@visual-z/xeno 0.6.0 → 0.7.1

package/src/runtime/openai-responses.ts

@@ -24,6 +24,7 @@ import { assertNever } from "../core/exhaustive.ts";
 import type { OnDelta, Provider, ProviderConfig, ToolSchema, Turn } from "./provider.ts";
 import { pushSse, HttpError, StreamError } from "./openai.ts";
 import { withRetry, DEFAULT_RETRY, type RetryPolicy } from "./retry.ts";
+import type { ProviderSendOptions } from "./provider-tool-policy.ts";
 
 /** What this adapter parks in a thinking block's raw: the reasoning item, whole. */
 interface ResponsesRaw { responses_item: Record<string, unknown> }
@@ -266,19 +267,20 @@ export class OpenAIResponsesProvider implements Provider {
     this.onRetry = options.onRetry;
   }
 
-  send(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta): Promise<Turn> {
-    return withRetry(() => this.attempt(frozen, messages, node, signal, onDelta), this.retry, undefined,
+  send(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta, options?: ProviderSendOptions): Promise<Turn> {
+    return withRetry(() => this.attempt(frozen, messages, node, signal, onDelta, options), this.retry, undefined,
       (attempt, delayMs, error) => { onDelta?.({ kind: "discard" }); onDelta?.({ kind: "retry", attempt, delayMs }); this.onRetry?.(attempt, delayMs, error); }, signal);
   }
 
-  private async attempt(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta): Promise<Turn> {
+  private async attempt(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta, options?: ProviderSendOptions): Promise<Turn> {
     const started = Date.now();
     const baseUrl = this.config.spec.baseUrl;
     if (baseUrl === undefined) throw new Error(`model ${this.config.spec.id} has no baseUrl to send to`);
     const init: RequestInit = {
       method: "POST",
       headers: { "content-type": "application/json", authorization: `Bearer ${this.apiKey}` },
-      body: JSON.stringify({ ...buildResponsesRequest(this.config, frozen, messages), stream: true }),
+      body: JSON.stringify({ ...buildResponsesRequest(this.config, frozen, messages), stream: true,
+        ...(options?.toolUse === "disabled" ? { tool_choice: "none" } : {}) }),
     };
     if (signal !== undefined) init.signal = signal;
     const response = await this.fetchImpl(`${baseUrl.replace(/\/$/, "")}/responses`, init);

package/src/runtime/openai.ts

@@ -26,6 +26,7 @@ import { assertNever } from "../core/exhaustive.ts";
 import type { Provider, ProviderConfig, Turn, ToolSchema, OnDelta } from "./provider.ts";
 import { DEFAULT_COMPAT, type Compat, type Effort, type ModelSpec } from "./model.ts";
 import { withRetry, DEFAULT_RETRY, type RetryPolicy } from "./retry.ts";
+import type { ProviderSendOptions } from "./provider-tool-policy.ts";
 
 /** One message as Chat Completions wants it. */
 export interface WireMessage {
@@ -48,6 +49,7 @@ export interface WireRequest {
   max_tokens?: number;
   max_completion_tokens?: number;
   tools?: unknown[];
+  tool_choice?: "none";
   thinking?: { type: "enabled" | "disabled" };
   reasoning_effort?: string;
 }
@@ -434,11 +436,12 @@ export class OpenAICompletionsProvider implements Provider {
     node: number,
     signal?: AbortSignal,
     onDelta?: OnDelta,
+    options?: ProviderSendOptions,
   ): Promise<Turn> {
     // The clock starts inside the retried request, so a reported duration is
     // one attempt rather than the sum of the ones that failed.
     return withRetry(
-      () => this.attempt(frozen, messages, node, signal, onDelta),
+      () => this.attempt(frozen, messages, node, signal, onDelta, options),
       this.retry,
       undefined,
       (attempt, delayMs, error) => {
@@ -456,6 +459,7 @@ export class OpenAICompletionsProvider implements Provider {
     node: number,
     signal?: AbortSignal,
     onDelta?: OnDelta,
+    options?: ProviderSendOptions,
   ): Promise<Turn> {
     const started = Date.now();
     const baseUrl = this.config.spec.baseUrl;
@@ -468,6 +472,7 @@ export class OpenAICompletionsProvider implements Provider {
       stream: true;
       stream_options?: { include_usage: true };
     } = { ...buildRequest(this.config, frozen, messages), stream: true };
+    if (options?.toolUse === "disabled") payload.tool_choice = "none";
     // Without include_usage an OpenAI-dialect stream never reports usage, and
     // the loop would treat the resulting zeros as a real prompt size. Servers
     // that 400 on the field opt out via Compat.supportsUsageInStreaming.

package/src/runtime/pi-provider.ts

@@ -17,12 +17,14 @@ import type { AssistantBlock } from "../core/events.ts";
 import { toolCallIdentityViolations, type FrozenPrefix, type Message } from "../core/project.ts";
 import type { Api, ModelSpec } from "./model.ts";
 import { providerRequest } from "./provider-request.ts";
+import { grokVersionHint } from "./oauth.ts";
 import type { ResolveEffects } from "./auth.ts";
 import { imageData } from "./images.ts";
 import { FailedResponseError, type OnDelta, type Provider, type ProviderConfig, type ToolSchema, type Turn } from "./provider.ts";
 import { DEFAULT_RETRY, withRetry, type RetryPolicy } from "./retry.ts";
 import { HttpError, StreamError } from "./openai.ts";
 import type { UsageSample } from "./usage.ts";
+import { disablePayloadTools, type ProviderSendOptions } from "./provider-tool-policy.ts";
 
 const APIS: Record<Api, ProviderStreams> = {
   "anthropic-messages": anthropicMessagesApi(), "openai-completions": openAICompletionsApi(),
@@ -305,14 +307,14 @@ export class PiProvider implements Provider {
     this.config = config; this.apiKey = apiKey; this.options = options;
   }
 
-  send(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta): Promise<Turn> {
+  send(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta, policy?: ProviderSendOptions): Promise<Turn> {
     // Bedrock's Pi adapter leaves retry ownership with the AWS SDK; never multiply that loop.
     const retry = this.options.retry ?? (this.config.spec.api === "bedrock-converse-stream" ? { ...DEFAULT_RETRY, maxRetries: 0 } : DEFAULT_RETRY);
-    return withRetry(() => this.attempt(frozen, messages, node, signal, onDelta), retry, undefined,
+    return withRetry(() => this.attempt(frozen, messages, node, signal, onDelta, policy), retry, undefined,
       (attempt, delayMs, error) => { onDelta?.({ kind: "discard" }); onDelta?.({ kind: "retry", attempt, delayMs }); this.options.onRetry?.(attempt, delayMs, error); }, signal);
   }
 
-  private async attempt(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta): Promise<Turn> {
+  private async attempt(frozen: FrozenPrefix, messages: readonly Message[], node: number, signal?: AbortSignal, onDelta?: OnDelta, policy?: ProviderSendOptions): Promise<Turn> {
     signal?.throwIfAborted();
     const started = Date.now();
     const request = providerRequest(this.config.spec, this.apiKey, this.options.effects, this.options.fetch, this.options.oauth);
@@ -342,7 +344,7 @@ export class PiProvider implements Provider {
         const next = mergePayload(payload, request.body);
         // Stateless Responses is required by D8: never replace the recomputable projection with server state.
         if (model.api.includes("responses")) { next["store"] = false; delete next["previous_response_id"]; }
-        return next;
+        return policy?.toolUse === "disabled" ? disablePayloadTools(model.api, next) : next;
       } };
     let completed: AssistantMessage | undefined;
     // Pi emits fragments; xeno's progress contract replaces the displayed argument buffer.
@@ -372,7 +374,11 @@ export class PiProvider implements Provider {
         case "error":
           if (event.reason === "aborted" || signal?.aborted) throw new DOMException("Request aborted", "AbortError");
           status ??= nativeStatus(event.error.errorMessage ?? "");
-          if (status && status >= 400) throw new HttpError(status, responseHeaders, event.error.errorMessage ?? "Provider request failed");
+          if (status && status >= 400) {
+            // The proxy's own text says "run `grok update`", which a xeno user cannot act on.
+            const hint = grokVersionHint(status, this.config.spec.provider);
+            throw new HttpError(status, responseHeaders, (event.error.errorMessage ?? "Provider request failed") + (hint ? `\n  ${hint}` : ""));
+          }
           throw new StreamError(event.error.errorMessage ?? "Provider stream failed");
         case "start": case "text_start": case "text_end": case "thinking_start": case "thinking_end": break;
         default: assertNever(event, "pi stream event");

package/src/runtime/provider-presets.ts

@@ -74,6 +74,17 @@ export function validProviderId(id: string): boolean {
   return /^[a-z0-9][a-z0-9_-]{0,63}$/.test(id);
 }
 
+/**
+ * The valid id a rejected one most likely meant ("My Gateway" → "my-gateway"),
+ * or "" when nothing Latin survives ("网关"). Only offered in the error, never
+ * applied silently: the id becomes a config and auth.json key the user will
+ * type in /model, so they should see it before it is saved.
+ */
+export function slugProviderId(raw: string): string {
+  if (validProviderId(raw)) return raw;
+  return raw.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[^a-z0-9]+/, "").slice(0, 64).replace(/-+$/, "");
+}
+
 /** A readable default id from a URL host: api.example.com → example. */
 export function suggestProviderId(baseUrl: string, taken: ReadonlySet<string>): string {
   let host = "custom";

package/src/runtime/provider-request.ts

@@ -1,7 +1,7 @@
 import { providerEnvironment, resolveKeyValue, type ResolveEffects } from "./auth.ts";
 import { providerAccess } from "./provider-access.ts";
 import type { ModelSpec } from "./model.ts";
-import { XENO_VERSION, GROK_PROVIDER, GROK_BASE_URL } from "./oauth.ts";
+import { XENO_VERSION, GROK_PROVIDER, GROK_BASE_URL, GROK_PROTOCOL_VERSION } from "./oauth.ts";
 
 const SDK_IDENTITY_HEADERS = ["x-app", "editor-version", "editor-plugin-version", "copilot-integration-id", "http-referer", "x-title"];
 
@@ -45,6 +45,8 @@ export function providerRequest(spec: ModelSpec, key: string, effects: ResolveEf
     // These select the auth protocol and backend; the User-Agent still identifies xeno (D18).
     headers["X-XAI-Token-Auth"] = "xai-grok-cli";
     headers["x-grok-model-override"] = spec.wireId ?? spec.id;
+    headers["x-grok-client-version"] = GROK_PROTOCOL_VERSION;
+    headers["x-grok-client-identifier"] = "xeno";
   }
   const anthropicOAuth = spec.api === "anthropic-messages" && spec.provider !== "github-copilot" && (oauth || key.includes("sk-ant-oat"));
   const noAutomaticAuth = access.auth === false || access.authHeader === false || typeof access.authHeader === "string" || anthropicOAuth;

package/src/runtime/provider-tool-policy.ts

@@ -0,0 +1,33 @@
+/** D6: native request controls may change; frozen system and tool declarations may not. */
+import { assertNever } from "../core/exhaustive.ts";
+import type { Api } from "./model.ts";
+
+export interface ProviderSendOptions { toolUse: "disabled" }
+
+export function supportsToolDisabling(api: Api): boolean {
+  // Bedrock's SDK implements none by deleting toolConfig. It cannot preserve D6.
+  switch (api) {
+    case "anthropic-messages": case "openai-completions": case "openai-responses": case "azure-openai-responses": case "openai-codex-responses":
+    case "google-generative-ai": case "google-vertex": case "mistral-conversations": case "pi-messages": return true;
+    case "bedrock-converse-stream": return false;
+    default: return assertNever(api, "tool disabling capability");
+  }
+}
+const object = (value: unknown): Record<string, unknown> => value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+
+/** Called after provider body overrides, at the last native payload boundary. */
+export function disablePayloadTools(api: Api, payload: Record<string, unknown>): Record<string, unknown> {
+  switch (api) {
+    case "anthropic-messages": return { ...payload, tool_choice: { type: "none" } };
+    case "openai-completions": case "openai-responses": case "azure-openai-responses": case "openai-codex-responses":
+      return { ...payload, tool_choice: "none" };
+    case "google-generative-ai": case "google-vertex": {
+      const config = object(payload["config"]), toolConfig = object(config["toolConfig"]);
+      return { ...payload, config: { ...config, toolConfig: { ...toolConfig, functionCallingConfig: { mode: "NONE" } } } };
+    }
+    case "mistral-conversations": return { ...payload, toolChoice: "none" };
+    case "pi-messages": return { ...payload, options: { ...object(payload["options"]), toolChoice: "none" } };
+    case "bedrock-converse-stream": throw new Error("Bedrock cannot disable tools while preserving frozen definitions");
+    default: return assertNever(api, "tool disabling protocol");
+  }
+}

package/src/runtime/provider.ts

@@ -39,6 +39,7 @@ import type { UsageSample } from "./usage.ts";
 import { type Effort, type ModelSpec, CLAUDE_OPUS_5 } from "./model.ts";
 import { withRetry, DEFAULT_RETRY, type RetryPolicy } from "./retry.ts";
 import { anthropicOAuthHeaders } from "./oauth.ts";
+import type { ProviderSendOptions } from "./provider-tool-policy.ts";
 
 export interface ToolSchema {
   name: string;
@@ -106,6 +107,7 @@ export interface Provider {
     node: number,
     signal?: AbortSignal,
     onDelta?: OnDelta,
+    options?: ProviderSendOptions,
   ): Promise<Turn>;
 }
 
@@ -235,9 +237,10 @@ export class AnthropicProvider implements Provider {
     node: number,
     signal?: AbortSignal,
     onDelta?: OnDelta,
+    options?: ProviderSendOptions,
   ): Promise<Turn> {
     return withRetry(
-      () => this.attempt(frozen, messages, node, signal, onDelta),
+      () => this.attempt(frozen, messages, node, signal, onDelta, options),
       this.retry,
       undefined,
       (attempt, delayMs, error) => {
@@ -257,6 +260,7 @@ export class AnthropicProvider implements Provider {
     node: number,
     signal?: AbortSignal,
     onDelta?: OnDelta,
+    options?: ProviderSendOptions,
   ): Promise<Turn> {
     const started = Date.now();
 
@@ -277,6 +281,7 @@ export class AnthropicProvider implements Provider {
         // Auto-caching walks the breakpoint forward over the growing tail.
         cache_control: { type: "ephemeral" },
         tools: frozen.tools as Anthropic.Tool[],
+        ...(options?.toolUse === "disabled" ? { tool_choice: { type: "none" as const } } : {}),
         // Only a reasoning model understands these. An older Claude, or an
         // Anthropic-compatible endpoint serving some other model, answers
         // them with a 400 or silently ignores them.

package/src/runtime/session-control.ts

@@ -164,6 +164,7 @@ export class SessionControl {
     // Assumed ingress bound, not an execution policy. Keep a client from queuing unbounded work.
     if (turn.queue.length >= 32) throw Error("steering queue is full");
     turn.queue.push(structuredClone(input));
+    this.session.wakeProcessWaits();
     this.emit("turn/steeringQueued", { count: turn.queue.length });
   }
   interrupt(turnId: string): void {

package/src/runtime/tools.ts

@@ -127,6 +127,9 @@ export interface ToolContext {
   historyCache?: HistoryCache;
   /** O.14: opaque process ownership is supplied by Session, never by model input. */
   execOwner?: string;
+  /** Session-owned empty stdin waits; low-level/native callers retain bounded polling. */
+  processWait?: { wake(): AbortSignal };
+  onProcessWait?: (session: number, active: boolean) => void;
   /** Session-owned registrations never mutate the built-in table (D13). */
   extensions?: ReadonlyMap<string, ToolDefinition>;
   /** R11: current locally selected optional schemas, never restored as authority from historical text. */
@@ -629,7 +632,7 @@ export const TOOL_DEFINITIONS: ToolDefinition[] = [
     access: "shell", execution: "exclusive", branch: "write", run: toolWriteStdin,
     description:
       "Send characters to an owned running process handle and return the output since the last call. " +
-      "Empty chars polls. Include \\n to submit a line; \\u0003 is Ctrl-C, \\u0004 is Ctrl-D (end of input). " +
+      "In an agent session, empty chars waits for new output, exit, hard timeout, cancellation or user steering without periodic model polling. Include \\n to submit a line; \\u0003 is Ctrl-C, \\u0004 is Ctrl-D (end of input). " +
       "After exit, empty chars retrieves the last receipt without rerunning or producing fresh verification. Source and byte cursor are in data; full_output recovers all captured output. " +
       "Lost handles cannot accept input; a last running observation is not an exit. Ctrl-C may interrupt a PTY foreground job while its REPL stays alive.",
     input_schema: {
@@ -637,7 +640,7 @@ export const TOOL_DEFINITIONS: ToolDefinition[] = [
       properties: {
         session_id: { type: "integer", minimum: 1 },
         chars: { type: "string", description: "Characters to write; empty to poll" },
-        yield_time_ms: { type: "integer", minimum: 100, maximum: 30000, description: "Milliseconds to wait for output; default 10000" },
+        yield_time_ms: { type: "integer", minimum: 100, maximum: 30000, description: "Bounded wait when sending input or using low-level polling; agent empty waits are owned until an observation changes" },
       },
       required: ["session_id"],
     },
@@ -1108,7 +1111,8 @@ async function toolWriteStdin(ctx: ToolContext, input: Record<string, unknown>):
       data: { kind: "process", version: 1, session_id: id, state: "unknown", capability: "unknown", source: null, running: null, exit: null, replayed: true } };
   }
   const outputStore = ctx.outputStore ?? join(ctx.root, ".xeno", "observations");
-  return sessionResult(ctx, session.command, session.timeoutMs, await pollSession(session, outputStore, ctx.maxOutputBytes, clampYield(input["yield_time_ms"]), chars, ctx.signal));
+  return sessionResult(ctx, session.command, session.timeoutMs, await pollSession(session, outputStore, ctx.maxOutputBytes, clampYield(input["yield_time_ms"]), chars, ctx.signal,
+    ctx.processWait && chars.length === 0 ? { wake: ctx.processWait.wake(), onWaiting: active => ctx.onProcessWait?.(id, active) } : undefined));
 }
 
 /** A successful historical query proves only that the receipt was found, never a new command exit. */

package/src/store/blobs.ts

@@ -121,8 +121,9 @@ export async function getBlob(dir: string, sha: string): Promise<string | null>
 }
 
 /** Restore uses bytes; decoding binary data is an irreversible transformation. */
-export async function getBlobBytes(dir: string, sha: string): Promise<Uint8Array | null> {
+export async function getBlobBytes(dir: string, sha: string, maxBytes?: number): Promise<Uint8Array | null> {
   try {
+    if (maxBytes !== undefined && (await stat(blobFilePath(dir, sha))).size > maxBytes) throw new RangeError("Blob exceeds byte limit");
     const bytes = await readFile(blobFilePath(dir, sha));
     if (blobAddress(bytes) !== sha) throw new Error(`blob integrity failure: ${sha}`);
     return bytes;

package/src/store/git-status.ts

@@ -0,0 +1,15 @@
+/** Local Git reads are asynchronous and bounded; a paint never launches a process. */
+import { execFile } from "node:child_process";
+import { parseGitStatus, type GitStatus } from "../core/git-status.ts";
+/** Assumed cold-disk allowance; Git failure remains unavailable rather than "clean". */
+const GIT_STATUS_TIMEOUT_MS = 1000;
+/** A busy repository cannot flood memory or the status view with paths. */
+const GIT_STATUS_MAX_BYTES = 1024 * 1024;
+
+export function readGitStatus(cwd: string): Promise<GitStatus | null> {
+  return new Promise(resolve => {
+    execFile("git", ["--no-optional-locks", "status", "--porcelain=v2", "--branch", "-z", "--untracked-files=normal"],
+      { cwd, timeout: GIT_STATUS_TIMEOUT_MS, maxBuffer: GIT_STATUS_MAX_BYTES, encoding: "utf8" },
+      (error, output) => resolve(error ? null : parseGitStatus(output)));
+  });
+}

package/src/tui/ui/dialog.ts

@@ -40,9 +40,20 @@ export type DialogSpec =
   | { kind: "busy"; title: string; message: string; onCancel?(): void }
   | { kind: "lines"; title: string; render(width: number): string[]; handleKey?(key: KeyPress): boolean | Promise<boolean>; hint?: string; onCancel?(): void };
 
+/**
+ * One stacked dialog. `list` and `row` (a plain form's label + Input) are
+ * persistent: built once, they carry typed text and cursor across repaints,
+ * and `show()` only detaches them. Everything else a repaint builds is
+ * ephemeral and destroyed recursively on the next one, so a persistent node
+ * must never sit inside an ephemeral parent -- that destroyed the form's
+ * Input on the first validation error and every later key threw
+ * (docs/tasks/fix-dialog-form-and-grok-version.md).
+ */
 interface Open {
   spec: DialogSpec;
   list?: ListView;
+  row?: BoxRenderable;
+  label?: TextRenderable;
   input?: InputRenderable;
   secret?: string;
   error?: string | undefined;
@@ -112,6 +123,7 @@ export class DialogHost {
     for (const open of this.stack) {
       open.list?.setColors(colors);
       if (open.input) { open.input.textColor = colors.text; open.input.focusedTextColor = colors.text; open.input.placeholderColor = colors.muted; }
+      if (open.label && open.spec.kind === "form") open.label.content = this.formLabel(open.spec.label);
     }
     if (this.open) this.show();
   }
@@ -180,6 +192,10 @@ export class DialogHost {
         focusedTextColor: this.colors.text, backgroundColor: "transparent", focusedBackgroundColor: "transparent", flexGrow: 1 });
       // Prefilled values are edited from their end (a URL gets a path appended).
       open.input.gotoBufferEnd();
+      open.row = new BoxRenderable(this.renderer, { id: `form-row-${serial++}`, flexDirection: "row", height: 1 });
+      open.label = new TextRenderable(this.renderer, { id: `form-label-${serial++}`, content: this.formLabel(spec.label), flexShrink: 0 });
+      open.row.add(open.label);
+      open.row.add(open.input);
     }
     if (spec.kind === "form" && spec.secret) open.secret = "";
     if (spec.kind === "confirm") open.yes = true;
@@ -228,17 +244,18 @@ export class DialogHost {
       }
       case "form": {
         if (spec.intro?.length) this.add(text(ansiText(spec.intro), { marginBottom: 1 }));
-        const row = new BoxRenderable(this.renderer, { id: `form-row-${serial++}`, flexDirection: "row", height: 1 });
-        row.add(new TextRenderable(this.renderer, { id: `form-label-${serial++}`, content: parts({ text: `${spec.label} › `, fg: c.muted }), flexShrink: 0 }));
-        if (top.input) { row.add(top.input); top.input.focus(); }
+        if (top.row) { this.slot.add(top.row); top.input!.focus(); }
         else {
-          // The secret never reaches a renderable: only its length does.
+          // The secret never reaches a renderable: only its length does. The
+          // whole row is rebuilt per repaint, so it holds nothing persistent.
+          const row = new BoxRenderable(this.renderer, { id: `form-row-${serial++}`, flexDirection: "row", height: 1 });
+          row.add(new TextRenderable(this.renderer, { id: `form-label-${serial++}`, content: this.formLabel(spec.label), flexShrink: 0 }));
           const mask = canvas([[{ text: "•".repeat(Math.min(top.secret!.length, 48)), role: "text" }, { text: "▏", role: "accent" }]]);
           mask.flexGrow = 1;
           row.add(mask);
+          this.add(row);
           this.renderer.currentFocusedRenderable?.blur();
         }
-        this.add(row);
         if (top.error) this.add(text(parts({ text: top.error, fg: c.error })));
         break;
       }
@@ -272,6 +289,8 @@ export class DialogHost {
     this.renderer.requestRender();
   }
 
+  private formLabel(label: string): ReturnType<typeof parts> { return parts({ text: `${label} › `, fg: this.colors.muted }); }
+
   private paintChrome(): void {
     const top = this.stack.at(-1);
     const spec = top?.spec;

package/src/tui/ui/layout.ts

@@ -1,7 +1,7 @@
 /**
  * Where status lives at a given terminal size (docs/tasks/refactor-tui-dock-layout.md). Pure.
  *
- *   sidebar  ≥ 110 cols and ≥ 20 rows   right column; the top bar is not shown
+ *   sidebar  ≥ 110 cols and ≥ 20 rows   right column plus compact provider header
  *   topbar   80–109 cols, or a wide but short terminal (≥ 18 rows)   one row on top
  *   bare     everything else            the input box's bottom edge only;
  *                                       session and branch go to the terminal title
@@ -42,16 +42,16 @@ export function screenLayout(cols: number, rows: number, sidebarWanted = true):
   const c = Math.max(0, Math.floor(cols)), r = Math.max(0, Math.floor(rows));
   if (sidebarWanted && c >= SIDEBAR_MIN_COLUMNS && r >= SIDEBAR_MIN_ROWS) {
     const sidebarWidth = sidebarContentWidth(c) + 1;
-    return { tier: "sidebar", sidebarWidth, mainWidth: c - sidebarWidth, topbar: false };
+    return { tier: "sidebar", sidebarWidth, mainWidth: c - sidebarWidth, topbar: true };
   }
   if (c >= TOPBAR_MIN_COLUMNS && r >= TOPBAR_MIN_ROWS) return { tier: "topbar", sidebarWidth: 0, mainWidth: c, topbar: true };
   return { tier: "bare", sidebarWidth: 0, mainWidth: c, topbar: false };
 }
 
-export const STATUS_FIELDS = ["model", "thinking", "context", "title", "workspace", "branch", "usage", "cost", "handoff", "tasks", "files", "background", "resources", "extension"] as const;
+export const STATUS_FIELDS = ["mode", "provider", "activity", "git", "model", "thinking", "context", "title", "workspace", "branch", "usage", "cost", "handoff", "tasks", "files", "background", "resources", "extension"] as const;
 export type StatusField = (typeof STATUS_FIELDS)[number];
 /** Screen surfaces only; the terminal title is outside the frame and listed separately. */
-export type Place = "sidebar" | "topbar" | "bottomEdge" | "hidden";
+export type Place = "sidebar" | "topbar" | "topEdge" | "bottomEdge" | "hidden";
 
 /**
  * The one place each field takes in a tier. Hidden fields stay one command
@@ -61,13 +61,13 @@ export type Place = "sidebar" | "topbar" | "bottomEdge" | "hidden";
 export function placement(tier: Tier): Readonly<Record<StatusField, Place>> {
   switch (tier) {
     case "sidebar":
-      return { model: "bottomEdge", thinking: "bottomEdge", context: "sidebar", title: "sidebar", workspace: "sidebar", branch: "sidebar",
+      return { mode: "bottomEdge", provider: "topbar", activity: "topEdge", git: "sidebar", model: "bottomEdge", thinking: "bottomEdge", context: "sidebar", title: "sidebar", workspace: "sidebar", branch: "sidebar",
         usage: "sidebar", cost: "sidebar", handoff: "sidebar", tasks: "sidebar", files: "sidebar", background: "sidebar", resources: "sidebar", extension: "sidebar" };
     case "topbar":
-      return { model: "bottomEdge", thinking: "bottomEdge", context: "bottomEdge", title: "topbar", workspace: "topbar", branch: "topbar",
+      return { mode: "bottomEdge", provider: "topbar", activity: "topEdge", git: "hidden", model: "bottomEdge", thinking: "bottomEdge", context: "bottomEdge", title: "topbar", workspace: "topbar", branch: "topbar",
         usage: "hidden", cost: "topbar", handoff: "topbar", tasks: "hidden", files: "hidden", background: "topbar", resources: "hidden", extension: "topbar" };
     case "bare":
-      return { model: "bottomEdge", thinking: "bottomEdge", context: "bottomEdge", title: "hidden", workspace: "hidden", branch: "hidden",
+      return { mode: "bottomEdge", provider: "hidden", activity: "topEdge", git: "hidden", model: "bottomEdge", thinking: "bottomEdge", context: "bottomEdge", title: "hidden", workspace: "hidden", branch: "hidden",
         usage: "hidden", cost: "hidden", handoff: "hidden", tasks: "hidden", files: "hidden", background: "hidden", resources: "hidden", extension: "hidden" };
     default: return assertNever(tier, "placement");
   }

package/src/tui/ui/messages.ts

@@ -34,7 +34,7 @@ export interface MessageFeatures {
 }
 
 /** Without a source (tests, print mode) pictures are named, not drawn. */
-const NO_PICTURES: PictureSource = { mode: "chip", protocol: "blocks", cell: DEFAULT_CELL, widthCells: 60, load: async () => null };
+const NO_PICTURES: PictureSource = { mode: "chip", protocol: "blocks", cell: DEFAULT_CELL, widthCells: 60, load: async () => ({ kind: "error", reason: "closed" }) };
 
 interface Entry { rev: string; node: Renderable; item: ViewItem }
 

package/src/tui/ui/pictures.ts

@@ -13,7 +13,7 @@
 import { BoxRenderable, ImageRenderable, type CliRenderer, type ImageRenderProtocol, type NativeImage } from "@opentui/core";
 import { Canvas } from "./canvas.ts";
 import type { UiColors } from "./colors.ts";
-import type { Seg } from "./edge.ts";
+import { splitLine, type Seg } from "./edge.ts";
 import { imageCells, IMAGES_PER_ITEM } from "./image-size.ts";
 import type { ImageView } from "./items.ts";
 
@@ -25,10 +25,14 @@ export interface PictureSource {
   readonly cell: { readonly width: number; readonly height: number };
   /** The widest a picture may be, in cells (`terminal.imageWidthCells`). */
   readonly widthCells: number;
-  /** The decoded picture for a blob, shared by every node that shows it; null when it cannot be shown. */
-  load(sha256: string): Promise<NativeImage | null>;
+  readonly reason?: string;
+  /** The decoded picture for a blob, shared by every node that shows it, or its preparation failure. */
+  load(sha256: string): Promise<PictureLoad>;
 }
 
+export type PictureLoad = { readonly kind: "ready"; readonly image: NativeImage } |
+  { readonly kind: "error"; readonly reason: "missing" | "corrupt" | "decode" | "limit" | "busy" | "closed" };
+
 let serial = 0;
 
 export function chipLine(images: readonly ImageView[], limit: number): Seg[] {
@@ -52,17 +56,31 @@ export class Pictures extends BoxRenderable {
     const limit = options.limit ?? IMAGES_PER_ITEM;
     const shown = images.slice(0, limit);
     const pictures: ImageRenderable[] = [];
+    const states = shown.map(() => source.mode === "picture" ? "preparing" : source.reason ?? "preview unavailable");
+    const caption = new Canvas(ctx, { id: `${id}-caption`, height: Math.max(1, shown.length), flexShrink: 0, colors });
+    // A long filename must not hide the preparation state or the reason a preview failed.
+    const paintCaption = () => caption.setRows(shown.length ? shown.map((image, i) => splitLine(options.maxCols, [
+      { segs: [{ text: "▣ ", role: "muted" }, { text: image.name, role: "text" }], priority: 0, min: 4, shrinkPriority: 5 },
+      { segs: [{ text: `${image.width}×${image.height}`, role: "muted" }], priority: 3 },
+      ...(i === shown.length - 1 && images.length > shown.length ? [{ segs: [{ text: `+${images.length - shown.length} more`, role: "muted" as const }], priority: 4 }] : []),
+    ], [{ segs: [{ text: states[i]!, role: states[i]?.startsWith("preview failed") ? "warning" : "muted" }], priority: 0 }], 1, [{ text: " · ", role: "muted" }])) : [chipLine(images, limit)]);
     if (source.mode === "picture" && shown.length) {
       const row = new BoxRenderable(ctx, { id: `${id}-row`, flexDirection: "row", flexShrink: 0, columnGap: 1 });
       // Pictures share the width; each keeps its own proportions.
       const each = Math.max(1, Math.floor((Math.min(options.maxCols, source.widthCells * shown.length) - (shown.length - 1)) / shown.length));
-      for (const image of shown) {
+      for (const [index, image] of shown.entries()) {
         const size = imageCells(image, Math.min(each, source.widthCells), options.maxRows, source.cell);
         const picture = new ImageRenderable(ctx, { id: `${id}-${image.sha256.slice(0, 8)}-${serial++}`, width: size.cols, height: size.rows,
-          fit: "fit", protocol: source.protocol, flexShrink: 0 });
-        void source.load(image.sha256).then(native => {
+          fit: "fit", protocol: source.protocol, flexShrink: 0,
+          onLoad: () => { states[index] = "decoded"; if (!caption.isDestroyed) paintCaption(); },
+          onError: () => { states[index] = "preview failed: decode"; picture.visible = false; if (!caption.isDestroyed) paintCaption(); } });
+        void source.load(image.sha256).then(result => {
+          if (picture.isDestroyed) return;
+          if (result.kind === "ready") picture.source = result.image;
+          else { picture.visible = false; states[index] = `preview failed: ${result.reason}`; paintCaption(); }
+        }).catch(() => {
           if (picture.isDestroyed) return;
-          if (native) picture.source = native; else picture.visible = false;
+          picture.visible = false; states[index] = "preview failed: decode"; paintCaption();
         });
         pictures.push(picture);
         row.add(picture);
@@ -71,8 +89,7 @@ export class Pictures extends BoxRenderable {
     }
     this.pictures = pictures;
     // The names stay visible beside the pictures (and stand in for them in chip mode).
-    const caption = new Canvas(ctx, { id: `${id}-caption`, height: 1, flexShrink: 0, colors });
-    caption.setRows([chipLine(images, source.mode === "picture" ? shown.length : limit)]);
+    paintCaption();
     this.add(caption);
   }
 }