@xingular/harness 0.1.6 → 2.0.0

package/src/terminal/terminal.test.ts

@@ -22,6 +22,23 @@ afterEach(async () => {
   for (const harness of open.splice(0)) await harness.close()
 })
 
+function tellOn(connection: SocketConnection, event: string, data: Record<string, unknown> = {}) {
+  return new Promise<any>((resolve, reject) => {
+    const stream = connect(connection.socket)
+    let buffer = ''
+    stream.on('connect', () => stream.write(`${JSON.stringify({ token: connection.token, event, data })}\n`))
+    stream.on('data', (chunk) => {
+      buffer += chunk.toString()
+      if (!buffer.includes('\n')) return
+      const reply = JSON.parse(buffer.slice(0, buffer.indexOf('\n')))
+      stream.end()
+      if (reply.error) reject(new Error(reply.error.message))
+      else resolve(reply.result)
+    })
+    stream.on('error', reject)
+  })
+}
+
 async function setup(policy: ToolPolicy = {}) {
   const root = rootWithProject()
   const harness = createHarness({ dataRoot: root, stateDir: mkdtempSync(join(tmpdir(), 'hs-')), secrets: memorySecretStore(), policy, piProgram: () => '/opt/pi/bin/pi', assets: { node: '/opt/node', cli: '/opt/harness/cli.js', piExtension: '/opt/harness/terminal-pi.js' } })
@@ -39,21 +56,7 @@ async function setup(policy: ToolPolicy = {}) {
   const launch = await harness.terminals.prepare({ sessionId: 'term-1', accountId: account.id, projectId: 'p1', cwd: root, sessionFolder, model: 'chosen-model', launch: { connections: 'Use mcp_list_tools.' } })
   const connection: SocketConnection = { socket: String(launch.env[SOCKET_ENV]), token: String(launch.env[TOKEN_ENV]) }
   /** One telemetry line, as the native extension sends it. */
-  const tell = (event: string, data: Record<string, unknown> = {}) =>
-    new Promise<any>((resolve, reject) => {
-      const stream = connect(connection.socket)
-      let buffer = ''
-      stream.on('connect', () => stream.write(`${JSON.stringify({ token: connection.token, event, data })}\n`))
-      stream.on('data', (chunk) => {
-        buffer += chunk.toString()
-        if (!buffer.includes('\n')) return
-        const reply = JSON.parse(buffer.slice(0, buffer.indexOf('\n')))
-        stream.end()
-        if (reply.error) reject(new Error(reply.error.message))
-        else resolve(reply.result)
-      })
-      stream.on('error', reject)
-    })
+  const tell = (event: string, data: Record<string, unknown> = {}) => tellOn(connection, event, data)
   return { harness, root, account, events, notices, launch, connection, tell, sessionFolder }
 }
 
@@ -237,6 +240,117 @@ describe('a pi terminal session', () => {
     expect(await decision).toEqual({ decision: 'approved' })
   })
 
+  it('protects permission controls and shares saved terminal grants across sessions', async () => {
+    const { connection, harness, account, root } = await setup()
+    await expect(socketCall(connection, 'terminal.permissions.get')).rejects.toMatchObject({ code: 'unauthorized' })
+    await expect(socketCall(connection, 'terminal.policy', { tool: 'bash', args: {} })).rejects.toMatchObject({ code: 'unauthorized' })
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    expect(await socketCall(connection, 'terminal.permissions.get', {}, 1000, key)).toEqual({ full: false, globalTools: [] })
+    await socketCall(connection, 'terminal.permissions.setTool', { tool: 'bash', allowed: true }, 1000, key)
+    await socketCall(connection, 'terminal.permissions.setFull', { enabled: true }, 1000, key)
+
+    const secondLaunch = await harness.terminals.prepare({ sessionId: 'term-2', accountId: account.id, projectId: 'p1', cwd: root, sessionFolder: join(root, 'sessions', 'p1', 'term-2') })
+    const secondConnection: SocketConnection = { socket: String(secondLaunch.env[SOCKET_ENV]), token: String(secondLaunch.env[TOKEN_ENV]) }
+    const { key: secondKey } = await socketCall<{ key: string }>(secondConnection, 'control.claim')
+    expect(await socketCall(secondConnection, 'terminal.permissions.get', {}, 1000, secondKey)).toEqual({ full: true, globalTools: ['bash'] })
+    await socketCall(secondConnection, 'terminal.permissions.setTool', { tool: 'bash', allowed: false }, 1000, secondKey)
+    expect(await socketCall(connection, 'terminal.permissions.get', {}, 1000, key)).toEqual({ full: true, globalTools: [] })
+    await expect(socketCall(connection, 'terminal.permissions.setFull', { enabled: 'yes' }, 1000, key)).rejects.toMatchObject({ code: 'invalid_request' })
+  })
+
+  it('does not let a permission change retroactively resolve an already pending approval', async () => {
+    const { connection, tell } = await setup()
+    await tell('ready')
+    await tell('begin', { text: 'Wait for a decision' })
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    const approval = socketCall<{ decision: string }>(connection, 'terminal.approval', { requestId: 'already-pending', tool: 'bash', args: { command: 'pwd' } }, 1000, key)
+    let requestId = ''
+    await vi.waitFor(async () => {
+      const { requests } = await socketCall<{ requests: Array<{ requestId: string }> }>(connection, 'terminal.pending', {}, 1000, key)
+      expect(requests).toHaveLength(1)
+      requestId = requests[0]!.requestId
+    })
+
+    await socketCall(connection, 'terminal.permissions.setFull', { enabled: true }, 1000, key)
+    expect(await socketCall(connection, 'terminal.pending', {}, 1000, key)).toMatchObject({ requests: [{ requestId }] })
+    await socketCall(connection, 'terminal.approve', { requestId, decision: 'denied' }, 1000, key)
+    expect(await approval).toEqual({ decision: 'denied' })
+  })
+
+  it('rechecks native tool policy when a pending approval is resolved', async () => {
+    let denied = false
+    const { connection, tell } = await setup({
+      scope: async () => denied ? { allowed: false, reason: 'The policy now denies this tool.' } : { allowed: true, requiresApproval: true }
+    })
+    await tell('ready')
+    await tell('begin', { text: 'Run a tool' })
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    expect(await socketCall(connection, 'terminal.policy', { tool: 'bash', args: { command: 'pwd' } }, 1000, key)).toMatchObject({ requiresApproval: true, rememberable: true })
+    const approval = socketCall<{ decision: string }>(connection, 'terminal.approval', { requestId: 'call-approval', tool: 'bash', args: { command: 'pwd' } }, 1000, key)
+    let requestId = ''
+    await vi.waitFor(async () => {
+      const pending = await socketCall<{ requests: Array<{ requestId: string }> }>(connection, 'terminal.pending', {}, 1000, key)
+      expect(pending.requests).toHaveLength(1)
+      requestId = pending.requests[0]!.requestId
+    })
+
+    denied = true
+    await socketCall(connection, 'terminal.approve', { requestId, decision: 'approved' }, 1000, key)
+    expect(await approval).toEqual({ decision: 'denied' })
+  })
+
+  it('keeps human-only rules out of tool grants and Full Permission unless the host opts in', async () => {
+    const { connection, tell, events, harness } = await setup({
+      scope: async () => ({ allowed: true, humanOnly: true, allowGlobalApproval: false })
+    })
+    harness.approvals.setAuto('pi', true)
+    await tell('ready')
+    await tell('begin', { text: 'Human decision required' })
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    expect(await socketCall(connection, 'terminal.policy', { tool: 'bash', args: {} }, 1000, key)).toMatchObject({ requiresApproval: true, rememberable: false, standing: 'none' })
+    const approval = socketCall<{ decision: string }>(connection, 'terminal.approval', { requestId: 'human-only', tool: 'bash', args: {} }, 1000, key)
+    let requestId = ''
+    await vi.waitFor(async () => {
+      expect(events.some(event => event.type === 'approval.requested')).toBe(true)
+      const { requests } = await socketCall<{ requests: Array<{ requestId: string; rememberable?: boolean }> }>(connection, 'terminal.pending', {}, 1000, key)
+      expect(requests).toHaveLength(1)
+      expect(requests[0]?.rememberable).toBe(false)
+      requestId = requests[0]!.requestId
+    })
+    await socketCall(connection, 'terminal.approve', { requestId, decision: 'denied' }, 1000, key)
+    expect(await approval).toEqual({ decision: 'denied' })
+  })
+
+  it('remembers a tool choice for future Pi terminal sessions sharing the state directory', async () => {
+    const { connection, tell, events, harness, account, root } = await setup()
+    await tell('ready')
+    await tell('begin', { text: 'Allow a tool' })
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    const first = socketCall<{ decision: string }>(connection, 'terminal.approval', { requestId: 'remember-call', tool: 'bash', args: { command: 'pwd' } }, 1000, key)
+    let requestId = ''
+    await vi.waitFor(async () => {
+      const { requests } = await socketCall<{ requests: Array<{ requestId: string; rememberable?: boolean }> }>(connection, 'terminal.pending', {}, 1000, key)
+      expect(requests[0]?.rememberable).toBe(true)
+      requestId = requests[0]!.requestId
+    })
+    await socketCall(connection, 'terminal.approve', { requestId, decision: 'approved', alwaysAllow: true }, 1000, key)
+    expect(await first).toEqual({ decision: 'approved' })
+    expect(harness.approvals.read().globalTools.pi).toEqual(['bash'])
+
+    const launch = await harness.terminals.prepare({ sessionId: 'term-2', accountId: account.id, projectId: 'p1', cwd: root, sessionFolder: join(root, 'sessions', 'p1', 'term-2') })
+    const next: SocketConnection = { socket: String(launch.env[SOCKET_ENV]), token: String(launch.env[TOKEN_ENV]) }
+    await tellOn(next, 'startup', { phase: 'ready' })
+    await tellOn(next, 'ready')
+    await tellOn(next, 'begin', { text: 'Reuse the grant' })
+    const { key: nextKey } = await socketCall<{ key: string }>(next, 'control.claim')
+    const before = events.filter(event => event.type === 'approval.requested').length
+    expect(await socketCall(next, 'terminal.approval', { requestId: 'next-call', tool: 'bash', args: { command: 'git status' } }, 1000, nextKey)).toEqual({ decision: 'approved' })
+    const automatic = events.filter(event => event.type === 'approval.requested').slice(before)
+    expect(automatic).toHaveLength(1)
+    expect(automatic[0]?.payload).toMatchObject({ automatic: 'remembered', target: 'bash' })
+    expect(await socketCall(next, 'terminal.pending', {}, 1000, nextKey)).toEqual({ requests: [] })
+  })
+
   it('applies the application policy to native tool calls', async () => {
     const seen: string[] = []
     const { tell } = await setup({
@@ -282,7 +396,8 @@ describe('a pi terminal session', () => {
     const listed = await socketCall<{ tools: { name: string; parameters: { type: string } }[] }>(connection, 'tools.list')
     expect(listed.tools.map((tool) => tool.name)).toEqual(['mcp_list_tools', 'mcp_call_tool'])
     expect(listed.tools[0].parameters.type).toBe('object')
-    await expect(socketCall(connection, 'accounts.list')).rejects.toMatchObject({ code: 'unknown_method' })
+    // Account calls exist, but only the session's extension holds the key that unlocks them.
+    await expect(socketCall(connection, 'accounts.list')).rejects.toMatchObject({ code: 'unauthorized' })
     await expect(socketCall({ ...connection, token: 'guess' }, 'wiki.list')).rejects.toMatchObject({ code: 'unauthorized' })
     await harness.terminals.dispose('term-1')
     await expect(socketCall(connection, 'wiki.list')).rejects.toMatchObject({ code: 'unauthorized' })
@@ -328,3 +443,92 @@ describe('xagent-wiki command', () => {
     expect(parseCli(['nonsense'])).toEqual({ kind: 'help' })
   })
 })
+
+
+describe('decisions in the Harness-owned frontend', () => {
+  it('exposes trajectory reads only to the input owner and scopes them to the current native conversation', async () => {
+    const { connection, tell, events } = await setup()
+    await tell('ready', { nativeSessionId: '/history/current.jsonl' })
+    await tell('begin', { text: 'Inspect this run' })
+    await tell('message', { text: 'Recorded response' })
+    await tell('settled', {})
+    const runId = events.find(event => event.type === 'started')!.runId
+
+    await expect(socketCall(connection, 'terminal.trajectory.list')).rejects.toMatchObject({ code: 'unauthorized' })
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    const listed = await socketCall<{ runs: Array<{ id: string }> }>(connection, 'terminal.trajectory.list', {}, 1000, key)
+    expect(listed.runs.map(run => run.id)).toContain(runId)
+    await expect(socketCall(connection, 'terminal.trajectory.events', { runId }, 1000, key)).resolves.toMatchObject({
+      run: { id: runId }, events: expect.arrayContaining([expect.objectContaining({ type: 'message.completed' })])
+    })
+
+    await tell('ready', { nativeSessionId: '/history/another.jsonl' })
+    await expect(socketCall(connection, 'terminal.trajectory.events', { runId }, 1000, key)).rejects.toMatchObject({ code: 'not_found' })
+    await expect(socketCall(connection, 'terminal.trajectory.list', {}, 1000, key)).resolves.toEqual({ runs: [] })
+  })
+
+  it('requires the private input-owner key for pending decisions and exact draft state', async () => {
+    const { connection, harness, tell } = await setup()
+    await tell('ready', { nativeSessionId: '/native.jsonl' })
+    await expect(socketCall(connection, 'terminal.pending')).rejects.toMatchObject({ code: 'unauthorized' })
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    await socketCall(connection, 'terminal.draft', { dirty: true }, 1000, key)
+    expect(harness.terminals.state('term-1').dirty).toBe(true)
+    await socketCall(connection, 'terminal.draft', { dirty: false }, 1000, key)
+    expect(harness.terminals.state('term-1').dirty).toBe(false)
+    await expect(socketCall(connection, 'terminal.approve', { requestId: 'missing', decision: 'approved' }, 1000, key)).rejects.toMatchObject({ code: 'invalid_request' })
+  })
+
+  it('answers through the existing run registry and rejects stale answers', async () => {
+    const { connection, tell, events } = await setup()
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    await tell('ready')
+    await tell('begin', { text: 'Ask a question' })
+    const answer = tell('question', { requestId: 'native-question', question: 'Choose?', options: [{ label: 'A', description: 'First' }], multiSelect: false })
+    let id = ''
+    await vi.waitFor(async () => {
+      const pending = await socketCall<{ requests: Array<{ requestId: string }> }>(connection, 'terminal.pending', {}, 1000, key)
+      expect(pending.requests).toHaveLength(1)
+      id = pending.requests[0].requestId
+    })
+    await socketCall(connection, 'terminal.answer', { requestId: id, answer: { selected: ['A'] } }, 1000, key)
+    expect(await answer).toEqual({ selected: ['A'] })
+    expect(events.some(event => event.type === 'question.answered')).toBe(true)
+    await expect(socketCall(connection, 'terminal.answer', { requestId: id, answer: { selected: ['A'] } }, 1000, key)).rejects.toMatchObject({ code: 'invalid_request' })
+  })
+
+  it('keeps an approval and question with the same native tool id independent', async () => {
+    const { connection, tell } = await setup()
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    await tell('ready'); await tell('begin', { text: 'Ask after approval' })
+    const approval = tell('approval', { requestId: 'same-tool-call', target: 'ask_user_question', action: '{}' })
+    let approvalId = ''
+    await vi.waitFor(async () => {
+      const { requests } = await socketCall<{ requests: Array<{ requestId: string }> }>(connection, 'terminal.pending', {}, 1000, key)
+      expect(requests).toHaveLength(1); approvalId = requests[0].requestId
+    })
+    await socketCall(connection, 'terminal.approve', { requestId: approvalId, decision: 'approved' }, 1000, key)
+    expect(await approval).toEqual({ decision: 'approved' })
+    const question = tell('question', { requestId: 'same-tool-call', question: 'Continue?', options: [{ label: 'Yes' }] })
+    let questionId = ''
+    await vi.waitFor(async () => {
+      const { requests } = await socketCall<{ requests: Array<{ requestId: string; type: string }> }>(connection, 'terminal.pending', {}, 1000, key)
+      expect(requests).toHaveLength(1); expect(requests[0].type).toBe('question'); questionId = requests[0].requestId
+    })
+    expect(questionId).not.toBe(approvalId)
+    await socketCall(connection, 'terminal.answer', { requestId: questionId, answer: { selected: ['Yes'] } }, 1000, key)
+    expect(await question).toEqual({ selected: ['Yes'] })
+  })
+
+  it('cancels a pending question through the run interrupt path', async () => {
+    const { connection, tell, harness } = await setup()
+    const { key } = await socketCall<{ key: string }>(connection, 'control.claim')
+    await tell('ready')
+    await tell('begin', { text: 'Wait for a question' })
+    const answer = tell('question', { requestId: 'cancel-question', question: 'Wait?', options: [], multiSelect: false })
+    await vi.waitFor(async () => expect((await socketCall<{ requests: unknown[] }>(connection, 'terminal.pending', {}, 1000, key)).requests).toHaveLength(1))
+    await socketCall(connection, 'terminal.interrupt', {}, 1000, key)
+    expect(await answer).toEqual({ selected: [] })
+    expect(harness.terminals.state('term-1').active).toBe(false)
+  })
+})

package/src/terminal/terminals.ts

@@ -1,15 +1,22 @@
-// Terminal sessions: a person working with the `pi` command in a terminal that the embedding
-// application draws. The harness prepares the launch (isolated account, compiled instructions,
-// skills, the session socket), then follows the process through its extension. It never owns
-// the terminal: the application spawns the process from the spec returned here and reports when
-// it exits.
+// A host owns the PTY and process supervision; Harness owns the terminal application inside it.
+// This service prepares the isolated account, compiled context, trusted resource selection and
+// socket bridge. The default launch runs our frontend with Pi's persistent SDK runtime.
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
+import { Type } from 'typebox'
+
+import type { CapabilitySet } from '../capabilities/types'
+import { freezeRun } from '../capabilities/runSnapshot'
+import type { Subagents } from '../sessions/subagentService'
+import { SPAWN_SUBAGENT, WAIT_SUBAGENTS, type SubagentOptions } from '../sessions/subagents'
+import { subagentTools } from '../tools/spawnSubagent'
+import type { Effort } from '../sessions/runner'
 import type { Accounts } from '../accounts/accounts'
+import type { Approvals } from '../sessions/approvals'
 import { configDir, launchEnv } from '../accounts/env'
-import type { Account } from '../accounts/store'
+import { readAudit, type Account } from '../accounts/store'
 import type { Bus } from '../core/bus'
 import { log } from '../core/bus'
 import type { HarnessEnv } from '../core/env'
@@ -20,8 +27,9 @@ import type { BrokerSession, ConnectedApps } from '../mcp/service'
 import type { CallerContext } from '../memory/caller'
 import { dispatch } from '../memory/dispatch'
 import type { AttachParams, PluginScope } from '../plugins/api'
-import type { Plugins } from '../plugins/plugins'
+import type { Loading, Plugins } from '../plugins/plugins'
 import type { Plugin } from '../plugins/types'
+import type { Hub } from '../hub/hub'
 import { compile, copyToRun, memoryDelta, record, render, saveForSession, type Launch } from '../prompt/compile'
 import type { RunRecord } from '../sessions/contracts'
 import { isActiveStatus } from '../sessions/contracts'
@@ -35,6 +43,17 @@ import { SOCKET_ENV, TOKEN_ENV } from './client'
 import { TerminalController, type PolicyReply } from './controller'
 import { resolvePiCommand, terminalCommandFiles } from './launch'
 import { SessionSocket, socketPath } from './socket'
+import { listTerminalTrajectoryRuns, readTerminalTrajectory } from './trajectory'
+
+/** Identity of the exact resource decision that this terminal was prepared with. */
+function resourceIdentity(loading: Loading | null): string {
+  if (!loading) return 'null'
+  return JSON.stringify({
+    extensions: loading.extensionPaths, builtins: loading.builtins, skills: loading.skillPaths,
+    prompts: loading.promptPaths, themes: loading.themePaths, detached: loading.detached,
+    project: loading.projectCode, packages: loading.packageCode
+  })
+}
 
 /** The files a terminal session needs on disk, outside this process. */
 export interface TerminalAssets {
@@ -54,6 +73,7 @@ export function defaultAssets(): TerminalAssets {
 }
 
 export interface TerminalPrepareInput {
+  subagents?: SubagentOptions | null
   sessionId: string
   /** The account the session is pinned to. Omitted only for a session that has none yet; it then takes the default and keeps it. */
   accountId?: string | null
@@ -91,10 +111,13 @@ interface Live {
 }
 
 export interface TerminalsOptions {
+  subagents?: Subagents
+  resolveCapabilities?: (caller: CallerContext, tools: readonly string[], cwd: string) => Promise<CapabilitySet>
   env: HarnessEnv
   stateDir: string
   accounts: Accounts
   runs: RunRegistry
+  approvals: Approvals
   apps: ConnectedApps
   policy: ToolPolicy
   bus: Bus
@@ -102,8 +125,9 @@ export interface TerminalsOptions {
   plugins?: Plugins
   /** Lists plugins and applies a person's choices, for the session's `/plugins` command. */
   pluginControl?: PluginControl
+  hub?: Hub
   assets?: TerminalAssets
-  /** The `pi` executable. Defaults to the PATH command on POSIX and the bundled CLI on Windows. */
+  /** The `pi` executable. Defaults to the pinned bundled CLI through the active Node runtime. */
   program?: () => string | null
 }
 
@@ -121,13 +145,31 @@ export class Terminals {
   private readonly sessions = new Map<string, Live>()
   private readonly socket: SessionSocket
   private readonly assets: TerminalAssets
+  /** A session's `/accounts` switch, taken once its Pi process has ended. */
+  private readonly relaunches = new Map<string, { accountId: string; nativeSessionId: string | null }>()
 
   constructor(private readonly options: TerminalsOptions) {
     this.assets = options.assets ?? defaultAssets()
+    options.runs.listen(event => {
+      this.sessions.get(event.sessionId)?.controller.observe(event)
+      const record = findRun(options.env.root, event.runId)
+      if (record?.relation !== 'subagent') return
+      let parentId = record.parentRunId
+      const seen = new Set<string>()
+      while (parentId && !seen.has(parentId)) {
+        seen.add(parentId)
+        const parent = findRun(options.env.root, parentId)
+        if (!parent) break
+        const owner = this.sessions.get(parent.sessionId)
+        if (owner?.controller.activeRun?.runId === parent.id) { owner.controller.observe(event, true); break }
+        parentId = parent.parentRunId
+      }
+    })
     this.socket = new SessionSocket(socketPath(options.stateDir), {
       memory: (caller, call, params) => dispatch(options.env, caller, call, params),
       apps: (session, call, params) => this.appsCall(session, call, params),
-      plugins: (grant, call, params, control) => this.pluginsCall(grant.sessionId, call, params, control)
+      plugins: (grant, call, params, control) => this.pluginsCall(grant.sessionId, call, params, control),
+      accounts: (grant, call, params, control) => this.accountsCall(grant.sessionId, call, params, control)
     })
   }
 
@@ -200,6 +242,12 @@ export class Terminals {
     if (!api || !live) throw new HarnessError('unknown_method', `Unknown call ${call}.`)
     const projectId = live.input.projectId ?? null
     const scope = { cwd: live.input.cwd, accountId: live.account.id, projectId }
+    if (call === 'hub.list' && this.options.hub) return this.options.hub.list(params.refresh === true)
+    if (call === 'hub.install' && this.options.hub) {
+      if (!control) throw new HarnessError('unauthorized', 'Only a person at this terminal can install items. Type /hub.')
+      if (typeof params.id !== 'string' || typeof params.version !== 'string') throw invalid('An item id and version are required.')
+      return this.options.hub.install(params.id, params.version)
+    }
     if (call === 'plugins.list') return api.list(scope)
     if (call === 'plugins.session') return { projectId }
     if (!control) throw new HarnessError('unauthorized', 'Only a person at this terminal can change plugins. Type /plugins.')
@@ -220,6 +268,86 @@ export class Terminals {
     }
   }
 
+  /**
+   * `/accounts` in a terminal. Every call needs the session's control key: adding, signing in,
+   * or removing an account is a person's choice, never the model's shell command.
+   */
+  private async accountsCall(sessionId: string, call: string, params: Record<string, unknown>, control: boolean): Promise<unknown> {
+    const { accounts } = this.options
+    const live = this.sessions.get(sessionId)
+    if (!live) throw new HarnessError('unknown_method', `Unknown call ${call}.`)
+    if (!control) throw new HarnessError('unauthorized', 'Only a person at this terminal can manage accounts. Type /accounts.')
+    const text = (name: string): string => {
+      if (typeof params[name] !== 'string' || !params[name]) throw invalid(`${name} is required.`)
+      return params[name] as string
+    }
+    const optional = (name: string): string | null => (typeof params[name] === 'string' ? (params[name] as string) : null)
+    switch (call) {
+      case 'accounts.deviceId':
+        return accounts.installationDeviceId()
+      case 'accounts.list':
+        return accounts.overview()
+      case 'accounts.session':
+        return { accountId: live.account.id, label: live.account.label }
+      case 'accounts.create':
+        return accounts.create(text('label'), optional('authKind') ?? 'subscription')
+      case 'accounts.rename':
+        return accounts.rename(text('accountId'), text('label'))
+      case 'accounts.setDefault':
+        return accounts.setDefault(text('accountId'))
+      case 'accounts.remove': {
+        const accountId = text('accountId')
+        // Every terminal in this process counts, this session's own included. Another process's terminals are not visible here.
+        if (accounts.terminalCount(accountId) > 0) throw new HarnessError('account_in_use', 'A running terminal is using this account, this one included.', 'Switch this session to another account first, then remove it.')
+        return accounts.remove(accountId)
+      }
+      case 'accounts.refresh':
+        return accounts.refresh(optional('accountId'))
+      case 'accounts.providers':
+        return accounts.providers()
+      case 'accounts.loginStart':
+        return accounts.loginStart(text('accountId'), text('provider'), optional('method'))
+      case 'accounts.loginStatus':
+        return accounts.loginStatus(text('accountId'))
+      case 'accounts.loginRespond':
+        accounts.loginRespond(text('loginId'), text('promptId'), optional('value'))
+        return {}
+      case 'accounts.loginCancel':
+        accounts.loginCancel(text('accountId'), optional('loginId'))
+        return {}
+      case 'accounts.setApiKey':
+        return accounts.setApiKey(text('accountId'), text('key'), text('provider'))
+      case 'accounts.removeProvider':
+        return accounts.removeProvider(text('accountId'), text('provider'))
+      case 'accounts.signOut':
+        return accounts.signOut(text('accountId'))
+      case 'accounts.savePool': {
+        const pool = params.pool as { id?: unknown; label?: unknown; accountIds?: unknown } | undefined
+        if (!pool || typeof pool.label !== 'string' || !Array.isArray(pool.accountIds) || !pool.accountIds.every((id) => typeof id === 'string')) throw invalid('A pool needs a label and its account ids.')
+        return accounts.savePool({ id: typeof pool.id === 'string' ? pool.id : undefined, label: pool.label, accountIds: pool.accountIds as string[] })
+      }
+      case 'accounts.removePool':
+        return accounts.removePool(text('poolId'))
+      case 'accounts.audit':
+        return readAudit(accounts.dir, optional('accountId'), typeof params.limit === 'number' ? params.limit : 100)
+      case 'accounts.relaunch': {
+        // Checked here so a bad choice is refused before the session is asked to end.
+        const target = accounts.resolve(text('accountId'))
+        this.relaunches.set(sessionId, { accountId: target.id, nativeSessionId: live.controller.nativeSessionId })
+        return { accountId: target.id, label: target.label }
+      }
+      default:
+        throw new HarnessError('unknown_method', `Unknown call ${call}.`)
+    }
+  }
+
+  /** The account a session asked to switch to. Taken once, after its Pi process has ended and before `dispose`. */
+  takeRelaunch(sessionId: string): { accountId: string; nativeSessionId: string | null } | null {
+    const request = this.relaunches.get(sessionId) ?? null
+    this.relaunches.delete(sessionId)
+    return request
+  }
+
   private live(sessionId: string): Live {
     const live = this.sessions.get(sessionId)
     if (!live) throw new HarnessError('terminal_not_ready', 'The terminal controller is unavailable. Reopen this session.')
@@ -283,19 +411,80 @@ export class Terminals {
     const { policy } = this.options
     if (policy.scope) {
       const scope = await policy.scope(call)
-      if (!scope.allowed && !scope.requiresApproval) return { allowed: false, reason: scope.reason ?? 'Outside what this session may do.' }
+      if (!scope.allowed && (scope.automatic || !scope.requiresApproval)) return { allowed: false, reason: scope.reason ?? 'Outside what this session may do.' }
       try {
         await policy.authorize?.(call)
       } catch (error) {
         return { allowed: false, reason: error instanceof Error ? error.message : 'Tool unavailable in the settings.' }
       }
-      return { allowed: scope.allowed, requiresApproval: !!scope.requiresApproval, reason: scope.reason ?? null }
+      const requiresApproval = !!scope.requiresApproval || (scope.allowed && !!scope.humanOnly)
+      return {
+        allowed: scope.allowed,
+        requiresApproval,
+        reason: scope.reason ?? null,
+        rememberable: scope.allowed && !scope.humanOnly,
+        ...(scope.humanOnly ? { standing: scope.allowGlobalApproval ? 'switch' as const : 'none' as const } : {})
+      }
     }
     // With no application policy: reads run, a read-only session refuses the rest, and anything else asks.
     const name = tool.toLowerCase()
-    if (READ_ONLY_TOOLS.has(name) || this.options.apps.toolNames.includes(name as never)) return { allowed: true }
+    if (name === SPAWN_SUBAGENT || name === WAIT_SUBAGENTS || READ_ONLY_TOOLS.has(name) || this.options.apps.toolNames.includes(name as never)) return { allowed: true }
     if (live.input.readOnly) return { allowed: false, reason: 'This session is read-only.' }
-    return { allowed: false, requiresApproval: true, reason: 'This native action requires approval.' }
+    return { allowed: false, requiresApproval: true, rememberable: true, reason: 'This native action requires approval.' }
+  }
+
+  private async subagentsCall(live: Live, call: string, params: Record<string, any>): Promise<unknown> {
+    const service = this.options.subagents
+    if (!service || live.input.subagents === null) {
+      if (call === 'terminal.subagents.tools') return { tools: [] }
+      throw invalid('Subagents are disabled for this terminal.')
+    }
+    if (call === 'terminal.subagents.tools') return { tools: subagentTools(service, '').map(tool => ({ name: tool.name, label: tool.label, description: tool.description, parameters: tool.parameters(Type) })) }
+    const run = live.controller.activeRun
+    if (!run) throw new HarnessError('run_not_active', 'This terminal has no active parent run.')
+    if (call === 'terminal.subagents.register') {
+      if (!Array.isArray(params.tools) || params.tools.some((name: unknown) => typeof name !== 'string')) throw invalid('Native tool names are required.')
+      const readOnly = live.input.readOnly === true
+      const readTools = new Set([...READ_ONLY_TOOLS, SPAWN_SUBAGENT, WAIT_SUBAGENTS, 'ask_user', 'mcp_list_tools', 'mcp_call_tool', 'history_search', 'history_read', 'wiki_search', 'wiki_read', 'wiki_list', 'memory_facts', 'skill_load'])
+      const tools = params.tools.filter((name: string) => !readOnly || readTools.has(name)) as string[]
+      const capabilities = this.options.resolveCapabilities ? await this.options.resolveCapabilities(live.caller, tools, live.input.cwd) : { version: 1 as const, tools, connectors: [], contributions: [] }
+      freezeRun(this.options.env.root, run.runId, live.caller, capabilities)
+      service.register({
+        run: { id: run.runId, sessionId: live.input.sessionId, mode: live.input.run?.mode ?? 'code', projectId: live.input.projectId, worktreeId: live.input.run?.worktreeId },
+        cwd: live.input.cwd, sessionDir: this.historyDir(live.input), text: '', caller: live.caller,
+        model: typeof params.model === 'string' ? params.model : live.input.model,
+        effort: typeof params.effort === 'string' ? params.effort as Effort : null,
+        launch: live.input.launch, tools: { allow: capabilities.tools, gated: capabilities.tools.filter(name => !readTools.has(name)) },
+        connections: live.input.connections === false ? false : { readOnly }, subagents: live.input.subagents,
+        capabilities
+      }, live.account.id, capabilities)
+      service.restore(run.runId, params.history ?? { owners: [], receipts: [] })
+      return { runId: run.runId }
+    }
+    if (call === 'terminal.subagents.verify') { await service.verify(run.runId, params.history); return {} }
+    if (call === 'terminal.subagents.delivery') return service.delivery(run.runId, params.history, params.settle === true)
+    if (call === 'terminal.subagents.call') {
+      const tool = subagentTools(service, run.runId).find(tool => tool.name === params.name)
+      if (!tool) throw invalid('Unknown subagent tool.')
+      const reason = await this.decide(live, run, tool.name, params.input ?? {})
+      if (!reason.allowed) throw new HarnessError('tool_denied', reason.reason ?? 'Subagents are unavailable.')
+      const result = await tool.execute(params.input ?? {})
+      return typeof result === 'string' ? { text: result } : result
+    }
+    throw invalid('Unknown subagent operation.')
+  }
+
+  private trajectoryCall(live: Live, call: string, params: Record<string, unknown>): unknown {
+    if (call === 'terminal.trajectory.list') {
+      return { runs: listTerminalTrajectoryRuns(this.options.env.root, live.input.sessionId, live.controller.nativeSessionId) }
+    }
+    if (call === 'terminal.trajectory.events') {
+      if (typeof params.runId !== 'string' || !params.runId) throw invalid('A run id is required.')
+      const afterSequence = params.afterSequence
+      if (afterSequence !== undefined && typeof afterSequence !== 'number') throw invalid('The event sequence must be a number.')
+      return readTerminalTrajectory(this.options.env.root, live.input.sessionId, live.controller.nativeSessionId, params.runId, afterSequence as number | undefined)
+    }
+    throw new HarnessError('unknown_method', `Unknown call ${call}.`)
   }
 
   /**
@@ -303,11 +492,12 @@ export class Terminals {
    * process's end with `dispose`, also when it never starts.
    */
   async prepare(input: TerminalPrepareInput): Promise<TerminalLaunch> {
+    input = structuredClone(input)
     const { env, accounts, apps, bus } = this.options
     const { root } = env
     if (!input?.sessionId || !input.cwd || !input.sessionFolder) throw invalid('A terminal session needs an id, a working folder, and its own folder.')
     await this.dispose(input.sessionId)
-    const command = resolvePiCommand({ platform: process.platform, node: this.assets.node, programOverride: this.options.program })
+    const command = resolvePiCommand({ platform: process.platform, node: this.assets.node, cli: this.assets.cli, programOverride: this.options.program })
     // A pinned account is used as it is; it is never exchanged for another one.
     const account = input.accountId ? accounts.find(input.accountId) : accounts.resolve(null, null)
     const launch = launchEnv(accounts.dir, account)
@@ -338,15 +528,42 @@ export class Terminals {
           nativeSessionId: input.nativeSessionId ?? null,
           begin: ({ reservedRunId, text }) => this.begin(live, reservedRunId, text),
           policy: (run, tool, args) => this.decide(live, run, tool, args),
+          allowToolGlobally: target => { this.options.approvals.allowTool('pi', target) },
           native: (nativeSessionId) => bus.emit({ type: 'terminal.native', sessionId, nativeSessionId }),
-          telemetry: (event) => bus.emit({ type: 'terminal.telemetry', sessionId, event })
+          telemetry: (event) => bus.emit({ type: 'terminal.telemetry', sessionId, event }),
+          interrupt: runId => this.options.runs.interrupt(runId),
+          resolveApproval: (runId, id, decision) => this.options.runs.resolveApproval(runId, id, decision),
+          answerQuestion: (runId, id, answer) => this.options.runs.answerQuestion(runId, id, answer),
+          answerQuestions: (runId, batchId, answers) => this.options.runs.answerQuestions(runId, batchId, answers)
         })
       }
       token = this.socket.issue({
         sessionId,
         caller: () => ({ ...caller, runId: live.controller.activeRun?.runId ?? null }),
         broker,
-        terminal: { accept: (event, data) => live.controller.accept(event, data), disconnected: () => live.controller.disconnected() }
+        terminal: { accept: (event, data) => live.controller.accept(event, data), disconnected: () => live.controller.disconnected(), control: async (call, params) => {
+          if (call.startsWith('terminal.subagents.')) return this.subagentsCall(live, call, params)
+          if (call.startsWith('terminal.trajectory.')) return this.trajectoryCall(live, call, params)
+          if (call === 'terminal.permissions.get') {
+            const policy = this.options.approvals.read()
+            return { full: this.options.approvals.isAuto('pi'), globalTools: policy.globalTools.pi ?? [] }
+          }
+          if (call === 'terminal.permissions.setFull') {
+            if (typeof params.enabled !== 'boolean') throw invalid('A boolean permission state is required.')
+            return { full: this.options.approvals.setAuto('pi', params.enabled).auto.pi === true }
+          }
+          if (call === 'terminal.permissions.setTool') {
+            if (typeof params.tool !== 'string' || !params.tool.trim() || typeof params.allowed !== 'boolean') throw invalid('A tool name and boolean permission state are required.')
+            const policy = params.allowed
+              ? this.options.approvals.allowTool('pi', params.tool)
+              : this.options.approvals.revokeTool('pi', params.tool)
+            return { globalTools: policy.globalTools.pi ?? [] }
+          }
+          if (call !== 'terminal.resources') return live.controller.control(call, params)
+          const current = await this.options.plugins?.loading({ cwd: input.cwd, agentDir: configDir(accounts.dir, account), install: false, caller: { projectId: input.projectId ?? null } }) ?? null
+          if (resourceIdentity(current) !== resourceIdentity(loading)) throw new HarnessError('terminal_resources_changed', 'Trusted resources changed since this terminal was prepared. Review /plugins and reopen the terminal to load the new selection.')
+          return {}
+        } }
       })
       live.token = token
       this.sessions.set(sessionId, live)
@@ -370,6 +587,7 @@ export class Terminals {
         args,
         env: {
           ...launch,
+          XINGULAR_HARNESS_NAME: env.productName,
           ...(process.platform === 'win32' ? { XINGULAR_HARNESS_NODE: this.assets.node, XINGULAR_HARNESS_CLI: this.assets.cli } : {}),
           ...prependSearchPath(this.ensureCommands(), searchPath()),
           [SOCKET_ENV]: this.socket.path,