@visual-z/xeno 0.2.0 → 0.3.0

package/src/apps/startup.ts

@@ -1,5 +1,6 @@
 import { release } from "node:os";
-import { workingProtocol } from "../core/continuation.ts";
+import { codingWorkingProtocol } from "../core/continuation.ts";
+import { taskGuidance } from "../core/prompt-policy.ts";
 import { environmentSection, type SessionEnvironment } from "../core/environment.ts";
 /**
  * From argv to a session that can run. Credential order, model selection,
@@ -14,6 +15,8 @@ import { Session, systemClock } from "../runtime/loop.ts";
 import { DEFAULT_PROVIDER, type ProviderConfig } from "../runtime/provider.ts";
 import { createProvider, selectModel, loadCatalog, groupedModels, parseUserCatalog, type CatalogFetch } from "../runtime/catalog.ts";
 import { ExtensionRegistry } from "../runtime/extensions.ts";
+import { DISCOVERY_TOOL_NAME } from "../runtime/tool-discovery.ts";
+import { declaredToolNames } from "../core/tool-discovery.ts";
 import { CATALOG, outputTokenBudget, type ModelSpec } from "../runtime/model.ts";
 import { asThinkingLevel, clampThinkingLevel, supportedThinkingLevels } from "../core/thinking.ts";
 import { modelKey } from "../core/session-position.ts";
@@ -25,10 +28,11 @@ import {
 import { authPath, configDir, readJsonFile } from "../store/config.ts";
 import { loadUiResources, loadTextResources, type UiResources } from "../store/resources.ts";
 import { discoverResources, type ResourceIndex } from "../store/resource-index.ts";
-import { runResourceConfig } from "./resource-browser.ts";
+import { pickProjectTrust, pickStartupSession, runResourceConfig } from "./ui/standalone.ts";
 import { PackageManager, type PackageCommand } from "../runtime/package-manager.ts";
-import { pickProjectTrust } from "./project-trust.ts";
-import { appendSkillsToSystem } from "../core/skills.ts";
+import { loadAcceptanceContract } from "../store/acceptance.ts";
+import type { AcceptanceContract } from "../core/acceptance.ts";
+import { appendSkillsToSystem, type Skill } from "../core/skills.ts";
 import { COMMANDS, resolveSlashCatalog, type SlashCatalog } from "./commands.ts";
 import { createStyle, IDENTITY, type Style } from "../tui/style.ts";
 import type { Settings } from "../core/settings.ts";
@@ -38,69 +42,41 @@ import { readCursor, writeCursor, type Cursor } from "../store/log.ts";
 import { resolveLogDir, findSessionByPrefix, listSessions, sessionsDir, type ResolveLogOpts } from "../store/sessions.ts";
 import { recoverCut } from "../store/recovery.ts";
 import { planSessionEntry, restoreSessionModel } from "../core/session-entry.ts";
-import { pickStartupSession } from "./session-picker.ts";
 import { loadContext, assembleSystemPrompt, formatNotice, type LoadedContext } from "../store/context-files.ts";
 import {
   projectTrust,
 } from "../store/trust.ts";
 import { stat } from "node:fs/promises";
 import {
-  parseToolList, rulesWithAllowTools, selectTools,
+  parseToolList, rulesWithAllowTools, selectTools, isToolProfile,
+  type ToolProfile,
   type PermissionRequest, type PermissionRule,
 } from "../core/permissions.ts";
 import {
-  TOOL_SCHEMAS, DEFAULT_TOOL_CONTEXT, workspaceRoot,
+  TOOL_SCHEMAS, TOOL_DEFINITIONS, modelToolSchema, DEFAULT_TOOL_CONTEXT, workspaceRoot,
   type ApprovalChoice, type ToolContext,
 } from "../runtime/tools.ts";
-import { DEFAULT_BOUNDARY } from "../core/boundary.ts";
-import { DEFAULT_CONTEXT_POLICY, isContextPolicy, type ContextPolicy } from "../core/context-policy.ts";
-import { windowBudget } from "../core/context-window.ts";
+import { assertNever } from "../core/exhaustive.ts";
+import {
+  contextLimits, DEFAULT_CONTEXT_POLICY, isContextPolicy, type ContextLimits, type ContextPolicy,
+} from "../core/context-policy.ts";
 import { colorEnabled, createPalette, describeError, stdinIsTty, stdoutIsTty, type Palette } from "./render.ts";
 import { type ActionId, type Keymap } from "../core/keymap.ts";
+import type { StartupInput } from "./startup-input.ts";
 
 export const SYSTEM_PROMPT = systemPromptFor(TOOL_SCHEMAS.map((tool) => tool.name));
 
 /**
- * The instructions mention only tools the model can actually see. Naming a
- * tool that was excluded from the schema teaches it to call something that
- * will never work. The default prompt is left alone when every tool is visible.
+ * Tool schemas are the only capability inventory. A branch may inherit this
+ * stable policy while narrowing its tools; no parent tool recipe can leak.
  */
 export function systemPromptFor(toolNames: readonly string[], env?: SessionEnvironment): string {
-  const has = (name: string) => toolNames.includes(name);
-  const toolsLine = toolNames.length === 0
-    ? "No tools are available in this session."
-    : `Tools: ${toolNames.join(", ")}.` +
-      (toolNames.some(name => ["grep", "find", "ls"].includes(name)) ? " Use the available grep/find/ls tools for confined search." : "") +
-      (has("bash")
-        ? " Use bash for verification commands and operations the other tools do not cover."
-        : "");
-
-  // Each line answers a failure class in the Terminal-Bench taxonomy
-  // (arXiv 2601.11868): premature termination, no verification, step
-  // repetition. The wording of the first and last follows the Codex
-  // prompting guide: persist end to end, and end on a change or a blocker.
-  const work = [
-    "How to work:",
-    "- Keep going until the request is fully resolved. When a reasonable assumption lets you proceed, make it and mention it at the end; stop to ask only when blocked on a decision only the user can make.",
-    "- Understand before changing: read the relevant code, and for a bug, reproduce it first.",
-    "- Put independent reads and searches in one response; they run in parallel.",
-    "- After a change, run the project's own tests, build or type check. When a command fails, read the end of its output first; errors and summaries are printed last.",
-    "- If the same approach fails twice, change the approach instead of retrying it.",
-    "- A claim without a passing command is not evidence. Finish with what changed and the command that verified it, or the specific blocker.",
-  ];
-  if (has("bash")) work.push(
-    "- Each bash call is a fresh non-interactive shell with no TTY: use workdir or `cd dir && ...` within one call. Never open pagers or interactive editors. " +
-    "Start servers in the background with output redirected (`nohup cmd > app.log 2>&1 &`), then poll the log or port. Pass a larger timeout for long builds and installs.",
-  );
-  if (has("exec_command")) work.push("- For servers, REPLs and programs that prompt for input, use exec_command (tty=true when the program needs a terminal) and continue with write_stdin.");
-  if (has("edit")) work.push("- Prefer edit to rewriting a whole file; copy old_string from read output without the line numbers.");
-
   return [
-    "You are a coding agent working in a terminal.",
-    toolsLine,
+    "You are an agent working in a terminal.",
+    "The declared tool schemas define available capabilities, input units and execution lifecycles. Do not assume additional tools or infer permission from a tool's visibility.",
     ...(env === undefined ? [] : [environmentSection(env)]),
-    work.join("\n"),
-    workingProtocol(toolNames),
+    taskGuidance(),
+    codingWorkingProtocol(toolNames),
     "Be concise. Do not narrate what you are about to do; do it, then say what happened.",
   ].join("\n\n");
 }
@@ -127,12 +103,12 @@ export function sessionEnvironment(workspace: string): SessionEnvironment {
  * Session policy a CLI coding session differs from a benchmark run in.
  * Benchmarks construct their own SessionConfig and keep the core defaults.
  */
-export function cliSessionConfig(args: Args): { continuationAfter: number; timeBudgetMs?: number } {
+export function cliSessionConfig(args: Args): { continuationAfter: number; workingSet: true; workingSetVersion: 2; guidanceVersion: 1; strictVerification: true; timeBudgetMs?: number } {
   // Never within a request. A real Kimi K3 run with the reminder at reply six
   // spent half its requests on notes after the work was already verified
   // (fix-cli-continuation-noise). The reminder still fires where it earns its
   // place: a resumed handoff that cannot continue, and boundary preparation.
-  return { continuationAfter: Infinity, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
+  return { continuationAfter: Infinity, workingSet: true, workingSetVersion: 2, guidanceVersion: 1, strictVerification: true, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
 }
 
 /**
@@ -150,6 +126,7 @@ export type AskSlot = {
 };
 
 export interface Args {
+  shellCheckpoints?: boolean;
   workspace: string;
   /**
    * `--state-dir <dir>`: where every xeno write goes -- snapshots, tool
@@ -192,6 +169,9 @@ export interface Args {
   systemPrompt: string | null;
   /** `--tools` allowlist. Omitted when the flag was not passed. */
   tools?: string[];
+  /** New sessions default to coding; restored context keeps its frozen schemas. */
+  toolProfile?: ToolProfile;
+  acceptanceFile?: string;
   excludeTools: string[];
   noTools: boolean;
   /** `--no-builtin-tools`. False when the flag was not passed. */
@@ -257,6 +237,7 @@ export interface Args {
  * parses; it just cannot be offered as a suggestion.
  */
 const KNOWN_FLAGS: readonly string[] = [
+  "--checkpoint-shell",
   "--workspace", "-w",
   "--path-root",
   "--state-dir",
@@ -282,6 +263,8 @@ const KNOWN_FLAGS: readonly string[] = [
   "--system-prompt",
   "--append-system-prompt",
   "--tools", "-t",
+  "--tool-profile",
+  "--acceptance-file",
   "--exclude-tools", "-xt",
   "--no-tools", "-nt",
   "--no-builtin-tools",
@@ -346,32 +329,6 @@ function rejectUnknownFlag(flag: string): never {
   process.exit(1);
 }
 
-/**
- * Stop the terminal echoing before startup does anything slow.
- *
- * Reading auth, scanning context files and printing the header all happen
- * before the TUI attaches. In cooked mode the tty echoes whatever is typed
- * during that window, so keystrokes land *between* the banner's own lines
- * and look like output the program produced. Raw mode is the TUI's anyway;
- * taking it at the first instruction just closes the gap.
- *
- * `stdin` is a parameter so the decision is testable without a real tty.
- * Returns an undo so a caller that bails out can put the terminal back.
- */
-export function silenceTtyEarly(opts: {
-  interactive: boolean;
-  stdin?: Pick<NodeJS.ReadStream, "isTTY" | "setRawMode" | "resume">;
-}): () => void {
-  const stdin = opts.stdin ?? process.stdin;
-  if (!opts.interactive || stdin.isTTY !== true) return () => {};
-  stdin.setRawMode(true);
-  // Leave input buffered until ProcessTerminal installs its listener. Resuming
-  // here drops keystrokes typed while startup or transcript loading awaits I/O.
-  return () => {
-    if (stdin.isTTY === true) stdin.setRawMode(false);
-  };
-}
-
 export function parseArgs(argv: string[], options: { deferExtensions?: boolean; flags?: ReadonlyMap<string, ExtensionFlag> } = {}): Args {
   let selectedTheme: string | undefined;
   const args: Args = {
@@ -399,7 +356,8 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
       console.error(`${a} requires a value`);
       process.exit(1);
     }
-    if (a === "--workspace" || a === "-w") args.workspace = argv[++i] ?? args.workspace;
+    if (a === "--checkpoint-shell") args.shellCheckpoints = true;
+    else if (a === "--workspace" || a === "-w") args.workspace = argv[++i] ?? args.workspace;
     else if (a === "--path-root") args.pathRoot = resolve(argv[++i] ?? "/");
     else if (a === "--state-dir") args.stateDir = resolve(argv[++i] ?? ".");
     else if (a === "--time-budget") {
@@ -454,6 +412,15 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
     else if (a === "--system-prompt") args.systemPrompt = argv[++i] ?? "";
     else if (a === "--append-system-prompt") args.appendSystemPrompt.push(argv[++i] ?? "");
     else if (a === "--tools" || a === "-t") args.tools = parseToolList(argv[++i] ?? "");
+    else if (a === "--acceptance-file") {
+      const path = argv[++i]; if (!path || path.startsWith("--")) throw new Error("--acceptance-file requires a JSON path");
+      args.acceptanceFile = path;
+    }
+    else if (a === "--tool-profile") {
+      const value = argv[++i] ?? "";
+      if (!isToolProfile(value)) throw new Error("unknown tool profile; choose coding, readonly, research, data or full");
+      args.toolProfile = value;
+    }
     else if (a === "--exclude-tools" || a === "-xt") args.excludeTools = parseToolList(argv[++i] ?? "");
     else if (a === "--no-tools" || a === "-nt") args.noTools = true;
     else if (a === "--no-builtin-tools" || a === "-nbt") args.noBuiltinTools = true;
@@ -623,16 +590,17 @@ export function formatStartupHeader(input: {
     `workspace  ${input.workspace}`,
     `session    ${input.session}`,
   ];
-  const pushCount = (label: string, items: readonly string[]): void => {
-    lines.push(`${label.padEnd(10)}${items.length}`);
-    if (input.verbose) {
+  const groups: [string, readonly string[]][] = [["agents", input.agents], ["skills", input.skills], ["prompts", input.prompts],
+    ...(input.tools !== undefined ? [["tools", input.tools] as [string, readonly string[]]] : [])];
+  if (input.verbose) {
+    for (const [label, items] of groups) {
+      lines.push(`${label.padEnd(10)}${items.length}`);
       for (const item of items) lines.push(`  ${item}`);
     }
-  };
-  pushCount("agents", input.agents);
-  pushCount("skills", input.skills);
-  pushCount("prompts", input.prompts);
-  if (input.tools !== undefined) pushCount("tools", input.tools);
+  } else {
+    // Four count rows were a third of the banner; one row says the same.
+    lines.push(`loaded     ${groups.map(([label, items]) => `${items.length} ${label}`).join(" · ")}`);
+  }
   const keys = formatShortcutLine(input.keymap);
   if (keys.length > 0) lines.push(`keys       ${keys}`);
   return lines;
@@ -835,13 +803,14 @@ export function describeUnauthenticatedScript(catalog: readonly ModelSpec[] = CA
   );
 }
 
-/** Banner / hint for an interactive session that started without a key. */
-export function describeUnauthenticatedSession(catalog: readonly ModelSpec[] = CATALOG): string {
-  const vars = [...new Set(catalog.map((m) => m.provider))].map((p) => envLabel(p));
-  return (
-    `no credential. This session cannot send until one is set. ` +
-    `Export ${vars.join(" or ")}, or run /login <provider>`
-  );
+/**
+ * Banner / hint for an interactive session that started without a key.
+ * Listing every provider's variable was a 20-line wall that buried the one
+ * action that works from here; the interactive routes are named instead.
+ */
+export function describeUnauthenticatedSession(_catalog: readonly ModelSpec[] = CATALOG): string {
+  return "no provider connected yet. Type /login to connect one — a Claude, ChatGPT or Copilot subscription, an API key, a gateway or a local server — " +
+    `or export a key such as ${["anthropic", "openai", "google", "deepseek"].map(provider => envLabel(provider).split(" or ")[0]).join(", ")}.`;
 }
 
 export function retryHandler(io: AppIO): (attempt: number, delayMs: number, error: unknown) => void {
@@ -858,6 +827,7 @@ export function retryHandler(io: AppIO): (attempt: number, delayMs: number, erro
 
 export function toolSelectionOf(args: Args) {
   return {
+    profile: args.toolProfile ?? "coding",
     ...(args.noTools ? { none: true as const } : {}),
     ...(args.tools !== undefined ? { only: args.tools } : {}),
     ...(args.excludeTools.length > 0 ? { exclude: args.excludeTools } : {}),
@@ -868,25 +838,40 @@ export function toolSelectionOf(args: Args) {
 /**
  * Schema assembly: every tool is tagged with a source here so
  * `--no-builtin-tools` can drop a category without a later cross-layer
- * recut. Today the only producer is builtin; an extension would push
- * `{ ...schema, source: "extension" }` into this list.
+ * recut. Optional extension descriptors remain local until selected; their
+ * harness-owned discovery entry belongs to that extension-enabled capability set.
  *
  * `source` is stripped before the frozen prefix: the wire schema is what
  * the provider bills, and an extra field there would look like a tool
  * argument.
  */
-export function visibleSchemas(args: Args, extensions?: ExtensionRegistry) {
+export function sessionToolCatalog(args: Args, extensions?: ExtensionRegistry, previous: readonly unknown[] = []) {
   const custom = [...extensions?.definitions().values() ?? []].map(({ name, description, input_schema }) => ({ name, description, input_schema, source: "extension" as const }));
-  const available = [...TOOL_SCHEMAS.filter(tool => !extensions?.tools.has(tool.name)).map((t) => ({ ...t, source: "builtin" as const })), ...custom];
-  return selectTools(available, toolSelectionOf(args)).map((tool) => {
-    const { source, ...schema } = tool;
-    void source;
-    return schema;
-  });
+  const available = [...TOOL_DEFINITIONS.filter(tool => !extensions?.tools.has(tool.name) && (!tool.optional || args.tools?.includes(tool.name))).map((t) => ({ ...t, source: "builtin" as const })), ...custom];
+  const selected = selectTools(available, toolSelectionOf(args));
+  const deferred = selected.filter(tool => tool.source === "extension" && extensions?.tools.get(tool.name)?.exposure === "deferred")
+    .map(({ name, description, input_schema }) => ({ name, description, input_schema }));
+  const deferredNames = new Set(deferred.map(tool => tool.name));
+  const active = new Set([...declaredToolNames(previous), ...args.tools ?? []]);
+  const visible = selected.filter(tool => (!deferredNames.has(tool.name) || active.has(tool.name)) &&
+    (tool.name !== DISCOVERY_TOOL_NAME || deferred.length > 0 || args.tools?.includes(DISCOVERY_TOOL_NAME)));
+  // A cold open must not reorder an already accepted declaration and invent a checkpoint.
+  const order = new Map(declaredToolNames(previous).map((name, index) => [name, index]));
+  visible.sort((a, b) => (order.get(a.name) ?? Infinity) - (order.get(b.name) ?? Infinity));
+  const builtins = visible.filter(tool => tool.source === "builtin").map(tool => tool.name);
+  const schemas = visible.map(tool => tool.source === "builtin" ? modelToolSchema(tool, builtins)
+    : { name: tool.name, description: tool.description, input_schema: tool.input_schema });
+  // D6: extension authors retain their registration objects and SDK catalog views.
+  // Neither may mutate the already frozen provider declaration through an alias.
+  return { schemas: JSON.parse(JSON.stringify(schemas)) as typeof schemas,
+    deferred: JSON.parse(JSON.stringify(deferred)) as typeof deferred };
+}
+export function visibleSchemas(args: Args, extensions?: ExtensionRegistry, previous: readonly unknown[] = []) {
+  return sessionToolCatalog(args, extensions, previous).schemas;
 }
 
 export function unknownToolNames(names: readonly string[]): string[] {
-  const known = new Set(TOOL_SCHEMAS.map((t) => t.name));
+  const known = new Set(TOOL_DEFINITIONS.map((t) => t.name));
   return names.filter((n) => !known.has(n));
 }
 
@@ -903,9 +888,11 @@ export function createSessionFor(opts: {
   oauth?: boolean;
   effects?: ResolveEffects;
   extensions?: ExtensionRegistry;
+  acceptanceContract?: AcceptanceContract;
+  skills?: readonly Skill[];
 }): Session {
   const { args, workspace, logDir, blobDir, system, providerConfig, credential, io, askSlot } = opts;
-  const schemas = visibleSchemas(args, opts.extensions);
+  const { schemas, deferred } = sessionToolCatalog(args, opts.extensions);
   const names = schemas.map((t) => t.name);
   const sessionRules: PermissionRule[] = [];
   const tools: ToolContext = {
@@ -913,6 +900,7 @@ export function createSessionFor(opts: {
     ...DEFAULT_TOOL_CONTEXT,
     ...(args.pathRoot === undefined ? {} : { pathRoot: args.pathRoot }),
     allow: names,
+    deferredTools: deferred,
     rules: rulesWithAllowTools(args.allowTools),
     sessionRules,
     askSlot,
@@ -923,9 +911,12 @@ export function createSessionFor(opts: {
       logDir,
       frozen: { system, tools: schemas },
       blobDir,
+      shellCheckpoints: args.shellCheckpoints === true,
       tools,
       maxTurns: args.maxTurns,
       ...cliSessionConfig(args),
+      ...(opts.skills ? { skills: opts.skills } : {}),
+      ...(opts.acceptanceContract ? { acceptanceContract: opts.acceptanceContract } : {}),
       // Explicit legacy thresholds still select that experiment unless overridden.
       contextPolicy: args.contextPolicy ?? (args.trigger > 0 ? "segmented" : DEFAULT_CONTEXT_POLICY),
       ...(args.trigger > 0
@@ -961,6 +952,7 @@ export function sessionDirFor(args: Args, workspace: string): string | undefined
 }
 
 type OpenSessionOptions = Omit<Parameters<typeof createSessionFor>[0], "providerConfig" | "credential" | "oauth" | "system"> & {
+  startupPhase?: (name: string) => void;
   catalog: readonly ModelSpec[];
   auth: AuthFile;
   credentialOf: (spec: ModelSpec) => Resolved;
@@ -1008,8 +1000,9 @@ export async function loadSessionResources(args: Args, workspace: string, io: Ap
   for (const line of new Set([...loaded.diagnostics, ...text.diagnostics, ...slash.diagnostics])) io.say(io.palette.yellow(`  ${line}`));
   const system = appendSkillsToSystem(assembleSystemPrompt(systemPromptFor(visibleSchemas(args, extensions).map(tool => tool.name), sessionEnvironment(workspace)), loadedContext), text.skills);
   const ui = toUiState(loaded, colorEnabled());
+  // Also reached on /resume and /reload: `auto` is resolved once per process by the Tui (apps/shell.ts), not here.
   if (args.tuiMode) ui.settings = { ...ui.settings, tuiMode: args.tuiMode };
-  return { loadedContext, slash: { ...slash.catalog, skillCommands: loaded.settings.enableSkillCommands !== false }, ui, index, trusted, system, extensions };
+  return { loadedContext, slash: { ...slash.catalog, skillExecution: true, skillCommands: loaded.settings.enableSkillCommands !== false }, ui, index, trusted, system, extensions };
 }
 
 /**
@@ -1021,6 +1014,7 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   session: Session; priorCursor: Cursor | null; providerConfig: ProviderConfig; credential: Resolved;
   workspace: string; blobDir: string; system: string; resources: Awaited<ReturnType<typeof loadSessionResources>>;
 }> {
+  opts.startupPhase?.("Reading session history");
   const recorded = await readCursor(opts.logDir);
   const priorCursor = recorded === null ? null : await recoverCut(opts.logDir, recorded);
   const workspace = priorCursor?.workspace ?? opts.workspace;
@@ -1029,11 +1023,12 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
     if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error("saved workspace is outside --path-root");
   }
   if (opts.preparedResources && opts.preparedResources.workspace !== workspace) await opts.preparedResources.value.extensions.dispose();
+  opts.startupPhase?.("Loading session resources");
   const resources = opts.preparedResources?.workspace === workspace ? opts.preparedResources.value
     : await loadSessionResources(opts.args, workspace, opts.io, workspace === opts.workspace ? opts.projectTrusted : undefined);
   const interactive = opts.interactive && !opts.args.print && !opts.args.prompt && opts.args.mode !== "json";
   const named = [...opts.args.tools ?? [], ...opts.args.excludeTools, ...opts.args.allowTools];
-  const unknown = unknownToolNames(named).filter(name => !resources.extensions.tools.has(name));
+  const unknown = unknownToolNames(named).filter(name => !resources.extensions.definitions().has(name));
   if (unknown.length) throw new Error(`unknown tool: ${unknown.join(", ")}`);
   const saved = priorCursor === null ? undefined : restoreSessionModel(priorCursor, opts.catalog);
   const flags = { ...opts.modelFlags ?? { model: "", provider: "" } };
@@ -1042,6 +1037,7 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   const explicit = flags.model.length > 0 || flags.provider.length > 0;
   const settings = opts.settings ?? {};
   const preferred = saved ?? opts.fallback?.spec;
+  opts.startupPhase?.("Resolving model credentials");
   const selected = !explicit && preferred !== undefined
     ? { ok: true as const, spec: preferred }
     : selectModel(settings, flags, (spec) => opts.credentialOf(spec).ok, opts.catalog);
@@ -1075,10 +1071,14 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   const restoring = saved ?? spec;
   const restoringCredential = saved === undefined ? credential : opts.credentialOf(restoring);
   const oauth = (model: ModelSpec, got: Resolved) => got.ok && storedIsOAuth(opts.auth, model.provider) && opts.args.apiKey.length === 0;
+  const acceptanceContract = priorCursor === null
+    ? await loadAcceptanceContract(workspace, resources.trusted, opts.args.acceptanceFile) : undefined;
   const session = createSessionFor({
     ...opts,
     system: resources.system,
     extensions: resources.extensions,
+    skills: [...resources.slash.skills.values()],
+    ...(acceptanceContract ? { acceptanceContract } : {}),
     workspace: priorCursor?.workspace ?? opts.workspace,
     blobDir: priorCursor?.blob_dir ?? (priorCursor?.workspace && priorCursor.workspace !== opts.workspace
       ? statePaths(priorCursor.workspace, opts.args.stateDir).blobs : opts.blobDir),
@@ -1086,10 +1086,12 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
     credential: restoringCredential,
     ...(oauth(restoring, restoringCredential) ? { oauth: true } : {}),
   });
+  opts.startupPhase?.("Opening session history");
   await session.start();
+  resources.slash = { ...resources.slash, skills: new Map((session.config.skills ?? []).map(skill => [skill.name, skill])) };
   if (resources.extensions.loaded.length || session.config.frozen.tools.some(tool =>
     typeof tool === "object" && tool !== null && "name" in tool && typeof tool.name === "string" && unknownToolNames([tool.name]).length)) {
-    await session.reloadResources({ system: resources.system, tools: visibleSchemas(opts.args, resources.extensions) });
+    await session.reloadResources({ system: resources.system, tools: visibleSchemas(opts.args, resources.extensions, session.config.frozen.tools) });
   }
   if (restoring.id !== spec.id || restoring.provider !== spec.provider) {
     await session.switchModel(createProvider(providerConfig, credential.ok ? credential.key : "", retryHandler(opts.io),
@@ -1103,7 +1105,8 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
     blobDir: session.config.blobDir ?? opts.blobDir, system: session.config.frozen.system, resources };
 }
 
-export async function startup(args: Args): Promise<App> {
+export async function startup(args: Args, input?: StartupInput): Promise<App> {
+  const withTerminal = <T>(run: (handoff: () => void) => Promise<T>): Promise<T> => input ? input.runWithTerminal(run) : run(() => {});
   if (args.extensionArgv && (args.listModels || args.modelsCommand || args.configCommand)) rejectUnknownFlag("--" + Object.keys(args.extensionInputs ?? {})[0]);
   const C = createPalette(colorEnabled());
   let printMode = isPrintMode(args);
@@ -1158,6 +1161,7 @@ export async function startup(args: Args): Promise<App> {
   }
 
   // File only. Passing fetch here would make the test of D16 un-runnable.
+  input?.phase("Loading model catalog");
   const loaded = loadCatalog(await readModelSources());
   for (const warning of loaded.warnings) io.say(C.yellow(`  ${warning}`));
   const catalog = loaded.models;
@@ -1187,6 +1191,7 @@ export async function startup(args: Args): Promise<App> {
    * It has to happen before model selection so a trusted `.xeno/settings.json`
    * can override the default model. Trust does not affect tools.
    */
+  input?.phase("Opening workspace");
   let workspace: string;
   try {
     workspace = await workspaceRoot(args.workspace);
@@ -1206,6 +1211,7 @@ export async function startup(args: Args): Promise<App> {
     }
   }
 
+  input?.phase("Preparing extensions and project settings");
   await prepareExtensionPackages(args,workspace);
   const trust = await projectTrust(workspace, args.approve);
   let loadProjectSettings = trust.trusted;
@@ -1213,11 +1219,11 @@ export async function startup(args: Args): Promise<App> {
     if (!stdinIsTty() || !stdoutIsTty()) {
       const index = await discoverResources({ ...args, workspace, trusted: loadProjectSettings });
       for (const entry of index.entries) io.say(`${entry.enabled ? "[x]" : "[ ]"} ${entry.kind} ${entry.scope}${entry.package?" · "+entry.package.source:""} ${entry.path}`);
-    } else await runResourceConfig({ ...args, workspace, trusted: loadProjectSettings });
+    } else await withTerminal(handoff => runResourceConfig({ ...args, workspace, trusted: loadProjectSettings }, handoff));
     process.exit(0);
   }
   const hasProjectResources = (await Promise.all(["settings.json", "keybindings.json", "skills", "prompts", "themes", "extensions"].map(name => stat(join(workspace, ".xeno", name)).then(() => true, () => false)))).some(Boolean);
-  if (!args.help && hasProjectResources && args.approve === undefined && !trust.saved && trust.policy === "ask" && isInteractiveSession(args)) loadProjectSettings = await pickProjectTrust(workspace);
+  if (!args.help && hasProjectResources && args.approve === undefined && !trust.saved && trust.policy === "ask" && isInteractiveSession(args)) loadProjectSettings = await withTerminal(handoff => pickProjectTrust(workspace, handoff));
   if (hasProjectResources && !loadProjectSettings) io.say(C.dim("  Project resources not loaded (project is not trusted). /trust changes resource trust; tool permissions are separate."));
 
   // Resolve the resource owner before factories run. Parsing flags must not load a different cwd first.
@@ -1231,6 +1237,7 @@ export async function startup(args: Args): Promise<App> {
     else if (args.continueLatest) resourceLog = (await listSessions(workspace, sessionDirFor(args, workspace), Infinity)).sessions.find(session => session.ok)?.path;
     if (resourceLog) resourceWorkspace = (await readCursor(resourceLog))?.workspace ?? workspace;
   }
+  input?.phase("Loading session resources");
   const preparedResources = prepareFlags
     ? { workspace: resourceWorkspace, value: await loadSessionResources(args, resourceWorkspace, io, resourceWorkspace === workspace ? loadProjectSettings : undefined) } : undefined;
   if (args.help) { printCliHelp(preparedResources?.value.extensions.flags); await preparedResources?.value.extensions.dispose(); process.exit(0); }
@@ -1268,8 +1275,8 @@ export async function startup(args: Args): Promise<App> {
       if (printMode || jsonMode || !stdinIsTty() || !stdoutIsTty()) {
         throw new Error("--resume needs an interactive terminal. Pass -r <id> or --session <id> instead");
       }
-      const picked = await pickStartupSession({ workspace, style: ui.style, say: io.say, keymap: ui.keymap,
-        ...(sessionDir === undefined ? {} : { sessionDir }) });
+      const picked = await withTerminal(handoff => pickStartupSession({ workspace, theme: ui.theme, say: io.say, keymap: ui.keymap,
+        ...(sessionDir === undefined ? {} : { sessionDir }) }, handoff));
       if (picked === null) { io.say(C.dim("No session selected")); process.exit(0); }
       sessionOpts = { explicit: picked };
     }
@@ -1301,6 +1308,7 @@ export async function startup(args: Args): Promise<App> {
       settings: mergedSettings, modelFlags: { model: args.model, provider: args.provider }, projectTrusted: loadProjectSettings,
       ...(preparedResources ? { preparedResources } : {}),
       interactive: isInteractiveSession(args),
+      ...(input ? { startupPhase: input.phase } : {}),
     });
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
@@ -1335,6 +1343,21 @@ export async function startup(args: Args): Promise<App> {
   };
 }
 
+/** The banner's words for the shared limits; the loop acts at exactly these numbers. */
+export function boundaryDescription(policy: ContextPolicy, limits: ContextLimits): string {
+  switch (limits.kind) {
+    case "stop":
+    case "open":
+      return "continuous replay; stops at model window";
+    case "window":
+      return `windowed replay; prepare ${limits.prepare}, cut ${limits.trigger}, output reserved`;
+    case "segment":
+      return `${policy}${policy === "windowed" ? " (unknown window; fixed fallback)" : ""}; cut ${limits.trigger}, hard ${limits.hard}`;
+    default:
+      return assertNever(limits, "boundaryDescription");
+  }
+}
+
 function printBanner(
   args: Args,
   io: AppIO,
@@ -1384,13 +1407,14 @@ function printBanner(
     const line = formatNotice(notice);
     io.say(notice.kind === "skipped" ? C.yellow(`  ${line}`) : C.dim(`  ${line}`));
   }
-  const { triggerTokens: trigger, hardTokens: hard } = { ...DEFAULT_BOUNDARY, ...session.config.boundary };
   const policy = session.config.contextPolicy ?? DEFAULT_CONTEXT_POLICY;
-  const budget = windowBudget(session.provider.config.spec.contextWindow, session.provider.config.maxTokens);
-  const description = policy === "continuous" ? "continuous replay; stops at model window"
-    : policy === "windowed" && budget !== null ? `windowed replay; prepare ${budget.prepare}, cut ${budget.trigger}, output reserved`
-    : `${policy}${policy === "windowed" ? " (unknown window; fixed fallback)" : ""}; cut ${trigger}, hard ${hard}`;
-  io.say(C.dim(`boundary   ${description} (estimated tokens)`));
+  const limits = contextLimits({
+    policy,
+    contextWindow: session.provider.config.spec.contextWindow,
+    outputReserve: session.provider.config.maxTokens,
+    ...(session.config.boundary ? { boundary: session.config.boundary } : {}),
+  });
+  io.say(C.dim(`boundary   ${boundaryDescription(policy, limits)} (estimated tokens)`));
   if (priorCursor !== null) {
     const events = session.state.events.length;
     io.say(
@@ -1419,6 +1443,8 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [--system-prompt <text-or-file>] [--append-system-prompt <text>]\n" +
           "            [--no-context-files|-nc]\n" +
           "            [--tools names] [--exclude-tools names] [--no-tools]\n" +
+          "            [--tool-profile coding|readonly|research|data|full]\n" +
+          "            [--acceptance-file contract.json]\n" +
           "            [--no-builtin-tools]\n" +
           "            [--allow-tools names] [--approve|--no-approve]\n" +
           "            [--theme <name|path>] [--use-theme name] [--no-themes] [--thinking level] [--models patterns]\n" +
@@ -1440,10 +1466,12 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "  --system-prompt replaces the built-in instructions (text, or a file that exists).\n" +
           "  --append-system-prompt appends; repeatable. -nc skips AGENTS.md discovery.\n" +
           "  --tools is a strict allowlist; excluded tools leave the schema.\n" +
+          "  New sessions use coding (10 tools); full exposes default built-ins.\n" +
           "  --no-builtin-tools drops built-ins and keeps any other source; --tools still wins.\n" +
           "  bash asks before it runs. --allow-tools bash skips the ask for this process.\n" +
           "  --time-budget <seconds> tells the model, once, when 75% of the run's wall-clock budget is used.\n" +
           "  --state-dir <dir> keeps snapshots, observations and sessions out of the workspace.\n" +
+          "  --checkpoint-shell enables best-effort Git recovery for command changes; ignored files and external effects are excluded.\n" +
           "  --path-root <dir> lets file tools reach absolute paths under <dir> (e.g. / in a container);\n" +
           "  relative paths, fingerprints and /back stay in the workspace, so edits outside it are not rewound.\n" +
           "  --approve loads .xeno/settings.json this run; --no-approve skips it.\n" +