@openchambery/web 2.0.0-beta.9 → 2.0.0

package/server/lib/quota/DOCUMENTATION.md

@@ -38,6 +38,15 @@ These provider IDs are currently dispatchable via `fetchQuotaForProvider(provide
 - `providers/openai.js` exists for logic parity/reuse but is intentionally not registered for dispatcher ID routing.
 
 ## Response contract
+Provider credentials are read asynchronously from the current OpenCode service via
+`opencode/auth.js`; only the selected credential is used. Account switching and
+logout are observed on the next request, without file fallback or persisted secret
+cache. Credential-list transport/auth/schema failure rejects the configured-provider
+list instead of returning an authoritative empty list; per-provider quota requests
+return `ok: false` with a sanitized error. VS Code uses the same credential adapter.
+OpenChamber-owned quota cookies and Grok/Antigravity-specific stores retain their
+separate explicit sources; they are not legacy OpenCode `auth.json` fallbacks.
+
 All providers should return results via shared helpers to preserve API shape:
 - Required fields: `providerId`, `providerName`, `ok`, `configured`, `usage`, `fetchedAt`
 - Optional field: `error`

package/server/lib/quota/provider-credentials.test.js

@@ -0,0 +1,29 @@
+import { afterEach, expect, it, vi } from 'vitest';
+import { configureOpenCodeCredentials } from '../opencode/auth.js';
+import { fetchQuota as fetchCodexQuota } from './providers/codex.js';
+import { fetchQuotaForProvider, listConfiguredQuotaProviders } from './providers/index.js';
+
+afterEach(() => { configureOpenCodeCredentials(null); vi.unstubAllGlobals(); });
+
+it('quota requests follow the current active account, then stop sending after logout', async () => {
+  let access = 'first-account';
+  configureOpenCodeCredentials(() => ({ credential: { list: async () => access ? [{ id: 'selected', integrationID: 'openai', active: true, value: { type: 'oauth', access, refresh: 'refresh', expires: 123 } }] : [] } }));
+  const fetchMock = vi.fn(async () => Response.json({ rate_limit: { primary_window: { used_percent: 20 } } }));
+  vi.stubGlobal('fetch', fetchMock);
+  await fetchCodexQuota();
+  expect(fetchMock.mock.calls[0][1].headers.Authorization).toBe('Bearer first-account');
+  access = 'second-account';
+  await fetchCodexQuota();
+  expect(fetchMock.mock.calls[1][1].headers.Authorization).toBe('Bearer second-account');
+  access = '';
+  await expect(fetchCodexQuota()).resolves.toMatchObject({ ok: false, configured: false });
+  expect(fetchMock).toHaveBeenCalledTimes(2);
+});
+
+it('quota source failure remains an error with no upstream secret in the response', async () => {
+  configureOpenCodeCredentials(() => ({ credential: { list: async () => { throw new Error('secret-from-upstream'); } } }));
+  await expect(listConfiguredQuotaProviders()).rejects.toThrow('Unable to read OpenCode credentials');
+  const result = await fetchQuotaForProvider('codex');
+  expect(result).toMatchObject({ ok: false, error: 'Unable to read OpenCode credentials' });
+  expect(JSON.stringify(result)).not.toContain('secret-from-upstream');
+});

package/server/lib/quota/providers/claude.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -12,14 +12,14 @@ export const providerId = 'claude';
 export const providerName = 'Claude';
 const aliases = ['anthropic', 'claude'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.access || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const accessToken = entry?.access ?? entry?.token;
 

package/server/lib/quota/providers/codex.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -14,14 +14,14 @@ export const providerId = 'codex';
 export const providerName = 'Codex';
 const aliases = ['openai', 'codex', 'chatgpt'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.access || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const accessToken = entry?.access ?? entry?.token;
   const accountId = entry?.accountId;

package/server/lib/quota/providers/codex.test.js

@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 
 vi.mock('../../opencode/auth.js', () => ({
-  readAuthFile: () => ({ openai: { access: 'test-token' } }),
+  readOpenCodeCredentials: async () => ({ openai: { access: 'test-token' } }),
 }));
 
 import { fetchQuota } from './codex.js';

package/server/lib/quota/providers/copilot.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -42,14 +42,14 @@ export const providerId = 'github-copilot';
 export const providerName = 'GitHub Copilot';
 const aliases = ['github-copilot', 'copilot'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.access || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const accessToken = entry?.access ?? entry?.token;
 
@@ -107,7 +107,7 @@ export const providerIdAddon = 'github-copilot-addon';
 export const providerNameAddon = 'GitHub Copilot Add-on';
 
 export const fetchQuotaAddon = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const accessToken = entry?.access ?? entry?.token;
 

package/server/lib/quota/providers/google/auth.js

@@ -14,7 +14,7 @@ import {
   asNonEmptyString,
   toTimestamp
 } from '../../utils/index.js';
-import { readAuthFile } from '../../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../../opencode/auth.js';
 import { parseGoogleRefreshToken } from './transforms.js';
 
 const ANTIGRAVITY_GOOGLE_CLIENT_ID =
@@ -90,8 +90,8 @@ const resolveAntigravityAuth = () => {
   return null;
 };
 
-export const resolveGoogleAuthSources = () => {
-  const auth = readAuthFile();
+export const resolveGoogleAuthSources = async () => {
+  const auth = await readOpenCodeCredentials();
   const sources = [];
 
   const geminiAuth = resolveGeminiCliAuth(auth);

package/server/lib/quota/providers/google/index.js

@@ -17,10 +17,10 @@ export const providerId = 'google';
 export const providerName = 'Google';
 export const aliases = ['google', 'google.oauth'];
 
-export const isConfigured = () => resolveGoogleAuthSources().length > 0;
+export const isConfigured = async () => (await resolveGoogleAuthSources()).length > 0;
 
 export const fetchGoogleQuota = async () => {
-  const authSources = resolveGoogleAuthSources();
+  const authSources = await resolveGoogleAuthSources();
   if (!authSources.length) {
     return buildResult({
       providerId,

package/server/lib/quota/providers/index.js

@@ -130,16 +130,12 @@ const registry = {
   }
 };
 
-export const listConfiguredQuotaProviders = () => {
+export const listConfiguredQuotaProviders = async () => {
   const configured = [];
 
   for (const [id, provider] of Object.entries(registry)) {
-    try {
-      if (provider.isConfigured()) {
-        configured.push(id);
-      }
-    } catch {
-      // Ignore provider-specific config errors in list API.
+    if (await provider.isConfigured()) {
+      configured.push(id);
     }
   }
 

package/server/lib/quota/providers/index.test.js

@@ -11,7 +11,7 @@ describe('quota provider registry', () => {
     expect(typeof google.resolveGoogleAuthSources).toBe('function');
   });
 
-  it('can list configured providers without missing provider exports', () => {
-    expect(() => listConfiguredQuotaProviders()).not.toThrow();
+  it('reports unavailable credentials instead of an empty configured-provider list', async () => {
+    await expect(listConfiguredQuotaProviders()).rejects.toThrow('Unable to read OpenCode credentials');
   });
 });

package/server/lib/quota/providers/kimi.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -14,14 +14,14 @@ export const providerId = 'kimi-for-coding';
 export const providerName = 'Kimi for Coding';
 const aliases = ['kimi-for-coding', 'kimi'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.key || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/minimax-shared.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -138,14 +138,14 @@ const calculateUsage = (model, isTokenPlan) => {
 };
 
 export const createMiniMaxCodingPlanProvider = ({ providerId, providerName, aliases, tokenPlanUrl, codingPlanUrl }) => {
-  const isConfigured = () => {
-    const auth = readAuthFile();
+  const isConfigured = async () => {
+    const auth = await readOpenCodeCredentials();
     const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
     return Boolean(entry?.key || entry?.token);
   };
 
   const fetchQuota = async () => {
-    const auth = readAuthFile();
+    const auth = await readOpenCodeCredentials();
     const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
     const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/nanogpt.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -14,14 +14,14 @@ export const providerId = 'nano-gpt';
 export const providerName = 'NanoGPT';
 const aliases = ['nano-gpt', 'nanogpt', 'nano_gpt'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.key || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/openai.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -12,14 +12,14 @@ const providerId = 'openai';
 const providerName = 'OpenAI';
 const aliases = ['openai', 'codex', 'chatgpt'];
 
-const isConfigured = () => {
-  const auth = readAuthFile();
+const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.access || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const accessToken = entry?.access ?? entry?.token;
 

package/server/lib/quota/providers/openrouter.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -12,14 +12,14 @@ export const providerId = 'openrouter';
 export const providerName = 'OpenRouter';
 const aliases = ['openrouter'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.key || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/wafer.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -17,14 +17,14 @@ const aliases = ['wafer', 'wafer-ai', 'wafer_ai', 'wafer.ai'];
 const WAFER_QUOTA_URL = 'https://pass.wafer.ai/v1/inference/quota';
 const WAFER_WINDOW_SECONDS = 5 * 3600;
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.key || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/zai.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -15,14 +15,14 @@ export const providerId = 'zai-coding-plan';
 export const providerName = 'z.ai';
 const aliases = ['zai-coding-plan', 'zai', 'z.ai'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.key || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/zhipuai-coding-plan.js

@@ -25,8 +25,7 @@
  * @property {number} [nextResetTime]
  * @property {Array<{modelCode: string, usage: number}>} [usageDetails]
  */
-import { readAuthFile } from '../../opencode/auth.js';
-import { readConfigLayers } from '../../opencode/shared.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -40,8 +39,8 @@ export const providerId = 'zhipuai-coding-plan';
 export const providerName = 'Zhipu AI Coding Plan';
 const aliases = ['zhipuai-coding-plan', 'zhipuai', 'zhipu'];
 
-function getApiKey() {
-  const auth = readAuthFile();
+async function getApiKey() {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKeyFromAuth = entry?.key ?? entry?.token;
 
@@ -49,28 +48,15 @@ function getApiKey() {
     return apiKeyFromAuth;
   }
 
-  try {
-    const { mergedConfig } = readConfigLayers();
-
-    for (const alias of aliases) {
-      const providerConfig = mergedConfig?.provider?.[alias];
-      if (providerConfig?.options?.apiKey) {
-        return providerConfig.options.apiKey;
-      }
-    }
-  } catch {
-    // Ignore config read errors; the provider will be treated as not configured.
-  }
-
   return null;
 }
 
-export const isConfigured = () => {
-  return Boolean(getApiKey());
+export const isConfigured = async () => {
+  return Boolean(await getApiKey());
 };
 
 export const fetchQuota = async () => {
-  const apiKey = getApiKey();
+  const apiKey = await getApiKey();
 
   if (!apiKey) {
     return buildResult({

package/server/lib/quota/routes.js

@@ -28,7 +28,7 @@ export function registerQuotaRoutes(app, { getQuotaProviders }) {
   app.get('/api/quota/providers', async (_req, res) => {
     try {
       const { listConfiguredQuotaProviders } = await getQuotaProviders();
-      res.json({ providers: listConfiguredQuotaProviders() });
+      res.json({ providers: await listConfiguredQuotaProviders() });
     } catch (error) {
       console.error('Failed to list quota providers:', error);
       res.status(500).json({ error: error.message || 'Failed to list quota providers' });

package/server/lib/relay/DOCUMENTATION.md

@@ -39,7 +39,8 @@ Relay is not a separate link format: it is one transport candidate inside the un
 ## What travels the tunnel
 
 Everything a client normally sends to the single OpenChamber origin:
-- **HTTP** — REST endpoints and proxied OpenCode SDK calls under `/api/*`, plus `/auth/*` and `/health`.
+- **HTTP** — REST endpoints and proxied OpenCode SDK calls under `/api/*`, plus `/auth/*` and `/health`. On a packaged desktop client the UI origin is `openchamber-ui://` (`location.origin` is `"null"`) while the SDK still addresses the injected loopback. Relay mode tunnels those shell-local absolute `/api` `/auth` `/health` URLs; they must not fall through to the local OpenCode process.
+- **Events** — relay `auto` uses SSE (bearer), the same path mobile uses. Desktop WebSocket upgrades over the tunnel close and drop assistant deltas; an explicit `ws` setting is unchanged.
 - **SSE** — streamed responses opened through `runtimeFetch`, including `/api/openchamber/events` and SDK global SSE. Relay carries these HTTP response body frames through the tunnel.
 - **WebSocket** — the endpoints that use a real socket (the global event stream on platforms that support WS, terminal I/O, dictation, and Preview/Browser HMR under `/api/preview/proxy/<id>/...`).
 
@@ -117,6 +118,7 @@ Catalog loaders (`loadProviders` / `loadAgents`) and assistant Query keys gate w
 - The tunnel is transparent to the app: adding relay support to a feature should not require the feature to know the relay exists — it goes through the shared runtime transport helpers.
 - The two implementations stay byte-compatible and the wire format is versioned/negotiated so mixed client/host app versions degrade gracefully rather than break. The Layer 1 Relay does not inspect application versions; unsupported Host/Client features are omitted at the endpoints.
 - Host-control reconnect storms are bounded at both ends: the Host does not reset backoff on a brief `open`, and the Relay rate-limits host-control upgrades per IP and per `serverId` (`4029`) without replacing a live control socket.
+- Concurrent service starts recheck the endpoint's active Host after awaiting identity, so each endpoint has one managed Host and stopping the service closes every started Host.
 - Tunneled HTTP/WS always dial `getLocalPort()` on loopback; there is no client-selected target-port override on the host dispatcher.
 
 For the operational rules that keep future changes (new WebSocket endpoints, transport refactors, terminal/voice porting) from breaking this, load the `relay-transport` skill.

package/server/lib/relay/service.js

@@ -313,6 +313,7 @@ export const createRelayService = ({
     }
     const identity = await identityRuntime.getRelayIdentity();
     for (const relayUrl of pending) {
+      if (hostClients.has(relayUrl)) continue;
       const hostClient = startRelayHost({
         relayUrl,
         identity,

package/server/lib/relay/service.test.js

@@ -123,6 +123,19 @@ describe('relay service pairing endpoint', () => {
     delete process.env.OPENCHAMBER_RELAY_URL;
   });
 
+  it('starts only one host per endpoint during concurrent startup and stops every started host', async () => {
+    const { service, settings } = createTestRelayService({ hasRelayDemand: async () => true });
+    await settings.write({ privateRelay: { enabled: true, relayUrl: DEFAULT_RELAY_URL } });
+
+    try {
+      await Promise.all([service.reconcile(), service.reconcile()]);
+      expect(relayMocks.starts).toEqual([DEFAULT_RELAY_URL]);
+    } finally {
+      service.stop();
+    }
+    expect(relayMocks.stops).toEqual(relayMocks.starts);
+  });
+
   it('appends a new pairing endpoint (multi-relay) while keeping the primary', async () => {
     const { service, settings } = createTestRelayService();
 

package/server/lib/scheduled-tasks/DOCUMENTATION.md

@@ -8,6 +8,7 @@ Server-owned scheduled task runtime and routes for OpenChamber-only automation.
 - Runtime orchestration and execution is owned by this module.
 - Durable run history is owned by an independent SQLite store in this module.
 - This module is OpenChamber feature logic; it is intentionally separate from OpenCode proxy/runtime internals.
+- Prompt and goal execution preserve hash-prefixed text literally; no snippet discovery or expansion occurs before dispatch.
 
 ## Files
 
@@ -215,7 +216,13 @@ Every actual run (timer or manual):
        `message.list({ limit: 50, order: 'desc' })` (newest first) — never
        `order: 'asc'` page-0 + `at(-1)`, which reads an old page once the
        session exceeds the limit.
-     - Real terminal success requires an assistant tail with `time.completed`
+      - OpenCode 2.0.16 emits a native `idle` tail whose `outcome` is authoritative:
+        `succeeded` → success; `failed` / `interrupted` → error. An unknown idle
+        outcome keeps polling. Read it only after `session.active` confirms the
+        session is inactive; an older terminal record cannot settle live work.
+        This also applies to post-run continuation snapshots. Earlier servers
+        without idle records use the assistant-tail rules below.
+      - Assistant-tail terminal success requires `time.completed`
        and finish not `tool-calls` (prefer `finish: 'stop'`). `finish:
        'tool-calls'`, incomplete assistants (no `time.completed`), and
        non-assistant tails such as `model-switched` never succeed — including

package/server/lib/scheduled-tasks/runtime.js

@@ -2,7 +2,6 @@ import crypto from 'node:crypto';
 import { DateTime } from 'luxon';
 import parser from 'cron-parser';
 import { makeOpenCodeV2Client } from '../opencode/v2-client.js';
-import { expandSnippets } from '../opencode/snippets.js';
 import {
   getSessionGoalCapability,
   isSessionGoalSupported,
@@ -304,7 +303,7 @@ const isUserMessage = (info) => (
  * - finish tool-calls is mid-loop, never success
  * - incomplete (no time.completed) is never success
  * - model-switched / non-assistant tails are not success
- * - only a completed assistant with a real terminal finish succeeds
+ * - native idle outcomes settle the execution; older servers use assistant finish
  */
 const classifyMessageTail = (messages) => {
   if (!Array.isArray(messages) || messages.length === 0) {
@@ -317,6 +316,15 @@ const classifyMessageTail = (messages) => {
   if (!latest) {
     return { outcome: 'unknown' };
   }
+  if (latest.type === 'idle') {
+    if (latest.outcome === 'succeeded') {
+      return { outcome: 'success' };
+    }
+    if (latest.outcome === 'failed' || latest.outcome === 'interrupted') {
+      return { outcome: 'error', error: `session execution ${latest.outcome}` };
+    }
+    return { outcome: 'unknown' };
+  }
   if (isAssistantMessage(latest)) {
     if (latest.error) {
       return {
@@ -849,7 +857,7 @@ export const createScheduledTasksRuntime = (deps) => {
   };
 
   const buildPromptText = (task, projectPath) => {
-    const promptText = expandSnippets(task.execution.prompt, projectPath);
+    const promptText = task.execution.prompt;
     if (!task.execution.goalEnabled) {
       return promptText;
     }
@@ -874,7 +882,7 @@ export const createScheduledTasksRuntime = (deps) => {
     // back to an inline objective so parseGoalMetadata still accepts the
     // record. Oversized prompts are distilled into audit criteria by the
     // small model; on distill failure a head+tail excerpt keeps intent.
-    let objectiveText = expandSnippets(task.execution.prompt, projectPath);
+    let objectiveText = task.execution.prompt;
     if (objectiveText.length > 5000) {
       let distilled = null;
       try {