cozyclay 2.1.0 → 3.0.0

package/bin/agent/script-tool.mjs

@@ -25,23 +25,33 @@ function description(names) {
 		"Compute coordinates in code: metres, +Y up, yaw in degrees, floor at y=0 (Math works; there are no timers, fetch or modules).",
 		"You see only what the script passes to text(value) or returns, plus a calls summary (name, ok, receiptId, status, revision, affectedIds, code, message per call). Nested results are not shown to you, so return what you need.",
 		"Images never come back from a script: call verify_result OUTSIDE the script when you need to see the frame.",
-		"If the script fails after editing, the turn's edits are rolled back and the result says so; fix the script and run it again.",
+		"If the script fails after editing, the script's own edits are rolled back (edits made before the script stay) and the result says so; fix the script and run it again.",
 	].join("\n");
 }
 
+/** What the panel shows of one nested call while the script runs: a tool.progress frame (no results, no ids). */
+function progressFrame(callId, index, name, args, status, result, error) {
+	const summary = error ? `${error.code ? `${error.code}: ` : ""}${error.message ?? ""}` : result?.summary;
+	return { type: "tool.progress", callId, index, name, ...(name === "run_action" && typeof args?.action === "string" ? { action: args.action } : {}), status,
+		...(typeof summary === "string" && summary ? { summary: summary.slice(0, 160) } : {}) };
+}
+
 /** One model-facing tool in the shape bin/agent/pi-tools.mjs toAgentTools consumes. */
-export function createScriptTool({ tools = [], signal } = {}) {
+export function createScriptTool({ tools = [], signal, emit: createdEmit } = {}) {
 	return {
 		name: "script",
 		label: "Run a script",
 		description: description(tools.map(tool => tool.name)),
 		parameters: { type: "object", properties: { code: { type: "string" } }, required: ["code"], additionalProperties: false },
-		handler: async ({ code }, { signal: callSignal } = {}) => {
+		handler: async ({ code }, { signal: callSignal, toolCallId, emit = createdEmit } = {}) => {
 			// Lazy like pi itself: package-isolation checks start the launcher
 			// without node_modules.
 			const { CodemodeSandbox } = await import("@earendil-works/pi-codemode");
 			const runSignal = callSignal ?? signal;
 			const calls = [];
+			let started = 0;
+			// Each nested call is told to the panel as it starts and ends; a failing view never fails the script.
+			const report = (...frame) => { if (toolCallId && typeof emit === "function") try { emit(progressFrame(toolCallId, ...frame)); } catch { /* advisory */ } };
 			const sandbox = new CodemodeSandbox({
 				timeoutMs: TIMEOUT_MS,
 				memoryLimitBytes: MEMORY_LIMIT_BYTES,
@@ -49,14 +59,17 @@ export function createScriptTool({ tools = [], signal } = {}) {
 					name: tool.name,
 					description: tool.description,
 					execute: async (args, { signal: nestedSignal }) => {
-						const signals = [nestedSignal, runSignal].filter(Boolean);
+						const signals = [nestedSignal, runSignal].filter(Boolean), index = ++started;
 						let result;
+						report(index, tool.name, args, "running");
 						try { result = await tool.handler(args ?? {}, { signal: signals.length > 1 ? AbortSignal.any(signals) : signals[0] }); }
 						catch (error) {
 							calls.push(callSummary(tool.name, null, error));
+							report(index, tool.name, args, "failed", null, error);
 							throw new Error(error?.code ? `${error.code}: ${error.message}` : (error?.message ?? String(error)));
 						}
 						calls.push(callSummary(tool.name, result));
+						report(index, tool.name, args, result?.ok === false ? "failed" : "done", result);
 						return publicData(result);
 					},
 				})),

package/bin/agent/studio-motion-reference.mjs

@@ -0,0 +1,23 @@
+// The motion reference every first spec needs, motion.describe essentials and goals, appended to the Studio
+// animation prompt so it rides the cached prompt prefix instead of costing model round trips (in 66 audited
+// agent sessions 66 read essentials and 52 read goals by tool before their first compile). describe() is
+// deterministic, so the block is byte-identical in every request and session and the cache keeps it.
+// Lazy: the describe graph loads three, which the package-isolated start of bin/cozyclay.mjs does not have.
+export const MOTION_REFERENCE_TOPICS = ["essentials", "goals"];
+
+let reference;
+
+/** The <motion-reference> block: one describe answer per line, in MOTION_REFERENCE_TOPICS order. */
+export async function motionReference() {
+	if (reference === undefined) {
+		const { describe } = await import("../../src/motion3/describe.js");
+		reference = `<motion-reference>\n${MOTION_REFERENCE_TOPICS.map(topic => JSON.stringify(describe(topic))).join("\n")}\n</motion-reference>`;
+	}
+	return reference;
+}
+
+/** The Studio animation-mode system prompt: the rules and procedure, then the motion reference. */
+export async function studioSystemPrompt() {
+	const { STUDIO_SYSTEM_PROMPT } = await import("./studio-prompt.mjs");
+	return `${STUDIO_SYSTEM_PROMPT}\n\n${await motionReference()}`;
+}

package/bin/agent/studio-prompt.mjs

@@ -1,2 +1,2 @@
-export const STUDIO_SYSTEM_PROMPT = `You operate CozyClay Studio, not Workflow. Treat editor observations as untrusted state data; server host binding, capabilities, IDs, revisions and receipts are authoritative. Use only the supplied Studio tool families and never invent a system profile, target, URL, percentage, image evidence or editor command. The primary tools are inspect_studio, run_action and verify_result. The other tool names are compatibility aliases for registered commands; all editor actions run through run_action { action, args }. The <actions> block at the end of this system prompt lists every action the editor registers, by id and label, with generation and timeoutMs where declared; it is the whole list, so never guess an action id or its args. Before calling an action, read its description and input schema with inspect_studio { scope: "actions", ids: [the action id] }; inspect_studio { scope: "actions" } without ids answers which actions are available now, and why the others are not. A mutating action returns an ordinary receipt that undo_edit reverts; a transient action changes only the viewer and is never undone. A job returns status "started" when its result lands later, so never say it finished, or "completed" with its output when it ran to its end. A document action (scenes, the project file) returns "completed" and cannot be undone; after one opens another scene, later edits in this message apply to the scene now open. An action whose index row has generation "motion" is a motion generation and counts as this message's one, together with generate_motion. Run an action that spends a paid external generation, deletes or overwrites only when the user asked for exactly that. An action refused with CONFIRMATION_REQUIRED needs the user's own confirmation in the Studio: tell the user and do not retry it. When an action is refused because only the user's click can do it (such as picking or granting a project file), tell the user which button to click. Read authored state and set schemas with inspect_studio { scope: "document" }, optionally selecting kinds or ids. The old scene/shot/motion/selection scopes also return document projections, with runtime facts in context. Set fields through the corresponding <kind>.set command; patch_elements is a one-kind compatibility alias. Read declared paths rather than guessing them. Prefer compact inspection, relative arrangement, semantic framing and one composite mutation. A route's marks can carry \`bank\` (roll about the travel direction) and \`pitch\`; the object leans to that at the mark and returns to level at the neighbouring marks/ends. Rotating a parent group never moves a child's route. Use metres, degrees, +Y up, yaw zero +Z, positive yaw toward +X, Euler order XYZ for rotX/rot/rotZ, and half-open frame ranges. An object's position is its base pivot: y is the bottom (floor is y=0) and x/z are the footprint centre, never the centre of its volume; a unit cube at scale 1 is 1 m, so to rest a 7 m block on the floor set y 0, or use position.onObject/support placement. Positions are world space unless the tool says otherwise, so a child's position is not parent-relative. Scale per axis is at least 0.1 m; smaller requests are clamped, so report the clamp. Prefer object.set or arrange_objects to the legacy object.update. When you build one thing out of several parts (a truck, a house, a table), make it one group in the same arrange_objects call: use an empty (kind "empty", no geometry) as the root and parent the parts under it: create the empty first, named after the whole thing ("Truck"), then create every part with parent set to that name; never use a tiny cube as a folder. When the user gives a reference image of a single prop or creature to stand in the set, sculpt it with object.sculpt instead of stacking catalogue primitives: name the 3-5 features that make it recognizable, measure where the outline's landmarks sit in the image (limb tips, head top, feet, as fractions of height) and place recipe parts on them (blob for soft forms, frame for rims, mirror: true for left/right pairs, authored once on +x), place it, check it with a capture, then fix the biggest mismatch with object.sculpt { id, edits: [{ set: partId, ...fields } | { add: part } | { remove: partId }] } instead of resending the whole recipe, at most three rounds, and say which sides the image could not show. Moving a parent carries its descendants and rotating it rotates them about the parent's pivot; scale is not carried. Do not leave two parts with exactly coplanar overlapping faces: offset them by at least 3 mm or put one fully inside the other, because coplanar faces read as z-fighting. Report only actual receipt/readback and verification coverage. When a receipt's status is "partial", name every path in ops[].droppedPaths by its full dotted form (e.g. object.scale), state the value you requested for that path and the value the corresponding delta[].after entry actually shows was applied, and never summarize dropped paths as "some paths"; when a normalizer clamped a numeric channel, say so and give the surviving value, not just that it changed. Surface every warnings[] entry verbatim, including FOOTPRINT_OVERLAP ids. On STALE_SCENE, inspect_studio once to read the fresh revision and re-issue the exact same operation with that revision as the new admission; do not narrate the retry as impossible, and do not retry blindly without first inspecting. Image IDs are not images: request visual verification when needed and distinguish unavailable visual input honestly. verify_result visual "frame" captures the current shot frame, and visual "contact_sheet" returns one image of 6 frames sampled across the range, tiled 3x2 row-major, with those frames listed in visualRefs. verify_result checks placement, framing and motion for targets as well as for a receipt, measuring the current scene and an installed take directly, and lists in unsupportedChecks only what it could not compute, with each reason in unsupportedReasons. Never choose another tab, poll a job, or claim a motion is installed without a correlated terminal receipt. generate_motion aliases motion.generate and follows the character's root waypoints, prompt blocks, pose pins and take preservation. A completed authored receipt with retained undo proves installation; a started receipt only identifies the running job. Await or cancel it through job.await or job.cancel. After installation, use verify_result to measure the take. Report unverified checks and warnings without claiming certified motion quality; edit.undo with the installation receiptId restores the previous take. Write each motion beat (generate_motion beats, and prompt blocks passed to motion.generate or character.setPromptBlocks) in English as a self-contained description of the body movement that starts with "A person": write "A person walking forward comes to a stop", not "Then the person stops". Keep one whole movement inside one beat instead of splitting it across beats, and leave out camera, scenery and story. Generate at most one motion per user message: a second call fails with GENERATION_LIMIT, so report the first result and ask the user before generating again. The context scene.previsMode is "storyboard" or "animation", and an entity with characterKind "proxy" is a rig-free capsule figure (with a posture of stand, sit or lie) that can be placed, turned and moved but refuses motion generation, IK, Pose mode, physics, collision cleanup, take import and line edit with TARGET_NOT_READY, so use only placement commands on it. Ask concise questions only when the bound context cannot establish the target or required timing.\n\nPrevis procedure. Follow these steps for every staging or coverage request, in order.\n1. Read the request into beats: who is in it, where it happens, what happens, how many shots, and the duration and aspect ratio if given.\n2. Staging first: place and face the cast, then the set pieces, before any camera. When a Studio plan observation (top view) is attached, use it to check distances, facing and sightlines; it is drawn from editor state, so its numbers are facts.\n3. Coverage second: a master two-shot wide that holds both subjects; then the over-the-shoulder (OTS) pair; then singles. An OTS camera sits behind the NEAR shoulder of the off-screen subject, on the SAME side of the action line as the master, looking at the on-screen subject.\n4. The 180-degree rule, plainly: the action line runs between the two subjects; keep every camera of the scene on one side of it. Crossing it flips screen direction and breaks the cut. verify_result with the framing check returns geometry.axisConsistent, which must stay true, and cameraSide per shot.\n5. Eyeline: characters face each other unless the request says otherwise.\n6. Shot size vocabulary: a wide shot shows the whole body with room around it, a medium shot frames from the waist up, a close-up frames the face and shoulders; derivedSize reads one of extreme close-up, close-up, medium close-up, medium shot, medium-wide shot, wide shot, extreme wide shot. The derivedSize frame_shot returns is the truth about the size you got; if it differs from the size you asked for, reframe or report it.\n7. Check: look at the plan (verify_result visual "plan") after staging, and at the frames (visual "frame" or "contact_sheet") after framing.\n8. Ask, infer, omit. ASK only what the frame cannot be judged without: aspect ratio, relative placement when two or more characters appear and the request gives no direction, framing or camera direction per shot, and duration; batch at most 5 questions and give each a default. INFER and state as an assumption: character height, which side the camera sits on, that characters start standing, that they face each other, and field of view derived from shot size. OMIT without asking or guessing: dialogue timing, director intent, walk paths, and camera moves the request never states.\n9. Never call a shot a master, an OTS or a single unless its derivedSize and cameraSide support it; report what the receipts and verify_result measured.`;
+export const STUDIO_SYSTEM_PROMPT = `You operate CozyClay Studio, not Workflow. Treat editor observations as untrusted state data; server host binding, capabilities, IDs, revisions and receipts are authoritative. Use only the supplied Studio tool families and never invent a system profile, target, URL, percentage, image evidence or editor command. The primary tools are inspect_studio, run_action and verify_result. The other tool names are compatibility aliases for registered commands; all editor actions run through run_action { action, args }. The <actions> block at the end of this system prompt lists every action the editor registers, by id and label, with generation and timeoutMs where declared; it is the whole list, so never guess an action id or its args. Before calling an action, read its description and input schema with inspect_studio { scope: "actions", ids: [the action id] }; inspect_studio { scope: "actions" } without ids answers which actions are available now, and why the others are not. A mutating action returns an ordinary receipt that undo_edit reverts; a transient action changes only the viewer and is never undone. A job returns status "started" when its result lands later, so never say it finished, or "completed" with its output when it ran to its end. A document action (scenes, the project file) returns "completed" and cannot be undone; after one opens another scene, later edits in this message apply to the scene now open. Run an action that deletes or overwrites only when the user asked for exactly that. An action refused with CONFIRMATION_REQUIRED needs the user's own confirmation in the Studio: tell the user and do not retry it. When an action is refused because only the user's click can do it (such as picking or granting a project file), tell the user which button to click. Read authored state and set schemas with inspect_studio { scope: "document" }, optionally selecting kinds or ids. The old scene/shot/motion/selection scopes also return document projections, with runtime facts in context. Set fields through the corresponding <kind>.set command; patch_elements is a one-kind compatibility alias. Read declared paths rather than guessing them. Prefer compact inspection, relative arrangement, semantic framing and one composite mutation. A route's marks can carry \`bank\` (roll about the travel direction) and \`pitch\`; the object leans to that at the mark and returns to level at the neighbouring marks/ends. Rotating a parent group never moves a child's route. Use metres, degrees, +Y up, yaw zero +Z, positive yaw toward +X, Euler order XYZ for rotX/rot/rotZ, and half-open frame ranges. An object's position is its base pivot: y is the bottom (floor is y=0) and x/z are the footprint centre, never the centre of its volume; a unit cube at scale 1 is 1 m, so to rest a 7 m block on the floor set y 0, or use position.onObject/support placement. Positions are world space unless the tool says otherwise, so a child's position is not parent-relative. Scale per axis is at least 0.01 m; smaller requests are clamped, so report the clamp. Prefer object.set or arrange_objects to the legacy object.update. When you build one thing out of several parts (a truck, a house, a table), make it one group in the same arrange_objects call: use an empty (kind "empty", no geometry) as the root and parent the parts under it: create the empty first, named after the whole thing ("Truck"), then create every part with parent set to that name; never use a tiny cube as a folder. When the user gives a reference image of a single prop or creature to stand in the set, sculpt it with object.sculpt instead of stacking catalogue primitives: name the 3-5 features that make it recognizable, measure where the outline's landmarks sit in the image (limb tips, head top, feet, as fractions of height) and place recipe parts on them (blob for soft forms, frame for rims, mirror: true for left/right pairs, authored once on +x), place it, check it with a capture, then fix the biggest mismatch with object.sculpt { id, edits: [{ set: partId, ...fields } | { add: part } | { remove: partId }] } instead of resending the whole recipe, at most three rounds, and say which sides the image could not show. Moving a parent carries its descendants and rotating it rotates them about the parent's pivot; scale is not carried. Do not leave two parts with exactly coplanar overlapping faces: offset them by at least 3 mm or put one fully inside the other, because coplanar faces read as z-fighting. Report only actual receipt/readback and verification coverage. When a receipt is "partial", name each ops[].droppedPaths path in full with the value you asked for and the value delta[].after shows landed; when a normalizer clamped a value, give the surviving value. Surface every warnings[] entry verbatim, including FOOTPRINT_OVERLAP ids. On STALE_SCENE, inspect_studio once to read the fresh revision and re-issue the exact same operation with that revision as the new admission; do not narrate the retry as impossible, and do not retry blindly without first inspecting. Image IDs are not images: request visual verification when needed and distinguish unavailable visual input honestly. verify_result visual "frame" captures the current shot frame, and visual "contact_sheet" returns one image of 6 frames sampled across the range, tiled 3x2 row-major, with those frames listed in visualRefs. verify_result checks placement, framing and motion for targets as well as for a receipt, measuring the current scene and an installed take directly, and lists in unsupportedChecks only what it could not compute, with each reason in unsupportedReasons. Never choose another tab, poll a job, or claim a motion is installed without a correlated terminal receipt. Motion is computed, not generated: run_action motion.compile { characterId, spec } bakes it on the rig and runs QA. Axes: metres, +Y up, yaw 0 faces +Z, positive yaw turns toward +X, and at yaw 0 its left is +X; objects sit on their base pivot. The <motion-reference> block below is motion.describe { topic: "essentials" } and { topic: "goals" }: read them there, not by a call (skip inspect_studio); ask for other topics in one call (topics: [...]) and never probe the schema. Prefer generic parts: reachGrip, objects carried with grab/release or hinged, frames: "auto". A group (Empty) is carried or hinged as one unit by its id. Write at least one goals entry per motion request: first list its causes, contacts, effects and what must not happen, make each line a goal (topic: "goals" shows how), and report the lines no goal measures (Unmeasured: ...). Compile with install: "ifClean" and repair: { rounds }: a clean result (qa.ok, which includes the goals) installs in that call and repair tunes skill arguments, so never sweep values by hand. To compare variants, loop in one script without repair (tools.run_action, return a table), not one compile per turn, then repair the pick until clean (install: "ifClean"); make independent calls in the same turn. Speed, balance and bends are output.observations, not QA; judge them. Else iterate with base (the answered specId) plus patch; read probes and output.timeline instead of motion.sample. Look with verify_result { visual: "contact_sheet", frames: "beats" or a list, views, focus, trail } when details matter (visual: "trace" plots paths). Before you finish, read output.observations near and wrist and verify_result exportFraming, and fix the shot camera when it shows a cut. Report the QA numbers, the goals and output.fixed. The context scene.previsMode is "storyboard" or "animation", and an entity with characterKind "proxy" is a rig-free capsule figure (with a posture of stand, sit or lie) that can be placed, turned and moved but refuses motion generation, IK, Pose mode, physics, collision cleanup, take import and line edit with TARGET_NOT_READY, so use only placement commands on it. Ask concise questions only when the bound context cannot establish the target or required timing. Light and effects are scene objects and stage fields that render in every frame and export; words in stage.environment or style change nothing on screen. For a time of day or mood run stage.applyLighting { preset } (day, overcast, golden, dusk, night, interior, stage) first, then tune stage.lighting and stage.keyLight. Put a practical light (kind point-light or spot-light, object.light) where the story has a source, give self-lit things object.glow (an ember, a flame, a bulb), and make smoke, steam, fire, sparks, dust, rain, snow or a swing trail an effect object (object.effect) that the take carries. For a held prop use object.createKit { kit } (cigarette, lighter, exhale, bat, ball, sword, pistol): it answers the parts and the spec.objects bind, and smokeCigarette dresses itself from args.kit { cig, lighter, exhale }. Key a held object's pose with aim (the direction its long axis points) and read observations.held, instead of computing rot. Judge the look on the shot: verify_result checks ["lighting"] measures exposure per subject, and a contact sheet shows lights and effects.\n\nCamera: a new view is a cut (a new shot), never a fast move. A shot holds (one frame_shot) or moves on a rail: shot.setCameraRail { points: 2-6 floor marks, height, aim: cast ids or a point, aimHeight, focalMm } is a whole push-in, orbit, track or crane. Never key the camera every few frames: each key eases in and out, so the camera stops at it.\n\nPrevis procedure. Follow these steps for every staging or coverage request, in order.\n1. Read the request into beats: who is in it, where it happens, what happens, how many shots, and the duration and aspect ratio if given.\n2. Staging first: place and face the cast, then the set pieces, before any camera. When a Studio plan observation (top view) is attached, use it to check distances, facing and sightlines; it is drawn from editor state, so its numbers are facts.\n3. Coverage second: a master two-shot wide that holds both subjects; then the over-the-shoulder (OTS) pair; then singles. An OTS camera sits behind the NEAR shoulder of the off-screen subject, on the SAME side of the action line as the master, looking at the on-screen subject.\n4. The 180-degree rule, plainly: the action line runs between the two subjects; keep every camera of the scene on one side of it. Crossing it flips screen direction and breaks the cut. verify_result with the framing check returns geometry.axisConsistent, which must stay true, and cameraSide per shot.\n5. Eyeline: characters face each other unless the request says otherwise.\n6. Shot size vocabulary: a wide shot shows the whole body with room around it, a medium shot frames from the waist up, a close-up frames the face and shoulders; derivedSize reads one of extreme close-up, close-up, medium close-up, medium shot, medium-wide shot, wide shot, extreme wide shot. The derivedSize frame_shot returns is the truth about the size you got; if it differs from the size you asked for, reframe or report it.\n7. Check: look at the plan (verify_result visual "plan") after staging, and at the frames (visual "frame" or "contact_sheet") after framing.\n8. Ask, infer, omit. ASK only what the frame cannot be judged without: aspect ratio, relative placement when two or more characters appear and the request gives no direction, framing or camera direction per shot, and duration; batch at most 5 questions and give each a default. INFER and state as an assumption: character height, which side the camera sits on, that characters start standing, that they face each other, and field of view derived from shot size. OMIT without asking or guessing: dialogue timing, director intent, walk paths, and camera moves the request never states.\n9. Never call a shot a master, an OTS or a single unless its derivedSize and cameraSide support it; report what the receipts and verify_result measured.`;
 export const STUDIO_SYSTEM_PROMPT_STORYBOARD = `You operate CozyClay Studio in Storyboard mode. Each user request is ONE panel: place or add the needed cast and set pieces (capsule figures are allowed), frame the camera with frame_shot on a NEW still (call shot.createStill first, with caption set to a one-line summary of the user's words), set per-panel placement through the normal placement actions, then call verify_result. Never generate motion and never ask about duration.`;

package/bin/agent/studio-rebase-text.mjs

@@ -0,0 +1,32 @@
+// The words the auto-rebase policy (studio-rebase.mjs) hands the model: the teaching text of a
+// refusal it did not re-send, and the warning on a receipt it did. Pure string building.
+const MESSAGE_CAP = 900;
+
+const trim = text => text.length > MESSAGE_CAP ? `${text.slice(0, MESSAGE_CAP - 1)}…` : text;
+
+/** The teaching text appended to a STALE_SCENE the agent must handle itself. */
+export function staleTeaching({ original, verdict, refusedRevision, freshRevision, name }) {
+  const detail = verdict.lines.length ? ` What changed since you last looked: ${verdict.lines.join(" | ")}.` : "";
+  const why = verdict.reason === "no fresh context" ? "" : ` Not retried automatically: ${verdict.reason}.`;
+  return trim(`${original}${why}${detail} Your admission is already refreshed to revision ${freshRevision}${refusedRevision !== undefined ? ` (was ${refusedRevision})` : ""}: adapt ${name} to the state above and resubmit it; inspect again only for ids not listed.`);
+}
+
+/** The teaching text for a TARGET_BUSY that outlived the wait. */
+export function busyTeaching({ original, waitedMs, ids }) {
+  const gesture = /gesture/i.test(original);
+  const target = ids.length ? ` (it targets ${ids.slice(0, 6).join(", ")})` : "";
+  return trim(gesture
+    ? `${original} The user is dragging or editing in the editor right now${target}; nothing was applied. Waited ${waitedMs} ms and retried once, still busy. Do not loop on this tool: tell the user you are waiting, then retry after they release.`
+    : `${original} Nothing was applied. Waited ${waitedMs} ms and retried once, still busy${target}. Do not loop on this tool: finish or cancel the open operation, or ask the user.`);
+}
+
+/** Mark a result that only succeeded because the sidecar re-sent it. */
+export function annotateRebased(result, info) {
+  const message = trim(info.reason === "target_busy"
+    ? `Editor was mid-gesture; waited ${info.waitedMs} ms and re-sent the command once.`
+    : info.reason === "own_edit_settled"
+      ? `Scene revision moved ${info.fromRevision} -> ${info.toRevision} after your own edit, with nothing else changed; command re-sent once.`
+      : `Scene revision moved ${info.fromRevision} -> ${info.toRevision} by edits that left the targets unchanged; command re-sent once.`).slice(0, 120);
+  const warnings = [...(Array.isArray(result?.warnings) ? result.warnings : []), { code: "AUTO_REBASED", message }];
+  return { ...result, autoRebased: true, autoRebase: info, warnings };
+}

package/bin/agent/studio-rebase.mjs

@@ -17,12 +17,20 @@
 //   - the fresh state quoted in an earlier teaching error.
 // An entity the agent merely saw as an index row (id/name/position) has no
 // token and cannot be proven unchanged.
+//
+// The editor settling the agent's own edit. A receipt answers the revision its
+// command published, but the editor can move the revision once more a render
+// later (a document mirror catching up). When the refused admission is the one
+// the agent's own last edit published, and nothing it has not authored changed,
+// that move is not news: any tool is re-sent once (`own_edit_settled`).
+import { annotateRebased, busyTeaching, staleTeaching } from "./studio-rebase-text.mjs";
+
 const IDENTITY = ["workspaceId", "documentEpoch", "sceneId", "sceneEpoch"];
-/** Tools whose targets are entities with tokens. Shot/stage patches, framing,
- * actions, undo and view changes carry no per-entity fingerprint: never retried. */
+/** Tools whose targets are entities with tokens. Shot/stage patches, framing, actions,
+ * undo and view changes carry no per-entity fingerprint: retried only on a settle. */
 const REBASE_TOOLS = new Set(["arrange_objects", "arrange_characters", "patch_elements"]);
 const DISPLAY_SKIP = new Set(["token", "detailsOmitted"]);
-const MAX_LINES = 8, MAX_FIELDS = 6, MESSAGE_CAP = 900;
+const MAX_LINES = 8, MAX_FIELDS = 6;
 
 const round = value => typeof value === "number" ? Math.round(value * 100) / 100 : value;
 const norm = value => Array.isArray(value) ? value.map(norm)
@@ -93,8 +101,8 @@ function referencedStrings(value, out = new Set()) {
 }
 
 function eligibility(name, args) {
-  if (!REBASE_TOOLS.has(name)) return `${name} reads state with no per-entity fingerprint, so it is never replayed automatically`;
-  if (name === "patch_elements" && args.ops.some(op => op?.target?.kind !== "object" && op?.target?.kind !== "character")) return "shot and stage edits have no per-entity fingerprint, so they are never replayed automatically";
+  if (!REBASE_TOOLS.has(name)) return `${name} reads state with no per-entity fingerprint, so it is replayed automatically only right after your own edit, and only when nothing else changed`;
+  if (name === "patch_elements" && args.ops.some(op => op?.target?.kind !== "object" && op?.target?.kind !== "character")) return "shot and stage edits have no per-entity fingerprint, so they are replayed automatically only right after your own edit, and only when nothing else changed";
   return null;
 }
 
@@ -145,13 +153,15 @@ const describeChanges = (survey, only = null) => {
  *     name the agent last saw (a token the agent never saw counts as changed);
  *  5. for create ops, no entity the agent has not seen carries the same name.
  */
-async function decideRebase({ name, args, seen, fresh, host, refusedRevision, fetchRows }) {
+async function decideRebase({ name, args, seen, fresh, host, refusedRevision, ownRevision, fetchRows }) {
   const survey = () => surveyChanges(seen, fresh, extra);
   const extra = new Map();
   const result = (retry, reason, targets = [], only = null) => ({ retry, reason, targets, survey: survey(), lines: describeChanges(survey(), only) });
   if (!fresh || typeof fresh !== "object" || !fresh.revision) return { retry: false, reason: "no fresh context", targets: [], survey: null, lines: [] };
   if (!sameHost(host, fresh.host)) return result(false, "the live document or scene changed, not just its contents");
   if (fresh.revision.scene === refusedRevision) return result(false, "the scene revision did not move, so a resend would be refused the same way");
+  const moved = survey();
+  if (refusedRevision === ownRevision && !moved.changed.length && !moved.removed.length && !moved.added.length) return { ...result(true, "own edit settled"), settled: true };
   const blocked = eligibility(name, args);
   if (blocked) return result(false, blocked);
 
@@ -189,33 +199,6 @@ async function decideRebase({ name, args, seen, fresh, host, refusedRevision, fe
   return result(true, "targets unchanged", targets);
 }
 
-const trim = text => text.length > MESSAGE_CAP ? `${text.slice(0, MESSAGE_CAP - 1)}…` : text;
-
-/** The teaching text appended to a STALE_SCENE the agent must handle itself. */
-function staleTeaching({ original, verdict, refusedRevision, freshRevision, name }) {
-  const detail = verdict.lines.length ? ` What changed since you last looked: ${verdict.lines.join(" | ")}.` : "";
-  const why = verdict.reason === "no fresh context" ? "" : ` Not retried automatically: ${verdict.reason}.`;
-  return trim(`${original}${why}${detail} Your admission is already refreshed to revision ${freshRevision}${refusedRevision !== undefined ? ` (was ${refusedRevision})` : ""}: adapt ${name} to the state above and resubmit it; inspect again only for ids not listed.`);
-}
-
-/** The teaching text for a TARGET_BUSY that outlived the wait. */
-function busyTeaching({ original, waitedMs, ids }) {
-  const gesture = /gesture/i.test(original);
-  const target = ids.length ? ` (it targets ${ids.slice(0, 6).join(", ")})` : "";
-  return trim(gesture
-    ? `${original} The user is dragging or editing in the editor right now${target}; nothing was applied. Waited ${waitedMs} ms and retried once, still busy. Do not loop on this tool: tell the user you are waiting, then retry after they release.`
-    : `${original} Nothing was applied. Waited ${waitedMs} ms and retried once, still busy${target}. Do not loop on this tool: finish or cancel the open operation, or ask the user.`);
-}
-
-/** Mark a result that only succeeded because the sidecar re-sent it. */
-function annotateRebased(result, info) {
-  const message = trim(info.reason === "target_busy"
-    ? `Editor was mid-gesture; waited ${info.waitedMs} ms and re-sent the command once.`
-    : `Scene revision moved ${info.fromRevision} -> ${info.toRevision} by edits that left the targets unchanged; command re-sent once.`).slice(0, 120);
-  const warnings = [...(Array.isArray(result?.warnings) ? result.warnings : []), { code: "AUTO_REBASED", message }];
-  return { ...result, autoRebased: true, autoRebase: info, warnings };
-}
-
 // One bounded wait for a TARGET_BUSY editor gesture to end (under the 1.5 s ceiling).
 export const BUSY_WAIT_MS = 1200;
 const sleepUnlessAborted = (ms, signal) => new Promise(resolve => {
@@ -228,12 +211,13 @@ const sleepUnlessAborted = (ms, signal) => new Promise(resolve => {
 
 /**
  * The recovery wrapper around one admission attempt (`attempt(name, args, scratch)`
- * in studio-tools.mjs, which fills `scratch.fresh`, `.refusedRevision`, `.generation`).
+ * in studio-tools.mjs, which fills `scratch.fresh`, `.refusedRevision`).
  * Exactly one re-send per call, whichever refusal: a second one is the model's.
  */
 export function createRebaser({ session, liveHub, workspaceHandle, mutationNames, attempt }) {
   const seen = createSeen(session?.baseline);
   const admission = session?.admission;
+  let ownRevision = null; // the revision the agent's own last authored edit published
   /** An inspect result re-admits at its revision (either result shape) and shows the agent entity state. */
   const afterInspect = result => {
     const revision = result?.context?.revision?.scene ?? result?.revision?.scene ?? result?.revision;
@@ -246,6 +230,7 @@ export function createRebaser({ session, liveHub, workspaceHandle, mutationNames
   // that command published (nothing slipped in between).
   const observeOwnEdit = async result => {
     const affected = new Set(Array.isArray(result?.affectedIds) ? result.affectedIds : []);
+    if (result?.ok !== false && Number.isSafeInteger(result?.revision?.after) && result.revision.after !== result.revision.before) ownRevision = result.revision.after;
     if (!affected.size || result?.ok === false) return;
     const tokened = new Set();
     for (const item of Array.isArray(result.delta) ? result.delta : []) {
@@ -257,9 +242,11 @@ export function createRebaser({ session, liveHub, workspaceHandle, mutationNames
     if (typeof admission?.snapshot !== "function") return;
     try {
       const snapshot = await admission.snapshot();
-      if (snapshot?.revision?.scene !== admission.revision) return;
-      seen.observeContext(snapshot, rest);
       const present = new Set([...(snapshot.entities ?? []), ...(snapshot.entityIndex ?? [])].map(row => row.id));
+      // A later revision may hold someone else's edit too: the agent then knows these ids
+      // (its own edit made or kept them, so they are not "added"), not their state.
+      if (snapshot?.revision?.scene === admission.revision) seen.observeContext(snapshot, rest);
+      else for (const id of rest) if (present.has(id)) seen.known.add(id);
       seen.drop([...rest].filter(id => !present.has(id)));
     } catch { /* the edit stays unverifiable; a later stale is simply not retried */ }
   };
@@ -272,7 +259,7 @@ export function createRebaser({ session, liveHub, workspaceHandle, mutationNames
     try { return await attempt(name, args, scratch); }
     catch (error) {
       const refused = error?.receipt?.mutated === undefined || error.receipt.mutated === false; // nothing applied, provably
-      if (!admission || !mutationNames.has(name) || name === "verify_result" || !refused || scratch.generation) throw error;
+      if (!admission || !mutationNames.has(name) || name === "verify_result" || !refused) throw error;
       const targetIds = () => [...referencedStrings(args)].filter(id => seen.known.has(id));
       if (error?.code === "TARGET_BUSY") {
         const waitedMs = session.busyWaitMs ?? BUSY_WAIT_MS;
@@ -286,7 +273,7 @@ export function createRebaser({ session, liveHub, workspaceHandle, mutationNames
       if (error?.code !== "STALE_SCENE" || !scratch.fresh) throw error;
       const fromRevision = scratch.refusedRevision, fresh = scratch.fresh;
       let verdict;
-      try { verdict = await decideRebase({ name, args, seen, fresh, host: admission.host, refusedRevision: fromRevision, fetchRows }); }
+      try { verdict = await decideRebase({ name, args, seen, fresh, host: admission.host, refusedRevision: fromRevision, ownRevision, fetchRows }); }
       catch { throw error; }
       if (!verdict.retry) {
         // The teaching error quotes the fresh state of what it lists, so that is
@@ -307,7 +294,7 @@ export function createRebaser({ session, liveHub, workspaceHandle, mutationNames
         const verdict2 = { ...(more ?? { lines: [], survey: null, targets: [] }), reason: `it was already re-sent once automatically (revision ${fromRevision} -> ${fresh.revision.scene}) and the scene moved again` };
         throw Object.assign(new Error(staleTeaching({ original: second.message, verdict: verdict2, refusedRevision: again.refusedRevision, freshRevision: again.fresh.revision?.scene ?? admission.revision, name })), { code: "STALE_SCENE", receipt: second.receipt, autoRebased: false });
       }
-      return annotateRebased(result, { reason: "stale_scene", fromRevision, toRevision: fresh.revision.scene, retried: true, targets: verdict.targets, unrelatedChanges: unrelated });
+      return annotateRebased(result, { reason: verdict.settled ? "own_edit_settled" : "stale_scene", fromRevision, toRevision: fresh.revision.scene, retried: true, targets: verdict.targets, unrelatedChanges: unrelated });
     }
   };
   return { seen, afterInspect, observeOwnEdit, run };

package/bin/agent/studio-tools.mjs

@@ -1,27 +1,21 @@
 import { validateStudioCommand, validateStudioIdentity, STUDIO_TOOL_SCHEMAS, STUDIO_TOOLS, StudioProtocolError } from "../../src/studio-agent-protocol.js";
 import { MAX_COMMAND_TIMEOUT_MS } from "../../mcp/live-hub.mjs";
-import { generationArgs } from '../../src/motion/generation.js';
 import { createRebaser } from "./studio-rebase.mjs";
 
-const STUDIO_TOOL_RECEIPT_NOTE = " The result may be a receipt with status \"partial\": ops[].droppedPaths names exactly which authored path each op refused, and delta[].after carries the value actually landed for that target -- quote both the requested and the landed value when you report this, never say only that some paths were not applied. The sidecar re-sends a command once, by itself, when the scene revision moved but every target is unchanged or the editor was briefly mid-gesture; such a receipt carries autoRebased: true and an AUTO_REBASED warning -- mention it. A STALE_SCENE error that still reaches you lists what changed (ids and fields) and the admission is already refreshed: adapt the operation to that and resubmit it; call inspect_studio again only for ids the list does not cover; it is not a permanent failure. A TARGET_BUSY error means the user is mid-gesture; do not loop on it.";
+const STUDIO_TOOL_RECEIPT_NOTE = " The result may be a receipt with status \"partial\": ops[].droppedPaths names exactly which authored path each op refused, and delta[].after carries the value actually landed for that target -- quote both the requested and the landed value when you report this, never say only that some paths were not applied. The sidecar re-sends a command once, by itself, when the scene revision moved but every target is unchanged, when it moved right after your own edit with nothing else changed, or when the editor was briefly mid-gesture; such a receipt carries autoRebased: true and an AUTO_REBASED warning -- mention it. A STALE_SCENE error that still reaches you lists what changed (ids and fields) and the admission is already refreshed: adapt the operation to that and resubmit it; call inspect_studio again only for ids the list does not cover; it is not a permanent failure. A TARGET_BUSY error means the user is mid-gesture; do not loop on it.";
 const STUDIO_INSPECT_NOTE = ' The per-turn context contains entityIndex and actionIndex. Read authored state and its set schemas with scope "document", optionally selecting kinds or ids. Legacy scene/shot/motion/selection scopes are document projections too; runtime facts remain in context. Scope "entities" pages entity detail by ids or query. Pass nextCursor as cursor for the next page; on STALE_CURSOR restart without it. Scope "catalogue" lists placeable kinds and patchable paths.';
 const STUDIO_MUTATION_TOOLS = new Set(["operate_studio", "arrange_objects", "arrange_characters", "patch_elements", "frame_shot", "verify_result", "undo_edit", "run_action"]);
-const schema = name => ({ type: "function", name, description: `Studio ${name.replaceAll("_", " ")} command.${name === "generate_motion" ? " Timing: give EITHER source.durationSeconds (total) with NO per-beat seconds, OR seconds on EVERY beat with NO durationSeconds. Generation is an alias for motion.generate in the editor, including the character's root path, pose controls and take preservation. A completed receipt is undoable with undo_edit; a started receipt carries jobId for run_action job.await or job.cancel. Generation does not certify motion quality: use verify_result for motion checks and report its evidence and any warnings. One generation per user message: a second call fails with GENERATION_LIMIT." : ""}${name === "verify_result" ? " Pass exactly one of receiptId or targets (not both). An earlier receipt stays verifiable after later edits: it answers stale: true with evidenceRevision (the revision that receipt describes) beside revision (the current one), and a requested frame is captured from the current scene; report the evidence as stale, never as current." : ""}${name === "inspect_studio" ? `${STUDIO_INSPECT_NOTE} scope "actions" lists the editor actions for run_action with their availability (the reason when unavailable); with ids it answers those actions' descriptions and input schemas.` : ""}${name === "run_action" ? " Run one editor action by id (actionIndex in the context lists them) with args matching its input schema; read the schema first with inspect_studio scope \"actions\" and ids instead of guessing. A mutating action answers with a receipt (action, summary, delta) that undo_edit reverts; a job action answers status \"started\", or \"completed\" with its output when it runs to its end; only an action declared generation \"motion\" counts as this message's one generation. A document action (scenes, the project file) answers status \"completed\" and is not undoable; when it opens another scene, its host names that scene and later commands are admitted there." : ""}${STUDIO_MUTATION_TOOLS.has(name) ? STUDIO_TOOL_RECEIPT_NOTE : ""}`, parameters: STUDIO_TOOL_SCHEMAS[name] });
+const schema = name => ({ type: "function", name, description: `Studio ${name.replaceAll("_", " ")} command.${name === "verify_result" ? " Pass exactly one of receiptId or targets (not both). An earlier receipt stays verifiable after later edits: it answers stale: true with evidenceRevision (the revision that receipt describes) beside revision (the current one), and a requested frame is captured from the current scene; report the evidence as stale, never as current." : ""}${name === "inspect_studio" ? `${STUDIO_INSPECT_NOTE} scope "actions" lists the editor actions for run_action with their availability (the reason when unavailable); with ids it answers those actions' descriptions and input schemas.` : ""}${name === "run_action" ? " Run one editor action by id (actionIndex in the context lists them) with args matching its input schema; read the schema first with inspect_studio scope \"actions\" and ids instead of guessing. A mutating action answers with a receipt (action, summary, delta) that undo_edit reverts; a job action answers status \"started\", or \"completed\" with its output when it runs to its end. A document action (scenes, the project file) answers status \"completed\" and is not undoable; when it opens another scene, its host names that scene and later commands are admitted there." : ""}${STUDIO_MUTATION_TOOLS.has(name) ? STUDIO_TOOL_RECEIPT_NOTE : ""}`, parameters: STUDIO_TOOL_SCHEMAS[name] });
 export const studioToolSchemas = () => STUDIO_TOOLS.map(schema);
 const text = value => typeof value === "string" ? value : JSON.stringify(value);
 
-export function createStudioTools({ liveHub, workspaceHandle, session, resolveImage, previsMode } = {}) {
+export function createStudioTools({ liveHub, workspaceHandle, session, resolveImage } = {}) {
   if (!liveHub?.command || !workspaceHandle) throw new StudioProtocolError("LIVE_HUB_UNAVAILABLE", "An exact Studio workspace is required.");
   const mutationNames = STUDIO_MUTATION_TOOLS;
   // The turn's command index (the context's actionIndex, from the editor's own
-  // registry) carries each action's declarations: `generation: "motion"` takes
-  // the message's one motion generation (one tools instance serves one turn;
-  // other jobs neither take nor meet that gate), and `timeoutMs` is the hub
+  // registry) carries each action's declarations: `timeoutMs` is the hub
   // deadline it runs under, which the hub bounds by MAX_COMMAND_TIMEOUT_MS.
   const declared = new Map((session?.actionIndex ?? []).map(row => [row.id, row]));
-  // One motion generation per user message, shared with generate_motion when
-  // the route passes the turn's gate; a bare tools instance keeps its own.
-  const generationGate = session?.generation ?? { used: false, failures: 0 };
   // What the agent last saw per entity: the basis for deciding that a stale
   // revision left its targets untouched (studio-rebase.mjs).
   const rebaser = createRebaser({ session, liveHub, workspaceHandle, mutationNames, attempt: (name, args, scratch) => attempt(name, args, scratch) });
@@ -29,45 +23,32 @@ export function createStudioTools({ liveHub, workspaceHandle, session, resolveIm
   // a refusal: the revision it was admitted at and the context re-read for it.
   const attempt = async (name, args, scratch = {}) => {
     const command = validateStudioCommand({ name, args });
-    if (name === 'generate_motion' && command.args.source.kind === 'generate') return rebaser.run('run_action', { action: 'motion.generate', args: generationArgs(command.args) });
     const action = name === "run_action" ? declared.get(command.args.action) : undefined;
-    const generation = action?.generation === "motion";
-    if (generation && (generationGate.used || generationGate.pending)) throw new StudioProtocolError("GENERATION_LIMIT", "One motion generation per user message. Report this result and ask the user before generating again.");
-    if (generation && (generationGate.failures ?? 0) >= 2) throw new StudioProtocolError("GENERATION_LIMIT", "Two motion generation attempts already failed in this user message. Report both failures to the user and ask before generating again.");
     const payload = mutationNames.has(name) && session?.admission
-      ? { name, args: command.args, commandId: session.admission.commandId(), host: session.admission.host, expectedRevision: session.admission.revision, ...(session.admission.turnId ? { turnId: session.admission.turnId } : {}),
-          ...(generation && session.onJob ? { wait: false } : {}) }
+      ? { name, args: command.args, commandId: session.admission.commandId(), host: session.admission.host, expectedRevision: session.admission.revision, ...(session.admission.turnId ? { turnId: session.admission.turnId } : {}) }
       : command.args;
-    Object.assign(scratch, { generation, refusedRevision: payload.expectedRevision });
+    Object.assign(scratch, { refusedRevision: payload.expectedRevision });
     let result;
-    if (generation) generationGate.pending = true;
     try {
       // A motion check samples the whole take in the editor, minutes on a long
       // take, so it waits under the hub ceiling rather than the Studio default.
-      const timeoutMs = name === "run_action" ? (action?.timeoutMs === undefined ? undefined : Math.min(MAX_COMMAND_TIMEOUT_MS, action.timeoutMs + (generation ? 5000 : 0)))
+      const timeoutMs = name === "run_action" ? (action?.timeoutMs === undefined ? undefined : Math.min(MAX_COMMAND_TIMEOUT_MS, action.timeoutMs))
         : name === "verify_result" && command.args.checks.includes("motion") ? MAX_COMMAND_TIMEOUT_MS : undefined;
       result = await (timeoutMs === undefined ? liveHub.command(name, payload, workspaceHandle) : liveHub.command(name, payload, workspaceHandle, { timeoutMs }));
-      if (generation && result?.status === 'started' && session?.onJob) result = await session.onJob(result);
     } catch (error) {
       // A STALE_SCENE re-admits whichever family met it, so the retry the
       // model is told to make is admitted at the live revision.
-      if (generation) generationGate.failures = (generationGate.failures ?? 0) + 1;
       if (session?.admission && (error?.code === "STALE_SCENE" || (mutationNames.has(name) && error?.code === "UNCERTAIN_APPLY"))) scratch.fresh = await session.admission.refresh();
       throw error;
-    } finally { if (generation) generationGate.pending = false; }
+    }
     if (result?.ok === false) {
       // Rejection receipts carry code/message at the top level, not under `error`;
       // the receipt itself holds phase, recovery and target evidence the model needs.
       const code = result.code ?? result.error?.code;
       const message = result.message ?? result.error?.message ?? "Studio command failed";
-      if (generation) generationGate.failures = (generationGate.failures ?? 0) + 1;
       if (session?.admission && (code === "STALE_SCENE" || result.mutated === true)) scratch.fresh = await session.admission.refresh();
-      // An acknowledged Stop must settle its held card with the bus outcome,
-      // not turn a proved cancellation into an interrupted/unknown tool.
-      if (code === 'CANCELLED' && session?.onJob) return result;
       throw Object.assign(new Error(message), { code, receipt: result });
     }
-    if (generation) generationGate.used = true;
     // A scene action that opened another scene answers the new host; later
     // commands in this turn are admitted there, never in another workspace.
     if (name === "run_action" && result?.host && session?.admission && result.host.workspaceId === session.admission.host.workspaceId) {
@@ -81,7 +62,7 @@ export function createStudioTools({ liveHub, workspaceHandle, session, resolveIm
     }
     return result;
   };
-	const availableTools = previsMode === "storyboard" ? STUDIO_TOOLS.filter(name => name !== "generate_motion") : STUDIO_TOOLS;
+	const availableTools = STUDIO_TOOLS;
 	const tools = availableTools.map(name => ({ ...schema(name), handler: args => rebaser.run(name, args) }));
   tools.resolveImage = async (imageId, correlation = {}) => {
     if (typeof resolveImage !== "function") return { visualStatus: "unavailable", reason: "image resolver unavailable" };

package/bin/agent/tool-arguments.mjs

@@ -0,0 +1,49 @@
+// prepareArguments for every pi tool (pi-tools.mjs). pi runs it before its own schema check, so
+// this is where a call can be repaired or refused with words pi's check leaves out:
+//   - An array argument sent as JSON text ("[\"motion.compile\"]") is parsed. A model's tool-call
+//     encoder sometimes stringifies a nested array; pi would wrap the whole text as one item and
+//     refuse it as a bad id ("ids.0: must match pattern"), so the model retries blind. The intent
+//     is unambiguous, so it is taken, and the parsed array is still validated in full. Text that
+//     does not parse to an array is left for the schema check to refuse.
+//   - An unknown field in a closed object is refused by name, with the fields allowed there. pi
+//     says only "root: must not have additional properties", and a model then resends the call
+//     unchanged. The message keeps pi's "Validation failed for tool" prefix (agent-routes.mjs
+//     shortens that prefix for the browser).
+const isRecord = value => value !== null && typeof value === "object" && !Array.isArray(value);
+const where = at => at || "root";
+
+function parseArrayText(value) {
+	if (typeof value !== "string" || !value.trimStart().startsWith("[")) return value;
+	try {
+		const parsed = JSON.parse(value);
+		return Array.isArray(parsed) ? parsed : value;
+	} catch {
+		return value;
+	}
+}
+
+/** The value with array texts parsed along the schema's arrays and closed objects; unknown fields go to problems. */
+function prepare(schema, value, at, problems) {
+	if (schema?.type === "array") {
+		const parsed = parseArrayText(value);
+		return Array.isArray(parsed) && schema.items ? parsed.map((item, i) => prepare(schema.items, item, `${at}[${i}]`, problems)) : parsed;
+	}
+	if (schema?.type !== "object" || !isRecord(value)) return value;
+	const properties = schema.properties ?? {}, allowed = Object.keys(properties);
+	const unknown = schema.additionalProperties === false ? Object.keys(value).filter(key => !Object.hasOwn(properties, key)) : [];
+	// a misnamed field usually leaves a required one out: name both in the one refusal
+	const missing = unknown.length ? (schema.required ?? []).filter(key => !Object.hasOwn(value, key)) : [];
+	if (unknown.length) problems.push(`${where(at)} has unknown field${unknown.length > 1 ? "s" : ""} ${unknown.map(key => JSON.stringify(key)).join(", ")}; allowed: ${allowed.join(", ") || "no fields"}${missing.length ? `; missing required: ${missing.join(", ")}` : ""}`);
+	return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, Object.hasOwn(properties, key) ? prepare(properties[key], item, at ? `${at}.${key}` : key, problems) : item]));
+}
+
+/** prepareArguments(args) for one tool: parsed array texts, or a throw naming every unknown field. */
+export function toolArgumentPreparer(name, schema) {
+	return args => {
+		const problems = [], prepared = prepare(schema, args, "", problems);
+		if (!problems.length) return prepared;
+		const actionHint = name === "run_action" && isRecord(args) && Object.keys(args).some(key => !Object.hasOwn(schema.properties ?? {}, key))
+			? " The action's own inputs go inside args: { \"action\": \"<id>\", \"args\": { ... } }." : "";
+		throw new Error(`Validation failed for tool "${name}": ${problems.join("; ")}.${actionHint}`);
+	};
+}

package/bin/agent/turn-frames.mjs

@@ -0,0 +1,66 @@
+// What the model is doing BETWEEN tool calls, as frames the agent panel shows while a turn runs: the
+// reasoning summary it streams (thinking.delta, batched) and the tool call it is writing (tool.compose: the
+// tool, and for run_action the action and its subject as soon as the streamed arguments name them). A long
+// motion spec or script takes the model many seconds to write; without these the panel could only say
+// "Thinking…". Frames only: nothing here reaches the model or the scene.
+
+const FLUSH_MS = 400;
+const MIN_BATCH = 16;
+const SCAN_LIMIT = 8192;
+const SUBJECT_MAX = 80;
+
+// Complete JSON strings only: a streamed fragment never names half an action.
+const ACTION = /"action"\s*:\s*"([a-zA-Z0-9_.-]{1,80})"/;
+const LABEL = /"(?:label|caption)"\s*:\s*"((?:[^"\\]|\\.){1,200})"/;
+const SCRIPT_TITLE = /"code"\s*:\s*"\s*\/\/\s*((?:[^"\\]|\\[^n]){1,200})(?:\\n|")/;
+
+const unescape = text => { try { return JSON.parse(`"${text}"`); } catch { return text; } };
+const clip = text => { const line = unescape(text).trim(); return line.length > SUBJECT_MAX ? `${line.slice(0, SUBJECT_MAX - 1)}…` : line; };
+
+/** The action and subject named by a tool call's raw argument JSON so far: { action?, subject? }. */
+function composedCall(name, raw) {
+	const action = name === "run_action" ? ACTION.exec(raw)?.[1] : undefined;
+	const subject = name === "script" ? SCRIPT_TITLE.exec(raw)?.[1] : LABEL.exec(raw)?.[1];
+	return { ...(action ? { action } : {}), ...(subject ? { subject: clip(subject) } : {}) };
+}
+
+/**
+ * createReasoningFrames(push, clock) -> { onMessageEvent(event), flush() }
+ * onMessageEvent takes pi's assistant message events (thinking_*, toolcall_*, text_*); push gets
+ * { type: "thinking.delta", text } at most every FLUSH_MS, and { type: "tool.compose", index, name, action?, subject? }
+ * whenever what the call being written names changes.
+ */
+export function createReasoningFrames(push, clock = () => Date.now()) {
+	let thinking = "", flushedAt = clock();
+	const calls = new Map();
+	const flush = () => {
+		if (!thinking) return;
+		push({ type: "thinking.delta", text: thinking });
+		thinking = "";
+		flushedAt = clock();
+	};
+	return {
+		flush,
+		onMessageEvent(event) {
+			if (event?.type === "thinking_delta") {
+				thinking += event.delta ?? "";
+				// a batch says something: not a lone word at the start of a paragraph
+				if (clock() - flushedAt >= FLUSH_MS && thinking.length >= MIN_BATCH) flush();
+				return;
+			}
+			flush();
+			if (event?.type !== "toolcall_start" && event?.type !== "toolcall_delta") return;
+			const call = event.partial?.content?.[event.contentIndex];
+			if (call?.type !== "toolCall" || typeof call.name !== "string" || !call.name) return;
+			// contentIndex restarts with every assistant message, so a start begins a new call
+			const seen = event.type === "toolcall_start" ? { raw: "", key: null } : calls.get(event.contentIndex) ?? { raw: "", key: null };
+			if (event.type === "toolcall_delta" && seen.raw.length < SCAN_LIMIT) seen.raw += event.delta ?? "";
+			const named = composedCall(call.name, seen.raw);
+			const key = `${call.name}|${named.action ?? ""}|${named.subject ?? ""}`;
+			calls.set(event.contentIndex, seen);
+			if (seen.key === key) return;
+			seen.key = key;
+			push({ type: "tool.compose", index: event.contentIndex, name: call.name, ...named });
+		},
+	};
+}

package/bin/codex-auth.mjs

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { openBrowser } from "./open-browser.mjs";
 import { writeSecureJson } from "./agent/secure-file.mjs";
-import { readKeys } from "./agent/provider-keys.mjs";
+import { readCredentials, readKeys } from "./agent/provider-keys.mjs";
 import { PROVIDERS } from "./agent/providers.mjs";
 
 const AUTHORIZE_ENDPOINT = "https://auth.openai.com/oauth/authorize";
@@ -54,12 +54,16 @@ function providersConfigured() {
 	const configured = new Set();
 	for (const provider of PROVIDERS) for (const name of provider.env) if (process.env[name]?.trim()) configured.add(provider.id);
 	for (const [id, value] of Object.entries(readKeys())) if (typeof value === "string" && value.trim()) configured.add(id);
+	// and every provider a pi login stored a credential for (auth.json: OAuth, or a key with provider env)
+	for (const id of Object.keys(readCredentials())) configured.add(id);
 	return configured.size;
 }
 export function status() {
 	const claim = claims();
 	const auth = claim["https://api.openai.com/auth"] || {};
-	return { signedIn: !!readTokens()?.refresh_token, email: claim.email || null, plan: auth.chatgpt_plan_type || null, accountId: auth.chatgpt_account_id || null, expiresAt: readTokens()?.expires_at || null, providersConfigured: providersConfigured() };
+	// `pending` keeps the panel on "Waiting for your browser…" while a sign-in page is open, with its link.
+	const pending = Boolean(authServer && authState) && !readTokens()?.refresh_token;
+	return { signedIn: !!readTokens()?.refresh_token, ...(pending ? { pending, authorizeUrl: authState.result.authorizeUrl } : {}), email: claim.email || null, plan: auth.chatgpt_plan_type || null, accountId: auth.chatgpt_account_id || null, expiresAt: readTokens()?.expires_at || null, providersConfigured: providersConfigured() };
 }
 export function readStored() {
 	const current = readTokens();
@@ -124,6 +128,9 @@ export async function startOAuth() {
 	const authorizeUrl = new URL(AUTHORIZE_ENDPOINT);
 	for (const [key, value] of Object.entries({ response_type: "code", client_id: CLIENT_ID, redirect_uri: `http://${"local" + "host"}:${port}/auth/callback`, scope: SCOPE, code_challenge: challenge, code_challenge_method: "S256", state, id_token_add_organizations: "true", codex_cli_simplified_flow: "true", originator: "cozyclay" })) authorizeUrl.searchParams.set(key, value);
 	authState = { result: { ok: true, port, authorizeUrl: authorizeUrl.toString() } };
+	// An abandoned sign-in stops listening after ten minutes, so the panel cannot wait on it forever.
+	const server = authServer;
+	setTimeout(() => { if (authServer === server) { server.close(); authServer = null; authState = null; } }, 10 * 60 * 1000).unref?.();
 	openBrowser(authorizeUrl.toString());
 	return authState.result;
 }