@visual-z/xeno 0.3.0 → 0.5.0

package/src/apps/control-transport.ts

@@ -0,0 +1,89 @@
+/** Q24: bounded local JSONL transport. No TCP listener or additional runtime dependency. */
+import { createServer, type Socket } from "node:net";
+import { chmodSync } from "node:fs";
+import { lstat, mkdir, rm } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { CONTROL_SCHEMA } from "../core/control-protocol.ts";
+import { ControlConnection, type RpcOutput } from "../runtime/control-connection.ts";
+import type { SessionControl } from "../runtime/session-control.ts";
+
+export class ControlJsonl {
+  private buffer = Buffer.alloc(0);
+  private pending = 0;
+  private tail = Promise.resolve();
+  private closed = false;
+  readonly connection: ControlConnection;
+  private readonly stop: () => void;
+  private readonly output: (text: string) => void;
+  constructor(control: () => SessionControl, output: (text: string) => void, stop: () => void, denyOnClose = false) {
+    this.stop = stop;
+    this.output = text => { try { output(text); } catch { this.close(); this.stop(); } };
+    this.connection = new ControlConnection(control, message => this.write(message), { denyOnClose });
+  }
+  private write(message: RpcOutput): void {
+    if (this.closed) return;
+    const text = JSON.stringify(message) + "\n";
+    if (Buffer.byteLength(text) > CONTROL_SCHEMA.limits.frameBytes) {
+      if ("id" in message) this.output(JSON.stringify({ id: message.id, error: { code: -32002, message: "response exceeds frame limit; use paginated inspectors" } }) + "\n");
+      else this.fail("event exceeds frame limit; reconnect and resynchronize");
+    } else this.output(text);
+  }
+  private fail(message: string): void {
+    if (this.closed) return;
+    this.output(JSON.stringify({ id: null, error: { code: -32001, message } }) + "\n");
+    this.close(); this.stop();
+  }
+  feed(chunk: Uint8Array): void {
+    if (this.closed) return;
+    this.buffer = Buffer.concat([this.buffer, chunk]);
+    for (;;) {
+      const newline = this.buffer.indexOf(10);
+      if (newline < 0) { if (this.buffer.length > CONTROL_SCHEMA.limits.frameBytes) this.fail("input frame exceeds limit"); return; }
+      if (newline > CONTROL_SCHEMA.limits.frameBytes) { this.fail("input frame exceeds limit"); return; }
+      const line = this.buffer.subarray(0, newline).toString("utf8"); this.buffer = this.buffer.subarray(newline + 1);
+      if (!line.trim()) continue;
+      if (++this.pending > CONTROL_SCHEMA.limits.queuedRequests) { this.fail("request queue is full"); return; }
+      this.tail = this.tail.then(async () => {
+        if (this.closed) return;
+        let value: unknown;
+        try { value = JSON.parse(line); }
+        catch { this.write({ id: null, error: { code: -32700, message: "invalid JSON" } }); return; }
+        await this.connection.receive(value);
+      }).finally(() => { this.pending--; });
+    }
+  }
+  async drained(): Promise<void> { await this.tail; }
+  close(): void { this.closed = true; this.buffer = Buffer.alloc(0); this.connection.close(); }
+}
+
+export async function listenControl(path: string, control: () => SessionControl): Promise<() => Promise<void>> {
+  const absolute = resolve(path), parent = dirname(absolute);
+  await mkdir(parent, { recursive: true, mode: 0o700 });
+  const directory = await lstat(parent);
+  if (!directory.isDirectory() || directory.mode & 0o077 || process.getuid && directory.uid !== process.getuid()) throw Error("control socket requires an owned private directory (mode 0700)");
+  try { await lstat(absolute); throw Error("control socket path already exists; refusing to replace it"); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+  const clients = new Map<Socket, ControlJsonl>();
+  const server = createServer(socket => {
+    // Assumed local adapter capacity; together with per-peer bounds this caps retained transport memory.
+    if (clients.size >= 32) { socket.destroy(); return; }
+    const peer = new ControlJsonl(control, text => {
+      if (socket.writableLength + Buffer.byteLength(text) > CONTROL_SCHEMA.limits.outputBytes) socket.destroy(); else socket.write(text);
+    }, () => socket.destroy());
+    clients.set(socket, peer);
+    socket.on("data", chunk => peer.feed(typeof chunk === "string" ? Buffer.from(chunk) : chunk));
+    socket.on("error", () => socket.destroy());
+    socket.on("close", () => { peer.close(); clients.delete(socket); });
+  });
+  await new Promise<void>((resolveReady, reject) => {
+    server.once("error", reject);
+    server.listen(absolute, () => { chmodSync(absolute, 0o600); resolveReady(); });
+  });
+  const owned = await lstat(absolute);
+  return async () => {
+    for (const [socket, peer] of clients) { peer.close(); socket.destroy(); }
+    await new Promise<void>((resolveClosed, reject) => server.close(error => error ? reject(error) : resolveClosed()));
+    try { const current = await lstat(absolute); if (current.ino === owned.ino && current.dev === owned.dev) await rm(absolute); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+  };
+}

package/src/apps/model-catalog.ts

@@ -1,6 +1,6 @@
 import { modelKey } from "../core/session-position.ts";
 import { clampThinkingLevel } from "../core/thinking.ts";
-import { createProvider } from "../runtime/catalog.ts";
+import { createProvider, providerSessionId } from "../runtime/catalog.ts";
 import { storedIsOAuth } from "../runtime/auth.ts";
 import { outputTokenBudget, type ModelSpec } from "../runtime/model.ts";
 import { providerAccess, setProviderAccess } from "../runtime/provider-access.ts";
@@ -29,6 +29,7 @@ export async function publishModelCatalog(app: App, models: readonly ModelSpec[]
   const config = { ...app.providerConfig, spec, maxTokens: outputTokenBudget(spec), effort: clampThinkingLevel(spec, app.providerConfig.effort) };
   const credential = app.credentialOf(spec);
   const next = createProvider(config, credential.ok ? credential.key : "", retryHandler(app.io), {
+    sessionId: providerSessionId(app.session.config.logDir),
     effects: app.effects, oauth: !app.args.apiKey && storedIsOAuth(app.auth, spec.provider),
   });
   const needsCut = providerReplayKey(previous) !== providerReplayKey(spec);

package/src/apps/preferences.ts

@@ -0,0 +1,20 @@
+/** User intent owns personal defaults; CLI overrides and restored/extension state only own a session. */
+import { mergeSettings, type Settings } from "../core/settings.ts";
+import { writeUserSettings } from "../store/resources.ts";
+import { describeError } from "./render.ts";
+import type { App } from "./startup.ts";
+
+export type PreferenceOrigin = "user" | "session";
+
+export async function commitUserSettings(app: App, patch: Settings): Promise<boolean> {
+  const ui = app.ui;
+  if (!ui) return false;
+  ui.settings = mergeSettings({ builtin: ui.settings, user: patch });
+  try { await writeUserSettings(patch); }
+  catch (error) {
+    app.io.say(app.io.palette.yellow(`  The change is active in this session, but could not save settings for the next startup: ${describeError(error)}`));
+    return false;
+  }
+  ui.userOverrides = mergeSettings({ builtin: ui.userOverrides, user: patch });
+  return true;
+}

package/src/apps/provider-connect.ts

@@ -1,5 +1,5 @@
 /**
- * Custom endpoints and connected-provider management, reached from `/login`.
+ * Custom endpoints and connected-provider management, reached from `/provider`.
  *
  * Flow (magpie's add form + OpenCode's /connect, see
  * docs/tasks/feat-provider-connect.md): choose a preset or a custom endpoint
@@ -68,7 +68,7 @@ function connectedName(id: string): string {
 }
 
 /**
- * Entry points from `/login`. API-key and subscription sign-in stay on the
+ * Entry points from `/provider`. API-key and subscription sign-in stay on the
  * login picker itself (their masked editor and OAuth flows are fixed by
  * tests); the wizard owns what login never did: custom endpoints and
  * per-provider model choice.
@@ -86,7 +86,7 @@ export function startConnect(host: ConnectHost, entry: "custom" | "manage"): voi
   }
   const connected = [...new Set(app.catalog.map(model => model.provider))].filter(id => providerReady(app, id).ready > 0).sort();
   if (connected.length === 0) {
-    wizard.push({ kind: "message", title: "No provider is connected yet", lines: ["Choose a subscription, an API-key provider or a custom endpoint from /login first."], onDone: () => host.close() });
+    wizard.push({ kind: "message", title: "No provider is connected yet", lines: ["Choose a subscription, an API-key provider or a custom endpoint from /provider first."], onDone: () => host.close() });
     return;
   }
   wizard.push({
@@ -100,7 +100,7 @@ export function startConnect(host: ConnectHost, entry: "custom" | "manage"): voi
   });
 }
 
-/** A provider configured by hand (or by an earlier /login) that is not a preset. */
+/** A provider configured by hand (or by an earlier /provider) that is not a preset. */
 function customFromCatalog(app: App, id: string): ProviderPreset | undefined {
   const model = app.catalog.find(candidate => candidate.provider === id);
   if (!model) return undefined;

package/src/apps/shell.ts

@@ -30,14 +30,14 @@ import {
 } from "../core/context-policy.ts";
 import { anchoredCount, estimateTokens, type Anchor, type TokenCounter } from "../core/tokens.ts";
 import type { RestorePoint, RewindMode } from "../runtime/loop.ts";
-import { createProvider, findModelByPattern, groupedModels, loadCatalog } from "../runtime/catalog.ts";
+import { createProvider, providerSessionId, findModelByPattern, groupedModels, loadCatalog } from "../runtime/catalog.ts";
 import { outputTokenBudget, type Effort, type ModelSpec } from "../runtime/model.ts";
 import { scopedModels } from "../runtime/model-scope.ts";
 import { equivalentCost, reportedCost } from "../runtime/usage.ts";
 import type { ProviderConfig } from "../runtime/provider.ts";
 import { describeMissingCredential, envLabel, ensureFreshCredential, storedIsOAuth } from "../runtime/auth.ts";
 import {
-  SUBSCRIPTION_NOTICE, SUBSCRIPTION_OPTIONS, isSubscriptionLogin, subscriptionById,
+  SUBSCRIPTION_NOTICE, SUBSCRIPTION_OPTIONS, subscriptionById, loginGrok,
   loginGitHubCopilot, generatePKCE, generateState, anthropicAuthorizeUrl, openaiCodexAuthorizeUrl,
   startCallbackServer, exchangeAnthropicCode, exchangeOpenAICode, parseAuthorizationInput,
   ANTHROPIC_CALLBACK_PORT, ANTHROPIC_CALLBACK_PATH, ANTHROPIC_REDIRECT_URI,
@@ -58,18 +58,20 @@ import { registerSessionRoot } from "../store/session-browser.ts";
 import { createSession, findSessionByPrefix, listSessions, truncationNote, sessionsDir } from "../store/sessions.ts";
 import { exportSessionArchive, importSessionArchive } from "../store/session-archive.ts";
 import { resolveTuiMode } from "../core/tui-mode.ts";
-import { recordRecent } from "../core/model-picker.ts";
+import { modelPreferencePatch, thinkingPreferencePatch } from "../core/model-preferences.ts";
 import { flattenTree, treeFromPoints, LEFT_BRANCH_MARK, EMPTY_TREE_MESSAGE, type TreeNode, type NodeParent, type TreePoint } from "../core/session-tree.ts";
 import { cycle } from "../core/cycle.ts";
 import { THINKING_LEVELS, asThinkingLevel as asEffort, supportedThinkingLevels, clampThinkingLevel } from "../core/thinking.ts";
 import { modelKey } from "../core/session-position.ts";
 import { defaultKeymap, listBindings } from "../core/keymap.ts";
-import { settingPatch, mergeSettings } from "../core/settings.ts";
-import { writeUserSettings, resolveTheme } from "../store/resources.ts";
+import { settingPatch } from "../core/settings.ts";
+import { resolveTheme } from "../store/resources.ts";
+import { commitUserSettings, type PreferenceOrigin } from "./preferences.ts";
 import { colorEnabled } from "./render.ts";
 import { createStyle, IDENTITY } from "../tui/style.ts";
 import { lastAssistantText, toHtml } from "../core/export.ts";
 import { toJsonEvent } from "../core/json-event.ts";
+import { sessionControl } from "../runtime/session-control.ts";
 import { COMMANDS, parseCommand, type Command } from "./commands.ts";
 import { expandInput } from "./input.ts";
 import {
@@ -84,7 +86,7 @@ import type { TurnSurface, Ui } from "./ui/surface.ts";
  * One line. Listing all ~40 commands here wrapped into a two-line wall that
  * nobody reads; typing `/` already opens the searchable command menu.
  */
-const HINT = `type a prompt · / for ${COMMANDS.length} commands · /login connects a provider · /model switches · /help`;
+const HINT = `type a prompt · / for ${COMMANDS.length} commands · /provider connects a provider · /model switches · /help`;
 const OAUTH_PASTE = "\0oauth";
 
 const initializedExtensions = new WeakSet<ExtensionRegistry>();
@@ -143,9 +145,9 @@ async function bindExtensions(app: App, tui?: Ui): Promise<void> {
     },
     setModel: async model => {
       if (typeof model !== "object" || !model || !("provider" in model) || !("id" in model)) return false;
-      await switchByPattern(app, String(model.provider) + "/" + String(model.id)); return app.providerConfig.spec.id === model.id && app.providerConfig.spec.provider === model.provider;
+      await switchByPattern(app, String(model.provider) + "/" + String(model.id), "session"); return app.providerConfig.spec.id === model.id && app.providerConfig.spec.provider === model.provider;
     },
-    setThinking: async level => { await applyThinkingCommand(app, level, tui ?? null); },
+    setThinking: async level => { await applyThinkingCommand(app, level, tui ?? null, "session"); },
     exec: (command, args, options) => app.session.runExtensionCommand(command, args, options),
   });
   if (!initializedExtensions.has(registry)) {
@@ -344,7 +346,7 @@ async function runLines(app: App): Promise<void> {
   await bindExtensions(app);
   const C = app.io.palette;
   if (app.ui?.settings.quietStartup !== true || app.args.verbose) app.io.say(C.dim(HINT));
-  /** Set by `/login <provider>`; the next line typed is the key, not a prompt. */
+  /** Set by `/provider <provider>`; the next line typed is the key, not a prompt. */
   let awaitingKeyFor: string | null = null;
   for await (const line of console) {
     const text = line.trim();
@@ -438,7 +440,11 @@ async function execute(app: App, command: Command, tui: Ui | null): Promise<Outc
       printUsage(app);
       return "continue";
     case "state":
-      printState(app);
+      await printState(app);
+      return "continue";
+    case "control":
+      if (tui) await tui.openControl();
+      else app.io.say(JSON.stringify(await sessionControl(app.session).snapshot(), null, 2));
       return "continue";
     case "context":
       printContext(app);
@@ -514,8 +520,8 @@ async function execute(app: App, command: Command, tui: Ui | null): Promise<Outc
       if (command.provider === undefined) {
         if (tui) { tui.openLogin(); return "continue"; }
         const C = app.io.palette;
-        const providers = [...new Set(app.catalog.map((m) => m.provider))];
-        app.io.say(C.bold("\nlogin"));
+        const providers = [...new Set(app.catalog.map((m) => m.provider))].filter(provider => !subscriptionById(provider));
+        app.io.say(C.bold("\nproviders"));
         app.io.say(C.bold("  API keys"));
         for (const p of providers) {
           app.io.say(`  ${p.padEnd(12)}${C.dim(envLabel(p))}`);
@@ -524,13 +530,15 @@ async function execute(app: App, command: Command, tui: Ui | null): Promise<Outc
         for (const s of SUBSCRIPTION_OPTIONS) {
           app.io.say(`  ${s.id.padEnd(16)}${C.dim(s.label)}`);
         }
-        app.io.say(C.dim("\n  /login <provider> then paste the key. Empty line cancels."));
-        app.io.say(C.dim("  /login claude-pro|codex|github-copilot starts a subscription login.\n"));
+        app.io.say(C.dim("\n  /provider <provider> then paste the key. Empty line cancels."));
+        app.io.say(C.dim(`  /provider ${SUBSCRIPTION_OPTIONS.map(option => option.id).join("|")} starts an account login.\n`));
         return "continue";
       }
-      if (isSubscriptionLogin(command.provider)) {
-        return startSubscriptionLogin(app, command.provider, tui);
+      const subscription = subscriptionById(command.provider);
+      if (subscription) {
+        return startSubscriptionLogin(app, subscription.id, tui);
       }
+      if (!app.catalog.some(model => model.provider === command.provider)) { app.io.say(app.io.palette.red(`  unknown provider: ${command.provider}. Use /provider to choose one.`)); return "continue"; }
       if (tui) {
         const provider = command.provider;
         const key = await tui.askSecret(`API key · ${provider}`, "Key", "paste the key · $VAR reads the environment · !cmd runs a command · enter save · esc cancel");
@@ -703,12 +711,21 @@ function printUsage(app: App): void {
   app.io.say("");
 }
 
-function printState(app: App): void {
+async function printState(app: App): Promise<void> {
   const C = app.io.palette;
   const s = app.session.state;
   app.io.say(C.bold("\nstate"));
   app.io.say(`  node              ${s.node}  (depth ${s.depth})`);
   app.io.say(`  events in node    ${s.events.length}`);
+  const request = await app.session.requestState();
+  if (request) {
+    app.io.say(`  request           ${request.request.event} · ${request.status}`);
+    app.io.say(`  execution         ${request.execution?.reason ?? "in progress or unknown"}`);
+    app.io.say(`  command evidence  ${request.commands.filter(command => command.status === "pass").length} current passes / ${request.commands.length} receipts`);
+    app.io.say(`  observations      ${request.progress.observations.length} new; artifact changes ${request.progress.artifact_changes.length}; acceptance advances ${request.progress.acceptance_advances.length}`);
+    app.io.say(`  diagnostics       ${request.progress.new_diagnostics.length} new; unchanged retries ${request.progress.unchanged_retries.length}; unknown ${request.progress.unknown_diagnostics.length}`);
+    if (!request.acceptance) app.io.say("  task verification no declared acceptance contract; command success alone does not verify the task");
+  }
   if (s.handoff) {
     const h = s.handoff;
     app.io.say(`  completed         ${h.state.completed.length}`);
@@ -806,7 +823,8 @@ async function commitSetting(app: App, field: string, value: string, tui: Ui | n
   }
   if (key === "thinking") {
     const effort = asEffort(value);
-    if (!effort || !await applyThinking(app, effort, tui)) return;
+    if (effort) await applyThinking(app, effort, tui);
+    return;
   }
   const parsed = settingPatch(key === "status" ? "statusBar" : field, value);
   if (parsed.diagnostics.length) { app.io.say(C.yellow(parsed.diagnostics.join("\n"))); return; }
@@ -817,12 +835,12 @@ async function commitSetting(app: App, field: string, value: string, tui: Ui | n
     app.ui.theme = theme;
     app.ui.style = colorEnabled() ? createStyle(theme.colors) : IDENTITY;
   }
-  await writeUserSettings(parsed.settings);
-  app.ui.settings = mergeSettings({ builtin: app.ui.settings, user: parsed.settings });
-  app.ui.userOverrides = mergeSettings({ builtin: app.ui.userOverrides, user: parsed.settings });
-  if (key === "enableskillcommands") { await reloadAppResources(app); await tui?.refreshResources(); }
-  if (tui) tui.toast(`${field} · ${value}`, "success");
-  else app.io.say(C.dim(`  ${field} ${value}`));
+  const saved = await commitUserSettings(app, parsed.settings);
+  if (saved && key === "enableskillcommands") { await reloadAppResources(app); await tui?.refreshResources(); }
+  if (saved) {
+    if (tui) tui.toast(`${field} · ${value}`, "success");
+    else app.io.say(C.dim(`  ${field} ${value}`));
+  }
   tui?.applyConfiguration();
   if (key === "theme") tui?.followTheme();
   tui?.redraw();
@@ -840,7 +858,7 @@ function effortSupported(spec: ModelSpec, level: Effort): boolean {
  * must not cut: a cut drops the prefix cache, and thinking blocks stay
  * valid because the model did not change.
  */
-async function applyThinking(app: App, level: Effort, tui: Ui | null): Promise<boolean> {
+async function applyThinking(app: App, level: Effort, tui: Ui | null, origin: PreferenceOrigin = "user"): Promise<boolean> {
   const C = app.io.palette;
   if (!effortSupported(app.providerConfig.spec, level)) {
     app.io.say(
@@ -858,19 +876,20 @@ async function applyThinking(app: App, level: Effort, tui: Ui | null): Promise<b
   if (app.ui !== undefined) {
     app.ui.settings = { ...app.ui.settings, thinking: level };
   }
+  if (origin === "user") await commitUserSettings(app, thinkingPreferencePatch(app.providerConfig.spec, level));
   app.io.say(C.dim(`  thinking ${level}`));
   tui?.redraw();
   return true;
 }
 
-async function applyThinkingCommand(app: App, level: string | undefined, tui: Ui | null): Promise<Outcome> {
+async function applyThinkingCommand(app: App, level: string | undefined, tui: Ui | null, origin: PreferenceOrigin = "user"): Promise<Outcome> {
   if (level !== undefined) {
     const effort = asEffort(level);
     if (effort === undefined) {
       app.io.say(app.io.palette.yellow("  thinking must be " + THINKING_LEVELS.join("|")));
       return "continue";
     }
-    await applyThinking(app, effort, tui);
+    await applyThinking(app, effort, tui, origin);
     return "continue";
   }
   if (tui) {
@@ -1244,7 +1263,7 @@ function providerOAuthOpts(app: App, spec: ModelSpec): { oauth: true } | undefin
 }
 
 function makeProvider(app: App, config: ProviderConfig, key: string) {
-  return createProvider(config, key, retryHandler(app.io), { ...providerOAuthOpts(app, config.spec), effects: app.effects });
+  return createProvider(config, key, retryHandler(app.io), { sessionId: providerSessionId(app.session.config.logDir), ...providerOAuthOpts(app, config.spec), effects: app.effects });
 }
 
 interface PendingOAuth {
@@ -1361,19 +1380,20 @@ async function startSubscriptionLogin(app: App, id: string, tui: Ui | null): Pro
   await cancelPendingOAuth(app);
   const effects = tui?.oauthEffects ?? loginEffects;
   app.io.say(C.yellow(`  ${SUBSCRIPTION_NOTICE}`));
-  if (sub.id === "github-copilot") {
+  if (sub.id === "github-copilot" || sub.id === "grok") {
     const pending: { abort: AbortController; tui: Ui | null; close?: () => void } = { abort: new AbortController(), tui };
     pendingDevices.set(app, pending);
     const work = async () => { try {
-      const credential = await effects.device({
+      const credential = await (sub.id === "grok" ? loginGrok : effects.device)({
         notify: (message) => {
           if (pendingDevices.get(app) !== pending) return;
-          if (tui) { pending.close?.(); pending.close = tui.waiting("GitHub Copilot", message.split("\n"), () => { void cancelPendingOAuth(app); }); }
+          if (tui) { pending.close?.(); pending.close = tui.waiting(sub.label, message.split("\n"), () => { void cancelPendingOAuth(app); }); }
           else app.io.say(`  ${message}`);
         },
         prompt: async () => "",
         fetch: effects.fetch,
         signal: pending.abort.signal,
+        openBrowser: effects.openBrowser,
       });
       if (pending.abort.signal.aborted || pendingDevices.get(app) !== pending) return;
       await storeOAuth(app, sub.provider, credential);
@@ -1387,7 +1407,7 @@ async function startSubscriptionLogin(app: App, id: string, tui: Ui | null): Pro
         pending.close?.();
       }
     } };
-    if (tui) { pending.close = tui.waiting("GitHub Copilot", ["Requesting a device code…"], () => { void cancelPendingOAuth(app); }); tui.runExtensionAction(work); return "continue"; }
+    if (tui) { pending.close = tui.waiting(sub.label, ["Requesting a device code…"], () => { void cancelPendingOAuth(app); }); tui.runExtensionAction(work); return "continue"; }
     await work();
     return "continue";
   }
@@ -1469,7 +1489,7 @@ async function adoptCredential(app: App, ready: readonly ModelSpec[]): Promise<v
   const got = app.credentialOf(spec);
   if (!got.ok) return;
   if (app.credential.ok || app.session.state.handoff !== null || app.session.state.events.some((e) => e.t === "assistant")) {
-    await switchToModel(app, spec);
+    await switchToModel(app, spec, undefined, "session");
     return;
   }
   const nextConfig: ProviderConfig = {
@@ -1494,7 +1514,7 @@ async function adoptCredential(app: App, ready: readonly ModelSpec[]): Promise<v
   app.io.say(C.green(`  now ${spec.name}`) + C.dim(`  ${spec.id}`));
 }
 
-async function switchByPattern(app: App, pattern: string): Promise<void> {
+async function switchByPattern(app: App, pattern: string, origin: PreferenceOrigin = "user"): Promise<void> {
   const C = app.io.palette;
   const found = scopedModels([pattern], app.catalog, true), selected = found.entries[0];
   if (!selected) {
@@ -1502,24 +1522,25 @@ async function switchByPattern(app: App, pattern: string): Promise<void> {
     app.io.say(C.red(`  ${diagnostic.ok ? found.diagnostics.join("; ") : diagnostic.reason}`));
     return;
   }
-  await switchToModel(app, selected.model, selected.thinking);
+  await switchToModel(app, selected.model, selected.thinking, origin);
 }
 
-export async function switchToModel(app: App, spec: ModelSpec, thinking?: Effort): Promise<void> {
+export async function switchToModel(app: App, spec: ModelSpec, thinking?: Effort, origin: PreferenceOrigin = "user"): Promise<void> {
   const C = app.io.palette;
-  if (spec.id === app.providerConfig.spec.id && spec.provider === app.providerConfig.spec.provider) {
-    if (thinking) await applyThinking(app, clampThinkingLevel(spec, thinking), null);
-    app.io.say(C.dim(`  already on ${spec.id}`));
-    return;
-  }
   const got = app.credentialOf(spec);
   if (!got.ok) {
     app.io.say(C.red(`\n  ${got.reason}\n`));
-    if (!got.reason.includes("/login")) {
+    if (!got.reason.includes("/provider")) {
       app.io.say(C.dim(`  ${describeMissingCredential(spec.provider)}\n`));
     }
     return;
   }
+  if (spec.id === app.providerConfig.spec.id && spec.provider === app.providerConfig.spec.provider) {
+    if (thinking) await applyThinking(app, clampThinkingLevel(spec, thinking), null, "session");
+    if (origin === "user") await rememberModelSelection(app, spec, thinking);
+    app.io.say(C.dim(`  already on ${spec.id}`));
+    return;
+  }
   const nextConfig: ProviderConfig = {
     spec,
     maxTokens: outputTokenBudget(spec),
@@ -1537,15 +1558,15 @@ export async function switchToModel(app: App, spec: ModelSpec, thinking?: Effort
   app.providerConfig = nextConfig;
   app.credential = got;
   app.io.say(C.green(`  now ${spec.name}`) + C.dim(`  ${spec.id}`));
-  await rememberRecentModel(app, spec);
+  if (origin === "user") await rememberModelSelection(app, spec, thinking);
 }
 
-/** Recency feeds the picker's first section; a write failure only costs ordering. */
-async function rememberRecentModel(app: App, spec: ModelSpec): Promise<void> {
+/** N.8 must accept the checkpoint before a user choice can own the next startup. */
+async function rememberModelSelection(app: App, spec: ModelSpec, explicitThinking: Effort | undefined): Promise<void> {
   if (!app.ui) return;
-  const recentModels = recordRecent(app.ui.settings.recentModels ?? [], modelKey(spec));
-  app.ui.settings = { ...app.ui.settings, recentModels };
-  try { await writeUserSettings({ recentModels }); } catch { /* ordering only */ }
+  const effort = app.providerConfig.effort;
+  const patch = modelPreferencePatch(spec, app.ui.settings.recentModels ?? [], effort);
+  await commitUserSettings(app, explicitThinking === undefined ? patch : { ...patch, ...thinkingPreferencePatch(spec, effort) });
 }
 
 function sessionDirOf(app: App): string | undefined {
@@ -1750,6 +1771,7 @@ async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Ui, ima
     if (tui) tui.beginBash(prompt.slice(excluded ? 2 : 1));
     const result = await app.session.runUserBash(prompt.slice(excluded ? 2 : 1), excluded, signal,
       tui ? chunk => tui.pushBash(chunk) : undefined);
+    tui?.observeEvent?.({ kind: "done", outcome: result.outcome });
     if (tui) { await tui.syncTranscript(); tui.commitStream(); }
     else app.io.say(`$ ${result.command}\n${result.content}`);
     return true;
@@ -1760,7 +1782,7 @@ async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Ui, ima
     const C = app.io.palette;
     app.io.say(C.yellow("  no credential yet -- this prompt was not sent."));
     app.io.say(C.dim(`  ${app.credential.reason}`));
-    app.io.say(C.dim("  export an API key, or /login <provider>.\n"));
+    app.io.say(C.dim("  export an API key, or /provider <provider>.\n"));
     tui?.restoreDraft(prompt, images);
     return false;
   }
@@ -1855,7 +1877,8 @@ export async function runTurn(
   }
   await registry?.emit("agent_start");
   await registry?.emit("turn_start", { turnIndex: 0 });
-  try { for await (const e of skill ? app.session.sendSkill(skill, prompt, signal) : app.session.send(prompt, signal, pull)) {
+  try { for await (const e of skill ? app.session.sendSkill(skill, prompt, signal) : sessionControl(app.session).send(prompt, signal, pull)) {
+    tui?.observeEvent?.(e);
     if (e.kind === "text_delta" || e.kind === "thinking_delta") await registry?.emit("message_update", { assistantMessageEvent: { type: e.kind, delta: e.text } });
     if (e.kind === "assistant_text") await registry?.emit("message_end", { message: { role: "assistant", content: [{ type: "text", text: e.text }] } });
     if (e.kind === "done") await registry?.emit("turn_end", { reason: e.reason });

package/src/apps/startup-input.ts

@@ -7,7 +7,7 @@
 type StartupStdin = Pick<NodeJS.ReadStream, "isTTY" | "isRaw" | "setRawMode" | "setEncoding" | "on" | "off" | "resume" | "pause" | "unshift">;
 export interface StartupInput {
   phase(name: string): void;
-  /** Pause, restore the shell's mode and replay held bytes to the next input owner. */
+  /** Pause and replay held bytes while keeping raw mode for the next input owner. */
   handoff(): void;
   /** Final cleanup discards unsubmitted input instead of leaking it to the shell. */
   restore(): void;
@@ -45,9 +45,14 @@ export function createStartupInput(opts: {
     stdin.off("data", receive);
     signals.off("SIGINT", interrupt); signals.off("SIGTERM", terminate); signals.off("SIGHUP", hangup);
     pasting = false; partial = "";
+  };
+  const restore = () => {
+    if (closed) return;
+    closed = true; release(); pending = [];
+    // D20: ownership transfer must not expose a cooked-mode gap that turns CR into LF.
+    // Final cleanup also restores termios when the next renderer never mounted.
     stdin.setRawMode(wasRaw);
   };
-  const restore = () => { closed = true; release(); pending = []; };
   const cancel = (code: number) => {
     if (!active) return;
     restore();