@namzu/sdk 59.0.0 → 60.1.0

package/src/plugin/loader.ts

@@ -11,6 +11,8 @@ import { type PluginManifest, PluginManifestSchema } from '../types/plugin/index
 import { toErrorMessage } from '../utils/error.js'
 import { SCOPE_ATTRIBUTE } from '../utils/log/types.js'
 import { type Logger, resolveLogger } from '../utils/logger.js'
+import { VERSION } from '../version.js'
+import { type PluginHostFacts, assertCompatible } from './compat.js'
 
 /**
  * Scans a directory for subdirectories containing a plugin manifest.
@@ -161,7 +163,7 @@ const REGISTRY_BACKED_CONTRIBUTIONS = ['skills'] as const
  * through host configuration; what does not exist is the manifest path
  * into them. Naming the types is what makes that actionable.
  */
-export interface PluginEnablementCapabilities {
+export interface PluginEnablementCapabilities extends PluginHostFacts {
 	/**
 	 * Whether the host wired a `SkillRegistry`.
 	 *
@@ -178,6 +180,10 @@ export function assertEnableable(
 	manifest: PluginManifest,
 	capabilities: PluginEnablementCapabilities = {},
 ): void {
+	assertCompatible(manifest, {
+		platform: capabilities.platform ?? platform(),
+		namzuVersion: capabilities.namzuVersion ?? VERSION,
+	})
 	const record = manifest as unknown as Record<string, unknown[] | undefined>
 	// One ordered pass over all three rather than two group filters
 	// concatenated, so the message keeps naming them in the order the

package/src/pricing/index.ts

@@ -14,6 +14,7 @@
  * than refreshed, and `rates.source.json` for the rates themselves.
  */
 
+import { stripModelWindowSuffix } from '../compaction/context-window.js'
 import type { ModelPricing } from '../utils/cost.js'
 import { VENDOR_RATES } from './catalogue.generated.js'
 
@@ -35,7 +36,7 @@ const SNAPSHOT_SUFFIX = /[-@]\d{8}$/
 
 /** Lowercase, snapshot suffix removed. Exported because tests assert it. */
 export function normaliseModelId(model: string): string {
-	return model.toLowerCase().replace(SNAPSHOT_SUFFIX, '')
+	return stripModelWindowSuffix(model).toLowerCase().replace(SNAPSHOT_SUFFIX, '')
 }
 
 /**

package/src/process/kill-tree.ts

@@ -1,4 +1,5 @@
 import { execFileSync } from 'node:child_process'
+import { readFileSync, readdirSync } from 'node:fs'
 
 /**
  * Git Bash children that the Windows process tree cannot reach.
@@ -11,13 +12,82 @@ import { execFileSync } from 'node:child_process'
  * in its environment, which every descendant inherits however it was started;
  * the tag is how the tree is found again.
  */
-const MSYS_SHELLS = new WeakMap<object, { readonly bash: string; readonly tag: string }>()
+const MSYS_SHELLS = new WeakMap<object, { readonly bash?: string; readonly tag: string }>()
+
+/**
+ * Whether a pid may be signalled, or addressed as a group with `-pid`.
+ *
+ * `kill(-1, sig)` signals every process the user may signal and `kill(0, sig)`
+ * signals the caller's own process group, so a recorded pid of 1, 0, a negative
+ * or a fractional number (a test double, a corrupt record, `NaN`) would take
+ * down the host's whole session. Only an integer above 1 that is not this
+ * process is a real, separate process. A refused pid is treated as already gone.
+ */
+export function isSignalablePid(pid: unknown): pid is number {
+	return typeof pid === 'number' && Number.isInteger(pid) && pid > 1 && pid !== process.pid
+}
 
 /** Remember how to find every process a Git Bash child started. Called by the spawn. */
 export function registerMsysShell(child: object, shell: { bash: string; tag: string }): void {
 	MSYS_SHELLS.set(child, shell)
 }
 
+/**
+ * Remember the tag a POSIX child's environment carries, so a kill can also find
+ * a descendant that left the child's process group (`setsid`, a double fork
+ * that starts its own session). Such a process has no group to signal, but it
+ * inherited the environment, and the tag is how it is found again.
+ *
+ * The limit is the same as the group's own: a process that clears its
+ * environment before it forks escapes this too.
+ */
+export function registerProcessTag(child: object, tag: string): void {
+	MSYS_SHELLS.set(child, { tag })
+}
+
+/**
+ * Signal every process of this user whose environment carries one of the tags,
+ * by reading `/proc/<pid>/environ`. Linux only: other POSIX systems have no
+ * `/proc`, and there the process group is all a kill can reach. A process whose
+ * environment cannot be read (another user's, or one that has just ended) is
+ * skipped without further work.
+ *
+ * Several tags are looked for in one pass, so stopping many jobs at once reads
+ * each environment once, not once per job. The scan is synchronous and its cost
+ * grows with the number of processes on the machine. There is also a window
+ * between reading an environment and signalling its pid in which the pid could
+ * be reused by an unrelated process of the same user; the window is the length
+ * of one read, and the signal goes only to a pid whose environment carried the
+ * tag a moment before.
+ */
+export function signalTagged(tags: string | readonly string[], signal: NodeJS.Signals): number {
+	const needles = (typeof tags === 'string' ? [tags] : tags).map(
+		(tag) => `${MSYS_TAG_VARIABLE}=${tag}\0`,
+	)
+	if (needles.length === 0) return 0
+	let entries: string[]
+	try {
+		entries = readdirSync('/proc')
+	} catch {
+		return 0
+	}
+	let signalled = 0
+	for (const entry of entries) {
+		if (!/^\d+$/.test(entry)) continue
+		const pid = Number(entry)
+		if (!isSignalablePid(pid)) continue
+		try {
+			const environ = readFileSync(`/proc/${entry}/environ`, 'latin1')
+			if (!needles.some((needle) => environ.includes(needle))) continue
+			process.kill(pid, signal)
+			signalled++
+		} catch {
+			// Not ours to read, or gone since the listing.
+		}
+	}
+	return signalled
+}
+
 /** The environment variable that carries the tag. */
 export const MSYS_TAG_VARIABLE = 'NAMZU_SHELL_TAG'
 
@@ -86,17 +156,49 @@ export function killTree(
 	child: { readonly pid?: number | undefined },
 	signal: NodeJS.Signals,
 ): void {
-	if (!child.pid) return
+	killTrees([child], signal)
+}
+
+/**
+ * `killTree` for several children at once: each child's group is signalled, then
+ * the environment scan runs once for all their tags. Used where the number of
+ * kills is unbounded and cannot wait, such as the host's exit.
+ */
+export function killTrees(
+	children: readonly { readonly pid?: number | undefined }[],
+	signal: NodeJS.Signals,
+): void {
+	const tags: string[] = []
+	for (const child of children) {
+		if (!isSignalablePid(child.pid)) continue
+		killOne(child, signal, tags)
+	}
+	if (tags.length > 0 && process.platform === 'linux') signalTagged(tags, signal)
+}
+
+function killOne(
+	child: { readonly pid?: number | undefined },
+	signal: NodeJS.Signals,
+	tags: string[],
+): void {
+	if (!isSignalablePid(child.pid)) return
 	try {
 		if (process.platform === 'win32') {
 			const msys = MSYS_SHELLS.get(child)
-			if (msys !== undefined) killMsysTagged(msys)
+			if (msys?.bash !== undefined) killMsysTagged({ bash: msys.bash, tag: msys.tag })
 			execFileSync(taskkillPath(), ['/pid', String(child.pid), '/t', '/f'], {
 				stdio: 'ignore',
 				windowsHide: true,
 			})
 		} else {
-			process.kill(-child.pid, signal)
+			try {
+				process.kill(-child.pid, signal)
+			} finally {
+				// After the group, which is cheap and exact: what is left is only
+				// what started its own session. Also when the group is already gone.
+				const tagged = MSYS_SHELLS.get(child)
+				if (tagged !== undefined) tags.push(tagged.tag)
+			}
 		}
 	} catch {
 		// Group (or tree) already gone

package/src/prompt/coding-agent-doctrine.ts

@@ -82,7 +82,15 @@ export const CODING_AGENT_DELEGATION_DOCTRINE = `### Planning and delegating
 - When the \`Agent\` tool is available, delegate independent work through it and give each delegation a short, specific description; the user watches those descriptions, not the prompts. Brief each sub-agent with four things: the objective; what is out of bounds; which tools and sources to use; and the shape of the reply you want, such as a short summary with a file path for anything long. A fresh sub-agent starts with none of your context and returns what you ask for.
 - When the \`Agent\` tool lists a \`fork\` type, use \`subagent_type: "fork"\` when a side task would fill your context with output you will not need again, such as an open-ended survey. A fork starts from this conversation under your own instructions, so its prompt is only the directive: what to do and where its scope ends, without the background. Never write or guess what a fork will find before its report arrives. A fork cannot start forks of its own.
 - When delegated agents finish, tell the user what each one found in your next message. Their results reach you and not the user, so a result you do not pass on stays unseen.
-- Delegate lookups — where something is defined, which files reference it, how a module works — with \`subagent_type: "explore"\`: it has reading and searching tools only and never interrupts the user for permission. Reserve the default sub-agent for work that changes files or runs commands.`
+- Delegate lookups — where something is defined, which files reference it, how a module works — with \`subagent_type: "explore"\`: it has reading and searching tools only and never interrupts the user for permission. Reserve the default sub-agent for work that changes files or runs commands.
+
+### Answering how work is going
+- When asked how things stand while background work runs, read the note about running work on your request first if the host gives you one, and add one status read from the tool that started an item only when the note does not say enough. The answer needs no waiting or polling and leaves the work running, because stopping or restarting an item to answer would lose what it has done.
+- Give each item the state you were given for it (progressing, waiting, stalled or dead) and how long ago it last moved, so the person can judge it for themselves. Stalled means only quiet for a while, not stuck.
+- Group the answer as finished (with its result), running (and where it is), queued, and needing a decision. Lead with the outcome, keep it short, and write in the language the person used, states included.
+- Name each item by what it is doing, not by its id: an id means nothing to the person, so give one only when they ask for it or need it for a command.
+- A result exists only once its completion message has arrived, so for an unfinished item say it is still running; a predicted result reads as a fact and may be wrong.
+- For an item reported dead, say it ended without a result and offer to run it again; starting the same work again unasked could repeat what it already did.`
 
 /**
  * For a session whose permission layer refuses every mutation. Says what that

package/src/provider/collect-chat-completion.ts

@@ -72,6 +72,7 @@ export async function collectChatCompletion(
 	let replayState: unknown
 	let finishReason: ChatCompletionResponse['finishReason'] = 'stop'
 	let finishDetail: ChatCompletionResponse['finishDetail']
+	let refusal: ChatCompletionResponse['refusal']
 	let usage: ChatCompletionResponse['usage'] = {
 		promptTokens: 0,
 		completionTokens: 0,
@@ -158,6 +159,7 @@ export async function collectChatCompletion(
 			finishReason = chunk.finishReason
 			finishDetail = chunk.finishReason === 'length' ? chunk.finishDetail : undefined
 		}
+		if (chunk.refusal) refusal = chunk.refusal
 		// Merge (per-field max), not last-write-wins: a late frame that omits
 		// input/cache tokens must not zero the counts captured earlier in the stream.
 		if (chunk.usage) usage = mergeTokenUsage(usage, chunk.usage)
@@ -207,6 +209,7 @@ export async function collectChatCompletion(
 		},
 		finishReason,
 		...(finishDetail ? { finishDetail } : {}),
+		...(refusal && finishReason === 'content_filter' ? { refusal } : {}),
 		usage,
 	}
 }

package/src/provider/fallback.ts

@@ -572,6 +572,23 @@ export function withProviderFallback(
 					) => first.provider.effortLevelsFor?.(model, thinking) ?? [],
 				}
 			: {}),
+		// Answered by the member the next request goes to first, the one the
+		// cursor rests on: it is the member whose model just declined.
+		...(members.some((member) => member.provider.refusalFallbackFor)
+			? {
+					refusalFallbackFor: (
+						model: string,
+						refusal: Parameters<NonNullable<LLMProvider['refusalFallbackFor']>>[1],
+						signal?: AbortSignal,
+					) => {
+						const serving = members[cursor] ?? first
+						return (
+							serving.provider.refusalFallbackFor?.(serving.model ?? model, refusal, signal) ??
+							Promise.resolve(undefined)
+						)
+					},
+				}
+			: {}),
 		...(first.provider.resolveContextWindow
 			? {
 					resolveContextWindow: (model: string, signal?: AbortSignal) =>

package/src/provider/idle-timeout.ts

@@ -247,6 +247,15 @@ export function withStreamIdleTimeout(
 					) => provider.effortLevelsFor?.(model, thinking) ?? [],
 				}
 			: {}),
+		...(provider.refusalFallbackFor
+			? {
+					refusalFallbackFor: (
+						model: string,
+						refusal: Parameters<NonNullable<LLMProvider['refusalFallbackFor']>>[1],
+						signal?: AbortSignal,
+					) => provider.refusalFallbackFor?.(model, refusal, signal) ?? Promise.resolve(undefined),
+				}
+			: {}),
 		...(provider.resolveContextWindow
 			? {
 					resolveContextWindow: (model: string, signal?: AbortSignal) =>

package/src/provider/mock.ts

@@ -49,11 +49,19 @@ export class MockLLMProvider implements LLMProvider {
 	/** Every request this provider has received, in order. */
 	readonly requests: ChatCompletionParams[] = []
 
+	/** Present only when the script names a model to retry a refusal on. */
+	readonly refusalFallbackFor?: (model: string) => Promise<string | undefined>
+
 	constructor(config: MockScript = {}) {
 		this.capabilities = config.capabilities
 		this.model = config.model ?? FALLBACK_MOCK_MODEL
 		this.responseDelayMs = config.responseDelayMs ?? 0
 		this.onRequest = config.onRequest
+		const refusalFallbackModel = config.refusalFallbackModel
+		if (refusalFallbackModel !== undefined) {
+			this.refusalFallbackFor = async (model) =>
+				model === refusalFallbackModel ? undefined : refusalFallbackModel
+		}
 		this.nextTurn = config.nextTurn
 		this.turns = config.turns ?? [{ text: config.responseText ?? 'Mock provider response' }] // Back-compat: the old single-string config becomes a one-turn script.
 	}
@@ -158,18 +166,20 @@ export class MockLLMProvider implements LLMProvider {
 			yield { id, delta: { toolCallEnd: { index, id: callId } } }
 		}
 
+		const finishReason: NonNullable<StreamChunk['finishReason']> =
+			turn.finishReason ??
+			// A call cut off mid-JSON is what the output limit does, and the
+			// finish reason is how a consumer tells that from malformed JSON.
+			(toolCalls.some((call) => call.truncateArguments === true)
+				? 'length'
+				: toolCalls.length > 0
+					? 'tool_calls'
+					: 'stop')
 		yield {
 			id,
 			delta: {},
-			finishReason:
-				turn.finishReason ??
-				// A call cut off mid-JSON is what the output limit does, and the
-				// finish reason is how a consumer tells that from malformed JSON.
-				(toolCalls.some((call) => call.truncateArguments === true)
-					? 'length'
-					: toolCalls.length > 0
-						? 'tool_calls'
-						: 'stop'),
+			finishReason,
+			...(finishReason === 'content_filter' ? { refusal: turn.refusal ?? {} } : {}),
 			usage: { ...EMPTY_USAGE, ...turn.usage },
 		}
 	}

package/src/provider/model-window-suffix.ts

@@ -0,0 +1,85 @@
+/**
+ * Keeps the `[1m]` window marker off the wire.
+ *
+ * A model id ending in `[1m]` declares a one-million-token window to Namzu
+ * (see `splitModelWindowSuffix`). The marker belongs to the person and the UI,
+ * not to the vendor, so every driver and every request sees the bare id. This
+ * wraps a provider once, where it is built, so no caller that holds the marked
+ * id (a main model, a sub-agent, a side-job model, a fallback chain member)
+ * has to remember to strip it.
+ */
+
+import { stripModelWindowSuffix } from '../compaction/context-window.js'
+import type { LLMProvider } from '../types/provider/interface.js'
+
+/** Provider methods whose first argument is a model id. */
+const MODEL_FIRST_METHODS: ReadonlySet<string> = new Set([
+	'supportsHostedWebSearchFor',
+	'supportsImageInputFor',
+	'reasoningEffortLevelsFor',
+	'reasoningEffortDefaultFor',
+	'effortLevelsFor',
+	'resolveContextWindow',
+	'refusalFallbackFor',
+	'healthCheck',
+	'doctorCheck',
+])
+
+function stripParams(params: unknown): unknown {
+	if (typeof params !== 'object' || params === null) return params
+	const model = (params as { model?: unknown }).model
+	if (typeof model !== 'string') return params
+	const bare = stripModelWindowSuffix(model)
+	return bare === model ? params : { ...params, model: bare }
+}
+
+const WRAPPED = Symbol.for('namzu.modelWindowSuffixStripped')
+
+type AnyMethod = (...args: unknown[]) => unknown
+
+function wrapMethod(name: string, method: AnyMethod): AnyMethod | undefined {
+	if (name === 'chatStream' || name === 'chat') {
+		return function (this: unknown, params: unknown, ...rest: unknown[]) {
+			return method.call(this, stripParams(params), ...rest)
+		}
+	}
+	if (MODEL_FIRST_METHODS.has(name)) {
+		return function (this: unknown, model: unknown, ...rest: unknown[]) {
+			return method.call(
+				this,
+				typeof model === 'string' ? stripModelWindowSuffix(model) : model,
+				...rest,
+			)
+		}
+	}
+	return undefined
+}
+
+/**
+ * The same provider, now stripping the marker from every model it is handed.
+ * The instance is patched in place (not proxied) so a host that keys state on
+ * the provider object keeps finding it; wrapping twice changes nothing.
+ */
+export function withModelWindowSuffixStripped<T extends LLMProvider>(provider: T): T {
+	const target = provider as unknown as Record<PropertyKey, unknown>
+	if (target[WRAPPED] === true) return provider
+	if (!Object.isExtensible(provider)) {
+		return new Proxy(provider, {
+			get(object, property) {
+				const value: unknown = Reflect.get(object, property, object)
+				if (typeof value !== 'function') return value
+				const wrapped =
+					typeof property === 'string' ? wrapMethod(property, value as AnyMethod) : undefined
+				return (wrapped ?? (value as AnyMethod)).bind(object)
+			},
+		})
+	}
+	for (const name of ['chatStream', 'chat', ...MODEL_FIRST_METHODS]) {
+		const method = target[name]
+		if (typeof method !== 'function') continue
+		const wrapped = wrapMethod(name, method as AnyMethod)
+		if (wrapped) target[name] = wrapped
+	}
+	Object.defineProperty(provider, WRAPPED, { value: true, enumerable: false })
+	return provider
+}

package/src/provider/retry.ts

@@ -417,6 +417,15 @@ export function withProviderRetry(
 					) => provider.effortLevelsFor?.(model, thinking) ?? [],
 				}
 			: {}),
+		...(provider.refusalFallbackFor
+			? {
+					refusalFallbackFor: (
+						model: string,
+						refusal: Parameters<NonNullable<LLMProvider['refusalFallbackFor']>>[1],
+						signal?: AbortSignal,
+					) => provider.refusalFallbackFor?.(model, refusal, signal) ?? Promise.resolve(undefined),
+				}
+			: {}),
 		...(provider.resolveContextWindow
 			? {
 					resolveContextWindow: (model: string, signal?: AbortSignal) =>

package/src/public-runtime.ts

@@ -24,11 +24,17 @@ export { WorkerCodeRuntime } from './execution/code-runtime/worker.js'
 // interpreter above, with `agent()` as its only host call.
 export {
 	FileWorkflowJournal,
+	formatWorkflowJournalLine,
+	loadWorkflowResume,
 	parseWorkflowMeta,
+	readWorkflowJournalChecked,
 	resolveWorkflowLimits,
 	summarizeWorkflowPhases,
 	WorkflowRuntime,
 	WorkflowScriptError,
+	workflowCallKey,
+	workflowJournalLineHash,
+	workflowJournalSeed,
 } from './execution/workflow/index.js'
 
 export {
@@ -608,7 +614,7 @@ export { resolveSessionLogReplay } from './types/session/log-cursor.js'
 
 // Commands a HOST offers its operator. Deliberately NOT tools: no
 // descriptor reaches a provider and no dispatch path reaches the model — a
-// `/tasks` readout is a question the operator asked, and making it callable
+// `/skills` readout is a question the operator asked, and making it callable
 // would let the model spend a turn on it and record the output as a finding.
 export {
 	HostCommandNameCollisionError,
@@ -1109,6 +1115,7 @@ export { wrapProviderWithProbes } from './provider/instrumentation.js'
 export type { ProviderInstrumentationOptions } from './provider/instrumentation.js'
 export type { ResolvedProviderCapabilities } from './provider/capabilities.js'
 export { collectChatCompletion } from './provider/collect-chat-completion.js'
+export { withModelWindowSuffixStripped } from './provider/model-window-suffix.js'
 
 // Old spellings of renamed exports, still live for one deprecation window.
 // The file explains why each is a `const`+`type` pair rather than a
@@ -1591,7 +1598,18 @@ export {
 // consumer (`SpanProcessorLike`, then `CompactNowInput` and `CompactionResult`).
 // The gate is the reason this is a list rather than a fourth accident.
 export type { ResolvedContextWindow } from './compaction/context-window.js'
-export { resolveTriggerThreshold } from './compaction/context-window.js'
+export {
+	AUTO_COMPACT_WINDOW_MAX_TOKENS,
+	AUTO_COMPACT_WINDOW_MIN_TOKENS,
+	ONE_MILLION_WINDOW_TOKENS,
+	oneMillionWindowDisabled,
+	parseAutoCompactWindow,
+	resolveAutoCompactWindowSetting,
+	resolveTriggerThreshold,
+	splitModelWindowSuffix,
+	stripModelWindowSuffix,
+} from './compaction/context-window.js'
+export type { AutoCompactWindowParse } from './compaction/context-window.js'
 // What the context window is made of, for a host that draws the answer to
 // "where did my context go".
 export {
@@ -1744,6 +1762,7 @@ export {
 	ChildSessionMetaSchema,
 	CompactionRecordSchema,
 	ExternalRefSchema,
+	IgnorableRecordSchema,
 	MessageRecordSchema,
 	MessageReplacedRecordSchema,
 	OriginSchema,

package/src/public-types.ts

@@ -35,6 +35,7 @@ export type * from './types/job/index.js'
 export type * from './execution/workflow/types.js'
 export type { PhaseAgentView, PhaseRecord } from './execution/workflow/phases.js'
 export type { WorkflowRuntimeOptions } from './execution/workflow/runtime.js'
+export type { WorkflowCallIdentity } from './execution/workflow/resume.js'
 export type { WorkerCodeRuntimeOptions } from './execution/code-runtime/worker.js'
 export type {
 	CodeRunOutcome,

package/src/registry/command/kernel-commands.ts

@@ -12,14 +12,13 @@ import type { GoalRef, SessionGoal } from '../../types/goal/index.js'
 import type { SessionId, TenantId } from '../../types/ids/index.js'
 import type { Skill } from '../../types/skills/index.js'
 import { isInvocableBy, skillInvocation } from '../../types/skills/index.js'
-import type { TaskStore } from '../../types/task/index.js'
 
 /**
  * The commands whose facts the kernel already owns.
  *
  * A registry with nothing in it is a declaration, and this repo has a rule
  * about those. These are facts a host would otherwise have to reach into
- * kernel internals to answer: the current Session goal, tracked work,
+ * kernel internals to answer: the current Session goal,
  * operator-invocable skills, and the agents this turn may delegate to. Each is
  * computed or owned here and should not acquire a second host-specific source.
  *
@@ -31,8 +30,6 @@ import type { TaskStore } from '../../types/task/index.js'
  */
 
 export interface KernelCommandOptions {
-	/** Absent is a real state — not every turn tracks tasks. */
-	readonly taskStore?: TaskStore
 	readonly allowedAgentIds?: readonly string[]
 	/**
 	 * The turn's skills, for the operator-facing half of the listing.
@@ -263,34 +260,6 @@ export function kernelHostCommands(options: KernelCommandOptions): HostCommandDe
 			hint: GOAL_ARGUMENTS,
 			handler: async ({ args }) => await runGoalCommand(options.goal, args),
 		},
-		{
-			name: 'tasks',
-			description: 'List the work this turn is tracking.',
-			hint: 'id, status, owner and subject for every task in the store',
-			async handler() {
-				// REFUSED rather than an empty report. "There are no tasks" and
-				// "this turn has no task store" are different answers, and a host
-				// that shows the first for the second gives an operator a
-				// confident zero nobody computed.
-				if (!options.taskStore) {
-					return {
-						kind: 'refused',
-						reason: 'This turn has no task store, so there is nothing to list.',
-					}
-				}
-				const tasks = await options.taskStore.list()
-				return {
-					kind: 'report',
-					title: 'Tasks',
-					rows: tasks.map((task) => ({
-						id: task.id,
-						status: task.status,
-						owner: task.owner ?? null,
-						subject: task.subject,
-					})),
-				}
-			},
-		},
 		{
 			name: 'skills',
 			description: 'List the skills an operator may invoke.',

package/src/runtime/jobs/awaited-jobs.ts

@@ -327,6 +327,17 @@ export class AwaitedJobs {
 		this.exits = []
 	}
 
+	/**
+	 * Say that a tool result has handed the model this job's exit and output.
+	 * Its entry goes, so a hold is not opened for a result the model has read;
+	 * the notice for the same exit is withdrawn by the caller.
+	 */
+	collected(id: string): void {
+		this.outstanding.delete(id)
+		this.exits = this.exits.filter((job) => job.id !== id)
+		for (const wake of [...this.arrivals]) wake()
+	}
+
 	/**
 	 * Take the recorded exits together with the text that delivers them, or
 	 * take neither.

package/src/runtime/jobs/host-exit-finalizer.ts

@@ -0,0 +1,67 @@
+import { killTrees } from '../../process/kill-tree.js'
+
+/**
+ * What the host's exit has to stop: a job's process, and how to signal it.
+ */
+export interface HostExitTarget {
+	readonly child: { readonly pid?: number | undefined }
+	/** The spawner's own kill, when it gave one; otherwise the process group is signalled. */
+	readonly kill?: (signal: NodeJS.Signals) => void
+}
+
+const live = new Set<HostExitTarget>()
+let installed = false
+
+/**
+ * Runs when the host process is about to end, by whatever road: `process.exit`,
+ * an uncaught exception, the event loop emptying. It is synchronous on purpose.
+ * An `exit` listener cannot await, so it starts no promise and no timer, signals
+ * each live job with SIGKILL (its own kill when it gave one, then its process
+ * group and any descendant found by the environment tag), and does not wait for any of them
+ * to stop or claim that they have. A job that was already stopped has been
+ * untracked and is not touched.
+ *
+ * It does not cover a SIGKILL of the host itself, which no listener can see.
+ */
+function finalizeAtHostExit(): void {
+	const children: HostExitTarget['child'][] = []
+	for (const target of live) {
+		children.push(target.child)
+		try {
+			target.kill?.('SIGKILL')
+		} catch {
+			// The process is already gone; the host is exiting either way.
+		}
+	}
+	live.clear()
+	try {
+		// One pass over the machine's processes for all the jobs, not one each.
+		// Every job goes through it, whether or not it has a kill of its own, so
+		// a descendant that left the process group is found in both cases.
+		killTrees(children, 'SIGKILL')
+	} catch {
+		// As above.
+	}
+}
+
+/**
+ * Track a running job so the host's exit stops it. Returns the untrack, to be
+ * called once the job has ended. The listener is installed once per process, on
+ * the first job, and is put first so a later listener that throws cannot
+ * keep it from running.
+ */
+export function stopAtHostExit(target: HostExitTarget): () => void {
+	live.add(target)
+	if (!installed) {
+		installed = true
+		process.prependListener('exit', finalizeAtHostExit)
+	}
+	return () => {
+		live.delete(target)
+	}
+}
+
+/** Jobs the host's exit would stop. For tests. */
+export function trackedForHostExit(): number {
+	return live.size
+}