@nanhara/hara 0.125.3 → 0.126.0

package/dist/mcp/client.js

@@ -175,6 +175,7 @@ export async function connectMcpServers(servers, log, options = {}) {
                     description: t.description ?? `${name}/${t.name}`,
                     input_schema: schema,
                     kind: "exec",
+                    visibility: "deferred",
                     trustBoundary: "external",
                     async run(input, ctx) {
                         if (!ctx.ask && process.env.HARA_ALLOW_TRUSTED_EXTENSIONS !== "1") {

package/dist/providers/bounded-turn.js

@@ -33,6 +33,12 @@ export async function boundedProviderTurn(provider, args, options) {
         // microtask starts. Re-check here so an already-cancelled auxiliary call never incurs a request/cost.
         .then(() => controller.signal.aborted ? errorResult(`${label} cancelled`) : provider.turn({ ...args, signal: controller.signal }))
         .catch((error) => errorResult(error instanceof Error ? error.message : String(error)));
+    try {
+        options.onProviderTurn?.(turn);
+    }
+    catch {
+        // Observability must never weaken the provider boundary.
+    }
     const result = await Promise.race([turn, stopped]);
     clearTimeout(timer);
     parent?.removeEventListener("abort", onParentAbort);

package/dist/providers/factory.js

@@ -0,0 +1,54 @@
+// Shared provider construction for the interactive CLI, Desktop serve, gateway approval/judge calls, and
+// connection tests. Every path must interpret auth:none/OAuth/wire-protocol targets identically.
+import { providerIsLocal } from "../config.js";
+import { getValidQwenAuth } from "./qwen-oauth.js";
+import { createAnthropicProvider } from "./anthropic.js";
+import { createOpenAIProvider } from "./openai.js";
+import { resolvePlatform } from "./registry.js";
+export async function createProviderForTarget(target, reasoningEffort) {
+    const { provider, apiKey, model, baseURL } = target;
+    if (provider === "qwen-oauth") {
+        const auth = await getValidQwenAuth();
+        if (!auth)
+            return null;
+        return createOpenAIProvider({
+            apiKey: auth.accessToken,
+            baseURL: auth.baseURL,
+            model,
+            label: provider,
+            reasoningEffort,
+        });
+    }
+    // The OpenAI SDK requires a non-empty constructor value even when a compatible local endpoint has no
+    // authentication. This sentinel never leaves the process for cloud targets and local targets have already
+    // discarded all user credentials at target resolution.
+    const transportKey = apiKey ?? (providerIsLocal(provider) ? "hara-local-no-secret" : undefined);
+    if (!transportKey)
+        return null;
+    const wire = resolvePlatform(provider, baseURL).wireApi;
+    if (wire === "anthropic") {
+        return createAnthropicProvider({ apiKey: transportKey, model, baseURL, reasoningEffort });
+    }
+    if (wire === "responses") {
+        return {
+            id: provider,
+            model,
+            async turn() {
+                return {
+                    text: "",
+                    toolUses: [],
+                    stop: "error",
+                    errorMsg: "This endpoint uses the OpenAI Responses API, which hara doesn't speak yet. Point hara at an OpenAI-compatible chat endpoint (…/compatible-mode/v1 or …/v1) or an Anthropic-compatible endpoint (…/apps/anthropic).",
+                };
+            },
+        };
+    }
+    return createOpenAIProvider({
+        apiKey: transportKey,
+        model,
+        baseURL,
+        label: provider,
+        reasoningEffort,
+        omitAuthorization: providerIsLocal(provider),
+    });
+}

package/dist/providers/openai.js

@@ -80,7 +80,12 @@ export function toOpenAI(system, history) {
 }
 /** OpenAI-compatible provider (works with OpenAI, Qwen/DashScope, GLM, Kimi, …). */
 export function createOpenAIProvider(opts) {
-    const client = new OpenAI({ apiKey: opts.apiKey, maxRetries: 4, ...(opts.baseURL ? { baseURL: opts.baseURL } : {}) });
+    const client = new OpenAI({
+        apiKey: opts.apiKey,
+        maxRetries: 4,
+        ...(opts.baseURL ? { baseURL: opts.baseURL } : {}),
+        ...(opts.omitAuthorization ? { defaultHeaders: { Authorization: null } } : {}),
+    });
     return {
         id: opts.label ?? "openai",
         model: opts.model,

package/dist/providers/registry.js

@@ -32,6 +32,7 @@ const BY_PROVIDER = {
     glm: { wireApi: "chat", reasoning: "none", cache: "auto" }, // Zhipu native /paas/v4 — different thinking param; leave alone (its /anthropic endpoint resolves via baseURL)
     deepseek: { wireApi: "chat", reasoning: "deepseek", cache: "auto" }, // V4: thinking:{type} + reasoning_effort(high|max)
     ollama: { wireApi: "chat", reasoning: "ollama_think", cache: "none" }, // local; `think` toggles reasoning
+    lmstudio: { wireApi: "chat", reasoning: "ollama_think", cache: "none" }, // local OpenAI-compatible server
     openai: { wireApi: "chat", reasoning: "reasoning_effort", cache: "auto" },
     openrouter: { wireApi: "chat", reasoning: "none", cache: "auto" },
     "hara-gateway": { wireApi: "chat", reasoning: "none", cache: "auto" },

package/dist/providers/target.js

@@ -0,0 +1,98 @@
+import { providerDefaultBaseURL, providerDefaultModel, providerEnvKey, isProviderId, providerIsLocal, } from "../config.js";
+import { getProfile, PERSONAL_ID, resolveActive, } from "../profile/profile.js";
+/** Resolve the identity profile for the same cwd used to load config. */
+export function profileForConfig(cfg) {
+    const resolution = resolveActive(cfg.cwd);
+    if (resolution.id !== PERSONAL_ID) {
+        const profile = getProfile(resolution.id);
+        if (profile)
+            return { profile, resolution };
+    }
+    return {
+        resolution: resolution.id === PERSONAL_ID
+            ? resolution
+            : { id: PERSONAL_ID, source: "fallback" },
+        profile: {
+            id: PERSONAL_ID,
+            kind: "byok",
+            label: "Personal",
+            provider: cfg.provider,
+            apiKey: cfg.apiKey,
+            baseURL: cfg.baseURL,
+            defaultModel: cfg.model,
+        },
+    };
+}
+/**
+ * Resolve one BYOK/local transport target.
+ *
+ * A named Profile is an identity boundary: its vendor, credential and endpoint must not be replaced by
+ * the always-populated personal/global config. Explicit HARA_* values remain one-shot overrides. The
+ * personal profile and explicit sidecars continue to use the merged config.
+ */
+export function resolveByokProviderTarget(cfg, profile, sidecarOverride, env = process.env) {
+    const personalOrOverride = profile.id === "personal" || sidecarOverride;
+    const profileProvider = profile.provider && profile.provider !== "hara-gateway" ? profile.provider : "anthropic";
+    const environmentProvider = isProviderId(env.HARA_PROVIDER) && env.HARA_PROVIDER !== "hara-gateway"
+        ? env.HARA_PROVIDER
+        : undefined;
+    const provider = personalOrOverride
+        ? (cfg.provider !== "hara-gateway" ? cfg.provider : profileProvider)
+        : environmentProvider ?? profileProvider;
+    const namedProviderChanged = !personalOrOverride && provider !== profileProvider;
+    const envKey = providerEnvKey(provider);
+    const providerEnvApiKey = envKey ? env[envKey] : undefined;
+    const candidateApiKey = personalOrOverride
+        ? cfg.apiKey ?? profile.apiKey
+        : env.HARA_API_KEY ?? providerEnvApiKey ?? (namedProviderChanged ? undefined : profile.apiKey);
+    // Ollama/LM Studio declare auth:none. Never forward a stale cloud key (including HARA_API_KEY) to a
+    // loopback process that happens to occupy the configured port.
+    const apiKey = providerIsLocal(provider) ? undefined : candidateApiKey;
+    const baseURL = personalOrOverride
+        ? cfg.baseURL ?? profile.baseURL ?? providerDefaultBaseURL(provider)
+        : env.HARA_BASE_URL
+            ?? (namedProviderChanged ? undefined : profile.baseURL)
+            ?? providerDefaultBaseURL(provider);
+    const profileModel = profile.model || profile.defaultModel || "";
+    const model = personalOrOverride
+        ? cfg.model || env.HARA_MODEL || profileModel
+        : env.HARA_MODEL
+            || (namedProviderChanged ? "" : profileModel)
+            || providerDefaultModel(provider);
+    return { provider, apiKey, baseURL, model };
+}
+/**
+ * Apply an explicit runtime selection (session model, role model, vision/route sidecar, fallback).
+ *
+ * A provider switch starts a fresh credential/endpoint boundary; absent fields use that provider's public
+ * defaults and never inherit the previous profile's key or host.
+ */
+export function overrideProviderTarget(base, override) {
+    if (!override)
+        return base;
+    const owns = (key) => Object.prototype.hasOwnProperty.call(override, key);
+    const provider = override.provider ?? base.provider;
+    const providerChanged = provider !== base.provider;
+    const apiKey = providerIsLocal(provider)
+        ? undefined
+        : owns("apiKey")
+            ? override.apiKey
+            : providerChanged
+                ? undefined
+                : base.apiKey;
+    const baseURL = owns("baseURL")
+        ? override.baseURL
+        : providerChanged
+            ? providerDefaultBaseURL(provider)
+            : base.baseURL;
+    const model = owns("model") && override.model
+        ? override.model
+        : providerChanged
+            ? providerDefaultModel(provider)
+            : base.model;
+    return { provider, apiKey, baseURL, model };
+}
+/** Gateway profiles own their default, while an explicit session/role model remains selectable. */
+export function resolveGatewayModel(cfg, profile, env = process.env, requestedModel) {
+    return env.HARA_MODEL || requestedModel || profile.model || profile.defaultModel || cfg.model;
+}

package/dist/security/guardian.js

@@ -223,7 +223,12 @@ export async function guardianVeto(provider, action, history, opts = {}) {
             history: [{ role: "user", content: prompt }],
             tools: [],
             onText: () => { },
-        }, { timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS, signal: opts.signal, label: "security guardian" });
+        }, {
+            timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+            signal: opts.signal,
+            label: "security guardian",
+            onProviderTurn: opts.onProviderTurn,
+        });
         if (r.stop === "error")
             return { decision: "allow", reason: "" }; // fail-open on model error
         return parseVerdict(r.text);

package/dist/security/private-state.js

@@ -8,7 +8,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { FileReadLimitError, MAX_EDIT_READ_BYTES, decodeUtf8Strict, openVerifiedRegularFileNoFollow, verifyOpenedRegularFileSync, } from "../fs-read.js";
 import { optionalPosixOpenFlag } from "../fs-open-flags.js";
 import { sameOpenedFileIdentity } from "../fs-identity.js";
-const PRIVATE_TREES = new Set(["sessions", "checkpoints", "index", "gateway", "cron", "weixin"]);
+const PRIVATE_TREES = new Set(["sessions", "checkpoints", "index", "gateway", "cron", "weixin", "tool-results"]);
 const tightenedHomes = new Set();
 const DEFAULT_MIGRATION_CAP = 50_000;
 function isMissing(error) {

package/dist/security/secrets.js

@@ -87,6 +87,25 @@ export function redactSensitiveText(text) {
     }
     return { text: out, redactions };
 }
+/** Remove caller-known secret values before pattern matching. Provider/server errors may echo an opaque key
+ * that has no recognizable prefix, so field-name and token-shape heuristics alone cannot uphold no-echo APIs. */
+export function redactKnownSecrets(text, secrets) {
+    let out = text;
+    const exactHits = [];
+    for (const value of secrets) {
+        if (!value)
+            continue;
+        const variants = new Set([value, encodeURIComponent(value)]);
+        for (const variant of variants) {
+            if (!variant || !out.includes(variant))
+                continue;
+            out = out.split(variant).join("***");
+            exactHits.push("known-secret");
+        }
+    }
+    const patterned = redactSensitiveText(out);
+    return { text: patterned.text, redactions: [...exactHits, ...patterned.redactions] };
+}
 /** Structured tool/config data often carries an opaque value that has no recognizable token prefix. In that
  *  case the FIELD name is the evidence (`apiKey`, `access_token`, `FEISHU_APP_SECRET`, …). Keep this narrow
  *  enough not to erase ordinary fields such as `tokenCount` or `secretary`. */

package/dist/serve/protocol.js

@@ -3,8 +3,10 @@
 // Everything here is PURE (parse + frame builders + error codes) and unit-tested.
 //
 // Client → server requests:
-//   initialize        {token,capabilities?}      → {name,version,protocol,cwd,provider,model,
+//   initialize        {token,capabilities?}      → {name,version,protocol,cwd,provider,model,setupState,
 //                                                   capabilities:{methods:[…]}}  (feature detection)
+//   server.shutdown   {}                         → {accepted:true} (authenticated graceful local shutdown;
+//                                                   BUSY while any client work/approval is active)
 //   session.list      {cwd?}                     → {sessions:[{id,title,cwd,model,updatedAt}]}
 //   session.create    {cwd?,approval?}           → {sessionId,model}
 //   session.resume    {sessionId}                → {sessionId,model,history:[{role,text}]}
@@ -19,6 +21,9 @@
 //   automation.list   {}                          → {jobs:[{id,name,mode,enabled,lastRunAt,lastStatus,…}],
 //                                                    sessions:[{id,title,source,sourceName,updatedAt,…}]}
 //   models.list       {}                          → {models:[…], current, effortLevels:[…]}
+//   settings.providers.list {}                    → redacted provider catalog + current profile state
+//   settings.providers.test {provider,model,…}     → {ok,models,error?} (credential is ephemeral)
+//   settings.providers.save {provider,model,…}     → redacted state (credential is never returned)
 //   automation.add    {name,schedule,task,mode?,cwd?,tz?} → {id,name,schedule}
 //   automation.toggle {id,enabled}                → {id,enabled}
 //   automation.delete {id}                        → {id,deleted}
@@ -37,7 +42,7 @@ export const ERR = {
     PARAMS: -32602,
     INTERNAL: -32603,
     UNAUTHORIZED: -32001, // initialize first (or bad token)
-    BUSY: -32002, // session already has a turn in flight
+    BUSY: -32002, // requested operation conflicts with active server/session work
     NO_SESSION: -32003, // unknown/expired sessionId
     LOCKED: -32004, // session held by another live hara process (single-writer lock)
 };

package/dist/serve/server.js

@@ -34,6 +34,7 @@ import { parseFrame, rpcResult, rpcError, rpcNotify, ERR, PROTOCOL_VERSION } fro
 import { readModelContextFileSync } from "../fs-read.js";
 import { optionalPosixOpenFlag } from "../fs-open-flags.js";
 import { sameOpenedFileIdentity } from "../fs-identity.js";
+import { redactSensitiveText, redactSensitiveValue } from "../security/secrets.js";
 import { consumePendingTaskSteering, createTaskExecution, continueTaskExecution, finishTaskExecution, newSteerInteraction, newTurnInteraction, recordTaskSteering, requestsTaskContinuation, taskExecutionContext, } from "../session/task.js";
 const APPROVAL_TIMEOUT_MS = 300_000; // an unanswered approval denies after 5 min (never hangs a turn)
 const COMPACT_TIMEOUT_MS = 60_000;
@@ -251,12 +252,11 @@ export async function startServe(opts, deps) {
         const fresh = deps.buildProviderFor
             ? await deps.buildProviderFor(session.meta.model, session.effort, session.meta.cwd)
             : await deps.buildSessionProvider(session.meta.cwd);
-        if (!fresh)
+        if (!fresh || fresh.model !== session.meta.model)
             return false;
         session.provider = fresh;
         session.meta.provider = fresh.id;
-        // Preserve the user's pinned model in meta; provider factories should honor it, but fail closed if they do not.
-        return fresh.model === session.meta.model;
+        return true;
     };
     const wss = new WebSocketServer({ host: opts.host, port: opts.port, maxPayload: 10 * 1024 * 1024 });
     await new Promise((res, rej) => {
@@ -267,8 +267,66 @@ export async function startServe(opts, deps) {
     const authed = new Set();
     const pendingApprovals = new Map();
     const inFlightRequests = new Set();
+    // Physical provider/tool work can outlive its logical timeout. Keep a process-level ledger independent
+    // of SessionHub membership so detach/delete cannot make an updater believe the old engine is quiescent.
+    const activeOperations = new Set();
     let closing = false;
     let closePromise = null;
+    const trackActiveOperation = (operation) => {
+        activeOperations.add(operation);
+        const settled = () => {
+            activeOperations.delete(operation);
+            if (closing)
+                hub.releaseIdle();
+        };
+        void operation.then(settled, settled);
+        return operation;
+    };
+    const releaseSessionBusyIfIdle = (session) => {
+        if (session.abort === null &&
+            session.pendingProviderTurns === 0 &&
+            session.pendingToolRuns === 0) {
+            session.busy = false;
+        }
+    };
+    const observeProviderTurn = (session, turn) => {
+        session.pendingProviderTurns += 1;
+        trackActiveOperation(turn);
+        const settled = () => {
+            session.pendingProviderTurns = Math.max(0, session.pendingProviderTurns - 1);
+            // A logical timeout/interrupt may return before a non-cooperative provider physically settles.
+            // Retain the per-session lease so a second turn cannot share that provider instance concurrently.
+            releaseSessionBusyIfIdle(session);
+            if (closing)
+                hub.releaseIdle();
+        };
+        void turn.then(settled, settled);
+    };
+    const observeToolRun = (session, toolRun) => {
+        session.pendingToolRuns += 1;
+        trackActiveOperation(toolRun);
+        const settled = () => {
+            session.pendingToolRuns = Math.max(0, session.pendingToolRuns - 1);
+            // `abort === null` means the logical turn already returned. Keep the session busy/locked until
+            // every late side-effect-capable Promise has physically stopped.
+            releaseSessionBusyIfIdle(session);
+            if (closing)
+                hub.releaseIdle();
+        };
+        void toolRun.then(settled, settled);
+    };
+    /** An RPC-requested shutdown is a cooperative handoff (for example, before a Desktop update), not a
+     * force-stop. Refuse it while ANY client still owns live work. `inFlightRequests` covers async work that
+     * has not attached a session yet (provider factories/settings/filesystem scans); the session fields cover
+     * turns, compaction, provider reconfiguration, and physically late provider/tool promises. */
+    const hasActiveClientWork = () => inFlightRequests.size > 0 ||
+        activeOperations.size > 0 ||
+        pendingApprovals.size > 0 ||
+        hub.active().some((session) => session.busy ||
+            session.configuring ||
+            session.abort !== null ||
+            session.pendingProviderTurns > 0 ||
+            session.pendingToolRuns > 0);
     const broadcast = (method, params) => {
         const frame = rpcNotify(method, params);
         for (const ws of authed)
@@ -384,8 +442,8 @@ export async function startServe(opts, deps) {
             if (signal.aborted)
                 finish(false);
             else {
-                // `signal` is runAgent's combined Esc + total-deadline signal. Listening only to turnAbort would
-                // leave the approval map and Desktop prompt stale when the internal lifecycle deadline fires.
+                // `signal` composes the owning turn cancellation with runAgent's lifecycle cancellation. Listening
+                // only to turnAbort would leave the approval map and Desktop prompt stale after an internal stop.
                 signal.addEventListener("abort", onAbort, { once: true });
                 broadcast("approval.request", { sessionId, approvalId, question: q });
             }
@@ -419,7 +477,10 @@ export async function startServe(opts, deps) {
                         cwd: s.meta.cwd,
                         sandbox: deps.sandbox,
                         todoScope: sessionId,
-                        spawn: (t, role, signal) => deps.spawnSubagent(s.provider, s.meta.cwd, s.projectContext, s.stats, t, role, signal),
+                        spawn: (t, role, signal) => deps.spawnSubagent(s.provider, s.meta.cwd, s.projectContext, s.stats, t, role, signal, {
+                            onProviderTurn: (turn) => observeProviderTurn(s, turn),
+                            onToolRun: (toolRun) => observeToolRun(s, toolRun),
+                        }),
                         ui: sink,
                     },
                     approval: s.approval,
@@ -446,28 +507,8 @@ export async function startServe(opts, deps) {
                     },
                     stats: s.stats,
                     signal: turnAbort.signal,
-                    onProviderTurn: (turn) => {
-                        s.pendingProviderTurns += 1;
-                        const settled = () => {
-                            s.pendingProviderTurns = Math.max(0, s.pendingProviderTurns - 1);
-                            if (closing)
-                                hub.releaseIdle();
-                        };
-                        void turn.then(settled, settled);
-                    },
-                    onToolRun: (toolRun) => {
-                        s.pendingToolRuns += 1;
-                        const settled = () => {
-                            s.pendingToolRuns = Math.max(0, s.pendingToolRuns - 1);
-                            // `abort === null` means the logical turn already returned. Keep the session busy/locked until
-                            // every late side-effect-capable Promise has physically stopped.
-                            if (s.pendingToolRuns === 0 && s.abort === null)
-                                s.busy = false;
-                            if (closing)
-                                hub.releaseIdle();
-                        };
-                        void toolRun.then(settled, settled);
-                    },
+                    onProviderTurn: (turn) => observeProviderTurn(s, turn),
+                    onToolRun: (toolRun) => observeToolRun(s, toolRun),
                     guardian: turnGuardian,
                     ...(deps.runLimits?.(s.meta.cwd) ?? {}),
                 });
@@ -508,7 +549,7 @@ export async function startServe(opts, deps) {
         }
         finally {
             s.abort = null;
-            s.busy = s.pendingToolRuns > 0;
+            s.busy = s.pendingProviderTurns > 0 || s.pendingToolRuns > 0;
         }
     };
     /** Context watermark for a session: how full the model's window was on the last turn. */
@@ -544,7 +585,7 @@ export async function startServe(opts, deps) {
             if (controller.signal.aborted)
                 return onAbort();
             // Promise.resolve protects this boundary even if a non-conforming provider throws synchronously.
-            void Promise.resolve().then(() => {
+            const providerTurn = Promise.resolve().then(() => {
                 // The abort can fire after scheduling this microtask but before it runs. Gate the provider call at
                 // the actual invocation boundary so an interrupted/expired compact cannot start a late request.
                 if (controller.signal.aborted)
@@ -556,7 +597,9 @@ export async function startServe(opts, deps) {
                     onText: () => { },
                     signal: controller.signal,
                 });
-            }).then((result) => finish(() => resolve(result)), (error) => finish(() => reject(error)));
+            });
+            observeProviderTurn(s, providerTurn);
+            void providerTurn.then((result) => finish(() => resolve(result)), (error) => finish(() => reject(error)));
         });
         if (controller.signal.aborted || r.stop === "error")
             return null;
@@ -619,18 +662,46 @@ export async function startServe(opts, deps) {
                         // clients feature-detect up front instead of probing for -32601 per call. `p.capabilities`
                         // (client-declared) is accepted and currently unused — reserved for opt-outs/experimental gating.
                         const methods = [
+                            "server.shutdown",
                             "session.list", "session.create", "session.resume", "session.send", "session.steer", "session.interrupt", "session.set-model",
                             "session.rename", "session.archive", "session.compact", "session.rewind", "session.context", "session.delete", "session.fork",
                             "approval.reply", "plugins.list", "plugins.set", "skills.list", "models.list", "files.search", "project.panels",
+                            "settings.providers.list", "settings.providers.test", "settings.providers.save",
                             "automation.list", "automation.add", "automation.toggle", "automation.delete",
                             "tasks.list", "approvals.list", "approvals.resolve",
                         ];
                         const runtime = runtimeInfo();
-                        return reply(rpcResult(id, { name: "hara", version: deps.version, protocol: PROTOCOL_VERSION, cwd: opts.cwd, provider: runtime.providerId, model: runtime.model, capabilities: { methods } }));
+                        const setupState = deps.providerSettings
+                            ? (deps.providerSettings(opts.cwd).current.authenticated ? "ready" : "needs-credentials")
+                            : "ready";
+                        return reply(rpcResult(id, {
+                            name: "hara",
+                            version: deps.version,
+                            protocol: PROTOCOL_VERSION,
+                            cwd: opts.cwd,
+                            provider: runtime.providerId,
+                            model: runtime.model,
+                            setupState,
+                            capabilities: { methods },
+                        }));
                     }
                     if (!authed.has(ws))
                         return reply(rpcError(id, ERR.UNAUTHORIZED, "initialize first"));
                     switch (req.method) {
+                        case "server.shutdown": {
+                            // The updater's stop request must never abort another client's turn or dismiss its approval.
+                            // The current shutdown request is not inserted into inFlightRequests until this synchronous
+                            // branch returns, so any entry observed here belongs to another request. Once accepted, close
+                            // admission atomically before replying/scheduling close: no new work can race into the gap.
+                            if (hasActiveClientWork()) {
+                                return reply(rpcError(id, ERR.BUSY, "server has active work — retry shutdown after all sessions and approvals are idle"));
+                            }
+                            closing = true;
+                            reply(rpcResult(id, { accepted: true }));
+                            const shutdown = setTimeout(() => void close(), 0);
+                            shutdown.unref();
+                            return;
+                        }
                         case "session.list":
                             return reply(rpcResult(id, { sessions: hub.list(typeof p.cwd === "string" ? p.cwd : undefined).filter((m) => !m.archived || p.archived === true).map((m) => ({ id: m.id, title: m.title, cwd: m.cwd, model: m.model, updatedAt: m.updatedAt, source: m.source ?? "interactive", sourceName: m.sourceName, archived: m.archived ?? false })) }));
                         case "session.create": {
@@ -826,6 +897,37 @@ export async function startServe(opts, deps) {
                             const currentRuntime = runtimeInfo(targetCwd, current);
                             return reply(rpcResult(id, { models, current, effort: session?.effort ?? null, effortLevels: currentRuntime.effortLevels }));
                         }
+                        case "settings.providers.list": {
+                            if (!deps.providerSettings)
+                                return reply(rpcError(id, ERR.METHOD, "provider settings not supported by this server"));
+                            const targetCwd = typeof p.cwd === "string" && p.cwd ? p.cwd : opts.cwd;
+                            return reply(rpcResult(id, redactSensitiveValue(deps.providerSettings(targetCwd)).value));
+                        }
+                        case "settings.providers.test":
+                        case "settings.providers.save": {
+                            const callback = req.method === "settings.providers.test" ? deps.testProviderSettings : deps.saveProviderSettings;
+                            if (!callback)
+                                return reply(rpcError(id, ERR.METHOD, "provider settings not supported by this server"));
+                            if (typeof p.provider !== "string" ||
+                                typeof p.model !== "string" ||
+                                (p.baseURL !== undefined && typeof p.baseURL !== "string") ||
+                                (p.apiKey !== undefined && typeof p.apiKey !== "string") ||
+                                (p.clearApiKey !== undefined && typeof p.clearApiKey !== "boolean") ||
+                                (p.activatePersonal !== undefined && typeof p.activatePersonal !== "boolean")) {
+                                return reply(rpcError(id, ERR.PARAMS, "provider + model required; optional baseURL/apiKey/clearApiKey/activatePersonal have invalid types"));
+                            }
+                            const targetCwd = typeof p.cwd === "string" && p.cwd ? p.cwd : opts.cwd;
+                            const input = {
+                                provider: p.provider,
+                                model: p.model,
+                                ...(p.baseURL !== undefined ? { baseURL: p.baseURL } : {}),
+                                ...(p.apiKey !== undefined ? { apiKey: p.apiKey } : {}),
+                                ...(p.clearApiKey !== undefined ? { clearApiKey: p.clearApiKey } : {}),
+                                ...(p.activatePersonal !== undefined ? { activatePersonal: p.activatePersonal } : {}),
+                            };
+                            const result = await callback(input, targetCwd);
+                            return reply(rpcResult(id, redactSensitiveValue(result).value));
+                        }
                         case "session.set-model": {
                             // per-session model / thinking-effort switch (the composer picker). Rebuilds the session's
                             // provider; takes effect on the NEXT turn. Refused mid-turn.
@@ -989,9 +1091,9 @@ export async function startServe(opts, deps) {
                                 return reply(rpcResult(id, { sessionId: s.meta.id, ctx: ctxOf(s), notes: s.meta.workingSet?.length ?? 0, history: historyForClient(s.history) }));
                             }
                             finally {
-                                s.busy = false;
                                 if (s.abort === compactAbort)
                                     s.abort = null;
+                                s.busy = s.pendingProviderTurns > 0 || s.pendingToolRuns > 0;
                             }
                         }
                         case "session.rewind": {
@@ -1018,7 +1120,7 @@ export async function startServe(opts, deps) {
                     }
                 }
                 catch (e) {
-                    return reply(rpcError(id, ERR.INTERNAL, String(e?.message ?? e)));
+                    return reply(rpcError(id, ERR.INTERNAL, redactSensitiveText(String(e?.message ?? e)).text));
                 }
             })();
             inFlightRequests.add(task);
@@ -1077,7 +1179,9 @@ export async function startServe(opts, deps) {
                 await removeOwnedDiscovery(discoveryDir, discoveryPath, discovery).catch(() => { });
             let quiet = false;
             while (Date.now() < deadline) {
-                if (inFlightRequests.size === 0 && hub.active().every((session) => !session.busy && !session.configuring && session.pendingProviderTurns === 0 && session.pendingToolRuns === 0)) {
+                if (inFlightRequests.size === 0 &&
+                    activeOperations.size === 0 &&
+                    hub.active().every((session) => !session.busy && !session.configuring && session.pendingProviderTurns === 0 && session.pendingToolRuns === 0)) {
                     quiet = true;
                     break;
                 }

package/dist/serve/sessions.js

@@ -95,7 +95,12 @@ export class SessionHub {
      * when resume attached successfully but live provider validation failed before the client got a handle. */
     detach(id) {
         const live = this.sessions.get(id);
-        if (!live || live.busy || live.configuring)
+        if (!live ||
+            live.busy ||
+            live.configuring ||
+            live.abort !== null ||
+            live.pendingProviderTurns > 0 ||
+            live.pendingToolRuns > 0)
             return false;
         this.sessions.delete(id);
         this.store.release(id);
@@ -213,7 +218,11 @@ export class SessionHub {
      *  "gone" on success, "busy" when a turn is running, "missing" when unknown/held elsewhere. */
     delete(id) {
         const live = this.sessions.get(id);
-        if (live?.busy || live?.configuring)
+        if (live?.busy ||
+            live?.configuring ||
+            (live?.abort ?? null) !== null ||
+            (live?.pendingProviderTurns ?? 0) > 0 ||
+            (live?.pendingToolRuns ?? 0) > 0)
             return "busy";
         const ok = this.store.delete(id);
         if (!ok)

package/dist/session/operation-drain.js

@@ -0,0 +1,45 @@
+/**
+ * A dynamic physical-operation drain for session leases.
+ *
+ * A one-time `Promise.allSettled([...pending])` snapshot is insufficient: an observed outer tool may
+ * start and register a nested provider after shutdown begins. This drain checks the live Set after every
+ * settlement and releases only once it remains empty at a microtask boundary.
+ */
+export function createPhysicalOperationDrain(onDrained) {
+    const pending = new Set();
+    let closing = false;
+    let drained = false;
+    let drainQueued = false;
+    const requestDrain = () => {
+        if (!closing || drained || drainQueued || pending.size > 0)
+            return;
+        drainQueued = true;
+        queueMicrotask(() => {
+            drainQueued = false;
+            if (!closing || drained || pending.size > 0)
+                return;
+            drained = true;
+            onDrained();
+        });
+    };
+    const observe = (operation) => {
+        if (drained) {
+            throw new Error("cannot observe a physical operation after its session lease drained");
+        }
+        pending.add(operation);
+        const settled = () => {
+            pending.delete(operation);
+            requestDrain();
+        };
+        void operation.then(settled, settled);
+        return operation;
+    };
+    return {
+        observe,
+        close: () => {
+            closing = true;
+            requestDrain();
+        },
+        pendingCount: () => pending.size,
+    };
+}

package/dist/tools/agent.js

@@ -31,6 +31,7 @@ registerTool({
         required: ["task"],
     },
     kind: "read", // parallel-safe: multiple agent() calls in a turn run concurrently
+    concurrencySafe: true,
     async run(input, ctx) {
         if (!ctx.spawn)
             return "Error: sub-agents are not available in this context.";