@visual-z/xeno 0.7.2 → 0.8.1

package/src/apps/shell.ts

@@ -6,10 +6,13 @@
  * by scripts, while the interactive app projects the durable transcript.
  */
 
+import { criterionSummary, draftGoal, pickCriteria, type PendingGoal } from "./goal-flow.ts";
+import { closeAppSession, switchAppSession } from "./session-lifecycle.ts";
 import { basename, dirname, join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { assertNever } from "../core/exhaustive.ts";
+import type { CounterVerdict } from "../core/acceptance.ts";
 import type { LogEvent } from "../core/events.ts";
 import type { Skill } from "../core/skills.ts";
 import { workReadiness } from "../core/work-state.ts";
@@ -29,7 +32,7 @@ import {
   type ContextDecision, type ContextLimits, type ContextPolicy, type GaugeLevel,
 } from "../core/context-policy.ts";
 import { anchoredCount, estimateTokens, type Anchor, type TokenCounter } from "../core/tokens.ts";
-import type { RestorePoint, RewindMode } from "../runtime/loop.ts";
+import type { RestorePoint, RewindMode, RequestOptions } from "../runtime/loop.ts";
 import { createProvider, providerSessionId, findModelByPattern, groupedModels, loadCatalog } from "../runtime/catalog.ts";
 import { outputTokenBudget, type Effort, type ModelSpec } from "../runtime/model.ts";
 import { scopedModels } from "../runtime/model-scope.ts";
@@ -335,10 +338,10 @@ async function fileIndexFor(app: App, refresh = false): Promise<FileIndex> {
 
 export async function runPrompt(app: App, prompt: string): Promise<void> {
   await bindExtensions(app);
-  if (app.shutdownRequested) { await app.session.dispose(); await app.extensions?.dispose(); return; }
+  if (app.shutdownRequested) { await closeAppSession(app); return; }
   let ok: boolean;
   try { ok = await run(app, prompt); }
-  finally { await app.session.dispose(); await app.extensions?.dispose(); }
+  finally { await closeAppSession(app); }
   printUsage(app);
   // One-shot mode is scriptable, so a failed turn has to be a failed exit.
   if (!ok) process.exit(1);
@@ -387,8 +390,7 @@ async function runLines(app: App): Promise<void> {
     if (typeof outcome === "object") awaitingKeyFor = outcome.login;
   }
   await cancelPendingOAuth(app);
-  await app.session.dispose();
-  await app.extensions?.dispose();
+  await closeAppSession(app);
   printUsage(app);
 }
 
@@ -408,7 +410,8 @@ async function runTui(app: App, releaseEarlyTty?: () => void): Promise<void> {
  */
 export const interactiveHooks = {
   handleLine: (app: App, text: string, ui: Ui) => handleLine(app, text, ui),
-  run: (app: App, prompt: string, signal: AbortSignal | undefined, ui: Ui | undefined, images: readonly ImageRef[] = [], skill?: Skill) => run(app, prompt, signal, ui, images, skill),
+  run: (app: App, prompt: string, signal: AbortSignal | undefined, ui: Ui | undefined, images: readonly ImageRef[] = [], skill?: Skill, options?: RequestOptions) =>
+    run(app, prompt, signal, ui, images, skill, options),
   parseLine: (app: App, text: string) => parseLine(app, text),
   bindExtensions: (app: App, ui?: Ui) => bindExtensions(app, ui),
   extensionContext: (app: App, ui?: Ui) => extensionContext(app, ui),
@@ -503,6 +506,9 @@ async function execute(app: App, command: Command, tui: Ui | null): Promise<Outc
       await app.session.acceptCriterion(command.criterion);
       await printAcceptance(app);
       return "continue";
+    case "goal":
+      await goalCommand(app, command, tui ?? undefined);
+      return "continue";
     case "help":
       printHelp(app);
       return "continue";
@@ -693,6 +699,70 @@ async function handleLine(app: App, text: string, tui: Ui): Promise<Outcome> {
   return execute(app, parseLine(app, text), tui);
 }
 
+/**
+ * S.2 / S.5. Line mode keeps a drafted goal until `/goal accept` names the
+ * criteria to keep; the TUI asks with a checklist instead.
+ */
+const pendingGoals = new WeakMap<App, PendingGoal>();
+
+async function goalCommand(app: App, command: Extract<Command, { kind: "goal" }>, tui?: Ui): Promise<void> {
+  const C = app.io.palette;
+  switch (command.action) {
+    case "status": await printGoal(app); return;
+    case "clear": app.io.say(await app.session.clearGoal() ? C.green("  goal cleared") : C.dim("  no active goal")); return;
+    case "set": {
+      if (tui) { tui.startGoal(command.objective); return; }
+      const drafted = await draftGoal(app, command.objective, (prompt, options) => run(app, prompt, undefined, undefined, [], undefined, options));
+      if (!drafted) return;
+      pendingGoals.set(app, drafted);
+      app.io.say(C.bold("\ndrafted criteria") + C.dim("  (accept with /goal accept all, or /goal accept 1,3)"));
+      drafted.criteria.forEach((item, index) => app.io.say(`  ${index + 1}. ${item.id} · ${criterionSummary(item)}`));
+      return;
+    }
+    case "accept": {
+      const drafted = pendingGoals.get(app);
+      if (!drafted) { app.io.say(C.yellow("  no drafted goal; run /goal <objective> first")); return; }
+      const picked = pickCriteria(drafted.criteria, command.pick);
+      if (!picked.ok) { app.io.say(C.yellow(`  ${picked.error}`)); return; }
+      pendingGoals.delete(app);
+      await app.session.setGoal({ ...drafted, accepted: picked.ids });
+      app.io.say(C.green(`  goal set with ${picked.ids.length} accepted criteria`));
+      await run(app, drafted.objective);
+      await printGoal(app);
+      return;
+    }
+    default: return assertNever(command, "goal command");
+  }
+}
+
+async function printGoal(app: App): Promise<void> {
+  const C = app.io.palette, goal = await app.session.goal();
+  if (!goal) { app.io.say(C.dim("  no active goal; /goal <objective> drafts one")); return; }
+  const request = await app.session.requestState();
+  const current = request?.acceptance?.contract_id === goal.contract.id ? request : undefined;
+  app.io.say(C.bold("\ngoal") + `  ${goal.objective}`);
+  for (const item of goal.contract.criteria) {
+    const criterion = current?.criteria.find(entry => entry.id === item.id), status = criterion?.status ?? "not_run";
+    const guard = item.kind === "command" && item.guard === true;
+    app.io.say(`  ${status === "pass" || status === "accepted" ? C.green("✓") : C.yellow("○")} ${item.id}${guard ? " (guard)" : ""} · ${status} · ${item.description}` +
+      (criterion?.counter ? counterSuffix(C, criterion.counter) : ""));
+  }
+  for (const blocker of current?.reported_blockers ?? []) app.io.say(C.yellow(`  reported blocker: ${blocker.reason}`));
+  if (current && current.evidence.independent !== "not_applicable") app.io.say(`  blind checks      ${current.evidence.independent}`);
+}
+
+/** One counter-check verdict after a criterion, in the words of its role (S.7). */
+function counterSuffix(C: App["io"]["palette"], verdict: CounterVerdict): string {
+  switch (verdict) {
+    case "vacuous": return C.yellow(" · also passes without the changes; it does not test them");
+    case "discriminating": return C.green(" · fails without the changes");
+    case "held": return C.green(" · held before the changes too");
+    case "not_held": return C.dim(" · did not hold before the changes; it tests them rather than guarding");
+    case "unavailable": return C.dim(" · counter-check unavailable");
+    default: return assertNever(verdict, "counter verdict");
+  }
+}
+
 function printUsage(app: App): void {
   const C = app.io.palette;
   const t = app.session.totals;
@@ -756,7 +826,10 @@ async function printState(app: App): Promise<void> {
     app.io.say(`  command evidence  ${request.commands.filter(command => command.status === "pass").length} current passes / ${request.commands.length} receipts`);
     app.io.say(`  observations      ${request.progress.observations.length} new; artifact changes ${request.progress.artifact_changes.length}; acceptance advances ${request.progress.acceptance_advances.length}`);
     app.io.say(`  diagnostics       ${request.progress.new_diagnostics.length} new; unchanged retries ${request.progress.unchanged_retries.length}; unknown ${request.progress.unknown_diagnostics.length}`);
-    if (!request.acceptance) app.io.say("  task verification no declared acceptance contract; command success alone does not verify the task");
+    app.io.say(`  evidence          ran ${request.evidence.ran} · discriminating ${request.evidence.discriminating} · independent ${request.evidence.independent} · human ${request.evidence.human}`);
+    for (const gap of request.unmet) app.io.say(`  unmet             ${gap}`);
+    for (const blocker of request.reported_blockers) app.io.say(`  reported blocker  ${blocker.reason}`);
+    if (!request.acceptance) app.io.say("  task verification no declared contract; a fresh check shows only that the changes ran, not that the request was met");
   }
   if (s.handoff) {
     const h = s.handoff;
@@ -805,7 +878,7 @@ async function printAcceptance(app: App): Promise<void> {
     app.io.say(`    build ${target.build_event ?? "none"}; instance ${target.binding ?? "unknown"}; observation ${target.observation ?? "none"}; ${target.reason ?? "start the declared target after its build"}`);
   }
   for (const item of state?.criteria ?? []) {
-    app.io.say(`  ${item.id}: ${item.status} · ${item.description}`);
+    app.io.say(`  ${item.id}${item.kind === "command" && item.guard ? " (guard)" : ""}: ${item.status} · ${item.description}`);
     if (item.kind === "command") app.io.say(`    command: ${item.command}; evidence: ${item.evidence?.event_id ?? "none"}`);
     else if (item.status !== "accepted") app.io.say(`    /accept ${item.id} records your acceptance${item.target ? ` of the observed target ${item.target}` : ""}`);
   }
@@ -841,8 +914,7 @@ async function applySettingsCommand(
   app.io.say(app.io.palette.bold("\nsettings"));
   app.io.say(`  theme             ${s?.theme ?? "dark"}`);
   app.io.say(`  thinking          ${s?.thinking ?? app.providerConfig.effort}`);
-  app.io.say(`  statusBar         ${s?.statusBar === false ? "off" : "on"}`);
-  app.io.say(app.io.palette.dim("  /settings <theme|thinking|statusBar> <value> to change.\n"));
+  app.io.say(app.io.palette.dim("  /settings <theme|thinking> <value> to change; /settings alone opens every option.\n"));
   return "continue";
 }
 
@@ -858,7 +930,7 @@ async function commitSetting(app: App, field: string, value: string, tui: Ui | n
     if (effort) await applyThinking(app, effort, tui);
     return;
   }
-  const parsed = settingPatch(key === "status" ? "statusBar" : field, value);
+  const parsed = settingPatch(field, value);
   if (parsed.diagnostics.length) { app.io.say(C.yellow(parsed.diagnostics.join("\n"))); return; }
   if (key === "theme") {
     const diagnostics: string[] = [];
@@ -1639,25 +1711,7 @@ async function resumeSession(app: App, idOrPath: string, tui?: Ui): Promise<void
 
 async function adoptLogDir(app: App, logDir: string): Promise<boolean> {
   try {
-    app.session.cancel(); await app.session.whenIdle();
-    if (app.extensions && !await app.extensions.releaseIntegrations()) throw Error("An integration still owns unfinished work or unconfirmed cleanup. Wait for it to settle before switching sessions.");
-    const opened = await openSessionFor({ ...app, logDir, fallback: app.providerConfig, interactive: true });
-    await app.session.dispose();
-    await app.extensions?.dispose();
-    app.session = opened.session;
-    app.providerConfig = opened.providerConfig;
-    app.credential = opened.credential;
-    app.logDir = logDir;
-    app.workspace = opened.workspace;
-    app.blobDir = opened.blobDir;
-    app.system = opened.system;
-    app.loadedContext = opened.resources.loadedContext;
-    app.slash = opened.resources.slash;
-    app.ui = opened.resources.ui;
-    app.resources = opened.resources.index;
-    app.projectTrusted = opened.resources.trusted;
-    app.extensions = opened.resources.extensions;
-    app.foundation = opened.resources.foundation;
+    await switchAppSession(app, logDir, (current, target) => openSessionFor({ ...current, logDir: target, fallback: current.providerConfig, interactive: true }));
   } catch (err) {
     app.io.say(app.io.palette.red(`  ${describeError(err)}`));
     return false;
@@ -1793,7 +1847,7 @@ async function nameSession(app: App, name: string, tui?: Ui): Promise<void> {
 }
 
 /** Runs a prompt. Returns false if the turn failed, having already said why. */
-async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Ui, images: readonly ImageRef[] = [], skill?: Skill): Promise<boolean> {
+async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Ui, images: readonly ImageRef[] = [], skill?: Skill, options?: RequestOptions): Promise<boolean> {
   if (app.extensions && !initializedExtensions.has(app.extensions)) await bindExtensions(app, tui);
   for (const result of await app.extensions?.emit("input", { text: prompt, images, source: "interactive" }) ?? []) {
     if (result["action"] === "handled") return true;
@@ -1873,7 +1927,7 @@ async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Ui, ima
     return false;
   }
   try {
-    await runTurn(app, input, signal, tui, skill);
+    await runTurn(app, input, signal, tui, skill, options);
     return true;
   } catch (error) {
     tui?.discardStream();
@@ -1895,6 +1949,7 @@ export async function runTurn(
   signal?: AbortSignal,
   tui?: TurnSurface,
   skill?: Skill,
+  options?: RequestOptions,
 ): Promise<void> {
   // A pipe cannot unwrite bytes. Non-tty / -p therefore does not stream:
   // deltas and discard are ignored, and the final block prints once.
@@ -1914,7 +1969,7 @@ export async function runTurn(
   }
   await registry?.emit("agent_start");
   await registry?.emit("turn_start", { turnIndex: 0 });
-  try { for await (const e of skill ? app.session.sendSkill(skill, prompt, signal) : sessionControl(app.session).send(prompt, signal, pull)) {
+  try { for await (const e of skill ? app.session.sendSkill(skill, prompt, signal) : sessionControl(app.session).send(prompt, signal, pull, options)) {
     // The log retains every response, but a script's final answer must be the
     // accepted last response. A rejected JSON document cannot be unwritten.
     if (e.kind === "turn_start" || e.kind === "discard") finalText = [];
@@ -1943,7 +1998,7 @@ export async function runTurn(
         if (e.kind === "discard") tui.discardStream();
         await tui.syncTranscript();
         if (["assistant_text", "thinking", "tool_call", "tool_result", "done", "cut"].includes(e.kind)) tui.commitStream();
-        if (e.kind === "snapshot_failed" || e.kind === "undeclared_change" || e.kind === "stop_and_ask") {
+        if (e.kind === "stop_and_ask") {
           for (const line of formatEvent(e, app.io.palette, Math.max(20, (process.stdout.columns ?? 80) - 1), {}, app.ui?.style)) app.io.say(line);
         }
       }

package/src/apps/startup.ts

@@ -1,3 +1,6 @@
+import { loadBlindChecks } from "../store/blind-checks.ts";
+import type { BlindChecks } from "../core/blind-checks.ts";
+import { appSessionFields } from "./session-lifecycle.ts";
 import { release } from "node:os";
 import { codingWorkingProtocol } from "../core/continuation.ts";
 import { taskGuidance } from "../core/prompt-policy.ts";
@@ -40,6 +43,7 @@ import { readModelSources, readCatalogCacheText, writeCatalogCache, catalogCache
 import { refreshRemoteCatalog } from "../runtime/models-fetch.ts";
 import { readCursor, writeCursor, type Cursor } from "../store/log.ts";
 import { getBlob } from "../store/blobs.ts";
+import { parseSessionContext } from "../core/session-format.ts";
 import { resolveLogDir, findSessionByPrefix, listSessions, sessionsDir, type ResolveLogOpts } from "../store/sessions.ts";
 import { recoverCut } from "../store/recovery.ts";
 import { planSessionEntry, restoreSessionModel } from "../core/session-entry.ts";
@@ -111,12 +115,12 @@ export function sessionEnvironment(workspace: string): SessionEnvironment {
  * Session policy a CLI coding session differs from a benchmark run in.
  * Benchmarks construct their own SessionConfig and keep the core defaults.
  */
-export function cliSessionConfig(args: Args): { continuationAfter: number; workingSet: true; workingSetVersion: 2; guidanceVersion: 1; strictVerification: true; timeBudgetMs?: number } {
+export function cliSessionConfig(args: Args): { continuationAfter: number; workingSet: true; strictVerification: true; timeBudgetMs?: number } {
   // Never within a request. A real Kimi K3 run with the reminder at reply six
   // spent half its requests on notes after the work was already verified
   // (fix-cli-continuation-noise). The reminder still fires where it earns its
   // place: a resumed handoff that cannot continue, and boundary preparation.
-  return { continuationAfter: Infinity, workingSet: true, workingSetVersion: 2, guidanceVersion: 1, strictVerification: true, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
+  return { continuationAfter: Infinity, workingSet: true, strictVerification: true, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
 }
 
 /**
@@ -190,6 +194,8 @@ export interface Args {
   /** New sessions default to coding; restored context keeps its frozen schemas. */
   toolProfile?: ToolProfile;
   acceptanceFile?: string;
+  /** feat-blind-checks: a directory outside the workspace holding blind.json and its fixtures. */
+  blindChecks?: string;
   excludeTools: string[];
   noTools: boolean;
   /** `--no-builtin-tools`. False when the flag was not passed. */
@@ -288,6 +294,7 @@ const KNOWN_FLAGS: readonly string[] = [
   "--tools", "-t",
   "--tool-profile",
   "--acceptance-file",
+  "--blind-checks",
   "--exclude-tools", "-xt",
   "--no-tools", "-nt",
   "--no-builtin-tools",
@@ -359,7 +366,9 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
   let updateExtensions = false;
   const args: Args = {
     cliFlags: argv.filter(value => value.startsWith("-")),
-    workspace: process.cwd(), logDir: "", maxTurns: 40, prompt: "",
+    // No default request cap (S.6 item 1): the stall watchdog ends a run that
+    // stops producing evidence; --max-turns or an agent budget sets a hard cap.
+    workspace: process.cwd(), logDir: "", maxTurns: Infinity, prompt: "",
     // Overridable so a node boundary can be forced in a short session --
     // otherwise cutting is only reachable after tens of thousands of tokens,
     // which makes the most interesting path the least exercised one.
@@ -443,6 +452,10 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
     else if (a === "--system-prompt") args.systemPrompt = argv[++i] ?? "";
     else if (a === "--append-system-prompt") args.appendSystemPrompt.push(argv[++i] ?? "");
     else if (a === "--tools" || a === "-t") args.tools = parseToolList(argv[++i] ?? "");
+    else if (a === "--blind-checks") {
+      const path = argv[++i]; if (!path || path.startsWith("--")) throw new Error("--blind-checks requires a directory outside the workspace");
+      args.blindChecks = path;
+    }
     else if (a === "--acceptance-file") {
       const path = argv[++i]; if (!path || path.startsWith("--")) throw new Error("--acceptance-file requires a JSON path");
       args.acceptanceFile = path;
@@ -942,6 +955,7 @@ export function createSessionFor(opts: {
   extensions?: ExtensionRegistry;
   foundation?: FoundationRuntime;
   acceptanceContract?: AcceptanceContract;
+  blindChecks?: BlindChecks;
   skills?: readonly Skill[];
 }): Session {
   const { args, workspace, logDir, blobDir, system, providerConfig, credential, io, askSlot } = opts;
@@ -975,6 +989,7 @@ export function createSessionFor(opts: {
       ...cliSessionConfig(args),
       ...(opts.skills ? { skills: opts.skills } : {}),
       ...(opts.acceptanceContract ? { acceptanceContract: opts.acceptanceContract } : {}),
+      ...(opts.blindChecks ? { blindChecks: opts.blindChecks } : {}),
       // Explicit legacy thresholds still select that experiment unless overridden.
       contextPolicy: args.contextPolicy ?? (args.trigger > 0 ? "segmented" : DEFAULT_CONTEXT_POLICY),
       ...(args.trigger > 0
@@ -1115,26 +1130,16 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   if (priorCursor?.context_ref) {
     const savedContext = await getBlob(join(opts.logDir, "artifacts"), priorCursor.context_ref);
     if (!savedContext) throw Error("missing frozen session context");
-    const metadata: unknown = JSON.parse(savedContext);
-    if (metadata && typeof metadata === "object") {
-      if (!("agentProfile" in metadata) && !opts.args.cliFlags?.includes("--workflow") && "workflowMode" in metadata) {
-        if (metadata.workflowMode !== "build" && metadata.workflowMode !== "plan") throw Error("unsupported saved workflow mode");
-        opts.args.workflow = metadata.workflowMode;
-      }
-      if ("workflowToolProfile" in metadata && metadata.workflowToolProfile !== undefined) {
-        if (metadata.workflowToolProfile !== "foundation") throw Error("unsupported saved workflow tool profile");
-        if (!opts.args.cliFlags?.some(flag => ["--tool-profile", "--tools", "-t", "--no-tools", "--no-builtin-tools"].includes(flag))) opts.args.toolProfile = "foundation";
-      }
-    }
-    if (metadata && typeof metadata === "object" && "agentProfile" in metadata && metadata.agentProfile !== undefined) {
-      const role = metadata.agentProfile;
-      if (!role || typeof role !== "object" || !("name" in role) || typeof role.name !== "string" || !/^[a-z][a-z0-9_-]{0,63}$/.test(role.name) || !("workflowExplicit" in role) || typeof role.workflowExplicit !== "boolean") throw Error("unsupported saved agent profile selector");
-      if (!opts.args.cliFlags?.includes("--agent")) opts.args.agent = role.name;
-      if (role.workflowExplicit && !opts.args.cliFlags?.includes("--workflow") && "workflowMode" in metadata) {
-        if (metadata.workflowMode !== "build" && metadata.workflowMode !== "plan") throw Error("unsupported saved workflow mode");
-        opts.args.workflow = metadata.workflowMode; opts.args.cliFlags = [...opts.args.cliFlags ?? [], "--workflow"];
+    // S.3: the same parser Session.start uses; there is one reader of this format.
+    const saved = parseSessionContext(JSON.parse(savedContext));
+    const explicit = (...flags: string[]) => opts.args.cliFlags?.some(flag => flags.includes(flag)) === true;
+    if (saved.agentProfile) {
+      if (!explicit("--agent")) opts.args.agent = saved.agentProfile.name;
+      if (saved.agentProfile.workflowExplicit && saved.workflowMode && !explicit("--workflow")) {
+        opts.args.workflow = saved.workflowMode; opts.args.cliFlags = [...opts.args.cliFlags ?? [], "--workflow"];
       }
-    }
+    } else if (saved.workflowMode && !explicit("--workflow")) opts.args.workflow = saved.workflowMode;
+    if (saved.workflowToolProfile && !explicit("--tool-profile", "--tools", "-t", "--no-tools", "--no-builtin-tools")) opts.args.toolProfile = "foundation";
   }
   const workspace = priorCursor?.workspace ?? opts.workspace;
   if (opts.args.pathRoot) {
@@ -1196,6 +1201,8 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
   const oauth = (model: ModelSpec, got: Resolved) => got.ok && storedIsOAuth(opts.auth, model.provider) && opts.args.apiKey.length === 0;
   const acceptanceContract = priorCursor === null
     ? await loadAcceptanceContract(workspace, resources.trusted, opts.args.acceptanceFile) : undefined;
+  // Frozen at session start like the contract; a resumed session reads its own copy from the saved context.
+  const blindChecks = priorCursor === null && opts.args.blindChecks ? await loadBlindChecks(opts.args.blindChecks, workspace) : undefined;
   const session = createSessionFor({
     ...opts,
     system: resources.system,
@@ -1203,6 +1210,7 @@ export async function openSessionFor(opts: OpenSessionOptions): Promise<{
     foundation: resources.foundation,
     skills: [...resources.slash.skills.values()],
     ...(acceptanceContract ? { acceptanceContract } : {}),
+    ...(blindChecks ? { blindChecks } : {}),
     workspace: priorCursor?.workspace ?? opts.workspace,
     blobDir: priorCursor?.blob_dir ?? (priorCursor?.workspace && priorCursor.workspace !== opts.workspace
       ? statePaths(priorCursor.workspace, opts.args.stateDir).blobs : opts.blobDir),
@@ -1429,7 +1437,6 @@ export async function startup(args: Args, input?: StartupInput): Promise<App> {
       sessionOpts = { explicit: picked };
     }
     const resolved = await resolveLogDir(workspace, sessionOpts);
-    if (resolved.legacyNotice !== null && !args.logDir) io.say(C.yellow(`  ${resolved.legacyNotice}`));
     logDir = resolved.logDir;
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
@@ -1483,13 +1490,7 @@ export async function startup(args: Args, input?: StartupInput): Promise<App> {
     tools: visible.map((t) => t.name),
   });
 
-  return {
-    args, session, workspace: opened.workspace, logDir, blobDir: opened.blobDir, system: opened.system, providerConfig, credential,
-    auth, effects, loadedContext: opened.resources.loadedContext, credentialOf, catalog, io, askSlot,
-    ui: opened.resources.ui, slash: opened.resources.slash, resources: opened.resources.index, projectTrusted: opened.resources.trusted,
-    extensions: opened.resources.extensions,
-    foundation: opened.resources.foundation,
-  };
+  return { args, logDir, auth, effects, credentialOf, catalog, io, askSlot, ...appSessionFields(opened) };
 }
 
 /** The banner's words for the shared limits; the loop acts at exactly these numbers. */
@@ -1596,7 +1597,7 @@ export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
           "            [--tool-profile coding|readonly|research|data|foundation|full]\n" +
           "            [--workflow build|plan] [--agent name]\n" +
           "            [--output-schema schema.json] [--output-last-message file]\n" +
-          "            [--acceptance-file contract.json]\n" +
+          "            [--acceptance-file contract.json] [--blind-checks dir]\n" +
           "            [--control-socket /private/directory/control.sock]\n" +
           "            [--no-builtin-tools]\n" +
           "            [--allow-tools names] [--yolo|-y] [--approve|--no-approve]\n" +

package/src/apps/ui/app.ts

@@ -10,6 +10,10 @@
  * either rebuilt from the log (transcript) or deliberately lost on exit
  * (draft queue that was never sent, scroll position).
  */
+import { ladderView } from "./control-model.ts";
+import { criterionSummary, draftGoal } from "../goal-flow.ts";
+import type { RequestOptions } from "../../runtime/loop.ts";
+import { closeAppSession } from "../session-lifecycle.ts";
 import { homedir } from "node:os";
 import { basename, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -29,7 +33,7 @@ import { DISPLAY_SETTINGS, settingValue, settingValues } from "../../core/settin
 import { THINKING_LEVELS, asThinkingLevel, supportedThinkingLevels } from "../../core/thinking.ts";
 import { builtinTheme } from "../../core/theme.ts";
 import { projectTranscript, type TranscriptItem } from "../../core/transcript.ts";
-import { DEFAULT_FULLSCREEN_EXIT_OUTPUT, sessionExitStatus } from "../../core/session-exit.ts";
+import { DEFAULT_FULLSCREEN_EXIT_OUTPUT, resumeCommand, sessionExitStatus } from "../../core/session-exit.ts";
 import { lastAssistantText } from "../../core/export.ts";
 import type { PermissionRequest } from "../../core/permissions.ts";
 import type { ApprovalChoice } from "../../runtime/tools.ts";
@@ -37,7 +41,8 @@ import { attachImageBytes, attachImageFile } from "../../runtime/images.ts";
 import { readClipboard, writeClipboard, type ClipboardContent } from "../../runtime/clipboard.ts";
 import { highlightCode, transformMermaid, warmSyntaxLanguages } from "../../runtime/rich-text.ts";
 import { SOURCE_PROVIDERS } from "../../runtime/model-data.ts";
-import { SUBSCRIPTION_OPTIONS, subscriptionById, loginGitHubCopilot, startCallbackServer, XENO_VERSION } from "../../runtime/oauth.ts";
+import { SUBSCRIPTION_OPTIONS, subscriptionById, loginGitHubCopilot, startCallbackServer } from "../../runtime/oauth.ts";
+import { XENO_VERSION } from "../../runtime/version.ts";
 import { reportedCost } from "../../runtime/usage.ts";
 import { UpdateChecks } from "../update-check.ts";
 import { updateNotice } from "../../core/update-check.ts";
@@ -46,9 +51,12 @@ import { isUpgrade } from "../../core/version.ts";
 import type { Effort } from "../../runtime/model.ts";
 import { readNode, readCursor, setSessionLabel } from "../../store/log.ts";
 import { readNodeHistory } from "../../store/restore.ts";
+import { sessionsDir } from "../../store/sessions.ts";
 import { readGitStatus } from "../../store/git-status.ts";
 import type { GitStatus } from "../../core/git-status.ts";
 import { activityStatus } from "../../core/activity-status.ts";
+import { goalStatus } from "../../core/goal-view.ts";
+import { generationSpeed } from "../../runtime/usage.ts";
 import { executionOutcome, type ExecutionOutcome } from "../../core/outcome.ts";
 import { projectTrust } from "../../store/trust.ts";
 import { discoverResources, setResourceOverride } from "../../store/resource-index.ts";
@@ -155,6 +163,14 @@ export class InteractiveApp implements Ui {
   private gitRun: Promise<void> | undefined;
   private gitAgain = false;
   private attention: ControlSnapshot["waiting"] = null;
+  /** The objective of a /goal whose criteria are being drafted. */
+  private drafting: string | undefined;
+  /** Index of this turn's first usage sample; generation speed reads from here. */
+  private turnUsageStart = 0;
+  /** Where this process began counting a goal's tokens: usage samples are kept per process, not in the log. */
+  private goalUsage: { goal: string; start: number } | undefined;
+  /** The last goal view and what it was derived from; see goalAndChecks. */
+  private goalCache: { key: string; view: import("../../core/goal-view.ts").GoalStatus | null; goal?: string } | undefined;
   private lastOutcome: ExecutionOutcome | undefined;
   private paintTimer: ReturnType<typeof setTimeout> | undefined;
   /** Handoff-derived status (sidebar / top bar), refreshed single-flight and debounced (DoD 9). */
@@ -588,20 +604,61 @@ export class InteractiveApp implements Ui {
       ...(budget ? { context: { used: budget.used, trigger: budget.trigger, estimated: budget.estimated, segment: app.session.state.node, ...(spec.contextWindow ? { window: spec.contextWindow } : {}) } } : {}),
       ...(t.requests ? { usage: { input: t.prompt_tokens, output: t.output_tokens, cacheRate: t.cache_hit_rate,
         // Under half a cent reads as $0.00, which says nothing (OpenCode #15903; Grok's status line hides it the same way).
-        cost: cost.kind === "usd" && cost.amount >= 0.005 ? `~$${cost.amount.toFixed(2)}` : cost.kind === "partial" && cost.known >= 0.005 ? `≥$${cost.known.toFixed(2)}` : null } } : {}),
+        cost: cost.kind === "usd" && cost.amount >= 0.005 ? `~$${cost.amount.toFixed(2)}` : cost.kind === "partial" && cost.known >= 0.005 ? `≥$${cost.known.toFixed(2)}` : null,
+        ...speedOf(app.session.state.usage.slice(this.turnUsageStart)) } } : {}),
       tools: { running: tools.filter(tool => tool.status === "pending").length, done: tools.filter(tool => tool.status === "ok").length, failed: tools.filter(tool => tool.status === "error").length },
       ...(this.derived ?? {}),
-      ...(this.controlSnapshot?.goal ? { goal: { text: this.controlSnapshot.goal.text,
-        status: this.controlSnapshot.goal.state.status,
-        execution: this.inflight ? "running" : this.controlSnapshot.goal.state.execution?.reason ?? "idle",
-        observations: this.controlSnapshot.goal.state.progress.observations.length,
-        retries: this.controlSnapshot.goal.state.progress.unchanged_retries.length } } : {}),
+      ...this.goalAndChecks(),
       files: this.files,
       resources: { contextFiles: app.loadedContext.agents.map(file => basename(file.path)), skills: app.slash?.skills.size ?? 0, extensions: app.extensions?.loaded.length ?? 0 },
       ...(extension ? { extension } : {}),
     };
   }
 
+  /**
+   * The sidebar's evidence: an explicit goal's block, or -- without one -- a
+   * Checks line for a request that changed files or declared a contract
+   * (feat-sidebar-goal-and-speed). Both read the request ledger the control
+   * snapshot already derived. The goal view is a scan of the whole log, so it
+   * is cached per log length; only its clock is read on every paint.
+   */
+  private goalAndChecks(): Pick<StatusModel, "goal" | "checks"> {
+    const state = this.controlSnapshot?.goal?.state, session = this.app.session;
+    const key = `${this.app.logDir}:${session.state.node}:${this.ancestors.length}:${session.state.events.length}:${this.inflight}:${this.drafting ?? ""}:${state?.request.event ?? ""}:${state?.status ?? ""}`;
+    if (this.goalCache?.key !== key) {
+      const events = [...this.ancestors, ...session.state.events];
+      const set = events.findLast(event => event.t === "goal" && event.action === "set");
+      this.goalCache = { key, view: goalStatus(events, state, { running: this.inflight, ...(this.drafting !== undefined ? { drafting: this.drafting } : {}) }),
+        ...(set ? { goal: set.id } : {}) };
+    }
+    const view = this.goalCache.view;
+    if (view) {
+      // The session's own clock stamps the log, so a running goal's time is read on it too.
+      const now = Date.parse(session.clock.now());
+      const since = this.goalCache.goal ? session.state.usage.slice(this.goalUsageStart(this.goalCache.goal)) : [];
+      const tokens = since.reduce((total, sample) => total + sample.input_tokens + sample.cache_creation_input_tokens + sample.cache_read_input_tokens + sample.output_tokens, 0);
+      return { goal: { phase: view.phase, objective: view.objective, checks: view.checks, requests: view.requests,
+        elapsedMs: view.phase === "drafting" ? 0 : Math.max(0, (view.endedAt ?? now) - view.startedAt),
+        ...(state && view.phase !== "drafting" ? ladderView(state) : {}), ...(tokens ? { tokens } : {}) } };
+    }
+    if (state?.acceptance) {
+      // A declared contract without /goal: how many of its criteria hold; /acceptance lists them.
+      const items = state.acceptance.criteria, passed = items.filter(item => item.status === "pass" || item.status === "accepted").length;
+      return { checks: { status: passed === items.length ? "pass" : "partial", command: `${passed}/${items.length} passed · /acceptance` } };
+    }
+    if (!state?.changed) return {};
+    const fresh = state.criteria.find(item => item.kind === "fresh_check");
+    const run = fresh?.command ? state.commands.findLast(command => command.command === fresh.command) : state.commands.at(-1);
+    if (!fresh || fresh.status === "not_run" || !run) return { checks: { status: "unchecked" } };
+    return { checks: { status: fresh.status === "pass" ? "pass" : fresh.status === "stale" ? "stale" : "fail", command: run.command, exit: run.exit } };
+  }
+
+  /** Usage samples belong to this process; a goal's spend counts those recorded after this process first saw it. */
+  private goalUsageStart(goal: string): number {
+    if (this.goalUsage?.goal !== goal) this.goalUsage = { goal, start: this.app.session.state.usage.length };
+    return this.goalUsage.start;
+  }
+
   private writeTitle(title: string): void {
     if (title === this.writtenTitle || this.disposed) return;
     this.writtenTitle = title;
@@ -851,16 +908,44 @@ export class InteractiveApp implements Ui {
     this.paint();
   }
 
-  private async runPromptTurn(text: string, images: readonly ImageRef[] = [], skill?: import("../../core/skills.ts").Skill): Promise<void> {
+  /**
+   * S.2 / S.5. The draft runs as an ordinary, visible and cancellable turn;
+   * its checklist opens once the reply is in. Only the checked criteria
+   * become the goal, and the goal's own request starts from the objective.
+   */
+  startGoal(objective: string): void {
+    this.track(async () => {
+      // The draft request's own text is an instruction to the model, not the goal; the sidebar shows the objective.
+      this.drafting = objective;
+      const pending = await draftGoal(this.app, objective, async (prompt, options) => {
+        await this.runPromptTurn(prompt, [], undefined, options);
+        // A cancelled draft is not a draft to accept, nor one to send back.
+        return this.lastOutcome?.status !== "cancelled";
+      }).finally(() => { this.drafting = undefined; this.paint(); });
+      if (!pending) return;
+      this.push({ kind: "list", title: `Accept the checks for: ${objective}`, multi: true, checked: pending.criteria.map(item => item.id), search: false,
+        items: pending.criteria.map(item => ({ value: item.id, label: item.id, description: criterionSummary(item) })),
+        onSubmitChecked: async ids => {
+          if (ids.length === 0) { this.notice("No criteria accepted; the goal was not set.", "warning"); return; }
+          await this.app.session.setGoal({ ...pending, accepted: ids });
+          this.notice(`Goal set with ${ids.length} accepted ${ids.length === 1 ? "check" : "checks"}.`, "success");
+          this.turn = this.runPromptTurn(objective).catch(error => this.notice(describeError(error), "error"));
+        } });
+    });
+  }
+
+  private async runPromptTurn(text: string, images: readonly ImageRef[] = [], skill?: import("../../core/skills.ts").Skill, options?: RequestOptions): Promise<void> {
     this.abort = new AbortController();
     this.inflight = true;
     this.lastOutcome = undefined;
+    // Speed is per turn: only this turn's model requests count (feat-sidebar-goal-and-speed).
+    this.turnUsageStart = this.app.session.state.usage.length;
     this.programResult = false;
     this.program?.update(programStatus({ running: true }));
     this.executionKind = text.startsWith("!") ? "bash" : "model";
     this.paint();
     try {
-      const sent = await this.hooks.run(this.app, text, this.abort.signal, this, images, skill);
+      const sent = await this.hooks.run(this.app, text, this.abort.signal, this, images, skill, options);
       if (!sent && !this.app.credential.ok) {
         this.programResult = true; this.program?.update(programStatus({ running: false, waiting: "auth" }));
       }
@@ -1109,7 +1194,7 @@ export class InteractiveApp implements Ui {
     const detachInput = control.attachInput(phase => this.pullQueued(phase));
     const unsubscribe = control.subscribe(notice => {
       if (this.disposed) return;
-      if (notice.method === "turn/started") { this.lastOutcome = undefined; this.program?.update(programStatus({ running: true })); }
+      if (notice.method === "turn/started") { this.lastOutcome = undefined; this.turnUsageStart = this.app.session.state.usage.length; this.program?.update(programStatus({ running: true })); }
       if (notice.method === "turn/error") {
         this.lastOutcome = executionOutcome("execution_error");
         this.programResult = true; this.program?.update({ state: "error", msg: "Turn failed; inspect the session" });
@@ -1558,7 +1643,7 @@ export async function runInteractive(app: App, hooks: Hooks, releaseEarlyTty?: (
     await ui.closed;
     await ui.settle();
   } finally {
-    try { await app.session.dispose(); await app.extensions?.dispose(); await hooks.cancelPendingOAuth(app); }
+    try { await closeAppSession(app); await hooks.cancelPendingOAuth(app); }
     finally {
       ui.dispose();
       if (!renderer) r.destroy();
@@ -1582,7 +1667,8 @@ async function printExit(app: App): Promise<void> {
     }
   }
   process.stdout.write(`\n  ${history.ok ? sessionExitStatus(events) : "session saved · history unavailable; inspect before continuing"}\n`);
-  process.stdout.write(`\n  resume with: xeno --session ${JSON.stringify(app.logDir)}\n`);
+  const path = resolve(app.logDir);
+  process.stdout.write(`\n  resume with: ${resumeCommand({ id: basename(path), directory: dirname(path), path }, resolve(sessionsDir(process.cwd())))}\n`);
 }
 
 /** The session-start rule first, then the projection (refactor-tui-dock-layout DoD 7). */
@@ -1591,6 +1677,12 @@ function projectWithStart(items: ReturnType<typeof projectItems>, clock: string
 }
 
 /** "~/Projects/workspace/xeno-tui" → "~/P/w/xeno-tui": every directory but the last cut to its first letter. */
+/** The turn's speed when one can be measured; nothing otherwise, so the row never shows a made-up figure. */
+function speedOf(samples: readonly import("../../runtime/usage.ts").UsageSample[]): { speed?: number } {
+  const speed = generationSpeed(samples);
+  return speed === undefined ? {} : { speed };
+}
+
 export function shortPath(path: string): string {
   const parts = path.split("/");
   return parts.map((part, i) => i === parts.length - 1 || part === "~" || part === "" ? part : part.startsWith(".") ? part.slice(0, 2) : part.slice(0, 1)).join("/");