined,
             environmentPrompt,
             memoryPrompt,
         ]
@@ -1427,6 +1551,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
         }
         delegatedResumeHandlers.set(entry.runId, resumeHandler);
         delegationScopes.set(entry.runId, { ...entry, topicId: scope.topicId });
+        delegationLimits.set(entry.runId, resumedLimits);
         const runTaskStore = selectTaskStore(entry.runId, {
             ...entry,
             topicId: scope.topicId,
@@ -1457,6 +1582,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     : {}),
                 authorizationGate: gateFor(options.rules),
                 compactionConfig: compactionConfigFor(options.compaction),
+                retainedToolPreviewChars: options.conversationSessions
+                    ? (options.compaction?.retainedToolPreviewChars ?? 4_000)
+                    : undefined,
                 prepareStep: [
                     createTaskContextStep(runTaskStore, entry.tenantId),
                     createDelegationHistoryStep(projectStateRoot, entry.sessionId),
@@ -1469,6 +1597,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                             }),
                         ]),
                     ...(options.conversationSessions ? [createContextInventoryStep()] : []),
+                    ...evidenceRecallFor(entry.sessionId),
                 ],
                 ...(options.compaction?.consolidate
                     ? { consolidateInto: memoryStore }
@@ -1488,9 +1617,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     model,
                     ...(nativeWebSearch ? { webSearch: nativeWebSearch } : {}),
                     ...(sandbox.provider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
-                    timeoutMs: CLI_INTERACTIVE_RUN_TIMEOUT_MS,
-                    tokenBudget: options.limits?.tokenBudget ?? 0,
-                    maxIterations: options.limits?.maxIterations ?? 50,
+                    ...resumedLimits,
                     maxResponseTokens: 8192,
                     permissionMode: 'auto',
                 },
@@ -1530,6 +1657,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             if (delegatedResumeHandlers.get(entry.runId) === resumeHandler) {
                 delegatedResumeHandlers.delete(entry.runId);
                 delegationScopes.delete(entry.runId);
+                delegationLimits.delete(entry.runId);
                 await subagentRuntime?.releaseRun(entry.runId);
             }
         }
@@ -1622,6 +1750,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
         reasoningEffortDefault,
         compact: (messages) => operations.promise(undefined, async (signal) => {
             const sessionId = scope.sessionId;
+            const sessions = options.conversationSessions;
             await prepareProviderCredential(signal);
             return compactNow({
                 messages,
@@ -1629,6 +1758,16 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 provider: providerForSession(sessionId),
                 model,
                 signal,
+                ...(sessions
+                    ? {
+                        onShed: async (removed) => {
+                            if (sessions.projectId !== scope.projectId ||
+                                sessions.tenantId !== scope.tenantId)
+                                throw new Error('Manual compaction is outside the current conversation scope.');
+                            await retainManualCompaction(sessions, sessionId, removed, signal);
+                        },
+                    }
+                    : {}),
             });
         }),
         // Reads the same registry object the deferred registration mutates, at
@@ -1638,6 +1777,17 @@ export async function createAgentSession(prefs, detected, options = {}) {
             .getCallableTools()
             .map((t) => t.name)
             .filter((name) => !goalToolNames.has(name)),
+        ...(pluginRuntime
+            ? {
+                plugins: {
+                    list: pluginRuntime.list,
+                    rememberState: (name) => operations.exclusive(() => pluginRuntime.rememberState(name)),
+                    setEnabled: (name, enabled) => operations.exclusive(async () => {
+                        await pluginRuntime.setEnabled(name, enabled);
+                    }),
+                },
+            }
+            : {}),
         agentIds: allowedAgentIds,
         currentTaskStore,
         resetTaskStore,
@@ -1685,6 +1835,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
         send: (messages, opts) => operations.stream(opts?.signal, (signal) => (async function* () {
             const selectTaskStore = beginTaskStoreReadout();
             const runId = opts?.runId ?? generateRunId();
+            const turnLimits = resolveRunGuards(options.limits, opts?.limits);
             const turnOpts = { ...opts, runId, signal };
             let runTools = registry;
             const resumeHandler = makeResumeHandler(approval, opts?.onPermission, opts?.permissionMode ?? options.permissionMode, (name, input) => isPromptExempt(runTools, name, input));
@@ -1698,6 +1849,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 delegatedInputWaiters.set(runId, opts.waitForInbound);
             const turnScope = { ...scope };
             delegationScopes.set(runId, turnScope);
+            delegationLimits.set(runId, turnLimits);
             try {
                 // Renew a lapsed OAuth token before the turn runs (no-op for valid
                 // tokens and non-subscription credentials).
@@ -1764,10 +1916,24 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     });
                 const residentContext = opts?.residentContext;
                 if (residentContext) {
-                    for (const contribution of createResidentStepContributions({
+                    const contextOptions = {
                         ...residentContext,
                         readOnly: (opts?.permissionMode ?? options.permissionMode) === 'plan',
-                    }))
+                    };
+                    const bundle = opts?.residentLearningDisclosure === 'on-demand'
+                        ? createResidentStepContext({
+                            ...contextOptions,
+                            authorizeLearningRead: (context) => context.runId === runId &&
+                                delegationScopes.get(context.runId) === turnScope,
+                        })
+                        : { contributions: createResidentStepContributions(contextOptions), tools: [] };
+                    if (bundle.tools.length) {
+                        // Per-send membership: neither another send nor delegated runs inherit this tool.
+                        runTools = runTools.fork();
+                        for (const tool of bundle.tools)
+                            runTools.register(tool);
+                    }
+                    for (const contribution of bundle.contributions)
                         promptContributions.register(contribution);
                     // These are invocation snapshots, not the stable working policy.
                     const invocationContext = [environmentPrompt, memoryPrompt, opts?.extraSystem]
@@ -1783,6 +1949,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     NAMZU_IDENTITY,
                     residentContext ? undefined : NAMZU_WORKING_DOCTRINE,
                     residentContext ? undefined : NAMZU_DELEGATION_DOCTRINE,
+                    options.conversationSessions ? CONVERSATION_EVIDENCE_GUIDANCE : undefined,
                     options.toolLoading === 'deferred' ? DEFERRED_TOOL_GUIDANCE : undefined,
                     // Present only while the turn runs under `plan`. A mode change
                     // is rare, so the cached prefix it re-keys is a price paid once
@@ -1828,8 +1995,11 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 try {
                     yield* runTurn({
                         provider: providerForSession(turnScope.sessionId),
-                        fileReadTracker: observationsFor(turnScope.sessionId),
+                        fileReadTracker: await observationsFor(turnScope.sessionId, messages),
                         compactionConfig: compactionConfigFor(options.compaction),
+                        retainedToolPreviewChars: options.conversationSessions
+                            ? (options.compaction?.retainedToolPreviewChars ?? 4_000)
+                            : undefined,
                         ...(options.compaction?.consolidate ? { consolidateInto: memoryStore } : {}),
                         ...(jobRegistry
                             ? {
@@ -1854,7 +2024,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                         pathBuilder,
                         workingDirectory: cwd,
                         ...(directories.length > 0 ? { additionalDirectories: [...directories] } : {}),
-                        ...(options.limits ? { limits: options.limits } : {}),
+                        limits: turnLimits,
                         sandboxWorkspace,
                         rules: options.rules,
                         structuredOutput: options.structuredOutput,
@@ -1874,6 +2044,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
                                     }),
                                 ]),
                             ...(options.conversationSessions ? [createContextInventoryStep()] : []),
+                            ...evidenceRecallFor(turnScope.sessionId),
+                            ...(options.residentEvidenceRecall ? [options.residentEvidenceRecall] : []),
                         ],
                         taskStore: runTaskStore,
                         systemPrompt,
@@ -1893,6 +2065,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                             task_update: options.toolLoading === 'deferred' ? 'deferred' : 'active',
                             task_list: options.toolLoading === 'deferred' ? 'deferred' : 'active',
                         },
+                        emergencySave: options.emergencySave ?? true,
                         onRunEvent: options.onRunEvent,
                         ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
                         ...(options.sandbox?.teardownTimeoutMs !== undefined
@@ -1916,6 +2089,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     modelSwitchHandlers.delete(runId);
                     delegatedInputWaiters.delete(runId);
                     delegationScopes.delete(runId);
+                    delegationLimits.delete(runId);
                     await subagentRuntime?.releaseRun(runId);
                 }
             }
@@ -2339,7 +2513,7 @@ function compactionConfigFor(compaction) {
             : {}),
     };
 }
-async function* runTurn({ fileReadTracker, provider, compactionConfig, consolidateInto, backgroundJobs, backgroundJobOwner, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, pathBuilder, workingDirectory, limits, additionalDirectories, sandboxWorkspace, rules, structuredOutput, reviewAnswer, maxAnswerReviews, promoteMemory, prepareStep, resumeHandler, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, completionInbox, promptContributions, runtimeToolOverrides, webSearch, web, sandboxProvider, sandboxTeardownTimeoutMs, onRunEvent, }) {
+async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTracker, provider, compactionConfig, consolidateInto, backgroundJobs, backgroundJobOwner, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, pathBuilder, workingDirectory, limits, additionalDirectories, sandboxWorkspace, rules, structuredOutput, reviewAnswer, maxAnswerReviews, promoteMemory, prepareStep, resumeHandler, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, completionInbox, promptContributions, runtimeToolOverrides, webSearch, web, sandboxProvider, sandboxTeardownTimeoutMs, onRunEvent, }) {
     const signal = opts?.signal;
     // One presenter for the whole stream, built from the registry this scope
     // already holds. Its absence HERE is what forced presentation to be name
@@ -2348,6 +2522,7 @@ async function* runTurn({ fileReadTracker, provider, compactionConfig, consolida
     const presenter = createToolPresenter(tools);
     try {
         const events = query({
+            ...(retainedToolPreviewChars !== undefined ? { retainedToolPreviewChars } : {}),
             ...(fileReadTracker ? { fileReadTracker } : {}),
             ...(structuredOutput ? { structuredOutput } : {}),
             provider,
@@ -2376,19 +2551,15 @@ async function* runTurn({ fileReadTracker, provider, compactionConfig, consolida
             compactionConfig,
             ...(consolidateInto ? { consolidateInto } : {}),
             ...(backgroundJobs ? { backgroundJobs, backgroundJobOwner } : {}),
-            // The CLI owns its process end to end, so it can safely hand the
-            // termination path to the kernel: a Ctrl-C mid-run now leaves a
-            // dump under the injected hierarchy's emergency partition instead of
-            // losing the turn.
-            emergencySave: true,
+            // Interactive chat may own process exit. An enclosing resident host
+            // instead drains the run and writes its finish/runner receipts first.
+            emergencySave,
             runConfig: {
                 model,
                 ...(sandboxProvider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
                 ...(opts?.effort !== undefined ? { effort: opts.effort } : {}),
                 ...(webSearch ? { webSearch } : {}),
-                timeoutMs: CLI_INTERACTIVE_RUN_TIMEOUT_MS,
-                tokenBudget: limits?.tokenBudget ?? 0,
-                maxIterations: limits?.maxIterations ?? 50,
+                ...resolveRunGuards(limits),
                 maxResponseTokens: 8192,
                 permissionMode: 'auto',
             },
@@ -2535,6 +2706,7 @@ export function toAgentEvent(event, presenter) {
             return {
                 kind: 'delta',
                 text: event.text,
+                ...(event.textPart ? { textPart: event.textPart } : {}),
                 ...(event.messageId ? { messageId: event.messageId } : {}),
                 ...(event.runId ? { runId: event.runId } : {}),
             };