xdog-coding 2.4.2__tar.gz → 2.4.3__tar.gz

xdog_coding-2.4.2/README.md → xdog_coding-2.4.3/PKG-INFO

@@ -1,3 +1,35 @@
+Metadata-Version: 2.5
+Name: xdog-coding
+Version: 2.4.3
+Summary: Interactive coding agent CLI
+Project-URL: Homepage, https://xdog.942295.xyz
+Project-URL: Repository, https://github.com/litterzhang/xdog
+Project-URL: Documentation, https://xdog.942295.xyz
+Project-URL: Issues, https://github.com/litterzhang/xdog/issues
+Author: HugeMan
+License-Expression: AGPL-3.0-or-later
+License-File: LICENSE
+License-File: LICENSE-EXCEPTION.md
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: agent-client-protocol<0.13,>=0.12.1; python_version < '3.15'
+Requires-Dist: click>=8.1.0
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: xdog-agent>=2.4.3
+Requires-Dist: xdog-ai[openai]>=2.4.3
+Requires-Dist: xdog-tui>=2.4.3
+Provides-Extra: skills
+Requires-Dist: xdog-skills>=2.4.3; extra == 'skills'
+Description-Content-Type: text/markdown
+
 # xdog-coding
 
 > Platform scope: **Linux only**. Non-Linux adapters and native-platform support
@@ -548,7 +580,8 @@ continuation silently reconnects, replays POSTs or expands configured disclosure
 
 ### Task planning and host read-only scope
 
-The builtin **`xdog-planning`** skill uses ordinary conversation or task documents
+The builtin **`xdog-planning`** skill, supplied by `xdog-skills` (install the
+`skills` extra), uses ordinary conversation or task documents
 for objectives, dependencies, acceptance criteria and evidence-backed progress.
 It does not create a separate plan database, inspector, execution mode or model
 loop. The former `/plan`, `PlanPanel` and `update_plan` UI/tool APIs are removed.
@@ -745,7 +778,7 @@ none of these interfaces grants tool permission or full Pi API compatibility.
 
 ### Supervised child agents
 
-`/agents start TASK` starts bounded read-only child work. `/agents start --inherit
+`/agents start TASK` starts host-managed read-only child work. `/agents start --inherit
 TASK` inherits the current host policy; it does not copy approval grants or bypass
 read-only. Inspect with `/agents list` or `/agents inspect ID`; use `steer ID TEXT`,
 `follow-up ID TEXT`, `cancel ID`, `wait ID` and `close ID` under `/agents`.
@@ -754,10 +787,34 @@ recursively delegate through their parent's supervision tools.
 
 Children share the workspace, so coordinate conflicting writes. Context is copied
 at admission through a complete tool/result checkpoint. Model/options/tool execution
-mode are inherited. Defaults are three active children, 16 retained records,
-120-second execution deadline, 16 model calls and a 32,000 reported-token stop
-threshold—not exact billing. Output limits are clamped; input accounting can
-overshoot on the final request. Cleanup/persistence may outlast the execution deadline.
+mode are inherited. There is no fixed concurrent-child or retained-record count
+limit, elapsed-time deadline, model-call cap or cumulative reported-token stop
+threshold. The main Agent/host manages lifecycle with cancel/wait/close. Usage
+counters remain reported usage, not exact billable accounting; actual model
+output/context limits, permissions and message/input/image/per-file capacities
+still apply. Complete history uses atomic segmented persistence instead of a
+cumulative 512 KiB / 2,000-message execution cutoff; tool/result pairs are not
+silently truncated.
+
+Coding and Claw child factories explicitly enable the Agent's existing built-in
+compaction policy through `AgentConfig(compaction=selected.compaction(child_stream))`
+and provide `archive_compaction=store.archive_compaction` to the supervisor.
+This does **not** change the generic Agent default: automatic compaction is off
+unless explicitly configured. The selected helper uses the executing adapter's
+real context/prompt/output capacity; unknown metadata, context capacity or output
+reserve returns `None` (auto-compaction remains off), not a guessed fallback.
+A host requiring automatic compaction must reject that case or explicitly supply
+trusted capacity/reserve through native `CompactionConfig`.
+
+With the policy enabled, one long tool turn can compact repeatedly at safe paired
+boundaries. The supervisor waits for a durable full pre-compaction snapshot before
+the native summary request starts. Archive, summary or stream-cleanup failure does
+not commit a history cut, and cancellation settles owned writes/cleanup. The native
+summary's per-request timeout/capacity checks remain; there is no replacement child
+lifetime cap. Inspect shows the current retained context, possibly with summaries;
+`children.store.compaction_archives(child_id)` reads full earlier snapshots without
+replay. These child archives are separate from the parent session's `/tree`
+compaction checkpoints.
 
 Each child has independent Coding approvals and extension workers/state. Parent
 validation/context hooks and current read-only/permission gates remain authoritative;
@@ -800,10 +857,10 @@ still uses silent no-UI answers to avoid borrowing its separate dialog reservati
 Complex extension forms are removed; basic child dialogs retain these ownership and cancellation checks.
 
 
-### Child specialization and limits
+### Child specialization and protocol limits
 
 `/agents start --label Reviewer --instructions "Inspect only" --tools filesystem,current_time
---fresh --timeout 60 --calls 4 --tokens 8000 -- TASK` specializes a child without
+--fresh -- TASK` specializes a child without
 changing parent permissions. Options precede the task; `--` preserves a task that
 starts with flags. Plain tasks preserve quotes/newlines. `--tools none` gives the
 child no executable tools; otherwise selected names must exist in its inherited tool
@@ -812,11 +869,15 @@ fail visibly. Instructions append to, rather than replace, parent restrictions.
 
 In `/agents` press `n`, then Ctrl+G for settings JSON. Supported keys are `label`,
 `instructions`, `tools` (array or null for inherited tools), `inherit_context`,
-`timeout`, `max_model_calls` and `max_tokens`. Enter applies the settings draft only;
+`model`, `thinking` and `preset`. Enter applies the settings draft only;
 start review requires every page to be painted before confirmation. Resize invalidates
 that review. This confirmation does NOT approve tool use. Effective settings persist
-with child results and appear in complete child source. Request/token caps may be
-lowered, not raised above 16 / 32,000; token usage is not exact billable accounting.
+with child results and appear in complete child source. Runtime budget options
+`--timeout`, `--calls`, `--tokens` and config/preset keys `timeout`, `max_model_calls`,
+`max_tokens` are removed and rejected for new starts. Historical child records with
+these budget fields remain readable; the fields are inert and never reapply a
+budget or restart work. This removal does not remove the actual model's per-request
+output token ceiling.
 `--fresh` omits canonical history/child entry inheritance, not mandatory parent
 validation/context or the shared workspace. Model/reasoning inherit by default; explicit overrides now use the actual adapter.
 Named presets now use explicit user configuration. Claw specialized
@@ -840,9 +901,12 @@ host native-tool overrides. Switching to a nonreasoning model disables inherited
 reasoning; unsupported positive choices fail visibly. Model switches omit inherited/
 transformed provider continuity and old reasoning from the CHILD copy, leaving parent
 provenance/history intact. Transformed images are validated; oversized switched-model
-contexts fail a conservative byte-based preflight with fresh/lower-output/larger-model
-guidance, not automatic summarization or exact token accounting. Parent model/options/
-settings/grants never change. Named presets now use explicit user configuration.
+contexts use the same built-in text-token estimate as native compaction, rather
+than comparing text bytes to token capacity. This is not exact tokenizer accounting.
+Host-enabled compaction runs before forwarding the next model request; context that
+cannot be safely compacted or fit still fails explicitly with original history
+retained. Image/capability and actual output limits remain enforced. Parent
+model/options/settings/grants never change. Named presets use explicit user configuration.
 
 
 ### Named child presets
@@ -859,15 +923,14 @@ using this descriptor shape:
         "instructions": "Review requested code; return findings with file locations.",
         "tools": ["filesystem", "current_time"],
         "inherit_context": false,
-        "max_model_calls": 4,
-        "max_tokens": 8000
+        "label": "Reviewer"
       }
     }
   }
 }
 ```
 
-Browse `/agents presets`, or use `/agents start --preset reviewer --tokens 6000 --
+Browse `/agents presets`, or use `/agents start --preset reviewer --label Audit --
 TASK`. Explicit flags override template fields. Ctrl+P selects a template in a new
 child form, Ctrl+G adjusts the draft, and full expanded settings/task review still
 precedes execution. Selection itself makes no model request. Templates cannot encode

xdog_coding-2.4.2/PKG-INFO → xdog_coding-2.4.3/README.md

@@ -1,33 +1,3 @@
-Metadata-Version: 2.5
-Name: xdog-coding
-Version: 2.4.2
-Summary: Interactive coding agent CLI
-Project-URL: Homepage, https://xdog.942295.xyz
-Project-URL: Repository, https://github.com/litterzhang/xdog
-Project-URL: Documentation, https://xdog.942295.xyz
-Project-URL: Issues, https://github.com/litterzhang/xdog/issues
-Author: HugeMan
-License-Expression: AGPL-3.0-or-later
-License-File: LICENSE
-License-File: LICENSE-EXCEPTION.md
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Intended Audience :: Developers
-Classifier: Operating System :: POSIX :: Linux
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Topic :: Software Development :: Libraries
-Classifier: Typing :: Typed
-Requires-Python: >=3.12
-Requires-Dist: agent-client-protocol<0.13,>=0.12.1; python_version < '3.15'
-Requires-Dist: click>=8.1.0
-Requires-Dist: pydantic>=2.0
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: xdog-agent>=2.4.2
-Requires-Dist: xdog-ai[openai]>=2.4.2
-Requires-Dist: xdog-tui>=2.4.2
-Description-Content-Type: text/markdown
-
 # xdog-coding
 
 > Platform scope: **Linux only**. Non-Linux adapters and native-platform support
@@ -578,7 +548,8 @@ continuation silently reconnects, replays POSTs or expands configured disclosure
 
 ### Task planning and host read-only scope
 
-The builtin **`xdog-planning`** skill uses ordinary conversation or task documents
+The builtin **`xdog-planning`** skill, supplied by `xdog-skills` (install the
+`skills` extra), uses ordinary conversation or task documents
 for objectives, dependencies, acceptance criteria and evidence-backed progress.
 It does not create a separate plan database, inspector, execution mode or model
 loop. The former `/plan`, `PlanPanel` and `update_plan` UI/tool APIs are removed.
@@ -775,7 +746,7 @@ none of these interfaces grants tool permission or full Pi API compatibility.
 
 ### Supervised child agents
 
-`/agents start TASK` starts bounded read-only child work. `/agents start --inherit
+`/agents start TASK` starts host-managed read-only child work. `/agents start --inherit
 TASK` inherits the current host policy; it does not copy approval grants or bypass
 read-only. Inspect with `/agents list` or `/agents inspect ID`; use `steer ID TEXT`,
 `follow-up ID TEXT`, `cancel ID`, `wait ID` and `close ID` under `/agents`.
@@ -784,10 +755,34 @@ recursively delegate through their parent's supervision tools.
 
 Children share the workspace, so coordinate conflicting writes. Context is copied
 at admission through a complete tool/result checkpoint. Model/options/tool execution
-mode are inherited. Defaults are three active children, 16 retained records,
-120-second execution deadline, 16 model calls and a 32,000 reported-token stop
-threshold—not exact billing. Output limits are clamped; input accounting can
-overshoot on the final request. Cleanup/persistence may outlast the execution deadline.
+mode are inherited. There is no fixed concurrent-child or retained-record count
+limit, elapsed-time deadline, model-call cap or cumulative reported-token stop
+threshold. The main Agent/host manages lifecycle with cancel/wait/close. Usage
+counters remain reported usage, not exact billable accounting; actual model
+output/context limits, permissions and message/input/image/per-file capacities
+still apply. Complete history uses atomic segmented persistence instead of a
+cumulative 512 KiB / 2,000-message execution cutoff; tool/result pairs are not
+silently truncated.
+
+Coding and Claw child factories explicitly enable the Agent's existing built-in
+compaction policy through `AgentConfig(compaction=selected.compaction(child_stream))`
+and provide `archive_compaction=store.archive_compaction` to the supervisor.
+This does **not** change the generic Agent default: automatic compaction is off
+unless explicitly configured. The selected helper uses the executing adapter's
+real context/prompt/output capacity; unknown metadata, context capacity or output
+reserve returns `None` (auto-compaction remains off), not a guessed fallback.
+A host requiring automatic compaction must reject that case or explicitly supply
+trusted capacity/reserve through native `CompactionConfig`.
+
+With the policy enabled, one long tool turn can compact repeatedly at safe paired
+boundaries. The supervisor waits for a durable full pre-compaction snapshot before
+the native summary request starts. Archive, summary or stream-cleanup failure does
+not commit a history cut, and cancellation settles owned writes/cleanup. The native
+summary's per-request timeout/capacity checks remain; there is no replacement child
+lifetime cap. Inspect shows the current retained context, possibly with summaries;
+`children.store.compaction_archives(child_id)` reads full earlier snapshots without
+replay. These child archives are separate from the parent session's `/tree`
+compaction checkpoints.
 
 Each child has independent Coding approvals and extension workers/state. Parent
 validation/context hooks and current read-only/permission gates remain authoritative;
@@ -830,10 +825,10 @@ still uses silent no-UI answers to avoid borrowing its separate dialog reservati
 Complex extension forms are removed; basic child dialogs retain these ownership and cancellation checks.
 
 
-### Child specialization and limits
+### Child specialization and protocol limits
 
 `/agents start --label Reviewer --instructions "Inspect only" --tools filesystem,current_time
---fresh --timeout 60 --calls 4 --tokens 8000 -- TASK` specializes a child without
+--fresh -- TASK` specializes a child without
 changing parent permissions. Options precede the task; `--` preserves a task that
 starts with flags. Plain tasks preserve quotes/newlines. `--tools none` gives the
 child no executable tools; otherwise selected names must exist in its inherited tool
@@ -842,11 +837,15 @@ fail visibly. Instructions append to, rather than replace, parent restrictions.
 
 In `/agents` press `n`, then Ctrl+G for settings JSON. Supported keys are `label`,
 `instructions`, `tools` (array or null for inherited tools), `inherit_context`,
-`timeout`, `max_model_calls` and `max_tokens`. Enter applies the settings draft only;
+`model`, `thinking` and `preset`. Enter applies the settings draft only;
 start review requires every page to be painted before confirmation. Resize invalidates
 that review. This confirmation does NOT approve tool use. Effective settings persist
-with child results and appear in complete child source. Request/token caps may be
-lowered, not raised above 16 / 32,000; token usage is not exact billable accounting.
+with child results and appear in complete child source. Runtime budget options
+`--timeout`, `--calls`, `--tokens` and config/preset keys `timeout`, `max_model_calls`,
+`max_tokens` are removed and rejected for new starts. Historical child records with
+these budget fields remain readable; the fields are inert and never reapply a
+budget or restart work. This removal does not remove the actual model's per-request
+output token ceiling.
 `--fresh` omits canonical history/child entry inheritance, not mandatory parent
 validation/context or the shared workspace. Model/reasoning inherit by default; explicit overrides now use the actual adapter.
 Named presets now use explicit user configuration. Claw specialized
@@ -870,9 +869,12 @@ host native-tool overrides. Switching to a nonreasoning model disables inherited
 reasoning; unsupported positive choices fail visibly. Model switches omit inherited/
 transformed provider continuity and old reasoning from the CHILD copy, leaving parent
 provenance/history intact. Transformed images are validated; oversized switched-model
-contexts fail a conservative byte-based preflight with fresh/lower-output/larger-model
-guidance, not automatic summarization or exact token accounting. Parent model/options/
-settings/grants never change. Named presets now use explicit user configuration.
+contexts use the same built-in text-token estimate as native compaction, rather
+than comparing text bytes to token capacity. This is not exact tokenizer accounting.
+Host-enabled compaction runs before forwarding the next model request; context that
+cannot be safely compacted or fit still fails explicitly with original history
+retained. Image/capability and actual output limits remain enforced. Parent
+model/options/settings/grants never change. Named presets use explicit user configuration.
 
 
 ### Named child presets
@@ -889,15 +891,14 @@ using this descriptor shape:
         "instructions": "Review requested code; return findings with file locations.",
         "tools": ["filesystem", "current_time"],
         "inherit_context": false,
-        "max_model_calls": 4,
-        "max_tokens": 8000
+        "label": "Reviewer"
       }
     }
   }
 }
 ```
 
-Browse `/agents presets`, or use `/agents start --preset reviewer --tokens 6000 --
+Browse `/agents presets`, or use `/agents start --preset reviewer --label Audit --
 TASK`. Explicit flags override template fields. Ctrl+P selects a template in a new
 child form, Ctrl+G adjusts the draft, and full expanded settings/task review still
 precedes execution. Selection itself makes no model request. Templates cannot encode

{xdog_coding-2.4.2 → xdog_coding-2.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "xdog-coding"
-version = "2.4.2"
+version = "2.4.3"
 description = "Interactive coding agent CLI"
 requires-python = ">=3.12"
 classifiers = [
@@ -22,15 +22,18 @@ readme = "README.md"
 license = "AGPL-3.0-or-later"
 license-files = ["LICENSE", "LICENSE-EXCEPTION.md"]
 dependencies = [
-    "xdog-ai[openai]>=2.4.2",
-    "xdog-agent>=2.4.2",
+    "xdog-ai[openai]>=2.4.3",
+    "xdog-agent>=2.4.3",
     "agent-client-protocol>=0.12.1,<0.13; python_version < '3.15'",
-    "xdog-tui>=2.4.2",
+    "xdog-tui>=2.4.3",
     "pyyaml>=6.0",
     "click>=8.1.0",
     "pydantic>=2.0",
 ]
 
+[project.optional-dependencies]
+skills = ["xdog-skills>=2.4.3"]
+
 [project.urls]
 Homepage = "https://xdog.942295.xyz"
 Repository = "https://github.com/litterzhang/xdog"

{xdog_coding-2.4.2 → xdog_coding-2.4.3}/src/xdog/coding/__init__.py

@@ -1,3 +1,3 @@
 """coding - Interactive coding agent CLI."""
 
-__version__ = "2.4.2"
+__version__ = "2.4.3"

{xdog_coding-2.4.2 → xdog_coding-2.4.3}/src/xdog/coding/config.py

@@ -37,7 +37,7 @@ def validate_max_messages_per_turn(value: object) -> int:
 
 MONOREPO_NAME = "xdog"
 APP_NAME = "coding"
-VERSION = "2.4.2"
+VERSION = "2.4.3"
 PROJECT_DIR_NAME = ".coding"
 ENV_OVERRIDE = "CODING_DIR"
 

{xdog_coding-2.4.2 → xdog_coding-2.4.3}/src/xdog/coding/core/agent_session.py

@@ -10,6 +10,7 @@ import uuid
 from collections.abc import Awaitable, Callable
 from dataclasses import dataclass, field, replace
 from functools import wraps
+from importlib.util import find_spec
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Concatenate, ParamSpec, TypeVar
 
@@ -55,6 +56,7 @@ from xdog.coding.core.system_prompt import build_system_prompt
 if TYPE_CHECKING:
     from concurrent.futures import Future
 
+    from xdog.coding.core.goal_adapter import CodingGoalHost
     from xdog.coding.core.session_staging import StagedExtensions
     from xdog.coding.core.sessions.batches import TurnInput
     from xdog.coding.core.sessions.controller import SessionController
@@ -80,11 +82,14 @@ def _idle_change(method: Callable[Concatenate["AgentSession", P], R]) -> Callabl
             async def owned() -> R:
                 return wrapped(self, *args, **kwargs)
             try:
-                same_loop = asyncio.get_running_loop() is controller._loop
+                asyncio.get_running_loop()
             except RuntimeError:
-                same_loop = False
-            if same_loop:
-                raise RuntimeError("Session controls must be submitted to the session owner")
+                pass
+            else:
+                # A synchronous wait would block this caller's loop, which may
+                # own the admitted producer's completion/cancellation signal.
+                raise RuntimeError("Session controls must be submitted to the session owner; "
+                                   "use an owner operation or asyncio.to_thread from async callers")
             borrowed = runtime is None
             if borrowed:
                 with self._sdk_lock:
@@ -144,6 +149,7 @@ def _idle_change(method: Callable[Concatenate["AgentSession", P], R]) -> Callabl
                         async def rebind_sdk() -> None:
                             from xdog.coding.core.sessions.store import InputStore
                             await asyncio.wrap_future(discarded)
+                            await self._settle_retired_goals()
                             previous = controller.inbox
                             if previous is not None:
                                 await previous.retire()
@@ -194,6 +200,11 @@ class AgentSession:
     _sdk_closing: Future[None] | None = field(default=None, init=False, repr=False)
     _sdk_retiring_leases: set[SessionLease] = field(default_factory=set, init=False, repr=False)
     _sdk_disposing: bool = field(default=False, init=False, repr=False)
+    _retired_goal_hosts: list[CodingGoalHost] = field(default_factory=list, init=False, repr=False)
+    _goal_start: asyncio.Task[None] | None = field(default=None, init=False, repr=False)
+    _user_prompt_messages: dict[int, UserMessage] = field(default_factory=dict, init=False, repr=False)
+    _authorized_messages: dict[int, UserMessage] = field(default_factory=dict, init=False, repr=False)
+    _user_operation_authorized: bool = field(default=False, init=False, repr=False)
     _sdk_lock: threading.Lock = field(default_factory=threading.Lock, init=False, repr=False)
     _lease: SessionLease | None = field(default=None, init=False, repr=False)
     _pending_lease: SessionLease | None = field(default=None, init=False, repr=False)
@@ -259,13 +270,17 @@ class AgentSession:
 
     async def _transform_user_input(self, message: UserMessage, source: str,
                                     cancel: asyncio.Event | None = None) -> UserMessage | HandledInput:
+        authorized = self._user_prompt_messages.get(id(message)) is message
         try:
             if self._base_input_transform is not None:
                 value = await self._base_input_transform(message, source, cancel)
                 if isinstance(value, HandledInput):
                     return value
                 message = value
-            return await self.extensions.input(message, source, channel="coding")
+            value = await self.extensions.input(message, source, channel="coding")
+            if authorized and isinstance(value, UserMessage):
+                self._authorized_messages[id(value)] = value
+            return value
         finally:
             await self._sync_extension_tools()
 
@@ -321,7 +336,8 @@ class AgentSession:
 
     def _load_children(self) -> None:
         self.children = CodingChildren(self)
-        base = tuple(tool for tool in self.agent.state.tools if tool.name not in {"agent_spawn", "agent_control"})
+        base = tuple(tool for tool in self.agent.state.tools if tool.name not in {"agent_spawn", "agent_control"}
+                     and not any(tool is host.tool for host in self._retired_goal_hosts))
         self.agent.set_tools((*base, *self.children.supervisor.tools()))
 
     def _children_idle(self) -> None:
@@ -374,6 +390,42 @@ class AgentSession:
         finally:
             await self._sync_extension_tools()
 
+    async def initialize_goals(self) -> None:
+        """Attach an installed capability on the existing session execution owner."""
+        if find_spec("xdog.skills") is None:
+            return
+        await self._settle_retired_goals()
+        if self.children.goal_host is not None:
+            return
+        if self._goal_start is None:
+            async def start() -> None:
+                from xdog.coding.core.goal_adapter import CodingGoalHost
+                from xdog.skills.goal.host import OperationContext
+                host = await CodingGoalHost.open(
+                    self, context=lambda: OperationContext(self._user_operation_authorized))
+                await host.flush()  # Durable obligations only; no model/Goal-state polling.
+            self._goal_start = asyncio.create_task(start())
+        from xdog.agent.async_work import wait_owned
+        try:
+            await wait_owned(self._goal_start)
+        finally:
+            if self._goal_start.done():
+                self._goal_start = None
+
+    def _retire_goal_host(self, host: CodingGoalHost) -> None:
+        if host not in self._retired_goal_hosts:
+            self._retired_goal_hosts.append(host)
+        # The controller's existing settling/close path joins these exact hosts;
+        # scheduling is not permission to release their callback loop/lease.
+        if not host.loop.is_closed():
+            host.loop.call_soon_threadsafe(lambda: asyncio.create_task(host.aclose()))
+
+    async def _settle_retired_goals(self) -> None:
+        from xdog.agent.supervision import settle_on
+        for host in tuple(self._retired_goal_hosts):
+            await settle_on(host.loop, host.aclose())
+            self._retired_goal_hosts.remove(host)
+
     async def initialize_extensions(self) -> None:
         try:
             if self.extensions.enabled:
@@ -639,6 +691,8 @@ class AgentSession:
     async def _close_sdk_owner(self, controller: SessionController) -> None:
         if controller.inbox is not None:
             await controller.inbox.retire()
+        if self._sdk_disposing or self.children.goal_host is not None or self._retired_goal_hosts:
+            await self._aclose_resources()
         self._release_sdk_leases()
 
     async def _acquire_owner(self) -> tuple[SessionController, bool]:
@@ -664,7 +718,10 @@ class AgentSession:
                         from xdog.coding.core.sessions.intake import attach_inbox
                         attach_inbox(controller)
                         controller._close_hook = lambda: self._close_sdk_owner(controller)
-                        controller.start()
+                        # Optional callback capabilities outlive an individual
+                        # SDK await/asyncio.run; retain the one controller's own
+                        # supported loop, never a second controller or daemon.
+                        controller.start(own_thread=find_spec("xdog.skills") is not None)
                         self._sdk_controller = controller
                     self._sdk_users += 1
                     return self._sdk_controller, True
@@ -673,7 +730,8 @@ class AgentSession:
     def _release_sdk_owner(self, controller: SessionController) -> Future[None] | None:
         with self._sdk_lock:
             self._sdk_users -= 1
-            if self._sdk_users == 0 and self._sdk_controller is controller:
+            if (self._sdk_users == 0 and self._sdk_controller is controller
+                    and self.children.goal_host is None and not self._retired_goal_hosts):
                 self._sdk_controller = None
                 self._sdk_closing = controller.close()
                 return self._sdk_closing
@@ -746,7 +804,10 @@ class AgentSession:
             raise ValueError('A turn requires distinct input messages')
         if not isinstance(batch_id, str) or not batch_id.strip() or len(batch_id.encode()) > 256 or '\x00' in batch_id:
             raise ValueError('Invalid batch identity')
-        if sum(input_size(item) for item in inputs) > MAX_BATCH_BYTES:
+        owner = self.runtime.controller if self.runtime is not None else self._sdk_controller
+        maximum = (owner.input_byte_limit(inputs[0])
+                   if len(inputs) == 1 and owner is not None and owner.owns_current_task else MAX_BATCH_BYTES)
+        if sum(input_size(item) for item in inputs) > maximum:
             raise ValueError('Batch input exceeds capacity')
         origins = tuple(item.input_origin or ('user' if item.value.origin == 'human' else 'session_input')
                         for item in inputs)
@@ -756,8 +817,12 @@ class AgentSession:
             raise ValueError('Canonical continuation cannot share a batch')
         images = tuple(image for item in inputs for image in item.images)
         context_snapshot = await self.context_messages.capture() if 'user' in origins else None
+        self._user_operation_authorized = False
+        self._user_prompt_messages.clear()
+        self._authorized_messages.clear()
         try:
             self.handled_feedback = []
+            await self.initialize_goals()
             if images:
                 from xdog.ai.utils.image_files import validate_references
                 await asyncio.to_thread(validate_references, images, self.model_info)
@@ -794,6 +859,9 @@ class AgentSession:
                 event_stream = await self.agent.continue_()
             else:
                 messages = [agent_message(item) for item in inputs]
+                self._user_prompt_messages = {
+                    id(message): message for message, origin in zip(messages, origins, strict=True)
+                    if origin == "user" and isinstance(message, UserMessage)}
                 event_stream = await self.agent.prompt(messages,
                     initial_prompt_context=(lambda: self.context_messages.admit(context_snapshot))
                         if context_snapshot is not None else None)
@@ -817,6 +885,9 @@ class AgentSession:
 
             return last_assistant
         finally:
+            self._user_operation_authorized = False
+            self._user_prompt_messages.clear()
+            self._authorized_messages.clear()
             await self._sync_extension_tools()
             self._expire_turn_scoped_skills()
 
@@ -1519,6 +1590,9 @@ class AgentSession:
         self.agent.set_system_prompt(prompt + self.access.state.prompt())
     def _on_agent_event(self, event: AgentEvent) -> None:
         """Handle agent lifecycle events."""
+        if (isinstance(event, MessageEndEvent) and isinstance(event.message, UserMessage)
+                and self._authorized_messages.get(id(event.message)) is event.message):
+            self._user_operation_authorized = True
         if isinstance(event, AgentEndEvent):
             self._persist()
 
@@ -1607,6 +1681,9 @@ class AgentSession:
 
     async def _aclose_resources(self) -> None:
         await self.children.supervisor.aclose()
+        if self.children.goal_host is not None:
+            await self.children.goal_host.aclose()
+        await self._settle_retired_goals()
         self.extension_dialogs.close()
         await self.extensions.aclose()
         if self.mcp is not None: