@visual-z/xeno 0.2.1 → 0.4.0

package/src/apps/startup-input.ts

@@ -1,7 +1,8 @@
-/** Startup owns raw input until a Pi screen can own it (D19). */
-import { StdinBuffer } from "../vendor/pi-tui/stdin-buffer.ts";
-import { isKeyRelease, matchesKey } from "../vendor/pi-tui/keys.ts";
-import { resolveEscapeTimeoutMs } from "../vendor/pi-tui/terminal.ts";
+/**
+ * Startup owns raw input until the renderer can (D20). Keystrokes typed while
+ * configuration loads are held as original bytes and handed to the next owner;
+ * only Ctrl+C outside a bracketed paste is interpreted here.
+ */
 
 type StartupStdin = Pick<NodeJS.ReadStream, "isTTY" | "isRaw" | "setRawMode" | "setEncoding" | "on" | "off" | "resume" | "pause" | "unshift">;
 export interface StartupInput {
@@ -31,7 +32,9 @@ export function createStartupInput(opts: {
   let active = false, closed = false, announced = false;
   let phase = "Reading configuration";
   let pending: string[] = [];
-  let parser: StdinBuffer | undefined;
+  let pasting = false;
+  /** An escape sequence cut across chunks; joined with the next chunk before matching. */
+  let partial = "";
   let timer: ReturnType<typeof setTimeout> | undefined;
 
   const release = () => {
@@ -41,7 +44,7 @@ export function createStartupInput(opts: {
     stdin.pause();
     stdin.off("data", receive);
     signals.off("SIGINT", interrupt); signals.off("SIGTERM", terminate); signals.off("SIGHUP", hangup);
-    parser?.destroy(); parser = undefined;
+    pasting = false; partial = "";
     stdin.setRawMode(wasRaw);
   };
   const restore = () => { closed = true; release(); pending = []; };
@@ -56,14 +59,17 @@ export function createStartupInput(opts: {
     // Keep original chunks, including partial escapes/pastes, for Pi's own decoder.
     // The temporary parser only recognizes cancellation outside bracketed paste.
     pending.push(data);
-    parser?.process(data);
+    const joined = partial + data;
+    const cut = trailingPartialEscape(joined);
+    const whole = joined.slice(0, joined.length - cut.length);
+    partial = cut;
+    if (interruptsStartup(whole, pasting)) interrupt();
+    pasting = pasteState(whole, pasting);
   };
   const announce = () => { if (active) { announced = true; report(`  Starting xeno: ${phase} (Ctrl+C to cancel)`); } };
   const capture = () => {
     if (closed || active) return;
     active = true; announced = false;
-    parser = new StdinBuffer({ escapeTimeout: resolveEscapeTimeoutMs() });
-    parser.on("data", (data: string) => { if (!isKeyRelease(data) && matchesKey(data, "ctrl+c")) interrupt(); });
     stdin.setEncoding("utf8");
     stdin.on("data", receive);
     signals.on("SIGINT", interrupt); signals.on("SIGTERM", terminate); signals.on("SIGHUP", hangup);
@@ -92,3 +98,33 @@ export function createStartupInput(opts: {
     },
   };
 }
+
+/** Bracketed paste state after a chunk: a paste that started and did not end yet. */
+export function pasteState(data: string, pasting: boolean): boolean {
+  const start = data.lastIndexOf("\x1b[200~"), end = data.lastIndexOf("\x1b[201~");
+  if (start < 0 && end < 0) return pasting;
+  return start > end;
+}
+
+/** Ctrl+C as legacy ETX or kitty CSI-u (99;5u press, not a :3 release), outside a paste. */
+export function interruptsStartup(data: string, pasting: boolean): boolean {
+  let outside = "";
+  let inPaste = pasting;
+  for (let i = 0; i < data.length;) {
+    if (data.startsWith("\x1b[200~", i)) { inPaste = true; i += 6; continue; }
+    if (data.startsWith("\x1b[201~", i)) { inPaste = false; i += 6; continue; }
+    if (!inPaste) outside += data[i];
+    i++;
+  }
+  return outside.includes("\x03") || /\x1b\[99;5(?::1)?u/.test(outside);
+}
+
+/** The unfinished CSI/SS3 at the end of a chunk ("\x1b[99;" waiting for "5u"), or "". */
+export function trailingPartialEscape(data: string): string {
+  const at = data.lastIndexOf("\x1b");
+  if (at < 0) return "";
+  const tail = data.slice(at);
+  if (tail === "\x1b") return tail;
+  if (/^\x1b\[[0-9;:?]*$/.test(tail) || /^\x1bO$/.test(tail)) return tail;
+  return "";
+}

package/src/apps/startup.ts

@@ -1,5 +1,6 @@
 import { release } from "node:os";
-import { workingProtocol } from "../core/continuation.ts";
+import { codingWorkingProtocol } from "../core/continuation.ts";
+import { taskGuidance } from "../core/prompt-policy.ts";
 import { environmentSection, type SessionEnvironment } from "../core/environment.ts";
 /**
  * From argv to a session that can run. Credential order, model selection,
@@ -12,8 +13,10 @@ import { mkdir } from "node:fs/promises";
 import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { Session, systemClock } from "../runtime/loop.ts";
 import { DEFAULT_PROVIDER, type ProviderConfig } from "../runtime/provider.ts";
-import { createProvider, selectModel, loadCatalog, groupedModels, parseUserCatalog, type CatalogFetch } from "../runtime/catalog.ts";
+import { createProvider, providerSessionId, selectModel, loadCatalog, groupedModels, parseUserCatalog, type CatalogFetch } from "../runtime/catalog.ts";
 import { ExtensionRegistry } from "../runtime/extensions.ts";
+import { DISCOVERY_TOOL_NAME } from "../runtime/tool-discovery.ts";
+import { declaredToolNames } from "../core/tool-discovery.ts";
 import { CATALOG, outputTokenBudget, type ModelSpec } from "../runtime/model.ts";
 import { asThinkingLevel, clampThinkingLevel, supportedThinkingLevels } from "../core/thinking.ts";
 import { modelKey } from "../core/session-position.ts";
@@ -25,10 +28,11 @@ import {
 import { authPath, configDir, readJsonFile } from "../store/config.ts";
 import { loadUiResources, loadTextResources, type UiResources } from "../store/resources.ts";
 import { discoverResources, type ResourceIndex } from "../store/resource-index.ts";
-import { runResourceConfig } from "./resource-browser.ts";
+import { pickProjectTrust, pickStartupSession, runResourceConfig } from "./ui/standalone.ts";
 import { PackageManager, type PackageCommand } from "../runtime/package-manager.ts";
-import { pickProjectTrust } from "./project-trust.ts";
-import { appendSkillsToSystem } from "../core/skills.ts";
+import { loadAcceptanceContract } from "../store/acceptance.ts";
+import type { AcceptanceContract } from "../core/acceptance.ts";
+import { appendSkillsToSystem, type Skill } from "../core/skills.ts";
 import { COMMANDS, resolveSlashCatalog, type SlashCatalog } from "./commands.ts";
 import { createStyle, IDENTITY, type Style } from "../tui/style.ts";
 import type { Settings } from "../core/settings.ts";
@@ -38,23 +42,24 @@ import { readCursor, writeCursor, type Cursor } from "../store/log.ts";
 import { resolveLogDir, findSessionByPrefix, listSessions, sessionsDir, type ResolveLogOpts } from "../store/sessions.ts";
 import { recoverCut } from "../store/recovery.ts";
 import { planSessionEntry, restoreSessionModel } from "../core/session-entry.ts";
-import { pickStartupSession } from "./session-picker.ts";
 import { loadContext, assembleSystemPrompt, formatNotice, type LoadedContext } from "../store/context-files.ts";
 import {
   projectTrust,
 } from "../store/trust.ts";
 import { stat } from "node:fs/promises";
 import {
-  parseToolList, rulesWithAllowTools, selectTools,
+  parseToolList, rulesWithAllowTools, selectTools, isToolProfile,
+  type ToolProfile,
   type PermissionRequest, type PermissionRule,
 } from "../core/permissions.ts";
 import {
-  TOOL_SCHEMAS, DEFAULT_TOOL_CONTEXT, workspaceRoot,
+  TOOL_SCHEMAS, TOOL_DEFINITIONS, modelToolSchema, DEFAULT_TOOL_CONTEXT, workspaceRoot,
   type ApprovalChoice, type ToolContext,
 } from "../runtime/tools.ts";
-import { DEFAULT_BOUNDARY } from "../core/boundary.ts";
-import { DEFAULT_CONTEXT_POLICY, isContextPolicy, type ContextPolicy } from "../core/context-policy.ts";
-import { windowBudget } from "../core/context-window.ts";
+import { assertNever } from "../core/exhaustive.ts";
+import {
+  contextLimits, DEFAULT_CONTEXT_POLICY, isContextPolicy, type ContextLimits, type ContextPolicy,
+} from "../core/context-policy.ts";
 import { colorEnabled, createPalette, describeError, stdinIsTty, stdoutIsTty, type Palette } from "./render.ts";
 import { type ActionId, type Keymap } from "../core/keymap.ts";
 import type { StartupInput } from "./startup-input.ts";
@@ -62,46 +67,16 @@ import type { StartupInput } from "./startup-input.ts";
 export const SYSTEM_PROMPT = systemPromptFor(TOOL_SCHEMAS.map((tool) => tool.name));
 
 /**
- * The instructions mention only tools the model can actually see. Naming a
- * tool that was excluded from the schema teaches it to call something that
- * will never work. The default prompt is left alone when every tool is visible.
+ * Tool schemas are the only capability inventory. A branch may inherit this
+ * stable policy while narrowing its tools; no parent tool recipe can leak.
  */
 export function systemPromptFor(toolNames: readonly string[], env?: SessionEnvironment): string {
-  const has = (name: string) => toolNames.includes(name);
-  const toolsLine = toolNames.length === 0
-    ? "No tools are available in this session."
-    : `Tools: ${toolNames.join(", ")}.` +
-      (toolNames.some(name => ["grep", "find", "ls"].includes(name)) ? " Use the available grep/find/ls tools for confined search." : "") +
-      (has("bash")
-        ? " Use bash for verification commands and operations the other tools do not cover."
-        : "");
-
-  // Each line answers a failure class in the Terminal-Bench taxonomy
-  // (arXiv 2601.11868): premature termination, no verification, step
-  // repetition. The wording of the first and last follows the Codex
-  // prompting guide: persist end to end, and end on a change or a blocker.
-  const work = [
-    "How to work:",
-    "- Keep going until the request is fully resolved. When a reasonable assumption lets you proceed, make it and mention it at the end; stop to ask only when blocked on a decision only the user can make.",
-    "- Understand before changing: read the relevant code, and for a bug, reproduce it first.",
-    "- Put independent reads and searches in one response; they run in parallel.",
-    "- After a change, run the project's own tests, build or type check. When a command fails, read the end of its output first; errors and summaries are printed last.",
-    "- If the same approach fails twice, change the approach instead of retrying it.",
-    "- A claim without a passing command is not evidence. Finish with what changed and the command that verified it, or the specific blocker.",
-  ];
-  if (has("bash")) work.push(
-    "- Each bash call is a fresh non-interactive shell with no TTY: use workdir or `cd dir && ...` within one call. Never open pagers or interactive editors. " +
-    "Start servers in the background with output redirected (`nohup cmd > app.log 2>&1 &`), then poll the log or port. Pass a larger timeout for long builds and installs.",
-  );
-  if (has("exec_command")) work.push("- For servers, REPLs and programs that prompt for input, use exec_command (tty=true when the program needs a terminal) and continue with write_stdin.");
-  if (has("edit")) work.push("- Prefer edit to rewriting a whole file; copy old_string from read output without the line numbers.");
-
   return [
-    "You are a coding agent working in a terminal.",
-    toolsLine,
+    "You are an agent working in a terminal.",
+    "The declared tool schemas define available capabilities, input units and execution lifecycles. Do not assume additional tools or infer permission from a tool's visibility.",
     ...(env === undefined ? [] : [environmentSection(env)]),
-    work.join("\n"),
-    workingProtocol(toolNames),
+    taskGuidance(),
+    codingWorkingProtocol(toolNames),
     "Be concise. Do not narrate what you are about to do; do it, then say what happened.",
   ].join("\n\n");
 }
@@ -128,12 +103,12 @@ export function sessionEnvironment(workspace: string): SessionEnvironment {
  * Session policy a CLI coding session differs from a benchmark run in.
  * Benchmarks construct their own SessionConfig and keep the core defaults.
  */
-export function cliSessionConfig(args: Args): { continuationAfter: number; timeBudgetMs?: number } {
+export function cliSessionConfig(args: Args): { continuationAfter: number; workingSet: true; workingSetVersion: 2; guidanceVersion: 1; strictVerification: true; timeBudgetMs?: number } {
   // Never within a request. A real Kimi K3 run with the reminder at reply six
   // spent half its requests on notes after the work was already verified
   // (fix-cli-continuation-noise). The reminder still fires where it earns its
   // place: a resumed handoff that cannot continue, and boundary preparation.
-  return { continuationAfter: Infinity, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
+  return { continuationAfter: Infinity, workingSet: true, workingSetVersion: 2, guidanceVersion: 1, strictVerification: true, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
 }
 
 /**
@@ -151,6 +126,7 @@ export type AskSlot = {
 };
 
 export interface Args {
+  shellCheckpoints?: boolean;
   workspace: string;
   /**
    * `--state-dir <dir>`: where every xeno write goes -- snapshots, tool
@@ -193,6 +169,9 @@ export interface Args {
   systemPrompt: string | null;
   /** `--tools` allowlist. Omitted when the flag was not passed. */
   tools?: string[];
+  /** New sessions default to coding; restored context keeps its frozen schemas. */
+  toolProfile?: ToolProfile;
+  acceptanceFile?: string;
   excludeTools: string[];
   noTools: boolean;
   /** `--no-builtin-tools`. False when the flag was not passed. */
@@ -245,6 +224,8 @@ export interface Args {
   sessionName?: string;
   /** `--mode json`. Empty / omitted when the flag was not passed. */
   mode?: string;
+  /** Explicit local adapter endpoint. An owned mode-0700 directory is required. */
+  controlSocket?: string;
   /** `--verbose`. Expands the startup header's counts into lists. */
   verbose?: boolean;
 }
@@ -258,6 +239,7 @@ export interface Args {
  * parses; it just cannot be offered as a suggestion.
  */
 const KNOWN_FLAGS: readonly string[] = [
+  "--checkpoint-shell",
   "--workspace", "-w",
   "--path-root",
   "--state-dir",
@@ -283,6 +265,8 @@ const KNOWN_FLAGS: readonly string[] = [
   "--system-prompt",
   "--append-system-prompt",
   "--tools", "-t",
+  "--tool-profile",
+  "--acceptance-file",
   "--exclude-tools", "-xt",
   "--no-tools", "-nt",
   "--no-builtin-tools",
@@ -298,6 +282,7 @@ const KNOWN_FLAGS: readonly string[] = [
   "--no-prompt-templates",
   "--extension", "-e", "--no-extensions", "-ne", "--extension-flag",
   "--mode",
+  "--control-socket",
   "--verbose",
   "--print", "-p",
   "--help", "-h",
@@ -374,7 +359,8 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
       console.error(`${a} requires a value`);
       process.exit(1);
     }
-    if (a === "--workspace" || a === "-w") args.workspace = argv[++i] ?? args.workspace;
+    if (a === "--checkpoint-shell") args.shellCheckpoints = true;
+    else if (a === "--workspace" || a === "-w") args.workspace = argv[++i] ?? args.workspace;
     else if (a === "--path-root") args.pathRoot = resolve(argv[++i] ?? "/");
     else if (a === "--state-dir") args.stateDir = resolve(argv[++i] ?? ".");
     else if (a === "--time-budget") {
@@ -429,6 +415,15 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
     else if (a === "--system-prompt") args.systemPrompt = argv[++i] ?? "";
     else if (a === "--append-system-prompt") args.appendSystemPrompt.push(argv[++i] ?? "");
     else if (a === "--tools" || a === "-t") args.tools = parseToolList(argv[++i] ?? "");
+    else if (a === "--acceptance-file") {
+      const path = argv[++i]; if (!path || path.startsWith("--")) throw new Error("--acceptance-file requires a JSON path");
+      args.acceptanceFile = path;
+    }
+    else if (a === "--tool-profile") {
+      const value = argv[++i] ?? "";
+      if (!isToolProfile(value)) throw new Error("unknown tool profile; choose coding, readonly, research, data or full");
+      args.toolProfile = value;
+    }
     else if (a === "--exclude-tools" || a === "-xt") args.excludeTools = parseToolList(argv[++i] ?? "");
     else if (a === "--no-tools" || a === "-nt") args.noTools = true;
     else if (a === "--no-builtin-tools" || a === "-nbt") args.noBuiltinTools = true;
@@ -459,6 +454,11 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
       (args.extensionFlags ??= Object.create(null) as Record<string, string | boolean>)[value.slice(0, at)] = value.slice(at + 1) === "true" ? true : value.slice(at + 1) === "false" ? false : value.slice(at + 1);
     }
     else if (a === "--mode") args.mode = argv[++i] ?? "";
+    else if (a === "--control-socket") {
+      const value = argv[++i];
+      if (!value || value.startsWith("-")) throw Error("--control-socket requires a path");
+      args.controlSocket = resolve(value);
+    }
     else if (a === "--verbose") args.verbose = true;
     else if (a === "-p" || a === "--print") {
       args.print = true;
@@ -598,16 +598,17 @@ export function formatStartupHeader(input: {
     `workspace  ${input.workspace}`,
     `session    ${input.session}`,
   ];
-  const pushCount = (label: string, items: readonly string[]): void => {
-    lines.push(`${label.padEnd(10)}${items.length}`);
-    if (input.verbose) {
+  const groups: [string, readonly string[]][] = [["agents", input.agents], ["skills", input.skills], ["prompts", input.prompts],
+    ...(input.tools !== undefined ? [["tools", input.tools] as [string, readonly string[]]] : [])];
+  if (input.verbose) {
+    for (const [label, items] of groups) {
+      lines.push(`${label.padEnd(10)}${items.length}`);
       for (const item of items) lines.push(`  ${item}`);
     }
-  };
-  pushCount("agents", input.agents);
-  pushCount("skills", input.skills);
-  pushCount("prompts", input.prompts);
-  if (input.tools !== undefined) pushCount("tools", input.tools);
+  } else {
+    // Four count rows were a third of the banner; one row says the same.
+    lines.push(`loaded     ${groups.map(([label, items]) => `${items.length} ${label}`).join(" · ")}`);
+  }
   const keys = formatShortcutLine(input.keymap);
   if (keys.length > 0) lines.push(`keys       ${keys}`);
   return lines;
@@ -720,7 +721,7 @@ export interface App {
   blobDir: string;
   system: string;
   providerConfig: ProviderConfig;
-  /** May be `{ ok: false }` in an interactive session waiting on /login. */
+  /** May be `{ ok: false }` in an interactive session waiting on /provider. */
   credential: Resolved;
   auth: AuthFile;
   effects: ResolveEffects;
@@ -780,8 +781,8 @@ export function whyNot(spec: ModelSpec, got: Resolved, auth: AuthFile, C: Palett
 }
 
 /**
- * /login only exists inside a live session. A one-shot prompt and a pipe
- * cannot answer it, so those runs must still refuse -- naming /login there
+ * /provider only exists inside a live session. A one-shot prompt and a pipe
+ * cannot answer it, so those runs must still refuse -- naming /provider there
  * is how this file used to deadlock a first run.
  */
 /**
@@ -799,7 +800,7 @@ export function isInteractiveSession(args: Args): boolean {
 
 /**
  * Script-facing missing-key text. Environment variables and --api-key are
- * the routes that actually work without a tty; /login is not one of them.
+ * the routes that actually work without a tty; /provider is not one of them.
  */
 export function describeUnauthenticatedScript(catalog: readonly ModelSpec[] = CATALOG): string {
   const providers = [...new Set(catalog.map((m) => m.provider))];
@@ -810,13 +811,14 @@ export function describeUnauthenticatedScript(catalog: readonly ModelSpec[] = CA
   );
 }
 
-/** Banner / hint for an interactive session that started without a key. */
-export function describeUnauthenticatedSession(catalog: readonly ModelSpec[] = CATALOG): string {
-  const vars = [...new Set(catalog.map((m) => m.provider))].map((p) => envLabel(p));
-  return (
-    `no credential. This session cannot send until one is set. ` +
-    `Export ${vars.join(" or ")}, or run /login <provider>`
-  );
+/**
+ * Banner / hint for an interactive session that started without a key.
+ * Listing every provider's variable was a 20-line wall that buried the one
+ * action that works from here; the interactive routes are named instead.
+ */
+export function describeUnauthenticatedSession(_catalog: readonly ModelSpec[] = CATALOG): string {
+  return "no provider connected yet. Type /provider to connect one — a Claude, ChatGPT, Copilot or Grok account, an API key, a gateway or a local server — " +
+    `or export a key such as ${["anthropic", "openai", "google", "deepseek"].map(provider => envLabel(provider).split(" or ")[0]).join(", ")}.`;
 }
 
 export function retryHandler(io: AppIO): (attempt: number, delayMs: number, error: unknown) => void {
@@ -833,6 +835,7 @@ export function retryHandler(io: AppIO): (attempt: number, delayMs: number, erro
 
 export function toolSelectionOf(args: Args) {
   return {
+    profile: args.toolProfile ?? "coding",
     ...(args.noTools ? { none: true as const } : {}),
     ...(args.tools !== undefined ? { only: args.tools } : {}),
     ...(args.excludeTools.length > 0 ? { exclude: args.excludeTools } : {}),
@@ -843,25 +846,40 @@ export function toolSelectionOf(args: Args) {
 /**
  * Schema assembly: every tool is tagged with a source here so
  * `--no-builtin-tools` can drop a category without a later cross-layer
- * recut. Today the only producer is builtin; an extension would push
- * `{ ...schema, source: "extension" }` into this list.
+ * recut. Optional extension descriptors remain local until selected; their
+ * harness-owned discovery entry belongs to that extension-enabled capability set.
  *
  * `source` is stripped before the frozen prefix: the wire schema is what
  * the provider bills, and an extra field there would look like a tool
  * argument.
  */
-export function visibleSchemas(args: Args, extensions?: ExtensionRegistry) {
+export function sessionToolCatalog(args: Args, extensions?: ExtensionRegistry, previous: readonly unknown[] = []) {
   const custom = [...extensions?.definitions().values() ?? []].map(({ name, description, input_schema }) => ({ name, description, input_schema, source: "extension" as const }));
-  const available = [...TOOL_SCHEMAS.filter(tool => !extensions?.tools.has(tool.name)).map((t) => ({ ...t, source: "builtin" as const })), ...custom];
-  return selectTools(available, toolSelectionOf(args)).map((tool) => {
-    const { source, ...schema } = tool;
-    void source;
-    return schema;
-  });
+  const available = [...TOOL_DEFINITIONS.filter(tool => !extensions?.tools.has(tool.name) && (!tool.optional || args.tools?.includes(tool.name))).map((t) => ({ ...t, source: "builtin" as const })), ...custom];
+  const selected = selectTools(available, toolSelectionOf(args));
+  const deferred = selected.filter(tool => tool.source === "extension" && extensions?.tools.get(tool.name)?.exposure === "deferred")
+    .map(({ name, description, input_schema }) => ({ name, description, input_schema }));
+  const deferredNames = new Set(deferred.map(tool => tool.name));
+  const active = new Set([...declaredToolNames(previous), ...args.tools ?? []]);
+  const visible = selected.filter(tool => (!deferredNames.has(tool.name) || active.has(tool.name)) &&
+    (tool.name !== DISCOVERY_TOOL_NAME || deferred.length > 0 || args.tools?.includes(DISCOVERY_TOOL_NAME)));
+  // A cold open must not reorder an already accepted declaration and invent a checkpoint.
+  const order = new Map(declaredToolNames(previous).map((name, index) => [name, index]));
+  visible.sort((a, b) => (order.get(a.name) ?? Infinity) - (order.get(b.name) ?? Infinity));
+  const builtins = visible.filter(tool => tool.source === "builtin").map(tool => tool.name);
+  const schemas = visible.map(tool => tool.source === "builtin" ? modelToolSchema(tool, builtins)
+    : { name: tool.name, description: tool.description, input_schema: tool.input_schema });
+  // D6: extension authors retain their registration objects and SDK catalog views.
+  // Neither may mutate the already frozen provider declaration through an alias.
+  return { schemas: JSON.parse(JSON.stringify(schemas)) as typeof schemas,
+    deferred: JSON.parse(JSON.stringify(deferred)) as typeof deferred };
+}
+export function visibleSchemas(args: Args, extensions?: ExtensionRegistry, previous: readonly unknown[] = []) {
+  return sessionToolCatalog(args, extensions, previous).schemas;
 }
 
 export function unknownToolNames(names: readonly string[]): string[] {
-  const known = new Set(TOOL_SCHEMAS.map((t) => t.name));
+  const known = new Set(TOOL_DEFINITIONS.map((t) => t.name));
   return names.filter((n) => !known.has(n));
 }
 
@@ -878,9 +896,11 @@ export function createSessionFor(opts: {
   oauth?: boolean;
   effects?: ResolveEffects;
   extensions?: ExtensionRegistry;
+  acceptanceContract?: AcceptanceContract;
+  skills?: readonly Skill[];
 }): Session {
   const { args, workspace, logDir, blobDir, system, providerConfig, credential, io, askSlot } = opts;
-  const schemas = visibleSchemas(args, opts.extensions);
+  const { schemas, deferred } = sessionToolCatalog(args, opts.extensions);
   const names = schemas.map((t) => t.name);
   const sessionRules: PermissionRule[] = [];
   const tools: ToolContext = {
@@ -888,6 +908,7 @@ export function createSessionFor(opts: {
     ...DEFAULT_TOOL_CONTEXT,
     ...(args.pathRoot === undefined ? {} : { pathRoot: args.pathRoot }),
     allow: names,
+    deferredTools: deferred,
     rules: rulesWithAllowTools(args.allowTools),
     sessionRules,
     askSlot,
@@ -898,9 +919,12 @@ export function createSessionFor(opts: {
       logDir,
       frozen: { system, tools: schemas },
       blobDir,
+      shellCheckpoints: args.shellCheckpoints === true,
       tools,
       maxTurns: args.maxTurns,
       ...cliSessionConfig(args),
+      ...(opts.skills ? { skills: opts.skills } : {}),
+      ...(opts.acceptanceContract ? { acceptanceContract: opts.acceptanceContract } : {}),
       // Explicit legacy thresholds still select that experiment unless overridden.
       contextPolicy: args.contextPolicy ?? (args.trigger > 0 ? "segmented" : DEFAULT_CONTEXT_POLICY),
       ...(args.trigger > 0
@@ -917,13 +941,13 @@ export function createSessionFor(opts: {
         : {}),
     },
     // Empty key is a placeholder the shell must not send through. Interactive
-    // startup reaches this path so /login exists; run() refuses until a real
+    // startup reaches this path so /provider exists; run() refuses until a real
     // credential is installed on the session.
     createProvider(
       providerConfig,
       credential.ok ? credential.key : "",
       retryHandler(io),
-      { ...(opts.oauth === true ? { oauth: true } : {}), ...(opts.effects ? { effects: opts.effects } : {}) },
+      { sessionId: providerSessionId(logDir), ...(opts.oauth === true ? { oauth: true } : {}), ...(opts.effects ? { effects: opts.effects } : {}) },
     ),
     systemClock(),
   );
@@ -984,8 +1008,9 @@ export async function loadSessionResources(args: Args, workspace: string, io: Ap
   for (const line of new Set([...loaded.diagnostics, ...text.diagnostics, ...slash.diagnostics])) io.say(io.palette.yellow(`  ${line}`));
   const system = appendSkillsToSystem(assembleSystemPrompt(systemPromptFor(visibleSchemas(args, extensions).map(tool => tool.name), sessionEnvironment(workspace)), loadedContext), text.skills);
   const ui = toUiState(loaded, colorEnabled());
+  // Also reached on /resume and /reload: `auto` is resolved once per process by the Tui (apps/shell.ts), not here.
   if (args.tuiMode) ui.settings = { ...ui.settings, tuiMode: args.tuiMode };
-  return { loadedContext, slash: { ...slash.catalog, skillCommands: loaded.settings.enableSkillCommands !== false }, ui, index, trusted, system, extensions };
+  return { loadedContext, slash: { ...slash.catalog, skillExecution: true, skillCommands: loaded.settings.enableSkillCommands !== false }, ui, index, trusted, system, extensions };
 }
 
 /**
@@ -1011,7 +1036,7 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
     : await loadSessionResources(opts.args, workspace, opts.io, workspace === opts.workspace ? opts.projectTrusted : undefined);
   const interactive = opts.interactive && !opts.args.print && !opts.args.prompt && opts.args.mode !== "json";
   const named = [...opts.args.tools ?? [], ...opts.args.excludeTools, ...opts.args.allowTools];
-  const unknown = unknownToolNames(named).filter(name => !resources.extensions.tools.has(name));
+  const unknown = unknownToolNames(named).filter(name => !resources.extensions.definitions().has(name));
   if (unknown.length) throw new Error(`unknown tool: ${unknown.join(", ")}`);
   const saved = priorCursor === null ? undefined : restoreSessionModel(priorCursor, opts.catalog);
   const flags = { ...opts.modelFlags ?? { model: "", provider: "" } };
@@ -1054,10 +1079,14 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   const restoring = saved ?? spec;
   const restoringCredential = saved === undefined ? credential : opts.credentialOf(restoring);
   const oauth = (model: ModelSpec, got: Resolved) => got.ok && storedIsOAuth(opts.auth, model.provider) && opts.args.apiKey.length === 0;
+  const acceptanceContract = priorCursor === null
+    ? await loadAcceptanceContract(workspace, resources.trusted, opts.args.acceptanceFile) : undefined;
   const session = createSessionFor({
     ...opts,
     system: resources.system,
     extensions: resources.extensions,
+    skills: [...resources.slash.skills.values()],
+    ...(acceptanceContract ? { acceptanceContract } : {}),
     workspace: priorCursor?.workspace ?? opts.workspace,
     blobDir: priorCursor?.blob_dir ?? (priorCursor?.workspace && priorCursor.workspace !== opts.workspace
       ? statePaths(priorCursor.workspace, opts.args.stateDir).blobs : opts.blobDir),
@@ -1065,15 +1094,16 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
     credential: restoringCredential,
     ...(oauth(restoring, restoringCredential) ? { oauth: true } : {}),
   });
-  opts.startupPhase?.("Preparing workspace snapshot");
+  opts.startupPhase?.("Opening session history");
   await session.start();
+  resources.slash = { ...resources.slash, skills: new Map((session.config.skills ?? []).map(skill => [skill.name, skill])) };
   if (resources.extensions.loaded.length || session.config.frozen.tools.some(tool =>
     typeof tool === "object" && tool !== null && "name" in tool && typeof tool.name === "string" && unknownToolNames([tool.name]).length)) {
-    await session.reloadResources({ system: resources.system, tools: visibleSchemas(opts.args, resources.extensions) });
+    await session.reloadResources({ system: resources.system, tools: visibleSchemas(opts.args, resources.extensions, session.config.frozen.tools) });
   }
   if (restoring.id !== spec.id || restoring.provider !== spec.provider) {
     await session.switchModel(createProvider(providerConfig, credential.ok ? credential.key : "", retryHandler(opts.io),
-      { ...(oauth(spec, credential) ? { oauth: true } : {}), ...(opts.effects ? { effects: opts.effects } : {}) }));
+      { sessionId: providerSessionId(session.config.logDir), ...(oauth(spec, credential) ? { oauth: true } : {}), ...(opts.effects ? { effects: opts.effects } : {}) }));
     opts.io.say(opts.io.palette.yellow(`  switched ${restoring.id} → ${spec.id} at a model checkpoint`));
   }
   resources.ui.settings = { ...resources.ui.settings, thinking: providerConfig.effort,
@@ -1253,7 +1283,7 @@ export async function startup(args: Args, input?: StartupInput): Promise<App> {
       if (printMode || jsonMode || !stdinIsTty() || !stdoutIsTty()) {
         throw new Error("--resume needs an interactive terminal. Pass -r <id> or --session <id> instead");
       }
-      const picked = await withTerminal(handoff => pickStartupSession({ workspace, style: ui.style, say: io.say, keymap: ui.keymap,
+      const picked = await withTerminal(handoff => pickStartupSession({ workspace, theme: ui.theme, say: io.say, keymap: ui.keymap,
         ...(sessionDir === undefined ? {} : { sessionDir }) }, handoff));
       if (picked === null) { io.say(C.dim("No session selected")); process.exit(0); }
       sessionOpts = { explicit: picked };
@@ -1321,6 +1351,21 @@ export async function startup(args: Args, input?: StartupInput): Promise<App> {
   };
 }
 
+/** The banner's words for the shared limits; the loop acts at exactly these numbers. */
+export function boundaryDescription(policy: ContextPolicy, limits: ContextLimits): string {
+  switch (limits.kind) {
+    case "stop":
+    case "open":
+      return "continuous replay; stops at model window";
+    case "window":
+      return `windowed replay; prepare ${limits.prepare}, cut ${limits.trigger}, output reserved`;
+    case "segment":
+      return `${policy}${policy === "windowed" ? " (unknown window; fixed fallback)" : ""}; cut ${limits.trigger}, hard ${limits.hard}`;
+    default:
+      return assertNever(limits, "boundaryDescription");
+  }
+}
+
 function printBanner(
   args: Args,
   io: AppIO,
@@ -1370,13 +1415,14 @@ function printBanner(
     const line = formatNotice(notice);
     io.say(notice.kind === "skipped" ? C.yellow(`  ${line}`) : C.dim(`  ${line}`));
   }
-  const { triggerTokens: trigger, hardTokens: hard } = { ...DEFAULT_BOUNDARY, ...session.config.boundary };
   const policy = session.config.contextPolicy ?? DEFAULT_CONTEXT_POLICY;
-  const budget = windowBudget(session.provider.config.spec.contextWindow, session.provider.config.maxTokens);
-  const description = policy === "continuous" ? "continuous replay; stops at model window"
-    : policy === "windowed" && budget !== null ? `windowed replay; prepare ${budget.prepare}, cut ${budget.trigger}, output reserved`
-    : `${policy}${policy === "windowed" ? " (unknown window; fixed fallback)" : ""}; cut ${trigger}, hard ${hard}`;
-  io.say(C.dim(`boundary   ${description} (estimated tokens)`));
+  const limits = contextLimits({
+    policy,
+    contextWindow: session.provider.config.spec.contextWindow,
+    outputReserve: session.provider.config.maxTokens,
+    ...(session.config.boundary ? { boundary: session.config.boundary } : {}),
+  });
+  io.say(C.dim(`boundary   ${boundaryDescription(policy, limits)} (estimated tokens)`));
   if (priorCursor !== null) {
     const events = session.state.events.length;
     io.say(
@@ -1405,6 +1451,9 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [--system-prompt <text-or-file>] [--append-system-prompt <text>]\n" +
           "            [--no-context-files|-nc]\n" +
           "            [--tools names] [--exclude-tools names] [--no-tools]\n" +
+          "            [--tool-profile coding|readonly|research|data|full]\n" +
+          "            [--acceptance-file contract.json]\n" +
+          "            [--control-socket /private/directory/control.sock]\n" +
           "            [--no-builtin-tools]\n" +
           "            [--allow-tools names] [--approve|--no-approve]\n" +
           "            [--theme <name|path>] [--use-theme name] [--no-themes] [--thinking level] [--models patterns]\n" +
@@ -1413,6 +1462,10 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [--extension <path>] [--no-extensions] [--extension-flag name=value]\n" +
           "            [--mode text|json] [--tui-mode regular|fullscreen] [--verbose]\n" +
           "            [-p <prompt>] [prompt...]\n\n" +
+          "  xeno app-server [session/model flags] runs the experimental JSONL control interface.\n" +
+          "  xeno app-server schema prints its versioned request schema without startup.\n" +
+          "  --control-socket attaches local adapters to the same live session as the TUI.\n" +
+          "  /control opens goal, progress and context panels; XENO_PROGRAM_STATUS=auto|1|0 controls terminal status.\n\n" +
           "  Starts a new session by default; --fresh is an explicit alias. Nothing is deleted.\n" +
           "  -c continues the newest (or starts one); -r opens the session picker.\n" +
           "  --session / -r <id> pick one (unique prefix only). Resume restores its model;\n" +
@@ -1426,10 +1479,12 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "  --system-prompt replaces the built-in instructions (text, or a file that exists).\n" +
           "  --append-system-prompt appends; repeatable. -nc skips AGENTS.md discovery.\n" +
           "  --tools is a strict allowlist; excluded tools leave the schema.\n" +
+          "  New sessions use coding (10 tools); full exposes default built-ins.\n" +
           "  --no-builtin-tools drops built-ins and keeps any other source; --tools still wins.\n" +
           "  bash asks before it runs. --allow-tools bash skips the ask for this process.\n" +
           "  --time-budget <seconds> tells the model, once, when 75% of the run's wall-clock budget is used.\n" +
           "  --state-dir <dir> keeps snapshots, observations and sessions out of the workspace.\n" +
+          "  --checkpoint-shell enables best-effort Git recovery for command changes; ignored files and external effects are excluded.\n" +
           "  --path-root <dir> lets file tools reach absolute paths under <dir> (e.g. / in a container);\n" +
           "  relative paths, fingerprints and /back stay in the workspace, so edits outside it are not rewound.\n" +
           "  --approve loads .xeno/settings.json this run; --no-approve skips it.\n" +