@p4code/cli 0.6.15 → 0.6.17

package/dist/bin.mjs

@@ -268,7 +268,7 @@ const make$124 = () => {
 const layer$124 = Layer.sync(NetService, make$124);
 //#endregion
 //#region package.json
-var version$1 = "0.6.15";
+var version$1 = "0.6.17";
 //#endregion
 //#region src/config.ts
 /**
@@ -3284,6 +3284,8 @@ const FUSION_GATE_PROMPT_PREFIX = "[fusion-gate]";
 const FUSION_ACTIVATION_PROMPT_PREFIX = "[fusion-activation]";
 /** Server message that returns a Builder to its unfinished phase on Jev's advice. */
 const FUSION_JEV_PROMPT_PREFIX = "[fusion-jev]";
+/** Server message that resumes a Fusion child once after a transient provider failure. */
+const FUSION_RETRY_PROMPT_PREFIX = "[fusion-retry]";
 /**
 * Message-id namespaces for server-generated fusion wakes. Wake detection is
 * keyed off these rather than message text, which a user or expanded skill
@@ -5296,7 +5298,7 @@ var OrchestrationSearchThreadsError = class extends Schema$1.TaggedErrorClass()(
 const ThreadWatchEventsInput = Schema$1.Struct({
 	threadId: ThreadId.annotate({ description: "The thread to read events from. Any thread on this server, not only this session's own." }),
 	afterSequence: Schema$1.optional(NonNegativeInt.annotate({ description: "Exclusive sequence cursor. Events with a higher sequence are returned. Omit to read from the beginning." })),
-	limit: Schema$1.optional(NonNegativeInt.check(Schema$1.isLessThanOrEqualTo(200)).annotate({ description: `Maximum events to return (default 50, max 200).` }))
+	limit: Schema$1.optional(NonNegativeInt.annotate({ description: `Maximum events to return (default 50, max 200; larger values are clamped).` }))
 });
 const ThreadWatchEventsResult = Schema$1.Struct({
 	threadId: ThreadId,
@@ -9888,7 +9890,13 @@ const DeviceSession = Schema$1.Struct({
 	platform: DevicePlatform,
 	openedAt: Schema$1.String,
 	/** Opaque lifetime identity; absent only on servers predating guarded close. */
-	leaseId: Schema$1.optional(DeviceId)
+	leaseId: Schema$1.optional(DeviceId),
+	/**
+	* Server-resolved folder of the agent's thread. Apple-backed control opens the
+	* Xcode project found here, because Xcode asks the user to approve an agent
+	* only once it opens a project.
+	*/
+	workspaceRoot: Schema$1.optional(Schema$1.String)
 });
 const DeviceServiceState = Schema$1.Struct({
 	hosts: Schema$1.Array(DeviceHostSummary),
@@ -11334,6 +11342,12 @@ const ServerSettings = Schema$1.Struct({
 	*/
 	enableUnpromptedSubagents: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(true))),
 	/**
+	* Compression mode new threads start with. The composer writes the user's
+	* last pick here, so the next new thread follows it; each thread keeps its
+	* own mode once created.
+	*/
+	defaultCompressMode: CompressMode.pipe(Schema$1.withDecodingDefault(Effect.succeed(DEFAULT_COMPRESS_MODE))),
+	/**
 	* Beta. Whether Fusion role rules travel once through the provider's
 	* session channel (Claude's system prompt, Codex's developer instructions)
 	* with a one-line reference on each message, or the legacy way: the full
@@ -11637,6 +11651,7 @@ const ServerSettingsPatch = Schema$1.Struct({
 	enableVerificationBeforeCompletion: Schema$1.optionalKey(Schema$1.Boolean),
 	enableRootCauseBeforeFix: Schema$1.optionalKey(Schema$1.Boolean),
 	enableUnpromptedSubagents: Schema$1.optionalKey(Schema$1.Boolean),
+	defaultCompressMode: Schema$1.optionalKey(CompressMode),
 	enableOptimizedFusionPromptDelivery: Schema$1.optionalKey(Schema$1.Boolean),
 	enableFusionObservation: Schema$1.optionalKey(Schema$1.Boolean),
 	storageCleanup: Schema$1.optionalKey(Schema$1.Struct({
@@ -13342,7 +13357,9 @@ const ThreadContextUpdateInput = Schema$1.Struct({
 });
 const ThreadContextUpdateResult = Schema$1.Struct({
 	pairId: ThreadPairId,
-	updatedAt: IsoDateTime
+	updatedAt: IsoDateTime,
+	/** Explains input the server dropped instead of rejecting the whole update. */
+	notice: Schema$1.optional(Schema$1.String)
 });
 const RoleContextItems = Schema$1.Struct({
 	supervisor: SharedContextItems,
@@ -21548,6 +21565,7 @@ const makeRuntimeSqliteLayer = Effect.fn("makeRuntimeSqliteLayer")(function* (co
 const applyPragmas = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	yield* sql`PRAGMA journal_mode = WAL;`;
+	yield* sql`PRAGMA synchronous = NORMAL;`;
 	yield* sql`PRAGMA foreign_keys = ON;`;
 });
 const setupFile = (dbPath) => Layer.effectDiscard(applyPragmas.pipe(Effect.andThen(runGuardedMigrations({ dbPath })), Effect.andThen(runHistoricalActivityCompaction())));
@@ -45404,8 +45422,9 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 			threadId,
 			...bounds
 		})).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$1("ProjectionSnapshotQuery.getThreadDetailById:listActivities:query", "ProjectionSnapshotQuery.getThreadDetailById:listActivities:decodeRows")), Effect.map((rows) => rows.map(mapThreadActivityRow)));
-		const [threadRow, messageRows, proposedPlanRows, activities, checkpointRows, turnRows, latestTurnRow, sessionRow, scheduledTaskRows] = yield* Effect.all([
-			getActiveThreadRowById({ threadId }).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$1("ProjectionSnapshotQuery.getThreadDetailById:getThread:query", "ProjectionSnapshotQuery.getThreadDetailById:getThread:decodeRow"))),
+		const threadRow = yield* getActiveThreadRowById({ threadId }).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$1("ProjectionSnapshotQuery.getThreadDetailById:getThread:query", "ProjectionSnapshotQuery.getThreadDetailById:getThread:decodeRow")));
+		if (Option.isNone(threadRow)) return Option.none();
+		const [messageRows, proposedPlanRows, activities, checkpointRows, turnRows, latestTurnRow, sessionRow, scheduledTaskRows] = yield* Effect.all([
 			(bounds === void 0 ? listThreadMessageRowsByThread({ threadId }) : listThreadMessageRowsByThreadWindow({
 				threadId,
 				...bounds
@@ -45418,7 +45437,6 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 			getThreadSessionRowByThread({ threadId }).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$1("ProjectionSnapshotQuery.getThreadDetailById:getSession:query", "ProjectionSnapshotQuery.getThreadDetailById:getSession:decodeRow"))),
 			listThreadScheduledTaskRowsByThread({ threadId }).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$1("ProjectionSnapshotQuery.getThreadDetailById:listScheduledTasks:query", "ProjectionSnapshotQuery.getThreadDetailById:listScheduledTasks:decodeRows")))
 		]);
-		if (Option.isNone(threadRow)) return Option.none();
 		const thread = {
 			id: threadRow.value.threadId,
 			projectId: threadRow.value.projectId,
@@ -49540,13 +49558,21 @@ var XcodeMcpClient = class XcodeMcpClient {
 			throw error;
 		}
 	}
-	request(method, params, signal) {
+	/**
+	* `abandonAfterMs` gives up on a slow reply without closing the bridge; the
+	* default timeout closes it, since a stuck bridge cannot be trusted.
+	*/
+	request(method, params, signal, abandonAfterMs) {
 		signal.throwIfAborted();
 		if (this.closed) return Promise.reject(/* @__PURE__ */ new Error("Device MCP session is closed. Select the device again."));
 		const id = ++this.sequence;
 		return new Promise((resolve, reject) => {
 			const abort = () => this.close(/* @__PURE__ */ new Error("Device MCP request cancelled. Select the device again."));
-			const timer = setTimeout(() => this.close(/* @__PURE__ */ new Error("Device MCP timed out. Select the device again.")), REQUEST_TIMEOUT_MS$5);
+			const timer = abandonAfterMs === void 0 ? setTimeout(() => this.close(/* @__PURE__ */ new Error("Device MCP timed out. Select the device again.")), REQUEST_TIMEOUT_MS$5) : setTimeout(() => {
+				this.pending.delete(id);
+				finish();
+				reject(/* @__PURE__ */ new Error(`Device MCP ${method} did not answer in time.`));
+			}, abandonAfterMs);
 			const finish = () => {
 				clearTimeout(timer);
 				signal.removeEventListener("abort", abort);
@@ -49570,7 +49596,7 @@ var XcodeMcpClient = class XcodeMcpClient {
 			}) + "\n");
 		});
 	}
-	async call(name, args, signal) {
+	async call(name, args, signal, options) {
 		if (!this.tools.has(name)) throw new Error(`Selected device MCP service does not expose ${name}. Check adapter capabilities and Xcode setup.`);
 		const redact = (error) => {
 			let message = error instanceof Error ? error.message : String(error);
@@ -49581,7 +49607,7 @@ var XcodeMcpClient = class XcodeMcpClient {
 			const result = objectValue(await this.request("tools/call", {
 				name,
 				arguments: args
-			}, signal));
+			}, signal, options?.abandonAfterMs));
 			const structured = objectValue(result.structuredContent);
 			if (result.isError === true || structured.didError === true) {
 				const detail = (Array.isArray(result.content) ? result.content : []).map((part) => objectValue(part).text).filter((part) => typeof part === "string").join("\n");
@@ -49783,6 +49809,15 @@ const REQUIRED_DEVICE_TOOLS = [
 	"DeviceInteractionSynthesize",
 	"DeviceInteractionEndSession"
 ];
+const XCODE_PROJECT_SEARCH_DEPTH = 3;
+const DISCOVERED_PROJECT_OPEN_WAIT_MS = 15e3;
+const XCODE_PROJECT_SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([
+	"node_modules",
+	"Pods",
+	"DerivedData",
+	"build",
+	"Carthage"
+]);
 const FRAME_PATTERN = /\{\{(-?[\d.]+),\s*(-?[\d.]+)\},\s*\{([\d.]+),\s*([\d.]+)\}\}/;
 const HIT_PATTERN = /hitPoint:\s*\{(-?[\d.]+),\s*(-?[\d.]+)\}/;
 const Capture = Schema$1.Struct({
@@ -49850,6 +49885,33 @@ function appleHierarchySnapshot(text, sequence) {
 		elements
 	};
 }
+/**
+* Shallowest `.xcworkspace` under a thread's folder, else the shallowest
+* `.xcodeproj`. Bundles, dot folders and dependency trees are not searched.
+*/
+const findXcodeProject = (fs, root) => Effect.gen(function* () {
+	let level = [root];
+	for (let depth = 0; depth <= XCODE_PROJECT_SEARCH_DEPTH && level.length > 0; depth++) {
+		const next = [];
+		let project;
+		for (const directory of level) {
+			const names = yield* fs.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
+			for (const name of names.toSorted()) {
+				const path = `${directory}/${name}`;
+				if (name.endsWith(".xcworkspace")) return path;
+				if (name.endsWith(".xcodeproj")) {
+					project ??= path;
+					continue;
+				}
+				if (name.startsWith(".") || XCODE_PROJECT_SKIPPED_DIRECTORIES.has(name)) continue;
+				const info = yield* fs.stat(path).pipe(Effect.option);
+				if (Option.isSome(info) && info.value.type === "Directory") next.push(path);
+			}
+		}
+		if (project) return project;
+		level = next;
+	}
+});
 function createAppleDeviceAdapter(input) {
 	const sessions = /* @__PURE__ */ new Map();
 	const fail = (operation) => (cause) => new DeviceOperationError({
@@ -49872,7 +49934,9 @@ function createAppleDeviceAdapter(input) {
 			}
 		}).catch(() => {});
 	};
-	const get = (session) => Effect.tryPromise({
+	const workspaceFor = (session) => input.workspacePath !== void 0 || !session.workspaceRoot || session.leaseId !== void 0 && sessions.has(session.leaseId) ? Effect.succeed(input.workspacePath) : findXcodeProject(input.fs, session.workspaceRoot);
+	const get = (session) => Effect.flatMap(workspaceFor(session), (workspace) => open(session, workspace));
+	const open = (session, workspace) => Effect.tryPromise({
 		try: async (signal) => {
 			if (session.hostId !== "local" || session.platform !== "ios" || !session.leaseId) throw new Error("Apple MCP requires an exact local iOS device lease.");
 			let pending = sessions.get(session.leaseId);
@@ -49887,6 +49951,7 @@ function createAppleDeviceAdapter(input) {
 						const missing = REQUIRED_DEVICE_TOOLS.filter((tool) => !client.tools.has(tool));
 						if (missing.length > 0) throw new Error(`Selected Xcode lacks required device tools: ${missing.join(", ")}. No device session was opened.`);
 						if (input.workspacePath) await client.call("XcodeOpenWorkspace", { path: input.workspacePath }, signal);
+						else if (workspace) await client.call("XcodeOpenWorkspace", { path: workspace }, signal, { abandonAfterMs: DISCOVERED_PROJECT_OPEN_WAIT_MS }).catch(() => void 0);
 						const opened = Schema$1.decodeUnknownSync(Session)(appleMcpData(await client.call("DeviceInteractionStartSession", {
 							deviceIdentifier: session.deviceId,
 							sessionIdentifier: `P4 Device ${session.threadId.slice(0, 8)}`
@@ -49958,7 +50023,7 @@ function createAppleDeviceAdapter(input) {
 			const permission = objectValue(status.permission);
 			if ((Array.isArray(permission.pendingAgentApprovals) ? permission.pendingAgentApprovals : []).some((item) => objectValue(objectValue(objectValue(objectValue(item).subject).agent)._0).name === "p4code-device-adapter")) return "Apple Xcode is waiting for approval of p4code-device-adapter and its project folder. Approve the pending request in Xcode, then select the device again. P4 cannot grant this approval automatically.";
 			if (status.running === false) return "Apple MCP service is not running. Open the selected Xcode project or configure its headless service, then select the device again.";
-			return "Apple MCP did not respond in time. Check Xcode agent/folder permissions and session logs before selecting the device again.";
+			return "Apple MCP refused or did not respond. Xcode asks to approve p4code-device-adapter only when P4 opens an Xcode project: use a thread whose folder contains an .xcworkspace or .xcodeproj (or set P4CODE_APPLE_MCP_WORKSPACE), approve the prompt in Xcode, then select the device again.";
 		}).pipe(Effect.orElseSucceed(() => "Apple MCP did not respond. Check Xcode agent/folder permissions and service status.")),
 		discover: Effect.gen(function* () {
 			const result = yield* input.run("xcrun", [
@@ -51691,7 +51756,8 @@ const makeWithHosts = Effect.fn("DeviceService.makeWithHosts")(function* (input)
 				deviceId: found.device.id,
 				platform: found.device.platform,
 				openedAt,
-				leaseId: NodeCrypto.randomUUID()
+				leaseId: NodeCrypto.randomUUID(),
+				...value.workspaceRoot ? { workspaceRoot: value.workspaceRoot } : {}
 			};
 			yield* closeCommands(sessionsToClose(state.sessions, session));
 			yield* update((current) => ({
@@ -57985,6 +58051,18 @@ const withDeviceInvocation = (execute, capability = "devices") => Effect.gen(fun
 	const work = execute(service, invocation.threadId).pipe(Effect.tap(() => lifetime.revoked ? Effect.fail(denied()) : Effect.void), Effect.mapError((error) => isDeviceToolUnavailableError(error) || isDeviceActionUnavailableError(error) ? error : isDeviceOperationError(error) && error.reason === "agent_access_disabled" ? new DeviceToolUnavailableError({ reason: error.message }) : denied()));
 	return yield* Effect.raceFirst(work, Deferred.await(lifetime.revocation).pipe(Effect.andThen(Effect.fail(denied()))));
 });
+/**
+* The thread's worktree, else its project root, for opening a device session.
+* Unreadable projections yield nothing: the session still opens without it.
+*/
+const threadWorkspaceRoot = (threadId) => Effect.gen(function* () {
+	const query = yield* ProjectionSnapshotQuery;
+	const thread = yield* query.getThreadShellById(threadId);
+	if (Option.isNone(thread)) return void 0;
+	if (thread.value.worktreePath) return thread.value.worktreePath;
+	const project = yield* query.getProjectShellById(thread.value.projectId);
+	return Option.isSome(project) ? project.value.workspaceRoot : void 0;
+}).pipe(Effect.orElseSucceed(() => void 0));
 const withDeviceSession = (target, execute) => withDeviceInvocation((service, threadId) => service.withAgentCommand({
 	hostId: target.hostId,
 	deviceId: target.deviceId,
@@ -58017,6 +58095,7 @@ const makeComputerUseDevices = Effect.fn("ComputerUseDevices.make")(function* ()
 	const screenshots = yield* DeviceScreenshot;
 	const commands = yield* DeviceCommandProxy;
 	const http = yield* HttpClient.HttpClient;
+	const snapshots = yield* ProjectionSnapshotQuery;
 	const stale = () => new DeviceOperationError({
 		operation: "command",
 		reason: "request_failed",
@@ -58037,11 +58116,13 @@ const makeComputerUseDevices = Effect.fn("ComputerUseDevices.make")(function* ()
 			const device = state.devices.find((device) => device.hostId === input.hostId && device.id === input.deviceId && device.platform === input.platform);
 			if (!device) return yield* stale();
 			if (device.physical) return yield* new DeviceToolUnavailableError({ reason: "Physical-device UI control is not supported by this adapter. Pairing, trust, Developer Mode and signing must be configured separately; use supported device-management workflows." });
+			const workspaceRoot = yield* threadWorkspaceRoot(threadId).pipe(Effect.provideService(ProjectionSnapshotQuery, snapshots));
 			const session = yield* service.agentOpen({
 				threadId,
 				hostId: input.hostId,
 				deviceId: input.deviceId,
-				platform: input.platform
+				platform: input.platform,
+				...workspaceRoot ? { workspaceRoot } : {}
 			});
 			if (!session.leaseId) return yield* stale();
 			return {
@@ -61790,6 +61871,38 @@ const prepareSharedCheckout = (input, git) => Effect.gen(function* () {
 	return { branch };
 }).pipe(Effect.withSpan("prepareSharedCheckout"));
 //#endregion
+//#region src/orchestration/ShellStreamingThrottle.ts
+/** Minimum gap between shell refetches caused by one streaming message. */
+const SHELL_STREAMING_REFRESH_INTERVAL_MS = 1e3;
+/**
+* Per-subscription filter for the shell stream. A streaming assistant message
+* emits a delta roughly every 50 ms and each one only moves the thread's
+* `updatedAt`, yet every delta would otherwise refetch the thread shell and
+* push it to the client. The first delta of a message always passes (it can
+* change `latestTurn`), later deltas pass at most once per interval, and the
+* final non-streaming message always passes, so the shell still settles on the
+* current state.
+*
+* Returns `(event, nowMs) => keep`. Create one per subscription: the state is
+* which deltas this subscriber has already seen.
+*/
+function makeShellStreamingThrottle(intervalMs = SHELL_STREAMING_REFRESH_INTERVAL_MS) {
+	const lastPassedAtByMessageId = /* @__PURE__ */ new Map();
+	return (event, nowMs) => {
+		if (event.type !== "thread.message-sent") return true;
+		const messageId = event.payload.messageId;
+		if (!event.payload.streaming) {
+			lastPassedAtByMessageId.delete(messageId);
+			return true;
+		}
+		const lastPassedAt = lastPassedAtByMessageId.get(messageId);
+		if (lastPassedAt !== void 0 && nowMs - lastPassedAt < intervalMs) return false;
+		if (lastPassedAtByMessageId.size >= 1e3) lastPassedAtByMessageId.clear();
+		lastPassedAtByMessageId.set(messageId, nowMs);
+		return true;
+	};
+}
+//#endregion
 //#region src/provider/ProviderInstanceEnvironment.ts
 function mergeProviderInstanceEnvironment(environment, baseEnv = process.env) {
 	if (!environment || environment.length === 0) return baseEnv;
@@ -92194,6 +92307,11 @@ const makeCodexSubagentModelReporter = (options) => {
 */
 /** Codex's own name for the token variable of p4code's built-in server. */
 const CODEX_P4CODE_BEARER_TOKEN_ENV_VAR = "P4_MCP_BEARER_TOKEN";
+/**
+* Codex `mcp_servers.<name>.tool_timeout_sec` for p4code's built-in server, a
+* TOML float. An hour, because `ask_user_question` blocks until a person answers.
+*/
+const CODEX_P4CODE_TOOL_TIMEOUT_SEC = "3600.0";
 /** Its own variable, so the Computer Use credential never rides on p4-code's. */
 const CODEX_P4_COMPUTER_USE_BEARER_TOKEN_ENV_VAR = "P4_COMPUTER_USE_BEARER_TOKEN";
 /** Prefix for the per-server variables the registered servers get. */
@@ -94329,7 +94447,9 @@ const makeCodexAdapter = Effect.fn("makeCodexAdapter")(function* (codexConfig, o
 						"-c",
 						`mcp_servers.${P4CODE_MCP_SERVER_NAME}.url=${mcpSession.endpoint}`,
 						"-c",
-						`mcp_servers.${P4CODE_MCP_SERVER_NAME}.bearer_token_env_var="${CODEX_P4CODE_BEARER_TOKEN_ENV_VAR}"`
+						`mcp_servers.${P4CODE_MCP_SERVER_NAME}.bearer_token_env_var="${CODEX_P4CODE_BEARER_TOKEN_ENV_VAR}"`,
+						"-c",
+						`mcp_servers.${P4CODE_MCP_SERVER_NAME}.tool_timeout_sec=${CODEX_P4CODE_TOOL_TIMEOUT_SEC}`
 					] : [],
 					...mcpSession?.computerUse ? [
 						"-c",
@@ -132505,7 +132625,10 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker, computerUseBrok
 		output.push(...yield* coalesceShellEvents(pendingEvents));
 		return output;
 	});
-	const coalesceShellLiveStream = (stream) => stream.pipe(Stream.groupedWithin(SHELL_COALESCE_MAX_CHUNK, SHELL_COALESCE_WINDOW), Stream.mapEffect(coalesceShellLiveInputs), Stream.flatMap((items) => Stream.fromIterable(items)));
+	const coalesceShellLiveStream = (stream) => {
+		const keepStreamingDelta = makeShellStreamingThrottle();
+		return stream.pipe(Stream.filterEffect((input) => input.kind === "event" ? Clock.currentTimeMillis.pipe(Effect.map((nowMs) => keepStreamingDelta(input.event, nowMs))) : Effect.succeed(true)), Stream.groupedWithin(SHELL_COALESCE_MAX_CHUNK, SHELL_COALESCE_WINDOW), Stream.mapEffect(coalesceShellLiveInputs), Stream.flatMap((items) => Stream.fromIterable(items)));
+	};
 	const dispatchBootstrapTurnStart = (command) => Effect.gen(function* () {
 		const bootstrap = command.bootstrap;
 		const { bootstrap: _bootstrap, ...finalTurnStartCommand } = command;
@@ -133178,6 +133301,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker, computerUseBrok
 				reason: plan.reason
 			});
 			const modelSelection = plan.model;
+			const compressMode = yield* serverSettings.getSettings.pipe(Effect.map((settings) => settings.defaultCompressMode), Effect.orElseSucceed(() => DEFAULT_COMPRESS_MODE));
 			const threadId = ThreadId.make(yield* crypto.randomUUIDv4.pipe(Effect.orDie));
 			const createdAt = yield* nowIso$2;
 			const threadTitle = buildTaskThreadTitle(task.title);
@@ -133202,7 +133326,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker, computerUseBrok
 				titleSeed: threadTitle,
 				runtimeMode: DEFAULT_RUNTIME_MODE$2,
 				interactionMode: DEFAULT_PROVIDER_INTERACTION_MODE,
-				compressMode: DEFAULT_COMPRESS_MODE,
+				compressMode,
 				unpromptedSubagents: true,
 				bootstrap: { createThread: {
 					projectId: plan.projectId,
@@ -133210,7 +133334,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker, computerUseBrok
 					modelSelection,
 					runtimeMode: DEFAULT_RUNTIME_MODE$2,
 					interactionMode: DEFAULT_PROVIDER_INTERACTION_MODE,
-					compressMode: DEFAULT_COMPRESS_MODE,
+					compressMode,
 					unpromptedSubagents: true,
 					branch: null,
 					worktreePath: null,
@@ -135398,7 +135522,11 @@ const DeviceOpenTool = Tool.make("device_open", {
 	parameters: DeviceToolOpenInput,
 	success: DeviceToolOpenResult,
 	failure: DeviceToolError,
-	dependencies: [McpInvocationContext, DeviceService]
+	dependencies: [
+		McpInvocationContext,
+		DeviceService,
+		ProjectionSnapshotQuery
+	]
 }).annotate(Tool.Title, "Open device").annotate(Tool.Readonly, false);
 const DeviceCloseTool = Tool.make("device_close", {
 	description: "Close this thread's device sessions on the named host. Omitted device closes all sessions on that host only. Optional shutdown powers off the selected devices and closes their other viewing sessions.",
@@ -135510,11 +135638,13 @@ const DeviceToolkitHandlersLive = DeviceToolkit.toLayer({
 			try: () => selectDevice(state, threadId, value),
 			catch: () => new DeviceToolUnavailableError({ reason: "Choose an explicit platform/device from device_list on the requested host." })
 		});
+		const workspaceRoot = yield* threadWorkspaceRoot(threadId);
 		const session = yield* service.agentOpen({
 			threadId,
 			hostId: value.hostId,
 			deviceId: selected.id,
-			platform: selected.platform
+			platform: selected.platform,
+			...workspaceRoot ? { workspaceRoot } : {}
 		});
 		const current = yield* service.state;
 		const device = current.devices.find((device) => device.hostId === session.hostId && device.id === session.deviceId && device.platform === session.platform);
@@ -136915,7 +137045,9 @@ const ThreadToolkitHandlersLive = ThreadToolkit.toLayer({
 		const { invocation, pair, reject } = yield* requireSharedPair("thread_context_update");
 		const isBuilder = invocation.threadId === pair.implementerThreadId;
 		if (isBuilder && (input.requirements !== void 0 || input.decisions !== void 0)) return yield* reject("Supervisor owns requirements and decisions. Propose revisions through thread_ask.");
-		if (!isBuilder && input.summary !== void 0) return yield* reject("Only Builder may replace its phase summary.");
+		const { summary, ...supervisorContext } = input;
+		const ignoresSummary = !isBuilder && summary !== void 0;
+		if (ignoresSummary && input.requirements === void 0 && input.decisions === void 0 && input.blockers.length === 0 && input.evidence.length === 0) return yield* reject("Only Builder may replace its phase summary.");
 		const crypto = yield* Crypto.Crypto;
 		const createdAt = DateTime.formatIso(yield* DateTime.now);
 		yield* dispatchControl({
@@ -136931,14 +137063,15 @@ const ThreadToolkitHandlersLive = ThreadToolkit.toLayer({
 				summary: "Shared working context updated",
 				turnId: null,
 				payload: {
-					...input,
+					...isBuilder ? input : supervisorContext,
 					pairId: pair.id
 				}
 			}
 		}, invocation.threadId);
 		return {
 			pairId: pair.id,
-			updatedAt: createdAt
+			updatedAt: createdAt,
+			...ignoresSummary ? { notice: "summary was ignored because only Builder owns its phase summary; the other fields were saved." } : {}
 		};
 	}),
 	thread_plan_update: (input) => Effect.gen(function* () {
@@ -138970,7 +139103,7 @@ const WatchToolkitHandlersLive = WatchToolkit.toLayer({
 		const page = yield* (yield* ThreadEventStreamService).read({
 			threadId: input.threadId,
 			...input.afterSequence !== void 0 ? { afterSequence: input.afterSequence } : {},
-			limit: input.limit ?? 50
+			limit: Math.min(input.limit ?? 50, 200)
 		}).pipe(Effect.mapError((cause) => new ThreadWatchFailedError({
 			threadId: input.threadId,
 			detail: cause.message
@@ -144933,7 +145066,8 @@ function citedSequences(summary) {
 * sequence numbers, the summary is required to cite them, and a dropped line,
 * unrenderable transcript field, or dropped ledger row makes coverage
 * incomplete. A shortened transcript field or clipped ledger argument stays
-* visible and its full text stays in the raw event, so neither does.
+* visible and its full text stays in the raw event, so neither does. A summary
+* line citing a sequence the transcript lacks is removed, never kept.
 *
 * @module orchestration/handoff/fusionEvidenceHandoff
 */
@@ -145087,6 +145221,34 @@ function summaryRejection(input) {
 	if (cited.length === 0) return "summary-uncited";
 	return cited.every((sequence) => input.includedSequences.has(sequence)) ? null : "summary-citation-invalid";
 }
+/**
+* The summary with every line citing a sequence absent from the transcript,
+* and the uncited lines continuing it, removed; or null when nothing was
+* removed or nothing cited survives.
+*
+* A line is the unit of claim: one invented citation condemns the line it is
+* on, never the lines beside it that cite real evidence. The removal is
+* disclosed in the text so the supervisor knows the summary was cut.
+*/
+function salvageSummary(input) {
+	const lines = input.summary.split("\n");
+	const kept = [];
+	let droppingClaim = false;
+	for (const line of lines) {
+		const cited = citedSequences(line);
+		if (cited.length > 0) droppingClaim = !cited.every((sequence) => input.includedSequences.has(sequence));
+		else if (/^\s*#{1,6}\s/u.test(line)) droppingClaim = false;
+		if (!droppingClaim) kept.push(line);
+	}
+	const dropped = lines.length - kept.length;
+	if (dropped === 0) return null;
+	const text = kept.join("\n").trim();
+	if (summaryRejection({
+		summary: text,
+		includedSequences: input.includedSequences
+	}) !== null) return null;
+	return `${text}\n\n[Server removed ${dropped} summary ${dropped === 1 ? "line" : "lines"} resting on sequences absent from this transcript.]`;
+}
 const buildFusionEvidenceHandoff = Effect.fn("fusionEvidenceHandoff.build")(function* (input) {
 	const engine = yield* OrchestrationEngineService;
 	const textGeneration = yield* TextGeneration;
@@ -145154,6 +145316,19 @@ const buildFusionEvidenceHandoff = Effect.fn("fusionEvidenceHandoff.build")(func
 		produced: Option.none(),
 		reason
 	});
+	const salvaged = (result) => {
+		const summary = salvageSummary({
+			summary: result.summary,
+			includedSequences: evidence.includedSequences
+		});
+		return summary === null ? null : {
+			produced: Option.some({
+				...result,
+				summary
+			}),
+			reason: null
+		};
+	};
 	const attempt = yield* Effect.gen(function* () {
 		const first = yield* runSummary(handoffSummaryInstructions({ includedSequences: evidence.includedSequences }));
 		if (Option.isNone(first)) return noSummary("summary-unavailable");
@@ -145167,6 +145342,8 @@ const buildFusionEvidenceHandoff = Effect.fn("fusionEvidenceHandoff.build")(func
 			produced: first,
 			reason: null
 		};
+		const firstSalvage = salvaged(first.value);
+		if (firstSalvage !== null) return firstSalvage;
 		const repaired = yield* runSummary(handoffSummaryRepairInstructions({
 			rejection,
 			summary: first.value.summary,
@@ -145182,7 +145359,7 @@ const buildFusionEvidenceHandoff = Effect.fn("fusionEvidenceHandoff.build")(func
 		return repairedRejection === null ? {
 			produced: repaired,
 			reason: null
-		} : noSummary(repairedRejection);
+		} : salvaged(repaired.value) ?? noSummary(repairedRejection);
 	}).pipe(Effect.timeoutOption(HANDOFF_TIMEOUT), Effect.map(Option.getOrElse(() => noSummary("summary-unavailable"))));
 	const produced = attempt.produced;
 	if (Option.isNone(produced)) return yield* fallback(attempt.reason ?? "summary-unavailable");
@@ -145273,6 +145450,26 @@ const gateMessageId = (gateId, round) => MessageId.make(`${FUSION_GATE_MESSAGE_I
 const gateActivityId = (gateId, threadId, suffix) => EventId.make(`fusion-gate:${gateId}:${suffix}:${threadId}`);
 const pairFailureCommandId = (pairId, sequence, suffix) => CommandId.make(`server:fusion:${pairId}:provider-failure:${sequence}:${suffix}`);
 const pairFailureActivityId = (pairId, sequence, threadId) => EventId.make(`fusion-provider-failure:${pairId}:${sequence}:${threadId}`);
+const PROVIDER_RETRY_MESSAGE_ID_PREFIX = "fusion-provider-retry:";
+const providerRetryCommandId = (pairId, sequence) => CommandId.make(`server:fusion:${pairId}:provider-retry:${sequence}`);
+/** Carries the origin and the failed completion's sequence ahead of the free-form pair id. */
+const providerRetryMessageId = (origin, sequence, pairId) => MessageId.make(`${PROVIDER_RETRY_MESSAGE_ID_PREFIX}${origin}:${sequence}:${pairId}`);
+const PROVIDER_RETRY_MESSAGE_ID = /^fusion-provider-retry:(review|other):(\d+):/u;
+/** The failed completion a review retry resumes, or null for any other message. */
+const retriedReviewSequence = (messageId) => {
+	const match = messageId === null ? null : PROVIDER_RETRY_MESSAGE_ID.exec(messageId);
+	return match?.[1] === "review" ? Number(match[2]) : null;
+};
+const TRANSIENT_PROVIDER_FAILURE = /runtime stream failed|stream disconnected|at capacity|overloaded|server failed|server error|internal error|\b(?:500|502|503|504|529)\b/i;
+const PERSISTENT_PROVIDER_FAILURE = /usage limit|rate limit|quota|billing|auth|log ?in|credential|unauthori[sz]ed|forbidden|\b(?:401|403)\b|does not exist|not found/i;
+/**
+* Whether a failed turn's recorded error is worth one automatic retry: a
+* dropped stream, a provider at capacity, or a server-side outage. Usage
+* limits, auth and missing paths never are, because retrying cannot fix them.
+*/
+function isTransientProviderFailure(lastError) {
+	return typeof lastError === "string" && TRANSIENT_PROVIDER_FAILURE.test(lastError) && !PERSISTENT_PROVIDER_FAILURE.test(lastError);
+}
 const idlePauseCommandId = (pairId, sequence, threadId) => CommandId.make(`server:fusion:${pairId}:idle-pause:${sequence}:${threadId}`);
 const idlePauseActivityId = (pairId, sequence, threadId) => EventId.make(`fusion-idle-pause:${pairId}:${sequence}:${threadId}`);
 /**
@@ -145551,10 +145748,11 @@ const make$3 = Effect.gen(function* () {
 		});
 	});
 	/**
-	* A provider-level failure is not a review boundary. Stop the other child if
-	* it is still active, record one visible pair-level reason, and leave both
-	* idle until a human starts the next turn. Deterministic ids make replay a
-	* no-op, while ignoring interrupted completions prevents a reciprocal loop.
+	* A provider-level failure that was not retried is not a review boundary.
+	* Stop the other child if it is still active, record one visible pair-level
+	* reason, and leave both idle until a human starts the next turn.
+	* Deterministic ids make replay a no-op, while ignoring interrupted
+	* completions prevents a reciprocal loop.
 	*/
 	const pausePairAfterProviderFailure = Effect.fn("FusionWatcherReactor.pausePairAfterProviderFailure")(function* (input) {
 		const { readModel } = yield* readPairs;
@@ -145591,6 +145789,46 @@ const make$3 = Effect.gen(function* () {
 			discard: true
 		});
 	});
+	/**
+	* Resumes a child whose turn failed on a transient provider error, once,
+	* instead of pausing the pair and interrupting its healthy peer. True when
+	* the retry went out (now or on an earlier pass); false sends the failure to
+	* the pause. A retry turn that fails again, a turn whose start message is
+	* unknown, a thread someone already started again, and a failure replayed
+	* at boot are never retried.
+	*/
+	const retryTransientProviderFailure = Effect.fn("FusionWatcherReactor.retryTransientProviderFailure")(function* (input) {
+		const { pair, completion, readModel } = input;
+		const threadId = completion.payload.threadId;
+		const retryIds = new Set(["review", "other"].map((origin) => providerRetryMessageId(origin, completion.sequence, pair.id)));
+		const laterStarts = yield* orchestrationEngine.readEvents(completion.sequence, readModel.snapshotSequence - completion.sequence, { eventTypes: ["thread.turn-start-requested"] }).pipe(Stream.takeWhile((event) => event.sequence <= readModel.snapshotSequence), Stream.filter((event) => event.type === "thread.turn-start-requested" && event.payload.threadId === threadId), Stream.runCollect);
+		if (laterStarts.some((event) => event.type === "thread.turn-start-requested" && retryIds.has(event.payload.messageId))) return true;
+		if (input.replayed) return false;
+		const thread = readModel.threads.find((candidate) => candidate.id === threadId && candidate.deletedAt === null);
+		if (laterStarts.length > 0 || thread === void 0 || thread.latestTurn?.state === "running" || !isTransientProviderFailure(thread.session?.lastError) || completion.payload.turnId === null) return false;
+		const started = yield* projectionSnapshotQuery.getTurnStart(threadId, completion.payload.turnId).pipe(Effect.map(Option.getOrNull), Effect.orElseSucceed(() => null));
+		if (started === null || started.messageId === null || started.messageId.startsWith(PROVIDER_RETRY_MESSAGE_ID_PREFIX)) return false;
+		return yield* orchestrationEngine.dispatch({
+			type: "thread.turn.start",
+			commandId: providerRetryCommandId(pair.id, completion.sequence),
+			threadId,
+			message: {
+				messageId: providerRetryMessageId(started.messageId.startsWith("fusion-review:") ? "review" : "other", completion.sequence, pair.id),
+				role: "user",
+				text: `${FUSION_RETRY_PROMPT_PREFIX} Your previous turn stopped on a transient provider error. Continue the same work from where it stopped; no new work or authority is added. If it was already finished, end with the report you would have given.`,
+				attachments: []
+			},
+			runtimeMode: thread.runtimeMode,
+			interactionMode: thread.interactionMode,
+			compressMode: thread.compressMode,
+			unpromptedSubagents: thread.unpromptedSubagents,
+			createdAt: completion.occurredAt
+		}).pipe(Effect.as(true), Effect.catchCause((cause) => Effect.logWarning("provider failure retry was not sent; pausing the pair instead", {
+			pairId: pair.id,
+			sequence: completion.sequence,
+			cause
+		}).pipe(Effect.as(false))));
+	});
 	const wakeWasRequested = Effect.fn("FusionWatcherReactor.wakeWasRequested")(function* (afterSequence, throughSequence, messageId) {
 		return (yield* orchestrationEngine.readEvents(afterSequence, throughSequence - afterSequence, { eventTypes: ["thread.turn-start-requested"] }).pipe(Stream.takeWhile((event) => event.sequence <= throughSequence), Stream.filter((event) => event.type === "thread.turn-start-requested" && event.payload.messageId === messageId), Stream.take(1), Stream.runCollect)).length > 0;
 	});
@@ -145925,7 +146163,7 @@ const make$3 = Effect.gen(function* () {
 			resolvedAt: event.payload.createdAt
 		});
 	});
-	const isFusionProtocolText = (text) => text.startsWith("[fusion-review]") || text.startsWith("[fusion-gate]") || text.startsWith("[fusion-activation]") || text.startsWith("[fusion-jev]") || text.startsWith("[fusion-advice]");
+	const isFusionProtocolText = (text) => text.startsWith("[fusion-review]") || text.startsWith("[fusion-gate]") || text.startsWith("[fusion-activation]") || text.startsWith("[fusion-jev]") || text.startsWith("[fusion-retry]") || text.startsWith("[fusion-advice]");
 	const processMessageSent = Effect.fn("FusionWatcherReactor.processMessageSent")(function* (event) {
 		if (event.sequence <= liveEventsAfterSequence) return;
 		if (event.payload.role !== "user") return;
@@ -146998,17 +147236,19 @@ Set outcome to summarized, fallback, or failed from the review that just ended.
 		if (Option.isNone(turn)) return;
 		const started = turn.value;
 		if (started.threadId !== pair.watcherThreadId) return;
+		const retriedSequence = retriedReviewSequence(started.messageId);
+		const retriedTurnId = retriedSequence === null ? null : yield* orchestrationEngine.readEvents(retriedSequence - 1, 1).pipe(Stream.runHead, Effect.map(Option.flatMap((event) => event.type === "thread.turn-completed" && event.payload.threadId === pair.watcherThreadId ? Option.fromNullishOr(event.payload.turnId) : Option.none())), Effect.map(Option.getOrNull), Effect.orElseSucceed(() => null));
 		const readAt = Date.parse(latest.readAt);
 		if (latest.turnId === null) {
 			if (input.replayed) return;
 			if (started.startedAt !== null && readAt < Date.parse(started.startedAt)) return;
 			if (readAt > Date.parse(completion.occurredAt)) return;
-		} else if (latest.turnId !== completion.payload.turnId) return;
+		} else if (latest.turnId !== completion.payload.turnId && (retriedTurnId === null || latest.turnId !== retriedTurnId)) return;
 		const wakeAt = (prefix) => projectionSnapshotQuery.getLatestThreadMessageWithIdPrefix(pair.watcherThreadId, prefix).pipe(Effect.map(Option.flatMap((wake) => {
 			const sentAt = Date.parse(wake.createdAt);
 			return Number.isNaN(sentAt) || sentAt > readAt ? Option.none() : Option.some(sentAt);
 		})), Effect.orElseSucceed(() => Option.none()));
-		if (!(started.messageId === null ? yield* Effect.map(Effect.all([wakeAt("fusion-review:"), wakeAt("fusion-gate:")]), ([review, gate]) => Option.isSome(review) && (Option.isNone(gate) || gate.value < review.value)) : started.messageId.startsWith("fusion-review:"))) return;
+		if (!(started.messageId === null ? yield* Effect.map(Effect.all([wakeAt("fusion-review:"), wakeAt("fusion-gate:")]), ([review, gate]) => Option.isSome(review) && (Option.isNone(gate) || gate.value < review.value)) : started.messageId.startsWith("fusion-review:") || retriedSequence !== null)) return;
 		if (latest.hasReport) {
 			if (input.watcher !== void 0) yield* dispatchEvidenceReportRepair(pair, input.watcher, completion.occurredAt, {
 				watchedThreadId: latest.watchedThreadId,
@@ -147024,6 +147264,12 @@ Set outcome to summarized, fallback, or failed from the review that just ended.
 		const activePairs = (readModel.threadPairs ?? []).filter((pair) => pair.detachedAt === null);
 		const failedPair = activePairs.find((pair) => pair.implementerThreadId === event.payload.threadId || pair.watcherThreadId === event.payload.threadId);
 		if (event.payload.state === "failed" && failedPair !== void 0) {
+			if (yield* retryTransientProviderFailure({
+				pair: failedPair,
+				completion: event,
+				readModel,
+				replayed: event.sequence <= liveEventsAfterSequence
+			})) return;
 			yield* pausePairAfterProviderFailure({
 				pair: failedPair,
 				failedThreadId: event.payload.threadId,