atom-agent 1.1.0 → 1.3.0

package/dist/App.js

@@ -5,8 +5,8 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import React, { useEffect, useMemo, useRef, useState } from "react";
-import { Box, Text, useApp, useInput, usePaste, useStdout } from "ink";
-import { DEFAULT_MODEL, EFFORT_OPTIONS, FALLBACK_MODELS, LoopCancelledError, REASONING_EFFORT_SUPPORTED_MODELS, buildSystemPrompt, fetchModelsForProviderWithStatus, fetchModelsWithStatus, historyChars, isEffortSupported, messageChars, openTodoNeedles, runAgenticLoopForProvider, } from "./zen.js";
+import { Box, Text, useApp, useInput, usePaste } from "ink";
+import { DEFAULT_MODEL, EFFORT_OPTIONS, FALLBACK_MODELS, LoopCancelledError, buildSystemPrompt, fetchModelsForProviderWithStatus, fetchModelsWithStatus, historyChars, isEffortSupported, messageChars, normalizeEffort, runAgenticLoopForProvider, } from "./zen.js";
 import { createContextManager, trackHistory, } from "./context-manager.js";
 import { assemblePrefix, providerCacheSupport, } from "./prompt-cache.js";
 import { TOOL_DEFINITIONS, TOOL_ONE_LINERS, APPROVAL_PREVIEW_MAX_BYTES, clearTodos, describeToolCall, executeTool, getTodos, needsApproval, previewDiffForApproval, providerSecrets } from "./tools.js";
@@ -16,7 +16,9 @@ import { formatRules, parseRuleInput, } from "./permissions.js";
 import { decidePolicy, skillGrantsFor } from "./policy.js";
 import { capSkillBodyForAuto, createSkillRegistry, loadSkillBody, matchSkills, resolveSkills, } from "./skills.js";
 import { contextWindowFor } from "./context-windows.js";
-import { COMPACT_PCT_DEFAULT, buildCompactedHistory, compactBoundaryLine, compactPct, countUserTurns, estimateTokensForChars, isThrashDisabled, requestCompactSummary, splitHistoryForCompaction, } from "./compact.js";
+import { emptyGoalStats, formatGoalForCompact, goalClearNotice, goalFollowUp, goalPauseNotice, goalResumeNotice, goalSetNotice, goalStatusText, goalTokensForUsage, parseGoalCommand, restoreGoalFromPersist, serializeGoalForPersist, } from "./goal.js";
+import { requestGoalVerdict } from "./agent/goal-evaluator.js";
+import { COMPACT_PCT_DEFAULT, buildCompactedHistory, collectStoredTouchedFiles, collectTouchedFiles, compactBoundaryLine, compactPct, countUserTurns, estimateTokensForChars, fitSummaryWithFilesAndGoal, isThrashDisabled, requestCompactSummary, splitHistoryForCompaction, } from "./compact.js";
 import { DEFAULT_PROVIDER, PROVIDERS, chatEndpointFor, getProvider, isLocalProviderId, isProviderId, localBaseURLFor, maskKey, openaiCompatibleChatEndpoint, providerNeedsKey, validateBaseURL, } from "./providers.js";
 import { createLocalDiscovery, summarizeLocalSnapshot, } from "./local-discovery.js";
 import { getStoredBaseURL, loadAuth, resolveApiKey, saveAuth, setStoredKey, } from "./auth.js";
@@ -24,20 +26,27 @@ import { validateProviderKey } from "./adapters.js";
 import { clearKiloModelsCache, isFreeKiloModel, preferFreeKiloModel, } from "./kilo.js";
 import { getGitInfo, withEnvBlock } from "./env-block.js";
 import { loadPrefs, loadSession, saveSession, sessionExists, } from "./session.js";
+import { createSession, ensureActiveSession, getActiveSession, getActiveSessionId, getSession, listSessions, renameSession, setActiveSession, updateSession, } from "./sessions.js";
+import { discoverExtensionEntries, loadExtensions, resolveExtensionName, } from "./extensions.js";
+import { formatExtensionStatusText } from "./extension-ui.js";
+import { getExtensionCommand, listExtensionCommands, parseExtensionCommandInput, runExtensionCommand, } from "./extension-commands.js";
 import { loadAtomConfig } from "./config.js";
+import { grantProjectTrust, isProjectTrusted, projectTrustQuestion, } from "./project-trust.js";
 import { cancelledTurnLine } from "./rollback.js";
 import { clearSnapshots, conversationCutIndex, getCheckpoint, listCheckpoints, registerHistoryProbe, restoreCheckpointFiles, } from "./snapshots.js";
-import { forgetReadFingerprint, refreshReadFingerprint } from "./tools.js";
+import { applyBeforeCompact, beforeCompactInterceptors, forgetReadFingerprint, refreshReadFingerprint } from "./tools.js";
 import { InputBox } from "./ui/input.js";
 import { historyNewerIndex, historyOlderIndex, killToLineEnd, killToLineStart, killWordBefore, lineColOf, moveVertically, normalizePaste, offsetOfLines, pushInputHistory as pushInputHistoryList, splitInputLines, } from "./ui/input-model.js";
-import { LiveTail } from "./ui/live-tail.js";
+import { LiveTailHost } from "./ui/live-host.js";
 import { InspectorPanel, MAX_TOOL_RECORDS, VIEWPORT_LINES, createToolRecord, } from "./ui/tool-inspector.js";
 import { activityText } from "./ui/activity.js";
 import { ApprovalBox, QuestionBox } from "./ui/modals.js";
 import { PalettePanel } from "./ui/palette.js";
 import { PALETTE_CATEGORY_ORDER, PALETTE_HINTS, paletteCategory } from "./ui/palette.js";
 import { PickerMoreAbove, PickerMoreBelow, PickerRow, PickerShell, pickerWindow } from "./ui/pickers.js";
-import { StatusBar, shortenCwd } from "./ui/status-bar.js";
+import { shortenCwd } from "./ui/status-bar.js";
+import { StatusBarHost } from "./ui/status-host.js";
+import { createStreamStore } from "./ui/stream-store.js";
 import { theme } from "./ui/theme.js";
 import { TodoPanel } from "./ui/todo-panel.js";
 import { TranscriptView, applyScrollAction } from "./ui/transcript.js";
@@ -48,7 +57,7 @@ export const SLASH_COMMANDS = [
     { name: "/provider", description: "Pick AI provider, paste API key once, chat." },
     {
         name: "/effort",
-        description: "Open the reasoning-effort picker (Default/Low/Medium/High/Max; top is Max, sent as max).",
+        description: "Open the reasoning-effort picker (Auto/Low/Medium/High/Max; Auto lets the model decide).",
     },
     { name: "/tools", description: "List the tools with one-line descriptions." },
     { name: "/skills", description: "List installed skills (project + global)." },
@@ -60,13 +69,16 @@ export const SLASH_COMMANDS = [
     { name: "/rules", description: "List session allow/deny rules (/rules clear wipes them)." },
     { name: "/clear", description: "Clear the conversation history (keeps session token totals; drops file checkpoints)." },
     { name: "/new", description: "Start a brand-new session (full fresh conversation + counters reset, previous kept for /resume)." },
+    { name: "/rename", description: "Rename the current session (/rename <name>)." },
     { name: "/compact", description: "Summarize older turns into one summary (optional focus text: /compact focus…)." },
     { name: "/context", description: "Show context usage by source (system, tools, history, skills)." },
     { name: "/queue", description: "List queued follow-ups (/queue clear wipes them)." },
     { name: "/steer", description: "Steer the running turn, or send when idle (/steer <text>)." },
-    { name: "/autoscroll", description: "Follow new output as it arrives (/autoscroll on|off; off freezes the view mid-turn)." },
+    { name: "/autoscroll", description: "Toggle following new output (on by default; bare toggles, on|off sets it; off freezes the view mid-turn)." },
+    { name: "/goal", description: "Set, show, pause, resume, or clear the session goal (/goal <objective>; bare shows it; /goal pause|resume; /goal clear ends it)." },
     { name: "/thinking", description: "Show or hide model thinking in the TUI (rendering only; the turn is untouched)." },
     { name: "/resume", description: "Restore the last saved session (turns, history, settings, usage)." },
+    { name: "/session", description: "Switch the active session (interactive picker, most recent first)." },
     { name: "/telemetry", description: "Show the local observability summary (sessions, tokens, tools)." },
     { name: "/dashboard", description: "Write the local observability dashboard page and show its path." },
     { name: "/rewind", description: "Restore files to a session checkpoint (files only; shell side effects are never snapshotted)." },
@@ -79,12 +91,12 @@ const SLASH_NAMES = new Set(SLASH_COMMANDS.map((c) => c.name));
 // conversation only. Files-only is the default highlight (safest).
 export const REWIND_SCOPES = ["files only", "files + conversation", "conversation only"];
 // Submit-time pipeline order (ticket 02): submit() below reads as one
-// ordered sequence — permissions → context assembly → budget check → loop
+// ordered sequence — permissions → context assembly → loop
 // entry — so future submit-time work has exactly one home stage. The
 // rollback-scope rule per stage states what a failed turn keeps vs drops.
 // This descriptor is the order test's source of truth:
 // tests/submit-order.test.ts pins both this order and the matching
-// `SUBMIT STAGE n/4` markers inside submit().
+// `SUBMIT STAGE n/3` markers inside submit().
 export const SUBMIT_PIPELINE_STAGES = [
     {
         name: "permissions",
@@ -94,10 +106,6 @@ export const SUBMIT_PIPELINE_STAGES = [
         name: "context-assembly",
         rollbackScope: "pre-rollbackTo: the env-block refresh survives a failed turn (it is not part of the user turn)",
     },
-    {
-        name: "budget-check",
-        rollbackScope: "pre-rollbackTo: the budget trim survives a failed turn (rollback indices are captured after it)",
-    },
     {
         name: "loop-entry",
         rollbackScope: "post-rollbackTo: the user message, skill context, and loop entries roll back on failure",
@@ -110,8 +118,27 @@ export const SKILL_USAGE = "usage: /skill:<name> — invoke a skill directly (li
 export const RULE_USAGE = "usage: /allow <tool[:glob]> · /deny <tool[:glob]> · /rules · /rules clear (e.g. /allow bash:npm test*, /deny bash:rm *)";
 export const QUEUE_USAGE = "usage: /queue (list) · /queue clear (wipe) · /steer <text> (steer the running turn, or send when idle)";
 export const STEER_USAGE = "usage: /steer <text> — while busy, injects into the running turn at the next step boundary (the current action finishes first); when idle, sends as a normal turn";
-export const AUTOSCROLL_USAGE = "usage: /autoscroll [on|off] — on (default) follows new output as it arrives; off freezes the view while a turn runs (a `↓ N new` indicator offers the jump back). Bare /autoscroll prints the current state.";
-export const THINKING_USAGE = "usage: /thinking — toggles model-thinking visibility in the TUI (rendering only: shows or hides the committed thinking blocks; the turn, history, and telemetry are untouched).";
+export const AUTOSCROLL_USAGE = "usage: /autoscroll [on|off] — on (default) follows new output as it arrives; off freezes the view while a turn runs (a `↓ N new` indicator offers the jump back). Bare /autoscroll toggles between the two.";
+export const THINKING_USAGE = "usage: /thinking — toggles model-thinking visibility in the TUI (rendering only: the live block and future rounds show or hide; already-printed blocks stay as printed; the turn, history, and telemetry are untouched).";
+export const RENAME_USAGE = 'usage: /rename <name> — rename the current session (e.g. /rename Build authentication; quotes optional: /rename "name with spaces"). Bare /rename prints this usage.';
+export const GOAL_USAGE = "usage: /goal <objective> (set; replacing resets counters) · /goal (show with cumulative stats) · /goal pause · /goal resume (re-arms; idle starts a turn, busy resumes at turn end) · /goal clear (ends it)";
+// Pure arg parser for /rename (unit-tested): strips the command, trims,
+// then strips one layer of matching outer quotes (single or double) so
+// quoted names work even though the command line has no real parser.
+// Unquoted multi-word names work as-is (everything after /rename is the
+// name). Empty/whitespace-only input yields "" (caller prints usage).
+export function parseRenameArg(raw) {
+    const text = raw.trim();
+    const arg = text === "/rename" ? "" : text.slice("/rename".length).trim();
+    if (arg.length >= 2) {
+        const first = arg[0];
+        const last = arg[arg.length - 1];
+        if ((first === '"' || first === "'") && last === first) {
+            return arg.slice(1, -1).trim();
+        }
+    }
+    return arg;
+}
 export function filterSlashCommands(prefix) {
     const q = prefix.startsWith("/") ? prefix.slice(1) : prefix;
     // Exact match wins outright: a fully-typed command collapses the menu
@@ -164,6 +191,32 @@ export function paletteEntries(query) {
         if (c.description.toLowerCase().includes(q))
             out.push({ c, tier: 3, score: 0, idx });
     });
+    // Extension slash commands (ticket 04): the same prefix/fuzzy/
+    // description tiers over the live registry — a colliding name can never
+    // reach here (activation rejects it), and dispatch routes builtins first
+    // as backstop, so builtins are never shadowed.
+    const extCmds = listExtensionCommands();
+    const extNames = new Set(extCmds.map((c) => `/${c.name}`));
+    extCmds.forEach((cmd, extIdx) => {
+        const c = { name: `/${cmd.name}`, description: cmd.description };
+        const idx = SLASH_COMMANDS.length + extIdx;
+        const name = cmd.name.toLowerCase();
+        if (!q) {
+            out.push({ c, tier: 0, score: 0, idx });
+            return;
+        }
+        if (name.startsWith(q)) {
+            out.push({ c, tier: 1, score: 0, idx });
+            return;
+        }
+        const s = fuzzyScore(q, name);
+        if (s !== null) {
+            out.push({ c, tier: 2, score: s, idx });
+            return;
+        }
+        if (cmd.description.toLowerCase().includes(q))
+            out.push({ c, tier: 3, score: 0, idx });
+    });
     const catOrder = (n) => PALETTE_CATEGORY_ORDER.indexOf(paletteCategory(n));
     out.sort((a, b) => a.tier - b.tier ||
         (a.tier === 0
@@ -172,20 +225,25 @@ export function paletteEntries(query) {
     return out.map(({ c }) => ({
         name: c.name,
         description: c.description,
-        category: paletteCategory(c.name),
+        category: extNames.has(c.name) ? "Extensions" : paletteCategory(c.name),
         hint: PALETTE_HINTS[c.name] ?? null,
     }));
 }
 // Busy-gate shared by the slash menu and the palette: /compact sets the
 // pending flag for turn-end drain; /queue + /steer manage the running turn;
-// /autoscroll and /thinking only flip view flags (never touch the turn).
+// /autoscroll and /thinking only flip view flags (never touch the turn);
+// /goal only flips session goal state (never touches the turn);
+// /rename only renames the store record + title state (the later turn-end
+// persist preserves the title, so it never races the turn).
 // Every other command waits idle.
 export function slashRunsWhileBusy(name) {
     return (name === "/compact" ||
         name === "/queue" ||
         name === "/steer" ||
         name === "/autoscroll" ||
-        name === "/thinking");
+        name === "/thinking" ||
+        name === "/goal" ||
+        name === "/rename");
 }
 // Fuzzy subsequence match with gap/start/word-boundary scoring (lower is
 // better; null = no match). Pure — shared by the command filter, the skill
@@ -224,6 +282,15 @@ export function filterSkillPicker(entries, query) {
         return entries;
     return entries.filter((e) => e.name.toLowerCase().includes(q));
 }
+export function sameSkillMenuSnapshot(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        if (a[i].name !== b[i].name || a[i].description !== b[i].description)
+            return false;
+    }
+    return true;
+}
 // Pure menu builder (unit-tested): matching commands first (prefix tier in
 // stable order, then fuzzy by score), then matching skills as `/skill:name`
 // entries (prefix tier stable, then fuzzy). Skills join only once the query
@@ -232,14 +299,37 @@ export function filterSkillPicker(entries, query) {
 // name. Skill rows carry a truncated description for discovery. Pure — the
 // App feeds it the cached registry snapshot.
 export const SKILL_MENU_DESC_CHARS = 60;
-export function buildSlashMenu(input, skills) {
+export function buildSlashMenu(input, skills, extensions = []) {
     const items = filterSlashCommands(input).map((c) => ({
         name: c.name,
         description: c.description,
     }));
     if (input.length < 2)
         return { items, moreSkills: 0 };
+    // Extension slash commands (ticket 04): prefix tier in registration
+    // order (registration order is deterministic), then fuzzy by score —
+    // listed after builtins (exact dispatch routes builtins first, so an
+    // extension never shadows) and before skills.
     const q = input.slice(1);
+    const extPrefix = [];
+    const extFuzzy = [];
+    for (const e of extensions) {
+        const entry = `/${e.name}`;
+        if (e.name.startsWith(q) || entry.startsWith(input)) {
+            extPrefix.push(e);
+            continue;
+        }
+        const score = fuzzyScore(q, e.name);
+        if (score !== null)
+            extFuzzy.push({ e, score });
+    }
+    extFuzzy.sort((a, b) => a.score - b.score || (a.e.name < b.e.name ? -1 : 1));
+    for (const e of [...extPrefix, ...extFuzzy.map((f) => f.e)]) {
+        const desc = e.description.length > SKILL_MENU_DESC_CHARS
+            ? `${e.description.slice(0, SKILL_MENU_DESC_CHARS)}…`
+            : e.description;
+        items.push({ name: `/${e.name}`, description: desc });
+    }
     const skillQ = q.startsWith("skill:") ? q.slice("skill:".length) : q;
     const pushSkill = (s, shown, more) => {
         const entry = `/skill:${s.name}`;
@@ -292,6 +382,10 @@ export function commandUsage(name) {
             return SKILL_USAGE;
         case "/compact":
             return "Usage: /compact [focus text] — summarize older turns (works while busy; drains at turn end).";
+        case "/rename":
+            return RENAME_USAGE;
+        case "/goal":
+            return GOAL_USAGE;
         default:
             return null;
     }
@@ -311,6 +405,41 @@ export function modelsCacheKey(providerId, baseURL) {
     }
     return providerId;
 }
+export function filterSessionEntries(entries, query) {
+    const q = query.trim().toLowerCase();
+    if (!q)
+        return entries;
+    const scored = [];
+    entries.forEach((e, idx) => {
+        const titleScore = fuzzyScore(q, e.title);
+        const idScore = fuzzyScore(q, e.id);
+        let best = titleScore;
+        if (idScore !== null && (best === null || idScore + 5 < best)) {
+            best = idScore + 5;
+        }
+        if (best !== null)
+            scored.push({ e, score: best, idx });
+    });
+    scored.sort((a, b) => a.score - b.score || a.idx - b.idx);
+    return scored.map((s) => s.e);
+}
+// Relative age for the picker secondary line (unit-tested). Invalid dates
+// say "unknown" (never throw, never invent).
+export function formatSessionAge(nowMs, updatedAt) {
+    const t = Date.parse(updatedAt);
+    if (!Number.isFinite(t))
+        return "unknown";
+    const secs = Math.max(0, Math.floor((nowMs - t) / 1000));
+    if (secs < 60)
+        return "just now";
+    const mins = Math.floor(secs / 60);
+    if (mins < 60)
+        return `${mins}m ago`;
+    const hours = Math.floor(mins / 60);
+    if (hours < 24)
+        return `${hours}h ago`;
+    return `${Math.floor(hours / 24)}d ago`;
+}
 // Pure helpers for the elapsed/stall indicator (injectable now for tests).
 export function elapsedSecsSince(startMs, nowMs) {
     return Math.max(0, Math.floor((nowMs - startMs) / 1000));
@@ -471,14 +600,14 @@ export function helpListText() {
         `\nPlan mode is the read-only mode for risky work: explore with read/grep/glob/webfetch/websearch/todos/ask_question (all run free) while write/edit/bash are blocked pre-execution with a replan note (never a prompt, never silent — the ⚙ audit line still renders). Scoped /deny rules still win in plan mode; /allow, /trust, yolo, [a]lways, and skill grants cannot punch through it (/trust while in plan stays read-only with a notice — Tab out first). Exiting plan is the human approval: Tab from plan mode returns to normal (never yolo) and the todowrite checklist recorded while planning carries into implementation.` +
         `\n/trust toggles the session trust tier: with trust on, write/edit/bash auto-approve (one approval covers the whole task) without global yolo. Default off, normal mode stays the default; in-memory only, never saved. Every auto-approved call still renders its ⚙ line. The approval prompt also offers [t]rust-all mid-run; [n]/Esc still denies one call, Ctrl+C (or Esc while busy) still cancels the whole turn.` +
         `\n/allow <tool[:glob]> pre-approves matching write/edit/bash calls this session (no prompt; e.g. /allow bash:npm test*, /allow write:src/**; bare /allow bash matches any args). /deny <tool[:glob]> refuses matching calls before execution — the model sees the standard denial result and replans. Deny wins over /trust, yolo, [a]lways, and skill grants. Every auto-approved call still renders its ⚙ line. Rules are in-memory only (like /trust, never saved); /rules lists them, /rules clear wipes them.` +
-        `\nToken totals accumulate per session from API-reported usage only: the status line shows \`token: n/a\` until the API reports usage (never estimated, never 0-by-default); with usage it shows \`token: (P%) NK\` — NK is the cumulative session spend in K, P% is the CURRENT context load over the model's verified window (last POST prompt_tokens, else the 4ch/token estimate; models with no verified window show a bare \`token: NK\`, never an invented percent). /clear keeps the totals; /new resets them.` +
-        `\n/compact [focus text]: summarize older turns into one \`[Compacted context …]\` summary + keep the newest tail (~8000 estimated tokens, tool outputs capped at 2000 chars). Tiny history (≤1 user turn) reports \`(nothing to compact)\`. Works for unknown-window models (estimate only for the tail split).` +
+        `\nToken totals accumulate per session from API-reported usage only: the status line shows \`token: n/a\` until the API reports usage (never estimated, never 0-by-default); with usage it shows \`token: (P%) NK\` — NK is the cumulative session spend in K, P% is the CURRENT context load over the model's verified window (last POST input tokens incl. prefix cache, else the 4ch/token estimate; models with no verified window show a bare \`token: NK\`, never an invented percent). /clear keeps the totals; /new resets them.` +
+        `\n/compact [focus text]: summarize older turns into one \`[Compacted context …]\` summary + keep the newest tail (~20000 estimated tokens, tool outputs capped at 2000 chars). Tiny history (≤1 user turn) reports \`(nothing to compact)\`. Works for unknown-window models (estimate only for the tail split).` +
+        `\n/goal <objective>: pin one session goal (setting one replaces any live goal and resets its counters). Bare /goal shows it with cumulative stats (turns · requests · tokens · work). /goal pause halts the run but keeps the objective and stats; /goal resume re-arms it — idle starts a turn with the continuation text, busy resumes when the current turn ends. /goal clear ends it. The run has no turn cap: it continues turn-to-turn until paused, cleared, a complete/blocked verdict, or a thrown failure. Cancel and spent step/tool-call budgets pause (never clear). The model reports each turn via update_goal (continue with the next action, or complete/blocked with a reason); a report-less turn gets one bounded judge call when configured, otherwise continues — an unclear or failed judge pauses with the goal preserved. Three consecutive repeated tool results redirect with a replan nudge (the goal stays active). A complete with unverified code or open todos continues instead of stopping; blocked stops unconditionally (declared-unverifiable checks print openly in the verdict, never gate). /clear and /new end the goal; the live goal rides every session save with its stats intact (resume and session switches restore it; corrupt data loads as no goal). Compaction appends a Goal: line (text, state, stats, open todos) to the summary as the model's context backstop.` +
         `\nAuto-compact: after every completed turn the load is checked; on known-window models with load/window ≥ ${Math.round(COMPACT_PCT_DEFAULT * 100)}% (env ATOM_COMPACT_PCT percent, clamped 50–95, invalid→default) history auto-compacts before the next turn. Unknown-window models never auto-compact — use /compact manually.` +
         `\nThrash guard: 3 auto-compactions without the load dropping below threshold disables auto for the session with \`(auto-compact thrashing — disabled, use /compact or /clear)\`; manual /compact still works and resets the counter on success.` +
         `\n/provider: pick kilo|opencode-zen|openai|anthropic|deepseek|mistral|google-gemini|openai-compatible, paste a key once (stored in ~/.atom/auth.json, env wins). Kilo is the default: its free :free models (e.g. kilo-auto/free) work with no key; a Kilo key unlocks the full catalog. Switching provider keeps session history text; system prompt stays.` +
-        `\n/effort options: Default/Low/Medium/High/Max (wire: default/low/medium/high/max; Default omits reasoning_effort).` +
-        `\nNote: xhigh was requested but only Max is verified, so the top setting is Max, sent as max.` +
-        `\nGating: reasoning_effort is sent ONLY when effort != Default AND the model is one of ${[...REASONING_EFFORT_SUPPORTED_MODELS].join(", ")} AND the provider is opencode-zen; otherwise omitted (setting kept, warning shown, status shows (unsupported)). Effort persists across /model switches.` +
+        `\n/effort options: Auto/Low/Medium/High/Max. Auto omits the knob (the model decides); anything else sends it — reasoning_effort on OpenAI-chat providers (every provider, every model), a thinking budget on Anthropic, a thinkingLevel on Gemini (Max rides high).` +
+        `\nUnsupported is server-authoritative, never preemptive: a model that truly lacks the knob fails the POST with a 400 naming it, and the turn retries once without it (warning shown, setting kept, status never invents "(unsupported)"). Effort persists across /model switches.` +
         `\n/resume: restores the last saved session (turns, history, provider/model/effort/mode, usage totals). The conversation never auto-restores — sending a message without /resume starts fresh, and the next completed turn overwrites the save. Your provider/model/effort picks DO persist across restarts automatically (saved on every completed turn and on clean exit; explicit OPENCODE_ZEN_MODEL wins over the saved model). /clear clears the live session only (the save keeps the pre-clear state until the next completed turn overwrites it). /new saves first, then starts a brand-new session (conversation + counters reset, settings kept) — so /resume right after /new restores the pre-/new conversation. Split: /clear = wipe transcript, keep counters; /new = full fresh conversation + counters reset, previous kept for /resume.` +
         `\nSession autosave: every completed turn (and clean exit, plus after each successful compaction) writes ~/.atom/session.json (0600 POSIX, may contain pasted secrets — never commit it); failed/cancelled turns never touch it; a corrupt save loads as "(saved session unreadable — starting fresh)".` +
         `\nBusy status shows the live phase plus elapsed seconds in the status line (· thinking… 4s); >3s without token/tool/phase activity adds a dim waiting… hint (status-bar only, never saved). ` +
@@ -494,8 +623,8 @@ export function helpListText() {
 // as `token: n/a` — never 0, which would imply measurement). The segment
 // itself lives in ./context-windows.js (single source for the exact
 // `token: (P%) NK` format); StatusBar (./ui/status-bar.js) is its only
-// surface. P% tracks CURRENT context load (last prompt_tokens, else
-// 4ch/token estimate); NK tracks cumulative session spend.
+// surface. P% tracks CURRENT context load (last POST input tokens incl.
+// cache, else 4ch/token estimate); NK tracks cumulative session spend.
 function formatKEst(chars) {
     return `~${(estimateTokensForChars(chars) / 1000).toFixed(1)}K`;
 }
@@ -506,17 +635,13 @@ export function MissingKey() {
 // Measured once: TOOL_DEFINITIONS never changes at runtime, so the schema
 // size is a constant (avoids re-serializing ~15KB on every manager build).
 const TOOLS_SCHEMA_CHARS = JSON.stringify(TOOL_DEFINITIONS).length;
-export function App({ apiKey, endpoint, initialModel, initialModels, initialProvider, restorePrefs, authHome, skillDirs, configDirs, now, setIntervalFn, clearIntervalFn, setTimeoutFn, clearTimeoutFn, localDiscovery }) {
+// Render-count probe for propagation audits: incremented on every App body
+// execution (hostile-perf suite asserts token paints and ticks stay out of
+// here — only real state transitions may run the orchestrator).
+export const appRenderProbe = { count: 0 };
+export function App({ apiKey, endpoint, initialModel, initialModels, initialProvider, restorePrefs, authHome, skillDirs, configDirs, extensionsLockdown, enableExtensions, disableExtensions, now, setIntervalFn, clearIntervalFn, setTimeoutFn, clearTimeoutFn, localDiscovery }) {
+    appRenderProbe.count += 1;
     const { exit } = useApp();
-    // Measured terminal width for the status bar's fit-or-drop branch logic.
-    // Unknown (piped output) falls back to the bar's own default.
-    let termColumns;
-    try {
-        termColumns = useStdout()?.stdout?.columns;
-    }
-    catch {
-        termColumns = undefined;
-    }
     // Saved preferences (provider/model/effort + resolved key/endpoint), loaded
     // once when restorePrefs is on (prod). Explicit props always win; without
     // prefs the CLI defaults apply. Null in tests (flag off) and on any
@@ -689,14 +814,33 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         skillFilterRef.current = next;
         setSkillFilter(next);
     }
+    // /session picker (interactive switcher): snapshot state loaded ONCE per
+    // open (listSessions reads each record a single time), filtered in memory
+    // per keystroke. ↑/↓ + Enter switches, Esc cancels with the live session
+    // untouched. Same keyboard/window pattern as the /skills picker.
+    const [selectingSession, setSelectingSession] = useState(false);
+    const [sessionItems, setSessionItems] = useState([]);
+    const [sessionIndex, setSessionIndex] = useState(0);
+    const sessionIndexRef = useRef(0);
+    const [sessionFilter, setSessionFilter] = useState("");
+    const sessionFilterRef = useRef("");
+    function setSessionIndexBoth(next) {
+        sessionIndexRef.current = next;
+        setSessionIndex(next);
+    }
+    function setSessionFilterBoth(next) {
+        sessionFilterRef.current = next;
+        setSessionFilter(next);
+    }
     // Reasoning-effort picker (/effort): same pattern as the /model picker
     // (↑/↓ + Enter, Esc cancels). Saved effort restores with restorePrefs,
-    // else the atom.json default, else Default.
+    // else the atom.json default, else Auto. normalizeEffort keeps pre-auto
+    // "default" values (old saves/configs) working.
     const [selectingEffort, setSelectingEffort] = useState(false);
     const [effortIndex, setEffortIndex] = useState(0);
     const effortIndexRef = useRef(0);
-    const [effort, setEffort] = useState(prefs?.effort ?? atomConfig.reasoningEffort ?? "default");
-    const effortRef = useRef(prefs?.effort ?? atomConfig.reasoningEffort ?? "default");
+    const [effort, setEffort] = useState(normalizeEffort(prefs?.effort ?? atomConfig.reasoningEffort ?? "auto"));
+    const effortRef = useRef(normalizeEffort(prefs?.effort ?? atomConfig.reasoningEffort ?? "auto"));
     // /provider picker + key/baseURL prompts (same keyboard pattern).
     const [selectingProvider, setSelectingProvider] = useState(false);
     const [providerIndex, setProviderIndex] = useState(0);
@@ -844,17 +988,97 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         showThinkingRef.current = next;
         setShowThinking(next);
     }
-    // /autoscroll (session-only, default on). On = today's behavior: a
-    // following view extends with every appended turn. Off = appends during a
-    // busy turn freeze a following view at its current end instead of yanking
-    // it (the `↓ N new` indicator offers the jump back; End resumes). Idle
-    // appends always follow — freezing only matters while output streams.
+    // /autoscroll (session-only, default on). On follows new output as it
+    // arrives; off freezes the view at the first busy append (the `↓ N new`
+    // indicator offers the jump back). Bare /autoscroll toggles.
     const [autoScroll, setAutoScroll] = useState(true);
     const autoScrollRef = useRef(true);
     function setAutoScrollBoth(next) {
         autoScrollRef.current = next;
         setAutoScroll(next);
     }
+    // Session goal (ticket 01, in-memory only): at most one active goal per
+    // session. Ordinary chat messages never touch it — only /goal does.
+    const [goal, setGoal] = useState(null);
+    const goalRef = useRef(null);
+    function setGoalBoth(next) {
+        goalRef.current = next;
+        setGoal(next);
+    }
+    // Goal stat patch (ticket 02): accumulates into the LIVE goal's counters,
+    // preserving objective/active. Drops when no goal exists (e.g. cleared
+    // mid-turn — the slice belongs to no goal anymore). Never throws.
+    function patchGoalStats(patch) {
+        try {
+            const g = goalRef.current;
+            if (!g)
+                return;
+            setGoalBoth({ ...g, stats: patch(g.stats ?? emptyGoalStats()) });
+        }
+        catch {
+            // accounting never breaks the turn
+        }
+    }
+    // Usage accumulator (session totals + goal slice, real reports only): the
+    // turn's onUsage below and the goal-judge runner share it so judge spend
+    // bills exactly like model spend. Every reporting POST accumulates
+    // (tool-round POSTs and successful retries each count once — each was
+    // billed; failed attempts report nothing, so nothing is deduped).
+    // usageTotals drives NK only, never P%.
+    // updateLoad pins the load metric (P% source) to main-context POSTs: the
+    // judge's summary-sized request must not move it (same rule as the
+    // compaction summary POST — load tracks the main context).
+    function accumulateUsage(u, updateLoad = true) {
+        const prev = usageRef.current ?? {};
+        const next = { ...prev };
+        if (u.prompt_tokens !== undefined) {
+            next.prompt_tokens = (next.prompt_tokens ?? 0) + u.prompt_tokens;
+            // Load metric source: last POST's reported input-side tokens
+            // (prompt_tokens, cache-inclusive for exclusive-cache providers) —
+            // the per-POST value, NOT the accumulated total.
+            if (updateLoad)
+                lastPromptTokensRef.current = u.prompt_tokens;
+        }
+        if (u.completion_tokens !== undefined) {
+            next.completion_tokens = (next.completion_tokens ?? 0) + u.completion_tokens;
+        }
+        if (u.total_tokens !== undefined) {
+            next.total_tokens = (next.total_tokens ?? 0) + u.total_tokens;
+        }
+        // Prefix-cache counters accumulate like spend (real reports only;
+        // absent fields mean "not reported", never zero).
+        if (u.cacheReadTokens !== undefined) {
+            next.cacheReadTokens = (next.cacheReadTokens ?? 0) + u.cacheReadTokens;
+        }
+        if (u.cacheWriteTokens !== undefined) {
+            next.cacheWriteTokens = (next.cacheWriteTokens ?? 0) + u.cacheWriteTokens;
+        }
+        setUsageBoth(next);
+        // Goal token slice (ticket 02): every reporting POST also accrues
+        // to the live goal's spend — real reports only, and the session
+        // totals above are untouched.
+        try {
+            if (goalRef.current) {
+                const slice = goalTokensForUsage(u);
+                if (slice > 0)
+                    patchGoalStats((s) => ({ ...s, tokens: s.tokens + slice }));
+            }
+        }
+        catch {
+            // accounting never breaks the turn
+        }
+    }
+    // Loop-owned pause (ticket 02): cancel and spent budgets pause with a
+    // visible notice — the objective and stats survive, so /goal resume
+    // continues where the run stopped. No-op when absent/already paused
+    // (pause fires exactly once per run).
+    function pauseGoalWithNotice(notice) {
+        const g = goalRef.current;
+        if (!g || !g.active)
+            return;
+        setGoalBoth({ ...g, active: false });
+        pushInfo(notice);
+    }
     // Skill registry (cached metadata): one instance per App, scoped to the
     // same dirs the suite injects via skillDirs. Every discovery path below
     // reads through it — refresh() revalidates by stat (mtime+size) and only
@@ -871,9 +1095,13 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         try {
             const found = await skillRegistry.refresh();
             const { skills } = resolveSkills(found.skills);
-            setSkillMenu(skills
+            const next = skills
                 .filter((s) => s.userInvocable)
-                .map((s) => ({ name: s.name, description: s.description })));
+                .map((s) => ({ name: s.name, description: s.description }));
+            // Install only on change: the mount refresh routinely rediscovers the
+            // identical set mid-turn, and a fresh array identity would schedule a
+            // full App render for zero new information.
+            setSkillMenu((prev) => (sameSkillMenuSnapshot(prev, next) ? prev : next));
         }
         catch {
             // menu keeps its previous snapshot (a hiccup must never break input)
@@ -929,6 +1157,14 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     const askSelIndexRef = useRef(0);
     const [askCustom, setAskCustom] = useState("");
     const askCustomRef = useRef("");
+    // Extension UI surface (ticket 10): the version bump re-renders on every
+    // runtime UI mutation (segment/widget/notice/dialog); the dialog owns its
+    // own select/custom state mirroring the question modal above.
+    const [, bumpExtUI] = useState(0);
+    const [extDlgSel, setExtDlgSel] = useState(0);
+    const extDlgSelRef = useRef(0);
+    const [extDlgCustom, setExtDlgCustom] = useState("");
+    const extDlgCustomRef = useRef("");
     const [busy, setBusy] = useState(false);
     const busyRef = useRef(false);
     // Per-turn cancellation (Ctrl+C mid-loop): abort stops after the current
@@ -964,8 +1200,8 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     const [usageTotals, setUsageTotals] = useState(null);
     // Synchronous mirror of `usageTotals` (same save-time reason as turnsRef).
     const usageRef = useRef(null);
-    // Current context load driving status P% (last POST prompt_tokens when
-    // available, else the 4ch/token estimate). Null until the first turn
+    // Current context load driving status P% (last POST input tokens incl.
+    // cache when available, else the 4ch/token estimate). Null until the first turn
     // completes. NK stays cumulative; P must NOT use the cumulative total.
     const [contextLoad, setContextLoad] = useState(null);
     const contextLoadRef = useRef(null);
@@ -981,8 +1217,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             setGitInfo(null);
         }
     }
-    // Last POST's reported prompt_tokens (load metric source). Summary-request
-    // usage never touches this — only main-loop POSTs do.
+    // Last POST's reported input-side tokens (prompt_tokens, normalized at
+    // parse time to include exclusive cache counters) — the load metric source.
+    // Summary-request usage never touches this — only main-loop POSTs do.
     const lastPromptTokensRef = useRef(undefined);
     // Thrash guard: consecutive auto-compactions without the load dropping
     // below threshold. At 3, auto disables for the session (manual still
@@ -997,22 +1234,39 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // as a dim line while the transcript is empty; the conversation itself
     // never auto-restores (only provider/model/effort do, via restorePrefs).
     const [sessionHint] = useState(() => sessionExists(authHome));
+    // Active session display title (rename feedback + failure messages).
+    // Initialized from the store record when one already exists (sync disk
+    // read, no write — creation stays in the mount effect); thereafter the
+    // store is the source of truth and every sync point below refreshes it.
+    // Deliberately NOT in the status bar: the sole info bar has a fixed width
+    // budget and a ~30-char title wraps `mode: X` onto its own line. Session
+    // identity surfaces instead in the /session picker rows, the rename
+    // confirmation, and the switch/new notices.
+    const [sessionTitle, setSessionTitle] = useState(() => {
+        try {
+            return getActiveSession(authHome)?.title ?? "";
+        }
+        catch {
+            return "";
+        }
+    });
+    const sessionTitleRef = useRef(sessionTitle);
     // Reasoning label from response metadata (via onReasoning). The status
-    // line shows the session effort when non-Default (plus " (unsupported)"
-    // when the model is outside the verified-support set); when effort is
-    // Default it shows this label, falling back to `default`.
+    // line shows the session effort when non-Auto; when effort is Auto it
+    // shows this label, falling back to `auto`.
     const [reasoning, setReasoning] = useState(null);
-    // Live streaming state: `draft` is the growing assistant text (onToken),
-    // `phase`/`phaseDetail` track the observe→act→inspect→adjust loop
-    // (thinking|streaming|tool|retry|done), and `toolHint` shows a streamed
-    // tool name before its execution line lands.
-    const [draft, setDraft] = useState(null);
+    // Live streaming state: the growing assistant text (onToken) and the
+    // thinking channel (onThinking) live in a per-mount StreamStore, NOT in App
+    // useState. Token paints (up to ~15/sec) notify only the subscribed
+    // LiveTailHost — App's body and every other leaf skip them entirely.
+    // `phase`/`phaseDetail`/`toolHint` stay in App state: they change at most a
+    // few times per turn (low frequency, and StatusBar legitimately needs them).
+    const [streamStore] = useState(() => createStreamStore());
     // Thinking channel (onThinking): reasoning text streamed apart from the
     // answer, rendered in its own dim block below. The live value is transient
-    // like `draft` — cleared on every turn boundary below — but each completed
+    // like the draft — cleared on every turn boundary below — but each completed
     // round commits to the transcript via commitThinking (stays in the TUI,
     // never the model history) instead of being replaced and lost.
-    const [thinking, setThinking] = useState(null);
     const thinkingRef = useRef(null);
     // Move the accumulated round thinking into the transcript as a quiet
     // annotation turn (no-op when empty). Called when a new POST starts and at
@@ -1021,18 +1275,49 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     function commitThinking() {
         const text = thinkingRef.current;
         thinkingRef.current = null;
-        setThinking(null);
+        try {
+            // Drop any trailing paint: the commit carries the full text, and a
+            // late flush must never resurrect stale reasoning after the clear.
+            thinkingThrottleRef.current?.cancel();
+        }
+        catch {
+            // ignore (the store clear below still wins)
+        }
+        streamStore.setThinking(null);
         if (typeof text === "string" && text.length > 0) {
             appendTurns({ role: "assistant", content: text, thinking: true });
         }
     }
     function clearThinking() {
         thinkingRef.current = null;
-        setThinking(null);
+        try {
+            thinkingThrottleRef.current?.cancel();
+        }
+        catch {
+            // ignore (the store clear below still wins)
+        }
+        streamStore.setThinking(null);
     }
     const [phase, setPhase] = useState("idle");
     const [phaseDetail, setPhaseDetail] = useState("");
     const [toolHint, setToolHint] = useState(null);
+    // Synchronous mirrors for the hot loop callbacks: zen fires
+    // onPhase("streaming") on EVERY content chunk, so the handler must not
+    // issue same-value setStates per token (React re-invokes the component
+    // before bailing out — 15 App-body executions/sec for nothing).
+    // setPhaseBoth is the only writer; equal values skip setState entirely.
+    const phaseRef = useRef("idle");
+    const phaseDetailRef = useRef("");
+    function setPhaseBoth(next, detail) {
+        if (phaseRef.current !== next) {
+            phaseRef.current = next;
+            setPhase(next);
+        }
+        if (phaseDetailRef.current !== detail) {
+            phaseDetailRef.current = detail;
+            setPhaseDetail(detail);
+        }
+    }
     // Task B smoothness (a): throttled streaming draft. onToken pushes every
     // partial (activity/stall tracking stays per-token); paints coalesce to one
     // per DRAFT_THROTTLE_MS trailing window, flushed on done/turn-end.
@@ -1045,7 +1330,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 setTimeoutFn,
                 clearTimeoutFn,
                 onFlush: (text) => {
-                    setDraft(text);
+                    // Paint path only: the commit carries the byte-exact full text.
+                    // Writing the store notifies LiveTailHost alone — never App.
+                    streamStore.setDraft(text);
                 },
             });
             draftThrottleRef.current = th;
@@ -1060,6 +1347,26 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             // ignore (draft stays as-is; the commit carries the full text)
         }
     }
+    // Thinking paint coalescing: reasoning chunks arrive at token rate but
+    // paint through the same trailing window into the store (producer/consumer
+    // symmetry with the draft). thinkingRef stays synchronous per chunk so
+    // commitThinking can never lose reasoning to a pending trailing paint.
+    const thinkingThrottleRef = useRef(null);
+    function thinkingThrottler() {
+        let th = thinkingThrottleRef.current;
+        if (!th) {
+            th = createDraftThrottler({
+                now,
+                setTimeoutFn,
+                clearTimeoutFn,
+                onFlush: (text) => {
+                    streamStore.setThinking(text);
+                },
+            });
+            thinkingThrottleRef.current = th;
+        }
+        return th;
+    }
     // Phase 5: models-list session cache (successful live lists only, keyed
     // by modelsCacheKey). Failures fall back uncached, exactly as before.
     const modelsCacheRef = useRef(new Map());
@@ -1135,6 +1442,15 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // on the next activity.
     const [elapsedSecs, setElapsedSecs] = useState(0);
     const [stalled, setStalled] = useState(false);
+    // Mirror for the per-token stall reset (same same-value-setState hazard
+    // as phase above — noteTurnActivity runs on every chunk).
+    const stalledRef = useRef(false);
+    function setStalledBoth(next) {
+        if (stalledRef.current !== next) {
+            stalledRef.current = next;
+            setStalled(next);
+        }
+    }
     const turnStartRef = useRef(0);
     const lastActivityRef = useRef(0);
     const turnTimerRef = useRef(null);
@@ -1150,7 +1466,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // below re-wrap via trackHistory (never assign a raw array here).
     const historyRef = useRef(trackHistory([{ role: "system", content: withEnvBlock(systemPrompt) }]));
     // Task 6 per-turn env block (cwd, git branch/status, node, timestamp):
-    // pinned to history[0] (the only slot truncateHistory never drops), NEVER
+    // pinned to history[0] (the system prompt), NEVER
     // to user content. Refreshed once per turn in submit() + after doResume, so
     // the loop's many POSTs reuse one block (no per-POST shell-outs).
     // Failure-silent via withEnvBlock (missing git → block shrinks).
@@ -1260,7 +1576,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         catch {
             // ignore clock errors (stall hint just won't trigger)
         }
-        setStalled(false);
+        // Guarded: runs on every token/thinking/phase event, but only a
+        // true→false transition may schedule a render.
+        setStalledBoth(false);
     }
     function startTurnTimer() {
         clearTurnTimer();
@@ -1274,7 +1592,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         turnStartRef.current = start;
         lastActivityRef.current = start;
         setElapsedSecs(0);
-        setStalled(false);
+        setStalledBoth(false);
         try {
             turnTimerRef.current = (setIntervalFn ?? setInterval)(() => {
                 let t;
@@ -1286,7 +1604,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 }
                 setElapsedSecs(elapsedSecsSince(turnStartRef.current, t));
                 if (isStalledSince(lastActivityRef.current, t)) {
-                    setStalled(true);
+                    // Guarded: the stalled flag flips false→true once per silence
+                    // window, not on every tick within it.
+                    if (!stalledRef.current)
+                        setStalledBoth(true);
                 }
             }, TURN_TICK_MS);
         }
@@ -1301,6 +1622,26 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // in that gap; runLoopWithChat checks the signal before the first POST).
     useEffect(() => {
         return () => {
+            // Extension host teardown: subscribers observe the shutdown, then the
+            // runtime is dropped. Best-effort and synchronous from React's side
+            // (emit records its own errors, never rejects).
+            // Extension UI teardown (ticket 10): remove every contribution with
+            // zero residue first, then let subscribers observe the shutdown —
+            // anything a shutdown handler re-registers lands in a dropped
+            // runtime (ref nulled below) and never paints.
+            try {
+                extRuntimeRef.current?.disposeUI();
+            }
+            catch {
+                // ignore
+            }
+            try {
+                void extRuntimeRef.current?.emit("session_shutdown", { reason: "quit" });
+            }
+            catch {
+                // ignore
+            }
+            extRuntimeRef.current = null;
             // Local observability: close the session trace on unmount (covers
             // every exit path — /exit, Ctrl+C idle, test teardown) and flush.
             // Best-effort, never throws; idempotent with closeTelemetry callers.
@@ -1329,6 +1670,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             }
             try {
                 draftThrottleRef.current?.cancel();
+                thinkingThrottleRef.current?.cancel();
             }
             catch {
                 // ignore
@@ -1432,9 +1774,21 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         askCustomRef.current = next;
         setAskCustom(next);
     }
+    function setExtDlgSelBoth(next) {
+        extDlgSelRef.current = next;
+        setExtDlgSel(next);
+    }
+    function setExtDlgCustomBoth(next) {
+        extDlgCustomRef.current = next;
+        setExtDlgCustom(next);
+    }
     function setEffortBoth(next) {
-        effortRef.current = next;
-        setEffort(next);
+        // Central normalization point: every restore path (saved prefs, session
+        // switch, picker) funnels through here, so a legacy "default" can never
+        // linger in live state.
+        const canonical = normalizeEffort(next);
+        effortRef.current = canonical;
+        setEffort(canonical);
     }
     function setEffortIndexBoth(next) {
         effortIndexRef.current = next;
@@ -1499,6 +1853,8 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setModelFilterBoth("");
         setSelectingSkills(false);
         setSkillFilterBoth("");
+        setSelectingSession(false);
+        setSessionFilterBoth("");
         setSelectingEffort(false);
         setSelectingProvider(false);
         setKeyPromptBoth(null);
@@ -1531,6 +1887,46 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             pushInfo("(skill discovery failed — no skills listed)");
         });
     }
+    // /session picker open: snapshot the store list ONCE (most-recent-first
+    // from listSessions) with the active record marked, then filter in memory
+    // per keystroke (no disk reads while typing). Idle-only (callers gate on
+    // busy like every picker — a mid-turn switch would race the loop's own
+    // history writes). Empty store degrades to a notice (unreachable while
+    // the mount bootstrap holds, but never a blank popup).
+    function openSessionPicker(initialFilter) {
+        setInputBoth("");
+        closeAllPickers();
+        let records;
+        try {
+            records = listSessions(authHome);
+        }
+        catch {
+            pushInfo("(could not list sessions — store unreadable)");
+            return;
+        }
+        if (records.length === 0) {
+            pushInfo("(no sessions yet — your current conversation is saved automatically)");
+            return;
+        }
+        let activeId = null;
+        try {
+            activeId = getActiveSessionId(authHome);
+        }
+        catch {
+            activeId = null;
+        }
+        setSessionItems(records.map((s) => ({
+            id: s.id,
+            title: s.title,
+            updatedAt: s.updatedAt,
+            createdAt: s.createdAt,
+            turnCount: s.turns.length,
+            active: s.id === activeId,
+        })));
+        setSessionFilterBoth(initialFilter);
+        setSessionIndexBoth(0);
+        setSelectingSession(true);
+    }
     // Unified /model entries for this render: active provider's current list
     // first, then every other keyed provider's cached-or-fallback list (pure,
     // local-only — see modelPickerEntries). Called from the /model open path,
@@ -1614,7 +2010,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             : def.defaultModel);
         setModelBoth(nextModel);
         setProviderBoth(pickedId);
-        // Provider switch resets the load latch: the last reported prompt_tokens
+        // Provider switch resets the load latch: the last reported input tokens
         // belonged to the old provider/model tokenizer, so the estimate applies
         // until the new provider reports (usageTotals spend is untouched).
         resetContextLoadToEstimate();
@@ -1652,6 +2048,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         usageRef.current = next;
         setUsageTotals(next);
     }
+    function setSessionTitleBoth(next) {
+        sessionTitleRef.current = next;
+        setSessionTitle(next);
+    }
     function setContextLoadBoth(next) {
         contextLoadRef.current = next;
         setContextLoad(next);
@@ -1661,7 +2061,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setAutoDisabled(next);
     }
     // Recompute contextLoad after a committed turn (or compaction): last
-    // POST prompt_tokens when available, else the 4ch/token estimate.
+    // POST input tokens (incl. cache) when available, else the 4ch/token estimate.
     function refreshContextLoad() {
         // No usage yet → no load (status keeps `token: n/a`).
         if (!usageRef.current) {
@@ -1672,7 +2072,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setContextLoadBoth(load);
         return load;
     }
-    // Load-reset contract (hold-last-known): the reported prompt_tokens survive
+    // Load-reset contract (hold-last-known): the reported input tokens survive
     // silent POSTs — estimates never override a fresher report — and reset ONLY
     // here: compaction, /clear, resume, and model/provider switch. After a reset
     // the chars/4 estimate applies until the next report arrives.
@@ -1688,9 +2088,49 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     function pushInfo(content) {
         appendTurns({ role: "tool", content });
     }
+    // Extension slash-command execution (ticket 04): handlers run outside
+    // the model turn loop — no history writes, no telemetry turn, no busy
+    // flag. say() posts transcript turns only (pushInfo), so a throwing
+    // handler surfaces one clean error line and leaves the model session
+    // untouched. The context is bound to the runtime generation at launch:
+    // a session replacement mid-command makes further ctx use throw into
+    // the same clean-error path.
+    async function runExtensionCommandFromApp(name, args) {
+        if (extCommandRunningRef.current) {
+            pushInfo("(an extension command is already running — wait for its prompt)");
+            return;
+        }
+        extCommandRunningRef.current = true;
+        try {
+            const runtime = extRuntimeRef.current;
+            const gen = runtime?.generation ?? 0;
+            const result = await runExtensionCommand(name, args, {
+                cwd: storeCwd(),
+                askUser,
+                getSession: () => ({
+                    id: activeSessionIdRef.current,
+                    title: sessionTitleRef.current,
+                    turnCount: turnsRef.current.length,
+                }),
+                say: (message) => {
+                    pushInfo(message);
+                },
+                checkStale: () => {
+                    if (runtime && runtime.generation !== gen) {
+                        throw new Error("extension context is stale after a session replacement — rerun the command for fresh state");
+                    }
+                },
+            });
+            if (!result.ok)
+                pushInfo(result.error);
+        }
+        finally {
+            extCommandRunningRef.current = false;
+        }
+    }
     // The session's ContextManager: window-derived budgets for the active
-    // model, measured tool schemas, configured ceilings. Built fresh per call
-    // (pure math, no I/O beyond the resolved ceiling sources) so it always sees
+    // model plus measured tool schemas. Built fresh per call
+    // (pure math, no I/O beyond compactPct) so it always sees
     // the current model; history is measured live on every use. The schema size
     // is memoized once — TOOL_DEFINITIONS never changes at runtime, so every
     // turn must not re-serialize 15KB to ask.
@@ -1721,6 +2161,11 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         const loadLine = u.loadPct !== undefined && b.windowTokens !== undefined
             ? `load: ${formatKEst(u.historyChars)} (${u.loadPct}% of ${(b.windowTokens / 1000).toFixed(0)}K verified window)`
             : `load: ${formatKEst(u.historyChars)} (no verified window — auto-compact off, use /compact manually)`;
+        // Window-derived allowance is informational only: history is never
+        // truncated, compaction is the only pressure valve.
+        const allowanceLine = b.historyChars !== undefined && b.windowTokens !== undefined
+            ? `allowance: ~${(b.historyChars / 1000).toFixed(0)}K chars of history fit the ${(b.windowTokens / 1000).toFixed(0)}K verified window`
+            : `allowance: no verified window — history uncapped, use /compact manually`;
         const cfg = atomConfigLoad;
         const cfgSources = cfg.sources.project && cfg.sources.global
             ? "project + global"
@@ -1756,7 +2201,8 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             `skill injections live in history: ${skillLoads}\n` +
             `${cfgLine}\n` +
             `${cacheLine}\n` +
-            `${loadLine} · budget: ${b.effectiveMaxMessages} msgs / ${(b.effectiveMaxChars / 1000).toFixed(0)}K chars`);
+            `${loadLine}\n` +
+            `${allowanceLine}`);
     }
     // Load a resolved skill into the session (tickets 03/06) with
     // progressive-disclosure tiers (Claude-Code-style):
@@ -1825,6 +2271,247 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // committed diff previews (Turn.diff) are display-only and never saved:
     // they can hold whole file contents (bloat) and would render stale
     // after later edits, so /resume restores label-only turns.
+    //
+    // Multi-session mirror (src/sessions.ts): every conversation auto-belongs
+    // to a durable session record (~/.atom/sessions/<id>.json + active
+    // pointer). persistSession() also mirrors the same committed snapshot
+    // into the active record via persistStoreSession() below, so completed
+    // turns, clean exits, and successful compactions bump updatedAt there too.
+    // Failures/cancels never reach here (same rollback rule as legacy).
+    // Active id lives in a ref only — never a session list in runtime state.
+    const activeSessionIdRef = useRef(null);
+    // Extension host (ticket: extension system 01): the loaded runtime lives
+    // in a ref so session replacements can invalidate it without re-render.
+    // Null until the mount-time load completes (or when nothing is installed).
+    const extRuntimeRef = useRef(null);
+    // An extension slash command in flight owns the question modal while
+    // prompting (single slot shared with ask_question): submit routes new
+    // model turns and nested extension commands aside with a notice until
+    // this clears, so resolvers can never clobber each other.
+    const extCommandRunningRef = useRef(false);
+    /**
+     * Session-replacement boundary for extensions: previously handed-out API
+     * objects go stale (loud on use), then session_start fires for the new
+     * lineage. This is the sanctioned post-replacement continuation — work
+     * that must continue after a replacement runs in session_start handlers
+     * via their fresh API, never via a captured pre-replacement handle (which
+     * throws). Never throws; a missing runtime is a no-op. Callers bind the
+     * new session id via runtime.setSessionId BEFORE calling, so start
+     * handlers observe the new session's extension state.
+     */
+    function replaceExtensionContext(reason) {
+        const runtime = extRuntimeRef.current;
+        if (!runtime)
+            return;
+        try {
+            runtime.invalidate(`extension context is stale after session ${reason} — use the fresh API passed to your session_start handler`);
+        }
+        catch {
+            // invalidate never throws by contract; defensive only.
+        }
+        void runtime.emit("session_start", { reason });
+    }
+    function storeCwd() {
+        try {
+            return process.cwd();
+        }
+        catch {
+            return "";
+        }
+    }
+    // Ensure exactly one active persistent session exists (fresh mount creates
+    // one with the current provider/model/effort/mode + cwd). Never throws,
+    // never blocks render — disk errors leave the ref null and the next
+    // persist retries.
+    function ensureStoreSession() {
+        try {
+            const existing = activeSessionIdRef.current;
+            // The record may vanish under a running process (external delete,
+            // corrupted file): a stale cached id must re-ensure instead of
+            // persisting into the void (every later turn would silently skip).
+            if (existing) {
+                try {
+                    if (getSession(existing, authHome))
+                        return existing;
+                }
+                catch {
+                    // fall through to re-ensure below
+                }
+            }
+            const s = ensureActiveSession({
+                cwd: storeCwd(),
+                provider: providerRef.current,
+                model: modelRef.current,
+                effort: effortRef.current,
+                mode: modeRef.current,
+            }, authHome);
+            activeSessionIdRef.current = s.id;
+            // The store owns the title (a /rename from an earlier mount must show
+            // after restart); sync the display state on every ensure.
+            setSessionTitleBoth(s.title);
+            return s.id;
+        }
+        catch {
+            return null;
+        }
+    }
+    // Mirror the committed snapshot into the active multi-session record
+    // (single updateSession so updatedAt bumps on every committed turn).
+    // Disk errors ignored, like the legacy save above.
+    function persistStoreSession() {
+        try {
+            const id = ensureStoreSession();
+            if (!id)
+                return;
+            updateSession(id, {
+                history: historyRef.current,
+                turns: turnsRef.current.map((t) => {
+                    const { diff: _dropped, ...rest } = t;
+                    return rest;
+                }),
+                usageTotals: usageRef.current,
+                // Piggyback: the live goal rides every store persist (same call
+                // as every completed turn — no new save cadence). Switching away
+                // snapshots this session's goal into its own record first, so a
+                // switch back restores it and sessions never leak goals.
+                goal: serializeGoalForPersist(goalRef.current),
+                provider: providerRef.current,
+                model: modelRef.current,
+                effort: effortRef.current,
+                mode: modeRef.current,
+                cwd: storeCwd(),
+            }, authHome);
+        }
+        catch {
+            // ignore disk errors (in-memory session still applies)
+        }
+    }
+    // One boot notice for the extension host (ticket 07): the existing
+    // loaded/failed line, plus one line per skip reason so declined/untrusted/
+    // locked-down/disabled extensions stay visible with how to enable them.
+    // Silent when nothing loaded, failed, or skipped.
+    function announceExtensionRuntime(runtime) {
+        if (runtime.loaded.length > 0 || runtime.errors.length > 0) {
+            const names = runtime.loaded.map((e) => e.name).join(", ");
+            const problems = runtime.errors.map((e) => `${e.path}: ${e.error}`).join("; ");
+            pushInfo(`(extensions: ${runtime.loaded.length} loaded${names ? ` (${names})` : ""}` +
+                `${problems ? `; ${runtime.errors.length} failed: ${problems}` : ""})`);
+        }
+        const byReason = new Map();
+        for (const s of runtime.skipped) {
+            const list = byReason.get(s.reason);
+            if (list)
+                list.push(s.name);
+            else
+                byReason.set(s.reason, [s.name]);
+        }
+        const whyFor = (reason) => {
+            switch (reason) {
+                case "lockdown":
+                    return "lockdown is on (--no-extensions)";
+                case "untrusted-project":
+                    return "the project is not trusted";
+                case "disabled":
+                    return "they match a disable pattern";
+                case "not-enabled":
+                    return "they match no enable pattern";
+            }
+        };
+        const hintFor = (reason) => {
+            switch (reason) {
+                case "lockdown":
+                    return "start without --no-extensions to load them";
+                case "untrusted-project":
+                    return "trust the project when asked on next startup to load them";
+                case "disabled":
+                    return 'remove the --disable-extension / atom.json "extensions.disabled" pattern to load them';
+                case "not-enabled":
+                    return 'match them with --enable-extension / atom.json "extensions.enabled" to load them';
+            }
+        };
+        for (const [reason, names] of byReason) {
+            const unique = [...new Set(names)];
+            pushInfo(`(extensions: ${unique.length} skipped (${unique.join(", ")}) — ${whyFor(reason)}; ${hintFor(reason)})`);
+        }
+    }
+    // Mount bootstrap: claim/create the active session before any turn can
+    // persist, so every normal conversation belongs to a durable session.
+    // Startup never auto-restores conversation state (fresh + legacy hint,
+    // matching current UX) — this only ensures the record exists.
+    useEffect(() => {
+        ensureStoreSession();
+        // Extension host boot (best-effort, never blocks render): trust-gated
+        // (ticket 07). Global-scope extensions are user-owned (implicitly
+        // trusted, like the user's own config); project-scope + explicit-path
+        // extensions never execute until the project is trusted — the user is
+        // asked once via the question modal (declining, or Esc, leaves them fully
+        // inert with a visible notice; the grant persists per project dir, so a
+        // decline simply asks again next boot). Lockdown (--no-extensions) skips
+        // the prompt and boots with zero third-party extensions. A loaded runtime
+        // still records per-extension errors — loadExtensions never throws here.
+        void (async () => {
+            const cwd = storeCwd();
+            const cfgExtensions = atomConfig.extensions;
+            // CLI patterns win over atom.json when set (same CLI-over-config
+            // layering as every other value); the project/global config merge
+            // already applied inside loadAtomConfig.
+            const enabled = enableExtensions !== undefined && enableExtensions.length > 0
+                ? enableExtensions
+                : (cfgExtensions?.enabled ?? []);
+            const disabled = disableExtensions !== undefined && disableExtensions.length > 0
+                ? disableExtensions
+                : (cfgExtensions?.disabled ?? []);
+            const lockdown = extensionsLockdown === true;
+            const finish = async (trusted) => {
+                const runtime = await loadExtensions({
+                    home: authHome,
+                    cwd,
+                    builtinSlashCommands: SLASH_COMMANDS.map((c) => c.name),
+                    projectTrusted: trusted,
+                    lockdown,
+                    enabledPatterns: enabled,
+                    disabledPatterns: disabled,
+                    // The TUI fulfills extension dialogs (ticket 10); headless modes
+                    // never load extensions, so they stay inert by construction.
+                    interactive: true,
+                });
+                extRuntimeRef.current = runtime;
+                // Live UI surface: every segment/widget/notice/dialog mutation
+                // re-renders (segments update across turns with no other trigger).
+                runtime.subscribeUI(() => {
+                    bumpExtUI((v) => v + 1);
+                });
+                // Bind the store session BEFORE the startup emit, so session_start
+                // handlers observe the reloaded session's extension state (ticket 05:
+                // per-session state restores on reload through the record metadata).
+                runtime.setSessionId(activeSessionIdRef.current);
+                announceExtensionRuntime(runtime);
+                return runtime.emit("session_start", { reason: "startup" });
+            };
+            if (!lockdown) {
+                const gated = discoverExtensionEntries({ home: authHome, cwd }).filter((e) => e.scope !== "global");
+                if (gated.length > 0 && !isProjectTrusted(cwd, authHome)) {
+                    const names = [...new Set(gated.map((e) => resolveExtensionName(e.path)))];
+                    let answer;
+                    try {
+                        answer = await askUser(projectTrustQuestion(names), ["Trust and load", "Keep disabled"]);
+                    }
+                    catch {
+                        answer = "Keep disabled"; // Esc declines: inert + visible, asked again next boot
+                    }
+                    const trusted = answer === "Trust and load";
+                    if (trusted)
+                        grantProjectTrust(cwd, authHome);
+                    await finish(trusted);
+                    return;
+                }
+            }
+            await finish(isProjectTrusted(cwd, authHome));
+        })().catch(() => {
+            // loadExtensions never rejects by contract; defensive only.
+        });
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
     function persistSession() {
         try {
             saveSession({
@@ -1833,6 +2520,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 effort: effortRef.current,
                 mode: modeRef.current,
                 usageTotals: usageRef.current,
+                // Piggyback: the live goal rides the legacy save too, so /resume
+                // and restarts bring it back with its cumulative stats intact.
+                goal: goalRef.current,
                 history: historyRef.current,
                 turns: turnsRef.current.map((t) => {
                     const { diff: _dropped, ...rest } = t;
@@ -1843,6 +2533,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         catch {
             // ignore disk errors (in-memory session still applies)
         }
+        persistStoreSession();
     }
     // Local observability persistence: flush the current telemetry session
     // file (atomic, best-effort). Called on turn boundaries and session events —
@@ -1900,6 +2591,20 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // failure: old history untouched + inline error (oversize retry-once
     // already handled inside requestCompactSummary, which appends /clear).
     // isAuto drives the thrash guard; manual resets the counter on success.
+    // A non-reducing auto outcome (load still at/above threshold, or an
+    // extension veto that changed nothing) counts toward the guard via
+    // bumpAutoStreak, so a standing veto disables auto with the standard
+    // notice instead of re-firing (and re-notifying) after every turn.
+    function bumpAutoStreak() {
+        autoStreakRef.current += 1;
+        if (isThrashDisabled(autoStreakRef.current)) {
+            setAutoDisabledBoth(true);
+            appendTurns({
+                role: "tool",
+                content: "(auto-compact thrashing — disabled, use /compact or /clear)",
+            });
+        }
+    }
     async function doCompact(focusText, isAuto) {
         if (countUserTurns(historyRef.current) <= 1) {
             if (!isAuto)
@@ -1930,52 +2635,109 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         }
         const baseURL = chatBaseURL(providerRef.current);
         try {
-            const summary = await requestCompactSummary({
-                provider: providerRef.current,
-                apiKey: submitKey,
-                model: modelRef.current,
-                systemContent,
-                head: split.head,
-                focusText,
-                baseURL,
-                endpointOverride: activeEndpoint,
-                onUsage: (u) => {
-                    // Totals keep accumulating (real summary spend); load source
-                    // untouched (summary prompt reflects head size, not new context).
-                    const prev = usageRef.current ?? {};
-                    const next = { ...prev };
-                    if (u.prompt_tokens !== undefined) {
-                        next.prompt_tokens = (next.prompt_tokens ?? 0) + u.prompt_tokens;
-                    }
-                    if (u.completion_tokens !== undefined) {
-                        next.completion_tokens = (next.completion_tokens ?? 0) + u.completion_tokens;
-                    }
-                    if (u.total_tokens !== undefined) {
-                        next.total_tokens = (next.total_tokens ?? 0) + u.total_tokens;
-                    }
-                    if (u.cacheReadTokens !== undefined) {
-                        next.cacheReadTokens = (next.cacheReadTokens ?? 0) + u.cacheReadTokens;
-                    }
-                    if (u.cacheWriteTokens !== undefined) {
-                        next.cacheWriteTokens = (next.cacheWriteTokens ?? 0) + u.cacheWriteTokens;
-                    }
-                    // Only accumulate when the summary actually reported usage;
-                    // an empty onUsage keeps totals byte-identical.
-                    if (u.prompt_tokens !== undefined ||
-                        u.completion_tokens !== undefined ||
-                        u.total_tokens !== undefined ||
-                        u.cacheReadTokens !== undefined ||
-                        u.cacheWriteTokens !== undefined) {
-                        setUsageBoth(next);
-                    }
-                    // Local observability: compaction spend is session-level (it
-                    // summarizes many turns and often lands after its turn ended), so
-                    // it is kept separate from per-turn usage. No-op when empty.
-                    telemetry.recordCompactionUsage(u, isAuto ? "auto" : "manual");
-                },
-            });
-            // Atomic swap: build the new history first, then replace.
-            const next = buildCompactedHistory(systemMsg, summary, split.tail, split.olderTurnCount);
+            // Extension gate (ticket 09): consulted BEFORE the builtin summary
+            // POST with the reason and the pending head/tail split as read-only
+            // deep copies — a mutating hook cannot corrupt the split below, and a
+            // cancelled attempt returns before EVERY write (history, snapshots,
+            // totals, ledger stay byte-identical). Zero-cost when no hooks are
+            // registered: the snapshot is a single spread and no await runs, so
+            // hook-free auto-compact keeps its timing (the zen.ts context-hook
+            // precedent). Fail-open: a throwing hook records a visible error and
+            // compaction falls back to the builtin summary, never half-compacted.
+            let customSummary = null;
+            const compactHooks = beforeCompactInterceptors();
+            if (compactHooks.length > 0) {
+                const verdict = await applyBeforeCompact(compactHooks, {
+                    reason: isAuto ? "auto" : "manual",
+                    focusText,
+                    head: split.head,
+                    tail: split.tail,
+                    olderTurnCount: split.olderTurnCount,
+                });
+                if (verdict.cancelled) {
+                    pushInfo(verdict.cancelReason
+                        ? `(compaction cancelled: ${verdict.cancelReason})`
+                        : "(compaction cancelled by an extension)");
+                    // A vetoed auto-compaction changes nothing, so the load that
+                    // triggered it is still above threshold — count it toward the
+                    // thrash guard (manual cancels are deliberate one-shots, untouched).
+                    if (isAuto)
+                        bumpAutoStreak();
+                    return false;
+                }
+                if (verdict.errors.length > 0) {
+                    pushInfo(`(extension compact hook failed — using builtin summary: ${verdict.errors.join("; ")})`);
+                }
+                if (verdict.summary !== null)
+                    customSummary = verdict.summary;
+            }
+            // Single injection point: a custom summary replaces the builtin text
+            // here and flows through the SAME post-processing below (goal block +
+            // touched-files append/fit, boundary marker, atomic swap, save,
+            // snapshot clearing) exactly like builtin output — never a parallel
+            // pipeline.
+            const summary = customSummary ??
+                (await requestCompactSummary({
+                    provider: providerRef.current,
+                    apiKey: submitKey,
+                    model: modelRef.current,
+                    systemContent,
+                    head: split.head,
+                    focusText,
+                    // Ticket 08: the live goal objective (active or paused) hints the
+                    // summarizer to preserve goal-relevant content; undefined keeps
+                    // the legacy instruction byte-identical. goalRef survives the
+                    // swap below untouched, so post-compact turns read the same live
+                    // goal through the loop's getGoal seam.
+                    goalObjective: goalRef.current?.objective,
+                    baseURL,
+                    endpointOverride: activeEndpoint,
+                    onUsage: (u) => {
+                        // Totals keep accumulating (real summary spend); load source
+                        // untouched (summary prompt reflects head size, not new context).
+                        const prev = usageRef.current ?? {};
+                        const next = { ...prev };
+                        if (u.prompt_tokens !== undefined) {
+                            next.prompt_tokens = (next.prompt_tokens ?? 0) + u.prompt_tokens;
+                        }
+                        if (u.completion_tokens !== undefined) {
+                            next.completion_tokens = (next.completion_tokens ?? 0) + u.completion_tokens;
+                        }
+                        if (u.total_tokens !== undefined) {
+                            next.total_tokens = (next.total_tokens ?? 0) + u.total_tokens;
+                        }
+                        if (u.cacheReadTokens !== undefined) {
+                            next.cacheReadTokens = (next.cacheReadTokens ?? 0) + u.cacheReadTokens;
+                        }
+                        if (u.cacheWriteTokens !== undefined) {
+                            next.cacheWriteTokens = (next.cacheWriteTokens ?? 0) + u.cacheWriteTokens;
+                        }
+                        // Only accumulate when the summary actually reported usage;
+                        // an empty onUsage keeps totals byte-identical.
+                        if (u.prompt_tokens !== undefined ||
+                            u.completion_tokens !== undefined ||
+                            u.total_tokens !== undefined ||
+                            u.cacheReadTokens !== undefined ||
+                            u.cacheWriteTokens !== undefined) {
+                            setUsageBoth(next);
+                        }
+                        // Local observability: compaction spend is session-level (it
+                        // summarizes many turns and often lands after its turn ended), so
+                        // it is kept separate from per-turn usage. No-op when empty.
+                        telemetry.recordCompactionUsage(u, isAuto ? "auto" : "manual");
+                    },
+                }));
+            // Atomic swap: build the new history first, then replace. The head's
+            // touched files (collected from the committed tool_calls the loop
+            // already recorded — no new tracking) plus the canonical `Goal:` block
+            // (live text, state, cumulative stats, open checklist — the model's
+            // context backstop; record restore stays the resume path) ride inside
+            // the summary within budget, so compacted and resumed sessions continue
+            // the same goal without re-exploring; over-budget lists shrink instead
+            // of failing compaction (model text + goal block are never cut).
+            const goalBlock = formatGoalForCompact(goalRef.current, getTodos().map((t) => ({ content: t.content, status: t.status })));
+            const fitted = fitSummaryWithFilesAndGoal(summary, collectTouchedFiles(split.head), goalBlock);
+            const next = buildCompactedHistory(systemMsg, fitted.text, split.tail, split.olderTurnCount);
             // Replacement: re-wrap so the ledger restarts from the compacted array
             // (the old ledger is discarded with the old array).
             historyRef.current = trackHistory(next);
@@ -1988,7 +2750,8 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 pushInfo(`(/compact — discarded ${compactDrops} file checkpoint(s); undos do not cross a compaction)`);
             }
             // P% must drop immediately: the old lastPromptTokens reflects the
-            // pre-compact context, so clear it and use the new-history estimate.
+            // pre-compact context (and its cache counters), so clear it and use
+            // the new-history estimate.
             lastPromptTokensRef.current = undefined;
             const newLoad = estimateTokensForChars(historyChars(historyRef.current));
             setContextLoadBoth(newLoad);
@@ -1999,14 +2762,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                     autoStreakRef.current = 0;
                 }
                 else {
-                    autoStreakRef.current += 1;
-                    if (isThrashDisabled(autoStreakRef.current)) {
-                        setAutoDisabledBoth(true);
-                        appendTurns({
-                            role: "tool",
-                            content: "(auto-compact thrashing — disabled, use /compact or /clear)",
-                        });
-                    }
+                    bumpAutoStreak();
                 }
             }
             else {
@@ -2077,6 +2833,11 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setEffortBoth(s.effort);
         setModeBoth(s.mode);
         setUsageBoth(s.usageTotals);
+        // Ticket 07: the saved goal restores verbatim (text, flag, cumulative
+        // stats — never reset) and mirrors into the store record below, so the
+        // resumed session continues the goal on its next turn. Corrupt/absent
+        // goal data restores as no-goal without touching the conversation.
+        setGoalBoth(restoreGoalFromPersist(s.goal));
         // Replacement: wrap the restored array (see the init comment).
         historyRef.current = trackHistory([...s.history]);
         // Task 6: refresh the pinned env block on the restored system line
@@ -2106,11 +2867,11 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 content: `(/resume — discarded ${resumedDrops} live file checkpoint(s); undos do not cross a resume)`,
             });
         }
-        // Same window-derived caps as the live path (the restored model is
-        // already in modelRef above).
-        contextManager().trimForSend(historyRef.current, (msg) => {
-            pendingNotices.push({ role: "tool", content: `⚠ ${msg}` });
-        }, undefined, openTodoNeedles());
+        // Restored history is used whole: no caps, no trimming. A resumed
+        // session knows what was touched without re-exploring the tree.
+        for (const section of collectStoredTouchedFiles(historyRef.current)) {
+            pendingNotices.push({ role: "tool", content: section });
+        }
         // Remount the turns <Static> (same mechanism as /clear and /new): Ink's
         // Static only renders newly appended indices, so restoring a transcript
         // over a non-empty rendered buffer (e.g. the /new boundary line) would
@@ -2128,6 +2889,175 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         ]);
         telemetry.recordEvent("resume", `restored session saved at ${s.savedAt} (${s.turns.length} turns)`);
         persistTelemetry();
+        // Mirror the restored legacy state into the active multi-session record
+        // (create+activate when none exists). Startup itself never auto-restores
+        // the store — only this explicit /resume does.
+        persistStoreSession();
+        // Same record stays active across a legacy resume — re-bind it so start
+        // handlers observe the restored session's extension state (ticket 05).
+        extRuntimeRef.current?.setSessionId(activeSessionIdRef.current);
+        replaceExtensionContext("resume");
+    }
+    // /session switch: make the picked record the live conversation. Exactly
+    // one history replacement (never merge, never duplicate): the target's
+    // history/turns REPLACE the live arrays wholesale, following the doResume
+    // precedent (endpoint recompute, env-block refresh, budget trim, lineage
+    // drop, Static remount, title sync). Differences from /resume:
+    // - the outgoing live state snapshots into the OLD record first, but only
+    //   when it holds turns (a fresh mount's system-only live state is NOT the
+    //   old record's content — persisting it would wipe that record);
+    // - re-picking the current session is a no-op (reloading from disk would
+    //   drop unpersisted live turns);
+    // - updatedAt is NOT bumped (switching is navigation, not a mutation —
+    //   listings keep true recency order);
+    // - a missing/unreadable target errors WITHOUT touching the live session.
+    // The legacy session.json follows the switch (same persistSession path as
+    // every completed turn) so /resume stays coherent with the live view.
+    async function switchToSession(id) {
+        let target = null;
+        try {
+            target = getSession(id, authHome);
+        }
+        catch {
+            target = null;
+        }
+        if (!target) {
+            pushInfo("(session no longer available — staying on the current session)");
+            return;
+        }
+        const currentId = activeSessionIdRef.current;
+        if (currentId !== null && currentId === target.id) {
+            pushInfo(`(already on "${target.title}")`);
+            return;
+        }
+        // Cancellable gate FIRST (ticket 05): before_switch handlers run before
+        // ANY snapshot/persist/mutate step (outgoing persist, active-pointer
+        // write, ref swaps, legacy save), so a cancelled switch is a pure no-op
+        // — the live session is byte-identical to before the call. Everything
+        // below this point mutates, so nothing above it may.
+        const gateRuntime = extRuntimeRef.current;
+        if (gateRuntime) {
+            let verdict;
+            try {
+                verdict = await gateRuntime.requestSwitch({ fromSessionId: currentId, toSessionId: target.id, reason: "switch" });
+            }
+            catch {
+                // requestSwitch never rejects by contract; defensive only.
+                verdict = { cancelled: false };
+            }
+            if (verdict.cancelled) {
+                pushInfo(verdict.reason
+                    ? `(session switch cancelled: ${verdict.reason})`
+                    : "(session switch cancelled by an extension — staying on the current session)");
+                return;
+            }
+        }
+        // Snapshot the outgoing conversation into its own record first (same
+        // rule as /new's pre-reset save). Guarded: only when the live state
+        // actually holds turns of the outgoing record.
+        if (currentId !== null && currentId !== target.id && turnsRef.current.length > 0) {
+            persistStoreSession();
+        }
+        try {
+            setActiveSession(target.id, authHome);
+        }
+        catch {
+            // setActiveSession never throws by contract; defensive only.
+        }
+        activeSessionIdRef.current = target.id;
+        setProviderBoth(target.provider);
+        const baseURL = chatBaseURL(target.provider);
+        if (target.provider === "openai-compatible") {
+            setActiveEndpoint(openaiCompatibleChatEndpoint(baseURL));
+        }
+        else if (target.provider === "opencode-zen") {
+            setActiveEndpoint(endpoint);
+        }
+        else {
+            setActiveEndpoint(chatEndpointFor(target.provider, baseURL));
+        }
+        setModelBoth(target.model);
+        setEffortBoth(target.effort);
+        setModeBoth(target.mode);
+        setUsageBoth(target.usageTotals);
+        // Ticket 07: the target's goal replaces the live one wholesale (never
+        // merged) — a session without a saved goal lands on no-goal, so one
+        // session's goal can never leak into another. The outgoing goal was
+        // snapshotted into its own record above, so switching back restores it.
+        setGoalBoth(restoreGoalFromPersist(target.goal));
+        // Replacement: the target's arrays replace the live ones wholesale (a
+        // fresh-created record carries empty history — fall back to a fresh
+        // system line so the system-first invariant always holds).
+        historyRef.current =
+            target.history.length > 0
+                ? trackHistory([...target.history])
+                : trackHistory([{ role: "system", content: withEnvBlock(systemPrompt) }]);
+        if (target.history.length > 0) {
+            refreshSystemEnv();
+        }
+        lastPromptTokensRef.current = undefined;
+        if (!usageRef.current) {
+            setContextLoadBoth(null);
+        }
+        else {
+            setContextLoadBoth(estimateTokensForChars(historyChars(historyRef.current)));
+        }
+        autoStreakRef.current = 0;
+        setAutoDisabledBoth(false);
+        pendingCompactRef.current = null;
+        const pendingNotices = [];
+        // New lineage (see src/rollback.ts): checkpoint marks index the old
+        // history — drop them, loudly when non-empty. Disk files untouched.
+        const switchDrops = clearSnapshots();
+        if (switchDrops > 0) {
+            pendingNotices.push({
+                role: "tool",
+                content: `(/session — discarded ${switchDrops} live file checkpoint(s); undos do not cross a session switch)`,
+            });
+        }
+        // TODO isolation (mirrors /new): the checklist is process-global memory
+        // that is never persisted — carrying it across sessions would show the
+        // new session the old session's plan, and the agent would act on it.
+        // Reset it, loudly when non-empty.
+        if (getTodos().length > 0) {
+            clearTodos();
+            setTodoSnap([]);
+            pendingNotices.push({
+                role: "tool",
+                content: "(/session — checklist reset; TODOs are per-conversation and do not cross sessions)",
+            });
+        }
+        else {
+            clearTodos();
+            setTodoSnap([]);
+        }
+        // The target's history/turns REPLACE the live arrays wholesale — used
+        // whole, never trimmed.
+        for (const section of collectStoredTouchedFiles(historyRef.current)) {
+            pendingNotices.push({ role: "tool", content: section });
+        }
+        // Same Static remount as /clear, /resume, and /new: the replaced list
+        // must not reuse the old buffer.
+        setScrollEndBoth(null);
+        setClearGen((g) => g + 1);
+        setTurnsBoth([
+            ...target.turns,
+            {
+                role: "tool",
+                content: `(switched to session "${target.title}" — ${target.turns.length} turns)`,
+            },
+            ...pendingNotices,
+        ]);
+        setSessionTitleBoth(target.title);
+        telemetry.recordEvent("info", `session switched to ${target.id} (${target.turns.length} turns)`);
+        persistTelemetry();
+        // Legacy single-file save follows the switch so /resume restores what
+        // the live view shows (same path/format as every completed turn).
+        // Bind the new record BEFORE the boundary emit, so session_start
+        // handlers observe the new session's extension state (ticket 05).
+        extRuntimeRef.current?.setSessionId(target.id);
+        persistSession();
+        replaceExtensionContext("switch");
     }
     // /rewind conversation scope (ticket 01): truncate history + transcript to
     // the checkpoint's turn. The cut drops the whole containing turn (submit's
@@ -2188,9 +3118,6 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         }
         pushInfo(filesMsg);
     }
-    function warnEffortUnsupported(modelName) {
-        pushInfo(`reasoning effort is not known to be supported by ${modelName} — setting kept, not sent`);
-    }
     // Manual /compact entry: busy → set pending flag, run at turn end (drain
     // boundary, never mid-turn); idle → run now under the busy guard so a
     // concurrent submit cannot interleave. Works for unknown-window models.
@@ -2322,19 +3249,54 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             ? "(thinking shown — model reasoning stays visible in the transcript)"
             : "(thinking hidden — reasoning still runs, it just isn't rendered)");
     }
+    // /rename for the CURRENT session only (never creates one: renameSession
+    // touches exactly the active record). Bare /rename prints usage — ATOM has
+    // no generic text-prompt overlay (key/baseURL prompts are
+    // provider-specific), so an interactive flow would be a new UI system.
+    // Empty/whitespace-only names are rejected safely (previous name kept).
+    // On failure the previous name is preserved (title state only changes on
+    // success); history/turns are never part of the write.
+    function runRenameCommand(raw) {
+        const name = parseRenameArg(raw);
+        if (!name) {
+            pushInfo(RENAME_USAGE);
+            return;
+        }
+        let id = null;
+        try {
+            id = ensureStoreSession();
+        }
+        catch {
+            id = null;
+        }
+        if (!id) {
+            pushInfo("(rename failed — session store unavailable; name unchanged)");
+            return;
+        }
+        let renamed = null;
+        try {
+            renamed = renameSession(id, name, authHome);
+        }
+        catch {
+            renamed = null;
+        }
+        if (!renamed) {
+            const current = sessionTitleRef.current || "untitled";
+            pushInfo(`(rename failed — still "${current}")`);
+            return;
+        }
+        setSessionTitleBoth(renamed.title);
+        pushInfo(`(renamed session to "${renamed.title}")`);
+    }
     // /autoscroll [on|off]: follow switch for the scrollback viewport. View-
     // only state — safe while busy (never touches the turn, like /queue).
-    // Bare prints the state; on jumps to the latest; off freezes a following
+    // Bare toggles off ⇄ on; on jumps to the latest; off freezes a following
     // view at its current end (mid-turn appends then accumulate below).
     function runAutoScrollCommand(raw) {
         const arg = raw.trim() === "/autoscroll" ? "" : raw.trim().slice("/autoscroll".length).trim().toLowerCase();
-        if (arg === "") {
-            pushInfo(autoScrollRef.current
-                ? "(autoscroll on — following new output as it arrives)"
-                : "(autoscroll off — the view freezes while a turn runs; End follows the latest)");
-            return;
-        }
-        if (arg === "on") {
+        // Bare command toggles; explicit on|off sets directly.
+        const effective = arg === "" ? (autoScrollRef.current ? "off" : "on") : arg;
+        if (effective === "on") {
             if (autoScrollRef.current) {
                 pushInfo("(autoscroll already on)");
                 return;
@@ -2344,7 +3306,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             pushInfo("(autoscroll on — following the latest)");
             return;
         }
-        if (arg === "off") {
+        if (effective === "off") {
             if (!autoScrollRef.current) {
                 pushInfo("(autoscroll already off)");
                 return;
@@ -2359,6 +3321,60 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         }
         pushInfo(AUTOSCROLL_USAGE);
     }
+    // /goal [<objective>|pause|resume|clear]: session goal state.
+    // View/state-only — safe while busy (never touches the turn, like
+    // /autoscroll). Bare shows the active goal (text, state, cumulative
+    // stats) or the none-hint; `/goal <objective>` sets with fresh stats (a
+    // second set replaces with a notice); `/goal pause` flips the active flag
+    // (pausing mid-turn stops continuation at the next turn end — the loop
+    // reads the flag live — while todos, evidence, and history stay intact);
+    // `/goal resume` re-arms the flag AND starts a continuation turn through
+    // the normal submit path when idle (cumulative stats carry over — nothing
+    // resets), or says so loudly without injecting a turn when busy (the
+    // running turn's next turn end picks the live flag up on its own);
+    // `/goal clear` ends it (harmless notice when absent). Every mutation
+    // persists through the normal save path immediately (no new cadence).
+    function runGoalCommand(raw) {
+        const cmd = parseGoalCommand(raw);
+        if (cmd.kind === "status") {
+            pushInfo(goalStatusText(goalRef.current));
+            return;
+        }
+        if (cmd.kind === "clear") {
+            pushInfo(goalClearNotice(goalRef.current));
+            if (!goalRef.current)
+                return;
+            setGoalBoth(null);
+            persistSession();
+            return;
+        }
+        if (cmd.kind === "pause") {
+            const g = goalRef.current;
+            pushInfo(goalPauseNotice(g));
+            if (!g || !g.active)
+                return;
+            setGoalBoth({ ...g, active: false });
+            persistSession();
+            return;
+        }
+        if (cmd.kind === "resume") {
+            const g = goalRef.current;
+            pushInfo(goalResumeNotice(g));
+            if (!g || g.active)
+                return;
+            setGoalBoth({ ...g, active: true });
+            persistSession();
+            if (busyRef.current) {
+                pushInfo("(goal resumes when the current turn ends — no new turn started while busy)");
+                return;
+            }
+            void submit(goalFollowUp(g.objective));
+            return;
+        }
+        pushInfo(goalSetNotice(cmd.objective, goalRef.current));
+        setGoalBoth({ objective: cmd.objective, active: true, stats: emptyGoalStats() });
+        persistSession();
+    }
     // /models: local-discovery status + refresh. Bare `/models` reports the
     // last snapshot (kicking a first probe when discovery never ran);
     // `/models refresh` re-probes all three runtimes, then reports. Results
@@ -2414,6 +3430,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             case "/clear":
                 // Task 6: same base as mount (no AGENTS.md re-read, as before) plus a
                 // fresh env block. Fresh array → fresh ledger via trackHistory.
+                // Store mirror: LAZY, matching legacy — /clear wipes the live
+                // transcript only and writes nothing to the store here; the cleared
+                // (empty) conversation persists on the next completed turn via
+                // persistSession()/persistStoreSession().
                 historyRef.current = trackHistory([
                     { role: "system", content: withEnvBlock(systemPrompt) },
                 ]);
@@ -2424,11 +3444,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 setScrollEndBoth(null);
                 setClearGen((g) => g + 1);
                 setError(null);
-                setDraft(null);
+                streamStore.setDraft(null);
                 clearThinking();
                 setToolHint(null);
-                setPhase("idle");
-                setPhaseDetail("");
+                setPhaseBoth("idle", "");
                 // /clear drops the transcript: load resets (no context), streak
                 // resets, pending compact drains, and turn-scoped skill grants go
                 // with it (no invisible auto-approvals survive a wiped transcript).
@@ -2443,6 +3462,15 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 if (clearedDrops > 0) {
                     pushInfo(`(/clear — discarded ${clearedDrops} file checkpoint(s); undos do not cross a cleared conversation)`);
                 }
+                // /clear wipes the conversation, so the active goal ends here with
+                // a visible notice (same lazy persist as the transcript above: the
+                // cleared state — goal included — persists on the next completed
+                // turn, and the save keeps the pre-clear state until then).
+                const clearedGoal = goalRef.current;
+                setGoalBoth(null);
+                if (clearedGoal) {
+                    pushInfo(`(goal cleared — "${clearedGoal.objective}" — /clear wipes the conversation)`);
+                }
                 // autoDisabled stays for the session (thrash guard is session-wide).
                 lastPromptTokensRef.current = undefined;
                 setContextLoadBoth(null);
@@ -2459,7 +3487,30 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 // restores — same path/format as every completed turn, no new
                 // schema). No sessions/ archive step: session.ts only has
                 // session.json, so no archiving is invented here.
+                // persistSession() also mirrors the pre-/new conversation into the
+                // OLD active store record before the reset below.
                 persistSession();
+                // Fresh store record for the new conversation (settings carried over,
+                // empty history/turns/usage; default title = formatSessionTitle(now)
+                // via createSession). Explicit setActiveSession: createSession only
+                // claims the pointer when none is set.
+                try {
+                    const created = createSession({
+                        cwd: storeCwd(),
+                        provider: providerRef.current,
+                        model: modelRef.current,
+                        effort: effortRef.current,
+                        mode: modeRef.current,
+                    }, authHome);
+                    setActiveSession(created.id, authHome);
+                    activeSessionIdRef.current = created.id;
+                    setSessionTitleBoth(created.title);
+                    // Bind the new record BEFORE the boundary emit (ticket 05).
+                    extRuntimeRef.current?.setSessionId(created.id);
+                }
+                catch {
+                    // ignore disk errors (in-memory reset below still applies)
+                }
                 // Fresh system re-read (system.ts base + current AGENTS.md overlay)
                 // plus a fresh Task 6 env block. Fresh array → fresh ledger.
                 historyRef.current = trackHistory([
@@ -2471,15 +3522,23 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                         content: "(new session started — previous conversation kept, /resume to restore it)",
                     },
                 ]);
+                // /new replaces the conversation lineage, so the active goal ends
+                // here with a visible notice — a fresh conversation must not inherit
+                // an auto-continuing goal. The pre-/new goal stays in the OLD record
+                // (persisted above), so /resume still brings it back with its stats.
+                const droppedGoal = goalRef.current;
+                setGoalBoth(null);
+                if (droppedGoal) {
+                    pushInfo(`(goal cleared — "${droppedGoal.objective}" — /new starts a fresh conversation with no goal)`);
+                }
                 // Fresh list: a held view has nothing to hold onto — re-follow.
                 setScrollEndBoth(null);
                 setClearGen((g) => g + 1);
                 setError(null);
-                setDraft(null);
+                streamStore.setDraft(null);
                 clearThinking();
                 setToolHint(null);
-                setPhase("idle");
-                setPhaseDetail("");
+                setPhaseBoth("idle", "");
                 // /new-vs-/clear split: /clear wipes the transcript but KEEPS usage
                 // totals; /new resets the counters too (fresh conversation). Session
                 // SETTINGS (effort/mode/provider/model) are kept — only the
@@ -2505,6 +3564,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 telemetry.recordEvent("new", "fresh conversation started (previous kept for /resume)");
                 persistTelemetry();
                 void refreshSkillMenu();
+                replaceExtensionContext("new");
                 return;
             case "/compact":
                 // Bare /compact with no focus text (slash-menu path). Free-text
@@ -2568,6 +3628,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             case "/autoscroll":
                 runAutoScrollCommand("/autoscroll");
                 return;
+            case "/goal":
+                runGoalCommand("/goal");
+                return;
             case "/mode":
                 if (modeRef.current === "plan") {
                     pushInfo("mode: plan (read-only — write/edit/bash blocked with a replan note; Tab to approve + exit)");
@@ -2612,6 +3675,15 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             case "/resume":
                 doResume();
                 return;
+            case "/session":
+                openSessionPicker("");
+                return;
+            case "/rename":
+                // Bare exact match (slash-menu Enter on the highlighted name):
+                // usage — the typed-args form is preserved by the menu branch and
+                // the submit prefix route above.
+                runRenameCommand("/rename");
+                return;
             case "/telemetry":
                 pushInfo(telemetrySummaryText());
                 return;
@@ -2642,7 +3714,17 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 return;
             }
             default:
-                return;
+                // Extension slash commands (ticket 04, bare form from the menu or
+                // palette): typed-args forms route through submit/menu above with
+                // args intact, so only the bare exact name lands here.
+                {
+                    const target = parseExtensionCommandInput(cmd);
+                    if (target && target.args === "" && getExtensionCommand(target.name)) {
+                        void runExtensionCommandFromApp(target.name, "");
+                        return;
+                    }
+                    return;
+                }
         }
     }
     // approve hook for runAgenticLoop: scoped rules first (deny refuses as a
@@ -2798,7 +3880,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         h?.reject(new Error("question cancelled by user"));
     }
     // Submit-time pipeline (ticket 02 — stage order is SUBMIT_PIPELINE_STAGES
-    // above; each `SUBMIT STAGE n/4` marker below names its stage plus its
+    // above; each `SUBMIT STAGE n/3` marker below names its stage plus its
     // rollback-scope rule). Local "/" routing precedes the pipeline: exact
     // slash commands, /allow-/deny-/rules, and skill invocations never enter
     // it (no turn, no history, nothing to roll back).
@@ -2818,11 +3900,29 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             await runCompactCommand(focus);
             return;
         }
-        // SUBMIT STAGE 1/4 — permissions (rollback scope: pre-turn, appends
+        // /rename with optional name: prefix match ("/rename" or "/rename ...").
+        // Instant local store op — safe while busy (the turn-end persist never
+        // carries a title, so it cannot clobber the rename).
+        if (text === "/rename" || text.startsWith("/rename ")) {
+            runRenameCommand(text);
+            return;
+        }
+        // SUBMIT STAGE 1/3 — permissions (rollback scope: pre-turn, appends
         // nothing). Busy guard + API-key check: rejections return before any
         // history mutation, so there is nothing to roll back.
         if (!text)
             return;
+        // An extension command in flight owns the question modal (single slot
+        // shared with ask_question): plain follow-ups and nested extension
+        // commands wait with a notice; view/state slash commands still run
+        // (they never touch the modal or the turn).
+        if (extCommandRunningRef.current) {
+            const nested = parseExtensionCommandInput(text);
+            if ((nested && getExtensionCommand(nested.name)) || !text.startsWith("/")) {
+                pushInfo("(an extension command is already running — wait for its prompt)");
+                return;
+            }
+        }
         // Busy: plain follow-ups queue instead of submitting (Claude-Code-style —
         // the thought is never lost); /queue + /steer manage and inject. Other
         // "/" input still needs idle (pickers/modals would race the turn), so it
@@ -2833,13 +3933,17 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 runQueueCommand(text);
                 return;
             }
-            // /autoscroll and /thinking are view-only state (never touch the
-            // turn), so they run while busy like /queue + /steer (see
+            // /autoscroll, /thinking, and /goal are view/state-only (never touch
+            // the turn), so they run while busy like /queue + /steer (see
             // slashRunsWhileBusy).
             if (text === "/autoscroll" || text.startsWith("/autoscroll ")) {
                 runAutoScrollCommand(text);
                 return;
             }
+            if (text === "/goal" || text.startsWith("/goal ")) {
+                runGoalCommand(text);
+                return;
+            }
             if (text === "/thinking" || text.startsWith("/thinking ")) {
                 runThinkingCommand(text);
                 return;
@@ -2861,12 +3965,17 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             return;
         }
         // /autoscroll takes an optional subcommand (/autoscroll on|off), like the
-        // /queue family — SLASH_NAMES only holds the exact command. /thinking
-        // is bare-toggle-only; anything appended prints its usage.
+        // /queue family — SLASH_NAMES only holds the exact command. /goal takes
+        // free-text args (/goal <objective>, /goal clear) the same way.
+        // /thinking is bare-toggle-only; anything appended prints its usage.
         if (text === "/autoscroll" || text.startsWith("/autoscroll ")) {
             runAutoScrollCommand(text);
             return;
         }
+        if (text === "/goal" || text.startsWith("/goal ")) {
+            runGoalCommand(text);
+            return;
+        }
         if (text === "/thinking" || text.startsWith("/thinking ")) {
             runThinkingCommand(text);
             return;
@@ -2887,6 +3996,13 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             void runModelsCommand(arg);
             return;
         }
+        // /session takes an optional initial filter ("/session auth" opens the
+        // picker pre-filtered) — SLASH_NAMES only holds the exact command.
+        if (text === "/session" || text.startsWith("/session ")) {
+            const initial = text === "/session" ? "" : text.slice("/session".length).trim();
+            openSessionPicker(initial);
+            return;
+        }
         // Exact full-command + Enter runs it. A single-token "/name" not in
         // SLASH_NAMES resolves through the skill registry (ticket 03, legacy
         // form — the namespaced `/skill:name` below is canonical); anything
@@ -2912,6 +4028,16 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             void invokeSkillByName(namespaced);
             return;
         }
+        // Extension slash commands (ticket 04): "/name args" runs extension
+        // code outside the model turn loop (no history, no telemetry turn —
+        // say() posts transcript turns only). Builtins and /skill: keep
+        // precedence above, so an extension never shadows them; the legacy
+        // /name skill form below yields to extensions deterministically.
+        const extTarget = parseExtensionCommandInput(text);
+        if (extTarget && getExtensionCommand(extTarget.name)) {
+            void runExtensionCommandFromApp(extTarget.name, extTarget.args);
+            return;
+        }
         const skillName = /^\/([A-Za-z0-9_-]+)$/.exec(text)?.[1];
         if (skillName !== undefined) {
             void invokeSkillByName(skillName);
@@ -2934,7 +4060,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         busyRef.current = true;
         setBusy(true);
         setError(null);
-        setDraft(null);
+        streamStore.setDraft(null);
         clearThinking();
         // Fresh turn, fresh latch: the queue drain at the end auto-sends only
         // when this turn was NOT cancelled (see the turn-end finally).
@@ -2944,13 +4070,13 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         // Expiry happens in the turn-end finally below, plus /clear + /new.
         try {
             draftThrottler().reset();
+            thinkingThrottler().reset();
         }
         catch {
             // ignore (first token still paints; at worst one window late)
         }
         setToolHint(null);
-        setPhase("thinking");
-        setPhaseDetail("");
+        setPhaseBoth("thinking", "");
         // Phase 5: start the elapsed/stall timer (status-bar only, never the
         // transcript). Cleared in finally below and on unmount.
         startTurnTimer();
@@ -2962,25 +4088,14 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         pendingDiffRef.current = null;
         lastPartialRef.current = "";
         refreshGitInfo();
-        // SUBMIT STAGE 2/4 — context-assembly (rollback scope: pre-rollbackTo,
+        // SUBMIT STAGE 2/3 — context-assembly (rollback scope: pre-rollbackTo,
         // survives failure). Refresh the pinned env block ONCE per turn (not per
         // POST — the loop reuses history[0] for all its POSTs, so this is the
-        // only git call for the turn). Before the budget check so truncation
-        // accounts for the fresh block size; before rollbackTo so the refresh
+        // only git call for the turn). Before rollbackTo so the refresh
         // survives a failed-turn rollback (it is not part of the user turn).
+        // History is uncapped: the full conversation rides every turn.
         refreshSystemEnv();
-        // SUBMIT STAGE 3/4 — budget-check (rollback scope: pre-rollbackTo,
-        // survives failure). History budget at turn start, BEFORE the push +
-        // rollbackTo capture below (so the existing splice-rollback indices stay
-        // valid): drop oldest user-turns first, reserving room for the incoming user message
-        // so the loop core's own budget check stays a no-op on entry - exactly
-        // one dim notice per truncating turn. /clear drops the notice with the
-        // transcript (usage totals still survive). Caps come from the session
-        // ContextManager (window-derived), with the same live todo pinning.
-        contextManager().trimForSend(historyRef.current, (msg) => {
-            appendTurns({ role: "tool", content: `? ${msg}` });
-        }, { messages: 1, chars: text.length }, openTodoNeedles());
-        // SUBMIT STAGE 4/4 — loop-entry (rollback scope: post-rollbackTo, rolls
+        // SUBMIT STAGE 3/3 — loop-entry (rollback scope: post-rollbackTo, rolls
         // back on failure). Turn boundary: on POST failure (HTTP/network/empty/
         // truncated) the whole user turn (user message plus any partial
         // assistant/tool loop entries) is removed, so the next request starts
@@ -2989,15 +4104,39 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         // catch). Cancellation (LoopCancelledError) shares the same splice
         // contract.
         const rollbackTo = historyRef.current.length;
+        // Goal work time (ticket 02): wall clock for this submit accrues to the
+        // live goal in the turn finally (all outcomes — success, failure, and
+        // cancel all did work). Pinned to the starting objective so a mid-turn
+        // replacement keeps its own stats.
+        const goalWorkStartMs = goalRef.current ? Date.now() : null;
+        const goalWorkObjective = goalRef.current?.objective ?? null;
         // Local observability: open this turn's trace (no-op when disabled).
         // Provider/model switches surface here per turn; session-level switches
         // are derived from the same updates (see setSessionMeta).
         telemetry.setSessionMeta({ provider: providerRef.current, model: modelRef.current });
+        // Goal snapshot for the trace (ticket 09): the live goal as this turn
+        // opens it (objective, flag, cumulative counters so far). Absent reads
+        // as no-goal; the recorder caps and copies it, never aliasing live state.
+        const turnGoal = goalRef.current
+            ? {
+                objective: goalRef.current.objective,
+                active: goalRef.current.active === true,
+                ...(goalRef.current.stats
+                    ? {
+                        turns: goalRef.current.stats.turns,
+                        requests: goalRef.current.stats.requests,
+                        tokens: goalRef.current.stats.tokens,
+                        workMs: goalRef.current.stats.workMs,
+                    }
+                    : {}),
+            }
+            : undefined;
         const telemetryTurnId = telemetry.startTurn(text, {
             provider: providerRef.current,
             model: modelRef.current,
             effort: effortRef.current,
             mode: modeRef.current,
+            ...(turnGoal ? { goal: turnGoal } : {}),
         });
         const telemetrySink = {
             onModelCall: (info) => telemetry.recordModelCall(telemetryTurnId, info),
@@ -3037,6 +4176,45 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             const reply = await runAgenticLoopForProvider(providerRef.current, submitKey, modelRef.current, historyRef.current, {
                 approve,
                 askUser,
+                // Goal auto-continue (ticket 02): the loop reads the live goal
+                // through getGoal (never imports App state), pauses with a notice
+                // via pauseGoal, and reports slice counters. Turns/requests land
+                // here; tokens accrue in onUsage below; work time in the finally.
+                goal: {
+                    getGoal: () => goalRef.current,
+                    pauseGoal: (notice) => {
+                        pauseGoalWithNotice(notice);
+                    },
+                    onGoalRequest: () => {
+                        patchGoalStats((s) => ({ ...s, requests: s.requests + 1 }));
+                    },
+                    onGoalTurn: () => {
+                        patchGoalStats((s) => ({ ...s, turns: s.turns + 1 }));
+                    },
+                },
+                // Evaluator fallback (ticket 04): report-less goal turns get one
+                // bounded, read-only judge call (same provider/model, tools disabled,
+                // 256-token cap — see src/agent/goal-evaluator.ts). Built from live
+                // refs at call time so a mid-run provider/model/key switch applies;
+                // judge spend accumulates exactly like model spend. Transport
+                // failures throw (the loop pauses on them, never crashes); an
+                // unclear verdict resolves null (the loop pauses with a notice).
+                goalJudge: async ({ goal: objective, turns }) => {
+                    return requestGoalVerdict({
+                        provider: providerRef.current,
+                        apiKey: keyForProvider(providerRef.current),
+                        model: modelRef.current,
+                        systemContent: systemPrompt,
+                        goal: objective,
+                        turns,
+                        baseURL: chatBaseURL(providerRef.current),
+                        endpointOverride: activeEndpoint,
+                        signal: controller.signal,
+                        onUsage: (u) => {
+                            accumulateUsage(u, false);
+                        },
+                    });
+                },
                 // Local observability sink: the loop reports completed model/tool
                 // calls (iterations, durations, usage) into the open turn trace.
                 telemetry: telemetrySink,
@@ -3056,19 +4234,27 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                         draftThrottler().push(partial);
                     }
                     catch {
-                        setDraft(partial);
+                        // Never lose tokens: paint now rather than drop the partial.
+                        streamStore.setDraft(partial);
                     }
                     lastPartialRef.current = partial;
                     noteTurnActivity();
                 },
                 onThinking: (partial) => {
                     thinkingRef.current = partial;
-                    setThinking(partial);
+                    try {
+                        thinkingThrottler().push(partial);
+                    }
+                    catch {
+                        // Never lose reasoning: paint now rather than drop the partial.
+                        streamStore.setThinking(partial);
+                    }
                     noteTurnActivity();
                 },
                 onPhase: (p, detail) => {
-                    setPhase(p);
-                    setPhaseDetail(detail ?? "");
+                    // Change-guarded (zen emits "streaming" per content chunk):
+                    // steady-state tokens issue zero setStates here.
+                    setPhaseBoth(p, detail ?? "");
                     noteTurnActivity();
                     if (p === "thinking") {
                         // New POST: the previous round's thinking (if any) commits to
@@ -3104,29 +4290,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                     // POST accumulates (tool-round POSTs and successful retries each
                     // count once — each was billed; failed attempts report nothing, so
                     // nothing is deduped). usageTotals drives NK only, never P%.
-                    const prev = usageRef.current ?? {};
-                    const next = { ...prev };
-                    if (u.prompt_tokens !== undefined) {
-                        next.prompt_tokens = (next.prompt_tokens ?? 0) + u.prompt_tokens;
-                        // Load metric source: last POST's reported prompt_tokens (the
-                        // per-POST value, NOT the accumulated total).
-                        lastPromptTokensRef.current = u.prompt_tokens;
-                    }
-                    if (u.completion_tokens !== undefined) {
-                        next.completion_tokens = (next.completion_tokens ?? 0) + u.completion_tokens;
-                    }
-                    if (u.total_tokens !== undefined) {
-                        next.total_tokens = (next.total_tokens ?? 0) + u.total_tokens;
-                    }
-                    // Prefix-cache counters accumulate like spend (real reports only;
-                    // absent fields mean "not reported", never zero).
-                    if (u.cacheReadTokens !== undefined) {
-                        next.cacheReadTokens = (next.cacheReadTokens ?? 0) + u.cacheReadTokens;
-                    }
-                    if (u.cacheWriteTokens !== undefined) {
-                        next.cacheWriteTokens = (next.cacheWriteTokens ?? 0) + u.cacheWriteTokens;
-                    }
-                    setUsageBoth(next);
+                    accumulateUsage(u);
                 },
                 onReasoning: (label) => {
                     setReasoning(label);
@@ -3216,12 +4380,6 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                     noteTurnActivity();
                 },
                 signal: controller.signal,
-                // Window-aware trim caps for this model's real window (the loop
-                // falls back to legacy caps without it — see AgenticOpts.context).
-                context: {
-                    model: modelRef.current,
-                    toolsChars: TOOLS_SCHEMA_CHARS,
-                },
             });
             // Turn-end flush: any trailing throttled partial paints before the
             // commit replaces the draft (byte-exact via `reply` regardless). The
@@ -3318,6 +4476,21 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             }
         }
         finally {
+            // Goal work time (ticket 02): this submit's wall clock accrues once,
+            // for every outcome (success, failure, and cancel all did work), when
+            // the same goal is still live. A mid-turn replacement keeps its own
+            // stats — we accrue only while the objective still matches.
+            try {
+                if (goalWorkStartMs !== null &&
+                    goalRef.current !== null &&
+                    goalRef.current.objective === goalWorkObjective) {
+                    const workedMs = Math.max(0, Date.now() - goalWorkStartMs);
+                    patchGoalStats((s) => ({ ...s, workMs: s.workMs + workedMs }));
+                }
+            }
+            catch {
+                // accounting never breaks turn teardown
+            }
             turnCancelRef.current = null;
             approvalResolveRef.current = null;
             setPendingApproval(null);
@@ -3340,14 +4513,13 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             catch {
                 // ignore
             }
-            setDraft(null);
+            streamStore.setDraft(null);
             clearThinking();
             setToolHint(null);
             clearTurnTimer();
-            setStalled(false);
+            setStalledBoth(false);
             setElapsedSecs(0);
-            setPhase("idle");
-            setPhaseDetail("");
+            setPhaseBoth("idle", "");
             // Queue drain (Claude-Code-style): a clean turn auto-sends the next
             // queued follow-up (chaining while the queue is non-empty); a cancelled
             // turn keeps its queue visible but never auto-sends. A steer stranded
@@ -3476,6 +4648,53 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             }
             return;
         }
+        // 2a. Extension dialog (ticket 10): same keys as the question modal —
+        // arrows + Enter picks, typing + Enter submits custom text (allowCustom
+        // only), Esc cancels with a clean error. Owns the keyboard while open
+        // (like every modal above): resolvers can never clobber each other, and
+        // a dialog stranded by a session switch is already rejected by
+        // invalidate, so resolve/cancel here always hits the live request.
+        const extDlg = extRuntimeRef.current?.getPendingDialog() ?? null;
+        if (extDlg) {
+            const len = Math.max(extDlg.options.length, 1);
+            if (key.upArrow) {
+                setExtDlgSelBoth((extDlgSelRef.current - 1 + len) % len);
+            }
+            else if (key.downArrow) {
+                setExtDlgSelBoth((extDlgSelRef.current + 1) % len);
+            }
+            else if (key.escape) {
+                extRuntimeRef.current?.cancelPendingDialog(`extension "${extDlg.owner}" dialog was cancelled by user`);
+                setExtDlgSelBoth(0);
+                setExtDlgCustomBoth("");
+            }
+            else if (key.return || key.tab) {
+                if (extDlg.allowCustom && extDlgCustomRef.current.trim().length > 0) {
+                    if (extRuntimeRef.current?.resolvePendingDialog(extDlgCustomRef.current) === true) {
+                        setExtDlgSelBoth(0);
+                        setExtDlgCustomBoth("");
+                    }
+                }
+                else {
+                    const picked = extDlg.options[extDlgSelRef.current];
+                    if (picked !== undefined && extRuntimeRef.current?.resolvePendingDialog(picked) === true) {
+                        setExtDlgSelBoth(0);
+                        setExtDlgCustomBoth("");
+                    }
+                }
+            }
+            else if (key.backspace || key.delete) {
+                if (extDlg.allowCustom) {
+                    setExtDlgCustomBoth(extDlgCustomRef.current.slice(0, -1));
+                }
+            }
+            else if (ch && !key.ctrl && !key.meta && !key.tab) {
+                if (extDlg.allowCustom) {
+                    setExtDlgCustomBoth(extDlgCustomRef.current + ch);
+                }
+            }
+            return;
+        }
         // 2b. Provider key prompt (masked • per char, paste works, Esc safe).
         const kp = keyPromptRef.current;
         if (kp && keyPrompt) {
@@ -3667,28 +4886,22 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                         // reported prompt_tokens no longer measures this context); the
                         // estimate applies until the new model reports.
                         resetContextLoadToEstimate();
-                        // Re-gate effort on every /model switch: setting persists, but a
-                        // non-Default effort on an unsupported model warns (kept, not sent).
-                        if (effortRef.current !== "default" && !isEffortSupported(picked.model)) {
-                            warnEffortUnsupported(picked.model);
-                        }
+                        // Effort needs no re-gating: it is assumed for every model and
+                        // only a server 400 can veto it (the POST retries without it).
                     }
                     else {
                         // Cross-provider pick: switch with the resolved key (env wins,
                         // else stored — remote sections only render for keyed providers;
                         // local sections need no key) and keep the picked model; the
                         // live refresh lands in the background via the standard switch
-                        // path. reasoning_effort is zen-only, so a non-Default effort
-                        // warns (kept, not sent).
+                        // path. Effort carries over untouched — it is valid on every
+                        // provider kind.
                         const switchedKey = keyForProvider(picked.providerId);
                         if (switchedKey || !providerNeedsKey(picked.providerId)) {
                             const pickedProvider = picked.providerId;
                             const pickedModel = picked.model;
                             void (async () => {
                                 await switchProviderWithKey(pickedProvider, switchedKey, pickedModel);
-                                if (effortRef.current !== "default") {
-                                    warnEffortUnsupported(pickedModel);
-                                }
                             })();
                         }
                     }
@@ -3751,6 +4964,51 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             }
             return;
         }
+        // 3a2. Session picker (interactive switcher, same pattern as /skills:
+        // type to filter, ↑/↓ + Enter switches, Esc cancels with the live
+        // session completely unchanged). The list is the open-time snapshot —
+        // filtering never touches disk. Enter on an empty filtered list only
+        // prints a widen hint (no switch, no state change).
+        if (selectingSession) {
+            // Rebuilt per keypress from the same render's state the paint uses, so
+            // highlight/filter/paint never disagree mid-tick.
+            const entries = filterSessionEntries(sessionItems, sessionFilterRef.current);
+            if (key.upArrow) {
+                if (entries.length > 0) {
+                    setSessionIndexBoth((sessionIndexRef.current - 1 + entries.length) % entries.length);
+                }
+            }
+            else if (key.downArrow) {
+                if (entries.length > 0) {
+                    setSessionIndexBoth((sessionIndexRef.current + 1) % entries.length);
+                }
+            }
+            else if (key.escape) {
+                setSessionFilterBoth("");
+                setSelectingSession(false);
+            }
+            else if (key.return) {
+                const picked = entries[sessionIndexRef.current];
+                setSessionFilterBoth("");
+                setSelectingSession(false);
+                if (picked) {
+                    exitHistoryBrowse();
+                    void switchToSession(picked.id);
+                }
+                else {
+                    pushInfo("(no sessions match — backspace to widen the filter.)");
+                }
+            }
+            else if (key.backspace || key.delete) {
+                setSessionFilterBoth(sessionFilterRef.current.slice(0, -1));
+                setSessionIndexBoth(0);
+            }
+            else if (ch && !key.ctrl && !key.meta && !key.tab) {
+                setSessionFilterBoth(sessionFilterRef.current + ch);
+                setSessionIndexBoth(0);
+            }
+            return;
+        }
         // 3b. Effort picker (/effort): same keyboard pattern as the /model
         // picker (↑/↓ + Enter, Esc cancels).
         if (selectingEffort) {
@@ -3766,10 +5024,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             else if (key.return) {
                 const picked = EFFORT_OPTIONS[effortIndexRef.current];
                 if (picked) {
+                    // No support warning: every model on every provider accepts the
+                    // knob; only a server 400 vetoes it (retried without, warned).
                     setEffortBoth(picked);
-                    if (picked !== "default" && !isEffortSupported(modelRef.current)) {
-                        warnEffortUnsupported(modelRef.current);
-                    }
                 }
                 setSelectingEffort(false);
             }
@@ -3830,7 +5087,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         // a newline anywhere means free text (slash commands never span lines).
         const cur = inputRef.current;
         const menu = !slashDismissedRef.current && cur.startsWith("/") && !cur.includes("\n")
-            ? buildSlashMenu(cur, skillMenu)
+            ? buildSlashMenu(cur, skillMenu, listExtensionCommands())
             : { items: [], moreSkills: 0 };
         const matches = menu.items;
         if (matches.length > 0) {
@@ -3857,8 +5114,8 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             }
             else if (key.return || key.tab) {
                 const pick = matches[slashIndexRef.current % matches.length];
-                // /compact, /queue, /steer, and /autoscroll run while busy (see
-                // slashRunsWhileBusy); every other entry still waits idle.
+                // /compact, /queue, /steer, /autoscroll, and /goal run while busy
+                // (see slashRunsWhileBusy); every other entry still waits idle.
                 if (pick && (slashRunsWhileBusy(pick.name) || !busyRef.current)) {
                     if (pick.skill) {
                         // Skill entries stage for confirm (opencode-style): Enter/Tab
@@ -3889,6 +5146,14 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                         setInputBoth("");
                         runAutoScrollCommand(raw);
                     }
+                    else if (pick.name === "/goal" &&
+                        (inputRef.current === "/goal" || inputRef.current.startsWith("/goal "))) {
+                        // Preserve the typed objective (e.g. "/goal Ship v2"); a bare
+                        // highlighted name falls through to status.
+                        const raw = inputRef.current;
+                        setInputBoth("");
+                        runGoalCommand(raw);
+                    }
                     else if ((pick.name === "/allow" || pick.name === "/deny" || pick.name === "/rules") &&
                         inputRef.current.startsWith(pick.name)) {
                         // Preserve the typed rule args (e.g. "/allow bash:npm test*");
@@ -3897,6 +5162,27 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                         setInputBoth("");
                         runRulesCommand(raw);
                     }
+                    else if (pick.name === "/rename" &&
+                        (inputRef.current === "/rename" || inputRef.current.startsWith("/rename "))) {
+                        // Preserve the typed name (e.g. '/rename "Build auth"'); a bare
+                        // highlighted name falls through to usage.
+                        const raw = inputRef.current;
+                        setInputBoth("");
+                        runRenameCommand(raw);
+                    }
+                    else if (!pick.skill &&
+                        getExtensionCommand(pick.name.slice(1)) &&
+                        (inputRef.current === pick.name || inputRef.current.startsWith(`${pick.name} `))) {
+                        // Extension slash command (ticket 04): preserve the typed args
+                        // like /rename — a bare highlighted name runs with empty args.
+                        // Builtins keep precedence (an extension name can never equal a
+                        // builtin — activation rejects the collision).
+                        const raw = inputRef.current;
+                        setInputBoth("");
+                        const target = parseExtensionCommandInput(raw);
+                        if (target)
+                            void runExtensionCommandFromApp(target.name, target.args);
+                    }
                     else {
                         runSlashCommand(pick.name);
                     }
@@ -3929,7 +5215,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         // input, and input keys never reach the inspector.
         if (key.ctrl && (ch === "o" || ch === "O")) {
             if (!busyRef.current && !turnCancelRef.current &&
-                !pendingApproval && !pendingQuestion &&
+                !pendingApproval && !pendingQuestion && !extDialogOpen &&
                 !selecting && !selectingSkills && !selectingProvider &&
                 !keyPrompt && !baseURLPrompt && !selectingEffort &&
                 !selectingRewind && !selectingRewindScope) {
@@ -3994,8 +5280,8 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         // open); Enter runs through the shared busy-gate, so only
         // compact/queue/steer fire while busy.
         if (key.ctrl && (ch === "p" || ch === "P")) {
-            if (!pendingApproval && !pendingQuestion &&
-                !selecting && !selectingSkills && !selectingProvider &&
+            if (!pendingApproval && !pendingQuestion && !extDialogOpen &&
+                !selecting && !selectingSkills && !selectingSession && !selectingProvider &&
                 !keyPrompt && !baseURLPrompt && !selectingEffort &&
                 !selectingRewind && !selectingRewindScope && !inspecting) {
                 if (paletteOpenRef.current)
@@ -4140,6 +5426,35 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             insertAtCursor(ch);
         }
     });
+    // Extension UI surface reads (ticket 10): fresh copies per render,
+    // repainted via the bumpExtUI subscription at boot. Unknown widget
+    // placements never reach here (the host validates fail-closed). Declared
+    // before the paste/memo guards below (render-execution order matters).
+    const extRuntime = extRuntimeRef.current;
+    const extSegments = extRuntime?.getStatusSegments().map((s) => s.text) ?? [];
+    const extWidgets = extRuntime?.getWidgets().filter((w) => w.placement === "panel") ?? [];
+    const extPendingDialog = extRuntime?.getPendingDialog() ?? null;
+    const extDialogOpen = extPendingDialog !== null;
+    const extStatusText = formatExtensionStatusText(extSegments);
+    const extDialogId = extPendingDialog?.id ?? null;
+    // Extension notices: drain the runtime queue into the transcript as
+    // `(owner) message` info lines. Runs every render; drain-then-clear is
+    // idempotent, so re-renders post nothing twice.
+    useEffect(() => {
+        const runtime = extRuntimeRef.current;
+        if (!runtime)
+            return;
+        const notes = runtime.drainNotifications();
+        for (const n of notes)
+            pushInfo(`(${n.owner}) ${n.message}`);
+    });
+    // A new dialog starts with a fresh selection (a session switch that
+    // rejects the old request also drops the modal — see invalidate).
+    useEffect(() => {
+        setExtDlgSelBoth(0);
+        setExtDlgCustomBoth("");
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [extDialogId]);
     // Bracketed paste (Ink enables `\x1b[?2004h` while active): pasted text —
     // including newlines — inserts at the cursor verbatim and NEVER submits,
     // so multiline pastes can't fire mid-paste. Separate channel from
@@ -4150,8 +5465,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     }, {
         isActive: !pendingApproval &&
             !pendingQuestion &&
+            !extDialogOpen &&
             !selecting &&
             !selectingSkills &&
+            !selectingSession &&
             !selectingProvider &&
             !keyPrompt &&
             !baseURLPrompt &&
@@ -4177,7 +5494,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                         : `thinking${theme.symbol.ellipsis}`;
     // Slash menu derived for render (mirrors the useInput computation above):
     // commands first, then matching skills as `/skill:name` entries.
-    const slashMenu = !selecting &&
+    // Memoized on every gate input: without this the fuzzy matcher rebuilds
+    // on each 1s tick and tool append even though the menu only depends on
+    // input + overlay state.
+    const slashMenu = useMemo(() => !selecting &&
         !selectingSkills &&
         !selectingEffort &&
         !selectingProvider &&
@@ -4185,13 +5505,31 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         !baseURLPrompt &&
         !pendingApproval &&
         !pendingQuestion &&
+        !extDialogOpen &&
         !selectingRewind &&
         !selectingRewindScope &&
         !slashDismissed &&
         input.startsWith("/") &&
         !input.includes("\n")
         ? buildSlashMenu(input, skillMenu)
-        : { items: [], moreSkills: 0 };
+        : { items: [], moreSkills: 0 }, 
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [
+        selecting,
+        selectingSkills,
+        selectingEffort,
+        selectingProvider,
+        keyPrompt,
+        baseURLPrompt,
+        pendingApproval,
+        pendingQuestion,
+        extDialogOpen,
+        selectingRewind,
+        selectingRewindScope,
+        slashDismissed,
+        input,
+        skillMenu,
+    ]);
     const filteredSlash = slashMenu.items;
     const slashVisible = filteredSlash.length > 0;
     const slashHi = filteredSlash.length > 0 ? slashIndex % filteredSlash.length : 0;
@@ -4205,9 +5543,21 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // Unified /model picker derived for render (mirrors the useInput
     // computation above): full entries, filtered entries, clamped highlight,
     // and the visible window — the frame never grows past MODEL_PICKER_VISIBLE
-    // rows no matter how many models providers list.
-    const modelEntriesAll = selecting ? buildModelEntries() : [];
-    const modelEntries = selecting ? filterModelEntries(modelEntriesAll, modelFilter) : [];
+    // rows no matter how many providers list. Memoized: the registry walk
+    // (all providers + fallbacks) must not rerun on ticks/appends while open.
+    // Deps cover every read inside buildModelEntries: selecting gate, provider
+    // mirror, live models, auth store (key presence), and the local snapshot
+    // (loopback baseURLs feed the cache keys); cache-ref writes always land
+    // alongside one of these setStates, so the memo can never go stale.
+    const { modelEntriesAll, modelEntries } = useMemo(() => {
+        const all = selecting ? buildModelEntries() : [];
+        return {
+            modelEntriesAll: all,
+            modelEntries: selecting ? filterModelEntries(all, modelFilter) : [],
+        };
+    }, 
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [selecting, provider, models, auth, localSnap, modelFilter]);
     const modelHi = modelEntries.length === 0 ? 0 : Math.max(0, Math.min(selIndex, modelEntries.length - 1));
     const modelWin = pickerWindow(modelEntries.length, modelHi);
     const modelTitle = `Atom — Select model (${modelEntries.length}` +
@@ -4216,13 +5566,35 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // /skills picker derived for render (mirrors the useInput computation
     // above): names only, filtered, clamped highlight, visible window. The
     // title keeps the `Skills (` prefix the registry header always had.
-    const skillEntriesAll = selectingSkills ? skillPickerItems : [];
-    const skillEntries = selectingSkills ? filterSkillPicker(skillEntriesAll, skillFilter) : [];
+    // Memoized for the same tick/append reason as the model picker above.
+    const { skillEntriesAll, skillEntries } = useMemo(() => {
+        const all = selectingSkills ? skillPickerItems : [];
+        return {
+            skillEntriesAll: all,
+            skillEntries: selectingSkills ? filterSkillPicker(all, skillFilter) : [],
+        };
+    }, [selectingSkills, skillPickerItems, skillFilter]);
     const skillHi = skillEntries.length === 0 ? 0 : Math.max(0, Math.min(skillIndex, skillEntries.length - 1));
     const skillWin = pickerWindow(skillEntries.length, skillHi);
     const skillTitle = `Skills (${skillEntries.length}` +
         (skillFilter ? ` of ${skillEntriesAll.length}, filter: "${skillFilter}"` : "") +
         `) — type to filter, up/down + Enter, Esc cancels:`;
+    // /session picker derived for render (mirrors the useInput computation
+    // above): open-time snapshot, filtered in memory, clamped highlight,
+    // visible window. Memoized for the same tick/append reason as the pickers
+    // above. nowMs via Date.now (render-time age labels, never persisted).
+    const { sessionEntriesAll, sessionEntries } = useMemo(() => {
+        const all = selectingSession ? sessionItems : [];
+        return {
+            sessionEntriesAll: all,
+            sessionEntries: selectingSession ? filterSessionEntries(all, sessionFilter) : [],
+        };
+    }, [selectingSession, sessionItems, sessionFilter]);
+    const sessionHi = sessionEntries.length === 0 ? 0 : Math.max(0, Math.min(sessionIndex, sessionEntries.length - 1));
+    const sessionWin = pickerWindow(sessionEntries.length, sessionHi);
+    const sessionPickerTitle = `Sessions (${sessionEntries.length}` +
+        (sessionFilter ? ` of ${sessionEntriesAll.length}, filter: "${sessionFilter}"` : "") +
+        `) — type to filter, up/down + Enter, Esc cancels:`;
     // Memoized render derivations (flicker fix): these rebuild arrays on every
     // App render (token paints, keystrokes, 1s ticks), which defeats the memo
     // on the leaf panels below. Memoized, the leaves skip everything but real
@@ -4231,27 +5603,31 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     const checkpointListMemo = useMemo(() => (selectingRewind ? listCheckpoints() : []), 
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [selectingRewind]);
+    // Approval description: the tool-call one-liner for the modal. Memoized on
+    // the pending approval itself — the 1s busy tick keeps firing while the
+    // modal waits, and must not rebuild the string (nor re-render the modal).
+    const approvalDescription = useMemo(() => (pendingApproval ? describeToolCall(pendingApproval.name, pendingApproval.args) : ""), [pendingApproval]);
     // (The cursor clamp lives inside the memoized InputBox now, next to its
     // only use — App body no longer reads cursor state for paint.)
-    // Status-line reasoning segment wired to the effort session state:
-    // non-Default shows the effort (plus " (unsupported)" when the model is
-    // outside the verified-support set OR the provider is not opencode-zen);
-    // Default shows response metadata or "default" as before.
-    // reasoning_effort is sent ONLY for opencode-zen + supported model.
-    const effortSupportedNow = effort === "default" ||
-        (provider === "opencode-zen" && isEffortSupported(model));
-    const reasoningDisplay = effort !== "default"
+    // Status-line reasoning segment wired to the effort session state: a
+    // non-Auto effort always shows the effort (the knob is sent for every
+    // model on every provider kind); Auto shows response metadata or "auto".
+    // "(unsupported)" survives only as a safety net for an unknown provider —
+    // support is otherwise assumed, with the server as the authority (a 400
+    // naming the knob retries the POST without it and warns).
+    const effortSupportedNow = effort === "auto" || isEffortSupported(model, provider);
+    const reasoningDisplay = effort !== "auto"
         ? effortSupportedNow
             ? effort
             : `${effort} (unsupported)`
-        : (reasoning ?? "default");
+        : (reasoning ?? "auto");
     // Display-only live tool elapsed: wall-clock now ≈ turn start + elapsed
     // ticks (the 1s busy tick re-renders, so this stays fresh). Null when no
     // tool is running — the running line then paints with no duration.
     const toolElapsedSecs = busy && toolHint && toolStartRef.current !== null
         ? elapsedSecsSince(toolStartRef.current, turnStartRef.current + elapsedSecs * 1000)
         : null;
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(TranscriptView, { turns: turns, clearGen: clearGen, end: scrollEnd, held: scrollEnd !== null, showThinking: showThinking }), _jsx(LiveTail, { isEmpty: turns.length === 0, sessionHint: sessionHint, draft: draft, thinking: thinking, busy: busy, held: scrollEnd !== null, toolHint: toolHint, toolElapsedSecs: toolElapsedSecs, elapsedSecs: elapsedSecs, showThinking: showThinking }), error ? _jsxs(Text, { color: theme.color.error, children: ["error> ", error] }) : null, pendingApproval ? (_jsx(ApprovalBox, { toolName: pendingApproval.name, description: describeToolCall(pendingApproval.name, pendingApproval.args), selected: approveIndex, diff: pendingApproval.diff ?? null })) : null, pendingQuestion ? (_jsx(QuestionBox, { question: pendingQuestion.question, options: pendingQuestion.options, allowCustom: pendingQuestion.allowCustom, askCustom: askCustom, askSelIndex: askSelIndex })) : null, _jsx(TodoPanel, { items: todoSnap }), steerPending ? _jsxs(Text, { dimColor: true, children: ["Steering: ", steerPending] }) : null, queue.length > 0 ? (_jsxs(Text, { dimColor: true, children: ["Queued (", queue.length, "): ", queue[0], queue.length > 1 ? ` +${queue.length - 1} more (/queue)` : ""] })) : null, paletteOpen ? (_jsx(PalettePanel, { entries: paletteEntriesMemo, index: paletteIndex, filter: paletteFilter })) : inspecting ? (_jsx(InspectorPanel, { records: toolLogRef.current, index: inspectIndex, expanded: inspectExpanded, scroll: inspectScroll })) : selecting ? (_jsxs(PickerShell, { title: modelTitle, children: [_jsx(PickerMoreAbove, { count: modelWin.start }), modelEntries.slice(modelWin.start, modelWin.end).map((e, k) => {
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(TranscriptView, { turns: turns, clearGen: clearGen, end: scrollEnd, held: scrollEnd !== null, showThinking: showThinking }), _jsx(LiveTailHost, { store: streamStore, isEmpty: turns.length === 0, sessionHint: sessionHint, emptySessionTitle: turns.length === 0 ? sessionTitle : null, busy: busy, held: scrollEnd !== null, toolHint: toolHint, toolElapsedSecs: toolElapsedSecs, elapsedSecs: elapsedSecs, showThinking: showThinking }), error ? _jsxs(Text, { color: theme.color.error, children: ["error> ", error] }) : null, pendingApproval ? (_jsx(ApprovalBox, { toolName: pendingApproval.name, description: approvalDescription, selected: approveIndex, diff: pendingApproval.diff ?? null })) : null, pendingQuestion ? (_jsx(QuestionBox, { question: pendingQuestion.question, options: pendingQuestion.options, allowCustom: pendingQuestion.allowCustom, askCustom: askCustom, askSelIndex: askSelIndex })) : null, extPendingDialog && !pendingApproval && !pendingQuestion ? (_jsx(QuestionBox, { question: `[${extPendingDialog.owner}] ${extPendingDialog.question}`, options: extPendingDialog.options, allowCustom: extPendingDialog.allowCustom, askCustom: extDlgCustom, askSelIndex: extDlgSel }, `ext-dialog-${extPendingDialog.id}`)) : null, _jsx(TodoPanel, { items: todoSnap }), extWidgets.map((w) => (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.panel, paddingX: theme.spacing.pickerPadX, children: [_jsxs(Text, { bold: true, children: ["[", w.owner, "] ", w.title] }), _jsx(Text, { children: w.text })] }, `${w.owner}-${w.id}`))), steerPending ? _jsxs(Text, { dimColor: true, children: ["Steering: ", steerPending] }) : null, queue.length > 0 ? (_jsxs(Text, { dimColor: true, children: ["Queued (", queue.length, "): ", queue[0], queue.length > 1 ? ` +${queue.length - 1} more (/queue)` : ""] })) : null, paletteOpen ? (_jsx(PalettePanel, { entries: paletteEntriesMemo, index: paletteIndex, filter: paletteFilter })) : inspecting ? (_jsx(InspectorPanel, { records: toolLogRef.current, index: inspectIndex, expanded: inspectExpanded, scroll: inspectScroll })) : selecting ? (_jsxs(PickerShell, { title: modelTitle, children: [_jsx(PickerMoreAbove, { count: modelWin.start }), modelEntries.slice(modelWin.start, modelWin.end).map((e, k) => {
                         const i = modelWin.start + k;
                         const entryLocal = e.local === true;
                         const prevLocal = i === 0 ? null : modelEntries[i - 1]?.local === true;
@@ -4266,7 +5642,13 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                         return (_jsxs(PickerRow, { highlighted: i === skillHi, children: ["/skill:", e.name, !e.userInvocable ? _jsx(Text, { dimColor: true, children: " [auto-only]" }) : null] }, `${e.name}-${i}`));
                     }), _jsx(PickerMoreBelow, { count: skillEntries.length - skillWin.end }), skillEntries.length === 0 ? (_jsx(Text, { dimColor: true, children: skillEntriesAll.length === 0
                             ? "No skills installed — add SKILL.md skills under .claude/skills/, .agents/skills/, or the ~/. counterparts."
-                            : "No skills match — backspace to widen the filter." })) : null] })) : selectingProvider ? (_jsx(PickerShell, { title: "Atom \u2014 Select provider (up/down + Enter, Esc cancels):", children: PROVIDERS.map((p, i) => {
+                            : "No skills match — backspace to widen the filter." })) : null] })) : selectingSession ? (_jsxs(PickerShell, { title: sessionPickerTitle, children: [_jsx(PickerMoreAbove, { count: sessionWin.start }), sessionEntries.slice(sessionWin.start, sessionWin.end).map((e, k) => {
+                        const i = sessionWin.start + k;
+                        const age = formatSessionAge(Date.now(), e.updatedAt);
+                        return (_jsxs(PickerRow, { highlighted: i === sessionHi, children: [e.title, e.active ? " (current)" : "", _jsxs(Text, { dimColor: true, children: [" ", "\u00B7 ", e.turnCount, " turn", e.turnCount === 1 ? "" : "s", " \u00B7 ", age] })] }, `${e.id}-${i}`));
+                    }), _jsx(PickerMoreBelow, { count: sessionEntries.length - sessionWin.end }), sessionEntries.length === 0 ? (_jsx(Text, { dimColor: true, children: sessionEntriesAll.length === 0
+                            ? "No sessions yet — your current conversation is saved automatically."
+                            : "No sessions match — backspace to widen the filter." })) : null] })) : selectingProvider ? (_jsx(PickerShell, { title: "Atom \u2014 Select provider (up/down + Enter, Esc cancels):", children: PROVIDERS.map((p, i) => {
                     const has = keyForProvider(p.id).length > 0;
                     const keyMark = isLocalProviderId(p.id)
                         ? `local ${theme.symbol.descSeparator} no key needed`
@@ -4276,7 +5658,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                                 ? `${theme.symbol.descSeparator} key optional — free models need none`
                                 : `${theme.symbol.descSeparator} no key`;
                     return (_jsxs(PickerRow, { highlighted: i === providerIndex, children: [p.name, " (", p.id, ") ", keyMark, p.id === provider ? " (current)" : ""] }, p.id));
-                }) })) : keyPrompt ? (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.picker, paddingX: theme.spacing.pickerPadX, children: [_jsxs(Text, { bold: true, children: ["Atom \u2014 API key for ", keyPrompt.providerId, " (paste + Enter, Esc cancels):"] }), keyPrompt.consoleURL ? (_jsxs(Text, { dimColor: true, children: ["Get a key: ", keyPrompt.consoleURL] })) : null, keyPrompt.existingMasked ? (_jsxs(Text, { dimColor: true, children: ["key on file (", keyPrompt.existingMasked, ") \u2014 type a new key to replace, Esc keeps + switches"] })) : (_jsx(Text, { dimColor: true, children: "No key on file \u2014 paste once, validated then stored in ~/.atom/auth.json" })), keyPrompt.providerId === "kilo" ? (_jsx(Text, { dimColor: true, children: "Optional: free models work without a key \u2014 empty Enter continues anonymously" })) : null, _jsxs(Text, { children: ["key: ", theme.symbol.keyMask.repeat(keyPrompt.draft.length), _jsx(Text, { color: theme.color.mutedPaint, children: theme.symbol.cursorBlock })] }), keyPrompt.validating ? _jsxs(Text, { dimColor: true, children: ["validating", theme.symbol.ellipsis] }) : null, keyPrompt.error ? _jsx(Text, { color: theme.color.error, children: keyPrompt.error }) : null] })) : baseURLPrompt ? (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.picker, paddingX: theme.spacing.pickerPadX, children: [_jsx(Text, { bold: true, children: "Atom \u2014 baseURL for openai-compatible (http(s) URL + Enter, Esc cancels):" }), _jsxs(Text, { children: ["baseURL: ", baseURLPrompt.draft, _jsx(Text, { color: theme.color.mutedPaint, children: theme.symbol.cursorBlock })] }), baseURLPrompt.error ? _jsx(Text, { color: theme.color.error, children: baseURLPrompt.error }) : null] })) : selectingEffort ? (_jsxs(PickerShell, { title: "Atom \u2014 Select reasoning effort (up/down + Enter, Esc cancels):", children: [EFFORT_OPTIONS.map((o, i) => (_jsxs(PickerRow, { highlighted: i === effortIndex, children: [o === "default" ? "Default" : o === "max" ? "Max" : o[0]?.toUpperCase() + o.slice(1), o === effort ? " (current)" : ""] }, `${o}-${i}`))), _jsx(Text, { dimColor: true, children: "Top is Max (sent as max); xhigh is not a verified value." })] })) : selectingRewind ? (_jsxs(PickerShell, { title: "Atom \u2014 Rewind to checkpoint (up/down + Enter, Esc cancels):", children: [checkpointListMemo.map((c, i) => (_jsxs(PickerRow, { highlighted: i === rewindIndex, children: ["#", c.seq, " ", theme.symbol.separator, " ", c.label, " ", theme.symbol.separator, " ", c.files.length, " file(s)"] }, c.id))), _jsx(Text, { dimColor: true, children: "Restores exact bytes (hash-verified). Shell side effects (bash) are never snapshotted and cannot be undone." })] })) : selectingRewindScope ? (_jsxs(PickerShell, { title: "Atom \u2014 Rewind scope (up/down + Enter, Esc cancels):", children: [REWIND_SCOPES.map((s, i) => (_jsx(PickerRow, { highlighted: i === rewindScopeIndex, children: s }, s))), _jsx(Text, { dimColor: true, children: "Shell side effects (bash) are explicitly out of scope and cannot be undone." })] })) : (
+                }) })) : keyPrompt ? (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.picker, paddingX: theme.spacing.pickerPadX, children: [_jsxs(Text, { bold: true, children: ["Atom \u2014 API key for ", keyPrompt.providerId, " (paste + Enter, Esc cancels):"] }), keyPrompt.consoleURL ? (_jsxs(Text, { dimColor: true, children: ["Get a key: ", keyPrompt.consoleURL] })) : null, keyPrompt.existingMasked ? (_jsxs(Text, { dimColor: true, children: ["key on file (", keyPrompt.existingMasked, ") \u2014 type a new key to replace, Esc keeps + switches"] })) : (_jsx(Text, { dimColor: true, children: "No key on file \u2014 paste once, validated then stored in ~/.atom/auth.json" })), keyPrompt.providerId === "kilo" ? (_jsx(Text, { dimColor: true, children: "Optional: free models work without a key \u2014 empty Enter continues anonymously" })) : null, _jsxs(Text, { children: ["key: ", theme.symbol.keyMask.repeat(keyPrompt.draft.length), _jsx(Text, { color: theme.color.mutedPaint, children: theme.symbol.cursorBlock })] }), keyPrompt.validating ? _jsxs(Text, { dimColor: true, children: ["validating", theme.symbol.ellipsis] }) : null, keyPrompt.error ? _jsx(Text, { color: theme.color.error, children: keyPrompt.error }) : null] })) : baseURLPrompt ? (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.picker, paddingX: theme.spacing.pickerPadX, children: [_jsx(Text, { bold: true, children: "Atom \u2014 baseURL for openai-compatible (http(s) URL + Enter, Esc cancels):" }), _jsxs(Text, { children: ["baseURL: ", baseURLPrompt.draft, _jsx(Text, { color: theme.color.mutedPaint, children: theme.symbol.cursorBlock })] }), baseURLPrompt.error ? _jsx(Text, { color: theme.color.error, children: baseURLPrompt.error }) : null] })) : selectingEffort ? (_jsxs(PickerShell, { title: "Atom \u2014 Select reasoning effort (up/down + Enter, Esc cancels):", children: [EFFORT_OPTIONS.map((o, i) => (_jsxs(PickerRow, { highlighted: i === effortIndex, children: [o === "auto" ? "Auto" : o === "max" ? "Max" : o[0]?.toUpperCase() + o.slice(1), o === effort ? " (current)" : ""] }, `${o}-${i}`))), _jsx(Text, { dimColor: true, children: "Auto lets the model decide; Low\u2192Max raise reasoning depth on every model." })] })) : selectingRewind ? (_jsxs(PickerShell, { title: "Atom \u2014 Rewind to checkpoint (up/down + Enter, Esc cancels):", children: [checkpointListMemo.map((c, i) => (_jsxs(PickerRow, { highlighted: i === rewindIndex, children: ["#", c.seq, " ", theme.symbol.separator, " ", c.label, " ", theme.symbol.separator, " ", c.files.length, " file(s)"] }, c.id))), _jsx(Text, { dimColor: true, children: "Restores exact bytes (hash-verified). Shell side effects (bash) are never snapshotted and cannot be undone." })] })) : selectingRewindScope ? (_jsxs(PickerShell, { title: "Atom \u2014 Rewind scope (up/down + Enter, Esc cancels):", children: [REWIND_SCOPES.map((s, i) => (_jsx(PickerRow, { highlighted: i === rewindScopeIndex, children: s }, s))), _jsx(Text, { dimColor: true, children: "Shell side effects (bash) are explicitly out of scope and cannot be undone." })] })) : (
             // The input is the one boxed, prominent surface (see the memoized
             // InputBox above): a quiet gray frame sets it apart from the
             // transcript above and the status line below. Pickers and modals
@@ -4284,5 +5666,5 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             // border color.
             _jsx(InputBox, { input: input, cursor: cursor })), slashVisible && !inspecting && !paletteOpen ? (_jsxs(PickerShell, { title: slashHasSkills
                     ? `Atom commands + skills (${theme.symbol.moreAbove}/${theme.symbol.moreBelow} + Enter/Tab to run, Esc dismisses):`
-                    : `Atom commands (${theme.symbol.moreAbove}/${theme.symbol.moreBelow} + Enter/Tab to run, Esc dismisses):`, borderColor: theme.border.menu, children: [_jsx(PickerMoreAbove, { count: slashWin.start }), filteredSlash.slice(slashWin.start, slashWin.end).map((c) => (_jsxs(PickerRow, { highlighted: c.name === slashHighlight, highlightColor: theme.color.menuSelection, children: [c.name, c.description ? ` ${theme.symbol.descSeparator} ${c.description}` : ""] }, c.name))), _jsx(PickerMoreBelow, { count: filteredSlash.length - slashWin.end }), slashUsage ? _jsx(Text, { dimColor: true, children: slashUsage }) : null, slashMenu.moreSkills > 0 ? (_jsxs(Text, { dimColor: true, children: [theme.symbol.ellipsis, "and ", slashMenu.moreSkills, " more skill", slashMenu.moreSkills === 1 ? "" : "s", " \u2014 keep typing to narrow"] })) : null] })) : null, _jsx(StatusBar, { provider: provider, model: model, usageTotals: usageTotals, contextLoad: contextLoad, reasoningDisplay: reasoningDisplay, mode: mode, trustAll: trustAll, busy: busy, activity: toolHint ? activityText(toolHint) : null, phaseLabel: phaseLabel, elapsedSecs: elapsedSecs, stalled: stalled, approvalPending: pendingApproval !== null, cwd: shortenCwd(process.cwd(), os.homedir()), branch: gitInfo?.branch ?? null, columns: termColumns })] }));
+                    : `Atom commands (${theme.symbol.moreAbove}/${theme.symbol.moreBelow} + Enter/Tab to run, Esc dismisses):`, borderColor: theme.border.menu, children: [_jsx(PickerMoreAbove, { count: slashWin.start }), filteredSlash.slice(slashWin.start, slashWin.end).map((c) => (_jsxs(PickerRow, { highlighted: c.name === slashHighlight, highlightColor: theme.color.menuSelection, children: [c.name, c.description ? ` ${theme.symbol.descSeparator} ${c.description}` : ""] }, c.name))), _jsx(PickerMoreBelow, { count: filteredSlash.length - slashWin.end }), slashUsage ? _jsx(Text, { dimColor: true, children: slashUsage }) : null, slashMenu.moreSkills > 0 ? (_jsxs(Text, { dimColor: true, children: [theme.symbol.ellipsis, "and ", slashMenu.moreSkills, " more skill", slashMenu.moreSkills === 1 ? "" : "s", " \u2014 keep typing to narrow"] })) : null] })) : null, _jsx(StatusBarHost, { provider: provider, model: model, usageTotals: usageTotals, contextLoad: contextLoad, reasoningDisplay: reasoningDisplay, mode: mode, trustAll: trustAll, busy: busy, activity: toolHint ? activityText(toolHint) : null, phaseLabel: phaseLabel, elapsedSecs: elapsedSecs, stalled: stalled, approvalPending: pendingApproval !== null, cwd: shortenCwd(process.cwd(), os.homedir()), branch: gitInfo?.branch ?? null, extensionStatus: extStatusText, goal: goal ? { objective: goal.objective, active: goal.active === true } : null })] }));
 }