context-mode 1.0.165 → 1.0.167

package/build/adapters/openclaw/usage.js

@@ -0,0 +1,52 @@
+/**
+ * adapters/openclaw/usage — per-turn token + cost capture handler.
+ *
+ * openclaw emits a first-class `model.usage` diagnostic event once per turn
+ * (`DiagnosticUsageEvent`, refs/platforms/openclaw/src/infra/diagnostic-events.ts:18-47),
+ * carrying the full usage breakdown {input, output, cacheRead, cacheWrite} plus
+ * a PRE-COMPUTED `costUsd` (estimateUsageCost, agent-runner.ts:1995). Consumers
+ * subscribe via `onDiagnosticEvent(listener)` (diagnostic-events.ts:1156) — the
+ * exact bus the first-party diagnostics-otel / diagnostics-prometheus extensions
+ * read.
+ *
+ * This module is the parse→build→insert handler the plugin's diagnostic-event
+ * listener invokes. It is deliberately decoupled from the openclaw plugin SDK so
+ * it stays unit-testable: the caller passes the raw payload and an `insert`
+ * callback (the plugin hands it `db.insertEvent`-bound-to-sessionId). The handler
+ * never throws — a usage-capture failure must never break the agent turn.
+ *
+ * Capture surface: the diagnostic-event bus, NOT the tool-call hook. The native
+ * before_tool_call / after_tool_call relay carries only approval/policy data and
+ * NO token usage (matrix §4) — so usage cannot be captured from after_tool_call.
+ */
+import { parseOpenclawUsage, buildAgentUsageEvent } from "../../session/extract.js";
+/**
+ * Handle one openclaw `model.usage` diagnostic payload: parse the per-turn usage
+ * (NOT lastCallUsage), build the structured `agent_usage` event with openclaw's
+ * native `costUsd` (preferred over the pricing catalog), and insert it.
+ *
+ * Returns the inserted event (for tests / callers that want to forward) or null
+ * when the payload is not a usage event, carries no usage, or sums to zero.
+ * Best-effort: swallows any insert failure.
+ */
+export function handleOpenclawUsageEvent(payload, insert) {
+    // parseOpenclawUsage maps cacheWrite→cache_creation_tokens,
+    // cacheRead→cache_read_tokens, costUsd→native_cost_usd, and reads ONLY the
+    // per-turn `usage` total — never the lastCallUsage delta.
+    const counts = parseOpenclawUsage(payload);
+    if (!counts)
+        return null;
+    // native_cost_usd (openclaw's pre-computed costUsd) is preferred over the
+    // catalog inside buildAgentUsageEvent.
+    const event = buildAgentUsageEvent(counts);
+    if (!event)
+        return null;
+    try {
+        insert(event);
+    }
+    catch {
+        // Usage capture must never break the agent turn.
+        return null;
+    }
+    return event;
+}

package/build/adapters/opencode/plugin.d.ts

@@ -88,6 +88,22 @@ interface AfterHookOutput {
     output: string;
     metadata: any;
 }
+/**
+ * OpenCode generic bus `event` hook — single parameter.
+ * The plugin SDK delivers every bus Event here (refs/platforms/opencode/
+ * packages/plugin/src/index.ts:224). We narrow to `message.updated`, whose
+ * `properties.info` is the full assistant Message carrying tokens/cost/modelID.
+ */
+interface EventHookInput {
+    event?: {
+        type?: string;
+        properties?: {
+            info?: {
+                sessionID?: string;
+            } & Record<string, unknown>;
+        };
+    };
+}
 /** OpenCode experimental.session.compacting — first parameter */
 interface CompactingHookInput {
     sessionID: string;
@@ -154,6 +170,7 @@ declare function createContextModePlugin(ctx: PluginContext): Promise<{
     tool: Record<string, NativeToolDefinition>;
     "tool.execute.before": (input: BeforeHookInput, output: BeforeHookOutput) => Promise<void>;
     "tool.execute.after": (input: AfterHookInput, output: AfterHookOutput) => Promise<void>;
+    event: (input: EventHookInput) => Promise<void>;
     "chat.message": (input: ChatMessageHookInput, output: ChatMessageHookOutput) => Promise<void>;
     "experimental.session.compacting": (input: CompactingHookInput, output: CompactingHookOutput) => Promise<string>;
     "experimental.chat.system.transform": (input: SystemTransformHookInput, output: SystemTransformHookOutput) => Promise<void>;

package/build/adapters/opencode/plugin.js

@@ -24,7 +24,7 @@ import { dirname, resolve, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { existsSync, readFileSync } from "node:fs";
 import { resolveSessionDbPath, SessionDB } from "../../session/db.js";
-import { extractEvents, extractUserEvents } from "../../session/extract.js";
+import { extractEvents, extractUserEvents, parseOpencodeUsage, buildAgentUsageEvent } from "../../session/extract.js";
 import { buildResumeSnapshot } from "../../session/snapshot.js";
 import { OpenCodeAdapter } from "./index.js";
 import { PLATFORM_ENV_VARS } from "../detect.js";
@@ -346,6 +346,45 @@ async function createContextModePlugin(ctx) {
                 // Silent — session capture must never break the tool call
             }
         },
+        // ── event: per-turn token + cost capture (paid-observability) ───
+        // The generic bus `event` hook (refs/platforms/opencode/packages/plugin/
+        // src/index.ts:224) delivers every Event; we filter `message.updated`
+        // (published on each assistant-message update incl. step-finish —
+        // session.ts:673) and read tokens/cost/modelID off properties.info
+        // (assistant filter via role; refs stream.transport.ts:214-216).
+        //
+        // CAVEAT (refs processor.ts:717-718): message-level `.tokens` is the LAST
+        // step's snapshot (overwritten per step-finish), while `.cost` is
+        // cumulative for the turn. parseOpencodeUsage passes `.cost` through as
+        // native_cost_usd so the billed $ stays exact despite the token snapshot
+        // being last-step only. `message.updated` fires multiple times per turn;
+        // because tokens are a terminal snapshot and cost is cumulative, the last
+        // event for a message carries the final figures — re-emitting on each
+        // update is idempotent at the cost column and merely refreshes the
+        // last-step token telemetry. db.insertEvent both persists locally AND
+        // forwards to the platform (the TS-plugin equivalent of the .mjs
+        // attributeAndInsertEvents path).
+        event: async (input) => {
+            try {
+                const ev = input?.event;
+                if (!ev || ev.type !== "message.updated")
+                    return;
+                const sessionId = ev.properties?.info?.sessionID;
+                if (!sessionId || typeof sessionId !== "string")
+                    return;
+                const counts = parseOpencodeUsage(ev);
+                if (!counts)
+                    return;
+                const usageEvent = buildAgentUsageEvent(counts);
+                if (!usageEvent)
+                    return;
+                db.ensureSession(sessionId, projectDir);
+                db.insertEvent(sessionId, usageEvent, "MessageUpdated");
+            }
+            catch {
+                // Silent — usage capture must never break the session.
+            }
+        },
         // ── chat.message: User-prompt capture (OC-2 / Z2) ───
         // SDK signature verified at refs/platforms/opencode/packages/plugin/src/
         // index.ts:233. Orchestrator reference at refs/plugin-examples/opencode/

package/build/adapters/pi/extension.js

@@ -16,9 +16,9 @@ import { homedir } from "node:os";
 import { join, resolve, dirname } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { resolveSessionDbPath, SessionDB } from "../../session/db.js";
-import { extractEvents, extractUserEvents } from "../../session/extract.js";
+import { extractEvents, extractUserEvents, parsePiUsage, buildAgentUsageEvent } from "../../session/extract.js";
 import { buildResumeSnapshot } from "../../session/snapshot.js";
-import { bootstrapMCPTools } from "./mcp-bridge.js";
+import { bootstrapMCPTools, makeBridgeDiag, isForegroundSession } from "./mcp-bridge.js";
 import { PiAdapter } from "./index.js";
 // ── Pi Tool Name Mapping ─────────────────────────────────
 // Pi uses lowercase; shared extractors expect PascalCase (Claude Code convention).
@@ -298,9 +298,9 @@ function handleCommandText(text, ctx) {
 // print-mode subagents (`pi --mode json -p --no-session`). We start and await
 // the bridge from that hook so ctx_* tools are present before Pi snapshots the
 // tool registry, while CLI-only commands never spawn a bridge at all.
-function startPiMCPBridge(pi, serverBundle, shouldKeepHandle) {
+function startPiMCPBridge(pi, serverBundle, shouldKeepHandle, foreground) {
     if (existsSync(serverBundle)) {
-        _mcpBridgeReady = bootstrapMCPTools(pi, serverBundle).then((handle) => {
+        _mcpBridgeReady = bootstrapMCPTools(pi, serverBundle, { foreground }).then((handle) => {
             if (shouldKeepHandle()) {
                 _mcpBridge = handle;
             }
@@ -319,8 +319,9 @@ function startPiMCPBridge(pi, serverBundle, shouldKeepHandle) {
             if (!shouldKeepHandle())
                 return;
             const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`[context-mode] WARNING: failed to bridge MCP tools to Pi (${msg}). ` +
-                `ctx_* tools will not be callable from this session.\n`);
+            // #868: route to Pi's file logger, never process.stderr (raw-mode TUI).
+            makeBridgeDiag(pi)(`[context-mode] WARNING: failed to bridge MCP tools to Pi (${msg}). ` +
+                `ctx_* tools will not be callable from this session.`);
         });
     }
     else {
@@ -382,12 +383,12 @@ export default function piExtension(pi) {
     const serverBundle = resolve(pluginRoot, "server.bundle.mjs");
     let mcpBridgeStarted = false;
     let mcpBridgeGeneration = 0;
-    const ensureMCPBridge = () => {
+    const ensureMCPBridge = (foreground) => {
         if (mcpBridgeStarted)
             return _mcpBridgeReady;
         mcpBridgeStarted = true;
         const generation = ++mcpBridgeGeneration;
-        return startPiMCPBridge(pi, serverBundle, () => mcpBridgeStarted && mcpBridgeGeneration === generation);
+        return startPiMCPBridge(pi, serverBundle, () => mcpBridgeStarted && mcpBridgeGeneration === generation, foreground);
     };
     // Issue #545 — Pi workspace resolver. PI_CONFIG_DIR is Pi's CONFIG dir
     // (~/.pi), NOT the user's workspace; using it as the project anchor
@@ -527,7 +528,7 @@ export default function piExtension(pi) {
         }
     });
     // ── 4. before_agent_start — Routing + active_memory + resume injection ─
-    pi.on("before_agent_start", async (event) => {
+    pi.on("before_agent_start", async (event, ctx) => {
         try {
             _pendingContext = ""; // Reset — will be filled below if events exist
             // Lazily start and await the MCP bridge only when Pi is about to
@@ -538,7 +539,24 @@ export default function piExtension(pi) {
             // here ensures ctx_* tools are registered before Pi snapshots the tool
             // registry for the model call. Resolves on bootstrap failure too — the
             // bridge is best-effort.
-            await ensureMCPBridge();
+            //
+            // #868: the FOREGROUND interactive session's bridge child is spawned with
+            // the #854 idle reaper disabled (via ctx.hasUI), so a multi-minute human
+            // pause never drops its ctx_* tools. Subagents (hasUI:false) keep the
+            // reaper so abandoned children can't accumulate (#854).
+            //
+            // INVARIANT — deciding foreground on the FIRST before_agent_start is safe
+            // even though the bridge spawns single-flight (first-wins, no sticky
+            // latch): Pi wires the interactive uiContext inside `mode.init()`, which
+            // main.ts AWAITS before dispatching the first prompt — and
+            // before_agent_start is emitted only from the per-turn prompt path. So the
+            // foreground session's first hook ALWAYS observes hasUI:true; subagents are
+            // provably hasUI:false. There is no early-init window where the foreground
+            // transiently reads hasUI:false (that window is scoped to a separate,
+            // buffered credential event). Do NOT add a latch here — it would guard an
+            // unreachable state. (Verified against oh-my-pi: main.ts init→prompt order,
+            // interactive-mode.ts uiContext wiring, executor.ts subagent hasUI:false.)
+            await ensureMCPBridge(isForegroundSession(ctx));
             if (!_sessionId)
                 return;
             const prompt = String(event?.prompt ?? "");
@@ -687,6 +705,39 @@ export default function piExtension(pi) {
             // best effort — never break provider response
         }
     });
+    // ── 4c. turn_end — per-turn token + native-USD cost capture ───
+    //
+    // Pi delivers per-turn usage on TurnEndEvent.message (an AssistantMessage):
+    // usage.{input,output,cacheRead,cacheWrite} + native usage.cost.total in USD,
+    // with model on .model. Usage is per-turn incremental, so each turn_end maps
+    // to exactly one structured `agent_usage` (category "cost") event — the same
+    // shape the Claude Code Stop path emits via buildAgentUsageEvent. We pass
+    // Pi's native cost as native_cost_usd so the builder trusts the source over
+    // the local price table (cost_confidence: HIGH — no price-table maintenance).
+    //
+    // Refs: adapter-matrix/pi.md @320261f — shared-events.ts:204-209 (TurnEndEvent),
+    // ai/src/types.ts:510/521 (model/usage), catalog/src/types.ts:100-145 (Usage).
+    // Best-effort: parse is null-safe and the handler never throws (a telemetry
+    // forwarder must never break the agent turn).
+    pi.on("turn_end", (event) => {
+        try {
+            if (!_sessionId)
+                return;
+            const counts = parsePiUsage(event);
+            if (!counts)
+                return; // non-assistant turn or all-zero usage
+            const ev = buildAgentUsageEvent(counts);
+            if (!ev)
+                return;
+            // db.insertEvent is the extension-side analog of the .mjs hooks'
+            // attributeAndInsertEvents (insert + project attribution). The MCP
+            // server forwards persisted agent_usage events to the platform.
+            db.insertEvent(_sessionId, ev, "Stop", _attribution);
+        }
+        catch {
+            // best effort — never break the agent turn
+        }
+    });
     // ── 5. session_before_compact — Build resume snapshot ──
     pi.on("session_before_compact", () => {
         try {

package/build/adapters/pi/mcp-bridge.d.ts

@@ -78,6 +78,12 @@ export declare class MCPStdioClient {
     private readonly serverScript;
     private readonly env;
     private readonly runtimeOverride;
+    /**
+     * TUI-safe sink for the child's forwarded stderr (#868). Defaults to a
+     * no-op so direct callers (skippedBridge, tests) never leak to the
+     * terminal; bootstrapMCPTools wires this to the Pi host's file logger.
+     */
+    private readonly diag;
     private child;
     private requestId;
     private readonly pending;
@@ -99,7 +105,13 @@ export declare class MCPStdioClient {
      * without needing to attach a process-tree probe.
      */
     _spawnEnv: NodeJS.ProcessEnv | null;
-    constructor(serverScript: string, env?: NodeJS.ProcessEnv, runtimeOverride?: string | null);
+    constructor(serverScript: string, env?: NodeJS.ProcessEnv, runtimeOverride?: string | null, 
+    /**
+     * TUI-safe sink for the child's forwarded stderr (#868). Defaults to a
+     * no-op so direct callers (skippedBridge, tests) never leak to the
+     * terminal; bootstrapMCPTools wires this to the Pi host's file logger.
+     */
+    diag?: BridgeDiag);
     /** Spawn the MCP child. Idempotent. */
     start(): void;
     private onExit;
@@ -161,7 +173,64 @@ export interface PiToolRegistration {
 }
 export interface PiLikeAPI {
     registerTool: (tool: PiToolRegistration) => void;
+    /**
+     * Pi's rotating file logger (`~/.omp/logs/`). Pi runs a raw-mode TUI that
+     * owns the terminal, so an in-process extension MUST NOT write to
+     * process.stdout/stderr — any console write is rendered straight into the
+     * editor input box and blocks typing (#868, confirmed against
+     * oh-my-pi tui/terminal.ts raw-mode + docs/skills/authoring-extensions.md:
+     * "nothing is written to the console, which would corrupt the TUI"). All
+     * bridge diagnostics route here instead. Optional: absent in tests / minimal
+     * hosts, in which case diagnostics are dropped — we NEVER fall back to the
+     * terminal.
+     */
+    logger?: {
+        debug?: (message: string, context?: Record<string, unknown>) => void;
+        info?: (message: string, context?: Record<string, unknown>) => void;
+        warn?: (message: string, context?: Record<string, unknown>) => void;
+        error?: (message: string, context?: Record<string, unknown>) => void;
+    };
 }
+/** TUI-safe diagnostics sink: routes to Pi's file logger, never the terminal. */
+export type BridgeDiag = (line: string, level?: "warn" | "debug") => void;
+/**
+ * Build a {@link BridgeDiag} bound to a Pi host's file logger (#868). Writing to
+ * process.stderr from inside Pi's raw-mode TUI corrupts the editor, so every
+ * bridge diagnostic — the forwarded MCP child stderr included — goes to
+ * `pi.logger` instead. When no logger is reachable (tests, non-Pi hosts) the
+ * line is dropped; we never touch the terminal as a fallback.
+ */
+export declare function makeBridgeDiag(pi: PiLikeAPI | null | undefined): BridgeDiag;
+/**
+ * Split a chunk of forwarded child output into lines without a regex (the repo
+ * forbids regex in source). Trailing `\r` is stripped so CRLF traces stay clean
+ * in the log; the final partial line (no trailing newline) is preserved.
+ */
+export declare function splitDiagLines(text: string): string[];
+/**
+ * #868: is this the FOREGROUND interactive Pi session (vs a subagent / print /
+ * RPC session)? Pi passes an ExtensionContext as the 2nd arg to
+ * `before_agent_start`; `ctx.hasUI === true` only for the interactive session
+ * with a real UI attached (refs oh-my-pi runner.ts:330-331), while subagents
+ * are provably `hasUI: false` (refs executor.ts:2052). Fail-safe: treat anything
+ * that is NOT an explicit `hasUI === false` as foreground, so an
+ * ambiguous/absent ctx keeps the session's bridge ALIVE rather than risking the
+ * #868 idle-drop. Mis-classifying an abandoned non-interactive child as
+ * foreground only costs one lingering child until parent-death/ session_shutdown
+ * reaps it; the opposite error re-drops the user's tools mid-session.
+ */
+export declare function isForegroundSession(ctx: unknown): boolean;
+/**
+ * #868: derive the bridge child's spawn env for a session kind. The FOREGROUND
+ * interactive session's child must never be idle-reaped — a multi-minute human
+ * pause should not drop its ctx_* tools — so we disable the #854 reaper for it
+ * via `CONTEXT_MODE_BRIDGE_IDLE_MS=0` (lifecycle.ts honors 0 → reaper not armed).
+ * Sub-context / non-interactive children keep the default reaper so abandoned
+ * children still can't accumulate (#854). The foreground child is still reaped
+ * on actual parent death by the ppid/​signal watchdog (#311/#388) — only the
+ * idle-time path is disabled. Pure; does not mutate the input env.
+ */
+export declare function foregroundBridgeEnv(baseEnv: NodeJS.ProcessEnv, foreground: boolean): NodeJS.ProcessEnv;
 /** Result of bootstrapping the bridge. */
 export interface BridgeHandle {
     /** Names of tools registered with Pi (for diagnostics / tests). */
@@ -186,6 +255,14 @@ export interface BootstrapOptions {
     env?: NodeJS.ProcessEnv;
     /** DI hook for tests: override the runtime resolver entirely. */
     _resolveJsRuntime?: () => string | null;
+    /**
+     * #868: true for the foreground interactive Pi session → spawn the child with
+     * the #854 idle reaper DISABLED so a human pause never drops its tools.
+     * Defaults to false (keep the reaper) for any non-foreground / unspecified
+     * caller; the pi extension resolves this from `ctx.hasUI` via
+     * {@link isForegroundSession}.
+     */
+    foreground?: boolean;
 }
 export declare function bootstrapMCPTools(pi: PiLikeAPI, serverScript: string, options?: BootstrapOptions): Promise<BridgeHandle>;
 export {};

package/build/adapters/pi/mcp-bridge.js

@@ -323,6 +323,7 @@ export class MCPStdioClient {
     serverScript;
     env;
     runtimeOverride;
+    diag;
     child = null;
     requestId = 0;
     pending = new Map();
@@ -344,10 +345,17 @@ export class MCPStdioClient {
      * without needing to attach a process-tree probe.
      */
     _spawnEnv = null;
-    constructor(serverScript, env = process.env, runtimeOverride = null) {
+    constructor(serverScript, env = process.env, runtimeOverride = null, 
+    /**
+     * TUI-safe sink for the child's forwarded stderr (#868). Defaults to a
+     * no-op so direct callers (skippedBridge, tests) never leak to the
+     * terminal; bootstrapMCPTools wires this to the Pi host's file logger.
+     */
+    diag = () => { }) {
         this.serverScript = serverScript;
         this.env = env;
         this.runtimeOverride = runtimeOverride;
+        this.diag = diag;
     }
     /** Spawn the MCP child. Idempotent. */
     start() {
@@ -434,21 +442,23 @@ export class MCPStdioClient {
         this.child = spawn(runtime, [this.serverScript], {
             // Pipe stderr (#472 round-3): swallowing it via "ignore" hides
             // server crash diagnostics — the user only saw "ctx_* tools will
-            // not be callable" with no clue WHY. Forwarding to process.stderr
-            // with a [mcp-bridge] prefix lets ops grep across session noise.
+            // not be callable" with no clue WHY. We capture it so the diagnostic
+            // is preserved, but route it through `diag` (Pi's file logger), NOT
+            // process.stderr — Pi's raw-mode TUI owns the terminal and any console
+            // write is rendered into the editor input box, blocking typing (#868).
             stdio: ["pipe", "pipe", "pipe"],
             env: childEnv,
         });
         this.child.stdout?.on("data", (chunk) => this.onData(chunk));
         this.child.stderr?.on("data", (chunk) => {
             const text = chunk.toString("utf-8");
-            // Preserve original line breaks; prefix every non-empty line so
-            // multi-line traces stay grep-friendly.
-            const prefixed = text
-                .split(/\r?\n/)
-                .map((line, i, arr) => i === arr.length - 1 && line === "" ? "" : `[mcp-bridge] ${line}`)
-                .join("\n");
-            process.stderr.write(prefixed);
+            // Forward each non-empty line, [mcp-bridge]-prefixed so it stays
+            // grep-friendly in ~/.omp/logs. debug level: this is mostly routine
+            // child chatter (e.g. the #854 idle-reaper notice), not an alert.
+            for (const line of splitDiagLines(text)) {
+                if (line !== "")
+                    this.diag(`[mcp-bridge] ${line}`, "debug");
+            }
         });
         this.child.on("exit", () => this.onExit());
         this.child.on("error", () => this.onExit());
@@ -690,6 +700,78 @@ export class MCPStdioClient {
         this.exited = true;
     }
 }
+/**
+ * Build a {@link BridgeDiag} bound to a Pi host's file logger (#868). Writing to
+ * process.stderr from inside Pi's raw-mode TUI corrupts the editor, so every
+ * bridge diagnostic — the forwarded MCP child stderr included — goes to
+ * `pi.logger` instead. When no logger is reachable (tests, non-Pi hosts) the
+ * line is dropped; we never touch the terminal as a fallback.
+ */
+export function makeBridgeDiag(pi) {
+    const logger = pi?.logger;
+    return (line, level = "warn") => {
+        try {
+            const fn = level === "debug" ? logger?.debug : logger?.warn;
+            if (typeof fn === "function")
+                fn(line);
+        }
+        catch {
+            /* never throw from diagnostics — and never write to the TUI terminal */
+        }
+    };
+}
+/**
+ * Split a chunk of forwarded child output into lines without a regex (the repo
+ * forbids regex in source). Trailing `\r` is stripped so CRLF traces stay clean
+ * in the log; the final partial line (no trailing newline) is preserved.
+ */
+export function splitDiagLines(text) {
+    const lines = [];
+    let start = 0;
+    for (let i = 0; i < text.length; i++) {
+        if (text[i] === "\n") {
+            let end = i;
+            if (end > start && text[end - 1] === "\r")
+                end--;
+            lines.push(text.slice(start, end));
+            start = i + 1;
+        }
+    }
+    if (start < text.length)
+        lines.push(text.slice(start));
+    return lines;
+}
+/**
+ * #868: is this the FOREGROUND interactive Pi session (vs a subagent / print /
+ * RPC session)? Pi passes an ExtensionContext as the 2nd arg to
+ * `before_agent_start`; `ctx.hasUI === true` only for the interactive session
+ * with a real UI attached (refs oh-my-pi runner.ts:330-331), while subagents
+ * are provably `hasUI: false` (refs executor.ts:2052). Fail-safe: treat anything
+ * that is NOT an explicit `hasUI === false` as foreground, so an
+ * ambiguous/absent ctx keeps the session's bridge ALIVE rather than risking the
+ * #868 idle-drop. Mis-classifying an abandoned non-interactive child as
+ * foreground only costs one lingering child until parent-death/ session_shutdown
+ * reaps it; the opposite error re-drops the user's tools mid-session.
+ */
+export function isForegroundSession(ctx) {
+    const hasUI = ctx?.hasUI;
+    return hasUI !== false;
+}
+/**
+ * #868: derive the bridge child's spawn env for a session kind. The FOREGROUND
+ * interactive session's child must never be idle-reaped — a multi-minute human
+ * pause should not drop its ctx_* tools — so we disable the #854 reaper for it
+ * via `CONTEXT_MODE_BRIDGE_IDLE_MS=0` (lifecycle.ts honors 0 → reaper not armed).
+ * Sub-context / non-interactive children keep the default reaper so abandoned
+ * children still can't accumulate (#854). The foreground child is still reaped
+ * on actual parent death by the ppid/​signal watchdog (#311/#388) — only the
+ * idle-time path is disabled. Pure; does not mutate the input env.
+ */
+export function foregroundBridgeEnv(baseEnv, foreground) {
+    if (!foreground)
+        return baseEnv;
+    return { ...baseEnv, CONTEXT_MODE_BRIDGE_IDLE_MS: "0" };
+}
 /**
  * Empty-but-valid handle returned when bootstrap is skipped (#516).
  * Keeps the shutdown contract intact so callers do not need null checks.
@@ -705,14 +787,16 @@ function skippedBridge() {
 }
 export async function bootstrapMCPTools(pi, serverScript, options = {}) {
     const env = options.env ?? process.env;
+    // #868: all bridge diagnostics go to Pi's file logger, never the TUI terminal.
+    const diag = makeBridgeDiag(pi);
     // Recursion guard (#516): if an ancestor bridge already incremented
     // the depth counter, refuse to spawn another child — even if the
     // binary-name check would let us through. Catches `node` shims that
     // re-exec Pi and other host swaps that bypass basename detection.
     const depth = Number.parseInt(env[BRIDGE_DEPTH_ENV] ?? "0", 10);
     if (Number.isFinite(depth) && depth > 0) {
-        process.stderr.write(`[context-mode] WARNING: skipping MCP bridge — ${BRIDGE_DEPTH_ENV}=${depth} ` +
-            `indicates recursion (fork-bomb guard, #516). ctx_* tools will not be callable.\n`);
+        diag(`[context-mode] WARNING: skipping MCP bridge — ${BRIDGE_DEPTH_ENV}=${depth} ` +
+            `indicates recursion (fork-bomb guard, #516). ctx_* tools will not be callable.`);
         return skippedBridge();
     }
     // Runtime guard (#516): when neither node nor bun is on PATH and the
@@ -720,11 +804,15 @@ export async function bootstrapMCPTools(pi, serverScript, options = {}) {
     // return an empty handle — the rest of the extension keeps working.
     const runtime = (options._resolveJsRuntime ?? resolveJsRuntimeForBridge)();
     if (runtime === null) {
-        process.stderr.write(`[context-mode] WARNING: no JS runtime found (need node or bun on PATH). ` +
-            `Skipping MCP bridge to avoid fork bomb (#516). ctx_* tools will not be callable.\n`);
+        diag(`[context-mode] WARNING: no JS runtime found (need node or bun on PATH). ` +
+            `Skipping MCP bridge to avoid fork bomb (#516). ctx_* tools will not be callable.`);
         return skippedBridge();
     }
-    const client = new MCPStdioClient(serverScript, env, runtime);
+    // #868: the foreground interactive session's child runs with the #854 idle
+    // reaper disabled (CONTEXT_MODE_BRIDGE_IDLE_MS=0) so a human pause never drops
+    // its tools; sub-context / non-interactive children keep the reaper (#854).
+    const spawnEnv = foregroundBridgeEnv(env, options.foreground ?? false);
+    const client = new MCPStdioClient(serverScript, spawnEnv, runtime, diag);
     // Retry-on-slow-initialize (#647).
     //
     // Each attempt is independently bounded by DEFAULT_REQUEST_TIMEOUT_MS
@@ -747,8 +835,8 @@ export async function bootstrapMCPTools(pi, serverScript, options = {}) {
             if (attempt === MAX_INIT_RETRIES)
                 break;
             const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`[context-mode] WARNING: MCP bridge initialize failed ` +
-                `(attempt ${attempt + 1}/${MAX_INIT_RETRIES + 1}): ${msg}. Retrying…\n`);
+            diag(`[context-mode] WARNING: MCP bridge initialize failed ` +
+                `(attempt ${attempt + 1}/${MAX_INIT_RETRIES + 1}): ${msg}. Retrying…`);
             // Reclaim the failed child's fds before respawning. shutdown() is
             // idempotent and bounded by a 5s SIGKILL fallback (#472 round-3),
             // so a child stuck in an uninterruptible syscall cannot block the

package/build/adapters/qwen-code/index.js

@@ -101,6 +101,19 @@ export class QwenCodeAdapter extends ClaudeCodeBaseAdapter {
                     ],
                 },
             ],
+            // Stop fires at end-of-turn. The qwen-specific stop hook records a
+            // turn_end marker AND captures per-turn token cost by tailing the session
+            // chats JSONL (~/.qwen/tmp/<hash>/chats/<sessionId>.jsonl) — usage is not
+            // reachable through hook stdin (usage.ts matrix §4). Points at the
+            // qwen-code/ hook dir (not the shared root) so it sets the qwen platform.
+            Stop: [
+                {
+                    matcher: "",
+                    hooks: [
+                        { type: "command", command: buildHookRuntimeCommand(`${pluginRoot}/hooks/qwen-code/stop.mjs`) },
+                    ],
+                },
+            ],
         };
     }
     // ── Settings read/write ────────────────────────────────
@@ -126,7 +139,7 @@ export class QwenCodeAdapter extends ClaudeCodeBaseAdapter {
         const results = [];
         const settings = this.readSettings();
         const hooks = (settings?.hooks ?? {});
-        for (const hookName of ["PreToolUse", "PostToolUse", "SessionStart", "PreCompact", "UserPromptSubmit"]) {
+        for (const hookName of ["PreToolUse", "PostToolUse", "SessionStart", "PreCompact", "UserPromptSubmit", "Stop"]) {
             const configured = Array.isArray(hooks[hookName]) && hooks[hookName].length > 0;
             results.push({
                 check: `${hookName} hook`,
@@ -275,6 +288,15 @@ export class QwenCodeAdapter extends ClaudeCodeBaseAdapter {
                 script: "userpromptsubmit.mjs",
                 matcher: "",
             },
+            {
+                // Stop captures per-turn token cost by tailing the session chats JSONL
+                // (usage is unreachable through hook stdin). Routes to the qwen-code/
+                // hook dir so it sets the qwen platform — keep in sync with
+                // generateHookConfig above.
+                name: "Stop",
+                script: "qwen-code/stop.mjs",
+                matcher: "",
+            },
         ];
         for (const { name, script, matcher } of hookTypes) {
             const entry = {