thwip-cli 1.3.0__tar.gz → 1.4.0__tar.gz

{thwip_cli-1.3.0 → thwip_cli-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: thwip-cli
-Version: 1.3.0
+Version: 1.4.0
 Summary: Universal coding agent multiplexer: detect, switch, and route between AI coding agents seamlessly
 Project-URL: Homepage, https://github.com/tanmayhutt/thwip-cli
 Project-URL: Repository, https://github.com/tanmayhutt/thwip-cli
@@ -46,6 +46,7 @@ Description-Content-Type: text/markdown
 ## Features
 
 - **Auto-Detection**: Discovers installed AI coding agents (Claude Code, Antigravity, Gemini CLI, OpenAI/Codex, Aider, Copilot, Cursor, Windsurf, Cline, Ollama) and configured credentials.
+- **Existing Sign-ins**: Chats through installed Codex, Claude Code, and Antigravity CLIs using their own logins and live model lists, with no API key required.
 - **Context Portability**: Switch providers with stored conversational text. Working files remain in the selected local project; they are not automatically uploaded.
 - **Handoff Preview**: Inspect text continuity, omitted state, capability changes, approximate context pressure, and a text fingerprint before switching. Runs locally without model calls.
 - **Dynamic UI**: Terminal interface adapts its status bar, capabilities, and theme based on the active provider.
@@ -81,6 +82,8 @@ Start the interactive terminal in your current project directory:
 
 ```bash
 thwip
+thwip --project ~/code/my-app   # open a specific project
+thwip --version
 ```
 
 ---
@@ -91,13 +94,13 @@ thwip
 |:---|:---|
 | `/switch [agent] [model]` | Switch active agent or model mid-conversation |
 | `/handoff [agent] [model]` | Preview a target locally without switching or sending data |
-| `/native codex` | Save and leave Thwip for the installed Codex CLI using its own authentication |
+| `/native codex` | Save and leave Thwip for the installed Codex CLI itself (launcher, no context transfer) |
 | `/agents` | Show all detected coding agents, company status, and capabilities |
 | `/models [agent]` | List available models for current or target agent |
 | `/key [provider]` | Enter an API key securely without placing it in prompt history |
 | `/status` | Display current session, project, and token stats |
 | `/limits` | View token usage, quota, and spend metrics |
-| `/detect` | Re-scan system for newly installed coding agents |
+| `/detect` | Re-scan installed agents and reconnect CLI sign-ins |
 | `/session save [name]` | Save current chat session |
 | `/session load <name>` | Load a previously saved session |
 | `/session list` | List all saved sessions |
@@ -110,23 +113,46 @@ thwip
 | `Ctrl + H` | View history |
 | `/quit` | Exit thwip |
 
-Short aliases are available for frequent commands: `/a`, `/m`, `/s`, `/k`, `/g`, and `/t`.
-
-### Existing Codex login
-
-Use `/native codex` to open the installed native CLI without configuring a Thwip API
-key. After confirmation, Thwip saves its session and replaces itself with Codex in
-the selected project, using a read-only sandbox and on-request approvals. Codex
-owns authentication, model selection, permissions, and usage limits. An expired
-or missing login must be resolved in Codex itself.
-
-This is a launcher, not an in-REPL provider adapter. Conversation history is not
-transferred, native activity is not included in Thwip usage totals, and exiting
-Codex does not automatically restart Thwip. Restart `thwip` and use `/session load`
-to resume the saved Thwip conversation. Claude and Gemini native launchers are not
-implemented. Direct API mode remains unchanged.
-
----
+Short aliases are available for frequent commands: `/a`, `/m`, `/s`, `/sw`, `/k`, `/g`, and `/t`.
+
+### Existing CLI sign-ins (no API key needed)
+
+If Codex, Claude Code, or the Antigravity CLI is installed and signed in, Thwip
+connects to it at startup and uses that sign-in for chat. No API key is copied or
+required, and Thwip never reads the CLI's stored credentials. A configured direct
+API key for the same provider always takes precedence over the native connection.
+
+| Provider | Installed CLI | Transport | Model list |
+|:---|:---|:---|:---|
+| OpenAI | `codex` | Codex App Server (JSON-RPC over stdio) | Live from `model/list` |
+| Anthropic | `claude` | Claude Code print mode (`stream-json`) | Aliases `fable`, `opus`, `sonnet`, `haiku`; explicit IDs pass through |
+| Google | `agy` (Antigravity CLI) or `gemini` | Antigravity print mode (`stream-json`) or Gemini ACP | Live from `agy models` or the ACP session |
+
+`/models` refreshes the catalog supplied by each CLI. An explicit model ID that is
+not in the catalog is passed to the CLI for validation instead of being rejected by
+a bundled list. A model available in a desktop app may still be absent from the
+installed CLI's catalog or account access.
+
+Native connections are read-only by default. Codex starts with a read-only sandbox
+and asks before operations outside it; approval requests appear in Thwip with the
+command or file list and default to denial. Claude Code and the Antigravity CLI run
+in their non-interactive print modes, where tools that would need an approval are
+declined by the CLI itself. Each turn sends the portable text conversation to a
+fresh native session, so native reasoning and tool state do not carry between turns.
+Ctrl+C interrupts the current turn and stops the child process; the unanswered
+message is removed so it can be re-sent or handed to another provider.
+
+Native billing and usage limits are managed by each CLI account. Thwip records the
+token counts the CLIs report but does not estimate cost for them. Codex and Claude
+Code also report their account usage windows (5 hour and 7 day) after each response;
+`/limits` and `/status` show the used percentage and reset time. When a CLI reports
+an exhausted usage limit, the standard failover prompt offers the other connected
+providers.
+
+`/native codex` remains available as a launcher: it saves the Thwip session and
+replaces Thwip with the Codex CLI itself in the selected project. Conversation
+history is not transferred by the launcher; use `/session load` after restarting
+Thwip to resume.
 
 ## Auditable handoffs
 
@@ -165,9 +191,9 @@ See [research and prior art](docs/handoff-research.md) for the differentiation r
 
 | Company | Agent | Capabilities |
 |:---|:---|:---|
-| Anthropic | Claude API (Fable 5, Opus 5, Sonnet 5, Haiku 4.5) | Chat, File Edit, Code Run, Terminal, Git |
-| Google | Gemini API (3.1 Pro Preview, 3.7 Flash, 3.5 Flash-Lite) | Chat, File Edit, Code Run, Terminal, Git |
-| OpenAI | OpenAI API (GPT-5.6 Sol, Terra, Luna) | Chat, File Edit, Code Run, Terminal, Git |
+| Anthropic | Claude Code sign-in, or Claude API (Fable 5, Opus 5, Sonnet 5, Haiku 4.5) | Chat, File Edit, Code Run, Terminal, Git |
+| Google | Antigravity or Gemini CLI sign-in, or Gemini API (3.1 Pro Preview, 3.7 Flash, 3.5 Flash-Lite) | Chat, File Edit, Code Run, Terminal, Git |
+| OpenAI | Codex CLI sign-in, or OpenAI API (GPT-5.6 Sol, Terra, Luna) | Chat, File Edit, Code Run, Terminal, Git |
 | DeepSeek | DeepSeek V3 / R1 Reasoner | Chat, File Edit, Code Run, Reasoning |
 | Groq | GPT-OSS 120B (default); Llama 3.3 for eligible enterprise accounts only | Chat, File Edit, Code Run |
 | Ollama | Local Models (Llama 3.3, Qwen Coder, DeepSeek R1) | Chat, File Edit, Code Run (Local, Offline) |
@@ -179,7 +205,7 @@ See [research and prior art](docs/handoff-research.md) for the differentiation r
 
 thwip auto-detects existing API keys from environment variables and existing agent configs (`~/.claude.json`, `~/.gemini/config.json`). Configuration can also be set manually:
 
-Installed apps, CLI sign-ins, and API access are separate. thwip can report a detected Claude, Gemini, or Codex CLI login, but the current SDK adapters require a provider API key. A ChatGPT, Claude, or Google subscription does not automatically provide a reusable third-party API key. Ollama needs no key when its local server is running.
+Installed CLI sign-ins and API access are separate paths. A signed-in Codex, Claude Code, or Antigravity CLI is used directly through its own protocol (see above). The direct SDK adapters for Anthropic, Google, OpenAI, DeepSeek, Groq, and OpenRouter require a provider API key. Ollama needs no key when its local server is running.
 
 ```toml
 [defaults]

{thwip_cli-1.3.0 → thwip_cli-1.4.0}/README.md

@@ -9,6 +9,7 @@
 ## Features
 
 - **Auto-Detection**: Discovers installed AI coding agents (Claude Code, Antigravity, Gemini CLI, OpenAI/Codex, Aider, Copilot, Cursor, Windsurf, Cline, Ollama) and configured credentials.
+- **Existing Sign-ins**: Chats through installed Codex, Claude Code, and Antigravity CLIs using their own logins and live model lists, with no API key required.
 - **Context Portability**: Switch providers with stored conversational text. Working files remain in the selected local project; they are not automatically uploaded.
 - **Handoff Preview**: Inspect text continuity, omitted state, capability changes, approximate context pressure, and a text fingerprint before switching. Runs locally without model calls.
 - **Dynamic UI**: Terminal interface adapts its status bar, capabilities, and theme based on the active provider.
@@ -44,6 +45,8 @@ Start the interactive terminal in your current project directory:
 
 ```bash
 thwip
+thwip --project ~/code/my-app   # open a specific project
+thwip --version
 ```
 
 ---
@@ -54,13 +57,13 @@ thwip
 |:---|:---|
 | `/switch [agent] [model]` | Switch active agent or model mid-conversation |
 | `/handoff [agent] [model]` | Preview a target locally without switching or sending data |
-| `/native codex` | Save and leave Thwip for the installed Codex CLI using its own authentication |
+| `/native codex` | Save and leave Thwip for the installed Codex CLI itself (launcher, no context transfer) |
 | `/agents` | Show all detected coding agents, company status, and capabilities |
 | `/models [agent]` | List available models for current or target agent |
 | `/key [provider]` | Enter an API key securely without placing it in prompt history |
 | `/status` | Display current session, project, and token stats |
 | `/limits` | View token usage, quota, and spend metrics |
-| `/detect` | Re-scan system for newly installed coding agents |
+| `/detect` | Re-scan installed agents and reconnect CLI sign-ins |
 | `/session save [name]` | Save current chat session |
 | `/session load <name>` | Load a previously saved session |
 | `/session list` | List all saved sessions |
@@ -73,23 +76,46 @@ thwip
 | `Ctrl + H` | View history |
 | `/quit` | Exit thwip |
 
-Short aliases are available for frequent commands: `/a`, `/m`, `/s`, `/k`, `/g`, and `/t`.
-
-### Existing Codex login
-
-Use `/native codex` to open the installed native CLI without configuring a Thwip API
-key. After confirmation, Thwip saves its session and replaces itself with Codex in
-the selected project, using a read-only sandbox and on-request approvals. Codex
-owns authentication, model selection, permissions, and usage limits. An expired
-or missing login must be resolved in Codex itself.
-
-This is a launcher, not an in-REPL provider adapter. Conversation history is not
-transferred, native activity is not included in Thwip usage totals, and exiting
-Codex does not automatically restart Thwip. Restart `thwip` and use `/session load`
-to resume the saved Thwip conversation. Claude and Gemini native launchers are not
-implemented. Direct API mode remains unchanged.
-
----
+Short aliases are available for frequent commands: `/a`, `/m`, `/s`, `/sw`, `/k`, `/g`, and `/t`.
+
+### Existing CLI sign-ins (no API key needed)
+
+If Codex, Claude Code, or the Antigravity CLI is installed and signed in, Thwip
+connects to it at startup and uses that sign-in for chat. No API key is copied or
+required, and Thwip never reads the CLI's stored credentials. A configured direct
+API key for the same provider always takes precedence over the native connection.
+
+| Provider | Installed CLI | Transport | Model list |
+|:---|:---|:---|:---|
+| OpenAI | `codex` | Codex App Server (JSON-RPC over stdio) | Live from `model/list` |
+| Anthropic | `claude` | Claude Code print mode (`stream-json`) | Aliases `fable`, `opus`, `sonnet`, `haiku`; explicit IDs pass through |
+| Google | `agy` (Antigravity CLI) or `gemini` | Antigravity print mode (`stream-json`) or Gemini ACP | Live from `agy models` or the ACP session |
+
+`/models` refreshes the catalog supplied by each CLI. An explicit model ID that is
+not in the catalog is passed to the CLI for validation instead of being rejected by
+a bundled list. A model available in a desktop app may still be absent from the
+installed CLI's catalog or account access.
+
+Native connections are read-only by default. Codex starts with a read-only sandbox
+and asks before operations outside it; approval requests appear in Thwip with the
+command or file list and default to denial. Claude Code and the Antigravity CLI run
+in their non-interactive print modes, where tools that would need an approval are
+declined by the CLI itself. Each turn sends the portable text conversation to a
+fresh native session, so native reasoning and tool state do not carry between turns.
+Ctrl+C interrupts the current turn and stops the child process; the unanswered
+message is removed so it can be re-sent or handed to another provider.
+
+Native billing and usage limits are managed by each CLI account. Thwip records the
+token counts the CLIs report but does not estimate cost for them. Codex and Claude
+Code also report their account usage windows (5 hour and 7 day) after each response;
+`/limits` and `/status` show the used percentage and reset time. When a CLI reports
+an exhausted usage limit, the standard failover prompt offers the other connected
+providers.
+
+`/native codex` remains available as a launcher: it saves the Thwip session and
+replaces Thwip with the Codex CLI itself in the selected project. Conversation
+history is not transferred by the launcher; use `/session load` after restarting
+Thwip to resume.
 
 ## Auditable handoffs
 
@@ -128,9 +154,9 @@ See [research and prior art](docs/handoff-research.md) for the differentiation r
 
 | Company | Agent | Capabilities |
 |:---|:---|:---|
-| Anthropic | Claude API (Fable 5, Opus 5, Sonnet 5, Haiku 4.5) | Chat, File Edit, Code Run, Terminal, Git |
-| Google | Gemini API (3.1 Pro Preview, 3.7 Flash, 3.5 Flash-Lite) | Chat, File Edit, Code Run, Terminal, Git |
-| OpenAI | OpenAI API (GPT-5.6 Sol, Terra, Luna) | Chat, File Edit, Code Run, Terminal, Git |
+| Anthropic | Claude Code sign-in, or Claude API (Fable 5, Opus 5, Sonnet 5, Haiku 4.5) | Chat, File Edit, Code Run, Terminal, Git |
+| Google | Antigravity or Gemini CLI sign-in, or Gemini API (3.1 Pro Preview, 3.7 Flash, 3.5 Flash-Lite) | Chat, File Edit, Code Run, Terminal, Git |
+| OpenAI | Codex CLI sign-in, or OpenAI API (GPT-5.6 Sol, Terra, Luna) | Chat, File Edit, Code Run, Terminal, Git |
 | DeepSeek | DeepSeek V3 / R1 Reasoner | Chat, File Edit, Code Run, Reasoning |
 | Groq | GPT-OSS 120B (default); Llama 3.3 for eligible enterprise accounts only | Chat, File Edit, Code Run |
 | Ollama | Local Models (Llama 3.3, Qwen Coder, DeepSeek R1) | Chat, File Edit, Code Run (Local, Offline) |
@@ -142,7 +168,7 @@ See [research and prior art](docs/handoff-research.md) for the differentiation r
 
 thwip auto-detects existing API keys from environment variables and existing agent configs (`~/.claude.json`, `~/.gemini/config.json`). Configuration can also be set manually:
 
-Installed apps, CLI sign-ins, and API access are separate. thwip can report a detected Claude, Gemini, or Codex CLI login, but the current SDK adapters require a provider API key. A ChatGPT, Claude, or Google subscription does not automatically provide a reusable third-party API key. Ollama needs no key when its local server is running.
+Installed CLI sign-ins and API access are separate paths. A signed-in Codex, Claude Code, or Antigravity CLI is used directly through its own protocol (see above). The direct SDK adapters for Anthropic, Google, OpenAI, DeepSeek, Groq, and OpenRouter require a provider API key. Ollama needs no key when its local server is running.
 
 ```toml
 [defaults]

thwip_cli-1.4.0/docs/verification.md

@@ -0,0 +1,58 @@
+# Verification status
+
+Verified locally on 2026-09-24 for the unreleased v1.4.0 source. The Python suite
+passes 216 offline tests. Exhaustive behavior across every provider and
+configuration has not been established.
+
+## Native CLI connections (2026-09-24)
+
+Live checks were run on macOS through a pseudo-terminal driving the real REPL with
+the installed Codex CLI 0.152.1, Claude Code 2.1.281, and Antigravity CLI 1.2.8,
+each using its existing sign-in. No API keys were configured.
+
+| Flow | Result |
+| --- | --- |
+| Startup discovery | All three CLIs connected; live model lists shown (Codex 4 models, Antigravity 14, Claude aliases) |
+| Chat turn per provider | Claude Code, Codex, and Antigravity each answered; text streamed into the Live view |
+| Context across `/switch` | Codex and Antigravity both recalled the answer given by the previous provider |
+| Codex approval request | A write command outside the read-only sandbox produced a permission prompt; denial left the workspace unchanged |
+| Ctrl+C during a response | Turn cancelled, child process terminated, REPL continued, unanswered message removed |
+| `/session save` and `/session load` | Session with a native provider saved and reloaded in a fresh run |
+| `/models`, `/models <provider>`, `/models <tier>` | Live catalogs listed with `CLI account` in place of API pricing |
+| `thwip --version`, `--help`, `--project` | Handled without starting the REPL; invalid project exits with code 2 |
+| `/limits` and `/status` usage windows | Codex and Claude Code account windows (5h, 7d) displayed with reset times after live turns |
+| Leftover processes | None after each run |
+
+The defect that blocked the previous attempt was the Codex sandbox value: the
+adapter sent `readOnly` and Codex rejected `thread/start` with an invalid-request
+error. The protocol enum is `read-only`. A regression test now checks the request.
+
+Remaining limitations: the Antigravity CLI showed intermittent network resets to
+Google's backend during testing, which surface as turn errors; Claude Code's model
+aliases are a curated list because the CLI exposes no model listing; native usage
+limit failover is unit-tested from error text, not observed live; the real Gemini
+CLI ACP path is covered by mocked tests only because it is not installed here.
+
+| Area | Evidence | Remaining limitation |
+| --- | --- | --- |
+| Commands and aliases | Offline command smoke tests, invalid input cases | Most smoke tests check exceptions, not all rendered content |
+| Sessions | Save/load, separate fresh conversations, malformed metadata, permissions, project rebinding | Concurrent writes to the same explicitly named session are not coordinated |
+| Provider switching and handoff | All seven provider catalogs, portable history, bounded failover | Live account quotas and model availability unverified |
+| Tool execution | Real temporary-file operations, path containment, process timeout/cancellation, invalid arguments | Shell and code tools retain local user privileges; output capture memory is unbounded |
+| Native Codex launcher | Save-before-launch, consent, flags, missing binary, terminal checks, failures | Mocked process replacement; no conversation transfer |
+| Native CLI connections | Live REPL runs above; mocked protocol tests for approvals, failures, limits, prompt building, discovery parsing | Gemini ACP path mocked only; live limit failover not observed |
+| Provider responses | Mocked native tool continuations; DeepSeek/Groq/OpenRouter streaming, usage-only chunks, 429/500 errors and serialized tool arguments | Other streaming and error branches still have coverage gaps |
+| Display/config/auth | Configuration validation, display settings, credential boundaries, short-key masking | No full terminal/platform matrix |
+| Usage | Atomic writes, malformed records, valid totals | Unknown catalog pricing may appear as zero estimated cost |
+| Website | Production build and deterministic demo completion/replay test | Real browser, layout, clipboard, keyboard and accessibility checks remain incomplete |
+| Dependencies | npm audit: zero advisories; Python installed-dependency audit: none found | Python audit skipped legacy local `thwip 1.0.0` metadata |
+| Packaging | Wheel/source build and metadata checks | Publication is separately verified through the release workflow |
+
+The Python suite measured 69% statement coverage with 160 passing tests before
+the final credential-masking tests were added. Coverage is diagnostic evidence,
+not proof that every feature works. The website test uses a minimal DOM stand-in
+and controlled timers, not a browser.
+
+This pass fixed default-session save collisions, malformed session/message
+metadata acceptance, tool-argument display crashes, Rich markup interpretation
+in action output, and short-key masking leakage.

{thwip_cli-1.3.0 → thwip_cli-1.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "thwip-cli"
-version = "1.3.0"
+version = "1.4.0"
 description = "Universal coding agent multiplexer: detect, switch, and route between AI coding agents seamlessly"
 readme = "README.md"
 license = "MIT"

{thwip_cli-1.3.0 → thwip_cli-1.4.0}/tests/test_audit_regressions.py

@@ -20,6 +20,9 @@ def cli(tmp_path, monkeypatch):
     cli = ThwipCLI.__new__(ThwipCLI)
     cli.config = ThwipConfig(project=str(tmp_path), auto_save=False)
     cli.registry = AgentRegistry(cli.config)
+    async def no_native_discovery(project):
+        return None
+    monkeypatch.setattr(cli.registry, 'connect_native_agents', no_native_discovery)
     for a in cli.registry.list_agents():
         monkeypatch.setattr(a, 'is_installed', lambda: True)
         monkeypatch.setattr(a, 'is_configured', lambda: False)
@@ -162,3 +165,41 @@ async def test_failover_does_not_retry_already_failed_provider(cli, monkeypatch)
     cli.config.limits.auto_switch = True
     await cli.process_user_message('hello')
     assert len(attempts) <= len(agents), f'Repeated failed providers: {attempts}'
+
+
+def test_main_handles_version_and_help_without_starting_the_repl(capsys):
+    from thwip import __version__
+    from thwip import cli as cli_module
+
+    with pytest.raises(SystemExit) as exit_info:
+        cli_module.main(['--version'])
+    assert exit_info.value.code == 0 and f'thwip {__version__}' in capsys.readouterr().out
+    with pytest.raises(SystemExit) as exit_info:
+        cli_module.main(['--help'])
+    assert exit_info.value.code == 0 and '--project' in capsys.readouterr().out
+    with pytest.raises(SystemExit) as exit_info:
+        cli_module.main(['--project', '/definitely/missing/dir'])
+    assert exit_info.value.code == 2
+
+
+@pytest.mark.asyncio
+async def test_failed_turn_removes_unanswered_user_message(cli, monkeypatch):
+    class Broken:
+        name = 'openai'
+        display_name = 'Broken'
+        company = 'OpenAI'
+        native_tools = True
+        project = '.'
+        def is_configured(self):
+            return True
+        def is_installed(self):
+            return True
+        def get_capabilities_for_model(self, model):
+            return set()
+        async def chat(self, **kwargs):
+            raise RuntimeError('Native CLI rejected thread/start')
+            yield
+    cli.current_agent = Broken()
+    cli.session.current_agent = 'openai'
+    await cli.process_user_message('hello')
+    assert cli.session.messages == []

{thwip_cli-1.3.0 → thwip_cli-1.4.0}/tests/test_cli.py

@@ -115,11 +115,12 @@ async def test_unconfigured_agent_shows_setup_guidance(tmp_path):
     assert len(cli.session.messages) == 0
 
 
-def test_inline_api_key_is_rejected():
+@pytest.mark.asyncio
+async def test_inline_api_key_is_rejected():
     cli = ThwipCLI.__new__(ThwipCLI)
     cli.config = SimpleNamespace(keys={}, key_sources={}, save=lambda: None)
 
-    cli.cmd_auth_config("openai", "secret-value")
+    await cli.cmd_auth_config("openai", "secret-value")
 
     assert cli.config.keys == {}
     assert cli.config.key_sources == {}

thwip_cli-1.4.0/tests/test_native_agents.py

@@ -0,0 +1,198 @@
+"""Native protocol behavior without credentials or model requests."""
+
+import asyncio
+
+import pytest
+
+from thwip.agents.base import AgentDone, LimitHit, LimitStatus, ModelInfo, NativePermission, TextDelta
+from thwip.agents.native_agent import NativeAgent
+
+
+class FakeRPC:
+    def __init__(self, provider, failure=False):
+        self.events = asyncio.Queue()
+        self.requests = []
+        self.sent = []
+        self.closed = False
+        self.provider = provider
+        self.failure = failure
+
+    async def request(self, method, params, **kwargs):
+        self.requests.append((method, params))
+        if method == 'account/read':
+            return {'account': {'type': 'chatgpt'}}
+        if method == 'model/list':
+            return {'data': [{'model': 'future-model', 'displayName': 'Future', 'isDefault': True}]}
+        if method == 'session/new':
+            return {'sessionId': 's', 'models': {'currentModelId': 'future-model',
+                    'availableModels': [{'modelId': 'future-model', 'name': 'Future'}]}}
+        if method == 'thread/start':
+            return {'thread': {'id': 't'}}
+        if method == 'turn/start':
+            await self.events.put({'id': 99, 'method': 'item/commandExecution/requestApproval',
+                                   'params': {'command': 'touch example'}})
+            return {}
+        if method == 'session/prompt':
+            await self.events.put({'id': 99, 'method': 'session/request_permission', 'params': {
+                'toolCall': {'title': 'Edit'}, 'options': [
+                    {'kind': 'allow_once', 'optionId': 'yes'}, {'kind': 'reject_once', 'optionId': 'no'}]}})
+            while not self.sent:
+                await asyncio.sleep(0)
+            await self.events.put({'method': 'session/update', 'params': {'update': {
+                'sessionUpdate': 'agent_message_chunk', 'content': {'type': 'text', 'text': 'done'}}}})
+            return {'stopReason': 'end_turn'}
+        return {}
+
+    async def send(self, message):
+        self.sent.append(message)
+        if self.provider == 'openai':
+            await self.events.put({'method': 'item/agentMessage/delta', 'params': {'itemId': 'a', 'delta': 'done'}})
+            await self.events.put({'method': 'turn/completed', 'params': {
+                'turn': {'status': 'failed' if self.failure else 'completed'}}})
+
+    async def close(self):
+        self.closed = True
+
+
+@pytest.mark.parametrize('provider', ['openai', 'google'])
+@pytest.mark.asyncio
+async def test_discovered_models_replace_bundled_catalog(provider, monkeypatch):
+    agent = NativeAgent(provider, '.')
+    rpc = FakeRPC(provider)
+    async def connect():
+        return rpc
+    monkeypatch.setattr(agent, '_connect', connect)
+    await agent.refresh_models()
+    assert agent.ready and agent.get_default_model() == 'future-model'
+    assert agent.get_model_info('explicit-new-model').id == 'explicit-new-model'
+    assert rpc.closed
+
+
+@pytest.mark.parametrize('provider', ['openai', 'google'])
+@pytest.mark.parametrize('approve', [False, True])
+@pytest.mark.asyncio
+async def test_native_permission_response_and_completion(provider, approve, monkeypatch):
+    agent = NativeAgent(provider, '.')
+    rpc = FakeRPC(provider)
+    async def connect():
+        return rpc
+    monkeypatch.setattr(agent, '_connect', connect)
+    events = []
+    async for event in agent.chat([{'role': 'user', 'content': 'hello'}], model='future-model'):
+        events.append(event)
+        if isinstance(event, NativePermission):
+            event.approved = approve
+    assert any(isinstance(event, TextDelta) and event.content == 'done' for event in events)
+    assert isinstance(events[-1], AgentDone)
+    response = rpc.sent[0]['result']
+    if provider == 'openai':
+        assert response['decision'] == ('accept' if approve else 'decline')
+    else:
+        assert response['outcome']['optionId'] == ('yes' if approve else 'no')
+    assert rpc.closed
+
+
+@pytest.mark.asyncio
+async def test_failed_turn_never_emits_success(monkeypatch):
+    agent = NativeAgent('openai', '.')
+    rpc = FakeRPC('openai', failure=True)
+    async def connect():
+        return rpc
+    monkeypatch.setattr(agent, '_connect', connect)
+    events = []
+    with pytest.raises(RuntimeError, match='could not complete'):
+        async for event in agent.chat([], model='future-model'):
+            events.append(event)
+    assert not any(isinstance(event, AgentDone) for event in events)
+    assert rpc.closed
+
+
+@pytest.mark.asyncio
+async def test_discovery_failure_marks_connection_unready(monkeypatch):
+    agent = NativeAgent('google', '.')
+    async def connect():
+        raise TimeoutError()
+    monkeypatch.setattr(agent, '_connect', connect)
+    await agent.refresh_models()
+    assert not agent.ready and 'timed out' in agent.discovery_error
+
+
+@pytest.mark.asyncio
+async def test_codex_thread_uses_protocol_sandbox_spelling(monkeypatch):
+    """Codex App Server rejects camelCase sandbox modes with an invalid-request error."""
+    agent = NativeAgent('openai', '.')
+    rpc = FakeRPC('openai')
+    async def connect():
+        return rpc
+    monkeypatch.setattr(agent, '_connect', connect)
+    async for _ in agent.chat([{'role': 'user', 'content': 'hello'}], model='future-model', system_prompt='Be terse.'):
+        pass
+    _method, params = next(request for request in rpc.requests if request[0] == 'thread/start')
+    assert params['sandbox'] == 'read-only' and params['approvalPolicy'] == 'on-request'
+    assert params['developerInstructions'] == 'Be terse.'
+    turn = next(params for method, params in rpc.requests if method == 'turn/start')
+    assert turn['input'][0]['text'] == 'hello'
+
+
+@pytest.mark.asyncio
+async def test_codex_usage_limit_failure_becomes_limit_hit(monkeypatch):
+    agent = NativeAgent('openai', '.')
+    rpc = FakeRPC('openai')
+    async def send(message):
+        rpc.sent.append(message)
+        await rpc.events.put({'method': 'turn/completed', 'params': {'turn': {
+            'status': 'failed', 'error': {'message': 'You have hit your usage limit.'}}}})
+    rpc.send = send
+    async def connect():
+        return rpc
+    monkeypatch.setattr(agent, '_connect', connect)
+    events = [event async for event in agent.chat([{'role': 'user', 'content': 'hi'}], model='future-model')]
+    assert isinstance(events[-1], LimitHit) and events[-1].error_type == LimitStatus.QUOTA_EXHAUSTED
+    assert rpc.closed
+
+
+def test_permission_descriptions_are_readable_and_scrubbed():
+    from thwip.agents.native_agent import describe_permission
+
+    text = describe_permission({"type": "commandExecution", "command": "curl -H 'Authorization: Bearer " + "k" * 40 + "'",
+                                "cwd": "/repo", "reason": "Fetch data"}, "Codex")
+    assert text.startswith("Codex wants to run a command.") and "Directory: /repo" in text and "Reason:    Fetch data" in text
+    assert "kkkk" not in text and "[redacted]" in text
+    files = describe_permission({"type": "fileChange", "changes": [{"path": "a.py", "kind": "update"}]}, "Codex")
+    assert "wants to change files" in files and "a.py (update)" in files
+    assert "Gemini requests permission for Edit" in describe_permission({"title": "Edit"}, "Gemini")
+
+
+def test_handoff_accepts_explicit_native_model_ids():
+    from thwip.handoff import build_handoff_report, local_model
+    from thwip.session import Session
+
+    agent = NativeAgent('openai', '.')
+    agent.available_models = [ModelInfo(id='listed', name='Listed', is_default=True)]
+    assert local_model(agent, 'listed').name == 'Listed'
+    assert local_model(agent, 'brand-new').id == 'brand-new'
+    assert local_model(agent, 'has space') is None
+    session = Session(current_agent='openai', current_model='listed')
+    report = build_handoff_report(session, agent, agent, 'brand-new')
+    assert report.target == 'openai/brand-new' and report.context_pressure == 'unknown'
+
+
+@pytest.mark.asyncio
+async def test_codex_rate_limit_notification_is_recorded(monkeypatch):
+    agent = NativeAgent('openai', '.')
+    rpc = FakeRPC('openai')
+    async def send(message):
+        rpc.sent.append(message)
+        await rpc.events.put({'method': 'account/rateLimits/updated', 'params': {'rateLimits': {
+            'primary': {'usedPercent': 2, 'windowDurationMins': 300, 'resetsAt': 1790212672},
+            'secondary': {'usedPercent': 23, 'windowDurationMins': 10080}}}})
+        await rpc.events.put({'method': 'turn/completed', 'params': {'turn': {'status': 'completed'}}})
+    rpc.send = send
+    async def connect():
+        return rpc
+    monkeypatch.setattr(agent, '_connect', connect)
+    events = [event async for event in agent.chat([{'role': 'user', 'content': 'hi'}], model='future-model')]
+    assert isinstance(events[-1], AgentDone)
+    assert agent.limit_windows == [
+        {'label': '5h', 'used_percent': 2, 'resets_at': 1790212672},
+        {'label': '7d', 'used_percent': 23, 'resets_at': None}]