@omercnet/paseo-omp 0.2.1-next.90.1 → 0.3.0-next.100.1

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.3.0](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.2.1...paseo-omp-v0.3.0) (2026-09-18)
+
+
+### Features
+
+* **paseo-omp:** add first-class MCP management ([#64](https://github.com/omercnet/paseo-plugins/issues/64)) ([5a8fefa](https://github.com/omercnet/paseo-plugins/commit/5a8fefa9148e8d01f0461aa4a90619ec6ae2c2fa))
+* **paseo-omp:** add workspace-scoped OMP management ([#59](https://github.com/omercnet/paseo-plugins/issues/59)) ([2807aec](https://github.com/omercnet/paseo-plugins/commit/2807aec6217ed2d52f8b4666f0a41a688109f8f5))
+* **paseo-omp:** make composer pills configurable ([#76](https://github.com/omercnet/paseo-plugins/issues/76)) ([28e7501](https://github.com/omercnet/paseo-plugins/commit/28e75011a06a11cdc963187aa4106dfc21d561e6))
+* **release:** publish plugins to npm ([#80](https://github.com/omercnet/paseo-plugins/issues/80)) ([3c93048](https://github.com/omercnet/paseo-plugins/commit/3c93048cfefda97d8c2bc1631e3428fb64bdad09))
+
+
+### Bug Fixes
+
+* **paseo-omp:** advertise nested subsession capability ([#62](https://github.com/omercnet/paseo-plugins/issues/62)) ([fcb4e82](https://github.com/omercnet/paseo-plugins/commit/fcb4e8243e9559d70f26ac6945e2f3c0bf05d575))
+* **paseo-omp:** bound model catalogs and retain safe failure diagnostics ([#73](https://github.com/omercnet/paseo-plugins/issues/73)) ([e70afb7](https://github.com/omercnet/paseo-plugins/commit/e70afb72be782446e7ff585bad40940c7231bdc5))
+* **paseo-omp:** correlate terminal events by request ([#81](https://github.com/omercnet/paseo-plugins/issues/81)) ([41f756e](https://github.com/omercnet/paseo-plugins/commit/41f756e9bebf5cbc275e5cbd3657c37d45a18997))
+* **paseo-omp:** fail closed on unowned later-turn terminal events ([#69](https://github.com/omercnet/paseo-plugins/issues/69)) ([072cd09](https://github.com/omercnet/paseo-plugins/commit/072cd09e38e450376bcd3f4c7b5eae9a670b56b5))
+* **paseo-omp:** preserve prompt scheduling error fidelity ([#67](https://github.com/omercnet/paseo-plugins/issues/67)) ([1c6d549](https://github.com/omercnet/paseo-plugins/commit/1c6d549fddca48be8fd86b4dd2c5faea526c8ac0))
+* **paseo-omp:** reconcile incomplete terminal outcomes ([#68](https://github.com/omercnet/paseo-plugins/issues/68)) ([854f4e6](https://github.com/omercnet/paseo-plugins/commit/854f4e6daddf905c671bb39a94d06a2de0c6d51d))
+* **paseo-omp:** replay failed turns from native transcript ([#79](https://github.com/omercnet/paseo-plugins/issues/79)) ([4a13b77](https://github.com/omercnet/paseo-plugins/commit/4a13b778a9ba413b61fe0cc85878d3c333c161d2))
+* **paseo-omp:** scope providers and auxiliary state to named profiles ([#74](https://github.com/omercnet/paseo-plugins/issues/74)) ([b265ad3](https://github.com/omercnet/paseo-plugins/commit/b265ad317a47230ec76dba799197443664492729))
+* **paseo-omp:** settle concurrent startup races ([#70](https://github.com/omercnet/paseo-plugins/issues/70)) ([9d4e6ef](https://github.com/omercnet/paseo-plugins/commit/9d4e6efb26041f9c88ab4ed6c02a9526520b83e9))
+* **paseo-omp:** show immutable approval mode ([#66](https://github.com/omercnet/paseo-plugins/issues/66)) ([4c586dc](https://github.com/omercnet/paseo-plugins/commit/4c586dc7d012127ee7570077a0d12cc0d6415bd4))
+* **paseo-omp:** support Paseo 0.9 beta ([#103](https://github.com/omercnet/paseo-plugins/issues/103)) ([0444d52](https://github.com/omercnet/paseo-plugins/commit/0444d52078a52befa62bb52f44545f22ab10e8c7))
+* **paseo-omp:** support unkeyed terminal events ([#89](https://github.com/omercnet/paseo-plugins/issues/89)) ([a00a831](https://github.com/omercnet/paseo-plugins/commit/a00a83158993fdf648fc10e06f1d8f8ebc62fa6a))
+
 ## [0.2.1](https://github.com/omercnet/paseo-plugins/compare/paseo-omp-v0.2.0...paseo-omp-v0.2.1) (2026-09-15)
 
 

package/README.md

@@ -6,7 +6,7 @@ Community OMP integration for Paseo. The plugin registers the distinct `omp-plug
 
 ## Quick start
 
-Requirements: Paseo `>=0.8.0 <0.10.0`, OMP `18.1.15` or newer, and OMP RPC protocol v2. Paseo `0.9.0-beta.1` is recommended for npm-managed installation and the complete client integration.
+Requirements: Paseo `>=0.8.0 <0.10.0`, OMP `18.1.15` or newer, and OMP RPC protocol v2. Paseo `0.9.0-beta.1` or newer is required for nested provider-subagent ancestry and spawning-tool links, and is recommended for npm-managed installation and the complete client integration.
 
 ```bash
 paseo plugin install npm:@omercnet/paseo-omp@<version>
@@ -99,7 +99,7 @@ Existing agents whose provider is `omp` remain owned by the bundled provider. Ne
 
 OMP `18.1.15` is the oldest version tested end to end. The direct provider's hard compatibility gate is `rpc-ui` protocol v2: metadata-free legacy ready frames and v1-only runtimes are rejected before a provider session opens because they cannot support the advertised persistence and conversation-rewind capabilities. Typed tool approvals remain capability-gated and fall back as described above. For terminal completion, a matching `agent_end.requestId` is authoritative and mismatches are ignored before state changes. Released OMP 18.2.x builds that omit that field use an ordered fallback requiring a fresh correlated native user entry followed by current-turn assistant activity, an idle non-compacting runtime, and no conflicting permission, tool, steer, or child-session work. Ambiguous events while OMP is active are ignored; unresolved ambiguity after confirmed idle fails only the Paseo turn. This trades a bounded residual same-agent stale-event risk for compatibility with released OMP instead of terminating and lazily restarting the runtime after every later prompt. Paseo clients, including mobile clients inside reconnect grace, do not own or terminate the daemon-managed OMP session.
 
-Paseo 0.9.0-beta.1 is the canary target and provides npm-managed plugin sources, platform-owned external URL opening, and whole-item timeline transforms before Overview grouping. Paseo 0.8.x remains supported for provider operation and Git or directory installation; its clients do not provide the external URL opener and retain their older timeline presentation semantics.
+Paseo 0.9.0-beta.1 is the verified canary target and the first release that preserves nested provider-subagent ancestry and spawning-tool links. The required full Docker canary passes there with OMP 18.1.15 and 18.2.0. Paseo 0.9 also provides npm-managed plugin sources, platform-owned external URL opening, and whole-item timeline transforms before Overview grouping. Paseo 0.8.x remains supported for other provider operations and Git or directory installation; its clients do not provide the external URL opener, retain their older timeline presentation semantics, and flatten nested provider subagents.
 
 Install, update, disable, or remove `paseo-omp` independently of the bundled provider. Verify the provider snapshot contains `omp-plugin` after installation; a bundled `omp` entry may remain present and is not modified by this plugin.
 

package/SUPPORT.md

@@ -16,8 +16,8 @@ Do not put credentials, private repository paths, session transcripts, or unreda
 
 ## Supported versions
 
-- Paseo: `>=0.8.0 <0.10.0` on both the daemon and every app loading the client entry. The pinned SDK and controlled canary use `0.9.0-beta.1`; 0.8.x remains the compatibility line.
-- OMP: `18.1.15` is the oldest release in the required real-binary regression job. The hard runtime contract is `rpc-ui` protocol v2, not the version string alone.
+- Paseo: `>=0.8.0 <0.10.0` on both the daemon and every app loading the client entry. The pinned SDK and controlled canary use `0.9.0-beta.1`, the first release that preserves nested provider-subagent ancestry and spawning-tool links. Paseo 0.8.x remains supported for other provider operations.
+- OMP: `18.1.15` is the oldest supported release. The required full Docker canary passes with 18.1.15 and 18.2.0; the hard runtime contract remains `rpc-ui` protocol v2, not the version string alone.
 - Plugin release channel: alpha. Backward compatibility is best effort until stable `0.1.0`; every known migration requirement must be stated in the release notes.
 - Typed approvals: optional. When both peers negotiate `typedToolApprovals: 1`, the plugin uses typed tool permissions. Otherwise it retains the bounded generic extension-question flow.
 

package/TESTING.md

@@ -1,6 +1,6 @@
 # OMP provider parity audit
 
-Validated against the Paseo plugin SDK versions pinned in `package.json` and the real OMP compatibility matrix: high-use historical releases 17.2.15, 17.3.4, 18.0.11, and 18.1.10; minimum supported release 18.1.15; latest published 18.1 patch 18.1.22; and current release 18.2.0. Validation against official Paseo Docker image `0.9.0-beta.1@sha256:f75a0eb3547ad3cc6bbdeaa7277d2d50eb4d06a9dd669d480371d7adf1c911b5` is partial as recorded below.
+Validated against the Paseo plugin SDK versions pinned in `package.json` and the real OMP compatibility matrix: high-use historical releases 17.2.15, 17.3.4, 18.0.11, and 18.1.10; minimum supported release 18.1.15; latest published 18.1 patch 18.1.22; and current release 18.2.0. On 2026-09-18, the full controlled canary passed against OMP 18.1.15 and 18.2.0 on official Paseo image `0.9.0-beta.1@sha256:f75a0eb3547ad3cc6bbdeaa7277d2d50eb4d06a9dd669d480371d7adf1c911b5`.
 
 Classifications:
 
@@ -101,11 +101,11 @@ Run the full local provider integration canary with:
 npm run test:integration:canary
 ```
 
-Set `PASEO_CANARY_OMP_VERSION` to exercise another pinned release. The local runner knows the SHA-256 values for every version in the compatibility matrix; an unlisted version requires explicit `PASEO_CANARY_OMP_SHA256_AMD64` and `PASEO_CANARY_OMP_SHA256_ARM64` values. It allocates isolated loopback ports, builds a version-specific image, waits for both services to become healthy, runs the deterministic provider scenarios, prints container logs on failure, and always removes its containers, volumes, and image namespace.
+Set `PASEO_CANARY_OMP_VERSION` to exercise another pinned release. The local runner knows the SHA-256 values for every version in the compatibility matrix; an unlisted version requires explicit `PASEO_CANARY_OMP_SHA256_AMD64` and `PASEO_CANARY_OMP_SHA256_ARM64` values. It allocates isolated loopback ports, builds a version-specific image, waits for both services to become healthy, runs the deterministic provider scenarios, prints container logs on failure, and always removes its containers, volumes, and image namespace. CI runs this full canary for OMP 18.1.15 and 18.2.0 whenever `paseo-omp` changes; both matrix entries feed the required `CI sentinel` gate and must pass before the supported OMP floor changes.
 
 The Linux real-OMP CI matrix downloads checksummed `omp-linux-x64` assets for OMP 17.2.15, 17.3.4, 18.0.11, 18.1.10, 18.1.15, 18.1.22, and 18.2.0, verifies each binary's pinned GitHub release SHA-256, and runs `PASEO_OMP_REAL_E2E=1 PASEO_OMP_VERSION=<version> npm test -- tests/provider.real.e2e.test.ts`. The historical entries are the four pre-floor releases with more than 4,000 downloads shown by npm for the seven days ending 2026-09-15; they are compatibility regression probes, not a support commitment. The remaining entries cover the supported floor, newest patch in that minor line, and current release. The test uses the real OMP binary and a local deterministic OpenAI-compatible model endpoint, including three sequential prompts on one native session, a Bash tool, and oversized-image transport.
 
-The controlled canary in `canary/compose.yml` successfully built the plugin into that official Paseo image, started the daemon, loaded `paseo-omp`, and completed runtime health, catalog/mode discovery, initial text, model switching, `autocompact`, `follow-up`, and the documented compact/handoff error collection. It then failed on the first Bash scenario because the later turn ended without request-correlated terminal ownership: `OMP terminal ownership could not be confirmed`. The subsequent image, MCP, permission, steering, interruption, persistence, subagent, Hub, usage, rewind, browser, and optional Ollama scenarios were not reached and remain unverified on Paseo 0.9.0-beta.1.
+The controlled canary passed end to end with OMP 18.1.15 and 18.2.0 on 2026-09-18. In addition to runtime health, catalog, prompts, tools, MCP, permissions, steering, interruption, persistence, Hub, usage, rewind, and plugin RPC coverage, it verified that a direct child has `parentSubagentId: null` and the root task's `toolCallId`, a nested child has its direct parent's public subagent ID and the nested task's `toolCallId`, both children finish as `completed`, and both timelines remain independently fetchable without cross-contamination.
 
 ## OMP RPC compatibility intake
 
@@ -145,6 +145,6 @@ The go/no-go criteria, manual acceptance boundary, and alpha limitation list are
 - `npm run test:integration:install`: npm package acquisition retains required production dependencies, and a fresh Git-style checkout runs frozen production-only preparation with lifecycle scripts disabled. Both installed trees resolve runtime dependencies, compile the client and server entries with Paseo's host compiler, and load the server contribution.
 - `npm run test:integration:docker`: verifies the host/container ownership boundary.
 - `npm run test:integration:wsl`: locally skips when `wsl.exe` is unavailable; Windows CI sets `PASEO_OMP_REQUIRE_WSL=1`, so this boundary remains required there.
-- `docker compose -f canary/compose.yml`: official Paseo 0.9.0-beta.1 image build, daemon startup, plugin load, and early deterministic scenarios passed; the smoke stopped at the first later-turn Bash scenario with `OMP terminal ownership could not be confirmed`, so the remaining scenarios are unverified.
+- `npm run test:integration:canary`: passed against OMP 18.1.15 and 18.2.0 on official Paseo `0.9.0-beta.1`; direct and nested ancestry, spawning-tool links, terminal status, and independently addressable child timelines passed.
 - `zizmor .github/workflows`: no findings (offline audit; six repository-wide suppressions remain).
 - Release Please 17.1.2 `config.json` and `manifest.json` schema validation: passed for `release-please-config.json` and `.release-please-manifest.json`.

package/docs/installation.md

@@ -4,7 +4,7 @@ Paseo plugins are trusted, unsandboxed code. Review this plugin and its producti
 
 ## Requirements
 
-- Paseo daemon and apps: `>=0.8.0 <0.10.0`; `0.9.0-beta.1` is recommended
+- Paseo daemon and apps: `>=0.8.0 <0.10.0`; use `0.9.0-beta.1` or newer for nested provider-subagent ancestry and spawning-tool links
 - OMP: `18.1.15` or newer is the supported floor
 - OMP RPC: protocol v2 must negotiate successfully
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omercnet/paseo-omp",
-  "version": "0.2.1-next.90.1",
+  "version": "0.3.0-next.100.1",
   "type": "module",
   "description": "Paseo integration for OMP, including its direct provider and workspace tooling.",
   "license": "MIT",

package/server/provider/connection.ts

@@ -58,6 +58,7 @@ const MAX_CONNECTION_SESSIONS = 32;
 const MAX_ACTIVE_OPERATIONS = 128;
 const MAX_PROVIDER_INPUT_BYTES = 2 * 1024 * 1024;
 const MAX_NESTED_OPTION_BYTES = 256 * 1024;
+const MAX_ENV_ENTRIES = 256;
 const MAX_NATIVE_SESSION_RESERVATIONS = 256;
 
 function hasOwnEntries(value: unknown): boolean {
@@ -68,6 +69,19 @@ function hasOwnEntries(value: unknown): boolean {
   return false;
 }
 
+function providerOptionsExceedPreflightLimits(value: unknown): boolean {
+  if (
+    boundedJsonBytes(value, MAX_NESTED_OPTION_BYTES, MAX_ENV_ENTRIES) === Number.POSITIVE_INFINITY
+  ) {
+    return true;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const unrelatedOptions = Object.fromEntries(
+    Object.entries(value).filter(([key]) => key !== "env" && key !== "inheritEnv"),
+  );
+  return boundedJsonBytes(unrelatedOptions, MAX_NESTED_OPTION_BYTES) === Number.POSITIVE_INFINITY;
+}
+
 function preflightProviderInput(input: unknown): void {
   if (!input || typeof input !== "object") throw new OmpPublicError("Invalid provider request");
   const record = input as Record<string, unknown>;
@@ -82,7 +96,16 @@ function preflightProviderInput(input: unknown): void {
       throw new OmpPublicError("Session persistence input is too large");
     }
     const config = record.config as Record<string, unknown> | undefined;
-    for (const value of [config?.mcpServers, config?.providerOptions, config?.settings]) {
+    if (
+      (config?.env !== undefined &&
+        boundedJsonBytes(config.env, MAX_NESTED_OPTION_BYTES, MAX_ENV_ENTRIES) ===
+          Number.POSITIVE_INFINITY) ||
+      (config?.providerOptions !== undefined &&
+        providerOptionsExceedPreflightLimits(config.providerOptions))
+    ) {
+      throw new OmpPublicError("Session configuration is too large");
+    }
+    for (const value of [config?.mcpServers, config?.settings]) {
       if (
         value !== undefined &&
         boundedJsonBytes(value, MAX_NESTED_OPTION_BYTES) === Number.POSITIVE_INFINITY
@@ -109,13 +132,17 @@ function preflightProviderInput(input: unknown): void {
     }
   }
   if (record.type === "catalog" || record.type === "sessions") {
-    for (const value of [record.providerOptions, record.settings]) {
-      if (
-        value !== undefined &&
-        boundedJsonBytes(value, MAX_NESTED_OPTION_BYTES) === Number.POSITIVE_INFINITY
-      ) {
-        throw new OmpPublicError("Provider configuration is too large");
-      }
+    if (
+      record.providerOptions !== undefined &&
+      providerOptionsExceedPreflightLimits(record.providerOptions)
+    ) {
+      throw new OmpPublicError("Provider configuration is too large");
+    }
+    if (
+      record.settings !== undefined &&
+      boundedJsonBytes(record.settings, MAX_NESTED_OPTION_BYTES) === Number.POSITIVE_INFINITY
+    ) {
+      throw new OmpPublicError("Provider configuration is too large");
     }
   }
   if (record.type === "session.prompt") {

package/server/provider/host-tools.ts

@@ -3,6 +3,7 @@ import type {
   ProviderMcpServerConfig,
   ProviderSessionConfig,
 } from "@getpaseo/plugin/server/provider";
+import { isValidImagePayload } from "./image";
 import {
   type ConnectedMcpClient,
   type ConnectedMcpTool,
@@ -37,7 +38,13 @@ const MAX_HOST_TOOL_DESCRIPTION_BYTES = 64 * 1024;
 const MAX_HOST_TOOL_SCHEMA_BYTES = 256 * 1024;
 const MAX_HOST_TOOL_CATALOG_BYTES = 768 * 1024;
 const MAX_HOST_TOOL_RESULT_BYTES = 12 * 1024 * 1024;
+const MAX_HOST_TOOL_CONTENT_BLOCKS = 512;
+const MAX_HOST_TOOL_TEXT_BYTES = 1024 * 1024;
+const MAX_HOST_TOOL_IMAGE_DATA_BYTES = 8 * 1024 * 1024;
 const MAX_STRUCTURED_CONTENT_FALLBACK_BYTES = 1024 * 1024;
+const CONTENT_TRUNCATED_NOTICE = "[MCP result content truncated: exceeded size limits]";
+const DETAILS_OMITTED_NOTICE = "[MCP structured content omitted: exceeded size limits]";
+const RESULT_TRUNCATED_NOTICE = "[MCP content truncated; details omitted]";
 const MAX_PENDING_HOST_TOOL_CALLS = 64;
 const MAX_PENDING_HOST_TOOL_BYTES = 8 * 1024 * 1024;
 const DEFAULT_INITIALIZATION_TIMEOUT_MS = 20_000;
@@ -272,42 +279,171 @@ async function discoverMcpTools(
   throw new OmpPublicError("MCP server tool-list pagination exceeds the supported limit");
 }
 
-function normalizeResult(result: unknown): OmpHostToolResult["result"] {
-  if (
-    !result ||
-    typeof result !== "object" ||
+type HostToolContentBlock = OmpHostToolResult["result"]["content"][number];
+
+function hostToolContentIsBounded(content: readonly HostToolContentBlock[]): boolean {
+  return (
+    boundedJsonBytes(
+      content,
+      MAX_HOST_TOOL_RESULT_BYTES,
+      MAX_HOST_TOOL_CONTENT_BLOCKS,
+      MAX_HOST_TOOL_IMAGE_DATA_BYTES,
+      4_096,
+    ) !== Number.POSITIVE_INFINITY
+  );
+}
+
+function noticeBlock(text: string): HostToolContentBlock {
+  return { type: "text", text };
+}
+
+function appendBoundedNotice(
+  content: readonly HostToolContentBlock[],
+  notice: string,
+): HostToolContentBlock[] {
+  const trailingNotice = content.at(-1)?.text;
+  const contentWasTruncated =
+    trailingNotice === CONTENT_TRUNCATED_NOTICE || trailingNotice === RESULT_TRUNCATED_NOTICE;
+  const prefix = (contentWasTruncated ? content.slice(0, -1) : content).slice(
+    0,
+    MAX_HOST_TOOL_CONTENT_BLOCKS - 1,
+  );
+  const markerText =
+    notice === DETAILS_OMITTED_NOTICE && contentWasTruncated ? RESULT_TRUNCATED_NOTICE : notice;
+  const marker = noticeBlock(markerText);
+  while (prefix.length > 0 && !hostToolContentIsBounded([...prefix, marker])) prefix.pop();
+  return [...prefix, marker];
+}
+
+function boundedTextPrefix(
+  prefix: readonly HostToolContentBlock[],
+  block: HostToolContentBlock,
+): HostToolContentBlock | undefined {
+  if (block.type !== "text" || typeof block.text !== "string") return;
+  const marker = noticeBlock(CONTENT_TRUNCATED_NOTICE);
+  let low = 0;
+  let high = block.text.length;
+  let best = "";
+  while (low <= high) {
+    const middle = Math.floor((low + high) / 2);
+    let text = block.text.slice(0, middle);
+    if (/\p{Surrogate}$/u.test(text)) text = text.slice(0, -1);
+    const candidate = { type: "text", text } satisfies HostToolContentBlock;
+    if (hostToolContentIsBounded([...prefix, candidate, marker])) {
+      best = text;
+      low = middle + 1;
+    } else {
+      high = middle - 1;
+    }
+  }
+  return best ? { type: "text", text: best } : undefined;
+}
+
+function normalizeContent(content: readonly unknown[]): HostToolContentBlock[] {
+  const normalized: HostToolContentBlock[] = [];
+  for (const value of content) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new Error("MCP tool returned invalid content");
+    }
+    const block = value as Record<string, unknown>;
+    if (typeof block.type !== "string" || !block.type || utf8Bytes(block.type) > 256) {
+      throw new Error("MCP tool returned invalid content");
+    }
+
+    let candidate: HostToolContentBlock;
+    let blockWasTruncated = false;
+    if (block.type === "text") {
+      if (typeof block.text !== "string") throw new Error("MCP tool returned invalid text content");
+      const text = truncateUtf8(block.text, MAX_HOST_TOOL_TEXT_BYTES);
+      candidate = { ...block, type: "text", text } as HostToolContentBlock;
+      blockWasTruncated = text !== block.text;
+    } else if (block.type === "image") {
+      if (typeof block.data !== "string" || typeof block.mimeType !== "string") {
+        throw new Error("MCP tool returned invalid image content");
+      }
+      if (block.data.length > MAX_HOST_TOOL_IMAGE_DATA_BYTES) {
+        return appendBoundedNotice(normalized, CONTENT_TRUNCATED_NOTICE);
+      }
+      if (!isValidImagePayload(block.data, block.mimeType, MAX_HOST_TOOL_IMAGE_DATA_BYTES)) {
+        throw new Error("MCP tool returned invalid image content");
+      }
+      candidate = {
+        ...block,
+        type: "image",
+        data: block.data,
+        mimeType: block.mimeType,
+      } as HostToolContentBlock;
+    } else {
+      candidate = block as HostToolContentBlock;
+    }
+
+    if (normalized.length >= MAX_HOST_TOOL_CONTENT_BLOCKS) {
+      return appendBoundedNotice(normalized, CONTENT_TRUNCATED_NOTICE);
+    }
+    if (!hostToolContentIsBounded([...normalized, candidate])) {
+      const prefix = boundedTextPrefix(normalized, candidate);
+      return appendBoundedNotice(
+        prefix ? [...normalized, prefix] : normalized,
+        CONTENT_TRUNCATED_NOTICE,
+      );
+    }
+    normalized.push(candidate);
+    if (blockWasTruncated) return appendBoundedNotice(normalized, CONTENT_TRUNCATED_NOTICE);
+  }
+  return normalized;
+}
+
+function structuredContentIsBounded(value: unknown): boolean {
+  return (
     boundedJsonBytes(
-      result,
+      value,
       MAX_HOST_TOOL_RESULT_BYTES,
       1_024,
       MAX_HOST_TOOL_RESULT_BYTES,
       4_096,
-    ) === Number.POSITIVE_INFINITY
-  ) {
-    throw new Error("MCP tool returned an invalid or oversized result");
+    ) !== Number.POSITIVE_INFINITY
+  );
+}
+
+function normalizeResult(result: unknown): OmpHostToolResult["result"] {
+  if (!result || typeof result !== "object" || Array.isArray(result)) {
+    throw new Error("MCP tool returned an invalid result");
   }
   const record = result as Record<string, unknown>;
   if (Array.isArray(record.content)) {
     const details = record.structuredContent;
-    const content =
-      record.content.length === 0 && details !== undefined
-        ? [
-            {
-              type: "text",
-              text: truncateUtf8(JSON.stringify(details), MAX_STRUCTURED_CONTENT_FALLBACK_BYTES),
-            },
-          ]
-        : record.content;
-    return parseOmpHostToolAgentResult({
+    const detailsAreBounded = details === undefined || structuredContentIsBounded(details);
+    let content = normalizeContent(record.content);
+    if (content.length === 0 && details !== undefined && detailsAreBounded) {
+      content = [
+        {
+          type: "text",
+          text: truncateUtf8(JSON.stringify(details), MAX_STRUCTURED_CONTENT_FALLBACK_BYTES),
+        },
+      ];
+    }
+    if (!detailsAreBounded) content = appendBoundedNotice(content, DETAILS_OMITTED_NOTICE);
+
+    let normalized = parseOmpHostToolAgentResult({
       content,
-      ...(details !== undefined ? { details } : {}),
+      ...(details !== undefined && detailsAreBounded ? { details } : {}),
       ...(typeof record.isError === "boolean" ? { isError: record.isError } : {}),
     });
+    if (!structuredContentIsBounded(normalized)) {
+      normalized = parseOmpHostToolAgentResult({
+        content: appendBoundedNotice(content, DETAILS_OMITTED_NOTICE),
+        ...(typeof record.isError === "boolean" ? { isError: record.isError } : {}),
+      });
+    }
+    return normalized;
   }
   if (Object.hasOwn(record, "toolResult")) {
+    const details = record.toolResult;
+    const detailsAreBounded = structuredContentIsBounded(details);
     return parseOmpHostToolAgentResult({
-      content: [{ type: "text", text: "MCP tool completed" }],
-      details: record.toolResult,
+      content: [noticeBlock(detailsAreBounded ? "MCP tool completed" : DETAILS_OMITTED_NOTICE)],
+      ...(detailsAreBounded ? { details } : {}),
+      ...(typeof record.isError === "boolean" ? { isError: record.isError } : {}),
     });
   }
   throw new Error("MCP tool returned an unsupported result");
@@ -704,12 +840,73 @@ export class OmpHostToolsBridge {
     result: OmpHostToolResult,
   ): OmpHostToolResult {
     const limit = runtime.maxHostToolFrameBytes ?? 1024 * 1024;
-    try {
-      if (Buffer.byteLength(`${JSON.stringify(result)}\n`) <= limit) return result;
-    } catch {
-      // Fall through to the bounded error result.
+    const fits = (candidate: OmpHostToolResult) => {
+      try {
+        return Buffer.byteLength(`${JSON.stringify(candidate)}\n`) <= limit;
+      } catch {
+        return false;
+      }
+    };
+    if (fits(result)) return result;
+
+    const withoutDetails: OmpHostToolResult = {
+      ...result,
+      result: {
+        content: appendBoundedNotice(result.result.content, DETAILS_OMITTED_NOTICE),
+        ...(result.result.isError !== undefined ? { isError: result.result.isError } : {}),
+      },
+    };
+    if (result.result.details !== undefined && fits(withoutDetails)) return withoutDetails;
+
+    const trailingNotice = result.result.content.at(-1)?.text;
+    const detailsWereOmitted =
+      trailingNotice === DETAILS_OMITTED_NOTICE || trailingNotice === RESULT_TRUNCATED_NOTICE;
+    const contentWasTruncated =
+      trailingNotice === CONTENT_TRUNCATED_NOTICE || trailingNotice === RESULT_TRUNCATED_NOTICE;
+    const marker = noticeBlock(
+      result.result.details !== undefined || detailsWereOmitted
+        ? RESULT_TRUNCATED_NOTICE
+        : CONTENT_TRUNCATED_NOTICE,
+    );
+    const sourceContent =
+      detailsWereOmitted || contentWasTruncated
+        ? result.result.content.slice(0, -1)
+        : result.result.content;
+    const boundedContent: HostToolContentBlock[] = [];
+    const terminalWith = (content: HostToolContentBlock[]): OmpHostToolResult => ({
+      ...result,
+      result: {
+        content,
+        ...(result.result.isError !== undefined ? { isError: result.result.isError } : {}),
+      },
+    });
+    for (const block of sourceContent) {
+      const candidate = terminalWith([...boundedContent, block, marker]);
+      if (fits(candidate)) {
+        boundedContent.push(block);
+        continue;
+      }
+      if (block.type === "text" && typeof block.text === "string") {
+        let low = 0;
+        let high = block.text.length;
+        let best = "";
+        while (low <= high) {
+          const middle = Math.floor((low + high) / 2);
+          let text = block.text.slice(0, middle);
+          if (/\p{Surrogate}$/u.test(text)) text = text.slice(0, -1);
+          if (fits(terminalWith([...boundedContent, { type: "text", text }, marker]))) {
+            best = text;
+            low = middle + 1;
+          } else {
+            high = middle - 1;
+          }
+        }
+        if (best) boundedContent.push({ type: "text", text: best });
+      }
+      break;
     }
-    return errorResult(result.id, OMP_HOST_TOOL_FRAME_LIMIT_ERROR);
+    const bounded = terminalWith([...boundedContent, marker]);
+    return fits(bounded) ? bounded : errorResult(result.id, OMP_HOST_TOOL_FRAME_LIMIT_ERROR);
   }
 
   private sendTerminal(

package/server/provider/omp-rpc.ts

@@ -4,7 +4,13 @@ import { isAbsolute, join } from "node:path";
 import { z } from "zod";
 import { ompDataDir } from "../paths";
 import { isValidImagePayload } from "./image";
-import { boundedJsonBytes, OmpCleanupFailure, OmpPublicError, utf8Bytes } from "./security";
+import {
+  boundedJsonBytes,
+  boundedJsonMetrics,
+  OmpCleanupFailure,
+  OmpPublicError,
+  utf8Bytes,
+} from "./security";
 import {
   listOmpSessionDescriptors,
   type OmpSessionDescriptor,
@@ -56,6 +62,14 @@ const MAX_PENDING_ONE_WAY_WRITES = 256;
 const MAX_PENDING_WRITE_BYTES = 8 * 1024 * 1024;
 const MAX_LINE_PARTS = 4_096;
 const MAX_ARRAY_ITEMS = 512;
+// OMP read metadata can contain one source entry per displayed line. Bound this optional,
+// opaque field separately so over-budget metadata can be omitted without losing completion events.
+const MAX_OPTIONAL_METADATA_BYTES = MAX_TOOL_PAYLOAD_LENGTH;
+const MAX_OPTIONAL_METADATA_ITEMS = 2_048;
+const MAX_OPTIONAL_METADATA_NODES = 4_096;
+const MAX_TASK_CORRELATION_BYTES = 256 * 1024;
+const MAX_TASK_CORRELATION_ITEMS = 1_024;
+const MAX_TASK_CORRELATION_NODES = 4_096;
 // Tool-intensive OMP turns legitimately exceed 64 blocks; transport byte/node budgets remain the
 // primary resource bounds.
 export const OMP_MAX_CONTENT_PARTS = 4_096;
@@ -106,6 +120,76 @@ const IDENTIFIER = boundedString(MAX_ID_LENGTH, 1);
 const NAME = boundedString(MAX_NAME_LENGTH, 1);
 const OMP_PROVIDER_NAME = NAME.refine((provider) => !provider.includes("/"));
 const TEXT = boundedString(MAX_TEXT_LENGTH);
+const RAW_DISPLAY_TEXT = boundedString(MAX_IMAGE_DATA_LENGTH);
+const DISPLAY_TRUNCATION_MARKER = "<truncated>";
+
+function boundRawDisplayContent(value: unknown): unknown {
+  if (typeof value === "string") {
+    return utf8Bytes(value) <= MAX_IMAGE_DATA_LENGTH ? value : DISPLAY_TRUNCATION_MARKER;
+  }
+  if (!Array.isArray(value)) return value;
+  let totalBytes = 0;
+  for (const part of value) {
+    if (!part || typeof part !== "object" || Array.isArray(part)) continue;
+    const record = part as Record<string, unknown>;
+    if (typeof record.text === "string") totalBytes += utf8Bytes(record.text);
+    if (typeof record.thinking === "string") totalBytes += utf8Bytes(record.thinking);
+  }
+  if (totalBytes <= MAX_IMAGE_DATA_LENGTH) return value;
+
+  let retainedMarker = false;
+  return value.map((part) => {
+    if (!part || typeof part !== "object" || Array.isArray(part)) return part;
+    const copy = { ...(part as Record<string, unknown>) };
+    for (const key of ["text", "thinking"] as const) {
+      if (typeof copy[key] !== "string") continue;
+      if (retainedMarker) delete copy[key];
+      else {
+        copy[key] = DISPLAY_TRUNCATION_MARKER;
+        retainedMarker = true;
+      }
+    }
+    return copy;
+  });
+}
+
+function sanitizeLiveMessageDisplay(value: unknown): unknown {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const message = value as Record<string, unknown>;
+  if (message.role === "assistant") {
+    const content = boundRawDisplayContent(message.content);
+    return content === message.content ? value : { ...message, content };
+  }
+  if (
+    message.role === "bashExecution" &&
+    typeof message.output === "string" &&
+    utf8Bytes(message.output) > MAX_IMAGE_DATA_LENGTH
+  ) {
+    return { ...message, output: DISPLAY_TRUNCATION_MARKER };
+  }
+  return value;
+}
+
+function sanitizeLiveDisplayFrame(value: unknown): unknown {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const frame = value as Record<string, unknown>;
+  if (
+    frame.type === "message_start" ||
+    frame.type === "message_update" ||
+    frame.type === "message_end"
+  ) {
+    const message = sanitizeLiveMessageDisplay(frame.message);
+    return message === frame.message ? value : { ...frame, message };
+  }
+  if (frame.type !== "agent_end" || !Array.isArray(frame.messages)) return value;
+  let changed = false;
+  const messages = frame.messages.map((message) => {
+    const sanitized = sanitizeLiveMessageDisplay(message);
+    if (sanitized !== message) changed = true;
+    return sanitized;
+  });
+  return changed ? { ...frame, messages } : value;
+}
 const OmpThinkingLevelSchema = z.enum(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
 
 function isBoundedJson(
@@ -118,6 +202,148 @@ function isBoundedJson(
     boundedJsonBytes(value, maxBytes, maxItems, maxBytes, maxNodes) !== Number.POSITIVE_INFINITY
   );
 }
+function optionalMetadataMetrics(value: unknown) {
+  return boundedJsonMetrics(
+    value,
+    MAX_OPTIONAL_METADATA_BYTES,
+    MAX_OPTIONAL_METADATA_ITEMS,
+    MAX_OPTIONAL_METADATA_BYTES,
+    MAX_OPTIONAL_METADATA_NODES,
+  );
+}
+
+function optionalMetadataIsBounded(value: unknown): boolean {
+  return optionalMetadataMetrics(value) !== undefined;
+}
+
+function omitUnsafeOptionalDetails(value: unknown): unknown {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+  const record = value as Record<string, unknown>;
+  if (!Object.hasOwn(record, "details") || optionalMetadataIsBounded(record.details)) return value;
+  const { details: _details, ...safe } = record;
+  return safe;
+}
+
+const TASK_RESULT_STATUSES: Readonly<Record<string, true>> = {
+  pending: true,
+  running: true,
+  completed: true,
+  failed: true,
+  error: true,
+  aborted: true,
+  canceled: true,
+  cancelled: true,
+};
+const TASK_PROGRESS_STATUSES: Readonly<Record<string, true>> = {
+  pending: true,
+  running: true,
+  completed: true,
+  failed: true,
+  aborted: true,
+};
+
+function boundedTaskId(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0 && utf8Bytes(value) <= MAX_ID_LENGTH;
+}
+
+function taskCorrelationDetails(value: unknown): unknown {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+  const details = value as Record<string, unknown>;
+  if (!Array.isArray(details.results) || details.results.length > MAX_TASK_CORRELATION_ITEMS)
+    return;
+  const results: Record<string, unknown>[] = [];
+  for (const value of details.results) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+    const result = value as Record<string, unknown>;
+    if (!boundedTaskId(result.id)) return;
+    const safe: Record<string, unknown> = { id: result.id };
+    if (typeof result.status === "string" && Object.hasOwn(TASK_RESULT_STATUSES, result.status)) {
+      safe.status = result.status;
+    }
+    if (typeof result.aborted === "boolean") safe.aborted = result.aborted;
+    if (typeof result.exitCode === "number" && Number.isFinite(result.exitCode)) {
+      safe.exitCode = result.exitCode;
+    }
+    if (
+      result.error !== undefined &&
+      boundedJsonMetrics(result.error, 4_096, 32, 4_096, 64) !== undefined
+    ) {
+      safe.error = result.error;
+    }
+    results.push(safe);
+  }
+  let progress: Record<string, unknown>[] | undefined;
+  if (details.progress !== undefined) {
+    if (!Array.isArray(details.progress) || details.progress.length > MAX_TASK_CORRELATION_ITEMS) {
+      return;
+    }
+    progress = [];
+    for (const value of details.progress) {
+      if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+      const item = value as Record<string, unknown>;
+      if (
+        !boundedTaskId(item.id) ||
+        typeof item.index !== "number" ||
+        !Number.isInteger(item.index) ||
+        item.index < 0 ||
+        item.index >= MAX_TASK_CORRELATION_ITEMS ||
+        typeof item.status !== "string" ||
+        !Object.hasOwn(TASK_PROGRESS_STATUSES, item.status)
+      ) {
+        return;
+      }
+      progress.push({ id: item.id, index: item.index, status: item.status });
+    }
+  }
+  const correlation = { results, ...(progress ? { progress } : {}) };
+  return boundedJsonMetrics(
+    correlation,
+    MAX_TASK_CORRELATION_BYTES,
+    MAX_TASK_CORRELATION_ITEMS,
+    MAX_TASK_CORRELATION_BYTES,
+    MAX_TASK_CORRELATION_NODES,
+  )
+    ? correlation
+    : undefined;
+}
+
+function omitOptionalDetails(value: unknown, preserveTaskCorrelation = false): unknown {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+  const record = value as Record<string, unknown>;
+  if (!Object.hasOwn(record, "details")) return value;
+  const { details: _details, ...structural } = record;
+  if (!preserveTaskCorrelation) return structural;
+  const correlation = taskCorrelationDetails(record.details);
+  return correlation === undefined ? structural : { ...structural, details: correlation };
+}
+
+function createOptionalMetadataSanitizer(): (value: unknown, taskResult?: boolean) => unknown {
+  let retainedBytes = 0;
+  let retainedNodes = 0;
+  return (value, taskResult = false) => {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+    const record = value as Record<string, unknown>;
+    if (!Object.hasOwn(record, "details")) return value;
+    const metrics = optionalMetadataMetrics(record.details);
+    if (
+      metrics &&
+      retainedBytes + metrics.bytes <= MAX_OPTIONAL_METADATA_BYTES &&
+      retainedNodes + metrics.nodes <= MAX_OPTIONAL_METADATA_NODES
+    ) {
+      retainedBytes += metrics.bytes;
+      retainedNodes += metrics.nodes;
+      return value;
+    }
+    const correlation = taskResult ? taskCorrelationDetails(record.details) : undefined;
+    const { details: _details, ...safe } = record;
+    return correlation === undefined ? safe : { ...safe, details: correlation };
+  };
+}
+
+const OmpOptionalMetadataSchema = z.preprocess(
+  (value) => (optionalMetadataIsBounded(value) ? value : undefined),
+  z.unknown().optional(),
+);
 
 const OmpContentPartSchema = z
   .object({
@@ -147,6 +373,14 @@ const OmpContentPartSchema = z
       context.addIssue({ code: "custom", message: "invalid image payload" });
     }
   });
+const OmpAssistantContentPartSchema = OmpContentPartSchema.safeExtend({
+  text: RAW_DISPLAY_TEXT.optional(),
+  thinking: RAW_DISPLAY_TEXT.optional(),
+});
+const OmpAssistantDisplayContentSchema = z.preprocess(
+  boundRawDisplayContent,
+  z.union([RAW_DISPLAY_TEXT, z.array(OmpAssistantContentPartSchema).max(OMP_MAX_CONTENT_PARTS)]),
+);
 const OmpDisplayContentSchema = z.union([
   TEXT,
   z.array(OmpContentPartSchema).max(OMP_MAX_CONTENT_PARTS),
@@ -165,10 +399,7 @@ const OmpMessageIdentityShape = {
   responseId: IDENTIFIER.optional(),
   images: OmpImageArraySchema.optional(),
   timestamp: z.number().finite().optional(),
-  details: z
-    .unknown()
-    .refine((value) => isBoundedJson(value, MAX_SEMANTIC_FRAME_BYTES, 1_024, 4_096))
-    .optional(),
+  details: OmpOptionalMetadataSchema,
 };
 type OmpContentPart = z.infer<typeof OmpContentPartSchema>;
 type OmpMessageIdentity = {
@@ -218,7 +449,7 @@ export type OmpMessage = OmpMessageIdentity &
 const OmpMessageSchema: z.ZodType<OmpMessage> = z.union([
   z.object({
     role: z.literal("assistant"),
-    content: OmpDisplayContentSchema.optional(),
+    content: OmpAssistantDisplayContentSchema.optional(),
     ...OmpMessageIdentityShape,
     errorMessage: boundedString(4_096).nullable().optional(),
     stopReason: boundedString(64).optional(),
@@ -241,7 +472,13 @@ const OmpMessageSchema: z.ZodType<OmpMessage> = z.union([
   z.object({
     role: z.literal("bashExecution"),
     command: TEXT,
-    output: TEXT.optional(),
+    output: z.preprocess(
+      (value) =>
+        typeof value === "string" && utf8Bytes(value) > MAX_IMAGE_DATA_LENGTH
+          ? DISPLAY_TRUNCATION_MARKER
+          : value,
+      RAW_DISPLAY_TEXT.optional(),
+    ),
     exitCode: z.number().int().nullable().optional(),
     cancelled: z.boolean().optional(),
     truncated: z.boolean().optional(),
@@ -409,6 +646,16 @@ const JsonObjectSchema = z.record(z.string(), z.unknown());
 const BoundedToolPayloadSchema = z
   .unknown()
   .refine((value) => isBoundedJson(value, MAX_SEMANTIC_FRAME_BYTES, 1_024, 4_096));
+const OmpToolResultPayloadSchema = z.preprocess(
+  omitUnsafeOptionalDetails,
+  z
+    .unknown()
+    .refine(
+      (value) =>
+        isBoundedJson(value, MAX_SEMANTIC_FRAME_BYTES, MAX_OPTIONAL_METADATA_ITEMS, 8_192) &&
+        isBoundedJson(omitOptionalDetails(value), MAX_SEMANTIC_FRAME_BYTES, 1_024, 4_096),
+    ),
+);
 const OmpHostToolDefinitionSchema = z.object({
   name: NAME,
   label: NAME.optional(),
@@ -616,13 +863,13 @@ const OmpAgentSessionEventSchema = z.discriminatedUnion("type", [
     toolCallId: IDENTIFIER,
     toolName: NAME,
     args: BoundedToolPayloadSchema.optional(),
-    partialResult: BoundedToolPayloadSchema,
+    partialResult: OmpToolResultPayloadSchema,
   }),
   z.object({
     type: z.literal("tool_execution_end"),
     toolCallId: IDENTIFIER,
     toolName: NAME,
-    result: BoundedToolPayloadSchema,
+    result: OmpToolResultPayloadSchema,
     isError: z.boolean().optional(),
   }),
   OmpCompactionStartSchema,
@@ -873,6 +1120,102 @@ const OmpRuntimeEventSchema = z.discriminatedUnion("type", [
   OmpToolApprovalCancelSchema,
   z.object({ type: z.literal("advisor_yielded") }),
 ]);
+type OptionalDetailsMapper = (value: unknown, taskResult?: boolean) => unknown;
+
+function mapRecordField(
+  record: Record<string, unknown>,
+  key: string,
+  map: OptionalDetailsMapper,
+  taskResult = false,
+): Record<string, unknown> {
+  if (!Object.hasOwn(record, key)) return record;
+  const next = map(record[key], taskResult);
+  return next === record[key] ? record : { ...record, [key]: next };
+}
+
+function mapMessageList(value: unknown, map: OptionalDetailsMapper): unknown {
+  if (!Array.isArray(value)) return value;
+  let changed = false;
+  const messages = value.map((message) => {
+    const taskResult =
+      message !== null &&
+      typeof message === "object" &&
+      !Array.isArray(message) &&
+      (message as Record<string, unknown>).role === "toolResult" &&
+      (message as Record<string, unknown>).toolName === "task";
+    const next = map(message, taskResult);
+    changed ||= next !== message;
+    return next;
+  });
+  return changed ? messages : value;
+}
+
+function mapAgentEventDetails(
+  frame: Record<string, unknown>,
+  map: OptionalDetailsMapper,
+): Record<string, unknown> {
+  switch (frame.type) {
+    case "message_start":
+    case "message_update":
+    case "message_end": {
+      const message = frame.message;
+      const taskResult =
+        message !== null &&
+        typeof message === "object" &&
+        !Array.isArray(message) &&
+        (message as Record<string, unknown>).role === "toolResult" &&
+        (message as Record<string, unknown>).toolName === "task";
+      return mapRecordField(frame, "message", map, taskResult);
+    }
+    case "tool_execution_update":
+      return mapRecordField(frame, "partialResult", map, frame.toolName === "task");
+    case "tool_execution_end":
+      return mapRecordField(frame, "result", map, frame.toolName === "task");
+    case "agent_end":
+      return mapRecordField(frame, "messages", (messages) => mapMessageList(messages, map));
+    default:
+      return frame;
+  }
+}
+
+function mapRuntimeFrameDetails(
+  frame: Record<string, unknown>,
+  map: OptionalDetailsMapper,
+): Record<string, unknown> {
+  if (frame.type !== "subagent_event") return mapAgentEventDetails(frame, map);
+  if (frame.payload === null || typeof frame.payload !== "object" || Array.isArray(frame.payload)) {
+    return frame;
+  }
+  const payload = frame.payload as Record<string, unknown>;
+  if (payload.event === null || typeof payload.event !== "object" || Array.isArray(payload.event)) {
+    return frame;
+  }
+  const event = mapAgentEventDetails(payload.event as Record<string, unknown>, map);
+  return event === payload.event ? frame : { ...frame, payload: { ...payload, event } };
+}
+
+function sanitizeMessageListMetadata(value: unknown): unknown {
+  return mapMessageList(value, createOptionalMetadataSanitizer());
+}
+
+function sanitizeHistoryResponseData(value: unknown): unknown {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return value;
+  return mapRecordField(value as Record<string, unknown>, "messages", sanitizeMessageListMetadata);
+}
+
+function runtimeFrameCollectionLimit(frame: Record<string, unknown>): number {
+  const type = frame.type;
+  if (
+    type === "message_start" ||
+    type === "message_update" ||
+    type === "message_end" ||
+    type === "agent_end" ||
+    type === "subagent_event"
+  ) {
+    return OMP_MAX_CONTENT_PARTS;
+  }
+  return 1_024;
+}
 const OmpModelsResultSchema = z.object({
   models: z.array(OmpModelSchema).min(1).max(256),
 });
@@ -1988,21 +2331,7 @@ class OmpRpcProcess {
       this.recordProtocolViolation();
       return;
     }
-    if (this.receiveKnownResponse(decoded)) return;
-    if (this.receiveDegradedAgentEnd(decoded, true)) return;
-    if (
-      boundedJsonBytes(decoded, MAX_SEMANTIC_FRAME_BYTES, 1_024, MAX_IMAGE_DATA_LENGTH, 4_096) ===
-      Number.POSITIVE_INFINITY
-    ) {
-      this.recordProtocolViolation();
-      return;
-    }
-    const frame = JsonObjectSchema.safeParse(decoded);
-    if (!frame.success) {
-      this.recordProtocolViolation();
-      return;
-    }
-    this.receiveFrame(frame.data);
+    this.receiveDecodedFrame(decoded, payload.byteLength);
   }
 
   private receiveChunk(frame: ChunkFrame): void {
@@ -2072,26 +2401,33 @@ class OmpRpcProcess {
       this.recordProtocolViolation();
       return;
     }
-    if (this.receiveKnownResponse(decodedFrame)) return;
-    if (this.receiveDegradedAgentEnd(decodedFrame, true)) return;
-    if (
-      boundedJsonBytes(
-        decodedFrame,
-        MAX_SEMANTIC_FRAME_BYTES,
-        1_024,
-        MAX_IMAGE_DATA_LENGTH,
-        4_096,
-      ) === Number.POSITIVE_INFINITY
-    ) {
-      this.recordProtocolViolation();
+    this.receiveDecodedFrame(decodedFrame, reassembled.byteLength);
+  }
+
+  private receiveDecodedFrame(value: unknown, rawByteLength: number): void {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const frame = value as Record<string, unknown>;
+      const pending = typeof frame.id === "string" ? this.pending.get(frame.id) : undefined;
+      if (
+        frame.type === "response" &&
+        (pending?.command === "get_messages" || pending?.command === "get_subagent_messages")
+      ) {
+        this.receiveResponse(frame);
+        return;
+      }
+    }
+    if (rawByteLength > MAX_SEMANTIC_FRAME_BYTES) {
+      this.fail(new Error("OMP RPC frame exceeds the semantic byte limit"));
       return;
     }
-    const frameObject = JsonObjectSchema.safeParse(decodedFrame);
-    if (!frameObject.success) {
+    if (this.receiveKnownResponse(value)) return;
+    const sanitized = sanitizeLiveDisplayFrame(value);
+    const frame = JsonObjectSchema.safeParse(sanitized);
+    if (!frame.success) {
       this.recordProtocolViolation();
       return;
     }
-    this.receiveFrame(frameObject.data);
+    this.receiveFrame(frame.data);
   }
 
   private receiveKnownResponse(value: unknown): boolean {
@@ -2130,6 +2466,11 @@ class OmpRpcProcess {
     const isBranchHistory = pending.command === "get_branch_messages";
     const isHistory =
       pending.command === "get_messages" || pending.command === "get_subagent_messages";
+    const responseData = isHistory
+      ? sanitizeHistoryResponseData(response.data.data)
+      : response.data.data;
+    const boundedFrame =
+      responseData === response.data.data ? frame : { ...frame, data: responseData };
     const responseItemLimit = isBranchHistory ? 1_024 : isHistory ? 100_000 : MAX_ARRAY_ITEMS;
     const responseByteLimit =
       isBranchHistory || isHistory
@@ -2146,7 +2487,7 @@ class OmpRpcProcess {
           : 2_048;
     if (
       boundedJsonBytes(
-        frame,
+        boundedFrame,
         responseByteLimit,
         responseItemLimit,
         MAX_IMAGE_DATA_LENGTH,
@@ -2162,7 +2503,7 @@ class OmpRpcProcess {
     if (!settled) return;
     if (response.data.success) {
       try {
-        settled.beforeResolve?.(response.data.data);
+        settled.beforeResolve?.(responseData);
         if (settled.command === "prompt") {
           if (this.acceptedPromptIds.size >= MAX_PENDING_REQUESTS) {
             const oldest = this.acceptedPromptIds.values().next().value;
@@ -2170,7 +2511,7 @@ class OmpRpcProcess {
           }
           this.acceptedPromptIds.add(response.data.id);
         }
-        settled.resolve(response.data.data);
+        settled.resolve(responseData);
       } catch {
         settled.reject(new Error("OMP RPC response is invalid"));
       }
@@ -2219,21 +2560,27 @@ class OmpRpcProcess {
       this.fail(new Error("OMP emitted invalid terminal metadata"));
       return true;
     }
+    const structuralFrame = mapRuntimeFrameDetails(frame, omitOptionalDetails);
     const messagesAreSafe =
       frame.messages === undefined ||
       (Array.isArray(frame.messages) &&
         frame.messages.length <= MAX_ARRAY_ITEMS &&
         boundedJsonBytes(
-          frame.messages,
+          structuralFrame.messages as unknown[],
           MAX_SEMANTIC_FRAME_BYTES,
-          MAX_ARRAY_ITEMS,
-          MAX_TEXT_LENGTH,
+          OMP_MAX_CONTENT_PARTS,
+          MAX_IMAGE_DATA_LENGTH,
           4_096,
         ) !== Number.POSITIVE_INFINITY);
     const payloadIsSafe =
       messagesAreSafe &&
-      boundedJsonBytes(frame, MAX_SEMANTIC_FRAME_BYTES, 1_024, MAX_IMAGE_DATA_LENGTH, 4_096) !==
-        Number.POSITIVE_INFINITY;
+      boundedJsonBytes(
+        structuralFrame,
+        MAX_SEMANTIC_FRAME_BYTES,
+        OMP_MAX_CONTENT_PARTS,
+        MAX_IMAGE_DATA_LENGTH,
+        4_096,
+      ) !== Number.POSITIVE_INFINITY;
     if (onlyUnsafePayload && payloadIsSafe) return false;
     if (envelope.data.isTerminal === false) {
       this.fail(new Error("OMP emitted an invalid nonterminal agent_end payload"));
@@ -2260,16 +2607,22 @@ class OmpRpcProcess {
       this.recordProtocolViolation();
       return;
     }
-    if (this.receiveDegradedAgentEnd(frame, true)) return;
+    const safeFrame = mapRuntimeFrameDetails(frame, createOptionalMetadataSanitizer());
+    if (this.receiveDegradedAgentEnd(safeFrame, true)) return;
     if (
-      boundedJsonBytes(frame, MAX_SEMANTIC_FRAME_BYTES, 1_024, MAX_IMAGE_DATA_LENGTH, 4_096) ===
-      Number.POSITIVE_INFINITY
+      boundedJsonBytes(
+        mapRuntimeFrameDetails(safeFrame, omitOptionalDetails),
+        MAX_SEMANTIC_FRAME_BYTES,
+        runtimeFrameCollectionLimit(safeFrame),
+        MAX_IMAGE_DATA_LENGTH,
+        4_096,
+      ) === Number.POSITIVE_INFINITY
     ) {
       this.recordProtocolViolation();
       return;
     }
     if (type === "rpc_chunk") {
-      const chunk = OmpChunkFrameSchema.safeParse(frame);
+      const chunk = OmpChunkFrameSchema.safeParse(safeFrame);
       if (!chunk.success) this.rejectChunk();
       else this.receiveChunk(chunk.data);
       return;
@@ -2287,7 +2640,7 @@ class OmpRpcProcess {
         this.recordProtocolViolation();
         return;
       }
-      const ready = OmpReadyFrameSchema.safeParse(frame);
+      const ready = OmpReadyFrameSchema.safeParse(safeFrame);
       if (!ready.success) {
         this.recordProtocolViolation();
       } else {
@@ -2297,13 +2650,13 @@ class OmpRpcProcess {
       return;
     }
     if (type === "response") {
-      this.receiveResponse(frame);
+      this.receiveResponse(safeFrame);
       return;
     }
-    const event = OmpRuntimeEventSchema.safeParse(frame);
+    const event = OmpRuntimeEventSchema.safeParse(safeFrame);
     if (!event.success) {
-      this.rejectMatchingToolApproval(frame);
-      if (type === "agent_end" && this.receiveDegradedAgentEnd(frame, false)) return;
+      this.rejectMatchingToolApproval(safeFrame);
+      if (type === "agent_end" && this.receiveDegradedAgentEnd(safeFrame, false)) return;
       this.recordProtocolViolation();
       return;
     }
@@ -2728,7 +3081,10 @@ export class OmpRpcRuntime implements OmpRuntime {
     );
     return {
       ...transcript,
-      messages: z.array(OmpMessageSchema).max(100_000).parse(transcript.messages),
+      messages: z
+        .array(OmpMessageSchema)
+        .max(100_000)
+        .parse(sanitizeMessageListMetadata(transcript.messages)),
     };
   }
   async readPersistedSubagentTranscript(options: {
@@ -2745,7 +3101,10 @@ export class OmpRpcRuntime implements OmpRuntime {
     );
     return {
       ...transcript,
-      messages: z.array(OmpMessageSchema).max(100_000).parse(transcript.messages),
+      messages: z
+        .array(OmpMessageSchema)
+        .max(100_000)
+        .parse(sanitizeMessageListMetadata(transcript.messages)),
     };
   }
 

package/server/provider/security.ts

@@ -83,16 +83,14 @@ function truncateJsonString(value: string, maxBytes: number): string {
 export function truncateUtf8(value: string, maxBytes: number): string {
   if (utf8Bytes(value) <= maxBytes) return value;
   const suffix = "<truncated>";
-  const budget = Math.max(0, maxBytes - utf8Bytes(suffix));
-  let output = "";
-  let bytes = 0;
-  for (const character of value) {
-    const characterBytes = utf8Bytes(character);
-    if (bytes + characterBytes > budget) break;
-    output += character;
-    bytes += characterBytes;
-  }
-  return `${output}${suffix}`;
+  const suffixBytes = utf8Bytes(suffix);
+  if (maxBytes <= 0) return "";
+  if (maxBytes < suffixBytes) return suffix.slice(0, Math.floor(maxBytes));
+
+  const bytes = Buffer.from(value, "utf8");
+  let end = Math.min(maxBytes - suffixBytes, bytes.byteLength);
+  while (end > 0 && (bytes[end] & 0xc0) === 0x80) end -= 1;
+  return `${bytes.subarray(0, end).toString("utf8")}${suffix}`;
 }
 
 export interface BoundedJsonMetrics {

package/server/provider/subsessions.ts

@@ -94,6 +94,18 @@ const TaskResultDetailsSchema = z.object({
         exitCode: z.number().optional(),
         error: z.unknown().optional(),
         aborted: z.boolean().optional(),
+        status: z
+          .enum([
+            "pending",
+            "running",
+            "completed",
+            "failed",
+            "error",
+            "aborted",
+            "canceled",
+            "cancelled",
+          ])
+          .optional(),
       }),
     )
     .max(MAX_CHILDREN),
@@ -192,8 +204,15 @@ function replayChildren(messages: readonly OmpMessage[]): ReplayChildRef[] {
     const details = taskResultDetails(message);
     const results = details?.results ?? [];
     for (const result of results) {
+      const canceled =
+        result.aborted === true ||
+        result.status === "aborted" ||
+        result.status === "canceled" ||
+        result.status === "cancelled";
       const failed =
         message.isError === true ||
+        result.status === "failed" ||
+        result.status === "error" ||
         Boolean(result.error) ||
         (typeof result.exitCode === "number" && result.exitCode !== 0);
       children.push({
@@ -201,7 +220,7 @@ function replayChildren(messages: readonly OmpMessage[]): ReplayChildRef[] {
         agent: result.agent ?? call?.title,
         description: call?.description,
         parentToolCallId: message.toolCallId,
-        status: result.aborted === true ? "canceled" : failed ? "failed" : "completed",
+        status: canceled ? "canceled" : failed ? "failed" : "completed",
       });
     }
     const resultIds = new Set(results.map((result) => result.id));
@@ -555,6 +574,7 @@ export class OmpSubsessionProjector {
       type: "session.opened",
       sessionId,
       parentSessionId,
+      toolCallId: ref.parentToolCallId,
       capabilities: ["session.subsession"],
       restoration: "parent",
       cwd: this.cwd,

package/server/provider/timeline-projector.ts

@@ -12,11 +12,14 @@ import {
   type JsonValue,
   OmpPublicDataSerializer,
   OmpPublicError,
+  truncateUtf8,
   utf8Bytes,
 } from "./security";
 
 const STREAM_FRAME_MS = 32;
 const MAX_STREAM_TEXT_LENGTH = 4 * 1024 * 1024;
+const MAX_RAW_STREAM_TEXT_LENGTH = 8 * 1024 * 1024;
+const MAX_REDACTED_STREAM_TEXT_LENGTH = MAX_RAW_STREAM_TEXT_LENGTH * 3;
 const MAX_ACTIVE_TOOLS = 64;
 const MAX_TODOS = 256;
 const MAX_TURN_NATIVE_IDENTITIES = 1_024;
@@ -908,10 +911,7 @@ export class OmpTimelineProjector {
       return;
     }
     if (message.role === "bashExecution") {
-      const text = message.output
-        ? `$ ${message.command}\n${message.output}`
-        : `$ ${message.command}`;
-      this.project({ type: "command_output", text }, this.replayTurnId);
+      this.publishCustomMessage(message);
       this.finishTurn(this.replayTurnId);
       this.replayTurnId = null;
     }
@@ -1007,13 +1007,28 @@ export class OmpTimelineProjector {
     if (!this.stream || this.closed || this.stream.dirtyBlocks.size === 0) return;
     const stream = this.stream;
     if (!stream.nativeIdentity && !finalizeFallback) return;
-    const indexes = [...stream.dirtyBlocks].sort((left, right) => left - right);
+    const indexes = [...stream.blocks.keys()].sort((left, right) => left - right);
+    let remainingTextBytes = MAX_STREAM_TEXT_LENGTH;
     stream.dirtyBlocks.clear();
     for (const contentIndex of indexes) {
       const block = stream.blocks.get(contentIndex);
-      if (!block?.text) continue;
-      const publicText = block.kind === "image" ? block.text : this.dataFilter.text(block.text);
-      if (!publicText || block.publishedText === publicText) continue;
+      if (!block) continue;
+      const publicText =
+        block.kind === "image"
+          ? block.text
+          : truncateUtf8(
+              this.dataFilter.text(block.text, MAX_REDACTED_STREAM_TEXT_LENGTH),
+              remainingTextBytes,
+            );
+      if (block.kind !== "image") {
+        remainingTextBytes = Math.max(0, remainingTextBytes - utf8Bytes(publicText));
+      }
+      if (
+        block.publishedText === publicText ||
+        (!publicText && block.publishedText === undefined)
+      ) {
+        continue;
+      }
       const nextPublishedBytes = utf8Bytes(publicText);
       if (
         stream.retainedBytes + stream.publishedBytes + nextPublishedBytes >
@@ -1267,7 +1282,7 @@ export class OmpTimelineProjector {
       (snapshot.kind === "image" ? 0 : snapshotBytes);
     if (
       retainedBytes + stream.publishedBytes > MAX_STREAM_TOTAL_BYTES ||
-      textBytes > MAX_STREAM_TEXT_LENGTH
+      textBytes > MAX_RAW_STREAM_TEXT_LENGTH
     ) {
       return;
     }
@@ -1291,7 +1306,7 @@ export class OmpTimelineProjector {
 
   private publishCommand(turnId: string): void {
     if (!this.commandText) return;
-    const publicText = this.dataFilter.text(this.commandText);
+    const publicText = this.dataFilter.text(this.commandText, MAX_STREAM_TEXT_LENGTH);
     if (!publicText || publicText === this.commandPublishedText) return;
     this.commandPublishedText = publicText;
     this.publish({
@@ -1377,13 +1392,21 @@ export class OmpTimelineProjector {
           type: "shell",
           command,
           ...(firstString(details, "cwd") ? { cwd: firstString(details, "cwd") } : {}),
-          ...(output ? { output: this.dataFilter.text(output) } : {}),
+          ...(output ? { output: this.dataFilter.text(output, MAX_STREAM_TEXT_LENGTH) } : {}),
           ...(typeof message.exitCode === "number" || message.exitCode === null
             ? { exitCode: message.exitCode }
             : typeof details?.exitCode === "number"
               ? { exitCode: details.exitCode }
               : {}),
         },
+        ...(message.cancelled !== undefined || message.truncated !== undefined
+          ? {
+              metadata: {
+                ...(message.cancelled !== undefined ? { cancelled: message.cancelled } : {}),
+                ...(message.truncated !== undefined ? { truncated: message.truncated } : {}),
+              },
+            }
+          : {}),
         status: message.cancelled ? "canceled" : "completed",
         error: null,
       });