@p4code/cli 0.3.21 → 0.3.22

package/dist/bin.mjs

@@ -96,6 +96,7 @@ import * as RcMap from "effect/RcMap";
 import { FileFinder } from "@ff-labs/fff-node";
 import * as LayerMap from "effect/LayerMap";
 import * as Logger from "effect/Logger";
+import * as PartitionedSemaphore from "effect/PartitionedSemaphore";
 import * as NodeURL from "node:url";
 import { createOpencodeClient } from "@opencode-ai/sdk/v2";
 import { query } from "@anthropic-ai/claude-agent-sdk";
@@ -238,7 +239,7 @@ const make$91 = () => {
 const layer$82 = Layer.sync(NetService, make$91);
 //#endregion
 //#region package.json
-var version = "0.3.21";
+var version = "0.3.22";
 //#endregion
 //#region src/config.ts
 /**
@@ -1853,6 +1854,13 @@ const FUSION_NO_OBJECTION_TEXT = "[fusion-no-objection]";
 const FUSION_ADVICE_PROMPT_PREFIX = "[fusion-advice]";
 const FUSION_GATE_PROMPT_PREFIX = "[fusion-gate]";
 const FUSION_ACTIVATION_PROMPT_PREFIX = "[fusion-activation]";
+/**
+* Message-id namespaces for server-generated fusion wakes. Wake detection is
+* keyed off these rather than message text, which a user or expanded skill
+* could echo.
+*/
+const FUSION_REVIEW_MESSAGE_ID_PREFIX = "fusion-review:";
+const FUSION_GATE_MESSAGE_ID_PREFIX = "fusion-gate:";
 const FUSION_GATE_UNWATCHED_SUMMARY = "Gate passed unwatched";
 const FUSION_GATE_DEFAULT_TIMEOUT_MS = 12e4;
 const OrchestrationProposedPlanId = TrimmedNonEmptyString;
@@ -2452,6 +2460,19 @@ const ThreadSessionStopCommand = Schema$1.Struct({
 	threadId: ThreadId,
 	createdAt: IsoDateTime
 });
+/**
+* Force-terminates the provider session's owned OS process tree, separate from
+* the cooperative `thread.session.stop`. Acceptance surfaces through the
+* persisted command receipt, whose resultSequence points at the typed
+* `thread.session-force-stop-requested` event; terminal lifecycle stays on the
+* authoritative `thread.session-set`.
+*/
+const ThreadSessionForceStopCommand = Schema$1.Struct({
+	type: Schema$1.Literal("thread.session.force-stop"),
+	commandId: CommandId,
+	threadId: ThreadId,
+	createdAt: IsoDateTime
+});
 const ThreadPairCreateCommand = Schema$1.Struct({
 	type: Schema$1.Literal("thread-pair.create"),
 	commandId: CommandId,
@@ -2509,6 +2530,7 @@ const DispatchableClientOrchestrationCommand = Schema$1.Union([
 	ThreadUserInputRespondCommand,
 	ThreadCheckpointRevertCommand,
 	ThreadSessionStopCommand,
+	ThreadSessionForceStopCommand,
 	ThreadPairCreateCommand,
 	ThreadPairDetachCommand,
 	ThreadPairGateResolveCommand
@@ -2539,6 +2561,7 @@ const ClientOrchestrationCommand = Schema$1.Union([
 	ThreadUserInputRespondCommand,
 	ThreadCheckpointRevertCommand,
 	ThreadSessionStopCommand,
+	ThreadSessionForceStopCommand,
 	ThreadPairCreateCommand,
 	ThreadPairDetachCommand,
 	ThreadPairGateResolveCommand
@@ -2550,6 +2573,19 @@ const ThreadSessionSetCommand = Schema$1.Struct({
 	session: OrchestrationSession,
 	createdAt: IsoDateTime
 });
+/**
+* Server-only: atomic convergence of a confirmed force stop. The decider
+* expands it into durable cancellations for every open approval/user-input
+* request plus the authoritative `thread.session-set`, committed in one
+* transaction so a crash can never expose partially cancelled requests.
+*/
+const ThreadSessionForceStopConvergeCommand = Schema$1.Struct({
+	type: Schema$1.Literal("thread.session.force-stop.converge"),
+	commandId: CommandId,
+	threadId: ThreadId,
+	session: OrchestrationSession,
+	createdAt: IsoDateTime
+});
 const ThreadTurnCompleteCommand = Schema$1.Struct({
 	type: Schema$1.Literal("thread.turn.complete"),
 	commandId: CommandId,
@@ -2648,6 +2684,7 @@ const ThreadRevertCompleteCommand = Schema$1.Struct({
 });
 const InternalOrchestrationCommand = Schema$1.Union([
 	ThreadSessionSetCommand,
+	ThreadSessionForceStopConvergeCommand,
 	ThreadTurnCompleteCommand,
 	ThreadPairCursorAdvanceCommand,
 	ThreadPairGateOpenCommand,
@@ -2688,6 +2725,7 @@ const OrchestrationEventType = Schema$1.Literals([
 	"thread.checkpoint-revert-requested",
 	"thread.reverted",
 	"thread.session-stop-requested",
+	"thread.session-force-stop-requested",
 	"thread.session-set",
 	"thread.proposed-plan-upserted",
 	"thread.turn-diff-completed",
@@ -2883,6 +2921,10 @@ const ThreadSessionStopRequestedPayload = Schema$1.Struct({
 	threadId: ThreadId,
 	createdAt: IsoDateTime
 });
+const ThreadSessionForceStopRequestedPayload = Schema$1.Struct({
+	threadId: ThreadId,
+	createdAt: IsoDateTime
+});
 const ThreadSessionSetPayload$1 = Schema$1.Struct({
 	threadId: ThreadId,
 	session: OrchestrationSession
@@ -3124,6 +3166,11 @@ const OrchestrationEvent = Schema$1.Union([
 		type: Schema$1.Literal("thread.session-stop-requested"),
 		payload: ThreadSessionStopRequestedPayload
 	}),
+	Schema$1.Struct({
+		...EventBaseFields,
+		type: Schema$1.Literal("thread.session-force-stop-requested"),
+		payload: ThreadSessionForceStopRequestedPayload
+	}),
 	Schema$1.Struct({
 		...EventBaseFields,
 		type: Schema$1.Literal("thread.session-set"),
@@ -6481,6 +6528,23 @@ const ProviderInterruptTurnInput = Schema$1.Struct({
 	turnId: Schema$1.optional(TurnId)
 });
 const ProviderStopSessionInput = Schema$1.Struct({ threadId: ThreadId });
+/**
+* Result of a force stop. `unsupported` means a live session exists on an
+* adapter without a registered owned process (the Claude Agent SDK owns its
+* child privately), so live force termination is refused rather than faked.
+*/
+const ProviderForceStopSessionOutcome = Schema$1.Literals([
+	"terminated",
+	"already-exited",
+	"kill-timeout",
+	"no-owned-process",
+	"unsupported"
+]);
+Schema$1.Struct({
+	outcome: ProviderForceStopSessionOutcome,
+	provider: Schema$1.NullOr(Schema$1.String),
+	pid: Schema$1.NullOr(Schema$1.Number)
+});
 const ProviderRespondToRequestInput = Schema$1.Struct({
 	threadId: ThreadId,
 	requestId: ApprovalRequestId,
@@ -27177,6 +27241,99 @@ const decideOrchestrationCommand = Effect.fn("decideOrchestrationCommand")(funct
 					createdAt: command.createdAt
 				}
 			};
+		case "thread.session.force-stop":
+			yield* requireThread({
+				readModel,
+				command,
+				threadId: command.threadId
+			});
+			return {
+				...yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt: command.createdAt,
+					commandId: command.commandId
+				}),
+				type: "thread.session-force-stop-requested",
+				payload: {
+					threadId: command.threadId,
+					createdAt: command.createdAt
+				}
+			};
+		case "thread.session.force-stop.converge": {
+			const thread = yield* requireThread({
+				readModel,
+				command,
+				threadId: command.threadId
+			});
+			const openRequests = /* @__PURE__ */ new Map();
+			for (const activity of thread.activities) {
+				const payload = typeof activity.payload === "object" && activity.payload !== null ? activity.payload : null;
+				const requestId = typeof payload?.requestId === "string" ? payload.requestId : null;
+				if (requestId === null) continue;
+				if (activity.kind === "approval.requested") openRequests.set(requestId, {
+					category: "approval",
+					requestedAt: activity.createdAt
+				});
+				else if (activity.kind === "user-input.requested") openRequests.set(requestId, {
+					category: "user-input",
+					requestedAt: activity.createdAt
+				});
+				else if (activity.kind === "approval.resolved" || activity.kind === "user-input.resolved") openRequests.delete(requestId);
+			}
+			let resolvedAtMillis = Date.parse(command.createdAt);
+			for (const request of openRequests.values()) {
+				const requestedAtMillis = Date.parse(request.requestedAt);
+				if (!Number.isNaN(requestedAtMillis)) resolvedAtMillis = Math.max(resolvedAtMillis, requestedAtMillis + 1);
+			}
+			const resolvedAt = DateTime.formatIso(DateTime.makeUnsafe(resolvedAtMillis));
+			const events = [];
+			for (const [requestId, request] of openRequests) {
+				const base = yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt: resolvedAt,
+					commandId: command.commandId
+				});
+				events.push({
+					...base,
+					type: "thread.activity-appended",
+					payload: {
+						threadId: command.threadId,
+						activity: {
+							id: base.eventId,
+							tone: "info",
+							kind: request.category === "approval" ? "approval.resolved" : "user-input.resolved",
+							summary: request.category === "approval" ? "Approval request cancelled by force stop" : "User input request cancelled by force stop",
+							payload: {
+								requestId,
+								detail: "Cancelled by session force stop."
+							},
+							turnId: null,
+							createdAt: resolvedAt
+						}
+					}
+				});
+			}
+			events.push({
+				...yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt: resolvedAt,
+					commandId: command.commandId,
+					metadata: {}
+				}),
+				type: "thread.session-set",
+				payload: {
+					threadId: command.threadId,
+					session: {
+						...command.session,
+						updatedAt: resolvedAt
+					}
+				}
+			});
+			return events;
+		}
 		case "thread.session.set": {
 			const thread = yield* requireThread({
 				readModel,
@@ -65016,6 +65173,102 @@ const ProviderEventLoggersLive = Layer.effect(ProviderEventLoggers, Effect.gen(f
 	};
 }));
 //#endregion
+//#region src/provider/ProviderOwnedProcessRegistry.ts
+/**
+* ProviderOwnedProcessRegistry - threadId to owned provider process handles.
+*
+* Long-lived provider session runtimes (Codex, ACP for Cursor/Grok, Muse,
+* OpenCode) register the child process they spawned for a thread. Force stop
+* kills only through a registered handle while that handle still observes its
+* process as running. The Claude Agent SDK owns its child privately and never
+* registers here; live force termination for it is unsupported by design.
+*
+* Identity model (fail-closed):
+* - `handle.isRunning` derives from the spawner's exit Deferred, resolved by
+*   Node's kernel-held child handle - it identifies the direct child without
+*   probing numeric PIDs, so a recycled PID can never look "running".
+* - Kill is attempted only while the handle observes the child running. On
+*   POSIX the child leads its own process group, and a live leader keeps that
+*   pgid owned, so the spawner's group kill cannot hit a recycled group.
+* - Once the handle observes exit, nothing is ever signalled: cleanup of
+*   surviving detached grandchildren after leader exit is explicitly
+*   unsupported, because no safe identity for the group remains. The residual
+*   check-to-kill window is the same one the spawner's own scope finalizer
+*   has, and is not widened here.
+*
+* Concurrency: every mutation of the registry - register, deregister, exit
+* observation, force stop - runs inside the same per-thread critical section,
+* so a force stop can never act on a replaced or exited generation.
+*/
+const FORCE_STOP_SIGKILL_ESCALATION = Duration.seconds(2);
+const FORCE_STOP_EXIT_BOUND = Duration.seconds(5);
+let generationCounter = 0;
+const entries = /* @__PURE__ */ new Map();
+const threadLocks = PartitionedSemaphore.makeUnsafe({ permits: 1 });
+/**
+* Records the owned child process for a thread and watches its exit so a dead
+* generation can never be killed. Returns the registration to pass back to
+* {@link deregisterOwnedProcess} on scope close. Re-registering a thread
+* replaces the previous generation.
+*/
+const registerOwnedProcess = (input) => threadLocks.withPermit(input.threadId)(Effect.gen(function* () {
+	generationCounter += 1;
+	const entry = {
+		threadId: input.threadId,
+		generation: generationCounter,
+		handle: input.handle,
+		exited: false
+	};
+	entries.set(input.threadId, entry);
+	yield* input.handle.exitCode.pipe(Effect.ignore, Effect.andThen(threadLocks.withPermit(input.threadId)(Effect.sync(() => {
+		entry.exited = true;
+		if (entries.get(input.threadId) === entry) entries.delete(input.threadId);
+	}))), Effect.forkDetach);
+	return {
+		threadId: input.threadId,
+		generation: entry.generation
+	};
+}));
+/** Removes the registration if this exact generation still owns the thread. */
+const deregisterOwnedProcess = (registration) => threadLocks.withPermit(registration.threadId)(Effect.sync(() => {
+	if (entries.get(registration.threadId)?.generation === registration.generation) entries.delete(registration.threadId);
+}));
+/**
+* Force-terminates the registered owned process for a thread. The whole
+* decision-and-kill runs in the per-thread critical section, so the entry it
+* captured cannot be replaced or reaped concurrently. Bounded and idempotent:
+* repeats after the process is gone report `no-owned-process` or
+* `already-exited` without signalling anything, and a `kill-timeout` keeps the
+* registration for retry instead of pretending convergence.
+*/
+const forceStopOwnedProcess = (threadId, options) => threadLocks.withPermit(threadId)(Effect.gen(function* () {
+	const entry = entries.get(threadId);
+	if (entry === void 0) return { outcome: "no-owned-process" };
+	const pid = Number(entry.handle.pid);
+	const running = yield* entry.handle.isRunning.pipe(Effect.orElseSucceed(() => false));
+	if (entry.exited || !running) {
+		entry.exited = true;
+		if (entries.get(threadId) === entry) entries.delete(threadId);
+		return {
+			outcome: "already-exited",
+			pid
+		};
+	}
+	if (!(yield* entry.handle.kill({
+		killSignal: "SIGTERM",
+		forceKillAfter: options?.sigkillAfter ?? FORCE_STOP_SIGKILL_ESCALATION
+	}).pipe(Effect.andThen(entry.handle.exitCode.pipe(Effect.ignore)), Effect.timeout(options?.exitBound ?? FORCE_STOP_EXIT_BOUND), Effect.as(true), Effect.orElseSucceed(() => false)))) return {
+		outcome: "kill-timeout",
+		pid
+	};
+	entry.exited = true;
+	if (entries.get(threadId) === entry) entries.delete(threadId);
+	return {
+		outcome: "terminated",
+		pid
+	};
+}));
+//#endregion
 //#region src/mcp/McpProviderSession.ts
 /**
 * The name p4code declares its own toolkit under, in every provider.
@@ -65826,6 +66079,53 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 			outcomeAttributes: () => providerMetricAttributes(metricProvider, { operation: "stop" })
 		}));
 	});
+	const forceStopSession = Effect.fn("forceStopSession")(function* (rawInput) {
+		const input = yield* decodeInputOrValidationError({
+			operation: "ProviderService.forceStopSession",
+			schema: ProviderStopSessionInput,
+			payload: rawInput
+		});
+		const routed = yield* resolveRoutableSession({
+			threadId: input.threadId,
+			operation: "ProviderService.forceStopSession",
+			allowRecovery: false
+		}).pipe(Effect.catchCause(() => Effect.succeed(null)));
+		const owned = yield* forceStopOwnedProcess(input.threadId);
+		const provider = routed?.adapter.provider ?? null;
+		if (owned.outcome === "no-owned-process" && routed !== null && routed.isActive) return {
+			outcome: "unsupported",
+			provider,
+			pid: null
+		};
+		if (owned.outcome === "kill-timeout") {
+			yield* analytics.record("provider.session.force-stopped", {
+				provider: provider ?? "unknown",
+				outcome: owned.outcome
+			});
+			return {
+				outcome: owned.outcome,
+				provider,
+				pid: owned.pid
+			};
+		}
+		yield* clearMcpSession(input.threadId);
+		if (routed !== null) yield* directory.upsert({
+			threadId: input.threadId,
+			provider: routed.adapter.provider,
+			providerInstanceId: routed.instanceId,
+			status: "stopped",
+			runtimePayload: { activeTurnId: null }
+		});
+		yield* analytics.record("provider.session.force-stopped", {
+			provider: provider ?? "unknown",
+			outcome: owned.outcome
+		});
+		return {
+			outcome: owned.outcome,
+			provider,
+			pid: "pid" in owned ? owned.pid : null
+		};
+	});
 	const listSessions = Effect.fn("listSessions")(function* () {
 		const currentAdapters = yield* getAdapterEntries;
 		const activeSessions = (yield* Effect.forEach(currentAdapters, ([instanceId, adapter]) => adapter.listSessions().pipe(Effect.map((sessions) => sessions.map((session) => ({
@@ -65928,6 +66228,7 @@ const makeProviderService = Effect.fn("makeProviderService")(function* (options)
 		respondToRequest,
 		respondToUserInput,
 		stopSession,
+		forceStopSession,
 		listSessions,
 		getCapabilities,
 		getInstanceInfo,
@@ -66418,6 +66719,13 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 		});
 		const terminateChild = killOpenCodeProcessGroup("SIGTERM").pipe(Effect.andThen(Effect.sleep("1 second")), Effect.andThen(killOpenCodeProcessGroup("SIGKILL")), Effect.ignore);
 		yield* Scope.addFinalizer(runtimeScope, terminateChild);
+		if (input.threadId !== void 0) {
+			const ownedProcess = yield* registerOwnedProcess({
+				threadId: input.threadId,
+				handle: child
+			});
+			yield* Scope.addFinalizer(runtimeScope, deregisterOwnedProcess(ownedProcess));
+		}
 		const stdoutRef = yield* Ref.make("");
 		const stderrRef = yield* Ref.make("");
 		const readyDeferred = yield* Deferred.make();
@@ -66478,7 +66786,8 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 			...input.environment !== void 0 ? { environment: input.environment } : {},
 			...input.port !== void 0 ? { port: input.port } : {},
 			...input.hostname !== void 0 ? { hostname: input.hostname } : {},
-			...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : {}
+			...input.timeoutMs !== void 0 ? { timeoutMs: input.timeoutMs } : {},
+			...input.threadId !== void 0 ? { threadId: input.threadId } : {}
 		}).pipe(Effect.map((server) => ({
 			url: server.url,
 			exitCode: server.exitCode,
@@ -90764,6 +91073,11 @@ const makeCodexSessionRuntime = (options) => Effect.gen(function* () {
 		command: `${options.binaryPath} app-server`,
 		cause
 	})));
+	const ownedProcess = yield* registerOwnedProcess({
+		threadId: options.threadId,
+		handle: child
+	});
+	yield* Scope.addFinalizer(runtimeScope, deregisterOwnedProcess(ownedProcess));
 	const clientContext = yield* layerChildProcess$1(child).pipe(Layer.build, Effect.provideService(Scope.Scope, runtimeScope));
 	const client = yield* Effect.service(CodexAppServerClient).pipe(Effect.provide(clientContext));
 	const serverNotifications = yield* Queue.unbounded();
@@ -96798,6 +97112,13 @@ const make$6 = (options) => Effect.gen(function* () {
 		command: options.spawn.command,
 		cause
 	})));
+	if (options.threadId !== void 0) {
+		const ownedProcess = yield* registerOwnedProcess({
+			threadId: options.threadId,
+			handle: child
+		});
+		yield* Scope.addFinalizer(runtimeScope, deregisterOwnedProcess(ownedProcess));
+	}
 	const acpContext = yield* Layer.build(layerChildProcess(child, {
 		...options.protocolLogging?.logIncoming !== void 0 ? { logIncoming: options.protocolLogging.logIncoming } : {},
 		...options.protocolLogging?.logOutgoing !== void 0 ? { logOutgoing: options.protocolLogging.logOutgoing } : {},
@@ -98577,6 +98898,7 @@ function makeCursorAdapter(cursorSettings, options) {
 				cursorSettings: effectiveCursorSettings,
 				...options?.environment ? { environment: options.environment } : {},
 				childProcessSpawner,
+				threadId: input.threadId,
 				cwd,
 				...resumeSessionId ? { resumeSessionId } : {},
 				clientInfo: {
@@ -99810,6 +100132,7 @@ function makeGrokAdapter(grokSettings, options) {
 				grokSettings,
 				...options?.environment ? { environment: options.environment } : {},
 				childProcessSpawner,
+				threadId: input.threadId,
 				cwd,
 				...resumeSessionId ? { resumeSessionId } : {},
 				clientInfo: {
@@ -101294,6 +101617,11 @@ const runMuseExec = Effect.fn("runMuseExec")(function* (input) {
 		detail: "Failed to spawn `muse exec`.",
 		cause
 	})));
+	const ownedProcess = yield* registerOwnedProcess({
+		threadId: input.threadId,
+		handle: child
+	});
+	yield* Scope.addFinalizer(runScope, deregisterOwnedProcess(ownedProcess));
 	const stderrRef = yield* Ref.make("");
 	const interruptedRef = yield* Ref.make(false);
 	const stdoutFiber = yield* child.stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.runForEach(input.onLine), Effect.ignore, Effect.forkIn(runScope));
@@ -103181,6 +103509,7 @@ function makeOpenCodeAdapter(openCodeSettings, options) {
 					const server = yield* openCodeRuntime.connectToOpenCodeServer({
 						binaryPath,
 						serverUrl,
+						threadId: input.threadId,
 						...options?.environment ? { environment: options.environment } : {}
 					});
 					const client = openCodeRuntime.createOpenCodeSdkClient({
@@ -105204,6 +105533,22 @@ const resolvePendingMcpUserInput = Effect.fn("pendingMcpUserInputs.resolve")(fun
 const forgetPendingMcpUserInput = (threadId, requestId) => {
 	if (pending.get(requestId)?.threadId === threadId) pending.delete(requestId);
 };
+/** Ids of the questions a thread has open right now (force-stop snapshot). */
+const listPendingMcpUserInputRequestIds = (threadId) => [...pending].filter(([, request]) => request.threadId === threadId).map(([requestId]) => requestId);
+/**
+* Cancels one pending MCP question (force stop). Interrupts the Deferred
+* before dropping the entry so the MCP handler blocked on it completes
+* instead of leaking a suspended fiber. Targeted by request id; the caller
+* owns the guarantee that the id belongs to the session being killed -
+* either a pre-kill snapshot, or a re-list taken while the doomed session's
+* generation is confirmed unchanged and before any stopped state is written.
+*/
+const failPendingMcpUserInput = Effect.fn("pendingMcpUserInputs.fail")(function* (threadId, requestId) {
+	const request = pending.get(requestId);
+	if (request?.threadId !== threadId) return;
+	pending.delete(requestId);
+	yield* Deferred.interrupt(request.answers);
+});
 //#endregion
 //#region src/mcp/toolkits/threads/handlers.ts
 const DEFAULT_MEMORY_APPEND_TARGET = "CLAUDE.md";
@@ -107524,7 +107869,22 @@ const DEFAULT_RUNTIME_MODE = "full-access";
 const DEFAULT_THREAD_TITLE = "New thread";
 const NON_SYSTEM_PROVIDER_STRUCTURED_USER_QUESTIONS = structuredUserQuestionPrompt("your provider's structured user-input question tool");
 const FUSION_PROMOTION_INSTRUCTIONS = `Work independently in this normal thread. Fusion is a silent escalation path, not a startup procedure. Do not inspect Fusion tools/skill, mention Fusion status, or announce that Fusion was not invoked. First analyze the task normally. Only if that analysis reveals a concrete unresolved tradeoff, correctness risk, or design decision materially needing a second opinion, stop before implementation, propose Fusion, and ask the user for explicit approval. The user may approve with ordinary affirmative text such as "approved"; /fusion or $fusion also authorizes Fusion directly without a prior proposal. Do not activate, spawn, or promote until one of those authorizations arrives. UI work, complex logic, task size, unfamiliarity, or duration alone never qualifies.`;
-const FUSION_BUILDER_INSTRUCTIONS = `You are Fusion Builder in an already-created native server pair. Server owns pairing and coordination. Do not inspect or invoke the Fusion skill, create/pair/rename threads, or announce/setup Fusion. Start the user's task directly. Before editing, create and maintain a visible task todo split into small independently reviewable phases plus a final integration/whole-task phase. Complete exactly one phase per turn. End every phase turn with phase completed, todo status, changed behavior/files, verification, and remaining phases; do not start the next phase in the same turn. Server then wakes the paired Supervisor, which resumes you through ${FUSION_ADVICE_PROMPT_PREFIX}; a user message may also revise or resume the work. Final phase verifies the entire task against the original request and labels it ready for whole-task review. Supervisor is unreachable during your turn. Never spawn/use another Supervisor thread/subagent or attribute Supervisor decisions without ${FUSION_ADVICE_PROMPT_PREFIX}. Within the current phase, continue when straightforward or evidence is clear. For a concrete unresolved tradeoff, correctness risk, or design decision materially needing judgment, stop safely before the risky choice; final response states the exact question and why review is needed. Evaluate/follow Supervisor advice unless conflicting with user request or verified repo state.`;
+const FUSION_BUILDER_INSTRUCTIONS = `You are Fusion Builder in an already-created native server pair. Server owns pairing and coordination. Do not inspect or invoke the Fusion skill, create/pair/rename threads, or announce/setup Fusion. Start the user's task directly. Before editing, create and maintain the phase list in the same plan/todo tool you use for ordinary step tracking, never the MCP task board tools - one entry per phase in order, exactly one in progress at a time, marked completed at each phase end - so phases render in the task banner. That list holds phase entries only for the whole task; keep step-level or per-file todos out of it. Prose alone leaves the banner empty. Split it into the fewest substantial phases the task genuinely needs plus a final integration/whole-task phase; most tasks need one to three work phases. Each phase is a complete reviewable slice of behavior. Never split per file, per function, or per trivial step: over-splitting spends review turns instead of finishing the job. Add a phase only when a real review boundary, risky decision, or independent behavior separates the work. Complete exactly one phase per turn, and finish the whole phase in that turn rather than stopping early. Do not run tests, typecheck, lint, or builds per phase; write the tests the change needs, then run verification once in the final phase over the whole task. Exception: a phase whose own correctness is unclear may run the single narrowest check that resolves it. End every phase turn with phase completed, todo status, changed behavior/files, and remaining phases; do not start the next phase in the same turn. Server then wakes the paired Supervisor, which resumes you through ${FUSION_ADVICE_PROMPT_PREFIX}; a user message may also revise or resume the work. Final phase verifies the entire task against the original request and labels it ready for whole-task review. Supervisor is unreachable during your turn. Never spawn/use another Supervisor thread/subagent or attribute Supervisor decisions without ${FUSION_ADVICE_PROMPT_PREFIX}. Within the current phase, continue when straightforward or evidence is clear. For a concrete unresolved tradeoff, correctness risk, or design decision materially needing judgment, stop safely before the risky choice; final response states the exact question and why review is needed. Evaluate/follow Supervisor advice unless conflicting with user request or verified repo state.`;
+const FUSION_WATCHER_INSTRUCTIONS = `You are Fusion Supervisor (watcher) in an already-created native server pair. Server owns pairing and coordination and wakes you with ${FUSION_REVIEW_PROMPT_PREFIX} or ${FUSION_GATE_PROMPT_PREFIX} prompts at builder turn boundaries; this message arrived outside such a wake, so your conversational memory of the pair may be gone. The pair metadata below is authoritative: the builder thread exists and is the counterpart thread id. Never report that no builder thread exists. To resume supervision, read builder events with thread_watch_events from lastReviewedImplementerSequence with limit 50, paging forward with the last returned sequence rather than requesting a whole range at once, derive phase from artifacts (git log/status, PR, builder events), steer with thread_advise, and answer an open gate with thread_gate_respond. When a review or gate wake prompt specifies an explicit event range, that range wins over this metadata. Never poll or wait for the builder; deliver review or advice, then end the turn.`;
+const isFusionWatcherWakeMessageId = (messageId) => messageId.startsWith("fusion-review:") || messageId.startsWith("fusion-gate:");
+const fusionPairContext = (pair, role) => {
+	const counterpartThreadId = role === "implementer" ? pair.watcherThreadId : pair.implementerThreadId;
+	return [
+		"[fusion-pair]",
+		`role: ${role}`,
+		`pairId: ${pair.id}`,
+		`counterpartThreadId: ${counterpartThreadId}`,
+		`roundCap: ${pair.roundCap}`,
+		`gateTimeoutMs: ${pair.gateTimeoutMs}`,
+		`lastReviewedImplementerSequence: ${pair.lastReviewedImplementerSequence}`,
+		`activeGate: ${pair.activeGate === null ? "none" : JSON.stringify(pair.activeGate)}`
+	].join("\n");
+};
 function providerErrorLabel(value) {
 	const normalized = value?.trim();
 	return normalized && normalized.length > 0 ? normalized : "unknown";
@@ -107609,6 +107969,7 @@ const make$3 = Effect.gen(function* () {
 	const vcsStatusBroadcaster = yield* VcsStatusBroadcaster;
 	const textGeneration = yield* TextGeneration;
 	const serverSettingsService = yield* ServerSettingsService;
+	const threadBackgroundLiveness = yield* ThreadBackgroundLivenessService;
 	const serverConfig = yield* ServerConfig$1;
 	const serverCommandId = (tag) => crypto.randomUUIDv4.pipe(Effect.map((uuid) => CommandId.make(`server:${tag}:${uuid}`)));
 	const serverEventId = () => crypto.randomUUIDv4.pipe(Effect.map(EventId.make));
@@ -108094,7 +108455,7 @@ const make$3 = Effect.gen(function* () {
 		].filter((part) => part !== void 0).join("\n\n");
 		const activeFusionPair = ((yield* projectionSnapshotQuery.getCommandReadModel()).threadPairs ?? []).find((pair) => pair.detachedAt === null && (pair.implementerThreadId === input.threadId || pair.watcherThreadId === input.threadId));
 		const isFusionBuilder = activeFusionPair?.implementerThreadId === input.threadId;
-		const fusionInput = expandedInputWithDocuments === void 0 ? void 0 : activeFusionPair === void 0 ? `${FUSION_PROMOTION_INSTRUCTIONS}\n\n${expandedInputWithDocuments}` : isFusionBuilder ? `${FUSION_BUILDER_INSTRUCTIONS}\n\n${expandedInputWithDocuments}` : expandedInputWithDocuments;
+		const fusionInput = expandedInputWithDocuments === void 0 ? void 0 : activeFusionPair === void 0 ? `${FUSION_PROMOTION_INSTRUCTIONS}\n\n${expandedInputWithDocuments}` : isFusionBuilder ? `${FUSION_BUILDER_INSTRUCTIONS}\n\n${fusionPairContext(activeFusionPair, "implementer")}\n\n${expandedInputWithDocuments}` : isFusionWatcherWakeMessageId(input.messageId) ? expandedInputWithDocuments : `${FUSION_WATCHER_INSTRUCTIONS}\n\n${fusionPairContext(activeFusionPair, "watcher")}\n\n${expandedInputWithDocuments}`;
 		const activeSession = yield* providerService.listSessions().pipe(Effect.map((sessions) => sessions.find((session) => session.threadId === input.threadId)));
 		const providerHasStructuredQuestionSystemPrompt = activeSession?.provider === "claudeAgent" || activeSession?.provider === "codex";
 		const inputWithStructuredQuestionPolicy = fusionInput !== void 0 && !providerHasStructuredQuestionSystemPrompt ? `${NON_SYSTEM_PROVIDER_STRUCTURED_USER_QUESTIONS}\n\n${fusionInput}` : fusionInput;
@@ -108260,6 +108621,7 @@ const make$3 = Effect.gen(function* () {
 		})));
 		const sendTurnRequest = yield* buildSendTurnRequestForThread({
 			threadId: event.payload.threadId,
+			messageId: message.id,
 			messageText: message.text,
 			...message.attachments !== void 0 ? { attachments: message.attachments } : {},
 			...event.payload.modelSelection !== void 0 ? { modelSelection: event.payload.modelSelection } : {},
@@ -108368,6 +108730,54 @@ const make$3 = Effect.gen(function* () {
 			createdAt: now
 		});
 	});
+	const processSessionForceStopRequested = Effect.fn("processSessionForceStopRequested")(function* (event) {
+		const thread = yield* resolveThread(event.payload.threadId);
+		if (!thread) return;
+		const now = event.payload.createdAt;
+		const pendingInputIdsBeforeKill = listPendingMcpUserInputRequestIds(thread.id);
+		const result = yield* providerService.forceStopSession({ threadId: thread.id }).pipe(Effect.catchCause((cause) => Effect.logWarning("provider session force stop failed", {
+			threadId: thread.id,
+			cause: Cause.pretty(cause)
+		}).pipe(Effect.as(null))));
+		if (result === null || result.outcome === "kill-timeout" || result.outcome === "unsupported") {
+			yield* appendProviderFailureActivity({
+				threadId: thread.id,
+				kind: "provider.session.force-stop.failed",
+				summary: "Force stop failed",
+				detail: result === null ? "Force stop failed before reaching the provider process." : result.outcome === "unsupported" ? `The active ${result.provider ?? "provider"} session does not expose a server-owned process; force stop is not supported while it runs.` : `The provider process (pid ${result.pid}) did not exit within the bound; the session was left running for retry.`,
+				turnId: thread.session?.activeTurnId ?? null,
+				createdAt: now
+			});
+			return;
+		}
+		yield* Effect.forEach(pendingInputIdsBeforeKill, (requestId) => failPendingMcpUserInput(thread.id, requestId), { discard: true });
+		const current = yield* resolveThread(event.payload.threadId);
+		if (!current) return;
+		if (!((current.session?.updatedAt ?? null) === (thread.session?.updatedAt ?? null) && (current.session?.activeTurnId ?? null) === (thread.session?.activeTurnId ?? null))) {
+			yield* Effect.logInfo("force stop superseded by a newer session; skipping convergence", { threadId: thread.id });
+			return;
+		}
+		yield* Effect.forEach(listPendingMcpUserInputRequestIds(thread.id), (requestId) => failPendingMcpUserInput(thread.id, requestId), { discard: true });
+		yield* serverCommandId("provider-session-force-converge").pipe(Effect.flatMap((commandId) => orchestrationEngine.dispatch({
+			type: "thread.session.force-stop.converge",
+			commandId,
+			threadId: thread.id,
+			session: {
+				threadId: thread.id,
+				status: "stopped",
+				providerName: current.session?.providerName ?? null,
+				...current.session?.providerInstanceId !== void 0 ? { providerInstanceId: current.session.providerInstanceId } : {},
+				runtimeMode: current.session?.runtimeMode ?? DEFAULT_RUNTIME_MODE,
+				activeTurnId: null,
+				lastError: current.session?.lastError ?? null,
+				updatedAt: now
+			},
+			createdAt: now
+		})));
+		yield* Effect.all([flushQueuedSettle(thread.id), flushQueuedWorkspaceCleanup(thread.id)], { discard: true });
+		threadSessionRulesetModes.delete(thread.id);
+		threadBackgroundLiveness.clearThreadLiveness(thread.id);
+	});
 	const processDomainEvent = Effect.fn("processDomainEvent")(function* (event) {
 		yield* Effect.annotateCurrentSpan({
 			"orchestration.event_type": event.type,
@@ -108398,6 +108808,9 @@ const make$3 = Effect.gen(function* () {
 			case "thread.session-stop-requested":
 				yield* processSessionStopRequested(event);
 				return;
+			case "thread.session-force-stop-requested":
+				yield* processSessionForceStopRequested(event);
+				return;
 		}
 	});
 	const processDomainEventSafely = (event) => processDomainEvent(event).pipe(Effect.catchCause((cause) => {
@@ -108408,15 +108821,20 @@ const make$3 = Effect.gen(function* () {
 		});
 	}));
 	const worker = yield* makeDrainableWorker(processDomainEventSafely);
+	const forceStopOutstanding = yield* TxRef.make(0);
+	const forceStopContext = yield* Effect.context();
+	const enqueueForceStop = (event) => Effect.uninterruptible(Effect.tx(TxRef.update(forceStopOutstanding, (n) => n + 1)).pipe(Effect.andThen(processDomainEventSafely(event).pipe(Effect.ensuring(Effect.tx(TxRef.update(forceStopOutstanding, (n) => n - 1))), Effect.provideContext(forceStopContext), Effect.forkScoped)), Effect.asVoid));
+	const forceStopDrain = TxRef.get(forceStopOutstanding).pipe(Effect.tap((n) => n > 0 ? Effect.txRetry : Effect.void), Effect.tx);
 	return {
 		start: Effect.fn("start")(function* () {
 			const processEvent = Effect.fn("processEvent")(function* (event) {
+				if (event.type === "thread.session-force-stop-requested") return yield* enqueueForceStop(event);
 				if (event.type === "thread.runtime-mode-set" || event.type === "thread.turn-start-requested" || event.type === "thread.turn-interrupt-requested" || event.type === "thread.approval-response-requested" || event.type === "thread.user-input-response-requested" || event.type === "thread.session-stop-requested") return yield* worker.enqueue(event);
 			});
 			yield* Effect.forkScoped(Stream.runForEach(orchestrationEngine.streamDomainEvents, processEvent));
 			yield* restorePendingWorkspaceCleanups().pipe(Effect.catchCause((cause) => Effect.logWarning("startup thread workspace cleanup recovery failed", { cause })));
 		}),
-		drain: worker.drain
+		drain: Effect.all([worker.drain, forceStopDrain], { discard: true }).pipe(Effect.asVoid)
 	};
 });
 const ProviderCommandReactorLive = Layer.effect(ProviderCommandReactor, make$3);
@@ -108937,9 +109355,9 @@ const CheckpointReactorLive = Layer.effect(CheckpointReactor, make$2);
 const GATE_TIMEOUT_SWEEP_INTERVAL = "10 seconds";
 const reviewCommandId = (pairId, sequence) => CommandId.make(`server:fusion:${pairId}:review:${sequence}`);
 const cursorCommandId = (pairId, sequence) => CommandId.make(`server:fusion:${pairId}:cursor:${sequence}`);
-const reviewMessageId = (pairId, sequence) => MessageId.make(`fusion-review:${pairId}:${sequence}`);
+const reviewMessageId = (pairId, sequence) => MessageId.make(`${FUSION_REVIEW_MESSAGE_ID_PREFIX}${pairId}:${sequence}`);
 const gateCommandId = (pairId, gateId, suffix) => CommandId.make(`server:fusion:${pairId}:gate:${gateId}:${suffix}`);
-const gateMessageId = (gateId, round) => MessageId.make(`fusion-gate:${gateId}:wake:${round}`);
+const gateMessageId = (gateId, round) => MessageId.make(`${FUSION_GATE_MESSAGE_ID_PREFIX}${gateId}:wake:${round}`);
 const gateActivityId = (gateId, threadId, suffix) => EventId.make(`fusion-gate:${gateId}:${suffix}:${threadId}`);
 const pairFailureCommandId = (pairId, sequence, suffix) => CommandId.make(`server:fusion:${pairId}:provider-failure:${sequence}:${suffix}`);
 const pairFailureActivityId = (pairId, sequence, threadId) => EventId.make(`fusion-provider-failure:${pairId}:${sequence}:${threadId}`);
@@ -108967,34 +109385,38 @@ Never poll thread_watch_events or wait for builder. Deliver review/advice, end t
 * definition of done and its recovery procedure must arrive with each wake,
 * and the current phase must be derived from artifacts rather than remembered.
 */
-const deliveryProtocol = (implementerThreadId) => `Own delivery loop. Completion requires artifact proof from builder events, git, PR - never memory:
+const deliveryProtocol = (implementerThreadId) => `Delivery loop runs only when the user's task authorizes delivery (commit, push, PR). Never infer authorization from finished code, green checks, or a clean review.
+
+Authorized - completion requires artifact proof from builder events, git, PR - never memory:
 
 1. Feature/fix branch, explicit-path staging, conventional commit, rebased latest main.
 2. Open PR; builder reports commit and PR URL.
 3. Global pr-reviewer reviewed branch/PR; confirmed findings fixed; affected checks green; follow-up review has no actionable findings.
 
-Code done/no objections but conditions missing: thread_advise ${implementerThreadId} with next delivery step - commit, rebase, PR, global pr-reviewer, fixes, affected checks, repeat until clean. Require final commit and PR URL.
+Authorized and code done/no objections but conditions missing: thread_advise ${implementerThreadId} with next delivery step - commit, rebase, PR, global pr-reviewer, fixes, affected checks, repeat until clean. Require final commit and PR URL.
+
+Not authorized: task is complete once code and final-phase verification are done. Report final state and the changed uncommitted paths to the user in this supervisor thread, say delivery needs their authorization, and end the turn. Nothing blocks the builder here, so do not use waitForUser; the prerequisite rule above applies only when the builder reports it is stuck mid-task awaiting authorization. Never advise the builder to branch, stage, commit, push, or open a PR, and never count missing delivery as unfinished work or an objection.
 
 Never instruct/report merge; user owns merging. After restart/context loss, derive phase from workspace git log/status, PR, recent builder events.`;
 const watcherPrompt = (input) => `${FUSION_REVIEW_PROMPT_PREFIX}
 Review completed builder turn ${input.implementerThreadId}.
 
-Call thread_watch_events, threadId ${input.implementerThreadId}, afterSequence ${input.afterSequence}; page through ${input.throughSequence}. Inspect repo when useful.
+Call thread_watch_events, threadId ${input.implementerThreadId}, afterSequence ${input.afterSequence}, limit 50; repeat with the last returned event's sequence as afterSequence until you reach ${input.throughSequence}. Never request a whole range in one call: an oversized page exceeds the tool output cap and wastes the turn. Inspect repo when useful.
 
 Always report concise:
 
 - Progress: work done; completeness.
-- Verification: checks/results; missing proof.
+- Verification: final phase only - checks/results, missing proof. Intermediate phases: report "deferred to final phase" and never demand per-phase checks.
 - Assessment: evidence-cited correctness risks, missed requirements, regressions, unsafe/unneeded scope. None: "No objections found."
 
 Determine review boundary from builder's todo status:
 
-- Remaining phases, or final status unclear: intermediate phase review. Always call thread_advise for ${input.implementerThreadId}. With objections, send required corrections and next phase. With none, explicitly approve phase and tell builder to continue next todo phase.
-- Final whole-task phase ready: call thread_watch_events again with afterSequence 0 through ${input.throughSequence}, then inspect full task diff/state. Review original requirements, integration across all phases, verification, and delivery. Advise only for concrete objections or unfinished work; otherwise report no objections and end.
+- Remaining phases, or final status unclear: intermediate phase review. Always call thread_advise for ${input.implementerThreadId}. With objections, send required corrections and next phase. With none, explicitly approve phase and tell builder to continue next todo phase. Never require tests, typecheck, lint, or builds before the final phase.
+- Final whole-task phase ready: call thread_watch_events again from afterSequence 0 through ${input.throughSequence}, same limit 50 paging, then inspect full task diff/state. Review original requirements, integration across all phases, verification, and delivery. Advise only for concrete objections or unfinished work; otherwise report no objections and end.
 
 ${watcherPowers(input.implementerThreadId)}
 
-Builder-blocking external prerequisite only: when the builder explicitly reports it cannot process the request until the user supplies access, authentication, credentials, permission, or another unavailable external prerequisite, call thread_advise with waitForUser true, ask the user in this supervisor thread, and end. That result does not wake the builder. Wait for user action or reply; only then call thread_advise normally with the confirmed result. Never send waiting/pending status to the builder because that starts another review cycle. Do not pause for ordinary review objections, design choices, or human-authority decisions the builder can safely await itself.
+Builder-blocking external prerequisite only: when the builder explicitly reports it cannot process the request until the user supplies access, authentication, credentials, permission, delivery authorization to commit/push/open a PR, or another unavailable external prerequisite, call thread_advise with waitForUser true, ask the user in this supervisor thread, and end. That result does not wake the builder. Wait for user action or reply; only then call thread_advise normally with the confirmed result. Never send waiting/pending status to the builder because that starts another review cycle. Do not pause for ordinary review objections, design choices, or human-authority decisions the builder can safely await itself.
 
 ${deliveryProtocol(input.implementerThreadId)}
 
@@ -109009,7 +109431,7 @@ const gateKindDescription = (gate) => {
 const gatePrompt = (input) => `${FUSION_GATE_PROMPT_PREFIX}
 Gate ${input.gate.id} is open on builder thread ${input.implementerThreadId}: ${gateKindDescription(input.gate)}. Round ${Math.min(input.gate.round + 1, input.roundCap)} of ${input.roundCap}.
 
-First read delta: thread_watch_events, threadId ${input.implementerThreadId}, afterSequence ${input.afterSequence}; page through ${input.throughSequence}. Inspect repo when useful.
+First read delta: thread_watch_events, threadId ${input.implementerThreadId}, afterSequence ${input.afterSequence}, limit 50; repeat with the last returned event's sequence as afterSequence until you reach ${input.throughSequence}. Never request a whole range in one call: an oversized page exceeds the tool output cap and wastes the turn. Inspect repo when useful.
 
 Then thread_gate_respond, threadId ${input.implementerThreadId}, gateId ${input.gate.id}:
 
@@ -109232,7 +109654,7 @@ const make$1 = Effect.gen(function* () {
 				commandId: gateCommandId(event.payload.pairId, event.payload.gateId, "unblock-continue"),
 				threadId: implementer.id,
 				message: {
-					messageId: MessageId.make(`fusion-gate:${event.payload.gateId}:unblock-continue`),
+					messageId: MessageId.make(`${FUSION_GATE_MESSAGE_ID_PREFIX}${event.payload.gateId}:unblock-continue`),
 					role: "user",
 					text: unwatched ? `${FUSION_GATE_PROMPT_PREFIX} The supervisor did not answer the repeated-failure gate within the timeout. The gate passed unwatched. Continue the work.` : `${FUSION_GATE_PROMPT_PREFIX} The user skipped the repeated-failure gate. Continue the work.`,
 					attachments: []