@namzu/cli 29.0.1 → 29.1.0

package/dist/tui/agent.js

@@ -24,10 +24,11 @@ import { countListedResults, webActivityFromInput, webActivityKind, webCallTitle
  * `emptySession()` whose `send()` yields a single error event so the UI
  * renders an actionable hint rather than crashing.
  */
-import { BOOT_EVENT_NAMES, BackgroundJobRegistry, DiskSessionCheckpointStore, DiskSessionLog, DiskTaskStore, EVENT_NAME_ATTRIBUTE, GuardedFetchProvider, InMemorySessionLog, MarkdownMemoryStore, PromptContributionRegistry, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, SessionPaths, ToolRegistry, WebFetchTool, abandonTurn, batchNeedsReview, buildAskUserQuestionTool, buildMemoryTools, buildResidentHistoryTools, buildResidentToolEvidenceTools, buildSessionGoalTools, compactNow, compactSession, createComputerUseTool, createFileReadTracker, createMemoryPromoter, createMemoryRecallStep, createResidentStepContext, createResidentStepContributions, createReviewHandler, createToolPresenter, ensureProject, generateSessionId, generateTenantId, generateTopicId, generateTurnId, getBuiltinTools, isReviewExempt, isTurnInProgressError, query, resumeSession, seedObservationLedger, webGuidanceContribution, withProviderFallback, } from '@namzu/sdk';
+import { BOOT_EVENT_NAMES, BackgroundJobRegistry, DiskSessionCheckpointStore, DiskSessionLog, DiskTaskStore, EVENT_NAME_ATTRIBUTE, GuardedFetchProvider, InMemorySessionLog, MarkdownMemoryStore, PromptContributionRegistry, ProviderRegistry, SCHEDULE_TOOL_NAME, SESSION_GOAL_TOOL_NAMES, SessionPaths, SkillTool, ToolRegistry, WebFetchTool, abandonTurn, batchNeedsReview, buildAskUserQuestionTool, buildMemoryTools, buildResidentHistoryTools, buildResidentToolEvidenceTools, buildSessionGoalTools, compactNow, compactSession, createBrowserTools, createComputerUseTool, createFileReadTracker, createMemoryPromoter, createMemoryRecallStep, createResidentStepContext, createResidentStepContributions, createReviewHandler, createToolPresenter, ensureProject, generateSessionId, generateTenantId, generateTopicId, generateTurnId, getBuiltinTools, isReviewExempt, isTurnInProgressError, query, resolveContextWindow, resumeSession, seedObservationLedger, webGuidanceContribution, withProviderFallback, } from '@namzu/sdk';
 import { SubprocessComputerUseHost } from '@namzu/computer-use';
 import { realpath, stat } from 'node:fs/promises';
 import { parse, resolve } from 'node:path';
+import { createBrowserControl, } from '../browser/control.js';
 import { FileCheckpointStore } from '../checkpoints/store.js';
 import { CHECKPOINTED_TOOLS, withCheckpoints } from '../checkpoints/wrap.js';
 import { configuredPassthroughTools, resolveToolResultScreens, unmatchedPassthroughTools, } from '../config/tool-result-screens.js';
@@ -62,13 +63,15 @@ import { discoverAgentDefinitions } from '../integrations/subagents/definitions.
 import { prepareDelegatedEffort } from '../integrations/subagents/model-effort.js';
 import { resolveSubagentParent } from '../integrations/subagents/parent.js';
 import { replaySavedChildrenFor } from '../integrations/subagents/replay.js';
-import { createSubagentRuntime } from '../integrations/subagents/runtime.js';
+import { createSubagentRuntime, } from '../integrations/subagents/runtime.js';
 import { createSavedAgentHistory, createSavedAgentsStep, } from '../integrations/subagents/saved-agents.js';
 import { cliLogger } from '../logging.js';
 import { formatMemoryDiagnostics } from '../memory/presentation.js';
 import { composeMemoryPrompt, readMemory } from '../memory/store.js';
 import { composeStoredMemoryPrompt, describeCuratedNotesImport, describeMemoryMigration, importCuratedNotes, migrateMemoryOnce, saveTypedNote, } from '../memory/typed.js';
 import { createLiveModeControl, permissionChangeReason, } from '../permissions/live-mode.js';
+import { createSessionSkillCatalog } from '../skills/catalog.js';
+import { SAVE_SKILL_TOOL_NAME } from '../skills/save.js';
 import { projectTurnConversation } from './conversation-history.js';
 import { buildSwitchModelTool } from './model-switch-tool.js';
 import { resolveModelSwitch } from './model-switch.js';
@@ -287,7 +290,7 @@ async function drainIterator(iterator) {
  * Read preferences + run discovery once. Returned context drives the
  * App's lifecycle decision: ready / picker / unhealthy.
  */
-export async function probeAgentSession() {
+export async function probeAgentSession(options = {}) {
     const read = readPreferences();
     // Bracketed in the log because this is where a boot has stalled without
     // a record on either side: it reads credential files, and on WSL it asks
@@ -295,7 +298,7 @@ export async function probeAgentSession() {
     // and nothing after is this step.
     const discoveryStartedAt = Date.now();
     cliLogger().debug('discovering provider credentials');
-    const detected = await discoverProviders();
+    const detected = await discoverProviders(options.env ? { env: options.env } : {});
     cliLogger().debug('provider credentials discovered', {
         'namzu.boot.discovery_ms': Date.now() - discoveryStartedAt,
         'namzu.boot.detected_count': detected.length,
@@ -376,6 +379,9 @@ const EAGER_TOOLS_WHEN_DEFERRED = [
     'web_fetch',
     'search_conversation',
     'read_conversation',
+    // The skills manifest tells the model to load a skill through this tool;
+    // deferring it would make every skill a two-step search first.
+    'skill',
     'search_resident_history',
     'read_resident_history',
     'search_resident_tools',
@@ -483,13 +489,6 @@ function buildToolRegistry(paths, backgroundJobs, checkpoints, screens) {
     // after runtime tools are registered. Ordinary CLI task tools are active.
     return { registry, memoryStore, memoryDirectory: directory };
 }
-/** Refresh plugin skill metadata before each provider operation. */
-async function currentPluginSkills(registry) {
-    const names = registry.list().map((skill) => skill.metadata.name);
-    for (const name of names)
-        await registry.load(name, 'metadata');
-    return registry.list();
-}
 export async function createAgentSession(prefs, detected, options = {}) {
     const fileObservations = new Map();
     /**
@@ -906,7 +905,12 @@ export async function createAgentSession(prefs, detected, options = {}) {
     let lastSendInteractive = false;
     const boundaryFor = (interactive) => ({
         ...(sandbox.provider && sandbox.environment
-            ? { sandbox: { environment: sandbox.environment, enforced: sandbox.enforced } }
+            ? {
+                sandbox: {
+                    environment: sandbox.environment,
+                    enforced: sandbox.enforced,
+                },
+            }
             : {}),
         escape: sandboxEscape === 'refuse'
             ? 'refused'
@@ -962,7 +966,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
      */
     const storedMemoryPrompt = async () => {
         try {
-            return { prompt: composeStoredMemoryPrompt(await memoryStore.readIndex()) };
+            return {
+                prompt: composeStoredMemoryPrompt(await memoryStore.readIndex()),
+            };
         }
         catch (error) {
             return {
@@ -1014,6 +1020,26 @@ export async function createAgentSession(prefs, detected, options = {}) {
             }));
         }
     }
+    // The browser: mounted for a surface that asked for it, never launched
+    // here. The host detects the engine now and starts the browser on the
+    // model's first call. Parent session only — sub-agents build their own
+    // registries below and never receive it.
+    const browserPackage = capabilities.find((probe) => probe.specifier === '@namzu/browser');
+    let browserControl;
+    let browserError;
+    if (options.browser && browserPackage?.state === 'present') {
+        try {
+            const { PlaywrightBrowserHost } = await import('@namzu/browser');
+            browserControl = createBrowserControl(PlaywrightBrowserHost, options.browser);
+            registry.register(createBrowserTools(browserControl.host));
+        }
+        catch (error) {
+            browserError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    const browserUnavailable = browserError !== undefined
+        ? describeError(browserError)
+        : browserControl?.status().unavailableReason;
     // Registered only on the main session path. Sub-agents call
     // `buildToolRegistry` directly below, so they never receive these tools.
     // Per-send denial further keeps the schemas out of ordinary human turns.
@@ -1069,6 +1095,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
         sandboxReady: sandbox.provider !== undefined,
         computerUseReady: computerUseHost !== undefined,
         ...(computerUseError ? { computerUseError } : {}),
+        browserReady: browserControl !== undefined && browserUnavailable === undefined,
+        ...(browserControl ? { browser: browserControl.status() } : {}),
+        ...(browserUnavailable !== undefined ? { browserUnavailable } : {}),
     });
     // URL fetching is separately opt-in and parent-only: children do not
     // carry its guarded provider. Independent search is shared below because
@@ -1096,6 +1125,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // Best-effort — if the runtime can't stand up, the chat still works.
     const delegationScopes = new Map();
     const delegationLimits = new Map();
+    // A resumed turn that runs on another model than the session's (a
+    // scheduled job's): its children inherit that model, not the session's.
+    const delegationModels = new Map();
     const delegatedInputWaiters = new Map();
     if (options.residentHistory) {
         const history = options.residentHistory;
@@ -1193,6 +1225,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             tokenBudget: options.limits?.tokenBudget,
             maxIterations: options.limits?.maxIterations,
             resolveLimits: (turnId) => delegationLimits.get(turnId),
+            resolveTurnModel: (turnId) => delegationModels.get(turnId),
             timeoutMs: options.limits?.timeoutMs,
             definitions: discovered.definitions,
             // Children log under the parent's `<session-id>/subagents/`; an
@@ -1382,6 +1415,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             const remaining = await Promise.allSettled([
                 mcp.close(),
                 computerUseHost?.dispose(),
+                browserControl?.dispose(),
                 jobRegistry?.killOwner(jobOwner),
                 checkpoints.close(),
             ]);
@@ -1448,6 +1482,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
         // park recorder is supplied.
         registry.register(buildAskUserQuestionTool({ resumeHandler: parkQuestion }));
     }
+    // The host's own additions, to this registry only: `buildTools` above
+    // builds a child's roster separately, so none of these reach a sub-agent.
+    for (const tool of options.extraTools ?? [])
+        registry.register(tool);
     // Task store → query registers task_create / task_update / task_list and
     // emits task_created/task_updated, so the agent can track a plan. Tasks
     // belong to the session (`<session-id>/tasks/`) and record the turn that
@@ -1514,14 +1552,35 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // refusal closes the MCP processes already opened for this candidate before
     // returning an inert session. Sub-agents were built above from their own
     // registries, so executable plugins remain a top-level-session capability.
+    // File skills (built-in, ~/.agents, ~/.namzu, and the project's) reach the
+    // model through the kernel's manifest and `skill` tool. Registered BEFORE
+    // the plugin runtime: a runtime that finds the tool already there never
+    // owns it, so disabling the last plugin skill cannot take away the tool
+    // the file skills load through.
+    const skillCatalog = await createSessionSkillCatalog({
+        cwd,
+        ...(options.skills ? { config: options.skills } : {}),
+        log: cliLogger(),
+    });
+    // A session that can save a skill loads it next turn through this tool,
+    // even when it started with none.
+    if ((skillCatalog.hasFileSkills || registry.has(SAVE_SKILL_TOOL_NAME)) &&
+        !registry.has(SkillTool.name))
+        registry.register(SkillTool);
     let pluginRuntime;
     try {
         pluginRuntime = await createCliPluginRuntime(options.plugins, registry, cwd, options.hooks);
     }
     catch (error) {
-        await Promise.allSettled([mcp.close(), computerUseHost?.dispose()]);
+        await Promise.allSettled([mcp.close(), computerUseHost?.dispose(), browserControl?.dispose()]);
         return emptySession(describeError(error));
     }
+    // Everything is registered by now but the deferred task tools, which no
+    // caller withholds.
+    for (const name of options.withheldTools ?? []) {
+        if (registry.get(name))
+            registry.unregister(name);
+    }
     // The session's own lifecycle, for hooks that set up or tear down
     // something per session rather than per turn. These two calls belong to no
     // turn, so they carry no turn id — nothing is minted to fill the field.
@@ -1530,6 +1589,14 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // is replaced when the conversation is first made durable — and a hook
     // given the provisional id could never match it to a turn.
     const sessionPlugins = pluginRuntime;
+    // What one turn's prompt manifest and `skill` tool see: the file skills
+    // gated against the tools registered now, merged with the plugins' own.
+    const turnSkillsFor = (turnModel) => skillCatalog.forTurn({
+        toolNames: registry.listNames(),
+        contextWindowTokens: resolveContextWindow(options.compaction?.contextWindowTokens, turnModel)
+            .tokens,
+        ...(sessionPlugins ? { pluginSkills: sessionPlugins.skills } : {}),
+    });
     let sessionStarted = false;
     const announceSessionStart = async () => {
         if (!sessionPlugins || sessionStarted)
@@ -1591,6 +1658,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 : undefined,
             mcp.close(),
             computerUseHost?.dispose(),
+            browserControl?.dispose(),
             jobRegistry?.killOwner(jobOwner),
             checkpoints.close(),
         ]);
@@ -1647,13 +1715,35 @@ export async function createAgentSession(prefs, detected, options = {}) {
         reasoningEffortDefault = undefined;
         effortNotice = `Reasoning effort levels could not be established for this session: ${describeError(error)}`;
     }
+    /**
+     * The provider a resumed turn runs on when its caller pinned one (a
+     * scheduled job's model): built from this session's credential for that
+     * provider, with no fallback chain, since the job's own run has none.
+     * `undefined` without a pin.
+     */
+    const pinnedResumeRoute = async (pin, sessionId, signal) => {
+        if (!pin)
+            return undefined;
+        const providerId = pin.provider;
+        const found = findDetected(detected, providerId);
+        if (!found)
+            throw new Error(`the turn runs on ${pin.provider}${pin.model ? `/${pin.model}` : ''} and this session has no credential for ${pin.provider}`);
+        const pinnedModel = pin.model ?? found.entry.defaultModel;
+        await ensureRegistered(providerId);
+        const credential = await currentCredentialFor(providerId, signal);
+        const pinnedProvider = constructProvider(providerId, credential, pinnedModel, { sessionId });
+        const effort = pin.effort;
+        if (effort !== undefined)
+            await prepareDelegatedEffort(pinnedProvider, pinnedModel, signal);
+        return { provider: pinnedProvider, model: pinnedModel, ...(effort ? { effort } : {}) };
+    };
     /**
      * The kernel's resume with this session's half of the turn attached: the
      * provider, the tools, the working directory, the doctrine — the part a
      * checkpoint cannot carry. `resumeDurable` and `resumePaused` differ only
      * in where the log and its lease come from.
      */
-    const kernelResume = ({ entry, sessionLog, checkpointStore, lease, signal, checkpointId, listener, permissionMode, currentPermissionMode, }) => operations.promise(signal, async (ownedSignal) => {
+    const kernelResume = ({ entry, sessionLog, checkpointStore, lease, signal, checkpointId, listener, permissionMode, currentPermissionMode, pendingDecision, onPermission, rules, reviewHold, model: pinned, systemNote, }) => operations.promise(signal, async (ownedSignal) => {
         const selectTaskStore = beginTaskStoreReadout();
         // The turn's own limits, as its `turn_started` recorded them.
         const resumedLimits = (await readStoredTurnGuards(sessionLog, entry.turnId)) ?? resolveTurnGuards(options.limits);
@@ -1662,9 +1752,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
         // fallback chain has to be built AFTER that so its members do not
         // hold a client the refresh just replaced.
         await prepareProviderCredential(ownedSignal);
-        const pluginSkills = pluginRuntime
-            ? await currentPluginSkills(pluginRuntime.skills)
-            : undefined;
+        const route = await pinnedResumeRoute(pinned, entry.sessionId, ownedSignal);
+        const turnSkills = await turnSkillsFor(route?.model ?? model);
         const curatedMemory = readMemory(undefined, cwd);
         for (const notice of formatMemoryDiagnostics(curatedMemory))
             cliLogger().warn(notice);
@@ -1687,6 +1776,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
             options.conversationSessions ? CONVERSATION_EVIDENCE_GUIDANCE : undefined,
             environmentPrompt,
             memoryPrompt,
+            systemNote,
+            turnSkills.overflowNote,
         ]
             .filter((s) => Boolean(s))
             .join('\n\n') || undefined;
@@ -1708,7 +1799,13 @@ export async function createAgentSession(prefs, detected, options = {}) {
             ...(recordedModes.has(String(entry.sessionId))
                 ? { recorded: recordedModes.get(String(entry.sessionId)) }
                 : {}),
-            handlerFor: (mode) => makeResumeHandler(approval, undefined, mode, reviewExemptionFor(mode, registry, (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true), { unattendedSandboxEscape }),
+            handlerFor: (mode) => onPermission === undefined && reviewHold !== undefined
+                ? makeHoldingResumeHandler(mode, reviewExemptionFor(mode, registry, (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true), { unattendedSandboxEscape }, reviewHold.reason)
+                : makeResumeHandler(
+                // A caller that brings its own prompt (a scheduled turn answered in
+                // the TUI) gets its own latch: the session's "approve all" is not
+                // an answer about a turn another policy started.
+                onPermission ? { all: false } : approval, onPermission, mode, reviewExemptionFor(mode, registry, (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true), { unattendedSandboxEscape }),
         });
         const resumeHandler = modeControl.handler;
         const reviewAllowedCalls = modeControl.reviewAllowedCalls;
@@ -1718,15 +1815,21 @@ export async function createAgentSession(prefs, detected, options = {}) {
         delegatedReviewAllowedCalls.set(entry.turnId, reviewAllowedCalls);
         delegationScopes.set(entry.turnId, turnScope);
         delegationLimits.set(entry.turnId, resumedLimits);
+        if (route && pinned)
+            delegationModels.set(entry.turnId, {
+                provider: pinned.provider,
+                model: route.model,
+                ...(route.effort ? { effort: route.effort } : {}),
+            });
         const turnTaskStore = selectTaskStore(turnScope);
         try {
             return await resumeSession({
-                provider: providerForSession(entry.sessionId),
-                fallbackProviders: fallbackPlan.build(currentToken, entry.sessionId),
+                provider: route?.provider ?? providerForSession(entry.sessionId),
+                fallbackProviders: route ? [] : fallbackPlan.build(currentToken, entry.sessionId),
                 tools: registry,
                 pluginManager: pluginRuntime?.manager,
-                skillRegistry: pluginRuntime?.skills,
-                skills: pluginSkills,
+                ...(turnSkills.registry ? { skillRegistry: turnSkills.registry } : {}),
+                ...(turnSkills.manifest ? { skills: turnSkills.manifest } : {}),
                 taskStore: turnTaskStore,
                 ...(webCapability ? { web: webCapability } : {}),
                 // The same availability the original turn registered under.
@@ -1739,9 +1842,12 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     task_list: 'active',
                 },
                 ...(subagentRuntime
-                    ? { taskScheduler: await subagentRuntime.gatewayForTurn(entry.turnId) }
+                    ? {
+                        taskScheduler: await subagentRuntime.gatewayForTurn(entry.turnId),
+                    }
                     : {}),
-                authorizationGate: gateFor(options.rules),
+                authorizationGate: gateFor(rules ?? options.rules),
+                ...(pendingDecision ? { pendingDecision } : {}),
                 compactionConfig: compactionConfigFor(options.compaction),
                 retainedToolPreviewChars: options.conversationSessions
                     ? (options.compaction?.retainedToolPreviewChars ?? 4_000)
@@ -1770,7 +1876,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     ? { sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs }
                     : {}),
                 turnConfig: {
-                    model,
+                    model: route?.model ?? model,
+                    ...(route?.effort ? { effort: route.effort } : {}),
                     ...(nativeWebSearch ? { webSearch: nativeWebSearch } : {}),
                     ...(sandbox.provider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
                     ...resumedLimits,
@@ -1833,6 +1940,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 delegatedReviewAllowedCalls.delete(entry.turnId);
                 delegationScopes.delete(entry.turnId);
                 delegationLimits.delete(entry.turnId);
+                delegationModels.delete(entry.turnId);
                 await subagentRuntime?.releaseTurn(entry.turnId);
             }
         }
@@ -1843,12 +1951,13 @@ export async function createAgentSession(prefs, detected, options = {}) {
      * headless caller renders a resumed turn exactly as it rendered the first
      * segment.
      */
-    const resumePausedStream = ({ turnId, checkpointId, signal, permissionMode, currentPermissionMode, }) => {
+    const resumePausedStream = ({ turnId, checkpointId, signal, permissionMode, currentPermissionMode, pendingDecision, onPermission, rules, reviewHold, model: pinned, systemNote, }) => {
         const queue = [];
         let wake;
         let settled = false;
         let failure;
         const presenter = createToolPresenter(registry);
+        const readsOnly = declaredReadOnly(registry);
         // The log the turn appends to, and its checkpoints beside it.
         const sessionLog = DiskSessionLog.at(paths, { sessionId: scope.sessionId });
         const outcome = kernelResume({
@@ -1863,6 +1972,12 @@ export async function createAgentSession(prefs, detected, options = {}) {
             ...(checkpointId !== undefined ? { checkpointId: checkpointId } : {}),
             ...(permissionMode ? { permissionMode } : {}),
             ...(currentPermissionMode ? { currentPermissionMode } : {}),
+            ...(pendingDecision ? { pendingDecision } : {}),
+            ...(onPermission ? { onPermission } : {}),
+            ...(rules ? { rules } : {}),
+            ...(reviewHold ? { reviewHold } : {}),
+            ...(pinned ? { model: pinned } : {}),
+            ...(systemNote ? { systemNote } : {}),
             listener: (event) => {
                 queue.push(event);
                 wake?.();
@@ -1888,7 +2003,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     const next = queue.shift();
                     if (!next)
                         break;
-                    const mapped = toAgentEvent(next, presenter);
+                    const mapped = toAgentEvent(next, presenter, readsOnly);
                     if (mapped)
                         yield mapped;
                 }
@@ -2005,6 +2120,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             return mcp.failed;
         },
         mcpStatus: () => mcp.current(),
+        ...(browserControl ? { browser: browserControl } : {}),
         configNotices: [
             ...(capabilityNotice ? [capabilityNotice] : []),
             ...(effortNotice ? [effortNotice] : []),
@@ -2012,15 +2128,24 @@ export async function createAgentSession(prefs, detected, options = {}) {
             ...(computerUseError
                 ? [`Computer use is unavailable on this device: ${describeError(computerUseError)}`]
                 : []),
+            ...(browserUnavailable !== undefined
+                ? [`The browser is unavailable: ${browserUnavailable}`]
+                : []),
             ...unresolvedNotice.map((line) => `Provider chain: capabilities could not be established for ${line}.`),
             ...fallbackPlan.notices,
             ...memoryMigrationNotices,
         ],
         rememberNote: (text, type) => saveTypedNote(memoryStore, text, type),
-        importCuratedNotes: async () => describeCuratedNotesImport(await importCuratedNotes({ store: memoryStore, directory: memoryDirectory, cwd }), memoryDirectory),
+        importCuratedNotes: async () => describeCuratedNotesImport(await importCuratedNotes({
+            store: memoryStore,
+            directory: memoryDirectory,
+            cwd,
+        }), memoryDirectory),
         storedMemoryIndex: async () => ({
             directory: memoryDirectory,
-            index: await memoryStore.readIndex({ maxLines: Number.POSITIVE_INFINITY }),
+            index: await memoryStore.readIndex({
+                maxLines: Number.POSITIVE_INFINITY,
+            }),
             derived: await memoryStore.readIndex({
                 maxLines: Number.POSITIVE_INFINITY,
                 derived: true,
@@ -2048,7 +2173,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             const turnScope = { ...scope };
             const initialMode = opts?.permissionMode ??
                 options.permissionMode ??
-                (opts?.onPermission ? 'prompt' : 'auto');
+                (opts?.onPermission || opts?.reviewHold ? 'prompt' : 'auto');
             // The mode is read at every decision, so the operator can change it
             // while this turn runs (see permissions/live-mode.ts).
             const modeControl = createLiveModeControl({
@@ -2057,7 +2182,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 ...(recordedModes.has(String(turnScope.sessionId))
                     ? { recorded: recordedModes.get(String(turnScope.sessionId)) }
                     : {}),
-                handlerFor: (mode) => makeResumeHandler(approval, opts?.onPermission, mode, reviewExemptionFor(mode, runTools, (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true), { unattendedSandboxEscape }),
+                handlerFor: (mode) => opts?.reviewHold
+                    ? makeHoldingResumeHandler(mode, reviewExemptionFor(mode, runTools, (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true), { unattendedSandboxEscape }, opts.reviewHold.reason)
+                    : makeResumeHandler(approval, opts?.onPermission, mode, reviewExemptionFor(mode, runTools, (input) => subagentRuntime?.launchesReadOnlyAgent(input) === true), { unattendedSandboxEscape }),
             });
             const resumeHandler = modeControl.handler;
             liveModeControls.add(modeControl);
@@ -2106,9 +2233,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 // runs — midnight passes, and the agent checks out a branch itself.
                 // Its text only changes when a fact changes, so it costs a prompt-cache
                 // miss exactly when a hit would have been a stale claim.
-                const pluginSkills = pluginRuntime
-                    ? await currentPluginSkills(pluginRuntime.skills)
-                    : undefined;
+                const turnSkills = await turnSkillsFor(model);
                 // One fork after plugin refresh, held through every iteration of
                 // this send. Discovery cannot activate another send's schemas.
                 if (options.toolLoading === 'deferred')
@@ -2121,7 +2246,11 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 }
                 const storedMemory = await storedMemoryPrompt();
                 if (storedMemory.notice) {
-                    yield { kind: 'context', text: storedMemory.notice, shed: false };
+                    yield {
+                        kind: 'context',
+                        text: storedMemory.notice,
+                        shed: false,
+                    };
                 }
                 const memoryPrompt = [composeMemoryPrompt(curatedMemory), storedMemory.prompt]
                     .filter((part) => Boolean(part))
@@ -2179,7 +2308,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
                             authorizeLearningRead: (context) => claimed.has(context.turnId) &&
                                 delegationScopes.get(context.turnId) === turnScope,
                         })
-                        : { contributions: createResidentStepContributions(contextOptions), tools: [] };
+                        : {
+                            contributions: createResidentStepContributions(contextOptions),
+                            tools: [],
+                        };
                     if (bundle.tools.length) {
                         // Per-send membership: neither another send nor delegated sessions inherit this tool.
                         runTools = runTools.fork();
@@ -2201,7 +2333,12 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 const systemPrompt = [
                     NAMZU_IDENTITY,
                     residentContext ? undefined : NAMZU_WORKING_DOCTRINE,
-                    residentContext ? undefined : NAMZU_DELEGATION_DOCTRINE,
+                    // Advice on delegating, for a session that has the Agent tool:
+                    // a scheduled run whose job withholds it would only be told how
+                    // to use a tool it was not sent.
+                    residentContext || options.withheldTools?.includes(AGENT_LAUNCH_TOOL)
+                        ? undefined
+                        : NAMZU_DELEGATION_DOCTRINE,
                     !residentContext && opts?.orchestrate ? NAMZU_ORCHESTRATE_DOCTRINE : undefined,
                     options.conversationSessions ? CONVERSATION_EVIDENCE_GUIDANCE : undefined,
                     options.toolLoading === 'deferred' ? DEFERRED_TOOL_GUIDANCE : undefined,
@@ -2214,6 +2351,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     residentContext ? undefined : environmentPrompt,
                     residentContext ? undefined : memoryPrompt,
                     residentContext ? undefined : opts?.extraSystem,
+                    residentContext ? undefined : opts?.systemNote,
+                    turnSkills.overflowNote,
                 ]
                     .filter((s) => Boolean(s))
                     .join('\n\n') || undefined;
@@ -2246,7 +2385,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 // when this session is the one bringing it into existence.
                 let ephemeralLog;
                 if (options.ephemeral) {
-                    ephemeralLog = new InMemorySessionLog({ sessionId: turnScope.sessionId });
+                    ephemeralLog = new InMemorySessionLog({
+                        sessionId: turnScope.sessionId,
+                    });
                     await ensureSessionStarted(ephemeralLog, {
                         ...turnScope,
                         cwd,
@@ -2288,8 +2429,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
                         model,
                         tools: runTools,
                         pluginManager: pluginRuntime?.manager,
-                        skillRegistry: pluginRuntime?.skills,
-                        skills: pluginSkills,
+                        skillRegistry: turnSkills.registry,
+                        skills: turnSkills.manifest,
                         scope: turnScope,
                         turnId,
                         paths,
@@ -2841,6 +2982,7 @@ async function* runTurn({ retainedToolPreviewChars, fileReadTracker, provider, c
     // matching in the first place: `toAgentEvent` is pure over a `SessionEvent`
     // and could not ask a tool anything, so the host guessed from the name.
     const presenter = createToolPresenter(tools);
+    const readsOnly = declaredReadOnly(tools);
     try {
         const events = query({
             ...(retainedToolPreviewChars !== undefined ? { retainedToolPreviewChars } : {}),
@@ -2959,7 +3101,7 @@ async function* runTurn({ retainedToolPreviewChars, fileReadTracker, provider, c
                     // receipts and reasoning before the next user turn.
                     continue;
                 }
-                const mapped = toAgentEvent(event, presenter);
+                const mapped = toAgentEvent(event, presenter, readsOnly);
                 if (!mapped)
                     continue;
                 yield mapped;
@@ -3016,6 +3158,41 @@ export function makeResumeHandler(approval, onPermission, mode = onPermission ?
         unattendedSandboxEscape: escapePolicy.unattendedSandboxEscape ?? 'refuse',
     });
 }
+/** Thrown by the holding prompt; never leaves {@link makeHoldingResumeHandler}. */
+class ReviewHoldSignal extends Error {
+    name = 'ReviewHoldSignal';
+}
+/**
+ * The kernel's review policy with a prompt that never answers: every batch
+ * that would be put to a person parks the turn instead (`{ action: 'pause' }`),
+ * which the kernel records durably for a person to answer later.
+ *
+ * The prompt throws and THIS wrapper catches it: a handler that rejects is
+ * turned into `abort` by the kernel (`awaitDecisionOrAbort`), which would end
+ * the turn rather than hold it. The latch is private and never set, so no
+ * earlier answer can approve a later batch.
+ */
+export function makeHoldingResumeHandler(mode, exempt, escapePolicy, reason) {
+    const inner = createReviewHandler({
+        mode,
+        prompt: async () => {
+            throw new ReviewHoldSignal(reason);
+        },
+        exempt,
+        remembered: { all: false },
+        unattendedSandboxEscape: escapePolicy.unattendedSandboxEscape ?? 'refuse',
+    });
+    return async (request) => {
+        try {
+            return await inner(request);
+        }
+        catch (error) {
+            if (error instanceof ReviewHoldSignal)
+                return { action: 'pause', reason };
+            throw error;
+        }
+    };
+}
 /**
  * Whether a call runs without asking. The kernel's rule: a trusted read-only
  * declaration or a named bookkeeping write, never a fetch, never a tool the
@@ -3038,10 +3215,53 @@ export const AGENT_LAUNCH_TOOL = 'Agent';
  * An operator who wants every launch asked about writes
  * `permissions: { Agent: "ask" }`: an `ask` rule is an explicit review, which
  * no exemption skips.
+ *
+ * `save_skill` (the TUI's alone) is not asked about here either, outside
+ * `strict` and `plan`: its own screen shows the whole file and where it goes,
+ * and asks in every mode, `auto` included. A second question in front of it
+ * would ask the same thing with less on the screen. `strict` and `plan` still
+ * refuse it, and an `ask` or `deny` rule for it still applies. Neither is
+ * the `schedule` tool's `create`, `resume` or `delete`, for the same reason
+ * (see {@link confirmsItself}).
  */
 export function reviewExemptionFor(mode, registry, launchesReadOnlyAgent) {
     return (name, input) => isPromptExempt(registry, name, input) ||
-        (mode !== 'strict' && name === AGENT_LAUNCH_TOOL && launchesReadOnlyAgent(input));
+        (mode !== 'strict' && name === AGENT_LAUNCH_TOOL && launchesReadOnlyAgent(input)) ||
+        (mode !== 'strict' && mode !== 'plan' && confirmsItself(name, input)) ||
+        (mode !== 'strict' &&
+            mode !== 'plan' &&
+            name === SAVE_SKILL_TOOL_NAME &&
+            registry.has(SAVE_SKILL_TOOL_NAME));
+}
+/**
+ * The `schedule` tool's `create`, `resume` and `delete`: each puts its own
+ * confirmation in front of the operator, drawn from the host's computation,
+ * and changes nothing unless they choose to. A review before it only asked
+ * "Do you want to run schedule?" over the model's raw arguments, and then the
+ * real question came. `pause` and anything else is reviewed as before; `plan`
+ * and `strict` still refuse, and an `ask` or `deny` rule still decides, since
+ * an explicit review is never exempted.
+ */
+export function confirmsItself(name, input) {
+    if (name !== SCHEDULE_TOOL_NAME || typeof input !== 'object' || input === null)
+        return false;
+    const action = input.action;
+    return action === 'create' || action === 'resume' || action === 'delete';
+}
+/**
+ * A call's own read-only declaration, as the tool states it for this input.
+ * Not a permission answer (that is `isPromptExempt`): it only says whether a
+ * finished turn changed anything, for the TUI's skill suggestion.
+ */
+function declaredReadOnly(registry) {
+    return (toolName, input) => {
+        try {
+            return registry.get(toolName)?.isReadOnly?.(input) === true;
+        }
+        catch {
+            return false;
+        }
+    };
 }
 /** The exempt roster, sorted, for the surface that has to NAME it. */
 export function promptExemptToolNames(registry) {
@@ -3058,7 +3278,9 @@ export const batchNeedsPrompt = batchNeedsReview;
  * `null` for events the chat surface doesn't render (iteration markers,
  * checkpoints, plan lifecycle, …). Pure — unit-tested.
  */
-export function toAgentEvent(event, presenter) {
+export function toAgentEvent(event, presenter, 
+/** Whether a call only reads, from the tool's own declaration; see `tool-start.readOnly`. */
+readsOnly) {
     switch (event.type) {
         case 'hosted_tool': {
             const common = {
@@ -3134,6 +3356,7 @@ export function toAgentEvent(event, presenter) {
                     const web = webActivityFromInput(event.toolName, event.input);
                     return web ? { web } : {};
                 })(),
+                ...(readsOnly?.(event.toolName, event.input) ? { readOnly: true } : {}),
             };
         case 'tool_progress':
             return {
@@ -3151,12 +3374,19 @@ export function toAgentEvent(event, presenter) {
                     output: event.result,
                 });
             const detail = viewToLines(view);
-            // Drop only an exact duplicate. A shortened summary cannot replace
-            // the first line's evidence in expanded or raw output.
-            const summary = view.kind === 'terminal' && detail && detail.length > 0
-                ? truncate(detail[0], 120)
-                : firstLine(event.result);
-            const withoutRepeatedSummary = view.kind === 'terminal' && detail?.[0] === summary ? detail.slice(1) : detail;
+            // The first line is the summary row. It leaves the body only when
+            // the row says all of it: a shortened summary cannot replace the
+            // first line's evidence in expanded or raw output. A first line
+            // up to a few rows long is shown whole, so a note like "A
+            // navigation to … was blocked" is not printed twice, once cut off
+            // on the summary row and again in full underneath.
+            const first = view.kind === 'terminal' && view.output.trim().length > 0
+                ? resultToLines(view.output)[0]
+                : undefined;
+            const summary = first !== undefined ? resultSummaryLine(first) : firstLine(event.result);
+            const withoutRepeatedSummary = first !== undefined && detail?.[0] === first && summarySaysAll(first, summary)
+                ? detail.slice(1)
+                : detail;
             return {
                 kind: 'tool-end',
                 output: event.result,
@@ -3167,6 +3397,9 @@ export function toAgentEvent(event, presenter) {
                 summary,
                 ...(event.durationMs !== undefined ? { durationMs: event.durationMs } : {}),
                 ...(view.kind === 'generic' && view.visibility === 'hidden' ? { hidden: true } : {}),
+                ...(event.isError && view.kind === 'generic' && view.outcome === 'cancelled'
+                    ? { cancelled: true }
+                    : {}),
                 ...(view.kind === 'generic' && view.label.length > 0 ? { resultLabel: view.label } : {}),
                 ...(withoutRepeatedSummary && withoutRepeatedSummary.length > 0
                     ? { detail: withoutRepeatedSummary }
@@ -3176,7 +3409,9 @@ export function toAgentEvent(event, presenter) {
                     if (!kind)
                         return {};
                     const results = kind === 'search' && !event.isError ? countListedResults(event.result) : undefined;
-                    return { web: { kind, ...(results !== undefined ? { results } : {}) } };
+                    return {
+                        web: { kind, ...(results !== undefined ? { results } : {}) },
+                    };
                 })(),
             };
         }
@@ -3265,6 +3500,7 @@ export function toAgentEvent(event, presenter) {
                 ...(event.failure ? { failure: event.failure } : {}),
                 ...(event.providerError ? { providerError: event.providerError } : {}),
                 ...(event.explanation ? { explanation: event.explanation } : {}),
+                ...(event.handoff ? { handoff: event.handoff } : {}),
             };
         case 'turn_completed':
             // Carried through rather than dropped: `turn_failed` fires only from
@@ -3448,8 +3684,10 @@ export function viewToLines(view) {
             if (view.output.trim().length === 0)
                 return undefined;
             const lines = resultToLines(view.output);
-            // A single short line is already the summary — no need to repeat it.
-            return lines.length === 1 && lines[0] === truncate(lines[0] ?? '', 120) ? undefined : lines;
+            // A single line the summary row shows whole is not repeated under it.
+            return lines.length === 1 && summarySaysAll(lines[0] ?? '', resultSummaryLine(lines[0] ?? ''))
+                ? undefined
+                : lines;
         }
     }
 }
@@ -3464,6 +3702,21 @@ export function viewToSummary(view) {
             return truncate(view.command ?? view.output.split('\n')[0] ?? '', 120);
     }
 }
+/**
+ * The longest first line a result's summary row shows whole, about three
+ * terminal rows. Longer, the row shows its first 120 characters and the body
+ * keeps the line.
+ */
+export const RESULT_SUMMARY_WHOLE_MAX = 300;
+/** A result's summary row for its first line: whole when short enough, else shortened. */
+export function resultSummaryLine(line) {
+    const flat = line.replace(/\s+/g, ' ');
+    return flat.length <= RESULT_SUMMARY_WHOLE_MAX ? flat : truncate(line, 120);
+}
+/** The summary row says everything `line` does (whitespace aside). */
+function summarySaysAll(line, summary) {
+    return line === summary || line.replace(/\s+/g, ' ') === summary;
+}
 function truncate(value, max) {
     const oneLine = value.replace(/\s+/g, ' ');
     return oneLine.length > max ? `${oneLine.slice(0, max - 1)}…` : oneLine;
@@ -3573,7 +3826,9 @@ function logCapabilities(probes, runtime) {
             ? runtime.sandboxReady
             : p.specifier === '@namzu/computer-use'
                 ? runtime.computerUseReady
-                : p.state === 'present';
+                : p.specifier === '@namzu/browser'
+                    ? runtime.browserReady === true
+                    : p.state === 'present';
         return `${p.specifier.split('/').pop()} ${present ? 'yes' : 'no'}`;
     })
         .join(' · ');
@@ -3597,6 +3852,22 @@ function logCapabilities(probes, runtime) {
             ...(probe.state === 'present' ? { 'namzu.capability.version': probe.version } : {}),
         });
     }
+    if (runtime.browser) {
+        // The engine and profile the browser tools will use; nothing is running yet.
+        log.info('Browser tools mounted', {
+            [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.CAPABILITY_DETECTED,
+            'namzu.capability.name': '@namzu/browser',
+            'namzu.capability.state': runtime.browserUnavailable === undefined ? 'ready' : 'unavailable',
+            'namzu.capability.present': runtime.browserReady === true,
+            'namzu.browser.engine': runtime.browser.engine,
+            'namzu.browser.profile': runtime.browser.profile,
+            'namzu.browser.headless': runtime.browser.headless,
+            'namzu.browser.site_count': Object.keys(runtime.browser.sites).length,
+            ...(runtime.browserUnavailable !== undefined
+                ? { 'namzu.browser.unavailable_reason': runtime.browserUnavailable }
+                : {}),
+        });
+    }
     if (runtime.computerUseError) {
         log.warn('Computer use adapter is unavailable', {
             [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.CAPABILITY_DETECTED,