@omercnet/paseo-omp 0.2.1-next.88.1 → 0.2.1-next.90.1

package/README.md

@@ -6,7 +6,7 @@ Community OMP integration for Paseo. The plugin registers the distinct `omp-plug
 
 ## Quick start
 
-Requirements: Paseo `^0.8.0`, OMP `18.1.15` or newer, and OMP RPC protocol v2.
+Requirements: Paseo `>=0.8.0 <0.10.0`, OMP `18.1.15` or newer, and OMP RPC protocol v2. Paseo `0.9.0-beta.1` is recommended for npm-managed installation and the complete client integration.
 
 ```bash
 paseo plugin install npm:@omercnet/paseo-omp@<version>
@@ -22,7 +22,7 @@ Open the **OMP** sidebar to review the provider-profile contract, choose which c
 - [Core-provider issue and parity audit](docs/core-provider-issue-audit.md)
 - [Alpha release checklist](docs/alpha-release-checklist.md)
 
-The plugin uses only public Paseo 0.8 provider contracts and registers distinct `omp-plugin` and `omp-plugin-<profile>` identities; it does not modify the bundled `omp` provider.
+The plugin uses public Paseo 0.8 and 0.9 beta provider contracts and registers distinct `omp-plugin` and `omp-plugin-<profile>` identities; it does not modify the bundled `omp` provider.
 
 ## Named OMP profiles
 
@@ -36,7 +36,7 @@ Profile selection is request-local: concurrent clients cannot change each other'
 
 ## Paseo provider SDK coverage
 
-This matrix inventories the complete capability set exported by the pinned `@getpaseo/plugin` 0.8.0 provider SDK. It measures strict SDK surface coverage, not general product quality.
+This matrix inventories the complete capability set exported by the pinned `@getpaseo/plugin` 0.9.0-beta.1 provider SDK. It measures strict SDK surface coverage, not general product quality.
 
 **Current capability completeness: 61.8%.** The provider advertises 11 of 17 capabilities (64.7%); ten are complete and `session.configure` is partial.
 
@@ -49,7 +49,7 @@ Scoring is deliberately mechanical so releases remain comparable:
 
 | SDK capability | Completeness | Support and gap |
 | --- | ---: | --- |
-| `prompt.message` | **100%** | Text, structured attachments, optimistic correlation, streaming, and terminal outcomes map to native OMP prompts. |
+| `prompt.message` | **100%** | Text, structured attachments, optimistic correlation, streaming, and terminal outcomes map to native OMP prompts. Matching terminal request IDs remain authoritative; released OMP builds without them use the ordered compatibility policy described below. |
 | `prompt.command` | **100%** | Native command discovery plus structured `compact`, `autocompact`, `handoff`, `steer`, and `follow-up` dispatch. Individual commands can still fail when their documented OMP prerequisites are absent. |
 | `prompt.image` | **100%** | Native image blocks for capable models; private bounded temporary files with cleanup for text-only models. |
 | `prompt.output_schema` | **0%** | Not advertised. OMP has no equivalent structured-output contract; `outputSchema` fails visibly. |
@@ -97,7 +97,9 @@ The plugin always remains a separate provider. It registers `omp-plugin` and `om
 
 Existing agents whose provider is `omp` remain owned by the bundled provider. New plugin agents persist under their selected `omp-plugin` or `omp-plugin-<profile>` identity with the plugin's versioned opaque handle. The plugin can list and import OMP-native sessions through its own provider flow, but it performs no implicit conversion of bundled-provider records.
 
-OMP `18.1.15` is the oldest version tested end to end. The direct provider's hard compatibility gate is `rpc-ui` protocol v2: metadata-free legacy ready frames and v1-only runtimes are rejected before a provider session opens because they cannot support the advertised persistence and conversation-rewind capabilities. Typed tool approvals remain capability-gated and fall back as described above.
+OMP `18.1.15` is the oldest version tested end to end. The direct provider's hard compatibility gate is `rpc-ui` protocol v2: metadata-free legacy ready frames and v1-only runtimes are rejected before a provider session opens because they cannot support the advertised persistence and conversation-rewind capabilities. Typed tool approvals remain capability-gated and fall back as described above. For terminal completion, a matching `agent_end.requestId` is authoritative and mismatches are ignored before state changes. Released OMP 18.2.x builds that omit that field use an ordered fallback requiring a fresh correlated native user entry followed by current-turn assistant activity, an idle non-compacting runtime, and no conflicting permission, tool, steer, or child-session work. Ambiguous events while OMP is active are ignored; unresolved ambiguity after confirmed idle fails only the Paseo turn. This trades a bounded residual same-agent stale-event risk for compatibility with released OMP instead of terminating and lazily restarting the runtime after every later prompt. Paseo clients, including mobile clients inside reconnect grace, do not own or terminate the daemon-managed OMP session.
+
+Paseo 0.9.0-beta.1 is the canary target and provides npm-managed plugin sources, platform-owned external URL opening, and whole-item timeline transforms before Overview grouping. Paseo 0.8.x remains supported for provider operation and Git or directory installation; its clients do not provide the external URL opener and retain their older timeline presentation semantics.
 
 Install, update, disable, or remove `paseo-omp` independently of the bundled provider. Verify the provider snapshot contains `omp-plugin` after installation; a bundled `omp` entry may remain present and is not modified by this plugin.
 

package/SUPPORT.md

@@ -16,7 +16,7 @@ Do not put credentials, private repository paths, session transcripts, or unreda
 
 ## Supported versions
 
-- Paseo: `^0.8.0` on both the daemon and every app loading the client entry.
+- Paseo: `>=0.8.0 <0.10.0` on both the daemon and every app loading the client entry. The pinned SDK and controlled canary use `0.9.0-beta.1`; 0.8.x remains the compatibility line.
 - OMP: `18.1.15` is the oldest release in the required real-binary regression job. The hard runtime contract is `rpc-ui` protocol v2, not the version string alone.
 - Plugin release channel: alpha. Backward compatibility is best effort until stable `0.1.0`; every known migration requirement must be stated in the release notes.
 - Typed approvals: optional. When both peers negotiate `typedToolApprovals: 1`, the plugin uses typed tool permissions. Otherwise it retains the bounded generic extension-question flow.
@@ -26,15 +26,17 @@ Do not put credentials, private repository paths, session transcripts, or unreda
 - `omp` and `omp-plugin` are independent provider identities. Agents, provider settings, and persisted handles do not migrate automatically between them.
 - Do not open the same underlying OMP session concurrently through both providers. Reservation tracking is provider-local and cannot coordinate ownership with Paseo's bundled adapter.
 - OMP 18.1.15 does not advertise typed tool approvals. The plugin uses its bounded generic permission fallback until both peers negotiate `typedToolApprovals: 1`.
-- OMP releases that do not correlate ordinary `prompt` requests with their terminal `agent_end` remain limited on ownership-sensitive later turns: the immediate response may omit `agentInvoked: true`, legacy `prompt_result` reports only local-only `false` results, and live user messages may omit their persisted `entryId`. Branch history can correlate user timeline entries, but even a new exact-text entry cannot authenticate a terminal event or its success/error outcome. The plugin accepts a later-turn terminal carrying the matching RPC `requestId`; without that identity, it rejects the event and fails the turn closed after the ownership deadline. An unavailable state or history lookup cannot bypass that guard.
-- Timeline correlation rebuilds an invalid watermark from a complete pre-prompt `get_branch_messages` snapshot, not replayed model context or an evicting identity cache. Snapshots are limited to 1,024 entries and 4 MiB; duplicate IDs, surplus exact-text matches, unavailable history, and exceeded bounds leave users uncorrelated rather than claiming an old entry. Repeated accepted prompts within a turn consume matching branch occurrences in order. User entries never grant terminal ownership to a later turn.
+- OMP releases through 18.2.x may omit the originating prompt `requestId` from `agent_end`. A matching ID is authoritative when present, and a mismatch is discarded before changing turn state. For an unkeyed later-turn terminal, the plugin uses a bounded ordered fallback: the accepted prompt must not be known local-only, a fresh native user entry must correlate to it, current-turn assistant activity must follow that entry, OMP must report idle and non-compacting, and no permission, tool, steer, or child-session work may remain. Ambiguous candidates are ignored while OMP is active; once OMP is confirmed idle, unresolved ambiguity fails only the Paseo turn and keeps the OMP process available. This deliberately accepts a residual same-agent risk: a sufficiently delayed unkeyed event with indistinguishable ordered evidence can still be misattributed. It is safer than accepting any idle `agent_end`, while remaining usable with released OMP builds that cannot provide request identity.
+- Timeline correlation rebuilds an invalid watermark from a complete pre-prompt `get_branch_messages` snapshot, not replayed model context or an evicting identity cache. Snapshots are limited to 1,024 entries and 4 MiB; duplicate IDs, surplus exact-text matches, unavailable history, and exceeded bounds leave users uncorrelated rather than claiming an old entry. Repeated accepted prompts within a turn consume matching branch occurrences in order.
 - Configured MCP servers are supported and bridged into OMP. Paseo's own orchestration tools appear under their native names when the daemon's **Enable Paseo tools** / `daemon.mcp.injectIntoAgents` setting is enabled; other MCP servers remain namespaced. Exact Paseo `toolPolicy` preapproval cannot be represented by OMP `set_host_tools` and therefore fails session startup closed. `disallowedTools` applies only to recognized native OMP built-ins; unknown names are rejected and MCP tools are not silently filtered through it.
 - `qwen2.5:0.5b` is provided only for free exploratory inference. It may ignore exact-output instructions and is not a deterministic protocol or tool-use oracle; use `canary-mock/Deterministic Canary` for assertions.
 - The deterministic mock does not implement OMP's compaction-summary contract, so `/compact` reports `OMP compaction failed` in the canary; compaction remains covered by protocol fixtures.
 - `/handoff` reports `OMP command failed` in the controlled canary even with deterministic role models configured; treat handoff as unavailable there until its native prerequisite is isolated.
 - On official Paseo 0.8.0, requesting a live approval-mode change that the plugin rejects can trigger the daemon's unhandled-rejection restart path. Create a new `full`, `write`, or `ask` session instead of changing mode in place.
+- Paseo 0.8 clients do not expose the platform-owned plugin URL opener and transform timeline items after Overview grouping. Use a 0.9.0-beta.1 app for external documentation/device-authorization actions and for reliable image-card transformation of every source tool call.
 - Native Fast mode and a first-class plan mode are not exposed. `/handoff` is implemented but is not reproducible in the controlled canary without its native OMP workflow prerequisites.
 - Terminal-started OMP sessions are discoverable and importable but are not registered automatically through a terminal hook.
+- Paseo clients do not own OMP sessions. Mobile or desktop disconnects remain subject to Paseo's reconnect grace while the daemon-owned provider and OMP child continue independently; reconnecting can reveal an existing turn but does not transfer or sever runtime ownership.
 - OMP tool output reaching RPC stdout is strictly parsed and bounded, but channel purity ultimately depends on OMP keeping non-protocol output off stdout.
 
 The deduplicated comparison with every known OMP report in `getpaseo/paseo` is maintained in [docs/core-provider-issue-audit.md](docs/core-provider-issue-audit.md).

package/TESTING.md

@@ -1,6 +1,6 @@
 # OMP provider parity audit
 
-Validated against the Paseo plugin SDK versions pinned in `package.json`, official Paseo Docker image `0.8.0@sha256:5518da7cdd35f132e8a944c35e509c677a90a8f3ec8a78df98f7fb5fd5e2c6c3`, and the real OMP compatibility matrix: high-use historical releases 17.2.15, 17.3.4, 18.0.11, and 18.1.10; minimum supported release 18.1.15; latest published 18.1 patch 18.1.22; and current release 18.2.0.
+Validated against the Paseo plugin SDK versions pinned in `package.json` and the real OMP compatibility matrix: high-use historical releases 17.2.15, 17.3.4, 18.0.11, and 18.1.10; minimum supported release 18.1.15; latest published 18.1 patch 18.1.22; and current release 18.2.0. Validation against official Paseo Docker image `0.9.0-beta.1@sha256:f75a0eb3547ad3cc6bbdeaa7277d2d50eb4d06a9dd669d480371d7adf1c911b5` is partial as recorded below.
 
 Classifications:
 
@@ -32,7 +32,7 @@ Classifications:
 | Image prompts | **Equivalent** | Valid native image models receive image blocks; text-only models receive private content-addressed local files with an aggregate cap and turn/session/failure cleanup. The file path is valid because the direct provider and OMP child share the daemon host. |
 | Structured attachments | **Equivalent** | Forge change requests/issues, legacy GitHub forms, text, reviews, and uploaded files render to bounded OMP prompt text; regression in `tests/provider.test.ts`. |
 | Optimistic message correlation | **Equivalent** | Native entry lookup, repeated-text occurrence correlation, steering correlation, replay-boundary dedupe, and exactly-one `session.prompt_result` regressions. Bounded branch snapshots rebuild incomplete or evicted replay watermarks; duplicate IDs, surplus matching entries, unavailable snapshots, and count/byte overflow retain local user-message fallback instead of claiming an old entry. |
-| Terminal ownership on later turns | **Version-gated** | A new exact-text branch entry proves user-message persistence, not ownership of an unkeyed `agent_end`. The plugin accepts a later-turn terminal only when it carries the originating prompt's RPC `requestId`. Older OMP releases remain fail-closed after the ownership deadline. `tests/provider.test.ts` covers matching and mismatched request IDs, stale ends before and after new entries, repeated prompts, evidence arriving during an older terminal check, and unavailable or hung history. |
+| Terminal correlation on later turns | **Equivalent with legacy fallback** | A matching `agent_end.requestId` is authoritative and a mismatch is discarded before turn state changes. Released OMP builds that omit the field use ordered evidence from the accepted prompt: a fresh branch-correlated native user entry, later current-turn assistant activity, an idle non-compacting runtime, and no conflicting permission, tool, steer, or child-session work. `prompt_result.agentInvoked: false` remains local-only. Active ambiguous terminals are ignored; confirmed-idle ambiguity fails only the Paseo turn without killing the OMP process. Tests cover three sequential legacy prompts, stale terminals before evidence and while active, repeated text, local-only results, keyed mismatch/match, and degraded state/history. The remaining risk is same-agent misattribution when a delayed unkeyed event is indistinguishable from this ordered evidence. |
 | Streaming assistant text | **Equivalent** | `OmpTimelineProjector` publishes stable complete snapshots with frame coalescing and bounded retained bytes. |
 | Streaming reasoning | **Equivalent** | Indexed thinking blocks map to stable `reasoning` items and share stream bounds. |
 | `contentIndex` ordering | **Equivalent** | Stable 0→1→0 updates, sparse-index rejection, and 64-block bounds are tested in `tests/provider.test.ts`. |
@@ -103,9 +103,9 @@ npm run test:integration:canary
 
 Set `PASEO_CANARY_OMP_VERSION` to exercise another pinned release. The local runner knows the SHA-256 values for every version in the compatibility matrix; an unlisted version requires explicit `PASEO_CANARY_OMP_SHA256_AMD64` and `PASEO_CANARY_OMP_SHA256_ARM64` values. It allocates isolated loopback ports, builds a version-specific image, waits for both services to become healthy, runs the deterministic provider scenarios, prints container logs on failure, and always removes its containers, volumes, and image namespace.
 
-The Linux real-OMP CI matrix downloads checksummed `omp-linux-x64` assets for OMP 17.2.15, 17.3.4, 18.0.11, 18.1.10, 18.1.15, 18.1.22, and 18.2.0, verifies each binary's pinned GitHub release SHA-256, and runs `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`. The historical entries are the four pre-floor releases with more than 4,000 downloads shown by npm for the seven days ending 2026-09-15; they are compatibility regression probes, not a support commitment. The remaining entries cover the supported floor, newest patch in that minor line, and current release. The test uses the real OMP binary and a local deterministic OpenAI-compatible model endpoint, so catalog, text-plus-Bash, and oversized-image execution are mandatory without repository secrets.
+The Linux real-OMP CI matrix downloads checksummed `omp-linux-x64` assets for OMP 17.2.15, 17.3.4, 18.0.11, 18.1.10, 18.1.15, 18.1.22, and 18.2.0, verifies each binary's pinned GitHub release SHA-256, and runs `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`. The historical entries are the four pre-floor releases with more than 4,000 downloads shown by npm for the seven days ending 2026-09-15; they are compatibility regression probes, not a support commitment. The remaining entries cover the supported floor, newest patch in that minor line, and current release. The test uses the real OMP binary and a local deterministic OpenAI-compatible model endpoint, including three sequential prompts on one native session, a Bash tool, and oversized-image transport.
 
-The controlled canary in `canary/compose.yml` builds this plugin into that official Paseo image and installs checksummed OMP binaries for `amd64` and `arm64`. `canary/smoke.ts` passed catalog/mode discovery, text and image prompts, Bash, a configured stdio MCP tool, permission allow/deny/cancel, steering, interruption, session listing/import/resume, subagents, conversation rewind followed by another turn, Hub process visibility, usage, and every plugin RPC. Browser verification loaded the global OMP health/configuration surface and the agent-scoped Hub, Memory, and Sessions controls. The default mock returned `CANARY_MOCK_OK`, `CANARY_TOOL_OK`, and `CANARY_MCP_OK`; the optional Ollama profile pulled `qwen2.5:0.5b` and completed turns without paid credentials. The harness records the canary-only `/compact` and `/handoff` failures instead of masking them.
+The controlled canary in `canary/compose.yml` successfully built the plugin into that official Paseo image, started the daemon, loaded `paseo-omp`, and completed runtime health, catalog/mode discovery, initial text, model switching, `autocompact`, `follow-up`, and the documented compact/handoff error collection. It then failed on the first Bash scenario because the later turn ended without request-correlated terminal ownership: `OMP terminal ownership could not be confirmed`. The subsequent image, MCP, permission, steering, interruption, persistence, subagent, Hub, usage, rewind, browser, and optional Ollama scenarios were not reached and remain unverified on Paseo 0.9.0-beta.1.
 
 ## OMP RPC compatibility intake
 
@@ -142,9 +142,9 @@ The go/no-go criteria, manual acceptance boundary, and alpha limitation list are
 - `npm test -- tests/provider-conformance.test.ts`: host-boundary conformance coverage includes `prompt.command`, `session.configure`, typed and fallback permission allow/deny/cancel paths, registry-driven reload/removal, verified stubborn-descendant cleanup, and sequential turns plus interrupt races with post-turn barriers.
 - `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`: the installed matrix version's catalog and hermetic real-binary text/Bash and oversized-image scenarios run against a local deterministic model.
 - `npm run test:coverage`: Vitest enforces aggregate 85% function and 89% line coverage over loaded source modules. Generated `dist/**` trees are excluded.
-- `npm run test:integration:install`: a packed npm package retains required production dependencies and bundles successfully; a fresh Git-style checkout installs with lifecycle scripts disabled, typechecks, and loads the server contribution.
+- `npm run test:integration:install`: npm package acquisition retains required production dependencies, and a fresh Git-style checkout runs frozen production-only preparation with lifecycle scripts disabled. Both installed trees resolve runtime dependencies, compile the client and server entries with Paseo's host compiler, and load the server contribution.
 - `npm run test:integration:docker`: verifies the host/container ownership boundary.
 - `npm run test:integration:wsl`: locally skips when `wsl.exe` is unavailable; Windows CI sets `PASEO_OMP_REQUIRE_WSL=1`, so this boundary remains required there.
-- `docker compose -f canary/compose.yml`: official Paseo 0.8.0, deterministic mock, Tailscale-bound web UI, and optional Ollama `qwen2.5:0.5b` passed end-to-end.
+- `docker compose -f canary/compose.yml`: official Paseo 0.9.0-beta.1 image build, daemon startup, plugin load, and early deterministic scenarios passed; the smoke stopped at the first later-turn Bash scenario with `OMP terminal ownership could not be confirmed`, so the remaining scenarios are unverified.
 - `zizmor .github/workflows`: no findings (offline audit; six repository-wide suppressions remain).
 - Release Please 17.1.2 `config.json` and `manifest.json` schema validation: passed for `release-please-config.json` and `.release-please-manifest.json`.

package/client/external-url.ts

@@ -0,0 +1,15 @@
+import * as paseoClient from "@getpaseo/plugin/client";
+import { Linking } from "react-native";
+import { selectExternalUrlOpener, validatedHttpUrl } from "../shared/external-url";
+
+const paseoOpenExternalUrl =
+  "openExternalUrl" in paseoClient && typeof paseoClient.openExternalUrl === "function"
+    ? paseoClient.openExternalUrl
+    : undefined;
+const openExternalUrl = selectExternalUrlOpener(paseoOpenExternalUrl, (url) =>
+  Linking.openURL(url),
+);
+
+export function openOmpExternalUrl(url: string): Promise<void> {
+  return openExternalUrl(validatedHttpUrl(url));
+}

package/client/mcp-authorization.tsx

@@ -1,11 +1,12 @@
 import { type PluginTimelineItemProps, useRpc } from "@getpaseo/plugin/client";
 import { Icon } from "@getpaseo/plugin/client/react-native";
 import { useMemo, useState } from "react";
-import { Linking, Pressable, Text, View } from "react-native";
+import { Pressable, Text, View } from "react-native";
 import {
   type OmpMcpAuthorizationTimeline,
   openOmpMcpAuthorizationInPaseoBrowser,
 } from "../shared/mcp";
+import { openOmpExternalUrl } from "./external-url";
 
 function browserAuthorizationError(error: unknown): string {
   const detail = error instanceof Error ? error.message : String(error);
@@ -98,7 +99,7 @@ export function OmpMcpAuthorizationCard({
     setError(null);
     setMessage(null);
     try {
-      await Linking.openURL(item.data.url);
+      await openOmpExternalUrl(item.data.url);
     } catch {
       setError("Could not open the authorization URL. Copy the URL below into a browser.");
     } finally {

package/client/omp-config-surface.tsx

@@ -10,7 +10,7 @@ import { useIsMutating, useMutation, useQuery, useQueryClient } from "@tanstack/
 import type { ReactNode } from "react";
 import { useCallback, useMemo, useState } from "react";
 import type { TextStyle, ViewStyle } from "react-native";
-import { Linking, Pressable, ScrollView, Switch, Text, View } from "react-native";
+import { Pressable, ScrollView, Switch, Text, View } from "react-native";
 import type { ComposerPillSettings } from "../shared/composer-pill-settings";
 import { listOmpConfig, type OmpConfig } from "../shared/omp-config";
 import {
@@ -26,6 +26,7 @@ import {
 import { type OmpStore, storeLabel } from "../shared/omp-store";
 import { getOmpProviderHealth, type OmpProviderHealth } from "../shared/provider-diagnostics";
 import { ComposerPillSettingsSection } from "./composer-pill-settings";
+import { openOmpExternalUrl } from "./external-url";
 import {
   documentationForSettingCategory,
   documentationForSettingPath,
@@ -1072,7 +1073,7 @@ function OmpConfigContent({
   const openDocumentation = useCallback(async (link: OmpDocumentationLink) => {
     setDocumentationError(null);
     try {
-      await Linking.openURL(link.url);
+      await openOmpExternalUrl(link.url);
     } catch {
       setDocumentationError(`Could not open ${link.label.toLocaleLowerCase()}.`);
     }

package/client/paseo-types.ts

@@ -0,0 +1,9 @@
+import type { PluginClientContext } from "@getpaseo/plugin/client";
+
+type AsyncResult<Callable> = Callable extends (...args: never[]) => Promise<infer Result>
+  ? Result
+  : never;
+
+export type PaseoApi = PluginClientContext["paseo"];
+export type PaseoAgentListResult = AsyncResult<PaseoApi["agents"]["list"]>;
+export type PaseoProviderSnapshotResult = AsyncResult<PaseoApi["providers"]["snapshot"]>;

package/client/provider-diagnostics-state.ts

@@ -1,4 +1,3 @@
-import type { PaseoApi, PaseoProviderSnapshotResult } from "@getpaseo/client";
 import type {
   OmpLspDiagnostics,
   OmpMcpDiagnostics,
@@ -8,8 +7,8 @@ import type {
   OmpVersionStatus,
   PathState,
 } from "../shared/provider-diagnostics";
-
 import { isOmpProvider } from "./omp-store-state";
+import type { PaseoApi, PaseoProviderSnapshotResult } from "./paseo-types";
 
 export type ProviderHealthTone = "ok" | "warning" | "danger" | "muted";
 export const OMP_PROVIDER_IDS = ["omp", "omp-plugin"] as const;

package/docs/alpha-release-checklist.md

@@ -7,7 +7,7 @@ This checklist prepares `paseo-omp-v0.1.0-alpha.1`. It does not authorize public
 - [ ] Release Please proposes `0.1.0-alpha.1` from manifest version `0.0.0`.
 - [ ] Package and tag names are `@omercnet/paseo-omp` and `paseo-omp-v0.1.0-alpha.1`.
 - [ ] Provider identity remains `omp-plugin`; bundled `omp` remains independent and enabled or disabled by the user.
-- [ ] Paseo requirement remains an official released range, currently `^0.8.0`.
+- [ ] Paseo requirement remains the reviewed dual-version range, currently `>=0.8.0 <0.10.0`.
 - [ ] Minimum tested OMP version, checksum, CI job, README, SUPPORT, and TESTING agree.
 
 ## Required gates

package/docs/core-provider-issue-audit.md

@@ -1,6 +1,6 @@
 # Core OMP provider issue audit
 
-This audit compares reports in `getpaseo/paseo` with the community `omp-plugin` provider. It was refreshed on 2026-09-12 from GitHub issue titles and bodies containing `OMP`, `oh-my-pi`, or `rpc-ui`, OMP-related pull requests, and materially equivalent Pi/RPC reports. GitHub Discussions were also inspected; the repository had no OMP-related discussion.
+This audit compares reports in `getpaseo/paseo` with the community `omp-plugin` provider. It was refreshed on 2026-09-18 from GitHub issue titles and bodies containing `OMP`, `oh-my-pi`, or `rpc-ui`, OMP-related pull requests, and materially equivalent Pi/RPC reports. GitHub Discussions were also inspected; the repository had no OMP-related discussion.
 
 Issue and pull-request pairs are consolidated by root cause. A closed upstream issue does not prove the plugin implements the behavior, and an open upstream issue does not imply the plugin is affected.
 
@@ -20,6 +20,7 @@ Status meanings:
 | [#2260](https://github.com/getpaseo/paseo/issues/2260), [PR #2261](https://github.com/getpaseo/paseo/pull/2261) | **Verified** | Incomplete or compacted `agent_end` frames use complete streamed `message_end` evidence or bounded history correlated by entry ID, with idle state confirmed before and after retrieval. Success, failure, native cancellation, and concurrent interrupts are preserved; missing, unavailable, non-correlatable, or conflicting terminal evidence fails closed with content-free count diagnostics. |
 | [#2281](https://github.com/getpaseo/paseo/issues/2281), [PR #2282](https://github.com/getpaseo/paseo/pull/2282) | **Verified** | Local-only prompt results and structured commands have explicit terminal ownership. |
 | [#3654](https://github.com/getpaseo/paseo/issues/3654), [#3998](https://github.com/getpaseo/paseo/issues/3998), [PR #3667](https://github.com/getpaseo/paseo/pull/3667) | **Verified** | Post-`agent_end` state reconciliation is bounded. Stale or unavailable `get_state` cannot leave a turn running forever. |
+| Upstream OMP [PR #12331](https://github.com/can1357/oh-my-pi/pull/12331) and released OMP 18.2.x unkeyed `agent_end` frames | **Mitigated** | Request-keyed terminals use exact matching. For released binaries that omit the key, the plugin accepts only ordered current-prompt evidence: a fresh branch-correlated user entry followed by assistant activity, confirmed native idle/non-compacting state, and no active permission, tool, steer, or child work. Active or pre-evidence stale candidates are ignored. Confirmed-idle ambiguity fails only the Paseo turn, not the OMP runtime. The remaining same-agent stale-event misattribution risk is explicit and bounded; waiting for the upstream protocol fix would make every later turn unusable on published releases. Client reconnects, including mobile reconnect grace, are host transport behavior and do not own the daemon-managed provider session. |
 | [#3999](https://github.com/getpaseo/paseo/issues/3999), [#4000](https://github.com/getpaseo/paseo/issues/4000), [#4039](https://github.com/getpaseo/paseo/issues/4039), [PR #3772](https://github.com/getpaseo/paseo/pull/3772), [PR #4217](https://github.com/getpaseo/paseo/pull/4217) | **Verified** | `prompt.steer` is negotiated and implemented with expected-turn checks, acknowledgement ordering, duplicate correlation, and interrupt/terminal race coverage. |
 | Shared RPC cancellation [#3540](https://github.com/getpaseo/paseo/issues/3540), Pi [#3749](https://github.com/getpaseo/paseo/issues/3749) | **Verified in provider** | Native abort, exactly-one terminal event, permission cleanup, descendant cleanup, and uncertain-cleanup quarantine are tested. UI keyboard delivery remains host-owned. |
 | [#3218](https://github.com/getpaseo/paseo/issues/3218) | **Verified at provider boundary** | Session close owns and awaits OMP process cleanup. Whether every archive UI route invokes provider close is a host concern. |

package/docs/installation.md

@@ -4,29 +4,53 @@ Paseo plugins are trusted, unsandboxed code. Review this plugin and its producti
 
 ## Requirements
 
-- Paseo daemon and apps: `^0.8.0`
+- Paseo daemon and apps: `>=0.8.0 <0.10.0`; `0.9.0-beta.1` is recommended
 - OMP: `18.1.15` or newer is the supported floor
 - OMP RPC: protocol v2 must negotiate successfully
 
 The first public build is an alpha. Alpha releases are compatibility previews and may require deleting and re-importing agents created by an earlier preview.
 
-## Install a release
+## Install or update from npm on Paseo 0.9
 
-Install an exact published version from npm:
+Paseo 0.9.0-beta.1 can acquire the published package and its production dependencies directly from npm on the daemon host:
 
 ```bash
 paseo plugin install npm:@omercnet/paseo-omp@<version>
 paseo plugin ls paseo-omp
 ```
 
-Alternatively, install the matching reviewed Git tag:
+Check for the registry's current `latest` version and approve the proposed update, or select an exact version explicitly:
+
+```bash
+paseo plugin update paseo-omp
+paseo plugin update paseo-omp --version <new-version>
+```
+
+The daemon uses its own npm registry and authentication configuration. npm acquisition installs the artifact's production dependencies before preparation; because npm artifacts omit `package-lock.json`, the preparation helper leaves that tree unchanged. A Git checkout with the committed lockfile runs frozen `npm ci --omit=dev --ignore-scripts`. A failed download, preparation, compatibility check, or activation keeps the installed revision active. Paseo 0.8 does not support npm plugin sources; use a Git tag or local directory instead.
+
+## Install a Git release on Paseo 0.8 or 0.9
+
+Install the matching reviewed Git tag:
 
 ```bash
 paseo plugin add omercnet/paseo-plugins:paseo-omp --ref paseo-omp-v<version>
 paseo plugin ls paseo-omp
 ```
 
-A Git tag-pinned installation does not advance through `paseo plugin update`. To upgrade, record the current installation, then replace it with the new tag in one maintenance window:
+### Update a Git installation on Paseo 0.9
+
+An ordinary update reviews the remote repository's current default HEAD. To move directly to another reviewed tag or commit, select it explicitly:
+
+```bash
+paseo plugin update paseo-omp
+paseo plugin update paseo-omp --ref paseo-omp-v<new-version>
+```
+
+The install-time `--ref` does not constrain later updates. Paseo 0.9 stages and validates the selected revision before replacing the active installation, so plugin settings remain intact and a failed update leaves the previous revision running.
+
+### Update a tag-pinned Git installation on Paseo 0.8
+
+Paseo 0.8 does not provide the 0.9 non-destructive explicit-ref update flow. Record the current installation, then replace it with the new tag in one maintenance window:
 
 ```bash
 paseo plugin ls paseo-omp --json > paseo-omp-before-update.json
@@ -56,12 +80,10 @@ paseo plugin ls paseo-omp
 
 ## Track a branch
 
-Tracking `main` executes future dependency and plugin updates with the daemon user's privileges. Record the installed commit before each update:
+Tracking `main` executes future dependency and plugin updates with the daemon user's privileges:
 
 ```bash
 paseo plugin add omercnet/paseo-plugins:paseo-omp --ref main
-paseo plugin ls paseo-omp --json > paseo-omp-before-update.json
-paseo plugin update paseo-omp
 ```
 
-A failed Git build or incompatible update leaves the previous revision active. Remove and re-add the recorded commit to roll back.
+On Paseo 0.9, preview and approve the remote default HEAD with `paseo plugin update paseo-omp`, or select `main` explicitly with `paseo plugin update paseo-omp --ref main`. On Paseo 0.8, record the installed commit before its existing branch-update workflow. A failed build or compatibility check leaves the previous revision active.

package/index.client.tsx

@@ -1,4 +1,3 @@
-import type { PaseoAgentListResult, PaseoApi } from "@getpaseo/client";
 import { settingsRpc } from "@getpaseo/plugin";
 import type {
   PluginButtonRegistration,
@@ -19,6 +18,7 @@ import {
   isOmpProvider,
   ompStoreKey,
 } from "./client/omp-store-state";
+import type { PaseoAgentListResult, PaseoApi } from "./client/paseo-types";
 import { quotaProviderIcon } from "./client/provider-icon";
 import { OmpImageTimeline } from "./client/provider-image";
 import { QuotaPopover } from "./client/quota-popover";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omercnet/paseo-omp",
-  "version": "0.2.1-next.88.1",
+  "version": "0.2.1-next.90.1",
   "type": "module",
   "description": "Paseo integration for OMP, including its direct provider and workspace tooling.",
   "license": "MIT",
@@ -57,20 +57,19 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@getpaseo/protocol": "0.9.0-beta.1",
     "@modelcontextprotocol/sdk": "1.29.0",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.10",
-    "@getpaseo/cli": "0.8.0",
-    "@getpaseo/client": "0.8.0",
-    "@getpaseo/plugin": "0.8.0",
-    "@getpaseo/protocol": "0.8.0",
+    "@getpaseo/cli": "0.9.0-beta.1",
+    "@getpaseo/client": "0.9.0-beta.1",
+    "@getpaseo/plugin": "0.9.0-beta.1",
     "@tanstack/react-query": "^5.102.3",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.18",
     "@vitest/coverage-v8": "^5.0.0",
-    "esbuild": "^0.28.0",
     "react": "19.1.0",
     "react-native": "0.81.5",
     "tsx": "^4.20.6",

package/paseo-plugin.json

@@ -1,5 +1,5 @@
 {
   "id": "paseo-omp",
-  "requirements": { "paseo": "^0.8.0" },
+  "requirements": { "paseo": ">=0.8.0 <0.10.0" },
   "build": [["node", "scripts/prepare-dependencies.mjs"]]
 }

package/scripts/prepare-dependencies.mjs

@@ -8,10 +8,14 @@ const projectRoot = dirname(dirname(fileURLToPath(import.meta.url)));
 export function prepareDependencies(root = projectRoot, execute = execFileSync) {
   if (!existsSync(join(root, "package-lock.json"))) return false;
 
-  execute(process.platform === "win32" ? "npm.cmd" : "npm", ["ci", "--ignore-scripts"], {
-    cwd: root,
-    stdio: "inherit",
-  });
+  execute(
+    process.platform === "win32" ? "npm.cmd" : "npm",
+    ["ci", "--omit=dev", "--ignore-scripts"],
+    {
+      cwd: root,
+      stdio: "inherit",
+    },
+  );
   return true;
 }
 

package/server/provider/session.ts

@@ -228,6 +228,24 @@ type PendingUser = {
   fallbackOnFinish: boolean;
   bufferedEchoes: OmpMessage[];
 };
+type TerminalCorrelationEvidence = "fresh-native-user" | "current-assistant";
+
+type TerminalCorrelation = {
+  policy: "initial-turn" | "ordered-legacy" | "native-command";
+  evidence: Map<TerminalCorrelationEvidence, number>;
+};
+
+type TerminalCandidate = {
+  event: Extract<OmpRpcEvent, { type: "agent_end" }>;
+  arrivalSequence: number;
+  confidence:
+    | "keyed"
+    | "initial-turn"
+    | "ordered-legacy"
+    | "native-command"
+    | "interrupted"
+    | "ambiguous";
+};
 
 type ActiveTurn = {
   turnId: string;
@@ -245,10 +263,8 @@ type ActiveTurn = {
   awaitingPermissionEvidence: boolean;
   activitySequence: number;
   acknowledged: boolean;
-  terminalOwnershipEvidence: boolean;
-  terminalOwnershipRequired: boolean;
+  terminalCorrelation: TerminalCorrelation;
   replayingBufferedEvents: boolean;
-  bufferedTerminalOwnershipEvidence: boolean;
   agentInvoked?: boolean;
   nativeRequestId?: string;
   promptAcceptedEventIndex?: number;
@@ -263,14 +279,15 @@ type ActiveTurn = {
   agentEndRetryTimer?: unknown;
   agentEndDeadlineTimer?: unknown;
   agentEndCheck?: Promise<void>;
-  terminalOwnershipTimer?: unknown;
+  ambiguousTerminalTimer?: unknown;
   terminalizing: boolean;
   terminalization?: Promise<void>;
   terminalOutcome?: TurnOutcome;
   terminalWake?: VoidDeferred;
   steerReady: VoidDeferred;
   steersInFlight: number;
-  deferredAgentEnd?: Extract<OmpRpcEvent, { type: "agent_end" }>;
+  deferredAgentEnd?: TerminalCandidate;
+  activeToolCallIds: Set<string>;
   bufferedEvents: OmpRpcEvent[];
   pendingUsers: PendingUser[];
   userEchoes: OmpMessage[];
@@ -784,7 +801,7 @@ function createActiveTurn(
   clientMessageId: string,
   text: string,
   generation: number,
-  terminalOwnershipRequired: boolean,
+  terminalPolicy: TerminalCorrelation["policy"],
   manualCompaction = false,
 ): ActiveTurn {
   return {
@@ -809,11 +826,10 @@ function createActiveTurn(
     manualCompaction,
     activitySequence: 0,
     acknowledged: false,
-    terminalOwnershipEvidence: false,
+    terminalCorrelation: { policy: terminalPolicy, evidence: new Map() },
     replayingBufferedEvents: false,
-    bufferedTerminalOwnershipEvidence: false,
-    terminalOwnershipRequired,
     steersInFlight: 0,
+    activeToolCallIds: new Set(),
     steerReady: Promise.withResolvers<void>(),
     userCorrelationActive: false,
     userLookups: new Set(),
@@ -833,6 +849,35 @@ function createActiveTurn(
     ],
   };
 }
+function classifyTerminalCandidate(
+  turn: ActiveTurn,
+  event: Extract<OmpRpcEvent, { type: "agent_end" }>,
+  arrivalSequence = turn.activitySequence,
+): TerminalCandidate {
+  if (event.requestId !== undefined) return { event, confidence: "keyed", arrivalSequence };
+  if (turn.agentInvoked === false) return { event, confidence: "ambiguous", arrivalSequence };
+  if (turn.terminalCorrelation.policy === "initial-turn") {
+    return { event, confidence: "initial-turn", arrivalSequence };
+  }
+  const assistantSequence = turn.terminalCorrelation.evidence.get("current-assistant");
+  if (
+    turn.terminalCorrelation.policy === "native-command" &&
+    assistantSequence !== undefined &&
+    assistantSequence <= arrivalSequence
+  ) {
+    return { event, confidence: "native-command", arrivalSequence };
+  }
+  const userSequence = turn.terminalCorrelation.evidence.get("fresh-native-user");
+  if (
+    userSequence !== undefined &&
+    assistantSequence !== undefined &&
+    userSequence < assistantSequence &&
+    assistantSequence <= arrivalSequence
+  ) {
+    return { event, confidence: "ordered-legacy", arrivalSequence };
+  }
+  return { event, confidence: "ambiguous", arrivalSequence };
+}
 
 export class OmpProviderSession {
   readonly id: string;
@@ -1864,7 +1909,7 @@ export class OmpProviderSession {
       input.prompt.clientMessageId,
       payload.text,
       this.generation,
-      this.runtimeTurnCompleted,
+      this.runtimeTurnCompleted ? "ordered-legacy" : "initial-turn",
       slashCommandName(payload.text) === "compact",
     );
     this.activeTurn = turn;
@@ -1901,7 +1946,11 @@ export class OmpProviderSession {
         return;
       }
       const ownershipPending = turn.pendingUsers[0];
-      if (turn.terminalOwnershipRequired && !this.branchWatermarkValid && ownershipPending) {
+      if (
+        turn.terminalCorrelation.policy === "ordered-legacy" &&
+        !this.branchWatermarkValid &&
+        ownershipPending
+      ) {
         await this.refreshBranchEntries(turn, ownershipPending);
         if (
           this.closed ||
@@ -1939,13 +1988,10 @@ export class OmpProviderSession {
         0,
         turn.promptAcceptedEventIndex ?? bufferedEvents.length,
       );
-      for (const event of preAcceptanceEvents) this.handleTurnEvent(turn, event);
+      for (const event of preAcceptanceEvents) this.handleTurnEvent(turn, event, false);
       this.projector.acceptLiveTurn(turn.turnId);
       for (const event of bufferedEvents) this.handleTurnEvent(turn, event);
       turn.replayingBufferedEvents = false;
-      if (acknowledgement.agentInvoked === true && turn.bufferedTerminalOwnershipEvidence) {
-        this.markTerminalOwnershipEvidence(turn);
-      }
       if (
         acknowledgement.agentInvoked === false &&
         turn.agentInvoked !== true &&
@@ -2096,7 +2142,7 @@ export class OmpProviderSession {
     if (this.activeTurn) {
       throw new OmpPublicError("OMP already has an active turn; send this message as a steer");
     }
-    const turn = createActiveTurn(clientMessageId, text, this.generation, false);
+    const turn = createActiveTurn(clientMessageId, text, this.generation, "native-command");
     this.activeTurn = turn;
     try {
       await invoke();
@@ -2994,6 +3040,7 @@ export class OmpProviderSession {
         return;
       }
       turn.localOnlyDisabled = true;
+      this.cancelAmbiguousTerminal(turn);
       turn.deferredAgentEnd = undefined;
       this.acceptPendingUser(turn, pending);
       this.emit({
@@ -3145,7 +3192,11 @@ export class OmpProviderSession {
     this.handleTurnEvent(turn, event);
   }
 
-  private handleTurnEvent(turn: ActiveTurn, event: OmpRpcEvent): void {
+  private handleTurnEvent(
+    turn: ActiveTurn,
+    event: OmpRpcEvent,
+    correlatesToAcceptedPrompt = true,
+  ): void {
     if (
       turn.generation !== this.generation ||
       turn.terminal ||
@@ -3161,7 +3212,7 @@ export class OmpProviderSession {
     ) {
       return;
     }
-    if (event.type === "message_end") {
+    if (event.type === "message_end" && correlatesToAcceptedPrompt) {
       const entryId = nativeEntryId(event.message);
       if (!entryId || turn.streamedMessageEntryIds.length >= MAX_AGENT_END_CORRELATION_MESSAGES) {
         turn.streamedMessageIdentityComplete = false;
@@ -3187,15 +3238,19 @@ export class OmpProviderSession {
     if (event.type === "prompt_result") {
       if (!event.id || event.id !== turn.nativeRequestId) return;
       if (event.agentInvoked) {
+        // A request-keyed prompt result proves dispatch, but an unkeyed terminal still needs
+        // ordered native user and assistant evidence from this accepted prompt.
         this.markAgentEvidence(turn);
-        if (turn.replayingBufferedEvents) turn.bufferedTerminalOwnershipEvidence = true;
-        else this.markTerminalOwnershipEvidence(turn);
         return;
       }
       if (turn.localOnlyDisabled || turn.steersInFlight > 0) return;
       if (!turn.nativeActivity && !turn.awaitingPermissionEvidence) {
         turn.agentInvoked = false;
         turn.localOnlyEligible = true;
+        if (turn.deferredAgentEnd?.confidence === "ambiguous") {
+          turn.deferredAgentEnd = undefined;
+          this.cancelAmbiguousTerminal(turn);
+        }
         this.scheduleLocalOnlyCompletion(turn);
       }
       return;
@@ -3243,8 +3298,10 @@ export class OmpProviderSession {
       return;
     }
     if (event.type === "agent_end" && turn.manualCompactionPending) return;
-    if (event.type === "tool_execution_end" && event.toolName === "ask_user") {
-      this.pendingFreeformSelection = null;
+    if (event.type === "tool_execution_start") turn.activeToolCallIds.add(event.toolCallId);
+    if (event.type === "tool_execution_end") {
+      turn.activeToolCallIds.delete(event.toolCallId);
+      if (event.toolName === "ask_user") this.pendingFreeformSelection = null;
     }
     if (event.type === "tool_execution_start" || event.type === "tool_execution_end") {
       try {
@@ -3254,23 +3311,6 @@ export class OmpProviderSession {
         return;
       }
     }
-    if (isNativeTurnActivity(event)) {
-      turn.nativeActivity = true;
-      this.cancelLocalOnlyCompletion(turn);
-    }
-    if (event.type === "message_end" && event.message.role === "user") {
-      this.markAgentEvidence(turn);
-      this.projectUserEcho(turn, event.message);
-      return;
-    }
-    if (
-      (event.type === "message_start" ||
-        event.type === "message_update" ||
-        event.type === "message_end") &&
-      event.message.role === "assistant"
-    ) {
-      turn.awaitingPermissionEvidence = false;
-    }
     if (event.type === "agent_end") {
       if (event.isTerminal === false) {
         turn.completedMessageCount = 0;
@@ -3280,41 +3320,51 @@ export class OmpProviderSession {
         turn.lastCompletedAssistantEntryId = undefined;
         return;
       }
-      if (event.requestId !== undefined) this.markTerminalOwnershipEvidence(turn);
-      if (
-        !turn.interrupted &&
-        turn.terminalOwnershipRequired &&
-        !turn.terminalOwnershipEvidence &&
-        !(turn.replayingBufferedEvents && turn.bufferedTerminalOwnershipEvidence)
-      ) {
-        this.scheduleTerminalOwnershipTimeout(turn);
+      const candidate: TerminalCandidate = turn.interrupted
+        ? { event, confidence: "interrupted", arrivalSequence: turn.activitySequence }
+        : classifyTerminalCandidate(turn, event);
+      if (candidate.confidence === "ambiguous") {
+        this.deferAmbiguousTerminal(turn, candidate);
         return;
       }
-      const hasAssistantEvidence =
-        event.messages?.some((message) => message.role === "assistant") ?? false;
-      if (turn.awaitingPermissionEvidence && !hasAssistantEvidence) {
-        turn.deferredAgentEnd = event;
-        return;
-      }
-      if (hasAssistantEvidence) turn.awaitingPermissionEvidence = false;
-      if (turn.terminalizing) {
-        turn.deferredAgentEnd = event;
-        return;
-      }
-      if (turn.steersInFlight > 0) {
-        turn.deferredAgentEnd = event;
+      turn.nativeActivity = true;
+      this.cancelLocalOnlyCompletion(turn);
+      if (
+        (!turn.interrupted &&
+          candidate.confidence !== "keyed" &&
+          this.hasTerminalConflict(turn, false)) ||
+        turn.steersInFlight > 0 ||
+        turn.terminalizing
+      ) {
+        turn.deferredAgentEnd = candidate;
         return;
       }
-      this.beginTerminalization(turn, event);
+      this.beginTerminalization(turn, candidate);
       return;
     }
-    if (isNativeTurnActivity(event)) this.markAgentEvidence(turn);
+    if (isNativeTurnActivity(event)) {
+      turn.nativeActivity = true;
+      this.cancelLocalOnlyCompletion(turn);
+    }
     if (event.type === "message_end" && event.message.role === "user") {
       this.markAgentEvidence(turn);
       this.projectUserEcho(turn, event.message);
       return;
     }
+    if (
+      (event.type === "message_start" ||
+        event.type === "message_update" ||
+        event.type === "message_end") &&
+      event.message.role === "assistant"
+    ) {
+      turn.awaitingPermissionEvidence = false;
+      if (correlatesToAcceptedPrompt) {
+        turn.terminalCorrelation.evidence.set("current-assistant", turn.activitySequence + 1);
+      }
+    }
+    if (isNativeTurnActivity(event)) this.markAgentEvidence(turn);
     this.projector.project(event, turn.turnId);
+    if (event.type === "tool_execution_end") this.resumeDeferredAgentEnd();
   }
 
   private projectUserEcho(turn: ActiveTurn, message: OmpMessage): void {
@@ -3385,6 +3435,7 @@ export class OmpProviderSession {
         pending.bufferedEchoes.push(...turn.userEchoes.splice(0));
         return;
       }
+      const observedSequence = turn.activitySequence;
       let resolvedId = entryId ?? this.claimUnclaimedBranchEntry(turn, pending.text);
       if (!resolvedId && (await this.refreshBranchEntries(turn, pending))) {
         resolvedId = this.claimUnclaimedBranchEntry(turn, pending.text);
@@ -3400,7 +3451,7 @@ export class OmpProviderSession {
       turn.userEchoes.shift();
       if (!resolvedId) return;
       turn.pendingUsers.shift();
-      this.publishCorrelatedUser(turn, pending, resolvedId);
+      this.publishCorrelatedUser(turn, pending, resolvedId, observedSequence);
     }
   }
   private async refreshBranchEntries(turn: ActiveTurn, pending: PendingUser): Promise<boolean> {
@@ -4234,23 +4285,27 @@ export class OmpProviderSession {
     return this.activeTurn?.turnId === pending.turnId && !this.activeTurn.terminal;
   }
 
-  private reevaluateDeferredPermissionTerminal(): void {
-    const turn = this.activeTurn;
-    if (!turn?.deferredAgentEnd || turn.terminal || turn.terminalizing) return;
+  private hasTerminalConflict(turn: ActiveTurn, includeChildren = true): boolean {
     const ownsTurn = (pending: PendingPermission | PendingToolPermission) =>
       pending.turnId === turn.turnId;
-    if (
+    return (
+      turn.awaitingPermissionEvidence ||
       [...this.pendingPermissions.values()].some(ownsTurn) ||
       [...this.inFlightPermissions.values()].some(ownsTurn) ||
       [...this.pendingToolPermissions.values()].some(ownsTurn) ||
-      [...this.inFlightToolPermissions.values()].some(ownsTurn)
-    ) {
-      return;
-    }
-    const hasAssistantEvidence =
-      turn.deferredAgentEnd.messages?.some((message) => message.role === "assistant") ?? false;
-    if (!hasAssistantEvidence || turn.awaitingPermissionEvidence) return;
+      [...this.inFlightToolPermissions.values()].some(ownsTurn) ||
+      turn.activeToolCallIds.size > 0 ||
+      turn.steersInFlight > 0 ||
+      (includeChildren && Boolean(this.subsessions?.hasActiveChildren()))
+    );
+  }
+
+  private reevaluateDeferredPermissionTerminal(): void {
+    const turn = this.activeTurn;
+    if (!turn?.deferredAgentEnd || turn.terminal || turn.terminalizing) return;
+    if (this.hasTerminalConflict(turn)) return;
     const deferred = turn.deferredAgentEnd;
+    if (deferred.confidence === "ambiguous") return;
     turn.deferredAgentEnd = undefined;
     this.beginTerminalization(turn, deferred);
   }
@@ -4266,12 +4321,18 @@ export class OmpProviderSession {
     return this.slashCommands.has(commandName);
   }
 
-  private publishCorrelatedUser(turn: ActiveTurn, pending: PendingUser, entryId?: string): void {
+  private publishCorrelatedUser(
+    turn: ActiveTurn,
+    pending: PendingUser,
+    entryId: string | undefined,
+    observedSequence: number,
+  ): void {
     if (entryId) {
       if (this.emittedEntryIds.has(entryId)) return;
       this.seenEntryIds.add(entryId);
       this.emittedEntryIds.add(entryId);
-      if (!turn.terminalOwnershipRequired) this.markTerminalOwnershipEvidence(turn);
+      turn.terminalCorrelation.evidence.set("fresh-native-user", observedSequence);
+      this.refreshAmbiguousTerminal(turn);
       if (this.branchWatermarkValid && !this.branchEntryIds.has(entryId)) {
         if (this.branchEntryIds.size >= MAX_UNCLAIMED_BRANCH_ENTRIES)
           this.quarantineBranchEntries();
@@ -4291,12 +4352,7 @@ export class OmpProviderSession {
     turn.activitySequence += 1;
     turn.localOnlyEligible = false;
     this.cancelLocalOnlyCompletion(turn);
-    if (!turn.awaitingPermissionEvidence) turn.deferredAgentEnd = undefined;
-  }
-
-  private markTerminalOwnershipEvidence(turn: ActiveTurn): void {
-    turn.terminalOwnershipEvidence = true;
-    this.cancelTerminalOwnershipTimeout(turn);
+    this.refreshAmbiguousTerminal(turn);
   }
 
   private scheduleLocalOnlyCompletion(turn: ActiveTurn): void {
@@ -4322,32 +4378,68 @@ export class OmpProviderSession {
     turn.localOnlyTimer = undefined;
   }
 
-  private scheduleTerminalOwnershipTimeout(turn: ActiveTurn): void {
-    if (
-      turn.terminalOwnershipTimer !== undefined ||
-      turn.terminalOwnershipEvidence ||
-      (turn.agentInvoked === false && turn.localOnlyEligible)
-    ) {
+  private refreshAmbiguousTerminal(turn: ActiveTurn): void {
+    const candidate = turn.deferredAgentEnd;
+    if (candidate?.confidence !== "ambiguous") return;
+    const resolved = classifyTerminalCandidate(turn, candidate.event, candidate.arrivalSequence);
+    if (resolved.confidence !== "ambiguous") {
+      this.cancelAmbiguousTerminal(turn);
+      turn.deferredAgentEnd = undefined;
+      if (turn.terminalizing || this.hasTerminalConflict(turn, false)) {
+        turn.deferredAgentEnd = resolved;
+      } else {
+        this.beginTerminalization(turn, resolved);
+      }
       return;
     }
-    turn.terminalOwnershipTimer = this.scheduler.set(() => {
-      turn.terminalOwnershipTimer = undefined;
-      if (
-        this.closed ||
-        turn.terminal ||
-        this.activeTurn !== turn ||
-        turn.terminalOwnershipEvidence
-      ) {
-        return;
-      }
-      this.handleRuntimeFailure("OMP terminal ownership could not be confirmed");
+    if (turn.activitySequence > candidate.arrivalSequence) {
+      turn.deferredAgentEnd = undefined;
+      this.cancelAmbiguousTerminal(turn);
+    }
+  }
+
+  private deferAmbiguousTerminal(turn: ActiveTurn, candidate: TerminalCandidate): void {
+    if (turn.agentInvoked === false && turn.localOnlyEligible) return;
+    this.cancelAmbiguousTerminal(turn);
+    turn.deferredAgentEnd = candidate;
+    turn.ambiguousTerminalTimer = this.scheduler.set(() => {
+      turn.ambiguousTerminalTimer = undefined;
+      void this.settleAmbiguousTerminal(turn, candidate);
     }, AGENT_END_STATE_TIMEOUT_MS);
   }
 
-  private cancelTerminalOwnershipTimeout(turn: ActiveTurn): void {
-    if (turn.terminalOwnershipTimer === undefined) return;
-    this.scheduler.clear(turn.terminalOwnershipTimer);
-    turn.terminalOwnershipTimer = undefined;
+  private cancelAmbiguousTerminal(turn: ActiveTurn): void {
+    if (turn.ambiguousTerminalTimer === undefined) return;
+    this.scheduler.clear(turn.ambiguousTerminalTimer);
+    turn.ambiguousTerminalTimer = undefined;
+  }
+
+  private async settleAmbiguousTerminal(
+    turn: ActiveTurn,
+    candidate: TerminalCandidate,
+  ): Promise<void> {
+    if (
+      this.closed ||
+      turn.terminal ||
+      this.activeTurn !== turn ||
+      turn.deferredAgentEnd !== candidate
+    ) {
+      return;
+    }
+    await Promise.allSettled(turn.userLookups);
+    this.refreshAmbiguousTerminal(turn);
+    if (turn.terminal || this.activeTurn !== turn || turn.deferredAgentEnd !== candidate) return;
+    const state = await this.boundedTerminalState(turn, FINAL_USAGE_WAIT_MS);
+    if (turn.terminal || this.activeTurn !== turn || turn.deferredAgentEnd !== candidate) return;
+    if (!state) {
+      this.handleRuntimeFailure("OMP agent_end state could not be confirmed");
+      return;
+    }
+    turn.deferredAgentEnd = undefined;
+    if (state.isStreaming || state.isCompacting) return;
+    await this.finishTurn(turn, "failed", {
+      message: "OMP unkeyed agent_end could not be correlated to the current prompt",
+    });
   }
 
   private async completeLocalOnlyTurn(turn: ActiveTurn): Promise<void> {
@@ -4373,15 +4465,44 @@ export class OmpProviderSession {
     await this.finishTurn(turn, "completed", undefined, false, false, true);
   }
 
-  private beginTerminalization(
-    turn: ActiveTurn,
-    event: Extract<OmpRpcEvent, { type: "agent_end" }>,
-  ): void {
+  private resetAgentEndProbe(turn: ActiveTurn): void {
+    turn.agentEndPending = false;
+    turn.terminalizing = false;
+    if (turn.agentEndRetryTimer !== undefined) {
+      this.scheduler.clear(turn.agentEndRetryTimer);
+      turn.agentEndRetryTimer = undefined;
+    }
+    if (turn.agentEndDeadlineTimer !== undefined) {
+      this.scheduler.clear(turn.agentEndDeadlineTimer);
+      turn.agentEndDeadlineTimer = undefined;
+    }
+  }
+  private ignoreActiveTerminalCandidate(turn: ActiveTurn, candidate: TerminalCandidate): void {
+    const replacement =
+      turn.deferredAgentEnd && turn.deferredAgentEnd !== candidate
+        ? turn.deferredAgentEnd
+        : undefined;
+    this.resetAgentEndProbe(turn);
+    turn.deferredAgentEnd = replacement;
+    if (replacement && replacement.confidence !== "ambiguous") {
+      turn.deferredAgentEnd = undefined;
+      this.beginTerminalization(turn, replacement);
+      return;
+    }
+    this.pollUsage(turn);
+  }
+
+  private beginTerminalization(turn: ActiveTurn, candidate: TerminalCandidate): void {
     if (turn.terminal || turn.terminalizing || turn.agentEndPending || this.activeTurn !== turn) {
       return;
     }
-    if (!turn.interrupted && this.deferAgentEndForSubsessions(turn, event)) return;
+    if (!turn.interrupted && this.deferAgentEndForSubsessions(turn, candidate)) return;
     turn.agentEndPending = true;
+    if (turn.deferredAgentEnd?.confidence === "ambiguous") {
+      turn.deferredAgentEnd = undefined;
+    }
+    turn.terminalizing = true;
+    this.cancelAmbiguousTerminal(turn);
     turn.usageSampleFloor = this.usageSequence + 1;
     if (this.usageSample?.turn === turn && this.usageSample.sequence < turn.usageSampleFloor) {
       this.usageSample = null;
@@ -4391,21 +4512,21 @@ export class OmpProviderSession {
       turn.agentEndDeadlineTimer = undefined;
       if (!turn.agentEndPending || turn.terminal || this.activeTurn !== turn) return;
       if (
-        turn.userEchoObserved ||
-        (turn.terminalOwnershipRequired && !turn.terminalOwnershipEvidence)
+        candidate.confidence === "keyed" ||
+        (candidate.confidence === "initial-turn" && !turn.userEchoObserved)
       ) {
-        this.handleRuntimeFailure("OMP agent_end state could not be confirmed");
+        void this.completeAgentEnd(turn, candidate.event);
       } else {
-        void this.completeAgentEnd(turn, event);
+        this.handleRuntimeFailure("OMP agent_end state could not be confirmed");
       }
     }, AGENT_END_SETTLE_MS);
-    this.finishFromAgentEnd(turn, event);
+    this.finishFromAgentEnd(turn, candidate);
   }
 
   private resumeAfterFailedSteer(turn: ActiveTurn): void {
     if (turn.terminal || this.activeTurn !== turn || turn.steersInFlight > 0) return;
     const deferred = turn.deferredAgentEnd;
-    if (deferred) {
+    if (deferred && deferred.confidence !== "ambiguous" && !this.hasTerminalConflict(turn)) {
       turn.deferredAgentEnd = undefined;
       this.beginTerminalization(turn, deferred);
       return;
@@ -4414,13 +4535,11 @@ export class OmpProviderSession {
       this.scheduleLocalOnlyCompletion(turn);
     }
   }
-  private deferAgentEndForSubsessions(
-    turn: ActiveTurn,
-    event: Extract<OmpRpcEvent, { type: "agent_end" }>,
-  ): boolean {
+
+  private deferAgentEndForSubsessions(turn: ActiveTurn, candidate: TerminalCandidate): boolean {
     if (!this.subsessions?.hasActiveChildren()) return false;
     turn.terminalizing = false;
-    turn.deferredAgentEnd = event;
+    turn.deferredAgentEnd = candidate;
     void this.subsessions.reconcile(this.runtime).catch(() => {
       if (!turn.terminal && this.activeTurn === turn) {
         this.handleRuntimeFailure("OMP subagent reconciliation failed");
@@ -4431,31 +4550,22 @@ export class OmpProviderSession {
 
   private resumeDeferredAgentEnd(): void {
     const turn = this.activeTurn;
-    if (
-      !turn ||
-      turn.terminal ||
-      turn.terminalizing ||
-      turn.steersInFlight > 0 ||
-      this.subsessions?.hasActiveChildren()
-    ) {
+    if (!turn || turn.terminal || turn.terminalizing || this.hasTerminalConflict(turn)) {
       return;
     }
-    const event = turn.deferredAgentEnd;
-    if (!event) return;
+    const candidate = turn.deferredAgentEnd;
+    if (!candidate || candidate.confidence === "ambiguous") return;
     turn.deferredAgentEnd = undefined;
-    this.beginTerminalization(turn, event);
+    this.beginTerminalization(turn, candidate);
   }
 
-  private finishFromAgentEnd(
-    turn: ActiveTurn,
-    event: Extract<OmpRpcEvent, { type: "agent_end" }>,
-  ): void {
+  private finishFromAgentEnd(turn: ActiveTurn, candidate: TerminalCandidate): void {
     if (!turn.agentEndPending || turn.terminal) return;
     if (turn.agentEndCheck) {
-      turn.deferredAgentEnd = event;
+      turn.deferredAgentEnd = candidate;
       return;
     }
-    const check = this.checkAgentEndState(turn, event);
+    const check = this.checkAgentEndState(turn, candidate);
     turn.agentEndCheck = check;
     void check.finally(() => {
       if (turn.agentEndCheck !== check) return;
@@ -4467,13 +4577,7 @@ export class OmpProviderSession {
     });
   }
 
-  private async checkAgentEndState(
-    turn: ActiveTurn,
-    event: Extract<OmpRpcEvent, { type: "agent_end" }>,
-  ): Promise<void> {
-    // Evidence arriving during this check cannot authorize an older terminal frame.
-    const ownershipObserved =
-      turn.terminalOwnershipEvidence || turn.bufferedTerminalOwnershipEvidence;
+  private async checkAgentEndState(turn: ActiveTurn, candidate: TerminalCandidate): Promise<void> {
     await Promise.allSettled(turn.userLookups);
     if (!turn.agentEndPending || turn.terminal || this.activeTurn !== turn) return;
     while (turn.userEchoes.length > 0) {
@@ -4482,40 +4586,42 @@ export class OmpProviderSession {
       await Promise.allSettled(turn.userLookups);
       if (!turn.agentEndPending || turn.terminal || this.activeTurn !== turn) return;
     }
+    if (
+      !turn.interrupted &&
+      candidate.confidence !== "keyed" &&
+      this.hasTerminalConflict(turn, false)
+    ) {
+      this.resetAgentEndProbe(turn);
+      turn.deferredAgentEnd = candidate;
+      this.pollUsage(turn);
+      return;
+    }
     if (turn.interrupted) {
-      await this.completeAgentEnd(turn, event);
+      await this.completeAgentEnd(turn, candidate.event);
       return;
     }
     const state = await this.boundedTerminalState(turn, FINAL_USAGE_WAIT_MS);
     if (!turn.agentEndPending || turn.terminal || this.activeTurn !== turn) return;
     if (!turn.interrupted && this.subsessions?.hasActiveChildren()) {
-      turn.agentEndPending = false;
-      if (this.deferAgentEndForSubsessions(turn, event)) return;
+      this.resetAgentEndProbe(turn);
+      if (this.deferAgentEndForSubsessions(turn, candidate)) return;
+    }
+    if (
+      !turn.interrupted &&
+      candidate.confidence !== "keyed" &&
+      this.hasTerminalConflict(turn, false)
+    ) {
+      this.resetAgentEndProbe(turn);
+      turn.deferredAgentEnd = candidate;
+      this.pollUsage(turn);
+      return;
     }
     if (state) {
       if (state.isStreaming || state.isCompacting) {
-        if (!turn.terminalOwnershipEvidence && !turn.terminalOwnershipRequired) {
-          const message = "OMP agent_end arrived while the native runtime remained active";
-          this.invalidateRuntime(message);
-          await this.finishTurn(turn, "failed", { message }, true, true);
-          return;
-        }
-        turn.agentEndPending = false;
-        turn.terminalizing = false;
-        turn.deferredAgentEnd = undefined;
-        return;
-      }
-      if (
-        turn.terminalOwnershipRequired &&
-        (!ownershipObserved || !turn.terminalOwnershipEvidence)
-      ) {
-        turn.agentEndPending = false;
-        turn.terminalizing = false;
-        turn.deferredAgentEnd = undefined;
-        this.scheduleTerminalOwnershipTimeout(turn);
+        this.ignoreActiveTerminalCandidate(turn, candidate);
         return;
       }
-      await this.completeAgentEnd(turn, event, true);
+      await this.completeAgentEnd(turn, candidate.event, true);
       return;
     }
     if (turn.userEchoObserved) {
@@ -4525,7 +4631,7 @@ export class OmpProviderSession {
     if (turn.agentEndRetryTimer === undefined) {
       turn.agentEndRetryTimer = this.scheduler.set(() => {
         turn.agentEndRetryTimer = undefined;
-        this.finishFromAgentEnd(turn, event);
+        this.finishFromAgentEnd(turn, candidate);
       }, USAGE_POLL_MS);
     }
   }
@@ -4556,8 +4662,11 @@ export class OmpProviderSession {
         )
           return;
         if (!turn.interrupted && state && (state.isStreaming || state.isCompacting)) {
-          turn.agentEndPending = false;
-          turn.deferredAgentEnd = undefined;
+          this.ignoreActiveTerminalCandidate(turn, {
+            event,
+            arrivalSequence: turn.activitySequence,
+            confidence: event.requestId === undefined ? "ordered-legacy" : "keyed",
+          });
           return;
         }
         if (state && !state.isStreaming && !state.isCompacting) {
@@ -4623,6 +4732,7 @@ export class OmpProviderSession {
     turn.starting = false;
     turn.terminal = true;
     this.stopUsagePoll(turn);
+    this.cancelAmbiguousTerminal(turn);
     this.resolveTurnPermissions(turn.turnId);
     this.projector.finishTurn(turn.turnId);
     if (this.activeTurn === turn) this.activeTurn = null;
@@ -4677,7 +4787,7 @@ export class OmpProviderSession {
     turn.manualCompactionPending = false;
     turn.agentEndPending = false;
     this.cancelLocalOnlyCompletion(turn);
-    this.cancelTerminalOwnershipTimeout(turn);
+    this.cancelAmbiguousTerminal(turn);
     this.stopUsagePoll(turn);
     if (turn.manualCompactionDeadlineTimer !== undefined) {
       this.scheduler.clear(turn.manualCompactionDeadlineTimer);

package/shared/external-url.ts

@@ -0,0 +1,21 @@
+export type ExternalUrlOpener = (url: string) => Promise<void>;
+
+export function selectExternalUrlOpener(
+  paseoOpener: ExternalUrlOpener | undefined,
+  fallback: ExternalUrlOpener,
+): ExternalUrlOpener {
+  return paseoOpener ?? fallback;
+}
+
+export function validatedHttpUrl(value: string): string {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Only absolute HTTP(S) URLs are supported.");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("Only absolute HTTP(S) URLs are supported.");
+  }
+  return url.href;
+}