Fix diff rendering edge cases

.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.8.0"}
+{".":"0.7.0"}

AGENTS.md

@@ -91,14 +91,6 @@ These classes drive multi-round reviews. Fix them before requesting review:
   final-component-only no-follow is insufficient. On multi-step setup, roll back
   only what this run created; never destroy pre-existing resources you did
   not create; never report success when cleanup or unlock failed.
-- **Normalize before matching:** Any transform that REMOVES bytes without
-  leaving a gap is also a reassembler, so it has to run before whatever matches
-  on the result. Redacting by shape and then stripping control bytes lets a
-  credential split by a NUL, an ESC or a C1 byte pass the patterns as two
-  fragments and be rejoined on the way out; comparing a path against a form
-  produced by the same resolver the kernel just used makes a redirect agree with
-  itself. Strip, decode, or canonicalize first, then match. The unsplit value
-  passing is not evidence, so the test needs a split case.
 - **Atomic shared state:** Write a complete temporary file, then atomically
   replace the destination so concurrent readers never see a partial write.
   Exclusive create or a write lock alone is not enough for readers. Serialize
@@ -111,42 +103,3 @@ These classes drive multi-round reviews. Fix them before requesting review:
   shipped. Wire advertised entry points or shrink the claim. Do not bundle
   unrelated fixes. Do not widen security allowlists by name alone; check
   classification and side effects too.
-- **Host tool version floors:** Zero shells out to `git` and other host tools,
-  and the project does not declare a minimum version for any of them. A flag,
-  subcommand, or config key that is not long-established therefore raises that
-  floor silently, and the failure on an older host is an unhelpful usage error
-  rather than a clear message. Before adding one, check when it landed and say
-  so where a caller would look. Record the floor for the exact subcommand you
-  call, not for the flag in general: `--end-of-options` reached Git's shared
-  parser in 2.24, but `git rev-parse` only accepted it from 2.30, and
-  `git checkout` and `git reset` later still. Likewise `--show-current` is
-  `git branch` 2.22, and `branch.autoSetupMerge=inherit` is 2.35. Then either
-  keep a fallback for older versions or gate the call. A test that depends on a
-  newer feature must skip below its floor instead of failing, and say which
-  version it needs.
-- **Prove the test fails without the change:** A regression test earns its
-  place only if it fails on the unfixed code, for the reason it claims. Run it
-  both ways and quote the failure in the PR. The recurring miss is not a
-  missing test but a test that never reaches the behavior it names, because an
-  earlier guard rejects the input first, so it passes with and without the fix.
-  When a test targets a specific layer, call that layer directly rather than
-  relying on a public entry point that may refuse earlier.
-- **Hermetic tests:** Tests must not read or write the developer's real config,
-  cache, or state directories. Redirect every root the code under test
-  resolves, not just config. `os.UserConfigDir` and `os.UserCacheDir` read
-  `XDG_CONFIG_HOME` and `XDG_CACHE_HOME` only on Linux and the BSDs. On macOS
-  they derive from `HOME`, and on Windows from `%AppData%` and `%LocalAppData%`.
-  Setting the XDG variables alone still leaves a macOS run writing to the real
-  home, so set `HOME` as well, or take the directory as a parameter. Apply it to
-  every test that reaches the same storage, not only the one where it was first
-  needed; a test that passes on a clean machine and pollutes a real one is a
-  blocker.
-- **Error codes vary by platform and by flag combination:** A check written
-  against the code one target returns can be silently inert on another while
-  still looking correct. `openat(O_DIRECTORY|O_NOFOLLOW)` on a symlink may
-  report `ENOTDIR` or `ELOOP` depending on the platform, because the kernel can
-  reject the directory mismatch before it ever resolves the link; accept both
-  rather than assuming the one POSIX names. On Windows, `\\?\` and `\\.\`
-  prefixes are not UNC paths, and an `NtCreateFile` information class must match
-  the struct actually passed. Confirm the code each supported target returns
-  instead of reasoning from the man page.

CHANGELOG.md

@@ -6,27 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once the first release is
 tagged. Until then, source builds report the version `dev`.
 
-## [0.8.0](https://github.com/Gitlawb/zero/compare/v0.7.0...v0.8.0) (2026-08-21)
-
-
-### Features
-
-* **security:** path-jail primitive, credential-store locking, worktree git hardening ([#891](https://github.com/Gitlawb/zero/issues/891)) ([060d38c](https://github.com/Gitlawb/zero/commit/060d38ce716feb7c5b6657b082cd35cb8dda3d75))
-* **update:** recognise Homebrew installs and add mise, go install docs ([#910](https://github.com/Gitlawb/zero/issues/910)) ([01c3498](https://github.com/Gitlawb/zero/commit/01c3498205e69d26e5f929225f9455b276444f39))
-* use Exa as default search provider ([#926](https://github.com/Gitlawb/zero/issues/926)) ([1ec7219](https://github.com/Gitlawb/zero/commit/1ec7219aee7b2840481ab0905f131644e27d2a4e))
-* **zerogit:** auto-create a conventional branch before push/pr on default branch ([#671](https://github.com/Gitlawb/zero/issues/671)) ([d065467](https://github.com/Gitlawb/zero/commit/d065467cd3ec3ed91c5dc60554c36fc4b4d6de4c))
-
-
-### Bug Fixes
-
-* **acp:** three defects a desktop ACP client hits ([#915](https://github.com/Gitlawb/zero/issues/915)) ([a78c6c3](https://github.com/Gitlawb/zero/commit/a78c6c357e1d21146d7cd2e8030a754e06f7f1f5))
-* bump Go to 1.26.6 for stdlib vulnerability fixes ([#903](https://github.com/Gitlawb/zero/issues/903)) ([dc15e82](https://github.com/Gitlawb/zero/commit/dc15e822987d8d7de467c62c375518f435b74d8c))
-* **daemon:** clean up child after startup timeout ([#774](https://github.com/Gitlawb/zero/issues/774)) ([9c29209](https://github.com/Gitlawb/zero/commit/9c292092a26c9092fd873d072b0af1b0d9d39ef0))
-* **dictation:** redact API keys from streaming transcriber errors ([#852](https://github.com/Gitlawb/zero/issues/852)) ([64a783b](https://github.com/Gitlawb/zero/commit/64a783b08caa2c7b21f188033b9ed84a14e00e84))
-* **modelregistry:** expose reasoning effort for DeepSeek V4 models ([#931](https://github.com/Gitlawb/zero/issues/931)) ([90dcfd1](https://github.com/Gitlawb/zero/commit/90dcfd127e8a6d9902ec9f4e72f6d03fef1a0fc6))
-* **providers:** discover ChatGPT capabilities ([#890](https://github.com/Gitlawb/zero/issues/890)) ([2d2450e](https://github.com/Gitlawb/zero/commit/2d2450e9a744349f0d01b1d4e9ba29c24ba5650d))
-* **sandbox:** normalize launcher names before the command-prefix denylist ([#934](https://github.com/Gitlawb/zero/issues/934)) ([6edf9a8](https://github.com/Gitlawb/zero/commit/6edf9a8b78dc030dc44598919db1c7fa9d4f809a))
-
 ## [0.7.0](https://github.com/Gitlawb/zero/compare/v0.6.0...v0.7.0) (2026-08-10)
 
 

README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.6+" src="https://img.shields.io/badge/Go-1.26.6+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.5+" src="https://img.shields.io/badge/Go-1.26.5+-00ADD8?logo=go&logoColor=white">
   <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
   <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
   <br>
@@ -76,7 +76,7 @@ irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | ie
 
 ### From source
 
-Source builds require Go 1.26.6+.
+Source builds require Go 1.26.5+.
 
 ```bash
 git clone https://github.com/Gitlawb/zero.git
@@ -273,19 +273,6 @@ zero sandbox grants list
 Zero includes local file/search/edit/shell tools, `web_fetch` for public URLs,
 and MCP support for additional tools.
 
-`web_fetch` refuses loopback, private and other special-use addresses: it checks
-the URL before asking permission, resolves the host, and dials the address it
-validated so a name cannot resolve to something else in between.
-
-If `HTTP_PROXY`/`HTTPS_PROXY` is set, `web_fetch` and the provider connectivity
-probe use it, and that last step changes: the proxy is dialed and the target
-hostname is sent to it, so the proxy decides which address the request actually
-reaches. The URL is still checked and resolved locally first, but a proxy that
-answers differently can reach a private service. A forward proxy already sees
-and can rewrite every request through it, so this is the trust you accept by
-configuring one. Leave the variables unset for the checks to be enforced end to
-end.
-
 For local dev servers, use shell commands such as `curl` through `exec_command`
 so the normal sandbox and permission policy applies. Long-running commands stay
 attached to a background terminal session and can be listed or stopped from the
@@ -384,13 +371,9 @@ go run ./cmd/zero-perf-bench
 
 Experimental: `ZERO_OPENAI_TURN_SESSION=1` enables the optimized OpenAI turn
 session (background connection prewarm + request-prefix telemetry) for headless
-`zero exec` runs against official OpenAI profiles. Off by default; `0`, `false`,
-or `off` disable it. A/B-benchmark it by running the same `zero-perf-bench` suite
-with the variable unset and set.
-
-Native ChatGPT Responses sessions are enabled by default. Set
-`ZERO_CHATGPT_TURN_SESSION=0`, `false`, or `off` to restore stateless HTTP/SSE
-transport.
+`zero exec` runs against official OpenAI profiles. Off by default; `0`/`false`
+disable. A/B-benchmark it by running the same `zero-perf-bench` suite with the
+variable unset and set.
 
 ### Code Quality and Security Checks
 

README_ZH.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.6+" src="https://img.shields.io/badge/Go-1.26.6+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.5+" src="https://img.shields.io/badge/Go-1.26.5+-00ADD8?logo=go&logoColor=white">
   <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
   <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
   <br>
@@ -57,7 +57,7 @@ irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | ie
 
 ### 从源码构建
 
-源码构建需要 Go 1.26.6+。
+源码构建需要 Go 1.26.5+。
 
 ```bash
 git clone https://github.com/Gitlawb/zero.git

SECURITY.md

@@ -33,4 +33,4 @@ Please include, where possible:
   depend on a user explicitly disabling the sandbox (`--skip-permissions-unsafe`), are generally
   out of scope — but please report anything you are unsure about.
 - Zero sends no telemetry. Network calls go to the model/tool providers you configure (and, for
-  keyless web search, to Exa's hosted MCP endpoint at `https://mcp.exa.ai/mcp`).
+  keyless web search, to the documented Firecrawl endpoint — see the README).

docs/HOW_ZERO_WORKS.md

@@ -627,12 +627,7 @@ Core tool groups include:
   skills, `ask_user`, permission requests.
 - **Write tools**: `write_file`, `edit_file`, `apply_patch`, `update_plan`.
 - **Shell tools**: `exec_command`, `write_stdin`, legacy `bash`.
-- **Network tools**: `web_fetch` and optional web search backend. `web_fetch`
-  validates the URL before the permission prompt, refuses loopback/private/
-  special-use addresses, and dials the address it resolved. With
-  `HTTP_PROXY`/`HTTPS_PROXY` set, the proxy is dialed instead and resolves the
-  target itself, so destination enforcement ends at the proxy; see the note in
-  the README.
+- **Network tools**: `web_fetch` and optional web search backend.
 - **Local-control tools**: config-gated wrappers for browser, terminal, desktop,
   and artifact helpers backed by packages such as `internal/localcontrol` and
   `internal/browser`.

docs/INSTALL.md

@@ -1,30 +1,14 @@
 # Installing Zero
 
-Pick whichever fits how you already install things. None of these is the
-blessed one.
+Zero is distributed as:
 
-| Method | Command | Self-update |
-| --- | --- | --- |
-| Install script (Linux, macOS) | `curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh \| bash` | `zero upgrade` |
-| Install script (Windows) | `irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 \| iex` | `zero upgrade` |
-| npm | `npm install -g @gitlawb/zero` | `zero upgrade` (runs npm) |
-| Release archive | download from [Releases](https://github.com/Gitlawb/zero/releases) | `zero upgrade` |
-| mise | `mise use -g ubi:Gitlawb/zero` | `mise upgrade` |
-| `go install` | `go install github.com/Gitlawb/zero/cmd/zero@latest` | rerun the command |
-| Source | `go build -o zero ./cmd/zero` | rebuild |
+- an npm package, `@gitlawb/zero`
+- release archives on GitHub Releases
+- source builds with Go 1.26.5+
 
-`zero upgrade` follows whatever owns the binary, with one exception it cannot
-detect. It delegates to npm for an npm install, refuses outright for a Homebrew
-keg and names `brew upgrade zero`, and replaces the binary in place for
-everything else — including a mise-managed one, which is the exception.
-
-mise is the one case it cannot detect: a mise-managed binary is an ordinary
-standalone install on disk, so `zero upgrade` will replace it and leave mise
-describing a version that is no longer there. Use `mise upgrade` instead.
-
-Release archives are the substrate for most of the above: the install scripts
-and the npm fallback both download a platform archive from a published GitHub
-Release and verify its checksum.
+The install scripts download a platform-specific release archive and require a
+published GitHub Release for the requested version. The npm package is
+self-contained: the platform binary installs from the npm registry.
 
 ## npm
 
@@ -127,45 +111,6 @@ Defaults:
 - Version: latest GitHub release
 - Install path: `%LOCALAPPDATA%\zero\bin\zero.exe`
 
-## mise
-
-[mise](https://mise.jdx.dev/) installs Zero straight from the GitHub Release
-archives through its `ubi` backend, so there is nothing extra to publish and no
-registry in the middle:
-
-```bash
-mise use -g ubi:Gitlawb/zero
-```
-
-Pin a version the same way you would any other tool:
-
-```bash
-mise use -g ubi:Gitlawb/[email protected]
-```
-
-Updates come from `mise upgrade`. `zero upgrade` also works, because a
-mise-managed binary is an ordinary standalone install, but then mise's records
-describe a version that is no longer on disk. Prefer `mise upgrade`.
-
-## go install
-
-```bash
-go install github.com/Gitlawb/zero/cmd/zero@latest
-```
-
-This builds from source, so it needs Go 1.26.6+ and it does not go through the
-release archives. Two consequences worth knowing before you pick it:
-
-- On Linux you also need the sandbox helper, which is a separate binary and is
-  not installed by this command. See
-  [Sandbox Helpers For Source Builds](#sandbox-helpers-for-source-builds).
-  Without it, native sandboxing is unavailable.
-- `zero upgrade` treats the result as a standalone install and will replace the
-  binary with a release build rather than rebuilding from source. If you chose
-  `go install` deliberately, rerun it instead.
-
-macOS and Windows need no extra helper.
-
 ## From Source
 
 ```bash
@@ -180,7 +125,7 @@ Build a local binary:
 go build -o zero ./cmd/zero
 ```
 
-Source builds require Go 1.26.6+.
+Source builds require Go 1.26.5+.
 
 ### Sandbox Helpers For Source Builds
 
@@ -297,23 +242,3 @@ zero upgrade
 ```
 
 See the [update guide](UPDATE.md) for update modes, flags, and platform details.
-
-`zero upgrade` behaves differently depending on how Zero was installed, because
-overwriting a binary a package manager owns leaves that manager describing a
-version that is no longer there:
-
-- **npm**: runs `npm install -g @gitlawb/zero@latest` for you.
-- **Homebrew**: refuses, and tells you to run `brew upgrade zero`. Replacing the
-  keg binary directly would be reverted by the next `brew upgrade` or
-  `brew reinstall`.
-- **everything else**: downloads the verified release archive and replaces the
-  binary in place.
-
-Homebrew is detected by the binary living inside a Cellar keg that carries
-Homebrew's own `INSTALL_RECEIPT.json`. The keg shape alone is not enough: a
-directory tree you built yourself can have exactly that shape, and refusing to
-update an install Homebrew never touched would be a real cost for a made-up
-reason. The receipt is the thing only Homebrew writes.
-
-An ordinary install under `/usr/local/bin` is left alone even on an Intel Mac
-where that is also the Homebrew prefix.

go.mod

@@ -4,7 +4,7 @@ go 1.26.6
 
 require (
 	charm.land/bubbles/v2 v2.1.1
-	charm.land/bubbletea/v2 v2.0.9
+	charm.land/bubbletea/v2 v2.0.8
 	charm.land/lipgloss/v2 v2.0.5
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/alecthomas/chroma/v2 v2.27.0

go.sum

@@ -1,7 +1,7 @@
 charm.land/bubbles/v2 v2.1.1 h1:7r55WzBxpo/R3z98hGmY7KKPd3ET6vsf0Fb9sDHOV60=
 charm.land/bubbles/v2 v2.1.1/go.mod h1:GE6M31gaWZVXzGw73OeuTTgy4lX+OtkH0E5ymnNsHxo=
-charm.land/bubbletea/v2 v2.0.9 h1:DpJCMWKgzQK8SJv4zbKKFHAI10ymWy/evClPFk0k0f8=
-charm.land/bubbletea/v2 v2.0.9/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
+charm.land/bubbletea/v2 v2.0.8 h1:SxTJMhCAI3lbPmy4SgX5LWZ24AdINr4I6UEqzZvYJuY=
+charm.land/bubbletea/v2 v2.0.8/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
 charm.land/lipgloss/v2 v2.0.5 h1:kbNxgeeUOYv5J0YdpxFjfvf3dFvqH8Aci4zB6xqFtrY=
 charm.land/lipgloss/v2 v2.0.5/go.mod h1:9oqhxt4yxIMe6q5A4kHr44DremZk7J9UNh74GlWa5nc=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -64,6 +64,8 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 golang.org/x/exp v0.0.0-20260611194520-c48552f49976 h1:X8Hz2ImujgbmetVuW+w2YkyZChE3cBpZi2P158rTG9M=
 golang.org/x/exp v0.0.0-20260611194520-c48552f49976/go.mod h1:vnf4pv9iKZXY58sQE1L86zmNWJ4159e1RkcWiLCkeEY=
+golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
+golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
 golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
 golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=

internal/acp/agent.go

@@ -296,16 +296,6 @@ func stopReasonFor(result agent.Result, err error) (string, error) {
 		if errors.Is(err, context.Canceled) {
 			return StopCancelled, nil
 		}
-		// A CLIENT THAT CANCELLED A PERMISSION PROMPT DID NOT FAIL. Only
-		// context.Canceled was matched here, so dismissing a permission dialog —
-		// a deliberate action, and for apply_patch the only refusal a client is
-		// offered — came back as JSON-RPC -32603 carrying the internal sentinel
-		// text. Editors and the desktop app both render that as a crashed turn,
-		// so declining a tool looked like ZERO falling over. It is a
-		// cancellation, and StopCancelled is what ACP has for saying so.
-		if errors.Is(err, agent.ErrPermissionApprovalCanceled) {
-			return StopCancelled, nil
-		}
 		return "", err
 	}
 	if result.FinishReason == "length" {
@@ -321,14 +311,10 @@ func stopReasonFor(result agent.Result, err error) (string, error) {
 // session/request_permission request and maps the outcome back. Failure to reach
 // the client fails closed to deny.
 func (a *Agent) requestPermission(ctx context.Context, sessionID string, req agent.PermissionRequest) (agent.PermissionDecision, error) {
-	// Built ONCE and used for both halves. Sending one list and validating the
-	// reply against another is the defect this whole path had; see
-	// decisionFromOutcome.
-	options := buildPermissionOptions(req)
 	params := RequestPermissionParams{
 		SessionID: sessionID,
 		ToolCall:  permissionToolCall(req),
-		Options:   options,
+		Options:   buildPermissionOptions(req),
 	}
 	var result RequestPermissionResult
 	if err := a.conn.Call(ctx, MethodSessionRequestPerm, params, &result); err != nil {
@@ -337,7 +323,7 @@ func (a *Agent) requestPermission(ctx context.Context, sessionID string, req age
 		}
 		return agent.PermissionDecision{Action: agent.PermissionDecisionDeny, Reason: "permission request failed: " + err.Error()}, nil
 	}
-	return decisionFromOutcome(result.Outcome, options), nil
+	return decisionFromOutcome(result.Outcome, req.AvailableDecisions), nil
 }
 
 func (a *Agent) emitPlan(registry *tools.Registry, note *notifier) {

internal/acp/desktopinterop_test.go

@@ -1,217 +0,0 @@
-package acp
-
-// desktopinterop_test.go covers three defects found by driving the real `zero
-// acp` binary from a desktop ACP client. Each is a case where ZERO and a
-// conforming client disagreed about the wire, and none of them failed loudly —
-// they produced a silent denial, a spurious crash, or two buttons the user
-// could not tell apart.
-//
-// A fourth, session/load restoring history without replaying it, is fixed by
-// #914 rather than here: that one also gives the replayed messages stable ids
-// and keeps session/resume replay-free, which this did not.
-
-import (
-	"errors"
-	"fmt"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/agent"
-)
-
-// ---- an offered option is an acceptable answer ----
-
-// The list the options were BUILT from and the list the answer was CHECKED
-// against were different whenever ZERO did not enumerate: the client was sent
-// Allow and Reject, and its reply was validated against an empty slice, so
-// every button it could possibly show failed closed to deny. The user clicked
-// Allow and ZERO recorded a denial, with nothing on screen to say so.
-func TestAnOfferedOptionIsAccepted(t *testing.T) {
-	// No AvailableDecisions: the fallback path, which is every permission event
-	// that is not a prompt.
-	req := agent.PermissionRequest{ToolName: "bash"}
-
-	options := buildPermissionOptions(req)
-	if len(options) == 0 {
-		t.Fatal("no options were offered")
-	}
-
-	for _, option := range options {
-		decision := decisionFromOutcome(
-			RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: option.OptionID},
-			buildPermissionOptions(req),
-		)
-		if string(decision.Action) != option.OptionID {
-			t.Fatalf("option %q was answered with %q (%s) — an offered option must be accepted",
-				option.OptionID, decision.Action, decision.Reason)
-		}
-	}
-}
-
-// The narrowing this validation exists for still holds: a client must not be
-// able to return a broader grant than it was shown.
-func TestAnOptionThatWasNotOfferedIsStillRefused(t *testing.T) {
-	req := agent.PermissionRequest{ToolName: "bash"}
-
-	decision := decisionFromOutcome(
-		RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(agent.PermissionDecisionAlwaysAllow)},
-		buildPermissionOptions(req),
-	)
-	if decision.Action != agent.PermissionDecisionDeny {
-		t.Fatalf("an unoffered broader grant was accepted as %q", decision.Action)
-	}
-}
-
-// The resolver is the single source of truth for both sides, which is what
-// makes the two agree by construction rather than by being kept in step.
-func TestOfferedDecisionsMatchWhatWasSent(t *testing.T) {
-	for _, req := range []agent.PermissionRequest{
-		{ToolName: "bash"},
-		{ToolName: "bash", AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowForSession,
-			agent.PermissionDecisionDeny,
-		}},
-	} {
-		offered := buildPermissionOptions(req)
-		for _, option := range buildPermissionOptions(req) {
-			if !actionOffered(option.OptionID, offered) {
-				t.Fatalf("option %q was sent but is not in the offered set %v", option.OptionID, offered)
-			}
-		}
-	}
-}
-
-// ---- two options the user can tell apart ----
-
-// request_permissions offers plain allow and strict-review allow together, and
-// both were labelled "Allow". The label is the only thing an ACP client shows,
-// so the panel presented two identical buttons where one silently enabled
-// strict auto-review of what was granted.
-func TestEveryOfferedOptionHasADistinctLabel(t *testing.T) {
-	req := agent.PermissionRequest{
-		ToolName: "request_permissions",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowStrict,
-			agent.PermissionDecisionAllowForSession,
-			agent.PermissionDecisionDeny,
-		},
-	}
-
-	seen := map[string]string{}
-	for _, option := range buildPermissionOptions(req) {
-		if previous, clash := seen[option.Name]; clash {
-			t.Fatalf("options %q and %q share the label %q — a user cannot tell them apart",
-				previous, option.OptionID, option.Name)
-		}
-		seen[option.Name] = option.OptionID
-	}
-}
-
-// The two remain distinct decisions: the label changed, the round trip did not.
-func TestStrictAllowStillRoundTrips(t *testing.T) {
-	req := agent.PermissionRequest{
-		ToolName: "request_permissions",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowStrict,
-		},
-	}
-	decision := decisionFromOutcome(
-		RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(agent.PermissionDecisionAllowStrict)},
-		buildPermissionOptions(req),
-	)
-	if decision.Action != agent.PermissionDecisionAllowStrict {
-		t.Fatalf("strict allow round-tripped as %q", decision.Action)
-	}
-}
-
-// ---- cancelling a permission is a cancellation, not a crash ----
-
-// Only context.Canceled was recognised, so dismissing a permission dialog came
-// back as JSON-RPC -32603 carrying the internal sentinel text. Clients render
-// that as a failed turn, so declining a tool looked like ZERO falling over —
-// and for apply_patch, dismissing is the ONLY refusal a client is offered.
-func TestCancellingAPermissionEndsTheTurnAsCancelled(t *testing.T) {
-	canceled := fmt.Errorf("%w for apply_patch", agent.ErrPermissionApprovalCanceled)
-
-	reason, err := stopReasonFor(agent.Result{}, canceled)
-	if err != nil {
-		t.Fatalf("stopReasonFor returned an error for a cancellation: %v", err)
-	}
-	if reason != StopCancelled {
-		t.Fatalf("stop reason = %q, want %q", reason, StopCancelled)
-	}
-}
-
-// A genuine failure must still be an error. Mapping too much to cancelled would
-// hide real faults behind a clean ending, which is the opposite mistake.
-func TestARealFailureIsStillAnError(t *testing.T) {
-	failure := errors.New("provider exploded")
-
-	if _, err := stopReasonFor(agent.Result{}, failure); !errors.Is(err, failure) {
-		t.Fatalf("stopReasonFor(%v) = %v, want the failure preserved", failure, err)
-	}
-}
-
-// The sentinel is matched through errors.Is, so it survives the wrapping every
-// return site applies — each one adds the tool name.
-func TestPermissionCancellationSurvivesWrapping(t *testing.T) {
-	if !errors.Is(fmt.Errorf("%w for bash", agent.ErrPermissionApprovalCanceled), agent.ErrPermissionApprovalCanceled) {
-		t.Fatal("a wrapped permission cancellation was not recognised")
-	}
-	if errors.Is(errors.New("something else"), agent.ErrPermissionApprovalCanceled) {
-		t.Fatal("an unrelated error was reported as a permission cancellation")
-	}
-}
-
-// A decision that never became an option cannot be selected.
-//
-// PermissionDecisionCancel is the case that exists today: optionKindFor drops
-// it because ACP expresses cancellation through the outcome, yet ZERO
-// enumerates it in AvailableDecisions for shell commands and apply_patch. While
-// the reply was validated against the DECISIONS rather than the sent options, a
-// client could return {"outcome":"selected","optionId":"cancel"} — an id it was
-// never shown — and abort the whole turn.
-//
-// Written over every option-less decision rather than over "cancel", so a
-// future action that optionKindFor declines to render is covered the day it is
-// added rather than the day someone remembers this test.
-func TestADecisionThatIsNotAnOptionCannotBeSelected(t *testing.T) {
-	for _, toolName := range []string{"bash", "apply_patch"} {
-		req := agent.PermissionRequest{
-			ToolName: toolName,
-			AvailableDecisions: []agent.PermissionDecisionAction{
-				agent.PermissionDecisionAllow,
-				agent.PermissionDecisionDeny,
-				agent.PermissionDecisionCancel,
-			},
-		}
-		options := buildPermissionOptions(req)
-
-		for _, action := range req.AvailableDecisions {
-			if actionOffered(string(action), options) {
-				continue // it was sent; selecting it is legitimate
-			}
-			decision := decisionFromOutcome(
-				RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(action)},
-				options,
-			)
-			if decision.Action != agent.PermissionDecisionDeny {
-				t.Fatalf("%s: %q was never sent as an option but was accepted as %q",
-					toolName, action, decision.Action)
-			}
-		}
-	}
-}
-
-// Cancelling is still reachable — through the outcome, which is where ACP puts
-// it. Closing the selected-id route must not close the real one.
-func TestCancellingThroughTheOutcomeStillWorks(t *testing.T) {
-	options := buildPermissionOptions(agent.PermissionRequest{ToolName: "apply_patch"})
-
-	decision := decisionFromOutcome(RequestPermissionOutcome{Outcome: OutcomeCancelled}, options)
-	if decision.Action != agent.PermissionDecisionCancel {
-		t.Fatalf("outcome=cancelled gave %q, want cancel", decision.Action)
-	}
-}

internal/acp/permission.go

@@ -15,7 +15,14 @@ import (
 // PermissionOptions. Only the actions ZERO actually presented (AvailableDecisions)
 // are surfaced; the optionId is the ZERO action string for a clean round-trip.
 func buildPermissionOptions(req agent.PermissionRequest) []PermissionOption {
-	actions := offeredDecisions(req)
+	actions := req.AvailableDecisions
+	if len(actions) == 0 {
+		// Sensible default if ZERO didn't enumerate: allow once / reject.
+		actions = []agent.PermissionDecisionAction{
+			agent.PermissionDecisionAllow,
+			agent.PermissionDecisionDeny,
+		}
+	}
 	options := make([]PermissionOption, 0, len(actions))
 	for _, action := range actions {
 		kind, name := optionKindFor(action, req.PrefixApprovalEscalates)
@@ -31,32 +38,6 @@ func buildPermissionOptions(req agent.PermissionRequest) []PermissionOption {
 	return options
 }
 
-// offeredDecisions resolves what this request actually offers the client.
-//
-// ONE RESOLVER, USED BY BOTH SIDES, and that is the entire point of it existing.
-// The fallback below used to live inside buildPermissionOptions while
-// requestPermission validated the client's answer against the raw
-// req.AvailableDecisions. When ZERO did not enumerate — which is every
-// permission event that is not a prompt, and includes a shell call whose sandbox
-// decision came back deny — the two disagreed completely: the client was sent
-// "Allow" and "Reject", and validation was performed against an EMPTY list, so
-// every option the client could possibly click failed closed to deny with
-// "permission option was not offered".
-//
-// The user clicked Allow and ZERO recorded a denial. Nothing surfaced it,
-// because a denial is a legitimate answer — the tool was simply refused and the
-// turn carried on as though the user had rejected it.
-func offeredDecisions(req agent.PermissionRequest) []agent.PermissionDecisionAction {
-	if len(req.AvailableDecisions) > 0 {
-		return req.AvailableDecisions
-	}
-	// Sensible default if ZERO didn't enumerate: allow once / reject.
-	return []agent.PermissionDecisionAction{
-		agent.PermissionDecisionAllow,
-		agent.PermissionDecisionDeny,
-	}
-}
-
 // optionKindFor maps a ZERO decision action to an ACP PermissionOptionKind and a
 // human label. Returns an empty kind for actions that ACP expresses through the
 // outcome rather than an option (cancel).
@@ -68,16 +49,8 @@ func offeredDecisions(req agent.PermissionRequest) []agent.PermissionDecisionAct
 // disclosure cannot be TUI-only.
 func optionKindFor(action agent.PermissionDecisionAction, escalates bool) (kind, name string) {
 	switch action {
-	case agent.PermissionDecisionAllow:
+	case agent.PermissionDecisionAllow, agent.PermissionDecisionAllowStrict:
 		return PermAllowOnce, "Allow"
-	case agent.PermissionDecisionAllowStrict:
-		// SPLIT FROM PLAIN ALLOW because the label is the only thing an ACP
-		// client shows. Both were labelled "Allow", and request_permissions
-		// offers them together — so the panel presented two identical buttons,
-		// and whichever the user picked looked the same while one of them
-		// silently turned on strict auto-review of what was granted. The option
-		// id carries no room for the distinction, so it has to be in the name.
-		return PermAllowOnce, "Allow with strict review"
 	case agent.PermissionDecisionAllowForSession:
 		return PermAllowAlways, "Allow for this session"
 	case agent.PermissionDecisionAllowPrefix:
@@ -97,31 +70,19 @@ func optionKindFor(action agent.PermissionDecisionAction, escalates bool) (kind,
 
 // decisionFromOutcome maps the client's permission outcome back to a ZERO
 // decision. A cancelled outcome cancels the run; a selected option id is the ZERO
-// action verbatim (validated against what was actually sent); anything
-// unrecognized fails closed to deny.
-//
-// IT TAKES THE OPTIONS THAT WERE SENT, not the decisions the request offered,
-// and the two are not the same list. Some actions never become options —
-// PermissionDecisionCancel is dropped by optionKindFor because ACP expresses
-// cancellation through the outcome instead — yet it IS enumerated in
-// AvailableDecisions for shell commands and apply_patch, the two commonest
-// prompts. Validating against the decisions therefore accepted
-// {"outcome":"selected","optionId":"cancel"}: an identifier no client was ever
-// shown, aborting the whole turn.
-//
-// Passing the sent options makes "what we offered" and "what we accept" the
-// same slice rather than two things kept in step, so anything optionKindFor
-// declines to render is excluded structurally instead of by name.
-func decisionFromOutcome(outcome RequestPermissionOutcome, offered []PermissionOption) agent.PermissionDecision {
+// action verbatim (validated against what was offered); anything unrecognized
+// fails closed to deny.
+func decisionFromOutcome(outcome RequestPermissionOutcome, offered []agent.PermissionDecisionAction) agent.PermissionDecision {
 	switch outcome.Outcome {
 	case OutcomeCancelled:
 		return agent.PermissionDecision{Action: agent.PermissionDecisionCancel, Reason: "client cancelled"}
 	case OutcomeSelected:
+		action := agent.PermissionDecisionAction(outcome.OptionID)
 		// Bind to what was actually offered for THIS call: a client must not be able
 		// to return a broader grant (always_allow / allow_for_session) that wasn't
 		// presented. Anything not offered fails closed to deny.
-		if actionOffered(outcome.OptionID, offered) {
-			return agent.PermissionDecision{Action: agent.PermissionDecisionAction(outcome.OptionID)}
+		if actionOffered(action, offered) {
+			return agent.PermissionDecision{Action: action}
 		}
 		return agent.PermissionDecision{Action: agent.PermissionDecisionDeny, Reason: "permission option was not offered"}
 	default:
@@ -129,9 +90,9 @@ func decisionFromOutcome(outcome RequestPermissionOutcome, offered []PermissionO
 	}
 }
 
-func actionOffered(optionID string, offered []PermissionOption) bool {
-	for _, option := range offered {
-		if option.OptionID == optionID {
+func actionOffered(action agent.PermissionDecisionAction, offered []agent.PermissionDecisionAction) bool {
+	for _, a := range offered {
+		if a == action {
 			return true
 		}
 	}
@@ -142,15 +103,13 @@ func actionOffered(optionID string, offered []PermissionOption) bool {
 // session/request_permission request from a ZERO permission request.
 func permissionToolCall(req agent.PermissionRequest) ToolCallUpdate {
 	args := marshalArgs(req.Args)
-	upd := ToolCallUpdate{
+	return ToolCallUpdate{
 		ToolCallID: req.ToolCallID,
 		Title:      toolTitle(req.ToolName, string(args)),
 		Kind:       toolKindFor(req.ToolName),
 		Status:     ToolStatusPending,
 		RawInput:   rawInputBytes(args),
 	}
-	attachBrowserToolDetails(&upd, req.ToolName)
-	return upd
 }
 
 func marshalArgs(args map[string]any) []byte {

internal/acp/permission_escalation_test.go

@@ -56,11 +56,10 @@ func TestACPPrefixOptionsStaySilentWithoutEscalation(t *testing.T) {
 // what was offered, so decorating it would fail every prefix approval closed.
 func TestACPDisclosureDoesNotDisturbTheOptionIDRoundTrip(t *testing.T) {
 	request := escalationRequest(true)
-	options := buildPermissionOptions(request)
-	for _, option := range options {
+	for _, option := range buildPermissionOptions(request) {
 		decision := decisionFromOutcome(
 			RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: option.OptionID},
-			options,
+			request.AvailableDecisions,
 		)
 		if string(decision.Action) != option.OptionID {
 			t.Errorf("option id %q round-tripped to %q (%s)", option.OptionID, decision.Action, decision.Reason)

internal/acp/permission_test.go

@@ -39,14 +39,11 @@ func TestBuildPermissionOptionsDefault(t *testing.T) {
 }
 
 func TestDecisionFromOutcome(t *testing.T) {
-	offered := buildPermissionOptions(agent.PermissionRequest{
-		ToolName: "bash",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAlwaysAllow,
-			agent.PermissionDecisionDeny,
-		},
-	})
+	offered := []agent.PermissionDecisionAction{
+		agent.PermissionDecisionAllow,
+		agent.PermissionDecisionAlwaysAllow,
+		agent.PermissionDecisionDeny,
+	}
 	if d := decisionFromOutcome(RequestPermissionOutcome{Outcome: OutcomeCancelled}, offered); d.Action != agent.PermissionDecisionCancel {
 		t.Errorf("cancelled -> %q, want cancel", d.Action)
 	}
@@ -82,17 +79,3 @@ func TestPermissionToolCall(t *testing.T) {
 		t.Error("expected rawInput from args")
 	}
 }
-
-func TestPermissionToolCallKeepsTheBrowserDescriptor(t *testing.T) {
-	call := permissionToolCall(agent.PermissionRequest{
-		ToolCallID: "browser-1",
-		ToolName:   "browser_connect",
-		Args:       map[string]any{"target": "127.0.0.1:9222"},
-	})
-	if got := browserDescriptor(t, call); got != (BrowserToolDetails{Version: 1, Command: "connect"}) {
-		t.Fatalf("browser descriptor = %#v", got)
-	}
-	if call.Title != "browser connect" {
-		t.Fatalf("title = %q", call.Title)
-	}
-}

internal/acp/translate.go

@@ -2,9 +2,7 @@ package acp
 
 import (
 	"encoding/json"
-	"net/url"
 	"strings"
-	"unicode"
 	"unicode/utf8"
 
 	"github.com/Gitlawb/zero/internal/agent"
@@ -46,125 +44,12 @@ func toolKindFor(name string) string {
 
 // toolTitle builds a concise human title, e.g. "read_file src/main.go".
 func toolTitle(name, rawArgs string) string {
-	if browser, ok := browserToolDetails(name); ok {
-		return browserToolTitle(browser.Command, rawArgs)
-	}
 	if hint := primaryArgHint(rawArgs); hint != "" {
 		return name + " " + hint
 	}
 	return name
 }
 
-// browserToolDetails identifies ZERO's local browser helpers without treating
-// similarly named MCP tools as browser automation. The descriptor intentionally
-// contains no request data: ACP tool input is already protocol-visible, but a
-// durable UI must not need to retain text, local CDP targets, or full URLs just
-// to recognise the browser operation.
-func browserToolDetails(name string) (*BrowserToolDetails, bool) {
-	const prefix = "browser_"
-	command, ok := strings.CutPrefix(name, prefix)
-	if !ok {
-		return nil, false
-	}
-	switch command {
-	case "install", "launch", "connect", "open", "snapshot", "click", "type", "press", "action":
-		return &BrowserToolDetails{Version: 1, Command: command}, true
-	default:
-		return nil, false
-	}
-}
-
-const zeroBrowserMetaKey = "github.com/Gitlawb/zero/browser"
-
-// attachBrowserToolDetails stores ZERO's browser descriptor in ACP's reserved
-// extension channel. Keeping this in one helper prevents start, result, and
-// permission payloads from drifting onto different wire shapes.
-func attachBrowserToolDetails(update *ToolCallUpdate, name string) {
-	browser, ok := browserToolDetails(name)
-	if !ok {
-		return
-	}
-	raw, err := json.Marshal(browser)
-	if err != nil {
-		return
-	}
-	update.Meta = map[string]json.RawMessage{zeroBrowserMetaKey: raw}
-}
-
-// browserToolTitle avoids putting browser_type text, an attached DevTools
-// endpoint, or a URL query/fragment in a tool-card title. Those values can
-// carry credentials or session data; the UI only needs the operation and, for
-// navigation, a human-recognisable origin.
-func browserToolTitle(command, rawArgs string) string {
-	switch command {
-	case "action":
-		action, ok := exactJSONStringArg(rawArgs, "command")
-		if !ok {
-			return "browser action"
-		}
-		if action, ok := tools.NormalizedBrowserActionCommand(action); ok {
-			return "browser action " + action
-		}
-		return "browser action"
-	case "open":
-		rawURL, ok := exactJSONStringArg(rawArgs, "url")
-		if !ok {
-			return "browser open"
-		}
-		normalized, err := tools.NormalizeBrowserOpenURL(rawURL)
-		if err != nil {
-			return "browser open"
-		}
-		u, err := url.Parse(normalized)
-		if err != nil || u.Scheme == "" || u.Host == "" {
-			return "browser open"
-		}
-		origin := u.Scheme + "://" + u.Host
-		if !browserTitleTextSafe(origin) {
-			return "browser open"
-		}
-		return "browser open " + truncateHint(origin)
-	default:
-		return "browser " + command
-	}
-}
-
-// browserTitleTextSafe validates text after URL parsing has decoded escaped
-// UTF-8 in the host. Valid UTF-8 alone is not presentation-safe: control,
-// format/bidi, and line/paragraph separator runes can reorder or split the
-// permission label shown to a user. The execution URL remains unchanged.
-func browserTitleTextSafe(text string) bool {
-	if !utf8.ValidString(text) {
-		return false
-	}
-	for _, r := range text {
-		if unicode.IsControl(r) || unicode.Is(unicode.Cf, r) || unicode.Is(unicode.Zl, r) || unicode.Is(unicode.Zp, r) {
-			return false
-		}
-	}
-	return true
-}
-
-// exactJSONStringArg mirrors ZERO's map-based tool argument decoding: only the
-// exact JSON key is considered, and a non-string value is invalid. In
-// particular, an incidental "URL" key must not change a permission title when
-// browser_open will only read "url".
-func exactJSONStringArg(rawArgs, key string) (string, bool) {
-	var args map[string]json.RawMessage
-	if json.Unmarshal([]byte(rawArgs), &args) != nil {
-		return "", false
-	}
-	raw, ok := args[key]
-	if !ok {
-		return "", false
-	}
-	var value string
-	if json.Unmarshal(raw, &value) != nil {
-		return "", false
-	}
-	return value, true
-}
-
 // primaryArgHint extracts the most relevant argument (path/pattern/command) from
 // raw JSON arguments. Best-effort; returns "" when it can't parse.
 func primaryArgHint(rawArgs string) string {
@@ -204,7 +89,7 @@ func rawInput(args string) json.RawMessage {
 // toolCallStart maps an advertised ZERO tool call to the initial ACP "tool_call"
 // update (status in_progress — ZERO executes immediately after advertising).
 func toolCallStart(call agent.ToolCall) ToolCallUpdate {
-	upd := ToolCallUpdate{
+	return ToolCallUpdate{
 		SessionUpdate: UpdateToolCall,
 		ToolCallID:    call.ID,
 		Title:         toolTitle(call.Name, call.Arguments),
@@ -212,8 +97,6 @@ func toolCallStart(call agent.ToolCall) ToolCallUpdate {
 		Status:        ToolStatusInProgress,
 		RawInput:      rawInput(call.Arguments),
 	}
-	attachBrowserToolDetails(&upd, call.Name)
-	return upd
 }
 
 // toolCallResult maps a finished ZERO tool result to a "tool_call_update".
@@ -233,7 +116,6 @@ func toolCallResult(result agent.ToolResult) ToolCallUpdate {
 	if locs := toolResultLocations(result); len(locs) > 0 {
 		upd.Locations = locs
 	}
-	attachBrowserToolDetails(&upd, result.Name)
 	return upd
 }
 

internal/acp/translate_test.go

@@ -1,29 +1,14 @@
 package acp
 
 import (
-	"encoding/json"
 	"strings"
 	"testing"
-	"unicode"
 	"unicode/utf8"
 
 	"github.com/Gitlawb/zero/internal/agent"
 	"github.com/Gitlawb/zero/internal/tools"
 )
 
-func browserDescriptor(t *testing.T, update ToolCallUpdate) BrowserToolDetails {
-	t.Helper()
-	raw, ok := update.Meta[zeroBrowserMetaKey]
-	if !ok {
-		t.Fatalf("browser metadata = %#v, want %q", update.Meta, zeroBrowserMetaKey)
-	}
-	var details BrowserToolDetails
-	if err := json.Unmarshal(raw, &details); err != nil {
-		t.Fatalf("decode browser metadata: %v", err)
-	}
-	return details
-}
-
 func TestAgentMessageAndThoughtChunks(t *testing.T) {
 	m := agentMessageChunk("hello")
 	if m.SessionUpdate != UpdateAgentMessageChunk || m.Content.Type != "text" || m.Content.Text != "hello" {
@@ -71,217 +56,6 @@ func TestToolTitleAndHint(t *testing.T) {
 	}
 }
 
-func TestBrowserToolUpdatesAreStructuredAndPresentationSafe(t *testing.T) {
-	start := toolCallStart(agent.ToolCall{
-		ID:        "browser-1",
-		Name:      "browser_open",
-		Arguments: `{"url":"https://example.com/settings?token=not-for-a-title#account"}`,
-	})
-	if got := browserDescriptor(t, start); got != (BrowserToolDetails{Version: 1, Command: "open"}) {
-		t.Fatalf("browser descriptor = %#v, want open", got)
-	}
-	if start.Title != "browser open https://example.com" {
-		t.Fatalf("browser title = %q", start.Title)
-	}
-	if strings.Contains(start.Title, "token=") || strings.Contains(start.Title, "#account") {
-		t.Fatalf("browser title leaked URL-sensitive data: %q", start.Title)
-	}
-	encoded, err := json.Marshal(start)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var wire struct {
-		Meta map[string]json.RawMessage `json:"_meta"`
-	}
-	if err := json.Unmarshal(encoded, &wire); err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := wire.Meta[zeroBrowserMetaKey]; !ok {
-		t.Fatalf("browser wire metadata = %#v", wire.Meta)
-	}
-
-	typed := toolCallStart(agent.ToolCall{
-		ID:        "browser-2",
-		Name:      "browser_type",
-		Arguments: `{"ref":"email","text":"[email protected]"}`,
-	})
-	if got := browserDescriptor(t, typed); got.Command != "type" {
-		t.Fatalf("browser type descriptor = %#v", got)
-	}
-	if typed.Title != "browser type" || strings.Contains(typed.Title, "[email protected]") {
-		t.Fatalf("browser type title = %q", typed.Title)
-	}
-
-	action := toolCallStart(agent.ToolCall{
-		ID:        "browser-3",
-		Name:      "browser_action",
-		Arguments: `{"command":"keyboard_insert_text","args":["[email protected]"]}`,
-	})
-	if action.Title != "browser action keyboard_insert_text" {
-		t.Fatalf("browser action title = %q", action.Title)
-	}
-
-	result := toolCallResult(agent.ToolResult{
-		ToolCallID: "browser-2",
-		Name:       "browser_type",
-		Status:     tools.StatusOK,
-	})
-	if got := browserDescriptor(t, result); got.Command != "type" {
-		t.Fatalf("browser result descriptor = %#v", got)
-	}
-}
-
-func TestBrowserDescriptorSurvivesProtocolShapedRoundTrip(t *testing.T) {
-	updates := []ToolCallUpdate{
-		toolCallStart(agent.ToolCall{
-			ID:        "start",
-			Name:      "browser_open",
-			Arguments: `{"url":"https://user:[email protected]/private?token=secret#fragment"}`,
-		}),
-		toolCallResult(agent.ToolResult{
-			ToolCallID: "result",
-			Name:       "browser_type",
-			Status:     tools.StatusOK,
-		}),
-		permissionToolCall(agent.PermissionRequest{
-			ToolCallID: "permission",
-			ToolName:   "browser_connect",
-			Args:       map[string]any{"target": "127.0.0.1:9222"},
-		}),
-	}
-
-	type protocolToolCallUpdate struct {
-		SessionUpdate string                     `json:"sessionUpdate,omitempty"`
-		ToolCallID    string                     `json:"toolCallId"`
-		Title         string                     `json:"title,omitempty"`
-		Kind          string                     `json:"kind,omitempty"`
-		Status        string                     `json:"status,omitempty"`
-		RawInput      json.RawMessage            `json:"rawInput,omitempty"`
-		Content       []ToolCallContent          `json:"content,omitempty"`
-		Locations     []ToolCallLocation         `json:"locations,omitempty"`
-		Meta          map[string]json.RawMessage `json:"_meta,omitempty"`
-	}
-
-	for _, update := range updates {
-		encoded, err := json.Marshal(update)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var root map[string]json.RawMessage
-		if err := json.Unmarshal(encoded, &root); err != nil {
-			t.Fatal(err)
-		}
-		if _, ok := root["browser"]; ok {
-			t.Fatalf("browser descriptor escaped ACP _meta: %s", encoded)
-		}
-
-		var protocol protocolToolCallUpdate
-		if err := json.Unmarshal(encoded, &protocol); err != nil {
-			t.Fatal(err)
-		}
-		forwarded, err := json.Marshal(protocol)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var roundTripped ToolCallUpdate
-		if err := json.Unmarshal(forwarded, &roundTripped); err != nil {
-			t.Fatal(err)
-		}
-		details := browserDescriptor(t, roundTripped)
-		if details.Version != 1 || details.Command == "" {
-			t.Fatalf("round-tripped browser descriptor = %#v", details)
-		}
-		descriptorJSON := string(roundTripped.Meta[zeroBrowserMetaKey])
-		for _, secret := range []string{"password", "private", "token", "fragment", "127.0.0.1", "9222"} {
-			if strings.Contains(descriptorJSON, secret) {
-				t.Fatalf("browser descriptor leaked %q: %s", secret, descriptorJSON)
-			}
-		}
-	}
-}
-
-func TestBrowserPermissionTitlesMirrorSafeToolArguments(t *testing.T) {
-	if got := browserToolTitle("open", `{"url":"evil.example.test/pay?token=hidden#fragment"}`); got != "browser open https://evil.example.test" {
-		t.Fatalf("bare-host title = %q", got)
-	}
-	if got := browserToolTitle("open", `{"URL":"https://different.example.test"}`); got != "browser open" {
-		t.Fatalf("case-variant URL title = %q", got)
-	}
-	if got := browserToolTitle("open", `{"URL":"https://different.example.test","url":"https://actual.example.test/path"}`); got != "browser open https://actual.example.test" {
-		t.Fatalf("exact URL key title = %q", got)
-	}
-	if got := browserToolTitle("action", `{"command":"not an action"}`); got != "browser action" {
-		t.Fatalf("unknown browser action title = %q", got)
-	}
-
-	longHost := "https://" + strings.Repeat("a", 200) + ".example.test/path?token=hidden"
-	title := browserToolTitle("open", `{"url":"`+longHost+`"}`)
-	if !utf8.ValidString(title) || utf8.RuneCountInString(title) > len("browser open ")+61 || strings.Contains(title, "token=") {
-		t.Fatalf("bounded browser origin title = %q", title)
-	}
-}
-
-func TestBrowserOpenTitlesRejectDecodedUnicodePresentationControls(t *testing.T) {
-	for _, rawURL := range []string{
-		"https://safe.example%E2%80%AEevil.test/path",
-		"https://safe.example%E2%81%A6evil.test/path",
-		"https://safe.example%C2%85evil.test/path",
-		"https://safe.example%E2%80%A8evil.test/path",
-		"https://safe.example%E2%80%A9evil.test/path",
-	} {
-		t.Run(rawURL, func(t *testing.T) {
-			normalized, err := tools.NormalizeBrowserOpenURL(rawURL)
-			if err != nil {
-				t.Fatalf("execution URL rejected: %v", err)
-			}
-			if normalized != rawURL {
-				t.Fatalf("execution URL = %q, want unchanged %q", normalized, rawURL)
-			}
-
-			args, err := json.Marshal(map[string]any{"url": rawURL})
-			if err != nil {
-				t.Fatal(err)
-			}
-			updates := []ToolCallUpdate{
-				toolCallStart(agent.ToolCall{ID: "start", Name: "browser_open", Arguments: string(args)}),
-				permissionToolCall(agent.PermissionRequest{ToolCallID: "permission", ToolName: "browser_open", Args: map[string]any{"url": rawURL}}),
-			}
-			for _, update := range updates {
-				encoded, err := json.Marshal(update)
-				if err != nil {
-					t.Fatal(err)
-				}
-				var decoded ToolCallUpdate
-				if err := json.Unmarshal(encoded, &decoded); err != nil {
-					t.Fatal(err)
-				}
-				if decoded.Title != "browser open" {
-					t.Fatalf("unsafe browser title survived wire round trip: %q", decoded.Title)
-				}
-				for _, r := range decoded.Title {
-					if unicode.IsControl(r) || unicode.Is(unicode.Cf, r) || unicode.Is(unicode.Zl, r) || unicode.Is(unicode.Zp, r) {
-						t.Fatalf("browser title contains unsafe presentation rune %U: %q", r, decoded.Title)
-					}
-				}
-			}
-		})
-	}
-}
-
-func TestBrowserDescriptorDoesNotClaimSimilarlyNamedMCPTools(t *testing.T) {
-	start := toolCallStart(agent.ToolCall{ID: "mcp-1", Name: "browser_plugin_open", Arguments: `{}`})
-	if len(start.Meta) != 0 {
-		t.Fatalf("MCP-like tool received built-in browser metadata: %#v", start.Meta)
-	}
-	encoded, err := json.Marshal(start)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(encoded), `"browser"`) {
-		t.Fatalf("non-browser tool encoded browser field: %s", encoded)
-	}
-}
-
 func TestToolCallStart(t *testing.T) {
 	upd := toolCallStart(agent.ToolCall{ID: "tc1", Name: "read_file", Arguments: `{"path":"a.go"}`})
 	if upd.SessionUpdate != UpdateToolCall {

internal/acp/types.go

@@ -210,21 +210,6 @@ type ToolCallUpdate struct {
 	RawInput      json.RawMessage    `json:"rawInput,omitempty"`
 	Content       []ToolCallContent  `json:"content,omitempty"`
 	Locations     []ToolCallLocation `json:"locations,omitempty"`
-	// Meta is ACP's extension channel. ZERO-owned values must remain beneath a
-	// namespaced key so protocol-shaped clients can preserve them while decoding
-	// and re-encoding a tool call.
-	Meta map[string]json.RawMessage `json:"_meta,omitempty"`
-}
-
-// BrowserToolDetails identifies the browser helper operation behind a tool
-// call. Version is the schema version for this optional ZERO extension;
-// Command is one of install, launch, connect, open, snapshot, click, type,
-// press, or action. Future fields must remain display-safe and must not
-// include browser profile data, cookies, typed text, URL paths/queries, or
-// DevTools endpoints.
-type BrowserToolDetails struct {
-	Version int    `json:"version"`
-	Command string `json:"command"`
 }
 
 // ToolCallContent is a tool call's rendered output. ZERO emits "content" (a

internal/agent/command_prefix_test.go

@@ -99,43 +99,6 @@ func TestProposedCommandPrefixRejectsUnsafeRequestedPrefix(t *testing.T) {
 	}
 }
 
-// The launcher denylist is only worth anything if it holds on the path a user
-// actually sees. A model naming its own prefix_rule is that path: before
-// launcher names were normalized, "python3.11" was offered as a one-token
-// grant, and hasStringPrefix then matched every later python3.11 invocation.
-func TestProposedCommandPrefixRejectsLauncherSpellingsInRequestedPrefix(t *testing.T) {
-	for _, testCase := range []struct {
-		command string
-		rule    []any
-	}{
-		{"python3.11 script.py", []any{"python3.11"}},
-		{"python.exe script.py", []any{"python.exe"}},
-		{"node.exe app.js", []any{"node.exe"}},
-		{"cmd /c whoami", []any{"cmd"}},
-		{"busybox sh -c id", []any{"busybox"}},
-		{"uv run main.py", []any{"uv", "run"}},
-		{"python3.11 -c import_os", []any{"python3.11", "-c"}},
-	} {
-		got := proposedCommandPrefix("bash", map[string]any{
-			"command":     testCase.command,
-			"prefix_rule": testCase.rule,
-		})
-		if got != nil {
-			t.Errorf("prefix_rule %v for %q was offered as %#v, want rejected", testCase.rule, testCase.command, got)
-		}
-	}
-}
-
-func TestProposedCommandPrefixStillOffersOrdinaryCommands(t *testing.T) {
-	got := proposedCommandPrefix("bash", map[string]any{
-		"command":     "cargo build --release",
-		"prefix_rule": []any{"cargo", "build"},
-	})
-	if len(got) != 2 || got[0] != "cargo" || got[1] != "build" {
-		t.Fatalf("ordinary prefix rule = %#v, want [cargo build]", got)
-	}
-}
-
 func TestProposedCommandPrefixRejectsUnsafeShellForms(t *testing.T) {
 	cases := []string{
 		"cat < in > out",

internal/agent/compaction.go

@@ -4,9 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"strconv"
 	"strings"
-	"unicode/utf8"
 
 	"github.com/Gitlawb/zero/internal/trace"
 	"github.com/Gitlawb/zero/internal/zeroruntime"
@@ -146,17 +144,11 @@ func estimateToolDefTokens(tools []zeroruntime.ToolDefinition) int {
 	for _, tool := range tools {
 		total += ApproxTextTokens(tool.Name)
 		total += ApproxTextTokens(tool.Description)
-		total += ApproxTextTokens(string(tool.Type))
 		if len(tool.Parameters) > 0 {
 			if encoded, err := json.Marshal(tool.Parameters); err == nil {
 				total += ApproxTextTokens(string(encoded))
 			}
 		}
-		if tool.Format != nil {
-			total += ApproxTextTokens(tool.Format.Type)
-			total += ApproxTextTokens(tool.Format.Syntax)
-			total += ApproxTextTokens(tool.Format.Definition)
-		}
 		total += 4 // per-tool overhead
 	}
 	return total
@@ -398,27 +390,6 @@ type compactionState struct {
 	// starts at 1.0 and converges via an EMA as each turn reports actual usage, so
 	// later turns compact nearer to real capacity. Zero is treated as 1.0.
 	calibrationRatio float64
-
-	// summarizerFactory lazily builds the dedicated (cheap) summarizer provider
-	// (Options.Summarizer) for the current main model. summarizerProvider
-	// memoizes the built provider and summarizerResolved records that the
-	// factory ran (it may legitimately return no provider: the main model is
-	// already the cheap one). summarizerBroken is the sticky fallback: once a
-	// build or call fails, the run stays on the main provider until the next
-	// model switch — a misconfigured cheap model must never break (or
-	// repeatedly delay) compaction.
-	summarizerFactory  func(ctx context.Context, mainModelID string) (Provider, error)
-	summarizerProvider Provider
-	summarizerResolved bool
-	summarizerBroken   bool
-	// window is the context window the threshold was derived from. The
-	// reactive free-prune stage compares against it (the limit the provider
-	// enforces), not against the 70% proactive threshold — a pruned history
-	// between the two would still succeed on retry.
-	window int
-	// mainModel is the model the run currently streams on; the summarizer
-	// choice is made against it and remade after a mid-run switch.
-	mainModel string
 }
 
 // calibrate folds one turn's (rawEstimate, actualPromptTokens) sample into the
@@ -453,88 +424,17 @@ func (state *compactionState) calibratedTokens(raw int) int {
 
 func newCompactionState(options Options, task *taskState) *compactionState {
 	state := &compactionState{
-		enabled:           options.ContextWindow > 0,
-		threshold:         compactionThreshold(options.ContextWindow),
-		window:            options.ContextWindow,
-		mainModel:         options.Model,
-		preserveLast:      options.CompactionPreserveLast,
-		onUsage:           options.OnUsage,
-		task:              task,
-		planner:           newContextPlanner(contextPlannerConfig{contextWindow: options.ContextWindow, serviceTier: options.ServiceTier}),
-		trace:             options.Trace,
-		summarizerFactory: options.Summarizer,
+		enabled:      options.ContextWindow > 0,
+		threshold:    compactionThreshold(options.ContextWindow),
+		preserveLast: options.CompactionPreserveLast,
+		onUsage:      options.OnUsage,
+		task:         task,
+		planner:      newContextPlanner(contextPlannerConfig{contextWindow: options.ContextWindow, serviceTier: options.ServiceTier}),
+		trace:        options.Trace,
 	}
 	return state
 }
 
-// updateWindow re-derives the compaction threshold after a mid-run model
-// switch. The low-water mark is reset: it was measured against the old
-// threshold, and keeping it could suppress a compaction the smaller window
-// now requires. <= 0 (unknown model) leaves everything unchanged.
-func (state *compactionState) updateWindow(window int) {
-	if window <= 0 {
-		return
-	}
-	state.enabled = true
-	state.window = window
-	state.threshold = compactionThreshold(window)
-	state.lowWaterMark = 0
-	if state.planner != nil {
-		state.planner.config.contextWindow = window
-	}
-}
-
-// switchModel records a mid-run model switch: the window is re-derived
-// (window <= 0 keeps the old one) and the summarizer choice is forgotten so
-// the next compaction re-resolves it against the new main model. A run that
-// started on the cheap model (no dedicated summarizer) and escalated to an
-// expensive one therefore regains cheap summaries — the exact workflow a
-// dedicated summarizer exists for.
-func (state *compactionState) switchModel(modelID string, window int) {
-	state.mainModel = modelID
-	state.updateWindow(window)
-	state.summarizerProvider = nil
-	state.summarizerResolved = false
-	state.summarizerBroken = false
-}
-
-// summarizeProvider returns the provider summarization calls should use and
-// whether it is the dedicated summarizer: that one when it applies to the
-// current main model and is healthy, else the main provider. The factory runs
-// at most once per main model; a build error marks the summarizer broken for
-// that model. Callers branch on the boolean rather than comparing Provider
-// values — interface comparison panics on a non-comparable dynamic type.
-func (state *compactionState) summarizeProvider(ctx context.Context, main Provider) (Provider, bool) {
-	if state.summarizerFactory == nil || state.summarizerBroken {
-		return main, false
-	}
-	if !state.summarizerResolved {
-		state.summarizerResolved = true
-		built, err := state.summarizerFactory(ctx, state.mainModel)
-		if err != nil {
-			state.summarizerBroken = true
-			return main, false
-		}
-		state.summarizerProvider = built
-	}
-	if state.summarizerProvider == nil {
-		return main, false
-	}
-	return state.summarizerProvider, true
-}
-
-// fitsWindow reports whether a calibrated size is safely under the limit the
-// provider enforces. The proactive threshold (70% of the window) is a trigger
-// for the paid summarizer, not the hard limit; the reactive path compares
-// against the window itself, with a small margin for estimate error, so a
-// history pruned to, say, 85% of the window takes the free retry.
-func (state *compactionState) fitsWindow(size int) bool {
-	if state.window <= 0 {
-		return size <= state.threshold
-	}
-	return size <= state.window-state.window/20
-}
-
 // maybeCompact runs proactive compaction at the top of a turn. It returns the
 // (possibly compacted) message slice. It is a no-op when compaction is disabled,
 // when the history is under threshold, or when the history has not grown past
@@ -628,34 +528,10 @@ func (state *compactionState) recover(
 		// context-limit error never triggers an unexpected summarization call.
 		return messages, false, nil
 	}
-	if !isContextLimitError(errorMessage) {
+	if state.reactiveAttempted {
 		return messages, false, nil
 	}
-
-	// CHEAP FIRST STAGE (mirrors maybeCompact): a context-limit failure can
-	// often be fixed for free by dropping superseded reads and pruning old
-	// tool-result bodies. It runs regardless of the one-shot reactive budget
-	// (it costs nothing and cannot loop: a second pass finds nothing left to
-	// prune). The free retry is taken only when the pruned history fits the
-	// window the provider enforces — otherwise a retry would fail the same
-	// way, so fall through to the paid summarizer in this same call.
-	toolTokens := estimateToolDefTokens(tools)
-	prunedAny := false
-	if pruned, reclaimed := pruneSupersededReadResults(messages); reclaimed > 0 {
-		messages, prunedAny = pruned, true
-	}
-	if pruned, reclaimed := pruneStaleToolOutput(messages, state.preserveLast); reclaimed > 0 {
-		messages, prunedAny = pruned, true
-	}
-	if prunedAny {
-		size := state.calibratedTokens(estimateTokens(messages) + toolTokens)
-		if state.fitsWindow(size) {
-			state.lowWaterMark = size
-			return messages, true, nil
-		}
-	}
-
-	if state.reactiveAttempted {
+	if !isContextLimitError(errorMessage) {
 		return messages, false, nil
 	}
 
@@ -695,21 +571,11 @@ func (state *compactionState) recover(
 // provider call. The summary stream intentionally does NOT forward OnText (so
 // compaction stays invisible on the user-facing surface), but it DOES forward
 // OnUsage so the summarizer's token cost is still counted by usage/budgeting.
-// The call goes to the dedicated (cheap) summarizer when one applies; if that
-// call fails the summarizer is marked broken for the current model and the
-// same slice is retried once on the main provider, so the caller sees at most
-// one (main-provider-quality) error.
 func (state *compactionState) summarizeClosure(ctx context.Context, provider Provider) func([]zeroruntime.Message) (string, error) {
 	if state.planner == nil {
 		state.planner = newContextPlanner(contextPlannerConfig{})
 	}
 	return func(toSummarize []zeroruntime.Message) (string, error) {
-		chosen, dedicated := state.summarizeProvider(ctx, provider)
-		summary, err := summarizeWithPlanner(ctx, chosen, toSummarize, state.onUsage, state.planner, state.trace)
-		if err == nil || !dedicated {
-			return summary, err
-		}
-		state.summarizerBroken = true
 		return summarizeWithPlanner(ctx, provider, toSummarize, state.onUsage, state.planner, state.trace)
 	}
 }
@@ -793,41 +659,8 @@ func summarizeMessagesOnce(ctx context.Context, provider Provider, messages []ze
 	return summary, nil
 }
 
-// summaryToolResultClamp bounds each tool-result body in the summarizer input.
-// Tool outputs dominate the elided middle's bulk (build logs, file reads,
-// search results), yet the summary instructions only need their gist — the
-// model that ACTED on the full output already turned it into decisions the
-// surrounding messages record. 2,000 chars (~500 tokens) keeps the useful
-// head+tail of a result while cutting the summarizer input by 5-10x on
-// tool-heavy sessions; the summarizer's own cost is the price being cut.
-const summaryToolResultClamp = 2000
-
-// summaryToolArgsClamp bounds each tool-call argument blob in the transcript:
-// a write_file call carries the whole file body in its arguments.
-const summaryToolArgsClamp = 500
-
-// clampForSummary head+tail-truncates text for the summarizer transcript,
-// snapping to rune boundaries so the clamp never splits a UTF-8 sequence.
-func clampForSummary(text string, max int) string {
-	if max <= 0 || len(text) <= max {
-		return text
-	}
-	head := max * 3 / 4
-	tail := max - head
-	for head > 0 && !utf8.RuneStart(text[head]) {
-		head--
-	}
-	start := len(text) - tail
-	for start < len(text) && !utf8.RuneStart(text[start]) {
-		start++
-	}
-	return text[:head] + "\n…[" + strconv.Itoa(len(text)-head-(len(text)-start)) + " chars omitted for summarization]…\n" + text[start:]
-}
-
 // renderTranscript flattens messages into a plain-text transcript for the
 // summarizer. Secret scrubbing already happened upstream at the tool boundary.
-// Tool-result bodies and tool-call arguments are clamped (see the constants
-// above): the summary needs what was done and decided, not the raw payloads.
 func renderTranscript(messages []zeroruntime.Message) string {
 	lines := make([]string, 0, len(messages))
 	for _, message := range messages {
@@ -837,13 +670,13 @@ func renderTranscript(messages []zeroruntime.Message) string {
 			if len(message.ToolCalls) > 0 {
 				calls := make([]string, 0, len(message.ToolCalls))
 				for _, call := range message.ToolCalls {
-					calls = append(calls, call.Name+"("+clampForSummary(call.Arguments, summaryToolArgsClamp)+")")
+					calls = append(calls, call.Name+"("+call.Arguments+")")
 				}
 				line += "\n[tool calls: " + strings.Join(calls, "; ") + "]"
 			}
 			lines = append(lines, line)
 		case zeroruntime.MessageRoleTool:
-			lines = append(lines, "tool result: "+clampForSummary(message.Content, summaryToolResultClamp))
+			lines = append(lines, "tool result: "+message.Content)
 		default:
 			lines = append(lines, string(message.Role)+": "+message.Content)
 		}

internal/agent/compaction_cheap_test.go

@@ -1,469 +0,0 @@
-package agent
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-// compactableHistory returns a history whose middle is large enough to trip
-// the proactive threshold for a 1000-token window.
-func compactableHistory() []zeroruntime.Message {
-	return []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: "sys"},
-		{Role: zeroruntime.MessageRoleUser, Content: strings.Repeat("u", 4000)},
-		{Role: zeroruntime.MessageRoleAssistant, Content: strings.Repeat("a", 4000)},
-		{Role: zeroruntime.MessageRoleUser, Content: "u2"},
-		{Role: zeroruntime.MessageRoleAssistant, Content: "a2"},
-		{Role: zeroruntime.MessageRoleUser, Content: "u3"},
-	}
-}
-
-// Summarization must run on the dedicated (cheap) summarizer when one is
-// configured — the main provider sees no summarize traffic at all.
-func TestMaybeCompactUsesDedicatedSummarizer(t *testing.T) {
-	cheap := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "CHEAP SUMMARY"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	main := &mockProvider{}
-	factoryCalls := 0
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer: func(context.Context, string) (Provider, error) {
-			factoryCalls++
-			return cheap, nil
-		},
-	}, nil)
-
-	compacted := state.maybeCompact(context.Background(), main, compactableHistory(), nil)
-
-	if len(cheap.requests) == 0 {
-		t.Fatal("dedicated summarizer never received the summarize call")
-	}
-	if len(main.requests) != 0 {
-		t.Fatalf("main provider must see no summarize traffic, got %d requests", len(main.requests))
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("summarizer factory calls = %d, want 1 (lazy, memoized)", factoryCalls)
-	}
-	if estimateTokens(compacted) >= estimateTokens(compactableHistory()) {
-		t.Fatal("compaction did not shrink the history")
-	}
-	found := false
-	for _, message := range compacted {
-		if strings.Contains(message.Content, "CHEAP SUMMARY") {
-			found = true
-		}
-	}
-	if !found {
-		t.Fatal("cheap summarizer's summary missing from the compacted history")
-	}
-}
-
-// A failing summarizer falls back to the main provider for the SAME slice and
-// stays broken for the rest of the run — no repeated failed cheap calls.
-func TestSummarizerFailureFallsBackToMainAndSticks(t *testing.T) {
-	broken := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventError, Error: "boom: model not found"},
-	}}}
-	main := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY"}, {Type: zeroruntime.StreamEventDone}},
-		{{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY 2"}, {Type: zeroruntime.StreamEventDone}},
-	}}
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer:             func(context.Context, string) (Provider, error) { return broken, nil },
-	}, nil)
-	summarize := state.summarizeClosure(context.Background(), main)
-	input := []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}}
-
-	summary, err := summarize(input)
-	if err != nil {
-		t.Fatalf("fallback must succeed via the main provider: %v", err)
-	}
-	if summary != "MAIN SUMMARY" {
-		t.Fatalf("summary = %q, want the main provider's", summary)
-	}
-	if len(broken.requests) != 1 {
-		t.Fatalf("broken summarizer requests = %d, want exactly 1", len(broken.requests))
-	}
-	if !state.summarizerBroken {
-		t.Fatal("a failed summarizer must be marked broken for the run")
-	}
-
-	// Second summarization: straight to main, no cheap retry.
-	if _, err := summarize(input); err != nil {
-		t.Fatal(err)
-	}
-	if len(broken.requests) != 1 {
-		t.Fatalf("broken summarizer was retried (%d requests)", len(broken.requests))
-	}
-	if len(main.requests) != 2 {
-		t.Fatalf("main provider requests = %d, want 2", len(main.requests))
-	}
-}
-
-// A factory that errors (misconfigured model) is equivalent to no summarizer:
-// main provider used, factory not retried.
-func TestSummarizerFactoryErrorFallsBack(t *testing.T) {
-	main := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	factoryCalls := 0
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer: func(context.Context, string) (Provider, error) {
-			factoryCalls++
-			return nil, errors.New("unknown model")
-		},
-	}, nil)
-	summarize := state.summarizeClosure(context.Background(), main)
-
-	summary, err := summarize([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}})
-	if err != nil || summary != "MAIN SUMMARY" {
-		t.Fatalf("summary = %q, err = %v; want main provider fallback", summary, err)
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("factory calls = %d, want 1 (sticky failure)", factoryCalls)
-	}
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("after a factory failure the run must stay on the main provider")
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("factory retried after failure (%d calls)", factoryCalls)
-	}
-}
-
-// Tool payloads are clamped in the summarizer transcript: results to
-// summaryToolResultClamp, call arguments to summaryToolArgsClamp.
-func TestRenderTranscriptClampsToolPayloads(t *testing.T) {
-	bigResult := strings.Repeat("r", 50_000)
-	bigArgs := strings.Repeat("w", 20_000)
-	transcript := renderTranscript([]zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleAssistant, Content: "editing", ToolCalls: []zeroruntime.ToolCall{
-			{ID: "c1", Name: "write_file", Arguments: bigArgs},
-		}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "c1", Content: bigResult},
-		{Role: zeroruntime.MessageRoleUser, Content: "keep going"},
-	})
-
-	if len(transcript) > summaryToolResultClamp+summaryToolArgsClamp+1024 {
-		t.Fatalf("transcript is %d bytes; clamps did not apply", len(transcript))
-	}
-	if !strings.Contains(transcript, "chars omitted for summarization") {
-		t.Fatal("clamped transcript must carry the omission marker")
-	}
-	if !strings.Contains(transcript, "keep going") {
-		t.Fatal("non-tool content must survive unclamped")
-	}
-	// Head AND tail of the clamped payloads survive.
-	if !strings.HasPrefix(transcript[strings.Index(transcript, "tool result: ")+len("tool result: "):], "r") ||
-		!strings.Contains(transcript, "rrr\n\nuser: keep going") {
-		t.Fatalf("head/tail of the tool result lost:\n%s", transcript[:200])
-	}
-}
-
-// bigToolHistory returns a history with n large tool results (~40k estimated
-// tokens each): the trailing protection window keeps the newest verbatim,
-// the older ones are prunable.
-func bigToolHistory(n int) []zeroruntime.Message {
-	bigBody := strings.Repeat("x", 160_000)
-	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleSystem, Content: "sys"}}
-	for i := 0; i < n; i++ {
-		id := string(rune('a' + i))
-		messages = append(messages,
-			zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{{ID: id, Name: "read_file", Arguments: "{\"path\":\"" + id + "\"}"}}},
-			zeroruntime.Message{Role: zeroruntime.MessageRoleTool, ToolCallID: id, Content: bigBody},
-		)
-	}
-	return append(messages, zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "go"})
-}
-
-func summaryProvider(text string) *mockProvider {
-	return &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{{Type: zeroruntime.StreamEventText, Content: text}, {Type: zeroruntime.StreamEventDone}},
-		{{Type: zeroruntime.StreamEventText, Content: text}, {Type: zeroruntime.StreamEventDone}},
-	}}
-}
-
-// A context-limit error is first answered with the free prune stage; when the
-// pruned history fits the window the retry is free (no summarizer call) and
-// the one-shot reactive budget is untouched. The paid summarizer only runs
-// when a later error finds nothing left to prune.
-func TestRecoverPrunesBeforeSummarizing(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	// The protected trailing tool output (~40k tokens) must fit the window.
-	state := newCompactionState(Options{ContextWindow: 200_000, CompactionPreserveLast: 2}, nil)
-	messages := bigToolHistory(5)
-
-	pruned, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("prunable history that fits must produce a free retry")
-	}
-	if len(provider.requests) != 0 {
-		t.Fatalf("free prune stage must not call the summarizer (%d requests)", len(provider.requests))
-	}
-	if state.reactiveAttempted {
-		t.Fatal("a free prune retry must not consume the reactive budget")
-	}
-	if estimateTokens(pruned) >= estimateTokens(messages) {
-		t.Fatal("prune did not shrink the history")
-	}
-
-	// Second context-limit error on the pruned history: nothing meaningfully
-	// prunable remains, so the paid summarizer fires and consumes the budget.
-	_, retried, err = state.recover(context.Background(), provider, pruned, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("second recover must compact and retry")
-	}
-	if len(provider.requests) == 0 {
-		t.Fatal("second recover must reach the summarizer")
-	}
-	if !state.reactiveAttempted {
-		t.Fatal("a paid recover must consume the reactive budget")
-	}
-}
-
-// When pruning reclaims something but the pruned history still exceeds the
-// window, recover falls through to the paid summarizer in the SAME call
-// instead of spending a retry that would fail the same way.
-func TestRecoverFallsThroughToSummarizerWhenPruneIsInsufficient(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	// A 1,000-token window: even the protected trailing output overflows it.
-	state := newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2}, nil)
-	messages := bigToolHistory(5)
-
-	compacted, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("insufficient prune must still end in a retry via summarization")
-	}
-	if len(provider.requests) == 0 {
-		t.Fatal("insufficient prune must reach the summarizer in the same recover call")
-	}
-	if !state.reactiveAttempted {
-		t.Fatal("the paid summarizer consumes the reactive budget")
-	}
-	if estimateTokens(compacted) >= estimateTokens(messages) {
-		t.Fatal("recover did not shrink the history")
-	}
-}
-
-// The free prune stage is not gated behind the one-shot budget: after a paid
-// reactive compaction, a later context-limit error still gets a free retry
-// when pruning makes the history fit.
-func TestRecoverFreePruneRunsAfterBudgetIsSpent(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	state := newCompactionState(Options{ContextWindow: 200_000, CompactionPreserveLast: 2}, nil)
-	state.reactiveAttempted = true
-	messages := bigToolHistory(5)
-
-	pruned, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried || len(provider.requests) != 0 {
-		t.Fatalf("free prune must retry without the summarizer even when the budget is spent (retried=%v, requests=%d)", retried, len(provider.requests))
-	}
-	if estimateTokens(pruned) >= estimateTokens(messages) {
-		t.Fatal("prune did not shrink the history")
-	}
-	// With nothing left to prune and the budget spent, the caller keeps its
-	// original error — recover neither loops nor summarizes.
-	_, retried, err = state.recover(context.Background(), provider, pruned, nil, "maximum context length exceeded")
-	if err != nil || retried || len(provider.requests) != 0 {
-		t.Fatalf("spent budget must not summarize again (retried=%v, requests=%d, err=%v)", retried, len(provider.requests), err)
-	}
-}
-
-// The free-retry gate compares against the window the provider enforces, not
-// the 70% proactive threshold: a history pruned to ~80% of the window still
-// takes the free retry.
-func TestRecoverFreeRetryGateUsesWindowNotThreshold(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	messages := bigToolHistory(5)
-	pruned, _ := pruneStaleToolOutput(messages, 2)
-	prunedTokens := estimateTokens(pruned)
-	// Choose a window so the pruned size sits between 70% and 95% of it.
-	window := prunedTokens * 100 / 80
-	state := newCompactionState(Options{ContextWindow: window, CompactionPreserveLast: 2}, nil)
-	if prunedTokens <= state.threshold {
-		t.Fatalf("test setup: pruned size %d must exceed the proactive threshold %d", prunedTokens, state.threshold)
-	}
-
-	_, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried || len(provider.requests) != 0 {
-		t.Fatalf("a history that fits the window must take the free retry (retried=%v, requests=%d)", retried, len(provider.requests))
-	}
-}
-
-// After a mid-run model switch the summarizer is re-resolved against the new
-// main model: a run that started on the cheap model (no dedicated summarizer)
-// and escalated gets a cheap summarizer, and a previously broken one is
-// retried for the new model.
-func TestSwitchModelReresolvesSummarizer(t *testing.T) {
-	cheap := summaryProvider("CHEAP SUMMARY")
-	main := summaryProvider("MAIN SUMMARY")
-	var factoryModels []string
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Model:                  "cheap-model",
-		Summarizer: func(_ context.Context, mainModelID string) (Provider, error) {
-			factoryModels = append(factoryModels, mainModelID)
-			if mainModelID == "cheap-model" {
-				return nil, nil // main already is the cheap model
-			}
-			return cheap, nil
-		},
-	}, nil)
-
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("on the cheap model the main provider must summarize")
-	}
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated || len(factoryModels) != 1 {
-		t.Fatalf("factory must run once per main model, calls=%v", factoryModels)
-	}
-
-	state.switchModel("big-model", 400_000)
-	if state.threshold != compactionThreshold(400_000) || state.window != 400_000 {
-		t.Fatalf("switchModel must re-derive the window, got threshold=%d window=%d", state.threshold, state.window)
-	}
-	if got, dedicated := state.summarizeProvider(context.Background(), main); !dedicated || got != Provider(cheap) {
-		t.Fatal("after escalating to an expensive model the dedicated cheap summarizer must be used")
-	}
-	if len(factoryModels) != 2 || factoryModels[1] != "big-model" {
-		t.Fatalf("factory must be re-invoked with the new main model, calls=%v", factoryModels)
-	}
-
-	// A broken summarizer is retried after the next switch.
-	state.summarizerBroken = true
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("a broken summarizer must fall back to main")
-	}
-	state.switchModel("other-model", 0)
-	if got, dedicated := state.summarizeProvider(context.Background(), main); !dedicated || got != Provider(cheap) {
-		t.Fatal("a model switch must clear the broken flag and rebuild the summarizer")
-	}
-}
-
-func TestCompactionUpdateWindow(t *testing.T) {
-	state := newCompactionState(Options{ContextWindow: 100_000, CompactionPreserveLast: 2}, nil)
-	state.lowWaterMark = 50_000
-	before := state.threshold
-
-	state.updateWindow(0) // unknown model: unchanged
-	if state.threshold != before || state.lowWaterMark != 50_000 {
-		t.Fatal("updateWindow(0) must be a no-op")
-	}
-
-	state.updateWindow(10_000)
-	if state.threshold >= before {
-		t.Fatalf("threshold = %d, want re-derived below %d", state.threshold, before)
-	}
-	if state.lowWaterMark != 0 {
-		t.Fatal("low-water mark must reset on a window change")
-	}
-	if !state.enabled {
-		t.Fatal("a positive window must keep compaction enabled")
-	}
-}
-
-// End-to-end: after escalate_model switches providers, the loop re-derives the
-// context window via ContextWindowFor, visible in the OnContext report.
-func TestRunEscalationRederivesContextWindow(t *testing.T) {
-	registry := tools.NewRegistry()
-	registry.Register(escalatingTool{target: "big-model"})
-	switched := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "done"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call-1", ToolName: "escalate"},
-		{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call-1", ArgumentsFragment: `{}`},
-		{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call-1"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-
-	var windows []int
-	result, err := Run(context.Background(), "go", provider, Options{
-		Registry:      registry,
-		ContextWindow: 100_000,
-		Model:         "small-model",
-		ModelSwitcher: func(context.Context, string) (Provider, error) { return switched, nil },
-		ContextWindowFor: func(modelID string) int {
-			if modelID == "big-model" {
-				return 400_000
-			}
-			return 0
-		},
-		OnContext: func(breakdown ContextBreakdown) { windows = append(windows, breakdown.ContextWindow) },
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q", result.FinalAnswer)
-	}
-	if len(windows) < 2 {
-		t.Fatalf("expected at least 2 OnContext reports, got %d", len(windows))
-	}
-	if windows[0] != 100_000 {
-		t.Fatalf("turn 1 window = %d, want the original 100000", windows[0])
-	}
-	if windows[len(windows)-1] != 400_000 {
-		t.Fatalf("post-escalation window = %d, want 400000", windows[len(windows)-1])
-	}
-}
-
-// nonComparableProvider has a slice field, so comparing two Provider interface
-// values holding it would panic; the summarizer path must never compare them.
-type nonComparableProvider struct {
-	inner *mockProvider
-	tags  []string
-}
-
-func (p nonComparableProvider) StreamCompletion(ctx context.Context, request zeroruntime.CompletionRequest) (<-chan zeroruntime.StreamEvent, error) {
-	return p.inner.StreamCompletion(ctx, request)
-}
-
-func TestSummarizeClosureNeverComparesProviderValues(t *testing.T) {
-	broken := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventError, Error: "boom: model not found"},
-	}}}
-	main := nonComparableProvider{inner: summaryProvider("MAIN SUMMARY"), tags: []string{"x"}}
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer:             func(context.Context, string) (Provider, error) { return nonComparableProvider{inner: broken}, nil },
-	}, nil)
-	summary, err := state.summarizeClosure(context.Background(), main)([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}})
-	if err != nil || summary != "MAIN SUMMARY" {
-		t.Fatalf("fallback with non-comparable providers must not panic and must use main, got %q err=%v", summary, err)
-	}
-	// And with no dedicated summarizer at all the closure still works.
-	state = newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2}, nil)
-	if _, err := state.summarizeClosure(context.Background(), main)([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}}); err != nil {
-		t.Fatal(err)
-	}
-}

internal/agent/compaction_projection.go

@@ -126,11 +126,8 @@ func capCompactionBrief(brief string) (string, bool) {
 
 func compactionToolCallLine(call zeroruntime.ToolCall) string {
 	detail := ""
-	if call.Freeform && call.Name == "apply_patch" {
-		detail = strings.Join(patchPaths(call.Arguments), ", ")
-	}
 	var arguments map[string]any
-	if detail == "" && json.Unmarshal([]byte(strings.TrimSpace(call.Arguments)), &arguments) == nil {
+	if json.Unmarshal([]byte(strings.TrimSpace(call.Arguments)), &arguments) == nil {
 		for _, key := range []string{"file_path", "path", "url", "query", "pattern", "prompt", "description", "question"} {
 			if value, ok := arguments[key].(string); ok && strings.TrimSpace(value) != "" {
 				detail = value

internal/agent/compaction_projection_test.go

@@ -73,7 +73,6 @@ func TestProjectCompactionInputRetainsAskUserExchangeAndSemanticArguments(t *tes
 		{Role: zeroruntime.MessageRoleTool, ToolCallID: "ask", Content: "Which database should remain?: Postgres only; do not touch MySQL."},
 		{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{
 			{ID: "patch", Name: "apply_patch", Arguments: `{"patch":"*** Begin Patch\n*** Update File: internal/db.go\n*** End Patch"}`},
-			{ID: "raw-patch", Name: "apply_patch", Freeform: true, Arguments: "*** Begin Patch\n*** Update File: internal/api.go\n*** Add File: internal/config.go\n*** End Patch\n"},
 			{ID: "fetch", Name: "web_fetch", Arguments: `{"url":"https://example.com/spec"}`},
 			{ID: "task", Name: "task", Arguments: `{"prompt":"Inspect the Windows implementation"}`},
 		}},
@@ -81,7 +80,7 @@ func TestProjectCompactionInputRetainsAskUserExchangeAndSemanticArguments(t *tes
 	}
 
 	content := projectCompactionInput(messages).messages[0].Content
-	for _, want := range []string{"Which database should remain?", "Postgres only; do not touch MySQL", "internal/db.go", "internal/api.go", "internal/config.go", "https://example.com/spec", "Inspect the Windows implementation"} {
+	for _, want := range []string{"Which database should remain?", "Postgres only; do not touch MySQL", "internal/db.go", "https://example.com/spec", "Inspect the Windows implementation"} {
 		if !strings.Contains(content, want) {
 			t.Fatalf("projection missing %q: %q", want, content)
 		}

internal/agent/compaction_test.go

@@ -275,27 +275,6 @@ func TestEstimateToolDefTokensCountsDefinitions(t *testing.T) {
 	if estimateToolDefTokens(one) <= 0 {
 		t.Fatal("a tool definition (name + description + schema) should estimate > 0 tokens")
 	}
-	typed := append([]zeroruntime.ToolDefinition(nil), one...)
-	typed[0].Type = zeroruntime.ToolDefinitionFreeform
-	if estimateToolDefTokens(typed) <= estimateToolDefTokens(one) {
-		t.Fatal("a non-empty tool type must increase the estimated request cost")
-	}
-	for _, test := range []struct {
-		name   string
-		format zeroruntime.ToolDefinitionFormat
-	}{
-		{name: "type", format: zeroruntime.ToolDefinitionFormat{Type: "grammar"}},
-		{name: "syntax", format: zeroruntime.ToolDefinitionFormat{Syntax: "lark"}},
-		{name: "definition", format: zeroruntime.ToolDefinitionFormat{Definition: "start: WORD"}},
-	} {
-		t.Run("format "+test.name, func(t *testing.T) {
-			formatted := append([]zeroruntime.ToolDefinition(nil), one...)
-			formatted[0].Format = &test.format
-			if estimateToolDefTokens(formatted) <= estimateToolDefTokens(one) {
-				t.Fatalf("a non-empty format %s must increase the estimated request cost", test.name)
-			}
-		})
-	}
 	two := append(append([]zeroruntime.ToolDefinition{}, one...), zeroruntime.ToolDefinition{
 		Name:        "write_file",
 		Description: "Write contents to a file in the workspace.",

internal/agent/context_planner.go

@@ -102,10 +102,6 @@ func copyToolDefinitions(toolDefs []zeroruntime.ToolDefinition) []zeroruntime.To
 	for index, definition := range toolDefs {
 		copied[index] = definition
 		copied[index].Parameters = copySchemaMap(definition.Parameters)
-		if definition.Format != nil {
-			format := *definition.Format
-			copied[index].Format = &format
-		}
 	}
 	return copied
 }

internal/agent/context_planner_test.go

@@ -15,7 +15,6 @@ func TestContextPlannerPreservesProviderRequest(t *testing.T) {
 	}
 	toolDefs := []zeroruntime.ToolDefinition{{
 		Name: "read_file", Description: "Read a file",
-		Format: &zeroruntime.ToolDefinitionFormat{Type: "grammar", Syntax: "lark", Definition: "start: PATH"},
 		Parameters: map[string]any{
 			"type":       "object",
 			"required":   []string{"path"},
@@ -54,12 +53,10 @@ func TestContextPlannerPreservesProviderRequest(t *testing.T) {
 	toolDefs[0].Parameters["required"].([]string)[0] = "other"
 	toolDefs[0].Parameters["properties"].(map[string]any)["path"].(map[string]any)["type"] = "integer"
 	toolDefs[0].Parameters["anyOf"].([]any)[0].(map[string]any)["type"] = "array"
-	toolDefs[0].Format.Definition = "changed"
 	if plan.Request.Messages[1].Content != "inspect this" || plan.Request.Messages[1].Images[0].Data[0] != 1 {
 		t.Fatalf("planned messages alias caller state: %#v", plan.Request.Messages[1])
 	}
 	if plan.Request.Tools[0].Name != "read_file" ||
-		plan.Request.Tools[0].Format == nil || plan.Request.Tools[0].Format.Definition != "start: PATH" ||
 		plan.Request.Tools[0].Parameters["required"].([]string)[0] != "path" ||
 		plan.Request.Tools[0].Parameters["properties"].(map[string]any)["path"].(map[string]any)["type"] != "string" ||
 		plan.Request.Tools[0].Parameters["anyOf"].([]any)[0].(map[string]any)["type"] != "object" {

internal/agent/freeform_tool_test.go

@@ -1,378 +0,0 @@
-package agent
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-type customApplyPatchTool struct {
-	calls int
-}
-
-type fixedPathScope struct {
-	roots []string
-}
-
-func (scope fixedPathScope) Roots() []string {
-	return append([]string(nil), scope.roots...)
-}
-
-func newFixedPathScope(t *testing.T, roots ...string) fixedPathScope {
-	t.Helper()
-	resolved := make([]string, 0, len(roots))
-	for _, root := range roots {
-		absolute, err := filepath.Abs(root)
-		if err != nil {
-			t.Fatalf("Abs(%q): %v", root, err)
-		}
-		if physical, err := filepath.EvalSymlinks(absolute); err == nil {
-			absolute = physical
-		}
-		resolved = append(resolved, absolute)
-	}
-	return fixedPathScope{roots: resolved}
-}
-
-func (*customApplyPatchTool) Name() string        { return "apply_patch" }
-func (*customApplyPatchTool) Description() string { return "custom JSON tool" }
-func (*customApplyPatchTool) Parameters() tools.Schema {
-	return tools.Schema{Type: "object", Properties: map[string]tools.PropertySchema{"value": {Type: "string"}}}
-}
-func (*customApplyPatchTool) Safety() tools.Safety {
-	return tools.Safety{Permission: tools.PermissionAllow, SideEffect: tools.SideEffectRead}
-}
-func (tool *customApplyPatchTool) Run(context.Context, map[string]any) tools.Result {
-	tool.calls++
-	return tools.Result{Status: tools.StatusOK}
-}
-
-func TestFreeformApplyPatchUsesExistingToolExecutionPath(t *testing.T) {
-	root := t.TempDir()
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, nil))
-	patch := "*** Begin Patch\n*** Add File: hello.txt\n+hello\n*** End Patch\n"
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID:        "call-1",
-		Name:      "apply_patch",
-		Arguments: patch,
-		Freeform:  true,
-	}, PermissionModeUnsafe, Options{Cwd: root, FileTracker: tools.NewFileTracker()})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusOK {
-		t.Fatalf("freeform apply_patch status = %s: %s", result.Status, result.Output)
-	}
-	content, err := os.ReadFile(filepath.Join(root, "hello.txt"))
-	if err != nil {
-		t.Fatalf("read patched file: %v", err)
-	}
-	if string(content) != "hello\n" {
-		t.Fatalf("patched content = %q, want hello newline", content)
-	}
-}
-
-func TestFreeformApplyPatchSupportsGrantedExtraRoot(t *testing.T) {
-	root := t.TempDir()
-	extra := t.TempDir()
-	scope, err := sandbox.NewScope(root, []string{extra})
-	if err != nil {
-		t.Fatalf("NewScope: %v", err)
-	}
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, scope))
-	target := filepath.Join(extra, "hello.txt")
-	patch := "*** Begin Patch\n*** Add File: " + target + "\n+hello\n*** End Patch\n"
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID: "call-1", Name: "apply_patch", Arguments: patch, Freeform: true,
-	}, PermissionModeUnsafe, Options{Cwd: root, FileTracker: tools.NewFileTracker()})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusOK {
-		t.Fatalf("freeform extra-root apply_patch status = %s: %s", result.Status, result.Output)
-	}
-	content, err := os.ReadFile(target)
-	if err != nil {
-		t.Fatalf("read extra-root patched file: %v", err)
-	}
-	if string(content) != "hello\n" {
-		t.Fatalf("patched content = %q, want hello newline", content)
-	}
-}
-
-func TestFreeformApplyPatchRejectsMixedWorkspaceAndExtraRoots(t *testing.T) {
-	for _, extraHasMatchingPath := range []bool{false, true} {
-		name := "extra target missing"
-		if extraHasMatchingPath {
-			name = "extra target exists"
-		}
-		t.Run(name, func(t *testing.T) {
-			workspace := t.TempDir()
-			extra := t.TempDir()
-			if err := os.MkdirAll(filepath.Join(workspace, "src"), 0o755); err != nil {
-				t.Fatal(err)
-			}
-			workspaceTarget := filepath.Join(workspace, "src", "a.go")
-			if err := os.WriteFile(workspaceTarget, []byte("old\n"), 0o644); err != nil {
-				t.Fatal(err)
-			}
-			extraTarget := filepath.Join(extra, "src", "a.go")
-			if extraHasMatchingPath {
-				if err := os.MkdirAll(filepath.Dir(extraTarget), 0o755); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(extraTarget, []byte("old\n"), 0o644); err != nil {
-					t.Fatal(err)
-				}
-			}
-			scope, err := sandbox.NewScope(workspace, []string{extra})
-			if err != nil {
-				t.Fatal(err)
-			}
-			registry := tools.NewRegistry()
-			registry.Register(tools.NewScopedApplyPatchTool(workspace, scope))
-			extraCreated := filepath.Join(extra, "b.go")
-			patch := strings.Join([]string{
-				"*** Begin Patch",
-				"*** Update File: src/a.go",
-				"@@",
-				"-old",
-				"+new",
-				"*** Add File: " + extraCreated,
-				"+extra",
-				"*** End Patch",
-			}, "\n")
-
-			result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-				ID: "call-1", Name: "apply_patch", Arguments: patch, Freeform: true,
-			}, PermissionModeUnsafe, Options{Cwd: workspace, FileTracker: tools.NewFileTracker()})
-			if err != nil {
-				t.Fatalf("executeToolCall: %v", err)
-			}
-			if result.Status != tools.StatusError || !strings.Contains(result.Output, "mixes workspace-relative paths with an extra write root") {
-				t.Fatalf("mixed-root patch result = %s: %s", result.Status, result.Output)
-			}
-			if content, err := os.ReadFile(workspaceTarget); err != nil || string(content) != "old\n" {
-				t.Fatalf("workspace target changed: content=%q err=%v", content, err)
-			}
-			if extraHasMatchingPath {
-				if content, err := os.ReadFile(extraTarget); err != nil || string(content) != "old\n" {
-					t.Fatalf("extra-root target changed: content=%q err=%v", content, err)
-				}
-			}
-			if _, err := os.Stat(extraCreated); !os.IsNotExist(err) {
-				t.Fatalf("mixed-root patch created extra file: %v", err)
-			}
-		})
-	}
-}
-
-func TestFreeformApplyPatchAcceptsOneSemanticRoot(t *testing.T) {
-	for _, test := range []struct {
-		name         string
-		useExtraRoot bool
-	}{
-		{name: "workspace"},
-		{name: "extra root", useExtraRoot: true},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			workspace := t.TempDir()
-			extra := t.TempDir()
-			scope, err := sandbox.NewScope(workspace, []string{extra})
-			if err != nil {
-				t.Fatal(err)
-			}
-			root := workspace
-			if test.useExtraRoot {
-				root = extra
-			}
-			if err := os.MkdirAll(filepath.Join(root, "src"), 0o755); err != nil {
-				t.Fatal(err)
-			}
-			target := filepath.Join(root, "src", "a.go")
-			if err := os.WriteFile(target, []byte("old\n"), 0o644); err != nil {
-				t.Fatal(err)
-			}
-			updatePath := target
-			if !test.useExtraRoot {
-				updatePath = filepath.Join("src", "a.go")
-			}
-			created := filepath.Join(root, "b.go")
-			patch := strings.Join([]string{
-				"*** Begin Patch",
-				"*** Update File: " + updatePath,
-				"@@",
-				"-old",
-				"+new",
-				"*** Add File: " + created,
-				"+created",
-				"*** End Patch",
-			}, "\n")
-			registry := tools.NewRegistry()
-			registry.Register(tools.NewScopedApplyPatchTool(workspace, scope))
-			result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-				ID: "call-1", Name: "apply_patch", Arguments: patch, Freeform: true,
-			}, PermissionModeUnsafe, Options{Cwd: workspace, FileTracker: tools.NewFileTracker()})
-			if err != nil {
-				t.Fatalf("executeToolCall: %v", err)
-			}
-			if result.Status != tools.StatusOK {
-				t.Fatalf("single-root patch status = %s: %s", result.Status, result.Output)
-			}
-			if content, err := os.ReadFile(target); err != nil || string(content) != "new\n" {
-				t.Fatalf("updated content=%q err=%v", content, err)
-			}
-			if content, err := os.ReadFile(created); err != nil || string(content) != "created\n" {
-				t.Fatalf("created content=%q err=%v", content, err)
-			}
-		})
-	}
-}
-
-func TestFreeformApplyPatchRejectsAbsolutePathOutsideGrantedRoots(t *testing.T) {
-	root := t.TempDir()
-	granted := t.TempDir()
-	outside := t.TempDir()
-	scope := newFixedPathScope(t, root, granted)
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, scope))
-	target := filepath.Join(outside, "blocked.txt")
-	patch := "*** Begin Patch\n*** Add File: " + target + "\n+blocked\n*** End Patch\n"
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID: "call-1", Name: "apply_patch", Arguments: patch, Freeform: true,
-	}, PermissionModeUnsafe, Options{Cwd: root})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusError {
-		t.Fatalf("ungranted absolute patch status = %s, want error: %s", result.Status, result.Output)
-	}
-	if _, err := os.Stat(target); !os.IsNotExist(err) {
-		t.Fatalf("ungranted absolute patch created target: %v", err)
-	}
-}
-
-func TestPreparedFreeformPatchRejectsIntermediateSymlinkSwap(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("creating directory symlinks requires privileges on Windows")
-	}
-	root := t.TempDir()
-	extra := t.TempDir()
-	outside := t.TempDir()
-	intermediate := filepath.Join(extra, "nested")
-	if err := os.Mkdir(intermediate, 0o755); err != nil {
-		t.Fatalf("Mkdir: %v", err)
-	}
-	scope := newFixedPathScope(t, root, extra)
-	tool := tools.NewScopedApplyPatchTool(root, scope)
-	target := filepath.Join(intermediate, "blocked.txt")
-	patch := "*** Begin Patch\n*** Add File: " + target + "\n+blocked\n*** End Patch\n"
-	args, err := tools.PrepareFreeformApplyPatchArguments(tool, patch)
-	if err != nil {
-		t.Fatalf("PrepareFreeformApplyPatchArguments: %v", err)
-	}
-
-	if err := os.Remove(intermediate); err != nil {
-		t.Fatalf("Remove intermediate: %v", err)
-	}
-	if err := os.Symlink(outside, intermediate); err != nil {
-		t.Fatalf("Symlink: %v", err)
-	}
-	result := tool.Run(context.Background(), args)
-	if result.Status != tools.StatusError {
-		t.Fatalf("symlink-swapped patch status = %s, want error: %s", result.Status, result.Output)
-	}
-	if _, err := os.Stat(filepath.Join(outside, "blocked.txt")); !os.IsNotExist(err) {
-		t.Fatalf("symlink-swapped patch wrote outside root: %v", err)
-	}
-}
-
-func TestUnknownFreeformToolFailsClosed(t *testing.T) {
-	result, err := executeToolCall(context.Background(), tools.NewRegistry(), zeroruntime.ToolCall{
-		ID: "call-1", Name: "unknown", Arguments: "raw", Freeform: true,
-	}, PermissionModeUnsafe, Options{})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusError {
-		t.Fatalf("unknown freeform status = %s, want error", result.Status)
-	}
-}
-
-func TestCustomApplyPatchCannotUseFreeformContract(t *testing.T) {
-	custom := &customApplyPatchTool{}
-	registry := tools.NewRegistry()
-	registry.Register(custom)
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID: "call-1", Name: "apply_patch", Arguments: "raw patch", Freeform: true,
-	}, PermissionModeUnsafe, Options{})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusError || !strings.Contains(result.Output, "Unsupported freeform tool call") {
-		t.Fatalf("custom freeform apply_patch result = %#v, want unsupported error", result)
-	}
-	if custom.calls != 0 {
-		t.Fatalf("custom apply_patch executed %d times", custom.calls)
-	}
-}
-
-func TestDeniedFreeformApplyPatchDoesNotWrite(t *testing.T) {
-	root := t.TempDir()
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, nil))
-	patch := "*** Begin Patch\n*** Add File: denied.txt\n+must not exist\n*** End Patch\n"
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID:        "call-1",
-		Name:      "apply_patch",
-		Arguments: patch,
-		Freeform:  true,
-	}, PermissionModeAsk, Options{
-		Cwd: root,
-		OnPermissionRequest: func(context.Context, PermissionRequest) (PermissionDecision, error) {
-			return PermissionDecision{Action: PermissionDecisionDeny, Reason: "test denial"}, nil
-		},
-	})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusError {
-		t.Fatalf("denied freeform status = %s, want error", result.Status)
-	}
-	if _, err := os.Stat(filepath.Join(root, "denied.txt")); !os.IsNotExist(err) {
-		t.Fatalf("denied freeform patch changed the workspace: %v", err)
-	}
-}
-
-func TestHistorySafeToolCallsPreservesRawFreeformArguments(t *testing.T) {
-	raw := "*** Begin Patch\n*** Update File: internal/main.go\n@@\n-old\n+new\n*** End Patch\n"
-	safe := historySafeToolCalls([]ToolCall{{
-		ID: "call-1", ProviderCallID: "provider-1", Name: "apply_patch", Arguments: raw, Freeform: true,
-	}})
-	if len(safe) != 1 || safe[0].Arguments != raw || safe[0].ProviderCallID != "provider-1" || !safe[0].Freeform {
-		t.Fatalf("freeform history changed raw call: %#v", safe)
-	}
-}
-
-func TestAbortedToolResultPreservesProviderCallID(t *testing.T) {
-	messages := appendAbortedToolResults(nil, []ToolCall{{
-		ID: "call-1", ProviderCallID: "provider-1", Name: "read_file",
-	}})
-	if len(messages) != 1 || messages[0].ToolCallID != "call-1" || messages[0].ToolCallProviderID != "provider-1" || !messages[0].IsError {
-		t.Fatalf("aborted tool result lost provider identity: %#v", messages)
-	}
-}

internal/agent/guardrails.go

@@ -33,11 +33,11 @@ const (
 	// knows before spending more tool turns.
 	toolOnlyProgressReminderAt = 6
 
-	// planReminderTurn and planReminderToolThreshold keep bounded implementation
-	// work plan-free while still nudging a genuinely sustained run that has not
-	// established any structured progress. Both thresholds must be met.
-	planReminderTurn          = 7
-	planReminderToolThreshold = 7
+	// planReminderTurn is the turn (1-based) by the end of which a multi-step
+	// task should have called update_plan; if it hasn't, a one-time reminder is
+	// injected. Set to 3 (not 2) so short, legitimate two-step tasks finish
+	// without a spurious planning nag.
+	planReminderTurn = 3
 
 	// planToolName is the planning tool the loop watches for by name.
 	planToolName = "update_plan"
@@ -591,12 +591,13 @@ func (state *guardState) planReminder(turn int) string {
 		return planStaleReminder(state.toolCallsSincePlanUpdate)
 	}
 
-	// NOT-CALLED reminder: once both the turn and tool-call thresholds are met,
-	// sustained work should have called update_plan. One-shot for the whole run.
+	// NOT-CALLED reminder: by the end of planReminderTurn the model should have
+	// called update_plan if it's doing a multi-step task (>=1 other tool call).
+	// One-shot for the whole run.
 	if !state.notCalledReminderSent &&
 		!state.planEverCalled &&
 		turn >= planReminderTurn &&
-		state.totalToolCalls >= planReminderToolThreshold {
+		state.totalToolCalls >= 1 {
 		state.notCalledReminderSent = true
 		return planNotCalledReminder()
 	}

internal/agent/guardrails_test.go

@@ -257,16 +257,19 @@ func TestRunDoesNotCountDroppedToolCallTurnsAsEmpty(t *testing.T) {
 }
 
 func TestRunInjectsPlanNotCalledReminderForMultiStepTask(t *testing.T) {
-	const expectedThreshold = 7
-	if planReminderToolThreshold != expectedThreshold {
-		t.Fatalf("plan reminder tool threshold = %d, want %d", planReminderToolThreshold, expectedThreshold)
-	}
 	root := t.TempDir()
 	writeAgentTestFile(t, root+"/notes.txt", "alpha")
 	registry := tools.NewRegistry()
 	registry.Register(tools.NewScopedReadFileTool(root, nil))
 
-	provider := &mockProvider{turns: append(repeatedReadTurns(expectedThreshold), textTurn("done"))}
+	provider := &mockProvider{
+		turns: [][]zeroruntime.StreamEvent{
+			toolTurn("call-1", "read_file", `{"path":"notes.txt"}`), // turn 1: other tool call
+			toolTurn("call-2", "read_file", `{"path":"notes.txt"}`), // turn 2: still no update_plan
+			toolTurn("call-3", "read_file", `{"path":"notes.txt"}`), // turn 3: reminder fires here
+			textTurn("done"),
+		},
+	}
 
 	result, err := Run(context.Background(), "go", provider, Options{
 		Registry: registry,
@@ -284,44 +287,6 @@ func TestRunInjectsPlanNotCalledReminderForMultiStepTask(t *testing.T) {
 	}
 }
 
-func TestRunDoesNotInjectPlanReminderForBoundedToolSequence(t *testing.T) {
-	const expectedThreshold = 7
-	root := t.TempDir()
-	writeAgentTestFile(t, root+"/notes.txt", "alpha")
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(root, nil))
-
-	provider := &mockProvider{turns: append(repeatedReadTurns(expectedThreshold-1), textTurn("done"))}
-	result, err := Run(context.Background(), "go", provider, Options{Registry: registry, MaxTurns: 12})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("expected final answer, got %q", result.FinalAnswer)
-	}
-	if count := countUserMessagesContaining(result.Messages, planNotCalledReminderMarker); count != 0 {
-		t.Fatalf("bounded tool sequence must not draw a plan reminder, got %d", count)
-	}
-}
-
-func TestPlanReminderWaitsForTurnThresholdAfterEnoughToolCalls(t *testing.T) {
-	state := guardState{totalToolCalls: 7}
-	if got := state.planReminder(6); got != "" {
-		t.Fatalf("planReminder(6) = %q, want no reminder before turn threshold", got)
-	}
-	if state.notCalledReminderSent {
-		t.Fatal("early turn marked the not-called reminder as sent")
-	}
-}
-
-func repeatedReadTurns(count int) [][]zeroruntime.StreamEvent {
-	turns := make([][]zeroruntime.StreamEvent, 0, count)
-	for range count {
-		turns = append(turns, toolTurn("call", "read_file", `{"path":"notes.txt"}`))
-	}
-	return turns
-}
-
 func TestRunDoesNotInjectPlanReminderForTrivialTask(t *testing.T) {
 	root := t.TempDir()
 	writeAgentTestFile(t, root+"/notes.txt", "alpha")

internal/agent/loop.go

@@ -40,15 +40,7 @@ const (
 	toolResultControlSpecReview = "spec_review_required"
 )
 
-// ErrPermissionApprovalCanceled ends a run because the caller cancelled a
-// permission prompt, rather than because anything failed.
-//
-// EXPORTED FOR THE SURFACES. A cancel is a normal ending and each surface says
-// so its own way — the TUI unwinds, and ACP has a "cancelled" stop reason for
-// exactly this. While it was unexported ACP could not distinguish it from a
-// fault and reported it as an internal error, so declining a tool looked like
-// the agent crashing.
-var ErrPermissionApprovalCanceled = errors.New("permission approval cancelled")
+var errPermissionApprovalCanceled = errors.New("permission approval cancelled")
 
 // isImageRejectionError reports whether err is a provider 400 that rejects
 // image/multimodal content. This is checked BEFORE the compaction-retry path
@@ -141,7 +133,6 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			}
 			options.Trace.Counter(trace.CounterInputTokens, int64(usage.InputTokens))
 			options.Trace.Counter(trace.CounterCachedInputTokens, int64(usage.CachedInputTokens))
-			options.Trace.Counter(trace.CounterCacheWriteTokens, int64(usage.CacheWriteTokens))
 			options.Trace.Counter(trace.CounterOutputTokens, int64(usage.OutputTokens))
 		}
 	}
@@ -698,12 +689,11 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				turnRequestedModel = toolResult.RequestedModel
 			}
 			messages = append(messages, zeroruntime.Message{
-				Role:               zeroruntime.MessageRoleTool,
-				Content:            toolResult.ModelOutput(),
-				ToolCallID:         toolResult.ToolCallID,
-				ToolCallProviderID: call.ProviderCallID,
-				IsError:            toolResult.Status == tools.StatusError,
-				ChangedFiles:       append([]string(nil), toolResult.ChangedFiles...),
+				Role:         zeroruntime.MessageRoleTool,
+				Content:      toolResult.ModelOutput(),
+				ToolCallID:   toolResult.ToolCallID,
+				IsError:      toolResult.Status == tools.StatusError,
+				ChangedFiles: append([]string(nil), toolResult.ChangedFiles...),
 			})
 			// Images ride a following USER message rather than the tool result
 			// above. Every provider drops images on a tool-role message —
@@ -846,21 +836,11 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 					options.ServiceTier = ""
 					planner.config.serviceTier = ""
 					options.Trace.Counter(trace.CounterModelSwitches, 1)
-					// Re-derive the context window for the new model so compaction and
-					// the OnContext budget report track the model actually in force —
-					// without this a switch to a smaller-window model can overflow the
-					// target, and a switch to a larger one over-compacts. An unknown
-					// model (<= 0) keeps the original window. The compactor also
-					// re-resolves its dedicated summarizer against the new model.
-					window := 0
-					if options.ContextWindowFor != nil {
-						window = options.ContextWindowFor(turnRequestedModel)
-					}
-					if window > 0 {
-						options.ContextWindow = window
-						planner.config.contextWindow = window
-					}
-					compactor.switchModel(turnRequestedModel, window)
+					// KNOWN LIMITATION (deferred): the compactor's context-window budget
+					// is fixed at run start from options.ContextWindow and is NOT updated
+					// here, so a switch to a model with a different window keeps compacting
+					// against the original budget. Fixing it needs the switcher to also
+					// report the new window — out of scope for this change.
 				}
 			}
 		}
@@ -1047,9 +1027,6 @@ func historySafeToolCalls(calls []ToolCall) []ToolCall {
 	safe := make([]ToolCall, len(calls))
 	for i, call := range calls {
 		safe[i] = call
-		if call.Freeform {
-			continue
-		}
 		args := strings.TrimSpace(call.Arguments)
 		switch {
 		case args == "":
@@ -1133,28 +1110,8 @@ func decodeToolArguments(arguments string, v any) error {
 }
 
 func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCall, permissionMode PermissionMode, options Options) (ToolResult, error) {
-	tool, toolFound := registry.Get(call.Name)
 	args := map[string]any{}
-	if call.Freeform {
-		if !toolFound || !tools.IsBuiltInApplyPatch(tool) {
-			return ToolResult{
-				ToolCallID: call.ID,
-				Name:       call.Name,
-				Status:     tools.StatusError,
-				Output:     "Error: Unsupported freeform tool call for " + call.Name + ".",
-			}, nil
-		}
-		prepared, err := tools.PrepareFreeformApplyPatchArguments(tool, call.Arguments)
-		if err != nil {
-			return ToolResult{
-				ToolCallID: call.ID,
-				Name:       call.Name,
-				Status:     tools.StatusError,
-				Output:     "Error: Invalid freeform apply_patch input: " + err.Error(),
-			}, nil
-		}
-		args = prepared
-	} else if call.Arguments != "" {
+	if call.Arguments != "" {
 		if err := decodeToolArguments(call.Arguments, &args); err != nil {
 			return ToolResult{
 				ToolCallID: call.ID,
@@ -1182,6 +1139,7 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 			DenialReason: DenialFiltered,
 		}, nil
 	}
+	tool, toolFound := registry.Get(call.Name)
 	if (permissionMode == PermissionModeSpecDraft || permissionMode == PermissionModePlan) && toolFound && !ToolAdvertised(tool, permissionMode) {
 		modeName := string(permissionMode)
 		return ToolResult{
@@ -1406,7 +1364,7 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 			}
 		case PermissionDecisionCancel:
 			emitCanceledPermission(options, call, requestEvent, decisionReason)
-			return canceledPermissionResult(call, decisionReason, requestEvent), fmt.Errorf("%w for %s", ErrPermissionApprovalCanceled, call.Name)
+			return canceledPermissionResult(call, decisionReason, requestEvent), fmt.Errorf("%w for %s", errPermissionApprovalCanceled, call.Name)
 		default:
 			emitDeniedPermission(options, call, requestEvent, decisionReason)
 			return deniedPermissionResult(call, decisionReason, requestEvent), nil
@@ -1590,7 +1548,7 @@ func maybeRetryUnsandboxedAfterSandboxRestriction(ctx context.Context, registry
 	case PermissionDecisionCancel:
 		emitCanceledPermission(options, call, requestEvent, reason)
 		canceled := canceledPermissionResult(call, reason, requestEvent)
-		return result, &canceled, true, decision.Action, reason, nil, fmt.Errorf("%w for %s", ErrPermissionApprovalCanceled, call.Name)
+		return result, &canceled, true, decision.Action, reason, nil, fmt.Errorf("%w for %s", errPermissionApprovalCanceled, call.Name)
 	default:
 		emitDeniedPermission(options, call, requestEvent, reason)
 		denied := deniedPermissionResult(call, reason, requestEvent)
@@ -1638,7 +1596,7 @@ func maybeRetryWithNetworkAfterSandboxDenial(ctx context.Context, registry *tool
 	case PermissionDecisionCancel:
 		emitCanceledPermission(options, call, requestEvent, reason)
 		canceled := canceledPermissionResult(call, reason, requestEvent)
-		return result, &canceled, true, decision.Action, reason, fmt.Errorf("%w for %s", ErrPermissionApprovalCanceled, call.Name)
+		return result, &canceled, true, decision.Action, reason, fmt.Errorf("%w for %s", errPermissionApprovalCanceled, call.Name)
 	default:
 		emitDeniedPermission(options, call, requestEvent, reason)
 		denied := deniedPermissionResult(call, reason, requestEvent)
@@ -3129,15 +3087,13 @@ func partitionToolsCached(registry *tools.Registry, permissionMode PermissionMod
 	// Deferral may activate only when tool_search is actually runnable; otherwise
 	// the loop would hide deferred tools behind a loader the dispatch gate rejects
 	// — an inescapable dead-end. "Runnable" mirrors executeToolCall's gate:
-	// registered, model-visible, not in DisabledTools, and advertised in the
-	// current permission mode (e.g. not spec-draft, where tool_search is not
-	// advertised). The
+	// registered, not in DisabledTools, and advertised in the current permission
+	// mode (e.g. not spec-draft, where tool_search is not advertised). The
 	// EnabledTools allowlist is intentionally NOT checked here — tool_search is
 	// exempt from the allowlist at dispatch, so an allowlist that omits it must
 	// not disable deferral.
 	loader, loaderFound := registry.Get(tools.ToolSearchToolName)
 	loaderUsable := loaderFound &&
-		tools.ModelVisible(loader) &&
 		!containsToolName(options.DisabledTools, tools.ToolSearchToolName) &&
 		ToolAdvertised(loader, permissionMode)
 
@@ -3244,21 +3200,15 @@ func cachedRuntimeToolDefinition(defCache map[string]zeroruntime.ToolDefinition,
 // runtimeToolDefinition renders a tool's advertised definition (name, description,
 // JSON-schema parameters) as sent to the provider.
 func runtimeToolDefinition(tool tools.Tool) zeroruntime.ToolDefinition {
-	definition := zeroruntime.ToolDefinition{
+	return zeroruntime.ToolDefinition{
 		Name:        tool.Name(),
 		Description: tool.Description(),
 		Parameters:  schemaToRuntimeMap(tool.Parameters()),
 	}
-	if tools.IsBuiltInApplyPatch(tool) {
-		definition.Type = zeroruntime.ToolDefinitionFreeform
-	}
-	return definition
 }
 
 func ToolVisible(tool tools.Tool, permissionMode PermissionMode, enabledTools []string, disabledTools []string) bool {
-	return tools.ModelVisible(tool) &&
-		ToolAllowedByFilters(tool.Name(), enabledTools, disabledTools) &&
-		ToolAdvertised(tool, permissionMode)
+	return ToolAllowedByFilters(tool.Name(), enabledTools, disabledTools) && ToolAdvertised(tool, permissionMode)
 }
 
 func ToolAllowedByFilters(name string, enabledTools []string, disabledTools []string) bool {
@@ -3407,11 +3357,10 @@ func loadedToolsFromResult(meta map[string]string) []string {
 func appendAbortedToolResults(messages []Message, remaining []ToolCall) []Message {
 	for _, call := range remaining {
 		messages = append(messages, zeroruntime.Message{
-			Role:               zeroruntime.MessageRoleTool,
-			Content:            abortedToolResultNotice,
-			ToolCallID:         call.ID,
-			ToolCallProviderID: call.ProviderCallID,
-			IsError:            true,
+			Role:       zeroruntime.MessageRoleTool,
+			Content:    abortedToolResultNotice,
+			ToolCallID: call.ID,
+			IsError:    true,
 		})
 	}
 	return messages

internal/agent/loop_test.go

@@ -1853,7 +1853,7 @@ func TestRunAbortsWhenPermissionRequestCanceled(t *testing.T) {
 		},
 	})
 
-	if !errors.Is(err, ErrPermissionApprovalCanceled) {
+	if !errors.Is(err, errPermissionApprovalCanceled) {
 		t.Fatalf("expected permission approval cancel error, got %v", err)
 	}
 	if result.FinalAnswer != "" {
@@ -4096,7 +4096,7 @@ func TestRunDoesNotFlagCleanToolOutput(t *testing.T) {
 // caller's callback AND stamps token counters, and the run completes.
 func TestRunTracingWrapperStampsUsage(t *testing.T) {
 	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventUsage, Usage: zeroruntime.Usage{PromptTokens: 100, CachedInputTokens: 20, CacheWriteTokens: 10, CompletionTokens: 40}},
+		{Type: zeroruntime.StreamEventUsage, Usage: zeroruntime.Usage{InputTokens: 100, CachedInputTokens: 20, OutputTokens: 40}},
 		{Type: zeroruntime.StreamEventText, Content: "done"},
 		{Type: zeroruntime.StreamEventDone},
 	}}}
@@ -4135,9 +4135,6 @@ func TestRunTracingWrapperStampsUsage(t *testing.T) {
 	if got := tr.Counter(trace.CounterCachedInputTokens); got != 20 {
 		t.Fatalf("cached input token counter = %d, want 20", got)
 	}
-	if got := tr.Counter(trace.CounterCacheWriteTokens); got != 10 {
-		t.Fatalf("cache-write token counter = %d, want 10", got)
-	}
 	if got := tr.Counter(trace.CounterOutputTokens); got != 40 {
 		t.Fatalf("output token counter = %d, want 40", got)
 	}
@@ -4343,95 +4340,3 @@ func TestPlanModeHonorsBeforeToolVeto(t *testing.T) {
 		t.Fatalf("expected tool result to mention the beforeTool veto, got %q", combined)
 	}
 }
-
-// A cancelled permission on either sandbox-retry path must abort the run with a
-// recognisable cancellation, and must not run the escalated retry.
-//
-// BOTH PATHS, because both wrap ErrPermissionApprovalCanceled and each is
-// reached by a different kind of denial: one by an unrestricted platform denial
-// asking for approval, the other by an external-network denial. Surfaces map
-// this sentinel onto their own idea of a cancel — ACP returns stopReason
-// "cancelled" for it — so a path that produced a bare error instead would show
-// the user a crash where they had simply declined.
-func TestCancellingASandboxRetryAbortsWithoutRetrying(t *testing.T) {
-	denial := func(capability execution.CapabilityKind, scope string) tools.Result {
-		return tools.Result{
-			Status: tools.StatusError,
-			ExecutionOutcome: &execution.Outcome{
-				State: execution.StateDenied,
-				Kind:  execution.OutcomeEnforcementDenied,
-				Denial: &execution.Denial{
-					Capability:  execution.Capability{Kind: capability, Scope: scope},
-					Source:      execution.DenialSourcePlatformSandbox,
-					Reason:      "denied by the sandbox",
-					Recoverable: true,
-					NextAction:  execution.DenialNextActionRequestApproval,
-				},
-			},
-		}
-	}
-
-	for _, testCase := range []struct {
-		name   string
-		result tools.Result
-		run    func(context.Context, *tools.Registry, ToolCall, tools.Tool, map[string]any, tools.Result, Options) error
-	}{
-		{
-			name:   "unsandboxed retry",
-			result: denial(execution.CapabilityUnrestricted, "host"),
-			run: func(ctx context.Context, registry *tools.Registry, call ToolCall, tool tools.Tool, args map[string]any, result tools.Result, options Options) error {
-				_, _, _, _, _, _, abortErr := maybeRetryUnsandboxedAfterSandboxRestriction(
-					ctx, registry, call, tool, args, result, PermissionModeAsk, options, nil)
-				return abortErr
-			},
-		},
-		{
-			name:   "network retry",
-			result: denial(execution.CapabilityExternalNetwork, ""),
-			run: func(ctx context.Context, registry *tools.Registry, call ToolCall, tool tools.Tool, args map[string]any, result tools.Result, options Options) error {
-				_, _, _, _, _, abortErr := maybeRetryWithNetworkAfterSandboxDenial(
-					ctx, registry, call, tool, args, result, PermissionModeAsk, options, nil)
-				return abortErr
-			},
-		},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			retryTool := &sandboxNamespaceLimitedRetryTool{}
-			registry := tools.NewRegistry()
-			registry.Register(retryTool)
-
-			asked := 0
-			options := Options{
-				Registry:       registry,
-				PermissionMode: PermissionModeAsk,
-				Autonomy:       "medium",
-				Sandbox: sandbox.NewEngine(sandbox.EngineOptions{
-					WorkspaceRoot: t.TempDir(),
-					Policy:        sandbox.DefaultPolicy(),
-				}),
-				OnPermissionRequest: func(context.Context, PermissionRequest) (PermissionDecision, error) {
-					asked++
-					return PermissionDecision{Action: PermissionDecisionCancel, Reason: "client cancelled"}, nil
-				},
-			}
-
-			call := ToolCall{ID: "call-1", Name: "bash", Arguments: `{"command":"curl example.com"}`}
-			args := map[string]any{"command": "curl example.com"}
-
-			abortErr := testCase.run(context.Background(), registry, call, retryTool, args, testCase.result, options)
-
-			if asked != 1 {
-				t.Fatalf("permission was requested %d times, want exactly 1", asked)
-			}
-			if !errors.Is(abortErr, ErrPermissionApprovalCanceled) {
-				t.Fatalf("abort error = %v, want it to match ErrPermissionApprovalCanceled", abortErr)
-			}
-			// The escalated retry is the thing the permission was gating. A
-			// cancelled prompt that still ran it would have run the command the
-			// user just declined.
-			if len(retryTool.calls) != 0 {
-				t.Fatalf("the escalated retry ran %d times after a cancel: %+v", len(retryTool.calls), retryTool.calls)
-			}
-		})
-	}
-}

internal/agent/partition_cache_test.go

@@ -31,19 +31,6 @@ func (t countingSchemaTool) Run(_ context.Context, _ map[string]any) tools.Resul
 	return tools.Result{Status: tools.StatusOK}
 }
 
-func TestRuntimeToolDefinitionMarksOnlyBuiltInApplyPatchFreeform(t *testing.T) {
-	builtIn := runtimeToolDefinition(tools.NewScopedApplyPatchTool(t.TempDir(), nil))
-	if builtIn.Type != zeroruntime.ToolDefinitionFreeform {
-		t.Fatalf("built-in apply_patch type = %q, want freeform", builtIn.Type)
-	}
-
-	calls := 0
-	custom := runtimeToolDefinition(countingSchemaTool{name: "apply_patch", calls: &calls})
-	if custom.Type != "" {
-		t.Fatalf("custom apply_patch type = %q, want legacy function shape", custom.Type)
-	}
-}
-
 // The cache renders a tool's schema once and reuses it across calls, and its
 // output is identical to the uncached path.
 func TestPartitionToolsCacheRendersOnceAndMatchesUncached(t *testing.T) {

internal/agent/prompt_budget_test.go

@@ -67,21 +67,3 @@ func TestEagerToolSchemaTokenBudget(t *testing.T) {
 		t.Fatalf("eager tool schemas are %d tokens, over the %d ceiling — trim a schema, drop a core tool, or raise the ceiling deliberately (deferring will NOT help: this test disables deferral)", got, maxEagerToolSchemaTokens)
 	}
 }
-
-func TestAgentAdvertisesBothEditTools(t *testing.T) {
-	registry := tools.NewRegistry()
-	for _, tool := range tools.CoreToolsScoped(t.TempDir(), nil) {
-		registry.Register(tool)
-	}
-	exposed, _ := partitionTools(registry, PermissionModeAsk, Options{}, map[string]bool{})
-	names := make(map[string]bool, len(exposed))
-	for _, definition := range exposed {
-		names[definition.Name] = true
-	}
-	if !names["apply_patch"] {
-		t.Fatal("agent must retain apply_patch for multi-hunk changes")
-	}
-	if !names["edit_file"] {
-		t.Fatal("agent must receive edit_file for targeted exact replacements")
-	}
-}

internal/agent/prompt_fingerprint.go

@@ -58,18 +58,12 @@ func toolSubstrings(exposed []zeroruntime.ToolDefinition) (toolsSubstr, schemaSu
 	for _, def := range exposed {
 		writeLengthPrefixed(&toolsSB, def.Name)
 		writeLengthPrefixed(&toolsSB, def.Description)
-		writeLengthPrefixed(&toolsSB, string(def.Type))
 		// Parameters is rendered to a canonical JSON string per tool. The
 		// schema-render cache in internal/agent (used by partitionToolsCached)
 		// guarantees the same render is byte-identical across turns for the
 		// same tool, so this substring is a stable hash input.
 		writeLengthPrefixed(&schemaSB, def.Name)
 		writeLengthPrefixed(&schemaSB, canonicalSchemaString(def.Parameters))
-		if def.Format != nil {
-			writeLengthPrefixed(&schemaSB, def.Format.Type)
-			writeLengthPrefixed(&schemaSB, def.Format.Syntax)
-			writeLengthPrefixed(&schemaSB, def.Format.Definition)
-		}
 	}
 	return toolsSB.String(), schemaSB.String()
 }

internal/agent/prompt_fingerprint_test.go

@@ -73,38 +73,6 @@ func TestComputePrefixFingerprintSchemaChangeChangesSchemaHash(t *testing.T) {
 	}
 }
 
-func TestComputePrefixFingerprintIncludesToolTypeAndFormat(t *testing.T) {
-	opts := Options{Cwd: t.TempDir(), SystemPrompt: "core"}
-	base := zeroruntime.ToolDefinition{Name: "apply_patch", Description: "Patch files"}
-	baseFingerprint := ComputePrefixFingerprint(opts, []zeroruntime.ToolDefinition{base})
-
-	typed := base
-	typed.Type = zeroruntime.ToolDefinitionFreeform
-	if got := ComputePrefixFingerprint(opts, []zeroruntime.ToolDefinition{typed}); got.ToolsHash == baseFingerprint.ToolsHash {
-		t.Fatal("ToolsHash must change when tool Type changes")
-	}
-
-	formatCases := []struct {
-		name   string
-		format zeroruntime.ToolDefinitionFormat
-	}{
-		{name: "type", format: zeroruntime.ToolDefinitionFormat{Type: "grammar"}},
-		{name: "syntax", format: zeroruntime.ToolDefinitionFormat{Syntax: "lark"}},
-		{name: "definition", format: zeroruntime.ToolDefinitionFormat{Definition: "start: PATCH"}},
-		{name: "empty", format: zeroruntime.ToolDefinitionFormat{}},
-	}
-	for _, test := range formatCases {
-		t.Run(test.name, func(t *testing.T) {
-			withFormat := base
-			withFormat.Format = &test.format
-			got := ComputePrefixFingerprint(opts, []zeroruntime.ToolDefinition{withFormat})
-			if got.SchemaHash == baseFingerprint.SchemaHash {
-				t.Fatalf("SchemaHash must change for %s format input", test.name)
-			}
-		})
-	}
-}
-
 // TestComputePrefixFingerprintSystemPromptChangeChangesBaseHash asserts the
 // most common drift path: a system-prompt edit (e.g. an agent.md update, a
 // model addendum change) must move the base-instructions hash, which moves

internal/agent/system_prompt.md

@@ -30,10 +30,13 @@ work.
    read-before-edit discipline: inspect the target file and nearby callers,
    tests, or config before you modify behavior. Never edit a file you have not
    read.
-2. **Plan.** Use update_plan for multi-component, sequencing-uncertain, or long
-   work. Skip it for bounded changes in one component. Update only when the
-   overall phase changes, keep at most one item in_progress, and never create a
-   plan after the work is complete.
+2. **Plan.** Use update_plan for implementation or investigation that has at
+   least three meaningful dependent steps, then keep it current at milestones.
+   Mark completed work and the next in-progress step together when practical;
+   do not spend separate turns updating it after every file or command. Keep at
+   most one item in_progress. Skip plans for simple lookups, explanations, code
+   navigation, and other short tasks. Never create a plan after the work is
+   already complete merely to describe what you did.
 3. **Implement.** Make focused changes that match the surrounding code's style,
    naming, and conventions. Prefer the smallest change that fully solves the
    problem. Avoid broad refactors, unrelated rewrites, dependency churn, and
@@ -49,48 +52,37 @@ work.
 
 - Choose the narrowest tool that safely accomplishes the step. Prefer native
   file tools - read_file, read_minified_file, list_directory, glob, grep,
-  edit_file, apply_patch, write_file - over shelling out to
+  write_file, edit_file, apply_patch - over shelling out to
   cat/sed/awk/python for file operations.
   They are safer, reviewable, and produce clean diffs.
-- Use read_minified_file only to explore large or unfamiliar source. Use
-  read_file for small or likely edit targets and exact text, comments, or line
-  numbers. Do not read both unless a new need for exact content appears.
+- Prefer read_minified_file when initially exploring source code; it preserves
+  code while removing comments and redundant whitespace. Use read_file when
+  exact text, comments, or line numbers are needed.
 - Keep edits focused and reviewable. A single patch may update several related
   files when they form one coherent change; do not hide unrelated edits in a
   bulk shell or script rewrite.
-- For edits to existing files, use edit_file for a targeted change (old_string
-  must match the file exactly and be unique, so include a few surrounding
-  lines) and apply_patch when one coherent change spans several hunks or
-  files. Use write_file only to create a file or when most of it changes; do
-  not rewrite a whole file to change a few lines. Match the existing
-  indentation, imports, and idioms. Match the file's comment density: do not
-  add explanatory comments unless the user asks or the code is already
-  comment-dense.
-- A successful edit result already confirms the change; do not re-read a file
-  just to verify an edit that succeeded. If an edit fails, read the error, fix
-  the old_string or hunk, and retry the same tool rather than switching to a
-  full rewrite.
+- For edits to existing files, prefer edit_file or apply_patch with minimal,
+  targeted diffs. Match the existing indentation, imports, and idioms. Match the
+  file's comment density: do not add explanatory comments unless the user asks or
+  the code is already comment-dense.
 - Solve the problem as posed, not a more general version of it. Add no
   speculative abstraction, configurability, or handling for cases that cannot
   occur, and nothing the user did not ask for. A small diff can still be
-  over-built; if a 200-line solution could be 50, rewrite it. Once the required
-  behavior passes validation, stop instead of adding optional cleanup.
+  over-built; if a 200-line solution could be 50, rewrite it.
 - Preserve behavior you were not asked to change. Do not delete or rewrite code
   you did not author unless the task requires it; if you must, say so.
 
 ## Testing gate (mandatory)
 
-- After code changes, run the project's documented appropriate validators.
-  Scope iteration checks, combine compatible commands when diagnostics stay
-  useful, and run the final set once after the last edit. Rerun only after a
-  change or failure.
-- If unsure which entry points apply, inspect the Makefile, manifests, or CI;
-  do not invent a parallel flow.
+- After any change to code, verify after edits by running the project's
+  validators before you summarize or commit: tests, type-checks, linters, and/or
+  the build, as appropriate. Scope them to the change while iterating; reserve
+  full-suite runs for milestones.
+- If you are unsure which validators apply, search the repo (Makefile, package
+  manifests, CI config) to find them.
 - Never claim a task is done, and never commit, while validators are failing. If
   they fail, fix the cause and rerun; do not paper over it. If you could not run
   a validator, say so explicitly rather than implying success.
-- A successful native patch confirms the edit. Reread only when the next change
-  needs exact content or the result was ambiguous.
 
 ## Tool use
 
@@ -112,7 +104,7 @@ work.
   you need to clean up a running foreground command yourself, use write_stdin.
 - write_stdin's session_id is only ever an id returned by a still-running
   exec_command; never guess or probe ids. If you have no such session, start one
-  with exec_command, or use edit_file/apply_patch/write_file for file changes.
+  with exec_command, or use write_file/edit_file/apply_patch for file changes.
 - write_stdin with empty input polls an existing exec_command session, and
   `\u0003` interrupts it. Sending other stdin bytes may require approval because
   it can drive the running process beyond the original command. Non-tty sessions
@@ -148,7 +140,6 @@ work.
 - Default to concise, skimmable output. Lead with the answer or the result.
 - Use GitHub-flavored Markdown: headings to structure longer replies, fenced
   code blocks for code, and `inline code` for file paths, commands, symbols, and
-  short snippets. Reference code with file paths and include line numbers when
-  already known; do not look them up solely for the final summary.
+  short snippets. Reference code as `file:line` so it is clickable.
 - Report outcomes faithfully: if tests failed, show it; if a step was skipped,
   say so; when something is done and verified, state it plainly without hedging.

internal/agent/system_prompt_models.go

@@ -60,11 +60,8 @@ const openAIPromptAddendum = `<model_guidance>
   longer answers, fenced code blocks for code, and ` + "`inline code`" + ` for paths,
   commands, and symbols.
 - Strongly prefer the native file tools (read_file, list_directory, grep, glob,
-  edit_file, apply_patch, write_file) over shelling out to cat/sed/awk/python for
-  file work. Use them directly; never run apply_patch through exec_command.
-  read_file, edit_file and write_file take one file per call, while one coherent
-  apply_patch may span several files. Keep independent native calls in the same
-  turn, and do not batch file writes into a script.
+  write_file, edit_file, apply_patch) over shelling out to cat/sed/awk/python for
+  file work. Make one tool call per file; do not batch file writes into a script.
 - Persist until the task is fully handled this turn: gather context, implement,
   run the validators, and report — do not stop at a partial result.
 </model_guidance>`

internal/agent/system_prompt_models_test.go

@@ -29,9 +29,6 @@ func TestBuildSystemPromptAppendsModelAddendum(t *testing.T) {
 	if got := buildSystemPrompt(Options{Model: "gpt-5"}); !strings.Contains(got, openAIPromptAddendum) {
 		t.Fatalf("expected the OpenAI addendum in the gpt-5 prompt")
 	}
-	if got := strings.Join(strings.Fields(strings.ToLower(buildSystemPrompt(Options{Model: "gpt-5"}))), " "); !strings.Contains(got, "never run apply_patch through exec_command") {
-		t.Fatalf("OpenAI prompt must route edits through the native patch tool:\n%s", got)
-	}
 	// Claude is aligned with the core prompt and gets no family addendum now that
 	// comment discipline is universal; it must not pick up another family's block.
 	claude := buildSystemPrompt(Options{Model: "claude-opus-4-6"})

internal/agent/system_prompt_test.go

@@ -29,17 +29,14 @@ func TestMain(m *testing.M) {
 }
 
 func TestCoreSystemPromptIncludesCodingQualityRules(t *testing.T) {
-	prompt := strings.Join(strings.Fields(strings.ToLower(buildSystemPrompt(Options{}))), " ")
-	if strings.Contains(prompt, "clickable file paths") {
-		t.Fatalf("system prompt must not claim inline-code file paths are clickable: %s", prompt)
-	}
+	prompt := strings.ToLower(buildSystemPrompt(Options{}))
 
 	for _, want := range []string{
 		"read-before-edit",
 		"inspect the target file",
 		"plan then act",
 		"choose the narrowest tool",
-		"for edits to existing files, use edit_file",
+		"prefer edit_file or apply_patch",
 		"verify after edits",
 		"honor the active permission mode",
 		"avoid broad refactors",
@@ -47,13 +44,6 @@ func TestCoreSystemPromptIncludesCodingQualityRules(t *testing.T) {
 		"do not recognize",
 		"scaled to the work",
 		"comment density",
-		"skip it for bounded changes in one component",
-		"do not read both unless a new need for exact content appears",
-		"combine compatible commands when diagnostics stay useful",
-		"do not invent a parallel flow",
-		"a successful native patch confirms the edit",
-		"once the required behavior passes validation, stop",
-		"do not look them up solely for the final summary",
 	} {
 		if !strings.Contains(prompt, want) {
 			t.Fatalf("expected core system prompt to include %q, got:\n%s", want, buildSystemPrompt(Options{}))

internal/agent/types.go

@@ -348,26 +348,10 @@ type Options struct {
 	// CompactionPreserveLast is how many trailing messages compaction keeps
 	// verbatim. <= 0 falls back to defaultCompactionPreserveLast.
 	CompactionPreserveLast int
-	// Summarizer, when set, lazily builds the provider used for compaction
-	// summarization calls — typically a cheap/fast model, since summaries at
-	// main-model prices are the single most expensive recurring event in a
-	// long run. It receives the main model currently in force and may return
-	// (nil, nil) when no dedicated summarizer applies to it (the main model is
-	// already the cheap one). Built on the first paid compaction and again
-	// after a mid-run model switch. Any failure (build or call) falls back to
-	// the run's main provider until the next switch, so a misconfigured
-	// summarizer can never break compaction. nil keeps today's behavior.
-	Summarizer func(ctx context.Context, mainModelID string) (Provider, error)
-	// ContextWindowFor, when set, resolves a model ID to its context window so
-	// the compactor can re-derive its threshold after a mid-run model switch
-	// (escalate_model). Without it a switch keeps compacting against the
-	// original model's window — overflowing a smaller target or over-compacting
-	// a larger one. Return <= 0 when the model is unknown (window unchanged).
-	ContextWindowFor func(modelID string) int
-	Registry         *tools.Registry
-	PermissionMode   PermissionMode
-	Autonomy         string
-	Sandbox          *sandbox.Engine
+	Registry               *tools.Registry
+	PermissionMode         PermissionMode
+	Autonomy               string
+	Sandbox                *sandbox.Engine
 	// FileTracker records per-session file read/write versions so the write tools
 	// can detect a file changed on disk outside Zero since it was last read. nil
 	// disables the check. Created once per session and threaded into every tool run.

internal/agenteval/trace.go

@@ -29,6 +29,10 @@ func ParseTraceEventKeys(stdout string) []string {
 	return keys
 }
 
+func TraceEventKeys(stdout string) []string {
+	return ParseTraceEventKeys(stdout)
+}
+
 func MissingTraceEvents(required []string, stdout string) []string {
 	seen := map[string]bool{}
 	for _, key := range ParseTraceEventKeys(stdout) {

internal/background/manager.go

@@ -453,12 +453,7 @@ func (manager *Manager) normalizeLoadedTask(fileTaskID string, task Task) (Task,
 	}
 	outputFile, err := manager.outputFile(task.ID, task.OutputFile)
 	if err != nil {
-		var migrated bool
-		outputFile, migrated = manager.migrateLegacyOutputFile(task.ID, task.OutputFile)
-		if !migrated {
-			return Task{}, false, err
-		}
-		changed = true
+		return Task{}, false, err
 	}
 	if outputFile != task.OutputFile {
 		changed = true
@@ -567,32 +562,6 @@ func (manager *Manager) outputFile(taskID string, requested string) (string, err
 	return path, nil
 }
 
-// migrateLegacyOutputFile recovers task metadata written under a previous home
-// or XDG data root. It accepts only the canonical per-task output
-// name in the historic zero/background layout, and only when the corresponding
-// regular file already exists inside the active manager root.
-func (manager *Manager) migrateLegacyOutputFile(taskID string, requested string) (string, bool) {
-	requested = strings.TrimSpace(requested)
-	if !filepath.IsAbs(requested) {
-		return "", false
-	}
-	requested = filepath.Clean(requested)
-	expectedName := taskID + ".ndjson"
-	if filepath.Base(requested) != expectedName {
-		return "", false
-	}
-	legacyRoot := filepath.Dir(requested)
-	if filepath.Base(legacyRoot) != "background" || filepath.Base(filepath.Dir(legacyRoot)) != "zero" {
-		return "", false
-	}
-	canonical := filepath.Join(manager.rootDir, expectedName)
-	info, err := os.Lstat(canonical)
-	if err != nil || !info.Mode().IsRegular() {
-		return "", false
-	}
-	return canonical, true
-}
-
 func validTaskID(taskID string) bool {
 	return taskIDPattern.MatchString(strings.TrimSpace(taskID))
 }

internal/background/manager_test.go

@@ -1,7 +1,6 @@
 package background
 
 import (
-	"encoding/json"
 	"errors"
 	"os"
 	"path/filepath"
@@ -192,88 +191,6 @@ func TestManagerSkipsInvalidPersistedMetadata(t *testing.T) {
 	}
 }
 
-func TestManagerMigratesLegacyOutputPathWhenCanonicalOutputExists(t *testing.T) {
-	root := t.TempDir()
-	const taskID = "legacy_task"
-	canonicalOutput := filepath.Join(root, taskID+".ndjson")
-	if err := os.WriteFile(canonicalOutput, []byte("legacy output\n"), 0o600); err != nil {
-		t.Fatalf("write canonical output: %v", err)
-	}
-	legacyOutput := filepath.Join(t.TempDir(), "zero", "background", taskID+".ndjson")
-	metadata, err := json.Marshal(Task{
-		ID:         taskID,
-		Type:       "specialist",
-		Status:     StatusCompleted,
-		OutputFile: legacyOutput,
-		StartedAt:  time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC),
-	})
-	if err != nil {
-		t.Fatalf("marshal legacy metadata: %v", err)
-	}
-	if err := os.WriteFile(filepath.Join(root, taskID+".json"), append(metadata, '\n'), 0o600); err != nil {
-		t.Fatalf("write legacy metadata: %v", err)
-	}
-
-	manager, err := NewManager(root)
-	if err != nil {
-		t.Fatalf("NewManager returned error: %v", err)
-	}
-	task, ok := manager.Get(taskID)
-	if !ok {
-		t.Fatal("manager did not load migrated task")
-	}
-	if task.OutputFile != canonicalOutput {
-		t.Fatalf("migrated output file = %q, want %q", task.OutputFile, canonicalOutput)
-	}
-	if warnings := manager.LoadWarnings(); len(warnings) != 0 {
-		t.Fatalf("migration produced load warnings: %#v", warnings)
-	}
-
-	persisted, err := os.ReadFile(filepath.Join(root, taskID+".json"))
-	if err != nil {
-		t.Fatalf("read migrated metadata: %v", err)
-	}
-	var saved Task
-	if err := json.Unmarshal(persisted, &saved); err != nil {
-		t.Fatalf("decode migrated metadata: %v", err)
-	}
-	if saved.OutputFile != canonicalOutput {
-		t.Fatalf("persisted output file = %q, want %q", saved.OutputFile, canonicalOutput)
-	}
-}
-
-func TestManagerRejectsUnrelatedAbsoluteOutputPathDuringMigration(t *testing.T) {
-	root := t.TempDir()
-	const taskID = "legacy_task"
-	if err := os.WriteFile(filepath.Join(root, taskID+".ndjson"), []byte("output\n"), 0o600); err != nil {
-		t.Fatalf("write canonical output: %v", err)
-	}
-	metadata, err := json.Marshal(Task{
-		ID:         taskID,
-		Type:       "specialist",
-		Status:     StatusCompleted,
-		OutputFile: filepath.Join(t.TempDir(), taskID+".ndjson"),
-		StartedAt:  time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC),
-	})
-	if err != nil {
-		t.Fatalf("marshal metadata: %v", err)
-	}
-	if err := os.WriteFile(filepath.Join(root, taskID+".json"), append(metadata, '\n'), 0o600); err != nil {
-		t.Fatalf("write metadata: %v", err)
-	}
-
-	manager, err := NewManager(root)
-	if err != nil {
-		t.Fatalf("NewManager returned error: %v", err)
-	}
-	if _, ok := manager.Get(taskID); ok {
-		t.Fatal("manager loaded task with an unrelated absolute output path")
-	}
-	if warnings := strings.Join(manager.LoadWarnings(), "\n"); !strings.Contains(warnings, "output file must be inside") {
-		t.Fatalf("load warnings = %q, want containment rejection", warnings)
-	}
-}
-
 func TestManagerMarksReloadedRunningTaskNonKillable(t *testing.T) {
 	root := t.TempDir()
 	manager, err := NewManager(root)

internal/background/process_posix.go

@@ -39,21 +39,3 @@ func ConfigureChildProcessGroup(cmd *exec.Cmd) {
 func terminateProcess(pid int) error {
 	return execution.TerminateProcessTree(pid, terminationGracePeriod, terminationPollInterval)
 }
-
-// terminateOwnedProcess terminates cmd's process group directly when its launch
-// configuration proves it was made a group leader. This avoids fragile Getpgid
-// rediscovery after an owned leader exits. Ordinary commands fall back to the
-// safe PID/tree path rather than assuming their PID is also a process-group ID.
-//
-// The Setpgid && Pgid == 0 guard only recognizes ConfigureChildProcessGroup's
-// own convention. A command made its own session leader via Setsid (as opposed
-// to Setpgid) is also its own process-group leader in practice, but takes the
-// slower rediscovery path here since Setsid isn't checked. Harmless today
-// because TerminateCommand has exactly one caller in this codebase; worth
-// covering explicitly if Setsid-configured commands start using this path too.
-func terminateOwnedProcess(cmd *exec.Cmd) (bool, error) {
-	if cmd.SysProcAttr != nil && cmd.SysProcAttr.Setpgid && cmd.SysProcAttr.Pgid == 0 {
-		return false, execution.TerminateProcessGroup(cmd.Process.Pid, terminationGracePeriod, terminationPollInterval)
-	}
-	return false, terminateProcess(cmd.Process.Pid)
-}

internal/background/process_posix_test.go

@@ -147,12 +147,11 @@ func TestTerminateProcessKillsForkedChildren(t *testing.T) {
 		t.Fatalf("terminateProcess: %v", err)
 	}
 
-	// The forked child must no longer be running. An orphaned zombie is already
-	// dead but may remain visible briefly until the platform's init reaps it.
+	// The forked child must be gone too (poll until reaped by init).
 	deadline := time.Now().Add(2 * time.Second)
-	// processStopped treats only ESRCH or an observed zombie state as stopped;
-	// other errors (for example EPERM) remain live and keep polling.
-	for !processStopped(childPID) {
+	// Only ESRCH proves the child is gone; any other error (e.g. EPERM) would
+	// wrongly pass the test, so treat it as still-present and keep polling.
+	for !errors.Is(syscall.Kill(childPID, syscall.Signal(0)), syscall.ESRCH) {
 		if time.Now().After(deadline) {
 			_ = syscall.Kill(childPID, syscall.SIGKILL)
 			t.Fatalf("forked child %d survived terminateProcess — group kill failed", childPID)
@@ -160,73 +159,3 @@ func TestTerminateProcessKillsForkedChildren(t *testing.T) {
 		time.Sleep(20 * time.Millisecond)
 	}
 }
-
-func TestTerminateCommandStopsUnconfiguredCommand(t *testing.T) {
-	cmd := exec.Command("sleep", "30")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	t.Cleanup(func() {
-		if cmd.ProcessState == nil {
-			_ = cmd.Process.Kill()
-		}
-	})
-
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("unconfigured command was not reaped")
-	}
-}
-
-func TestTerminateCommandKillsChildAfterLeaderExits(t *testing.T) {
-	grace, poll := terminationGracePeriod, terminationPollInterval
-	terminationGracePeriod, terminationPollInterval = 2*time.Second, 20*time.Millisecond
-	t.Cleanup(func() { terminationGracePeriod, terminationPollInterval = grace, poll })
-
-	// The leader exits immediately after launching the child. TerminateCommand
-	// must capture and signal the process group before Wait reaps the leader and
-	// makes its group identity unavailable.
-	cmd := exec.Command("sh", "-c", "sleep 300 & echo $!; exit 0")
-	ConfigureChildProcessGroup(cmd)
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		t.Fatalf("stdout pipe: %v", err)
-	}
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	line, err := bufio.NewReader(stdout).ReadString('\n')
-	if err != nil {
-		t.Fatalf("read forked child pid: %v", err)
-	}
-	childPID, err := strconv.Atoi(strings.TrimSpace(line))
-	if err != nil {
-		t.Fatalf("parse forked child pid %q: %v", line, err)
-	}
-
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v", err)
-	}
-
-	deadline := time.Now().Add(2 * time.Second)
-	for !processStopped(childPID) {
-		if time.Now().After(deadline) {
-			_ = syscall.Kill(childPID, syscall.SIGKILL)
-			t.Fatalf("forked child %d survived TerminateCommand", childPID)
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-}
-
-func processStopped(pid int) bool {
-	if errors.Is(syscall.Kill(pid, syscall.Signal(0)), syscall.ESRCH) {
-		return true
-	}
-	state, err := exec.Command("ps", "-o", "stat=", "-p", strconv.Itoa(pid)).Output()
-	if err != nil {
-		return errors.Is(syscall.Kill(pid, syscall.Signal(0)), syscall.ESRCH)
-	}
-	return strings.HasPrefix(strings.TrimSpace(string(state)), "Z")
-}

internal/background/process_windows.go

@@ -3,20 +3,11 @@
 package background
 
 import (
-	"fmt"
 	"os/exec"
 
 	"github.com/Gitlawb/zero/internal/execution"
-	"golang.org/x/sys/windows"
 )
 
-// stillActiveExitCode is the documented GetExitCodeProcess value for a process
-// that has not terminated. x/sys/windows does not expose Windows' STILL_ACTIVE
-// constant.
-const stillActiveExitCode uint32 = 259
-
-var terminateProcessForTest = terminateProcess
-
 // ConfigureChildProcessGroup is a no-op on Windows: process-tree termination is
 // delegated to execution.TerminateProcessTree, so no launch-time process-group
 // setup is required (the POSIX build sets Setpgid here instead).
@@ -25,28 +16,3 @@ func ConfigureChildProcessGroup(cmd *exec.Cmd) { execution.ConfigureProcessGroup
 func terminateProcess(pid int) error {
 	return execution.TerminateProcessTree(pid, 0, 0)
 }
-
-// terminateOwnedProcess asks taskkill /T to terminate the tree rooted at cmd,
-// with KillProcessTree's direct Process.Kill fallback if taskkill fails. taskkill
-// can discover descendants only while the root PID still exists; unlike a POSIX
-// process group, a Windows tree has no independently addressable identity after
-// its root exits.
-func terminateOwnedProcess(cmd *exec.Cmd) (bool, error) {
-	var (
-		alreadyExited bool
-		terminateErr  error
-	)
-	err := cmd.Process.WithHandle(func(handle uintptr) {
-		var exitCode uint32
-		if windows.GetExitCodeProcess(windows.Handle(handle), &exitCode) == nil {
-			alreadyExited = exitCode != stillActiveExitCode
-		}
-		// Keep the exact process identity pinned while the PID-based taskkill
-		// operation runs, preventing the PID from being recycled underneath it.
-		terminateErr = terminateProcessForTest(cmd.Process.Pid)
-	})
-	if err != nil {
-		return false, fmt.Errorf("pin process %d for termination: %w", cmd.Process.Pid, err)
-	}
-	return alreadyExited, terminateErr
-}

internal/background/process_windows_test.go

@@ -1,106 +0,0 @@
-//go:build windows
-
-package background
-
-import (
-	"bufio"
-	"errors"
-	"os/exec"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestTerminateCommandReturnsTreeFailureAfterRootFallbackReaps(t *testing.T) {
-	cmd := exec.Command("powershell.exe", "-NoProfile", "-NonInteractive", "-Command", "Start-Sleep -Seconds 300")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	treeErr := errors.New("taskkill /T failed")
-	originalTerminateProcess := terminateProcessForTest
-	terminateProcessForTest = func(pid int) error {
-		if err := cmd.Process.Kill(); err != nil {
-			return errors.Join(treeErr, err)
-		}
-		return treeErr
-	}
-	t.Cleanup(func() { terminateProcessForTest = originalTerminateProcess })
-
-	err := TerminateCommand(cmd)
-	if !errors.Is(err, treeErr) {
-		t.Fatalf("TerminateCommand error = %v, want tree failure", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("root process was not reaped")
-	}
-}
-
-func TestTerminateCommandReapsExitedLeader(t *testing.T) {
-	cmd := exec.Command("cmd.exe", "/c", "exit", "0")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	// Let the child exit without calling Wait so cleanup exercises the Windows
-	// taskkill/TerminateProcess race while it still owns the process handle.
-	time.Sleep(500 * time.Millisecond)
-
-	// jatmn's #774 finding: taskkill /T racing an already-exited PID (and the
-	// Process.Kill fallback) both fail here, but the reap below still succeeds —
-	// the process-handle exit-code check proves the leader was already gone, so
-	// TerminateCommand must not surface the expected kill-attempt error.
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v, want nil (leader was already gone and got reaped)", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("exited process was not reaped")
-	}
-}
-
-func TestTerminateCommandDeadLeaderCannotIdentifyDescendantTree(t *testing.T) {
-	cmd := exec.Command("powershell.exe", "-NoProfile", "-NonInteractive", "-Command",
-		`$p = Start-Process powershell.exe -ArgumentList '-NoProfile','-Command','Start-Sleep -Seconds 300' -PassThru; $p.Id`)
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		t.Fatalf("stdout pipe: %v", err)
-	}
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	line, err := bufio.NewReader(stdout).ReadString('\n')
-	if err != nil {
-		t.Fatalf("read descendant pid: %v", err)
-	}
-	descendantPID, err := strconv.Atoi(strings.TrimSpace(line))
-	if err != nil {
-		t.Fatalf("parse descendant pid %q: %v", line, err)
-	}
-	t.Cleanup(func() {
-		_ = exec.Command("taskkill.exe", "/F", "/PID", strconv.Itoa(descendantPID)).Run()
-	})
-
-	// Wait until the leader is observably exited but deliberately leave it
-	// unreaped, matching the POSIX regression's ordering.
-	deadline := time.Now().Add(5 * time.Second)
-	for processExistsOnWindows(cmd.Process.Pid) {
-		if time.Now().After(deadline) {
-			t.Fatal("leader did not exit")
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v", err)
-	}
-
-	// Windows has no persistent group ID analogous to POSIX: once the leader is
-	// gone, taskkill /T cannot rediscover this descendant. Assert that platform
-	// distinction rather than claiming TerminateCommand can provide it here.
-	if !processExistsOnWindows(descendantPID) {
-		t.Fatal("descendant unexpectedly stopped after its root exited")
-	}
-}
-
-func processExistsOnWindows(pid int) bool {
-	return exec.Command("powershell.exe", "-NoProfile", "-NonInteractive", "-Command",
-		"Get-Process -Id "+strconv.Itoa(pid)+" -ErrorAction Stop | Out-Null").Run() == nil
-}

internal/background/terminate.go

@@ -1,14 +1,5 @@
 package background
 
-import (
-	"errors"
-	"fmt"
-	"os/exec"
-	"time"
-)
-
-const commandReapTimeout = 3 * time.Second
-
 // TerminateProcess stops a background process by PID — on Windows its process
 // tree; on POSIX its whole process group when the PID leads its own group (the
 // invariant ConfigureChildProcessGroup establishes for processes started through
@@ -21,69 +12,3 @@ const commandReapTimeout = 3 * time.Second
 func TerminateProcess(pid int) error {
 	return terminateProcess(pid)
 }
-
-// TerminateCommand stops a started command and reaps its leader. The caller must
-// have exclusive ownership of cmd: it must not have previously called Wait or
-// Process.Release, and no goroutine may call either concurrently. On POSIX it
-// stops the whole group when the command was configured as its leader; ordinary
-// commands safely fall back to PID/tree discovery. On Windows, success for a
-// leader that was already dead confirms only that the leader was reaped;
-// descendants may survive because Windows cannot rediscover a tree from a dead
-// root. `zero daemon start` needs this operation when readiness times out: it
-// launched the child, so it must both stop the tree and collect the leader.
-//
-// The order matters: the tree is signalled first, because Wait releases the
-// leader's PID and a later group lookup could then resolve to nothing (or, worse,
-// to a recycled PID). Termination stays in the shared execution lifecycle
-// primitives rather than introducing a second platform-specific killer.
-//
-// If the bounded reap times out, the Wait call already started by this function
-// continues in its goroutine. From that point onward the caller must not access
-// cmd at all, including ProcessState, because that would race with Wait.
-func TerminateCommand(cmd *exec.Cmd) error {
-	if cmd == nil || cmd.Process == nil {
-		return errors.New("terminate command: process was never started")
-	}
-	leaderAlreadyExited, terminateErr := terminateOwnedProcess(cmd)
-	reapErr := waitForTerminatedCommandWithin(cmd, commandReapTimeout)
-	if reapErr != nil {
-		if terminateErr != nil {
-			return fmt.Errorf("%v (reap failed: %w)", terminateErr, reapErr)
-		}
-		return reapErr
-	}
-	if terminateErr != nil && !leaderAlreadyExited {
-		return terminateErr
-	}
-	// Only discard a termination error when the platform demonstrated before
-	// attempting termination that the leader had already exited. A successful
-	// reap alone says nothing about whether a live descendant tree was stopped.
-	return nil
-}
-
-// classifyWaitError treats a non-zero exit status as success: a process being
-// terminated is expected to report one (or a signal), so the only interesting
-// failure is Wait itself not working.
-func classifyWaitError(waitErr error) error {
-	var exitErr *exec.ExitError
-	if waitErr != nil && !errors.As(waitErr, &exitErr) {
-		return fmt.Errorf("reap process: %w", waitErr)
-	}
-	return nil
-}
-
-// waitForTerminatedCommandWithin bounds the reap so a child that somehow survives
-// termination cannot hang the caller — the daemon-start cleanup path runs while a
-// user waits at the CLI. On timeout its Wait goroutine is intentionally left to
-// finish: exec.Cmd permits only one Wait call, and abandoning it without a reaper
-// would leak the child once it eventually exits.
-func waitForTerminatedCommandWithin(cmd *exec.Cmd, timeout time.Duration) error {
-	waitDone := make(chan error, 1)
-	go func() { waitDone <- cmd.Wait() }()
-	select {
-	case waitErr := <-waitDone:
-		return classifyWaitError(waitErr)
-	case <-time.After(timeout):
-		return fmt.Errorf("process %d did not reap after termination", cmd.Process.Pid)
-	}
-}

internal/cli/app.go

@@ -64,53 +64,38 @@ type appDeps struct {
 	// getenv reads a process environment variable (production: os.Getenv, set in
 	// defaultAppDeps — deliberately NOT filled by fillAppDeps, so tests are hermetic
 	// against ambient vars like ZERO_PROVIDER unless they inject it). nil ⇒ empty.
-	getenv                       func(string) string
-	probeProviderHealth          func(context.Context, providerhealth.Options) providerhealth.Result
-	discoverProviderModels       func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error)
-	detectLocalRuntimes          func(context.Context, provideronboarding.LocalDetectOptions) []provideronboarding.DetectedLocalRuntime
-	openRouterLogin              func(context.Context, provideroauth.OpenRouterOptions) (string, error)
-	newSessionStore              func() *sessions.Store
-	loadPlugins                  func(plugins.LoadOptions) (plugins.LoadResult, error)
-	loadHooks                    func(hooks.LoadOptions) (hooks.LoadResult, error)
-	skillsDir                    func() string
-	pluginsDir                   func() string
-	toolsDir                     func() string
-	newMCPStore                  func() (*mcp.PermissionStore, error)
-	newMCPTokenStore             func() (*mcp.TokenStore, error)
-	newSandboxStore              func() (*sandbox.GrantStore, error)
-	selectSandboxBackend         func(sandbox.BackendOptions) sandbox.Backend
-	runSandboxSetupHelper        func(path string, args []string, stdout io.Writer, stderr io.Writer) error
-	registerMCPTools             func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error)
-	prepareWorktree              func(context.Context, worktrees.Options) (worktrees.Result, error)
-	releaseWorktree              func(context.Context, worktrees.Options, string) error
-	detectVerifyPlan             func(string) (verify.Plan, error)
-	runVerify                    func(context.Context, verify.Plan, verify.RunOptions) verify.Report
-	runSelfVerify                func(context.Context, verify.Plan, selfverify.Options) selfverify.Report
-	runAgentEval                 func(context.Context, agentEvalOptions) (agentEvalReport, error)
-	inspectChanges               func(context.Context, zerogit.InspectOptions) (zerogit.ChangeSummary, error)
-	commitChanges                func(context.Context, zerogit.CommitOptions) (zerogit.CommitResult, error)
-	pushChanges                  func(context.Context, zerogit.PushOptions) (zerogit.PushResult, error)
-	createPR                     func(context.Context, zerogit.PROptions) (zerogit.PRResult, error)
-	createBranch                 func(context.Context, zerogit.BranchOptions) (zerogit.BranchResult, error)
-	isDefaultBranch              func(context.Context, zerogit.DefaultBranchOptions) (bool, string, string, error)
-	currentGitUser               func(context.Context, string) string
-	headCommitSubject            func(context.Context, string) string
-	commitsAhead                 func(context.Context, string, string, string) (int, error)
-	isUnbornRemote               func(context.Context, string, string) (bool, error)
-	refreshTrackingRef           func(context.Context, string, string, string) error
-	branchUpstreamRemote         func(context.Context, string, string) string
-	branchUpstreamRemoteAndMerge func(context.Context, string, string) (string, string)
-	resolveRemoteBranchTip       func(context.Context, string, string, string) (string, error)
-	remoteHasBranch              func(context.Context, string, string, string) (bool, error)
-	currentGitBranch             func(context.Context, string) string
-	currentBranchTip             func(context.Context, string) string
-	deleteBranch                 func(context.Context, string, string, string) error
-	resetBranchRef               func(context.Context, string, string, string, string) error
-	runTUI                       func(context.Context, tui.Options) int
-	runEditor                    func(string) error
-	checkUpdate                  func(context.Context, update.Options) (update.Result, error)
-	applyUpdate                  func(context.Context, update.Options) (update.ApplyResult, error)
-	now                          func() time.Time
+	getenv                 func(string) string
+	probeProviderHealth    func(context.Context, providerhealth.Options) providerhealth.Result
+	discoverProviderModels func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error)
+	detectLocalRuntimes    func(context.Context, provideronboarding.LocalDetectOptions) []provideronboarding.DetectedLocalRuntime
+	openRouterLogin        func(context.Context, provideroauth.OpenRouterOptions) (string, error)
+	newSessionStore        func() *sessions.Store
+	loadPlugins            func(plugins.LoadOptions) (plugins.LoadResult, error)
+	loadHooks              func(hooks.LoadOptions) (hooks.LoadResult, error)
+	skillsDir              func() string
+	pluginsDir             func() string
+	toolsDir               func() string
+	newMCPStore            func() (*mcp.PermissionStore, error)
+	newMCPTokenStore       func() (*mcp.TokenStore, error)
+	newSandboxStore        func() (*sandbox.GrantStore, error)
+	selectSandboxBackend   func(sandbox.BackendOptions) sandbox.Backend
+	runSandboxSetupHelper  func(path string, args []string, stdout io.Writer, stderr io.Writer) error
+	registerMCPTools       func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error)
+	prepareWorktree        func(context.Context, worktrees.Options) (worktrees.Result, error)
+	releaseWorktree        func(context.Context, worktrees.Options, string) error
+	detectVerifyPlan       func(string) (verify.Plan, error)
+	runVerify              func(context.Context, verify.Plan, verify.RunOptions) verify.Report
+	runSelfVerify          func(context.Context, verify.Plan, selfverify.Options) selfverify.Report
+	runAgentEval           func(context.Context, agentEvalOptions) (agentEvalReport, error)
+	inspectChanges         func(context.Context, zerogit.InspectOptions) (zerogit.ChangeSummary, error)
+	commitChanges          func(context.Context, zerogit.CommitOptions) (zerogit.CommitResult, error)
+	pushChanges            func(context.Context, zerogit.PushOptions) (zerogit.PushResult, error)
+	createPR               func(context.Context, zerogit.PROptions) (zerogit.PRResult, error)
+	runTUI                 func(context.Context, tui.Options) int
+	runEditor              func(string) error
+	checkUpdate            func(context.Context, update.Options) (update.Result, error)
+	applyUpdate            func(context.Context, update.Options) (update.ApplyResult, error)
+	now                    func() time.Time
 }
 
 type mcpToolRuntime interface {
@@ -213,52 +198,11 @@ func defaultAppDeps() appDeps {
 		commitChanges:    zerogit.Commit,
 		pushChanges:      zerogit.Push,
 		createPR:         zerogit.CreatePR,
-		createBranch:     zerogit.CreateBranch,
-		isDefaultBranch:  zerogit.IsDefaultBranch,
-		currentGitUser: func(ctx context.Context, cwd string) string {
-			return zerogit.CurrentGitUser(ctx, cwd, nil)
-		},
-		headCommitSubject: func(ctx context.Context, cwd string) string {
-			return zerogit.HeadCommitSubject(ctx, cwd, nil)
-		},
-		commitsAhead: func(ctx context.Context, cwd, remote, branch string) (int, error) {
-			return zerogit.CommitsAhead(ctx, cwd, remote, branch, nil)
-		},
-		isUnbornRemote: func(ctx context.Context, cwd, remote string) (bool, error) {
-			return zerogit.IsUnbornRemote(ctx, cwd, remote, nil)
-		},
-		refreshTrackingRef: func(ctx context.Context, cwd, remote, branch string) error {
-			return zerogit.RefreshTrackingRef(ctx, cwd, remote, branch, nil)
-		},
-		branchUpstreamRemote: func(ctx context.Context, cwd, branch string) string {
-			return zerogit.UpstreamRemote(ctx, cwd, branch, nil)
-		},
-		branchUpstreamRemoteAndMerge: func(ctx context.Context, cwd, branch string) (string, string) {
-			return zerogit.UpstreamRemoteAndMergeBranch(ctx, cwd, branch, nil)
-		},
-		resolveRemoteBranchTip: func(ctx context.Context, cwd, remote, branch string) (string, error) {
-			return zerogit.ResolveRemoteBranchTip(ctx, cwd, remote, branch, nil)
-		},
-		remoteHasBranch: func(ctx context.Context, cwd, remote, branch string) (bool, error) {
-			return zerogit.RemoteHasBranch(ctx, cwd, remote, branch, nil)
-		},
-		currentGitBranch: func(ctx context.Context, cwd string) string {
-			return zerogit.CurrentBranch(ctx, cwd, nil)
-		},
-		currentBranchTip: func(ctx context.Context, cwd string) string {
-			return zerogit.CurrentBranchTip(ctx, cwd, nil)
-		},
-		deleteBranch: func(ctx context.Context, cwd, fallbackBranch, branchToDelete string) error {
-			return zerogit.DeleteBranch(ctx, cwd, fallbackBranch, branchToDelete, nil)
-		},
-		resetBranchRef: func(ctx context.Context, cwd, branch, newTip, expectedOld string) error {
-			return zerogit.ResetBranchRef(ctx, cwd, branch, newTip, nil, expectedOld)
-		},
-		runTUI:      tui.Run,
-		runEditor:   openEditor,
-		checkUpdate: update.Check,
-		applyUpdate: update.Apply,
-		now:         time.Now,
+		runTUI:           tui.Run,
+		runEditor:        openEditor,
+		checkUpdate:      update.Check,
+		applyUpdate:      update.Apply,
+		now:              time.Now,
 	}
 }
 
@@ -618,45 +562,6 @@ func fillAppDeps(deps appDeps) appDeps {
 	if deps.createPR == nil {
 		deps.createPR = defaults.createPR
 	}
-	if deps.createBranch == nil {
-		deps.createBranch = defaults.createBranch
-	}
-	if deps.isDefaultBranch == nil {
-		deps.isDefaultBranch = defaults.isDefaultBranch
-	}
-	if deps.currentGitUser == nil {
-		deps.currentGitUser = defaults.currentGitUser
-	}
-	if deps.headCommitSubject == nil {
-		deps.headCommitSubject = defaults.headCommitSubject
-	}
-	if deps.commitsAhead == nil {
-		deps.commitsAhead = defaults.commitsAhead
-	}
-	if deps.isUnbornRemote == nil {
-		deps.isUnbornRemote = defaults.isUnbornRemote
-	}
-	if deps.refreshTrackingRef == nil {
-		deps.refreshTrackingRef = defaults.refreshTrackingRef
-	}
-	if deps.branchUpstreamRemote == nil {
-		deps.branchUpstreamRemote = defaults.branchUpstreamRemote
-	}
-	if deps.branchUpstreamRemoteAndMerge == nil {
-		deps.branchUpstreamRemoteAndMerge = defaults.branchUpstreamRemoteAndMerge
-	}
-	if deps.remoteHasBranch == nil {
-		deps.remoteHasBranch = defaults.remoteHasBranch
-	}
-	if deps.currentGitBranch == nil {
-		deps.currentGitBranch = defaults.currentGitBranch
-	}
-	if deps.currentBranchTip == nil {
-		deps.currentBranchTip = defaults.currentBranchTip
-	}
-	// resolveRemoteBranchTip, deleteBranch, and resetBranchRef stay nil when
-	// unset so unit tests that mock createBranch without a real git tree do not
-	// hit real git restore/delete commands.
 	if deps.runTUI == nil {
 		deps.runTUI = defaults.runTUI
 	}
@@ -839,26 +744,24 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 		mcpTokenStore = nil
 		err = nil
 	}
-	criticalMCPConfig, optionalMCPConfig := splitMCPStartupConfig(mcpConfig)
 	mcpRuntime := mcpToolRuntime(noopMCPRuntime{})
-	if len(criticalMCPConfig.Servers) > 0 {
-		runtime, registerErr := deps.registerMCPTools(context.Background(), registry, criticalMCPConfig, mcp.RegisterOptions{
+	if len(mcpConfig.Servers) > 0 {
+		mcpRuntime, err = deps.registerMCPTools(context.Background(), registry, mcpConfig, mcp.RegisterOptions{
 			PermissionStore: mcpPermissionStore,
 			Autonomy:        mcp.AutonomyLow,
 			Execution:       executionRunner,
 			WorkspaceRoot:   workspaceRoot,
 		})
-		if registerErr != nil {
-			closeMCPRuntime(stderr, runtime)
-			return writeAppError(stderr, redaction.ErrorMessage(registerErr, redaction.Options{}), 1)
-		}
-		mcpRuntime = runtime
+	}
+	if err != nil {
+		closeMCPRuntime(stderr, mcpRuntime)
+		return writeAppError(stderr, err.Error(), 1)
 	}
 	defer closeMCPRuntime(stderr, mcpRuntime)
 	// A server that could not be reached or validated is skipped, not fatal (one
 	// bad MCP server must not abort startup) — surface each so a missing tool set is
 	// explained rather than silently absent. A built-in default the user never
-	// configured (e.g. keyless Exa with no credentials) is the exception: it
+	// configured (e.g. keyless Firecrawl with no credentials) is the exception: it
 	// was never asked for, so its failure is not worth a startup warning — only
 	// servers the user actually configured warn on failure (issue #552).
 	for _, skipped := range mcpRuntime.Skipped() {
@@ -911,35 +814,11 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 	}
 	// Activate deferred MCP-tool loading for the interactive run only when the
 	// VISIBLE deferred-eligible count meets the resolved threshold, matching exec.
-	// This first pass covers every prompt-critical tool. Optional built-in MCP
-	// defaults re-run the same gate after publishing their atomic batch, so a
-	// later catalog generation cannot miss its loader. The interactive surface
-	// applies no operator tool filters, so enabled/disabled are nil — matching the
-	// AgentOptions below.
+	// The registry is complete (core + specialist + MCP + plugins) here, so the
+	// count is accurate; below threshold this is a no-op and the surface is
+	// unchanged. The interactive surface applies no operator tool filters, so
+	// enabled/disabled are nil — matching the AgentOptions below.
 	registerToolSearchIfEligible(registry, resolved.Tools.DeferThreshold, permissionMode, nil, nil)
-	var optionalMCPRuntime *optionalMCPStartup
-	var awaitToolReadiness func(context.Context)
-	if len(optionalMCPConfig.Servers) > 0 {
-		optionalMCPRuntime = startOptionalMCP(
-			context.Background(),
-			registry,
-			optionalMCPConfig,
-			mcp.RegisterOptions{
-				PermissionStore: mcpPermissionStore,
-				Autonomy:        mcp.AutonomyLow,
-				Execution:       executionRunner,
-				WorkspaceRoot:   workspaceRoot,
-			},
-			deps.registerMCPTools,
-			func() {
-				registerToolSearchIfEligible(registry, resolved.Tools.DeferThreshold, permissionMode, nil, nil)
-			},
-		)
-		defer closeMCPRuntime(stderr, optionalMCPRuntime)
-		awaitToolReadiness = func(ctx context.Context) {
-			optionalMCPRuntime.Await(ctx, optionalMCPPromptGrace)
-		}
-	}
 	lastKnownMCPConfig := mcpConfig
 	fileTracker := tools.NewFileTracker()
 	var scratchBaseline scratchFileBaseline
@@ -974,20 +853,10 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 		FavoriteModels:       resolved.Preferences.FavoriteModels,
 		RecentModels:         resolved.Preferences.RecentModels,
 		RecapsEnabled:        resolved.Preferences.RecapsEnabled(),
-		CompactionModel:      resolved.Preferences.CompactionModel,
 		Provider:             provider,
 		NewProvider:          deps.newProvider,
-		NewTurnSessionProvider: func(profile config.ProviderProfile, provider zeroruntime.Provider) zeroruntime.TurnSessionProvider {
-			if provider == nil {
-				return nil
-			}
-			if optimized, ok := providers.OptimizedTurnSessions(profile, provider, providers.Options{}); ok {
-				return optimized
-			}
-			return providers.DefaultTurnSessions(profile, provider, providers.Options{})
-		},
-		ProbeProviderHealth: deps.probeProviderHealth,
-		UserAgent:           userAgent(),
+		ProbeProviderHealth:  deps.probeProviderHealth,
+		UserAgent:            userAgent(),
 		PrepareRunCompletionWarning: func() {
 			scratchBaseline = scratchFileSnapshot(workspaceRoot)
 		},
@@ -995,7 +864,6 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 			return scratchFileWarning(workspaceRoot, scratchBaseline)
 		},
 		Registry:           registry,
-		AwaitToolReadiness: awaitToolReadiness,
 		SessionStore:       sessionStore,
 		PeerService:        peerService,
 		SandboxStore:       sandboxStore,

internal/cli/app_test.go

@@ -17,7 +17,6 @@ import (
 	"github.com/Gitlawb/zero/internal/agent"
 	"github.com/Gitlawb/zero/internal/config"
 	"github.com/Gitlawb/zero/internal/mcp"
-	"github.com/Gitlawb/zero/internal/redaction"
 	"github.com/Gitlawb/zero/internal/tools"
 	"github.com/Gitlawb/zero/internal/tui"
 	"github.com/Gitlawb/zero/internal/update"
@@ -212,12 +211,12 @@ func TestTUIStartupSuppressesWarningForUnconfiguredDefaultServer(t *testing.T) {
 		},
 		resolveMCPConfig: func(workspaceRoot string, excludeProject bool) (config.MCPConfig, error) {
 			return config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-				"exa": config.DefaultMCPServers()["exa"],
+				"firecrawl": config.DefaultMCPServers()["firecrawl"],
 			}}, nil
 		},
 		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
 			return fakeMCPRuntimeWithSkips{skipped: []mcp.SkippedServer{
-				{Name: "exa", Err: errors.New("returned HTTP 401"), UnconfiguredDefault: true},
+				{Name: "firecrawl", Err: errors.New("returned HTTP 401"), UnconfiguredDefault: true},
 			}}, nil
 		},
 		runTUI: func(ctx context.Context, options tui.Options) int {
@@ -228,7 +227,7 @@ func TestTUIStartupSuppressesWarningForUnconfiguredDefaultServer(t *testing.T) {
 	if exitCode != 0 {
 		t.Fatalf("exitCode = %d stderr=%s", exitCode, stderr.String())
 	}
-	if strings.Contains(stderr.String(), "exa") {
+	if strings.Contains(stderr.String(), "firecrawl") {
 		t.Fatalf("stderr = %q, want no warning for an unconfigured default server", stderr.String())
 	}
 }
@@ -487,74 +486,6 @@ func TestRunNoArgsLaunchesTUIWithMCPState(t *testing.T) {
 	}
 }
 
-func TestRunNoArgsPaintsBeforeOptionalDefaultMCPIsReady(t *testing.T) {
-	var stdout bytes.Buffer
-	var stderr bytes.Buffer
-	cwd := t.TempDir()
-	userConfigPath := filepath.Join(t.TempDir(), "zero", "config.json")
-	permissionStore, err := mcp.NewPermissionStore(mcp.StoreOptions{FilePath: filepath.Join(t.TempDir(), "mcp-permissions.json")})
-	if err != nil {
-		t.Fatalf("NewPermissionStore() error = %v", err)
-	}
-	tokenStore, err := mcp.NewTokenStore(mcp.TokenStoreOptions{FilePath: filepath.Join(t.TempDir(), "mcp-oauth.json")})
-	if err != nil {
-		t.Fatalf("NewTokenStore() error = %v", err)
-	}
-	started := make(chan struct{})
-	release := make(chan struct{})
-	configResult := make(chan error, 1)
-
-	exitCode := runWithDeps([]string{}, &stdout, &stderr, appDeps{
-		getwd:          func() (string, error) { return cwd, nil },
-		userConfigPath: func() (string, error) { return userConfigPath, nil },
-		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) {
-			return config.ResolvedConfig{MaxTurns: 8}, nil
-		},
-		resolveMCPConfig: func(string, bool) (config.MCPConfig, error) {
-			return config.MCPConfig{Servers: config.DefaultMCPServers()}, nil
-		},
-		newMCPStore:      func() (*mcp.PermissionStore, error) { return permissionStore, nil },
-		newMCPTokenStore: func() (*mcp.TokenStore, error) { return tokenStore, nil },
-		registerMCPTools: func(_ context.Context, registry *tools.Registry, cfg config.MCPConfig, _ mcp.RegisterOptions) (mcpToolRuntime, error) {
-			var configErr error
-			if _, ok := cfg.Servers["exa"]; !ok || len(cfg.Servers) != 1 {
-				configErr = fmt.Errorf("optional MCP config = %#v, want only exa", cfg.Servers)
-			}
-			configResult <- configErr
-			close(started)
-			<-release
-			registry.Register(cliFakeMCPRegistryTool{})
-			return noopMCPRuntime{}, nil
-		},
-		runTUI: func(ctx context.Context, options tui.Options) int {
-			select {
-			case <-started:
-			case <-time.After(time.Second):
-				t.Fatal("optional MCP initialization did not start")
-			}
-			if options.AwaitToolReadiness == nil {
-				t.Fatal("TUI did not receive optional tool readiness barrier")
-			}
-			if _, ok := options.Registry.Get("mcp_docs_lookup"); ok {
-				t.Fatal("optional MCP tool was published before registration completed")
-			}
-			close(release)
-			options.AwaitToolReadiness(ctx)
-			if _, ok := options.Registry.Get("mcp_docs_lookup"); !ok {
-				t.Fatal("optional MCP tool was not visible after readiness completed")
-			}
-			return 0
-		},
-	})
-
-	if exitCode != 0 {
-		t.Fatalf("exitCode = %d stderr=%s", exitCode, stderr.String())
-	}
-	if configErr := <-configResult; configErr != nil {
-		t.Fatal(configErr)
-	}
-}
-
 func TestTUIMCPCommandUsesLastGoodConfigOnRefreshError(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -634,7 +565,6 @@ func TestRunNoArgsClosesPartialMCPRuntimeWhenRegistrationFails(t *testing.T) {
 		t.Fatalf("NewTokenStore() error = %v", err)
 	}
 	runtimeClosed := false
-	secret := "sk-proj-" + strings.Repeat("a", 23) + "0"
 
 	exitCode := runWithDeps([]string{}, &stdout, &stderr, appDeps{
 		getwd: func() (string, error) {
@@ -661,7 +591,7 @@ func TestRunNoArgsClosesPartialMCPRuntimeWhenRegistrationFails(t *testing.T) {
 			return closeFunc(func() error {
 				runtimeClosed = true
 				return nil
-			}), fmt.Errorf("register mcp tools failed: %s", secret)
+			}), errors.New("register mcp tools failed")
 		},
 		runTUI: func(ctx context.Context, options tui.Options) int {
 			t.Fatal("TUI should not launch after MCP registration fails")
@@ -675,12 +605,6 @@ func TestRunNoArgsClosesPartialMCPRuntimeWhenRegistrationFails(t *testing.T) {
 	if !strings.Contains(stderr.String(), "register mcp tools failed") {
 		t.Fatalf("stderr missing registration error: %s", stderr.String())
 	}
-	if strings.Contains(stderr.String(), secret) {
-		t.Fatalf("stderr leaked MCP registration secret: %s", stderr.String())
-	}
-	if !strings.Contains(stderr.String(), redaction.RedactedSecret) {
-		t.Fatalf("stderr missing redaction marker: %s", stderr.String())
-	}
 	if !runtimeClosed {
 		t.Fatal("partial MCP runtime was not closed after registration error")
 	}

internal/cli/daemon.go

@@ -1,7 +1,6 @@
 package cli
 
 import (
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -161,61 +160,20 @@ func runDaemonStartDetached(paths daemon.Paths, stdout io.Writer, stderr io.Writ
 	cmd.Stdout = logFile
 	cmd.Stderr = logFile
 	background.ConfigureChildProcessGroup(cmd) // own process group: outlives this shell
-	if err := startAndAwaitDaemonProcess(cmd, func() bool { return daemonReachable(paths) }, 5*time.Second, 25*time.Millisecond); err != nil {
-		if errors.Is(err, errDaemonStartTimeout) {
-			return writeAppError(stderr, err.Error()+"; see "+logPath, exitCrash)
-		}
+	if err := cmd.Start(); err != nil {
 		return writeAppError(stderr, err.Error(), exitCrash)
 	}
-	fmt.Fprintf(stdout, "zero daemon started (socket %s)\n", paths.Socket)
-	return exitSuccess
-}
+	_ = cmd.Process.Release()
 
-var errDaemonStartTimeout = errors.New("daemon did not come up within timeout")
-
-func startAndAwaitDaemonProcess(cmd *exec.Cmd, reachable func() bool, timeout time.Duration, pollInterval time.Duration) error {
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	if waitForDaemonReadiness(reachable, timeout, pollInterval) {
-		if err := cmd.Process.Release(); err != nil {
-			cleanupErr := terminateAndReapDaemonProcess(cmd)
-			if cleanupErr != nil {
-				return fmt.Errorf("release daemon process: %w (cleanup failed: %v)", err, cleanupErr)
-			}
-			return fmt.Errorf("release daemon process: %w", err)
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if daemonReachable(paths) {
+			fmt.Fprintf(stdout, "zero daemon started (socket %s)\n", paths.Socket)
+			return exitSuccess
 		}
-		return nil
+		time.Sleep(25 * time.Millisecond)
 	}
-	if err := terminateAndReapDaemonProcess(cmd); err != nil {
-		return fmt.Errorf("%w; cleanup failed: %v", errDaemonStartTimeout, err)
-	}
-	return errDaemonStartTimeout
-}
-
-func waitForDaemonReadiness(reachable func() bool, timeout time.Duration, pollInterval time.Duration) bool {
-	deadline := time.Now().Add(timeout)
-	for {
-		if reachable() {
-			return true
-		}
-		remaining := time.Until(deadline)
-		if remaining <= 0 {
-			break
-		}
-		time.Sleep(min(pollInterval, remaining))
-	}
-	// The loop's last reachable() call already ran immediately before this one
-	// (right after the final Sleep, with the same deadline check separating
-	// them), so this adds no extra waiting time and is not a grace window for a
-	// slow-starting daemon — it only re-checks the same instant in case
-	// reachable() itself is non-deterministic. To tolerate a genuinely slow
-	// start, raise the timeout passed to startAndAwaitDaemonProcess instead.
-	return reachable()
-}
-
-func terminateAndReapDaemonProcess(cmd *exec.Cmd) error {
-	return background.TerminateCommand(cmd)
+	return writeAppError(stderr, "daemon did not come up within timeout; see "+logPath, exitCrash)
 }
 
 func runDaemonStop(args []string, stdout io.Writer, stderr io.Writer) int {

internal/cli/daemon_test.go

@@ -2,15 +2,8 @@ package cli
 
 import (
 	"bytes"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
 	"strings"
 	"testing"
-	"time"
-
-	"github.com/Gitlawb/zero/internal/background"
 )
 
 // isolateDaemonPaths points DefaultPaths at a temp dir so the test never touches
@@ -128,84 +121,3 @@ func TestDaemonSubcommandsRejectExtraArgs(t *testing.T) {
 		}
 	}
 }
-
-func TestWaitForDaemonReadinessChecksTimeoutBoundary(t *testing.T) {
-	checks := 0
-	ready := waitForDaemonReadiness(func() bool {
-		checks++
-		return checks == 2
-	}, 0, time.Millisecond)
-	if !ready {
-		t.Fatal("daemon that became reachable at the timeout boundary was not detected")
-	}
-	if checks != 2 {
-		t.Fatalf("reachability checks = %d, want initial and final checks", checks)
-	}
-}
-
-func TestTerminateAndReapDaemonProcess(t *testing.T) {
-	cmd := daemonDetachedChildCommand("hang")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start helper process: %v", err)
-	}
-
-	if err := terminateAndReapDaemonProcess(cmd); err != nil {
-		t.Fatalf("terminate and reap helper process: %v", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatalf("helper process was not reaped: state=%v", cmd.ProcessState)
-	}
-	if cmd.ProcessState.Success() {
-		t.Fatalf("helper process unexpectedly exited successfully: %v", cmd.ProcessState)
-	}
-}
-
-func TestStartAndAwaitDaemonProcessTimeoutTerminatesAndReaps(t *testing.T) {
-	cmd := daemonDetachedChildCommand("hang")
-	if err := startAndAwaitDaemonProcess(cmd, func() bool { return false }, 0, time.Millisecond); !errors.Is(err, errDaemonStartTimeout) {
-		t.Fatalf("start and await error = %v, want timeout", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("timed-out helper process was not reaped")
-	}
-}
-
-func TestStartAndAwaitDaemonProcessReleasesReadyChild(t *testing.T) {
-	marker := filepath.Join(t.TempDir(), "child-finished")
-	cmd := daemonDetachedChildCommand("mark", "ZERO_TEST_DAEMON_CHILD_MARKER="+marker)
-	if err := startAndAwaitDaemonProcess(cmd, func() bool { return true }, time.Second, time.Millisecond); err != nil {
-		t.Fatalf("start and await ready helper: %v", err)
-	}
-
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		if _, err := os.Stat(marker); err == nil {
-			return
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	t.Fatal("released helper process did not remain alive to write its marker")
-}
-
-func daemonDetachedChildCommand(mode string, extraEnv ...string) *exec.Cmd {
-	cmd := exec.Command(os.Args[0], "-test.run=TestDaemonDetachedChildProcess")
-	cmd.Env = append(os.Environ(), "ZERO_TEST_DAEMON_DETACHED_CHILD="+mode)
-	cmd.Env = append(cmd.Env, extraEnv...)
-	background.ConfigureChildProcessGroup(cmd)
-	return cmd
-}
-
-func TestDaemonDetachedChildProcess(t *testing.T) {
-	switch os.Getenv("ZERO_TEST_DAEMON_DETACHED_CHILD") {
-	case "":
-		return
-	case "mark":
-		if err := os.WriteFile(os.Getenv("ZERO_TEST_DAEMON_CHILD_MARKER"), []byte("ready"), 0o600); err != nil {
-			os.Exit(2)
-		}
-		os.Exit(0)
-	}
-	for {
-		time.Sleep(time.Hour)
-	}
-}

internal/cli/exec.go

@@ -682,20 +682,16 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 		ModelSwitcher:        modelSwitcher,
 		TurnSessionProvider:  turnSessions,
 		ModelSessionSwitcher: modelSessionSwitcher,
-		Summarizer:           summarizerFactory(resolved, deps.newProvider),
-		ContextWindowFor: func(modelID string) int {
-			return modelregistry.AgentContextWindow(modelContextWindow(modelRegistry, modelID))
-		},
-		ReasoningEffort: forwardEffort,
-		Trace:           traceRecorder,
-		Cwd:             workspaceRoot,
-		Images:          images,
-		Registry:        registry,
-		PermissionMode:  permissionMode,
-		Autonomy:        options.autonomy,
-		SelfCorrect:     selfCorrector,
-		FileDiagnostics: fileDiagnostics,
-		Profile:         execProfile.Policy(displacedMaxTurns, execProfileFilledEffort),
+		ReasoningEffort:      forwardEffort,
+		Trace:                traceRecorder,
+		Cwd:                  workspaceRoot,
+		Images:               images,
+		Registry:             registry,
+		PermissionMode:       permissionMode,
+		Autonomy:             options.autonomy,
+		SelfCorrect:          selfCorrector,
+		FileDiagnostics:      fileDiagnostics,
+		Profile:              execProfile.Policy(displacedMaxTurns, execProfileFilledEffort),
 		// Headless exec: don't accept a no-tool-call turn as "done" while work
 		// clearly remains (pending plan items / a mid-step continuation cue) —
 		// nudge to continue, and finalize as INCOMPLETE rather than false success
@@ -943,9 +939,6 @@ func registerToolSearchIfEligible(registry *tools.Registry, deferThreshold int,
 	if deferThreshold <= 0 {
 		return
 	}
-	if _, registered := registry.Get(tools.ToolSearchToolName); registered {
-		return
-	}
 	if deferredEligibleCount(registry, permissionMode, enabledTools, disabledTools) < deferThreshold {
 		return
 	}

internal/cli/exec_writer.go

@@ -267,29 +267,23 @@ func streamJSONPermissionEventType(event agent.PermissionEvent) streamjson.Event
 func (writer *execEventWriter) usage(usage agent.Usage) {
 	if writer.format == execOutputJSON {
 		writer.writeJSON(map[string]any{
-			"type":                "usage",
-			"prompt_tokens":       usage.PromptTokens,
-			"completion_tokens":   usage.CompletionTokens,
-			"cached_input_tokens": usage.CachedInputTokens,
-			"cache_write_tokens":  usage.CacheWriteTokens,
-			"total_tokens":        usage.TotalTokens(),
+			"type":              "usage",
+			"prompt_tokens":     usage.PromptTokens,
+			"completion_tokens": usage.CompletionTokens,
+			"total_tokens":      usage.TotalTokens(),
 		})
 		return
 	}
 	if writer.format == execOutputStreamJSON {
 		promptTokens := usage.EffectiveInputTokens()
 		completionTokens := usage.EffectiveOutputTokens()
-		cachedInputTokens := usage.CachedInputTokens
-		cacheWriteTokens := usage.CacheWriteTokens
 		totalTokens := usage.TotalTokens()
 		writer.writeStreamJSON(streamjson.Event{
-			Type:              streamjson.EventUsage,
-			RunID:             writer.runID,
-			PromptTokens:      &promptTokens,
-			CompletionTokens:  &completionTokens,
-			CachedInputTokens: &cachedInputTokens,
-			CacheWriteTokens:  &cacheWriteTokens,
-			TotalTokens:       &totalTokens,
+			Type:             streamjson.EventUsage,
+			RunID:            writer.runID,
+			PromptTokens:     &promptTokens,
+			CompletionTokens: &completionTokens,
+			TotalTokens:      &totalTokens,
 		})
 	}
 }

internal/cli/exec_writer_test.go

@@ -52,39 +52,3 @@ func TestExecWriterPropagatesToolResultTruncation(t *testing.T) {
 		})
 	}
 }
-
-func TestExecWriterPropagatesCacheUsage(t *testing.T) {
-	for _, format := range []execOutputFormat{execOutputJSON, execOutputStreamJSON} {
-		t.Run(string(format), func(t *testing.T) {
-			var stdout bytes.Buffer
-			writer := execEventWriter{
-				stdout:       &stdout,
-				format:       format,
-				runID:        "run_usage",
-				streamedText: &strings.Builder{},
-			}
-			writer.usage(agent.Usage{
-				InputTokens:       100,
-				OutputTokens:      20,
-				PromptTokens:      100,
-				CompletionTokens:  20,
-				CachedInputTokens: 60,
-				CacheWriteTokens:  10,
-			})
-			if writer.err != nil {
-				t.Fatalf("usage: %v", writer.err)
-			}
-			var payload map[string]any
-			if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &payload); err != nil {
-				t.Fatalf("decode output %q: %v", stdout.String(), err)
-			}
-			cachedKey, writeKey := "cached_input_tokens", "cache_write_tokens"
-			if format == execOutputStreamJSON {
-				cachedKey, writeKey = "cachedInputTokens", "cacheWriteTokens"
-			}
-			if payload[cachedKey] != float64(60) || payload[writeKey] != float64(10) {
-				t.Fatalf("cache usage missing from payload: %#v", payload)
-			}
-		})
-	}
-}

internal/cli/mcp_default_test.go

@@ -9,15 +9,15 @@ import (
 	"github.com/Gitlawb/zero/internal/config"
 )
 
-// `zero mcp disable exa` must work even though exa is a built-in
+// `zero mcp disable firecrawl` must work even though firecrawl is a built-in
 // default that is not written to the user's config file until overridden.
-func TestRunMCPDisableSeededExaDefault(t *testing.T) {
+func TestRunMCPDisableSeededFirecrawlDefault(t *testing.T) {
 	configPath := filepath.Join(t.TempDir(), "zero", "config.json")
-	// A config with no Exa entry — the default lives in code, not the file.
+	// A config with no firecrawl entry — the default lives in code, not the file.
 	writeMCPCommandRawConfig(t, configPath, `{"activeProvider":"fast"}`)
 
 	var out, errBuf bytes.Buffer
-	code := runWithDeps([]string{"mcp", "disable", "exa", "--json"}, &out, &errBuf, appDeps{
+	code := runWithDeps([]string{"mcp", "disable", "firecrawl", "--json"}, &out, &errBuf, appDeps{
 		userConfigPath: func() (string, error) { return configPath, nil },
 	})
 	if code != exitSuccess {
@@ -31,8 +31,8 @@ func TestRunMCPDisableSeededExaDefault(t *testing.T) {
 	if err := json.Unmarshal(out.Bytes(), &payload); err != nil {
 		t.Fatalf("decode disable JSON: %v\n%s", err, out.String())
 	}
-	if payload.ServerName != "exa" || !payload.Disabled || !payload.Changed {
-		t.Fatalf("disable payload = %#v, want exa disabled+changed", payload)
+	if payload.ServerName != "firecrawl" || !payload.Disabled || !payload.Changed {
+		t.Fatalf("disable payload = %#v, want firecrawl disabled+changed", payload)
 	}
 
 	// End-to-end: resolving that config now turns the default off.
@@ -40,7 +40,7 @@ func TestRunMCPDisableSeededExaDefault(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	if !cfg.Servers["exa"].Disabled {
-		t.Fatal("expected `mcp disable exa` to turn the seeded default off in the resolved config")
+	if !cfg.Servers["firecrawl"].Disabled {
+		t.Fatal("expected `mcp disable firecrawl` to turn the seeded default off in the resolved config")
 	}
 }

internal/cli/mcp_startup.go

@@ -1,147 +0,0 @@
-package cli
-
-import (
-	"context"
-	"sync"
-	"time"
-
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/mcp"
-	"github.com/Gitlawb/zero/internal/tools"
-)
-
-const (
-	optionalMCPPromptGrace = time.Second
-	optionalMCPCloseGrace  = 250 * time.Millisecond
-)
-
-// splitMCPStartupConfig keeps explicitly configured servers on the
-// prompt-critical path. Only unchanged built-in defaults may initialize after
-// first paint; their failure was already intentionally silent.
-func splitMCPStartupConfig(cfg config.MCPConfig) (critical config.MCPConfig, optional config.MCPConfig) {
-	critical.Servers = map[string]config.MCPServerConfig{}
-	optional.Servers = map[string]config.MCPServerConfig{}
-	for name, server := range cfg.Servers {
-		if server.Disabled {
-			continue
-		}
-		if config.IsUnconfiguredDefault(name, server) {
-			optional.Servers[name] = server
-			continue
-		}
-		critical.Servers[name] = server
-	}
-	return critical, optional
-}
-
-type optionalMCPStartup struct {
-	cancel context.CancelFunc
-	done   chan struct{}
-
-	mu      sync.Mutex
-	runtime mcpToolRuntime
-
-	closeOnce        sync.Once
-	runtimeCloseOnce sync.Once
-	closeErr         error
-}
-
-func startOptionalMCP(
-	parent context.Context,
-	registry *tools.Registry,
-	cfg config.MCPConfig,
-	options mcp.RegisterOptions,
-	register func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error),
-	onReady func(),
-) *optionalMCPStartup {
-	ctx, cancel := context.WithCancel(parent)
-	startup := &optionalMCPStartup{cancel: cancel, done: make(chan struct{})}
-	go func() {
-		runtime, err := register(ctx, registry, cfg, options)
-		if err == nil && onReady != nil {
-			onReady()
-		}
-		startup.mu.Lock()
-		startup.runtime = runtime
-		startup.mu.Unlock()
-		close(startup.done)
-	}()
-	return startup
-}
-
-// Await gives optional tools one bounded opportunity to join the next turn's
-// immutable registry snapshot. A timeout leaves this turn on the existing core
-// tool set; a later turn observes the completed generation.
-func (startup *optionalMCPStartup) Await(ctx context.Context, timeout time.Duration) bool {
-	if startup == nil {
-		return true
-	}
-	select {
-	case <-startup.done:
-		return true
-	default:
-	}
-	if timeout <= 0 {
-		select {
-		case <-startup.done:
-			return true
-		case <-ctx.Done():
-			return false
-		}
-	}
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-	select {
-	case <-startup.done:
-		return true
-	case <-timer.C:
-		return false
-	case <-ctx.Done():
-		return false
-	}
-}
-
-func (startup *optionalMCPStartup) Close() error {
-	if startup == nil {
-		return nil
-	}
-	startup.closeOnce.Do(func() {
-		startup.cancel()
-		reaped := make(chan struct{})
-		go func() {
-			defer close(reaped)
-			<-startup.done
-			startup.closeRuntime()
-		}()
-		timer := time.NewTimer(optionalMCPCloseGrace)
-		defer timer.Stop()
-		select {
-		case <-reaped:
-		case <-timer.C:
-		}
-	})
-	startup.mu.Lock()
-	defer startup.mu.Unlock()
-	return startup.closeErr
-}
-
-func (startup *optionalMCPStartup) closeRuntime() {
-	startup.runtimeCloseOnce.Do(func() {
-		startup.mu.Lock()
-		runtime := startup.runtime
-		startup.mu.Unlock()
-		if runtime == nil {
-			return
-		}
-		err := runtime.Close()
-		startup.mu.Lock()
-		if err != nil && startup.closeErr == nil {
-			startup.closeErr = err
-		}
-		startup.mu.Unlock()
-	})
-}
-
-func (startup *optionalMCPStartup) Skipped() []mcp.SkippedServer {
-	return nil
-}

internal/cli/mcp_startup_test.go

@@ -1,187 +0,0 @@
-package cli
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/mcp"
-	"github.com/Gitlawb/zero/internal/tools"
-)
-
-type closeTrackingMCPRuntime struct {
-	closed chan struct{}
-	err    error
-}
-
-func (runtime *closeTrackingMCPRuntime) Close() error {
-	close(runtime.closed)
-	return runtime.err
-}
-
-func (*closeTrackingMCPRuntime) Skipped() []mcp.SkippedServer { return nil }
-
-func TestSplitMCPStartupConfigDefersOnlyUnconfiguredDefaults(t *testing.T) {
-	defaults := config.DefaultMCPServers()
-	cfg := config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"exa":      defaults["exa"],
-		"docs":     {Type: "http", URL: "https://docs.example.test/mcp"},
-		"disabled": {Type: "http", URL: "https://disabled.example.test/mcp", Disabled: true},
-	}}
-
-	critical, optional := splitMCPStartupConfig(cfg)
-	if _, ok := critical.Servers["docs"]; !ok || len(critical.Servers) != 1 {
-		t.Fatalf("critical servers = %#v, want only docs", critical.Servers)
-	}
-	if _, ok := optional.Servers["exa"]; !ok || len(optional.Servers) != 1 {
-		t.Fatalf("optional servers = %#v, want only exa", optional.Servers)
-	}
-}
-
-func TestOptionalMCPAwaitTimesOutThenObservesPublishedTools(t *testing.T) {
-	registry := tools.NewRegistry()
-	release := make(chan struct{})
-	started := make(chan struct{})
-	startup := startOptionalMCP(
-		context.Background(),
-		registry,
-		config.MCPConfig{Servers: config.DefaultMCPServers()},
-		mcp.RegisterOptions{},
-		func(ctx context.Context, registry *tools.Registry, _ config.MCPConfig, _ mcp.RegisterOptions) (mcpToolRuntime, error) {
-			close(started)
-			select {
-			case <-release:
-				registry.RegisterBatch([]tools.Tool{tools.NewScopedReadFileTool(t.TempDir(), nil)})
-				return noopMCPRuntime{}, nil
-			case <-ctx.Done():
-				return noopMCPRuntime{}, ctx.Err()
-			}
-		},
-		nil,
-	)
-	defer func() { _ = startup.Close() }()
-	<-started
-
-	if startup.Await(t.Context(), time.Millisecond) {
-		t.Fatal("optional startup unexpectedly completed before release")
-	}
-	if got := len(registry.All()); got != 0 {
-		t.Fatalf("registry published tools before readiness: %d", got)
-	}
-	close(release)
-	if !startup.Await(t.Context(), time.Second) {
-		t.Fatal("optional startup did not complete after release")
-	}
-	if _, ok := registry.Get("read_file"); !ok {
-		t.Fatal("completed optional startup did not publish its tool batch")
-	}
-}
-
-func TestOptionalMCPFailedRegistrationSkipsReadinessCallback(t *testing.T) {
-	readyCalls := 0
-	startup := startOptionalMCP(
-		context.Background(),
-		tools.NewRegistry(),
-		config.MCPConfig{Servers: config.DefaultMCPServers()},
-		mcp.RegisterOptions{},
-		func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return noopMCPRuntime{}, errors.New("connect failed")
-		},
-		func() { readyCalls++ },
-	)
-	defer func() { _ = startup.Close() }()
-
-	if !startup.Await(t.Context(), time.Second) {
-		t.Fatal("failed optional startup did not settle")
-	}
-	if readyCalls != 0 {
-		t.Fatalf("readiness callback ran after failed registration: %d", readyCalls)
-	}
-}
-
-func TestOptionalMCPCloseCancelsBlockedStartup(t *testing.T) {
-	started := make(chan struct{})
-	startup := startOptionalMCP(
-		context.Background(),
-		tools.NewRegistry(),
-		config.MCPConfig{Servers: config.DefaultMCPServers()},
-		mcp.RegisterOptions{},
-		func(ctx context.Context, _ *tools.Registry, _ config.MCPConfig, _ mcp.RegisterOptions) (mcpToolRuntime, error) {
-			close(started)
-			<-ctx.Done()
-			return noopMCPRuntime{}, nil
-		},
-		nil,
-	)
-	<-started
-	if err := startup.Close(); err != nil {
-		t.Fatalf("Close() error = %v", err)
-	}
-}
-
-func TestOptionalMCPCloseReturnsRuntimeErrorWithinGrace(t *testing.T) {
-	closeErr := errors.New("close failed")
-	runtime := &closeTrackingMCPRuntime{closed: make(chan struct{}), err: closeErr}
-	startup := startOptionalMCP(
-		context.Background(),
-		tools.NewRegistry(),
-		config.MCPConfig{Servers: config.DefaultMCPServers()},
-		mcp.RegisterOptions{},
-		func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return runtime, nil
-		},
-		nil,
-	)
-	if !startup.Await(t.Context(), time.Second) {
-		t.Fatal("optional startup did not settle")
-	}
-	if err := startup.Close(); !errors.Is(err, closeErr) {
-		t.Fatalf("Close() error = %v, want %v", err, closeErr)
-	}
-}
-
-func TestOptionalMCPCloseBoundsRegistrationThatIgnoresCancellation(t *testing.T) {
-	started := make(chan struct{})
-	release := make(chan struct{})
-	released := false
-	defer func() {
-		if !released {
-			close(release)
-		}
-	}()
-	runtime := &closeTrackingMCPRuntime{closed: make(chan struct{})}
-	startup := startOptionalMCP(
-		context.Background(),
-		tools.NewRegistry(),
-		config.MCPConfig{Servers: config.DefaultMCPServers()},
-		mcp.RegisterOptions{},
-		func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			close(started)
-			<-release
-			return runtime, nil
-		},
-		nil,
-	)
-	<-started
-
-	closeResult := make(chan error, 1)
-	go func() { closeResult <- startup.Close() }()
-	select {
-	case err := <-closeResult:
-		if err != nil {
-			t.Fatalf("Close() error = %v", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("Close blocked on registration after cancellation")
-	}
-
-	close(release)
-	released = true
-	select {
-	case <-runtime.closed:
-	case <-time.After(time.Second):
-		t.Fatal("late optional MCP runtime was not closed")
-	}
-}

internal/cli/summarizer.go

@@ -1,17 +0,0 @@
-package cli
-
-import (
-	"context"
-
-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/providers"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-// summarizerFactory adapts the resolved profile and the authenticated provider
-// builder into agent.Options.Summarizer; the selection rules live in
-// providers.CompactionSummarizerFactory, shared with the TUI.
-func summarizerFactory(resolved config.ResolvedConfig, newProvider func(config.ProviderProfile) (zeroruntime.Provider, error)) func(context.Context, string) (agent.Provider, error) {
-	return providers.CompactionSummarizerFactory(resolved.Provider, resolved.Preferences.CompactionModel, newProvider)
-}

internal/cli/workflows.go

@@ -2,12 +2,9 @@ package cli
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
-	"path"
 	"path/filepath"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -605,20 +602,18 @@ func parseChangesArgs(args []string, command string) (changesCommandOptions, boo
 			return options, false, execUsageError{fmt.Sprintf("unexpected changes argument %q", arg)}
 		}
 	}
-	if command != "commit" && options.hasMessage {
+	if command != "commit" && options.message != "" {
 		return options, false, execUsageError{"--message is only valid with `zero changes commit`"}
 	}
+	if command != "commit" && (options.hasMessage || options.dryRun || options.auto) {
+		return options, false, execUsageError{"--message, --dry-run, and --auto are only valid with `zero changes commit`"}
+	}
 	if command == "commit" && options.hasMessage && options.auto {
 		return options, false, execUsageError{"cannot specify both --message and --auto"}
 	}
 	if command != "commit" && command != "push" && options.dryRun {
 		return options, false, execUsageError{"--dry-run is only valid with commit or push"}
 	}
-	// --auto on push/pr is the explicit opt-in for LLM branch naming (see
-	// ensureFeatureBranch); on commit it opts into the LLM commit message.
-	if command != "commit" && command != "push" && command != "pr" && options.auto {
-		return options, false, execUsageError{"--auto is only valid with commit, push, or pr"}
-	}
 	if command != "inspect" && options.baseRef != "" {
 		return options, false, execUsageError{"--base is only valid with `zero changes inspect`"}
 	}
@@ -939,7 +934,8 @@ Flags:
       --fill              Automatically populate PR title and body from commits
       --draft             Create PR as a draft
       --yes               Confirm pushing to a default/protected branch
-  -a, --auto              Use the LLM: commit generates the message, push/pr name the auto-created branch (sends the diff to the provider)
+  -a, --auto              Auto-generate commit message using LLM (use --dry-run to preview)
+      --dry-run           Preview commit metadata without mutating git state
       --json              Print JSON output
   -h, --help              Show this help
 `)
@@ -962,31 +958,11 @@ func runChangesPush(args []string, stdout io.Writer, stderr io.Writer, deps appD
 		return writeExecUsageError(stderr, err.Error())
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	defer cancel()
-
-	branch, remote, created, err := ensureFeatureBranch(ctx, stdout, workspaceRoot, options.remote, featureBranchOptions{
-		JSONMode:           options.json,
-		AllowDefaultBranch: options.yes,
-		DryRun:             options.dryRun,
-		AutoNaming:         options.auto,
-		MaxDiffBytes:       options.maxDiffBytes,
-	}, deps)
-	if err != nil {
-		return writeExecUsageError(stderr, err.Error())
-	}
-
-	// context.Background() is deliberate: the 2-minute ctx above is the
-	// feature-branch preflight (inspection, remote probes, branch creation).
-	// The push itself must not be cancelled mid-transfer just because the
-	// preflight budget elapsed; a large push can legitimately take longer.
 	result, err := deps.pushChanges(context.Background(), zerogit.PushOptions{
 		Cwd:                    workspaceRoot,
-		Remote:                 firstNonEmptyString(options.remote, remote),
-		Branch:                 branch,
+		Remote:                 options.remote,
 		Force:                  options.force,
 		DryRun:                 options.dryRun,
-		RequireNewRemoteBranch: created,
 		AllowPushDefaultBranch: options.yes,
 	})
 	if err != nil {
@@ -1034,62 +1010,15 @@ func runChangesPR(args []string, stdout io.Writer, stderr io.Writer, deps appDep
 		return writeExecUsageError(stderr, err.Error())
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	defer cancel()
-
-	branch, remote, created, err := ensureFeatureBranch(ctx, stdout, workspaceRoot, options.remote, featureBranchOptions{
-		JSONMode:           options.json,
-		AllowDefaultBranch: options.yes,
-		DryRun:             false,
-		AutoNaming:         options.auto,
-		MaxDiffBytes:       options.maxDiffBytes,
-	}, deps)
-	if err != nil {
-		return writeExecUsageError(stderr, err.Error())
-	}
-
-	// Resolve the target remote for the unborn-remote check. Explicit --remote wins,
-	// followed by the remote resolved by ensureFeatureBranch. When --yes is set,
-	// fall back to the branch upstream or "origin".
-	targetRemote := strings.TrimSpace(options.remote)
-	if targetRemote == "" {
-		targetRemote = remote
-	}
-	if targetRemote == "" {
-		currentBranch := ""
-		if deps.currentGitBranch != nil {
-			currentBranch = deps.currentGitBranch(context.Background(), workspaceRoot)
-		}
-		if deps.branchUpstreamRemote != nil && currentBranch != "" {
-			targetRemote = deps.branchUpstreamRemote(context.Background(), workspaceRoot, currentBranch)
-		}
-		if targetRemote == "" {
-			targetRemote = "origin"
-		}
-	}
-
-	// Probe errors are intentionally ignored so the flow can continue; if the
-	// probe fails, the subsequent push or PR operation provides fail-closed behavior.
-	if deps.isUnbornRemote != nil {
-		if unborn, unbornErr := deps.isUnbornRemote(context.Background(), workspaceRoot, targetRemote); unbornErr == nil && unborn {
-			return writeExecUsageError(stderr, fmt.Sprintf("cannot create pull request on unborn remote %s: push the initial default branch first", targetRemote))
-		}
-	}
-
 	if !options.json {
 		if _, err := fmt.Fprintln(stdout, "Pushing current branch to set upstream..."); err != nil {
 			return exitCrash
 		}
 	}
-	// context.Background() is deliberate here too: runChangesPR reuses the
-	// 2-minute ctx for preflight (branch creation and remote probes), but the
-	// push must not be cancelled mid-transfer if that budget elapsed.
 	pushResult, err := deps.pushChanges(context.Background(), zerogit.PushOptions{
 		Cwd:                    workspaceRoot,
-		Remote:                 firstNonEmptyString(options.remote, remote),
-		Branch:                 branch,
+		Remote:                 options.remote,
 		Force:                  options.force,
-		RequireNewRemoteBranch: created,
 		AllowPushDefaultBranch: options.yes,
 	})
 	if err != nil {
@@ -1171,462 +1100,3 @@ func generateAutoCommitMessage(ctx context.Context, provider zeroruntime.Provide
 	}
 	return msg, nil
 }
-
-type featureBranchOptions struct {
-	JSONMode           bool
-	AllowDefaultBranch bool
-	DryRun             bool
-	AutoNaming         bool
-	MaxDiffBytes       int
-}
-
-// branchPushPlan holds the resolved parameters for a push or PR workflow
-// before any branches are created or refs mutated. Separating plan resolution
-// from mutation allows tests to assert the resolution matrix directly without
-// touching a git repository.
-type branchPushPlan struct {
-	ShouldBranch           bool
-	CurrentBranch          string
-	PushRemote             string
-	RequireNewRemoteBranch bool
-	TrackingRemote         string
-	TrackingBranch         string
-	RestoreTip             string
-	PublishabilityBase     string
-	Summary                zerogit.ChangeSummary
-	Slug                   string
-}
-
-// resolveBranchPushPlan resolves the branch, remotes, restore tip, and naming
-// slug for changes push / pr workflows. It performs all checks (clean working
-// tree, unborn remote detection, ahead count, restore tip resolution) but
-// executes no mutation (no branch creation, ref resets, or deletions).
-func resolveBranchPushPlan(ctx context.Context, stdout io.Writer, workspaceRoot string, requestedRemote string, opts featureBranchOptions, deps appDeps) (branchPushPlan, error) {
-	if opts.AllowDefaultBranch || opts.DryRun {
-		return branchPushPlan{
-			ShouldBranch:           false,
-			PushRemote:             strings.TrimSpace(requestedRemote),
-			RequireNewRemoteBranch: false,
-		}, nil
-	}
-
-	if deps.isDefaultBranch == nil {
-		return branchPushPlan{}, fmt.Errorf("isDefaultBranch dependency missing")
-	}
-	isDefault, currentBranch, remote, err := deps.isDefaultBranch(ctx, zerogit.DefaultBranchOptions{Cwd: workspaceRoot, Remote: requestedRemote})
-	if err != nil {
-		return branchPushPlan{}, err
-	}
-	if !isDefault {
-		// Whether this push needs the nonexistence lease is decided by one
-		// live check against the destination remote, not by inference from
-		// local git state (upstream config, a generated-branch marker):
-		// every local signal that stood in for that check turned out to be
-		// wrong in some ordering (inherited config from checkout -b, a
-		// config write that failed after a successful push, a push aimed at
-		// a different remote than the one local config describes). A branch
-		// missing on the remote gets the nonexistence lease, protecting a
-		// concurrent creator of the same name; a branch already there gets a
-		// plain push, and git's own fast-forward check is the safety net —
-		// if the remote history isn't ours, the push fails with a clear
-		// non-fast-forward error instead of an attempted silent recovery.
-		if deps.remoteHasBranch == nil {
-			return branchPushPlan{
-				ShouldBranch:           false,
-				CurrentBranch:          currentBranch,
-				PushRemote:             remote,
-				RequireNewRemoteBranch: true,
-			}, nil
-		}
-		targetRemote := firstNonEmptyString(requestedRemote, remote)
-		exists, existsErr := deps.remoteHasBranch(ctx, workspaceRoot, targetRemote, currentBranch)
-		if existsErr != nil {
-			return branchPushPlan{}, fmt.Errorf("cannot check whether %s already exists on remote %s: %w", currentBranch, targetRemote, existsErr)
-		}
-		return branchPushPlan{
-			ShouldBranch:           false,
-			CurrentBranch:          currentBranch,
-			PushRemote:             remote,
-			RequireNewRemoteBranch: !exists,
-		}, nil
-	}
-
-	// CreateBranch and Push publish commits only. A dirty working tree would
-	// leave uncommitted edits behind under a branch/PR that does not include
-	// them, so refuse until the tree is clean (commit or stash first).
-	workingTree, err := deps.inspectChanges(ctx, zerogit.InspectOptions{Cwd: workspaceRoot})
-	if err != nil {
-		return branchPushPlan{}, fmt.Errorf("failed to inspect working tree: %w", err)
-	}
-	if !workingTree.Clean {
-		return branchPushPlan{}, fmt.Errorf("working tree has uncommitted changes; commit or stash them before pushing from the default branch")
-	}
-
-	// Capture the source default branch's own upstream before refreshing or
-	// leaving it. --remote selects the push destination; restore must not
-	// rewrite local main to upstream/main when main still tracks origin/main
-	// (fork setups), and refreshing must update the exact tracking ref that
-	// will supply both the ahead count and the restore target.
-	trackingRemote := remote
-	trackingBranch := currentBranch
-	if deps.branchUpstreamRemoteAndMerge != nil {
-		if r, m := deps.branchUpstreamRemoteAndMerge(ctx, workspaceRoot, currentBranch); r != "" && m != "" {
-			trackingRemote = r
-			trackingBranch = m
-		}
-	}
-
-	// Refresh the local remote-tracking ref before trusting it: IsDefaultBranch
-	// already contacted the remote for its symref check, but the tracking ref
-	// commitsAhead reads from is only a local cache (written at clone or the
-	// last fetch) and can sit behind the remote's live tip. Left stale, a real
-	// publishable range could look like zero commits ahead, and the diff
-	// derived below (which reuses this same ref as its base) would be stale
-	// too. A failure here (offline, or a genuinely unborn remote with no such
-	// ref to fetch yet) is folded into the same fail-closed path as an
-	// unresolvable ahead count below.
-	var fetchErr error
-	if deps.refreshTrackingRef != nil {
-		fetchErr = deps.refreshTrackingRef(ctx, workspaceRoot, trackingRemote, trackingBranch)
-	}
-
-	// The ahead check gates on the source upstream (trackingRemote), but the
-	// feature branch is pushed to `pushRemote`, which can be a different
-	// destination (--remote on a fork). Refuse to auto-branch onto an unborn
-	// destination: without an initial default branch the new feature branch
-	// becomes the destination's first ref and its HEAD is left pointing at it.
-	// This is checked once, here, against the push destination, before resolving
-	// commit tips or creating any branches.
-	pushRemote := firstNonEmptyString(requestedRemote, remote)
-	if deps.isUnbornRemote != nil {
-		if unbornDest, unbornDestErr := deps.isUnbornRemote(ctx, workspaceRoot, pushRemote); unbornDestErr == nil && unbornDest {
-			return branchPushPlan{}, fmt.Errorf("remote %s has no branches yet; push the initial default branch first with --yes (`zero changes push --yes`), then use auto-branching for subsequent work", pushRemote)
-		}
-	}
-
-	// Branching off the default branch only makes sense when HEAD carries a
-	// commit that is not already on the remote default branch. A clean,
-	// up-to-date default branch would otherwise publish a feature branch at the
-	// exact default tip. If the ahead count cannot be determined (for example
-	// the remote-tracking ref was never fetched), fail rather than guess. When
-	// the remote is confirmed unborn, refuse auto-branching entirely: the
-	// initial default branch must be established first (changes push --yes)
-	// so the remote has a real HEAD before any feature branch is published.
-	ahead, aheadErr := deps.commitsAhead(ctx, workspaceRoot, trackingRemote, trackingBranch)
-	if fetchErr != nil || aheadErr != nil {
-		var unbornRemote bool
-		var unbornErr error
-		if deps.isUnbornRemote != nil {
-			unbornRemote, unbornErr = deps.isUnbornRemote(ctx, workspaceRoot, trackingRemote)
-		}
-		if unbornErr == nil && unbornRemote {
-			return branchPushPlan{}, fmt.Errorf("remote %s has no branches yet; push the initial default branch first with --yes (`zero changes push --yes`), then use auto-branching for subsequent work", trackingRemote)
-		}
-		cause := aheadErr
-		if cause == nil {
-			cause = fetchErr
-		}
-		return branchPushPlan{}, fmt.Errorf("cannot determine whether HEAD is ahead of %s/%s: %w; fetch the remote tracking branch first", trackingRemote, trackingBranch, cause)
-	}
-	if ahead == 0 {
-		return branchPushPlan{}, fmt.Errorf("no changes to publish: HEAD is not ahead of %s/%s; commit your work before pushing", trackingRemote, trackingBranch)
-	}
-
-	// Resolve the restore tip to a concrete commit before creating any branch.
-	// It must never be a bare local branch name: resolving "main" yields the
-	// very commit the feature branch is about to own, so restore becomes a
-	// silent no-op and the publishable commits stay on the default branch. A
-	// named remote resolves through its just-refreshed remote-tracking ref; a
-	// direct URL or path asks the remote itself. Fail closed rather than
-	// substitute a local branch name.
-	restoreTip := ""
-	if deps.resolveRemoteBranchTip != nil {
-		tip, tipErr := deps.resolveRemoteBranchTip(ctx, workspaceRoot, trackingRemote, trackingBranch)
-		if tipErr != nil {
-			return branchPushPlan{}, fmt.Errorf("cannot resolve restore tip for %s/%s: %w", trackingRemote, trackingBranch, tipErr)
-		}
-		restoreTip = tip
-	}
-	if restoreTip == "" {
-		restoreTip = trackingRemote + "/" + trackingBranch
-	}
-
-	// Name the branch (and, with --auto, send the provider) from what HEAD is
-	// actually ahead of the resolved remote branch by, using the same ref
-	// commitsAhead just checked. A working-tree snapshot can describe edits a
-	// commit-only push will never include.
-	baseRef := restoreTip
-	summary, err := deps.inspectChanges(ctx, zerogit.InspectOptions{Cwd: workspaceRoot, BaseRef: baseRef, MaxDiffBytes: opts.MaxDiffBytes})
-	if err != nil {
-		return branchPushPlan{}, fmt.Errorf("failed to inspect changes: %w", err)
-	}
-
-	slug := fallbackBranchSlug(summary)
-	if len(summary.Files) == 0 {
-		// An empty commit (or one whose only content the diff omits) leaves
-		// nothing to derive a slug from; name the branch from the commit
-		// subject instead.
-		if subject := deps.headCommitSubject(ctx, workspaceRoot); subject != "" {
-			slug = zerogit.SlugifyBranchComponent(subject)
-		}
-	}
-	if opts.AutoNaming && strings.TrimSpace(summary.Diff) != "" {
-		llmSlug := ""
-		if resolved, cfgErr := deps.resolveConfig(workspaceRoot, config.Overrides{}); cfgErr == nil && config.HasProviderProfile(resolved.Provider) {
-			if provider, provErr := deps.newProvider(resolved.Provider); provErr == nil {
-				if !opts.JSONMode {
-					fmt.Fprintln(stdout, "Generating branch name using LLM...")
-				}
-				genCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
-				generated, genErr := generateAutoBranchSlug(genCtx, provider, resolved.Provider.Model, redactChangeSummary(summary))
-				cancel()
-				if genErr == nil && generated != "" {
-					llmSlug = generated
-				}
-			}
-		}
-		if llmSlug != "" {
-			slug = llmSlug
-		} else if !opts.JSONMode {
-			// Cover resolveConfig failures, missing provider profiles,
-			// newProvider errors, generation errors, and empty results so the
-			// user is not left guessing after "Generating..." or silence.
-			fmt.Fprintln(stdout, "LLM branch naming unavailable; using deterministic name.")
-		}
-	}
-
-	return branchPushPlan{
-		ShouldBranch:           true,
-		CurrentBranch:          currentBranch,
-		PushRemote:             pushRemote,
-		RequireNewRemoteBranch: true,
-		TrackingRemote:         trackingRemote,
-		TrackingBranch:         trackingBranch,
-		RestoreTip:             restoreTip,
-		PublishabilityBase:     baseRef,
-		Summary:                summary,
-		Slug:                   slug,
-	}, nil
-}
-
-// ensureFeatureBranch is the branch-naming step `zero changes push`/`pr` run
-// before pushing: pushing straight to the default branch is refused deeper in
-// zerogit.Push, so rather than surface that as a dead end, create and switch
-// to a conventionally named "<user>/<slug>" branch first. It returns the
-// branch push/pr should target, or "" to mean "current HEAD branch, unchanged"
-// (zerogit.Push already treats an empty Branch that way), plus the remote the
-// preflight resolved (requestedRemote, then the original branch's configured
-// upstream, then "origin"), plus whether Push should require that branch not
-// already exist on that remote. Callers must pass the remote to Push: a
-// freshly created branch has no tracking configuration, so Push's own
-// fallback would silently retarget "origin" even when the work came from a
-// branch tracking a different remote. Callers must also pass that third value
-// through as Push's RequireNewRemoteBranch: CreateBranch's own
-// remote-collision probe runs before this returns, and closing that race
-// requires Push's push itself to assert the destination is still new. That
-// requirement also carries across a retry: if the current branch is already
-// non-default (this call didn't create it) but has not been successfully
-// published to the exact target remote under the same branch name, keep the
-// nonexistence lease. branch.<name>.remote alone is not enough: with
-// branch.autoSetupMerge=inherit, checkout -b copies remote=origin from the
-// source branch before any push. After a successful create, the original
-// default branch ref is moved back to its own upstream tip (not necessarily
-// the push destination) so the feature branch exclusively owns the
-// publishable commits; a failed restore rolls the feature branch back.
-// allowDefaultBranch (the --yes flag) and dryRun both opt out via the ""
-// branch / false return, leaving Push's own guard/preview behavior on the
-// default branch unaffected.
-//
-// autoNaming gates the LLM naming path (--auto): these commands were
-// git-only, and sending the change diff to a configured provider on every
-// default-branch push would silently export source code nobody asked to
-// share. Without the opt-in the name comes from deterministic local
-// information only. maxDiffBytes caps the committed-range diff Inspect
-// returns, so a user who passed --diff-bytes to bound the proprietary source
-// sent for LLM naming has that cap honored here just as the commit path does.
-// The working tree must be clean and HEAD must be ahead of the resolved
-// remote branch; both are verified before any branch is created. The
-// inspectChanges, commitsAhead, headCommitSubject, currentGitUser, and
-// createBranch dependencies are required on the default-branch path and are
-// called without nil guards; fillAppDeps populates all of them. The
-// refreshTrackingRef, resolveRemoteBranchTip, isUnbornRemote, resetBranchRef,
-// and deleteBranch dependencies are optional and are skipped when nil.
-func ensureFeatureBranch(ctx context.Context, stdout io.Writer, workspaceRoot string, requestedRemote string, opts featureBranchOptions, deps appDeps) (string, string, bool, error) {
-	plan, err := resolveBranchPushPlan(ctx, stdout, workspaceRoot, requestedRemote, opts, deps)
-	if err != nil {
-		return "", "", false, err
-	}
-	if !plan.ShouldBranch {
-		return plan.CurrentBranch, plan.PushRemote, plan.RequireNewRemoteBranch, nil
-	}
-
-	expectedRestoreTip := ""
-	if deps.currentBranchTip != nil {
-		expectedRestoreTip = deps.currentBranchTip(ctx, workspaceRoot)
-	}
-
-	name := zerogit.BuildBranchName(deps.currentGitUser(ctx, workspaceRoot), plan.Slug)
-	result, err := deps.createBranch(ctx, zerogit.BranchOptions{Cwd: workspaceRoot, Name: name, Remote: plan.PushRemote})
-	if err != nil {
-		return "", "", false, fmt.Errorf("failed to create branch: %w", err)
-	}
-	// The normal flow commits on the default branch first, then creates the
-	// feature branch at the same HEAD. Without moving the original default
-	// ref back, local main keeps the pre-squash commits and diverges from
-	// its upstream after a squash-merge (and a later pull/push can re-publish
-	// them). Once the feature branch owns those commits, restore the default
-	// branch to the source branch's own upstream tip captured above.
-	// Failure-safe: if the restore fails, delete the feature branch and
-	// check the default branch back out so the tree is not left half-moved.
-	if deps.resetBranchRef != nil {
-		if err := deps.resetBranchRef(ctx, workspaceRoot, plan.CurrentBranch, plan.RestoreTip, expectedRestoreTip); err != nil {
-			// A compare-and-swap conflict means the default branch moved
-			// while we were branching, so restoreTip is no longer the tip we
-			// meant to restore. The rollback below deletes the branch that
-			// now exclusively owns the user's commits, which would destroy
-			// work to recover from a race we can simply report. Keep the
-			// branch and let the user reconcile the default branch.
-			if errors.Is(err, zerogit.ErrCompareAndSwapConflict) {
-				return "", "", false, fmt.Errorf("failed to restore default branch %s to %s after auto-branching: %w; generated branch %s was preserved because the default branch changed concurrently", plan.CurrentBranch, plan.RestoreTip, err, result.Branch)
-			}
-			var rollbackErr error
-			if deps.deleteBranch != nil {
-				rollbackErr = deps.deleteBranch(ctx, workspaceRoot, plan.CurrentBranch, result.Branch)
-			}
-			if rollbackErr != nil {
-				return "", "", false, fmt.Errorf("failed to restore default branch %s to %s after auto-branching: %w; rollback of %s also failed: %v", plan.CurrentBranch, plan.RestoreTip, err, result.Branch, rollbackErr)
-			}
-			return "", "", false, fmt.Errorf("failed to restore default branch %s to %s after auto-branching: %w", plan.CurrentBranch, plan.RestoreTip, err)
-		}
-	}
-	if !opts.JSONMode {
-		fmt.Fprintf(stdout, "Created branch %s (was on %s)\n", result.Branch, plan.CurrentBranch)
-	}
-	return result.Branch, plan.PushRemote, true, nil
-}
-
-// fallbackBranchSlug derives a deterministic branch-name slug from a change
-// summary without calling an LLM, so ensureFeatureBranch still works when no
-// provider is configured.
-func fallbackBranchSlug(summary zerogit.ChangeSummary) string {
-	switch len(summary.Files) {
-	case 0:
-		return "changes"
-	case 1:
-		// Git paths are always slash-separated regardless of platform, so
-		// path.Base (not filepath.Base) extracts the filename portably.
-		return zerogit.SlugifyBranchComponent(path.Base(summary.Files[0].Path))
-	default:
-		return fmt.Sprintf("update-%d-files", len(summary.Files))
-	}
-}
-
-// generateAutoBranchSlug asks the model for a short kebab-case slug
-// describing the diff, mirroring generateAutoCommitMessage's prompt shape.
-func generateAutoBranchSlug(ctx context.Context, provider zeroruntime.Provider, model string, summary zerogit.ChangeSummary) (string, error) {
-	var promptBuilder strings.Builder
-	promptBuilder.WriteString("Analyze the following git diff and generate a short git branch name slug for it.\n")
-	promptBuilder.WriteString("The slug must be 2 to 5 lowercase words separated by hyphens (kebab-case), using only letters, digits, and hyphens, with no prefix like \"feature/\" or \"fix/\" and no surrounding quotes.\n")
-	promptBuilder.WriteString("Output ONLY the raw slug text, nothing else.\n\n")
-	promptBuilder.WriteString("Git Diff:\n")
-	promptBuilder.WriteString(summary.Diff)
-
-	request := zeroruntime.CompletionRequest{
-		Messages: []zeroruntime.Message{
-			{Role: zeroruntime.MessageRoleUser, Content: promptBuilder.String()},
-		},
-	}
-	stream, err := provider.StreamCompletion(ctx, request)
-	if err != nil {
-		return "", err
-	}
-	collected := zeroruntime.CollectStream(ctx, stream)
-	if collected.Error != "" {
-		return "", fmt.Errorf("%s", collected.Error)
-	}
-
-	slug := zerogit.SlugifyBranchComponent(extractBranchSlug(collected.Text))
-	if slug == "" {
-		return "", fmt.Errorf("provider returned empty branch slug")
-	}
-	return slug, nil
-}
-
-// slugLineRe matches a line that already reads as a kebab-case slug (letters,
-// digits, and internal single hyphens only). extractBranchSlug prefers such a
-// line so a preamble sentence is never mistaken for the slug.
-var slugLineRe = regexp.MustCompile(`^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$`)
-
-func isPreambleText(s string) bool {
-	lower := strings.ToLower(strings.TrimSpace(s))
-	if strings.HasSuffix(lower, ":") || strings.HasSuffix(lower, ".") || strings.HasSuffix(lower, "!") || strings.HasSuffix(lower, "?") {
-		return true
-	}
-	preambles := []string{
-		"here is", "here's", "below is", "below are", "sure", "certainly",
-		"i suggest", "suggested branch", "branch name", "recommended branch",
-		"how about", "you could use",
-	}
-	for _, p := range preambles {
-		if strings.HasPrefix(lower, p) {
-			return true
-		}
-	}
-	return false
-}
-
-// extractBranchSlug pulls the intended slug out of a model response that didn't
-// follow the "output only the raw slug" instruction exactly. It drops Markdown
-// code-fence lines, then prefers a line that already looks like a kebab-case
-// slug: that skips a leading preamble such as "Here is a suggested branch
-// name:" in favor of the "add-login-page" line that follows it. One-word
-// acknowledgements that happen to match the slug regex ("Sure", "Certainly")
-// are filtered as preamble before the early return, so "Sure\nadd login page"
-// yields the real suggestion. Inline labeled forms ("Branch name: add-login-page")
-// still work: the preamble check runs on the extracted value after the label
-// is stripped. If no line is strictly kebab-cased, it prefers a plausible
-// non-preamble line so plain multi-word replies still slugify correctly.
-func extractBranchSlug(text string) string {
-	var firstLine string
-
-	for _, line := range strings.Split(text, "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "```") {
-			continue
-		}
-		line = strings.TrimSpace(strings.Trim(line, `"'`))
-		if line == "" {
-			continue
-		}
-
-		candidate := line
-		if idx := strings.Index(line, ":"); idx != -1 {
-			after := strings.TrimSpace(strings.Trim(line[idx+1:], `"'`))
-			if after != "" {
-				candidate = after
-			}
-		}
-		// Models often terminate a suggestion with sentence punctuation;
-		// strip it so "add login page." is recovered as the slug rather than
-		// rejected as preamble (isPreambleText treats a trailing '.' as a
-		// full sentence). True preamble lines still match the prefix list.
-		candidate = strings.TrimSpace(strings.TrimRight(candidate, ".!?"))
-		if candidate == "" {
-			continue
-		}
-
-		// Preamble classification runs before accepting a slug-shaped line so
-		// "Sure" does not win over a later "add-login-page". The check is on
-		// candidate (post label-strip) so "Branch name: add-login-page" still
-		// returns the extracted slug.
-		if slugLineRe.MatchString(candidate) && !isPreambleText(candidate) {
-			return candidate
-		}
-
-		if firstLine == "" && !isPreambleText(candidate) {
-			firstLine = candidate
-		}
-	}
-
-	return firstLine
-}

internal/config/command_test.go

@@ -105,17 +105,7 @@ func TestLoadProviderCommandTimeout(t *testing.T) {
 //
 // This is a hang-breaker, not a tuned margin. Nothing in a healthy run waits on
 // it, since both tests return about one WaitDelay after the fixture exits.
-const (
-	providerCommandTestBudget        = 90 * time.Second
-	providerCommandReadyWaitAttempts = 45
-)
-
-func TestProviderCommandBudgetLeavesCleanupMargin(t *testing.T) {
-	readyWaitCeiling := time.Duration(providerCommandReadyWaitAttempts) * time.Second
-	if providerCommandTestBudget < 2*readyWaitCeiling {
-		t.Fatalf("provider command test budget %s leaves less than one readiness window for cleanup after %s", providerCommandTestBudget, readyWaitCeiling)
-	}
-}
+const providerCommandTestBudget = 60 * time.Second
 
 // backgroundChildLifetime must exceed providerCommandTestBudget so that a child
 // dying of old age is unobservable: any run where runProviderCommand has not
@@ -351,15 +341,15 @@ func writeCommand(t *testing.T, script commandScript) string {
 			// assertion fail is far more diagnosable than blocking until the
 			// timeout fires and reporting an unrelated error. Each iteration is
 			// about a second, since `ping -n 2` sleeps between its two echoes,
-			// so the ceiling is roughly 45s: enough for a heavily loaded Windows
-			// runner while leaving the other half of providerCommandTestBudget for
-			// process exit, PID-file verification, and cleanup. Giving up surfaces a legible
+			// so the ceiling is roughly 15s: far longer than any cold PowerShell
+			// start seen on a runner, and far shorter than
+			// providerCommandTestBudget, so giving up surfaces a legible
 			// PID-file failure rather than a timeout that hides the real cause.
 			lines = append(lines,
 				":zeroWaitReady",
 				"if exist \""+readyFile+"\" goto zeroReady",
 				"set /a ZERO_READY_TRIES+=1",
-				"if %ZERO_READY_TRIES% GEQ "+itoa(providerCommandReadyWaitAttempts)+" goto zeroReady",
+				"if %ZERO_READY_TRIES% GEQ 15 goto zeroReady",
 				"ping -n 2 127.0.0.1 >nul",
 				"goto zeroWaitReady",
 				":zeroReady",

internal/config/mcp_defaults.go

@@ -5,20 +5,22 @@ import (
 	"strings"
 )
 
-// DefaultMCPServers returns the MCP servers Zero ships ENABLED by default so
-// web search and page fetching work out of the box with no setup and no API
-// key. They are seeded before user/project config is merged (see ResolveMCP),
-// so a user can override any field — for example add an API-key header to lift
-// Exa's anonymous rate limit — or disable it entirely with
+// DefaultMCPServers returns the MCP servers Zero ships ENABLED by default so web
+// search and scraping work out of the box with no setup and no API key. They are
+// seeded before user/project config is merged (see ResolveMCP), so a user can
+// override any field — for example point firecrawl at a self-hosted instance, or
+// add an API-key header to lift the free-tier limit — or disable it entirely with
 // `zero mcp disable <name>` (which writes `"disabled": true`).
 //
-// Exa's hosted MCP server works anonymously with rate limits. Users can add an
-// Exa API key for higher limits.
+// Keyless Firecrawl routes requests through firecrawl.dev (1,000 free credits per
+// month, no account). Self-host Firecrawl (AGPL-3.0) for unlimited and private
+// use. Zero only calls it over the network, so Firecrawl's license never reaches
+// into Zero's own code.
 func DefaultMCPServers() map[string]MCPServerConfig {
 	return map[string]MCPServerConfig{
-		"exa": {
+		"firecrawl": {
 			Type: "http",
-			URL:  "https://mcp.exa.ai/mcp",
+			URL:  "https://mcp.firecrawl.dev/v2/mcp",
 		},
 	}
 }
@@ -33,13 +35,13 @@ func IsDefaultMCPServer(name string) bool {
 
 // IsUnconfiguredDefault reports whether server is one of Zero's built-in
 // defaults that the user never wrote an entry for in their config — i.e. it is
-// running with whatever Zero ships (e.g. keyless Exa, no credentials).
+// running with whatever Zero ships (e.g. keyless Firecrawl, no credentials).
 //
 // Both conditions below must hold:
 //   - !server.configured: the user's JSON never declared an object for this
 //     server key at all (set by MCPServerConfig.UnmarshalJSON only when it
 //     actually ran for this key). Any explicit action — including a
-//     disable/enable toggle like `zero mcp enable exa` that leaves the
+//     disable/enable toggle like `zero mcp enable firecrawl` that leaves the
 //     resolved value unchanged — sets configured, so it always counts as
 //     user-configured, even though the value comparison below could not tell
 //     the difference on its own.
@@ -56,90 +58,3 @@ func IsUnconfiguredDefault(name string, server MCPServerConfig) bool {
 	def, ok := DefaultMCPServers()[strings.TrimSpace(name)]
 	return ok && !server.configured && reflect.DeepEqual(def, server)
 }
-
-// retiredDefaultMCPServer describes a built-in default Zero no longer ships.
-type retiredDefaultMCPServer struct {
-	// successor is the default that replaced it.
-	successor string
-	// shipped is the value Zero used to seed for this name. A user entry
-	// written while the default was still shipped may name only an override
-	// (a header, say) and rely on these fields for the rest, so they have to
-	// outlive the default itself.
-	shipped MCPServerConfig
-}
-
-// retiredDefaultMCPServers maps a retired built-in default to what replaced it
-// and to the value Zero used to ship for it.
-var retiredDefaultMCPServers = map[string]retiredDefaultMCPServer{
-	"firecrawl": {
-		successor: "exa",
-		shipped: MCPServerConfig{
-			Type: "http",
-			URL:  "https://mcp.firecrawl.dev/v2/mcp",
-		},
-	},
-}
-
-// migrateRetiredDefaultMCPServers keeps an upgrade across a default-provider
-// swap from changing what the user's config means. It handles the two ways a
-// rename can break a config written against the old default:
-//
-//   - A user who ran `zero mcp disable <old default>` made an explicit choice
-//     not to open that outbound connection. Without carrying that decision to
-//     the successor, the upgrade re-opens it under the new name — and because
-//     the replacement looks like an untouched default, even the startup
-//     warning stays quiet (see IsUnconfiguredDefault and issue #552).
-//   - A user who customized the old default could name only the field they
-//     were changing, because the seeded default supplied the transport. Once
-//     the default stops being seeded that entry resolves to a server with no
-//     type, url, or command, which fails NormalizeConfig and takes the whole
-//     startup down rather than just that one server.
-//
-// It runs immediately after the user layer merges (see ResolveMCP), which
-// scopes it to user-level decisions — the only scope whose disable is sticky.
-// The carried-over disable applies only when the user never declared the
-// successor themselves: an explicit `exa` entry wins whether it enables or
-// disables. Because the disable is recorded as a user-level decision, the
-// lower-trust project layer cannot lift it, while `zero mcp enable exa` still
-// can (the CLI override scope merges with canReenable=true).
-func migrateRetiredDefaultMCPServers(cfg *MCPConfig) {
-	for name, retired := range retiredDefaultMCPServers {
-		entry, ok := cfg.Servers[name]
-		if !ok {
-			continue
-		}
-		if inheritsRetiredTransport(entry) {
-			// Re-seed what Zero used to ship underneath the user's fields, so a
-			// partial entry still resolves to the complete server it named when
-			// it was written. Their own values still win — this only fills the
-			// gap the retired default used to cover.
-			entry = mergeMCPServer(retired.shipped, entry, true)
-			cfg.Servers[name] = entry
-		}
-		if !entry.disabledSet || !entry.Disabled {
-			continue
-		}
-		replacement, ok := cfg.Servers[retired.successor]
-		if !ok || replacement.configured {
-			continue
-		}
-		replacement.Disabled = true
-		replacement.disabledSet = true
-		cfg.Servers[retired.successor] = replacement
-	}
-}
-
-// inheritsRetiredTransport reports whether entry named no transport of its own
-// — no type, url, command, or args — and so relied entirely on the retired
-// default to supply one.
-//
-// Anything else is a complete definition the user owns (a self-hosted url, a
-// stdio command) and must be left alone: grafting the retired default's http
-// type onto an entry that names a command produces a server that is rejected
-// outright, turning a working config into a startup failure.
-func inheritsRetiredTransport(entry MCPServerConfig) bool {
-	return strings.TrimSpace(entry.Type) == "" &&
-		strings.TrimSpace(entry.URL) == "" &&
-		strings.TrimSpace(entry.Command) == "" &&
-		len(entry.Args) == 0
-}

internal/config/mcp_defaults_test.go

@@ -7,10 +7,10 @@ import (
 )
 
 func TestIsDefaultMCPServer(t *testing.T) {
-	if !IsDefaultMCPServer("exa") {
-		t.Fatal("exa should be a built-in default")
+	if !IsDefaultMCPServer("firecrawl") {
+		t.Fatal("firecrawl should be a built-in default")
 	}
-	if IsDefaultMCPServer("  exa  ") == false {
+	if IsDefaultMCPServer("  firecrawl  ") == false {
 		t.Fatal("IsDefaultMCPServer should trim whitespace")
 	}
 	if IsDefaultMCPServer("not-a-default") {
@@ -18,45 +18,45 @@ func TestIsDefaultMCPServer(t *testing.T) {
 	}
 }
 
-func TestResolveMCPSeedsEnabledExaDefault(t *testing.T) {
+func TestResolveMCPSeedsEnabledFirecrawlDefault(t *testing.T) {
 	cfg, err := ResolveMCP(ResolveOptions{})
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	exa, ok := cfg.Servers["exa"]
+	firecrawl, ok := cfg.Servers["firecrawl"]
 	if !ok {
-		t.Fatal("expected the exa default to be seeded with no user config")
+		t.Fatal("expected the firecrawl default to be seeded with no user config")
 	}
-	if exa.Type != "http" || exa.URL != "https://mcp.exa.ai/mcp" {
-		t.Fatalf("unexpected exa default: %#v", exa)
+	if firecrawl.Type != "http" || firecrawl.URL != "https://mcp.firecrawl.dev/v2/mcp" {
+		t.Fatalf("unexpected firecrawl default: %#v", firecrawl)
 	}
-	if exa.Disabled {
-		t.Fatal("the exa default must be enabled out of the box")
+	if firecrawl.Disabled {
+		t.Fatal("the firecrawl default must be enabled out of the box")
 	}
 }
 
 func TestResolveMCPUserCanDisableDefault(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"exa":{"disabled":true}}}}`), 0o600); err != nil {
+	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	if !cfg.Servers["exa"].Disabled {
+	if !cfg.Servers["firecrawl"].Disabled {
 		t.Fatal("a user must be able to disable the default by writing over it")
 	}
 }
 
 func TestIsUnconfiguredDefault(t *testing.T) {
-	if !IsUnconfiguredDefault("exa", DefaultMCPServers()["exa"]) {
-		t.Fatal("an untouched exa default should be reported as unconfigured")
+	if !IsUnconfiguredDefault("firecrawl", DefaultMCPServers()["firecrawl"]) {
+		t.Fatal("an untouched firecrawl default should be reported as unconfigured")
 	}
-	if IsUnconfiguredDefault("exa", MCPServerConfig{Type: "http", URL: "https://example.com/mcp"}) {
+	if IsUnconfiguredDefault("firecrawl", MCPServerConfig{Type: "http", URL: "http://localhost:3002/mcp"}) {
 		t.Fatal("a server overriding the default URL is no longer unconfigured")
 	}
-	if IsUnconfiguredDefault("exa", MCPServerConfig{Type: "http", URL: "https://mcp.exa.ai/mcp", Auth: "bearer"}) {
+	if IsUnconfiguredDefault("firecrawl", MCPServerConfig{Type: "http", URL: "https://mcp.firecrawl.dev/v2/mcp", Auth: "bearer"}) {
 		t.Fatal("a server with credentials added is no longer unconfigured")
 	}
 	if IsUnconfiguredDefault("not-a-default", MCPServerConfig{}) {
@@ -65,173 +65,57 @@ func TestIsUnconfiguredDefault(t *testing.T) {
 }
 
 func TestResolveMCPExplicitReenableIsNotUnconfiguredDefault(t *testing.T) {
-	// `zero mcp enable exa` after a prior disable writes {"disabled":false}
+	// `zero mcp enable firecrawl` after a prior disable writes {"disabled":false}
 	// explicitly. The resolved value is identical to the untouched default (both
 	// enabled, no credentials), but the user DID take an explicit action here, so
 	// IsUnconfiguredDefault must not treat it as untouched (issue #563 review).
 	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"exa":{"disabled":false}}}}`), 0o600); err != nil {
+	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":false}}}}`), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	exa := cfg.Servers["exa"]
-	if exa.Disabled {
-		t.Fatalf("explicit re-enable should leave the server enabled: %#v", exa)
+	firecrawl := cfg.Servers["firecrawl"]
+	if firecrawl.Disabled {
+		t.Fatalf("explicit re-enable should leave the server enabled: %#v", firecrawl)
 	}
-	if IsUnconfiguredDefault("exa", exa) {
+	if IsUnconfiguredDefault("firecrawl", firecrawl) {
 		t.Fatal("an explicit enable/disable toggle must count as user-configured, even though the resolved value matches the default")
 	}
 }
 
 func TestResolveMCPExplicitRedeclareOfDefaultValuesIsNotUnconfiguredDefault(t *testing.T) {
-	// A user who copies Exa's exact default type/url into their config
+	// A user who copies firecrawl's exact default type/url into their config
 	// (e.g. from an example file, planning to add credentials later) produces a
-	// resolved value byte-identical to DefaultMCPServers()["exa"] — the
+	// resolved value byte-identical to DefaultMCPServers()["firecrawl"] — the
 	// same trap TestResolveMCPExplicitReenableIsNotUnconfiguredDefault covers for
 	// the disabled toggle. IsUnconfiguredDefault must still treat this as
 	// user-configured because the user's JSON declared an entry for it, even
 	// though a plain resolved-value comparison could not tell the difference.
 	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"exa":{"type":"http","url":"https://mcp.exa.ai/mcp"}}}}`), 0o600); err != nil {
+	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"type":"http","url":"https://mcp.firecrawl.dev/v2/mcp"}}}}`), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	exa := cfg.Servers["exa"]
-	want := DefaultMCPServers()["exa"]
-	if exa.Type != want.Type || exa.URL != want.URL || exa.Disabled != want.Disabled {
-		t.Fatalf("expected the resolved value to match the default's fields exactly: %#v", exa)
+	firecrawl := cfg.Servers["firecrawl"]
+	want := DefaultMCPServers()["firecrawl"]
+	if firecrawl.Type != want.Type || firecrawl.URL != want.URL || firecrawl.Disabled != want.Disabled {
+		t.Fatalf("expected the resolved value to match the default's fields exactly: %#v", firecrawl)
 	}
-	if IsUnconfiguredDefault("exa", exa) {
+	if IsUnconfiguredDefault("firecrawl", firecrawl) {
 		t.Fatal("redeclaring the default's exact values is still an explicit user configuration, not an untouched default")
 	}
 }
 
 func TestResolveMCPUserCanOverrideDefaultURLKeepingOtherFields(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.json")
-	// Point Exa at a proxy; the default's Type must survive.
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"exa":{"url":"https://example.com/mcp"}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	exa := cfg.Servers["exa"]
-	if exa.URL != "https://example.com/mcp" {
-		t.Fatalf("user override of the default URL did not apply: %#v", exa)
-	}
-	if exa.Type != "http" {
-		t.Fatalf("override should keep the default's other fields (type), got %#v", exa)
-	}
-}
-
-func TestResolveMCPCarriesLegacyDefaultDisableToSuccessor(t *testing.T) {
-	// Upgrade path: the user disabled the firecrawl default Zero used to ship.
-	// Swapping the default to exa must not re-open an outbound connection they
-	// explicitly switched off.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	if !cfg.Servers["exa"].Disabled {
-		t.Fatalf("a prior disable of the retired default must carry to its replacement: %#v", cfg.Servers["exa"])
-	}
-}
-
-func TestResolveMCPExplicitSuccessorBeatsLegacyDefaultDisable(t *testing.T) {
-	// The user disabled the old default but has since explicitly configured exa.
-	// Their newer, explicit choice wins — the migration must not override it.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true},"exa":{"disabled":false}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	exa := cfg.Servers["exa"]
-	if exa.Disabled {
-		t.Fatalf("an explicit exa entry must survive the legacy-disable migration: %#v", exa)
-	}
-	if IsUnconfiguredDefault("exa", exa) {
-		t.Fatal("an explicitly configured exa is not an untouched default")
-	}
-}
-
-func TestResolveMCPLegacyDefaultLeftEnabledDoesNotDisableSuccessor(t *testing.T) {
-	// A user who configured firecrawl without disabling it (e.g. added a header)
-	// never opted out of the default search server, so exa stays enabled.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"headers":{"Authorization":"Bearer k"}}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	if cfg.Servers["exa"].Disabled {
-		t.Fatal("only an explicit disable of the retired default should carry over")
-	}
-}
-
-func TestResolveMCPLegacyDefaultDisableIsLiftableByOverride(t *testing.T) {
-	// The carried-over disable is a user-level decision, not a permanent one:
-	// `zero mcp enable exa` merges through the CLI override scope, which is the
-	// one layer allowed to re-enable.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	enabled := MCPServerConfig{Disabled: false, disabledSet: true}
-	cfg, err := ResolveMCP(ResolveOptions{
-		UserConfigPath: path,
-		Overrides:      Overrides{MCP: MCPConfig{Servers: map[string]MCPServerConfig{"exa": enabled}}},
-	})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	if cfg.Servers["exa"].Disabled {
-		t.Fatalf("an explicit enable must lift the carried-over disable: %#v", cfg.Servers["exa"])
-	}
-}
-
-func TestResolveMCPLegacyDisableSurvivesProjectReenable(t *testing.T) {
-	// The project layer is lower-trust and must not lift the carried-over
-	// user-level disable — the same guard a direct `zero mcp disable exa` gets.
-	dir := t.TempDir()
-	userPath := filepath.Join(dir, "config.json")
-	if err := os.WriteFile(userPath, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	projectPath := filepath.Join(dir, "project.json")
-	if err := os.WriteFile(projectPath, []byte(`{"mcp":{"servers":{"exa":{"disabled":false}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: userPath, ProjectConfigPath: projectPath})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	if !cfg.Servers["exa"].Disabled {
-		t.Fatal("project config must not re-enable a server the user disabled")
-	}
-}
-
-func TestResolveMCPKeepsRetiredDefaultTransportForPartialEntry(t *testing.T) {
-	// A user who added an API key to the firecrawl default wrote only the header
-	// — the seeded default supplied the http type and URL. Retiring the default
-	// must not strip those out from under them and leave an unusable server.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"headers":{"Authorization":"Bearer k"}}}}}`), 0o600); err != nil {
+	// Point firecrawl at a self-hosted instance; the default's Type must survive.
+	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"url":"http://localhost:3002/mcp"}}}}`), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
@@ -239,55 +123,10 @@ func TestResolveMCPKeepsRetiredDefaultTransportForPartialEntry(t *testing.T) {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
 	firecrawl := cfg.Servers["firecrawl"]
-	if firecrawl.Type != "http" || firecrawl.URL != "https://mcp.firecrawl.dev/v2/mcp" {
-		t.Fatalf("a partial entry must keep the retired default's transport: %#v", firecrawl)
+	if firecrawl.URL != "http://localhost:3002/mcp" {
+		t.Fatalf("user override of the default URL did not apply: %#v", firecrawl)
 	}
-	if firecrawl.Headers["Authorization"] != "Bearer k" {
-		t.Fatalf("the user's own field must still win: %#v", firecrawl)
-	}
-}
-
-func TestResolveMCPDoesNotGraftRetiredDefaultOntoOwnTransport(t *testing.T) {
-	// A self-hosted firecrawl over stdio is a complete definition the user owns.
-	// Re-seeding the retired http default under it would produce an http server
-	// carrying a command, which NormalizeConfig rejects outright.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"command":"firecrawl-mcp"}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	firecrawl := cfg.Servers["firecrawl"]
-	if firecrawl.Type != "" || firecrawl.URL != "" {
-		t.Fatalf("an entry naming its own transport must be left alone: %#v", firecrawl)
-	}
-	if firecrawl.Command != "firecrawl-mcp" {
-		t.Fatalf("the user's command must survive: %#v", firecrawl)
-	}
-}
-
-func TestResolveMCPDisabledRetiredEntryStaysReEnableable(t *testing.T) {
-	// The disable carries to exa, and the retired entry itself keeps a usable
-	// transport so a later `zero mcp enable firecrawl` does not resolve to a
-	// server with no type, url, or command.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	firecrawl := cfg.Servers["firecrawl"]
-	if !firecrawl.Disabled {
-		t.Fatalf("the retired entry must stay disabled: %#v", firecrawl)
-	}
-	if firecrawl.Type != "http" || firecrawl.URL != "https://mcp.firecrawl.dev/v2/mcp" {
-		t.Fatalf("a disabled retired entry should still carry a usable transport: %#v", firecrawl)
-	}
-	if !cfg.Servers["exa"].Disabled {
-		t.Fatal("the disable must still carry to the successor")
+	if firecrawl.Type != "http" {
+		t.Fatalf("override should keep the default's other fields (type), got %#v", firecrawl)
 	}
 }

internal/config/resolve_mcp_exclude_project_test.go

@@ -34,7 +34,7 @@ func TestResolveMCPExcludeProjectDropsProjectServers(t *testing.T) {
 		if _, ok := cfg.Servers["user-srv"]; !ok {
 			t.Fatal("the user server must always be present")
 		}
-		if _, ok := cfg.Servers["exa"]; !ok {
+		if _, ok := cfg.Servers["firecrawl"]; !ok {
 			t.Fatal("the built-in default must always be present")
 		}
 	})
@@ -54,7 +54,7 @@ func TestResolveMCPExcludeProjectDropsProjectServers(t *testing.T) {
 		if _, ok := cfg.Servers["user-srv"]; !ok {
 			t.Fatal("the user server must survive when the project layer is dropped")
 		}
-		if _, ok := cfg.Servers["exa"]; !ok {
+		if _, ok := cfg.Servers["firecrawl"]; !ok {
 			t.Fatal("the built-in default must survive when the project layer is dropped")
 		}
 	})

internal/config/resolver.go

@@ -180,7 +180,7 @@ func Resolve(options ResolveOptions) (ResolvedConfig, error) {
 }
 
 func ResolveMCP(options ResolveOptions) (MCPConfig, error) {
-	// Seed Zero's built-in default MCP servers (e.g. keyless Exa for free,
+	// Seed Zero's built-in default MCP servers (e.g. keyless Firecrawl for free,
 	// no-setup web search/scrape) BEFORE merging user/project config, so the user
 	// can override any field or disable a default by writing over it.
 	cfg := FileConfig{MCP: MCPConfig{Servers: DefaultMCPServers()}}
@@ -194,10 +194,6 @@ func ResolveMCP(options ResolveOptions) (MCPConfig, error) {
 		// server the user disabled (a user-level disable is sticky, but the user
 		// scope itself may lift it).
 		mergeMCPConfig(&cfg.MCP, fileConfig.MCP, true)
-		// Reconcile config written against a default Zero has since retired,
-		// here while the user layer is the only one merged — so a carried-over
-		// disable counts as a user-level decision the project layer cannot lift.
-		migrateRetiredDefaultMCPServers(&cfg.MCP)
 	}
 	// Drop the project layer when the workspace is untrusted, so a cloned repo's
 	// ./.zero/config.json cannot register (and spawn) MCP servers. Fail-closed:

internal/config/types.go

@@ -119,12 +119,6 @@ type PreferencesConfig struct {
 	// the user turned idle recaps off. A *bool is its own tri-state, so no
 	// custom unmarshal is needed (unlike ToolsConfig.DeferThreshold's int).
 	Recaps *bool `json:"recaps,omitempty"`
-	// CompactionModel routes compaction summarization calls to this model
-	// instead of the session's main model (summaries at main-model prices are
-	// the most expensive recurring event in long runs). Empty = automatic: a
-	// curated cheap model on official endpoints, the main model elsewhere.
-	// "main" forces the main model. ZERO_COMPACTION_MODEL overrides.
-	CompactionModel string `json:"compactionModel,omitempty"`
 }
 
 // RecentModelEntry is one provider-qualified model selection recorded in
@@ -157,8 +151,7 @@ type KeyBindingsConfig struct {
 	ToggleMouse KeyBindingDef `json:"toggleMouse,omitempty"`
 	// CycleReasoning cycles through reasoning effort levels (default: ctrl+t).
 	CycleReasoning KeyBindingDef `json:"cycleReasoning,omitempty"`
-	// TogglePlan is retained for configuration compatibility. Plan updates render
-	// in the transcript and no longer have a persistent panel to toggle.
+	// TogglePlan toggles the plan panel expansion (default: ctrl+p).
 	TogglePlan KeyBindingDef `json:"togglePlan,omitempty"`
 	// ToggleSidebar toggles the right context sidebar (default: ctrl+b).
 	ToggleSidebar KeyBindingDef `json:"toggleSidebar,omitempty"`
@@ -471,7 +464,7 @@ type MCPServerConfig struct {
 	// fields it set or what values they hold. A built-in default seeded by
 	// DefaultMCPServers() is never unmarshaled from JSON, so it starts false;
 	// any explicit entry in the user/project file — even one that happens to
-	// repeat a default's exact field values (e.g. re-declaring Exa's
+	// repeat a default's exact field values (e.g. re-declaring firecrawl's
 	// default URL) — sets it true. IsUnconfiguredDefault checks this alongside
 	// a resolved-value comparison, so redeclaring default values verbatim still
 	// counts as user-configured.

internal/credstore/concurrency_test.go

@@ -1,246 +0,0 @@
-package credstore
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-)
-
-func fileStore(t *testing.T, dir string) *Store {
-	t.Helper()
-	store, err := New(Options{Dir: dir, Storage: "file"})
-	if err != nil {
-		t.Fatalf("New: %v", err)
-	}
-	return store
-}
-
-// THE REPRODUCTION, kept as the regression. Before the lock this reliably kept
-// 1 of 100: every writer read the same map, added its own provider, and the
-// last rename published a file missing all the others.
-func TestConcurrentSetKeepsEveryKey(t *testing.T) {
-	dir := t.TempDir()
-	store := fileStore(t, dir)
-
-	const n = 100
-	var wg sync.WaitGroup
-	errs := make(chan error, n)
-	for i := 0; i < n; i++ {
-		wg.Add(1)
-		go func(i int) {
-			defer wg.Done()
-			if err := store.Set(fmt.Sprintf("p%03d", i), fmt.Sprintf("k%03d", i)); err != nil {
-				errs <- err
-			}
-		}(i)
-	}
-	wg.Wait()
-	close(errs)
-	for err := range errs {
-		t.Fatalf("Set: %v", err)
-	}
-
-	got, err := store.Providers()
-	if err != nil {
-		t.Fatalf("Providers: %v", err)
-	}
-	if len(got) != n {
-		t.Fatalf("kept %d of %d concurrent writes", len(got), n)
-	}
-	// ...and every value is the one its own writer wrote, not a neighbour's.
-	for i := 0; i < n; i++ {
-		key, ok, err := store.Get(fmt.Sprintf("p%03d", i))
-		if err != nil {
-			t.Fatalf("Get: %v", err)
-		}
-		if !ok || key != fmt.Sprintf("k%03d", i) {
-			t.Fatalf("p%03d = %q (present=%v); a writer's own value must survive", i, key, ok)
-		}
-	}
-}
-
-// DELETE RACES SET, and an unlocked delete loses the other writer's key.
-//
-// A first version of this only checked that keys nobody deleted survived — and
-// every reader sees those, so it passed with the lock removed from Delete. The
-// case that actually breaks is a Delete whose stale read predates a concurrent
-// Set: it writes back a map that never contained the new key, and the Set is
-// gone. So the assertion is on the SETS surviving, not on the bystanders.
-func TestADeleteCannotClobberAConcurrentSet(t *testing.T) {
-	dir := t.TempDir()
-	store := fileStore(t, dir)
-
-	// Throwaway keys for the deleters to remove, written first so a delete
-	// always has something to do.
-	const churn = 40
-	for i := 0; i < churn; i++ {
-		if err := store.Set(fmt.Sprintf("churn%02d", i), "v"); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	const adds = 60
-	var wg sync.WaitGroup
-	for i := 0; i < adds; i++ {
-		wg.Add(1)
-		go func(i int) {
-			defer wg.Done()
-			_ = store.Set(fmt.Sprintf("added%02d", i), "v")
-		}(i)
-	}
-	for i := 0; i < churn; i++ {
-		wg.Add(1)
-		go func(i int) {
-			defer wg.Done()
-			_, _ = store.Delete(fmt.Sprintf("churn%02d", i))
-		}(i)
-	}
-	wg.Wait()
-
-	got, err := store.Providers()
-	if err != nil {
-		t.Fatal(err)
-	}
-	survivors := map[string]bool{}
-	for _, name := range got {
-		survivors[name] = true
-	}
-	missing := []string{}
-	for i := 0; i < adds; i++ {
-		name := fmt.Sprintf("added%02d", i)
-		if !survivors[name] {
-			missing = append(missing, name)
-		}
-	}
-	if len(missing) > 0 {
-		t.Fatalf("%d of %d concurrent Set calls were clobbered by a racing Delete: %v",
-			len(missing), adds, missing)
-	}
-	// ...and every churn key really was removed, so the deletes were not
-	// no-ops that would make the check above vacuous.
-	for i := 0; i < churn; i++ {
-		if survivors[fmt.Sprintf("churn%02d", i)] {
-			t.Fatalf("churn%02d survived; the deletes did nothing and this test proves nothing", i)
-		}
-	}
-}
-
-// ACROSS PROCESSES, which is the case that matters: a plan running with
-// max_workers > 1 spawns child PROCESSES, and an in-process mutex would not
-// have helped any of them. The race detector cannot see this one either — it is
-// two OS processes — so it is driven for real.
-func TestConcurrentSetAcrossProcesses(t *testing.T) {
-	if testing.Short() {
-		t.Skip("spawns processes")
-	}
-	helper := os.Getenv("ZERO_CREDSTORE_HELPER_DIR")
-	if helper != "" {
-		// Child mode: write our slice of the keys and exit.
-		store, err := New(Options{Dir: helper, Storage: "file"})
-		if err != nil {
-			os.Exit(3)
-		}
-		prefix := os.Getenv("ZERO_CREDSTORE_HELPER_PREFIX")
-		for i := 0; i < 25; i++ {
-			if err := store.Set(fmt.Sprintf("%s%02d", prefix, i), "v"); err != nil {
-				os.Exit(4)
-			}
-		}
-		os.Exit(0)
-	}
-
-	dir := t.TempDir()
-	const children = 4
-	var wg sync.WaitGroup
-	failures := make(chan string, children)
-	for c := 0; c < children; c++ {
-		wg.Add(1)
-		go func(c int) {
-			defer wg.Done()
-			cmd := exec.Command(os.Args[0], "-test.run=TestConcurrentSetAcrossProcesses", "-test.v")
-			cmd.Env = append(os.Environ(),
-				"ZERO_CREDSTORE_HELPER_DIR="+dir,
-				fmt.Sprintf("ZERO_CREDSTORE_HELPER_PREFIX=c%d_", c),
-			)
-			if out, err := cmd.CombinedOutput(); err != nil {
-				failures <- fmt.Sprintf("child %d: %v\n%s", c, err, out)
-			}
-		}(c)
-	}
-	wg.Wait()
-	close(failures)
-	for failure := range failures {
-		t.Fatal(failure)
-	}
-
-	store := fileStore(t, dir)
-	got, err := store.Providers()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != children*25 {
-		t.Fatalf("kept %d of %d keys written by %d concurrent processes", len(got), children*25, children)
-	}
-}
-
-// The lock lives BESIDE the data file, never on it. write publishes by rename,
-// so a lock taken on the data file would be attached to an inode the next
-// writer has already replaced — every writer would appear to hold it.
-func TestTheLockIsNotTheDataFile(t *testing.T) {
-	dir := t.TempDir()
-	store := fileStore(t, dir)
-	if store.lockPath() == store.file {
-		t.Fatal("the lock is the data file; rename would carry it away")
-	}
-	if !strings.HasPrefix(filepath.Base(store.lockPath()), filepath.Base(store.file)) {
-		t.Fatalf("lock %q is not beside the data file %q", store.lockPath(), store.file)
-	}
-	if err := store.Set("p", "k"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(store.lockPath()); err != nil {
-		t.Fatalf("the lock file was not created: %v", err)
-	}
-	// ...and it survives a write, since the rename replaces only the data file.
-	if err := store.Set("q", "k"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(store.lockPath()); err != nil {
-		t.Fatalf("the lock file did not survive a write: %v", err)
-	}
-}
-
-// The lock is a security boundary, so the path where it CANNOT be taken needs
-// coverage too: an operation that could not lock must report that, never proceed
-// unserialized and never report success. Replacing the credential directory with
-// a regular file makes the lock's MkdirAll fail on every platform.
-func TestOperationsFailWhenTheLockCannotBeAcquired(t *testing.T) {
-	base := t.TempDir()
-	dir := filepath.Join(base, "creds")
-	store := fileStore(t, dir)
-	// Where the store expects its directory, put a regular file.
-	if err := os.WriteFile(dir, []byte("not a directory"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := store.Set("openai", "sk-test"); err == nil {
-		t.Error("Set reported success although the lock could not be acquired")
-	}
-	if _, err := store.Delete("openai"); err == nil {
-		t.Error("Delete reported success although the lock could not be acquired")
-	}
-	if _, _, err := store.Get("openai"); err == nil {
-		t.Error("Get reported success although the lock could not be acquired")
-	}
-	if _, err := store.Providers(); err == nil {
-		t.Error("Providers reported success although the lock could not be acquired")
-	}
-	// And nothing may have been written through the failed path.
-	if raw, err := os.ReadFile(dir); err != nil || string(raw) != "not a directory" {
-		t.Errorf("the blocking file was modified: %q (err %v)", raw, err)
-	}
-}

internal/credstore/credstore.go

@@ -9,7 +9,6 @@ package credstore
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -126,27 +125,14 @@ func (s *Store) Backend() string { return s.backend }
 func (s *Store) Encrypted() bool { return s.backend == "keyring" || s.backend == "encrypted-file" }
 
 // Set stores (or overwrites) the API key for provider.
-func (s *Store) Set(provider, key string) (err error) {
+func (s *Store) Set(provider, key string) error {
 	provider = normalizeProvider(provider)
 	if provider == "" {
 		return fmt.Errorf("credstore: provider is required")
 	}
 	if s.backend == "keyring" {
-		// The OS keyring serializes its own writes; the file lock guards the
-		// file backends only.
 		return s.kr.Set(keyringService, keyringPrefix+provider, key)
 	}
-	// READ AND WRITE UNDER ONE LOCK. Separately locking each half would still
-	// lose keys: two writers would each read the same map, each add their own
-	// provider, and the second rename would publish a file missing the first.
-	// Measured before this existed: 1 of 100 concurrent Set calls survived.
-	release, err := s.acquireFileLock(true)
-	if err != nil {
-		return err
-	}
-	// Joined, not chosen between: a release failure annotates the result instead
-	// of masking the write error that actually explains what went wrong.
-	defer func() { err = errors.Join(err, release()) }()
 	data, err := s.read()
 	if err != nil {
 		return err
@@ -156,7 +142,7 @@ func (s *Store) Set(provider, key string) (err error) {
 }
 
 // Get returns the API key for provider and whether one is stored.
-func (s *Store) Get(provider string) (value string, found bool, err error) {
+func (s *Store) Get(provider string) (string, bool, error) {
 	provider = normalizeProvider(provider)
 	if provider == "" {
 		return "", false, nil
@@ -164,15 +150,6 @@ func (s *Store) Get(provider string) (value string, found bool, err error) {
 	if s.backend == "keyring" {
 		return s.kr.Get(keyringService, keyringPrefix+provider)
 	}
-	// A shared lock, so a read serializes against a writer's publish. On unix
-	// the rename is atomic and this only prevents reading an empty file mid-swap;
-	// on Windows an unsynchronized reader holding the file open would block the
-	// writer's rename outright, so readers must coordinate through the same lock.
-	release, err := s.acquireFileLock(false)
-	if err != nil {
-		return "", false, err
-	}
-	defer func() { err = errors.Join(err, release()) }()
 	data, err := s.read()
 	if err != nil {
 		return "", false, err
@@ -182,7 +159,7 @@ func (s *Store) Get(provider string) (value string, found bool, err error) {
 }
 
 // Delete removes the API key for provider, reporting whether one existed.
-func (s *Store) Delete(provider string) (existed bool, err error) {
+func (s *Store) Delete(provider string) (bool, error) {
 	provider = normalizeProvider(provider)
 	if provider == "" {
 		return false, nil
@@ -190,13 +167,6 @@ func (s *Store) Delete(provider string) (existed bool, err error) {
 	if s.backend == "keyring" {
 		return s.kr.Delete(keyringService, keyringPrefix+provider)
 	}
-	// The same lock as Set: a delete is a read-modify-write too, and one racing
-	// a set would otherwise resurrect or erase an unrelated provider.
-	release, err := s.acquireFileLock(true)
-	if err != nil {
-		return false, err
-	}
-	defer func() { err = errors.Join(err, release()) }()
 	data, err := s.read()
 	if err != nil {
 		return false, err
@@ -209,22 +179,17 @@ func (s *Store) Delete(provider string) (existed bool, err error) {
 }
 
 // Providers lists providers with a stored key (sorted), for display/audit.
-func (s *Store) Providers() (names []string, err error) {
+func (s *Store) Providers() ([]string, error) {
 	if s.backend == "keyring" {
 		// The OS keyring has no enumerate-by-prefix in our minimal surface; callers
 		// that need a list pass known provider names to Get. Return empty here.
 		return nil, nil
 	}
-	release, err := s.acquireFileLock(false)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { err = errors.Join(err, release()) }()
 	data, err := s.read()
 	if err != nil {
 		return nil, err
 	}
-	names = make([]string, 0, len(data))
+	names := make([]string, 0, len(data))
 	for name := range data {
 		names = append(names, name)
 	}
@@ -299,15 +264,6 @@ func (s *Store) write(data map[string]string) error {
 	return nil
 }
 
-// lockPath is the advisory lock guarding a read-modify-write of the credential
-// file. Beside the data file, never the data file itself — write publishes by
-// rename and would carry the lock away with the old inode.
-func (s *Store) lockPath() string { return s.file + ".lock" }
-
-// filepathDir is filepath.Dir, named locally so the two platform lock files can
-// share it without either importing path/filepath for one call.
-func filepathDir(path string) string { return filepath.Dir(path) }
-
 func normalizeProvider(provider string) string {
 	return strings.ToLower(strings.TrimSpace(provider))
 }

internal/credstore/filelock_unix.go

@@ -1,55 +0,0 @@
-//go:build !windows
-
-package credstore
-
-import (
-	"errors"
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/unix"
-)
-
-// acquireFileLock takes an exclusive advisory lock (flock) so a read-modify-write
-// of the credential file is serialized against every other one — across
-// processes AND across goroutines, since flock is held per open file
-// description and two opens in one process contend exactly as two processes do.
-//
-// THE LOCK FILE IS SEPARATE FROM THE DATA FILE, and that is not tidiness. write
-// publishes by os.Rename, which replaces the inode; a lock taken on the data
-// file would be attached to an inode that the next writer has already replaced,
-// so every writer would appear to hold it. The lock lives on a file nothing
-// renames.
-func (s *Store) acquireFileLock(exclusive bool) (func() error, error) {
-	path := s.lockPath()
-	if err := os.MkdirAll(filepathDir(path), 0o700); err != nil {
-		return nil, fmt.Errorf("credstore: lock dir: %w", err)
-	}
-	file, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE, 0o600)
-	if err != nil {
-		return nil, fmt.Errorf("credstore: open lock: %w", err)
-	}
-	// Writers take LOCK_EX; readers take LOCK_SH so they run concurrently with
-	// each other but still serialize against a writer's publish (see Get).
-	how := unix.LOCK_SH
-	if exclusive {
-		how = unix.LOCK_EX
-	}
-	if err := unix.Flock(int(file.Fd()), how); err != nil {
-		_ = file.Close()
-		return nil, fmt.Errorf("credstore: lock: %w", err)
-	}
-	return func() error {
-		// Close alone drops the flock, so the explicit unlock is belt-and-braces —
-		// but its failure is reported rather than swallowed, because a cleanup that
-		// did not complete must not be indistinguishable from one that did. The
-		// callers join this into their result, so it annotates a successful write
-		// instead of masking it.
-		unlockErr := unix.Flock(int(file.Fd()), unix.LOCK_UN)
-		closeErr := file.Close()
-		if err := errors.Join(unlockErr, closeErr); err != nil {
-			return fmt.Errorf("credstore: release lock: %w", err)
-		}
-		return nil
-	}, nil
-}

internal/credstore/filelock_windows.go

@@ -1,55 +0,0 @@
-//go:build windows
-
-package credstore
-
-import (
-	"errors"
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/windows"
-)
-
-// acquireFileLock takes an exclusive OS lock (LockFileEx) so a read-modify-write
-// of the credential file is serialized, matching the flock behaviour on unix.
-//
-// The lock file is SEPARATE from the data file for the same reason: write
-// publishes by rename, and a lock on the renamed file would be attached to
-// something the next writer has already replaced.
-func (s *Store) acquireFileLock(exclusive bool) (func() error, error) {
-	path := s.lockPath()
-	if err := os.MkdirAll(filepathDir(path), 0o700); err != nil {
-		return nil, fmt.Errorf("credstore: lock dir: %w", err)
-	}
-	file, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE, 0o600)
-	if err != nil {
-		return nil, fmt.Errorf("credstore: open lock: %w", err)
-	}
-	handle := windows.Handle(file.Fd())
-	overlapped := new(windows.Overlapped)
-	// A fixed 1-byte region, blocking (no LOCKFILE_FAIL_IMMEDIATELY) so a
-	// waiter queues rather than failing the operation. Writers pass
-	// LOCKFILE_EXCLUSIVE_LOCK; readers omit it (a shared lock) so they still
-	// serialize against a writer's publish — which matters more on Windows,
-	// where an unsynchronized reader holding the file open blocks the rename.
-	flags := uint32(0)
-	if exclusive {
-		flags = windows.LOCKFILE_EXCLUSIVE_LOCK
-	}
-	if err := windows.LockFileEx(handle, flags, 0, 1, 0, overlapped); err != nil {
-		_ = file.Close()
-		return nil, fmt.Errorf("credstore: lock: %w", err)
-	}
-	return func() error {
-		// Reported rather than swallowed, for the same reason as the unix side: a
-		// cleanup that did not complete must not look identical to one that did.
-		// It matters more here — on Windows the handle staying open is what blocks
-		// the next writer's rename, so a failed release has a visible consequence.
-		unlockErr := windows.UnlockFileEx(handle, 0, 1, 0, overlapped)
-		closeErr := file.Close()
-		if err := errors.Join(unlockErr, closeErr); err != nil {
-			return fmt.Errorf("credstore: release lock: %w", err)
-		}
-		return nil
-	}, nil
-}

internal/cron/lock.go

@@ -5,23 +5,31 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sync/atomic"
 	"time"
 
 	"github.com/Gitlawb/zero/internal/lockutil"
 )
 
 // Cross-process lock tuning. The lock is held only for a single metadata
-// read-modify-write (milliseconds), never across a job's exec, so the timeout
-// is generous relative to any real hold.
+// read-modify-write (milliseconds), never across a job's exec, so the timeout is
+// generous and the stale threshold sits far above any real hold.
 const (
 	cronLockTimeout    = 10 * time.Second
+	cronLockStaleAfter = 60 * time.Second
 	cronLockRetryDelay = 20 * time.Millisecond
 )
 
-// lockJob takes a cross-process advisory lock for one job on a stable sibling
-// "<id>.lock" file next to the job directory. It serializes the read-modify-write
-// of a job's metadata across concurrent schedulers and commands. The kernel
-// releases the lock when a holder exits; the file is never renamed or removed.
+var cronLockSeq atomic.Uint64
+
+// lockJob takes a cross-process exclusive lock for one job by O_EXCL-creating a
+// sibling "<id>.lock" file next to the job directory (so Remove's RemoveAll of
+// the job dir never deletes a live lock). It serializes the read-modify-write of
+// a job's metadata across concurrent schedulers and commands. The lock file is
+// removed on release; a stale lock from a crashed holder (older than
+// cronLockStaleAfter) is reclaimed. Wall-clock time.Now is used deliberately
+// (not the injectable Store.now) so lock timing never depends on a frozen test
+// clock and the stale check compares against real file mtimes.
 func (s *Store) lockJob(id string) (func(), error) {
 	if !validID(id) {
 		return nil, fmt.Errorf("invalid cron job id %q", id)
@@ -30,15 +38,64 @@ func (s *Store) lockJob(id string) (func(), error) {
 	if err := os.MkdirAll(filepath.Dir(lockPath), 0o700); err != nil {
 		return nil, err
 	}
+	token := fmt.Sprintf("%d-%d-%d", os.Getpid(), time.Now().UnixNano(), cronLockSeq.Add(1))
 	deadline := time.Now().Add(cronLockTimeout)
 	for {
-		lock, err := lockutil.TryAcquireFileLock(lockPath)
+		f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
 		if err == nil {
-			return func() { _ = lock.Release() }, nil
+			// A partial write would leave a lock file without our token, so the
+			// releaser could never delete it — stranding the lock. Fail closed.
+			if _, werr := f.WriteString(token); werr != nil {
+				_ = f.Close()
+				_ = lockutil.RemoveLockFile(lockPath)
+				return nil, fmt.Errorf("cron: write job lock: %w", werr)
+			}
+			if cerr := f.Close(); cerr != nil {
+				_ = lockutil.RemoveLockFile(lockPath)
+				return nil, fmt.Errorf("cron: close job lock: %w", cerr)
+			}
+			var released bool
+			return func() {
+				if released {
+					return
+				}
+				released = true
+				if data, rerr := os.ReadFile(lockPath); rerr == nil && string(data) == token {
+					_ = lockutil.RemoveLockFile(lockPath)
+				}
+			}, nil
 		}
-		if !errors.Is(err, lockutil.ErrLockHeld) {
+		// On Windows a concurrent holder's os.Remove leaves the lock file in a
+		// "delete pending" state, so an O_EXCL create races it with
+		// ERROR_ACCESS_DENIED (os.ErrPermission) rather than ErrExist. Treat that
+		// as contention and retry, exactly like ErrExist — otherwise the lock
+		// spuriously fails under concurrency on Windows.
+		if !errors.Is(err, os.ErrExist) && !errors.Is(err, os.ErrPermission) {
 			return nil, fmt.Errorf("cron: acquire job lock: %w", err)
 		}
+		// Reclaim a stale lock left by a crashed holder — atomically (H3). A blind
+		// Remove lets two racers both "reclaim" and recreate, so both hold the lock;
+		// reclaimStaleLock renames the file aside (only one rename of a given file
+		// wins) and restores it if it turns out fresh, so a live lock is never deleted
+		// out from under its holder.
+		if info, statErr := os.Stat(lockPath); statErr == nil && time.Since(info.ModTime()) > cronLockStaleAfter {
+			cleared, rerr := lockutil.ReclaimStaleLock(lockPath, token, func(reclaimedPath string) bool {
+				info, err := os.Stat(reclaimedPath)
+				return err == nil && time.Since(info.ModTime()) <= cronLockStaleAfter
+			})
+			if rerr != nil {
+				// Reclaim hit a hard failure: the rename aside failed outright, or a
+				// live holder's lock could not be put back (the lock path may be
+				// missing, so re-acquiring would break mutual exclusion). Fail closed
+				// instead of spinning to the deadline.
+				return nil, fmt.Errorf("cron: reclaim stale job lock: %w", rerr)
+			}
+			if cleared {
+				continue // cleared a genuinely stale lock; retry the O_EXCL create now
+			}
+			// Lost the reclaim race (or it was actually fresh) — fall through to the
+			// bounded wait instead of hot-spinning on a reclaim that never wins (L13).
+		}
 		if !time.Now().Before(deadline) {
 			return nil, fmt.Errorf("cron: timed out acquiring job lock for %q", id)
 		}

internal/cron/mutate_test.go

@@ -64,7 +64,7 @@ func TestMutateRemovedJobReturnsNotFound(t *testing.T) {
 	if !errors.Is(err, ErrJobNotFound) {
 		t.Fatalf("Mutate on removed job = %v, want ErrJobNotFound", err)
 	}
-	// The stable advisory-lock file does not resurrect the removed job dir.
+	// And the lock file left no litter / did not resurrect the job dir.
 	if _, gerr := store.Get(job.ID); !errors.Is(gerr, ErrJobNotFound) {
 		t.Fatalf("job should remain removed, Get = %v", gerr)
 	}

internal/daemon/lock.go

@@ -3,60 +3,107 @@ package daemon
 import (
 	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"strconv"
 	"strings"
+	"sync/atomic"
 
 	"github.com/Gitlawb/zero/internal/lockutil"
 )
 
-// Single-instance lock. The stable PID file carries a kernel advisory lock for
-// the daemon's full lifetime. Process exit releases the lock automatically, so
-// stale metadata needs no rename/remove recovery protocol.
+// Single-instance lock. Mirrors reference-daemon-code-agent-js/supervisor.js's
+// lock file: a PID file created with O_EXCL. A second start fails; a STALE lock
+// left by a dead daemon (the recorded PID is no longer alive) is reclaimed so the
+// daemon recovers from an unclean shutdown without manual cleanup.
 
 // ErrAlreadyRunning is returned when a live daemon already holds the lock.
 var ErrAlreadyRunning = errors.New("daemon: another instance is already running")
 
 // fileLock is an acquired single-instance lock.
 type fileLock struct {
-	lock *lockutil.FileLock
+	path string
 }
 
 // processAlive reports whether pid is a live process. Implemented per-platform
 // (lock_posix.go / lock_windows.go). It is a package var so tests can stub it.
 var processAlive = osProcessAlive
 
-// acquireLock takes the single-instance advisory lock at path. isAlive is used
-// only to enrich a contention error with the current holder's PID; the kernel
-// lock, not PID metadata, is authoritative.
+// acquireLock takes the single-instance lock at path, reclaiming a stale lock
+// whose recorded PID is dead. isAlive overrides the liveness check (tests pass a
+// stub); nil uses the real processAlive.
 func acquireLock(path string, isAlive func(pid int) bool) (*fileLock, error) {
 	if isAlive == nil {
 		isAlive = processAlive
 	}
-	lock, err := lockutil.TryAcquireFileLock(path)
-	if err != nil {
-		if !errors.Is(err, lockutil.ErrLockHeld) {
+	// At most two passes: create, or detect-stale-then-retry once.
+	for attempt := 0; attempt < 2; attempt++ {
+		f, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
+		if err == nil {
+			// A failed PID write would leave a malformed lock file that another
+			// process reads as stale (unparsable PID) and wrongly reclaims, breaking
+			// the single-instance guarantee — so on write failure, remove it and fail.
+			if _, werr := fmt.Fprintf(f, "%d\n", os.Getpid()); werr != nil {
+				_ = f.Close()
+				_ = lockutil.RemoveLockFile(path)
+				return nil, werr
+			}
+			if cerr := f.Close(); cerr != nil {
+				_ = lockutil.RemoveLockFile(path)
+				return nil, cerr
+			}
+			return &fileLock{path: path}, nil
+		}
+		if !errors.Is(err, fs.ErrExist) && !errors.Is(err, os.ErrPermission) {
 			return nil, err
 		}
 		pid, perr := readPidFile(path)
 		if perr == nil && pid > 0 && isAlive(pid) {
 			return nil, fmt.Errorf("%w (pid %d)", ErrAlreadyRunning, pid)
 		}
-		return nil, ErrAlreadyRunning
+		// Stale lock (dead PID or unreadable) — reclaim it atomically, then retry the
+		// O_EXCL create. A blind Remove here races: two daemons starting at once could
+		// both read the stale PID, both Remove, and then one Removes the OTHER's
+		// freshly-created lock — leaving both "holding" the single-instance lock.
+		// reclaimStaleLock renames the file aside so only one racer wins the rename,
+		// and restores it if a live holder reacquired in the gap (D6).
+		if _, rerr := reclaimStaleLock(path, isAlive); rerr != nil {
+			// Reclaim hit a hard failure: the rename aside failed outright, or a
+			// live holder's lock could not be put back (the lock path may be
+			// missing, so re-acquiring would break the single-instance guarantee).
+			// Fail closed instead of spinning to the deadline.
+			return nil, fmt.Errorf("daemon: reclaim stale lock: %w", rerr)
+		}
 	}
-	if err := lock.WriteMetadata([]byte(fmt.Sprintf("%d\n", os.Getpid()))); err != nil {
-		return nil, errors.Join(err, lock.Release())
-	}
-	return &fileLock{lock: lock}, nil
+	return nil, ErrAlreadyRunning
 }
 
-// release drops the kernel lock and closes its handle. The stable PID file is
-// deliberately retained so contenders always address the same inode.
+// daemonLockSeq makes each reclaim attempt's sidelined filename unique per process.
+var daemonLockSeq atomic.Uint64
+
+// reclaimStaleLock atomically reclaims a single-instance lock whose recorded
+// PID is dead, via lockutil.ReclaimStaleLock: the lock file is renamed aside
+// (only one racer can win the rename) and stolen only if the moved file's PID
+// is still dead; a holder that reacquired the lock in the gap between the
+// stale check and the rename carries a LIVE pid and is restored rather than
+// stolen. Returns true only when a genuinely stale lock was removed. A
+// non-nil error means the caller must fail closed instead of re-acquiring
+// (see lockutil.ReclaimStaleLock).
+func reclaimStaleLock(path string, isAlive func(pid int) bool) (bool, error) {
+	suffix := fmt.Sprintf("%d-%d", os.Getpid(), daemonLockSeq.Add(1))
+	return lockutil.ReclaimStaleLock(path, suffix, func(reclaimedPath string) bool {
+		pid, err := readPidFile(reclaimedPath)
+		return err == nil && pid > 0 && isAlive(pid)
+	})
+}
+
+// release removes the lock file. Safe to call once. An already-missing lock
+// file is not an error (lockutil.RemoveLockFile swallows it on every platform).
 func (l *fileLock) release() error {
-	if l == nil || l.lock == nil {
+	if l == nil || l.path == "" {
 		return nil
 	}
-	return l.lock.Release()
+	return lockutil.RemoveLockFile(l.path)
 }
 
 // readPidFile reads and parses the PID recorded in a lock file.
@@ -65,20 +112,5 @@ func readPidFile(path string) (int, error) {
 	if err != nil {
 		return 0, err
 	}
-	metadata := strings.TrimSpace(string(data))
-	if pid, err := strconv.Atoi(metadata); err == nil {
-		return pid, nil
-	}
-	pidText, sequenceText, ok := strings.Cut(metadata, "-")
-	if !ok || pidText == "" || sequenceText == "" || strings.Contains(sequenceText, "-") {
-		return 0, fmt.Errorf("daemon: parse lock PID metadata %q", metadata)
-	}
-	if _, err := strconv.ParseUint(sequenceText, 10, 64); err != nil {
-		return 0, fmt.Errorf("daemon: parse lock holder sequence: %w", err)
-	}
-	pid, err := strconv.Atoi(pidText)
-	if err != nil {
-		return 0, fmt.Errorf("daemon: parse lock PID: %w", err)
-	}
-	return pid, nil
+	return strconv.Atoi(strings.TrimSpace(string(data)))
 }

internal/daemon/lock_test.go

@@ -32,48 +32,27 @@ func TestLockSingleInstance(t *testing.T) {
 	_ = l2.release()
 }
 
-// A PID liveness probe is diagnostic only. Even if it reports the recorded PID
-// dead, a contended kernel lock proves that the holder is active and must win.
-// The old rename-aside protocol trusted this stale observation and admitted a
-// second daemon while the first one was still inside its critical section.
-func TestLockDoesNotOverrideKernelHolderWithStalePIDProbe(t *testing.T) {
+func TestLockStaleRecovery(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "daemon.lock")
-	first, err := acquireLock(path, func(int) bool { return true })
-	if err != nil {
-		t.Fatalf("first acquireLock: %v", err)
-	}
-	defer first.release()
-
-	second, err := acquireLock(path, func(int) bool { return false })
-	if second != nil {
-		_ = second.release()
-	}
-	if !errors.Is(err, ErrAlreadyRunning) {
-		t.Fatalf("contended acquire with stale PID probe = %v, want ErrAlreadyRunning", err)
-	}
-}
-
-func TestLockIgnoresStaleMetadataWhenKernelLockIsFree(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "daemon.lock")
-	// A crashed daemon may leave PID metadata behind, but its kernel lock is
-	// released automatically, so the next daemon can acquire without moving it.
+	// Simulate a stale lock from a crashed daemon: a PID file whose process is
+	// dead.
 	if err := os.WriteFile(path, []byte("4242\n"), 0o600); err != nil {
 		t.Fatalf("write stale lock: %v", err)
 	}
 	dead := func(int) bool { return false }
 	l, err := acquireLock(path, dead)
 	if err != nil {
-		t.Fatalf("acquire over stale metadata: %v", err)
+		t.Fatalf("stale-lock recovery failed: %v", err)
 	}
 	// The lock now records OUR pid, not the stale one.
 	data, _ := os.ReadFile(path)
 	if strings.TrimSpace(string(data)) != strconv.Itoa(os.Getpid()) {
-		t.Fatalf("lock pid = %q, want %d", strings.TrimSpace(string(data)), os.Getpid())
+		t.Fatalf("reclaimed lock pid = %q, want %d", strings.TrimSpace(string(data)), os.Getpid())
 	}
 	_ = l.release()
 }
 
-func TestLockReleaseKeepsStableFile(t *testing.T) {
+func TestLockReleaseRemovesFile(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "daemon.lock")
 	l, err := acquireLock(path, func(int) bool { return true })
 	if err != nil {
@@ -82,37 +61,46 @@ func TestLockReleaseKeepsStableFile(t *testing.T) {
 	if err := l.release(); err != nil {
 		t.Fatalf("release: %v", err)
 	}
-	if _, err := os.Stat(path); err != nil {
-		t.Fatalf("release removed stable lock file: %v", err)
+	if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("lock file still present after release: %v", err)
 	}
 }
 
-func TestReadPidFileMetadataFormats(t *testing.T) {
+func TestReclaimStaleLockRemovesDeadHolder(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "daemon.lock")
-	for _, test := range []struct {
-		name     string
-		metadata string
-		wantPID  int
-		wantErr  bool
-	}{
-		{name: "legacy PID", metadata: "4242\n", wantPID: 4242},
-		{name: "PID and holder sequence", metadata: "4242-7\n", wantPID: 4242},
-		{name: "missing sequence", metadata: "4242-", wantErr: true},
-		{name: "non-numeric sequence", metadata: "4242-next", wantErr: true},
-		{name: "extra component", metadata: "4242-7-8", wantErr: true},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			if err := os.WriteFile(path, []byte(test.metadata), 0o600); err != nil {
-				t.Fatal(err)
-			}
-			got, err := readPidFile(path)
-			if (err != nil) != test.wantErr {
-				t.Fatalf("readPidFile() error = %v, wantErr %v", err, test.wantErr)
-			}
-			if !test.wantErr && got != test.wantPID {
-				t.Fatalf("readPidFile() = %d, want %d", got, test.wantPID)
-			}
-		})
+	if err := os.WriteFile(path, []byte("4242\n"), 0o600); err != nil {
+		t.Fatalf("write stale lock: %v", err)
+	}
+	if ok, err := reclaimStaleLock(path, func(int) bool { return false }); err != nil || !ok {
+		t.Fatalf("reclaimStaleLock must report a genuinely stale (dead-PID) lock reclaimed (ok=%v err=%v)", ok, err)
+	}
+	if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("a reclaimed stale lock must be removed, stat = %v", err)
+	}
+}
+
+func TestReclaimStaleLockRestoresLiveHolder(t *testing.T) {
+	// If a holder reacquires the lock in the gap between the stale check and the
+	// rename, the moved file carries a LIVE pid; reclaim must restore it untouched
+	// rather than steal it — otherwise two daemons both "hold" the lock (D6).
+	path := filepath.Join(t.TempDir(), "daemon.lock")
+	if err := os.WriteFile(path, []byte("4242\n"), 0o600); err != nil {
+		t.Fatalf("write lock: %v", err)
+	}
+	if ok, err := reclaimStaleLock(path, func(int) bool { return true }); err != nil || ok {
+		t.Fatalf("reclaimStaleLock must NOT report a live-PID lock reclaimed (ok=%v err=%v)", ok, err)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("live lock must be restored in place, read = %v", err)
+	}
+	if strings.TrimSpace(string(data)) != "4242" {
+		t.Fatalf("restored lock content = %q, want %q (unchanged)", strings.TrimSpace(string(data)), "4242")
+	}
+	// No sidelined ".stale" leftovers.
+	matches, _ := filepath.Glob(path + ".stale.*")
+	if len(matches) != 0 {
+		t.Fatalf("reclaim left sidelined files: %v", matches)
 	}
 }
 

internal/daemon/server_test.go

@@ -124,16 +124,12 @@ func TestServerEndToEnd(t *testing.T) {
 	case <-time.After(3 * time.Second):
 		t.Fatal("Serve did not return after shutdown")
 	}
-	// Runtime endpoints are removed on exit. The advisory lock file remains as
-	// a stable inode, but the kernel lock on it has been released.
-	for _, p := range []string{paths.Socket, paths.Status} {
+	// Socket, status, and lock files are removed on exit.
+	for _, p := range []string{paths.Socket, paths.Status, paths.Lock} {
 		if _, err := os.Stat(p); !errors.Is(err, os.ErrNotExist) {
 			t.Fatalf("file %s not cleaned up after shutdown: %v", p, err)
 		}
 	}
-	if _, err := os.Stat(paths.Lock); err != nil {
-		t.Fatalf("stable lock file missing after shutdown: %v", err)
-	}
 }
 
 func TestServerSecondInstanceFails(t *testing.T) {

internal/dictation/transcriber_deepgram.go

@@ -9,7 +9,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/Gitlawb/zero/internal/providers/providerio"
 	"github.com/coder/websocket"
 )
 
@@ -61,15 +60,7 @@ func (d *deepgramTranscriber) StreamTranscribe(ctx context.Context, chunks <-cha
 		HTTPHeader: http.Header{"Authorization": {"Token " + d.cfg.APIKey}},
 	})
 	if err != nil {
-		// Preserve the context.Canceled sentinel (it carries no key) so an
-		// Esc-abort during dial still matches the UI's errors.Is check. Key
-		// on ctx.Err() itself rather than unwrapping err: a cancellation can
-		// surface as a plain transport error (e.g. "closed network
-		// connection") rather than context.Canceled directly.
-		if ctx.Err() != nil {
-			return "", ctx.Err()
-		}
-		return "", fmt.Errorf("connecting to Deepgram: %s", providerio.Redact(err.Error(), d.cfg.APIKey))
+		return "", fmt.Errorf("connecting to Deepgram: %w", err)
 	}
 	defer conn.CloseNow()
 
@@ -77,26 +68,15 @@ func (d *deepgramTranscriber) StreamTranscribe(ctx context.Context, chunks <-cha
 	// so no conversion (unlike sherpa-onnx, which wants float32).
 	writeErrCh := make(chan error, 1)
 	go func() {
-		// Select on ctx.Done() while waiting for the next chunk so a cancelled
-		// session does not leave this goroutine blocked on an open idle channel.
-		for {
-			select {
-			case <-ctx.Done():
-				writeErrCh <- ctx.Err()
+		for chunk := range chunks {
+			if err := conn.Write(ctx, websocket.MessageBinary, chunk); err != nil {
+				writeErrCh <- err
 				return
-			case chunk, ok := <-chunks:
-				if !ok {
-					// CloseStream flushes any buffered audio and returns final
-					// results before Deepgram closes the socket.
-					writeErrCh <- conn.Write(ctx, websocket.MessageText, []byte(`{"type":"CloseStream"}`))
-					return
-				}
-				if err := conn.Write(ctx, websocket.MessageBinary, chunk); err != nil {
-					writeErrCh <- err
-					return
-				}
 			}
 		}
+		// CloseStream flushes any buffered audio and returns final results before
+		// Deepgram closes the socket.
+		writeErrCh <- conn.Write(ctx, websocket.MessageText, []byte(`{"type":"CloseStream"}`))
 	}()
 
 	// Deepgram results are per-utterance segments, not cumulative: accumulate the
@@ -120,18 +100,7 @@ func (d *deepgramTranscriber) StreamTranscribe(ctx context.Context, chunks <-cha
 				}
 			default:
 			}
-			// A user abort cancels the streaming context; the UI matches it
-			// with errors.Is(err, context.Canceled), so return the sentinel
-			// itself (it carries no key) instead of a flat redacted string.
-			// Key on ctx.Err() rather than unwrapping err: the writeErrCh
-			// swap above can replace err with a plain transport error (e.g.
-			// "closed network connection") that doesn't itself unwrap to
-			// context.Canceled even though the cancellation is what caused it.
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
-			//nolint:staticcheck // Preserve established user-facing error text.
-			return compose(), fmt.Errorf("Deepgram stream error: %s", providerio.Redact(err.Error(), d.cfg.APIKey))
+			return compose(), fmt.Errorf("Deepgram stream error: %w", err) //nolint:staticcheck // Preserve established user-facing error text.
 		}
 		if typ != websocket.MessageText {
 			continue

internal/dictation/transcriber_deepgram_test.go

@@ -1,278 +0,0 @@
-package dictation
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/coder/websocket"
-)
-
-// Non-cancellation dial failure: handshake returns 101 with an Upgrade header
-// equal to the API key so the dial error embeds the key and redaction must strip it.
-func TestDeepgramDialFailureRedactsKey(t *testing.T) {
-	const key = "sk-test-dial-key-abcdef"
-	baseURL := dialFailServerWithUpgrade(t, key)
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: key, BaseURL: baseURL})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, nil)
-	if ferr == nil {
-		t.Fatal("expected dial failure")
-	}
-	if errors.Is(ferr, context.Canceled) {
-		t.Fatalf("dial failure should not be context.Canceled: %v", ferr)
-	}
-	if strings.Contains(ferr.Error(), key) {
-		t.Errorf("API key leaked from dial failure: %v", ferr)
-	}
-	if !strings.Contains(ferr.Error(), "connecting to Deepgram") {
-		t.Errorf("expected dial-path error prefix, got: %v", ferr)
-	}
-}
-
-// dialFailServerWithUpgrade returns a ws URL whose handshake responds 101 with
-// Upgrade set to upgradeValue (not "websocket"), so websocket.Dial fails with
-// that value in the error string. Hijacks and closes immediately to avoid the
-// library's 3s body-drain timeout on failed dials.
-func dialFailServerWithUpgrade(t *testing.T, upgradeValue string) string {
-	t.Helper()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		hj, ok := w.(http.Hijacker)
-		if !ok {
-			http.Error(w, "hijack not supported", http.StatusInternalServerError)
-			return
-		}
-		conn, bufrw, err := hj.Hijack()
-		if err != nil {
-			return
-		}
-		defer conn.Close()
-		_, _ = bufrw.WriteString("HTTP/1.1 101 Switching Protocols\r\n")
-		_, _ = bufrw.WriteString("Connection: Upgrade\r\n")
-		_, _ = bufrw.WriteString("Upgrade: " + upgradeValue + "\r\n\r\n")
-		_ = bufrw.Flush()
-	}))
-	t.Cleanup(srv.Close)
-	return "ws" + strings.TrimPrefix(srv.URL, "http")
-}
-
-func TestDeepgramStreamTranscribeErrorRedaction(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Drain the client's audio frames, then wait for CloseStream so the
-		// client has flushed its writes before we reject the connection. Closing
-		// immediately (before CloseStream) risks the client failing on a write
-		// error and never observing this API-key-bearing close reason.
-		for {
-			typ, data, err := c.Read(ctx)
-			if err != nil {
-				return
-			}
-			if typ == websocket.MessageText && strings.Contains(string(data), "CloseStream") {
-				break
-			}
-		}
-		c.Close(websocket.StatusPolicyViolation, "invalid key sk-test-key")
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 320)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-	if ferr == nil {
-		t.Fatal("expected error")
-	}
-	if strings.Contains(ferr.Error(), "sk-test-key") {
-		t.Errorf("API key leaked: %v", ferr)
-	}
-}
-
-func TestDeepgramStreamTranscribeCancelKeepsSentinel(t *testing.T) {
-	firstFrame := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Hold the connection open, never answering, so the client blocks in
-		// Read until its context is cancelled (the Esc-abort path).
-		var once sync.Once
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-			once.Do(func() { close(firstFrame) })
-		}
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	chunks <- make([]byte, 320)
-	// The channel stays open: the session is live when the user aborts.
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-firstFrame:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("cancelled stream error lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed early instead of blocking: %v", ferr)
-	}
-}
-
-// Esc can cancel while the WebSocket dial is still pending. The dial error is
-// redacted with %s, so we must return ctx.Err() rather than a flat string.
-func TestDeepgramStreamTranscribeDialCancelKeepsSentinel(t *testing.T) {
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{
-		APIKey:  "sk-test-key",
-		BaseURL: "ws://127.0.0.1:1", // never reached; ctx is already cancelled
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	chunks := make(chan []byte)
-	defer close(chunks)
-
-	_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-	if !errors.Is(ferr, context.Canceled) {
-		t.Fatalf("dial-cancel lost the context.Canceled sentinel: %v", ferr)
-	}
-}
-
-// Esc right after accept can race the first write or the first Read; both
-// setup/write redaction sites must still yield context.Canceled.
-func TestDeepgramStreamTranscribeStartupCancelKeepsSentinel(t *testing.T) {
-	accepted := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		close(accepted)
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-		}
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	// No frames yet: the writer blocks on chunks or the reader blocks on Read.
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-accepted:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("startup-cancel lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed before accept: %v", ferr)
-	}
-}
-
-// TestDeepgramStreamErrorRedactsHeaderShapedKey exercises the same stream-error
-// redaction path as TestDeepgramStreamTranscribeErrorRedaction, with a close
-// reason that embeds the key next to an X-Api-Key-shaped header label.
-func TestDeepgramStreamErrorRedactsHeaderShapedKey(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		for {
-			typ, data, err := c.Read(ctx)
-			if err != nil {
-				return
-			}
-			if typ == websocket.MessageText && strings.Contains(string(data), "CloseStream") {
-				break
-			}
-		}
-		c.Close(websocket.StatusPolicyViolation, "X-Api-Key: sk-custom-secret-key-1234567890 failed")
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-custom-secret-key-1234567890", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 320)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-	if ferr == nil {
-		t.Fatal("expected error")
-	}
-	if strings.Contains(ferr.Error(), "sk-custom-secret-key-1234567890") {
-		t.Errorf("Custom header API key leaked: %v", ferr)
-	}
-}
-
-func TestDeepgramSinglePassRedaction(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		for {
-			typ, data, err := c.Read(ctx)
-			if err != nil {
-				return
-			}
-			if typ == websocket.MessageText && strings.Contains(string(data), "CloseStream") {
-				break
-			}
-		}
-		c.Close(websocket.StatusPolicyViolation, "error with sk-key1234567890abcdef1234")
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-key1234567890abcdef1234", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 320)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-	if ferr == nil {
-		t.Fatal("expected error")
-	}
-	got := ferr.Error()
-	if strings.Contains(got, "sk-key1234567890abcdef1234") {
-		t.Fatalf("API key leaked into stream error: %q", got)
-	}
-	// One key occurrence must produce exactly one redaction marker (no double wrap).
-	if strings.Count(got, "[REDACTED]") != 1 {
-		t.Fatalf("redaction markers in %q: want exactly 1 [REDACTED]", got)
-	}
-}

internal/dictation/transcriber_openai_realtime.go

@@ -8,7 +8,6 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/Gitlawb/zero/internal/providers/providerio"
 	"github.com/coder/websocket"
 )
 
@@ -23,10 +22,6 @@ type OpenAIRealtimeConfig struct {
 	Model  string // default "gpt-4o-transcribe"
 	// BaseURL overrides the wss endpoint (tests point it at a fake server).
 	BaseURL string
-	// writeErrInjector, when set, is consulted before each JSON websocket write.
-	// Used by same-package tests to force controllable write failures that embed
-	// secrets; production callers leave it nil.
-	writeErrInjector func() error
 }
 
 type openAIRealtimeTranscriber struct {
@@ -64,15 +59,7 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 		},
 	})
 	if err != nil {
-		// Preserve the context.Canceled sentinel (it carries no key) so an
-		// Esc-abort during dial still matches the UI's errors.Is check. Key
-		// on ctx.Err() itself rather than unwrapping err: a cancellation can
-		// surface as a plain transport error (e.g. "closed network
-		// connection") rather than context.Canceled directly.
-		if ctx.Err() != nil {
-			return "", ctx.Err()
-		}
-		return "", fmt.Errorf("connecting to OpenAI Realtime: %s", providerio.Redact(err.Error(), o.cfg.APIKey))
+		return "", fmt.Errorf("connecting to OpenAI Realtime: %w", err)
 	}
 	defer conn.CloseNow()
 
@@ -86,53 +73,24 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 			},
 		},
 	}
-	if err := o.writeJSON(ctx, conn, sessionUpdate); err != nil {
-		// Same cancellation short-circuit as the dial above: an Esc-abort
-		// while the session update is in flight must stay context.Canceled.
-		if ctx.Err() != nil {
-			return "", ctx.Err()
-		}
-		return "", fmt.Errorf("configuring OpenAI Realtime session: %s", providerio.Redact(err.Error(), o.cfg.APIKey))
+	if err := writeJSON(ctx, conn, sessionUpdate); err != nil {
+		return "", fmt.Errorf("configuring OpenAI Realtime session: %w", err)
 	}
 
 	writeErrCh := make(chan error, 1)
 	go func() {
-		// Select on ctx.Done() while waiting for the next chunk so a cancelled
-		// session does not leave this goroutine blocked on an open idle channel.
-		for {
-			select {
-			case <-ctx.Done():
-				writeErrCh <- ctx.Err()
+		for chunk := range chunks {
+			appendMsg := map[string]any{
+				"type":  "input_audio_buffer.append",
+				"audio": base64.StdEncoding.EncodeToString(chunk),
+			}
+			if err := writeJSON(ctx, conn, appendMsg); err != nil {
+				writeErrCh <- err
 				return
-			case chunk, ok := <-chunks:
-				if !ok {
-					// Commit the buffered audio to force final transcription.
-					if err := o.writeJSON(ctx, conn, map[string]any{"type": "input_audio_buffer.commit"}); err != nil {
-						writeErrCh <- err
-						// Unblock the reader: without a close, conn.Read stays
-						// parked on a silent peer and the error is never drained
-						// from writeErrCh. CloseNow aborts instead of waiting on
-						// the close handshake, which a silent peer never answers.
-						conn.CloseNow()
-						return
-					}
-					writeErrCh <- nil
-					return
-				}
-				appendMsg := map[string]any{
-					"type":  "input_audio_buffer.append",
-					"audio": base64.StdEncoding.EncodeToString(chunk),
-				}
-				if err := o.writeJSON(ctx, conn, appendMsg); err != nil {
-					writeErrCh <- err
-					// Same unblocking close as the commit path: a server that
-					// goes silent after session setup would otherwise leave the
-					// reader blocked in conn.Read with the error undrained.
-					conn.CloseNow()
-					return
-				}
 			}
 		}
+		// Commit the buffered audio to force final transcription of the utterance.
+		writeErrCh <- writeJSON(ctx, conn, map[string]any{"type": "input_audio_buffer.commit"})
 	}()
 
 	// OpenAI deltas are incremental (append), unlike Deepgram/sherpa's cumulative
@@ -155,17 +113,7 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 				}
 			default:
 			}
-			// A user abort cancels the streaming context; the UI matches it
-			// with errors.Is(err, context.Canceled), so return the sentinel
-			// itself (it carries no key) instead of a flat redacted string.
-			// Key on ctx.Err() rather than unwrapping err: the writeErrCh
-			// swap above can replace err with a plain transport error (e.g.
-			// "closed network connection") that doesn't itself unwrap to
-			// context.Canceled even though the cancellation is what caused it.
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
-			return compose(), fmt.Errorf("OpenAI Realtime stream error: %s", providerio.Redact(err.Error(), o.cfg.APIKey))
+			return compose(), fmt.Errorf("OpenAI Realtime stream error: %w", err)
 		}
 		if typ != websocket.MessageText {
 			continue
@@ -177,12 +125,6 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 			if onPartial != nil {
 				onPartial(compose(), false)
 			}
-			// onPartial may deliver the partial that makes the TUI cancel
-			// (Esc). Observe that before the next Read, which can already
-			// have a racing OpenAI error frame buffered.
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
 		case realtimeCompleted:
 			// A completed item replaces the in-progress delta buffer with the
 			// server's authoritative transcript for that segment.
@@ -196,9 +138,6 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 			if onPartial != nil {
 				onPartial(compose(), true)
 			}
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
 			// Once we've committed the buffer (user stopped) and the server has
 			// returned a completed transcription, the utterance is done.
 			if committed {
@@ -208,15 +147,7 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 		case realtimeCommitted:
 			committed = true
 		case realtimeError:
-			// Esc can race an incoming error event: conn.Read may already have
-			// the OpenAI error in hand by the time cancellation lands. Key on
-			// ctx.Err() first, same as every other return point in this loop,
-			// so a cancel that wins the race still surfaces as context.Canceled
-			// instead of a spurious redacted failure alongside it.
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
-			return compose(), fmt.Errorf("OpenAI Realtime error: %s", providerio.Redact(evt.text, o.cfg.APIKey))
+			return compose(), fmt.Errorf("OpenAI Realtime error: %s", evt.text)
 		}
 		// The writer signals commit completion out of band; observe it so a
 		// stop with no further audio still flips `committed`.
@@ -224,10 +155,6 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 		case werr := <-writeErrCh:
 			if werr == nil {
 				committed = true
-			} else if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			} else {
-				return compose(), fmt.Errorf("OpenAI Realtime stream error: %s", providerio.Redact(werr.Error(), o.cfg.APIKey))
 			}
 		default:
 		}
@@ -274,15 +201,6 @@ func parseRealtimeEvent(data []byte) realtimeEvent {
 	return realtimeEvent{kind: realtimeOther}
 }
 
-func (o *openAIRealtimeTranscriber) writeJSON(ctx context.Context, conn *websocket.Conn, v any) error {
-	if o.cfg.writeErrInjector != nil {
-		if err := o.cfg.writeErrInjector(); err != nil {
-			return err
-		}
-	}
-	return writeJSON(ctx, conn, v)
-}
-
 func writeJSON(ctx context.Context, conn *websocket.Conn, v any) error {
 	data, err := json.Marshal(v)
 	if err != nil {

internal/dictation/transcriber_openai_realtime_test.go

@@ -1,437 +0,0 @@
-package dictation
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/coder/websocket"
-)
-
-// Non-cancellation dial failure: handshake returns 101 with an Upgrade header
-// equal to the API key so the dial error embeds the key and redaction must strip it.
-func TestOpenAIRealtimeDialFailureRedactsKey(t *testing.T) {
-	const key = "sk-test-dial-key-abcdef"
-	baseURL := dialFailServerWithUpgrade(t, key)
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: key, BaseURL: baseURL})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, nil)
-	if ferr == nil {
-		t.Fatal("expected dial failure")
-	}
-	if errors.Is(ferr, context.Canceled) {
-		t.Fatalf("dial failure should not be context.Canceled: %v", ferr)
-	}
-	if strings.Contains(ferr.Error(), key) {
-		t.Errorf("API key leaked from dial failure: %v", ferr)
-	}
-	if !strings.Contains(ferr.Error(), "connecting to OpenAI Realtime") {
-		t.Errorf("expected dial-path error prefix, got: %v", ferr)
-	}
-}
-
-// Session-configuration write fails after dial: inject a write error that embeds
-// the API key (peer close cannot reach this path reliably — the session write
-// always lands in the kernel buffer first) and assert redaction.
-func TestOpenAIRealtimeSessionConfigFailureRedactsKey(t *testing.T) {
-	const key = "sk-test-session-key-abcdef"
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Hold open; the client fails on the injected session write before reading.
-		<-ctx.Done()
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{
-		APIKey:  key,
-		BaseURL: url,
-		writeErrInjector: func() error {
-			return errors.New("invalid API key " + key)
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, nil)
-	if ferr == nil {
-		t.Fatal("expected session-config failure")
-	}
-	if errors.Is(ferr, context.Canceled) {
-		t.Fatalf("session-config failure should not be context.Canceled: %v", ferr)
-	}
-	if strings.Contains(ferr.Error(), key) {
-		t.Errorf("API key leaked from session-config failure: %v", ferr)
-	}
-	if !strings.Contains(ferr.Error(), "configuring OpenAI Realtime session") {
-		t.Errorf("expected session-config error prefix, got: %v", ferr)
-	}
-}
-
-// Asynchronous writer failure: session update succeeds, then the audio writer
-// injects a key-bearing write error. The server keeps the connection open and
-// emits a delta so the reader loop observes writeErrCh (not a peer close).
-func TestOpenAIRealtimeWriterFailureRedactsKey(t *testing.T) {
-	const key = "sk-test-writer-key-abcdef"
-	sessionDone := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		if _, _, err := c.Read(ctx); err != nil {
-			return
-		}
-		close(sessionDone)
-		// Keep reading and emit a delta so the client processes an event and
-		// drains writeErrCh while the connection is still open.
-		_ = c.Write(ctx, websocket.MessageText, []byte(
-			`{"type":"conversation.item.input_audio_transcription.delta","delta":"hi"}`,
-		))
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-		}
-	})
-
-	var writes atomic.Int32
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{
-		APIKey:  key,
-		BaseURL: url,
-		writeErrInjector: func() error {
-			// First write is session.update; fail subsequent audio/commit writes.
-			if writes.Add(1) == 1 {
-				return nil
-			}
-			return errors.New("invalid API key " + key)
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 480)
-	// Leave open after the first frame so the writer hits the injected error
-	// on that append rather than a clean commit.
-
-	done := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-		done <- ferr
-	}()
-
-	var ferr error
-	select {
-	case ferr = <-done:
-	case <-time.After(5 * time.Second):
-		close(chunks)
-		t.Fatal("StreamTranscribe did not complete after writer failure")
-	}
-	close(chunks)
-
-	if ferr == nil {
-		t.Fatal("expected writer failure")
-	}
-	if errors.Is(ferr, context.Canceled) {
-		t.Fatalf("writer failure should not be context.Canceled: %v", ferr)
-	}
-	if strings.Contains(ferr.Error(), key) {
-		t.Errorf("API key leaked from writer failure: %v", ferr)
-	}
-	if !strings.Contains(ferr.Error(), "OpenAI Realtime stream error") {
-		t.Errorf("expected stream/writer error prefix, got: %v", ferr)
-	}
-	select {
-	case <-sessionDone:
-	default:
-		// Session may race the injected audio write; prefix assertion above is enough.
-	}
-}
-
-// Writer failure with a silent server: the peer never sends a frame after
-// session setup, so the reader is parked in conn.Read. The writer must close
-// the connection on failure or the writeErrCh error is never observed and
-// StreamTranscribe blocks forever.
-func TestOpenAIRealtimeWriterFailureUnblocksSilentServer(t *testing.T) {
-	const key = "sk-test-silent-writer-key-abcdef"
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Hold the connection open without ever writing a frame.
-		<-ctx.Done()
-	})
-
-	var writes atomic.Int32
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{
-		APIKey:  key,
-		BaseURL: url,
-		writeErrInjector: func() error {
-			// First write is session.update; fail the subsequent append write.
-			if writes.Add(1) == 1 {
-				return nil
-			}
-			return errors.New("invalid API key " + key)
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 480)
-	// Leave the channel open: the writer must fail on the append, not the commit.
-	done := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, func(string, bool) {})
-		done <- ferr
-	}()
-
-	select {
-	case ferr := <-done:
-		if ferr == nil {
-			t.Fatal("expected writer failure")
-		}
-		if errors.Is(ferr, context.Canceled) {
-			t.Fatalf("writer failure should not be context.Canceled: %v", ferr)
-		}
-		if strings.Contains(ferr.Error(), key) {
-			t.Errorf("API key leaked from writer failure: %v", ferr)
-		}
-		if !strings.Contains(ferr.Error(), "OpenAI Realtime stream error") {
-			t.Errorf("expected stream/writer error prefix, got: %v", ferr)
-		}
-	case <-time.After(5 * time.Second):
-		close(chunks)
-		t.Fatal("StreamTranscribe did not unblock after writer failure with a silent server")
-	}
-}
-
-func TestOpenAIRealtimeStreamTranscribeErrorRedaction(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		defer c.Close(websocket.StatusNormalClosure, "")
-		for {
-			typ, _, err := c.Read(ctx)
-			if err != nil {
-				return
-			}
-			if typ != websocket.MessageText {
-				continue
-			}
-			_ = c.Write(ctx, websocket.MessageText, []byte(`{"type":"error","error":{"message":"invalid API key sk-test-key"}}`))
-		}
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 480)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-	if ferr == nil {
-		t.Fatal("expected error")
-	}
-	if strings.Contains(ferr.Error(), "sk-test-key") {
-		t.Errorf("API key leaked: %v", ferr)
-	}
-}
-
-func TestOpenAIRealtimeStreamTranscribeCancelKeepsSentinel(t *testing.T) {
-	firstFrame := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Hold the connection open, never answering, so the client blocks in
-		// Read until its context is cancelled (the Esc-abort path).
-		var once sync.Once
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-			once.Do(func() { close(firstFrame) })
-		}
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	chunks <- make([]byte, 480)
-	// The channel stays open: the session is live when the user aborts.
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-firstFrame:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("cancelled stream error lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed early instead of blocking: %v", ferr)
-	}
-}
-
-// Esc can cancel while the WebSocket dial is still pending. The dial error is
-// redacted with %s, so we must return ctx.Err() rather than a flat string.
-func TestOpenAIRealtimeStreamTranscribeDialCancelKeepsSentinel(t *testing.T) {
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{
-		APIKey:  "sk-test-key",
-		BaseURL: "ws://127.0.0.1:1", // never reached; ctx is already cancelled
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	chunks := make(chan []byte)
-	defer close(chunks)
-
-	_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-	if !errors.Is(ferr, context.Canceled) {
-		t.Fatalf("dial-cancel lost the context.Canceled sentinel: %v", ferr)
-	}
-}
-
-// Esc right after accept can hit the session-update write or the first Read;
-// both redaction sites must still yield context.Canceled.
-func TestOpenAIRealtimeStreamTranscribeStartupCancelKeepsSentinel(t *testing.T) {
-	accepted := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		close(accepted)
-		// Do not read: leave the client in session-update write or first Read.
-		<-ctx.Done()
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-accepted:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("startup-cancel lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed before accept: %v", ferr)
-	}
-}
-
-// Cancel while the writer is blocked on more chunks. Whichever path observes
-// the cancellation first (the blocked conn.Read or the writeErrCh drain) must
-// return context.Canceled rather than a redacted flat string.
-func TestOpenAIRealtimeStreamTranscribeWriteCancelKeepsSentinel(t *testing.T) {
-	sessionReceived := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		if _, _, err := c.Read(ctx); err != nil {
-			return
-		}
-		close(sessionReceived)
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-		}
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 480)
-	defer close(chunks)
-
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-sessionReceived:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("write-path cancel lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed early instead of blocking: %v", ferr)
-	}
-}
-
-// Esc can race an incoming OpenAI error event. conn.Read may already have
-// the error frame in hand by the time the cancellation lands. The server
-// fires a delta immediately followed by the error, back to back. Cancel from
-// inside the delta callback (same path the TUI uses when a partial triggers
-// Esc handling) so the cancel is observed before the next event is processed.
-// The returned error must still be context.Canceled, not the redacted OpenAI
-// error.
-func TestOpenAIRealtimeStreamTranscribeErrorRaceKeepsSentinel(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		if _, _, err := c.Read(ctx); err != nil {
-			return
-		}
-		_ = c.Write(ctx, websocket.MessageText, []byte(
-			`{"type":"conversation.item.input_audio_transcription.delta","delta":"hi"}`,
-		))
-		_ = c.Write(ctx, websocket.MessageText, []byte(
-			`{"type":"error","error":{"message":"invalid API key sk-test-key"}}`,
-		))
-		<-ctx.Done()
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	chunks <- make([]byte, 480)
-	var once sync.Once
-	_, ferr := tr.StreamTranscribe(ctx, chunks, func(string, bool) {
-		// Cancel synchronously from the partial callback, before the
-		// stream loop continues to the already-buffered error frame.
-		once.Do(cancel)
-	})
-	if !errors.Is(ferr, context.Canceled) {
-		t.Fatalf("StreamTranscribe error = %v, want context.Canceled (cancel must win over a racing OpenAI error event)", ferr)
-	}
-}

internal/execution/contracts.go

@@ -9,16 +9,7 @@ import (
 	"strings"
 )
 
-// PolicyVersion is the version of the approval policy that recorded grants were
-// evaluated under. Bump it whenever a change narrows what may be approved: the
-// grant store then backs the file up, keeps deny grants, invalidates prior
-// approvals, and tells the user once, instead of silently honoring approvals
-// that the current rules would have refused.
-//
-// v2 tightened command-prefix validation so a launcher spelled with a version
-// or an executable extension ("python3.11", "python.exe") can no longer be
-// approved as an ordinary command.
-const PolicyVersion = 2
+const PolicyVersion = 1
 
 type Origin string
 

internal/execution/process_unix.go

@@ -6,8 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"os/exec"
-	"strconv"
-	"strings"
 	"syscall"
 	"time"
 )
@@ -40,45 +38,12 @@ func KillProcessTree(pid int) error {
 // TerminateProcessTree requests graceful termination, then force-kills the
 // process tree after grace. Callers retain their distinct persistence models;
 // this function owns only the OS lifecycle primitive.
-//
-// The signal target is REDISCOVERED here via processSignalTarget(pid), which
-// asks the OS for pid's current group. A caller that already knows pid was
-// configured as its own group leader at launch (e.g. via ConfigureProcessGroup)
-// should use TerminateProcessGroup instead — see its doc comment for why this
-// rediscovery is fragile once the leader may have already exited.
 func TerminateProcessTree(pid int, grace, poll time.Duration) error {
 	target, err := processSignalTarget(pid)
 	if err != nil {
 		return err
 	}
-	return terminateTarget(pid, target, grace, poll)
-}
-
-// TerminateProcessGroup is like TerminateProcessTree, but for a caller that
-// already knows pid is (or was, at launch) its own process-group leader — e.g.
-// a command started after ConfigureProcessGroup(cmd), which sets Setpgid so
-// cmd.Process.Pid always leads its own group at the moment it is signalled.
-//
-// TerminateProcessTree instead rediscovers the group via syscall.Getpgid(pid)
-// at call time. On Darwin, that lookup can return ESRCH once an unreaped group
-// leader has already exited, even though live descendants remain in the group
-// it configured — TerminateProcessTree would then silently fall back to
-// signalling only the (already dead) leader PID and leave those descendants
-// running. Skipping rediscovery in favor of the launch-time invariant avoids
-// that: the negative PID is used directly, regardless of whether the leader is
-// still alive to be looked up.
-func TerminateProcessGroup(pid int, grace, poll time.Duration) error {
-	if pid <= 1 {
-		return fmt.Errorf("refusing to signal invalid pid %d", pid)
-	}
-	return terminateTarget(pid, -pid, grace, poll)
-}
-
-// terminateTarget signals target (an individual PID or, negative, a process
-// group) with SIGTERM then, after grace, SIGKILL. reportPid identifies the
-// original process in error messages regardless of which form target takes.
-func terminateTarget(reportPid, target int, grace, poll time.Duration) error {
-	alive := func() bool { return signalTargetRunning(target) }
+	alive := func() bool { return syscall.Kill(target, syscall.Signal(0)) == nil }
 	if err := syscall.Kill(target, syscall.SIGTERM); err != nil {
 		if errors.Is(err, syscall.ESRCH) {
 			return nil
@@ -112,91 +77,11 @@ func terminateTarget(reportPid, target int, grace, poll time.Duration) error {
 		time.Sleep(poll)
 	}
 	if alive() {
-		return fmt.Errorf("process %d did not exit after SIGKILL", reportPid)
+		return fmt.Errorf("process %d did not exit after SIGKILL", pid)
 	}
 	return nil
 }
 
-// signalTargetRunning reports whether the signal target still has a process that
-// is actually RUNNING, as opposed to one waiting to be reaped.
-//
-// kill(2) with signal 0 succeeds for a zombie: the PID still exists until its
-// parent collects it. That matters because the target here is usually a process
-// GROUP, and a terminated leader's child is briefly a zombie before init/launchd
-// reaps it. Treating that window as "still alive" made termination sit through
-// both grace periods, SIGKILL an already-dead group, and then report
-// "did not exit after SIGKILL" for a tree that had in fact stopped — turning a
-// successful cleanup into a spurious failure (and a flaky one, since it depends on
-// reap timing).
-//
-// Zombie detection goes through ps, which is available on every Unix we target and
-// avoids a /proc dependency Darwin does not have. It is only consulted when the
-// cheap kill check says something is still there, so the common path costs nothing
-// extra. If ps cannot be run or its output cannot be parsed, the conservative
-// pre-existing answer (the kill result) stands.
-func signalTargetRunning(target int) bool {
-	if syscall.Kill(target, syscall.Signal(0)) != nil {
-		return false
-	}
-	// A negative target is a process GROUP: check whether any member is
-	// non-zombie. A positive target is an individual PID that is NOT its own
-	// group leader (processSignalTarget's fallback) — its actual PGID differs
-	// from its own PID, so matching rows by PGID here would look for a group
-	// that doesn't exist and always report "unknown" (conservatively alive).
-	// Check its own PID's state instead.
-	var running, ok bool
-	if target < 0 {
-		running, ok = processGroupHasRunningMember(-target)
-	} else {
-		running, ok = processIsRunning(target)
-	}
-	if !ok {
-		return true
-	}
-	return running
-}
-
-// processGroupHasRunningMember reports whether any member of pgid is in a state
-// other than zombie. ok is false when the group's states could not be determined.
-func processGroupHasRunningMember(pgid int) (running bool, ok bool) {
-	return processTableStateMatches(func(_, rowPgid int) bool { return rowPgid == pgid })
-}
-
-// processIsRunning reports whether pid itself is in a state other than zombie.
-// ok is false when pid's state could not be determined.
-func processIsRunning(pid int) (running bool, ok bool) {
-	return processTableStateMatches(func(rowPid, _ int) bool { return rowPid == pid })
-}
-
-// processTableStateMatches scans the process table once, via ps, and reports
-// whether any row satisfying match is non-zombie, and whether at least one
-// matching row was found at all (ok). No rows found means either the process
-// (or group) genuinely doesn't exist (a race with exit) or ps's output was
-// unparseable/restricted; either way, the caller should not claim knowledge.
-func processTableStateMatches(match func(pid, pgid int) bool) (running bool, ok bool) {
-	output, err := exec.Command("ps", "-A", "-o", "pid=,pgid=,stat=").Output()
-	if err != nil {
-		return false, false
-	}
-	found := false
-	for line := range strings.SplitSeq(string(output), "\n") {
-		fields := strings.Fields(line)
-		if len(fields) < 3 {
-			continue
-		}
-		rowPid, errPid := strconv.Atoi(fields[0])
-		rowPgid, errPgid := strconv.Atoi(fields[1])
-		if errPid != nil || errPgid != nil || !match(rowPid, rowPgid) {
-			continue
-		}
-		found = true
-		if !strings.HasPrefix(fields[2], "Z") {
-			return true, true
-		}
-	}
-	return false, found
-}
-
 func processSignalTarget(pid int) (int, error) {
 	if pid <= 1 {
 		return 0, fmt.Errorf("refusing to signal invalid pid %d", pid)
@@ -206,14 +91,10 @@ func processSignalTarget(pid int) (int, error) {
 		if pgid == pid {
 			target = -pid
 		}
-	} else {
-		if errors.Is(err, syscall.ESRCH) {
-			// Preserve the individual target; the signal call below treats ESRCH as
-			// already gone, which is a successful lifecycle outcome.
-			return pid, nil
-		}
-		// Conservatively retain the individual PID after other lookup failures;
-		// guessing and signalling a process group could affect unrelated processes.
+	} else if errors.Is(err, syscall.ESRCH) {
+		// Preserve the individual target; the signal call below treats ESRCH as
+		// already gone, which is a successful lifecycle outcome.
+		return pid, nil
 	}
 	return target, nil
 }

internal/execution/process_unix_test.go

@@ -1,261 +0,0 @@
-//go:build !windows
-
-package execution
-
-import (
-	"errors"
-	"os"
-	"os/exec"
-	"strconv"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-// requireProcessState refuses to let a broken ps pipeline masquerade as passing
-// coverage. Every test in this file proves something about zombie detection,
-// and every one of those proofs is read out of ps — so if ps cannot report
-// state, the tests verify nothing whatever they do next.
-//
-// The old code answered that with t.Skip, which is indistinguishable from
-// success in CI output. This probes BOTH ps pipelines against this test
-// process, which is by definition alive and not a zombie, so a working ps must
-// report a live state for it. Failing that:
-//
-//   - In CI (or with ZERO_REQUIRE_PS=1) it is a hard failure. ps is present on
-//     every image used today, so its absence means the pipeline regressed and
-//     that has to surface immediately rather than as skipped-green.
-//   - Elsewhere it stays a skip, so a contributor on an exotic box is not
-//     blocked by an environment the project does not claim to support.
-//
-// This only covers "ps cannot report state at all". Once it passes, a later
-// failure to observe an EXPECTED state is a real defect, and the tests below
-// treat it as one.
-func requireProcessState(t *testing.T) {
-	t.Helper()
-	self := os.Getpid()
-	var reasons []string
-	// The production path: ps -A -o pid=,pgid=,stat=, parsed by
-	// processTableStateMatches. This is what signalTargetRunning consults.
-	if running, ok := processIsRunning(self); !ok || !running {
-		reasons = append(reasons, "the process table read used by signalTargetRunning reported no live state for this test process")
-	}
-	// This file's independent oracle: ps -o stat= -p <pid>. It is deliberately
-	// NOT the production parser, so a regression in that parser cannot hide by
-	// breaking the test's own precondition check in the same way.
-	if zombie, ok := processIsZombie(self); !ok || zombie {
-		reasons = append(reasons, "the per-PID state read used by this test file reported no live state for this test process")
-	}
-	if len(reasons) == 0 {
-		return
-	}
-	reason := "cannot read process state, so ps-based zombie detection is unverifiable here: " + strings.Join(reasons, "; ")
-	if requireWorkingPS() {
-		t.Fatal(reason + " — failing rather than skipping because CI (or ZERO_REQUIRE_PS) is set, where ps is expected to work")
-	}
-	t.Skip(reason)
-}
-
-// requireWorkingPS reports whether an unusable ps must fail the run instead of
-// skipping it. ZERO_REQUIRE_PS lets a developer opt into the strict behavior
-// locally to reproduce what CI does.
-func requireWorkingPS() bool {
-	if strings.TrimSpace(os.Getenv("ZERO_REQUIRE_PS")) != "" {
-		return true
-	}
-	return strings.TrimSpace(os.Getenv("CI")) != ""
-}
-
-// awaitZombie blocks until pid is an unreaped zombie. The caller must not have
-// waited on the child, so the zombie is a stable state rather than a race: it
-// persists until something reaps it. Failing to reach it therefore means the
-// child never exited or ps stopped reporting its state, and both are defects
-// rather than reasons to skip.
-func awaitZombie(t *testing.T, pid int) {
-	t.Helper()
-	deadline := time.Now().Add(5 * time.Second)
-	for {
-		zombie, ok := processIsZombie(pid)
-		if ok && zombie {
-			return
-		}
-		if time.Now().After(deadline) {
-			if !ok {
-				t.Fatalf("pid %d left the process table without being reaped; this test never waited on it, so its zombie row must persist", pid)
-			}
-			t.Fatalf("pid %d did not reach the zombie state within 5s", pid)
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-}
-
-// TestTerminateProcessTreeTreatsZombieGroupAsExited is the regression test for
-// counting unreaped processes as alive: kill(2) with signal 0 succeeds for a
-// zombie, so a group whose only remaining member is waiting to be reaped used to
-// sit through both grace periods, take a pointless SIGKILL, and then be reported
-// as "did not exit after SIGKILL" — a spurious cleanup failure whose timing
-// depended on when the reaper ran.
-func TestTerminateProcessTreeTreatsZombieGroupAsExited(t *testing.T) {
-	requireProcessState(t)
-
-	cmd := exec.Command("sh", "-c", "exit 0")
-	ConfigureProcessGroup(cmd)
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	pid := cmd.Process.Pid
-	// Deliberately do NOT Wait: the child stays a zombie in its own group, which
-	// is exactly the state a terminated tree passes through.
-	t.Cleanup(func() { _ = cmd.Wait() })
-
-	awaitZombie(t, pid)
-
-	// Whether a zombie-only group can be signalled is a KERNEL difference, not a
-	// ps one. On Linux the zombie still occupies the process table and
-	// kill(-pid, 0) succeeds, so signalTargetRunning goes on to consult ps —
-	// which is the branch this test was written for. Darwin returns EPERM for
-	// the same call, so signalTargetRunning short-circuits on the kill and never
-	// reaches the ps check.
-	//
-	// The OUTCOME is identical and is asserted on every platform below. Only the
-	// branch that produces it differs, so record that instead of skipping the
-	// whole test (which would drop Darwin's coverage of the outcome) or failing
-	// it (which would report a supported platform as broken). Any errno other
-	// than EPERM means the group is not in the state this test needs.
-	psPathReachable := true
-	if err := syscall.Kill(-pid, syscall.Signal(0)); err != nil {
-		if !errors.Is(err, syscall.EPERM) {
-			t.Fatalf("zombie group %d is unsignalable with an unexpected error (%v); the zombie case is not present, so nothing below would be meaningful", pid, err)
-		}
-		psPathReachable = false
-		t.Logf("kernel refuses to signal zombie-only group %d (EPERM); signalTargetRunning answers from kill(2) rather than ps here, so the ps-based zombie check is asserted directly on platforms that allow the signal", pid)
-	}
-
-	// Where the signal IS permitted, pin the ps-based check itself. This is the
-	// regression #774 was about, and asserting only signalTargetRunning would
-	// let a ps-side regression hide behind the kill result.
-	if psPathReachable {
-		running, ok := processGroupHasRunningMember(pid)
-		if !ok {
-			t.Fatalf("process group %d has no rows while its zombie is unreaped; ps stopped reporting the group rather than the group being gone", pid)
-		}
-		if running {
-			t.Fatal("the ps-based group check must not report a zombie-only group as running")
-		}
-	}
-
-	// Valid on every platform: whichever branch answers, a zombie-only group is
-	// not running. On a kernel that refuses the signal this is the whole of the
-	// coverage, and it is more than the previous skip provided.
-	if signalTargetRunning(-pid) {
-		t.Fatal("a group holding only a zombie must not count as running")
-	}
-
-	if !psPathReachable {
-		// terminateTarget's own kill(2) would hit the same EPERM and be returned
-		// as a cleanup error, so this assertion cannot be made where the kernel
-		// refuses the signal. That may be a real gap in TerminateProcessTree on
-		// such a platform rather than a test limitation — a zombie-only tree is
-		// already exited and should terminate cleanly — but confirming and
-		// changing that is a production fix, not this test's business.
-		t.Log("skipping the TerminateProcessTree assertion: its kill(2) would hit the same EPERM as the probe above")
-		return
-	}
-	if err := TerminateProcessTree(pid, 50*time.Millisecond, 10*time.Millisecond); err != nil {
-		t.Fatalf("TerminateProcessTree on an already-exited tree: %v", err)
-	}
-}
-
-// TestTerminateProcessTreeStopsRunningGroup is the positive control: a group with
-// a live member must still be seen as running and then actually stopped, so the
-// zombie tolerance above cannot degrade into ignoring real processes.
-func TestTerminateProcessTreeStopsRunningGroup(t *testing.T) {
-	requireProcessState(t)
-
-	cmd := exec.Command("sh", "-c", "sleep 30")
-	ConfigureProcessGroup(cmd)
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	pid := cmd.Process.Pid
-	defer func() { _ = cmd.Wait() }()
-
-	if !signalTargetRunning(-pid) {
-		t.Fatal("a group with a live member must count as running")
-	}
-	if err := TerminateProcessTree(pid, time.Second, 10*time.Millisecond); err != nil {
-		t.Fatalf("TerminateProcessTree: %v", err)
-	}
-	// ok reports whether ANY row for this group was found. This test never waits
-	// on the child, so its zombie row must still be there — an unknown state
-	// means ps stopped answering, not that the group is gone. Treating that as a
-	// pass is what let this assertion succeed without checking anything.
-	running, ok := processGroupHasRunningMember(pid)
-	if !ok {
-		t.Fatalf("process group %d has no rows after termination; the unreaped child's zombie row must persist, so the group's state is undeterminable rather than clean", pid)
-	}
-	if running {
-		t.Fatal("the group still has a running member after termination")
-	}
-}
-
-// TestSignalTargetRunningTreatsZombieIndividualPIDAsExited is the regression
-// test for jatmn's second #774 finding: signalTargetRunning's zombie check
-// matched the individual-PID fallback target (a process that is NOT its own
-// group leader — processSignalTarget's positive-PID case) against process-table
-// rows by PGID. That target's actual PGID differs from its own PID by
-// definition (that's exactly why processSignalTarget fell back to the
-// individual PID instead of a negative group target), so no row ever matched,
-// "unknown" resulted every time, and signalTargetRunning conservatively (and
-// incorrectly) treated a zombie individual-PID target as still running.
-func TestSignalTargetRunningTreatsZombieIndividualPIDAsExited(t *testing.T) {
-	requireProcessState(t)
-
-	cmd := exec.Command("sh", "-c", "exit 0")
-	// Deliberately do NOT call ConfigureProcessGroup: the child inherits this
-	// test process's group, so it is not its own leader and processSignalTarget
-	// falls back to the individual (positive) PID.
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	pid := cmd.Process.Pid
-	t.Cleanup(func() { _ = cmd.Wait() })
-
-	awaitZombie(t, pid)
-
-	target, err := processSignalTarget(pid)
-	if err != nil {
-		t.Fatalf("processSignalTarget: %v", err)
-	}
-	// The child inherited this process's group, so its PGID is this process's
-	// PID and can never equal its own PID. A negative target here would mean
-	// processSignalTarget misread the group, which is the very thing the
-	// individual-PID fallback exists to handle.
-	if target != pid {
-		t.Fatalf("processSignalTarget(%d) = %d, want the individual PID: the child inherited this process's group, so it is not its own leader", pid, target)
-	}
-	if signalTargetRunning(target) {
-		t.Fatal("a zombie individual-PID target must not count as running")
-	}
-}
-
-// processIsZombie reports a process's zombie state via ps. It is deliberately a
-// separate, per-PID ps invocation rather than a reuse of the production
-// process-table parser: these tests assert what that parser concludes, so
-// borrowing it to establish their own preconditions would let one regression
-// silence both sides at once.
-//
-// ok is false when no state could be read, which after requireProcessState has
-// passed means the process left the table rather than that ps is broken.
-func processIsZombie(pid int) (zombie bool, ok bool) {
-	output, err := exec.Command("ps", "-o", "stat=", "-p", strconv.Itoa(pid)).Output()
-	if err != nil {
-		return false, false
-	}
-	state := strings.TrimLeft(string(output), " \n\t")
-	if state == "" {
-		return false, false
-	}
-	return state[0] == 'Z', true
-}

internal/execution/process_windows.go

@@ -3,8 +3,6 @@
 package execution
 
 import (
-	"errors"
-	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -14,34 +12,10 @@ import (
 
 func ConfigureProcessGroup(cmd *exec.Cmd) {}
 
-// KillProcessTree asks taskkill /T to kill pid and descendants it can still
-// discover from that live root. If taskkill fails, it falls back to killing pid
-// alone but still returns the tree error because descendants may have survived.
-// Neither path can recover descendants after the root has exited.
 func KillProcessTree(pid int) error {
-	return killProcessTree(pid, runTaskkill, killRootProcess)
-}
-
-func killProcessTree(pid int, killTree, killRoot func(int) error) error {
-	treeErr := killTree(pid)
-	if treeErr == nil {
+	if err := exec.Command(taskkillPath(), "/T", "/F", "/PID", strconv.Itoa(pid)).Run(); err == nil {
 		return nil
 	}
-	rootErr := killRoot(pid)
-	if rootErr != nil {
-		return errors.Join(
-			fmt.Errorf("kill process tree rooted at %d: %w", pid, treeErr),
-			fmt.Errorf("kill root process %d: %w", pid, rootErr),
-		)
-	}
-	return fmt.Errorf("kill process tree rooted at %d (root process killed directly): %w", pid, treeErr)
-}
-
-func runTaskkill(pid int) error {
-	return exec.Command(taskkillPath(), "/T", "/F", "/PID", strconv.Itoa(pid)).Run()
-}
-
-func killRootProcess(pid int) error {
 	process, err := os.FindProcess(pid)
 	if err != nil {
 		return err

internal/execution/process_windows_test.go

@@ -1,29 +0,0 @@
-//go:build windows
-
-package execution
-
-import (
-	"errors"
-	"strings"
-	"testing"
-)
-
-func TestKillProcessTreeRetainsTreeErrorWhenRootFallbackSucceeds(t *testing.T) {
-	treeErr := errors.New("taskkill failed")
-	err := killProcessTree(42, func(int) error { return treeErr }, func(int) error { return nil })
-	if !errors.Is(err, treeErr) {
-		t.Fatalf("killProcessTree error = %v, want tree error", err)
-	}
-	if !strings.Contains(err.Error(), "root process killed directly") {
-		t.Fatalf("killProcessTree error = %q, want fallback context", err)
-	}
-}
-
-func TestKillProcessTreeJoinsTreeAndRootErrors(t *testing.T) {
-	treeErr := errors.New("taskkill failed")
-	rootErr := errors.New("root kill failed")
-	err := killProcessTree(42, func(int) error { return treeErr }, func(int) error { return rootErr })
-	if !errors.Is(err, treeErr) || !errors.Is(err, rootErr) {
-		t.Fatalf("killProcessTree error = %v, want both failures", err)
-	}
-}

internal/hooks/lock.go

@@ -5,39 +5,93 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sync/atomic"
 	"time"
 
 	"github.com/Gitlawb/zero/internal/lockutil"
 )
 
 // Cross-process lock tuning for the audit log. The lock is held only across a
-// single read-then-append (milliseconds), so the timeout is generous relative
-// to any real hold.
+// single read-then-append (milliseconds), so the timeout is generous and the
+// stale threshold sits far above any real hold.
 const (
 	auditLockTimeout    = 10 * time.Second
+	auditLockStaleAfter = 60 * time.Second
 	auditLockRetryDelay = 20 * time.Millisecond
 )
 
-// lockAudit takes a cross-process advisory lock on the audit log through a
-// stable sibling "<auditPath>.lock" file. It makes
+var auditLockSeq atomic.Uint64
+
+// lockAudit takes a cross-process exclusive lock on the audit log by
+// O_EXCL-creating a sibling "<auditPath>.lock" file (removed on release). It makes
 // the lastSequence()+append in append() atomic across processes; the audit log is
 // a shared global file, so without it two processes can read the same last
-// sequence and write duplicate numbers. Kernel lock lifetime provides crash
-// recovery without moving or deleting the lock path.
+// sequence and write duplicate numbers. A stale lock from a crashed holder (older
+// than auditLockStaleAfter) is reclaimed. Wall-clock time is used deliberately so
+// lock timing never depends on the store's injectable clock and the stale check
+// compares against real file mtimes. This mirrors internal/cron/lock.go and
+// internal/oauth/lock.go. Uses internal/lockutil for lock restore and reclaim.
 func (store *AuditStore) lockAudit() (func(), error) {
 	lockPath := store.auditPath + ".lock"
 	if err := os.MkdirAll(filepath.Dir(lockPath), 0o700); err != nil {
 		return nil, err
 	}
+	token := fmt.Sprintf("%d-%d-%d", os.Getpid(), time.Now().UnixNano(), auditLockSeq.Add(1))
 	deadline := time.Now().Add(auditLockTimeout)
 	for {
-		lock, err := lockutil.TryAcquireFileLock(lockPath)
+		f, err := os.OpenFile(lockPath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
 		if err == nil {
-			return func() { _ = lock.Release() }, nil
+			// A partial write would leave a lock file without our token, so the
+			// releaser could never delete it — stranding the lock. Fail closed.
+			if _, werr := f.WriteString(token); werr != nil {
+				_ = f.Close()
+				_ = lockutil.RemoveLockFile(lockPath)
+				return nil, fmt.Errorf("hooks: write audit lock: %w", werr)
+			}
+			if cerr := f.Close(); cerr != nil {
+				_ = lockutil.RemoveLockFile(lockPath)
+				return nil, fmt.Errorf("hooks: close audit lock: %w", cerr)
+			}
+			var released bool
+			return func() {
+				if released {
+					return
+				}
+				released = true
+				if data, rerr := os.ReadFile(lockPath); rerr == nil && string(data) == token {
+					_ = lockutil.RemoveLockFile(lockPath)
+				}
+			}, nil
 		}
-		if !errors.Is(err, lockutil.ErrLockHeld) {
+		// On Windows a concurrent holder's os.Remove leaves the lock file in a
+		// "delete pending" state, so an O_EXCL create races it with
+		// ERROR_ACCESS_DENIED (os.ErrPermission) rather than ErrExist. Treat both
+		// as contention and retry.
+		if !errors.Is(err, os.ErrExist) && !errors.Is(err, os.ErrPermission) {
 			return nil, fmt.Errorf("hooks: acquire audit lock: %w", err)
 		}
+		// Reclaim a stale lock left by a crashed holder — atomically (H3). A blind
+		// Remove lets two racers both reclaim + recreate and so both hold the lock;
+		// reclaimStaleLock renames the file aside (only one rename wins) and restores
+		// it if it turns out fresh, so a live lock is never deleted out from under it.
+		if info, statErr := os.Stat(lockPath); statErr == nil && time.Since(info.ModTime()) > auditLockStaleAfter {
+			cleared, rerr := lockutil.ReclaimStaleLock(lockPath, token, func(reclaimedPath string) bool {
+				info, err := os.Stat(reclaimedPath)
+				return err == nil && time.Since(info.ModTime()) <= auditLockStaleAfter
+			})
+			if rerr != nil {
+				// Reclaim hit a hard failure: the rename aside failed outright, or a
+				// live holder's lock could not be put back (the lock path may be
+				// missing, so re-acquiring would break mutual exclusion). Fail closed
+				// instead of spinning to the deadline.
+				return nil, fmt.Errorf("hooks: reclaim stale audit lock: %w", rerr)
+			}
+			if cleared {
+				continue
+			}
+			// Lost the reclaim race (or it was actually fresh) — fall through to the
+			// bounded wait rather than hot-spinning on a reclaim that never wins.
+		}
 		if !time.Now().Before(deadline) {
 			return nil, fmt.Errorf("hooks: timed out acquiring audit lock")
 		}

internal/lockutil/lockutil.go

@@ -1,127 +1,64 @@
-// Package lockutil provides cross-process advisory file locks used by cron,
-// daemon, hooks, oauth, and swarm. Locks are held by the kernel for the lifetime
-// of an open file handle, so process exit releases them without a stale-file
-// reclaim protocol. The lock file itself is stable: holders never rename or
-// remove it while another process may still have its inode locked.
+// Package lockutil provides the platform-specific file primitives behind the
+// O_EXCL lock files in cron, daemon, hooks, oauth, and swarm: a no-overwrite
+// restore for locks that were sidelined during a stale-reclaim attempt, and a
+// lock file remover with one cross-platform contract (missing files are a
+// no-op; Windows retries transient sharing violations).
 package lockutil
 
 import (
-	"errors"
-	"fmt"
+	"io"
 	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"sync/atomic"
 )
 
-var (
-	// ErrLockHeld reports that another process or goroutine currently holds the
-	// advisory lock. Callers may wait and retry until their own deadline.
-	ErrLockHeld = errors.New("lockutil: lock is held")
-	// ErrLockReleased reports an attempt to update metadata after Release.
-	ErrLockReleased = errors.New("lockutil: lock is released")
-)
-
-var holderSequence atomic.Uint64
-
-// FileLock is an exclusive advisory lock held through an open file handle.
-// Release is idempotent. The lock path remains on disk after release; deleting
-// or replacing it would let different processes lock different inodes.
-type FileLock struct {
-	mu         sync.Mutex
-	file       *os.File
-	state      platformLockState
-	released   bool
-	releaseErr error
-}
-
-// TryAcquireFileLock attempts to take an exclusive advisory lock without
-// waiting. A contended lock returns ErrLockHeld. The kernel releases a lock if
-// its process exits, so an old unlocked file never needs stale reclamation.
-func TryAcquireFileLock(path string) (*FileLock, error) {
-	return TryAcquireFileLockAt(filepath.Dir(path), path)
-}
-
-// TryAcquireFileLockAt attempts to lock path while confining every component
-// below root to a handle-relative traversal. root is the caller's trusted
-// boundary and may itself be reached through a legitimate link; links and
-// reparse points below it are rejected before metadata can be written.
-func TryAcquireFileLockAt(root, path string) (*FileLock, error) {
-	if root == "" {
-		return nil, errors.New("lockutil: lock root is empty")
-	}
-	relative, err := filepath.Rel(root, path)
+// restoreByCopy restores reclaimed to path without overwriting an existing
+// path, as a fallback for when the platform's primary no-replace primitive
+// (hard link on POSIX, MoveFileEx on Windows) fails for a reason other than
+// the destination existing. It stages a full copy under a private name next
+// to reclaimed and publishes it to path with publish (the same no-replace
+// primitive the caller's platform uses for the primary restore), so path
+// never appears in a partially-copied state: a crash between staging and
+// publish leaves path exactly as it was (missing or, if a competing holder
+// created it, untouched), never a truncated file that a PID/content-based
+// liveness check could mistake for dead. Leaving path missing here would let
+// the next O_EXCL create succeed while the sidelined holder is still live,
+// breaking mutual exclusion. publish keeps the no-overwrite guarantee: a new
+// holder that appeared in the meantime wins and this returns os.ErrExist. The
+// copy resets the lock's mtime to now, which only makes the restored lock
+// look fresher; that is safe, since it is being handed back to a live holder.
+func restoreByCopy(reclaimed, path string, publish func(from, to string) error) error {
+	staged := reclaimed + ".copy"
+	src, err := os.Open(reclaimed)
 	if err != nil {
-		return nil, fmt.Errorf("lockutil: resolve lock path relative to root: %w", err)
+		return err
 	}
-	relative = filepath.Clean(relative)
-	if relative == "." || relative == ".." || filepath.IsAbs(relative) || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
-		return nil, fmt.Errorf("lockutil: lock path %q escapes root %q", path, root)
-	}
-
-	file, err := openLockFileAt(root, relative, path)
+	dst, err := os.OpenFile(staged, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
 	if err != nil {
-		return nil, fmt.Errorf("lockutil: open lock file: %w", err)
+		_ = src.Close()
+		return err
 	}
-	state, contended, err := tryLockFile(file)
+	_, err = io.Copy(dst, src)
+	// Close the source before removing anything below: Go opens files without
+	// FILE_SHARE_DELETE on Windows, so deleting reclaimed or staged while src
+	// is open would fail with a sharing violation.
+	_ = src.Close()
 	if err != nil {
-		_ = file.Close()
-		return nil, fmt.Errorf("lockutil: acquire advisory lock: %w", err)
+		_ = dst.Close()
+		_ = os.Remove(staged)
+		return err
 	}
-	if contended {
-		_ = file.Close()
-		return nil, ErrLockHeld
+	if err := dst.Close(); err != nil {
+		_ = os.Remove(staged)
+		return err
 	}
-
-	lock := &FileLock{file: file, state: state}
-	metadata := []byte(fmt.Sprintf("%d-%d\n", os.Getpid(), holderSequence.Add(1)))
-	if err := lock.WriteMetadata(metadata); err != nil {
-		return nil, errors.Join(err, lock.Release())
-	}
-	return lock, nil
-}
-
-// WriteMetadata replaces the diagnostic contents of the lock file while the
-// caller holds it. Metadata does not establish ownership; the kernel lock does.
-func (lock *FileLock) WriteMetadata(data []byte) error {
-	if lock == nil {
-		return ErrLockReleased
-	}
-	lock.mu.Lock()
-	defer lock.mu.Unlock()
-	if lock.released || lock.file == nil {
-		return ErrLockReleased
-	}
-	if err := lock.file.Truncate(0); err != nil {
-		return fmt.Errorf("lockutil: truncate lock metadata: %w", err)
-	}
-	if _, err := lock.file.Seek(0, 0); err != nil {
-		return fmt.Errorf("lockutil: seek lock metadata: %w", err)
-	}
-	if _, err := lock.file.Write(data); err != nil {
-		return fmt.Errorf("lockutil: write lock metadata: %w", err)
+	if err := publish(staged, path); err != nil {
+		_ = os.Remove(staged)
+		return err
 	}
+	// publish may leave staged behind (a hard-link publish keeps both names),
+	// so remove it explicitly; a move-based publish already made this a no-op.
+	_ = os.Remove(staged)
+	// The lock is back at path, so the restore has succeeded; failing to clean
+	// up the sidelined name must not be reported as a failed restore.
+	_ = RemoveLockFile(reclaimed)
 	return nil
 }
-
-// Release unlocks and closes the held file handle. It deliberately leaves the
-// stable lock file in place. Repeated calls return the first release result.
-func (lock *FileLock) Release() error {
-	if lock == nil {
-		return nil
-	}
-	lock.mu.Lock()
-	defer lock.mu.Unlock()
-	if lock.released {
-		return lock.releaseErr
-	}
-	lock.released = true
-	unlockErr := unlockFile(lock.file, &lock.state)
-	closeErr := lock.file.Close()
-	lock.file = nil
-	if err := errors.Join(unlockErr, closeErr); err != nil {
-		lock.releaseErr = fmt.Errorf("lockutil: release advisory lock: %w", err)
-	}
-	return lock.releaseErr
-}

internal/lockutil/lockutil_other.go

@@ -4,92 +4,43 @@ package lockutil
 
 import (
 	"errors"
-	"fmt"
+	"io/fs"
 	"os"
-	"path/filepath"
-	"strings"
-
-	"golang.org/x/sys/unix"
 )
 
-type platformLockState struct{}
-
-func openLockFileAt(root, relative, displayPath string) (_ *os.File, resultErr error) {
-	parentFD, err := unix.Open(root, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return nil, fmt.Errorf("open lock root: %w", err)
-	}
-	defer func() {
-		if parentFD >= 0 {
-			resultErr = errors.Join(resultErr, unix.Close(parentFD))
-		}
-	}()
-
-	components := strings.Split(filepath.Clean(relative), string(filepath.Separator))
-	for _, component := range components[:len(components)-1] {
-		nextFD, openErr := unix.Openat(parentFD, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
-		if openErr != nil {
-			return nil, fmt.Errorf("open lock path component %q: %w", component, openErr)
-		}
-		if closeErr := unix.Close(parentFD); closeErr != nil {
-			_ = unix.Close(nextFD)
-			parentFD = -1
-			return nil, fmt.Errorf("close lock path component: %w", closeErr)
-		}
-		parentFD = nextFD
-	}
-
-	name := components[len(components)-1]
-	fd := -1
-	// Darwin can transiently return ENOENT when many callers race to create the
-	// same O_NOFOLLOW entry. The bound parent handle cannot be redirected, so a
-	// bounded retry preserves first-use contention without weakening no-follow.
-	for attempt := 0; attempt < 10; attempt++ {
-		fd, err = unix.Openat(parentFD, name, unix.O_CREAT|unix.O_RDWR|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0o600)
-		if !errors.Is(err, unix.ENOENT) {
-			break
-		}
-	}
-	if err != nil {
-		return nil, err
-	}
-	file := os.NewFile(uintptr(fd), displayPath)
-	if file == nil {
-		_ = unix.Close(fd)
-		return nil, errors.New("convert lock handle to file")
-	}
-	var stat unix.Stat_t
-	if err := unix.Fstat(fd, &stat); err != nil {
-		return nil, errors.Join(fmt.Errorf("inspect lock file: %w", err), file.Close())
-	}
-	if stat.Mode&unix.S_IFMT != unix.S_IFREG {
-		return nil, errors.Join(errors.New("refusing non-regular lock file"), file.Close())
-	}
-	if stat.Nlink != 1 {
-		return nil, errors.Join(errors.New("refusing multiply-linked lock file"), file.Close())
-	}
-	if err := unix.Close(parentFD); err != nil {
-		parentFD = -1
-		return nil, errors.Join(fmt.Errorf("close lock parent: %w", err), file.Close())
-	}
-	parentFD = -1
-	return file, nil
-}
-
-func tryLockFile(file *os.File) (platformLockState, bool, error) {
-	err := unix.Flock(int(file.Fd()), unix.LOCK_EX|unix.LOCK_NB)
+// RestoreLockFile restores a sidelined lock file on non-Windows platforms. It
+// uses os.Link so a competing lock created at path in the meantime wins: the
+// link fails with os.ErrExist instead of overwriting it. If the link fails for
+// any other reason (hardlink-incapable filesystems such as FAT or some
+// FUSE/network mounts, ENOSPC, EPERM), it falls back to an O_EXCL copy rather
+// than leaving path missing and the live holder's lock stranded in reclaimed.
+// Once the lock is back at path the restore has succeeded, so a failed cleanup
+// of the sidelined name is not reported as an error; the leftover file is
+// invisible to the lock protocol.
+func RestoreLockFile(reclaimed, path string) error {
+	err := os.Link(reclaimed, path)
 	if err == nil {
-		return platformLockState{}, false, nil
-	}
-	if errors.Is(err, unix.EWOULDBLOCK) || errors.Is(err, unix.EAGAIN) {
-		return platformLockState{}, true, nil
-	}
-	return platformLockState{}, false, err
-}
-
-func unlockFile(file *os.File, _ *platformLockState) error {
-	if file == nil {
+		_ = RemoveLockFile(reclaimed)
 		return nil
 	}
-	return unix.Flock(int(file.Fd()), unix.LOCK_UN)
+	if errors.Is(err, os.ErrExist) {
+		return err
+	}
+	return restoreByCopy(reclaimed, path, os.Link)
+}
+
+// isReclaimContended reports whether a failed rename-aside of a suspected
+// stale lock means it was lost to a racer rather than a hard failure. POSIX
+// rename has no contention errno (a lost race surfaces only as ENOENT, which
+// ReclaimStaleLock already treats as benign), so nothing extra is benign here.
+func isReclaimContended(error) bool { return false }
+
+// RemoveLockFile removes a lock file on non-Windows platforms. Removing an
+// already-missing file reports nil, matching the Windows implementation, so
+// callers see one cross-platform contract.
+func RemoveLockFile(path string) error {
+	if err := os.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	return nil
 }

internal/lockutil/lockutil_test.go

@@ -1,220 +1,116 @@
 package lockutil
 
 import (
-	"bufio"
 	"errors"
-	"fmt"
-	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
-	"runtime"
-	"strings"
-	"sync"
 	"testing"
 )
 
-func TestFileLockSerializesAndKeepsStablePath(t *testing.T) {
+func TestRestoreLockFile(t *testing.T) {
+	tempDir := t.TempDir()
+	path := filepath.Join(tempDir, "lock")
+	reclaimed := filepath.Join(tempDir, "lock.stale.token")
+
+	// 1. Successful restore when target does not exist
+	if err := os.WriteFile(reclaimed, []byte("token"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := RestoreLockFile(reclaimed, path); err != nil {
+		t.Fatalf("RestoreLockFile failed: %v", err)
+	}
+	if data, err := os.ReadFile(path); err != nil || string(data) != "token" {
+		t.Fatalf("restored lock content = %q, err %v; want %q intact", data, err, "token")
+	}
+	if _, err := os.Stat(reclaimed); !os.IsNotExist(err) {
+		t.Fatalf("expected sidelined lock to be cleaned up/removed: %v", err)
+	}
+
+	// 2. Fail when target already exists (prevent overwrite)
+	if err := os.WriteFile(reclaimed, []byte("token"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("competing"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	err := RestoreLockFile(reclaimed, path)
+	if err == nil {
+		t.Fatal("expected RestoreLockFile to fail when target exists")
+	}
+	if !errors.Is(err, os.ErrExist) {
+		t.Fatalf("expected os.ErrExist, got: %v", err)
+	}
+
+	// The sidelined lock must still exist on failure, and the competing lock
+	// must be untouched.
+	if _, err := os.Stat(reclaimed); err != nil {
+		t.Fatalf("expected sidelined lock to still exist: %v", err)
+	}
+	if data, _ := os.ReadFile(path); string(data) != "competing" {
+		t.Fatalf("competing lock was clobbered: %q", data)
+	}
+}
+
+func TestRestoreByCopy(t *testing.T) {
+	tempDir := t.TempDir()
+	path := filepath.Join(tempDir, "lock")
+	reclaimed := filepath.Join(tempDir, "lock.stale.token")
+
+	// 1. Restores content and cleans up the sidelined file when the target is
+	// free (the fallback taken when the platform's no-replace primitive fails
+	// for a reason other than the destination existing).
+	if err := os.WriteFile(reclaimed, []byte("token"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := restoreByCopy(reclaimed, path, os.Link); err != nil {
+		t.Fatalf("restoreByCopy failed: %v", err)
+	}
+	if data, err := os.ReadFile(path); err != nil || string(data) != "token" {
+		t.Fatalf("restored lock content = %q, err %v; want %q intact", data, err, "token")
+	}
+	if _, err := os.Stat(reclaimed); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("expected sidelined lock to be cleaned up after copy: %v", err)
+	}
+	if _, err := os.Stat(reclaimed + ".copy"); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("expected staged copy to be cleaned up: %v", err)
+	}
+
+	// 2. Keeps the no-overwrite guarantee: a competing lock at the target wins
+	// and the sidelined lock survives for the caller's ErrExist cleanup.
+	if err := os.WriteFile(reclaimed, []byte("token"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("competing"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := restoreByCopy(reclaimed, path, os.Link); !errors.Is(err, os.ErrExist) {
+		t.Fatalf("expected os.ErrExist when target exists, got: %v", err)
+	}
+	if data, _ := os.ReadFile(path); string(data) != "competing" {
+		t.Fatalf("competing lock was clobbered: %q", data)
+	}
+	if _, err := os.Stat(reclaimed); err != nil {
+		t.Fatalf("expected sidelined lock to still exist: %v", err)
+	}
+	if _, err := os.Stat(reclaimed + ".copy"); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("expected staged copy to be cleaned up after a failed publish: %v", err)
+	}
+}
+
+func TestRemoveLockFile(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "lock")
-	first, err := TryAcquireFileLock(path)
-	if err != nil {
-		t.Fatalf("first acquire: %v", err)
+	if err := os.WriteFile(path, []byte("token"), 0o600); err != nil {
+		t.Fatal(err)
 	}
-	firstInfo, err := os.Stat(path)
-	if err != nil {
-		t.Fatalf("stat first lock path: %v", err)
+	if err := RemoveLockFile(path); err != nil {
+		t.Fatalf("RemoveLockFile failed: %v", err)
 	}
-	if _, err := TryAcquireFileLock(path); !errors.Is(err, ErrLockHeld) {
-		t.Fatalf("contended acquire = %v, want ErrLockHeld", err)
+	if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("expected lock file to be removed: %v", err)
 	}
-	if err := first.Release(); err != nil {
-		t.Fatalf("release first: %v", err)
-	}
-	releasedInfo, err := os.Stat(path)
-	if err != nil {
-		t.Fatalf("release removed stable lock path: %v", err)
-	}
-	if !os.SameFile(firstInfo, releasedInfo) {
-		t.Fatal("release replaced the stable lock file")
-	}
-
-	second, err := TryAcquireFileLock(path)
-	if err != nil {
-		t.Fatalf("acquire after release: %v", err)
-	}
-	secondInfo, err := os.Stat(path)
-	if err != nil {
-		t.Fatalf("stat second lock path: %v", err)
-	}
-	if !os.SameFile(firstInfo, secondInfo) {
-		t.Fatal("reacquire used a different lock file")
-	}
-	if err := second.Release(); err != nil {
-		t.Fatalf("release second: %v", err)
-	}
-	if err := second.Release(); err != nil {
-		t.Fatalf("idempotent release: %v", err)
+	// Removing an already-missing lock file is a no-op on every platform.
+	if err := RemoveLockFile(path); err != nil {
+		t.Fatalf("RemoveLockFile on a missing file = %v, want nil", err)
 	}
 }
-
-func TestFileLockMetadata(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "lock")
-	lock, err := TryAcquireFileLock(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := lock.WriteMetadata([]byte("holder\n")); err != nil {
-		t.Fatalf("write metadata: %v", err)
-	}
-	data, err := os.ReadFile(path)
-	if err != nil || string(data) != "holder\n" {
-		t.Fatalf("metadata = %q, err %v", data, err)
-	}
-	if err := lock.Release(); err != nil {
-		t.Fatal(err)
-	}
-	if err := lock.WriteMetadata(nil); !errors.Is(err, ErrLockReleased) {
-		t.Fatalf("write after release = %v, want ErrLockReleased", err)
-	}
-}
-
-func TestFileLockConcurrentFirstAcquisition(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "lock")
-	const contenders = 200
-	start := make(chan struct{})
-	results := make(chan error, contenders)
-	locks := make(chan *FileLock, contenders)
-	var ready sync.WaitGroup
-	ready.Add(contenders)
-	for range contenders {
-		go func() {
-			ready.Done()
-			<-start
-			lock, err := TryAcquireFileLock(path)
-			if lock != nil {
-				locks <- lock
-			}
-			results <- err
-		}()
-	}
-	ready.Wait()
-	close(start)
-	acquired := 0
-	for range contenders {
-		err := <-results
-		switch {
-		case err == nil:
-			acquired++
-		case !errors.Is(err, ErrLockHeld):
-			t.Errorf("concurrent first acquire: %v", err)
-		}
-	}
-	close(locks)
-	for lock := range locks {
-		if err := lock.Release(); err != nil {
-			t.Error(err)
-		}
-	}
-	if acquired != 1 {
-		t.Fatalf("concurrent first acquire: got %d holders, want 1", acquired)
-	}
-}
-
-func TestFileLockRefusesMultiplyLinkedEntry(t *testing.T) {
-	dir := t.TempDir()
-	target := filepath.Join(dir, "target")
-	lockPath := filepath.Join(dir, "lock")
-	const sentinel = "do not overwrite"
-	if err := os.WriteFile(target, []byte(sentinel), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Link(target, lockPath); err != nil {
-		t.Fatalf("create redirected hard link: %v", err)
-	}
-	if lock, err := TryAcquireFileLock(lockPath); err == nil {
-		_ = lock.Release()
-		t.Fatal("TryAcquireFileLock accepted a multiply-linked entry")
-	}
-	data, err := os.ReadFile(target)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(data) != sentinel {
-		t.Fatalf("redirected target was modified: %q", data)
-	}
-}
-
-func TestFileLockAtRejectsEscapingPath(t *testing.T) {
-	base := t.TempDir()
-	outside := filepath.Join(filepath.Dir(base), "outside.lock")
-	if lock, err := TryAcquireFileLockAt(base, outside); err == nil {
-		_ = lock.Release()
-		t.Fatal("TryAcquireFileLockAt accepted a path outside its root")
-	}
-	if _, err := os.Stat(outside); !errors.Is(err, os.ErrNotExist) {
-		t.Fatalf("escaping path was created: %v", err)
-	}
-}
-
-// TestFileLockReleasedByProcessExit proves crash recovery is provided by the
-// kernel lock lifetime. The child exits without calling Release; the next
-// process can then lock the same persistent file without moving or deleting it.
-func TestFileLockReleasedByProcessExit(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "lock")
-	cmd := exec.Command(os.Args[0], "-test.run=^TestFileLockHelperProcess$")
-	cmd.Env = append(os.Environ(), "ZERO_LOCKUTIL_HELPER=1", "ZERO_LOCKUTIL_PATH="+path)
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	stdin, err := cmd.StdinPipe()
-	if err != nil {
-		t.Fatal(err)
-	}
-	cmd.Stderr = os.Stderr
-	if err := cmd.Start(); err != nil {
-		t.Fatal(err)
-	}
-
-	ready, err := bufio.NewReader(stdout).ReadString('\n')
-	if err != nil || strings.TrimSpace(ready) != "ready" {
-		_ = cmd.Process.Kill()
-		_ = cmd.Wait()
-		t.Fatalf("helper readiness = %q, err %v", ready, err)
-	}
-	if _, err := TryAcquireFileLock(path); !errors.Is(err, ErrLockHeld) {
-		_ = cmd.Process.Kill()
-		_ = cmd.Wait()
-		t.Fatalf("acquire while helper holds lock = %v, want ErrLockHeld", err)
-	}
-	if err := stdin.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := cmd.Wait(); err != nil {
-		t.Fatalf("helper exit: %v", err)
-	}
-
-	lock, err := TryAcquireFileLock(path)
-	if err != nil {
-		t.Fatalf("acquire after helper exit: %v", err)
-	}
-	if err := lock.Release(); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestFileLockHelperProcess(t *testing.T) {
-	if os.Getenv("ZERO_LOCKUTIL_HELPER") != "1" {
-		return
-	}
-	lock, err := TryAcquireFileLock(os.Getenv("ZERO_LOCKUTIL_PATH"))
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(2)
-	}
-	if _, err := fmt.Fprintln(os.Stdout, "ready"); err != nil {
-		os.Exit(3)
-	}
-	_, _ = io.Copy(io.Discard, os.Stdin)
-	runtime.KeepAlive(lock) // deliberately exit without Release
-}

internal/lockutil/lockutil_windows.go

@@ -4,202 +4,77 @@ package lockutil
 
 import (
 	"errors"
-	"fmt"
 	"os"
-	"path/filepath"
-	"strings"
-	"unsafe"
+	"syscall"
+	"time"
 
 	"golang.org/x/sys/windows"
 )
 
-type platformLockState struct {
-	overlapped windows.Overlapped
+// RestoreLockFile restores a sidelined lock file on Windows. It moves the file
+// with a no-replace MoveFileEx so a competing lock created at path in the
+// meantime wins: the move fails with os.ErrExist instead of overwriting it. If
+// the move fails for any other reason (ERROR_SHARING_VIOLATION or
+// ERROR_ACCESS_DENIED under concurrent access to the file), it falls back to
+// an O_EXCL copy rather than leaving path missing and the live holder's lock
+// stranded in reclaimed.
+func RestoreLockFile(reclaimed, path string) error {
+	err := moveFileNoReplace(reclaimed, path)
+	if err == nil || errors.Is(err, os.ErrExist) {
+		return err
+	}
+	return restoreByCopy(reclaimed, path, moveFileNoReplace)
 }
 
-const lockByteOffsetHigh = 1
-
-func openLockFileAt(root, relative, displayPath string) (_ *os.File, resultErr error) {
-	rootPtr, err := windows.UTF16PtrFromString(root)
+// moveFileNoReplace renames from to to, failing if to already exists. It calls
+// MoveFileExW directly via golang.org/x/sys/windows (the standard library's
+// syscall package does not export MoveFileEx on this platform) with no flags,
+// so an existing destination fails with ERROR_ALREADY_EXISTS, which satisfies
+// errors.Is(err, os.ErrExist) (pinned by
+// TestMoveFileNoReplaceMapsAlreadyExistsToErrExist), instead of overwriting it
+// the way os.Rename does on Windows (it passes MOVEFILE_REPLACE_EXISTING to
+// match POSIX rename semantics cross-platform).
+func moveFileNoReplace(from, to string) error {
+	fromPtr, err := windows.UTF16PtrFromString(from)
 	if err != nil {
-		return nil, err
+		return err
 	}
-	parent, err := windows.CreateFile(
-		rootPtr,
-		windows.FILE_READ_ATTRIBUTES|windows.FILE_TRAVERSE|windows.SYNCHRONIZE,
-		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
-		nil,
-		windows.OPEN_EXISTING,
-		windows.FILE_FLAG_BACKUP_SEMANTICS,
-		0,
-	)
+	toPtr, err := windows.UTF16PtrFromString(to)
 	if err != nil {
-		return nil, fmt.Errorf("open lock root: %w", err)
+		return err
 	}
-	defer func() {
-		if parent != 0 {
-			resultErr = errors.Join(resultErr, windows.CloseHandle(parent))
-		}
-	}()
-
-	components := strings.Split(filepath.Clean(relative), string(filepath.Separator))
-	for _, component := range components[:len(components)-1] {
-		next, openErr := openLockDirectoryAt(parent, component)
-		if openErr != nil {
-			return nil, fmt.Errorf("open lock path component %q: %w", component, openErr)
-		}
-		if closeErr := windows.CloseHandle(parent); closeErr != nil {
-			_ = windows.CloseHandle(next)
-			parent = 0
-			return nil, fmt.Errorf("close lock path component: %w", closeErr)
-		}
-		parent = next
-	}
-
-	handle, err := openLockFileHandleAt(parent, components[len(components)-1])
-	if err != nil {
-		return nil, err
-	}
-	file := os.NewFile(uintptr(handle), displayPath)
-	if file == nil {
-		_ = windows.CloseHandle(handle)
-		return nil, errors.New("convert lock handle to file")
-	}
-	if err := windows.CloseHandle(parent); err != nil {
-		parent = 0
-		return nil, errors.Join(fmt.Errorf("close lock parent: %w", err), file.Close())
-	}
-	parent = 0
-	return file, nil
+	return windows.MoveFileEx(fromPtr, toPtr, 0)
 }
 
-func openLockDirectoryAt(parent windows.Handle, name string) (windows.Handle, error) {
-	handle, err := openLockPathAt(
-		parent,
-		name,
-		windows.FILE_READ_ATTRIBUTES|windows.FILE_TRAVERSE|windows.SYNCHRONIZE,
-		windows.FILE_OPEN,
-		windows.FILE_ATTRIBUTE_DIRECTORY,
-		windows.FILE_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
-	)
-	if err != nil {
-		return 0, err
-	}
-	if err := validateWindowsLockHandle(handle, true); err != nil {
-		return 0, errors.Join(err, windows.CloseHandle(handle))
-	}
-	return handle, nil
+// isReclaimContended reports whether a failed rename-aside of a suspected
+// stale lock means the file was concurrently open or pending deletion (which
+// surfaces as ERROR_SHARING_VIOLATION or ERROR_ACCESS_DENIED on Windows)
+// rather than a hard failure, so ReclaimStaleLock reports a lost race instead
+// of an error. Neither errno satisfies errors.Is(err, os.ErrExist), and
+// ERROR_SHARING_VIOLATION does not satisfy errors.Is(err, os.ErrPermission)
+// either, so the classification compares raw errnos like RemoveLockFile below.
+func isReclaimContended(err error) bool {
+	var errno syscall.Errno
+	return errors.As(err, &errno) && (errno == windows.ERROR_SHARING_VIOLATION || errno == windows.ERROR_ACCESS_DENIED)
 }
 
-func openLockFileHandleAt(parent windows.Handle, name string) (windows.Handle, error) {
-	for attempt := 0; attempt < 10; attempt++ {
-		handle, err := openLockPathAt(
-			parent,
-			name,
-			windows.GENERIC_READ|windows.GENERIC_WRITE|windows.SYNCHRONIZE,
-			windows.FILE_OPEN,
-			windows.FILE_ATTRIBUTE_NORMAL,
-			windows.FILE_NON_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
-		)
-		if err == nil {
-			if err := validateWindowsLockHandle(handle, false); err != nil {
-				return 0, errors.Join(err, windows.CloseHandle(handle))
-			}
-			return handle, nil
+// RemoveLockFile removes a lock file on Windows, retrying on the sharing
+// violation or access denied errors that are common under heavy concurrent
+// contention. Removing an already-missing file reports nil, matching the
+// non-Windows implementation, so callers see one cross-platform contract.
+func RemoveLockFile(path string) error {
+	var err error
+	for i := 0; i < 15; i++ {
+		err = os.Remove(path)
+		if err == nil || os.IsNotExist(err) {
+			return nil
 		}
-		if !windowsLockPathMissing(err) {
-			return 0, err
-		}
-
-		handle, err = openLockPathAt(
-			parent,
-			name,
-			windows.GENERIC_READ|windows.GENERIC_WRITE|windows.SYNCHRONIZE,
-			windows.FILE_CREATE,
-			windows.FILE_ATTRIBUTE_NORMAL,
-			windows.FILE_NON_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
-		)
-		if err == windows.STATUS_OBJECT_NAME_COLLISION || errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
+		var errno syscall.Errno
+		if errors.As(err, &errno) && (errno == windows.ERROR_SHARING_VIOLATION || errno == windows.ERROR_ACCESS_DENIED) {
+			time.Sleep(5 * time.Millisecond)
 			continue
 		}
-		if err != nil {
-			return 0, err
-		}
-		if err := validateWindowsLockHandle(handle, false); err != nil {
-			return 0, errors.Join(err, windows.CloseHandle(handle))
-		}
-		return handle, nil
+		return err
 	}
-	return 0, errors.New("lock file creation did not stabilize")
-}
-
-func windowsLockPathMissing(err error) bool {
-	return err == windows.STATUS_NO_SUCH_FILE ||
-		err == windows.STATUS_OBJECT_NAME_NOT_FOUND ||
-		err == windows.STATUS_OBJECT_PATH_NOT_FOUND ||
-		errors.Is(err, windows.ERROR_FILE_NOT_FOUND) ||
-		errors.Is(err, windows.ERROR_PATH_NOT_FOUND)
-}
-
-func openLockPathAt(parent windows.Handle, name string, access, disposition, attributes, options uint32) (windows.Handle, error) {
-	objectName, err := windows.NewNTUnicodeString(name)
-	if err != nil {
-		return 0, err
-	}
-	objectAttributes := &windows.OBJECT_ATTRIBUTES{
-		Length:        uint32(unsafe.Sizeof(windows.OBJECT_ATTRIBUTES{})),
-		RootDirectory: parent,
-		ObjectName:    objectName,
-		Attributes:    windows.OBJ_CASE_INSENSITIVE | windows.OBJ_DONT_REPARSE,
-	}
-	var handle windows.Handle
-	err = windows.NtCreateFile(
-		&handle,
-		access,
-		objectAttributes,
-		&windows.IO_STATUS_BLOCK{},
-		nil,
-		attributes,
-		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
-		disposition,
-		options,
-		0,
-		0,
-	)
-	return handle, err
-}
-
-func validateWindowsLockHandle(handle windows.Handle, wantDirectory bool) error {
-	var info windows.ByHandleFileInformation
-	if err := windows.GetFileInformationByHandle(handle, &info); err != nil {
-		return fmt.Errorf("inspect lock path handle: %w", err)
-	}
-	isDirectory := info.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY != 0
-	if info.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 || isDirectory != wantDirectory {
-		return errors.New("refusing non-file or reparse-point lock path")
-	}
-	if !wantDirectory && info.NumberOfLinks != 1 {
-		return errors.New("refusing multiply-linked lock file")
-	}
-	return nil
-}
-
-func tryLockFile(file *os.File) (platformLockState, bool, error) {
-	state := platformLockState{overlapped: windows.Overlapped{OffsetHigh: lockByteOffsetHigh}}
-	flags := uint32(windows.LOCKFILE_EXCLUSIVE_LOCK | windows.LOCKFILE_FAIL_IMMEDIATELY)
-	err := windows.LockFileEx(windows.Handle(file.Fd()), flags, 0, 1, 0, &state.overlapped)
-	if err == nil {
-		return state, false, nil
-	}
-	if errors.Is(err, windows.ERROR_LOCK_VIOLATION) || errors.Is(err, windows.ERROR_SHARING_VIOLATION) {
-		return platformLockState{}, true, nil
-	}
-	return platformLockState{}, false, err
-}
-
-func unlockFile(file *os.File, state *platformLockState) error {
-	if file == nil {
-		return nil
-	}
-	return windows.UnlockFileEx(windows.Handle(file.Fd()), 0, 1, 0, &state.overlapped)
+	return err
 }

internal/lockutil/lockutil_windows_test.go

@@ -0,0 +1,83 @@
+//go:build windows
+
+package lockutil
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/windows"
+)
+
+// TestMoveFileNoReplaceMapsAlreadyExistsToErrExist pins the errno coupling
+// every caller keys its cleanup on: with no flags, MoveFileEx fails with
+// ERROR_ALREADY_EXISTS when the destination exists, and that errno must
+// satisfy errors.Is(err, os.ErrExist).
+func TestMoveFileNoReplaceMapsAlreadyExistsToErrExist(t *testing.T) {
+	dir := t.TempDir()
+	from := filepath.Join(dir, "from")
+	to := filepath.Join(dir, "to")
+	if err := os.WriteFile(from, []byte("sidelined"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(to, []byte("competing"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	err := moveFileNoReplace(from, to)
+	if !errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
+		t.Fatalf("MoveFileEx with an existing destination = %v, want ERROR_ALREADY_EXISTS", err)
+	}
+	if !errors.Is(err, os.ErrExist) {
+		t.Fatalf("ERROR_ALREADY_EXISTS must satisfy errors.Is(err, os.ErrExist), got: %v", err)
+	}
+	if data, _ := os.ReadFile(to); string(data) != "competing" {
+		t.Fatalf("destination was overwritten: %q", data)
+	}
+}
+
+// TestRemoveLockFileRetriesSharingViolation holds the file open briefly (Go
+// opens files without FILE_SHARE_DELETE on Windows, so a concurrent DeleteFile
+// fails with ERROR_SHARING_VIOLATION while the handle is open); RemoveLockFile
+// must ride its retry loop (15 x 5ms) past the window and succeed once the
+// handle closes.
+func TestRemoveLockFileRetriesSharingViolation(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "lock")
+	if err := os.WriteFile(path, []byte("token"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	go func() {
+		time.Sleep(10 * time.Millisecond)
+		_ = f.Close()
+	}()
+	if err := RemoveLockFile(path); err != nil {
+		t.Fatalf("RemoveLockFile should succeed once the contending handle closes: %v", err)
+	}
+	if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("expected lock file to be removed: %v", err)
+	}
+}
+
+// TestRemoveLockFileSharingViolationExhausts verifies the retry loop is
+// bounded: with the contending handle held for the whole call, RemoveLockFile
+// surfaces the sharing violation instead of retrying forever.
+func TestRemoveLockFileSharingViolationExhausts(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "lock")
+	if err := os.WriteFile(path, []byte("token"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	if err := RemoveLockFile(path); !errors.Is(err, windows.ERROR_SHARING_VIOLATION) {
+		t.Fatalf("RemoveLockFile with a held handle = %v, want ERROR_SHARING_VIOLATION", err)
+	}
+}

internal/lockutil/reclaim.go

@@ -0,0 +1,82 @@
+package lockutil
+
+import (
+	"errors"
+	"os"
+)
+
+// restoreLockFile is swappable so tests can force the fail-closed path of
+// ReclaimStaleLock, which requires both the fast restore and its no-replace
+// fallback (with its own copy fallback) to fail; that cannot be provoked
+// portably on a healthy filesystem.
+var restoreLockFile = restoreLiveLock
+
+// restoreLiveLock puts a lock that turned out to be live back at path after
+// ReclaimStaleLock moved it aside to inspect it. It first tries a fast,
+// replacing rename straight from reclaimed to path: a single syscall, which
+// keeps the window during which path does not exist (and so is open to a
+// fourth process's unrelated O_EXCL create landing on it) as short as
+// possible. RestoreLockFile's no-replace restore (with its slower copy
+// fallback on some failures) is a correctness-preserving fallback for when
+// the fast path itself fails (e.g. a cross-device sidelined name): it is a
+// much longer version of the identical race, but still detects rather than
+// silently clobbers a competing lock, which the fast path's replacing rename
+// cannot do. Neither path makes the race impossible, only unlikely; see
+// ReclaimStaleLock's doc comment.
+func restoreLiveLock(reclaimed, path string) error {
+	if err := os.Rename(reclaimed, path); err == nil {
+		return nil
+	}
+	return RestoreLockFile(reclaimed, path)
+}
+
+// ReclaimStaleLock atomically reclaims a suspected-stale lock file. It renames
+// lockPath aside to "<lockPath>.stale.<suffix>" (only one racer can win the
+// rename of a given file, so two racers can never both reclaim the same lock),
+// then consults isLive on the moved file; if the lock turns out to be live (a
+// holder reacquired it in the gap between the caller's stale check and the
+// rename) it is restored rather than stolen. The suffix must be unique per
+// acquirer attempt. Returns true only when a genuinely stale lock was removed,
+// so the caller knows it is safe to retry its exclusive create immediately; on
+// a lost race it returns false. A non-nil error means either the rename aside
+// failed for a reason that is not contention (so retrying cannot help and the
+// caller should fail fast instead of spinning to its deadline), or a live
+// holder's lock could not be restored (both restoreLiveLock's fast path and
+// its no-replace fallback failed), so lockPath may be missing; callers must
+// fail closed instead of re-acquiring. The sidelined file is removed on every
+// restore failure: once the restore has failed it has no protocol function
+// (release only consults the lock path), so keeping it would only leak files.
+//
+// The live-restore path has an inherent, unclosed race: between the rename
+// aside above and restoreLiveLock putting the lock back, lockPath does not
+// exist, so an unrelated caller's O_EXCL create can legitimately succeed
+// there. restoreLiveLock's fast path then silently overwrites that new
+// claimant's lock file, which does not corrupt release (it is
+// ownership-aware, so the new claimant's later release safely no-ops against
+// content it no longer owns) but does mean the new claimant can still run
+// its critical section concurrently with the original live holder. Making
+// this race actually impossible would need an OS-level advisory lock (flock
+// / LockFileEx) held for a holder's whole critical section, checked
+// non-destructively instead of by moving the file; restoreLiveLock only
+// shrinks the window to roughly one syscall, it does not close it.
+func ReclaimStaleLock(lockPath, suffix string, isLive func(reclaimedPath string) bool) (bool, error) {
+	reclaimed := lockPath + ".stale." + suffix
+	if err := os.Rename(lockPath, reclaimed); err != nil {
+		if errors.Is(err, os.ErrNotExist) || isReclaimContended(err) {
+			return false, nil // another racer already moved/removed it, or it vanished
+		}
+		return false, err
+	}
+	if isLive(reclaimed) {
+		// Put the live lock back instead of stealing it, and let the caller wait.
+		if rerr := restoreLockFile(reclaimed, lockPath); rerr != nil {
+			_ = RemoveLockFile(reclaimed)
+			if !errors.Is(rerr, os.ErrExist) {
+				return false, rerr
+			}
+		}
+		return false, nil
+	}
+	_ = RemoveLockFile(reclaimed)
+	return true, nil
+}

internal/lockutil/reclaim_other_test.go

@@ -0,0 +1,31 @@
+//go:build !windows
+
+package lockutil
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestReclaimStaleLockPropagatesRenameFailure pins the fail-fast contract of
+// the rename aside: a failure that is not a lost race must reach the caller.
+// Mapping it to the benign lost-race result would leave acquirers spinning
+// until their deadline and reporting a timeout instead of the real cause. A
+// directory squatting on the sidelined name makes os.Rename fail with EISDIR,
+// which matches neither os.ErrNotExist nor a contention errno.
+func TestReclaimStaleLockPropagatesRenameFailure(t *testing.T) {
+	lockPath := filepath.Join(t.TempDir(), "lock")
+	if err := os.WriteFile(lockPath, []byte("stale-holder"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(lockPath+".stale.tok", 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if ok, err := ReclaimStaleLock(lockPath, "tok", func(string) bool { return false }); err == nil || ok {
+		t.Fatalf("a hard rename failure must surface an error (ok=%v err=%v)", ok, err)
+	}
+	if _, err := os.Stat(lockPath); err != nil {
+		t.Fatalf("the lock file must be left in place on a failed rename: %v", err)
+	}
+}

internal/lockutil/reclaim_test.go

@@ -0,0 +1,112 @@
+package lockutil
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestReclaimStaleLock(t *testing.T) {
+	lockPath := filepath.Join(t.TempDir(), "lock")
+	dead := func(string) bool { return false }
+	live := func(string) bool { return true }
+
+	// A lock the predicate reports dead is reclaimed and removed.
+	if err := os.WriteFile(lockPath, []byte("crashed-holder"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if ok, err := ReclaimStaleLock(lockPath, "tok-a", dead); err != nil || !ok {
+		t.Fatalf("a dead lock should be reclaimed (ok=%v err=%v)", ok, err)
+	}
+	if _, err := os.Stat(lockPath); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("reclaimed dead lock should be gone, stat err=%v", err)
+	}
+
+	// A LIVE lock (a holder reacquired in the gap) must be RESTORED intact.
+	if err := os.WriteFile(lockPath, []byte("live-holder"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if ok, err := ReclaimStaleLock(lockPath, "tok-b", live); err != nil || ok {
+		t.Fatalf("a live lock must not be reclaimed (ok=%v err=%v)", ok, err)
+	}
+	if data, err := os.ReadFile(lockPath); err != nil || string(data) != "live-holder" {
+		t.Fatalf("live lock must be left intact, got %q err %v", data, err)
+	}
+
+	// A missing lock reports no reclaim (nothing to steal).
+	_ = os.Remove(lockPath)
+	if ok, err := ReclaimStaleLock(lockPath, "tok-c", live); err != nil || ok {
+		t.Fatalf("a missing lock should not report a reclaim (ok=%v err=%v)", ok, err)
+	}
+}
+
+// restoreLiveLock's fast path is a single replacing rename, chosen to
+// minimize (not eliminate) the window during which lockPath is absent and
+// open to an unrelated O_EXCL create; see ReclaimStaleLock's doc comment for
+// why that residual race exists. This test pins the resulting behavior: the
+// fast path overwrites a competing file at path rather than detecting it,
+// unlike RestoreLockFile's own no-replace contract.
+func TestRestoreLiveLockFastPathOverwritesCompetingFile(t *testing.T) {
+	dir := t.TempDir()
+	reclaimed := filepath.Join(dir, "lock.stale.tok")
+	path := filepath.Join(dir, "lock")
+
+	if err := os.WriteFile(reclaimed, []byte("original-holder"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("new-claimant"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := restoreLiveLock(reclaimed, path); err != nil {
+		t.Fatalf("restoreLiveLock failed: %v", err)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil || string(data) != "original-holder" {
+		t.Fatalf("path = %q, err %v; want the original holder's content restored", data, err)
+	}
+	if _, err := os.Stat(reclaimed); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("expected reclaimed to be consumed by the rename: %v", err)
+	}
+}
+
+func TestReclaimStaleLockFailsClosedOnRestoreError(t *testing.T) {
+	// When both the no-replace restore and its copy fallback fail (only
+	// provokable via the seam; a healthy filesystem cannot produce it), the
+	// caller must receive an error so it fails closed instead of re-acquiring a
+	// missing lock path, and the sidelined file must not leak.
+	restoreLockFile = func(reclaimed, path string) error { return errors.New("restore failed") }
+	defer func() { restoreLockFile = restoreLiveLock }()
+
+	lockPath := filepath.Join(t.TempDir(), "lock")
+	if err := os.WriteFile(lockPath, []byte("live-holder"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	ok, err := ReclaimStaleLock(lockPath, "tok", func(string) bool { return true })
+	if err == nil || ok {
+		t.Fatalf("a failed restore must surface an error (ok=%v err=%v)", ok, err)
+	}
+	if matches, _ := filepath.Glob(lockPath + ".stale.*"); len(matches) != 0 {
+		t.Fatalf("a failed restore must not leak sidelined files: %v", matches)
+	}
+}
+
+func TestReclaimStaleLockDropsSidelinedWhenNewHolderWins(t *testing.T) {
+	// An os.ErrExist restore failure means a new holder recreated the lock
+	// path; that is not an error for the caller, and the sidelined file is
+	// dropped rather than leaked.
+	restoreLockFile = func(reclaimed, path string) error { return os.ErrExist }
+	defer func() { restoreLockFile = restoreLiveLock }()
+
+	lockPath := filepath.Join(t.TempDir(), "lock")
+	if err := os.WriteFile(lockPath, []byte("live-holder"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	ok, err := ReclaimStaleLock(lockPath, "tok", func(string) bool { return true })
+	if err != nil || ok {
+		t.Fatalf("losing to a new holder is not an error (ok=%v err=%v)", ok, err)
+	}
+	if matches, _ := filepath.Glob(lockPath + ".stale.*"); len(matches) != 0 {
+		t.Fatalf("the sidelined file must be dropped when a new holder wins: %v", matches)
+	}
+}

internal/lockutil/reclaim_windows_test.go

@@ -0,0 +1,50 @@
+//go:build windows
+
+package lockutil
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestReclaimStaleLockTreatsSharingViolationAsLostRace pins the errno
+// classification the Windows acquire loops depend on: a rename aside that
+// fails because the lock file is concurrently open (Go opens files without
+// FILE_SHARE_DELETE, so the rename fails with ERROR_SHARING_VIOLATION or
+// ERROR_ACCESS_DENIED) is contention, not a hard failure, and must report a
+// benign lost race so the caller keeps waiting.
+func TestReclaimStaleLockTreatsSharingViolationAsLostRace(t *testing.T) {
+	lockPath := filepath.Join(t.TempDir(), "lock")
+	if err := os.WriteFile(lockPath, []byte("held"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(lockPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	if ok, rerr := ReclaimStaleLock(lockPath, "tok", func(string) bool { return true }); rerr != nil || ok {
+		t.Fatalf("a sharing-violation rename must report a benign lost race (ok=%v err=%v)", ok, rerr)
+	}
+	if _, err := os.Stat(lockPath); err != nil {
+		t.Fatalf("the lock file must be left in place: %v", err)
+	}
+}
+
+// TestReclaimStaleLockPropagatesRenameFailure pins the fail-fast contract of
+// the rename aside on Windows: a failure that is not contention must reach
+// the caller instead of masquerading as a lost race. A quote is an invalid
+// filename character, so the sidelined name fails with ERROR_INVALID_NAME.
+func TestReclaimStaleLockPropagatesRenameFailure(t *testing.T) {
+	lockPath := filepath.Join(t.TempDir(), "lock")
+	if err := os.WriteFile(lockPath, []byte("stale-holder"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if ok, err := ReclaimStaleLock(lockPath, `bad"name`, func(string) bool { return false }); err == nil || ok {
+		t.Fatalf("a hard rename failure must surface an error (ok=%v err=%v)", ok, err)
+	}
+	if _, err := os.Stat(lockPath); err != nil {
+		t.Fatalf("the lock file must be left in place on a failed rename: %v", err)
+	}
+}

internal/mcp/config.go

@@ -35,7 +35,7 @@ type Server struct {
 	// credential lookup uses it to avoid reusing legacy user tokens by name.
 	ProjectConfigured bool
 	// UnconfiguredDefault is true when this server is one of Zero's built-in
-	// defaults (e.g. keyless Exa) that the user never touched in their
+	// defaults (e.g. keyless Firecrawl) that the user never touched in their
 	// config — no credentials, no overrides. Callers use it to avoid warning
 	// loudly when a server nobody configured fails to connect.
 	UnconfiguredDefault bool

internal/mcp/config_test.go

@@ -1,8 +1,6 @@
 package mcp
 
 import (
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -92,7 +90,7 @@ func TestNormalizeConfigValidatesTransportBoundaries(t *testing.T) {
 
 func TestNormalizeConfigFlagsUnconfiguredDefault(t *testing.T) {
 	cfg := config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"exa": config.DefaultMCPServers()["exa"],
+		"firecrawl": config.DefaultMCPServers()["firecrawl"],
 		"web": {
 			Type: "http",
 			URL:  "https://example.com/mcp",
@@ -109,8 +107,8 @@ func TestNormalizeConfigFlagsUnconfiguredDefault(t *testing.T) {
 		byName[server.Name] = server
 	}
 
-	if !byName["exa"].UnconfiguredDefault {
-		t.Fatal("an untouched exa default should be flagged UnconfiguredDefault")
+	if !byName["firecrawl"].UnconfiguredDefault {
+		t.Fatal("an untouched firecrawl default should be flagged UnconfiguredDefault")
 	}
 	if byName["web"].UnconfiguredDefault {
 		t.Fatal("a server the user configured must not be flagged UnconfiguredDefault")
@@ -242,116 +240,3 @@ func TestCopyStringMapTrimsKeysAndPreservesValues(t *testing.T) {
 		t.Fatalf("copied[TOKEN] = %q, want value preserved verbatim", copied["TOKEN"])
 	}
 }
-
-// Startup behavior for the firecrawl -> exa default migration: a user who
-// disabled the retired default must end up with no Exa server to connect to,
-// not merely a disabled entry in the resolved config.
-func TestNormalizeConfigSkipsExaAfterLegacyFirecrawlDisable(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.ResolveMCP(config.ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	servers, err := NormalizeConfig(cfg)
-	if err != nil {
-		t.Fatalf("NormalizeConfig: %v", err)
-	}
-	for _, server := range servers {
-		if server.Name == "exa" {
-			t.Fatalf("exa must not be started after the user disabled the default it replaced: %#v", server)
-		}
-	}
-}
-
-// The same path with no legacy disable still starts Exa, so the migration
-// cannot quietly switch off the default for everyone else.
-func TestNormalizeConfigStartsExaWithoutLegacyDisable(t *testing.T) {
-	cfg, err := config.ResolveMCP(config.ResolveOptions{})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	servers, err := NormalizeConfig(cfg)
-	if err != nil {
-		t.Fatalf("NormalizeConfig: %v", err)
-	}
-	for _, server := range servers {
-		if server.Name == "exa" {
-			if !server.UnconfiguredDefault {
-				t.Fatalf("an untouched exa default should be flagged unconfigured: %#v", server)
-			}
-			return
-		}
-	}
-	t.Fatal("expected the exa default to be started out of the box")
-}
-
-// The failure path CodeRabbit flagged: a firecrawl entry that named only a
-// header relied on the retired default for its transport. Resolving it must
-// still produce a complete server — an incomplete one fails NormalizeConfig,
-// which takes down every other server's startup with it, not just this one.
-func TestNormalizeConfigResolvesPartialRetiredDefaultEntry(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"headers":{"Authorization":"Bearer k"}}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.ResolveMCP(config.ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	servers, err := NormalizeConfig(cfg)
-	if err != nil {
-		t.Fatalf("a header-only legacy entry must not break startup: %v", err)
-	}
-	var firecrawl *Server
-	var sawExa bool
-	for i := range servers {
-		switch servers[i].Name {
-		case "firecrawl":
-			firecrawl = &servers[i]
-		case "exa":
-			sawExa = true
-		}
-	}
-	if firecrawl == nil {
-		t.Fatalf("expected the customized firecrawl server to survive: %#v", servers)
-	}
-	if firecrawl.Type != ServerTypeHTTP || firecrawl.URL != "https://mcp.firecrawl.dev/v2/mcp" {
-		t.Fatalf("firecrawl lost the transport its entry relied on: %#v", *firecrawl)
-	}
-	if firecrawl.Headers["Authorization"] != "Bearer k" {
-		t.Fatalf("firecrawl lost the user's header: %#v", *firecrawl)
-	}
-	if !sawExa {
-		t.Fatal("the new exa default should still start alongside it")
-	}
-}
-
-// The mirror case: an entry that names its own stdio transport must not have
-// the retired http default grafted onto it, which would be rejected outright.
-func TestNormalizeConfigLeavesRetiredEntryWithOwnTransportAlone(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"command":"firecrawl-mcp"}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.ResolveMCP(config.ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	servers, err := NormalizeConfig(cfg)
-	if err != nil {
-		t.Fatalf("a self-hosted stdio entry must keep working: %v", err)
-	}
-	for _, server := range servers {
-		if server.Name != "firecrawl" {
-			continue
-		}
-		if server.Type != ServerTypeStdio || server.Command != "firecrawl-mcp" {
-			t.Fatalf("the user's own stdio transport was corrupted: %#v", server)
-		}
-		return
-	}
-	t.Fatalf("expected the self-hosted firecrawl server to survive: %#v", servers)
-}

internal/mcp/oauth.go

@@ -63,9 +63,8 @@ func tokenToStored(t oauth.Token) StoredToken {
 }
 
 // OAuthConfig describes how to authenticate to a remote MCP server using OAuth.
-// Endpoints may be discovered through RFC 9728 protected-resource metadata and
-// RFC 8414 authorization-server metadata; explicit values override or fill in
-// anything discovery cannot provide.
+// Endpoints may be discovered from the server's metadata document; explicit
+// values here override or fill in anything discovery cannot provide.
 type OAuthConfig struct {
 	ClientID              string
 	ClientSecret          string
@@ -86,11 +85,6 @@ type authServerMetadata struct {
 	TokenEndpoint         string   `json:"token_endpoint"`
 	RegistrationEndpoint  string   `json:"registration_endpoint"`
 	ScopesSupported       []string `json:"scopes_supported"`
-
-	protectedResourceURL         string
-	protectAuthorizationEndpoint bool
-	protectTokenEndpoint         bool
-	protectRegistrationEndpoint  bool
 }
 
 // pkceParams holds a PKCE verifier/challenge pair.
@@ -126,7 +120,7 @@ type authorizationFlow struct {
 // discoverAuthorizationServer fetches the RFC 8414 authorization server metadata
 // at the well-known path under baseURL, via the shared engine.
 func discoverAuthorizationServer(ctx context.Context, client *http.Client, baseURL string) (authServerMetadata, error) {
-	meta, err := oauth.DiscoverAuthorizationServer(ctx, withoutDiscoveryRedirects(client), baseURL)
+	meta, err := oauth.DiscoverAuthorizationServer(ctx, client, baseURL)
 	if err != nil {
 		return authServerMetadata{}, err
 	}
@@ -139,9 +133,10 @@ func discoverAuthorizationServer(ctx context.Context, client *http.Client, baseU
 	}, nil
 }
 
-// validateResolvedEndpoints applies the shared https/loopback scheme rule to
-// every non-empty endpoint in the resolved metadata. Protected-resource
-// discovery adds its stricter provenance-aware network rule below.
+// validateResolvedEndpoints applies the shared https/loopback endpoint rule to
+// every non-empty endpoint in the resolved metadata — configured or discovered
+// alike — so discovery metadata can never downgrade an MCP login to an insecure
+// or attacker-controlled authorization, token, or registration endpoint.
 func validateResolvedEndpoints(metadata authServerMetadata) error {
 	for _, ep := range []struct{ kind, url string }{
 		{"authorization", metadata.AuthorizationEndpoint},
@@ -158,43 +153,9 @@ func validateResolvedEndpoints(metadata authServerMetadata) error {
 	return nil
 }
 
-func validateProtectedDiscoveredEndpoints(ctx context.Context, metadata authServerMetadata) error {
-	if metadata.protectedResourceURL == "" {
-		return nil
-	}
-	policy, err := newOAuthDiscoveryNetworkPolicy(metadata.protectedResourceURL)
-	if err != nil {
-		return err
-	}
-	for _, endpoint := range []struct {
-		kind      string
-		url       string
-		protected bool
-	}{
-		{kind: "authorization", url: metadata.AuthorizationEndpoint, protected: metadata.protectAuthorizationEndpoint},
-		{kind: "token", url: metadata.TokenEndpoint, protected: metadata.protectTokenEndpoint},
-		{kind: "registration", url: metadata.RegistrationEndpoint, protected: metadata.protectRegistrationEndpoint},
-	} {
-		if !endpoint.protected || strings.TrimSpace(endpoint.url) == "" {
-			continue
-		}
-		parsed, parseErr := url.Parse(endpoint.url)
-		if parseErr != nil || parsed.Hostname() == "" {
-			return fmt.Errorf("mcp oauth: %s endpoint: %w", endpoint.kind, errUnsafeOAuthDiscoveryTarget)
-		}
-		if err := policy.validateLiteralHost(parsed.Hostname()); err != nil {
-			return fmt.Errorf("mcp oauth: %s endpoint: %w", endpoint.kind, err)
-		}
-		if _, err := policy.resolve(ctx, parsed.Hostname()); err != nil {
-			return fmt.Errorf("mcp oauth: %s endpoint: %w", endpoint.kind, err)
-		}
-	}
-	return nil
-}
-
-// resolveAuthorizationServer follows protected-resource metadata when the MCP
-// endpoint advertises it, falls back to direct authorization-server discovery
-// for legacy providers, then applies explicit config overrides.
+// resolveAuthorizationServer discovers metadata and applies explicit config
+// overrides. Configured endpoints take precedence over discovered ones, and act
+// as a fallback when discovery fails or omits a value.
 func resolveAuthorizationServer(ctx context.Context, client *http.Client, baseURL string, cfg OAuthConfig) (authServerMetadata, error) {
 	// When the config supplies both the authorization and token endpoints
 	// directly, skip network discovery entirely: there is nothing to discover,
@@ -213,40 +174,17 @@ func resolveAuthorizationServer(ctx context.Context, client *http.Client, baseUR
 		return metadata, nil
 	}
 
-	discoveryClient := withoutDiscoveryRedirects(client)
 	discoveryBase := strings.TrimSpace(cfg.IssuerURL)
-	protectedResourceDiscovery := false
 	if discoveryBase == "" {
-		issuer, found, protectedErr := discoverProtectedResourceAuthorizationServer(ctx, discoveryClient, baseURL)
-		if protectedErr != nil {
-			return authServerMetadata{}, protectedErr
-		}
-		if found {
-			discoveryBase = issuer
-			protectedResourceDiscovery = true
-			discoveryClient, protectedErr = newAdvertisedOAuthDiscoveryClient(discoveryClient, baseURL)
-			if protectedErr != nil {
-				return authServerMetadata{}, protectedErr
-			}
-		} else {
-			discoveryBase = baseURL
-		}
+		discoveryBase = baseURL
 	}
 
-	metadata, err := discoverAuthorizationServer(ctx, discoveryClient, discoveryBase)
+	metadata, err := discoverAuthorizationServer(ctx, client, discoveryBase)
 	if err != nil {
 		// Discovery failures are non-fatal when the config supplies the endpoints
 		// directly; otherwise surface the discovery error.
 		metadata = authServerMetadata{}
 	}
-	if protectedResourceDiscovery {
-		if strings.TrimSpace(metadata.Issuer) == "" {
-			return authServerMetadata{}, errors.New("mcp oauth: authorization server metadata is missing its required issuer")
-		}
-		if metadata.Issuer != discoveryBase {
-			return authServerMetadata{}, errors.New("mcp oauth: authorization server metadata issuer does not match protected resource metadata")
-		}
-	}
 
 	if endpoint := strings.TrimSpace(cfg.AuthorizationEndpoint); endpoint != "" {
 		metadata.AuthorizationEndpoint = endpoint
@@ -257,12 +195,6 @@ func resolveAuthorizationServer(ctx context.Context, client *http.Client, baseUR
 	if endpoint := strings.TrimSpace(cfg.RegistrationEndpoint); endpoint != "" {
 		metadata.RegistrationEndpoint = endpoint
 	}
-	if protectedResourceDiscovery {
-		metadata.protectedResourceURL = strings.TrimSpace(baseURL)
-		metadata.protectAuthorizationEndpoint = strings.TrimSpace(cfg.AuthorizationEndpoint) == ""
-		metadata.protectTokenEndpoint = strings.TrimSpace(cfg.TokenEndpoint) == ""
-		metadata.protectRegistrationEndpoint = strings.TrimSpace(cfg.RegistrationEndpoint) == ""
-	}
 
 	if strings.TrimSpace(metadata.AuthorizationEndpoint) == "" {
 		return authServerMetadata{}, errors.New("no authorization endpoint discovered or configured")
@@ -273,9 +205,6 @@ func resolveAuthorizationServer(ctx context.Context, client *http.Client, baseUR
 	if err := validateResolvedEndpoints(metadata); err != nil {
 		return authServerMetadata{}, err
 	}
-	if err := validateProtectedDiscoveredEndpoints(ctx, metadata); err != nil {
-		return authServerMetadata{}, err
-	}
 	return metadata, nil
 }
 
@@ -434,25 +363,10 @@ func Login(ctx context.Context, options LoginOptions) (StoredToken, error) {
 	}
 	defer listener.Close()
 	redirectURI := fmt.Sprintf("http://%s/callback", listener.Addr().String())
-	protectedEndpointClient := httpClient
-	if metadata.protectRegistrationEndpoint || metadata.protectTokenEndpoint {
-		protectedEndpointClient, err = newAdvertisedOAuthDiscoveryClient(httpClient, metadata.protectedResourceURL)
-		if err != nil {
-			return StoredToken{}, err
-		}
-	}
-	tokenClient := httpClient
-	if metadata.protectTokenEndpoint {
-		tokenClient = protectedEndpointClient
-	}
 
 	if strings.TrimSpace(cfg.ClientID) == "" {
 		if registration := strings.TrimSpace(metadata.RegistrationEndpoint); registration != "" {
-			registrationClient := httpClient
-			if metadata.protectRegistrationEndpoint {
-				registrationClient = protectedEndpointClient
-			}
-			clientID, clientSecret, regErr := registerClient(loginCtx, registrationClient, registration, redirectURI, cfg.Scopes)
+			clientID, clientSecret, regErr := registerClient(loginCtx, httpClient, registration, redirectURI, cfg.Scopes)
 			if regErr != nil {
 				return StoredToken{}, regErr
 			}
@@ -476,7 +390,7 @@ func Login(ctx context.Context, options LoginOptions) (StoredToken, error) {
 	}
 
 	flow := &authorizationFlow{
-		httpClient: tokenClient,
+		httpClient: httpClient,
 		metadata:   metadata,
 		config:     cfg,
 		pkce:       pkce,

internal/mcp/oauth_discovery_network.go

@@ -1,290 +0,0 @@
-package mcp
-
-import (
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"strings"
-)
-
-var errUnsafeOAuthDiscoveryTarget = errors.New("mcp oauth: refused non-public server-advertised discovery target")
-
-var nonPublicOAuthDiscoveryPrefixes = []netip.Prefix{
-	netip.MustParsePrefix("0.0.0.0/8"),
-	netip.MustParsePrefix("10.0.0.0/8"),
-	netip.MustParsePrefix("100.64.0.0/10"),
-	netip.MustParsePrefix("127.0.0.0/8"),
-	netip.MustParsePrefix("169.254.0.0/16"),
-	netip.MustParsePrefix("172.16.0.0/12"),
-	netip.MustParsePrefix("192.0.0.0/24"),
-	netip.MustParsePrefix("192.0.2.0/24"),
-	netip.MustParsePrefix("192.88.99.0/24"),
-	netip.MustParsePrefix("192.168.0.0/16"),
-	netip.MustParsePrefix("198.18.0.0/15"),
-	netip.MustParsePrefix("198.51.100.0/24"),
-	netip.MustParsePrefix("203.0.113.0/24"),
-	netip.MustParsePrefix("224.0.0.0/4"),
-	netip.MustParsePrefix("240.0.0.0/4"),
-	netip.MustParsePrefix("::/128"),
-	netip.MustParsePrefix("::1/128"),
-	netip.MustParsePrefix("100::/64"),
-	netip.MustParsePrefix("2001:2::/48"),
-	netip.MustParsePrefix("2001:db8::/32"),
-	netip.MustParsePrefix("fc00::/7"),
-	netip.MustParsePrefix("fe80::/10"),
-	netip.MustParsePrefix("ff00::/8"),
-}
-
-type oauthDiscoveryNetworkPolicy struct {
-	allowLoopback bool
-	lookupNetIP   func(context.Context, string, string) ([]netip.Addr, error)
-}
-
-type advertisedOAuthDiscoveryTransport struct {
-	base   http.RoundTripper
-	policy oauthDiscoveryNetworkPolicy
-}
-
-// newAdvertisedOAuthDiscoveryClient binds server-advertised discovery to the
-// public network. Loopback targets remain available only when the operator
-// explicitly configured a loopback MCP resource.
-func newAdvertisedOAuthDiscoveryClient(client *http.Client, resourceURL string) (*http.Client, error) {
-	policy, err := newOAuthDiscoveryNetworkPolicy(resourceURL)
-	if err != nil {
-		return nil, err
-	}
-	copied := withoutDiscoveryRedirects(client)
-	transport := copied.Transport
-	if transport == nil {
-		transport = http.DefaultTransport
-	}
-	copied.Transport = advertisedOAuthDiscoveryTransport{base: transport, policy: policy}
-	return copied, nil
-}
-
-func newOAuthDiscoveryNetworkPolicy(resourceURL string) (oauthDiscoveryNetworkPolicy, error) {
-	parsed, err := url.Parse(strings.TrimSpace(resourceURL))
-	if err != nil || parsed.Hostname() == "" {
-		return oauthDiscoveryNetworkPolicy{}, errors.New("mcp oauth: invalid MCP resource URL for discovery policy")
-	}
-	return oauthDiscoveryNetworkPolicy{allowLoopback: isExplicitOAuthLoopbackHost(parsed.Hostname())}, nil
-}
-
-func validateAdvertisedOAuthDiscoveryURL(resourceURL string, targetURL string) error {
-	policy, err := newOAuthDiscoveryNetworkPolicy(resourceURL)
-	if err != nil {
-		return err
-	}
-	parsed, err := url.Parse(targetURL)
-	if err != nil || parsed.Hostname() == "" {
-		return errUnsafeOAuthDiscoveryTarget
-	}
-	return policy.validateLiteralHost(parsed.Hostname())
-}
-
-func (transport advertisedOAuthDiscoveryTransport) RoundTrip(request *http.Request) (*http.Response, error) {
-	if request == nil || request.URL == nil {
-		return nil, errors.New("mcp oauth: discovery request has no URL")
-	}
-	if err := transport.policy.validateLiteralHost(request.URL.Hostname()); err != nil {
-		return nil, err
-	}
-
-	baseTransport, ok := transport.base.(*http.Transport)
-	if !ok {
-		return nil, errors.New("mcp oauth: cannot enforce discovery network policy with a custom HTTP transport")
-	}
-	addresses, err := transport.policy.resolve(request.Context(), request.URL.Hostname())
-	if err != nil {
-		return nil, err
-	}
-	var lastErr error
-	for index, address := range addresses {
-		attempt := request
-		if index > 0 && request.Body != nil {
-			if request.GetBody == nil {
-				break
-			}
-			body, bodyErr := request.GetBody()
-			if bodyErr != nil {
-				return nil, bodyErr
-			}
-			attempt = request.Clone(request.Context())
-			attempt.Body = body
-		}
-		response, roundTripErr := roundTripPinnedOAuthDiscovery(attempt, baseTransport, address)
-		if roundTripErr == nil {
-			return response, nil
-		}
-		lastErr = roundTripErr
-	}
-	if lastErr == nil {
-		lastErr = errUnsafeOAuthDiscoveryTarget
-	}
-	return nil, lastErr
-}
-
-func roundTripPinnedOAuthDiscovery(request *http.Request, base *http.Transport, address netip.Addr) (*http.Response, error) {
-	pinnedRequest := request.Clone(request.Context())
-	pinnedURL := *request.URL
-	originalHost := request.URL.Hostname()
-	port := request.URL.Port()
-	if port == "" {
-		switch strings.ToLower(request.URL.Scheme) {
-		case "http":
-			port = "80"
-		case "https":
-			port = "443"
-		default:
-			return nil, errUnsafeOAuthDiscoveryTarget
-		}
-	}
-	pinnedURL.Host = net.JoinHostPort(address.String(), port)
-	pinnedRequest.URL = &pinnedURL
-	if pinnedRequest.Host == "" {
-		pinnedRequest.Host = request.URL.Host
-	}
-
-	pinnedTransport := base.Clone()
-	pinnedTransport.DisableKeepAlives = true
-	var proxyURL *url.URL
-	if base.Proxy != nil {
-		var err error
-		proxyURL, err = base.Proxy(request)
-		if err != nil {
-			return nil, fmt.Errorf("mcp oauth: resolve discovery proxy: %w", err)
-		}
-		if proxyURL == nil {
-			pinnedTransport.Proxy = nil
-		} else {
-			pinnedTransport.Proxy = http.ProxyURL(proxyURL)
-		}
-	}
-	if pinnedTransport.TLSClientConfig == nil {
-		pinnedTransport.TLSClientConfig = &tls.Config{ServerName: originalHost} //nolint:gosec // standard verification remains enabled
-	} else {
-		pinnedTransport.TLSClientConfig = pinnedTransport.TLSClientConfig.Clone()
-		pinnedTransport.TLSClientConfig.ServerName = originalHost
-	}
-	// A custom TLS dialer must not resolve the advertised hostname again after
-	// the policy has pinned it. For an HTTPS proxy, however, that proxy remains
-	// the TLS first hop and the transport sends CONNECT to the pinned target.
-	dialContext := pinnedTransport.DialContext
-	if dialContext == nil {
-		dialContext = (&net.Dialer{}).DialContext
-	}
-	pinnedAddress := net.JoinHostPort(address.String(), port)
-	targetTLSConfig := pinnedTransport.TLSClientConfig
-	pinnedTransport.DialTLSContext = func(ctx context.Context, network string, address string) (net.Conn, error) {
-		if proxyURL != nil && strings.EqualFold(proxyURL.Scheme, "https") {
-			proxyTLSConfig := targetTLSConfig.Clone()
-			proxyTLSConfig.ServerName = proxyURL.Hostname()
-			return dialOAuthDiscoveryTLS(ctx, dialContext, network, address, proxyTLSConfig)
-		}
-		return dialOAuthDiscoveryTLS(ctx, dialContext, network, pinnedAddress, targetTLSConfig)
-	}
-	return pinnedTransport.RoundTrip(pinnedRequest)
-}
-
-func dialOAuthDiscoveryTLS(ctx context.Context, dialContext func(context.Context, string, string) (net.Conn, error), network string, address string, config *tls.Config) (net.Conn, error) {
-	connection, err := dialContext(ctx, network, address)
-	if err != nil {
-		return nil, err
-	}
-	tlsConnection := tls.Client(connection, config)
-	if err := tlsConnection.HandshakeContext(ctx); err != nil {
-		connection.Close()
-		return nil, err
-	}
-	return tlsConnection, nil
-}
-
-func (policy oauthDiscoveryNetworkPolicy) resolve(ctx context.Context, host string) ([]netip.Addr, error) {
-	if address, err := netip.ParseAddr(strings.Trim(host, "[]")); err == nil {
-		address = address.Unmap()
-		if err := policy.validateAddress(address); err != nil {
-			return nil, err
-		}
-		return []netip.Addr{address}, nil
-	}
-
-	lookupNetIP := policy.lookupNetIP
-	if lookupNetIP == nil {
-		lookupNetIP = net.DefaultResolver.LookupNetIP
-	}
-	addresses, err := lookupNetIP(ctx, "ip", host)
-	if err != nil {
-		return nil, errors.New("mcp oauth: resolve server-advertised discovery target failed")
-	}
-	if len(addresses) == 0 {
-		return nil, errors.New("mcp oauth: server-advertised discovery target resolved to no addresses")
-	}
-	explicitLoopback := isExplicitOAuthLoopbackHost(host)
-	resolved := make([]netip.Addr, 0, len(addresses))
-	for _, address := range addresses {
-		address = address.Unmap()
-		if explicitLoopback && !address.IsLoopback() {
-			return nil, errUnsafeOAuthDiscoveryTarget
-		}
-		if err := policy.validateAddress(address); err != nil {
-			return nil, err
-		}
-		resolved = append(resolved, address)
-	}
-	return resolved, nil
-}
-
-func (policy oauthDiscoveryNetworkPolicy) validateLiteralHost(host string) error {
-	normalized := strings.ToLower(strings.TrimSuffix(strings.Trim(host, "[]"), "."))
-	if normalized == "" {
-		return errUnsafeOAuthDiscoveryTarget
-	}
-	if isCloudMetadataHostname(normalized) {
-		return errUnsafeOAuthDiscoveryTarget
-	}
-	if isExplicitOAuthLoopbackHost(normalized) && !policy.allowLoopback {
-		return errUnsafeOAuthDiscoveryTarget
-	}
-	if address, err := netip.ParseAddr(normalized); err == nil {
-		return policy.validateAddress(address.Unmap())
-	}
-	return nil
-}
-
-func (policy oauthDiscoveryNetworkPolicy) validateAddress(address netip.Addr) error {
-	if policy.allowLoopback && address.IsLoopback() {
-		return nil
-	}
-	if !address.IsValid() || !address.IsGlobalUnicast() || address.IsPrivate() {
-		return errUnsafeOAuthDiscoveryTarget
-	}
-	for _, prefix := range nonPublicOAuthDiscoveryPrefixes {
-		if prefix.Contains(address) {
-			return errUnsafeOAuthDiscoveryTarget
-		}
-	}
-	return nil
-}
-
-func isExplicitOAuthLoopbackHost(host string) bool {
-	normalized := strings.ToLower(strings.TrimSuffix(strings.Trim(host, "[]"), "."))
-	if normalized == "localhost" || strings.HasSuffix(normalized, ".localhost") {
-		return true
-	}
-	address, err := netip.ParseAddr(normalized)
-	return err == nil && address.Unmap().IsLoopback()
-}
-
-func isCloudMetadataHostname(host string) bool {
-	switch strings.ToLower(strings.TrimSuffix(host, ".")) {
-	case "metadata", "metadata.google.internal", "metadata.azure.internal":
-		return true
-	default:
-		return false
-	}
-}

internal/mcp/oauth_discovery_network_test.go

@@ -1,180 +0,0 @@
-package mcp
-
-import (
-	"bufio"
-	"context"
-	"errors"
-	"io"
-	"net"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"strings"
-	"sync/atomic"
-	"testing"
-)
-
-func TestOAuthDiscoveryNetworkPolicyRejectsNonPublicAddresses(t *testing.T) {
-	policy := oauthDiscoveryNetworkPolicy{}
-	for _, value := range []string{
-		"127.0.0.1",
-		"10.0.0.1",
-		"169.254.169.254",
-		"192.0.2.10",
-		"224.0.0.1",
-		"::1",
-		"fc00::1",
-		"fe80::1",
-		"2001:db8::1",
-	} {
-		t.Run(value, func(t *testing.T) {
-			if err := policy.validateAddress(netip.MustParseAddr(value)); err == nil {
-				t.Fatalf("address %s should be rejected", value)
-			}
-		})
-	}
-	for _, value := range []string{"8.8.8.8", "2606:4700:4700::1111"} {
-		if err := policy.validateAddress(netip.MustParseAddr(value)); err != nil {
-			t.Fatalf("public address %s rejected: %v", value, err)
-		}
-	}
-	loopbackPolicy := oauthDiscoveryNetworkPolicy{allowLoopback: true}
-	if err := loopbackPolicy.validateAddress(netip.MustParseAddr("127.0.0.1")); err != nil {
-		t.Fatalf("explicit loopback resource should allow loopback discovery: %v", err)
-	}
-	if err := loopbackPolicy.validateAddress(netip.MustParseAddr("10.0.0.1")); err == nil {
-		t.Fatal("loopback development must not permit arbitrary private targets")
-	}
-}
-
-func TestProtectedDiscoveryRejectsNonPublicOAuthEndpoints(t *testing.T) {
-	for _, endpoint := range []struct {
-		name     string
-		metadata authServerMetadata
-	}{
-		{
-			name: "authorization",
-			metadata: authServerMetadata{
-				AuthorizationEndpoint:        "http://127.0.0.1/authorize",
-				protectAuthorizationEndpoint: true,
-			},
-		},
-		{
-			name: "token",
-			metadata: authServerMetadata{
-				TokenEndpoint:        "https://10.0.0.1/token",
-				protectTokenEndpoint: true,
-			},
-		},
-		{
-			name: "registration",
-			metadata: authServerMetadata{
-				RegistrationEndpoint:        "https://169.254.169.254/register",
-				protectRegistrationEndpoint: true,
-			},
-		},
-	} {
-		t.Run(endpoint.name, func(t *testing.T) {
-			endpoint.metadata.protectedResourceURL = "https://mcp.example/mcp"
-			if err := validateProtectedDiscoveredEndpoints(context.Background(), endpoint.metadata); err == nil {
-				t.Fatalf("protected %s endpoint should be rejected", endpoint.name)
-			}
-		})
-	}
-}
-
-func TestAdvertisedOAuthDiscoveryRejectsHostnameResolvingPrivateAtUseTime(t *testing.T) {
-	var dialed atomic.Bool
-	policy := oauthDiscoveryNetworkPolicy{
-		lookupNetIP: func(context.Context, string, string) ([]netip.Addr, error) {
-			return []netip.Addr{netip.MustParseAddr("10.0.0.12")}, nil
-		},
-	}
-	client := &http.Client{Transport: advertisedOAuthDiscoveryTransport{
-		base: &http.Transport{DialContext: func(context.Context, string, string) (net.Conn, error) {
-			dialed.Store(true)
-			return nil, io.EOF
-		}},
-		policy: policy,
-	}}
-
-	_, err := client.Get("https://auth.example/.well-known/oauth-authorization-server")
-	if err == nil || !strings.Contains(err.Error(), errUnsafeOAuthDiscoveryTarget.Error()) {
-		t.Fatalf("error = %v, want private-resolution rejection", err)
-	}
-	if dialed.Load() {
-		t.Fatal("private resolved address reached the dialer")
-	}
-}
-
-func TestAdvertisedOAuthDiscoveryPinsResolvedAddress(t *testing.T) {
-	const publicAddress = "93.184.216.34"
-	var dialedAddress string
-	policy := oauthDiscoveryNetworkPolicy{
-		lookupNetIP: func(context.Context, string, string) ([]netip.Addr, error) {
-			return []netip.Addr{netip.MustParseAddr(publicAddress)}, nil
-		},
-	}
-	baseTransport := &http.Transport{DialContext: func(_ context.Context, _, address string) (net.Conn, error) {
-		dialedAddress = address
-		clientConn, serverConn := net.Pipe()
-		go func() {
-			defer serverConn.Close()
-			reader := bufio.NewReader(serverConn)
-			for {
-				line, err := reader.ReadString('\n')
-				if err != nil || line == "\r\n" {
-					break
-				}
-			}
-			_, _ = io.WriteString(serverConn, "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\n{}")
-		}()
-		return clientConn, nil
-	}}
-	client := &http.Client{Transport: advertisedOAuthDiscoveryTransport{base: baseTransport, policy: policy}}
-
-	response, err := client.Get("http://auth.example/metadata")
-	if err != nil {
-		t.Fatalf("GET pinned discovery target: %v", err)
-	}
-	response.Body.Close()
-	if dialedAddress != net.JoinHostPort(publicAddress, "80") {
-		t.Fatalf("dialed %q, want resolved address", dialedAddress)
-	}
-}
-
-func TestPinnedOAuthDiscoveryPreservesHTTPSProxyFirstHop(t *testing.T) {
-	for _, test := range []struct {
-		name     string
-		proxy    string
-		firstHop string
-	}{
-		{name: "HTTP", proxy: "http://proxy.example:8080", firstHop: "proxy.example:8080"},
-		{name: "HTTPS", proxy: "https://proxy.example:8443", firstHop: "proxy.example:8443"},
-		{name: "SOCKS", proxy: "socks5://proxy.example:1080", firstHop: "proxy.example:1080"},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			proxyURL, err := url.Parse(test.proxy)
-			if err != nil {
-				t.Fatalf("parse proxy URL: %v", err)
-			}
-			var dialedAddress string
-			baseTransport := &http.Transport{
-				Proxy: http.ProxyURL(proxyURL),
-				DialContext: func(_ context.Context, _, address string) (net.Conn, error) {
-					dialedAddress = address
-					return nil, errors.New("stop after observing first hop")
-				},
-			}
-			request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "https://auth.example/metadata", nil)
-			if err != nil {
-				t.Fatalf("create request: %v", err)
-			}
-
-			_, _ = roundTripPinnedOAuthDiscovery(request, baseTransport, netip.MustParseAddr("93.184.216.34"))
-			if dialedAddress != test.firstHop {
-				t.Fatalf("dialed %q, want %s proxy first hop", dialedAddress, test.name)
-			}
-		})
-	}
-}