@visual-z/xeno 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # xeno changelog
 
+## 0.8.2 — 2026-10-11
+
+The stall watchdog no longer stops work that is merely long:
+- A run is treated as stuck only when it repeats the same tool call, or the same cycle of up to five calls, three times without learning anything new. Re-reading files, rerunning a test after an edit, a failing test whose output changes, and waiting on a running process never count.
+- The first time, the model is told to change its method. If the cycle comes back, an interactive session asks you: Continue, Stop, or type instructions for the agent. Without anyone to ask (headless), the request still ends as stalled.
+- The old request-wide allowance of twelve exchanges without new evidence is gone. It stopped a long, finished task right after its final answer.
+
+The input box after a turn:
+- A finished turn reads `✓ Turn finished · 32m 34s` in the success colour, with how long the turn ran. The time stays until the next turn starts.
+- A turn the harness stopped reads `■ Stopped · no progress` (or request limit, context budget, output limit, time limit) in the warning colour, instead of `Awaiting input`. `Awaiting input` now means a question is waiting for you. A failed turn reads `✗ Failed` in the error colour.
+- A stop report names the tools that failed (`Failed tools: exec_command ×2, edit ×1`) instead of listing receipt ids, and says when the model had already given a final reply before the stop.
+
+Tools:
+- Where `rg` is missing, interactive sessions install a pinned ripgrep (14.1.1, checked against its SHA-256) into `~/.xeno/bin` in the background and add it to the end of the command PATH. Nothing is downloaded with `--offline`, in CI or from a source checkout. The environment tells the model whether `rg` is available.
+- A new `worktree` tool lets the model create an isolated Git worktree under `~/.xeno/worktrees`, on a branch `xeno/<name>`, and move the session into it; leaving returns to the main checkout and keeps the worktree and branch. Resumed sessions add the tool after their existing tools.
+- `exec_command` and `write_stdin` accept Codex's `max_output_tokens`. It lowers the inline preview only, and near spellings such as `max_output_chars` are pointed at the right name.
+- `grep`, `rg`, `diff`, `cmp` and `test` exiting 1 as the last command is read as their answer (no match, files differ), not a failure. The receipt keeps the real exit code.
+- A leading `(?i)` in a grep pattern means the same with or without ripgrep.
+
+Fixes:
+- A new segment no longer sends the model to `history` first when every user message is already in its handoff. Before, the first tool call of almost every session was that read.
+- The completion check says that a verification command counts only when run on its own, without redirects, pipes, `$()`, `;` or `&&`. The read it asks for no longer counts toward the stall watchdog.
+- Refusing an edit under `.git` or `.xeno` now says it is a fixed rule, instead of asking for a policy change that no setting can make.
+
+## 0.8.1 — 2026-10-11
+
+The sidebar now follows your goal:
+- The Goal block appears only for `/goal`. It lists every accepted check — ✓ passed, ✗ failed with its exit code, ○ not yet — with `guard` or `/accept <id>` beside it, then the evidence ladder and what the goal has used: requests, and tokens in this run.
+  - The heading reads working, needs you, met or stopped, with how long the goal has been running.
+  - A met goal stays as one line until your next message.
+- A request without a goal shows nothing, or one `Checks` line once it has changed files: not run since the last edit, or the latest check with ✓ or ✗ and its exit code. A declared acceptance contract shows how many of its criteria hold.
+- While a goal's criteria are being drafted the sidebar shows `Goal · drafting` and your objective, not the drafting instructions.
+- Without a sidebar (narrower than 110 columns) the goal sits on the input box's lower edge: `goal 2/3 · needs you · 4m 12s`.
+- Context and Usage fit in five rows instead of up to eight. Both budgets keep their names and shares. The node number, the observation and retry counts, the tool count when nothing failed and the `/control` hint moved out; they remain in `/control` and `/state`.
+- Generation speed: Usage and the input box show tokens per second for the current turn, measured as OpenCode does: output over the time its model requests took. Reasoning that a provider does not stream is never left out of the time, so the figure does not overstate. Requests shorter than 250 ms are not counted.
+- Running time reads `59s`, `1m 05s`, `1h 02m 05s` instead of `3725s`, and so does an update's progress against its limit.
+
+Fixes:
+- A gateway that answers "about to call a tool" with no tool call no longer ends the request silently. The response is retried automatically; once retries run out it is reported as a provider error.
+- The Anthropic SDK path now sends `xeno/<version>` as its User-Agent, as the other paths do, so gateways attribute its traffic to xeno instead of a custom client.
+
 ## 0.8.0 — 2026-10-10
 
 xeno now proves completion with receipts, and proves the receipts test the change. Two changes need attention when upgrading:

package/docs/install.md

@@ -144,6 +144,31 @@ check described above is a separate action):
 - the run is not the interactive app: `-p`, `--mode json`, `--export`, `--list-models`, `models --refresh`, package and `config` commands, `--version`
 - xeno runs from a checkout: its package root is not under `node_modules`, or has a `.git` (`bun src/apps/cli.ts`, `bun run agent`, `bun link`)
 
+## ripgrep
+
+Agents reach for `rg` in shell commands, and xeno's grep tool is faster with
+it. When neither `PATH` nor `~/.xeno/bin` has one, the interactive app
+installs ripgrep 14.1.1 into `~/.xeno/bin/rg` in the background:
+
+- **Only that build.** The archive comes from the ripgrep GitHub release and
+  must match a sha256 pinned in xeno (`src/core/ripgrep-release.ts`).
+  Anything else is discarded before extraction; only the `rg` executable is
+  unpacked.
+- **Yours wins.** `~/.xeno/bin` is appended to the end of the PATH of tool
+  commands, so an `rg` you install yourself is used instead.
+- **What the model is told.** The session's environment section says whether
+  `rg` exists in the shell at session start. A copy that finishes
+  downloading during the first session appears in the next one's line, but
+  shell commands can use it immediately.
+- **When not.** The same conditions as background update checks, except the
+  update settings: `--offline` / `XENO_OFFLINE`, `CI` /
+  `CONTINUOUS_INTEGRATION`, a non-interactive run, or running from a
+  checkout. `XENO_NO_TOOL_INSTALL` turns off only this download. Quitting
+  cancels it.
+
+Platforms: macOS arm64 and x64, Linux x64 (static musl) and arm64 (glibc).
+Elsewhere grep uses its built-in TypeScript search.
+
 ## Credentials
 
 Resolution order, first match wins:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visual-z/xeno",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "license": "UNLICENSED",
   "type": "module",
   "description": "Segmented append-only agent log with pure context and handoff projections",

package/src/apps/cli.ts

@@ -13,7 +13,7 @@
  */
 
 import {
-  parseArgs, startup, readPipedStdin, mergePrintPrompt, isInteractiveSession, printCliHelp,
+  parseArgs, startup, readPipedStdin, mergePrintPrompt, isInteractiveSession, printCliHelp, provisionToolsInBackground,
 } from "./startup.ts";
 import { createStartupInput } from "./startup-input.ts";
 import { runPrompt, runRepl } from "./shell.ts";
@@ -37,6 +37,7 @@ const args = parseArgs(process.argv.slice(serverMode || acpMode || reviewMode ?
 if (serverMode || acpMode) { args.print = true; args.mode = "json"; if (args.prompt) throw Error("protocol servers receive prompts through their client"); }
 if (reviewMode) args.print = true;
 let closeControl: (() => Promise<void>) | undefined;
+let stopToolInstall = (): void => {};
 const input = createStartupInput({ interactive: isInteractiveSession(args) && !args.packageCommand && !args.version && !args.exportFile && !args.listModels && !args.modelsCommand });
 process.once("exit", input.restore);
 try {
@@ -60,6 +61,7 @@ try {
     catch (error) { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = controller.signal.aborted ? 130 : 1; }
     finally { process.off("SIGINT", cancel); process.off("SIGTERM", cancel); }
   } else {
+    stopToolInstall = provisionToolsInBackground(args);
     const app = await startup(args, input);
     if (args.controlSocket) closeControl = await listenControl(args.controlSocket, () => sessionControl(app.session));
     if (serverMode) {
@@ -90,6 +92,7 @@ try {
 } catch (error) {
   console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 1;
 } finally {
+  stopToolInstall();
   await closeControl?.();
   process.off("exit", input.restore);
   input.restore();

package/src/apps/startup.ts

@@ -29,6 +29,10 @@ import {
   resolveCredential, envLabel, storedIsOAuth,
   type AuthFile, type ResolveEffects, type Resolved, describeMissingCredential } from "../runtime/auth.ts";
 import { authPath, configDir, readJsonFile } from "../store/config.ts";
+import { findRipgrep, provisionRipgrep } from "../store/tool-binaries.ts";
+import { packageLocation } from "../store/update-cache.ts";
+import { installKind } from "../core/update-check.ts";
+import { toolInstallAllowed } from "../core/ripgrep-release.ts";
 import { loadUiResources, loadTextResources, type UiResources } from "../store/resources.ts";
 import { discoverResources, type ResourceIndex } from "../store/resource-index.ts";
 import { pickProjectTrust, pickStartupSession, runResourceConfig } from "./ui/standalone.ts";
@@ -108,9 +112,29 @@ export function sessionEnvironment(workspace: string): SessionEnvironment {
     cwd: workspace,
     date: `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`,
     git,
+    ripgrep: findRipgrep(configDir()) !== null,
   };
 }
 
+/**
+ * Fills the rg gap in the background for interactive sessions only: scripts,
+ * protocol servers and test subprocesses must not reach the network on their
+ * own. Failure is silent because grep keeps its TypeScript engine; the next
+ * session's environment line reports what is actually there. The returned
+ * stop aborts the download, so quitting never waits for it.
+ */
+export function provisionToolsInBackground(args: Args): () => void {
+  const location = packageLocation();
+  if (!isInteractiveSession(args) || !toolInstallAllowed({ env: process.env, offline: args.offline === true, install: installKind(location.root, location.git) })) return () => {};
+  const controller = new AbortController();
+  void provisionRipgrep({ configDir: configDir(), signal: controller.signal, fetchBytes: async (url, signal) => {
+    const response = await fetch(url, { ...(signal ? { signal } : {}), redirect: "follow" });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    return new Uint8Array(await response.arrayBuffer());
+  } }).catch(() => { /* grep falls back to its own engine */ });
+  return () => controller.abort();
+}
+
 /**
  * Session policy a CLI coding session differs from a benchmark run in.
  * Benchmarks construct their own SessionConfig and keep the core defaults.
@@ -366,8 +390,9 @@ export function parseArgs(argv: string[], options: { deferExtensions?: boolean;
   let updateExtensions = false;
   const args: Args = {
     cliFlags: argv.filter(value => value.startsWith("-")),
-    // No default request cap (S.6 item 1): the stall watchdog ends a run that
-    // stops producing evidence; --max-turns or an agent budget sets a hard cap.
+    // No default request cap (S.6 item 1): the stall watchdog catches a run
+    // repeating a cycle without evidence, and asks the user when one can answer
+    // (S.8); --max-turns or an agent budget sets a hard cap.
     workspace: process.cwd(), logDir: "", maxTurns: Infinity, prompt: "",
     // Overridable so a node boundary can be forced in a short session --
     // otherwise cutting is only reachable after tens of thousands of tokens,

package/src/apps/ui/app.ts

@@ -55,6 +55,8 @@ import { sessionsDir } from "../../store/sessions.ts";
 import { readGitStatus } from "../../store/git-status.ts";
 import type { GitStatus } from "../../core/git-status.ts";
 import { activityStatus } from "../../core/activity-status.ts";
+import { goalStatus } from "../../core/goal-view.ts";
+import { generationSpeed } from "../../runtime/usage.ts";
 import { executionOutcome, type ExecutionOutcome } from "../../core/outcome.ts";
 import { projectTrust } from "../../store/trust.ts";
 import { discoverResources, setResourceOverride } from "../../store/resource-index.ts";
@@ -161,6 +163,14 @@ export class InteractiveApp implements Ui {
   private gitRun: Promise<void> | undefined;
   private gitAgain = false;
   private attention: ControlSnapshot["waiting"] = null;
+  /** The objective of a /goal whose criteria are being drafted. */
+  private drafting: string | undefined;
+  /** Index of this turn's first usage sample; generation speed reads from here. */
+  private turnUsageStart = 0;
+  /** Where this process began counting a goal's tokens: usage samples are kept per process, not in the log. */
+  private goalUsage: { goal: string; start: number } | undefined;
+  /** The last goal view and what it was derived from; see goalAndChecks. */
+  private goalCache: { key: string; view: import("../../core/goal-view.ts").GoalStatus | null; goal?: string } | undefined;
   private lastOutcome: ExecutionOutcome | undefined;
   private paintTimer: ReturnType<typeof setTimeout> | undefined;
   /** Handoff-derived status (sidebar / top bar), refreshed single-flight and debounced (DoD 9). */
@@ -594,21 +604,61 @@ export class InteractiveApp implements Ui {
       ...(budget ? { context: { used: budget.used, trigger: budget.trigger, estimated: budget.estimated, segment: app.session.state.node, ...(spec.contextWindow ? { window: spec.contextWindow } : {}) } } : {}),
       ...(t.requests ? { usage: { input: t.prompt_tokens, output: t.output_tokens, cacheRate: t.cache_hit_rate,
         // Under half a cent reads as $0.00, which says nothing (OpenCode #15903; Grok's status line hides it the same way).
-        cost: cost.kind === "usd" && cost.amount >= 0.005 ? `~$${cost.amount.toFixed(2)}` : cost.kind === "partial" && cost.known >= 0.005 ? `≥$${cost.known.toFixed(2)}` : null } } : {}),
+        cost: cost.kind === "usd" && cost.amount >= 0.005 ? `~$${cost.amount.toFixed(2)}` : cost.kind === "partial" && cost.known >= 0.005 ? `≥$${cost.known.toFixed(2)}` : null,
+        ...speedOf(app.session.state.usage.slice(this.turnUsageStart)) } } : {}),
       tools: { running: tools.filter(tool => tool.status === "pending").length, done: tools.filter(tool => tool.status === "ok").length, failed: tools.filter(tool => tool.status === "error").length },
       ...(this.derived ?? {}),
-      ...(this.controlSnapshot?.goal ? { goal: { text: this.controlSnapshot.goal.text,
-        status: this.controlSnapshot.goal.state.status,
-        execution: this.inflight ? "running" : this.controlSnapshot.goal.state.execution?.reason ?? "idle",
-        observations: this.controlSnapshot.goal.state.progress.observations.length,
-        ...ladderView(this.controlSnapshot.goal.state),
-        retries: this.controlSnapshot.goal.state.progress.unchanged_retries.length } } : {}),
+      ...this.goalAndChecks(),
       files: this.files,
       resources: { contextFiles: app.loadedContext.agents.map(file => basename(file.path)), skills: app.slash?.skills.size ?? 0, extensions: app.extensions?.loaded.length ?? 0 },
       ...(extension ? { extension } : {}),
     };
   }
 
+  /**
+   * The sidebar's evidence: an explicit goal's block, or -- without one -- a
+   * Checks line for a request that changed files or declared a contract
+   * (feat-sidebar-goal-and-speed). Both read the request ledger the control
+   * snapshot already derived. The goal view is a scan of the whole log, so it
+   * is cached per log length; only its clock is read on every paint.
+   */
+  private goalAndChecks(): Pick<StatusModel, "goal" | "checks"> {
+    const state = this.controlSnapshot?.goal?.state, session = this.app.session;
+    const key = `${this.app.logDir}:${session.state.node}:${this.ancestors.length}:${session.state.events.length}:${this.inflight}:${this.drafting ?? ""}:${state?.request.event ?? ""}:${state?.status ?? ""}`;
+    if (this.goalCache?.key !== key) {
+      const events = [...this.ancestors, ...session.state.events];
+      const set = events.findLast(event => event.t === "goal" && event.action === "set");
+      this.goalCache = { key, view: goalStatus(events, state, { running: this.inflight, ...(this.drafting !== undefined ? { drafting: this.drafting } : {}) }),
+        ...(set ? { goal: set.id } : {}) };
+    }
+    const view = this.goalCache.view;
+    if (view) {
+      // The session's own clock stamps the log, so a running goal's time is read on it too.
+      const now = Date.parse(session.clock.now());
+      const since = this.goalCache.goal ? session.state.usage.slice(this.goalUsageStart(this.goalCache.goal)) : [];
+      const tokens = since.reduce((total, sample) => total + sample.input_tokens + sample.cache_creation_input_tokens + sample.cache_read_input_tokens + sample.output_tokens, 0);
+      return { goal: { phase: view.phase, objective: view.objective, checks: view.checks, requests: view.requests,
+        elapsedMs: view.phase === "drafting" ? 0 : Math.max(0, (view.endedAt ?? now) - view.startedAt),
+        ...(state && view.phase !== "drafting" ? ladderView(state) : {}), ...(tokens ? { tokens } : {}) } };
+    }
+    if (state?.acceptance) {
+      // A declared contract without /goal: how many of its criteria hold; /acceptance lists them.
+      const items = state.acceptance.criteria, passed = items.filter(item => item.status === "pass" || item.status === "accepted").length;
+      return { checks: { status: passed === items.length ? "pass" : "partial", command: `${passed}/${items.length} passed · /acceptance` } };
+    }
+    if (!state?.changed) return {};
+    const fresh = state.criteria.find(item => item.kind === "fresh_check");
+    const run = fresh?.command ? state.commands.findLast(command => command.command === fresh.command) : state.commands.at(-1);
+    if (!fresh || fresh.status === "not_run" || !run) return { checks: { status: "unchecked" } };
+    return { checks: { status: fresh.status === "pass" ? "pass" : fresh.status === "stale" ? "stale" : "fail", command: run.command, exit: run.exit } };
+  }
+
+  /** Usage samples belong to this process; a goal's spend counts those recorded after this process first saw it. */
+  private goalUsageStart(goal: string): number {
+    if (this.goalUsage?.goal !== goal) this.goalUsage = { goal, start: this.app.session.state.usage.length };
+    return this.goalUsage.start;
+  }
+
   private writeTitle(title: string): void {
     if (title === this.writtenTitle || this.disposed) return;
     this.writtenTitle = title;
@@ -865,11 +915,13 @@ export class InteractiveApp implements Ui {
    */
   startGoal(objective: string): void {
     this.track(async () => {
+      // The draft request's own text is an instruction to the model, not the goal; the sidebar shows the objective.
+      this.drafting = objective;
       const pending = await draftGoal(this.app, objective, async (prompt, options) => {
         await this.runPromptTurn(prompt, [], undefined, options);
         // A cancelled draft is not a draft to accept, nor one to send back.
         return this.lastOutcome?.status !== "cancelled";
-      });
+      }).finally(() => { this.drafting = undefined; this.paint(); });
       if (!pending) return;
       this.push({ kind: "list", title: `Accept the checks for: ${objective}`, multi: true, checked: pending.criteria.map(item => item.id), search: false,
         items: pending.criteria.map(item => ({ value: item.id, label: item.id, description: criterionSummary(item) })),
@@ -886,6 +938,8 @@ export class InteractiveApp implements Ui {
     this.abort = new AbortController();
     this.inflight = true;
     this.lastOutcome = undefined;
+    // Speed is per turn: only this turn's model requests count (feat-sidebar-goal-and-speed).
+    this.turnUsageStart = this.app.session.state.usage.length;
     this.programResult = false;
     this.program?.update(programStatus({ running: true }));
     this.executionKind = text.startsWith("!") ? "bash" : "model";
@@ -1140,7 +1194,7 @@ export class InteractiveApp implements Ui {
     const detachInput = control.attachInput(phase => this.pullQueued(phase));
     const unsubscribe = control.subscribe(notice => {
       if (this.disposed) return;
-      if (notice.method === "turn/started") { this.lastOutcome = undefined; this.program?.update(programStatus({ running: true })); }
+      if (notice.method === "turn/started") { this.lastOutcome = undefined; this.turnUsageStart = this.app.session.state.usage.length; this.program?.update(programStatus({ running: true })); }
       if (notice.method === "turn/error") {
         this.lastOutcome = executionOutcome("execution_error");
         this.programResult = true; this.program?.update({ state: "error", msg: "Turn failed; inspect the session" });
@@ -1623,6 +1677,12 @@ function projectWithStart(items: ReturnType<typeof projectItems>, clock: string
 }
 
 /** "~/Projects/workspace/xeno-tui" → "~/P/w/xeno-tui": every directory but the last cut to its first letter. */
+/** The turn's speed when one can be measured; nothing otherwise, so the row never shows a made-up figure. */
+function speedOf(samples: readonly import("../../runtime/usage.ts").UsageSample[]): { speed?: number } {
+  const speed = generationSpeed(samples);
+  return speed === undefined ? {} : { speed };
+}
+
 export function shortPath(path: string): string {
   const parts = path.split("/");
   return parts.map((part, i) => i === parts.length - 1 || part === "~" || part === "" ? part : part.startsWith(".") ? part.slice(0, 2) : part.slice(0, 1)).join("/");

package/src/core/activity-status.ts

@@ -14,10 +14,19 @@ export interface ActivityFacts {
 }
 export interface ActivityStatus { readonly state: ProgramStatus["state"]; readonly label: string; readonly detail: string; readonly queued: number }
 
+const STOP_CAUSE: Partial<Record<ExecutionOutcome["reason"], string>> = {
+  stalled: "no progress", no_progress: "no progress", max_turns: "request limit", context_budget: "context budget",
+  output_limit: "output limit", timeout: "time limit",
+};
+
 export function activityStatus(facts: ActivityFacts): ActivityStatus {
   const status = programStatus(facts), queued = Math.max(0, Math.floor(facts.queued));
   const view = (label: string, detail = status.msg ?? ""): ActivityStatus => ({ state: status.state, label, detail, queued });
-  if (status.state === "blocked") return view(status.kind === "auth" ? "Sign in required" : status.kind === "permission" ? "Awaiting approval" : "Awaiting input");
+  // A harness stop is not a question: saying "Awaiting input" left the user
+  // guessing what to answer (fix-finished-turn-status). The OSC state stays blocked.
+  if (!facts.running && !facts.waiting && facts.outcome?.status === "stopped") return view("Stopped", STOP_CAUSE[facts.outcome.reason] ?? facts.outcome.reason.replaceAll("_", " "));
+  if (status.state === "blocked") return view(status.kind === "auth" ? "Sign in required" : status.kind === "permission" ? "Awaiting approval"
+    : !facts.waiting && facts.goal === "awaiting_human" ? "Awaiting review" : "Awaiting input");
   if (status.state === "error") return view("Failed");
   if (!facts.running) return view(status.state === "done" ? "Turn finished" : facts.outcome?.status === "cancelled" ? "Cancelled" : "Ready");
   if (facts.retry) return view("Retrying", `attempt ${facts.retry.attempt} · ${Math.max(0, Math.ceil(facts.retry.seconds))}s`);

package/src/core/command-contract.ts

@@ -10,10 +10,18 @@ export function commandArgv(command: string): string[] {
   return ["bash", "-o", "pipefail", "-lc", command];
 }
 
-/** Preserve inherited values except documented noninteractive defaults; never mutate the host. */
-export function commandEnvironment(base: Readonly<Record<string, string | undefined>>): Record<string, string> {
+/**
+ * Preserve inherited values except documented noninteractive defaults; never mutate the host.
+ *
+ * `appendPath` is xeno's own tool directory (store/tool-binaries.ts). It goes
+ * last, so anything the user installed wins and xeno only fills a gap.
+ */
+export function commandEnvironment(base: Readonly<Record<string, string | undefined>>, appendPath?: string): Record<string, string> {
   const env: Record<string, string> = {};
   for (const [key, value] of Object.entries(base)) if (value !== undefined) env[key] = value;
+  if (appendPath !== undefined && appendPath.length > 0 && !(env["PATH"] ?? "").split(":").includes(appendPath)) {
+    env["PATH"] = env["PATH"] ? `${env["PATH"]}:${appendPath}` : appendPath;
+  }
   Object.assign(env, {
     TERM: "dumb", PAGER: "cat", GIT_PAGER: "cat", NO_COLOR: "1",
     GIT_TERMINAL_PROMPT: "0", DEBIAN_FRONTEND: "noninteractive",
@@ -22,14 +30,80 @@ export function commandEnvironment(base: Readonly<Record<string, string | undefi
   return env;
 }
 
+/**
+ * Codex's `max_output_tokens` as an inline byte budget for one call. It can
+ * only lower the session ceiling: full output is still captured and
+ * recoverable, so this shapes the preview, never the receipt.
+ *
+ * Assumed, not measured: 4 bytes per token rounds the ASCII estimate in
+ * tokens.ts (about 3.6) up, so the model never gets less than it asked for.
+ * The 1 KiB floor keeps room for the header and recovery hint (about 300
+ * bytes); below it a preview shows almost no output and forces a re-read.
+ */
+export const OUTPUT_BYTES_PER_TOKEN = 4;
+export const MIN_OUTPUT_BYTES = 1_024;
+export function outputBytesForTokens(tokens: unknown, ceiling: number): number {
+  if (typeof tokens !== "number" || !Number.isFinite(tokens) || tokens <= 0) return ceiling;
+  return Math.min(ceiling, Math.max(MIN_OUTPUT_BYTES, Math.floor(tokens) * OUTPUT_BYTES_PER_TOKEN));
+}
+
 /** Model seconds and host milliseconds meet once; a yield is never a command deadline. */
 export function commandTimeout(requestedSeconds: number | undefined, defaultMs: number, maximumMs = defaultMs): number {
   return Math.min(requestedSeconds === undefined ? defaultMs : requestedSeconds * 1000, maximumMs);
 }
 
+/**
+ * Programs whose exit 1 is an answer rather than a fault (POSIX: grep's 1 is
+ * "no match" and >1 an error; diff and cmp use 1 for "differ"; test for
+ * false). Reporting them as failures tells the model to inspect and retry an
+ * answer it already holds -- the same reading Claude Code's command semantics
+ * give these programs.
+ */
+const NEGATIVE_ANSWERS: Readonly<Record<string, string>> = {
+  grep: "no match", egrep: "no match", fgrep: "no match", rg: "no match",
+  diff: "files differ", cmp: "files differ", test: "condition false", "[": "condition false",
+};
+
+/**
+ * What exit 1 of the command's final simple command means, or null.
+ *
+ * Only the last segment after a top-level `;`, newline, `||` or `|` is read.
+ * After `&&` the 1 may come from the command that short-circuited, so it is
+ * not classified. Under pipefail an earlier pipeline stage can also set the
+ * status; the exit is kept in the receipt either way, and the label states
+ * the program's meaning rather than claiming success. Anything this scanner
+ * cannot read with certainty -- unbalanced quotes, subshells, compound
+ * statements, substitutions -- yields null.
+ */
+export function negativeAnswer(command: string, exit: number): string | null {
+  if (exit !== 1) return null;
+  let quote: "'" | "\"" | null = null, start = 0, separator = "";
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i]!;
+    if (quote !== null) {
+      if (c === "\\" && quote === "\"") i++;
+      else if (c === quote) quote = null;
+      continue;
+    }
+    if (c === "\\") { i++; continue; }
+    if (c === "'" || c === "\"") { quote = c; continue; }
+    if (c === "`" || c === "(" || c === ")" || c === "{" || c === "}" || (c === "$" && command[i + 1] === "(")) return null;
+    const two = command.slice(i, i + 2);
+    if (two === "&&" || two === "||") { separator = two; start = i + 2; i++; continue; }
+    if (c === ";" || c === "\n" || c === "|") { separator = c; start = i + 1; continue; }
+    if (c === "&" && command[i + 1] !== ">" && command[i - 1] !== ">") return null;
+  }
+  if (quote !== null || separator === "&&") return null;
+  const words = command.slice(start).trim().split(/\s+/).filter(word => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(word));
+  const program = (words[0] ?? "").replace(/^.*\//, "");
+  if (program === "git") return words[1] === "grep" ? "no match" : null;
+  return Object.hasOwn(NEGATIVE_ANSWERS, program) ? NEGATIVE_ANSWERS[program]! : null;
+}
+
 /** A trap can exit zero after cancellation: successful exit alone does not erase the stop. */
-export function commandCompletion(exit: number, stopped?: "cancelled" | "timeout", cleanup?: ToolDiagnostic) {
-  return { ok: stopped === undefined && exit === 0 && cleanup === undefined,
-    outcome: executionOutcome(stopped ?? (exit === 0 && cleanup === undefined ? "tool_completed" : "tool_failed")),
+export function commandCompletion(exit: number, stopped?: "cancelled" | "timeout", cleanup?: ToolDiagnostic, command?: string) {
+  const answered = exit === 0 || command !== undefined && negativeAnswer(command, exit) !== null;
+  return { ok: stopped === undefined && answered && cleanup === undefined,
+    outcome: executionOutcome(stopped ?? (answered && cleanup === undefined ? "tool_completed" : "tool_failed")),
     ...(cleanup ? { warnings: [cleanup] } : {}) };
 }

package/src/core/completion-review.ts

@@ -69,7 +69,7 @@ export function requestCompletion(state: RequestState, remainingRequests: number
   if (state.used_tools && text.length === 0) gaps.push("the final reply is empty");
   // Strict verification counts only configured gates (O.11); say so, since a successful `cat` would otherwise look like a check.
   if (freshCheck && freshCheck.status !== "pass") gaps.push(freshCheck.gate_only
-    ? "files were changed but no configured verification gate (a test, typecheck, lint, build or check command) has passed since the last edit; reading or printing files does not count"
+    ? "files were changed but no configured verification gate (a test, typecheck, lint, build or check command) has passed since the last edit; reading or printing files does not count, and a gate counts only when run as its own plain command, without redirects, pipes, $(), ; or &&"
     : "files were changed but no command has succeeded since the last edit");
   if (acceptance?.status === "needs_work") gaps.push(`declared acceptance criteria need evidence: ${[
     ...missingCommands.map(item => `${item.id}=${item.status}`),

package/src/core/environment.ts

@@ -19,6 +19,12 @@ export interface SessionEnvironment {
   /** Local calendar date, YYYY-MM-DD. */
   date: string;
   git: boolean;
+  /**
+   * Whether `rg` resolves in tool shells at session start. Models reach for
+   * it by habit; without this line a missing one costs an exit-127 request.
+   * Optional so environments recorded before it existed still render.
+   */
+  ripgrep?: boolean;
 }
 
 export function environmentSection(env: SessionEnvironment): string {
@@ -29,6 +35,7 @@ export function environmentSection(env: SessionEnvironment): string {
     `- Working directory: ${env.cwd}`,
     `- Date: ${env.date}`,
     `- Git repository: ${env.git ? "yes" : "no"}`,
+    ...(env.ripgrep === undefined ? [] : [`- ripgrep (rg) in the shell: ${env.ripgrep ? "yes" : "no — use the grep and find tools"}`]),
   ].join("\n");
 }
 

package/src/core/goal-view.ts

@@ -0,0 +1,64 @@
+/**
+ * What the sidebar shows about an explicit goal (feat-sidebar-goal-and-speed),
+ * derived from the log alone so it reads the same after a restart.
+ *
+ * The block exists only while a /goal is set, and for one message after it is
+ * met. Its verdicts are the request ledger's (D11); this only chooses words:
+ * the phase answers "do I need to act, and is it still running", and each
+ * accepted check says what it needs from the user.
+ */
+import type { LogEvent } from "./events.ts";
+import type { RequestCriterion, RequestState } from "./request-state.ts";
+
+export type GoalPhase = "drafting" | "working" | "needs_you" | "met" | "stopped";
+export type GoalCheck = { id: string; kind: RequestCriterion["kind"]; status: RequestCriterion["status"]; guard?: true; exit?: number };
+/**
+ * `startedAt` is when the goal was set; `endedAt` when it was met, absent while
+ * it runs. Times, not a duration, so a caller can cache this per log length and
+ * read the clock only when it paints.
+ */
+export type GoalStatus = { phase: GoalPhase; objective: string; checks: GoalCheck[]; startedAt: number; endedAt?: number; requests: number };
+
+/**
+ * The goal block for the end of an ancestry, or null when no goal applies.
+ * `running` is whether a request is in flight now; `drafting` is the objective
+ * of a /goal whose criteria are still being drafted.
+ */
+export function goalStatus(events: readonly LogEvent[], state: RequestState | undefined,
+  live: { running: boolean; drafting?: string }): GoalStatus | null {
+  if (live.drafting !== undefined) return { phase: "drafting", objective: live.drafting, checks: [], startedAt: 0, requests: 0 };
+  const lastSet = events.findLastIndex(event => event.t === "goal" && event.action === "set");
+  if (lastSet < 0) return null;
+  const set = events[lastSet]!;
+  if (set.t !== "goal" || set.action !== "set") return null;
+  const after = events.slice(lastSet + 1);
+  // The last clear decides: a met goal the user then cleared is gone like any other cleared goal.
+  const clear = after.findLastIndex(event => event.t === "goal" && event.action === "clear");
+  const cleared = clear < 0 ? undefined : after[clear];
+  // A goal the user cleared is gone; a met goal stays for one summary, until the next message opens a new request.
+  if (cleared?.t === "goal" && cleared.action === "clear" && cleared.reason !== "met") return null;
+  const recorded = cleared !== undefined;
+  if (recorded && after.slice(clear + 1).some(event => event.t === "user" && event.request === undefined)) return null;
+  // Only the goal's own request carries its contract; the ledger of any other request says nothing about it.
+  const own = state?.acceptance?.contract_id === set.contract.id && state.acceptance.contract_event !== undefined
+    && events.some((event, index) => index > lastSet && event.id === state.acceptance!.contract_event) ? state : undefined;
+  // The ledger is the verdict (D11): verified is met even before the clear is recorded -- an /accept outside a
+  // request, a log written before /accept recorded it -- and its clock stops at the last recorded fact.
+  const met = recorded || own?.status === "verified";
+  const end = recorded ? Date.parse(cleared.at) : met ? Date.parse(after.at(-1)?.at ?? set.at) : undefined;
+  const checks: GoalCheck[] = set.contract.criteria.map(item => {
+    const entry = own?.criteria.find(criterion => criterion.id === item.id);
+    const run = item.kind === "command" ? own?.commands.findLast(command => command.command === item.command) : undefined;
+    return { id: item.id, kind: item.kind, status: entry?.status ?? (item.kind === "human" ? "awaiting_human" : "not_run"),
+      ...(item.kind === "command" && item.guard ? { guard: true as const } : {}),
+      ...(entry?.status === "fail" && run ? { exit: run.exit } : {}) };
+  });
+  return { phase: met ? "met" : live.running ? "working" : own?.status === "awaiting_human" ? "needs_you" : "stopped",
+    objective: set.objective, checks, startedAt: Date.parse(set.at), ...(end === undefined ? {} : { endedAt: end }),
+    requests: (recorded ? after.slice(0, clear) : after).filter(event => event.t === "assistant").length };
+}
+
+/** The words the sidebar and the input edge use for a phase. */
+export function goalPhaseLabel(phase: GoalPhase): string {
+  return phase === "needs_you" ? "needs you" : phase;
+}

package/src/core/history.ts

@@ -2,6 +2,7 @@
 import { emitHandoff, type Handoff } from "./handoff.ts";
 import { estimateTokens } from "./tokens.ts";
 import { recoveryWorkingSet } from "./working-set.ts";
+import { recoveryInstructions } from "./prompt-policy.ts";
 import type { RecoveryNodes } from "./recovery-sources.ts";
 
 // A carried handoff must leave room for another segment's work. This budget is
@@ -122,6 +123,11 @@ export function boundRecoveryHandoff(full: Handoff, nodes: RecoveryNodes, budget
   const legacy = boundHandoff(full, budget);
   const view = recoveryWorkingSet(full, nodes, budget * .4, tools);
   if (!view) return legacy;
-  try { return boundHandoff({ ...full, working_set: view }, budget); }
+  let carried: Handoff;
+  try { carried = boundHandoff({ ...full, working_set: view }, budget); }
   catch (error) { if (error instanceof RangeError) return legacy; throw error; }
+  // Whether the user turns survived bounding is known only now. The inline
+  // wording is shorter, so swapping it in cannot push the handoff over budget.
+  const inline = tools?.includes("history") && carried.user_turns_truncated === undefined && (carried.history?.sections["user_turns"]?.offset ?? 0) === 0;
+  return inline && carried.working_set ? { ...carried, working_set: { ...carried.working_set, recovery: recoveryInstructions(tools!, true) } } : carried;
 }

package/src/core/permissions.ts

@@ -45,9 +45,10 @@ export type ToolSource = "builtin" | "extension";
 
 /** Task capabilities are frozen once at session creation (O.7); not permissions. */
 export const TOOL_PROFILES = {
-  coding: ["read", "grep", "find", "write", "edit", "environment", "exec_command", "write_stdin", "history", "note"],
-  // An explicit preset preserves the measured legacy ten-tool coding contract.
-  foundation: ["read", "grep", "find", "write", "edit", "environment", "exec_command", "write_stdin", "history", "note", "question", "apply_patch", "diff", "webfetch", "websearch", "format", "lsp"],
+  // worktree joined the measured ten (2026-10-11, feat-worktree-tool): without
+  // it a model needing isolation had no checkout it was allowed to edit.
+  coding: ["read", "grep", "find", "write", "edit", "environment", "exec_command", "write_stdin", "history", "note", "worktree"],
+  foundation: ["read", "grep", "find", "write", "edit", "environment", "exec_command", "write_stdin", "history", "note", "worktree", "question", "apply_patch", "diff", "webfetch", "websearch", "format", "lsp"],
   readonly: ["read", "grep", "find", "history", "note"],
   research: ["read", "grep", "find", "history", "note", "branch", "resolve"],
   data: ["read", "grep", "find", "history", "note", "query"],

package/src/core/prompt-policy.ts

@@ -23,9 +23,16 @@ export function toolDescription(description: string, guidance: readonly ToolGuid
   return [description, ...guidance.filter(item => item.requires.every(name => tools.includes(name))).map(item => item.text)].join(" ");
 }
 
-export function recoveryInstructions(tools: readonly string[]): string {
+/**
+ * `usersInline`: the carried `user_turns` hold every user message verbatim.
+ * Telling the model to page them anyway costs a guaranteed first-call read
+ * that returns what it already has -- or an empty page after a model switch
+ * on a fresh session (Horizyn mv3nsske-x50u, fix-recovery-inline-users).
+ */
+export function recoveryInstructions(tools: readonly string[], usersInline = false): string {
   return (tools.includes("history")
-    ? "Read original user messages before continuing: history(node=source.node,recovery=users,offset=0). Other pages: failures, environment, next_actions; event=ID reads one original. history(work_id=ID) recovers work. "
+    ? (usersInline ? "User messages are verbatim in user_turns. Other history(node=source.node,recovery=...) pages: failures, environment, next_actions; " : "Read original user messages before continuing: history(node=source.node,recovery=users,offset=0). Other pages: failures, environment, next_actions; ") +
+      "event=ID reads one original. history(work_id=ID) recovers work. "
     : "Original user messages and evidence remain at the source references. The original-source recovery capability is unavailable; state any resulting evidence gap instead of guessing. ") +
     "Abandoned messages are cancelled; annotations are not user instructions. Observations are historical: recheck resource, host and current permissions before acting.";
 }

package/src/core/regex-dialect.ts

@@ -0,0 +1,25 @@
+/**
+ * Brings the ripgrep regex dialect to JS RegExp where the two differ in
+ * spelling, not meaning.
+ *
+ * grep runs ripgrep when it is on PATH and a TypeScript walk otherwise, and
+ * the model writes for ripgrep (Rust regex), where a leading `(?i)` is the
+ * usual way to ask for case-insensitivity. JS rejects that spelling but
+ * accepts the scoped form `(?i:...)`, so a leading global group is rewritten
+ * into a scoped group around the rest of the pattern. Without this the same
+ * call works or fails depending on whether rg happens to be installed.
+ *
+ * Only the leading form and only flags JS modifiers support (i, m, s) are
+ * rewritten; anything else is passed through so RegExp reports it as it is.
+ */
+const LEADING_FLAGS = /^\(\?([ims]+)\)/;
+
+export function jsPatternFromRipgrep(pattern: string): string {
+  const match = LEADING_FLAGS.exec(pattern);
+  if (match === null) return pattern;
+  const flags = match[1]!;
+  // A repeated flag is a SyntaxError inside a modifier group; ripgrep
+  // tolerates it, so duplicates are dropped rather than surfaced.
+  const unique = [...new Set(flags)].join("");
+  return `(?${unique}:${pattern.slice(match[0].length)})`;
+}