@prestyj/cli 5.31.0 → 5.32.1

package/dist/core/agent-session.js

@@ -1,14 +1,18 @@
 import { agentLoop, isAbortError, isUsageLimitError, repairToolPairingAdjacent, } from "@prestyj/agent";
-import { ProviderError, stream, } from "@prestyj/ai";
+import { ProviderError, resolveToolSchema, stream, } from "@prestyj/ai";
 import { EventBus } from "./event-bus.js";
 import { flagUntrustedToolResult } from "./injection-detect.js";
+import { sameStamp, scanProjectLockfiles, stampProjectLockfiles, } from "./installed-threats.js";
+import { onThreatFeedUpdated } from "./threat-feed.js";
+import { parseSafetyBlock } from "./action-threats.js";
+import { recordBlockedPackages } from "./blocked-packages-file.js";
 import { COMPLETION_REVIEW_STATE_KIND, } from "./completion-review.js";
 import { SlashCommandRegistry, createBuiltinCommands, } from "./slash-commands.js";
 import { PROMPT_COMMANDS, getPromptCommand } from "./prompt-commands.js";
 import { loadWorkspaceCustomCommands } from "./custom-commands.js";
 import { expandPromptCommand } from "./prompt-command-expansion.js";
 import { SettingsManager } from "./settings-manager.js";
-import { AuthStorage } from "./auth-storage.js";
+import { AuthStorage, NotLoggedInError } from "./auth-storage.js";
 import { dualAuthProvider } from "@prestyj/core";
 import { getClaudeCliUserAgent, recordRequiredClaudeCodeVersion } from "./claude-code-version.js";
 import { kimiCodingHeaders, isKimiCodingEndpoint } from "./oauth/kimi.js";
@@ -19,7 +23,7 @@ import { shouldCompact, compact, } from "./compaction/compactor.js";
 import { getHistoryMessageVisibility } from "./session-history.js";
 import { sourceFingerprint as computeSourceFingerprint } from "./session-compaction.js";
 import { getAuthStorageKeys, getContextWindow, getModel, MODELS } from "./model-registry.js";
-import { discoverSkills } from "./skills.js";
+import { discoverSkillsWithBlocked } from "./skills.js";
 import { ensureAppDirs } from "../config.js";
 import { buildSubAgentSystemPrompt, buildSystemPrompt, } from "../system-prompt.js";
 import { createTools, createWebSearchTool, } from "../tools/index.js";
@@ -54,7 +58,7 @@ import { buildLoopBreakMessage } from "./loop-breaker.js";
 import { buildRegroundingMessage, requestTextForRegrounding } from "./regrounding.js";
 import { buildSemanticLoopJudgePrompt, buildSemanticLoopMessage, parseSemanticLoopVerdict, SEMANTIC_LOOP_JUDGE_TIMEOUT_MS, withJudgeTimeout, } from "./semantic-loop-check.js";
 import { buildEnvDeltaMessage, buildLanguageUpdateMessage } from "./env-delta.js";
-import { wrapSteeringText, buildNotificationSteeringText, STEERING_PREFIX } from "./steering.js";
+import { wrapSteeringText, buildNotificationSteeringText, buildIdleWakeNotificationText, STEERING_PREFIX, } from "./steering.js";
 import { AgentNotificationQueue } from "./agent-notifications.js";
 import { VerificationGate, VERIFICATION_STATE_KIND } from "./verification-gate.js";
 import { findUserSessionPrompt, getUserSessionPrompt } from "./session-preview.js";
@@ -69,8 +73,101 @@ import { RunLoopMonitor } from "./agent-session/run-loop-monitor.js";
 import { VerificationTracker } from "./agent-session/verification-tracker.js";
 import { McpToolRegistry } from "./agent-session/mcp-tools.js";
 import { TranscriptMarkers } from "./agent-session/transcript-markers.js";
+// ── Output cap ─────────────────────────────────────────────
+/**
+ * The output cap to send on a request. A model's output ceiling can equal its
+ * whole window (Kimi K2.7 Code: 262,144 of 262,144), and providers that count
+ * prompt + max_tokens against the window reject every request with a real
+ * prompt. Cap it at the room the model's TOTAL window leaves once the context
+ * reaches this session's compaction trigger — the largest prompt it lets build
+ * up. The total window, not the route's: the ChatGPT/Codex route's 272K
+ * window is an input budget, and GPT-6's 128K output sits outside it.
+ */
+export function outputCapForRequest(options) {
+    const totalWindow = getContextWindow(options.model, { provider: options.provider });
+    const { targetTokens } = resolveCompactionPolicy({
+        provider: options.provider,
+        model: options.model,
+        contextWindow: getContextWindow(options.model, {
+            provider: options.provider,
+            accountId: options.accountId,
+        }),
+        threshold: options.threshold,
+        accountId: options.accountId,
+    });
+    const room = totalWindow - targetTokens;
+    return room > 0 ? Math.min(options.maxTokens, room) : options.maxTokens;
+}
+// ── Paid models ────────────────────────────────────────────
+/**
+ * Reply for chat bridges (Telegram, agent home) that have no confirmation step.
+ * Generic on purpose: every paid model (Claude fast mode, MiMo UltraSpeed) is
+ * refused here, so the reason must not name one of them.
+ */
+export function paidModelRefusal(modelName) {
+    return `${modelName} spends real money, so it can't be switched to from chat. Switch to it in the EZ Coder app or CLI, where you confirm it.`;
+}
+/**
+ * Thrown by {@link AgentSession.switchModel} when the target model spends real
+ * money and the caller didn't pass the user's explicit confirmation.
+ */
+export class PaidModelConfirmationError extends Error {
+    modelName;
+    detail;
+    constructor(modelName, detail) {
+        super(`${modelName} spends real money. ${detail} Confirm before switching to it.`);
+        this.name = "PaidModelConfirmationError";
+        this.modelName = modelName;
+        this.detail = detail;
+    }
+}
 export { resolveSessionToolResultCharLimit, resolveSessionTurnToolResultCharLimit, } from "./agent-session/helpers.js";
 // ── Agent Session ──────────────────────────────────────────
+/** A prompt that asks for the live web (see AgentSession.attachWebSearchIfAsked). */
+const WEB_INTENT = /\b(?:web|internet|online|google|googling|website|look (?:it |this |that )?up|(?:latest|newest|current) (?:version|release|news|docs?|documentation)|release notes|news)\b/i;
+/** Distinct security rows one run may add to the chat (and session file). */
+const MAX_SECURITY_ROWS_PER_RUN = 20;
+/**
+ * A chat row's target: first line, no control or bidi-override characters
+ * (they could make a command look like another), at most 120 chars.
+ */
+export function securityRowTarget(raw) {
+    const first = (raw.slice(0, 1024).split(/\r?\n/, 1)[0] ?? "")
+        // eslint-disable-next-line no-control-regex -- stripping control characters is the point
+        .replace(/[\u0000-\u001f\u007f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "")
+        .trim();
+    return first.length > 120 ? `${first.slice(0, 119)}\u2026` : first;
+}
+/** Not the home folder or a filesystem root (those are never a project). */
+export function isScannableProjectDir(dir, home = os.homedir()) {
+    const resolved = path.resolve(dir);
+    if (path.parse(resolved).root === resolved)
+        return false;
+    const norm = (p) => (process.platform === "win32" ? p.toLowerCase() : p);
+    return !home || norm(path.resolve(home)) !== norm(resolved);
+}
+/**
+ * Windows on the same project in this process share one in-flight scan
+ * (session start and a feed update otherwise fire N identical scans).
+ */
+const inflightLockfileScans = new Map();
+function sharedLockfileScan(cwd, options) {
+    const run = async () => {
+        const stamp = await stampProjectLockfiles(cwd);
+        const found = stamp.size === 0 ? [] : await scanProjectLockfiles(cwd, options);
+        return { stamp, found };
+    };
+    // Test-specific check options are never shared.
+    if (options)
+        return run();
+    const key = path.resolve(cwd);
+    const existing = inflightLockfileScans.get(key);
+    if (existing)
+        return existing;
+    const promise = run().finally(() => inflightLockfileScans.delete(key));
+    inflightLockfileScans.set(key, promise);
+    return promise;
+}
 export class AgentSession {
     eventBus = new EventBus();
     slashCommands = new SlashCommandRegistry();
@@ -97,6 +194,18 @@ export class AgentSession {
     clearReadTracker;
     recordBashReads;
     skills = [];
+    /** Skills discovery refused to load (safety scan); shown to the user, named by the skill tool. */
+    blockedSkills = [];
+    /** Lockfile entries now known to be malware (background check), for the app/CLI to show. */
+    installedThreats = [];
+    installedWatchStop;
+    installedStamp;
+    installedScanRunning = false;
+    installedWatchStopped = false;
+    /** rule\0target of the security rows already shown this run. */
+    securityRowsThisRun = new Set();
+    /** Project session (code mode): the only kind that writes the "don't install" list. */
+    projectSession = false;
     cacheKeyLogged = false;
     // ── Self-correction hook state (mirrors the TUI's useAgentLoop refs) ──
     // Reset at the start of every run; observed from the event stream; read by
@@ -158,6 +267,8 @@ export class AgentSession {
     deferredCompactionPending = false;
     /** Latest provider count, anchored to the assistant response it measured. */
     providerContext = null;
+    /** See {@link toolDefinitionChars}. */
+    toolCharsCache = null;
     originalRequest = "";
     // Messages queued by the user while a run is in flight. Drained at the
     // mid-loop steering boundary (user steering wins over the hooks), mirroring
@@ -169,6 +280,8 @@ export class AgentSession {
     // different message (or past the end) by the time the cancel arrives.
     userQueue = [];
     queueSeq = 0;
+    /** Monotonic count of human-originated prompts; idle-wake budgets reset on it. */
+    humanPromptSeq = 0;
     /** Instant interrupt: the running loop's preempt listeners, fired on queueMessage. */
     steeringListeners = new Set();
     processManager;
@@ -299,9 +412,25 @@ export class AgentSession {
         }
         return modelInfo?.maxOutputTokens ?? 16384;
     }
+    /** {@link outputCapForRequest} for this session's live model and settings. */
+    requestMaxTokens(accountId) {
+        return outputCapForRequest({
+            provider: this.provider,
+            model: this.model,
+            maxTokens: this.maxTokens,
+            threshold: this.settingsManager.get("compactThreshold"),
+            accountId,
+        });
+    }
     async initialize() {
         // Set model for accurate token estimation
         setEstimatorModel(this.model);
+        // The Anthropic transport needs the current Claude Code version for its
+        // User-Agent before the first request. Without a fresh on-disk cache that
+        // is an npm round-trip (~0.3–3s) on the user's first prompt; start it now
+        // so it overlaps session setup and the user's typing instead.
+        if (this.provider === "anthropic")
+            void getClaudeCliUserAgent().catch(() => { });
         const paths = await ensureAppDirs();
         // Load settings & auth
         this.settingsManager = new SettingsManager(paths.settingsFile);
@@ -312,6 +441,12 @@ export class AgentSession {
         // Session manager. Agent-specific roots keep chat and coder histories isolated.
         this.sessionManager = new SessionManager(this.opts.sessionRootDir ?? paths.sessionsDir);
         const projectCustomization = this.opts.projectCustomization !== false;
+        // A real project folder: not Motion (own skills), not GG Goals (goal notes
+        // folder, agentContext "none"), not chat (no project customization).
+        this.projectSession =
+            projectCustomization &&
+                !this.opts.skills &&
+                (this.opts.agentContext ?? "project") === "project";
         // A sub-agent worker never creates them: the session that owns the
         // project does. EZ Goals' workers work in the user's attached folders,
         // which mustn't gain empty .ezcoder folders as a side effect.
@@ -326,10 +461,13 @@ export class AgentSession {
             this.skills = [...this.opts.skills];
         }
         else if (projectCustomization) {
-            this.skills = await discoverSkills({
+            const discovery = await discoverSkillsWithBlocked({
                 globalSkillsDir: paths.skillsDir,
                 projectDir: this.cwd,
             });
+            this.skills = discovery.skills;
+            this.blockedSkills = discovery.blocked;
+            this.startInstalledPackageWatch();
         }
         else {
             this.skills = [];
@@ -351,6 +489,7 @@ export class AgentSession {
             shareWorkspaceRoots: this.opts.shareRootsWithSubAgents,
             defaultSubAgent: this.opts.defaultSubAgent,
             skills: this.skills,
+            blockedSkills: this.blockedSkills,
             contextLimits: this.contextLimits,
             provider: this.provider,
             model: this.model,
@@ -360,6 +499,7 @@ export class AgentSession {
                 allowOutsideWorkspaceWrites: this.settingsManager.get("allowOutsideWorkspaceWrites"),
                 additionalRoots: this.additionalRoots,
             }),
+            getPackageCooldownDays: () => this.settingsManager.get("packageCooldownDays"),
             getNetworkPolicy: () => ({
                 mode: this.settingsManager.get("networkMode"),
                 allow: this.settingsManager.get("networkAllow"),
@@ -718,6 +858,45 @@ export class AgentSession {
         this.wrapToPromote("spawn_agent", ["wait_agent"]);
         this.wrapToPromote("bash", ["task_output", "task_send", "task_stop"], (args) => args.run_in_background === true);
     }
+    /**
+     * Whether provider-native web search rides along with this request.
+     *
+     * Anthropic's `web_search_20250305` server tool costs ~2.5k prefix tokens on
+     * every request (count_tokens: 6,628 vs 4,098 for the GG prefix without it),
+     * yet web search is reached in ~6% of sessions — the reason the client tool
+     * is deferred everywhere else. So on a tiered Anthropic session it is only
+     * attached once the model has promoted `web_search` (tool_search or a direct
+     * call). The server tool is appended last, so the tool block stays
+     * append-only. Untiered sessions and other providers keep it always on.
+     */
+    nativeWebSearchOn() {
+        if (this.provider !== "anthropic")
+            return true;
+        if (!this.deferredBuiltinToolNames.includes("web_search"))
+            return true;
+        return this.tools.some((t) => t.name === "web_search");
+    }
+    /**
+     * A human prompt that plainly asks for the web gets native web search from
+     * its first request. Without this, an on-demand web_search costs an extra
+     * round trip (tool_search or a client search) before the native tool is
+     * attached — slower than the always-on tool it replaced for exactly the
+     * sessions that need it. Conservative on purpose: a miss only costs that
+     * one discovery turn, a false hit only the ~2.5k-token schema.
+     */
+    attachWebSearchIfAsked(content) {
+        if (this.provider !== "anthropic" || this.nativeWebSearchOn())
+            return;
+        const text = typeof content === "string"
+            ? content
+            : Array.isArray(content)
+                ? content
+                    .map((part) => part && typeof part === "object" && "text" in part ? String(part.text) : "")
+                    .join(" ")
+                : "";
+        if (WEB_INTENT.test(text))
+            this.promoteDeferredBuiltin("web_search");
+    }
     /** Append a deferred built-in to the live tool list (append-only). */
     promoteDeferredBuiltin(name) {
         if (!this.deferredBuiltinToolNames.includes(name))
@@ -810,6 +989,8 @@ export class AgentSession {
         visibility: "transcript",
     }, options = {}) {
         this.prewarmController?.abort();
+        if (provenance.source === "human")
+            this.humanPromptSeq += 1;
         await this.settlePostTurnCompaction();
         await this.adoptDeferredCheckpointBeforePrompt();
         const slash = await this.resolveSlashInput(content);
@@ -837,6 +1018,8 @@ export class AgentSession {
         this.messages.push(userMessage);
         await this.persistMessage(userMessage);
         this.lastPersistedIndex = this.messages.length;
+        if (provenance.source === "human")
+            this.attachWebSearchIfAsked(content);
         await this.runLoop(options);
     }
     /**
@@ -848,11 +1031,13 @@ export class AgentSession {
      */
     async promptWithAttachments(text, attachments) {
         this.prewarmController?.abort();
+        this.humanPromptSeq += 1;
         await this.settlePostTurnCompaction();
         await this.adoptDeferredCheckpointBeforePrompt();
         const parts = this.buildAttachmentParts(text, attachments);
         if (parts.length === 0)
             return;
+        this.attachWebSearchIfAsked(text);
         const userMessage = {
             role: "user",
             content: parts,
@@ -948,6 +1133,7 @@ export class AgentSession {
         this.opts.completionReview?.begin(originalRequest);
         this.lspManager?.clearPendingDiagnostics();
         this.loopMonitor.reset();
+        this.securityRowsThisRun.clear();
         this.verificationTracker.resetRun();
         this.regroundingInjected = false;
         this.runStartedAt = Date.now();
@@ -991,6 +1177,9 @@ export class AgentSession {
                 const call = this.verificationTracker.getToolCall(event.toolCallId);
                 const name = call?.name ?? "";
                 const args = call?.args;
+                const safetyRule = parseSafetyBlock(event.result);
+                if (safetyRule)
+                    this.recordSafetyBlock(safetyRule, name, args, event.details);
                 this.loopMonitor.recordToolEnd(name, args, event.result, event.isError);
                 const verificationChanged = await this.verificationTracker.recordToolCallEnd(event, call, this.planModeRef.current);
                 if (verificationChanged)
@@ -1432,6 +1621,11 @@ export class AgentSession {
             });
             return [...diagnosticMessages, ...processFollowUp];
         }
+        // A check whose exit status could not count (`npm test | tail; node -e …`)
+        // is re-run on its own before the gate decides, so a passing run is not
+        // demanded again. Diagnostics errors take precedence over the re-run.
+        if (diagnosticMessages.length === 0)
+            await this.rerunRefusedCheck();
         // Verification gate: code was edited but nothing verified since the last
         // edit. Off via the `verificationGateEnabled` setting.
         if (this.verificationGateActive()) {
@@ -1506,17 +1700,76 @@ export class AgentSession {
         }
         return null;
     }
+    /**
+     * The model often runs its tests inside a longer command (`npm test 2>&1 |
+     * tail; node -e '…'`) whose exit status belongs to a later part, so the
+     * tests can pass without counting. When the turn would end unverified that
+     * way, run that check once more on its own, through the same bash tool, and
+     * record its real exit status. No model turn and nothing in the transcript:
+     * only the run's verification status changes.
+     */
+    async rerunRefusedCheck() {
+        if (this.planModeRef.current || this.opts.signal?.aborted)
+            return;
+        const check = this.verificationTracker.takeRefusedCheck();
+        if (!check)
+            return;
+        const bash = this.tools.find((tool) => tool.name === "bash");
+        // An explicit timeout stops a stuck run instead of moving it to the
+        // background, which would leave a process for the next turn to collect.
+        const params = bash?.parameters.safeParse({ command: check.command, timeout: 120_000 });
+        if (!bash || !params?.success)
+            return;
+        const startedAt = Date.now();
+        let passed = false;
+        try {
+            const result = await bash.execute(params.data, {
+                signal: this.opts.signal ?? new AbortController().signal,
+                toolCallId: `ez-recheck-${startedAt}`,
+            });
+            const text = typeof result === "string" ? result : result.content;
+            passed = typeof text === "string" && /^Exit code:\s*0(?:\s|$)/.test(text.trim());
+        }
+        catch (error) {
+            if (isAbortError(error) || this.opts.signal?.aborted)
+                return;
+            log("WARN", "verification", `Re-running a refused check failed: ${String(error)}`);
+        }
+        if (this.opts.signal?.aborted)
+            return;
+        this.verificationTracker.recordRefusedCheckRerun(check, passed);
+        log("INFO", "verification", "Re-ran a check whose original exit status could not count", {
+            passed: String(passed),
+            durationMs: String(Date.now() - startedAt),
+        });
+        await this.persistVerificationState();
+    }
     /** Wraps the real run: cancels an in-flight cache prewarm and tracks run
      *  activity / last real request time for {@link prewarm}. */
     async runLoop(options = {}) {
         this.prewarmController?.abort();
         this.runLoopDepth++;
+        if (this.runLoopDepth === 1)
+            this.notifyRunActive(true);
         try {
             await this.runLoopInner(options);
         }
         finally {
             this.runLoopDepth--;
             this.lastRealRequestAt = Date.now();
+            if (this.runLoopDepth === 0)
+                this.notifyRunActive(false);
+        }
+    }
+    /** `opts.onRunActive`, never allowed to throw into the run. */
+    notifyRunActive(active) {
+        try {
+            this.opts.onRunActive?.(active);
+        }
+        catch (err) {
+            log("WARN", "session", "onRunActive listener threw", {
+                message: err instanceof Error ? err.message : String(err),
+            });
         }
     }
     /** Auto-compact if needed, run agent loop with auth retry, and persist messages. */
@@ -1536,7 +1789,10 @@ export class AgentSession {
         }
         // Reset self-correction hook state for this run; pin the latest user message
         // as the verbatim original request for post-compaction re-grounding.
-        const lastUser = [...this.messages].reverse().find((m) => m.role === "user");
+        // A status update that started an idle-wake run is not the user's request.
+        const lastUser = [...this.messages]
+            .reverse()
+            .find((m) => m.role === "user" && m.provenance?.kind !== "notification");
         this.resetHookState(requestTextForRegrounding(lastUser));
         // Resolve OAuth credentials and run agent loop.
         // On 401, force-refresh the token and retry once — the provider may have
@@ -1631,8 +1887,8 @@ export class AgentSession {
                 provider: this.provider,
                 model: this.model,
                 tools: options.disableTools ? [] : this.tools,
-                webSearch: !options.disableTools,
-                maxTokens: this.maxTokens,
+                webSearch: options.disableTools ? false : () => this.nativeWebSearchOn(),
+                maxTokens: this.requestMaxTokens(accountId),
                 maxTurns: this.opts.maxTurns,
                 maxTurnExtensions: this.opts.maxTurnExtensions,
                 // Plan mode caps effort at medium (Codex `plan_mode_reasoning_effort`
@@ -1688,7 +1944,7 @@ export class AgentSession {
                             thinking: this.planModeRef.current || options.capThinking
                                 ? clampThinkingForPlanMode(this.thinkingLevel)
                                 : this.thinkingLevel,
-                            webSearch: !options.disableTools,
+                            webSearch: !options.disableTools && this.nativeWebSearchOn(),
                             supportsImages: modelInfo?.supportsImages,
                             promptCacheKey: this.getPromptCacheKey(),
                         },
@@ -1738,8 +1994,12 @@ export class AgentSession {
                         if (anchor?.role === "assistant") {
                             this.providerContext = { usage: { ...transformOpts.usage }, anchor };
                             // Feed the authoritative usage back into the token estimator so
-                            // char-based estimates track this session's real tokenizer.
-                            calibrateEstimatorFromUsage(messages.slice(0, anchorIndex), transformOpts.usage);
+                            // char-based estimates track this session's real tokenizer. The
+                            // provider's count includes the tool definitions sent with the
+                            // request, so their characters must be counted too — without
+                            // them a short history reads as ~2 chars/token and drags the
+                            // shared ratio down for every session in the process.
+                            calibrateEstimatorFromUsage(messages.slice(0, anchorIndex), transformOpts.usage, options.disableTools ? 0 : this.toolDefinitionChars());
                         }
                     }
                     const force = transformOpts.force === true;
@@ -1790,12 +2050,13 @@ export class AgentSession {
                                     compactedToolCalls: String(pruneResult.compactedToolCalls),
                                     freedTokens: String(pruneResult.freedTokens),
                                 });
-                                // The turn's own usage also counted the pruned content — estimate
-                                // the (now smaller) history so the freed tokens actually defer
-                                // the LLM compaction.
-                                activeTokens = calculateActiveContextTokens(messages, {
-                                    pendingMessages: transformOpts.pendingMessages,
-                                });
+                                // The measured size counted the pruned content, so take the
+                                // freed tokens off it. Never swap the provider's count for a
+                                // whole-history estimate here: that estimate rides a shared
+                                // chars-per-token ratio, and it once read a 234K-token MiMo
+                                // context (23% of 1M) as ~400K and compacted it against a 340K
+                                // trigger.
+                                activeTokens = Math.max(0, activeTokens - pruneResult.freedTokens);
                             }
                         }
                         if (Date.now() < this.compactionRetryAfter)
@@ -1855,6 +2116,12 @@ export class AgentSession {
             }
             finally {
                 this.activeLoopMessages = null;
+                // An in-flight compaction rebinds `this.messages` to the compacted array
+                // while the loop keeps appending to `loopMessages`. Resync on every exit
+                // — a failed or aborted run included — or the session silently drops
+                // this run's post-compaction messages (they are still on disk) and the
+                // next prompt replays a history the provider may reject.
+                this.messages = loopMessages;
             }
         };
         const clearInvalidStaticApiKey = async (error) => {
@@ -1979,7 +2246,17 @@ export class AgentSession {
         // prompt. Detached by design; the pre-run path above remains the backstop.
         this.maybeCompactPostTurn(creds);
     }
-    async switchModel(provider, model) {
+    /**
+     * Switch the session's model. A model that spends real money (Claude fast
+     * mode bills usage credits) is refused unless `confirmPaid` carries the
+     * user's explicit yes, so no caller can switch onto one by accident: every
+     * path (app, CLI, editors, chat bridges, RPC) fails closed by default.
+     */
+    async switchModel(provider, model, options = {}) {
+        const target = getModel(model);
+        if (target?.billing?.paid && options.confirmPaid !== true && model !== this.model) {
+            throw new PaidModelConfirmationError(target.name, target.billing.detail);
+        }
         // The model-switch note is appended to `this.messages`; settle any
         // background compaction first so the note cannot be swapped out.
         await this.settlePostTurnCompaction();
@@ -2043,7 +2320,13 @@ export class AgentSession {
             // Add/remove client-side web_search tool based on provider.
             // Anthropic has native server-side web search; all other providers need the client tool.
             const hasWebSearch = this.tools.some((t) => t.name === "web_search");
-            if (this.provider === "anthropic" && hasWebSearch) {
+            if (this.deferredBuiltinToolNames.includes("web_search")) {
+                // Tiered: the client tool lives in the catalog for every provider and,
+                // once promoted, is swapped for the native server tool by the Anthropic
+                // transport. Nothing to add or remove — doing so would either load the
+                // schema eagerly or take away a capability the model already has.
+            }
+            else if (this.provider === "anthropic" && hasWebSearch) {
                 // Switching TO anthropic — remove client-side web_search (server-side handles it)
                 this.tools = this.tools.filter((t) => t.name !== "web_search");
             }
@@ -2633,6 +2916,117 @@ export class AgentSession {
         this.setSessionPath(loaded.path);
         return this.sessionManager.listBranches(loaded.entries);
     }
+    /** Skills the safety scan kept out of this session, for the app/CLI to show. */
+    getBlockedSkills() {
+        return this.blockedSkills;
+    }
+    /** Installed packages (project lockfiles) now known to be malware. */
+    getInstalledThreats() {
+        return this.installedThreats;
+    }
+    /**
+     * Background check of the project's lockfiles for packages flagged as
+     * malware after they were installed: shortly after start, after each daily
+     * threat-feed update, and after a run that changed a lockfile. Never awaited
+     * by anything; a new hit is shown to the user once (security_notice) and told
+     * to the agent at its next turn. Off under vitest unless a test opts in.
+     */
+    startInstalledPackageWatch() {
+        const enabled = this.opts.installedPackageWatch ?? !process.env.VITEST;
+        // Workers share their parent's project: the parent session watches it.
+        if (!enabled || !this.projectSession || this.opts.subagentWorker || this.installedWatchStop) {
+            return;
+        }
+        // The home folder or a filesystem root is not a project: never scan it.
+        if (!isScannableProjectDir(this.cwd))
+            return;
+        const delay = this.opts.installedPackageWatchDelayMs ?? 5_000;
+        const timer = setTimeout(() => void this.scanInstalledPackages(), delay);
+        timer.unref?.();
+        const offFeed = onThreatFeedUpdated(() => void this.scanInstalledPackages());
+        const offDone = this.eventBus.on("agent_done", () => void this.rescanIfLockfilesChanged());
+        this.installedWatchStop = () => {
+            this.installedWatchStopped = true;
+            clearTimeout(timer);
+            offFeed();
+            offDone();
+        };
+    }
+    async rescanIfLockfilesChanged() {
+        if (!this.installedStamp || this.installedWatchStopped)
+            return;
+        const stamp = await stampProjectLockfiles(this.cwd);
+        if (!sameStamp(stamp, this.installedStamp))
+            await this.scanInstalledPackages();
+    }
+    /**
+     * A guard refused a tool call: a lasting chat row (live event + persisted
+     * marker, so a reopened session shows it too) and, for packages, an entry in
+     * the project's "don't install" list. All fire-and-forget; never blocks.
+     */
+    recordSafetyBlock(rule, toolName, args, details) {
+        const a = (args ?? {});
+        const raw = String(a.command ?? a.input ?? a.file_path ?? a.path ?? a.url ?? toolName);
+        this.emitSecurityRow(rule, securityRowTarget(raw));
+        const packages = details
+            ?.safetyBlock?.packages;
+        if (packages?.length)
+            this.recordBlockedList(packages);
+    }
+    /**
+     * One row per distinct block per run: an agent retrying the same blocked
+     * install 30 times leaves one row, and a run hitting 100 blocks leaves at
+     * most MAX_SECURITY_ROWS_PER_RUN (the session file stays small).
+     */
+    emitSecurityRow(rule, target) {
+        const key = `${rule}\0${target}`;
+        if (this.securityRowsThisRun.has(key))
+            return;
+        if (this.securityRowsThisRun.size >= MAX_SECURITY_ROWS_PER_RUN)
+            return;
+        this.securityRowsThisRun.add(key);
+        this.eventBus.emit("security_block", { rule, target });
+        void this.persistAppMarker("security", { rule, target }).catch(() => { });
+    }
+    recordBlockedList(packages) {
+        const enabled = this.opts.blockedPackagesFile ?? !process.env.VITEST;
+        if (!enabled || !this.projectSession)
+            return;
+        void recordBlockedPackages(this.cwd, packages).then((file) => {
+            if (file)
+                log("INFO", "blocked-packages", `recorded blocked packages in ${file}`);
+        }, (err) => log("WARN", "blocked-packages", `could not record blocked packages: ${String(err)}`));
+    }
+    /** Exposed for tests; safe to call any time (one scan at a time, never throws). */
+    async scanInstalledPackages() {
+        if (this.installedScanRunning || this.installedWatchStopped)
+            return;
+        this.installedScanRunning = true;
+        try {
+            const { stamp, found } = await sharedLockfileScan(this.cwd, this.opts.installedPackageCheck);
+            // Disposed mid-scan: no late events.
+            if (this.installedWatchStopped)
+                return;
+            this.installedStamp = stamp;
+            const known = new Set(this.installedThreats.map((t) => t.key));
+            this.installedThreats = found;
+            for (const threat of found) {
+                if (known.has(threat.key))
+                    continue;
+                log("WARN", "installed-threats", threat.message);
+                this.notify(`installed-threat:${threat.file}`, threat.agentText);
+                this.eventBus.emit("security_notice", { key: threat.key, message: threat.message });
+                this.emitSecurityRow("installed-malware", securityRowTarget(`${threat.packages.join(", ")} in ${path.relative(this.cwd, threat.file) || threat.file}`));
+                this.recordBlockedList(threat.blocked);
+            }
+        }
+        catch (err) {
+            log("WARN", "installed-threats", `installed-package check failed: ${String(err)}`);
+        }
+        finally {
+            this.installedScanRunning = false;
+        }
+    }
     getState() {
         return {
             provider: this.provider,
@@ -2766,6 +3160,74 @@ export class AgentSession {
     notify(id, text) {
         this.notifications.enqueue("goal", id, text, { terminal: true });
     }
+    /**
+     * Observe urgent background alerts — a background task failed or exited
+     * non-zero, or a child agent finished — as they are queued. Hosts use this to
+     * wake an idle session (see {@link continueFromNotifications}); a live run
+     * already receives them at its next steering boundary. Returns unsubscribe.
+     */
+    onBackgroundAlert(listener) {
+        return this.notifications.onUrgent(() => listener());
+    }
+    /**
+     * Characters of the tool definitions sent with every request (name,
+     * description, JSON schema), for estimator calibration. Cached by tool count:
+     * the tool array is append-only.
+     */
+    toolDefinitionChars() {
+        if (this.toolCharsCache?.count === this.tools.length)
+            return this.toolCharsCache.chars;
+        let chars = 0;
+        for (const tool of this.tools) {
+            chars += tool.name.length + tool.description.length;
+            try {
+                chars += JSON.stringify(resolveToolSchema(tool)).length;
+            }
+            catch {
+                // A schema that cannot be serialized is not sent either.
+            }
+        }
+        this.toolCharsCache = { count: this.tools.length, chars };
+        return chars;
+    }
+    /** True while an urgent background alert is waiting to be delivered. */
+    hasPendingBackgroundAlert() {
+        return this.notifications.hasUrgent();
+    }
+    /** Monotonic count of human-originated prompts this session has run. */
+    getHumanPromptSeq() {
+        return this.humanPromptSeq;
+    }
+    /**
+     * Start a run from pending background notifications, for a session that had
+     * already finished its turn. The notifications become one hidden runtime
+     * message (never shown as something the user typed), and the agent decides
+     * whether they need action. Returns false, starting nothing, when no urgent
+     * alert is pending — a live run may have delivered it in the meantime.
+     */
+    async continueFromNotifications() {
+        if (!this.notifications.hasUrgent())
+            return false;
+        this.prewarmController?.abort();
+        await this.settlePostTurnCompaction();
+        await this.adoptDeferredCheckpointBeforePrompt();
+        const notified = this.notifications.drain();
+        if (notified.length === 0)
+            return false;
+        const message = {
+            role: "user",
+            content: buildIdleWakeNotificationText(notified.map((entry) => entry.text)),
+            provenance: { source: "runtime", kind: "notification", visibility: "hidden" },
+        };
+        log("INFO", "notifications", "Starting a run from background alerts", {
+            count: String(notified.length),
+        });
+        this.messages.push(message);
+        await this.persistMessage(message);
+        this.lastPersistedIndex = this.messages.length;
+        await this.runLoop();
+        return true;
+    }
     /** This session's sub-agents (workers), newest-state, including ones restored after a restart. */
     listSubAgents() {
         return this.subAgentManager?.list() ?? [];
@@ -3295,10 +3757,18 @@ export class AgentSession {
             return { enhanced: text, segments: [{ kind: "text", text }] };
         // Keep credentials and settings on the model selected at click time, even
         // if the user switches models while credential resolution is pending.
-        const { provider, model, thinkingLevel, maxTokens, baseUrl } = this;
+        const { provider, model, thinkingLevel, baseUrl } = this;
+        const threshold = this.settingsManager.get("compactThreshold");
         const creds = await this.authStorage.resolveCredentials(provider, {
             storageKeys: this.currentAuthStorageKeys(),
         });
+        const maxTokens = outputCapForRequest({
+            provider,
+            model,
+            maxTokens: this.maxTokens,
+            threshold,
+            accountId: creds.accountId,
+        });
         // Cheap, best-effort stack detection from the project root so terminology is
         // idiomatic to the user's stack. Never throws (returns "" on any failure).
         let stack = "";
@@ -3415,8 +3885,8 @@ export class AgentSession {
                 model: this.model,
                 messages,
                 tools: this.tools,
-                webSearch: true,
-                maxTokens: this.maxTokens,
+                webSearch: this.nativeWebSearchOn(),
+                maxTokens: this.requestMaxTokens(creds.accountId),
                 thinking: this.planModeRef.current
                     ? clampThinkingForPlanMode(this.thinkingLevel)
                     : this.thinkingLevel,
@@ -3511,6 +3981,7 @@ export class AgentSession {
         // First and synchronous: nothing below may delay this, or a hung teardown
         // step leaves background commands running after the app has quit.
         this.stopBackgroundProcesses();
+        this.installedWatchStop?.();
         // Quiesce any in-flight post-turn compaction BEFORE tearing down state:
         // the background compact() snapshots and replaces `this.messages`, so
         // letting it run past this point would checkpoint a near-empty history
@@ -3620,16 +4091,28 @@ export class AgentSession {
         }
         // Auto-compact on load if the restored session exceeds the context window.
         // Without this, huge sessions (1M+ tokens) get loaded into memory and OOM.
-        const creds = await this.authStorage.resolveCredentials(this.provider, {
-            storageKeys: this.currentAuthStorageKeys(),
+        // Credentials only refine the context window here (OpenAI OAuth's Codex
+        // window). A missing login must not make the old conversation unopenable —
+        // the user can switch to a model they're signed in to once it's loaded;
+        // the first prompt still fails cleanly through the run's auth handling.
+        const creds = await this.authStorage
+            .resolveCredentials(this.provider, { storageKeys: this.currentAuthStorageKeys() })
+            .catch((err) => {
+            if (!(err instanceof NotLoggedInError))
+                throw err;
+            log("WARN", "session", "Resuming without credentials for the session model", {
+                provider: this.provider,
+                model: this.model,
+            });
+            return undefined;
         });
         // Cache for sync callers (see field doc) so the app-sidecar's footer shows
         // the right context window immediately on resume, before any prompt runs
         // runLoop() and would otherwise be the first to set this.
-        this.lastAccountId = creds.accountId;
+        this.lastAccountId = creds?.accountId;
         const contextWindow = getContextWindow(this.model, {
             provider: this.provider,
-            accountId: creds.accountId,
+            accountId: creds?.accountId,
         });
         this.sessionId = loaded.header.id;
         this.setSessionPath(loaded.path);
@@ -3639,20 +4122,22 @@ export class AgentSession {
             model: this.model,
             contextWindow,
             threshold: this.settingsManager.get("compactThreshold"),
-            accountId: creds.accountId,
+            accountId: creds?.accountId,
             approvedPlanPath: this.approvedPlanPath,
         });
         log("INFO", "compaction", "Restore compaction decision", {
             provider: this.provider,
             model: this.model,
-            transport: this.provider === "openai" && creds.accountId ? "codex_oauth" : "public_api",
+            transport: this.provider === "openai" && creds?.accountId ? "codex_oauth" : "public_api",
             contextWindow: String(contextWindow),
             activeTokens: "estimated",
             triggerLimit: String(loadPolicy.targetTokens),
         });
         const needsLoadCompaction = this.settingsManager.get("autoCompact") &&
             shouldCompact(this.messages, contextWindow, loadPolicy.threshold, undefined, loadPolicy.targetTokens);
-        if (needsLoadCompaction && this.opts.deferLoadCompaction) {
+        // Without credentials the summary call can't run now; defer it to the first
+        // prompt, by which point the user has picked a model they're signed in to.
+        if (needsLoadCompaction && (this.opts.deferLoadCompaction || !creds)) {
             // Canonicalize again immediately before the first prompt is persisted:
             // another process may create the shared checkpoint after this load.
             this.deferredCompactionPending = true;
@@ -3726,7 +4211,7 @@ export class AgentSession {
     }
     createSlashCommandContext() {
         return {
-            switchModel: (provider, model) => this.switchModel(provider, model),
+            switchModel: (provider, model, options) => this.switchModel(provider, model, options),
             compact: (focus) => this.compact(undefined, "manual", focus),
             newSession: () => this.newSession(),
             listSessions: async () => {