xdog-coding 2.4.3__tar.gz → 2.4.5__tar.gz

{xdog_coding-2.4.3 → xdog_coding-2.4.5}/.gitignore

@@ -57,3 +57,6 @@ plan.txt
 /cli_agent_workflow.json
 /cli_agent_workflow.py
 /essay_writer.py
+
+# Goal workspaces contain local plans, task evidence and routing; never publish.
+.xdog/

{xdog_coding-2.4.3 → xdog_coding-2.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: xdog-coding
-Version: 2.4.3
+Version: 2.4.5
 Summary: Interactive coding agent CLI
 Project-URL: Homepage, https://xdog.942295.xyz
 Project-URL: Repository, https://github.com/litterzhang/xdog
@@ -23,11 +23,12 @@ Requires-Dist: agent-client-protocol<0.13,>=0.12.1; python_version < '3.15'
 Requires-Dist: click>=8.1.0
 Requires-Dist: pydantic>=2.0
 Requires-Dist: pyyaml>=6.0
-Requires-Dist: xdog-agent>=2.4.3
-Requires-Dist: xdog-ai[openai]>=2.4.3
-Requires-Dist: xdog-tui>=2.4.3
+Requires-Dist: xdog-agent>=2.4.5
+Requires-Dist: xdog-ai[openai]>=2.4.5
+Requires-Dist: xdog-skills>=2.4.5
+Requires-Dist: xdog-tui>=2.4.5
 Provides-Extra: skills
-Requires-Dist: xdog-skills>=2.4.3; extra == 'skills'
+Requires-Dist: xdog-skills>=2.4.5; extra == 'skills'
 Description-Content-Type: text/markdown
 
 # xdog-coding
@@ -59,6 +60,15 @@ saved model, messages and usage are preserved.
 
 ## Interactive terminal
 
+Auxiliary browsers use the main UI's existing semantic colors: warm accent
+headings and current selection, muted metadata/hints, and green/red status cues.
+This covers session/history, transcript/tool inventory, details, child/draft,
+MCP/OAuth, export review and attachment chrome, including existing nested/fullscreen
+viewers. Coding's pre-start resume picker follows the same theme. Plain mode and
+`NO_COLOR` keep these panels unstyled. Colors do not change row budgets,
+keybindings, visible-confirmation requirements, original source or exported data.
+See [panel theming](../../docs/panel-theming.md).
+
 The interface uses native scrollback, one status row, and a shared multiline
 editor. Enter submits or queues; Ctrl+Enter inserts a newline. Ctrl+O opens
 recent tool/reasoning details: Left/Right chooses an entry and Page Up/Page Down
@@ -145,6 +155,7 @@ the timer. Worker locks and cancellation signals remain separate from UI state.
 
 Potentially mutating tool calls are gated immediately before execution. By
 default, read-only filesystem operations and `current_time` run automatically;
+the exact host-bound `ext_coding_session` inspection also needs no approval;
 `bash`, filesystem writes/edits/deletes, and unknown extension tools ask first.
 
 ```bash
@@ -464,6 +475,30 @@ fallback files persist until you delete them. Kernel-blocked filesystem operatio
 cannot be forcibly interrupted; helper success may transfer clipboard ownership
 to the platform's normal persistent clipboard process.
 
+### Read-only session inspection
+
+`/session` and the built-in host extension tool `ext_coding_session` share the
+same current-session query. The tool takes `{}` and returns structured JSON:
+current session/branch/name/workspace, selected model and known capabilities,
+thinking, effective permission/read-only state, and measured context usage.
+Unknown capabilities/usage remain explicitly unavailable; selected provider/model
+configuration is not proof of a server's underlying model identity. No credentials,
+conversation bodies, file reads or settings dump are included.
+
+The instruction prefix points to this query instead of embedding mutable model,
+thinking, permission or session-ID values. Explicit tool selection still applies:
+an empty/narrowed selection does not silently re-enable inspection, and prompts
+state when the tool is unavailable. This is a Coding-owned tool, not a new Python
+plugin worker or a generic slash-command execution bridge. Its actual bound tool
+may read without frontend approval even in ask-all/deny/read-only mode; arbitrary
+extension tools and same-name replacements gain no exemption. Existing extension
+validation/vetoes remain active. Navigation/close retire old handles, and children
+do not inherit their parent's inspection callback. Neither ACP nor a TUI is needed.
+
+Session navigation normalizes title/summary/detail/error whitespace for display
+only, so embedded newlines/tabs cannot desynchronize terminal row tracking. The
+stored original text is not modified.
+
 ### MCP stdio tools (first transport slice)
 
 Global `settings.json` and project `.coding/settings.json` accept `mcp_servers`;
@@ -580,12 +615,12 @@ continuation silently reconnects, replays POSTs or expands configured disclosure
 
 ### Task planning and host read-only scope
 
-The builtin **`xdog-planning`** skill, supplied by `xdog-skills` (install the
+The builtin **`plan`** skill, supplied by `xdog-skills` (install the
 `skills` extra), uses ordinary conversation or task documents
 for objectives, dependencies, acceptance criteria and evidence-backed progress.
 It does not create a separate plan database, inspector, execution mode or model
 loop. The former `/plan`, `PlanPanel` and `update_plan` UI/tool APIs are removed.
-List it with `/skills` and activate it with `/xdog-planning [request]`.
+List it with `/skills` and activate it with `/plan [request]`.
 
 Use the native host control separately:
 
@@ -595,10 +630,11 @@ Use the native host control separately:
 /readonly off
 ```
 
-With host read-only scope on, only local `filesystem` read/ls/grep/find and
-`current_time` tool calls are eligible; shell, workspace writes, MCP/extension
-tools and child-control tools are blocked. Normal permission policy still applies
-to eligible calls. Cached approvals, `allow-all`, skill text, model arguments and
+With host read-only scope on, only local `filesystem` read/ls/grep/find,
+`current_time` calls and the host-bound `ext_coding_session` query are eligible.
+Shell, workspace writes, arbitrary MCP/extension tools and child-control tools
+are blocked. Ordinary eligible calls retain their normal permission policy;
+the exact bound session query needs no approval. Cached approvals, `allow-all`, skill text, model arguments and
 delayed approvals cannot release or bypass this restriction. Keep planning notes
 in the conversation while read-only; writing a task document still needs the
 normal write permission outside that scope.
@@ -782,7 +818,7 @@ none of these interfaces grants tool permission or full Pi API compatibility.
 TASK` inherits the current host policy; it does not copy approval grants or bypass
 read-only. Inspect with `/agents list` or `/agents inspect ID`; use `steer ID TEXT`,
 `follow-up ID TEXT`, `cancel ID`, `wait ID` and `close ID` under `/agents`.
-Parents also receive reserved `agent_spawn`/`agent_control` tools; children cannot
+Parents also receive the reserved unified `agent` tool; children cannot
 recursively delegate through their parent's supervision tools.
 
 Children share the workspace, so coordinate conflicting writes. Context is copied
@@ -2080,7 +2116,7 @@ count and `initial-task`/`crash-snapshot`/`durable-return` uncertainty are visib
 This native view has no editor, reorder/remove/return control, recovery-copy button
 or permission-confirmation action. Paste cannot submit or adopt a draft.
 
-The ordinary main-Agent `agent_control` tool retains `action="queue"` with a typed
+The ordinary main-Agent `agent` tool retains `action="queue"` with a typed
 JSON `text` request. SDK `ChildSupervisor.control("queue", ...)` also remains.
 Their edit/remove/move/text-return and explicit stopped recovery operations use the
 real owner loop and existing identity, revision, selected-input, image-byte and
@@ -2198,7 +2234,7 @@ existing limitations.
 `recover_images` remains an explicit SDK/main-Agent queue operation with exact
 input `id` and queue `revision`. `ChildSupervisor.control` returns the verified
 non-destructive `image_recovery` payload and `queue.image_receipt`; the ordinary
-`agent_control` wrapper returns typed images plus receipt/count metadata. The
+`agent` wrapper returns typed images plus receipt/count metadata. The
 text-only `recover` action refuses image-bearing inputs rather than dropping bytes.
 Running children use the separate owned live-return protocol, not stopped recovery.
 
@@ -2272,7 +2308,7 @@ SDK journaling and same-session transient editor recovery are not removed.
 The native user interface offers neither manual live queue edit/reorder/remove/
 return nor stopped task/input copy controls. Those queue operations remain in the
 permissioned main-Agent/SDK backend; native queue inspection is read-only.
-The main Agent can use its ordinary permissioned `agent_control` tool with
+The main Agent can use its ordinary permissioned `agent` tool with
 `action="queue"` and a JSON `text` request containing `return_prepare`,
 `return_commit` or `return_cancel` plus the required input/revision/receipt fields.
 Preparation returns typed image content and bounded token/receipt metadata; it
@@ -2655,3 +2691,91 @@ and widget layouts are removed. Native approval and recovery reviews remain host
 owned; they expose no plugin layout or editor/session-mutation authority. Core TUI
 overlays, transcript fullscreen, Unicode, clipping, cursor and tool-approval behavior
 remain.
+
+## Session ownership and reliable shutdown
+
+Coding's TUI, print, SDK and ACP ingress share one session controller and Agent.
+Persistent writer locks live under `<sessions>/.owners`; they do not depend on
+`TMPDIR`. Short private Linux Unix socket/discovery files are separate, under
+`/tmp/xdog-coding-<uid>/<store-hash>`. Stop older Coding processes before upgrading:
+old binaries do not participate in this store-anchored writer-lock protocol. Do
+not run mixed old/new writers against the same session store.
+
+SDK applications should `await session.aclose()` in `finally`. Closure is
+idempotent, waits for actual child/Goal/extension/MCP cleanup, and reports cleanup
+errors only after attempting the other resources. Cancellation of a waiter does
+not abandon the underlying close. `session.dispose()` requests the same close
+and returns a concurrent Future; synchronous applications can wait on `.result()`.
+Do not block an asynchronous caller loop with `.result()`; await `aclose()` instead.
+Synchronous construction and controls can be called with `asyncio.to_thread` when
+used from an async application. A receiver accepting a queued message does not
+require message approval; existing approval applies to tool execution only.
+
+Automatic project instructions come **only** from the working directory's
+`AGENTS.md`, `.coding/INSTRUCTIONS.md` and `.coding/instructions.md`. There is no
+parent walk. Other harness configuration files are not automatic instruction
+sources; they remain ordinary files that users can explicitly read or attach under
+normal file-access and permission rules. There is no filename denylist.
+Each automatic source must be a regular UTF-8 file of at most 64 KiB; symlinks,
+special files and unreadable/oversized sources cause an explicit preparation error. Missing files are optional. These
+instructions are refreshed in owned off-loop preparation before a turn, reach the
+actual model prompt, and never grant tool permissions. The Agent alone renders
+skill indexes and session/turn-scoped bodies; loading a skill starts no observer,
+model, receiver or daemon.
+
+`CreateSessionOptions.thinking_level` is honored, including explicit `"off"`.
+Initial `allowed_tools` configuration is a **tool selection**, not authorization:
+absent/null falls through to a lower layer, `[]` selects no tools, and a nonempty
+list selects those configured names. Caller options/overrides take precedence
+over saved explicit choices, then project and global configuration. Choices are
+not unioned. Unavailable saved names do not create tools or gain authority later;
+normal permission checks still apply to the selected tools.
+
+The separate input history ledger has a common **64 MiB** read/write bound.
+Admission reserves final-state, batch-ID and bounded diagnostic space for every
+unfinished input; if it cannot fit, it is refused before acknowledgement. Errors
+retain up to 4096 characters with an explicit truncation marker; batch IDs are
+limited to 256 UTF-8 bytes. Accepted execution facts are never silently deleted.
+At capacity, explicitly start another session rather than automatically archiving
+or replaying requests. Recovery marks unfinished execution interrupted and never
+replays potentially executed tool effects automatically.
+
+Ordinary turn history uses one immutable, original-owner disk commit, off the
+model loop, before publishing saved state and completing producer receipts.
+File replacement synchronizes the file and parent directory. A failed or
+uncertain history commit retains the live executed tail and fences further turns;
+close and explicitly reload/inspect the saved state before continuing. Concurrent
+metadata revision conflicts fail closed instead of overwriting newer facts.
+These are local filesystem/process guarantees, not hardware power-loss
+exactly-once execution or an OS security sandbox. No existing user data is migrated
+or discarded automatically.
+
+Enabled extensions may declare a public slash name. The packaged `goal_ui`
+display exposes `/goals [GOAL_ID | page OFFSET]`; default native `/goal` manages the current Goal.
+This is generic extension routing, not a Coding-specific Goal command. Public
+names appear in help/completion and cannot shadow builtins or other owners; native installed capabilities
+may explicitly overlap only their own skill command entry, without preventing skill loading;
+model tool names and permissions do not change. See
+`docs/extension-public-commands.md` for the shared Coding/Claw contract.
+
+
+### Installed capability code boundaries
+
+Trusted installed native capabilities use generic owner, lifecycle event, ACP
+routing and receipt ports. Coding/Claw default dependencies include xdog-skills:
+`/goal` commands and the model tool are available without a display-worker setting
+or Goal enable flag. The packaged skill remains discoverable/loadable. No Goal is
+created merely by installation or ordinary chat.
+
+Goal owns one current binding/history, task files and ACP reminders. The current
+main Agent plans, executes itself or uses existing child tools, updates tasks and
+judges completion according to the skill. No Goal-owned worker/reviewer scheduler
+or independent acceptance protocol remains. Tasks/*.json are authoritative, not
+projections of duplicate database task state. Pauses and user/host waits cannot be
+released by an automatic message. Existing readonly/permissions/approval checks
+remain in force. Eyes watches only the generated task directory configuration;
+stopping Goal automation does not cancel unrelated observers or accepted work.
+
+See `docs/goal-simple-design.md` and its requirement/verification record. Earlier
+capability-boundary and Goal reviewer lifecycle evidence describes its old frozen
+implementation, not the current Goal contract.

{xdog_coding-2.4.3 → xdog_coding-2.4.5}/README.md

@@ -27,6 +27,15 @@ saved model, messages and usage are preserved.
 
 ## Interactive terminal
 
+Auxiliary browsers use the main UI's existing semantic colors: warm accent
+headings and current selection, muted metadata/hints, and green/red status cues.
+This covers session/history, transcript/tool inventory, details, child/draft,
+MCP/OAuth, export review and attachment chrome, including existing nested/fullscreen
+viewers. Coding's pre-start resume picker follows the same theme. Plain mode and
+`NO_COLOR` keep these panels unstyled. Colors do not change row budgets,
+keybindings, visible-confirmation requirements, original source or exported data.
+See [panel theming](../../docs/panel-theming.md).
+
 The interface uses native scrollback, one status row, and a shared multiline
 editor. Enter submits or queues; Ctrl+Enter inserts a newline. Ctrl+O opens
 recent tool/reasoning details: Left/Right chooses an entry and Page Up/Page Down
@@ -113,6 +122,7 @@ the timer. Worker locks and cancellation signals remain separate from UI state.
 
 Potentially mutating tool calls are gated immediately before execution. By
 default, read-only filesystem operations and `current_time` run automatically;
+the exact host-bound `ext_coding_session` inspection also needs no approval;
 `bash`, filesystem writes/edits/deletes, and unknown extension tools ask first.
 
 ```bash
@@ -432,6 +442,30 @@ fallback files persist until you delete them. Kernel-blocked filesystem operatio
 cannot be forcibly interrupted; helper success may transfer clipboard ownership
 to the platform's normal persistent clipboard process.
 
+### Read-only session inspection
+
+`/session` and the built-in host extension tool `ext_coding_session` share the
+same current-session query. The tool takes `{}` and returns structured JSON:
+current session/branch/name/workspace, selected model and known capabilities,
+thinking, effective permission/read-only state, and measured context usage.
+Unknown capabilities/usage remain explicitly unavailable; selected provider/model
+configuration is not proof of a server's underlying model identity. No credentials,
+conversation bodies, file reads or settings dump are included.
+
+The instruction prefix points to this query instead of embedding mutable model,
+thinking, permission or session-ID values. Explicit tool selection still applies:
+an empty/narrowed selection does not silently re-enable inspection, and prompts
+state when the tool is unavailable. This is a Coding-owned tool, not a new Python
+plugin worker or a generic slash-command execution bridge. Its actual bound tool
+may read without frontend approval even in ask-all/deny/read-only mode; arbitrary
+extension tools and same-name replacements gain no exemption. Existing extension
+validation/vetoes remain active. Navigation/close retire old handles, and children
+do not inherit their parent's inspection callback. Neither ACP nor a TUI is needed.
+
+Session navigation normalizes title/summary/detail/error whitespace for display
+only, so embedded newlines/tabs cannot desynchronize terminal row tracking. The
+stored original text is not modified.
+
 ### MCP stdio tools (first transport slice)
 
 Global `settings.json` and project `.coding/settings.json` accept `mcp_servers`;
@@ -548,12 +582,12 @@ continuation silently reconnects, replays POSTs or expands configured disclosure
 
 ### Task planning and host read-only scope
 
-The builtin **`xdog-planning`** skill, supplied by `xdog-skills` (install the
+The builtin **`plan`** skill, supplied by `xdog-skills` (install the
 `skills` extra), uses ordinary conversation or task documents
 for objectives, dependencies, acceptance criteria and evidence-backed progress.
 It does not create a separate plan database, inspector, execution mode or model
 loop. The former `/plan`, `PlanPanel` and `update_plan` UI/tool APIs are removed.
-List it with `/skills` and activate it with `/xdog-planning [request]`.
+List it with `/skills` and activate it with `/plan [request]`.
 
 Use the native host control separately:
 
@@ -563,10 +597,11 @@ Use the native host control separately:
 /readonly off
 ```
 
-With host read-only scope on, only local `filesystem` read/ls/grep/find and
-`current_time` tool calls are eligible; shell, workspace writes, MCP/extension
-tools and child-control tools are blocked. Normal permission policy still applies
-to eligible calls. Cached approvals, `allow-all`, skill text, model arguments and
+With host read-only scope on, only local `filesystem` read/ls/grep/find,
+`current_time` calls and the host-bound `ext_coding_session` query are eligible.
+Shell, workspace writes, arbitrary MCP/extension tools and child-control tools
+are blocked. Ordinary eligible calls retain their normal permission policy;
+the exact bound session query needs no approval. Cached approvals, `allow-all`, skill text, model arguments and
 delayed approvals cannot release or bypass this restriction. Keep planning notes
 in the conversation while read-only; writing a task document still needs the
 normal write permission outside that scope.
@@ -750,7 +785,7 @@ none of these interfaces grants tool permission or full Pi API compatibility.
 TASK` inherits the current host policy; it does not copy approval grants or bypass
 read-only. Inspect with `/agents list` or `/agents inspect ID`; use `steer ID TEXT`,
 `follow-up ID TEXT`, `cancel ID`, `wait ID` and `close ID` under `/agents`.
-Parents also receive reserved `agent_spawn`/`agent_control` tools; children cannot
+Parents also receive the reserved unified `agent` tool; children cannot
 recursively delegate through their parent's supervision tools.
 
 Children share the workspace, so coordinate conflicting writes. Context is copied
@@ -2048,7 +2083,7 @@ count and `initial-task`/`crash-snapshot`/`durable-return` uncertainty are visib
 This native view has no editor, reorder/remove/return control, recovery-copy button
 or permission-confirmation action. Paste cannot submit or adopt a draft.
 
-The ordinary main-Agent `agent_control` tool retains `action="queue"` with a typed
+The ordinary main-Agent `agent` tool retains `action="queue"` with a typed
 JSON `text` request. SDK `ChildSupervisor.control("queue", ...)` also remains.
 Their edit/remove/move/text-return and explicit stopped recovery operations use the
 real owner loop and existing identity, revision, selected-input, image-byte and
@@ -2166,7 +2201,7 @@ existing limitations.
 `recover_images` remains an explicit SDK/main-Agent queue operation with exact
 input `id` and queue `revision`. `ChildSupervisor.control` returns the verified
 non-destructive `image_recovery` payload and `queue.image_receipt`; the ordinary
-`agent_control` wrapper returns typed images plus receipt/count metadata. The
+`agent` wrapper returns typed images plus receipt/count metadata. The
 text-only `recover` action refuses image-bearing inputs rather than dropping bytes.
 Running children use the separate owned live-return protocol, not stopped recovery.
 
@@ -2240,7 +2275,7 @@ SDK journaling and same-session transient editor recovery are not removed.
 The native user interface offers neither manual live queue edit/reorder/remove/
 return nor stopped task/input copy controls. Those queue operations remain in the
 permissioned main-Agent/SDK backend; native queue inspection is read-only.
-The main Agent can use its ordinary permissioned `agent_control` tool with
+The main Agent can use its ordinary permissioned `agent` tool with
 `action="queue"` and a JSON `text` request containing `return_prepare`,
 `return_commit` or `return_cancel` plus the required input/revision/receipt fields.
 Preparation returns typed image content and bounded token/receipt metadata; it
@@ -2623,3 +2658,91 @@ and widget layouts are removed. Native approval and recovery reviews remain host
 owned; they expose no plugin layout or editor/session-mutation authority. Core TUI
 overlays, transcript fullscreen, Unicode, clipping, cursor and tool-approval behavior
 remain.
+
+## Session ownership and reliable shutdown
+
+Coding's TUI, print, SDK and ACP ingress share one session controller and Agent.
+Persistent writer locks live under `<sessions>/.owners`; they do not depend on
+`TMPDIR`. Short private Linux Unix socket/discovery files are separate, under
+`/tmp/xdog-coding-<uid>/<store-hash>`. Stop older Coding processes before upgrading:
+old binaries do not participate in this store-anchored writer-lock protocol. Do
+not run mixed old/new writers against the same session store.
+
+SDK applications should `await session.aclose()` in `finally`. Closure is
+idempotent, waits for actual child/Goal/extension/MCP cleanup, and reports cleanup
+errors only after attempting the other resources. Cancellation of a waiter does
+not abandon the underlying close. `session.dispose()` requests the same close
+and returns a concurrent Future; synchronous applications can wait on `.result()`.
+Do not block an asynchronous caller loop with `.result()`; await `aclose()` instead.
+Synchronous construction and controls can be called with `asyncio.to_thread` when
+used from an async application. A receiver accepting a queued message does not
+require message approval; existing approval applies to tool execution only.
+
+Automatic project instructions come **only** from the working directory's
+`AGENTS.md`, `.coding/INSTRUCTIONS.md` and `.coding/instructions.md`. There is no
+parent walk. Other harness configuration files are not automatic instruction
+sources; they remain ordinary files that users can explicitly read or attach under
+normal file-access and permission rules. There is no filename denylist.
+Each automatic source must be a regular UTF-8 file of at most 64 KiB; symlinks,
+special files and unreadable/oversized sources cause an explicit preparation error. Missing files are optional. These
+instructions are refreshed in owned off-loop preparation before a turn, reach the
+actual model prompt, and never grant tool permissions. The Agent alone renders
+skill indexes and session/turn-scoped bodies; loading a skill starts no observer,
+model, receiver or daemon.
+
+`CreateSessionOptions.thinking_level` is honored, including explicit `"off"`.
+Initial `allowed_tools` configuration is a **tool selection**, not authorization:
+absent/null falls through to a lower layer, `[]` selects no tools, and a nonempty
+list selects those configured names. Caller options/overrides take precedence
+over saved explicit choices, then project and global configuration. Choices are
+not unioned. Unavailable saved names do not create tools or gain authority later;
+normal permission checks still apply to the selected tools.
+
+The separate input history ledger has a common **64 MiB** read/write bound.
+Admission reserves final-state, batch-ID and bounded diagnostic space for every
+unfinished input; if it cannot fit, it is refused before acknowledgement. Errors
+retain up to 4096 characters with an explicit truncation marker; batch IDs are
+limited to 256 UTF-8 bytes. Accepted execution facts are never silently deleted.
+At capacity, explicitly start another session rather than automatically archiving
+or replaying requests. Recovery marks unfinished execution interrupted and never
+replays potentially executed tool effects automatically.
+
+Ordinary turn history uses one immutable, original-owner disk commit, off the
+model loop, before publishing saved state and completing producer receipts.
+File replacement synchronizes the file and parent directory. A failed or
+uncertain history commit retains the live executed tail and fences further turns;
+close and explicitly reload/inspect the saved state before continuing. Concurrent
+metadata revision conflicts fail closed instead of overwriting newer facts.
+These are local filesystem/process guarantees, not hardware power-loss
+exactly-once execution or an OS security sandbox. No existing user data is migrated
+or discarded automatically.
+
+Enabled extensions may declare a public slash name. The packaged `goal_ui`
+display exposes `/goals [GOAL_ID | page OFFSET]`; default native `/goal` manages the current Goal.
+This is generic extension routing, not a Coding-specific Goal command. Public
+names appear in help/completion and cannot shadow builtins or other owners; native installed capabilities
+may explicitly overlap only their own skill command entry, without preventing skill loading;
+model tool names and permissions do not change. See
+`docs/extension-public-commands.md` for the shared Coding/Claw contract.
+
+
+### Installed capability code boundaries
+
+Trusted installed native capabilities use generic owner, lifecycle event, ACP
+routing and receipt ports. Coding/Claw default dependencies include xdog-skills:
+`/goal` commands and the model tool are available without a display-worker setting
+or Goal enable flag. The packaged skill remains discoverable/loadable. No Goal is
+created merely by installation or ordinary chat.
+
+Goal owns one current binding/history, task files and ACP reminders. The current
+main Agent plans, executes itself or uses existing child tools, updates tasks and
+judges completion according to the skill. No Goal-owned worker/reviewer scheduler
+or independent acceptance protocol remains. Tasks/*.json are authoritative, not
+projections of duplicate database task state. Pauses and user/host waits cannot be
+released by an automatic message. Existing readonly/permissions/approval checks
+remain in force. Eyes watches only the generated task directory configuration;
+stopping Goal automation does not cancel unrelated observers or accepted work.
+
+See `docs/goal-simple-design.md` and its requirement/verification record. Earlier
+capability-boundary and Goal reviewer lifecycle evidence describes its old frozen
+implementation, not the current Goal contract.

{xdog_coding-2.4.3 → xdog_coding-2.4.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "xdog-coding"
-version = "2.4.3"
+version = "2.4.5"
 description = "Interactive coding agent CLI"
 requires-python = ">=3.12"
 classifiers = [
@@ -22,17 +22,18 @@ readme = "README.md"
 license = "AGPL-3.0-or-later"
 license-files = ["LICENSE", "LICENSE-EXCEPTION.md"]
 dependencies = [
-    "xdog-ai[openai]>=2.4.3",
-    "xdog-agent>=2.4.3",
+    "xdog-ai[openai]>=2.4.5",
+    "xdog-agent>=2.4.5",
+    "xdog-skills>=2.4.5",
     "agent-client-protocol>=0.12.1,<0.13; python_version < '3.15'",
-    "xdog-tui>=2.4.3",
+    "xdog-tui>=2.4.5",
     "pyyaml>=6.0",
     "click>=8.1.0",
     "pydantic>=2.0",
 ]
 
 [project.optional-dependencies]
-skills = ["xdog-skills>=2.4.3"]
+skills = ["xdog-skills>=2.4.5"]
 
 [project.urls]
 Homepage = "https://xdog.942295.xyz"

{xdog_coding-2.4.3 → xdog_coding-2.4.5}/src/xdog/coding/__init__.py

@@ -1,3 +1,3 @@
 """coding - Interactive coding agent CLI."""
 
-__version__ = "2.4.3"
+__version__ = "2.4.5"

{xdog_coding-2.4.3 → xdog_coding-2.4.5}/src/xdog/coding/acp/backend.py

@@ -89,17 +89,19 @@ class CodingBackend:
         try:
             session = await asyncio.shield(task)
         except asyncio.CancelledError:
-            session = await task
-            session.dispose()
+            from xdog.agent.async_work import wait_owned
+            async def settle_construction() -> None:
+                late_session = await task
+                await late_session.aclose()
+            await wait_owned(asyncio.create_task(settle_construction(), name='coding-acp-canceled-construction'))
             raise
-        runtime = SessionRuntime(session, bound=False, router=self.router)
-        runtime.start()
         try:
+            runtime = SessionRuntime(session, bound=False, router=self.router)
+            runtime.start()
             from xdog.coding.acp.server import serve_local
-
             server = await serve_local(runtime)
         except BaseException:
-            await asyncio.wrap_future(runtime.close())
+            await session.aclose()
             raise
         self._owned[session.session_id] = peer.id, runtime, server
         ref = SessionRef(session.session_id, session.working_dir, runtime.controller.generation)
@@ -300,31 +302,51 @@ class CodingBackend:
                 await asyncio.wrap_future(running.controller.cancel(running.ticket.id, peer_id=peer.id))
 
     async def disconnect(self, peer: Peer) -> None:
-        await self._inbox.disconnect(peer)
+        from functools import partial
+
+        from xdog.agent.async_work import settle_cleanup
         pending = tuple(row for key, row in self._running.items() if key[0] == peer.id)
-        for row in pending:
-            if row.ticket is None and not row.task.cancelling():
-                row.task.cancel()
-        for controller in {row.controller for row in pending}:
-            await asyncio.wrap_future(controller.disconnect(peer.id))
-        tasks = [row.task for row in pending if row.task is not asyncio.current_task()]
-        if tasks:
-            for task in tasks:
-                if not task.done() and not task.cancelling():
-                    task.cancel()
-            await asyncio.gather(*tasks, return_exceptions=True)
-        for key, remote in tuple(self._remote.items()):
-            if key[0] == peer.id:
-                await remote.close()
-                del self._remote[key]
-        for identifier, (owner, runtime, server) in tuple(self._owned.items()):
-            if owner == peer.id:
-                await server.close()
-                await asyncio.wrap_future(runtime.close())
-                del self._owned[identifier]
-        for key in tuple(self._refs):
-            if key[0] == peer.id:
-                del self._refs[key]
+        async def ingress() -> None:
+            await self._inbox.disconnect(peer)
+        async def requests() -> None:
+            for row in pending:
+                if row.ticket is None and not row.task.cancelling():
+                    row.task.cancel()
+            async def disconnect(controller: SessionController) -> None:
+                await asyncio.wrap_future(controller.disconnect(peer.id))
+            async def join() -> None:
+                tasks = [row.task for row in pending if row.task is not asyncio.current_task()]
+                for task in tasks:
+                    if not task.done() and not task.cancelling():
+                        task.cancel()
+                if tasks:
+                    await asyncio.gather(*tasks, return_exceptions=True)
+            controllers = {row.controller for row in pending}
+            await settle_cleanup(*(partial(disconnect, controller) for controller in controllers),
+                                 join, message='ACP request retirement failed')
+        async def remote(key: tuple[str, str], attachment: AcpAttachment) -> None:
+            try:
+                await attachment.close()
+            finally:
+                self._remote.pop(key, None)
+        async def owned(identifier: str, runtime: SessionRuntime) -> None:
+            try:
+                # The session owns its CURRENT endpoint too. Closing the saved
+                # old endpoint first would bypass all remaining resource cleanup.
+                await runtime.session.aclose()
+            finally:
+                if runtime.session._lease is None:
+                    self._owned.pop(identifier, None)
+        async def references() -> None:
+            for key in tuple(self._refs):
+                if key[0] == peer.id:
+                    self._refs.pop(key, None)
+        owned_sessions = tuple(self._owned.items())
+        await settle_cleanup(ingress, requests,
+            *(partial(remote, key, attachment) for key, attachment in tuple(self._remote.items()) if key[0] == peer.id),
+            *(partial(owned, identifier, runtime) for identifier, (owner, runtime, _server) in owned_sessions
+              if owner == peer.id), references, message='ACP peer cleanup failed')
+
     async def extension(self, peer: Peer, method: str, params: dict[str, Any]) -> dict[str, Any]:
         if method in {'xdog/enqueue', 'xdog/inbox_status'}:
             target = params.get('session_id')