@visual-z/xeno 0.2.1 → 0.4.0

package/src/apps/approve.ts

@@ -9,7 +9,7 @@
 
 import type { PermissionRequest } from "../core/permissions.ts";
 import type { ApprovalChoice } from "../runtime/tools.ts";
-import type { SelectItem } from "../tui/select.ts";
+import type { ListItem } from "../tui/ui/list-model.ts";
 
 export function approvalHeading(request: PermissionRequest): string {
   if (request.command !== undefined) {
@@ -24,8 +24,8 @@ export function approvalHeading(request: PermissionRequest): string {
   return `${request.tool} wants to run. Approval is the last look, not a boundary.`;
 }
 
-export function approvalItems(request: PermissionRequest): SelectItem[] {
-  const items: SelectItem[] = [{ value: "once", label: "this once" }];
+export function approvalItems(request: PermissionRequest): ListItem[] {
+  const items: ListItem[] = [{ value: "once", label: "this once" }];
   if (request.command !== undefined) {
     items.push({ value: "command", label: "this command this session" });
   }

package/src/apps/cli.ts

@@ -19,8 +19,16 @@ import { createStartupInput } from "./startup-input.ts";
 import { runPrompt, runRepl } from "./shell.ts";
 import { runPackageCommand } from "../runtime/package-manager.ts";
 import { exportHtmlFile } from "./export-cli.ts";
+import { CONTROL_SCHEMA } from "../core/control-protocol.ts";
+import { sessionControl } from "../runtime/session-control.ts";
+import { listenControl } from "./control-transport.ts";
+import { runAppServer } from "./app-server.ts";
 
-const args = parseArgs(process.argv.slice(2), { deferExtensions: true });
+const serverMode = process.argv[2] === "app-server";
+if (serverMode && process.argv[3] === "schema") { console.log(JSON.stringify(CONTROL_SCHEMA, null, 2)); process.exit(0); }
+const args = parseArgs(process.argv.slice(serverMode ? 3 : 2), { deferExtensions: true });
+if (serverMode) { args.print = true; args.mode = "json"; if (args.prompt) throw Error("app-server receives prompts through turn/start"); }
+let closeControl: (() => Promise<void>) | undefined;
 const input = createStartupInput({ interactive: isInteractiveSession(args) && !args.packageCommand && !args.version && !args.exportFile && !args.listModels && !args.modelsCommand });
 process.once("exit", input.restore);
 try {
@@ -43,22 +51,29 @@ try {
     finally { process.off("SIGINT", cancel); process.off("SIGTERM", cancel); }
   } else {
     const app = await startup(args, input);
-    if (args.print) {
-      // With a prompt already given, stdin is optional context: wait briefly for it.
-      args.prompt = mergePrintPrompt(args.prompt,
-        await readPipedStdin(process.stdin, args.prompt.length > 0 ? { firstByteMs: 3_000 } : {}));
-    }
-    if (args.prompt) {
+    if (args.controlSocket) closeControl = await listenControl(args.controlSocket, () => sessionControl(app.session));
+    if (serverMode) {
       input.restore();
-      await runPrompt(app, args.prompt);
+      await runAppServer(app);
     } else {
-      input.phase("Loading conversation");
-      await runRepl(app, input.handoff);
+      if (args.print) {
+        // With a prompt already given, stdin is optional context: wait briefly for it.
+        args.prompt = mergePrintPrompt(args.prompt,
+          await readPipedStdin(process.stdin, args.prompt.length > 0 ? { firstByteMs: 3_000 } : {}));
+      }
+      if (args.prompt) {
+        input.restore();
+        await runPrompt(app, args.prompt);
+      } else {
+        input.phase("Loading conversation");
+        await runRepl(app, input.handoff);
+      }
     }
   }
 } catch (error) {
   console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1;
 } finally {
+  await closeControl?.();
   process.off("exit", input.restore);
   input.restore();
 }

package/src/apps/commands.ts

@@ -16,10 +16,17 @@ import { skillInvocationMessage, type Skill } from "../core/skills.ts";
 
 export type Command =
   | { kind: "extension"; name: string; args: string }
-  | { kind: "prompt"; text: string }
+  | { kind: "prompt"; text: string; skill?: Skill }
   | { kind: "quit" }
   | { kind: "usage" }
   | { kind: "state" }
+  | { kind: "context" }
+  | { kind: "control" }
+  | { kind: "acceptance" }
+  | { kind: "tasks" }
+  | { kind: "branches"; action?: "wait" | "cancel" | "status"; node?: number }
+  | { kind: "processes" }
+  | { kind: "accept"; criterion: string }
   | { kind: "model"; pattern?: string }
   | { kind: "scoped-models" }
   | { kind: "login"; provider?: string }
@@ -54,7 +61,7 @@ export const COMMANDS = [
   { name: "scoped-models", description: "Enable and order models for cycling", busy: "idle" },
   { name: "thinking", description: "Set reasoning effort", argumentHint: "[level]", busy: "idle" },
   { name: "settings", description: "Configure appearance, input and model behavior", argumentHint: "[key value]", busy: "idle" },
-  { name: "login", description: "Sign in or store an API key", argumentHint: "[provider]", busy: "idle" },
+  { name: "provider", description: "Connect and manage providers: account, API key, gateway or local server", argumentHint: "[provider]", busy: "idle" },
   { name: "logout", description: "Remove a stored credential", argumentHint: "[provider]", busy: "idle" },
   { name: "new", description: "Start a new session", busy: "idle" },
   { name: "resume", description: "Search saved sessions", argumentHint: "[id]", busy: "idle" },
@@ -66,13 +73,20 @@ export const COMMANDS = [
   { name: "session", description: "Show session details", busy: "run" },
   { name: "usage", description: "Show token usage and costs", busy: "run" },
   { name: "state", description: "Show log and handoff state", busy: "run" },
+  { name: "context", description: "Explain context sources, omissions and token estimates", busy: "run" },
+  { name: "control", description: "Inspect the goal, evidence and context; control the active turn", busy: "run" },
+  { name: "acceptance", description: "Show declared criteria and current evidence", busy: "idle" },
+  { name: "tasks", description: "Show work dependencies, readiness and ownership", busy: "run" },
+  { name: "branches", description: "Inspect or join owned background work", argumentHint: "[wait|cancel|status node]", busy: "idle" },
+  { name: "processes", description: "Show process observations and available handles", busy: "run" },
+  { name: "accept", description: "Record your acceptance of a human criterion", argumentHint: "<criterion ID>", busy: "idle" },
   { name: "export", description: "Export HTML or JSONL", argumentHint: "[file]", busy: "idle" },
   { name: "import", description: "Import a portable JSONL session", argumentHint: "<file>", busy: "idle" },
   { name: "debug", description: "Write local terminal diagnostics", argumentHint: "[file]", busy: "run" },
   { name: "changelog", description: "Show local release notes", busy: "run" },
   { name: "copy", description: "Copy the last assistant reply", busy: "run" },
   { name: "attachments", description: "Remove images from the current draft", busy: "run" },
-  { name: "models", description: "Refresh the model catalog", argumentHint: "refresh", busy: "idle" },
+  { name: "models", description: "Refresh the model catalog", argumentHint: "<refresh>", busy: "idle" },
   { name: "trust", description: "Set workspace configuration trust", argumentHint: "[here|parent|never]", busy: "idle" },
   { name: "reload", description: "Reload settings, skills, prompts, themes and models", busy: "idle" },
   { name: "config", description: "Configure resource sources and enablement", busy: "idle" },
@@ -82,10 +96,18 @@ export const COMMANDS = [
   { name: "exit", description: "Exit xeno", busy: "run" },
 ] as const;
 
-export const BUILTIN_COMMAND_NAMES = COMMANDS.map((command) => command.name);
+/**
+ * Hidden spellings of a listed command. Not in COMMANDS, so the `/` menu,
+ * the startup hint and completion show one entry per job.
+ */
+const ALIASES: Readonly<Record<string, string>> = { login: "provider", connect: "provider" };
+
+// Hidden spellings still own their names, so resources cannot promise an unreachable route.
+export const BUILTIN_COMMAND_NAMES: readonly string[] = [...COMMANDS.map(command => command.name), ...Object.keys(ALIASES)];
 
 export function commandDefinition(input: string): (typeof COMMANDS)[number] | undefined {
-  const name = input.trim().split(/\s/, 1)[0]?.slice(1).toLowerCase();
+  const typed = input.trim().split(/\s/, 1)[0]?.slice(1).toLowerCase() ?? "";
+  const name = ALIASES[typed] ?? typed;
   return COMMANDS.find((command) => command.name === name);
 }
 
@@ -95,6 +117,7 @@ export interface SlashCatalog {
   readonly prompts: ReadonlyMap<string, PromptTemplate>;
   readonly skills: ReadonlyMap<string, Skill>;
   readonly skillCommands?: boolean;
+  readonly skillExecution?: boolean;
 }
 
 export function resolveSlashCatalog(
@@ -140,7 +163,9 @@ export function parseCommand(input: string, catalog?: SlashCatalog): Command {
   if (!text.startsWith("/")) return { kind: "prompt", text };
 
   const [head, ...rest] = text.split(/\s+/);
-  const token = (head ?? "").toLowerCase();
+  const typed = (head ?? "").toLowerCase();
+  const token = `/${ALIASES[typed.slice(1)] ?? typed.slice(1)}`;
+  if (token === "/control") return { kind: "control" };
   const arg = rest.join(" ");
 
   if (!commandDefinition(text)) return resolveRegistered(token, arg, text, rest.length, catalog);
@@ -157,9 +182,20 @@ export function parseCommand(input: string, catalog?: SlashCatalog): Command {
       return { kind: "usage" };
     case "/state":
       return { kind: "state" };
+    case "/context": return { kind: "context" };
+    case "/acceptance": return { kind: "acceptance" };
+    case "/tasks": return { kind: "tasks" };
+    case "/processes": return { kind: "processes" };
+    case "/branches": {
+      if (!arg) return { kind: "branches" };
+      const action = rest[0], node = Number(rest[1]);
+      return (action === "wait" || action === "cancel" || action === "status") && Number.isSafeInteger(node) && node >= 0 && rest.length === 2
+        ? { kind: "branches", action, node } : { kind: "unknown", input: text };
+    }
+    case "/accept": return { kind: "accept", criterion: arg };
     case "/model":
       return arg.length > 0 ? { kind: "model", pattern: arg } : { kind: "model" };
-    case "/login":
+    case "/provider":
       return rest[0] === undefined ? { kind: "login" } : { kind: "login", provider: rest[0] };
     case "/logout":
       return rest[0] === undefined ? { kind: "logout" } : { kind: "logout", provider: rest[0] };
@@ -240,7 +276,8 @@ function resolveRegistered(
       const name = token.slice("/skill:".length);
       const skill = catalog.skills.get(name);
       if (skill !== undefined) {
-        return { kind: "prompt", text: skillInvocationMessage(skill, arg) };
+        if (skill.userInvocable === false) return { kind: "unknown", input: text };
+        return { kind: "prompt", text: skillInvocationMessage(skill, arg), ...(catalog.skillExecution ? { skill } : {}) };
       }
     }
     const prompt = catalog.prompts.get(token.slice(1));

package/src/apps/completions.ts

@@ -1,31 +1,87 @@
-import { COMMANDS } from "./commands.ts";
+/**
+ * What the composer offers for the text at the cursor. Pure given its
+ * sources, so the three cases are tested without a terminal:
+ *   "/mo|"          command names (the palette's own entries)
+ *   "/thinking h|" the command's argument values
+ *   "see @src/ap|"  workspace paths (ranked fuzzy, quoted when they contain spaces)
+ * `@` inside a word (an e-mail) or after a backslash is not a reference.
+ */
 import type { App } from "./startup.ts";
-import { WorkspaceAutocomplete } from "../tui/autocomplete.ts";
-import { SUBSCRIPTION_OPTIONS } from "../runtime/oauth.ts";
-import { modelKey } from "../core/session-position.ts";
+import { SUBSCRIPTION_OPTIONS, subscriptionById } from "../runtime/oauth.ts";
 import { supportedThinkingLevels } from "../core/thinking.ts";
-import { SETTINGS_KEYS, DISPLAY_SETTINGS } from "../core/settings.ts";
+import { interactiveSettingKeys } from "../core/settings.ts";
+import { fuzzyFilter } from "../tui/fuzzy.ts";
+import { COMMANDS, commandDefinition } from "./commands.ts";
+import { commandCompletionRank } from "../core/completion-action.ts";
+import type { Completion } from "../tui/ui/composer.ts";
+import type { ListItem } from "../tui/ui/list-model.ts";
 
-export function interactiveAutocomplete(app: App, paths: (refresh?: boolean) => Promise<readonly string[]>): WorkspaceAutocomplete {
-  const providers = [...new Set([...app.catalog.map((m) => m.provider), ...SUBSCRIPTION_OPTIONS.map((p) => p.id)])];
+export interface CompletionSources {
+  readonly commands: readonly { name: string; description: string }[];
+  readonly argumentValues: (command: string) => readonly string[];
+  readonly paths: readonly string[];
+}
+
+/** Twelve rows: enough to see siblings of a path without hiding the composer. Assumed. */
+const MAX_ITEMS = 12;
+
+export function completionAt(text: string, cursor: number, sources: CompletionSources): Completion | undefined {
+  const before = text.slice(0, cursor);
+  const line = before.slice(before.lastIndexOf("\n") + 1);
+  const lineStart = cursor - line.length;
+  if (line.startsWith("/") && lineStart === 0) {
+    const space = line.indexOf(" ");
+    if (space < 0) {
+      const query = line.slice(1).toLowerCase();
+      const items = sources.commands
+        .map(command => ({ command, rank: commandCompletionRank(command.name, query) }))
+        .filter(item => Number.isFinite(item.rank)).sort((a, b) => a.rank - b.rank)
+        .map(({ command }) => ({ value: `/${command.name} `, label: `/${command.name}`, description: command.description }));
+      return items.length ? { kind: "command", start: 0, end: cursor, items: items.slice(0, MAX_ITEMS) } : undefined;
+    }
+    const command = line.slice(1, space).toLowerCase();
+    const arg = line.slice(space + 1);
+    if (arg.includes(" ")) return undefined;
+    const values = sources.argumentValues(command);
+    if (!values.length) return undefined;
+    const items = fuzzyFilter(values, arg).slice(0, MAX_ITEMS).map(value => ({ value, label: value }));
+    return items.length ? { kind: "argument", start: space + 1, end: cursor, items } : undefined;
+  }
+  const at = line.lastIndexOf("@");
+  if (at < 0) return undefined;
+  const prev = line[at - 1];
+  if (prev !== undefined && !/\s/.test(prev)) return undefined;
+  const query = line.slice(at + 1);
+  if (/\s/.test(query) && !query.startsWith("\"")) return undefined;
+  const bare = query.replace(/^"/, "");
+  const items: ListItem[] = fuzzyFilter(sources.paths, bare).slice(0, MAX_ITEMS)
+    .map(path => ({ value: `@${/\s/.test(path) ? JSON.stringify(path) : path} `, label: path }));
+  return items.length ? { kind: "path", start: lineStart + at, end: cursor, items } : undefined;
+}
+
+export function completionSources(app: App, paths: readonly string[]): CompletionSources {
+  const providers = [...new Set([...app.catalog.map(m => m.provider).filter(provider => !subscriptionById(provider)), ...SUBSCRIPTION_OPTIONS.map(p => p.id)])];
   const values: Record<string, () => string[]> = {
-    model: () => app.catalog.map(modelKey),
+    // Model identities belong to the searchable picker. The generic completer
+    // still handles arbitrary argument sources; this app supplies only one
+    // model selection surface, rather than a second list with different keys.
     thinking: () => [...supportedThinkingLevels(app.providerConfig.spec)],
-    login: () => providers, logout: () => providers,
-    settings: () => [...new Set([...SETTINGS_KEYS, ...DISPLAY_SETTINGS.map(item => item.id)])],
+    provider: () => providers, logout: () => Object.keys(app.auth).filter(provider => app.auth[provider] !== undefined),
+    settings: interactiveSettingKeys,
     models: () => ["refresh"], trust: () => ["once", "here", "parent", "never"],
   };
-  const commands = COMMANDS.map((definition) => ({
-    ...definition,
-    getArgumentCompletions(prefix: string) {
-      return (values[definition.name]?.() ?? []).filter((v) => v.toLowerCase().includes(prefix.toLowerCase()))
-        .map((v) => ({ value: v, label: v }));
-    },
-  }));
-  const registered = [
-    ...[...app.extensions?.commands ?? []].map(([name, command]) => ({ name, ...command })),
-    ...[...(app.slash?.prompts.values() ?? [])].map((p) => ({ name: p.name, description: p.description })),
-    ...(app.slash?.skillCommands === false ? [] : [...(app.slash?.skills.values() ?? [])].map((s) => ({ name: `skill:${s.name}`, description: s.description }))),
+  return {
+    commands: [...COMMANDS.filter(command => command.name !== "exit"), ...commandEntries(app)],
+    argumentValues: command => values[commandDefinition(`/${command}`)?.name ?? command.toLowerCase()]?.() ?? [],
+    paths,
+  };
+}
+
+/** Built-ins, then extension commands, prompt templates and skills: the same names the palette lists. */
+export function commandEntries(app: App): { name: string; description: string; section: string }[] {
+  return [
+    ...[...app.extensions?.commands ?? []].map(([name, command]) => ({ name, description: command.description ?? "extension command", section: "Extensions" })),
+    ...[...(app.slash?.prompts.values() ?? [])].map(p => ({ name: p.name, description: p.description ?? "prompt template", section: "Prompts" })),
+    ...(app.slash?.skillCommands === false ? [] : [...(app.slash?.skills.values() ?? [])].map(s => ({ name: `skill:${s.name}`, description: s.description ?? "skill", section: "Skills" }))),
   ];
-  return new WorkspaceAutocomplete([...commands, ...registered], app.workspace, paths);
 }

package/src/apps/control-transport.ts

@@ -0,0 +1,89 @@
+/** Q24: bounded local JSONL transport. No TCP listener or additional runtime dependency. */
+import { createServer, type Socket } from "node:net";
+import { chmodSync } from "node:fs";
+import { lstat, mkdir, rm } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { CONTROL_SCHEMA } from "../core/control-protocol.ts";
+import { ControlConnection, type RpcOutput } from "../runtime/control-connection.ts";
+import type { SessionControl } from "../runtime/session-control.ts";
+
+export class ControlJsonl {
+  private buffer = Buffer.alloc(0);
+  private pending = 0;
+  private tail = Promise.resolve();
+  private closed = false;
+  readonly connection: ControlConnection;
+  private readonly stop: () => void;
+  private readonly output: (text: string) => void;
+  constructor(control: () => SessionControl, output: (text: string) => void, stop: () => void, denyOnClose = false) {
+    this.stop = stop;
+    this.output = text => { try { output(text); } catch { this.close(); this.stop(); } };
+    this.connection = new ControlConnection(control, message => this.write(message), { denyOnClose });
+  }
+  private write(message: RpcOutput): void {
+    if (this.closed) return;
+    const text = JSON.stringify(message) + "\n";
+    if (Buffer.byteLength(text) > CONTROL_SCHEMA.limits.frameBytes) {
+      if ("id" in message) this.output(JSON.stringify({ id: message.id, error: { code: -32002, message: "response exceeds frame limit; use paginated inspectors" } }) + "\n");
+      else this.fail("event exceeds frame limit; reconnect and resynchronize");
+    } else this.output(text);
+  }
+  private fail(message: string): void {
+    if (this.closed) return;
+    this.output(JSON.stringify({ id: null, error: { code: -32001, message } }) + "\n");
+    this.close(); this.stop();
+  }
+  feed(chunk: Uint8Array): void {
+    if (this.closed) return;
+    this.buffer = Buffer.concat([this.buffer, chunk]);
+    for (;;) {
+      const newline = this.buffer.indexOf(10);
+      if (newline < 0) { if (this.buffer.length > CONTROL_SCHEMA.limits.frameBytes) this.fail("input frame exceeds limit"); return; }
+      if (newline > CONTROL_SCHEMA.limits.frameBytes) { this.fail("input frame exceeds limit"); return; }
+      const line = this.buffer.subarray(0, newline).toString("utf8"); this.buffer = this.buffer.subarray(newline + 1);
+      if (!line.trim()) continue;
+      if (++this.pending > CONTROL_SCHEMA.limits.queuedRequests) { this.fail("request queue is full"); return; }
+      this.tail = this.tail.then(async () => {
+        if (this.closed) return;
+        let value: unknown;
+        try { value = JSON.parse(line); }
+        catch { this.write({ id: null, error: { code: -32700, message: "invalid JSON" } }); return; }
+        await this.connection.receive(value);
+      }).finally(() => { this.pending--; });
+    }
+  }
+  async drained(): Promise<void> { await this.tail; }
+  close(): void { this.closed = true; this.buffer = Buffer.alloc(0); this.connection.close(); }
+}
+
+export async function listenControl(path: string, control: () => SessionControl): Promise<() => Promise<void>> {
+  const absolute = resolve(path), parent = dirname(absolute);
+  await mkdir(parent, { recursive: true, mode: 0o700 });
+  const directory = await lstat(parent);
+  if (!directory.isDirectory() || directory.mode & 0o077 || process.getuid && directory.uid !== process.getuid()) throw Error("control socket requires an owned private directory (mode 0700)");
+  try { await lstat(absolute); throw Error("control socket path already exists; refusing to replace it"); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+  const clients = new Map<Socket, ControlJsonl>();
+  const server = createServer(socket => {
+    // Assumed local adapter capacity; together with per-peer bounds this caps retained transport memory.
+    if (clients.size >= 32) { socket.destroy(); return; }
+    const peer = new ControlJsonl(control, text => {
+      if (socket.writableLength + Buffer.byteLength(text) > CONTROL_SCHEMA.limits.outputBytes) socket.destroy(); else socket.write(text);
+    }, () => socket.destroy());
+    clients.set(socket, peer);
+    socket.on("data", chunk => peer.feed(typeof chunk === "string" ? Buffer.from(chunk) : chunk));
+    socket.on("error", () => socket.destroy());
+    socket.on("close", () => { peer.close(); clients.delete(socket); });
+  });
+  await new Promise<void>((resolveReady, reject) => {
+    server.once("error", reject);
+    server.listen(absolute, () => { chmodSync(absolute, 0o600); resolveReady(); });
+  });
+  const owned = await lstat(absolute);
+  return async () => {
+    for (const [socket, peer] of clients) { peer.close(); socket.destroy(); }
+    await new Promise<void>((resolveClosed, reject) => server.close(error => error ? reject(error) : resolveClosed()));
+    try { const current = await lstat(absolute); if (current.ino === owned.ino && current.dev === owned.dev) await rm(absolute); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+  };
+}

package/src/apps/image-draft.ts

@@ -0,0 +1,46 @@
+import { draftImageInput, draftImageSpans, focusedDraftImage, imageMarker } from "../core/draft-images.ts";
+import type { ImageRef } from "../core/images.ts";
+
+/** D19: the renderer owns text and undo; the app only binds tokens to D8 blob identities. */
+export interface ImageDraftEditor {
+  readonly text: string;
+  readonly cursor: number;
+  setAtoms(spans: (text: string) => readonly { start: number; end: number }[]): void;
+  insert(text: string): void;
+  removeAtom(label: string): void;
+  resetDraft(project: (text: string) => string): void;
+}
+
+export class ImageDraft {
+  private readonly editor: ImageDraftEditor;
+  private readonly registry = new Map<number, ImageRef>();
+  // Never reuse an ID: undo, kill/yank and local history can restore an earlier tag.
+  private nextId = 1;
+
+  constructor(editor: ImageDraftEditor) {
+    this.editor = editor;
+    editor.setAtoms(text => draftImageSpans(text, this.registry));
+  }
+  get images(): ImageRef[] { return this.input(this.editor.text).images; }
+  get focusedImage() { return focusedDraftImage(this.editor.text, this.editor.cursor, this.registry); }
+  input(text: string) { return draftImageInput(text, this.registry); }
+
+  insertImages(images: readonly ImageRef[]): void {
+    let labels = "";
+    for (const image of images) {
+      while (this.editor.text.includes(imageMarker(this.nextId))) this.nextId++;
+      const id = this.nextId++;
+      this.registry.set(id, image); labels += imageMarker(id);
+    }
+    if (labels) this.editor.insert(labels);
+  }
+  removeImage(index: number): void {
+    const ids = [...new Set(draftImageSpans(this.editor.text, this.registry).map(span => span.id))];
+    const id = ids[index];
+    if (id !== undefined) this.editor.removeAtom(imageMarker(id));
+  }
+  reset(): void {
+    this.editor.resetDraft(text => this.input(text).text);
+    this.registry.clear();
+  }
+}

package/src/apps/model-catalog.ts

@@ -1,6 +1,6 @@
 import { modelKey } from "../core/session-position.ts";
 import { clampThinkingLevel } from "../core/thinking.ts";
-import { createProvider } from "../runtime/catalog.ts";
+import { createProvider, providerSessionId } from "../runtime/catalog.ts";
 import { storedIsOAuth } from "../runtime/auth.ts";
 import { outputTokenBudget, type ModelSpec } from "../runtime/model.ts";
 import { providerAccess, setProviderAccess } from "../runtime/provider-access.ts";
@@ -29,6 +29,7 @@ export async function publishModelCatalog(app: App, models: readonly ModelSpec[]
   const config = { ...app.providerConfig, spec, maxTokens: outputTokenBudget(spec), effort: clampThinkingLevel(spec, app.providerConfig.effort) };
   const credential = app.credentialOf(spec);
   const next = createProvider(config, credential.ok ? credential.key : "", retryHandler(app.io), {
+    sessionId: providerSessionId(app.session.config.logDir),
     effects: app.effects, oauth: !app.args.apiKey && storedIsOAuth(app.auth, spec.provider),
   });
   const needsCut = providerReplayKey(previous) !== providerReplayKey(spec);

package/src/apps/project-trust.ts

@@ -1,49 +1,9 @@
+/** Project trust decisions; the picker itself is apps/ui/standalone.ts (startup) and apps/ui/app.ts (/trust). */
 import { dirname } from "node:path";
-import { SelectList } from "../tui/select.ts";
-import { createInteractiveTui } from "../tui/host.ts";
-import { IDENTITY } from "../tui/style.ts";
-import { installBindings } from "../tui/input.ts";
-import { loadUiResources } from "../store/resources.ts";
-import type { Style } from "../tui/style.ts";
-import { projectTrust, saveTrust } from "../store/trust.ts";
-import { truncateToWidth } from "../vendor/pi-tui/utils.ts";
+import { saveTrust } from "../store/trust.ts";
 
 export type TrustChoice = "once" | "here" | "parent" | "never";
 export async function applyTrustChoice(workspace: string, choice: TrustChoice): Promise<boolean> {
   if (choice !== "once") await saveTrust(choice === "parent" ? dirname(workspace) : workspace, choice !== "never");
   return choice !== "never";
 }
-export class TrustSelector extends SelectList {
-  private readonly workspace: string;
-  private readonly decision: Awaited<ReturnType<typeof projectTrust>>;
-  constructor(workspace: string, decision: Awaited<ReturnType<typeof projectTrust>>, style: Style) {
-    super([
-      { value: "once", label: "Trust for this session", description: "Load project resources without saving a decision" },
-      { value: "here", label: "Trust this directory", description: workspace },
-      { value: "parent", label: "Trust parent directory", description: dirname(workspace) },
-      { value: "never", label: "Do not trust this directory", description: "Skip project configuration and executable extensions" },
-    ], { title: "Project trust", search: false, style,
-      ...(decision.saved ? { selectedValue: decision.saved.trusted ? decision.saved.path === workspace ? "here" : "parent" : "never" } : {}) });
-    this.workspace = workspace; this.decision = decision;
-  }
-  override render(width: number): string[] {
-    const saved = this.decision.saved;
-    return ["Project trust", this.workspace, `Saved: ${saved ? `${saved.trusted ? "trusted" : "untrusted"} (${saved.path})` : "none"}`,
-      `Current session: ${this.decision.trusted ? "trusted" : "untrusted"} · Tool permissions are separate`, ...super.render(width).slice(1)]
-      .map(line => truncateToWidth(line, width, ""));
-  }
-}
-export async function pickProjectTrust(workspace: string, handoff?: () => void): Promise<boolean> {
-  const decision = await projectTrust(workspace);
-  installBindings((await loadUiResources({ workspace, trusted: false })).keymap.byAction);
-  const screen = createInteractiveTui();
-  const select = new TrustSelector(workspace, decision, IDENTITY);
-  screen.addChild(select); screen.setFocus(select);
-  try {
-    const choice = await new Promise<string | null>(resolve => {
-      select.onInput = data => { const state = select.acceptInput(data); if (state.cancelled) resolve(null); else if (state.confirmed) resolve(state.confirmed.value); screen.requestRender(); };
-      handoff?.(); screen.start();
-    });
-    return choice === null ? false : applyTrustChoice(workspace, choice as TrustChoice);
-  } finally { await screen.terminal.drainInput(); screen.stop(); }
-}