zigmini 1.0.0-beta.3 → 1.1.0-beta.1

package/host/omo-check/patches/omo-5.1.51-agent-tool-authority.patch

@@ -0,0 +1,471 @@
+--- a/@code-yeongyu/senpi/dist/core/agent-session.js
++++ b/@code-yeongyu/senpi/dist/core/agent-session.js
+@@ -13,6 +13,14 @@
+  * Modes use this class and add their own I/O layer on top.
+  */
+ import { randomUUID } from "node:crypto";
++import { checkExternalToolStart, createPolicyPermissionAuthority, hasExternalPermissionAuthority, registerExternalPermissionAuthority as registerExternalAuthorityFor, requestExternalToolStart, settleExternalToolStart, } from "./extensions/builtin/permission-system/dispatch.js";
++import { getDispatchIdentity } from "./extensions/builtin/permission-system/dispatch-metadata.js";
++// Registered-agent tool operations (zigmini 294). Durable custom entries make a held call,
++// its single execution and its single continuation idempotent across restarts.
++const AGENT_TOOL_OPERATION_ENTRY = "agent_tool_operation";
++const AGENT_TOOL_STARTED_ENTRY = "agent_tool_started";
++const AGENT_TOOL_RESULT_ENTRY = "agent_tool_result";
++const AGENT_TOOL_RESUME_ENTRY = "agent_tool_resume";
+ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+ import { rm } from "node:fs/promises";
+ import { dirname, join } from "node:path";
+@@ -1251,6 +1259,12 @@
+         // Callers such as executeTool only honor an explicit block, so returning nothing here would let it run.
+         if ((await this._waitForToolBarrier(toolCall, signal)) && signal?.aborted) {
+             return { block: true, reason: "Operation aborted" };
++        }
++        // The registered-agent authority runs before every hook, so no preset, internal-tool
++        // exemption or extension answer can start a call it has not allowed.
++        const external = this._checkAgentToolStart(toolCall, args, options);
++        if (external !== undefined) {
++            return external;
+         }
+         const runner = this._extensionRunner;
+         if (!runner.hasHandlers("tool_call")) {
+@@ -1272,6 +1286,142 @@
+             throw new Error(`Extension failed, blocking execution: ${String(err)}`);
+         }
+     }
++    /** Install the authority that decides every tool start of this session. Returns its retirement. */
++    registerExternalPermissionAuthority(authority) {
++        return registerExternalAuthorityFor(this.sessionManager, authority);
++    }
++    hasExternalPermissionAuthority() {
++        return hasExternalPermissionAuthority(this.sessionManager);
++    }
++    /** A host-pushed policy replaces the previous one; the acknowledged revision is returned. */
++    applyAgentToolPolicy(policy) {
++        const authority = createPolicyPermissionAuthority(policy);
++        this._retireAgentToolPolicy?.();
++        this._retireAgentToolPolicy = this.registerExternalPermissionAuthority(authority);
++        return authority.describe();
++    }
++    _agentToolSource(toolName, args) {
++        const info = this._toolDefinitions.get(toolName);
++        if (info === undefined)
++            return { sourceKind: "unknown" };
++        const identity = getDispatchIdentity(info.definition.parameters, args);
++        return {
++            sourceKind: info.sourceInfo?.source ?? "unknown",
++            ...(info.sourceInfo?.path === undefined ? {} : { ownerPath: info.sourceInfo.path }),
++            ...(identity === undefined ? {} : { identity: { owner: identity.owner, operation: identity.operation } }),
++        };
++    }
++    /** Decide one start against the external authority; undefined when none is registered or it allows. */
++    _checkAgentToolStart(toolCall, args, options = {}) {
++        if (!hasExternalPermissionAuthority(this.sessionManager))
++            return undefined;
++        const operationId = options.agentToolOperationId ?? `agent-op:${toolCall.id}`;
++        const call = {
++            path: options.agentToolPath ?? (options.parentToolCallId ? "nested" : "direct"),
++            toolName: toolCall.name,
++            toolCallId: toolCall.id,
++            operationId,
++            input: args,
++            ...(options.parentToolCallId ? { parentToolCallId: options.parentToolCallId } : {}),
++            ...this._agentToolSource(toolCall.name, args),
++        };
++        const decision = checkExternalToolStart(this.sessionManager, call);
++        if (decision === undefined || decision.action === "allow")
++            return undefined;
++        if (decision.action === "deny" || options.agentToolOperationId !== undefined) {
++            return { block: true, reason: `agent_tool_denied: ${decision.reason ?? decision.action}` };
++        }
++        // Held: record the exact call once and end this tool call with one pending result.
++        // The native toolCall is not kept open; the host continues the logical work later.
++        let pending = this._findAgentToolEntry(AGENT_TOOL_OPERATION_ENTRY, operationId);
++        if (pending === undefined) {
++            const { requestId } = requestExternalToolStart(this.sessionManager, call);
++            const data = { operationId, requestId, toolName: toolCall.name, toolCallId: toolCall.id, input: args, path: call.path };
++            this._emitEntryAppended(this.sessionManager.appendCustomEntry(AGENT_TOOL_OPERATION_ENTRY, data));
++            pending = { data };
++        }
++        return {
++            block: true,
++            reason: JSON.stringify({ state: "permission_pending", requestId: pending.data.requestId, operationId }),
++        };
++    }
++    _findAgentToolEntry(customType, key, field = "operationId") {
++        return this.sessionManager
++            .getEntries()
++            .find((entry) => entry.type === "custom" && entry.customType === customType && entry.data?.[field] === key);
++    }
++    /**
++     * Run a held operation exactly once through the common tool pipeline (preflight included).
++     * A stored result is returned again without running the tool; a start without a result is
++     * reported as outcome_unknown and never repeated.
++     */
++    async executeAgentToolOperation(operationId, options = {}) {
++        const stored = this._findAgentToolEntry(AGENT_TOOL_RESULT_ENTRY, operationId);
++        if (stored !== undefined)
++            return { operationId, executed: false, state: stored.data.isError ? "failed" : "succeeded", result: stored.data.result };
++        const operation = this._findAgentToolEntry(AGENT_TOOL_OPERATION_ENTRY, operationId);
++        if (operation === undefined)
++            throw new Error("agent_tool_operation_unknown");
++        this._agentToolRunning ??= new Set();
++        if (this._agentToolRunning.has(operationId) || this._findAgentToolEntry(AGENT_TOOL_STARTED_ENTRY, operationId) !== undefined) {
++            return { operationId, executed: false, state: this._agentToolRunning.has(operationId) ? "started" : "outcome_unknown" };
++        }
++        const { toolName, input } = operation.data;
++        const decision = checkExternalToolStart(this.sessionManager, {
++            path: "operation", toolName, toolCallId: operation.data.toolCallId, operationId, input, ...this._agentToolSource(toolName, input),
++        });
++        if (decision !== undefined && decision.action !== "allow") {
++            return { operationId, executed: false, state: "not_granted", reason: decision.reason ?? decision.action };
++        }
++        this._agentToolRunning.add(operationId);
++        try {
++            this._emitEntryAppended(this.sessionManager.appendCustomEntry(AGENT_TOOL_STARTED_ENTRY, { operationId }));
++            let result;
++            let isError = false;
++            try {
++                const output = await this.executeTool(toolName, input, { signal: options.signal, activateInactiveTool: true, agentToolOperationId: operationId });
++                result = { content: output.content ?? [], ...(output.details === undefined ? {} : { details: output.details }) };
++                isError = output.isError === true || output.details?.isError === true;
++            }
++            catch (error) {
++                result = { content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }] };
++                isError = true;
++            }
++            this._emitEntryAppended(this.sessionManager.appendCustomEntry(AGENT_TOOL_RESULT_ENTRY, { operationId, isError, result }));
++            settleExternalToolStart(this.sessionManager, { operationId, state: isError ? "failed" : "succeeded" });
++            return { operationId, executed: true, state: isError ? "failed" : "succeeded", result };
++        }
++        finally {
++            this._agentToolRunning.delete(operationId);
++        }
++    }
++    /**
++     * Accept one managed continuation for a stored result. The same continuation id returns
++     * the first acceptance; the caller submits `message` only when `accepted` is true.
++     */
++    acceptAgentToolContinuation(operationId, continuationId) {
++        if (typeof continuationId !== "string" || continuationId.length === 0 || continuationId.length > 128)
++            throw new Error("agent_tool_continuation_invalid");
++        const previous = this._findAgentToolEntry(AGENT_TOOL_RESUME_ENTRY, continuationId, "continuationId");
++        if (previous !== undefined) {
++            if (previous.data.operationId !== operationId)
++                throw new Error("agent_tool_continuation_conflict");
++            return { operationId, continuationId, accepted: false, duplicate: true };
++        }
++        if (this._findAgentToolEntry(AGENT_TOOL_RESUME_ENTRY, operationId) !== undefined)
++            return { operationId, continuationId, accepted: false, duplicate: true };
++        const stored = this._findAgentToolEntry(AGENT_TOOL_RESULT_ENTRY, operationId);
++        if (stored === undefined)
++            throw new Error("agent_tool_result_missing");
++        const operation = this._findAgentToolEntry(AGENT_TOOL_OPERATION_ENTRY, operationId);
++        this._emitEntryAppended(this.sessionManager.appendCustomEntry(AGENT_TOOL_RESUME_ENTRY, { operationId, continuationId }));
++        const text = (stored.data.result.content ?? []).filter((block) => block.type === "text").map((block) => block.text).join("\n");
++        const message = `[agent_tool_permission] ${JSON.stringify({
++            origin: "agent_tool_permission", operationId, continuationId, requestId: operation?.data.requestId,
++            toolName: operation?.data.toolName, state: stored.data.isError ? "failed" : "succeeded", result: text,
++        })}`;
++        return { operationId, continuationId, accepted: true, duplicate: false, message };
++    }
+     async _emitAfterToolCallHooks(toolCall, args, result, isError, parentToolCallId) {
+         const runner = this._extensionRunner;
+         const hookResult = runner.hasHandlers("tool_result")
+@@ -3708,6 +3858,7 @@
+         }
+         const beforeResult = await this.preflightToolCall(prepared.toolCall, prepared.args, {
+             waitForEventQueue: this._toolExecutionDepth === 0,
++            ...(options?.agentToolOperationId === undefined ? {} : { agentToolOperationId: options.agentToolOperationId, agentToolPath: "operation" }),
+         });
+         if (beforeResult?.block) {
+             throw new ExecuteToolError("blocked", toolName, beforeResult.reason || "Tool execution was blocked", activeTools);
+--- a/@code-yeongyu/senpi/dist/core/extensions/types.d.ts
++++ b/@code-yeongyu/senpi/dist/core/extensions/types.d.ts
+@@ -2933,5 +2933,41 @@
+     event: string;
+     error: string;
+     stack?: string;
++}
++/** One tool start as the registered-agent authority sees it (zigmini 294). */
++export interface ExternalToolStart {
++    path: "direct" | "nested" | "operation" | "mcp" | "rpc";
++    toolName: string;
++    toolCallId: string;
++    operationId?: string;
++    input: unknown;
++    parentToolCallId?: string;
++    sourceKind?: string;
++    ownerPath?: string;
++    identity?: {
++        owner: string;
++        operation: string;
++    };
++}
++export type ExternalToolDecision = {
++    action: "allow";
++} | {
++    action: "deny" | "hold";
++    reason?: string;
++};
++/**
++ * Registered with `registerExternalPermissionAuthority`. `checkStart` is synchronous so it can
++ * run in the last fence before dispatch; a thrown error or unknown answer refuses the call.
++ */
++export interface ExternalPermissionAuthority {
++    describe(): unknown;
++    request(call: ExternalToolStart): {
++        requestId: string;
++    };
++    checkStart(call: ExternalToolStart): ExternalToolDecision;
++    settle(outcome: {
++        operationId: string;
++        state: "succeeded" | "failed";
++    }): void;
+ }
+ //# sourceMappingURL=types.d.ts.map
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/permission-system/dispatch.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/permission-system/dispatch.js
+@@ -1,5 +1,109 @@
+ import { DeniedError } from "./types.js";
+ const authorizers = new WeakMap();
++// Registered-agent authority (zigmini 294). One registry per process, shared by the
++// session, the MCP dispatch fence and in-process extensions such as codemode.
++const EXTERNAL_AUTHORITY_REGISTRY = Symbol.for("senpi.externalPermissionAuthority");
++const externalAuthorities = (globalThis[EXTERNAL_AUTHORITY_REGISTRY] ??= new WeakMap());
++const EXTERNAL_AUTHORITY_METHODS = ["describe", "request", "checkStart", "settle"];
++/**
++ * Compose an external authority with this session's dispatch authorization. While it is
++ * registered every tool start asks `checkStart` first; native presets cannot skip it.
++ * Retirement keeps a refusing registration, so a lost authority never reads as "none".
++ */
++export function registerExternalPermissionAuthority(session, authority) {
++    for (const method of EXTERNAL_AUTHORITY_METHODS) {
++        if (typeof authority?.[method] !== "function")
++            throw new TypeError(`external_authority_${method}_missing`);
++    }
++    const registration = { authority, retired: false };
++    externalAuthorities.set(session, registration);
++    return () => {
++        registration.retired = true;
++    };
++}
++export function hasExternalPermissionAuthority(session) {
++    return externalAuthorities.has(session);
++}
++/** Synchronous so it can run inside the last fence before dispatch. Any fault refuses. */
++export function checkExternalToolStart(session, call) {
++    const registration = externalAuthorities.get(session);
++    if (registration === undefined)
++        return undefined;
++    if (registration.retired)
++        return { action: "deny", reason: "agent_authority_retired" };
++    let decision;
++    try {
++        decision = registration.authority.checkStart(call);
++    }
++    catch {
++        return { action: "deny", reason: "agent_authority_failed" };
++    }
++    if (decision?.action === "allow" || decision?.action === "deny" || decision?.action === "hold")
++        return decision;
++    return { action: "deny", reason: "agent_authority_invalid_decision" };
++}
++/** Ask the authority to record a held call. The request id names the pending card. */
++export function requestExternalToolStart(session, call) {
++    const registration = externalAuthorities.get(session);
++    if (registration === undefined || registration.retired)
++        throw new Error("agent_authority_unavailable");
++    const requested = registration.authority.request(call);
++    if (typeof requested?.requestId !== "string" || requested.requestId.length === 0)
++        throw new Error("agent_authority_request_invalid");
++    return requested;
++}
++export function settleExternalToolStart(session, outcome) {
++    const registration = externalAuthorities.get(session);
++    if (registration === undefined || registration.retired)
++        return;
++    try {
++        registration.authority.settle(outcome);
++    }
++    catch (error) {
++        console.error(`agent authority settle failed: ${error instanceof Error ? error.message : String(error)}`);
++    }
++}
++function policyGrantMatches(grant, call) {
++    return (grant.toolName === call.toolName &&
++        (grant.owner === undefined || grant.owner === call.identity?.owner) &&
++        (grant.operation === undefined || grant.operation === call.identity?.operation));
++}
++/**
++ * The authority a host pushes over RPC: an acknowledged policy revision with exact grants.
++ * A call without a grant is held for consent (or refused when `missing` is "deny").
++ */
++export function createPolicyPermissionAuthority(policy) {
++    if (!Number.isSafeInteger(policy?.revision) || policy.revision < 1)
++        throw new TypeError("agent_policy_revision_invalid");
++    if (!Array.isArray(policy.grants) ||
++        !policy.grants.every((grant) => typeof grant?.toolName === "string" &&
++            grant.toolName.length > 0 &&
++            (grant.owner === undefined || typeof grant.owner === "string") &&
++            (grant.operation === undefined || typeof grant.operation === "string"))) {
++        throw new TypeError("agent_policy_grants_invalid");
++    }
++    if (policy.missing !== undefined && policy.missing !== "hold" && policy.missing !== "deny")
++        throw new TypeError("agent_policy_missing_invalid");
++    const grants = policy.grants.map((grant) => ({ ...grant }));
++    const missing = policy.missing ?? "hold";
++    return {
++        describe: () => ({ revision: policy.revision, grants: grants.length, missing }),
++        request: (call) => ({ requestId: `agent-tool-request:${call.operationId ?? call.toolCallId}` }),
++        checkStart: (call) => grants.some((grant) => policyGrantMatches(grant, call))
++            ? { action: "allow" }
++            : { action: missing, reason: "no_grant" },
++        settle: () => undefined,
++    };
++}
++function externalDispatchCall(request) {
++    return {
++        path: "mcp",
++        toolName: request.toolName,
++        toolCallId: request.toolCallId,
++        input: request.input,
++        ...(request.identity === undefined ? {} : { identity: { owner: request.identity.owner, operation: request.identity.operation } }),
++    };
++}
+ // AgentSession passes this validated object unchanged from preflight to execution.
+ // Identical calls, including calls with duplicate provider IDs, get distinct objects.
+ const approvals = new WeakMap();
+@@ -76,6 +180,9 @@
+  */
+ export async function authorizeToolDispatch(session, request, ctx, signal) {
+     signal?.throwIfAborted();
++    const external = checkExternalToolStart(session, externalDispatchCall(request));
++    if (external !== undefined && external.action !== "allow")
++        throw new Error(`agent_tool_denied: ${external.reason ?? external.action}`);
+     const registration = authorizers.get(session);
+     if (!registration)
+         throw new Error("Permission authorizer is unavailable");
+@@ -97,6 +204,9 @@
+             return false;
+         if (JSON.stringify(request.input) !== approvedInput)
+             return false;
++        const latest = checkExternalToolStart(session, externalDispatchCall(request));
++        if (latest !== undefined && latest.action !== "allow")
++            return false;
+         const current = registration.authorizer.policy(request, ctx);
+         if (current.action === "deny")
+             return false;
+--- a/@code-yeongyu/senpi/dist/modes/rpc/connection-handler.js
++++ b/@code-yeongyu/senpi/dist/modes/rpc/connection-handler.js
+@@ -913,6 +913,7 @@
+                                 USER_ACTIVITY_CAPABILITY,
+                                 RESUME_SESSION_CAPABILITY,
+                                 ENTRIES_TAIL_CAPABILITY,
++                                "agent_tool_authority",
+                                 ...(options.retryFallbackCommand ? [RETRY_FALLBACK_COMMAND_CAPABILITY] : []),
+                                 ...(options.toolRuntime ? toolRuntimeCapabilities(options.toolRuntime) : []),
+                                 // Client flags cannot advertise a host guard this classic binding does not run, nor a tool runtime.
+@@ -1342,7 +1343,50 @@
+             case "set_label":
+                 session.sessionManager.appendLabelChange(command.entryId, command.label);
+                 return success(id, "set_label");
++            // Registered-agent tool authority (zigmini 294). Host-only commands on the
++            // authenticated RPC channel; the model cannot name an operation or change its input.
++            case "zgw.agent_tool_policy": {
++                try {
++                    return success(id, command.type, session.applyAgentToolPolicy(command.policy));
++                }
++                catch (err) {
++                    return error(id, command.type, err instanceof Error ? err.message : String(err));
++                }
++            }
++            case "zgw.agent_tool_execute": {
++                if (typeof command.operationId !== "string" || command.operationId.length === 0)
++                    return error(id, command.type, "agent_tool_operation_invalid");
++                try {
++                    return success(id, command.type, await session.executeAgentToolOperation(command.operationId));
++                }
++                catch (err) {
++                    return error(id, command.type, err instanceof Error ? err.message : String(err));
++                }
++            }
++            case "zgw.agent_tool_resume": {
++                let accepted;
++                try {
++                    accepted = session.acceptAgentToolContinuation(command.operationId, command.continuationId);
++                }
++                catch (err) {
++                    return error(id, command.type, err instanceof Error ? err.message : String(err));
++                }
++                if (!accepted.accepted)
++                    return success(id, command.type, accepted);
++                turnRequested = true;
++                const admission = handleClientInput(session, { id, type: "prompt", message: accepted.message,
++                    clientInputId: accepted.continuationId, streamingBehavior: "followUp" }, { output, promptCalls });
++                promptCalls.add(admission);
++                void admission.finally(() => promptCalls.delete(admission));
++                return undefined;
++            }
+             case "bash": {
++                // A registered agent's raw shell must pass the same authority as its tool calls.
++                if (session.hasExternalPermissionAuthority()) {
++                    const denied = session._checkAgentToolStart({ id: command.executionId ?? `rpc-bash-${id ?? "anonymous"}`, name: "bash" }, { command: command.command }, { agentToolPath: "rpc", agentToolOperationId: `rpc-bash:${id ?? "anonymous"}` });
++                    if (denied !== undefined)
++                        return error(id, "bash", denied.reason);
++                }
+                 if (routingSessionId !== undefined)
+                     outputEvent({ type: "bash_start" });
+                 try {
+--- a/@code-yeongyu/senpi/dist/core/cursor-exec-bridge.js
++++ b/@code-yeongyu/senpi/dist/core/cursor-exec-bridge.js
+@@ -92,7 +92,11 @@
+         if (!isRecord(params)) {
+             throw new Error(`Tool "${toolName}" prepared non-object arguments`);
+         }
+-        const preflight = await options.preflightToolCall?.({
++        // Without a preflight hook nothing could refuse the call (the agent authority included): fail closed.
++        if (options.preflightToolCall === undefined) {
++            throw new Error("Tool permission preflight is unavailable");
++        }
++        const preflight = await options.preflightToolCall({
+             type: "tool_call",
+             toolCallId,
+             toolName,
+--- a/@code-yeongyu/senpi-codemode/src/tool/eval-tool.ts
++++ b/@code-yeongyu/senpi-codemode/src/tool/eval-tool.ts
+@@ -38,6 +38,26 @@
+ 	ToolDefinition<TUnsafe<Request | Partial<EvalToolInput>>, EvalToolDetails>["execute"]
+ >;
+ 
++const EXTERNAL_AUTHORITY_REGISTRY = Symbol.for("senpi.externalPermissionAuthority");
++
++/** True when a registered-agent authority governs the calling session (zigmini 294). */
++export function agentAuthorityGoverns(ctx: unknown): boolean {
++	const registry = (globalThis as Record<symbol, unknown>)[EXTERNAL_AUTHORITY_REGISTRY];
++	const session = typeof ctx === "object" && ctx !== null && "sessionManager" in ctx ? ctx.sessionManager : undefined;
++	return registry instanceof WeakMap && typeof session === "object" && session !== null && registry.has(session);
++}
++
++/**
++ * A governed session runs code only as JavaScript in the QuickJS isolate. The server sets
++ * `isolate`; the model cannot turn it off or switch to another language or a host kernel.
++ */
++export function enforceAgentIsolation<Request extends EvalToolRequest>(request: Request, ctx: unknown): Request {
++	if (!agentAuthorityGoverns(ctx) || isEvalControlRequest(request)) return request;
++	if (!("language" in request) || request.language !== "js")
++		throw new EvalIsolateInvalidError("agent_eval_language_unavailable: registered agents run JavaScript in the QuickJS isolate only");
++	return { ...request, isolate: true } as Request;
++}
++
+ export function createEvalTool(options: CreateEvalToolOptions) {
+ 	const foregroundWindowSeconds = options.foregroundWindowSeconds ?? DEFAULT_FOREGROUND_WINDOW_SECONDS;
+ 	const maxDetachedCells =
+@@ -83,7 +103,7 @@
+ 	async function execute(
+ 		...[toolCallId, params, signal, onUpdate, ctx]: EvalExecuteArgs<EvalToolRequest>
+ 	): Promise<AgentToolResult<EvalResultDetails>> {
+-		const request = parseEvalRequest(params, languages, { sandbox });
++		const request = enforceAgentIsolation(parseEvalRequest(params, languages, { sandbox }), ctx);
+ 		if (isEvalControlRequest(request)) return await executeEvalControl(cellManager, request);
+ 		if (options.proxyExecutor) {
+ 			// A proxy runs cells elsewhere and knows nothing of sandbox cells: an isolated cell must never run unisolated.

package/host/omo-check/patches/omo-5.1.51-gateway-port.manifest.json

@@ -1,11 +1,11 @@
 {
   "schema": 1,
-  "revision": 4,
+  "revision": 6,
   "upstream": {
     "omo": "5.1.51",
     "senpi": "2026.10.27-1"
   },
-  "candidate": "<zigmini home>/omo/5.1.51-zgw.4",
+  "candidate": "<zigmini home>/omo/5.1.51-zgw.6",
   "pristine": "<zigmini home>/omo/5.1.51",
   "entrypoint": "node_modules/@code-yeongyu/senpi/dist/cli.js",
   "patchRoot": "node_modules",
@@ -17,7 +17,9 @@
     "omo-5.1.51-compaction-recovery.patch",
     "omo-5.1.51-provider-failover.patch",
     "omo-5.1.51-compaction-long-context.patch",
-    "omo-5.1.51-chatgpt-terra.patch"
+    "omo-5.1.51-chatgpt-terra.patch",
+    "omo-5.1.51-memory-receipts.patch",
+    "omo-5.1.51-agent-tool-authority.patch"
   ],
   "files": [
     {
@@ -28,7 +30,7 @@
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/agent-session.js",
       "originalSha256": "6bc07b317862db56e6277767320673ac87cdc637751f365c00ad861df39f22e0",
-      "patchedSha256": "81b8c282c4cbeb376f9294599cacf2ab3fd25bdcb8e054e5e52b52e398e38656"
+      "patchedSha256": "b4b48626e4feb21bb8e28cd6410363d9c16eeb45cb6d0fcbb14a18493c2efb6c"
     },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/auth-storage.js",
@@ -258,7 +260,7 @@
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/types.d.ts",
       "originalSha256": "ae1efdb5f5f68c3aa0d147d8f2828552ebcb6ec95b54817cb90393b927abcc20",
-      "patchedSha256": "a8c90acd1c4325130d98a0a10840bf35ca5f81b6d6e63592d2581db276482fb4"
+      "patchedSha256": "1939cd9035b886859fe748ec7e08052f9bca7b98f6471e10d8b75bc88bf1ee9b"
     },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/model-runtime.js",
@@ -273,7 +275,7 @@
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/modes/rpc/connection-handler.js",
       "originalSha256": "df28c8c8aca7c01633510e2a892a1cca6cfef785f15e44c026a997788543e570",
-      "patchedSha256": "6c539f4ba8b29019df69f88404779b3350fbaaad1f4230c5182305c4360bad7f"
+      "patchedSha256": "bcd721298ed68439885fdfaef87026694feb836f0c72ec4296796816b55e390f"
     },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/modes/rpc/connection-question-bridge.js",
@@ -374,6 +376,26 @@
       "path": "node_modules/@code-yeongyu/senpi/dist/bundle/chunks/session-worker.js",
       "originalSha256": "8cd4a903ea9243667f63b131b9c3cb87ca3d9e1b46f8e8d54cfa2a11add853b2",
       "patchedSha256": "cf6a2a7e06aef03bf8fdc3583578e66c0e0f35951bf6a373107f9e375e00bbd5"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/permission-system/dispatch.js",
+      "originalSha256": "0a94637e71e60260cf8de7a9b5c39300a5d91f9cd8adffdd379a5337c45cd903",
+      "patchedSha256": "0966ee6a7e3ddaab8242fce7cba75e7a83af64e97a3e08bcd5ab1b8ea4248365"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/cursor-exec-bridge.js",
+      "originalSha256": "e6c4fedef2bdd5f69b3373947204266f8b1fc9bcd31f18ab10c3f512f559cf29",
+      "patchedSha256": "1cffccc2e71ea684aa1b611b9a8c11eadde48890ffe0b76ff4e733a8c4b7ddc0"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi-codemode/src/tool/eval-tool.ts",
+      "originalSha256": "107e41edbfd1d0403a62d8265a18c62042c0f6b48e0a5a2f65d171b9fcdc914b",
+      "patchedSha256": "5ee8e1aca3f0ca73067c0da7387051c95211e784288a25c153b9c9112640f49f"
+    },
+    {
+      "path": "node_modules/omo-ai/plugin/extensions/omo.js",
+      "originalSha256": "443394ed1461a1502d91124667dc6fc94d82c458867b07e5549f8080e061080e",
+      "patchedSha256": "e4823cb98e4c7e17ce1cee865ace6fad97613f349e644344b10669ac7bbe9add"
     }
   ]
 }

package/host/omo-check/patches/omo-5.1.51-memory-receipts.patch

@@ -0,0 +1,5 @@
+--- a/omo-ai/plugin/extensions/omo.js
++++ b/omo-ai/plugin/extensions/omo.js
+@@ replace @@
+-async function L1(e,t){let n=(await e.lsTree(t)).filter(z1);if(0===n.length)return 0;let r=(await Promise.all(n.map(n=>e.show(t,n)))).reduce((e,t)=>e+Buffer.byteLength(t,"utf8"),0);return Math.floor(r/4)}
++async function L1(e,t){let n=(await e.lsTree(t)).filter(z1);if(0===n.length)return 0;let r=(await Promise.all(n.map(async n=>{let r=await e.show(t,n);return"system/agreements.md"===n?r.split(/\r?\n/).filter(e=>void 0===$F(e.trim())).join("\n"):r}))).reduce((e,t)=>e+Buffer.byteLength(t,"utf8"),0);return Math.floor(r/4)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zigmini",
-  "version": "1.0.0-beta.3",
+  "version": "1.1.0-beta.1",
   "type": "module",
   "bin": {
     "zigmini": "bin/zigmini"
@@ -57,9 +57,11 @@
     "typecheck": "tsc --noEmit",
     "test": "bun test test/unit",
     "test:e2e": "bun test test/e2e",
-    "test:contract": "bun test test/contract",
-    "test:all": "tsc --noEmit && bun test test/unit && bun test test/contract",
+    "test:contract": "bun scripts/test-split.ts contract",
+    "test:all": "tsc --noEmit && bun scripts/test-split.ts unit && bun scripts/test-split.ts contract",
     "test:mutation": "bun scripts/mutation-run.ts",
+    "test:documents:native": "bun scripts/build-document-reader.ts --native-test",
+    "build:document-reader": "bun scripts/build-document-reader.ts",
     "heavy": "bun host/heavy-slot.ts run",
     "formal:check": "bun scripts/formal-check.ts"
   },