@oh-my-pi/pi-coding-agent 17.0.7 → 17.0.9

package/src/extensibility/typebox.ts

@@ -17,7 +17,7 @@
  * like a small validator at runtime.
  */
 
-import { areJsonValuesEqual } from "@oh-my-pi/pi-ai/utils/schema";
+import { areJsonValuesEqual, upgradeJsonSchemaTo202012, validateJsonSchemaValue } from "@oh-my-pi/pi-ai/utils/schema";
 
 // ---------------------------------------------------------------------------
 // Type aliases — exported so `import type { Static, TSchema } from "..."`
@@ -41,6 +41,8 @@ export type TOptional<_E extends ArkSchema> = ArkSchema;
 export type TUnion<_T extends readonly ArkSchema[] = readonly ArkSchema[]> = ArkSchema;
 export type TEnum<_T extends readonly (string | number)[] = readonly (string | number)[]> = ArkSchema;
 export type TRecord<_K extends ArkSchema, _V extends ArkSchema> = ArkSchema;
+/** TypeBox-compatible wrapper for raw JSON Schema documents. */
+export type TUnsafe<_T = unknown> = ArkSchema;
 
 // ---------------------------------------------------------------------------
 // ArkSchema wrapper — JSON Schema object with hidden validator metadata
@@ -560,18 +562,14 @@ function tNull(opts?: Meta): ArkSchema {
 	return applyMeta(createArkSchema(validator, { type: "null" }), opts);
 }
 
+const identityValidator = (data: unknown): unknown => data;
+
 function tAny(opts?: Meta): ArkSchema {
-	return applyMeta(
-		createArkSchema((data: unknown) => data, {}),
-		opts,
-	);
+	return applyMeta(createArkSchema(identityValidator, {}), opts);
 }
 
 function tUnknown(opts?: Meta): ArkSchema {
-	return applyMeta(
-		createArkSchema((data: unknown) => data, {}),
-		opts,
-	);
+	return applyMeta(createArkSchema(identityValidator, {}), opts);
 }
 
 function tNever(opts?: Meta): ArkSchema {
@@ -920,6 +918,21 @@ export const Type = {
 	Null: tNull,
 	Any: tAny,
 	Unknown: tUnknown,
+	Unsafe<T = unknown>(jsonSchema: Record<string, unknown> = {}): TUnsafe<T> {
+		// Validate against the same draft-2020-12 upgrade the wire/tool-call
+		// path applies, so legacy draft-07 documents (tuple `items`, etc.)
+		// behave identically in `safeParse` and `validateToolArguments`.
+		const upgradedSchema = upgradeJsonSchemaTo202012(jsonSchema);
+		const validator = (data: unknown): unknown => {
+			const result = validateJsonSchemaValue(upgradedSchema, data);
+			if (result.success) return data;
+			const messages = result.issues.map(issue =>
+				issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message,
+			);
+			return validationFailure(messages.join("; ") || "Invalid value");
+		};
+		return createArkSchema(validator, jsonSchema);
+	},
 	Never: tNever,
 	Literal: tLiteral,
 	Union: tUnion,

package/src/hindsight/client.test.ts

@@ -31,3 +31,45 @@ describe("HindsightApi fetch cancellation", () => {
 		expect(requestSignal?.reason).toBe(caller.signal.reason);
 	});
 });
+
+describe("HindsightApi per-op timeouts", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("reports the effective per-op deadline in the timeout error", async () => {
+		vi.spyOn(globalThis, "fetch").mockImplementation(
+			Object.assign(
+				async (): Promise<Response> => {
+					throw new DOMException("The operation timed out.", "TimeoutError");
+				},
+				{ preconnect: globalThis.fetch.preconnect },
+			),
+		);
+
+		const client = new HindsightApi({
+			baseUrl: "https://hindsight.example",
+			timeouts: { reflect: 90_000, recall: 15_000 },
+		});
+
+		await expect(client.reflect("bank", "q")).rejects.toThrow("reflect request timed out after 90s");
+		await expect(client.recall("bank", "q")).rejects.toThrow("recall request timed out after 15s");
+	});
+
+	it("falls back to the client request default for ops without an override", async () => {
+		vi.spyOn(globalThis, "fetch").mockImplementation(
+			Object.assign(
+				async (): Promise<Response> => {
+					throw new DOMException("The operation timed out.", "TimeoutError");
+				},
+				{ preconnect: globalThis.fetch.preconnect },
+			),
+		);
+		const client = new HindsightApi({
+			baseUrl: "https://hindsight.example",
+			timeouts: { request: 45_000 },
+		});
+
+		await expect(client.createBank("bank")).rejects.toThrow("createBank request timed out after 45s");
+	});
+});

package/src/hindsight/client.ts

@@ -13,17 +13,32 @@ import type { HindsightConfig } from "./config";
 
 const USER_AGENT = "oh-my-pi-coding-agent";
 const DEFAULT_USER_AGENT = USER_AGENT;
-const HINDSIGHT_REQUEST_TIMEOUT_MS = 30_000;
+/** Fallback deadlines (ms) applied when the caller supplies no override. */
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+const DEFAULT_REFLECT_TIMEOUT_MS = 120_000;
+const DEFAULT_RECALL_TIMEOUT_MS = 30_000;
+const DEFAULT_RETAIN_TIMEOUT_MS = 60_000;
 
 export type Budget = "low" | "mid" | "high" | string;
 export type TagsMatch = "any" | "all" | "any_strict" | "all_strict";
 export type UpdateMode = "replace" | "append";
 export type ConsolidationState = "failed" | "pending" | "done";
 
+/** Per-operation request deadlines (ms). Each falls back to a built-in default. */
+export interface HindsightTimeouts {
+	/** Default deadline for ops without a specific override. */
+	request?: number;
+	reflect?: number;
+	recall?: number;
+	retain?: number;
+}
+
 export interface HindsightApiOptions {
 	baseUrl: string;
 	apiKey?: string;
 	userAgent?: string;
+	/** Per-op deadlines; unset entries fall back to built-in defaults. */
+	timeouts?: HindsightTimeouts;
 }
 
 /** Caller cancellation shared by Hindsight request option bags. */
@@ -216,11 +231,17 @@ interface RequestOptions {
 	/** Return null instead of throwing on a 404 response. */
 	allow404?: boolean;
 	signal?: AbortSignal;
+	/** Op deadline (ms); defaults to the client's request timeout. */
+	timeoutMs?: number;
 }
 
 export class HindsightApi {
 	#baseUrl: string;
 	#headers: Record<string, string>;
+	#reflectTimeoutMs: number;
+	#recallTimeoutMs: number;
+	#retainTimeoutMs: number;
+	#requestTimeoutMs: number;
 
 	constructor(options: HindsightApiOptions) {
 		this.#baseUrl = options.baseUrl.replace(/\/+$/, "");
@@ -231,6 +252,11 @@ export class HindsightApi {
 		if (options.apiKey) {
 			this.#headers.Authorization = `Bearer ${options.apiKey}`;
 		}
+		const timeouts = options.timeouts;
+		this.#requestTimeoutMs = timeouts?.request ?? DEFAULT_REQUEST_TIMEOUT_MS;
+		this.#reflectTimeoutMs = timeouts?.reflect ?? DEFAULT_REFLECT_TIMEOUT_MS;
+		this.#recallTimeoutMs = timeouts?.recall ?? DEFAULT_RECALL_TIMEOUT_MS;
+		this.#retainTimeoutMs = timeouts?.retain ?? DEFAULT_RETAIN_TIMEOUT_MS;
 	}
 
 	async retain(bankId: string, content: string, options?: RetainOptions): Promise<RetainResponse> {
@@ -251,6 +277,7 @@ export class HindsightApi {
 			{
 				body: { items: [item], async: options?.async },
 				signal: options?.signal,
+				timeoutMs: this.#retainTimeoutMs,
 			},
 		);
 	}
@@ -282,6 +309,7 @@ export class HindsightApi {
 					async: options?.async,
 				},
 				signal: options?.signal,
+				timeoutMs: this.#retainTimeoutMs,
 			},
 		);
 	}
@@ -301,6 +329,7 @@ export class HindsightApi {
 					tags_match: options?.tagsMatch,
 				},
 				signal: options?.signal,
+				timeoutMs: this.#recallTimeoutMs,
 			},
 		);
 	}
@@ -319,6 +348,7 @@ export class HindsightApi {
 					tags_match: options?.tagsMatch,
 				},
 				signal: options?.signal,
+				timeoutMs: this.#reflectTimeoutMs,
 			},
 		);
 	}
@@ -506,10 +536,11 @@ export class HindsightApi {
 			if (qs) url += `?${qs}`;
 		}
 
+		const timeoutMs = opts?.timeoutMs ?? this.#requestTimeoutMs;
 		const init: RequestInit = {
 			method,
 			headers: this.#headers,
-			signal: withTimeoutSignal(HINDSIGHT_REQUEST_TIMEOUT_MS, opts?.signal),
+			signal: withTimeoutSignal(timeoutMs, opts?.signal),
 		};
 		if (opts?.body !== undefined) {
 			init.body = JSON.stringify(pruneUndefined(opts.body));
@@ -520,7 +551,7 @@ export class HindsightApi {
 			response = await fetch(url, init);
 		} catch (err) {
 			const message = isTimeoutError(err)
-				? `${operation} request timed out after 30s`
+				? `${operation} request timed out after ${Math.round(timeoutMs / 1000)}s`
 				: `${operation} request failed: ${err instanceof Error ? err.message : String(err)}`;
 			throw new HindsightError(message, undefined, err);
 		}
@@ -639,5 +670,11 @@ export function createHindsightClient(config: HindsightConfig & { hindsightApiUr
 		baseUrl: config.hindsightApiUrl,
 		apiKey: config.hindsightApiToken ?? undefined,
 		userAgent: USER_AGENT,
+		timeouts: {
+			request: config.requestTimeoutMs,
+			reflect: config.reflectTimeoutMs,
+			recall: config.recallTimeoutMs,
+			retain: config.retainTimeoutMs,
+		},
 	});
 }

package/src/hindsight/config.ts

@@ -42,6 +42,15 @@ export interface HindsightConfig {
 
 	debug: boolean;
 
+	/** Default per-request client deadline (ms) for ops without a specific override. */
+	requestTimeoutMs: number;
+	/** Client deadline (ms) for reflect (agentic synthesis; costlier than a metadata fetch). */
+	reflectTimeoutMs: number;
+	/** Client deadline (ms) for recall. */
+	recallTimeoutMs: number;
+	/** Client deadline (ms) for retain / retainBatch. */
+	retainTimeoutMs: number;
+
 	mentalModelsEnabled: boolean;
 	mentalModelAutoSeed: boolean;
 	mentalModelRefreshIntervalMs: number;
@@ -115,6 +124,10 @@ export function loadHindsightConfig(settings: Settings, env: NodeJS.ProcessEnv =
 	const recallContextTurnsEnv = envInt(env.HINDSIGHT_RECALL_CONTEXT_TURNS);
 	const recallMaxQueryCharsEnv = envInt(env.HINDSIGHT_RECALL_MAX_QUERY_CHARS);
 	const retainEveryNTurnsEnv = envInt(env.HINDSIGHT_RETAIN_EVERY_N_TURNS);
+	const requestTimeoutMsEnv = envInt(env.HINDSIGHT_REQUEST_TIMEOUT_MS);
+	const reflectTimeoutMsEnv = envInt(env.HINDSIGHT_REFLECT_TIMEOUT_MS);
+	const recallTimeoutMsEnv = envInt(env.HINDSIGHT_RECALL_TIMEOUT_MS);
+	const retainTimeoutMsEnv = envInt(env.HINDSIGHT_RETAIN_TIMEOUT_MS);
 
 	// Read from settings (each falls back to its schema default).
 	const settingsRetainMode = pickRetainMode(settings.get("hindsight.retainMode"));
@@ -158,6 +171,11 @@ export function loadHindsightConfig(settings: Settings, env: NodeJS.ProcessEnv =
 
 		debug: debugEnv ?? settings.get("hindsight.debug"),
 
+		requestTimeoutMs: requestTimeoutMsEnv ?? settings.get("hindsight.requestTimeoutMs"),
+		reflectTimeoutMs: reflectTimeoutMsEnv ?? settings.get("hindsight.reflectTimeoutMs"),
+		recallTimeoutMs: recallTimeoutMsEnv ?? settings.get("hindsight.recallTimeoutMs"),
+		retainTimeoutMs: retainTimeoutMsEnv ?? settings.get("hindsight.retainTimeoutMs"),
+
 		mentalModelsEnabled: settings.get("hindsight.mentalModelsEnabled"),
 		mentalModelAutoSeed: settings.get("hindsight.mentalModelAutoSeed"),
 		mentalModelRefreshIntervalMs: settings.get("hindsight.mentalModelRefreshIntervalMs"),

package/src/internal-urls/registry-helpers.ts

@@ -90,3 +90,43 @@ export async function sessionFilesFromDisk(): Promise<Map<string, string>> {
 	for (const dir of artifactsDirsFromRegistry()) await scan(dir, 0);
 	return found;
 }
+
+/**
+ * Availability half of the `history://` resolution semantics: true when a
+ * transcript for `agentId` can be served from a registered ref's live session
+ * or retained session file, or from an on-disk `.jsonl` under a known
+ * artifacts dir. Hint surfaces use this so they only advertise
+ * `history://<agentId>` links that `HistoryProtocolHandler` can actually
+ * resolve. A retained sessionFile path is verified on disk before it counts,
+ * and probing never throws: a stale path or unreadable artifacts subtree
+ * reads as unavailable instead of disturbing the caller's delivery path.
+ */
+export async function hasResolvableTranscript(agentId: string): Promise<boolean> {
+	try {
+		const registry = AgentRegistry.global();
+		const lower = agentId.toLowerCase();
+		let ref = registry.get(agentId);
+		if (ref?.kind === "advisor") ref = undefined;
+		ref ??= registry.list().find(candidate => candidate.kind !== "advisor" && candidate.id.toLowerCase() === lower);
+		if (ref?.session) return true;
+		if (ref?.sessionFile && (await isReadableFile(ref.sessionFile))) return true;
+		const files = await sessionFilesFromDisk();
+		for (const id of files.keys()) {
+			if (id.toLowerCase() === lower) return true;
+		}
+	} catch {
+		// Availability probing is advisory; any filesystem failure means the
+		// transcript cannot be promised, never that delivery should fail.
+	}
+	return false;
+}
+
+/** True when `file` exists and is a regular file; never throws. */
+async function isReadableFile(file: string): Promise<boolean> {
+	try {
+		const stat = await fs.stat(file);
+		return stat.isFile();
+	} catch {
+		return false;
+	}
+}

package/src/launch/broker.ts

@@ -491,8 +491,17 @@ class DaemonBroker {
 		await this.#launch(record);
 		let readyTimedOut = false;
 		if (spec.ready && !terminalState(record.snapshot.state)) {
-			const ready = await this.#waitUntil(record, () => record.snapshot.state === "ready", spec.ready.timeoutMs);
-			readyTimedOut = !ready && !terminalState(record.snapshot.state);
+			// Wake on the sticky readyAt marker or any terminal state, not the live
+			// state: a fast process flips starting→ready→exited within one poll
+			// interval, so sampling `state === "ready"` never observes readiness even
+			// though #markReady durably recorded readyAt. A pre-ready exit must also
+			// wake the wait rather than block for the full timeout.
+			const ready = await this.#waitUntil(
+				record,
+				() => record.snapshot.readyAt !== undefined || terminalState(record.snapshot.state),
+				spec.ready.timeoutMs,
+			);
+			readyTimedOut = !ready;
 		}
 		await record.persistQueue;
 		return { op: "start", daemon: record.snapshot, readyTimedOut };
@@ -748,6 +757,11 @@ class DaemonBroker {
 			const uptime = Date.now() - record.snapshot.startedAt;
 			record.consecutiveFailures = uptime >= 30_000 ? 0 : record.consecutiveFailures + 1;
 			record.snapshot.restartCount++;
+			// Readiness belongs to the exited generation; clear it before the backoff
+			// so start / for:"ready" waits don't treat a dead service as ready during
+			// the restart window (readyAt is re-set by #launch once the child is up).
+			record.snapshot.readyAt = undefined;
+			record.snapshot.readyMatch = undefined;
 			record.snapshot.state = "restarting";
 			const delay = Math.min(1_000 * 2 ** Math.min(record.consecutiveFailures, 5), RESTART_MAX_DELAY_MS);
 			record.log?.append(
@@ -812,6 +826,12 @@ class DaemonBroker {
 				throw new Error(`Invalid wait regex: ${error instanceof Error ? error.message : String(error)}`);
 			}
 		}
+		// Readiness was actually observed: the sticky readyAt survives a fast
+		// ready→exit, a live "ready" state, or a "running" daemon with no ready spec.
+		const readyObserved = (): boolean =>
+			record.snapshot.readyAt !== undefined ||
+			record.snapshot.state === "ready" ||
+			(record.snapshot.state === "running" && !record.spec.ready);
 		const condition = (): boolean => {
 			if (pattern) {
 				const match = pattern.exec(record.readinessBuffer);
@@ -820,10 +840,16 @@ class DaemonBroker {
 				return true;
 			}
 			if (operation.for === "exit") return terminalState(record.snapshot.state);
-			return record.snapshot.state === "ready" || (record.snapshot.state === "running" && !record.spec.ready);
+			// Wake on observed readiness or any terminal state so the wait never
+			// blocks for the full timeout; success is judged by readyObserved below.
+			return readyObserved() || terminalState(record.snapshot.state);
 		};
-		const reached = condition() || (await this.#waitUntil(record, condition, operation.timeoutMs));
-		return { op: "wait", daemon: record.snapshot, matched, timedOut: !reached };
+		const woke = condition() || (await this.#waitUntil(record, condition, operation.timeoutMs));
+		// A for:"ready" wait that woke on a terminal exit without ever observing
+		// readiness is still "not ready" — surface it as timed out so callers and the
+		// renderer don't chain work against a dead process.
+		const timedOut = operation.for === "ready" && !pattern ? !readyObserved() : !woke;
+		return { op: "wait", daemon: record.snapshot, matched, timedOut };
 	}
 
 	async #send(operation: Extract<DaemonOperation, { op: "send" }>): Promise<DaemonRpcResult> {

package/src/lsp/client.ts

@@ -846,6 +846,29 @@ export async function getOrCreateClient(
 	return clientPromise;
 }
 
+/** Return an active or already-starting client without starting a language server. */
+export async function getActiveOrPendingClient(
+	config: ServerConfig,
+	cwd: string,
+	signal?: AbortSignal,
+): Promise<LspClient | undefined> {
+	throwIfAborted(signal);
+	const client = clients.get(`${config.command}:${cwd}`);
+	if (client) {
+		client.lastActivity = Date.now();
+		return client;
+	}
+
+	const pending = clientLocks.get(`${config.command}:${cwd}`);
+	if (!pending) return undefined;
+	try {
+		return await untilAborted(signal, pending);
+	} catch {
+		throwIfAborted(signal);
+		return undefined;
+	}
+}
+
 /**
  * Ensure a file is opened in the LSP client.
  * Sends didOpen notification if the file is not already tracked.

package/src/lsp/clients/biome-client.ts

@@ -2,7 +2,7 @@
  * Biome CLI-based linter client.
  * Uses Biome's CLI with JSON output instead of LSP (which has stale diagnostics issues).
  */
-import path from "node:path";
+import * as path from "node:path";
 import { logger } from "@oh-my-pi/pi-utils";
 import type { Diagnostic, DiagnosticSeverity, LinterClient, ServerConfig } from "../../lsp/types";
 
@@ -141,14 +141,13 @@ export class BiomeClient implements LinterClient {
 	) {}
 
 	async format(filePath: string, content: string): Promise<string> {
-		// Write content to file first
+		// Keep the standalone LinterClient contract: callers supply the content to
+		// format, regardless of what is currently on disk.
 		await Bun.write(filePath, content);
 
-		// Run biome format --write
 		const result = await runBiome(["format", "--write", filePath], this.cwd, this.config.resolvedCommand);
 
 		if (result.success) {
-			// Read back formatted content
 			return await Bun.file(filePath).text();
 		}
 

package/src/lsp/index.ts

@@ -20,6 +20,7 @@ import {
 	ensureFileOpen,
 	FileChangeType,
 	getActiveClients,
+	getActiveOrPendingClient,
 	getOrCreateClient,
 	type LspServerStatus,
 	notifySaved,
@@ -211,6 +212,7 @@ async function syncFileContent(
 	cwd: string,
 	servers: Array<[string, ServerConfig]>,
 	signal?: AbortSignal,
+	createMissing = true,
 ): Promise<void> {
 	throwIfAborted(signal);
 	await Promise.allSettled(
@@ -219,11 +221,15 @@ async function syncFileContent(
 			if (serverConfig.createClient) {
 				return;
 			}
-			const client = await getOrCreateClient(serverConfig, cwd, undefined, signal);
+			const client = createMissing
+				? await getOrCreateClient(serverConfig, cwd, undefined, signal)
+				: await getActiveOrPendingClient(serverConfig, cwd, signal);
+			if (!client) return;
 			throwIfAborted(signal);
 			await syncContent(client, absolutePath, content, signal);
 		}),
 	);
+	throwIfAborted(signal);
 }
 
 /**
@@ -239,6 +245,7 @@ async function notifyFileSaved(
 	cwd: string,
 	servers: Array<[string, ServerConfig]>,
 	signal?: AbortSignal,
+	createMissing = true,
 ): Promise<void> {
 	throwIfAborted(signal);
 	await Promise.allSettled(
@@ -247,10 +254,14 @@ async function notifyFileSaved(
 			if (serverConfig.createClient) {
 				return;
 			}
-			const client = await getOrCreateClient(serverConfig, cwd, undefined, signal);
+			const client = createMissing
+				? await getOrCreateClient(serverConfig, cwd, undefined, signal)
+				: await getActiveOrPendingClient(serverConfig, cwd, signal);
+			if (!client) return;
 			await notifySaved(client, absolutePath, signal);
 		}),
 	);
+	throwIfAborted(signal);
 }
 
 // Cache config per cwd to avoid repeated file I/O
@@ -1333,7 +1344,8 @@ async function runLspWritethrough(
 	// Capture diagnostic versions BEFORE syncing to detect stale diagnostics
 	// Bound client creation by the writethrough budget: a hung/broken server
 	// must not add its full init wait (30s default) to every edit.
-	const minVersions = enableDiagnostics ? await captureDiagnosticVersions(cwd, servers, 5_000, signal) : undefined;
+	const minVersionsPromise = enableDiagnostics ? captureDiagnosticVersions(cwd, servers, 5_000, signal) : undefined;
+	let minVersions = useCustomFormatter ? undefined : await minVersionsPromise;
 	let expectedDocumentVersions: ServerVersionMap | undefined;
 
 	let formatter: FileFormatResult | undefined;
@@ -1353,13 +1365,19 @@ async function runLspWritethrough(
 		operationSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
 		await untilAborted(operationSignal, async () => {
 			if (useCustomFormatter) {
-				// Custom linters (e.g. Biome CLI) require on-disk input.
+				// Custom linters operate on on-disk input; the shared pre-write also
+				// supports implementations that inspect the file before formatting.
 				await writeContent(content);
-				finalContent = await formatContent(dst, content, cwd, customLinterServers, operationSignal);
+				const [formattedContent, capturedVersions] = await Promise.all([
+					formatContent(dst, content, cwd, customLinterServers, operationSignal),
+					minVersionsPromise,
+				]);
+				finalContent = formattedContent;
+				minVersions = capturedVersions;
 				formatter = finalContent !== content ? FileFormatResult.FORMATTED : FileFormatResult.UNCHANGED;
 				await writeContent(finalContent);
 				await notifyWriteCommitted(operationSignal);
-				await syncFileContent(dst, finalContent, cwd, lspServers, operationSignal);
+				await syncFileContent(dst, finalContent, cwd, lspServers, operationSignal, enableDiagnostics);
 			} else {
 				// 1. Sync original content to LSP servers
 				await syncFileContent(dst, content, cwd, lspServers, operationSignal);
@@ -1385,7 +1403,7 @@ async function runLspWritethrough(
 			}
 
 			// 5. Notify saved to LSP servers
-			await notifyFileSaved(dst, cwd, lspServers, operationSignal);
+			await notifyFileSaved(dst, cwd, lspServers, operationSignal, !useCustomFormatter || enableDiagnostics);
 		});
 		synced = true;
 	} catch {
@@ -1565,7 +1583,7 @@ export class LspTool implements AgentTool<typeof lspSchema, LspToolDetails, Them
 		_context?: AgentToolContext,
 	): Promise<AgentToolResult<LspToolDetails>> {
 		const { action, file, line, symbol, query, new_name, apply, timeout } = params;
-		const timeoutSec = clampTimeout("lsp", timeout);
+		const timeoutSec = clampTimeout("lsp", timeout, this.session.settings.get("tools.maxTimeout"));
 		const timeoutSignal = AbortSignal.timeout(timeoutSec * 1000);
 		const callerSignal = signal;
 		signal = callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;

package/src/main.ts

@@ -134,6 +134,7 @@ async function checkForNewVersion(currentVersion: string): Promise<string | unde
 // embedders need project-level opt-outs for reminder/prelude prompt injection.
 const HOST_DEFAULTED_SETTING_PATHS: SettingPath[] = [
 	"task.isolation.mode",
+	"task.isolation.apply",
 	"task.isolation.merge",
 	"task.isolation.commits",
 	"task.eager",
@@ -882,6 +883,7 @@ export async function buildSessionOptions(
 			cliProvider: parsed.provider,
 			cliModel: parsed.model,
 			modelRegistry,
+			availableModels: modelRegistry.getAvailable(),
 			settings: activeSettings,
 			preferences: modelMatchPreferences,
 		});
@@ -954,13 +956,22 @@ export async function buildSessionOptions(
 		if (resolved.warning) {
 			process.stderr.write(`${chalk.yellow(`Warning: ${resolved.warning}`)}\n`);
 		}
+		// Prewalk is an optional optimization (off by default): switch to a fast
+		// model at the first edit. If its hand-off target can't be resolved or has
+		// no configured auth, warn and leave prewalk unarmed rather than aborting
+		// startup and locking the user out of the app (issue #6064).
 		if (resolved.error || !resolved.model) {
-			throw new Error(resolved.error ?? `Model "${parsed.prewalkInto ?? DEFAULT_PREWALK_TARGET}" not found`);
-		}
-		if (!modelRegistry.hasConfiguredAuth(resolved.model)) {
-			throw new Error(`No API key for ${resolved.model.provider}/${resolved.model.id}`);
+			const target = parsed.prewalkInto ?? DEFAULT_PREWALK_TARGET;
+			process.stderr.write(
+				`${chalk.yellow(`Warning: prewalk disabled — ${resolved.error ?? `model "${target}" not found`}`)}\n`,
+			);
+		} else if (!modelRegistry.hasConfiguredAuth(resolved.model)) {
+			process.stderr.write(
+				`${chalk.yellow(`Warning: prewalk disabled — no API key for ${resolved.model.provider}/${resolved.model.id}`)}\n`,
+			);
+		} else {
+			options.prewalk = { target: resolved.model, thinkingLevel: resolved.thinkingLevel };
 		}
-		options.prewalk = { target: resolved.model, thinkingLevel: resolved.thinkingLevel };
 	}
 
 	if (parsed.planYoloInto !== undefined && !parsed.planYolo) {