@visual-z/xeno 0.5.0 → 0.7.0

package/src/runtime/control-connection.ts

@@ -4,6 +4,7 @@ import { selectLens, type LensFocus } from "../core/control-view.ts";
 import { assertNever } from "../core/exhaustive.ts";
 import type { SessionControl } from "./session-control.ts";
 import type { ApprovalChoice } from "./tools.ts";
+import type { SessionHub } from "./session-hub.ts";
 
 export type RpcOutput = { id: RpcId | null; result?: unknown; error?: { code: number; message: string } } | { method: string; params: unknown };
 
@@ -17,9 +18,13 @@ export class ControlConnection {
   private attached: SessionControl | undefined;
   private stop: (() => void) | undefined;
   private readonly denyOnClose: boolean;
+  private readonly hub: SessionHub | undefined;
+  private readonly subscriptions = new Map<SessionControl, () => void>();
+  private readonly questionClients = new Map<SessionControl, () => void>();
 
-  constructor(control: () => SessionControl, write: (output: RpcOutput) => void, options: { denyOnClose?: boolean } = {}) {
+  constructor(control: () => SessionControl, write: (output: RpcOutput) => void, options: { denyOnClose?: boolean; hub?: SessionHub } = {}) {
     this.control = control; this.write = write; this.denyOnClose = options.denyOnClose ?? false;
+    this.hub = options.hub;
   }
   private attach(): SessionControl {
     const control = this.control();
@@ -36,23 +41,50 @@ export class ControlConnection {
       if (typeof value === "object" && value !== null && "id" in value &&
         (typeof value.id === "string" && value.id.length <= 128 || typeof value.id === "number" && Number.isSafeInteger(value.id))) id = value.id;
       const request = parseControlRequest(value), params = request.params;
-      const control = this.attach();
+      let control = this.attach();
       if (request.method === "initialize") {
         if (this.initialized) throw new ControlProtocolError(-32000, "already initialized");
         this.initialized = true;
         this.write({ id, result: { protocol: CONTROL_SCHEMA.protocol, experimental: true, threadId: control.threadId, streamId: control.streamId,
-          capabilities: { turns: true, steering: true, approvals: true, contextLens: true, snapshotResync: true, durableEventReplay: "item/list", adaptiveExecution: false } } });
+          capabilities: { turns: true, steering: true, approvals: true, questions: true, contextLens: true, snapshotResync: true, durableEventReplay: "item/list", adaptiveExecution: false } } });
         return;
       }
       if (!this.initialized) throw new ControlProtocolError(-32000, "not initialized");
       if (request.method === "initialized") { if (this.ready) throw new ControlProtocolError(-32000, "already ready"); this.ready = true; return; }
       if (!this.ready) throw new ControlProtocolError(-32000, "send initialized before using the session");
+      if (request.method === "thread/list") {
+        if (!this.hub) throw Error("multi-session methods require app-server");
+        this.write({ id, result: await this.hub.list() }); return;
+      }
+      if (request.method === "thread/new" || request.method === "thread/resume") {
+        if (!this.hub) throw Error("multi-session methods require app-server");
+        const opened = await this.hub.open(request.method === "thread/new" ? "new" : "resume", params);
+        this.write({ id, result: await opened.snapshot() }); return;
+      }
+      if (this.hub && typeof params["threadId"] === "string") control = this.hub.get(params["threadId"]);
       if (params["threadId"] !== control.threadId) throw new ControlProtocolError(-32000, "stale or unknown threadId; initialize a new connection after changing sessions");
       let result: unknown;
       switch (request.method) {
+        case "thread/fork": {
+          if (!this.hub) throw Error("multi-session methods require app-server");
+          result = await (await this.hub.open("fork", { ...params, session: control.session.config.logDir })).snapshot(); break;
+        }
+        case "thread/close": {
+          if (!this.hub) throw Error("multi-session methods require app-server");
+          await this.hub.close(control.threadId); this.subscriptions.get(control)?.(); this.subscriptions.delete(control);
+          this.questionClients.get(control)?.(); this.questionClients.delete(control);
+          result = { closed: true }; break;
+        }
+        case "thread/mode": {
+          if (!control.configureWorkflow) throw Error("workflow changes are unavailable for this session");
+          await control.configureWorkflow(params["mode"] as "build" | "plan"); result = await control.snapshot(); break;
+        }
         case "thread/read": result = await control.snapshot(); break;
         case "thread/subscribe": {
-          this.subscribed = true;
+          if (!this.questionClients.has(control)) this.questionClients.set(control, control.attachQuestionClient());
+          if (this.hub) {
+            if (!this.subscriptions.has(control)) this.subscriptions.set(control, control.subscribe(notice => { if (!this.closed) this.write(notice); }));
+          } else this.subscribed = true;
           const snapshot = await control.snapshot();
           const after = params["after"] as { streamId: string; sequence: number } | undefined;
           result = { snapshot, resyncRequired: after !== undefined && (after.streamId !== snapshot.streamId || after.sequence !== snapshot.sequence) };
@@ -62,6 +94,7 @@ export class ControlConnection {
         case "turn/steer": control.steer(String(params["turnId"]), String(params["input"])); result = { queued: true }; break;
         case "turn/interrupt": control.interrupt(String(params["turnId"])); result = { interruptRequested: true }; break;
         case "approval/respond": control.respond(String(params["turnId"]), String(params["approvalId"]), params["choice"] as ApprovalChoice); result = { accepted: true }; break;
+        case "question/respond": control.respondQuestion(String(params["turnId"]), String(params["requestId"]), JSON.parse(String(params["reply"]))); result = { accepted: true }; break;
         case "acceptance/accept": await control.accept(String(params["requestId"]), String(params["criterionId"])); result = { accepted: true }; break;
         case "context/read": {
           const snapshot = await control.snapshot(false), all = selectLens(snapshot.context, params["focus"] as LensFocus);
@@ -96,6 +129,8 @@ export class ControlConnection {
   }
   close(): void {
     this.closed = true; this.stop?.();
+    for (const stop of this.subscriptions.values()) stop(); this.subscriptions.clear();
+    for (const stop of this.questionClients.values()) stop(); this.questionClients.clear();
     if (this.denyOnClose && this.attached) {
       this.attached.denyApprovals();
       if (this.attached.activeTurnId) this.attached.interrupt(this.attached.activeTurnId);

package/src/runtime/exec-sessions.ts

@@ -30,7 +30,7 @@ import type { CommandArtifactReceipt } from "../core/command-artifacts.ts";
 
 /** Codex's default: long enough for most commands to finish in one call. */
 export const DEFAULT_YIELD_MS = 10_000;
-/** Bounds on one wait. A longer wait is a longer silence the model cannot act in. */
+/** Bounds on a foreground poll or input send. Owned observation waits have no polling deadline. */
 export const MIN_YIELD_MS = 100;
 export const MAX_YIELD_MS = 30_000;
 /**
@@ -66,6 +66,7 @@ interface Session {
   spoolPath: string;
   queue: Promise<unknown>;
   operations: Promise<unknown>;
+  outputListeners: Set<() => void>;
   final?: TakenOutput;
   captureError?: string;
   written: number;
@@ -128,6 +129,7 @@ export function closedSession(id: number, owner?: string): ClosedSession | undef
 }
 
 function append(session: Session, chunk: Uint8Array): void {
+  if (chunk.length === 0) return;
   const bytes = chunk.slice();
   session.queue = session.queue.then(async () => {
     let offset = 0;
@@ -136,6 +138,7 @@ function append(session: Session, chunk: Uint8Array): void {
       if (bytesWritten < 1) throw new Error("process output spool made no write progress");
       offset += bytesWritten; session.written += bytesWritten;
     }
+    for (const notify of session.outputListeners) notify();
   }).catch(error => {
     session.captureError = `process output capture failed: ${String(error)}`;
     stopSession(session, "cancelled");
@@ -161,7 +164,7 @@ export async function startSession(input: {
   const exited = new Promise<void>((resolve) => { resolveExit = resolve; });
   const session = {
     id: nextId++, ...(input.owner === undefined ? {} : { owner: input.owner }), command: input.command, cwd: input.cwd, tty: input.tty, source: input.source, started: performance.now(),
-    spool, spoolPath, queue: Promise.resolve(), operations: Promise.resolve(), written: 0, read: 0,
+    spool, spoolPath, queue: Promise.resolve(), operations: Promise.resolve(), outputListeners: new Set<() => void>(), written: 0, read: 0,
     exit: null, timeoutMs: input.timeoutMs, exited, drained: Promise.resolve(),
     ...(input.artifactObserver ? { artifactObserver: input.artifactObserver } : {}),
   } as Omit<Session, "pid" | "write" | "kill" | "timer"> as Session;
@@ -282,6 +285,38 @@ async function waitSession(session: Session, yieldMs: number, signal?: AbortSign
   await session.queue;
 }
 
+export interface ObservationWait {
+  /** Steering releases this observation wait without cancelling the owned command. */
+  wake?: AbortSignal;
+  onWaiting?: (active: boolean) => void;
+}
+
+/** OMP's job owner pattern: no paid model turn merely to observe elapsed time. */
+async function waitForObservation(session: Session, signal: AbortSignal | undefined, wait: ObservationWait): Promise<void> {
+  await session.queue;
+  let notify!: () => void;
+  const changed = new Promise<void>(resolve => { notify = resolve; });
+  session.outputListeners.add(notify);
+  signal?.addEventListener("abort", notify, { once: true });
+  wait.wake?.addEventListener("abort", notify, { once: true });
+  const pending = session.exit === null && session.read === session.written && !signal?.aborted && !wait.wake?.aborted;
+  try {
+    if (pending) {
+      wait.onWaiting?.(true);
+      await Promise.race([session.exited, changed]);
+    }
+  } finally {
+    session.outputListeners.delete(notify);
+    signal?.removeEventListener("abort", notify);
+    wait.wake?.removeEventListener("abort", notify);
+    if (pending) wait.onWaiting?.(false);
+  }
+  if (signal?.aborted) stopSession(session, "cancelled");
+  if (session.stopped !== undefined) await session.exited;
+  if (session.exit !== null) await drainExitedSession(session);
+  await session.queue;
+}
+
 /**
  * Bytes printed since the previous call, archived in full. A session whose
  * exit has now been reported is closed.
@@ -325,7 +360,7 @@ async function takeOutput(session: Session, outputStore: string, previewBytes: n
 
 /** One lease covers stdin, waiting, archival and cursor commit; cancellation can interrupt a queued wait. */
 export async function pollSession(session: Session, outputStore: string, previewBytes: number, yieldMs: number,
-  chars = "", signal?: AbortSignal): Promise<TakenOutput> {
+  chars = "", signal?: AbortSignal, wait?: ObservationWait): Promise<TakenOutput> {
   const cancel = () => stopSession(session, "cancelled");
   if (signal?.aborted) cancel(); else signal?.addEventListener("abort", cancel, { once: true });
   const result = session.operations.then(async () => {
@@ -337,7 +372,8 @@ export async function pollSession(session: Session, outputStore: string, preview
       if (session.exit !== null) throw new ToolFault("not_found", "process has exited; input was not sent; poll with empty chars", NOT_STARTED);
       session.write(chars);
     }
-    await waitSession(session, yieldMs, signal);
+    if (chars.length === 0 && wait) await waitForObservation(session, signal, wait);
+    else await waitSession(session, yieldMs, signal);
     return takeOutput(session, outputStore, previewBytes);
   });
   session.operations = result.catch(() => {});

package/src/runtime/extensions.ts

@@ -43,6 +43,7 @@ export interface ExtensionTool {
   exposure?: "direct" | "deferred";
   promptSnippet?: string; promptGuidelines?: string[]; executionMode?: "parallel" | "sequential";
   prepareArguments?(input: unknown): unknown;
+  validateInput?(input: unknown): void;
   execute(id: string, args: Record<string, unknown>, signal: AbortSignal | undefined,
     onUpdate: (result: ExtensionToolResult) => void, ctx: ExtensionContext): Promise<ExtensionToolResult>;
   renderCall?(args: unknown, theme: ExtensionTheme, context: ExtensionToolRenderContext): ExtensionComponent;
@@ -102,6 +103,14 @@ interface ExtensionRegistryOptions {
 
 /** Registrations are staged before activation, and disposed as one generation on reload. */
 export class ExtensionRegistry {
+  /** Harness-owned tools keep capability metadata; arbitrary extensions cannot claim it. */
+  readonly builtinTools = new Map<string, ToolDefinition>();
+  private readonly ownedDisposers: (() => Promise<void>)[] = [];
+  installBuiltin(tool: ToolDefinition): void {
+    if (this.tools.has(tool.name) || this.builtinTools.has(tool.name)) throw Error(`duplicate harness tool ${tool.name}`);
+    this.builtinTools.set(tool.name, tool);
+  }
+  own(dispose: () => Promise<void>): void { this.ownedDisposers.push(dispose); }
   readonly commands = new Map<string, ExtensionCommand>();
   readonly tools = new Map<string, ExtensionTool>();
   readonly shortcuts = new Map<string, { description?: string; handler(ctx: ExtensionContext): void | Promise<void> }>();
@@ -160,6 +169,7 @@ export class ExtensionRegistry {
         this.insert(this.commands, name, command, source);
       },
       registerTool: tool => {
+        if (this.builtinTools.has(tool.name)) throw Error(`${tool.name} is owned by the harness`);
         if (!/^[a-zA-Z0-9_-]+$/.test(tool.name) || typeof tool.execute !== "function") throw new Error("Invalid tool definition");
         if (["note", "history", "branch", "resolve", DISCOVERY_TOOL_NAME].includes(tool.name)) throw new Error(`${tool.name} owns the append-only harness and cannot be replaced`);
         if (tool.exposure !== undefined && tool.exposure !== "direct" && tool.exposure !== "deferred") throw new Error("Unknown tool exposure");
@@ -287,6 +297,7 @@ export class ExtensionRegistry {
       access: "write", execution: "exclusive", branch: "none",
       ...(this.integrationTools.has(name) ? { integrationHealth: () => this.integrationTools.get(name)!.observe() } : {}),
       ...(tool.prepareArguments ? { prepareArguments: tool.prepareArguments } : {}),
+      ...(tool.validateInput ? { validateInput: tool.validateInput } : {}),
       run: async (ctx: ToolContext, raw: Record<string, unknown>) => {
         const context = { ...this.active().context(), signal: ctx.signal, tools: this.active().getTools(),
           executeTool: async (target: string, input: unknown) => {
@@ -313,6 +324,7 @@ export class ExtensionRegistry {
       },
     }]));
     if ([...this.tools.values()].some(tool => tool.exposure === "deferred")) definitions.set(DISCOVERY_TOOL_NAME, DISCOVERY_TOOL);
+    for (const [name, tool] of this.builtinTools) definitions.set(name, tool);
     return definitions;
   }
   toolHooks(): NonNullable<ToolContext["extensionHooks"]> {
@@ -328,6 +340,7 @@ export class ExtensionRegistry {
   }
   async dispose(): Promise<void> {
     if (this.disposed) return;
+    for (const dispose of this.ownedDisposers.splice(0)) await dispose();
     await Promise.all([...this.integrations.values()].map(owner => owner.dispose()));
     for (const detach of this.detachListeners) try { detach(); } catch (error) { this.report(String(error)); }
     this.detachListeners.clear(); this.toolUpdateListeners.clear();
@@ -337,16 +350,21 @@ export class ExtensionRegistry {
   }
   /** Q.13: a new generation must not overlap an unresolved callback from its predecessor. */
   async releaseIntegrations(): Promise<boolean> {
+    if ([...this.integrations.values()].some(owner => !owner.canReleaseForReload())) return false;
     const released = await Promise.all([...this.integrations.values()].map(owner => owner.releaseForReload()));
     return released.every(Boolean);
   }
+  restoreIntegrations(): boolean {
+    const restored = [...this.integrations.values()].map(owner => owner.resumeAfterReload());
+    return restored.every(Boolean);
+  }
 }
 
 function extensionSchema(parameters: unknown): ToolDefinition["input_schema"] {
   if (typeof parameters !== "object" || parameters === null) throw new Error("Tool parameters must be an object schema");
   const schema = parameters as Record<string, unknown>;
-  if (schema["type"] !== "object" || typeof schema["properties"] !== "object" || schema["properties"] === null) throw new Error("Tool parameters need object properties");
+  if (schema["type"] !== "object" || schema["properties"] !== undefined && (typeof schema["properties"] !== "object" || schema["properties"] === null || Array.isArray(schema["properties"]))) throw new Error("Tool parameters need an object schema");
   const required = schema["required"] ?? [];
   if (!Array.isArray(required) || required.some(value => typeof value !== "string")) throw new Error("Tool required fields must be names");
-  return { ...schema, type: "object", properties: schema["properties"] as Record<string, unknown>, required: required as string[] };
+  return { ...schema, type: "object", properties: (schema["properties"] ?? {}) as Record<string, unknown>, required: required as string[] };
 }

package/src/runtime/formatter-tool.ts

@@ -0,0 +1,38 @@
+/** Trusted formatter configuration controls commands; model arguments supply only paths. */
+import { planFormatters, runConfiguredFormatters, validateFormatters, type FormatterConfig } from "./formatter.ts";
+import { presentObservation, type ToolDefinition } from "./tools.ts";
+import { failureDiagnostic, failureFromError, NOT_STARTED, UNKNOWN_EFFECT } from "../core/tool-failure.ts";
+import { readEditableFile } from "../store/file-checkpoints.ts";
+
+export function createFormatterTool(configs: readonly FormatterConfig[]): ToolDefinition {
+  const frozen = validateFormatters(configs);
+  return {
+    name: "format", access: "shell", execution: "exclusive", branch: "write",
+    description: "Run explicitly configured trusted formatters for these existing workspace files. Every formatter command goes through the session's normal command admission, logs and checkpoints; no executable is auto-discovered or installed. Returns real command outcomes and resulting file digests. Formatting can change content; read the current file before deriving further edits.",
+    input_schema: { type: "object", required: ["paths"], properties: { paths: { type: "array", minItems: 1, maxItems: 100, items: { type: "string" } } } },
+    run: async (ctx, input) => {
+      if (!ctx.invokeHost) return { ok: false, content: "Formatter requires the session command lifecycle.", diagnostic: failureDiagnostic("environment_missing", "Formatter requires the session command lifecycle.", NOT_STARTED) };
+      let executing = false;
+      try {
+        const paths = input["paths"] as string[], plans = await planFormatters(ctx.root, paths, frozen);
+        if (!plans.length) return { ok: false, content: "No configured formatter matches these file extensions.", diagnostic: failureDiagnostic("environment_missing", "No configured formatter matches these file extensions.", NOT_STARTED) };
+        executing = true;
+        const results = await runConfiguredFormatters(plans, ctx.invokeHost, ctx.signal);
+        if (!results.length) return { ok: false, content: "Formatter cancelled before execution.", diagnostic: failureDiagnostic("cancelled", "Formatter cancelled before execution.", NOT_STARTED) };
+        const files = [];
+        for (const path of [...new Set(results.map(result => result.plan.path))]) {
+          const observed = await readEditableFile(ctx.root, path);
+          files.push({ path, sha256: observed.version?.sha256 ?? null });
+        }
+        const receipts = results.map(({ plan, result }) => `${plan.formatter} ${plan.path}: ${result.ok ? "completed" : "failed"}\n${result.content}`).join("\n\n");
+        const last = results.at(-1)!.result;
+        return { ...await presentObservation(ctx, receipts + "\n\nCurrent file versions:\n" + files.map(file => `${file.path}: ${file.sha256 ?? "absent"}`).join("\n")),
+          ok: results.length === plans.length && results.every(result => result.result.ok), data: { files, commands: results.length },
+          ...(last.outcome === undefined ? {} : { outcome: last.outcome }), ...(last.diagnostic === undefined ? {} : { diagnostic: last.diagnostic }) };
+      } catch (error) {
+        const diagnostic = failureFromError(error, executing ? UNKNOWN_EFFECT : NOT_STARTED);
+        return { ok: false, content: diagnostic.message, diagnostic };
+      }
+    },
+  };
+}

package/src/runtime/formatter.ts

@@ -0,0 +1,50 @@
+/** Explicit trusted formatters use the original command broker, never hidden subprocesses. */
+import { extname, resolve } from "node:path";
+import { readEditableFile } from "../store/file-checkpoints.ts";
+import type { NativeCommandInput, ToolResult } from "./tools.ts";
+export interface FormatterConfig { name: string; extensions: readonly string[]; command: readonly string[]; disabled?: boolean }
+export interface FormatterPlan { formatter: string; path: string; input: NativeCommandInput }
+
+export function validateFormatters(value: unknown): FormatterConfig[] {
+  if (!Array.isArray(value)) throw new Error("formatters must be an array of trusted command definitions");
+  const names = new Set<string>();
+  return value.map((entry: unknown) => {
+    if (entry === null || typeof entry !== "object" || Array.isArray(entry)) throw new Error("formatter must be an object");
+    const config = entry as Record<string, unknown>, name = config["name"], extensions = config["extensions"], command = config["command"], disabled = config["disabled"];
+    if (Object.keys(config).some(key => !["name", "extensions", "command", "disabled"].includes(key))) throw new Error("unknown formatter configuration field");
+    if (typeof name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(name) || names.has(name)) throw new Error("formatter names must be unique stable identifiers");
+    if (!Array.isArray(extensions) || !extensions.length || !extensions.every(extension => typeof extension === "string" && (extension === "*" || /^\.[A-Za-z0-9]+$/.test(extension)))) throw new Error("formatter extensions must contain dotted extensions or *");
+    if (!Array.isArray(command) || !command.length || !command.every(argument => typeof argument === "string" && !argument.includes("\0")) || !command[0]?.trim() || !command.some(argument => argument.includes("$FILE"))) throw new Error("formatter command must be literal argv containing $FILE");
+    if (disabled !== undefined && typeof disabled !== "boolean") throw new Error("formatter disabled must be boolean");
+    names.add(name);
+    return { name, extensions: extensions as string[], command: command as string[], ...(disabled === undefined ? {} : { disabled }) };
+  });
+}
+
+/** Absolute filename substitution prevents option and shell parsing of model paths. */
+export async function planFormatters(root: string, paths: readonly string[], configs: readonly FormatterConfig[]): Promise<FormatterPlan[]> {
+  const definitions = validateFormatters(configs), plans: FormatterPlan[] = [];
+  const known = new Set<string>();
+  for (const path of paths) {
+    const absolute = resolve(root, path);
+    if (known.has(absolute)) continue;
+    known.add(absolute);
+    const source = await readEditableFile(root, path);
+    if (source.version === null) throw new Error(`formatter target is missing: ${path}`);
+    for (const config of definitions) if (!config.disabled && (config.extensions.includes("*") || config.extensions.includes(extname(absolute))))
+      plans.push({ formatter: config.name, path, input: { argv: config.command.map(argument => argument.replaceAll("$FILE", absolute)), cwd: root } });
+  }
+  return plans;
+}
+
+/** Every command returns its real receipt; stop after failure or cancellation. */
+export async function runConfiguredFormatters(plans: readonly FormatterPlan[], invokeHost: (input: NativeCommandInput, signal?: AbortSignal) => Promise<ToolResult>, signal?: AbortSignal): Promise<{ plan: FormatterPlan; result: ToolResult }[]> {
+  const results: { plan: FormatterPlan; result: ToolResult }[] = [];
+  for (const plan of plans) {
+    if (signal?.aborted) break;
+    const result = await invokeHost(plan.input, signal);
+    results.push({ plan, result });
+    if (!result.ok || result.outcome?.status === "stopped") break;
+  }
+  return results;
+}

package/src/runtime/foundation.ts

@@ -0,0 +1,78 @@
+/** Foundations use the existing catalog, broker, permission and checkpoint owners. */
+import { parsePermissionRule, type PermissionRule } from "../core/permissions.ts";
+import { parsePatch, patchPaths } from "../core/patch.ts";
+import { parseWebSearchConfig } from "../core/web-content.ts";
+import { lastTurnChanges } from "../core/review.ts";
+import { discoverTargetInstructions, renderTargetInstructions } from "../store/context-files.ts";
+import { createPatchTool } from "./patch-tool.ts";
+import { createDiffTool } from "./review-tool.ts";
+import { createQuestionTool, type QuestionSlot } from "./question-tool.ts";
+import { createWebFetchTool, createWebSearchTool } from "./web-tools.ts";
+import { LspManager, parseLspConfig } from "./lsp-client.ts";
+import { validateFormatters } from "./formatter.ts";
+import { createFormatterTool } from "./formatter-tool.ts";
+import { permissionResourceAction } from "./permission-resources.ts";
+import type { ToolContext, ToolDefinition, ToolResult } from "./tools.ts";
+import { McpManager } from "./mcp-client.ts";
+import { parseMcpServers } from "../core/mcp-config.ts";
+import type { ExtensionRegistry } from "./extensions.ts";
+import { join } from "node:path";
+import { getBlob } from "../store/blobs.ts";
+
+export class FoundationRuntime {
+  readonly questionSlot: QuestionSlot;
+  readonly mcp: McpManager;
+  readonly tools: ToolDefinition[];
+  readonly permissions: PermissionRule[];
+  private readonly lsp: LspManager;
+  constructor(workspace: string, config: Record<string, unknown>, offline: boolean, configDirectory: string, questionSlot: QuestionSlot = {}) {
+    this.questionSlot = questionSlot;
+    const servers = Object.fromEntries(Object.entries(parseMcpServers(config["mcp"])).map(([name, server]) => [name, offline && server.transport === "http" ? { ...server, enabled: false } : server]));
+    this.mcp = new McpManager(servers, { cwd: workspace, credentialsDirectory: join(configDirectory, "mcp-credentials") });
+    if (config["permissions"] !== undefined && !Array.isArray(config["permissions"])) throw Error("permissions must be an array");
+    this.permissions = Array.isArray(config["permissions"]) ? config["permissions"].map(parsePermissionRule) : [];
+    const lsp = parseLspConfig(config["lsp"]); this.lsp = new LspManager(workspace, lsp);
+    const formatters = config["formatters"] === undefined ? [] : validateFormatters(config["formatters"]);
+    const search = parseWebSearchConfig(config["webSearch"]);
+    const network = [createWebFetchTool(), createWebSearchTool(search)];
+    if (offline) for (const tool of network) tool.run = async () => ({ ok: false, content: "Network tools are unavailable in offline mode." });
+    this.tools = [createQuestionTool(this.questionSlot), createPatchTool(), createDiffTool({ lastTurn: async ctx => {
+      if (!ctx.historyEvents || !ctx.checkpointBlobs) throw Error("original checkpoint history is unavailable");
+      return { blobs: ctx.checkpointBlobs, ...lastTurnChanges(await ctx.historyEvents()) };
+    }, canRead: async (ctx, path) => await permissionResourceAction(ctx.root, path, ctx.rules ?? [], ctx.sessionRules ?? [], "diff") === "allow" }), ...network, ...(lsp.length ? [this.lsp.tool()] : [])];
+    this.tools.push({ ...createFormatterTool(formatters), branch: "none" });
+  }
+  async register(registry: ExtensionRegistry): Promise<void> {
+    for (const tool of this.tools) registry.installBuiltin(tool);
+    const discovered = await this.mcp.discover();
+    for (const integration of discovered.integrations) registry.api("xeno-mcp").registerIntegration(integration);
+  }
+  async instructions(ctx: ToolContext, name: string, input: unknown, noContextFiles: boolean): Promise<ToolResult | null> {
+    if (noContextFiles || !["read", "write", "edit", "apply_patch", "query", "format", "lsp"].includes(name) || !input || typeof input !== "object") return null;
+    const args = input as Record<string, unknown>;
+    const paths = name === "apply_patch" ? patchPaths(parsePatch(String(args["patchText"]))) : typeof args["path"] === "string" ? [args["path"]] : Array.isArray(args["paths"]) ? args["paths"].filter((path): path is string => typeof path === "string") : [];
+    if (!paths.length) return null;
+    const known = new Set<string>();
+    for (const event of await ctx.historyEvents?.() ?? []) {
+      if (event.t !== "tool_result") continue;
+      let data: unknown = event.data;
+      if (event.data_ref && ctx.outputStore) {
+        const saved = await getBlob(ctx.outputStore, event.data_ref.sha256);
+        if (saved) data = JSON.parse(saved) as unknown;
+      }
+      if (!data || typeof data !== "object" || Array.isArray(data)) continue;
+      const receipt = data as Record<string, unknown>;
+      if (receipt["kind"] !== "scoped_instructions") continue;
+      const keys = receipt["keys"]; if (Array.isArray(keys)) for (const key of keys) if (typeof key === "string") known.add(key);
+    }
+    const found = await discoverTargetInstructions({ workspace: ctx.root, paths, known,
+      canRead: async path => await permissionResourceAction(ctx.root, path, ctx.rules ?? [], ctx.sessionRules ?? []) === "allow" });
+    if (found.notices.some(notice => notice.kind === "skipped" && notice.reason === "instruction read permission is unavailable")) return { ok: false, content: "Scoped instructions require read permission before this operation." };
+    const files = found.files.filter(file => !ctx.frozenSystem?.().includes(file.content));
+    if (!files.length) return null;
+    for (const file of files) if (await permissionResourceAction(ctx.root, file.path, ctx.rules ?? [], ctx.sessionRules ?? []) !== "allow") return { ok: false, content: "Scoped instructions require read permission before this operation." };
+    return { ok: false, content: "Scoped instructions were discovered. Read and follow them before deciding whether to retry the original operation. No original operation was executed.\n\n" + renderTargetInstructions(files),
+      data: { kind: "scoped_instructions", keys: files.map(file => file.key), files: files.map(file => ({ path: file.path, scope: file.scope, key: file.key, content: file.content, truncated: file.truncated })) } };
+  }
+  async dispose(): Promise<void> { await Promise.all([this.lsp.dispose(), this.mcp.dispose()]); }
+}

package/src/runtime/images.ts

@@ -7,13 +7,17 @@ import { convertImageBytesToPng, convertToPng } from "../vendor/pi-rich/image-co
 import { putBlob, getBlobBytes } from "../store/blobs.ts";
 import { imageDescription, validImageRef, type ImageRef } from "../core/images.ts";
 import type { ContentBlock, Message } from "../core/project.ts";
+import { imageDimensions, modelImageSide, MAX_IMAGE_SOURCE_BYTES, MAX_IMAGE_SOURCE_PIXELS } from "../core/image-limits.ts";
 
 // Admission limit, not a context threshold: avoid reading arbitrarily large local binaries into WASM.
-const MAX_IMAGE_SOURCE_BYTES = 64 * 1024 * 1024;
 export async function attachImageBytes(bytes: Uint8Array, name: string, blobDir: string, autoResize = true): Promise<ImageRef> {
   if (bytes.byteLength > MAX_IMAGE_SOURCE_BYTES) throw new Error("Image exceeds the 64 MiB attachment limit");
   let mime = detectSupportedImageMimeType(bytes);
   if (!mime) throw new Error("Unsupported or malformed image: " + name);
+  const dimensions = imageDimensions(bytes, mime);
+  if (!dimensions) throw new Error("Cannot read image dimensions: " + name);
+  if (dimensions.width * dimensions.height > MAX_IMAGE_SOURCE_PIXELS) throw new Error("Image exceeds the 25 megapixel decode limit: " + name);
+  const maxSide = modelImageSide(dimensions);
   const originalBytes = bytes;
   if (mime === "image/bmp") {
     const converted = await convertImageBytesToPng(bytes);
@@ -21,7 +25,7 @@ export async function attachImageBytes(bytes: Uint8Array, name: string, blobDir:
     bytes = converted; mime = "image/png";
   }
   // Pi's disabled auto-resize setting preserves the input; decoding still verifies its dimensions.
-  const result = await resizeImage(bytes, mime, autoResize ? undefined : { maxWidth: Number.MAX_SAFE_INTEGER, maxHeight: Number.MAX_SAFE_INTEGER, maxBytes: Number.MAX_SAFE_INTEGER });
+  const result = await resizeImage(bytes, mime, autoResize ? { maxWidth: maxSide, maxHeight: maxSide } : { maxWidth: Number.MAX_SAFE_INTEGER, maxHeight: Number.MAX_SAFE_INTEGER, maxBytes: Number.MAX_SAFE_INTEGER });
   if (!result) throw new Error("Cannot decode or resize image: " + name);
   if (result.mimeType !== "image/png" && result.mimeType !== "image/jpeg" && result.mimeType !== "image/gif" && result.mimeType !== "image/webp") {
     throw new Error("Unsupported image encoding: " + result.mimeType);

package/src/runtime/integrations.ts

@@ -55,7 +55,7 @@ export class LazyIntegration {
   private busy = false;
   private phase: "idle" | "connect" | "call" | "repair" = "idle";
   private disposed = false;
-  private readonly lifetime = new AbortController();
+  private lifetime = new AbortController();
   private readonly pending = new Set<Promise<unknown>>();
   private readonly closed = new WeakSet<IntegrationConnection>();
   private cleanup: "none" | "pending" | "complete" | "failed" = "none";
@@ -199,7 +199,7 @@ export class LazyIntegration {
     // No promise can kill trusted in-process code. Pending ownership remains visible until it settles.
   }
   async releaseForReload(): Promise<boolean> {
-    if (this.busy || this.pending.size || this.cleanup === "failed") return false;
+    if (!this.canReleaseForReload()) return false;
     this.disposed = true; this.lifetime.abort();
     const closing = this.retire(this.handle);
     let timer: ReturnType<typeof setTimeout> | undefined;
@@ -207,4 +207,10 @@ export class LazyIntegration {
     clearTimeout(timer);
     return this.pending.size === 0 && this.observe().cleanup !== "failed";
   }
+  canReleaseForReload(): boolean { return !this.busy && this.pending.size === 0 && this.cleanup !== "failed"; }
+  /** Re-enable explicit future invocations after an abandoned staged reload. No operation is replayed. */
+  resumeAfterReload(): boolean {
+    if (!this.canReleaseForReload()) return false;
+    this.disposed = false; this.lifetime = new AbortController(); return true;
+  }
 }