@visual-z/xeno 0.8.4 → 0.9.1

package/src/apps/startup.ts

@@ -1,1677 +0,0 @@
-import { loadBlindChecks } from "../store/blind-checks.ts";
-import type { BlindChecks } from "../core/blind-checks.ts";
-import { appSessionFields } from "./session-lifecycle.ts";
-import { release } from "node:os";
-import { codingWorkingProtocol } from "../core/continuation.ts";
-import { taskGuidance } from "../core/prompt-policy.ts";
-import { environmentSection, type SessionEnvironment } from "../core/environment.ts";
-/**
- * From argv to a session that can run. Credential order, model selection,
- * --fresh and the leftover-log notice all live here so the CLI entry can
- * stay a few calls -- and so those rules can be tested without starting
- * a REPL.
- */
-
-import { mkdir } from "node:fs/promises";
-import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { Session, systemClock } from "../runtime/loop.ts";
-import { DEFAULT_PROVIDER, type ProviderConfig } from "../runtime/provider.ts";
-import { createProvider, providerSessionId, selectModel, loadCatalog, groupedModels, parseUserCatalog, type CatalogFetch } from "../runtime/catalog.ts";
-import { ExtensionRegistry } from "../runtime/extensions.ts";
-import { DISCOVERY_TOOL_NAME } from "../runtime/tool-discovery.ts";
-import { declaredToolNames } from "../core/tool-discovery.ts";
-import { CATALOG, outputTokenBudget, type ModelSpec } from "../runtime/model.ts";
-import { asThinkingLevel, clampThinkingLevel, supportedThinkingLevels } from "../core/thinking.ts";
-import { modelKey } from "../core/session-position.ts";
-import { extensionFlagValue, type ExtensionFlag, type FlagInput } from "../core/extension-flags.ts";
-import { scopedModels } from "../runtime/model-scope.ts";
-import {
-  resolveCredential, envLabel, storedIsOAuth,
-  type AuthFile, type ResolveEffects, type Resolved, describeMissingCredential } from "../runtime/auth.ts";
-import { authPath, configDir, readJsonFile } from "../store/config.ts";
-import { findRipgrep, provisionRipgrep } from "../store/tool-binaries.ts";
-import { packageLocation } from "../store/update-cache.ts";
-import { installKind } from "../core/update-check.ts";
-import { toolInstallAllowed } from "../core/ripgrep-release.ts";
-import { loadUiResources, loadTextResources, type UiResources } from "../store/resources.ts";
-import { discoverResources, type ResourceIndex } from "../store/resource-index.ts";
-import { pickProjectTrust, pickStartupSession, runResourceConfig } from "./ui/standalone.ts";
-import { PackageManager, type PackageCommand } from "../runtime/package-manager.ts";
-import { loadAcceptanceContract } from "../store/acceptance.ts";
-import type { AcceptanceContract } from "../core/acceptance.ts";
-import { appendSkillsToSystem, type Skill } from "../core/skills.ts";
-import { COMMANDS, resolveSlashCatalog, type SlashCatalog } from "./commands.ts";
-import { createStyle, IDENTITY, type Style } from "../tui/style.ts";
-import type { Settings } from "../core/settings.ts";
-import { readModelSources, readCatalogCacheText, writeCatalogCache, catalogCachePath } from "../store/models.ts";
-import { refreshRemoteCatalog } from "../runtime/models-fetch.ts";
-import { readCursor, writeCursor, type Cursor } from "../store/log.ts";
-import { getBlob } from "../store/blobs.ts";
-import { parseSessionContext } from "../core/session-format.ts";
-import { resolveLogDir, findSessionByPrefix, newestConversation, sessionsDir, type ResolveLogOpts } from "../store/sessions.ts";
-import { recoverCut } from "../store/recovery.ts";
-import { planSessionEntry, restoreSessionModel } from "../core/session-entry.ts";
-import { loadContext, assembleSystemPrompt, formatNotice, type LoadedContext } from "../store/context-files.ts";
-import {
-  projectTrust,
-} from "../store/trust.ts";
-import { stat } from "node:fs/promises";
-import {
-  parseToolList, rulesWithAllowTools, selectTools, isToolProfile,
-  type ToolProfile,
-  type PermissionRequest, type PermissionRule,
-} from "../core/permissions.ts";
-import {
-  TOOL_SCHEMAS, TOOL_DEFINITIONS, modelToolSchema, DEFAULT_TOOL_CONTEXT, workspaceRoot,
-  type ApprovalChoice, type ToolContext,
-} from "../runtime/tools.ts";
-import { assertNever } from "../core/exhaustive.ts";
-import {
-  contextLimits, DEFAULT_CONTEXT_POLICY, isContextPolicy, type ContextLimits, type ContextPolicy,
-} from "../core/context-policy.ts";
-import { colorEnabled, createPalette, describeError, stdinIsTty, stdoutIsTty, type Palette } from "./render.ts";
-import { type ActionId, type Keymap } from "../core/keymap.ts";
-import type { StartupInput } from "./startup-input.ts";
-import { FoundationRuntime } from "../runtime/foundation.ts";
-import { readFoundationConfig, readOutputSchema } from "../store/foundation-config.ts";
-import { outputValidator } from "../runtime/output-schema.ts";
-import { loadAgentProfileLayers } from "../runtime/agent-profiles.ts";
-import { resolveAgentProfile, builtinAgentProfileLayer, type ResolvedAgentProfile } from "../core/agent-profile.ts";
-import { workflowToolNames, workflowInstructions, isWorkflowMode, type WorkflowMode } from "../core/workflow-mode.ts";
-import { resolveContextWorkspace } from "../store/context-files.ts";
-
-export const SYSTEM_PROMPT = systemPromptFor(TOOL_SCHEMAS.map((tool) => tool.name));
-
-/**
- * Tool schemas are the only capability inventory. A branch may inherit this
- * stable policy while narrowing its tools; no parent tool recipe can leak.
- */
-export function systemPromptFor(toolNames: readonly string[], env?: SessionEnvironment): string {
-  return [
-    "You are an agent working in a terminal.",
-    "The declared tool schemas define available capabilities, input units and execution lifecycles. Do not assume additional tools or infer permission from a tool's visibility.",
-    ...(env === undefined ? [] : [environmentSection(env)]),
-    taskGuidance(),
-    codingWorkingProtocol(toolNames),
-    "Be concise. Do not narrate what you are about to do; do it, then say what happened.",
-  ].join("\n\n");
-}
-
-/** I/O half of the environment snapshot; the formatting is pure (core/environment.ts). */
-export function sessionEnvironment(workspace: string): SessionEnvironment {
-  const now = new Date();
-  const pad = (n: number) => String(n).padStart(2, "0");
-  let git = false;
-  try {
-    git = Bun.spawnSync(["git", "rev-parse", "--is-inside-work-tree"], { cwd: workspace, stdout: "pipe", stderr: "ignore" })
-      .stdout.toString().trim() === "true";
-  } catch { /* no git on PATH is "not a repository" for the model's purposes */ }
-  return {
-    platform: `${process.platform} ${release()} (${process.arch})`,
-    shell: "bash (tool commands run with bash -lc)",
-    cwd: workspace,
-    date: `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`,
-    git,
-    ripgrep: findRipgrep(configDir()) !== null,
-  };
-}
-
-/**
- * Fills the rg gap in the background for interactive sessions only: scripts,
- * protocol servers and test subprocesses must not reach the network on their
- * own. Failure is silent because grep keeps its TypeScript engine; the next
- * session's environment line reports what is actually there. The returned
- * stop aborts the download, so quitting never waits for it.
- */
-export function provisionToolsInBackground(args: Args): () => void {
-  const location = packageLocation();
-  if (!isInteractiveSession(args) || !toolInstallAllowed({ env: process.env, offline: args.offline === true, install: installKind(location.root, location.git) })) return () => {};
-  const controller = new AbortController();
-  void provisionRipgrep({ configDir: configDir(), signal: controller.signal, fetchBytes: async (url, signal) => {
-    const response = await fetch(url, { ...(signal ? { signal } : {}), redirect: "follow" });
-    if (!response.ok) throw new Error(`HTTP ${response.status}`);
-    return new Uint8Array(await response.arrayBuffer());
-  } }).catch(() => { /* grep falls back to its own engine */ });
-  return () => controller.abort();
-}
-
-/**
- * Session policy a CLI coding session differs from a benchmark run in.
- * Benchmarks construct their own SessionConfig and keep the core defaults.
- */
-export function cliSessionConfig(args: Args): { continuationAfter: number; workingSet: true; strictVerification: true; timeBudgetMs?: number } {
-  // Never within a request. A real Kimi K3 run with the reminder at reply six
-  // spent half its requests on notes after the work was already verified
-  // (fix-cli-continuation-noise). The reminder still fires where it earns its
-  // place: a resumed handoff that cannot continue, and boundary preparation.
-  return { continuationAfter: Infinity, workingSet: true, strictVerification: true, ...(args.timeBudgetMs === undefined ? {} : { timeBudgetMs: args.timeBudgetMs }) };
-}
-
-/**
- * Pure: where each kind of state lives for this workspace. Tool observations
- * are not listed: Session keeps them in `<logDir>/artifacts`, inside the
- * session, so fork and copy carry them -- moving sessions moves them too.
- */
-export function statePaths(workspace: string, stateDir?: string): { blobs: string; sessions: string } {
-  const root = stateDir ?? join(workspace, ".xeno");
-  return { blobs: join(root, "blobs"), sessions: join(root, "sessions") };
-}
-
-export type AskSlot = {
-  current?: (request: PermissionRequest) => Promise<ApprovalChoice>;
-};
-
-export interface Args {
-  agentBase?: { model: string; provider: string; thinking: string; maxTurns: number; excludeTools: string[]; noTools: boolean; noBuiltinTools: boolean;
-    tools?: string[]; toolProfile?: ToolProfile; timeBudgetMs?: number; workflow?: WorkflowMode };
-  clientMcp?: import("../core/mcp-config.ts").McpServers;
-  workflow?: WorkflowMode;
-  agent?: string;
-  outputSchema?: string;
-  outputLastMessage?: string;
-  cliFlags?: readonly string[];
-  role?: ResolvedAgentProfile;
-  shellCheckpoints?: boolean;
-  workspace: string;
-  /**
-   * `--state-dir <dir>`: where every xeno write goes -- snapshots, tool
-   * observations and, unless --session-dir says otherwise, sessions. Absent
-   * means `<workspace>/.xeno`. Evaluations need it outside the workspace:
-   * patches and verifiers see whatever is written there.
-   */
-  stateDir?: string;
-  /** `--time-budget <seconds>`, in ms: when to warn the model its run is nearly out of time. */
-  timeBudgetMs?: number;
-  /**
-   * `--path-root`: how far file tools may reach, absolute. Must contain the
-   * workspace. Fingerprints, snapshots and rewind stay workspace-scoped.
-   */
-  pathRoot?: string;
-  logDir: string;
-  maxTurns: number;
-  prompt: string;
-  trigger: number;
-  hard: number;
-  contextPolicy?: ContextPolicy;
-  model: string;
-  provider: string;
-  apiKey: string;
-  listModels: boolean;
-  modelSearch?: string;
-  help?: boolean;
-  version?: boolean;
-  manualUpdateCheck?: boolean;
-  exportFile?: string;
-  offline?: boolean;
-  tuiMode?: "regular" | "fullscreen";
-  noThemes?: boolean;
-  themePaths?: string[];
-  sessionId?: string;
-  modelsCommand: boolean;
-  modelsRefresh: boolean;
-  fresh: boolean;
-  noContextFiles: boolean;
-  appendSystemPrompt: string[];
-  systemPrompt: string | null;
-  /** `--tools` allowlist. Omitted when the flag was not passed. */
-  tools?: string[];
-  /** New sessions default to coding; restored context keeps its frozen schemas. */
-  toolProfile?: ToolProfile;
-  acceptanceFile?: string;
-  /** feat-blind-checks: a directory outside the workspace holding blind.json and its fixtures. */
-  blindChecks?: string;
-  excludeTools: string[];
-  noTools: boolean;
-  /** `--no-builtin-tools`. False when the flag was not passed. */
-  noBuiltinTools: boolean;
-  allowTools: string[];
-  /** `--yolo` / `-y`: skip tool approval for this process only. */
-  yolo: boolean;
-  /** `--approve` true, `--no-approve` false. Omitted when neither. */
-  approve?: boolean;
-  configCommand?: boolean;
-  local?: boolean;
-  packageCommand?: PackageCommand;
-  packagePaths?: {source:string;path:string}[];
-  /**
-   * `-p` / `--print`. Distinct from a leftover positional prompt: only this
-   * flag reads piped stdin, so a one-shot that did not ask for a pipe cannot
-   * hang on an open stdin the caller never meant to send.
-   */
-  print: boolean;
-  /** `--theme <name|path>`. Empty when the flag was not passed. */
-  theme: string;
-  /** `--thinking <level>`. Empty when the flag was not passed. */
-  thinking?: string;
-  /** `--models <patterns>`. Comma-separated; empty when the flag was not passed. */
-  models?: string;
-  modelsExplicit?: boolean;
-  noSkills: boolean;
-  noPromptTemplates: boolean;
-  noExtensions?: boolean;
-  extensionPaths?: string[];
-  extensionFlags?: Record<string, string | boolean>;
-  extensionArgv?: string[];
-  extensionInputs?: Record<string, FlagInput>;
-  skillPaths: string[];
-  promptTemplatePaths: string[];
-  /** `-c` / `--continue`. */
-  continueLatest?: boolean;
-  /**
-   * `-r` / `--resume`. A string is an id prefix; `true` is the selector
-   * with no id (list, do not guess).
-   */
-  resume?: string | true;
-  /** `--session <path|id prefix>`. */
-  session?: string;
-  /** `--fork <path|id prefix>`. */
-  forkFrom?: string;
-  /** `--no-session`. */
-  noSession?: boolean;
-  /** `--session-dir <dir>`. */
-  sessionDir?: string;
-  /** `-n` / `--name`. */
-  sessionName?: string;
-  /** `--mode json`. Empty / omitted when the flag was not passed. */
-  mode?: string;
-  /** Explicit local adapter endpoint. An owned mode-0700 directory is required. */
-  controlSocket?: string;
-  /** `--verbose`. Expands the startup header's counts into lists. */
-  verbose?: boolean;
-}
-
-/**
- * Names `parseArgs` actually accepts. Subcommand-only `--refresh` and
- * `--check` are not here; listing them would make a top-level
- * `--refresh` suggest itself while still being rejected.
- *
- * Keep in sync with the branches in `parseArgs`. A missing entry still
- * parses; it just cannot be offered as a suggestion.
- */
-const KNOWN_FLAGS: readonly string[] = [
-  "--workflow", "--agent", "--output-schema", "--output-last-message",
-  "--checkpoint-shell",
-  "--workspace", "-w",
-  "--path-root",
-  "--state-dir",
-  "--time-budget",
-  "--log",
-  "--max-turns",
-  "--trigger",
-  "--hard",
-  "--context-policy",
-  "--model", "-m",
-  "--provider",
-  "--api-key",
-  "--list-models",
-  "--fresh",
-  "--continue", "-c",
-  "--resume", "-r",
-  "--session",
-  "--fork",
-  "--no-session",
-  "--session-dir",
-  "--name", "-n",
-  "--no-context-files", "-nc",
-  "--system-prompt",
-  "--append-system-prompt",
-  "--tools", "-t",
-  "--tool-profile",
-  "--acceptance-file",
-  "--blind-checks",
-  "--exclude-tools", "-xt",
-  "--no-tools", "-nt",
-  "--no-builtin-tools",
-  "--allow-tools",
-  "--yolo", "-y",
-  "--approve", "-a",
-  "--no-approve", "-na",
-  "--theme",
-  "--thinking",
-  "--models",
-  "--skill",
-  "--prompt-template",
-  "--no-skills",
-  "--no-prompt-templates",
-  "--extension", "-e", "--no-extensions", "-ne", "--extension-flag",
-  "--mode",
-  "--control-socket",
-  "--verbose",
-  "--print", "-p",
-  "--help", "-h",
-  "--version", "-v", "--export", "--session-id", "--offline", "--tui-mode", "--use-theme", "--no-themes", "-ns", "-np", "-nbt",
-];
-
-/**
- * Levenshtein. Ten lines instead of a dependency. `--no-session` and
- * `--no-sessions` are distance 1: the caller must suggest, never apply.
- */
-function editDistance(a: string, b: string): number {
-  const n = b.length;
-  const prev = Array.from({ length: n + 1 }, (_, j) => j);
-  const cur = new Array<number>(n + 1);
-  for (let i = 1; i <= a.length; i++) {
-    cur[0] = i;
-    for (let j = 1; j <= n; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      cur[j] = Math.min(prev[j]! + 1, cur[j - 1]! + 1, prev[j - 1]! + cost);
-    }
-    for (let j = 0; j <= n; j++) prev[j] = cur[j]!;
-  }
-  return prev[n]!;
-}
-
-function closestKnownFlag(flag: string): string {
-  let best = KNOWN_FLAGS[0]!;
-  let bestD = Infinity;
-  for (const known of KNOWN_FLAGS) {
-    const d = editDistance(flag, known);
-    if (d < bestD || (d === bestD && known < best)) {
-      bestD = d;
-      best = known;
-    }
-  }
-  return best;
-}
-
-/**
- * A warning that still exits 0 is how this bug hid: scripts treated a typo
- * as success. Suggest the nearest name and stop. Never rewrite the argv.
- */
-function rejectUnknownFlag(flag: string): never {
-  const suggestion = closestKnownFlag(flag);
-  console.error(`unknown flag: ${flag}`);
-  console.error(`  did you mean ${suggestion}?`);
-  process.exit(1);
-}
-
-export function parseArgs(argv: string[], options: { deferExtensions?: boolean; flags?: ReadonlyMap<string, ExtensionFlag> } = {}): Args {
-  let selectedTheme: string | undefined;
-  let updateExtensions = false;
-  const args: Args = {
-    cliFlags: argv.filter(value => value.startsWith("-")),
-    // No default request cap (S.6 item 1): the stall watchdog catches a run
-    // repeating a cycle without evidence, and asks the user when one can answer
-    // (S.8); --max-turns or an agent budget sets a hard cap.
-    workspace: process.cwd(), logDir: "", maxTurns: Infinity, prompt: "",
-    // Overridable so a node boundary can be forced in a short session --
-    // otherwise cutting is only reachable after tens of thousands of tokens,
-    // which makes the most interesting path the least exercised one.
-    trigger: 0, hard: 0,
-    model: "", provider: "", apiKey: "", listModels: false, modelsCommand: false, modelsRefresh: false, fresh: false,
-    noContextFiles: false, appendSystemPrompt: [],
-    systemPrompt: null,
-    excludeTools: [], noTools: false, noBuiltinTools: false, allowTools: [], yolo: false,
-    print: false,
-    theme: "",
-    thinking: "",
-    models: "",
-    noSkills: false, noPromptTemplates: false, skillPaths: [], promptTemplatePaths: [],
-    continueLatest: false, session: "", forkFrom: "", noSession: false, sessionDir: "", sessionName: "",
-    mode: "", verbose: false,
-  };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i]!;
-    if (["--log", "--session", "--fork", "--session-dir", "--state-dir"].includes(a) &&
-      (!argv[i + 1] || argv[i + 1]!.startsWith("-"))) {
-      console.error(`${a} requires a value`);
-      process.exit(1);
-    }
-    if (a === "--workflow") { const mode = argv[++i]; if (!mode || !isWorkflowMode(mode)) throw Error("--workflow requires build or plan"); args.workflow = mode; }
-    else if (a === "--agent") { const name = argv[++i]; if (!name || name.startsWith("-")) throw Error("--agent requires a profile name"); args.agent = name; }
-    else if (a === "--output-schema" || a === "--output-last-message") { const path = argv[++i]; if (!path || path.startsWith("-")) throw Error(`${a} requires a file path`); if (a === "--output-schema") args.outputSchema = resolve(path); else args.outputLastMessage = resolve(path); }
-    else if (a === "--checkpoint-shell") args.shellCheckpoints = true;
-    else if (a === "--workspace" || a === "-w") args.workspace = argv[++i] ?? args.workspace;
-    else if (a === "--path-root") args.pathRoot = resolve(argv[++i] ?? "/");
-    else if (a === "--state-dir") args.stateDir = resolve(argv[++i] ?? ".");
-    else if (a === "--time-budget") {
-      const seconds = Number(argv[++i]);
-      if (!Number.isFinite(seconds) || seconds <= 0) throw new Error("--time-budget requires a positive number of seconds");
-      args.timeBudgetMs = seconds * 1000;
-    }
-    else if (a === "--log") args.logDir = argv[++i] ?? "";
-    else if (a === "--max-turns") args.maxTurns = Number(argv[++i] ?? args.maxTurns);
-    else if (a === "--trigger") args.trigger = Number(argv[++i] ?? 0);
-    else if (a === "--hard") args.hard = Number(argv[++i] ?? 0);
-    else if (a === "--context-policy") {
-      const policy = argv[++i];
-      if (!isContextPolicy(policy)) throw new Error("--context-policy requires windowed, segmented, continuous, or adaptive");
-      args.contextPolicy = policy;
-    }
-    else if (a === "--model" || a === "-m") args.model = argv[++i] ?? "";
-    else if (a === "--provider") args.provider = argv[++i] ?? "";
-    else if (a === "--api-key") args.apiKey = argv[++i] ?? "";
-    else if (a === "--list-models") { args.listModels = true; const next = argv[i + 1]; if (next && !next.startsWith("-") && !next.startsWith("@")) args.modelSearch = argv[++i]!; }
-    else if (a === "--version" || a === "-v") args.version = true;
-    else if (a === "--export") { const file = argv[++i]; if (!file || file.startsWith("-")) throw new Error("--export requires a session path"); args.exportFile = file; }
-    else if (a === "--session-id") { const id = argv[++i]; if (!id || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,127}$/.test(id)) throw new Error("--session-id requires a plain session identifier"); args.sessionId = id; }
-    else if (a === "--offline") args.offline = true;
-    else if (a === "--tui-mode") { const mode = argv[++i]; if (mode !== "regular" && mode !== "fullscreen") throw new Error("--tui-mode requires regular or fullscreen"); args.tuiMode = mode; }
-    else if (a === "models" && i === 0) {
-      // Subcommand, not a prompt. Do not consume the rest: a later
-      // `--models-url` must still be an unknown-flag error, and `-h`
-      // must still print help.
-      args.modelsCommand = true;
-    }
-    else if (a === "config" && i === 0) args.configCommand = true;
-    else if ((a === "install" || a === "remove" || a === "update" || a === "list") && i === 0) args.packageCommand = {operation:a,sources:[]};
-    else if ((a === "--local" || a === "-l") && (args.packageCommand || args.configCommand)) { args.local=true; if(args.packageCommand)args.packageCommand.local=true; }
-    else if (a === "--extensions" && args.packageCommand?.operation === "update") updateExtensions = true;
-    else if (a === "--check" && args.packageCommand?.operation === "update") args.manualUpdateCheck = true;
-    else if (a === "--refresh" && args.modelsCommand) {
-      args.modelsRefresh = true;
-    }
-    else if (a === "--fresh") args.fresh = true;
-    else if (a === "-c" || a === "--continue") args.continueLatest = true;
-    else if (a === "-r" || a === "--resume") {
-      const next = argv[i + 1];
-      if (next !== undefined && !next.startsWith("-")) args.resume = argv[++i]!;
-      else args.resume = true;
-    }
-    else if (a === "--session") args.session = argv[++i] ?? "";
-    else if (a === "--fork") args.forkFrom = argv[++i] ?? "";
-    else if (a === "--no-session") args.noSession = true;
-    else if (a === "--session-dir") args.sessionDir = argv[++i] ?? "";
-    else if (a === "-n" || a === "--name") args.sessionName = argv[++i] ?? "";
-    else if (a === "--no-context-files" || a === "-nc") args.noContextFiles = true;
-    else if (a === "--system-prompt") args.systemPrompt = argv[++i] ?? "";
-    else if (a === "--append-system-prompt") args.appendSystemPrompt.push(argv[++i] ?? "");
-    else if (a === "--tools" || a === "-t") args.tools = parseToolList(argv[++i] ?? "");
-    else if (a === "--blind-checks") {
-      const path = argv[++i]; if (!path || path.startsWith("--")) throw new Error("--blind-checks requires a directory outside the workspace");
-      args.blindChecks = path;
-    }
-    else if (a === "--acceptance-file") {
-      const path = argv[++i]; if (!path || path.startsWith("--")) throw new Error("--acceptance-file requires a JSON path");
-      args.acceptanceFile = path;
-    }
-    else if (a === "--tool-profile") {
-      const value = argv[++i] ?? "";
-      if (!isToolProfile(value)) throw new Error("unknown tool profile; choose coding, readonly, research, data, foundation or full");
-      args.toolProfile = value;
-    }
-    else if (a === "--exclude-tools" || a === "-xt") args.excludeTools = parseToolList(argv[++i] ?? "");
-    else if (a === "--no-tools" || a === "-nt") args.noTools = true;
-    else if (a === "--no-builtin-tools" || a === "-nbt") args.noBuiltinTools = true;
-    else if (a === "--allow-tools") args.allowTools = parseToolList(argv[++i] ?? "");
-    else if (a === "--yolo" || a === "-y") args.yolo = true;
-    else if (a === "--approve" || a === "-a") args.approve = true;
-    else if (a === "--no-approve" || a === "-na") args.approve = false;
-    else if (a === "--theme") {
-      const theme = argv[++i]; if (!theme || theme.startsWith("-")) throw new Error("--theme requires a name or path");
-      if (theme.includes("/") || theme.includes("\\") || theme.endsWith(".json")) { (args.themePaths ??= []).push(theme); if (theme.endsWith(".json")) args.theme = theme; }
-      else args.theme = theme;
-    }
-    else if (a === "--use-theme") { const theme = argv[++i]; if (!theme || theme.startsWith("-")) throw new Error("--use-theme requires a name"); selectedTheme = theme; }
-    else if (a === "--no-themes") args.noThemes = true;
-    else if (a === "--thinking") args.thinking = argv[++i] ?? "";
-    else if (a === "--models") { const value = argv[++i]; if (value === undefined || value.startsWith("--")) throw new Error("--models requires a value"); args.models = value; args.modelsExplicit = true; }
-    else if (a === "--skill") args.skillPaths.push(argv[++i] ?? "");
-    else if (a === "--prompt-template") args.promptTemplatePaths.push(argv[++i] ?? "");
-    else if (a === "--no-skills" || a === "-ns") args.noSkills = true;
-    else if (a === "--no-prompt-templates" || a === "-np") args.noPromptTemplates = true;
-    else if (a === "--no-extensions" || a === "-ne") args.noExtensions = true;
-    else if (a === "--extension" || a === "-e") {
-      const path = argv[++i]; if (!path || path.startsWith("-")) throw new Error("--extension requires a path");
-      (args.extensionPaths ??= []).push(path);
-    }
-    else if (a === "--extension-flag") {
-      const value = argv[++i] ?? "", at = value.indexOf("=");
-      if (at <= 0) throw new Error("--extension-flag requires name=value");
-      (args.extensionFlags ??= Object.create(null) as Record<string, string | boolean>)[value.slice(0, at)] = value.slice(at + 1) === "true" ? true : value.slice(at + 1) === "false" ? false : value.slice(at + 1);
-    }
-    else if (a === "--mode") args.mode = argv[++i] ?? "";
-    else if (a === "--control-socket") {
-      const value = argv[++i];
-      if (!value || value.startsWith("-")) throw Error("--control-socket requires a path");
-      args.controlSocket = resolve(value);
-    }
-    else if (a === "--verbose") args.verbose = true;
-    else if (a === "-p" || a === "--print") {
-      args.print = true;
-    }
-    else if (a === "--help" || a === "-h") {
-      if (options.deferExtensions) { args.help = true; continue; }
-      printCliHelp();
-      process.exit(0);
-    } else if (a === "--") {
-      // Everything after `--` is content, never a flag. The delimiter
-      // is consumed so a dashed token cannot be mistaken for an option.
-      for (let j = i + 1; j < argv.length; j++) {
-        args.prompt += (args.prompt ? " " : "") + argv[j]!;
-      }
-      break;
-    } else if (a.startsWith("-") && a !== "-") {
-      const equal = a.indexOf("="), name = a.slice(2, equal === -1 ? undefined : equal), definition = options.flags?.get(name);
-      if (a.startsWith("--") && (definition || options.deferExtensions)) {
-        const next = argv[i + 1], input: FlagInput = { inline: equal !== -1,
-          ...(equal !== -1 ? { value: a.slice(equal + 1) } : next !== undefined && !next.startsWith("-") && !next.startsWith("@") ? { value: next } : {}) };
-        if (definition) {
-          const value = extensionFlagValue(name, definition, input);
-          if (value !== undefined) (args.extensionFlags ??= Object.create(null) as Record<string, string | boolean>)[name] = value;
-          if (!input.inline && input.value !== undefined && (definition.type === "string" || input.value === "true" || input.value === "false")) i++;
-        } else {
-          args.extensionArgv = [...argv]; (args.extensionInputs ??= Object.create(null) as Record<string, FlagInput>)[name] = input;
-          if (!input.inline && input.value !== undefined) i++;
-        }
-      } else rejectUnknownFlag(a);
-    } else if(args.packageCommand)args.packageCommand.sources.push(a);
-    else args.prompt += (args.prompt ? " " : "") + a;
-  }
-  if (selectedTheme !== undefined) args.theme = selectedTheme;
-  if (args.manualUpdateCheck && (args.packageCommand!.sources.length || args.local || updateExtensions || args.prompt)) {
-    throw new Error("update --check cannot be combined with package sources, --local, or --extensions");
-  }
-  return args;
-}
-
-/**
- * Command-line prompt first, piped stdin after. Both belong in the first
- * user message; reversing that would make `cat README | xeno -p "总结"`
- * look like the file was the instruction.
- */
-export function mergePrintPrompt(prompt: string, stdinText: string): string {
-  if (stdinText.length === 0) return prompt;
-  if (prompt.length === 0) return stdinText;
-  return (prompt.endsWith("\n") ? prompt : `${prompt}\n`) + stdinText;
-}
-
-/**
- * Drain stdin only when it is not a tty. Reading a tty would wait forever
- * for a pipe that an interactive `-p` never has.
- *
- * `firstByteMs` bounds the wait for the FIRST byte, and is set when the
- * command line already carries a prompt. An eval runner, an IDE or a parent
- * script often hands a child a pipe it never writes and never closes; reading
- * that to EOF hung the whole run before the banner (fix-print-stdin-hang).
- * Claude Code applies the same 3s guard. Once data starts, it is read to EOF
- * however slowly it arrives, so a slow producer is not truncated.
- */
-export async function readPipedStdin(
-  input: { readonly isTTY?: boolean } & AsyncIterable<unknown> = process.stdin,
-  opts: { firstByteMs?: number; warn?: (line: string) => void } = {},
-): Promise<string> {
-  if (input.isTTY === true) return "";
-  const chunks: Uint8Array[] = [];
-  const encoder = new TextEncoder();
-  const iterator = input[Symbol.asyncIterator]();
-  const push = (chunk: unknown) => {
-    if (typeof chunk === "string") chunks.push(encoder.encode(chunk));
-    else if (chunk instanceof Uint8Array) chunks.push(chunk);
-  };
-  let first: IteratorResult<unknown>;
-  if (opts.firstByteMs === undefined) first = await iterator.next();
-  else {
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    const timeout = new Promise<null>((resolve) => { timer = setTimeout(() => resolve(null), opts.firstByteMs); });
-    const raced = await Promise.race([iterator.next(), timeout]);
-    clearTimeout(timer);
-    if (raced === null) {
-      (opts.warn ?? ((line) => process.stderr.write(line + "\n")))(
-        `warning: no stdin data received in ${(opts.firstByteMs / 1000).toFixed(0)}s, proceeding without it; ` +
-        "redirect stdin from /dev/null to skip the wait");
-      // Stop holding the pipe open for the rest of the run.
-      if (input === process.stdin) process.stdin.pause();
-      return "";
-    }
-    first = raced;
-  }
-  for (let result = first; !result.done; result = await iterator.next()) push(result.value);
-  if (chunks.length === 0) return "";
-  return new TextDecoder().decode(Buffer.concat(chunks));
-}
-
-export function isPrintMode(args: Args): boolean {
-  return args.print || args.prompt.length > 0;
-}
-
-export function isJsonMode(args: Args): boolean {
-  return args.mode === "json";
-}
-
-/**
- * Most-used actions, in glance order. Keys are read off the map so an
- * unbound action cannot appear as a hint (feat-status-line rule 6, reused
- * here). Labels are not chords; a chord that is not in `byKey` is a bug.
- */
-const HEADER_SHORTCUTS: readonly { action: ActionId; label: string }[] = [
-  { action: "app.interrupt", label: "interrupt" },
-  { action: "app.toggleTools", label: "tools" },
-  { action: "app.toggleThinking", label: "think" },
-  { action: "app.externalEditor", label: "editor" },
-  { action: "app.exit", label: "quit" },
-];
-
-export function formatShortcutLine(keymap: Keymap): string {
-  const parts: string[] = [];
-  for (const { action, label } of HEADER_SHORTCUTS) {
-    const key = keymap.byAction[action]?.[0];
-    if (key === undefined) continue;
-    parts.push(`${key} ${label}`);
-  }
-  return parts.join(" · ");
-}
-
-export function formatStartupHeader(input: {
-  readonly model: string;
-  readonly workspace: string;
-  readonly session: string;
-  readonly agents: readonly string[];
-  readonly skills: readonly string[];
-  readonly prompts: readonly string[];
-  readonly tools?: readonly string[];
-  readonly keymap: Keymap;
-  readonly verbose: boolean;
-}): string[] {
-  const lines: string[] = [
-    input.model,
-    `workspace  ${input.workspace}`,
-    `session    ${input.session}`,
-  ];
-  const groups: [string, readonly string[]][] = [["agents", input.agents], ["skills", input.skills], ["prompts", input.prompts],
-    ...(input.tools !== undefined ? [["tools", input.tools] as [string, readonly string[]]] : [])];
-  if (input.verbose) {
-    for (const [label, items] of groups) {
-      lines.push(`${label.padEnd(10)}${items.length}`);
-      for (const item of items) lines.push(`  ${item}`);
-    }
-  } else {
-    // Four count rows were a third of the banner; one row says the same.
-    lines.push(`loaded     ${groups.map(([label, items]) => `${items.length} ${label}`).join(" · ")}`);
-  }
-  const keys = formatShortcutLine(input.keymap);
-  if (keys.length > 0) lines.push(`keys       ${keys}`);
-  return lines;
-}
-
-function countCatalogDelta(
-  beforeText: string | null,
-  afterText: string | null,
-): { added: number; changed: number } {
-  const ids = (text: string | null): Map<string, string> => {
-    const map = new Map<string, string>();
-    if (text === null || text.trim().length === 0) return map;
-    let json: unknown;
-    try {
-      json = JSON.parse(text);
-    } catch {
-      return map;
-    }
-    for (const spec of parseUserCatalog(json).models) {
-      map.set(modelKey(spec), JSON.stringify(spec));
-    }
-    return map;
-  };
-  const before = ids(beforeText);
-  const after = ids(afterText);
-  let added = 0;
-  let changed = 0;
-  for (const [id, body] of after) {
-    const prev = before.get(id);
-    if (prev === undefined) added += 1;
-    else if (prev !== body) changed += 1;
-  }
-  return { added, changed };
-}
-
-/**
- * Explicit catalog refresh. Download and validate before the write; a
- * failure returns a reason and must not have touched the existing file.
- * Exit status is the caller's: the CLI process exits non-zero, `/models
- * refresh` only prints.
- */
-export async function runModelsRefresh(opts: {
-  fetch: CatalogFetch;
-  write: (value: unknown) => Promise<void>;
-}): Promise<
-  | { ok: true; count: number; added: number; changed: number }
-  | { ok: false; reason: string }
-> {
-  const before = await readCatalogCacheText();
-  const result = await refreshRemoteCatalog({
-    fetch: opts.fetch,
-    write: opts.write,
-  });
-  if (!result.ok) return result;
-  const after = await readCatalogCacheText();
-  const delta = countCatalogDelta(before.text, after.text);
-  return { ok: true, count: result.count, added: delta.added, changed: delta.changed };
-}
-
-/**
- * The two effects credential resolution needs. Real ones here; the tests
- * inject fakes, which is why the priority rules can be pinned offline.
- *
- * A key command runs once per process. Re-running `security find-generic-
- * password` on every request would spend a keychain round trip per turn to
- * re-learn something that has not changed.
- */
-const commandCache = new Map<string, string>();
-
-export function processEffects(): ResolveEffects {
-  return {
-    env: (name) => process.env[name],
-    run: (command) => {
-      const cached = commandCache.get(command);
-      if (cached !== undefined) return cached;
-      const p = Bun.spawnSync(["bash", "-lc", command]);
-      if (p.exitCode !== 0) {
-        throw new Error(`exit ${p.exitCode}: ${new TextDecoder().decode(p.stderr).trim()}`);
-      }
-      const out = new TextDecoder().decode(p.stdout);
-      commandCache.set(command, out);
-      return out;
-    },
-  };
-}
-
-/**
- * Mutable I/O for a running app. The TUI replaces `say` so retry lines
- * land in the transcript rather than punching through the live region.
- * The object identity is stable: providers close over this reference.
- */
-export interface AppIO {
-  palette: Palette;
-  say: (line: string) => void;
-  err: (line: string) => void;
-  /**
-   * Print mode only. The assistant's final text belongs on stdout; `say` is
-   * stderr there so a script cannot mistake a draft or a banner for the
-   * answer. Absent in interactive and piped-REPL runs, which still print
-   * the whole transcript through `say`.
-   */
-  answer?: (text: string) => void;
-}
-
-export interface App {
-  foundation?: FoundationRuntime;
-  args: Args;
-  session: Session;
-  workspace: string;
-  logDir: string;
-  blobDir: string;
-  system: string;
-  providerConfig: ProviderConfig;
-  /** May be `{ ok: false }` in an interactive session waiting on /provider. */
-  credential: Resolved;
-  auth: AuthFile;
-  effects: ResolveEffects;
-  loadedContext: LoadedContext;
-  credentialOf: (spec: ModelSpec) => Resolved;
-  catalog: readonly ModelSpec[];
-  io: AppIO;
-  /**
-   * The TUI writes `current` while it can ask. One-shot and piped runs
-   * leave it empty, so an ask becomes a named refusal.
-   */
-  askSlot: AskSlot;
-  ui?: UiState;
-  slash?: SlashCatalog;
-  resources?: ResourceIndex;
-  projectTrusted?: boolean;
-  extensions?: ExtensionRegistry;
-  shutdownRequested?: boolean;
-}
-
-export interface UiState {
-  settings: Settings;
-  theme: UiResources["theme"];
-  keymap: UiResources["keymap"];
-  userOverrides: Partial<Settings>;
-  style: Style;
-}
-
-function toUiState(loaded: UiResources, color: boolean): UiState {
-  return {
-    settings: loaded.settings,
-    theme: loaded.theme,
-    keymap: loaded.keymap,
-    userOverrides: loaded.userOverrides,
-    style: color ? createStyle(loaded.theme.colors) : IDENTITY,
-  };
-}
-
-/** `--models a,b` and settings.scopedModels share this split so a stray space cannot invent a pattern. */
-export function splitModelPatterns(raw: string | undefined): string[] {
-  if (raw === undefined || raw.length === 0) return [];
-  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-}
-
-/**
- * One line saying where the key came from, or why there isn't one.
- *
- * When a stored entry is what failed, the reason has to be the stored entry
- * -- naming the environment variable would offer a fix that this resolver
- * will then deliberately ignore, because a stored credential owns its
- * provider.
- */
-export function whyNot(spec: ModelSpec, got: Resolved, auth: AuthFile, C: Palette): string {
-  if (got.ok) return C.dim(`  via ${got.source}`);
-  if (auth[spec.provider] !== undefined) return C.yellow(`  ${got.reason}`);
-  return C.dim(`  ${envLabel(spec.provider)}`);
-}
-
-/**
- * /provider only exists inside a live session. A one-shot prompt and a pipe
- * cannot answer it, so those runs must still refuse -- naming /provider there
- * is how this file used to deadlock a first run.
- */
-/**
- * What a non-interactive run says when it has no key. A model named with
- * --model is the only thing the caller asked about; listing every provider
- * hides the one variable that would fix it.
- */
-export function missingCredentialMessage(spec: ModelSpec, explicit: boolean, catalog: readonly ModelSpec[] = CATALOG): string {
-  return explicit ? `${spec.id}: ${describeMissingCredential(spec.provider)}` : describeUnauthenticatedScript(catalog);
-}
-
-export function isInteractiveSession(args: Args): boolean {
-  return !args.print && !args.help && args.mode !== "json" && args.prompt.length === 0 && stdinIsTty() && stdoutIsTty();
-}
-
-/**
- * Script-facing missing-key text. Environment variables and --api-key are
- * the routes that actually work without a tty; /provider is not one of them.
- */
-export function describeUnauthenticatedScript(catalog: readonly ModelSpec[] = CATALOG): string {
-  const providers = [...new Set(catalog.map((m) => m.provider))];
-  const vars = providers.map((p) => envLabel(p));
-  return (
-    `no model has a credential. Set an API key for one of: ${providers.join(", ")}` +
-    ` -- export ${vars.join(" or ")}, or pass --api-key`
-  );
-}
-
-/**
- * Banner / hint for an interactive session that started without a key.
- * Listing every provider's variable was a 20-line wall that buried the one
- * action that works from here; the interactive routes are named instead.
- */
-export function describeUnauthenticatedSession(_catalog: readonly ModelSpec[] = CATALOG): string {
-  return "no provider connected yet. Type /provider to connect one — a Claude, ChatGPT, Copilot or Grok account, an API key, a gateway or a local server — " +
-    `or export a key such as ${["anthropic", "openai", "google", "deepseek"].map(provider => envLabel(provider).split(" or ")[0]).join(", ")}.`;
-}
-
-export function retryHandler(io: AppIO): (attempt: number, delayMs: number, error: unknown) => void {
-  return (attempt, delayMs, error) => {
-    const C = io.palette;
-    // A retry that prints nothing is indistinguishable from a hang, which is
-    // the problem retrying was supposed to remove rather than one to add.
-    io.say(
-      C.yellow(`  retry ${attempt} in ${(delayMs / 1000).toFixed(1)}s`) +
-        C.dim(`  ${describeError(error)}`),
-    );
-  };
-}
-
-export function toolSelectionOf(args: Args) {
-  return {
-    profile: args.toolProfile ?? "coding",
-    ...(args.noTools ? { none: true as const } : {}),
-    ...(args.tools !== undefined ? { only: args.tools } : {}),
-    ...(args.excludeTools.length > 0 ? { exclude: args.excludeTools } : {}),
-    ...(args.noBuiltinTools === true ? { noBuiltin: true as const } : {}),
-  };
-}
-
-export function processPermissionRules(args: Args, foundation?: FoundationRuntime, hostRules?: readonly PermissionRule[]): PermissionRule[] {
-  const configured = [...args.role?.profile.permissions ?? [], ...foundation?.permissions ?? []];
-  return [...(args.yolo ? configured.filter(rule => rule.action === "deny") : configured), ...(hostRules ?? rulesWithAllowTools(args.allowTools, { yolo: args.yolo }))];
-}
-
-/**
- * Schema assembly: every tool is tagged with a source here so
- * `--no-builtin-tools` can drop a category without a later cross-layer
- * recut. Optional extension descriptors remain local until selected; their
- * harness-owned discovery entry belongs to that extension-enabled capability set.
- *
- * `source` is stripped before the frozen prefix: the wire schema is what
- * the provider bills, and an extra field there would look like a tool
- * argument.
- */
-export function sessionToolCatalog(args: Args, extensions?: ExtensionRegistry, previous: readonly unknown[] = [], builtinDefaults?: readonly string[]) {
-  const custom = [...extensions?.definitions().values() ?? []].map(tool => ({ ...tool, source: extensions?.builtinTools.has(tool.name) ? "builtin" as const : "extension" as const }));
-  // O.7/D6: a cold app open uses saved capabilities as defaults, never today's profile.
-  // Explicit selection still wins; extension loading and current exclusions remain live.
-  const retained = builtinDefaults !== undefined && args.tools === undefined && args.toolProfile === undefined ? new Set(builtinDefaults) : undefined;
-  const available = [...TOOL_DEFINITIONS.filter(tool => !extensions?.tools.has(tool.name) &&
-    (retained === undefined ? !tool.optional || args.tools?.includes(tool.name) : retained.has(tool.name))).map((t) => ({ ...t, source: "builtin" as const })),
-    ...custom.filter(tool => tool.source !== "builtin" || retained === undefined || retained.has(tool.name))];
-  const admitted = new Set(workflowToolNames(available, args.workflow ?? "build"));
-  const selected = selectTools(available, { ...toolSelectionOf(args), ...(retained ? { profile: "full" as const } : {}) }).filter(tool => admitted.has(tool.name));
-  const deferred = selected.filter(tool => tool.source === "extension" && extensions?.tools.get(tool.name)?.exposure === "deferred")
-    .map(({ name, description, input_schema }) => ({ name, description, input_schema }));
-  const deferredNames = new Set(deferred.map(tool => tool.name));
-  const active = new Set([...declaredToolNames(previous), ...args.tools ?? []]);
-  const visible = selected.filter(tool => (!deferredNames.has(tool.name) || active.has(tool.name)) &&
-    (tool.name !== DISCOVERY_TOOL_NAME || deferred.length > 0 || args.tools?.includes(DISCOVERY_TOOL_NAME)));
-  // A cold open must not reorder an already accepted declaration and invent a checkpoint.
-  const order = new Map(declaredToolNames(previous).map((name, index) => [name, index]));
-  visible.sort((a, b) => (order.get(a.name) ?? Infinity) - (order.get(b.name) ?? Infinity));
-  const builtins = visible.filter(tool => tool.source === "builtin").map(tool => tool.name);
-  const schemas = visible.map(tool => tool.source === "builtin" ? modelToolSchema(tool, builtins)
-    : { name: tool.name, description: tool.description, input_schema: tool.input_schema });
-  // D6: extension authors retain their registration objects and SDK catalog views.
-  // Neither may mutate the already frozen provider declaration through an alias.
-  return { schemas: JSON.parse(JSON.stringify(schemas)) as typeof schemas,
-    deferred: JSON.parse(JSON.stringify(deferred)) as typeof deferred };
-}
-export function visibleSchemas(args: Args, extensions?: ExtensionRegistry, previous: readonly unknown[] = []) {
-  return sessionToolCatalog(args, extensions, previous).schemas;
-}
-
-export function unknownToolNames(names: readonly string[]): string[] {
-  const known = new Set(TOOL_DEFINITIONS.map((t) => t.name));
-  return names.filter((n) => !known.has(n));
-}
-
-export function createSessionFor(opts: {
-  args: Args;
-  workspace: string;
-  logDir: string;
-  blobDir: string;
-  system: string;
-  providerConfig: ProviderConfig;
-  credential: Resolved;
-  io: AppIO;
-  askSlot: AskSlot;
-  oauth?: boolean;
-  effects?: ResolveEffects;
-  extensions?: ExtensionRegistry;
-  foundation?: FoundationRuntime;
-  acceptanceContract?: AcceptanceContract;
-  blindChecks?: BlindChecks;
-  skills?: readonly Skill[];
-}): Session {
-  const { args, workspace, logDir, blobDir, system, providerConfig, credential, io, askSlot } = opts;
-  const { schemas, deferred } = sessionToolCatalog(args, opts.extensions);
-  const names = schemas.map((t) => t.name);
-  const sessionRules: PermissionRule[] = [];
-  const tools: ToolContext = {
-    root: workspace,
-    ...DEFAULT_TOOL_CONTEXT,
-    workflowMode: args.workflow ?? "build",
-    appOwnsPermissions: true,
-    ...(opts.foundation ? { questionSlot: opts.foundation.questionSlot,
-      instructionCheck: (ctx: ToolContext, name: string, input: unknown) => opts.foundation!.instructions(ctx, name, input, args.noContextFiles) } : {}),
-    ...(args.pathRoot === undefined ? {} : { pathRoot: args.pathRoot }),
-    allow: names,
-    deferredTools: deferred,
-    rules: processPermissionRules(args, opts.foundation),
-    sessionRules,
-    askSlot,
-    ...(opts.extensions ? { extensions: opts.extensions.definitions(), extensionHooks: opts.extensions.toolHooks() } : {}),
-  };
-  return new Session(
-    {
-      logDir,
-      frozen: { system, tools: schemas },
-      blobDir,
-      shellCheckpoints: args.shellCheckpoints === true,
-      tools,
-      maxTurns: args.maxTurns,
-      ...(args.agent ? { agentProfile: { name: args.agent, workflowExplicit: args.cliFlags?.includes("--workflow") === true } } : {}),
-      ...cliSessionConfig(args),
-      ...(opts.skills ? { skills: opts.skills } : {}),
-      ...(opts.acceptanceContract ? { acceptanceContract: opts.acceptanceContract } : {}),
-      ...(opts.blindChecks ? { blindChecks: opts.blindChecks } : {}),
-      // Explicit legacy thresholds still select that experiment unless overridden.
-      contextPolicy: args.contextPolicy ?? (args.trigger > 0 ? "segmented" : DEFAULT_CONTEXT_POLICY),
-      ...(args.trigger > 0
-        ? {
-            boundary: {
-              triggerTokens: args.trigger,
-              hardTokens: args.hard || args.trigger * 2,
-              // The work floor has to scale with the trigger: the two are
-              // validated against each other, and a default floor of 5000 under
-              // an experimental trigger of 1200 is a contradiction.
-              minNodeWorkTokens: Math.max(1, Math.floor(args.trigger / 6)),
-            },
-          }
-        : {}),
-    },
-    // Empty key is a placeholder the shell must not send through. Interactive
-    // startup reaches this path so /provider exists; run() refuses until a real
-    // credential is installed on the session.
-    createProvider(
-      providerConfig,
-      credential.ok ? credential.key : "",
-      retryHandler(io),
-      { sessionId: providerSessionId(logDir), ...(opts.oauth === true ? { oauth: true } : {}), ...(opts.effects ? { effects: opts.effects } : {}) },
-    ),
-    systemClock(),
-  );
-}
-
-/** One location policy for startup, /new, /resume and /fork. */
-export function sessionDirFor(args: Args, workspace: string): string | undefined {
-  if (args.sessionDir) return args.sessionDir;
-  return args.stateDir === undefined ? undefined : statePaths(workspace, args.stateDir).sessions;
-}
-
-type OpenSessionOptions = Omit<Parameters<typeof createSessionFor>[0], "providerConfig" | "credential" | "oauth" | "system"> & {
-  startupPhase?: (name: string) => void;
-  catalog: readonly ModelSpec[];
-  auth: AuthFile;
-  credentialOf: (spec: ModelSpec) => Resolved;
-  interactive: boolean;
-  settings?: Settings;
-  /** CLI overrides belong to this open only; /resume must not inherit them. */
-  modelFlags?: { model: string; provider: string };
-  preparedResources?: { workspace: string; value: Awaited<ReturnType<typeof loadSessionResources>> };
-  fallback?: ProviderConfig;
-  projectTrusted?: boolean;
-};
-
-/** Pi replaces cwd-scoped resources with the session runtime; publish only after all reads succeed. */
-async function prepareExtensionPackages(args: Args, workspace: string): Promise<void> {
-  const remote=(args.extensionPaths??[]).filter(path=>/^(npm:|git:|git\+|https?:\/\/|ssh:\/\/|git@)/.test(path));
-  if(!remote.length)return;
-  if(args.offline || process.env["XENO_OFFLINE"] === "1") throw new Error("--offline prevents remote extension package preparation; install it explicitly beforehand");
-  const manager=new PackageManager({workspace});
-  for(const source of remote)(args.packagePaths??=[]).push({source,path:await manager.temporary(source)});
-  args.extensionPaths=(args.extensionPaths??[]).filter(path=>!remote.includes(path));
-}
-
-export async function loadSessionResources(args: Args, workspace: string, io: AppIO, trustOverride?: boolean, questionSlot?: import("../runtime/question-tool.ts").QuestionSlot): Promise<{
-  loadedContext: LoadedContext; slash: SlashCatalog; ui: UiState; index: ResourceIndex; trusted: boolean; system: string; extensions: ExtensionRegistry; foundation: FoundationRuntime;
-}> {
-  const { trusted } = await projectTrust(workspace, trustOverride ?? args.approve);
-  const profiles = await loadAgentProfileLayers({ workspace, trustProject: trusted });
-  for (const diagnostic of profiles.diagnostics) io.say(diagnostic);
-  if (args.agent) {
-    if (!args.agentBase) args.agentBase = { model: args.model, provider: args.provider, thinking: args.thinking ?? "", maxTurns: args.maxTurns, excludeTools: [...args.excludeTools], noTools: args.noTools, noBuiltinTools: args.noBuiltinTools,
-      ...(args.tools ? { tools: [...args.tools] } : {}), ...(args.toolProfile ? { toolProfile: args.toolProfile } : {}), ...(args.timeBudgetMs ? { timeBudgetMs: args.timeBudgetMs } : {}), ...(args.workflow ? { workflow: args.workflow } : {}) };
-    const explicitWorkflow = args.cliFlags?.includes("--workflow") ? args.workflow : undefined;
-    delete args.tools; delete args.toolProfile; delete args.timeBudgetMs; delete args.workflow;
-    Object.assign(args, args.agentBase);
-    if (explicitWorkflow) args.workflow = explicitWorkflow;
-    if (profiles.diagnostics.length) throw Error("Agent profile configuration is invalid; fix the reported file before selecting a role");
-    const role = resolveAgentProfile(args.agent, [builtinAgentProfileLayer(), ...profiles.layers]);
-    if (!role) throw Error(`Unknown agent profile: ${args.agent}`);
-    args.role = role;
-    const profile = role.profile, explicit = (name: string) => args.cliFlags?.includes(name) === true;
-    if (profile.mode && !explicit("--workflow")) args.workflow = profile.mode;
-    if (profile.model) { if (!explicit("--model") && !explicit("-m")) args.model = profile.model.id; if (!explicit("--provider")) args.provider = profile.model.provider; if (profile.model.thinking && !explicit("--thinking")) args.thinking = profile.model.thinking; }
-    if (profile.tools?.profile && !explicit("--tool-profile")) args.toolProfile = profile.tools.profile;
-    if (profile.tools?.only && !explicit("--tools") && !explicit("-t")) args.tools = [...profile.tools.only];
-    if (profile.tools?.exclude && !explicit("--exclude-tools") && !explicit("-xt")) args.excludeTools = [...profile.tools.exclude];
-    if (profile.tools?.none !== undefined && !explicit("--no-tools")) args.noTools = profile.tools.none;
-    if (profile.tools?.noBuiltin !== undefined && !explicit("--no-builtin-tools")) args.noBuiltinTools = profile.tools.noBuiltin;
-    if (profile.budget?.maxTurns && !explicit("--max-turns")) args.maxTurns = profile.budget.maxTurns;
-    if (profile.budget?.timeBudgetMs && !explicit("--time-budget")) args.timeBudgetMs = profile.budget.timeBudgetMs;
-  }
-  const foundationConfig = await readFoundationConfig(configDir(), workspace, trusted);
-  if (args.clientMcp) { const { parseMcpServers } = await import("../core/mcp-config.ts"); foundationConfig["mcp"] = { ...parseMcpServers(foundationConfig["mcp"]), ...args.clientMcp }; }
-  const foundation = new FoundationRuntime(workspace, foundationConfig, args.offline === true || process.env["XENO_OFFLINE"] === "1", configDir(), questionSlot);
-  await prepareExtensionPackages(args,workspace);
-  const index = await discoverResources({ ...args, workspace, trusted });
-  const extensions = new ExtensionRegistry({ reserved: COMMANDS.map(command => command.name), reservedFlags: KNOWN_FLAGS.map(flag => flag.replace(/^-+/, "")),
-    flagValue: (name, definition) => args.extensionFlags && Object.hasOwn(args.extensionFlags, name) ? args.extensionFlags[name] : extensionFlagValue(name, definition, args.extensionInputs && Object.hasOwn(args.extensionInputs, name) ? args.extensionInputs[name] : undefined), report: io.say });
-  extensions.own(() => foundation.dispose());
-  try {
-  await foundation.register(extensions);
-  await extensions.load(index);
-  if(args.extensionArgv) {
-    const validated = parseArgs(args.extensionArgv, { flags: extensions.flags, ...(args.help ? { deferExtensions: true } : {}) });
-    if (validated.extensionArgv) rejectUnknownFlag("--" + Object.keys(validated.extensionInputs ?? {})[0]);
-    args.prompt = validated.prompt; args.extensionFlags = validated.extensionFlags ?? {};
-  }
-  const loaded = await loadUiResources({ ...args, workspace, trusted, ...(args.theme ? { theme: args.theme } : {}) }, index);
-  const instructionRoot = await resolveContextWorkspace(workspace);
-  const loadedContext = await loadContext({ workspace: instructionRoot, cwd: workspace, configDir: configDir(),
-    noContextFiles: args.noContextFiles, appendSystemPrompt: args.appendSystemPrompt,
-    ...(args.systemPrompt === null ? {} : { systemPrompt: args.systemPrompt }) });
-  for (const notice of loadedContext.notices) if (notice.kind === "skipped" || notice.truncated) io.say(io.palette.yellow(formatNotice(notice)));
-  const text = await loadTextResources({ workspace, configDir: configDir(), trusted, noSkills: args.noSkills,
-    noPromptTemplates: args.noPromptTemplates, skillPaths: args.skillPaths, promptTemplatePaths: args.promptTemplatePaths }, index);
-  const slash = resolveSlashCatalog(text.prompts, text.skills);
-  for (const line of new Set([...loaded.diagnostics, ...text.diagnostics, ...slash.diagnostics])) io.say(io.palette.yellow(`  ${line}`));
-  const system = appendSkillsToSystem(assembleSystemPrompt([systemPromptFor(visibleSchemas(args, extensions).map(tool => tool.name), sessionEnvironment(workspace)), workflowInstructions(args.workflow ?? "build"), args.role?.profile.instructions ?? "",
-    ...(args.outputSchema ? ["Return the final answer as JSON matching this schema. Do not use Markdown fences:\n" + JSON.stringify(await readOutputSchema(args.outputSchema))] : [])].filter(Boolean).join("\n\n"), loadedContext), text.skills);
-  const ui = toUiState(loaded, colorEnabled());
-  // Also reached on /resume and /reload: `auto` is resolved once per process by the Tui (apps/shell.ts), not here.
-  if (args.tuiMode) ui.settings = { ...ui.settings, tuiMode: args.tuiMode };
-  return { loadedContext, slash: { ...slash.catalog, skillExecution: true, skillCommands: loaded.settings.enableSkillCommands !== false }, ui, index, trusted, system, extensions, foundation };
-  } catch (error) { await extensions.dispose().catch(() => {}); throw error; }
-}
-
-/**
- * Pi's session-before-model order, with xeno's N.8 checkpoint on an explicit
- * model change. Opening never sends a request to the previous provider.
- * Callers publish the returned session/config/credential together on success.
- */
-export async function openSessionFor(opts: OpenSessionOptions): Promise<{
-  session: Session; priorCursor: Cursor | null; providerConfig: ProviderConfig; credential: Resolved;
-  workspace: string; blobDir: string; system: string; resources: Awaited<ReturnType<typeof loadSessionResources>>;
-}> {
-  const resourceSelector = () => JSON.stringify([opts.args.agent, opts.args.workflow, opts.args.toolProfile, opts.args.cliFlags]);
-  const preparedSelector = resourceSelector();
-  opts.startupPhase?.("Reading session history");
-  const recorded = await readCursor(opts.logDir);
-  const priorCursor = recorded === null ? null : await recoverCut(opts.logDir, recorded);
-  // A durable selector restores intent, while current trusted files supply code
-  // and permission authority. Missing/revoked project roles fail by name.
-  if (priorCursor?.context_ref) {
-    const savedContext = await getBlob(join(opts.logDir, "artifacts"), priorCursor.context_ref);
-    if (!savedContext) throw Error("missing frozen session context");
-    // S.3: the same parser Session.start uses; there is one reader of this format.
-    const saved = parseSessionContext(JSON.parse(savedContext));
-    const explicit = (...flags: string[]) => opts.args.cliFlags?.some(flag => flags.includes(flag)) === true;
-    if (saved.agentProfile) {
-      if (!explicit("--agent")) opts.args.agent = saved.agentProfile.name;
-      if (saved.agentProfile.workflowExplicit && saved.workflowMode && !explicit("--workflow")) {
-        opts.args.workflow = saved.workflowMode; opts.args.cliFlags = [...opts.args.cliFlags ?? [], "--workflow"];
-      }
-    } else if (saved.workflowMode && !explicit("--workflow")) opts.args.workflow = saved.workflowMode;
-    if (saved.workflowToolProfile && !explicit("--tool-profile", "--tools", "-t", "--no-tools", "--no-builtin-tools")) opts.args.toolProfile = "foundation";
-  }
-  const workspace = priorCursor?.workspace ?? opts.workspace;
-  if (opts.args.pathRoot) {
-    const rel = relative(opts.args.pathRoot, workspace);
-    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error("saved workspace is outside --path-root");
-  }
-  const reusePrepared = opts.preparedResources?.workspace === workspace && preparedSelector === resourceSelector();
-  if (opts.preparedResources && !reusePrepared) await opts.preparedResources.value.extensions.dispose();
-  opts.startupPhase?.("Loading session resources");
-  const resources = opts.preparedResources && reusePrepared ? opts.preparedResources.value
-    : await loadSessionResources(opts.args, workspace, opts.io, workspace === opts.workspace ? opts.projectTrusted : undefined);
-  let openedSession: Session | undefined;
-  try {
-  const interactive = opts.interactive && !opts.args.print && !opts.args.prompt && opts.args.mode !== "json";
-  const named = [...opts.args.tools ?? [], ...opts.args.excludeTools, ...opts.args.allowTools];
-  const unknown = unknownToolNames(named).filter(name => !resources.extensions.definitions().has(name));
-  if (unknown.length) throw new Error(`unknown tool: ${unknown.join(", ")}`);
-  const saved = priorCursor === null ? undefined : restoreSessionModel(priorCursor, opts.catalog);
-  const flags = { ...opts.modelFlags ?? { model: "", provider: "" } };
-  if (opts.args.agent) { flags.model = opts.args.model; flags.provider = opts.args.provider; }
-  const parsedModel = flags.model ? scopedModels([flags.model], flags.provider ? opts.catalog.filter(model => model.provider === flags.provider) : opts.catalog, true).entries[0] : undefined;
-  if (parsedModel) flags.model = modelKey(parsedModel.model);
-  const explicit = flags.model.length > 0 || flags.provider.length > 0;
-  const settings = opts.settings ?? {};
-  const preferred = saved ?? opts.fallback?.spec;
-  opts.startupPhase?.("Resolving model credentials");
-  const selected = !explicit && preferred !== undefined
-    ? { ok: true as const, spec: preferred }
-    : selectModel(settings, flags, (spec) => opts.credentialOf(spec).ok, opts.catalog);
-  let spec: ModelSpec;
-  if (selected.ok) spec = selected.spec;
-  else {
-    const missingAll = selected.reason.startsWith("no model has a credential");
-    if (!missingAll || !interactive) {
-      throw new Error(missingAll ? describeUnauthenticatedScript(opts.catalog) : selected.reason);
-    }
-    const fallback = selectModel(settings, flags, () => true, opts.catalog);
-    if (!fallback.ok) throw new Error(fallback.reason);
-    spec = fallback.spec;
-  }
-  const credential = opts.credentialOf(spec);
-  if (!credential.ok && !interactive) {
-    throw new Error(credential.reason.startsWith("no credential for ")
-      ? missingCredentialMessage(spec, explicit || saved !== undefined, opts.catalog) : credential.reason);
-  }
-  const explicitEffort = asThinkingLevel(opts.args.thinking), requestedEffort = explicitEffort ?? parsedModel?.thinking;
-  if (opts.args.thinking && (!explicitEffort || !supportedThinkingLevels(spec).includes(explicitEffort))) {
-    throw new Error(`thinking ${opts.args.thinking} is not supported by ${modelKey(spec)}; supported: ${supportedThinkingLevels(spec).join(", ")}`);
-  }
-  const providerConfig: ProviderConfig = {
-    spec, maxTokens: outputTokenBudget(spec),
-    effort: clampThinkingLevel(spec, requestedEffort ?? asThinkingLevel(priorCursor?.thinking) ??
-      settings.modelThinkingLevels?.[modelKey(spec)] ?? opts.fallback?.effort ?? asThinkingLevel(settings.defaultThinking) ??
-      asThinkingLevel(settings.thinking) ?? DEFAULT_PROVIDER.effort),
-    thinkingDisplay: opts.fallback?.thinkingDisplay ?? DEFAULT_PROVIDER.thinkingDisplay,
-  };
-  const restoring = saved ?? spec;
-  const restoringCredential = saved === undefined ? credential : opts.credentialOf(restoring);
-  const oauth = (model: ModelSpec, got: Resolved) => got.ok && storedIsOAuth(opts.auth, model.provider) && opts.args.apiKey.length === 0;
-  const acceptanceContract = priorCursor === null
-    ? await loadAcceptanceContract(workspace, resources.trusted, opts.args.acceptanceFile) : undefined;
-  // Frozen at session start like the contract; a resumed session reads its own copy from the saved context.
-  const blindChecks = priorCursor === null && opts.args.blindChecks ? await loadBlindChecks(opts.args.blindChecks, workspace) : undefined;
-  const session = createSessionFor({
-    ...opts,
-    system: resources.system,
-    extensions: resources.extensions,
-    foundation: resources.foundation,
-    skills: [...resources.slash.skills.values()],
-    ...(acceptanceContract ? { acceptanceContract } : {}),
-    ...(blindChecks ? { blindChecks } : {}),
-    workspace: priorCursor?.workspace ?? opts.workspace,
-    blobDir: priorCursor?.blob_dir ?? (priorCursor?.workspace && priorCursor.workspace !== opts.workspace
-      ? statePaths(priorCursor.workspace, opts.args.stateDir).blobs : opts.blobDir),
-    providerConfig: { ...providerConfig, spec: restoring, maxTokens: outputTokenBudget(restoring) },
-    credential: restoringCredential,
-    ...(oauth(restoring, restoringCredential) ? { oauth: true } : {}),
-  });
-  openedSession = session;
-  opts.startupPhase?.("Opening session history");
-  await session.start();
-  const requestedWorkflow = opts.args.workflow;
-  if (requestedWorkflow === undefined && session.config.tools.workflowMode) opts.args.workflow = session.config.tools.workflowMode;
-  if (opts.args.outputSchema) session.config.validateOutput = outputValidator(await readOutputSchema(opts.args.outputSchema));
-  resources.slash = { ...resources.slash, skills: new Map((session.config.skills ?? []).map(skill => [skill.name, skill])) };
-  const restoredTools = sessionToolCatalog(opts.args, resources.extensions, session.config.frozen.tools,
-    priorCursor === null ? undefined : declaredToolNames(session.config.frozen.tools));
-  const refreshResources = opts.args.agent !== undefined || opts.args.outputSchema !== undefined || opts.args.cliFlags?.includes("--workflow") === true || resources.extensions.loaded.length > 0 || session.config.frozen.tools.some(tool =>
-    typeof tool === "object" && tool !== null && "name" in tool && typeof tool.name === "string" && unknownToolNames([tool.name]).length);
-  const explicitTools = requestedWorkflow !== undefined || opts.args.agent !== undefined || opts.args.tools !== undefined || opts.args.toolProfile !== undefined || opts.args.noTools ||
-    opts.args.noBuiltinTools || opts.args.excludeTools.length > 0;
-  const previousMode = session.config.tools.workflowMode, previousProfile = session.config.agentProfile, previousScope = session.config.workflowToolProfile;
-  session.config.tools.workflowMode = opts.args.workflow ?? "build";
-  if (opts.args.agent) session.config.agentProfile = { name: opts.args.agent, workflowExplicit: opts.args.cliFlags?.includes("--workflow") === true };
-  if (opts.args.toolProfile === "foundation") session.config.workflowToolProfile = "foundation"; else delete session.config.workflowToolProfile;
-  const metadataChanged = previousMode !== session.config.tools.workflowMode || JSON.stringify(previousProfile) !== JSON.stringify(session.config.agentProfile) || previousScope !== session.config.workflowToolProfile;
-  if (refreshResources || (priorCursor !== null && (explicitTools || metadataChanged))) {
-    await session.reloadResources({ system: refreshResources ? resources.system : session.config.frozen.system, tools: restoredTools.schemas }, undefined, undefined, metadataChanged);
-  }
-  // Admission follows this app's selected declaration; current process approval rules stay intact.
-  // Keep this out of Session.start(): an SDK caller can intentionally supply a narrower allowlist.
-  session.config.tools.allow = declaredToolNames(session.config.frozen.tools);
-  session.config.tools.workflowMode = opts.args.workflow ?? "build";
-  session.config.tools.deferredTools = restoredTools.deferred;
-  if (restoring.id !== spec.id || restoring.provider !== spec.provider) {
-    const cut = await session.switchModel(createProvider(providerConfig, credential.ok ? credential.key : "", retryHandler(opts.io),
-      { sessionId: providerSessionId(session.config.logDir), ...(oauth(spec, credential) ? { oauth: true } : {}), ...(opts.effects ? { effects: opts.effects } : {}) }));
-    opts.io.say(opts.io.palette.yellow(`  switched ${restoring.id} → ${spec.id}${cut ? " at a model checkpoint" : ""}`));
-  }
-  resources.ui.settings = { ...resources.ui.settings, thinking: providerConfig.effort,
-    ...(opts.args.modelsExplicit || opts.args.models ? { scopedModels: splitModelPatterns(opts.args.models) } : {}) };
-  if (resources.ui.settings.scopedModels) for (const warning of scopedModels(resources.ui.settings.scopedModels, opts.catalog).diagnostics) opts.io.say(`  ${warning}`);
-  return { session, priorCursor, providerConfig, credential, workspace: session.config.tools.root,
-    blobDir: session.config.blobDir ?? opts.blobDir, system: session.config.frozen.system, resources };
-  } catch (error) {
-    await openedSession?.dispose().catch(() => {});
-    await resources.extensions.dispose().catch(() => {});
-    throw error;
-  }
-}
-
-export async function startup(args: Args, input?: StartupInput): Promise<App> {
-  const withTerminal = <T>(run: (handoff: () => void) => Promise<T>): Promise<T> => input ? input.runWithTerminal(run) : run(() => {});
-  if (args.extensionArgv && (args.listModels || args.modelsCommand || args.configCommand)) rejectUnknownFlag("--" + Object.keys(args.extensionInputs ?? {})[0]);
-  const C = createPalette(colorEnabled());
-  let printMode = isPrintMode(args);
-  const jsonMode = isJsonMode(args);
-  if ((args.mode ?? "").length > 0 && args.mode !== "json" && args.mode !== "text") {
-    console.error(`unknown --mode ${args.mode} (supported: text, json)`);
-    process.exit(1);
-  }
-  let divert = printMode || jsonMode;
-  const io: AppIO = {
-    palette: C,
-    say: (line) => (divert ? console.error(line) : console.log(line)),
-    err: (line) => console.error(line),
-    ...(printMode && !jsonMode
-      ? {
-          answer: (text: string) => {
-            process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
-          },
-        }
-      : {}),
-  };
-  const refreshOutputMode = () => {
-    printMode = isPrintMode(args); divert = printMode || jsonMode;
-    if (printMode && !jsonMode) io.answer = text => { process.stdout.write(text.endsWith("\n") ? text : `${text}\n`); };
-    else delete io.answer;
-  };
-  const effects = processEffects();
-
-  const authRead = await readJsonFile<AuthFile>(authPath());
-  if (authRead.error) io.say(C.yellow(`  ${authRead.error}`));
-  const auth: AuthFile = authRead.value ?? {};
-
-  if (args.modelsCommand) {
-    if (!args.modelsRefresh) {
-      io.say("usage: xeno models --refresh");
-      io.say(C.dim("  fetches models.dev into ~/.xeno/models.json; startup never does this."));
-      process.exit(0);
-    }
-    if (args.offline || process.env["XENO_OFFLINE"] === "1") throw new Error("--offline prevents catalog refresh");
-    const result = await runModelsRefresh({
-      fetch: globalThis.fetch,
-      write: writeCatalogCache,
-    });
-    if (result.ok) {
-      io.say(`  added ${result.added}, changed ${result.changed} (${result.count} total) → ${catalogCachePath()}`);
-      process.exit(0);
-    } else {
-      io.say(C.yellow(`  ${result.reason}`));
-      io.say(C.dim("  existing models.json left unchanged"));
-      process.exit(1);
-    }
-  }
-
-  // File only. Passing fetch here would make the test of D16 un-runnable.
-  input?.phase("Loading model catalog");
-  const loaded = loadCatalog(await readModelSources());
-  for (const warning of loaded.warnings) io.say(C.yellow(`  ${warning}`));
-  const catalog = loaded.models;
-
-  const credentialOf = (spec: ModelSpec) => resolveCredential(spec, auth, args.apiKey, effects);
-
-  if (args.listModels) {
-    io.say(C.bold("models"));
-    const query = args.modelSearch?.toLowerCase();
-    for (const group of groupedModels(query ? catalog.filter(model => [modelKey(model), model.name].some(text => { let at=0; for(const char of text.toLowerCase()) if(char===query[at])at++; return at===query.length; })) : catalog)) {
-      io.say(C.bold(group.provider));
-      for (const spec of group.models) {
-        const got = credentialOf(spec);
-        const mark = got.ok ? C.green("ready") : C.dim("  --  ");
-        io.say(`  ${mark}  ${spec.id.padEnd(28)}${C.dim(spec.name.padEnd(28))}${whyNot(spec, got, auth, C)}`);
-      }
-    }
-    io.say(C.dim("\n  run one with  --model <id>"));
-    process.exit(0);
-  }
-
-  /**
-   * Resolving the workspace is the first thing that can fail, and it fails for
-   * ordinary reasons -- a typo in `-w`, a directory that was moved. Reported as
-   * a sentence rather than as a stat() stack trace.
-   *
-   * It has to happen before model selection so a trusted `.xeno/settings.json`
-   * can override the default model. Trust does not affect tools.
-   */
-  input?.phase("Opening workspace");
-  let workspace: string;
-  try {
-    workspace = await workspaceRoot(args.workspace);
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    io.err(C.red(`\n  cannot use ${args.workspace} as a workspace`));
-    io.err(C.dim(`  ${detail}\n`));
-    process.exit(1);
-  }
-  // A path root that does not contain the workspace would confine relative
-  // paths out of the very directory they resolve in.
-  if (args.pathRoot !== undefined) {
-    const rel = relative(args.pathRoot, workspace);
-    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-      io.err(C.red(`\n  --path-root ${args.pathRoot} does not contain the workspace ${workspace}\n`));
-      process.exit(1);
-    }
-  }
-
-  input?.phase("Preparing extensions and project settings");
-  await prepareExtensionPackages(args,workspace);
-  const trust = await projectTrust(workspace, args.approve);
-  let loadProjectSettings = trust.trusted;
-  if (args.configCommand) {
-    if (!stdinIsTty() || !stdoutIsTty()) {
-      const index = await discoverResources({ ...args, workspace, trusted: loadProjectSettings });
-      for (const entry of index.entries) io.say(`${entry.enabled ? "[x]" : "[ ]"} ${entry.kind} ${entry.scope}${entry.package?" · "+entry.package.source:""} ${entry.path}`);
-    } else await withTerminal(handoff => runResourceConfig({ ...args, workspace, trusted: loadProjectSettings }, handoff));
-    process.exit(0);
-  }
-  const hasProjectResources = (await Promise.all(["settings.json", "keybindings.json", "skills", "prompts", "themes", "extensions"].map(name => stat(join(workspace, ".xeno", name)).then(() => true, () => false)))).some(Boolean);
-  if (!args.help && hasProjectResources && args.approve === undefined && !trust.saved && trust.policy === "ask" && isInteractiveSession(args)) loadProjectSettings = await withTerminal(handoff => pickProjectTrust(workspace, handoff));
-  if (hasProjectResources && !loadProjectSettings) io.say(C.dim("  Project resources not loaded (project is not trusted). /trust changes resource trust; tool permissions are separate."));
-
-  // Resolve the resource owner before factories run. Parsing flags must not load a different cwd first.
-  let resourceWorkspace = workspace;
-  const prepareFlags = (args.extensionArgv && args.resume !== true) || args.help;
-  if (prepareFlags) {
-    const target = args.logDir || args.session || args.forkFrom || (typeof args.resume === "string" ? args.resume : undefined);
-    let resourceLog: string | undefined;
-    if (target) { const found = await findSessionByPrefix(workspace, target, sessionDirFor(args, workspace)); if (found.ok) resourceLog = found.session.path; }
-    else if (args.sessionId) resourceLog = join(sessionsDir(workspace, sessionDirFor(args, workspace)), args.sessionId);
-    else if (args.continueLatest) resourceLog = (await newestConversation(workspace, sessionDirFor(args, workspace)))?.path;
-    if (resourceLog) resourceWorkspace = (await readCursor(resourceLog))?.workspace ?? workspace;
-  }
-  input?.phase("Loading session resources");
-  const preparedResources = prepareFlags
-    ? { workspace: resourceWorkspace, value: await loadSessionResources(args, resourceWorkspace, io, resourceWorkspace === workspace ? loadProjectSettings : undefined) } : undefined;
-  if (args.help) { printCliHelp(preparedResources?.value.extensions.flags); await preparedResources?.value.extensions.dispose(); process.exit(0); }
-  refreshOutputMode();
-  const uiLoaded = preparedResources ? undefined : await loadUiResources({
-    ...args,
-    workspace,
-    trusted: loadProjectSettings,
-    ...(args.theme.length > 0 ? { theme: args.theme } : {}),
-  });
-  for (const line of uiLoaded?.diagnostics ?? []) io.say(C.yellow(`  ${line}`));
-  const ui = preparedResources?.value.ui ?? toUiState(uiLoaded!, colorEnabled());
-  const mergedSettings = ui.settings;
-  const scopedFromFlag = splitModelPatterns(args.models);
-  if (args.modelsExplicit || scopedFromFlag.length > 0) {
-    ui.settings = { ...ui.settings, scopedModels: scopedFromFlag };
-  }
-
-  const paths = statePaths(workspace, args.stateDir);
-  const sessionDir = sessionDirFor(args, workspace);
-  let sessionOpts: ResolveLogOpts = {
-    ...(args.logDir ? { explicit: resolve(args.logDir) } : {}),
-    fresh: args.fresh,
-    ...(args.continueLatest === undefined ? {} : { continueLatest: args.continueLatest }),
-    ...(args.noSession === undefined ? {} : { noSession: args.noSession }),
-    ...(args.session === undefined ? {} : { session: args.session }),
-    ...(args.sessionId === undefined ? {} : { sessionId: args.sessionId }),
-    ...(args.resume === undefined ? {} : { resume: args.resume }),
-    ...(args.forkFrom === undefined ? {} : { forkFrom: args.forkFrom }),
-    ...(sessionDir === undefined ? {} : { sessionDir }),
-  };
-  let logDir: string;
-  try {
-    if (planSessionEntry(sessionOpts).kind === "select") {
-      if (printMode || jsonMode || !stdinIsTty() || !stdoutIsTty()) {
-        throw new Error("--resume needs an interactive terminal. Pass -r <id> or --session <id> instead");
-      }
-      const picked = await withTerminal(handoff => pickStartupSession({ workspace, theme: ui.theme, say: io.say, keymap: ui.keymap,
-        ...(sessionDir === undefined ? {} : { sessionDir }) }, handoff));
-      if (picked === null) { io.say(C.dim("No session selected")); process.exit(0); }
-      sessionOpts = { explicit: picked };
-    }
-    const resolved = await resolveLogDir(workspace, sessionOpts);
-    logDir = resolved.logDir;
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    io.err(C.red(`\n  ${detail}\n`));
-    process.exit(1);
-  }
-  // Snapshots are on by default here. They are optional in the loop because a
-  // read-only branch has nothing to snapshot, but a session a person drives is
-  // exactly the one that will want to go back, and the content has to have been
-  // stored before the turn a person wants back -- it cannot be opted into after.
-  const blobDir = paths.blobs;
-  await mkdir(logDir, { recursive: true });
-  await mkdir(blobDir, { recursive: true });
-
-  // Resource ownership follows the resolved session workspace. openSessionFor
-  // loads and freezes it once; explicit reloads checkpoint a changed prefix (D6).
-  const visible = visibleSchemas(args);
-
-  const askSlot: AskSlot = {};
-  let opened: Awaited<ReturnType<typeof openSessionFor>>;
-  try {
-    opened = await openSessionFor({
-      args, workspace, logDir, blobDir, io, askSlot, catalog, auth, credentialOf, effects,
-      settings: mergedSettings, modelFlags: { model: args.model, provider: args.provider }, projectTrusted: loadProjectSettings,
-      ...(preparedResources ? { preparedResources } : {}),
-      interactive: isInteractiveSession(args),
-      ...(input ? { startupPhase: input.phase } : {}),
-    });
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    io.err(C.red(`\n  cannot start a session in ${workspace}`));
-    io.err(C.dim(`  ${detail}\n`));
-    process.exit(1);
-  }
-  const { session, priorCursor, providerConfig, credential } = opened;
-  refreshOutputMode();
-
-  const sessionName = args.sessionName;
-  if (sessionName !== undefined && sessionName.length > 0) {
-    const cursor = await readCursor(logDir);
-    if (cursor !== null) {
-      await writeCursor(logDir, { ...cursor, name: sessionName });
-    }
-  }
-
-  if (opened.resources.ui.settings.quietStartup !== true || args.verbose) printBanner(args, io, {
-    workspace: opened.workspace, logDir, providerConfig, credential, loadedContext: opened.resources.loadedContext, session, priorCursor, catalog,
-    keymap: opened.resources.ui.keymap,
-    skills: [...opened.resources.slash.skills.keys()],
-    prompts: [...opened.resources.slash.prompts.keys()],
-    tools: visible.map((t) => t.name),
-  });
-
-  return { args, logDir, auth, effects, credentialOf, catalog, io, askSlot, ...appSessionFields(opened) };
-}
-
-/** The banner's words for the shared limits; the loop acts at exactly these numbers. */
-export function boundaryDescription(policy: ContextPolicy, limits: ContextLimits): string {
-  switch (limits.kind) {
-    case "stop":
-    case "open":
-      return "continuous replay; stops at model window";
-    case "window":
-      return `windowed replay; prepare ${limits.prepare}, cut ${limits.trigger}, output reserved`;
-    case "segment":
-      return `${policy}${policy === "windowed" ? " (unknown window; fixed fallback)" : ""}; cut ${limits.trigger}, hard ${limits.hard}`;
-    default:
-      return assertNever(limits, "boundaryDescription");
-  }
-}
-
-function printBanner(
-  args: Args,
-  io: AppIO,
-  opts: {
-    workspace: string;
-    logDir: string;
-    providerConfig: ProviderConfig;
-    credential: Resolved;
-    loadedContext: LoadedContext;
-    session: Session;
-    priorCursor: Cursor | null;
-    catalog: readonly ModelSpec[];
-    keymap: Keymap;
-    skills: readonly string[];
-    prompts: readonly string[];
-    tools: readonly string[];
-  },
-): void {
-  const C = io.palette;
-  const {
-    workspace, logDir, providerConfig, credential, loadedContext, session, priorCursor, catalog,
-    keymap, skills, prompts, tools,
-  } = opts;
-  io.say(
-    C.bold("xeno") +
-      C.dim(`  ${providerConfig.spec.name}  effort=${providerConfig.effort}`) +
-      (credential.ok ? C.dim(`  key from ${credential.source}`) : C.yellow("  no credential")),
-  );
-  const header = formatStartupHeader({
-    model: providerConfig.spec.id,
-    workspace,
-    session: basename(logDir),
-    agents: loadedContext.agents.map((f) => f.path),
-    skills,
-    prompts,
-    tools,
-    keymap,
-    verbose: args.verbose === true,
-  });
-  for (const line of header) {
-    // The first header line is the model; the banner already named it.
-    if (line === providerConfig.spec.id) continue;
-    io.say(C.dim(line));
-  }
-  io.say(C.dim(`log        ${logDir}`));
-  for (const notice of loadedContext.notices) {
-    const line = formatNotice(notice);
-    io.say(notice.kind === "skipped" ? C.yellow(`  ${line}`) : C.dim(`  ${line}`));
-  }
-  const policy = session.config.contextPolicy ?? DEFAULT_CONTEXT_POLICY;
-  const limits = contextLimits({
-    policy,
-    contextWindow: session.provider.config.spec.contextWindow,
-    outputReserve: session.provider.config.maxTokens,
-    ...(session.config.boundary ? { boundary: session.config.boundary } : {}),
-  });
-  io.say(C.dim(`boundary   ${boundaryDescription(policy, limits)} (estimated tokens)`));
-  if (priorCursor !== null) {
-    const events = session.state.events.length;
-    io.say(
-      C.green(`resumed    node ${session.state.node}`) +
-        C.dim(`  ${events} event${events === 1 ? "" : "s"} in context, last ${priorCursor.updated_at}`),
-    );
-  }
-  if (!credential.ok) {
-    io.say(C.yellow(`  ${describeUnauthenticatedSession(catalog)}`));
-  }
-  io.say("");
-}
-
-export function printCliHelp(flags?: ReadonlyMap<string, ExtensionFlag>): void {
-      console.log(
-        "usage: xeno [-m <model>] [--provider <name>] [--api-key <key>]\n" +
-          "            [-w <workspace>] [--log <dir>] [--max-turns N]\n" +
-          "            [--context-policy windowed|segmented|continuous|adaptive]\n" +
-          "            [--trigger N --hard N] [--list-models] [--fresh]\n" +
-          "            [-c|--continue] [-r|--resume [id]] [--session path|id]\n" +
-          "            [--fork path|id] [--no-session] [--session-dir dir]\n" +
-          "            [-n|--name name] [--session-id id] [--version|-v]\n" +
-          "            [models --refresh]\n" +
-          "            [install|remove <source>... [--local]] [update [source] [--extensions]] [list]\n" +
-          "            [update --check]  Check for a newer xeno without installing (/update installs)\n" +
-          "            [config [--local]] [--export session [output.html]] [--offline]\n" +
-          "            [--system-prompt <text-or-file>] [--append-system-prompt <text>]\n" +
-          "            [--no-context-files|-nc]\n" +
-          "            [--tools names] [--exclude-tools names] [--no-tools]\n" +
-          "            [--tool-profile coding|readonly|research|data|foundation|full]\n" +
-          "            [--workflow build|plan] [--agent name]\n" +
-          "            [--output-schema schema.json] [--output-last-message file]\n" +
-          "            [--acceptance-file contract.json] [--blind-checks dir]\n" +
-          "            [--control-socket /private/directory/control.sock]\n" +
-          "            [--no-builtin-tools]\n" +
-          "            [--allow-tools names] [--yolo|-y] [--approve|--no-approve]\n" +
-          "            [--theme <name|path>] [--use-theme name] [--no-themes] [--thinking level] [--models patterns]\n" +
-          "            [--skill <path>] [--no-skills]\n" +
-          "            [--prompt-template <path>] [--no-prompt-templates]\n" +
-          "            [--extension <path>] [--no-extensions] [--extension-flag name=value]\n" +
-          "            [--mode text|json] [--tui-mode regular|fullscreen] [--verbose]\n" +
-          "            [-p <prompt>] [prompt...]\n\n" +
-          "  xeno app-server [session/model flags] runs the experimental JSONL control interface.\n" +
-          "  xeno app-server schema prints its versioned request schema without startup.\n" +
-          "  xeno acp [session/model flags] serves the standard ACP protocol over stdio.\n" +
-          "  xeno review [working|last-turn|branch <base>|commit <ref>] runs an independent read-only review.\n" +
-          "  --control-socket attaches local adapters to the same live session as the TUI.\n" +
-          "  /control opens goal, progress and context panels; XENO_PROGRAM_STATUS=auto|1|0 controls terminal status.\n\n" +
-          "  Starts a new session by default; --fresh is an explicit alias. Nothing is deleted.\n" +
-          "  -c continues the newest (or starts one); -r opens the session picker.\n" +
-          "  --session / -r <id> pick one (unique prefix only). Resume restores its model;\n" +
-          "  an explicit --model switches at a checkpoint before the next turn.\n" +
-          "  --no-session runs without writing .xeno/sessions/. --fork copies into a new one.\n" +
-          "  A leftover .xeno/log is not moved; continue it with --log .xeno/log.\n\n" +
-          "  With a prompt, runs it and exits. Without one, reads prompts from stdin.\n" +
-          "  Commands: " + COMMANDS.map(command => "/" + command.name).join("  ") + "\n\n" +
-          "  Credentials resolve in this order: --api-key, then ~/.xeno/auth.json,\n" +
-          "  then the provider's environment variable.\n" +
-          "  --system-prompt replaces the built-in instructions (text, or a file that exists).\n" +
-          "  --append-system-prompt appends; repeatable. -nc skips AGENTS.md discovery.\n" +
-          "  --tools is a strict allowlist; excluded tools leave the schema.\n" +
-          "  New sessions keep coding (10 tools); foundation adds the new basic workflows.\n" +
-          "  --agent build|plan selects foundation; full exposes the complete builtin catalog.\n" +
-          "  Plan admits read tools plus note/question; Build admits the selected capability set.\n" +
-          "  /agent selects named profiles from ~/.xeno/agents.json and trusted .xeno/agents.json.\n" +
-          "  foundation.json configures MCP, web search, formatters, LSP and resource permissions.\n" +
-          "  --output-schema validates final JSON without coercion; invalid output exits 1.\n" +
-          "  --output-last-message writes the accepted final answer after the owner completes.\n" +
-          "  --no-builtin-tools drops built-ins and keeps any other source; --tools still wins.\n" +
-          "  Shell entry points (exec_command, environment, bash, target) ask before they run.\n" +
-          "  --allow-tools exec_command skips asks for that tool for this process.\n" +
-          "  --yolo (-y) skips all tool approvals for this process, including resumed sessions.\n" +
-          "  Tool exclusions and path limits still apply; YOLO does not change project trust.\n" +
-          "  --time-budget <seconds> tells the model, once, when 75% of the run's wall-clock budget is used.\n" +
-          "  --state-dir <dir> keeps snapshots, observations and sessions out of the workspace.\n" +
-          "  --checkpoint-shell enables best-effort Git recovery for command changes; ignored files and external effects are excluded.\n" +
-          "  --path-root <dir> lets file tools reach absolute paths under <dir> (e.g. / in a container);\n" +
-          "  relative paths, fingerprints and /back stay in the workspace, so edits outside it are not rewound.\n" +
-          "  --approve loads .xeno/settings.json this run; --no-approve skips it.\n" +
-          "  Project trust does not affect tool execution.\n" +
-          "  --mode json writes one JSON object per event to stdout; diagnostics stay on stderr.\n" +
-          "  --verbose expands the startup header (AGENTS.md, skills, prompt templates).",
-      );
-  if (flags?.size) console.log("\nExtension CLI flags:\n" + [...flags].map(([name, flag]) => `  --${name}${flag.type === "string" ? " <value>" : ""}  ${flag.description ?? ""}`).join("\n"));
-}