@visual-z/xeno 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # xeno changelog
 
+## 0.7.1 — 2026-10-09
+
+- Keep a dialog form editable after a validation error. A rejected provider id no longer destroys the input field (`EditBuffer is destroyed`), and the error suggests a valid id.
+- Send the Grok proxy's version-gate header so Grok account inference no longer fails with HTTP 426. A future 426 explains how a xeno user recovers.
+- Show progress, elapsed time and a 3-second limit for a manual `/update` check, with failures styled as errors.
+
+## 0.7.0 — 2026-10-09
+
+- Keep fullscreen exit output bounded to the execution state and resume command. Preserve full transcript export as an explicit choice.
+- Wait for actual process output, exit or the configured timeout when the agent owns an empty-input process wait. Preserve steering, cancellation and process receipts without spending model requests on empty polling.
+- Reserve the last available model request for a response with tools disabled, and report unfinished work when the budget is exhausted. Track cumulative unproductive activity separately from consecutive failures.
+- Share in-flight session discovery so concurrent cold resumes resolve aliases to one execution owner.
+- Show provider, approval/YOLO, Build/Plan, running/waiting/queued state, model budgets and Git status from their current owners. Label model request time explicitly.
+- Preserve screenshot detail with a 4096-pixel long edge and an 8 Mi-pixel default limit, preflight decoding, bounded image caching and visible load errors.
+
 ## 0.6.0 — 2026-10-09
 
 - Add a foundation tool profile and Build/Plan agent roles, structured questions, resource and literal command-prefix permissions. Keep the ten-tool coding default and explicit tool selections intact across cold resumes.

package/README.md

@@ -17,7 +17,7 @@ is ever summarized by a model, and nothing is ever rewritten in place.
 messages[]                             frozen system prefix + handoff + this node's events
 ```
 
-Version **0.6.0**. The on-disk session format will still change; `0.x` is that
+Version **0.7.1**. The on-disk session format will still change; `0.x` is that
 statement. Published as `@visual-z/xeno`; the license is `UNLICENSED` (readable and installable, no reuse granted).
 
 ## Install
@@ -497,9 +497,20 @@ PgUp/PgDn scroll, and Ctrl+Home/End jump to the start or latest messages.
 Ctrl+O expands tools, Ctrl+T expands thinking, and Ctrl+B toggles the sidebar.
 Mouse selection copies plain text when `fullscreenCopyOnSelect` is enabled;
 Ctrl+X copies a selection or the last reply. Exiting restores the terminal and
-prints the conversation and a resume command. The composer stays at the bottom
+prints a bounded execution status and a resume command. Set
+`fullscreenExitOutput` to `transcript` in `/settings` for full replay on exit.
+The composer stays at the bottom
 and grows with the draft; pickers and forms use the same input area.
 
+An empty `write_stdin` in an agent session waits for new output, command exit,
+hard timeout, cancellation or user steering. The process owner holds that wait;
+quiet commands do not consume model requests through periodic polling.
+Sending input and low-level process polling keep their bounded yield contract.
+For `--max-turns N`, budgets above one reserve the last request for a text answer.
+Tools stay frozen and are disabled for that request, with host enforcement.
+Unsupported protocols or a failed final response use an evidence-based stop
+report inside the same budget. `/usage` labels provider durations as model time.
+
 `/settings theme` previews built-in and custom themes from the config directory's
 `themes/`. Escape restores the prior theme. Custom files reload after valid edits;
 `auto` follows terminal light/dark changes. Built-in themes keep the terminal's

package/docs/providers.md

@@ -25,7 +25,7 @@ xeno 内置 Pi 0.99.1 和 OpenCode 所用 Models.dev 的固定源并集，另加
 
 账户存为 `auth.json` 的 `xai-grok`（0600），模型身份为 `xai-grok/grok-build`，请求走 `https://cli-chat-proxy.grok.com/v1`。`xai` 仍表示 `XAI_API_KEY` 与 `https://api.x.ai/v1`；两个身份不共享凭据或计费账户。也可显式提供 `GROK_ACCESS_TOKEN`，但环境 token 没有 refresh token，不能自动刷新。账户代理地址不能覆盖到其它服务。
 
-采用官方 RFC 8628 设备授权（`https://auth.x.ai/oauth2/device/code` 与 `/oauth2/token`）；只申请推理及刷新所需 scopes，`referrer` 与 User-Agent 标识 xeno。协议所需 `X-XAI-Token-Auth` 与模型路由头遵循官方代理合同。依据：[Grok Build 企业认证](https://docs.x.ai/build/enterprise)、[官方授权源码](https://github.com/xai-org/grok-build/tree/main/crates/codegen/xai-grok-login/src)、[官方代理调用示例](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-shell/README.md)。
+采用官方 RFC 8628 设备授权（`https://auth.x.ai/oauth2/device/code` 与 `/oauth2/token`）；只申请推理及刷新所需 scopes，`referrer` 与 User-Agent 标识 xeno。协议所需 `X-XAI-Token-Auth`、模型路由头与版本闸门头 `x-grok-client-version`（固定为 1.0.46，`x-grok-client-identifier: xeno`）遵循官方代理合同；代理最低版本越过它时返回 426，xeno 会提示更新 xeno 或暂用 `xai` + `XAI_API_KEY`。依据：[Grok Build 企业认证](https://docs.x.ai/build/enterprise)、[官方授权源码](https://github.com/xai-org/grok-build/tree/main/crates/codegen/xai-grok-login/src)、[官方代理调用示例](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-shell/README.md)。
 
 `grok-build` 是官方代理别名，不能把 API 模型的价格、上下文长度或可选 effort 套给它。当前保守暴露文本/工具调用，价格未知、effort 选择关闭；实际账户权限由官方服务决定。设备授权启动已实测返回 200，授权后的推理/刷新有受控 HTTP 验证；没有替用户完成真实账户批准或调用付费模型。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visual-z/xeno",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "license": "UNLICENSED",
   "type": "module",
   "description": "Segmented append-only agent log with pure context and handoff projections",

package/src/apps/provider-connect.ts

@@ -19,7 +19,7 @@ import type { ModelSpec } from "../runtime/model.ts";
 import { discoverModels, discoveryFamily, likelyChatModel, normalizeBaseUrl, type DiscoveredModel } from "../runtime/model-discovery.ts";
 import { SOURCE_PROVIDERS } from "../runtime/model-data.ts";
 import { applyConnect, applyDisconnect, catalogTwin } from "../runtime/provider-connect.ts";
-import { CUSTOM_PRESETS, presetById, suggestProviderId, validProviderId, type ProviderPreset } from "../runtime/provider-presets.ts";
+import { CUSTOM_PRESETS, presetById, slugProviderId, suggestProviderId, validProviderId, type ProviderPreset } from "../runtime/provider-presets.ts";
 import { providerAccess } from "../runtime/provider-access.ts";
 import { writeAuthFile } from "../store/auth-store.ts";
 import { authPath } from "../store/config.ts";
@@ -154,8 +154,8 @@ function beginPreset(host: ConnectHost, preset: ProviderPreset): void {
         title: `${preset.label} · name`,
         label: "Provider ID",
         value: suggested,
-        hint: "shown in /model as <id>/<model>; lowercase letters, digits, - and _",
-        validate: id => !validProviderId(id) ? "Use lowercase letters, digits, - and _ (start with a letter or digit)"
+        hint: "shown in /model as <id>/<model>; lowercase a-z, digits, - and _",
+        validate: id => !validProviderId(id) ? `Use lowercase a-z, digits, - and _ (no spaces, capitals or non-Latin letters); try "${slugProviderId(id) || suggested}"`
           : SOURCE_PROVIDERS[id] !== undefined ? `"${id}" is a built-in provider; pick another id or choose it from the list` : undefined,
         onSubmit: id => {
           draft.id = id;

package/src/apps/session-hub.ts

@@ -15,6 +15,17 @@ export function createAppSessionHub(initial: App): SessionHub {
   // Aliases resolve to one durable log before construction: two cold resumes
   // must never append through independent Session owners (D5/D6).
   const opening = new Map<string, { result: Promise<SessionControl>; configuration: string }>();
+  let lookup: ReturnType<typeof listSessions> | undefined;
+  // Q.26: cold aliases await one scan in ingress order before claiming their
+  // canonical owner. Keep only in-flight I/O; construction and live reloads stay independent.
+  const lookupSessions = (): ReturnType<typeof listSessions> => {
+    if (lookup) return lookup;
+    const current = listSessions(initial.workspace, sessionDirFor(initial.args, initial.workspace));
+    lookup = current;
+    const release = () => { if (lookup === current) lookup = undefined; };
+    void current.then(release, release);
+    return current;
+  };
   return new SessionHub(sessionControl(initial.session), {
     list: async () => ({ ...await listSessions(initial.workspace, sessionDirFor(initial.args, initial.workspace)), live: [...apps.keys()] }),
     open: async (kind, params) => {
@@ -31,7 +42,7 @@ export function createAppSessionHub(initial: App): SessionHub {
           });
           return sessionControl(live.session);
         }
-        const found = (await listSessions(initial.workspace, sessionDirFor(initial.args, initial.workspace))).sessions
+        const found = (await lookupSessions()).sessions
           .find(item => item.ok && (createHash("sha256").update(item.path).digest("hex") === requested || item.path === requested || item.id === requested));
         if (!live && !found) throw Error("session must belong to this app-server workspace");
         source = live?.logDir ?? found!.path;

package/src/apps/shell.ts

@@ -739,7 +739,7 @@ function printUsage(app: App): void {
   } else {
     return assertNever(dollars, "printUsage");
   }
-  app.io.say(`  wall clock        ${(t.ms / 1000).toFixed(1)}s`);
+  app.io.say(`  model time        ${(t.ms / 1000).toFixed(1)}s`);
   app.io.say("");
 }
 

package/src/apps/ui/app.ts

@@ -29,6 +29,7 @@ import { DISPLAY_SETTINGS, settingValue, settingValues } from "../../core/settin
 import { THINKING_LEVELS, asThinkingLevel, supportedThinkingLevels } from "../../core/thinking.ts";
 import { builtinTheme } from "../../core/theme.ts";
 import { projectTranscript, type TranscriptItem } from "../../core/transcript.ts";
+import { DEFAULT_FULLSCREEN_EXIT_OUTPUT, sessionExitStatus } from "../../core/session-exit.ts";
 import { lastAssistantText } from "../../core/export.ts";
 import type { PermissionRequest } from "../../core/permissions.ts";
 import type { ApprovalChoice } from "../../runtime/tools.ts";
@@ -44,7 +45,10 @@ import { isUpgrade } from "../../core/version.ts";
 import type { Effort } from "../../runtime/model.ts";
 import { readNode, readCursor, setSessionLabel } from "../../store/log.ts";
 import { readNodeHistory } from "../../store/restore.ts";
-import { currentBranch } from "../../store/git-branch.ts";
+import { readGitStatus } from "../../store/git-status.ts";
+import type { GitStatus } from "../../core/git-status.ts";
+import { activityStatus } from "../../core/activity-status.ts";
+import { executionOutcome, type ExecutionOutcome } from "../../core/outcome.ts";
 import { projectTrust } from "../../store/trust.ts";
 import { discoverResources, setResourceOverride } from "../../store/resource-index.ts";
 import { nextResourceOverride } from "../../core/resource-selection.ts";
@@ -107,6 +111,11 @@ function samePalette(a: TerminalPalette, b: TerminalPalette | null): boolean {
   return b !== null && a.foreground === b.foreground && a.background === b.background && a.slots.every((slot, i) => slot === b.slots[i]);
 }
 
+/** Only the endpoint host is chrome; credentials, query and path stay out of it. */
+function endpointHost(baseUrl: string | undefined): string | null {
+  try { return baseUrl ? new URL(baseUrl).host : null; } catch { return null; }
+}
+
 export class InteractiveApp implements Ui {
   readonly app: App;
   readonly screen: Screen;
@@ -141,6 +150,11 @@ export class InteractiveApp implements Ui {
   private retryTimer: ReturnType<typeof setInterval> | undefined;
   private bashDecoder = new TextDecoder();
   private branch: string | null;
+  private git: GitStatus | null = null;
+  private gitRun: Promise<void> | undefined;
+  private gitAgain = false;
+  private attention: ControlSnapshot["waiting"] = null;
+  private lastOutcome: ExecutionOutcome | undefined;
   private paintTimer: ReturnType<typeof setTimeout> | undefined;
   /** Handoff-derived status (sidebar / top bar), refreshed single-flight and debounced (DoD 9). */
   private derived: ReturnType<typeof handoffStatus> | undefined;
@@ -211,7 +225,7 @@ export class InteractiveApp implements Ui {
     this.program = program;
     this.stopOsc = program ? renderer.subscribeOsc(sequence => program.receive(sequence)) : undefined;
     this.closed = new Promise(resolve => { this.closedResolve = resolve; });
-    this.branch = currentBranch(app.workspace);
+    this.branch = null;
     this.sessionName = app.args.sessionName || null;
     this.thinkingExpanded = app.ui?.settings.hideThinkingBlock === false;
     this.screen = new Screen(renderer, this.colors(), () => this.keymap().byAction, {
@@ -347,9 +361,19 @@ export class InteractiveApp implements Ui {
   checkForUpdate(): void {
     // The explicit action owns its result even when it joins a startup request.
     this.manualUpdateRequested = true;
-    void this.updateChecks.manual({ offline: this.app.args.offline === true }, text => {
-      if (!this.disposed) this.notice(text);
-    }).catch(() => { if (!this.disposed) this.notice("Could not check for xeno updates. Try /update again.", "error"); });
+    void this.updateChecks.manual({ offline: this.app.args.offline === true }, (text, tone) => {
+      if (!this.disposed) this.notice(text, tone);
+    }, activity => {
+      if (this.disposed) return;
+      this.screen.setTransientActivity(activity.state === "checking" ? {
+        label: `Checking for xeno updates (current ${activity.current})`, timeoutMs: activity.timeoutMs,
+      } : undefined);
+    }).catch(() => {
+      if (!this.disposed) {
+        this.screen.setTransientActivity(undefined);
+        this.notice("Could not check for xeno updates. Try /update again.", "error");
+      }
+    });
   }
 
   private emptySession(): boolean {
@@ -417,7 +441,7 @@ export class InteractiveApp implements Ui {
         // A different session: its notices, queue and draft attachments do not carry over.
         if (this.historyDir) { this.notices = []; this.queue = []; this.imageDraft.reset(); this.screen.dialogs.clear(); }
         this.clearStream();
-        this.branch = currentBranch(this.app.workspace);
+        void this.refreshGit();
         this.sessionName = (await readCursor(dir))?.name ?? this.sessionName;
         this.thinkingExpanded = this.app.ui?.settings.hideThinkingBlock === false;
         void this.refreshFileIndex();
@@ -458,7 +482,8 @@ export class InteractiveApp implements Ui {
     } else {
       this.stopRetry();
       if (progress.kind === "tool") this.live.tools.set(progress.id, { name: progress.name, arguments: progress.arguments });
-      else this.live.output = `${this.live.output}${progress.text}`.slice(-64 * 1024);
+      else if (progress.kind === "output") this.live.output = `${this.live.output}${progress.text}`.slice(-64 * 1024);
+      else this.live.output = progress.active ? `Waiting for process ${progress.session} · Esc to interrupt` : "";
     }
     this.paint();
   }
@@ -542,9 +567,19 @@ export class InteractiveApp implements Ui {
     const t = app.session.totals, cost = reportedCost(t, spec.price);
     const tools = items.filter(item => item.kind === "tool");
     const extension = [this.extensions.status, app.credential.ok ? "" : "no provider · /provider"].filter(Boolean).join(" · ");
+    const pending = tools.find(tool => tool.status === "pending");
+    const phase = this.executionKind === "bash" || pending ? "tool" : this.live.text ? "streaming" : this.live.thinking ? "thinking" : "connecting";
+    const activity = activityStatus({ running: this.inflight, waiting: this.attention ?? (!app.credential.ok ? "auth" : null), queued: this.queue.length, phase,
+      ...(pending ? { tool: pending.name } : this.executionKind === "bash" ? { tool: "bash" } : {}),
+      ...(this.lastOutcome ? { outcome: this.lastOutcome } : this.controlSnapshot?.goal?.state.execution ? { outcome: this.controlSnapshot.goal.state.execution } : {}),
+      ...(this.controlSnapshot?.goal ? { goal: this.controlSnapshot.goal.state.status } : {}),
+      ...(this.live.retryUntil ? { retry: { attempt: this.live.retryAttempt, seconds: (this.live.retryUntil - Date.now()) / 1000 } } : {}) });
     return {
       version: XENO_VERSION, title: this.sessionName ?? this.prompt, workspace: displayPath(app.workspace, homedir()),
       workspaceShort: shortPath(displayPath(app.workspace, homedir())), branch: this.branch,
+      mode: { yolo: app.args.yolo, workflow: app.session.config.tools.workflowMode ?? "build" },
+      provider: { name: spec.provider, api: spec.api, host: endpointHost(spec.baseUrl), role: app.args.role?.profile.name ?? app.args.agent ?? null, ready: app.credential.ok },
+      activity, git: this.git,
       ...(budget ? { context: { used: budget.used, trigger: budget.trigger, estimated: budget.estimated, segment: app.session.state.node, ...(spec.contextWindow ? { window: spec.contextWindow } : {}) } } : {}),
       ...(t.requests ? { usage: { input: t.prompt_tokens, output: t.output_tokens, cacheRate: t.cache_hit_rate,
         // Under half a cent reads as $0.00, which says nothing (OpenCode #15903; Grok's status line hides it the same way).
@@ -568,6 +603,18 @@ export class InteractiveApp implements Ui {
     this.renderer.setTerminalTitle(title);
   }
 
+  private async refreshGit(): Promise<void> {
+    if (this.disposed) return;
+    if (this.gitRun) { this.gitAgain = true; return; }
+    const workspace = this.app.workspace;
+    this.gitRun = (async () => {
+      const status = await readGitStatus(workspace);
+      if (!this.disposed && this.app.workspace === workspace) { this.git = status; this.branch = status?.branch ?? null; this.paint(); }
+    })();
+    try { await this.gitRun; }
+    finally { this.gitRun = undefined; if (this.gitAgain) { this.gitAgain = false; void this.refreshGit(); } }
+  }
+
   private liveStream(): LiveStream | undefined {
     const l = this.live;
     if (!l.thinking && !l.text && !l.tools.size && !l.output && l.bash === null && !l.retryUntil) return undefined;
@@ -793,7 +840,8 @@ export class InteractiveApp implements Ui {
     const shell = command.text.startsWith("!");
     const images = shell ? [] : input.images;
     if (shell) this.imageDraft.insertImages(input.images);
-    if (this.inflight) { this.queue.push({ kind: shell ? "followup" : kind, text: command.text, ...(images.length ? { images } : {}) }); this.paint(); return; }
+    if (this.inflight) { this.queue.push({ kind: shell ? "followup" : kind, text: command.text, ...(images.length ? { images } : {}) });
+      if (!shell && kind === "steering") this.app.session.wakeProcessWaits(); this.paint(); return; }
     this.turn = this.runPromptTurn(command.text, images, command.skill).catch(error => this.notice(describeError(error), "error"));
     this.paint();
   }
@@ -801,6 +849,7 @@ export class InteractiveApp implements Ui {
   private async runPromptTurn(text: string, images: readonly ImageRef[] = [], skill?: import("../../core/skills.ts").Skill): Promise<void> {
     this.abort = new AbortController();
     this.inflight = true;
+    this.lastOutcome = undefined;
     this.programResult = false;
     this.program?.update(programStatus({ running: true }));
     this.executionKind = text.startsWith("!") ? "bash" : "model";
@@ -813,16 +862,18 @@ export class InteractiveApp implements Ui {
       if (sent && !this.abort.signal.aborted) await this.drainFollowUps();
     } catch (error) {
       this.programResult = true;
+      this.lastOutcome = executionOutcome("execution_error");
       this.program?.update({ state: "error", msg: "Turn failed; inspect the session" });
       throw error;
     } finally {
+      if (this.abort?.signal.aborted && !this.lastOutcome) this.lastOutcome = executionOutcome("cancelled");
       if (!this.programResult) this.program?.update(programStatus({ running: false }));
       await this.syncTranscript();
       this.abort = null;
       this.hooks.dropFileIndex(this.app.workspace);
       this.inflight = false;
       this.executionKind = "idle";
-      this.branch = currentBranch(this.app.workspace);
+      void this.refreshGit();
       this.clearStream();
       this.requestDerived();
       this.paint();
@@ -954,7 +1005,7 @@ export class InteractiveApp implements Ui {
     this.runExtensionAction(async () => { try { await action(); } finally { this.sessionTransition = false; } });
   }
   deliverExtension(text: string, kind: QueueKind): void {
-    if (this.inflight) { this.queue.push({ kind, text }); this.paint(); }
+    if (this.inflight) { this.queue.push({ kind, text }); if (kind === "steering") this.app.session.wakeProcessWaits(); this.paint(); }
     else this.turn = this.runPromptTurn(text).catch(error => this.notice(describeError(error), "error"));
   }
 
@@ -993,10 +1044,12 @@ export class InteractiveApp implements Ui {
     const requested = terminal?.imageProtocol ?? "auto";
     const resolution = this.renderer.resolution;
     const effective = resolveImageRenderProtocol(requested, this.renderer.capabilities, resolution !== null);
-    const show = terminal?.showImages !== false && (requested !== "auto" || effective !== "blocks");
+    const show = terminal?.showImages !== false && effective !== "blocks";
+    const reason = terminal?.showImages === false ? "preview off" : requested === "sixel" && resolution === null ? "waiting for terminal resolution" : "terminal graphics unavailable";
     const cell = resolution && this.renderer.terminalWidth > 0 && this.renderer.terminalHeight > 0
       ? { width: resolution.width / this.renderer.terminalWidth, height: resolution.height / this.renderer.terminalHeight } : DEFAULT_CELL;
-    return { mode: show ? "picture" : "chip", protocol: requested, cell, widthCells: terminal?.imageWidthCells ?? 60, load: sha => this.images.load(sha) };
+    return { mode: show ? "picture" : "chip", protocol: effective, cell, widthCells: terminal?.imageWidthCells ?? 60,
+      ...(!show ? { reason } : {}), load: sha => this.images.loadResult(sha) };
   }
   private applyPictures(): void {
     if (this.disposed) return;
@@ -1046,18 +1099,23 @@ export class InteractiveApp implements Ui {
     const control = sessionControl(this.app.session);
     if (this.control === control) return;
     this.stopControl?.(); this.control = control; this.controlSnapshot = undefined;
+    this.attention = null; this.lastOutcome = undefined;
     this.screen.setControlModel(undefined);
     const detachInput = control.attachInput(phase => this.pullQueued(phase));
     const unsubscribe = control.subscribe(notice => {
       if (this.disposed) return;
-      if (notice.method === "turn/started") this.program?.update(programStatus({ running: true }));
+      if (notice.method === "turn/started") { this.lastOutcome = undefined; this.program?.update(programStatus({ running: true })); }
       if (notice.method === "turn/error") {
+        this.lastOutcome = executionOutcome("execution_error");
         this.programResult = true; this.program?.update({ state: "error", msg: "Turn failed; inspect the session" });
         this.track(() => this.syncTranscript());
       }
       if (notice.method === "approval/request") this.program?.update(programStatus({ running: true, waiting: "permission" }));
-      if (notice.method === "thread/statusChanged" && "waiting" in notice.params)
+      if (notice.method === "thread/statusChanged" && "waiting" in notice.params) {
+        this.attention = notice.params["waiting"] as ControlSnapshot["waiting"];
         this.program?.update(programStatus({ running: control.busy, waiting: notice.params["waiting"] as ControlSnapshot["waiting"] }));
+      }
+      if (notice.method === "turn/completed") this.lastOutcome = notice.params["outcome"] as ExecutionOutcome | undefined;
       // A remote client drives the same Session; local turns already have the shell's stream adapter.
       if (!this.abort) {
         if (notice.method === "turn/started") { this.inflight = true; this.executionKind = "model"; }
@@ -1093,6 +1151,7 @@ export class InteractiveApp implements Ui {
   }
 
   observeEvent(event: import("../../runtime/loop.ts").LoopEvent): void {
+    if (event.outcome) this.lastOutcome = event.outcome;
     if (event.kind === "done" || event.kind === "stop_and_ask") this.programResult = true;
     if (event.kind === "done") this.program?.update(programStatus({ running: false,
       ...(event.outcome ? { outcome: event.outcome } : {}), ...(event.request ? { goal: event.request.status } : {}) }));
@@ -1501,20 +1560,23 @@ export async function runInteractive(app: App, hooks: Hooks, releaseEarlyTty?: (
       app.io.say = previousSay;
       process.off("SIGTERM", terminate); process.off("SIGHUP", hangup); process.off("uncaughtException", crash); process.off("unhandledRejection", crash); process.off("exit", lastResort);
     }
-    if (!renderer && fullscreen) printExit(app);
+    if (!renderer && fullscreen) await printExit(app);
   }
 }
 
-/** After leaving the alternate screen: the conversation as plain text, then how to come back. */
-function printExit(app: App): void {
-  const mode = app.ui?.settings.fullscreenExitOutput ?? "transcript";
+/** Restore the shell with a bounded status and resume entry; full replay is explicit. */
+async function printExit(app: App): Promise<void> {
+  const history = await readNodeHistory(app.logDir, app.session.state.node);
+  const events = history.ok ? history.nodes.flatMap(part => part.events) : app.session.state.events;
+  const mode = app.ui?.settings.fullscreenExitOutput ?? DEFAULT_FULLSCREEN_EXIT_OUTPUT;
   if (mode === "transcript") {
-    for (const item of projectTranscript(app.session.state.events)) {
+    for (const item of projectTranscript(events)) {
       if (item.kind === "user") process.stdout.write(`\n❯ ${item.text}\n`);
       else if (item.kind === "assistant") process.stdout.write(`\n${item.text}\n`);
       else if (item.kind === "tool") process.stdout.write(`  ⏺ ${item.name}${item.result ? item.result.ok ? "" : " (failed)" : " (pending)"}\n`);
     }
   }
+  process.stdout.write(`\n  ${history.ok ? sessionExitStatus(events) : "session saved · history unavailable; inspect before continuing"}\n`);
   process.stdout.write(`\n  resume with: xeno --session ${JSON.stringify(app.logDir)}\n`);
 }
 

package/src/apps/ui/image-cache.ts

@@ -8,20 +8,28 @@
  * its pixels, and memory is returned once the last node goes.
  *
  * Bytes come from the blob store, which checks the hash; a missing or
- * corrupt blob, or one that will not decode, resolves to null and the view
- * names the picture instead of drawing it.
+ * corrupt blob, or one that will not decode, has a typed failure so the view
+ * retains the caption and shows the actual preparation error.
  */
-import { NativeImage } from "@opentui/core";
+import { NativeImage, imageInfo } from "@opentui/core";
 import { getBlobBytes } from "../../store/blobs.ts";
+import { modelImageDimensions, MAX_IMAGE_SOURCE_BYTES, MAX_IMAGE_SOURCE_PIXELS } from "../../core/image-limits.ts";
+import type { PictureLoad } from "../../tui/ui/pictures.ts";
 
-/** Decoded RGBA kept for reuse. 64 MiB is in line with Grok's and pi's image budgets; assumed, not measured here. */
+/** Two full previews fit; mounted ImageRenderables retain their own references. */
 export const IMAGE_CACHE_BYTES = 64 * 1024 * 1024;
-
-interface Entry { readonly image: Promise<NativeImage | null>; bytes: number }
+/** Bounds failed entries and queued requests as well as successful pixels. */
+export const IMAGE_CACHE_ENTRIES = 128;
+/** Limit simultaneous native allocations; remaining admitted loads wait in the bounded cache. */
+const IMAGE_DECODE_CONCURRENCY = 2;
+interface Entry { readonly result: Promise<PictureLoad>; bytes: number; settled: boolean }
 
 export class ImageCache {
   private readonly entries = new Map<string, Entry>();
   private used = 0;
+  private active = 0;
+  private closed = false;
+  private readonly waiting: (() => void)[] = [];
   private readonly blobDir: () => string;
   private readonly budget: number;
 
@@ -34,45 +42,80 @@ export class ImageCache {
   get size(): number { return this.used; }
   get count(): number { return this.entries.size; }
 
-  load(sha256: string): Promise<NativeImage | null> {
+  async load(sha256: string): Promise<NativeImage | null> {
+    const result = await this.loadResult(sha256);
+    return result.kind === "ready" ? result.image : null;
+  }
+
+  loadResult(sha256: string): Promise<PictureLoad> {
+    if (this.closed) return Promise.resolve({ kind: "error", reason: "closed" });
     const hit = this.entries.get(sha256);
     if (hit) {
       // Most recently used goes last; eviction starts from the front.
       this.entries.delete(sha256); this.entries.set(sha256, hit);
-      return hit.image;
+      return hit.result;
     }
-    const entry: Entry = { image: this.decode(sha256), bytes: 0 };
+    if (this.entries.size >= IMAGE_CACHE_ENTRIES) {
+      const oldest = [...this.entries].find(([, entry]) => entry.settled);
+      if (oldest) this.drop(oldest[0], oldest[1]);
+      else return Promise.resolve({ kind: "error", reason: "busy" });
+    }
+    // Capture the blob owner before awaiting: session switches cannot redirect an in-flight read.
+    const entry: Entry = { result: this.decode(this.blobDir(), sha256), bytes: 0, settled: false };
     this.entries.set(sha256, entry);
-    void entry.image.then(native => {
-      if (this.entries.get(sha256) !== entry) return;
-      entry.bytes = native ? native.width * native.height * 4 : 0;
+    void entry.result.then(result => {
+      entry.settled = true;
+      if (this.entries.get(sha256) !== entry) { if (result.kind === "ready") result.image.dispose(); return; }
+      entry.bytes = result.kind === "ready" ? result.image.width * result.image.height * 4 : 0;
       this.used += entry.bytes;
-      this.evict(sha256);
+      for (const [sha, old] of this.entries) {
+        if (this.used <= this.budget) break;
+        if (sha !== sha256 && old.settled) this.drop(sha, old);
+      }
     });
-    return entry.image;
+    return entry.result;
   }
 
-  private async decode(sha256: string): Promise<NativeImage | null> {
+  private async decode(dir: string, sha: string): Promise<PictureLoad> {
+    if (this.active >= IMAGE_DECODE_CONCURRENCY) await new Promise<void>(resolve => this.waiting.push(resolve));
+    else this.active++;
+    if (this.closed) return { kind: "error", reason: "closed" };
+    let native: NativeImage | undefined;
     try {
-      const bytes = await getBlobBytes(this.blobDir(), sha256);
-      return bytes ? await NativeImage.load(bytes) : null;
-    } catch { return null; }
+      let bytes: Uint8Array | null;
+      try { bytes = await getBlobBytes(dir, sha, MAX_IMAGE_SOURCE_BYTES); }
+      catch (error) { return { kind: "error", reason: error instanceof RangeError ? "limit" : "corrupt" }; }
+      if (!bytes) return { kind: "error", reason: "missing" };
+      if (bytes.length > MAX_IMAGE_SOURCE_BYTES) return { kind: "error", reason: "limit" };
+      const info = imageInfo(bytes);
+      if (info.width * info.height > MAX_IMAGE_SOURCE_PIXELS) return { kind: "error", reason: "limit" };
+      native = await NativeImage.load(bytes);
+      const target = modelImageDimensions(native);
+      if (target.width !== native.width || target.height !== native.height) {
+        const resized = native.resize(target); native.dispose(); native = resized;
+      }
+      if (this.closed) return { kind: "error", reason: "closed" };
+      if (native.width * native.height * 4 > this.budget) return { kind: "error", reason: "limit" };
+      const image = native; native = undefined;
+      return { kind: "ready", image };
+    } catch { return { kind: "error", reason: "decode" }; }
+    finally {
+      native?.dispose();
+      const next = this.waiting.shift();
+      if (next) next(); else this.active--;
+    }
   }
 
-  /** Drop least recently used entries until the budget holds, never the one just loaded. */
-  private evict(keep: string): void {
-    for (const [sha, entry] of this.entries) {
-      if (this.used <= this.budget) break;
-      if (sha === keep) continue;
-      this.entries.delete(sha);
-      this.used -= entry.bytes;
-      void entry.image.then(native => native?.dispose());
-    }
+  private drop(sha: string, entry: Entry): void {
+    this.entries.delete(sha); this.used -= entry.bytes;
+    void entry.result.then(result => { if (result.kind === "ready") result.image.dispose(); });
   }
 
   dispose(): void {
-    for (const entry of this.entries.values()) void entry.image.then(native => native?.dispose());
+    this.closed = true;
+    for (const entry of this.entries.values()) if (entry.settled) void entry.result.then(result => { if (result.kind === "ready") result.image.dispose(); });
     this.entries.clear();
     this.used = 0;
+    this.waiting.splice(0).forEach(resolve => resolve());
   }
 }

package/src/apps/update-check.ts

@@ -1,7 +1,7 @@
 /** Shared lifecycle for automatic hints and explicit checks; policy remains in core (D16). */
 import { installKind, manualUpdateResult, updateDisabled, updatePlan, type UpdateInput } from "../core/update-check.ts";
 import { packageLocation, readUpdateCache, writeUpdateCache } from "../store/update-cache.ts";
-import { fetchLatestVersion } from "../runtime/update-check.ts";
+import { fetchLatestVersion, UPDATE_TIMEOUT_MS } from "../runtime/update-check.ts";
 import { XENO_VERSION } from "../runtime/oauth.ts";
 
 export interface UpdateOptions {
@@ -9,6 +9,12 @@ export interface UpdateOptions {
   readonly enabled?: boolean | undefined;
 }
 
+export type ManualUpdateActivity =
+  | { readonly state: "checking"; readonly current: string; readonly timeoutMs: number }
+  | { readonly state: "idle" };
+
+type ManualUpdateReporter = (text: string, tone?: "info" | "error") => void;
+
 export class UpdateChecks {
   private readonly controller = new AbortController();
   private pending: Promise<string | null> | undefined;
@@ -36,14 +42,14 @@ export class UpdateChecks {
     return pending;
   }
 
-  manual(options: UpdateOptions, say: (text: string) => void): Promise<number> {
+  manual(options: UpdateOptions, say: ManualUpdateReporter, onActivity?: (activity: ManualUpdateActivity) => void): Promise<number> {
     if (this.manualTask) return this.manualTask;
-    const task = this.runManual(options, say).finally(() => { if (this.manualTask === task) this.manualTask = undefined; });
+    const task = this.runManual(options, say, onActivity).finally(() => { if (this.manualTask === task) this.manualTask = undefined; });
     this.manualTask = task;
     return task;
   }
 
-  private async runManual(options: UpdateOptions, say: (text: string) => void): Promise<number> {
+  private async runManual(options: UpdateOptions, say: ManualUpdateReporter, onActivity?: (activity: ManualUpdateActivity) => void): Promise<number> {
     const { input, plan, disabled } = await this.prepare(options, true);
     if (this.controller.signal.aborted) return 130;
     if (!plan.check) {
@@ -51,12 +57,17 @@ export class UpdateChecks {
         : `Update check skipped: ${disabled ?? "check unavailable"} (xeno ${input.current}).`);
       return input.install === "checkout" ? 0 : 1;
     }
-    say(`Checking for xeno updates (current ${input.current})...`);
-    const latest = await this.refresh(input);
-    if (this.controller.signal.aborted) return 130;
-    const result = manualUpdateResult(latest, input.current, input.install);
-    say(result.text);
-    return result.status === "failed" ? 1 : 0;
+    if (onActivity) onActivity({ state: "checking", current: input.current, timeoutMs: UPDATE_TIMEOUT_MS });
+    else say(`Checking for xeno updates (current ${input.current})...`);
+    try {
+      const latest = await this.refresh(input);
+      if (this.controller.signal.aborted) return 130;
+      const result = manualUpdateResult(latest, input.current, input.install);
+      say(result.text, result.status === "failed" ? "error" : "info");
+      return result.status === "failed" ? 1 : 0;
+    } finally {
+      if (onActivity) onActivity({ state: "idle" });
+    }
   }
 
   cancel(): void { this.controller.abort(); }

package/src/core/activity-status.ts

@@ -0,0 +1,28 @@
+/** A finer view of OSC status, derived from the same runtime facts (D11). */
+import { programStatus, type ProgramStatus } from "./program-status.ts";
+import type { ExecutionOutcome } from "./outcome.ts";
+
+export interface ActivityFacts {
+  readonly running: boolean;
+  readonly waiting?: "permission" | "question" | "auth" | null;
+  readonly outcome?: ExecutionOutcome;
+  readonly goal?: string;
+  readonly phase?: "connecting" | "thinking" | "streaming" | "tool";
+  readonly tool?: string;
+  readonly retry?: { readonly attempt: number; readonly seconds: number };
+  readonly queued: number;
+}
+export interface ActivityStatus { readonly state: ProgramStatus["state"]; readonly label: string; readonly detail: string; readonly queued: number }
+
+export function activityStatus(facts: ActivityFacts): ActivityStatus {
+  const status = programStatus(facts), queued = Math.max(0, Math.floor(facts.queued));
+  const view = (label: string, detail = status.msg ?? ""): ActivityStatus => ({ state: status.state, label, detail, queued });
+  if (status.state === "blocked") return view(status.kind === "auth" ? "Sign in required" : status.kind === "permission" ? "Awaiting approval" : "Awaiting input");
+  if (status.state === "error") return view("Failed");
+  if (!facts.running) return view(status.state === "done" ? "Turn finished" : facts.outcome?.status === "cancelled" ? "Cancelled" : "Ready");
+  if (facts.retry) return view("Retrying", `attempt ${facts.retry.attempt} · ${Math.max(0, Math.ceil(facts.retry.seconds))}s`);
+  if (facts.phase === "tool") return view("Running tool", facts.tool ?? "Tool execution");
+  if (facts.phase === "thinking") return view("Thinking");
+  if (facts.phase === "streaming") return view("Responding");
+  return view("Connecting", "Waiting for the first response");
+}