@worca/app 1.4.0 → 1.5.0-rc.2

package/src/core/ask/tools.mjs

@@ -319,6 +319,20 @@ export function createAskTools(deps) {
     catch { return null; }
   };
 
+  // The person signed in to this chat on a shared sign-in (identity.mjs isSharedIdentity), else null.
+  const viewer = () => (typeof deps.viewer === 'string' && deps.viewer ? deps.viewer : null);
+  // A startedBy filter: lowercased; "me" resolves to the viewer, and is refused without a shared sign-in
+  // (on a local or one-person worca runs are not told apart by person).
+  const personFilter = (v, tool) => {
+    const raw = str(v);
+    if (!raw) return '';
+    if (raw.toLowerCase() === 'me') {
+      if (!viewer()) throw new AskToolError(`${tool}: "me" needs a per-person sign-in; this worca does not tell people apart — name the person, or leave startedBy out`);
+      return viewer().toLowerCase();
+    }
+    return raw.replace(/ \(this machine\)$/i, '').toLowerCase();
+  };
+
   const defs = [
     { name: 'list_projects',
       description: 'List the registered projects (key, name, path) and workspaces (id, name, member project keys). Use the key / id in the other tools.',
@@ -327,11 +341,15 @@ export function createAskTools(deps) {
       description: 'List the saved workflows with their ordered step groups (parallel agent nodes share a group) and feedback loops. Pick one by name, domain and steps.',
       inputSchema: SCHEMA.obj({}) },
     { name: 'list_runs',
-      description: 'Find past runs, newest first. Optional filters: projectKey OR workspaceId, status (e.g. done, running, error, stopped), query (title substring). limit defaults to 20, max 100.',
+      description: 'Find past runs, newest first. Optional filters: projectKey OR workspaceId, status (e.g. done, running, error, stopped), query (title substring), startedBy (the person who started the run, exactly as list_people names them, case-insensitive; "me" = the person signed in to this chat, only on a shared sign-in). Each row carries startedBy (a person, "local" for this machine, null before attribution). limit defaults to 20, max 100.',
       inputSchema: SCHEMA.obj({ projectKey: SCHEMA.s('project key from list_projects'), workspaceId: SCHEMA.s('workspace id from list_projects'),
-        status: SCHEMA.s('run status to match'), limit: SCHEMA.i('max results (1-100)', 1, L.listRunsMaxLimit), query: SCHEMA.s('case-insensitive title substring') }) },
+        status: SCHEMA.s('run status to match'), limit: SCHEMA.i('max results (1-100)', 1, L.listRunsMaxLimit), query: SCHEMA.s('case-insensitive title substring'),
+        startedBy: SCHEMA.s('who started the run (a name from list_people, or "me")') }) },
+    { name: 'list_people',
+      description: 'Who has started runs on this worca: one row per person (the name recorded when they started a run — a verified sign-in email, a trusted-header name, or the operator\'s declared name; "local" = runs started on this machine with no identity) with runs, lastRunAt and totalCostUsd, most active first. Optional scope: projectKey OR workspaceId. Runs from before attribution existed have no person and are not counted. Read-only; this machine\'s runs only (team-wide people are in get_team_metrics actor breakdowns).',
+      inputSchema: SCHEMA.obj({ projectKey: SCHEMA.s('project key from list_projects'), workspaceId: SCHEMA.s('workspace id from list_projects') }) },
     { name: 'get_run',
-      description: 'Read one run: its metadata and the user\'s original prompt. Give projectKey or workspaceId when known; without them the user-pinned scope (when the chat has one) is tried first, then the id is searched everywhere.',
+      description: 'Read one run: its metadata, the user\'s original prompt, startedBy (the person who started it), `scheduled` when a schedule started it, and `actions` — the people who acted on it (paused, resumed, stopped, answered its questions, continued past a cost cap, opened its PR, archived it) with when. Give projectKey or workspaceId when known; without them the user-pinned scope (when the chat has one) is tried first, then the id is searched everywhere.',
       inputSchema: SCHEMA.obj({ id: SCHEMA.s('run id (8 hex)'), projectKey: SCHEMA.s('scope to a project'), workspaceId: SCHEMA.s('scope to a workspace') }, ['id']) },
     { name: 'get_run_diff',
       description: 'Read the unified diff of a run, paged by byte offset (use nextOffset until truncated is false). Optional path = one file only. files[] lists every file with added/removed counts; credential files are omitted.',
@@ -575,7 +593,7 @@ export function createAskTools(deps) {
     // tool-list pin stays byte-identical. Every change is a card the user applies.
     ...(deps.models ? [
       { name: 'list_models',
-        description: 'The model catalog every picker, workflow node and Ask chat draws from: id, label, source (built-in | user | plugin | team policy), editable (a user entry — the only kind propose_model_change edits or removes), efforts, connection ("default" = the claude CLI\'s own login; "env" = the entry\'s ANTHROPIC_BASE_URL/… env points the CLI at an endpoint that speaks the Messages API; "provider" = worca\'s bridge forwards to a provider), and for a bridged model its provider, upstreamApi (anthropic passes through; openai-chat is translated), upstreamModel, capabilities (maxPromptTokens / maxOutputTokens …) and ready / notReady. A user entry adds its own config under entry: env (credential values masked; ${VAR} references readable), upstream (baseUrl, apiKey masked or ${VAR}, headers, capabilities) and cost. Read-only.',
+        description: 'The model catalog every picker, workflow node and Ask chat draws from: id, label, source (built-in | user | plugin | team policy), editable (a user entry — the only kind propose_model_change edits or removes), efforts, connection ("default" = the claude CLI\'s own login; "env" = the entry\'s ANTHROPIC_BASE_URL/… env points the CLI at an endpoint that speaks the Messages API; "provider" = worca\'s bridge forwards to a provider), and for a bridged model its provider, upstreamApi (anthropic passes through; openai-chat and openai-responses are translated), upstreamModel, capabilities (maxPromptTokens / maxOutputTokens / reasoningEfforts …) and ready / notReady. A user entry adds its own config under entry: env (credential values masked; ${VAR} references readable), upstream (baseUrl, apiKey masked or ${VAR}, headers, capabilities) and cost. Read-only.',
         inputSchema: SCHEMA.obj({}) },
       { name: 'get_providers',
         description: 'The providers that bridged models share (Settings › Providers): copilot (connected, login, accountType, termsCurrent — the notice acknowledgement, maxConcurrent), openai and anthropic (baseUrl, keySet, keySource "env" | "stored", keyRef when it is a ${VAR} reference, keyOptional — a local OpenAI-compatible endpoint needs no key, configured — the key resolves now, maxConcurrent). Never a key. Read-only.',
@@ -584,13 +602,13 @@ export function createAskTools(deps) {
         description: 'Check one provider now: openai / anthropic GET the endpoint\'s models list with the configured key (reachability + auth, and how many models it lists); copilot exchanges the sign-in for a Copilot token. Returns {ok:true, models?} or {ok:false, message}. The endpoint is contacted.',
         inputSchema: SCHEMA.obj({ provider: SCHEMA.s('copilot | openai | anthropic') }, ['provider']) },
       { name: 'list_copilot_models',
-        description: 'The chat models GitHub Copilot offers the signed-in account, for import: id (pass it to propose_model_change kind "import_copilot"), name, vendor, context and output limits, whether it is enabled in the account\'s Copilot settings, and inCatalog / catalogId (imports land as copilot-<id>). Fails when Copilot is not signed in. GitHub is contacted.',
+        description: 'The chat models GitHub Copilot offers the signed-in account, for import: id (pass it to propose_model_change kind "import_copilot"), name, vendor, context and output limits, whether it is enabled in the account\'s Copilot settings, and inCatalog / catalogId (imports land as copilot-<id>), and api — the wire protocol an import uses (anthropic, openai-chat or openai-responses). Fails when Copilot is not signed in. GitHub is contacted.',
         inputSchema: SCHEMA.obj({}) },
       { name: 'list_endpoint_models',
         description: 'Ask an OpenAI-compatible endpoint what it serves — llama.cpp\'s llama-server, Ollama, LM Studio, vLLM or a gateway — so a model can be added without typing ids or limits. baseUrl defaults to the openai provider\'s (get_providers); pass one to browse another server without saving it first. Returns server (llama.cpp | ollama | lmstudio | vllm | openai-compatible), baseUrl, warnings, and per model: id (pass it to propose_model_change kind "import_endpoint"), catalogId, inCatalog, kind (llm | embedding), servedContext — the window ONE request really gets, the only number a prompt limit may come from — trainedContext (what the model supports, often far larger), toolCalls, vision, reasoning, loaded, and importable / blocked. Read the warnings out: Ollama serves 4096 tokens by default whatever the model supports, and llama-server splits its -c across --parallel slots. The endpoint is contacted.',
         inputSchema: SCHEMA.obj({ baseUrl: SCHEMA.s('the endpoint\'s OpenAI base URL, e.g. http://127.0.0.1:11434/v1 (default: the openai provider\'s)') }) },
       { name: 'propose_model_change',
-        description: 'Propose a model catalog or provider change for the user to confirm — it never changes anything itself; the user sees a card with the before → after and applies or declines it. kind: "add_model" (model: {id, label?, efforts?, env?, cost?, upstream?} — a Messages-API endpoint by env: {ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN:"${VAR}", …}; through a provider by upstream: {provider: openai | anthropic | copilot, api: anthropic | openai-chat, model: <the id the endpoint expects>, baseUrl?, apiKey?: "${VAR}", headers?, capabilities?: {maxPromptTokens, maxOutputTokens, …}}; cost: {free:true} or {perMtok:{input, output, …}}), "edit_model" (id + model: the fields to change — env merges per key, null deletes a key; upstream merges into the current block, a null field removes it, capabilities merge per key; upstream:null drops the bridge), "remove_model" (id — workflow nodes that name it fall back to the default model), "provider" (provider + set: {baseUrl?, apiKey?: "${VAR}", maxConcurrent?, accountType?: individual | business | enterprise (copilot)}; null or "" clears a field), "import_copilot" (ids from list_copilot_models), "import_endpoint" (ids from list_endpoint_models, with its baseUrl when you passed one — each becomes a free, keyless entry carrying the window the server reports). Credentials are ${VAR} references to variables in worca\'s environment, never the value: a literal key is refused — the user pastes one in Settings › Providers. The Copilot sign-in and its notice are the user\'s, on the Providers card (Settings › Providers). Returns {ok:true, card} (card.warnings: what will still stop the model working) or {ok:false, errors} to fix and retry. Never claim a change was applied — the card says so when it happens.',
+        description: 'Propose a model catalog or provider change for the user to confirm — it never changes anything itself; the user sees a card with the before → after and applies or declines it. kind: "add_model" (model: {id, label?, efforts?, env?, cost?, upstream?} — a Messages-API endpoint by env: {ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN:"${VAR}", …}; through a provider by upstream: {provider: openai | anthropic | copilot, api: anthropic | openai-chat | openai-responses, model: <the id the endpoint expects>, baseUrl?, apiKey?: "${VAR}", headers?, capabilities?: {maxPromptTokens, maxOutputTokens, reasoning, reasoningEfforts?: the effort levels the model lists, …}}; cost: {free:true} or {perMtok:{input, output, …}}), "edit_model" (id + model: the fields to change — env merges per key, null deletes a key; upstream merges into the current block, a null field removes it, capabilities merge per key; upstream:null drops the bridge), "remove_model" (id — workflow nodes that name it fall back to the default model), "provider" (provider + set: {baseUrl?, apiKey?: "${VAR}", maxConcurrent?, accountType?: individual | business | enterprise (copilot)}; null or "" clears a field), "import_copilot" (ids from list_copilot_models), "import_endpoint" (ids from list_endpoint_models, with its baseUrl when you passed one — each becomes a free, keyless entry carrying the window the server reports). Credentials are ${VAR} references to variables in worca\'s environment, never the value: a literal key is refused — the user pastes one in Settings › Providers. The Copilot sign-in and its notice are the user\'s, on the Providers card (Settings › Providers). Returns {ok:true, card} (card.warnings: what will still stop the model working) or {ok:false, errors} to fix and retry. Never claim a change was applied — the card says so when it happens.',
         inputSchema: SCHEMA.obj({ kind: SCHEMA.s('add_model | edit_model | remove_model | provider | import_copilot'),
           id: SCHEMA.s('edit_model / remove_model: the catalog model id'),
           model: { type: 'object', description: 'add_model: the entry; edit_model: the fields to change', additionalProperties: true },
@@ -600,6 +618,14 @@ export function createAskTools(deps) {
           baseUrl: SCHEMA.s('import_endpoint: the endpoint listed, when it is not the provider\'s own'),
           note: SCHEMA.s('one line shown on the card: why this change (≤ 200 chars)') }, ['kind']) },
     ] : []),
+    ...(deps.clones ? [
+      { name: 'propose_clone_project',
+        description: 'Propose adding a project by cloning a repository into worca\'s projects folder, for the user to confirm — it never clones anything itself; the user sees a card with the URL, branch, target folder and how GitHub is reached, and applies or declines it. url: an https:// repository URL (https://github.com/owner/repo), no credentials in it. branch: optional (default: the repository\'s default branch). name: optional folder and project name (default: the repository name). Returns {ok:true, card} or {ok:false, errors} — fix the input and call again.',
+        inputSchema: SCHEMA.obj({ url: SCHEMA.s('https:// repository URL, e.g. https://github.com/acme/api'),
+          branch: SCHEMA.s('branch to check out (default: the repository default)'),
+          name: SCHEMA.s('folder and project name (default: the repository name)'),
+          note: SCHEMA.s('one line shown on the card: why (≤ 200 chars)') }, ['url']) },
+    ] : []),
   ];
 
   const EMPTY_DIFF = () => ({ available: false, files: [], text: '', truncated: false, totalBytes: 0, nextOffset: 0 });
@@ -673,8 +699,10 @@ export function createAskTools(deps) {
       prompt: row.prompt == null ? null : deps.redact(row.prompt),     // run prompts are untrusted text (spec §6.3/§6.6)
       totalCostUsd: deps.totalsFor(row).cost,
       archived: !!row.archived_at,
+      // The person who started it (identity.mjs; 'local' on a local install, null before attribution).
+      startedBy: row.started_by ?? null,
       // Started by a schedule (docs/scheduled-runs.md): only then, so every other run keeps its shape.
-      ...(row.scheduled_for || row.schedule_id ? { startedBy: { scheduledFor: row.scheduled_for ?? null, scheduleId: row.schedule_id ?? null } } : {}),
+      ...(row.scheduled_for || row.schedule_id ? { scheduled: { scheduledFor: row.scheduled_for ?? null, scheduleId: row.schedule_id ?? null } } : {}),
     };
   }
 
@@ -1093,7 +1121,17 @@ export function createAskTools(deps) {
     overlap: s.overlap, maxFailures: s.maxFailures, failureStreak: s.failureStreak, ifMissed: s.ifMissed, graceMin: s.graceMin,
     runsCount: s.runsCount, lastResult: s.lastResult, request: shapeRequest(s.summary),
     ...(s.askCardId ? { askCardId: s.askCardId } : {}),
+    ...peopleOf(s),
   });
+  // Who made / last changed a series or scheduled run (identity.mjs actors); absent when unknown, and
+  // 'local' is not a person, so it is left out too.
+  const peopleOf = (x) => {
+    const person = (v) => (typeof v === 'string' && v && v !== 'local' ? v : null);
+    const out = {};
+    if (person(x.createdBy)) out.createdBy = person(x.createdBy);
+    if (person(x.updatedBy)) out.updatedBy = person(x.updatedBy);
+    return out;
+  };
   const shapeTicket = (t) => {
     // Run chains (spec D11): a waiting after-ticket's run_at is the year-9999 sentinel — never a time to show.
     // The model sees what it waits for instead; `after.id` is a run id (get_run) or a scheduled run id (get_schedule).
@@ -1104,6 +1142,7 @@ export function createAskTools(deps) {
       after: t.after ? { kind: t.after.kind, id: t.after.id, policy: t.after.policy } : null, sourceFromPrevious: !!t.sourceFromPrevious,
       failReason: t.failReason ? deps.redact(t.failReason) : null, pipelineId: t.pipelineId, attempts: t.attempts,
       ifMissed: t.ifMissed, graceMin: t.graceMin, heldByTerminal: !!t.ownerPid, request: shapeRequest(t.summary),
+      ...peopleOf(t),
     };
   };
   const shapeNotice = (n) => ({
@@ -1252,6 +1291,7 @@ export function createAskTools(deps) {
       const status = str(input.status).toLowerCase();
       const query = str(input.query).toLowerCase();
       const limit = clampInt(input.limit, 1, L.listRunsMaxLimit, L.listRunsDefaultLimit);
+      const startedBy = personFilter(input.startedBy, 'list_runs');
       // Unkeyed: the newest runsScanLimit rows are enough. Keyed: scan everything — a
       // project's runs may all be older than the 200 globally newest (lite = one SQL
       // + one readdir per store key, no git).
@@ -1261,6 +1301,7 @@ export function createAskTools(deps) {
         if (wantKey && e.projectKey !== wantKey) continue;
         if (status && String(e.status ?? '').toLowerCase() !== status) continue;
         if (query && !String(e.title ?? '').toLowerCase().includes(query)) continue;
+        if (startedBy && String(e.startedBy ?? '').toLowerCase() !== startedBy) continue;
         const isWs = e.target === 'workspace' || String(e.projectKey).startsWith('workspaces/');
         out.push({
           id: e.id, title: deps.redact(e.title ?? e.id), target: isWs ? 'workspace' : 'project',
@@ -1271,6 +1312,7 @@ export function createAskTools(deps) {
           updatedAt: e.mtime ? new Date(e.mtime).toISOString() : null,
           branch: e.branch ?? null, sourceBranch: e.sourceBranch ?? null, guardrailsId: e.guardrailsId ?? null,
           totalCostUsd: e.totalCostUsd ?? null,
+          startedBy: e.startedBy ?? null,
         });
         if (out.length >= limit) break;
       }
@@ -1283,7 +1325,22 @@ export function createAskTools(deps) {
       // by the injected dep; a row-only bundle answers null and the shape stays byte-identical).
       const memory = typeof deps.readRunMemory === 'function' ? await deps.readRunMemory(row) : null;
       const policy = runPolicy(row);
-      return { ...run, hasDiff: !run.archived && await deps.hasDiffPatch(row), ...(memory ? { memory } : {}), ...(policy ? { policy } : {}) };
+      // Who acted on the run (pipeline_events.actor): only when anyone did, so other runs keep their shape.
+      const actions = typeof deps.readRunActions === 'function' ? await deps.readRunActions(row) : [];
+      return { ...run, hasDiff: !run.archived && await deps.hasDiffPatch(row), ...(memory ? { memory } : {}), ...(policy ? { policy } : {}),
+        ...(actions.length ? { actions: actions.map((a) => ({ at: a.at, by: a.by, what: deps.redact(a.what) })) } : {}) };
+    },
+    async list_people(input) {
+      const projectKey = str(input.projectKey);
+      const workspaceId = str(input.workspaceId);
+      if (projectKey && workspaceId) throw new AskToolError('list_people: give projectKey OR workspaceId, not both');
+      if (typeof deps.listPeople !== 'function') return [];
+      const rows = await deps.listPeople(workspaceId ? { workspaceKey: workspaceId } : projectKey ? { projectKey } : {});
+      return rows.map((r) => ({
+        name: r.name === 'local' ? 'local (this machine)' : r.name,
+        ...(viewer() && r.name.toLowerCase() === viewer().toLowerCase() ? { you: true } : {}),
+        runs: r.runs, lastRunAt: r.lastRunAt ?? null, totalCostUsd: Number(r.totalCostUsd || 0),
+      }));
     },
     // Read-only by contract: the parent process (ui/server.mjs askTrackRun, via the turn's onTrackRun hook) does the
     // linking and the following. A live run id lives only in the server's runs Map, so the child passes it through.
@@ -1881,6 +1938,10 @@ export function createAskTools(deps) {
       catch (err) { throw new AskToolError(`list_copilot_models: ${err && err.message ? err.message : err}`); }
     },
     async propose_model_change(input) { return modelsOf('propose_model_change').validateChange(input); },
+    async propose_clone_project(input) {
+      if (!deps.clones) throw new AskToolError('propose_clone_project: cloning is unavailable');
+      return deps.clones.validateChange(input);
+    },
     async save_script(input) {
       const s = scriptWriterOf('save_script');
       // The model's OWN text, on its way to disk: never redacted here (a redaction marker

package/src/core/ask/turn.mjs

@@ -27,6 +27,7 @@ import { validateProposal } from './proposal.mjs';
 import { validateMetricsChange } from './metrics-deps.mjs';
 import { validatePolicyChange } from './policy-deps.mjs';
 import { validateModelChange } from './model-deps.mjs';
+import { validateCloneProposal } from './clone-deps.mjs';
 import { validateScheduleChange } from './schedule-deps.mjs';
 import { lookupTask } from './source-deps.mjs';
 import { effectiveTimeZone } from './schedule-spec.mjs';
@@ -53,10 +54,13 @@ class AskTurn extends EventEmitter {
     pinnedScope = null,
     memoryProject = null,
     timeZone = null,
+    reader = null,
     deps = {},
   } = {}) {
     super();
     this.threadId = threadId;
+    // A shared sign-in's name (identity.mjs): the MCP child's per-person reads (notifications).
+    this.reader = typeof reader === 'string' && reader ? reader : null;
     this.assistantMessageId = assistantMessageId;
     this.userMessageId = userMessageId;
     this.prompt = prompt;
@@ -93,6 +97,7 @@ class AskTurn extends EventEmitter {
       validatePolicyChange: deps.validatePolicyChange ?? validatePolicyChange,
       validateScheduleChange: deps.validateScheduleChange ?? validateScheduleChange,
       validateModelChange: deps.validateModelChange ?? validateModelChange,
+      validateCloneProposal: deps.validateCloneProposal ?? validateCloneProposal,
       scheduleDefaults: deps.scheduleDefaults ?? scheduleDefaults,
       // A proposed plugin task is looked up here, once: it must exist, and the card shows its title.
       lookupTask: deps.lookupTask === undefined ? lookupTask : deps.lookupTask,
@@ -344,6 +349,30 @@ class AskTurn extends EventEmitter {
     this._persistBlocks();
   }
 
+  /**
+   * propose_clone_project RESULT: the model card's split — the child validated for the model, the parent
+   * re-validates the same INPUT (and adds how GitHub is reached) and mints the card. A child {ok:false}
+   * already reached the model as text: no card, no notice.
+   */
+  async _onCloneProposal(input, text, isError) {
+    if (isError) return;
+    let out = null;
+    try { out = JSON.parse(text); } catch { out = null; }
+    if (!out || out.ok !== true) return;
+    const d = this.deps;
+    try {
+      const r = await d.validateCloneProposal(input && typeof input === 'object' ? input : {});
+      if (r && r.ok) this.reducer.addBlock({ kind: 'card', id: d.newAskId('card'), state: 'proposed', card: r.card });
+      else {
+        const errors = (r && Array.isArray(r.errors) && r.errors.length) ? r.errors : ['invalid proposal'];
+        this.reducer.addBlock({ kind: 'notice', text: `Clone rejected: ${errors.join('; ')}` });
+      }
+    } catch (err) {
+      this.reducer.addBlock({ kind: 'notice', text: `Clone rejected: ${err?.message || err}` });
+    }
+    this._persistBlocks();
+  }
+
   /** The card exists from the tool_use on (spec §8.2, PD7): a building block with the four-step trace, persisted. */
   _onWorkflowStart(toolUseId, input) {
     const d = this.deps;
@@ -431,6 +460,7 @@ class AskTurn extends EventEmitter {
       onPolicyProposal: ({ input, text, isError }) => this._onPolicyProposal(input, text, isError),
       onScheduleProposal: ({ input, text, isError }) => this._onScheduleProposal(input, text, isError),
       onModelProposal: ({ input, text, isError }) => this._onModelProposal(input, text, isError),
+      onCloneProposal: ({ input, text, isError }) => this._onCloneProposal(input, text, isError),
       // pause / resume / skip / mark-read in the child → the server's schedules-changed frames.
       onScheduleMutation: (e) => { try { this.deps.onScheduleMutation(e); } catch { /* a broken sink never breaks the turn */ } },
       // The MCP child cannot broadcast; the parent turns its comment writes into
@@ -583,7 +613,7 @@ class AskTurn extends EventEmitter {
       mcpConfigPath = join(scratchDir, `mcp-${this.assistantMessageId}.json`);
       await d.fs.writeFile(
         mcpConfigPath,
-        JSON.stringify(d.buildMcpConfig({ homeBase, threadId: this.threadId, serverPath: d.serverPath }), null, 2),
+        JSON.stringify(d.buildMcpConfig({ homeBase, threadId: this.threadId, serverPath: d.serverPath, ...(this.reader ? { reader: this.reader } : {}) }), null, 2),
         'utf8',
       );
       // One 30-minute budget for the whole turn, retry included. The timedOut

package/src/core/bridge/errors.mjs

@@ -11,7 +11,7 @@ export const PAYLOAD_CEILING_BYTES = 2_500_000;
 /** The phrase Claude Code matches on to trigger its own compaction. */
 export const PROMPT_TOO_LONG = 'prompt is too long';
 
-const CONTEXT_RE = /context.?length|too long|maximum context|token limit|exceeds? .*tokens|too many tokens|request too large|payload too large/i;
+const CONTEXT_RE = /context.?length|too long|maximum context|token limit|exceeds? .*tokens|too many tokens|request too large|payload too large|exceeds the context window/i;
 
 /** Envelope for a status/type/message triple. */
 export function anthropicError(status, type, message) {
@@ -30,6 +30,51 @@ export function upstreamMessage(text) {
   return String(text).slice(0, 500);
 }
 
+/** The machine-readable code in an upstream error body ('' when there is none). */
+export function upstreamCode(text) {
+  if (!text) return '';
+  try {
+    const j = JSON.parse(text);
+    const e = j && (j.error || j);
+    return e && typeof e === 'object' && typeof e.code === 'string' ? e.code : '';
+  } catch { return ''; }
+}
+
+/** An upstream saying it serves this model through the other OpenAI protocol (Copilot: unsupported_api_for_model). */
+const UNSUPPORTED_API_RE = /not accessible via the \/(chat\/completions|responses) endpoint|does not support (the )?Responses API/i;
+
+/** The fix that refusal needs, per provider. */
+export function unsupportedApiFix(provider) {
+  return provider === 'copilot'
+    ? 'this model needs a different API: re-import it (Settings › Models › Import models…) or change its API in the model editor'
+    : 'this model needs a different API: change its API in the model editor';
+}
+
+/** Error codes for a prompt past the model's context window: OpenAI's, and Copilot's own limit check. */
+const CONTEXT_CODES = new Set(['context_length_exceeded', 'model_max_prompt_tokens_exceeded']);
+
+/** Whether an upstream error — by its code or its message — says the prompt overflowed the context window. */
+export function isContextOverflow(code, message) {
+  return CONTEXT_CODES.has(String(code || '')) || CONTEXT_RE.test(String(message || ''));
+}
+
+/** A code or wording that names another failure: a rate limit, a quota, a server error, a timeout. */
+const OTHER_FAILURE_RE = /rate.?limit|quota|server_error|overloaded|unavailable|timed? ?out|timeout|per min(ute)?\b|\bTPM\b/i;
+
+/**
+ * isContextOverflow for a failure reported inside an HTTP 200 — a Responses
+ * stream's response.failed / error, or a buffered body with status "failed".
+ * No status narrows it to a 400 there, so a code or wording that names another
+ * failure outranks CONTEXT_RE's broad phrases ("too long", "request too
+ * large"): a rate limit or a timeout must never make the CLI compact.
+ */
+export function isFailedResponseOverflow(code, message) {
+  const c = String(code || '');
+  const m = String(message || '');
+  if (CONTEXT_CODES.has(c)) return true;
+  return !OTHER_FAILURE_RE.test(c) && !OTHER_FAILURE_RE.test(m) && CONTEXT_RE.test(m);
+}
+
 /**
  * Map an upstream HTTP failure to the envelope.
  * @param {number} status  upstream status
@@ -47,9 +92,12 @@ export function mapUpstreamError(status, text, { provider = 'upstream', retryAft
     if (retryAfter) e.headers = { 'retry-after': String(retryAfter) };
     return e;
   }
-  if (status === 413 || (status === 400 && CONTEXT_RE.test(msg))) {
+  if (status === 413 || (status === 400 && isContextOverflow(upstreamCode(text), msg))) {
     return anthropicError(400, 'invalid_request_error', PROMPT_TOO_LONG);
   }
+  if (status >= 400 && status < 500 && (upstreamCode(text) === 'unsupported_api_for_model' || UNSUPPORTED_API_RE.test(msg))) {
+    return anthropicError(400, 'invalid_request_error', `${who}: ${msg || 'the model is not served through this API'} — ${unsupportedApiFix(who)}`);
+  }
   if (status === 404) {
     return anthropicError(400, 'invalid_request_error', `${who}: model or endpoint not found (404)${msg ? ` — ${msg}` : ''}`);
   }

package/src/core/bridge/provider-ops.mjs

@@ -11,10 +11,10 @@ import {
   copilotTermsAcknowledged, acknowledgeCopilotTerms, clearCopilotSignIn,
   listGlobalModels, addGlobalModel, updateGlobalModel,
 } from '../settings.mjs';
-import { modelEnvRef, maskModelEnvValue, COPILOT_TERMS_VERSION, UPSTREAM_PROVIDERS, isUpstreamBaseUrl } from '../model-env.mjs';
+import { modelEnvRef, maskModelEnvValue, COPILOT_TERMS_VERSION, UPSTREAM_PROVIDERS, isUpstreamBaseUrl, EFFORTS } from '../model-env.mjs';
 import {
   startDeviceFlow, pollDeviceFlow, githubLogin, copilotToken, invalidateCopilotToken,
-  listCopilotModels, copilotUsage, catalogEntryForCopilotModel,
+  listCopilotModels, copilotUsage, catalogEntryForCopilotModel, copilotApiFor,
 } from './providers/copilot.mjs';
 import { keyOptional } from './registry.mjs';
 import { listEndpointModels, catalogEntryForEndpointModel, importableModel } from './providers/endpoint.mjs';
@@ -139,14 +139,15 @@ export async function copilotModelsForImport({ fetch: f } = {}) {
   if (!token) throw Object.assign(new Error('not signed in to GitHub Copilot'), { code: 'NOT_SIGNED_IN' });
   const list = await listCopilotModels(token, { accountType: c.accountType, fetch: f });
   const have = new Set(listGlobalModels().map((m) => m.id.toLowerCase()));
-  return list.map((m) => ({ ...m, catalogId: `copilot-${m.id}`, inCatalog: have.has(`copilot-${m.id}`.toLowerCase()) }))
+  return list.map((m) => ({ ...m, api: copilotApiFor(m), catalogId: `copilot-${m.id}`, inCatalog: have.has(`copilot-${m.id}`.toLowerCase()) }))
     .sort((a, b) => (Number(b.pickerEnabled) - Number(a.pickerEnabled)) || a.name.localeCompare(b.name));
 }
 
 /**
  * Import Copilot models into the catalog (§8.4). A new id gets the full
- * import shape; an existing `copilot-*` id only has its capabilities (and api,
- * should the vendor route change) refreshed — a user-edited label, efforts or
+ * import shape; an existing `copilot-*` id has its api, upstream model and
+ * capabilities refreshed, and its efforts widened only when they are the old
+ * importer's automatic medium-only default — a user-edited label, efforts or
  * pricing is never overwritten.
  * @param {string[]} ids  Copilot model ids (not catalog ids)
  * @returns {Promise<{created:string[], updated:string[], skipped:string[]}>}
@@ -164,7 +165,19 @@ export async function importCopilotModels(ids, { fetch: f } = {}) {
     if (m.inCatalog) {
       const current = listGlobalModels().find((x) => x.id.toLowerCase() === entry.id.toLowerCase());
       if (!current || !current.upstream || current.upstream.provider !== 'copilot') { skipped.push(id); continue; }
-      await updateGlobalModel(current.id, { upstream: { ...current.upstream, api: entry.upstream.api, model: entry.upstream.model, capabilities: entry.upstream.capabilities } });
+      const patch = { upstream: { ...current.upstream, api: entry.upstream.api, model: entry.upstream.model, capabilities: entry.upstream.capabilities } };
+      // Before Copilot listed effort levels, a translated model the id regex missed
+      // was stored non-reasoning and trimmed to medium. Widen exactly that automatic
+      // default — never a list the user chose: a reasoning entry pinned to medium
+      // stays, and an Anthropic entry was never trimmed, so its medium is the user's.
+      const autoMediumOnly = current.upstream.api !== 'anthropic' && entry.upstream.api !== 'anthropic'
+        && Array.isArray(current.efforts) && current.efforts.length === 1 && current.efforts[0] === 'medium'
+        && !(current.upstream.capabilities && current.upstream.capabilities.reasoning === true);
+      if (autoMediumOnly) {
+        const next = entry.efforts === undefined ? [...EFFORTS] : entry.efforts;
+        if (!(next.length === 1 && next[0] === 'medium')) patch.efforts = next;
+      }
+      await updateGlobalModel(current.id, patch);
       updated.push(current.id);
     } else {
       await addGlobalModel(entry);
@@ -206,7 +219,7 @@ export async function endpointModelsForImport({ baseUrl, fetch: f } = {}) {
 
 /**
  * Import endpoint models into the catalog. A new id gets the full entry; an existing one keeps the
- * label, efforts and pricing you edited and only has its upstream refreshed — the Copilot rule.
+ * label, efforts and pricing you edited and only has its upstream refreshed.
  * @param {string[]} ids  model ids as the endpoint reports them (not catalog ids)
  * @returns {Promise<{created:string[], updated:string[], skipped:Array<{id:string, why:string}>, server:string, baseUrl:string}>}
  */

package/src/core/bridge/providers/copilot.mjs

@@ -12,6 +12,8 @@
 // Every network call takes an injectable `fetch` so the whole module is
 // testable against a stub without touching github.com.
 
+import { EFFORTS, REASONING_EFFORT_LEVELS } from '../../model-env.mjs';
+
 export const GITHUB_CLIENT_ID = 'Iv1.b507a08c87ecfe98';
 export const GITHUB_SCOPES = 'read:user';
 export const GITHUB_BASE = 'https://github.com';
@@ -84,7 +86,11 @@ export function bodyHasImage(body) {
 /** 'agent' when the last message continues a tool loop, else 'user' (§7.1). */
 export function requestInitiator(body) {
   const msgs = body && Array.isArray(body.messages) ? body.messages : [];
-  const last = msgs[msgs.length - 1];
+  // The CLI appends its mid-conversation system reminders AFTER the turn they
+  // ride on (…, user[tool_result], system): the turn is the last message before them.
+  let i = msgs.length - 1;
+  while (i >= 0 && msgs[i] && msgs[i].role === 'system') i -= 1;
+  const last = msgs[i];
   if (!last) return 'user';
   if (last.role === 'assistant') return 'agent';
   if (Array.isArray(last.content) && last.content.some((b) => b?.type === 'tool_result')) return 'agent';
@@ -190,7 +196,12 @@ export function normalizeCopilotModel(m) {
   const supports = caps.supports && typeof caps.supports === 'object' ? caps.supports : {};
   const limits = caps.limits && typeof caps.limits === 'object' ? caps.limits : {};
   const vendor = typeof m.vendor === 'string' ? m.vendor : '';
-  const reasoning = supports.reasoning_effort === true || supports.thinking === true || REASONING_ID_RE.test(m.id);
+  // Copilot lists a model's reasoning-effort levels (an array); older payloads sent `true`.
+  const efforts = Array.isArray(supports.reasoning_effort)
+    ? REASONING_EFFORT_LEVELS.filter((e) => supports.reasoning_effort.includes(e))
+    : null;
+  const reasoning = (efforts !== null && efforts.some((e) => e !== 'none'))
+    || supports.reasoning_effort === true || supports.thinking === true || REASONING_ID_RE.test(m.id);
   return {
     id: m.id,
     name: typeof m.name === 'string' && m.name ? m.name : m.id,
@@ -203,6 +214,8 @@ export function normalizeCopilotModel(m) {
     toolCalls: supports.tool_calls !== false,
     vision: supports.vision === true,
     reasoning,
+    reasoningEfforts: efforts && efforts.length ? efforts : null,
+    endpoints: Array.isArray(m.supported_endpoints) ? m.supported_endpoints.filter((e) => typeof e === 'string') : null,
     maxPromptTokens: Number(limits.max_prompt_tokens) || null,
     maxOutputTokens: Number(limits.max_output_tokens) || null,
     contextWindow: Number(limits.max_context_window_tokens) || null,
@@ -214,19 +227,52 @@ export function isAnthropicVendor(m) {
   return /anthropic/i.test(m.vendor || '') || /^claude/i.test(m.id || '');
 }
 
+/**
+ * The wire protocol an imported Copilot model is driven through
+ * (2026-09-23-bridge-openai-responses-design.md §11): Anthropic models pass
+ * through; an OpenAI model uses the Responses API whenever Copilot serves it
+ * there (its reasoning then carries across tool turns); any other model uses
+ * it only when Copilot serves it nowhere else; no endpoint list (legacy
+ * models) → chat completions.
+ */
+export function copilotApiFor(m) {
+  if (isAnthropicVendor(m)) return 'anthropic';
+  const eps = Array.isArray(m.endpoints) ? m.endpoints : null;
+  if (eps && eps.includes('/responses') && (/openai/i.test(m.vendor || '') || !eps.includes('/chat/completions'))) return 'openai-responses';
+  return 'openai-chat';
+}
+
+/**
+ * Worca efforts for an imported Copilot model: every effort (undefined) for an
+ * Anthropic model; the Worca efforts among the model's listed levels when
+ * Copilot lists them (all four → undefined; none in common → medium, which the
+ * bridge maps to the nearest listed level); else every effort for a reasoning
+ * model and medium otherwise.
+ */
+export function copilotEfforts(m) {
+  if (isAnthropicVendor(m)) return undefined;
+  if (Array.isArray(m.reasoningEfforts) && m.reasoningEfforts.length) {
+    const eff = EFFORTS.filter((e) => m.reasoningEfforts.includes(e));
+    if (!eff.length) return ['medium'];
+    return eff.length === EFFORTS.length ? undefined : eff;
+  }
+  return m.reasoning ? undefined : ['medium'];
+}
+
 /** The catalog entry an import creates for a Copilot model (§8.4). */
 export function catalogEntryForCopilotModel(m) {
-  const anthropic = isAnthropicVendor(m);
+  const api = copilotApiFor(m);
   const capabilities = {
     toolCalls: m.toolCalls, vision: m.vision, reasoning: m.reasoning,
     ...(m.maxPromptTokens ? { maxPromptTokens: m.maxPromptTokens } : {}),
     ...(m.maxOutputTokens ? { maxOutputTokens: m.maxOutputTokens } : {}),
+    ...(api !== 'anthropic' && Array.isArray(m.reasoningEfforts) && m.reasoningEfforts.length ? { reasoningEfforts: m.reasoningEfforts } : {}),
   };
   return {
     id: `copilot-${m.id}`,
     label: `${m.name} (Copilot)`,
-    efforts: anthropic || m.reasoning ? undefined : ['medium'],
-    upstream: { provider: 'copilot', api: anthropic ? 'anthropic' : 'openai-chat', model: m.id, capabilities },
+    efforts: copilotEfforts(m),
+    upstream: { provider: 'copilot', api, model: m.id, capabilities },
     cost: { free: true },
   };
 }