@omercnet/paseo-omp 0.2.1 → 0.3.0

package/server/provider/connection.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { isAbsolute } from "node:path";
 import {
@@ -7,6 +8,7 @@ import {
   ProviderInputSchema,
   requireProviderCapabilities,
 } from "@getpaseo/plugin/server/provider";
+import type { OmpBrowserAuthorizationRegistry } from "../mcp-browser";
 import { discoverOmpCatalog } from "./catalog";
 import { normalizeOmpCatalogOptions } from "./config-normalization";
 import type { OmpMcpConnector } from "./host-tools";
@@ -39,6 +41,7 @@ const SUPPORTED_CAPABILITIES: Readonly<Record<string, true>> = {
   "session.subsession": true,
   "session.revert.conversation": true,
   permission: true,
+  "timeline.plugin": true,
 };
 const SUPPORTED_INPUTS: Readonly<Record<string, true>> = {
   catalog: true,
@@ -264,8 +267,164 @@ function validateInputEnvelope(input: unknown): asserts input is ProviderInput {
   }
 }
 
-function errorDetails(error: unknown, fallback: string): { message: string } {
-  return { message: isOmpPublicError(error) ? error.message : fallback };
+export interface OmpConnectionDiagnostic {
+  diagnosticId: string;
+  operation: string;
+  errorClass: "TypeError" | "RangeError" | "SyntaxError" | "ReferenceError" | "Error" | "NonError";
+  classification:
+    | "rpc-response-limit"
+    | "rpc-invalid-response"
+    | "rpc-timeout"
+    | "rpc-closed"
+    | "rpc-input-failed"
+    | "rpc-exit"
+    | "spawn-not-found"
+    | "spawn-not-runnable"
+    | "spawn-failed"
+    | "system-error"
+    | "database-error"
+    | "catalog-empty"
+    | "unexpected";
+  stage?: "spawn" | "rpc" | "storage";
+  code?: (typeof SYSTEM_ERROR_CODES)[number] | (typeof DATABASE_ERROR_CODES)[number];
+  exitCode?: number;
+  signal?: (typeof EXIT_SIGNALS)[number];
+}
+
+// Match complete, locally authored messages only. Never log an arbitrary message, error name,
+// stack, cause, request payload, or environment: each can contain credentials or prompt text.
+const KNOWN_FAILURES = new Map<string, Pick<OmpConnectionDiagnostic, "classification" | "stage">>([
+  [
+    "OMP RPC response exceeded command limits",
+    { classification: "rpc-response-limit", stage: "rpc" },
+  ],
+  ["OMP RPC response is invalid", { classification: "rpc-invalid-response", stage: "rpc" }],
+  ["OMP RPC request timed out", { classification: "rpc-timeout", stage: "rpc" }],
+  ["OMP RPC process is closed", { classification: "rpc-closed", stage: "rpc" }],
+  ["OMP RPC process was closed", { classification: "rpc-closed", stage: "rpc" }],
+  ["OMP RPC output channel closed", { classification: "rpc-closed", stage: "rpc" }],
+  ["OMP RPC input channel failed", { classification: "rpc-input-failed", stage: "rpc" }],
+  ["OMP reported no available models", { classification: "catalog-empty", stage: "rpc" }],
+  ["OMP executable was not found", { classification: "spawn-not-found", stage: "spawn" }],
+  ["OMP executable is not runnable", { classification: "spawn-not-runnable", stage: "spawn" }],
+  ["OMP process could not be launched", { classification: "spawn-failed", stage: "spawn" }],
+]);
+
+// These are diagnostic vocabulary, not patterns: an unrecognized code or signal is never emitted.
+const SYSTEM_ERROR_CODES = [
+  "ENOENT",
+  "EACCES",
+  "EPERM",
+  "ENOTDIR",
+  "EISDIR",
+  "ENOSPC",
+  "EMFILE",
+  "ENFILE",
+  "ETIMEDOUT",
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "EPIPE",
+  "EIO",
+] as const;
+const DATABASE_ERROR_CODES = [
+  "SQLITE_ERROR",
+  "SQLITE_BUSY",
+  "SQLITE_LOCKED",
+  "SQLITE_CANTOPEN",
+  "SQLITE_CORRUPT",
+  "SQLITE_NOTADB",
+  "SQLITE_READONLY",
+  "SQLITE_FULL",
+  "SQLITE_IOERR",
+  "ERR_SQLITE_ERROR",
+] as const;
+const EXIT_SIGNALS = [
+  "SIGABRT",
+  "SIGALRM",
+  "SIGBUS",
+  "SIGCHLD",
+  "SIGCONT",
+  "SIGFPE",
+  "SIGHUP",
+  "SIGILL",
+  "SIGINT",
+  "SIGIO",
+  "SIGIOT",
+  "SIGKILL",
+  "SIGPIPE",
+  "SIGPOLL",
+  "SIGPROF",
+  "SIGPWR",
+  "SIGQUIT",
+  "SIGSEGV",
+  "SIGSTKFLT",
+  "SIGSTOP",
+  "SIGSYS",
+  "SIGTERM",
+  "SIGTRAP",
+  "SIGTSTP",
+  "SIGTTIN",
+  "SIGTTOU",
+  "SIGUNUSED",
+  "SIGURG",
+  "SIGUSR1",
+  "SIGUSR2",
+  "SIGVTALRM",
+  "SIGWINCH",
+  "SIGXCPU",
+  "SIGXFSZ",
+  "SIGBREAK",
+  "SIGLOST",
+  "SIGINFO",
+  "unknown",
+] as const;
+
+function classifyFailure(
+  error: unknown,
+): Omit<OmpConnectionDiagnostic, "diagnosticId" | "operation"> {
+  const result: Omit<OmpConnectionDiagnostic, "diagnosticId" | "operation"> = {
+    errorClass:
+      error instanceof TypeError
+        ? "TypeError"
+        : error instanceof RangeError
+          ? "RangeError"
+          : error instanceof SyntaxError
+            ? "SyntaxError"
+            : error instanceof ReferenceError
+              ? "ReferenceError"
+              : error instanceof Error
+                ? "Error"
+                : "NonError",
+    classification: "unexpected",
+  };
+  const message = error instanceof Error ? error.message : undefined;
+  if (typeof message === "string") {
+    const known = KNOWN_FAILURES.get(message);
+    if (known) return { ...result, ...known };
+    const exit = /^OMP RPC process exited \(code (-?(?:0|[1-9]\d{0,9}))\)$/.exec(message);
+    if (exit && exit[0] === message) {
+      const exitCode = Number(exit[1]);
+      if (exitCode >= -2147483648 && exitCode <= 4294967295) {
+        return { ...result, classification: "rpc-exit", stage: "rpc", exitCode };
+      }
+    }
+    const signal = EXIT_SIGNALS.find(
+      (value) => message === `OMP RPC process exited (signal ${value})`,
+    );
+    if (signal) return { ...result, classification: "rpc-exit", stage: "rpc", signal };
+  }
+  // Inspect data properties only; error-code getters may execute arbitrary application code.
+  const code =
+    error && typeof error === "object"
+      ? Object.getOwnPropertyDescriptor(error, "code")?.value
+      : undefined;
+  const systemCode = SYSTEM_ERROR_CODES.find((value) => value === code);
+  if (systemCode) return { ...result, classification: "system-error", code: systemCode };
+  const databaseCode = DATABASE_ERROR_CODES.find((value) => value === code);
+  if (databaseCode) {
+    return { ...result, classification: "database-error", stage: "storage", code: databaseCode };
+  }
+  return result;
 }
 
 type NativeReservation = { owner: symbol; quarantined: boolean };
@@ -494,7 +653,22 @@ export function createOmpConnection(
   mcpConnector?: OmpMcpConnector,
   mcpInitializationTimeoutMs?: number,
   replayTimeoutMs?: number,
+  browserAuthorizationRegistry?: OmpBrowserAuthorizationRegistry,
+  reportDiagnostic: (diagnostic: OmpConnectionDiagnostic) => void = (diagnostic) =>
+    console.error("OMP provider failure", diagnostic),
 ): ProviderConnection {
+  const errorDetails = (error: unknown, fallback: string): { message: string } => {
+    if (isOmpPublicError(error)) return { message: error.message };
+    // The generated ID is the only correlation value we log. It also travels in the public
+    // request failure, avoiding any assumption that a caller-supplied request ID is value-safe.
+    const diagnosticId = randomUUID();
+    try {
+      reportDiagnostic({ diagnosticId, operation: fallback, ...classifyFailure(error) });
+    } catch {
+      // A diagnostic sink must never prevent the request from settling or its cleanup.
+    }
+    return { message: `${fallback} (diagnostic ${diagnosticId})` };
+  };
   const safeCapabilities = [...new Set(capabilities)].filter(
     (capability) =>
       SUPPORTED_CAPABILITIES[capability] &&
@@ -504,7 +678,12 @@ export function createOmpConnection(
   const listeners = new Set<(event: ProviderEvent) => void>();
   const sessions = new Map<
     string,
-    { token: symbol; session: OmpProviderSession; nativeSessionId?: string }
+    {
+      token: symbol;
+      session: OmpProviderSession;
+      nativeSessionId?: string;
+      removeBrowserAuthorization?: () => void;
+    }
   >();
   const opening = new Map<
     string,
@@ -525,6 +704,13 @@ export function createOmpConnection(
     if (closed) return;
     for (const listener of listeners) listener(event);
   };
+  const deleteSession = (sessionId: string, token: symbol): boolean => {
+    const slot = sessions.get(sessionId);
+    if (slot?.token !== token) return false;
+    sessions.delete(sessionId);
+    slot.removeBrowserAuthorization?.();
+    return true;
+  };
 
   const requestFailure = (
     requestId: string,
@@ -696,7 +882,7 @@ export function createOmpConnection(
             );
           };
           const retireRewindSession = () => {
-            if (sessions.get(input.sessionId)?.token === token) sessions.delete(input.sessionId);
+            deleteSession(input.sessionId, token);
           };
           session = await OmpProviderSession.open(
             input,
@@ -735,19 +921,36 @@ export function createOmpConnection(
             nativeReservations.release(nativeSessionId, token);
             return;
           }
-          sessions.set(input.sessionId, { token, session, nativeSessionId });
+          const browserAgentId = input.config.env.PASEO_AGENT_ID?.trim() || input.sessionId;
+          const browserAuthorization = browserAuthorizationRegistry?.register(
+            browserAgentId,
+            session.openPaseoBrowser.bind(session),
+          );
+          session.setBrowserAuthorizationIssuer(browserAuthorization?.issue ?? null);
+          const removeBrowserAuthorization = browserAuthorization
+            ? () => {
+                session?.setBrowserAuthorizationIssuer(null);
+                browserAuthorization.remove();
+              }
+            : undefined;
+          sessions.set(input.sessionId, {
+            token,
+            session,
+            nativeSessionId,
+            ...(removeBrowserAuthorization ? { removeBrowserAuthorization } : {}),
+          });
           await session.publishOpened(input.requestId);
           if (
             closing ||
             controller.signal.aborted ||
             opening.get(input.sessionId)?.token !== token
           ) {
-            if (sessions.get(input.sessionId)?.token === token) sessions.delete(input.sessionId);
+            deleteSession(input.sessionId, token);
             await session.close();
             nativeReservations.release(nativeSessionId, token);
           }
         } catch (error) {
-          if (sessions.get(input.sessionId)?.token === token) sessions.delete(input.sessionId);
+          deleteSession(input.sessionId, token);
           let cleanupError: unknown;
           if (session) {
             try {
@@ -841,11 +1044,11 @@ export function createOmpConnection(
         try {
           await slot.session.close();
         } catch (error) {
-          if (sessions.get(input.sessionId)?.token === slot.token) sessions.delete(input.sessionId);
+          deleteSession(input.sessionId, slot.token);
           quarantineFailedCleanup(input.sessionId, slot.token, error, slot.nativeSessionId);
           throw new OmpPublicError("OMP session close failed");
         }
-        if (sessions.get(input.sessionId)?.token === slot.token) sessions.delete(input.sessionId);
+        deleteSession(input.sessionId, slot.token);
         nativeReservations.release(slot.nativeSessionId, slot.token);
         emit({ type: "request.completed", requestId: input.requestId });
         return;
@@ -862,6 +1065,7 @@ export function createOmpConnection(
     shutdown.abort(shutdownReason);
     for (const { controller } of opening.values()) controller.abort(shutdownReason);
     for (const { session } of sessions.values()) session.beginConnectionShutdown();
+    for (const slot of sessions.values()) slot.removeBrowserAuthorization?.();
     const failures: unknown[] = [];
     const operationBatch = [...activeOperations];
     const operationResults = await Promise.allSettled(operationBatch);

package/server/provider/host-tools.ts

@@ -42,6 +42,8 @@ const MAX_PENDING_HOST_TOOL_CALLS = 64;
 const MAX_PENDING_HOST_TOOL_BYTES = 8 * 1024 * 1024;
 const DEFAULT_INITIALIZATION_TIMEOUT_MS = 20_000;
 const DEFAULT_MCP_CALL_LIFETIME_MS = 5 * 60 * 1000;
+const MAX_DIRECT_BROWSER_CALLS = 4;
+const BROWSER_CALL_TIMEOUT_MS = 20_000;
 
 export type OmpMcpTool = ConnectedMcpTool;
 export type OmpMcpToolPage = ConnectedMcpToolPage;
@@ -331,6 +333,17 @@ async function settleCleanup(promises: readonly Promise<void>[]): Promise<void>
     .map((result) => result.reason);
   if (failures.length > 0) throw new AggregateError(failures, "OMP MCP cleanup failed");
 }
+function paseoBrowserFailure(error: unknown): OmpPublicError {
+  const detail = error instanceof Error ? error.message : String(error);
+  if (/browser_no_host/iu.test(detail)) {
+    return new OmpPublicError("No Paseo desktop browser host is connected");
+  }
+  if (/browser_disabled/iu.test(detail)) {
+    return new OmpPublicError("Paseo browser tools are disabled on this host");
+  }
+  return new OmpPublicError("Paseo could not open the MCP authorization browser tab");
+}
+
 export class OmpHostToolsBridge {
   private runtime: OmpRuntimeSession | null = null;
   private readonly pending = new Map<string, PendingCall>();
@@ -338,6 +351,7 @@ export class OmpHostToolsBridge {
   private generation = 0;
   private closePromise: Promise<void> | null = null;
   private fatalHandler: ((error: Error) => void) | null = null;
+  private activeDirectBrowserCalls = 0;
 
   readonly labels: ReadonlyMap<string, string>;
   private constructor(
@@ -515,6 +529,63 @@ export class OmpHostToolsBridge {
   onFatal(handler: (error: Error) => void): void {
     this.fatalHandler = handler;
   }
+  async openPaseoBrowser(url: string): Promise<void> {
+    let parsed: URL;
+    try {
+      parsed = new URL(url);
+    } catch {
+      throw new OmpPublicError("MCP authorization URL is invalid");
+    }
+    if (
+      (parsed.protocol !== "http:" && parsed.protocol !== "https:") ||
+      parsed.username ||
+      parsed.password
+    ) {
+      throw new OmpPublicError("MCP authorization URL is not safe to open");
+    }
+    if (!this.runtime || this.closePromise) {
+      throw new OmpPublicError("The OMP session is not ready for browser authorization");
+    }
+    const target = this.targets.get("browser_new_tab");
+    if (!target) {
+      throw new OmpPublicError("Paseo browser tools are unavailable in this OMP session");
+    }
+    if (this.activeDirectBrowserCalls >= MAX_DIRECT_BROWSER_CALLS) {
+      throw new OmpPublicError("Too many Paseo browser requests are already running");
+    }
+
+    this.activeDirectBrowserCalls += 1;
+    const controller = new AbortController();
+    const deadline = this.callScheduler.set(
+      () => controller.abort(new Error("Paseo browser request timed out")),
+      BROWSER_CALL_TIMEOUT_MS,
+    );
+    try {
+      const result = normalizeResult(
+        await target.connection.callTool(
+          target.toolName,
+          { i: "Opening MCP authorization", url },
+          {
+            signal: controller.signal,
+            maxTotalTimeoutMs: BROWSER_CALL_TIMEOUT_MS,
+            onProgress() {},
+          },
+        ),
+      );
+      if (result.isError) {
+        const detail = result.content
+          .flatMap((part) => (part.type === "text" && part.text ? [part.text] : []))
+          .join("\n");
+        throw paseoBrowserFailure(new Error(detail));
+      }
+    } catch (error) {
+      if (error instanceof OmpPublicError) throw error;
+      throw paseoBrowserFailure(error);
+    } finally {
+      this.callScheduler.clear(deadline);
+      this.activeDirectBrowserCalls -= 1;
+    }
+  }
 
   handle(
     event: OmpHostToolCall | { type: "host_tool_cancel"; id: string; targetId: string },

package/server/provider/omp-rpc.ts

@@ -2,12 +2,14 @@ import { type ChildProcessWithoutNullStreams, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { isAbsolute, join } from "node:path";
 import { z } from "zod";
+import { ompDataDir } from "../paths";
 import { isValidImagePayload } from "./image";
 import { boundedJsonBytes, OmpCleanupFailure, OmpPublicError, utf8Bytes } from "./security";
 import {
   listOmpSessionDescriptors,
   type OmpSessionDescriptor,
   type OmpSessionListOptions,
+  readOmpPersistedSessionTranscript,
   readOmpPersistedSubagentTranscript,
   validateNativeSessionId,
 } from "./session-descriptors";
@@ -54,7 +56,9 @@ const MAX_PENDING_ONE_WAY_WRITES = 256;
 const MAX_PENDING_WRITE_BYTES = 8 * 1024 * 1024;
 const MAX_LINE_PARTS = 4_096;
 const MAX_ARRAY_ITEMS = 512;
-const MAX_CONTENT_PARTS = 64;
+// Tool-intensive OMP turns legitimately exceed 64 blocks; transport byte/node budgets remain the
+// primary resource bounds.
+export const OMP_MAX_CONTENT_PARTS = 4_096;
 const MAX_TODOS = 256;
 const MAX_ENV_ENTRIES = 256;
 const MAX_ENV_VALUE_LENGTH = 64 * 1024;
@@ -63,6 +67,9 @@ const MAX_PATH_LENGTH = 4_096;
 const WINDOWS_DEFAULT_SYSTEM_ROOT = "C:\\Windows";
 const MAX_TOKEN_COUNT = Number.MAX_SAFE_INTEGER;
 const MAX_COST_USD = 1_000_000_000;
+const MAX_RPC_ERROR_BYTES = 4_096;
+const MAX_RPC_ERROR_CODE_BYTES = 256;
+const PROMPT_SCHEDULING_FAILURE = "OMP prompt scheduling failed";
 const MAX_CONTEXT_PERCENT = 1_000_000;
 function boundedJsonString(maxBytes: number, minBytes = 0) {
   return z.string().refine((value) => {
@@ -142,11 +149,11 @@ const OmpContentPartSchema = z
   });
 const OmpDisplayContentSchema = z.union([
   TEXT,
-  z.array(OmpContentPartSchema).max(MAX_CONTENT_PARTS),
+  z.array(OmpContentPartSchema).max(OMP_MAX_CONTENT_PARTS),
 ]);
 const OmpImageArraySchema = z
   .array(OmpContentPartSchema)
-  .max(MAX_CONTENT_PARTS)
+  .max(OMP_MAX_CONTENT_PARTS)
   .superRefine((parts, context) => {
     if (parts.some((part) => part.type !== "image")) {
       context.addIssue({ code: "custom", message: "invalid image collection" });
@@ -259,7 +266,7 @@ const OmpAssistantMessageEventSchema = z
       .number()
       .int()
       .nonnegative()
-      .max(MAX_CONTENT_PARTS - 1)
+      .max(OMP_MAX_CONTENT_PARTS - 1)
       .optional(),
     delta: TEXT.optional(),
     content: z
@@ -387,7 +394,8 @@ const OmpResponseFrameSchema = z.object({
   id: IDENTIFIER,
   success: z.boolean(),
   data: z.unknown().optional(),
-  error: boundedString(4_096).optional(),
+  error: boundedString(MAX_RPC_ERROR_BYTES).optional(),
+  code: boundedString(MAX_RPC_ERROR_CODE_BYTES, 1).optional(),
 });
 const OmpChunkFrameSchema = z.object({
   type: z.literal("rpc_chunk"),
@@ -562,6 +570,7 @@ const OmpToolApprovalResponseSchema = z.union([
 ]);
 const OmpAgentEndEnvelopeSchema = z.object({
   type: z.literal("agent_end"),
+  requestId: IDENTIFIER.optional(),
   messageCount: z.number().int().nonnegative().optional(),
   isTerminal: z.boolean().optional(),
 });
@@ -582,6 +591,7 @@ const OmpAgentSessionEventSchema = z.discriminatedUnion("type", [
   z.object({ type: z.literal("agent_start") }),
   z.object({
     type: z.literal("agent_end"),
+    requestId: IDENTIFIER.optional(),
     messages: z.array(OmpMessageSchema).max(MAX_ARRAY_ITEMS).optional(),
     messageCount: z.number().int().nonnegative().optional(),
     isTerminal: z.boolean().optional(),
@@ -924,7 +934,7 @@ export function parseOmpHostToolAgentResult(value: unknown): OmpHostToolResult["
 }
 export type OmpRpcEvent =
   | z.infer<typeof OmpRuntimeEventSchema>
-  | { type: "prompt_error"; id: string; error: string }
+  | { type: "prompt_error"; id: string; error: string; code?: string }
   | { type: "process_exit"; error: string };
 export type OmpAgentSessionEvent = z.infer<typeof OmpAgentSessionEventSchema>;
 export type OmpSubagentSnapshot = z.infer<typeof OmpSubagentsResultSchema>["subagents"][number];
@@ -945,6 +955,12 @@ export interface OmpPersistedSubagentMessages {
   byteLength: number;
   messages: OmpMessage[];
 }
+export interface OmpPersistedSessionMessages {
+  sessionFile: string;
+  nativeSessionId: string;
+  byteLength: number;
+  messages: OmpMessage[];
+}
 
 export interface OmpStartOptions {
   cwd: string;
@@ -997,6 +1013,7 @@ export interface OmpRuntimeSession {
     message: string,
     images?: readonly OmpImage[],
     onAccepted?: () => void,
+    onRequested?: (requestId: string) => void,
   ): Promise<{ requestId: string; agentInvoked?: boolean }>;
   compact(customInstructions?: string): Promise<OmpCompactionResult>;
   setAutoCompaction(enabled: boolean): Promise<void>;
@@ -1022,6 +1039,12 @@ export interface OmpRuntime {
   readonly supportsPersistence: boolean;
   startSession(options: OmpStartOptions): Promise<OmpRuntimeSession>;
   listSessions(options: OmpSessionListOptions): Promise<OmpSessionDescriptor[]>;
+  readPersistedSessionTranscript?(options: {
+    sessionFile: string;
+    sessionId: string;
+    cwd: string;
+    signal?: AbortSignal;
+  }): Promise<OmpPersistedSessionMessages>;
   readPersistedSubagentTranscript(options: {
     parentSessionFile: string;
     childTranscriptId: string;
@@ -2074,7 +2097,11 @@ class OmpRpcProcess {
   private receiveKnownResponse(value: unknown): boolean {
     if (!value || typeof value !== "object" || Array.isArray(value)) return false;
     const frame = value as Record<string, unknown>;
-    if (frame.type !== "response" || typeof frame.id !== "string" || !this.pending.has(frame.id)) {
+    if (
+      frame.type !== "response" ||
+      typeof frame.id !== "string" ||
+      (!this.pending.has(frame.id) && !this.acceptedPromptIds.has(frame.id))
+    ) {
       return false;
     }
     this.receiveResponse(frame);
@@ -2088,19 +2115,15 @@ class OmpRpcProcess {
     if (!response.success) {
       if (rawId && knownPending) {
         this.takePending(rawId)?.reject(new Error("OMP RPC response is invalid"));
-      } else {
+      } else if (!rawId || !this.emitAcceptedPromptFailure(rawId, frame)) {
         this.recordProtocolViolation();
       }
       return;
     }
     const pending = this.pending.get(response.data.id);
     if (!pending) {
-      if (!response.data.success && this.acceptedPromptIds.delete(response.data.id)) {
-        this.emit({
-          type: "prompt_error",
-          id: response.data.id,
-          error: "OMP prompt scheduling failed",
-        });
+      if (!response.data.success) {
+        this.emitAcceptedPromptFailure(response.data.id, response.data);
       }
       return;
     }
@@ -2112,7 +2135,15 @@ class OmpRpcProcess {
       isBranchHistory || isHistory
         ? Math.min(MAX_REASSEMBLED_FRAME_BYTES, this.reassembledFrameLimit)
         : 2 * 1024 * 1024;
-    const responseNodeLimit = isBranchHistory ? 4_096 : isHistory ? 400_000 : 2_048;
+    // A model catalog contains up to 256 structured models, so its aggregate
+    // node budget must exceed the small state/command-response budget.
+    const responseNodeLimit = isBranchHistory
+      ? 4_096
+      : isHistory
+        ? 400_000
+        : pending.command === "get_available_models"
+          ? 16_384
+          : 2_048;
     if (
       boundedJsonBytes(
         frame,
@@ -2148,6 +2179,22 @@ class OmpRpcProcess {
     }
   }
 
+  private emitAcceptedPromptFailure(id: string, frame: Record<string, unknown>): boolean {
+    if (frame.success !== false || !this.acceptedPromptIds.delete(id)) return false;
+    const error = typeof frame.error === "string" ? frame.error : undefined;
+    const nativeError =
+      error && utf8Bytes(error) <= MAX_RPC_ERROR_BYTES ? error : PROMPT_SCHEDULING_FAILURE;
+    const code = typeof frame.code === "string" ? frame.code : undefined;
+    const nativeCode = code && utf8Bytes(code) <= MAX_RPC_ERROR_CODE_BYTES ? code : undefined;
+    this.emit({
+      type: "prompt_error",
+      id,
+      error: nativeError,
+      ...(nativeCode ? { code: nativeCode } : {}),
+    });
+    return true;
+  }
+
   private takePending(id: string): PendingRequest | undefined {
     const pending = this.pending.get(id);
     if (!pending) return undefined;
@@ -2595,6 +2642,7 @@ class OmpRpcSession implements OmpRuntimeSession {
     message: string,
     images: readonly OmpImage[] = [],
     onAccepted?: () => void,
+    onRequested?: (requestId: string) => void,
   ): Promise<{ requestId: string; agentInvoked?: boolean }> {
     const safeMessage = validateBoundedText(message, "prompt", MAX_TEXT_LENGTH);
     let acknowledgement: z.infer<typeof OmpPromptAckSchema> | undefined;
@@ -2606,6 +2654,7 @@ class OmpRpcSession implements OmpRuntimeSession {
         onAccepted?.();
       },
     );
+    onRequested?.(request.id);
     await request.promise;
     return { requestId: request.id, ...acknowledgement };
   }
@@ -2664,6 +2713,24 @@ export class OmpRpcRuntime implements OmpRuntime {
         listOmpSessionDescriptors(options, this.options.environment ?? process.env),
     );
   }
+  async readPersistedSessionTranscript(options: {
+    sessionFile: string;
+    sessionId: string;
+    cwd: string;
+    signal?: AbortSignal;
+  }): Promise<OmpPersistedSessionMessages> {
+    const transcript = await readOmpPersistedSessionTranscript(
+      options.sessionFile,
+      options.sessionId,
+      options.cwd,
+      options.signal,
+      join(ompDataDir(this.options.environment ?? process.env), "blobs"),
+    );
+    return {
+      ...transcript,
+      messages: z.array(OmpMessageSchema).max(100_000).parse(transcript.messages),
+    };
+  }
   async readPersistedSubagentTranscript(options: {
     parentSessionFile: string;
     childTranscriptId: string;