@oar-sh/oar 0.9.1 → 0.9.3

package/server/copilot-worker/copilot-question-bridge.mjs

@@ -1,10 +1,13 @@
-// Bridges the Copilot runtime's two blocking interactive surfaces onto the
+// Bridges the Copilot runtime's blocking interactive surfaces onto the
 // relay's question cards:
 //
 //   * `onUserInputRequest` — the model called `ask_user`. Phase 1 answered these
 //     in-band with a "not supported" note; this asks the human.
 //   * `onPermissionRequest` in **ask** mode — the model wants to run a mutating
 //     tool. Phase 1 blanket-rejected; this offers approve/deny.
+//   * `onElicitationRequest` — a structured form (MCP elicitation). The card
+//     carries the `requestedSchema`, the relay validates the submission, and
+//     the answer comes back as `structuredAnswer` (`askStructured`).
 //
 // Both are wired to the SAME relay endpoints the extension's
 // `skills/question-bridge.mjs` uses, so a question raised by the SDK engine
@@ -20,6 +23,7 @@
 // question array. Composing the waiter instead of copying it keeps one
 // implementation of the abort semantics.
 import { createAskUserBridge } from '../../shared/ask-user-bridge.mjs';
+import { looksLikeMultiSelectQuestion } from '../../shared/question-multi-select.mjs';
 import {
   DEFAULT_QUESTION_TIMEOUT_MS,
   QUESTION_TIMEOUT_CONTINUATION_TEXT,
@@ -85,9 +89,27 @@ export function createCopilotQuestionBridge({
   // walks these so a pending card is timed out deliberately rather than left
   // spinning in the UI until the relay's 10s expiry sweeper notices.
   const pendingQuestionIds = new Set();
+  // Creates still in flight. Shutdown's snapshot of `pendingQuestionIds` only
+  // covers cards whose create already RETURNED — a POST in flight when
+  // `cancelPendingQuestions` runs would otherwise resolve just after the
+  // snapshot and leave its card pending forever. Each tracked promise also
+  // covers the expiry the create performs itself when it lands after closing
+  // started, so awaiting the set is awaiting the whole late-card teardown.
+  const inflightCreates = new Set();
+  // One-way: set by `cancelPendingQuestions`. From then on no new card is
+  // minted and any card a late create produces is expired at birth.
+  let closing = false;
 
-  async function createQuestion({ prompt, choices, allowFreeform, source, rationale, extra = {} }) {
-    const activeMsg = typeof getActiveMessage === 'function' ? getActiveMessage() : null;
+  async function expireQuestion(questionId) {
+    await api('POST', `/api/relay-question/${questionId}/timeout`, {}).catch(() => {});
+  }
+
+  async function createQuestion({ prompt, choices, allowFreeform, source, rationale, requestedSchema, timeoutMs, extra = {} }, owner) {
+    // A caller that knows which row the card belongs to names it (`message`);
+    // by the time the card is created the "active" row can be another one.
+    const activeMsg = owner !== undefined
+      ? owner
+      : (typeof getActiveMessage === 'function' ? getActiveMessage() : null);
     const payload = {
       // The relay 409s ("No active relay turn") unless this queue row is
       // `processing`, which is exactly the state a blocking handler runs in.
@@ -98,8 +120,16 @@ export function createCopilotQuestionBridge({
       prompt,
       choices,
       allowFreeform,
+      // Top-level, as the create route reads it: the relay stores it as the
+      // card's `requestSchema` and validates the eventual `structuredAnswer`
+      // against it.
+      ...(requestedSchema ? { requestedSchema } : {}),
       sdk_session_id: sdkSessionId || undefined,
-      timeout_ms: questionTimeoutMs,
+      // Fences the card to the delivering attempt: the server refuses creation
+      // once the row has been requeued to a newer attempt (same field the
+      // shared bridge sends).
+      attemptId: activeMsg?.attemptId || undefined,
+      timeout_ms: timeoutMs ?? questionTimeoutMs,
       context: {
         source,
         rationale,
@@ -115,17 +145,75 @@ export function createCopilotQuestionBridge({
     return questionId;
   }
 
-  async function ask(spec, { signal } = {}) {
-    const questionId = await createQuestion(spec);
-    pendingQuestionIds.add(questionId);
+  async function ask(spec, { signal, message } = {}) {
+    // Shutdown already began: nothing will ever poll an answer, so minting a
+    // card would only strand it in the UI. Shaped like a timeout so the caller
+    // degrades exactly as it does for an unanswered card.
+    if (closing) return { answer: QUESTION_TIMEOUT_CONTINUATION_TEXT, timedOut: true };
+    const create = (async () => {
+      const questionId = await createQuestion(spec, message);
+      if (closing) {
+        // The create raced `cancelPendingQuestions` and lost: its card was
+        // born after the shutdown snapshot, so it is expired here, at birth —
+        // the one place that still knows its id.
+        dbg('relay question expired at birth (bridge closing)', questionId);
+        await expireQuestion(questionId);
+        return null;
+      }
+      pendingQuestionIds.add(questionId);
+      return questionId;
+    })();
+    inflightCreates.add(create);
+    let questionId;
+    try {
+      questionId = await create;
+    } finally {
+      inflightCreates.delete(create);
+    }
+    if (questionId === null) return { answer: QUESTION_TIMEOUT_CONTINUATION_TEXT, timedOut: true };
     dbg('relay question created', questionId, spec.source, spec.prompt.slice(0, 80));
     try {
-      return await shared.waitForRelayQuestionAnswer(questionId, { signal });
+      return await shared.waitForRelayQuestionAnswer(questionId, {
+        signal,
+        ...(spec.timeoutMs === undefined ? {} : { timeoutMs: spec.timeoutMs }),
+      });
     } finally {
       pendingQuestionIds.delete(questionId);
     }
   }
 
+  /**
+   * A structured elicitation (audit #17) → a schema-carrying relay card →
+   * `{ structuredAnswer, answer, timedOut }`.
+   *
+   * The card is created with a top-level `requestedSchema`; the relay's answer
+   * route validates the submission against it and stores `structuredAnswer`,
+   * which the shared waiter reads back off the GET payload. A card that times
+   * out, is cancelled, or was answered without a validatable structured body
+   * comes back with `structuredAnswer: null` — the caller declines in that
+   * case, so a half-valid submission can never be forced into a form result.
+   */
+  async function askStructured({ prompt, requestedSchema, timeoutMs }, { signal, message } = {}) {
+    const result = await ask({
+      prompt: String(prompt || '').trim() || 'Copilot needs structured input to continue this turn.',
+      choices: [],
+      allowFreeform: true,
+      requestedSchema,
+      ...(timeoutMs === undefined ? {} : { timeoutMs }),
+      source: 'onElicitationRequest',
+      rationale: 'Copilot requested a structured form answer to continue this turn.',
+    }, { signal, message });
+    const structuredAnswer = result?.structuredAnswer && typeof result.structuredAnswer === 'object'
+      && !Array.isArray(result.structuredAnswer)
+      ? result.structuredAnswer
+      : null;
+    return {
+      structuredAnswer,
+      answer: String(result?.answer ?? ''),
+      timedOut: result?.timedOut === true,
+    };
+  }
+
   /**
    * `onUserInputRequest` → a relay question card → `{ answer, wasFreeform }`.
    *
@@ -134,20 +222,37 @@ export function createCopilotQuestionBridge({
    * silently. A relay that is unreachable therefore degrades to the same
    * in-band note phase 1 always returned, which lets the model continue.
    */
-  async function askUserInput(request, { signal } = {}) {
+  async function askUserInput(request, { signal, message } = {}) {
     const question = String(request?.question || '').trim();
     const choices = normalizeUserInputChoices(request?.choices);
     // `allowFreeform` is only meaningful alongside choices; with none, the card
     // must accept free text or it cannot be answered.
     const allowFreeform = choices.length ? request?.allowFreeform !== false : true;
+    // Multi-select, in order of trust: the model's own flag (the relay's
+    // `ask_user` tool has `multi_select`; the runtime's built-in one has no
+    // such field), then the wording ("select all that apply"). Either way
+    // every Copilot choice card also offers the "Select several" switch
+    // (`allowMultiSelect`), because a model can forget to say so. The answer
+    // comes back as the labels joined with ", ", which the model reads as a
+    // freeform reply.
+    // A request that demands exactly one of the offered choices
+    // (`allowFreeform: false`) gets neither: a joined answer would be outside
+    // the set the runtime asked for.
+    const canPickSeveral = choices.length >= 2 && allowFreeform;
+    const multiSelect = canPickSeveral
+      && (request?.multiSelect === true || looksLikeMultiSelectQuestion(question, choices));
     const result = await ask({
       prompt: question || 'Copilot asked for input to continue this turn.',
       choices,
       allowFreeform,
-      source: 'onUserInputRequest',
+      source: String(request?.source || '').trim() || 'onUserInputRequest',
       rationale: 'Copilot requested clarification to continue this turn.',
-      extra: { requestId: String(request?.requestId || '') || undefined },
-    }, { signal });
+      extra: {
+        requestId: String(request?.requestId || '') || undefined,
+        ...(multiSelect ? { multiSelect: true } : {}),
+        ...(canPickSeveral ? { allowMultiSelect: true } : {}),
+      },
+    }, { signal, message });
     const answer = String(result?.answer ?? '');
     return {
       answer,
@@ -163,7 +268,7 @@ export function createCopilotQuestionBridge({
    * so a human can type *why* they are refusing and the model receives it as
    * feedback instead of a bare refusal.
    */
-  async function askToolApproval(request, { signal } = {}) {
+  async function askToolApproval(request, { signal, message } = {}) {
     const description = describePermissionRequest(request);
     const result = await ask({
       prompt: `Copilot wants to run:\n\n${description}\n\nApprove this action?`,
@@ -175,7 +280,7 @@ export function createCopilotQuestionBridge({
         requestId: String(request?.requestId || '') || undefined,
         permissionKind: String(request?.kind || '') || undefined,
       },
-    }, { signal });
+    }, { signal, message });
     const answer = String(result?.answer ?? '').trim();
     const approved = !result?.timedOut && answer.toLowerCase() === PERMISSION_APPROVE_CHOICE.toLowerCase();
     // The denial note is composed HERE rather than in the permission handler so
@@ -194,18 +299,26 @@ export function createCopilotQuestionBridge({
    * Settle every card this worker is still waiting on. Called on shutdown: the
    * process is about to stop polling, so a card left `pending` would sit in the
    * UI inviting an answer that nothing will ever read.
+   *
+   * `closing` is set FIRST, then the in-flight creates are awaited, so the
+   * snapshot below cannot miss a card: a create that resolves after this line
+   * sees `closing` and expires its own card before its tracked promise
+   * settles. Returns only the count of cards timed out from the snapshot —
+   * late-born cards are torn down but were never pending.
    */
   async function cancelPendingQuestions() {
+    closing = true;
+    if (inflightCreates.size) await Promise.allSettled([...inflightCreates]);
     const ids = [...pendingQuestionIds];
     pendingQuestionIds.clear();
-    await Promise.all(ids.map((questionId) => api('POST', `/api/relay-question/${questionId}/timeout`, {})
-      .catch(() => {})));
+    await Promise.all(ids.map((questionId) => expireQuestion(questionId)));
     return ids.length;
   }
 
   return {
     askUserInput,
     askToolApproval,
+    askStructured,
     cancelPendingQuestions,
     pendingQuestionCount: () => pendingQuestionIds.size,
     // Re-exported so the runner can wait on a question id it created itself.

package/server/copilot-worker/copilot-sdk-adapter.mjs

@@ -23,7 +23,12 @@ import {
   isStructuredQuotaError,
   normalizeTerminalSendAndWaitError,
   toKebabToken,
-} from '../../.github/extensions/web-relay/runtime/send-and-wait-errors.mjs';
+} from '../../shared/worker-runtime/send-and-wait-errors.mjs';
+import {
+  MODEL_SWITCH_UNCONFIRMED_CODE,
+  MODEL_SWITCH_UNCONFIRMED_STABLE_CODE,
+  isModelSwitchUnconfirmedError,
+} from './copilot-model-switch.mjs';
 import { copilotRuntimeEntry } from '../copilot-sdk-runtime.mjs';
 
 const VERSION_DIR_RE = /^\d+\.\d+\.\d+$/;
@@ -344,7 +349,18 @@ export function copilotAgentModeForRelayMode(relayMode) {
 export function isCopilotQuotaError(data) {
   if (isStructuredQuotaError(data)) return true;
   const message = String(data?.message || '');
-  return /quota/i.test(message) && /(exceed|exhaust)/i.test(message);
+  if (/quota/i.test(message) && /(exceed|exhaust)/i.test(message)) return true;
+  // GitHub's CURRENT wording ("You have reached your monthly quota …",
+  // "reached your usage limit/allowance") says "reached", not "exceeded" — and
+  // the SDK's `sendAndWait` rebuilds a plain Error from the session error's
+  // MESSAGE alone (session.js ~467-495), so a `session.error` can arrive with
+  // no structured field to save it from the prose branch. The possessive
+  // ("your") keeps this off impersonal transient limits ("context length
+  // limit reached"), and rate limits are excluded outright: they reset in
+  // seconds, quota resets with the billing window.
+  if (/rate.?limit/i.test(message)) return false;
+  return /\b(?:reached|hit|used up|exhausted)\b[^.!\n]{0,60}\byour\b[^.!\n]{0,40}\b(?:quota|limit|allowance)\b/i
+    .test(message);
 }
 
 /**
@@ -373,6 +389,14 @@ export function classifyCopilotSessionError(data) {
       quota,
     };
   }
+  // The SAME auth branch the thrown-exception path takes (audit #15): a
+  // `session.error` tagged `errorType: "authentication"`/`"authorization"`, an
+  // auth `errorCode`, or HTTP 401 is a relay-host sign-in problem, and generic
+  // "retry" guidance sends the user in circles. `isCopilotAuthError` reads the
+  // structured `ErrorData` fields first and falls back to prose.
+  if (isCopilotAuthError(data)) {
+    return { ...copilotAuthClassification(detail), quota: false };
+  }
   const code = toKebabToken(data?.errorType) || toKebabToken(data?.errorCode) || 'session-error';
   return {
     code,
@@ -415,6 +439,21 @@ const AUTH_ERROR_CODES = new Set([
   'credentials_invalid',
 ]);
 
+/**
+ * The one auth failure record, shared verbatim by the session-event and
+ * thrown-exception classifiers so the remediation cannot drift between them:
+ * the fix is a user action on the relay host, never a retry.
+ */
+function copilotAuthClassification(detail) {
+  return {
+    code: 'authentication_failed',
+    stableCode: 'copilot.authentication_failed',
+    text: `System note: the Copilot runtime could not authenticate (${detail}). `
+      + 'Run `copilot` on the relay host and sign in, then retry.',
+    detail,
+  };
+}
+
 /**
  * Structured auth signals first (the runtime tags `errorType: "authentication"`
  * and HTTP 401), prose only as the fallback.
@@ -437,23 +476,32 @@ export function isCopilotAuthError(error) {
  */
 export function classifyCopilotTurnException(error) {
   const detail = String(error?.message || error || '').trim() || 'unknown error';
-  const terminal = normalizeTerminalSendAndWaitError(error);
+  // An unconfirmed explicit model selection (audit #13). The error's own
+  // message already names requested vs actual model, so it IS the user-facing
+  // text; the stable code is what lets the UI (and tests) key on it.
+  if (isModelSwitchUnconfirmedError(error)) {
+    return {
+      code: MODEL_SWITCH_UNCONFIRMED_CODE,
+      stableCode: MODEL_SWITCH_UNCONFIRMED_STABLE_CODE,
+      text: detail,
+      detail,
+    };
+  }
+  // The quota hint mirrors the session-event path: sendAndWait-shaped errors
+  // carry only the prose, and "reached your monthly quota" must be terminal
+  // however the error arrived.
+  const hint = { quota: isCopilotQuotaError(error) };
+  const terminal = normalizeTerminalSendAndWaitError(error, hint);
   if (terminal) {
     return {
       code: terminal.code,
       stableCode: terminal.stableCode,
-      text: buildTerminalFailureText(error),
+      text: buildTerminalFailureText(error, hint),
       detail,
     };
   }
   if (isCopilotAuthError(error)) {
-    return {
-      code: 'authentication_failed',
-      stableCode: 'copilot.authentication_failed',
-      text: `System note: the Copilot runtime could not authenticate (${detail}). `
-        + 'Run `copilot` on the relay host and sign in, then retry.',
-      detail,
-    };
+    return copilotAuthClassification(detail);
   }
   return {
     code: 'turn-error',

package/server/copilot-worker/copilot-sdk-event-normalizer.mjs

@@ -83,6 +83,26 @@ export function formatToolActivityText(toolName, input) {
   return truncate(summary ? `Tool (${name}): ${summary}` : `Tool (${name})`);
 }
 
+/**
+ * The closing-message summary out of a task_complete TOOL call's arguments.
+ * Some model/runtime combinations (live-observed with gpt-5.3-codex) deliver
+ * task_complete only as `tool.execution_start` and never as the
+ * `session.task_complete` event — arguments may arrive as an object or as a
+ * JSON-encoded string.
+ */
+export function taskCompleteSummaryFromToolArguments(rawArguments) {
+  let args = rawArguments;
+  if (typeof args === 'string') {
+    try {
+      args = JSON.parse(args);
+    } catch {
+      return '';
+    }
+  }
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return '';
+  return String(args.summary || '').trim();
+}
+
 /**
  * True when an event belongs to a SUBAGENT rather than the root agent.
  *
@@ -208,7 +228,11 @@ function createUsageAccumulator() {
  * `{ channel, payload }` actions; the session process dispatches them to the
  * relay and treats the first `result` action as the turn's terminator.
  */
-export function createCopilotEventNormalizer() {
+export function createCopilotEventNormalizer({
+  // The runner's answer to "is this agent id a background agent?" — shared
+  // across turns, unlike this normalizer's own `backgroundRuns`.
+  isBackgroundAgent = () => false,
+} = {}) {
   let sessionModel = '';
   let sessionId = '';
   let lastEmittedStreamText = '';
@@ -286,6 +310,13 @@ export function createCopilotEventNormalizer() {
   // runtime tags only one of them.
   const subagentRuns = new Map(); // runId -> { displayName, status, opened }
   const subagentAliases = new Map(); // agentId|toolCallId -> runId
+  // Runs spawned with `executionMode: "background"`: task-panel cards, not
+  // lanes. This normalizer lives for ONE turn while a background agent
+  // outlives it, so the runner's knowledge (`isBackgroundAgent`) is consulted
+  // too — a later turn must not open a lane for an agent spawned earlier.
+  const backgroundRuns = new Set();
+  const isBackgroundRun = (runId, agentId) => backgroundRuns.has(runId)
+    || (!!agentId && isBackgroundAgent(agentId) === true);
 
   /**
    * `useToolCallId` is true only for `subagent.*` lifecycle events, where
@@ -412,6 +443,17 @@ export function createCopilotEventNormalizer() {
     return { channel: 'activity', payload: { text, subagentRunId } };
   }
 
+  /**
+   * A line that only tracks background work: the main agent polling its
+   * background agent (`read_agent`), or a permission granted for a tool call
+   * (the call's own line, when it is the main agent's, is the real work). It
+   * still shows on the row; it just does not make a runtime-opened row worth
+   * keeping on its own (the task card covers the background agent).
+   */
+  function bookkeepingActivityAction(text) {
+    return { ...activityAction(text), bookkeeping: true };
+  }
+
   /**
    * Build the single terminal `result` action for this turn. Guarded so a
    * `session.error` arriving after a `session.idle` (or a second error) cannot
@@ -478,23 +520,43 @@ export function createCopilotEventNormalizer() {
       case 'subagent.started': {
         const runId = resolveSubagentRun(event, { useToolCallId: true });
         if (!runId) return [];
+        // A BACKGROUND agent (`executionMode: "background"`) is not a lane in
+        // this reply: it outlives the turn and shows in the task panel as a
+        // stoppable card (the runner reads `rpc.tasks`), and its completion
+        // arrives as a continuation. Opening a lane for it would leave a
+        // bubble spinning after the reply settled — or, if closed at the
+        // terminal, would mark a running agent failed. A one-line note keeps
+        // the transcript honest; its tagged events are dropped below.
+        if (String(data.executionMode || '').trim().toLowerCase() === 'background') {
+          backgroundRuns.add(runId);
+          const name = subagentDisplayName(data);
+          const agentType = String(data.agentType || '').trim();
+          return [activityAction(truncate(
+            `Started background agent: ${name}${agentType && agentType !== name ? ` (${agentType})` : ''} — see the task panel`,
+          ))];
+        }
         return ensureSubagentRun(runId, subagentDisplayName(data));
       }
       case 'subagent.configured':
       case 'subagent.selected': {
-        // `subagent.configured` is UNDOCUMENTED — it appears in no published
-        // schema and a live probe found it between started and completed,
-        // carrying `agentId` but neither `toolCallId` nor a display name. It is
-        // handled rather than ignored so the lane still opens if it ever
-        // arrives first, and it must never clobber the roster's display name
-        // with its own absent one (hence the `||` in ensureSubagentRun).
+        // `subagent.configured` (since documented: `{model, multiTurn, …}`)
+        // arrives between started and completed, carrying `agentId` but
+        // neither `toolCallId` nor a display name. It is handled rather than
+        // ignored so the lane still opens if it ever arrives first, and it
+        // must never clobber the roster's display name with its own absent
+        // one (hence the `||` in ensureSubagentRun). A background agent's
+        // arrives too, and must not open the lane `subagent.started` withheld.
         const runId = resolveSubagentRun(event, { useToolCallId: true });
         if (!runId) return [];
+        if (isBackgroundRun(runId, subagentEventKeys(event).agentId)) return [];
         return ensureSubagentRun(runId, subagentDisplayName(data));
       }
       case 'subagent.completed': {
         const runId = resolveSubagentRun(event, { useToolCallId: true });
         if (!runId) return [];
+        // A background agent finishing inside a later turn is the task panel's
+        // business (the runner watches the same event); no lane to close.
+        if (isBackgroundRun(runId, subagentEventKeys(event).agentId)) return [];
         const actions = closeSubagentRun(runId, 'completed', subagentDisplayName(data));
         const stats = formatSubagentStats(data);
         if (stats) actions.push(activityAction(truncate(`Finished · ${stats}`), runId));
@@ -505,6 +567,11 @@ export function createCopilotEventNormalizer() {
         if (!runId) return [];
         const name = subagentDisplayName(data);
         const reason = String(data.error || '').trim() || 'unknown error';
+        // A background agent's failure still deserves a main-thread line (the
+        // parent agent recovers silently), but there is no lane to close.
+        if (isBackgroundRun(runId, subagentEventKeys(event).agentId)) {
+          return [activityAction(truncate(`Background agent failed (${name}): ${reason}`))];
+        }
         const actions = closeSubagentRun(runId, 'failed', name);
         actions.push(activityAction(truncate(`Subagent failed: ${reason}`), runId));
         // ALSO on the main thread. The parent agent recovers from a failed
@@ -531,6 +598,14 @@ export function createCopilotEventNormalizer() {
     if (isSubagentEvent(event)) {
       const runId = resolveSubagentRun(event);
       if (!runId) return [];
+      // A background agent's traffic belongs to its task card (the runner
+      // tracks its live tool call and tokens from the same events), not to a
+      // lane in this reply — but its model calls still cost real money, so
+      // they count toward the spend of whichever turn is live, as before.
+      if (isBackgroundRun(runId, subagentEventKeys(event).agentId)) {
+        if (type === 'assistant.usage') usage.add(data, { allowModel: false });
+        return [];
+      }
       if (type === 'assistant.message') {
         const content = String(data.content || '');
         if (!content.trim()) return [];
@@ -683,7 +758,23 @@ export function createCopilotEventNormalizer() {
         const toolCallId = String(data.toolCallId || '').trim();
         const toolName = String(data.toolName || '').trim() || 'tool';
         if (toolCallId) toolNames.set(toolCallId, toolName);
-        return [activityAction(formatToolActivityText(toolName, data.arguments))];
+        // task_complete is the agent's closing message wearing a tool call's
+        // clothes. gpt-5.3-codex (live, 2026-09-12) closes with ONLY this tool
+        // call — no session.task_complete event follows — and whatever text
+        // was mid-stream gets cut, so without adopting the summary here the
+        // reply renders as the truncated fragment. Same precedence as the
+        // event case below; no generic activity row, the summary IS the reply.
+        if (toolName === 'task_complete') {
+          const summary = taskCompleteSummaryFromToolArguments(data.arguments);
+          if (!summary) return [];
+          taskCompleteSummary = summary;
+          const text = finalText();
+          if (!shouldEmitStreamUpdate(text, lastEmittedStreamText)) return [];
+          lastEmittedStreamText = text;
+          return [{ channel: 'stream', payload: { text, done: false, subagentRunId: null } }];
+        }
+        const toolLine = formatToolActivityText(toolName, data.arguments);
+        return [toolName === 'read_agent' ? bookkeepingActivityAction(toolLine) : activityAction(toolLine)];
       }
       case 'tool.execution_complete': {
         // There is no `tool.*_failed` event type — failure is `success: false`
@@ -708,9 +799,9 @@ export function createCopilotEventNormalizer() {
         const summary = permissionRequests.get(requestId) || '';
         permissionRequests.delete(requestId);
         const kind = String(data.result?.kind || 'unknown').trim();
-        return [activityAction(truncate(summary
-          ? `Permission ${kind}: ${summary}`
-          : `Permission ${kind}`))];
+        const line = truncate(summary ? `Permission ${kind}: ${summary}` : `Permission ${kind}`);
+        // A denial is news; a grant is bookkeeping for the call it unblocked.
+        return [kind.startsWith('approved') ? bookkeepingActivityAction(line) : activityAction(line)];
       }
       case 'user_input.requested': {
         // The question is forwarded to the relay as a question card; this row
@@ -756,7 +847,40 @@ export function createCopilotEventNormalizer() {
         lastEmittedStreamText = text;
         return [{ channel: 'stream', payload: { text, done: false, subagentRunId: null } }];
       }
-      // ---- the one true terminator -----------------------------------------
+      // ---- compaction ------------------------------------------------------
+      //
+      // Surfaced as activity lines so a long pause reads as what it is. The
+      // runner ALSO watches these two events directly for its steering hold
+      // (a message must not be pushed into a compaction's replay).
+      case 'session.compaction_start': {
+        return [activityAction('Compacting the conversation context…')];
+      }
+      case 'session.compaction_complete': {
+        if (data.success === false) {
+          const reason = String(data.error || '').trim();
+          return [activityAction(truncate(reason ? `Context compaction failed: ${reason}` : 'Context compaction failed'))];
+        }
+        const removed = Number(data.messagesRemoved);
+        const tokens = Number(data.tokensRemoved);
+        const parts = [];
+        if (Number.isFinite(removed) && removed > 0) parts.push(`${removed} messages`);
+        if (Number.isFinite(tokens) && tokens > 0) parts.push(`${Math.round(tokens / 1000)}k tokens`);
+        return [activityAction(parts.length ? `Context compacted (removed ${parts.join(', ')})` : 'Context compacted')];
+      }
+      // ---- the terminators ---------------------------------------------------
+      //
+      // `assistant.idle` is "the main agent's processing loop went idle" and
+      // fires even while background agents / attached shells keep the
+      // session-level idle deferred (runtime 1.0.88, live-probed 2026-09-25).
+      // It is the terminator that lets a row settle while a background agent
+      // the turn spawned keeps running under the task panel — exactly the
+      // Claude worker's lingering model. `session.idle` stays the hard
+      // terminator for runtimes that do not emit the assistant-level one and
+      // for the drain's end; `terminalEmitted` makes the second a no-op.
+      case 'assistant.idle': {
+        if (data.aborted === true) aborted = true;
+        return terminalAction({ subtype: aborted ? 'aborted' : 'completed' });
+      }
       case 'session.idle': {
         if (data.aborted === true) aborted = true;
         return terminalAction({ subtype: aborted ? 'aborted' : 'completed' });