test(cli): isolate the exec image tests from the models.dev refresh

runExec starts a background models.dev download unless ZERO_DISABLE_MODELS_FETCH is set. TestRunExecImageAttachmentHistory moved the user directories into a TempDir by hand but left the fetch on, so a 5.7 MB download landed in the TempDir while its cleanup ran, and the macOS runner failed with "unlinkat ... directory not empty". The two older image tests had no isolation and fetched into the real user cache. Use isolateCLIUserState in all three, which also points the cache path into the fixture and turns the fetch off.
fix(workspaceindex): import gitsafe under the Twigpine module path (#1153 )
2026-11-08 01:09:46 -10:00 · 2026-10-17 19:17:58 +05:30 · 2026-10-17 16:59:52 +08:00 · 2026-10-17 16:59:21 +08:00 · 2026-10-17 07:14:03 +08:00 · 2026-10-17 07:13:21 +08:00
715 changed files with 8082 additions and 1996 deletions
@@ -1,11 +1,11 @@
 blank_issues_enabled: false
 contact_links:
  - name: Questions and setup help
-    url: https://github.com/Gitlawb/zero/discussions/categories/q-a
+    url: https://github.com/Twigpine/zero/discussions/categories/q-a
    about: Ask in Discussions Q&A. Include zero --version, your OS, provider/model, and zero doctor output for setup problems.
  - name: Feature ideas
-    url: https://github.com/Gitlawb/zero/discussions/categories/ideas
+    url: https://github.com/Twigpine/zero/discussions/categories/ideas
    about: Propose and discuss ideas in Discussions before opening a PR (Zero is in controlled development, see CONTRIBUTING.md).
  - name: Security vulnerability
-    url: https://github.com/Gitlawb/zero/security/advisories/new
+    url: https://github.com/Twigpine/zero/security/advisories/new
    about: Report security issues privately via GitHub Security Advisories (see SECURITY.md). Do not file a public issue.
@@ -5,7 +5,7 @@ body:
  - type: markdown
    attributes:
      value: |
-        New feature ideas start in [Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
+        New feature ideas start in [Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
        not here. This form is for the step after that: an idea that gained traction in Discussions,
        or one a maintainer asked to have tracked as an issue. Please link the discussion below.
        Do not begin implementation until the issue has been reviewed and marked with the
@@ -100,19 +100,21 @@ jobs:
          gh release create "$tag" --repo "$GITHUB_REPOSITORY" --title "$tag" --generate-notes 2>/dev/null || true
          gh release upload "$tag" dist/release/* --repo "$GITHUB_REPOSITORY" --clobber

-  # Publishes @gitlawb/zero to npm: first the five platform payloads (versions
-  # of the SAME package at suffixed versions like X.Y.Z-linux-x64, carrying the
-  # native binary + vendored helpers), then the wrapper at X.Y.Z whose
-  # optionalDependencies alias those platform versions. Platform versions MUST
-  # publish first — the wrapper pins them exactly, so the reverse order would
-  # open a window where installs resolve aliases that 404. See
-  # docs/NPM_PACKAGING.md for the full contract.
+  # Publishes the npm package named in package.json (@twigpine/zero): first
+  # the five platform payloads (versions of the SAME package at suffixed
+  # versions like X.Y.Z-linux-x64, carrying the native binary + vendored
+  # helpers), then the wrapper at X.Y.Z whose optionalDependencies alias those
+  # platform versions. Platform versions MUST publish first — the wrapper pins
+  # them exactly, so the reverse order would open a window where installs
+  # resolve aliases that 404. See docs/NPM_PACKAGING.md for the full contract.
  #
  # Auth is npm OIDC trusted publishing: no NPM_TOKEN secret. The package's
-  # npmjs.com settings must list this repo + workflow file as a trusted
-  # publisher, and provenance is then generated automatically. Note npm only
-  # allows configuring a trusted publisher on an EXISTING package, so the very
-  # first @gitlawb/zero publish is a one-time manual `npm publish` bootstrap.
+  # npmjs.com settings must list this repo + workflow file + the npm-publish
+  # environment as a trusted publisher, and provenance is then generated
+  # automatically. npm checks provenance against package.json `repository`,
+  # so that must name this repository. Note npm only allows configuring a
+  # trusted publisher on an EXISTING package, so a new package name starts
+  # with a one-time manual `npm publish` of an empty 0.0.0 placeholder.
  # Because the platform payloads are versions of the same package, they reuse
  # that single trusted-publisher configuration.
  publish-npm:
@@ -125,7 +127,7 @@ jobs:
    # maintainer approves it in the Actions UI before anything reaches npm.
    environment:
      name: npm-publish
-      url: https://www.npmjs.com/package/@gitlawb/zero
+      url: https://www.npmjs.com/package/@twigpine/zero
    permissions:
      contents: read
      id-token: write # OIDC token exchange for npm trusted publishing + provenance
@@ -201,47 +203,13 @@ jobs:
      - name: Assemble npm packages
        run: node scripts/npm/build-platform-packages.mjs --artifacts-dir dist/artifacts --out-dir dist/npm

-      # Platform versions are semver PRERELEASES of the wrapper version
-      # (X.Y.Z-linux-x64), so they must never publish under the default
-      # `latest` dist-tag — that would make `npm install @gitlawb/zero`
-      # deliver a platform payload as the CLI. Publish them under a dedicated
-      # tag and assert `latest` survived before the wrapper goes out.
-      - name: Publish platform packages to npm
+      # Platform payloads first under the `platform` dist-tag, then the wrapper,
+      # with the `latest` dist-tag checked before and after (platform versions
+      # are semver PRERELEASES of the wrapper version and must never become
+      # `latest`). npm applies publishes asynchronously, so the script waits
+      # until npm shows every platform version before the wrapper goes out,
+      # and until `latest` moves after it. Versions already on the registry
+      # are skipped, so "Re-run failed jobs" is safe after a partial publish.
+      - name: Publish npm packages
        shell: bash
-        run: |
-          version="$(node -p "require('./package.json').version")"
-          for dir in dist/npm/platforms/*/; do
-            echo "publishing ${dir}"
-            (cd "$dir" && npm publish --access public --tag platform)
-          done
-          # Tolerate a failed lookup (registry lag, or no latest tag yet on a
-          # bootstrap publish): under set -e a bare failure here would abort
-          # AFTER the platform payloads went out, leaving no wrapper and a
-          # re-run that fails on republishing existing versions. An empty
-          # value falls through the guard below.
-          latest="$(npm view @gitlawb/zero dist-tags.latest || true)"
-          case "$latest" in
-            "${version}-"*)
-              echo "::error::dist-tag latest points at platform version ${latest} — a platform publish clobbered it. Fix the dist-tag before the wrapper publish." >&2
-              exit 1
-              ;;
-          esac
-          echo "dist-tag latest is ${latest} (unchanged by platform publishes)."
-
-      - name: Publish wrapper to npm
-        shell: bash
-        run: |
-          version="$(node -p "require('./package.json').version")"
-          (cd dist/npm/wrapper && npm publish --access public)
-          # Confirm the wrapper owns `latest` (retry: registry metadata can lag
-          # a publish by a few seconds).
-          for attempt in 1 2 3 4 5; do
-            latest="$(npm view @gitlawb/zero dist-tags.latest || true)"
-            if [ "$latest" = "$version" ]; then
-              echo "dist-tag latest is ${version}."
-              exit 0
-            fi
-            sleep 5
-          done
-          echo "::error::dist-tag latest is ${latest}, expected ${version} after the wrapper publish." >&2
-          exit 1
+        run: scripts/npm/publish-packages.sh dist/npm
@@ -1 +1 @@
-{".":"0.9.0"}
+{".":"0.11.0"}
@@ -6,6 +6,70 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once the first release is
 tagged. Until then, source builds report the version `dev`.

+## [0.11.0](https://github.com/Twigpine/zero/compare/v0.10.0...v0.11.0) (2026-10-15)
+
+
+### Features
+
+* **providers:** add Concentrate provider preset ([#1147](https://github.com/Twigpine/zero/issues/1147)) ([61b0936](https://github.com/Twigpine/zero/commit/61b09364f0f45b0fa8aebaf0a6c3d1c55dbe01c3))
+
+
+### Bug Fixes
+
+* **cli:** let providers subcommands run with no active provider ([#1143](https://github.com/Twigpine/zero/issues/1143)) ([d1a0d04](https://github.com/Twigpine/zero/commit/d1a0d048ee2c1e7cbfb75160ec4c9f099f3c4472))
+* **npm:** wait for npm to apply each publish, and drop the one-time @gitlawb/zero steps ([#1145](https://github.com/Twigpine/zero/issues/1145)) ([8e363fc](https://github.com/Twigpine/zero/commit/8e363fcaa5d51bf5b5b244692dc61bf8d4ae8799))
+* **tui,cli:** stop a repository's git config from running programs in Zero's own git calls ([#1133](https://github.com/Twigpine/zero/issues/1133)) ([640d936](https://github.com/Twigpine/zero/commit/640d936bfbe00c4cd3017ca35fb7b5c15d91a1c5))
+* **workspaceindex:** skip git-ignored and build-cache dirs in Scan only ([#1117](https://github.com/Twigpine/zero/issues/1117)) ([c88c77b](https://github.com/Twigpine/zero/commit/c88c77bf701039dca01d9786bf5648d779c949b3))
+
+
+### Performance Improvements
+
+* **redaction:** add fast-path byte checks to eliminate regex allocations on clean strings ([#945](https://github.com/Twigpine/zero/issues/945)) ([ce2fcff](https://github.com/Twigpine/zero/commit/ce2fcffaf10d8e8c8c5a13e06fd7809f09fc9867))
+
+## [0.10.0](https://github.com/Twigpine/zero/compare/v0.9.0...v0.10.0) (2026-10-15)
+
+
+### Features
+
+* **notify:** make permission-prompt alerts on by default and discoverable ([#1001](https://github.com/Twigpine/zero/issues/1001)) ([7f8e5f0](https://github.com/Twigpine/zero/commit/7f8e5f08bb83371ce16cc54c97ab032a010026cf))
+* **npm:** publish as @twigpine/zero ([#1142](https://github.com/Twigpine/zero/issues/1142)) ([530563a](https://github.com/Twigpine/zero/commit/530563a0bb58d3cbadceb97b3ee234ef763124df))
+* **providers:** add GMI Cloud provider preset and partner listing ([#1127](https://github.com/Twigpine/zero/issues/1127)) ([1335ca6](https://github.com/Twigpine/zero/commit/1335ca6671023ecda81a3cfaae7e9f2ff5d6e0de))
+* **providers:** opt-in ZERO_RESPONSE_HEADER_TIMEOUT override for slow first-byte deployments ([#1106](https://github.com/Twigpine/zero/issues/1106)) ([ddc45f2](https://github.com/Twigpine/zero/commit/ddc45f2c8152fdd04b45dc11ed20d246fe7740a5))
+* **runtime:** add process-local per-model RPM admission limits ([#1116](https://github.com/Twigpine/zero/issues/1116)) ([eebb384](https://github.com/Twigpine/zero/commit/eebb384676fb567acc1f5a20dcbb17df8a03dc42))
+* **sessions:** add zero sessions prune, which never removes a session another process has open ([#1089](https://github.com/Twigpine/zero/issues/1089)) ([23c27e0](https://github.com/Twigpine/zero/commit/23c27e0778e3af54c04b8749d1eda846d3253f4e))
+
+
+### Bug Fixes
+
+* **acp:** persist the session permission mode across restarts ([#1134](https://github.com/Twigpine/zero/issues/1134)) ([bb96206](https://github.com/Twigpine/zero/commit/bb96206c2781e846fd13437113eec5790afe9c81)), closes [#1125](https://github.com/Twigpine/zero/issues/1125)
+* **acp:** persist token usage events for ACP sessions ([#1137](https://github.com/Twigpine/zero/issues/1137)) ([300cf62](https://github.com/Twigpine/zero/commit/300cf6275f8c94f06da3f00197d21cb8771842d9)), closes [#1118](https://github.com/Twigpine/zero/issues/1118)
+* **acp:** publish sub-run sessions loaded over ACP as view-only ([#1078](https://github.com/Twigpine/zero/issues/1078)) ([7f11491](https://github.com/Twigpine/zero/commit/7f11491078662b2d389c278f3ce5d41d956670c4))
+* **agent:** retry mid-stream transport aborts before tool dispatch ([#1076](https://github.com/Twigpine/zero/issues/1076)) ([b9ef1d2](https://github.com/Twigpine/zero/commit/b9ef1d271aa6ebc6d9adad2ef4ff0d695bb40da5))
+* **config:** sync atomic config replacements ([#1093](https://github.com/Twigpine/zero/issues/1093)) ([4d2e9f0](https://github.com/Twigpine/zero/commit/4d2e9f0d08472f7304652ef7896df587e1cc6c21))
+* **cron:** bound run history and read recent records from the tail ([#1094](https://github.com/Twigpine/zero/issues/1094)) ([42eb6ab](https://github.com/Twigpine/zero/commit/42eb6ab5fbe4ae9037f1f4cd42a00243c456a22e))
+* **cron:** preserve newer claims when overlapping runs complete ([#1090](https://github.com/Twigpine/zero/issues/1090)) ([2eb9d94](https://github.com/Twigpine/zero/commit/2eb9d94fac56d91d749ea4f96edcf1c87f79b48c))
+* **daemon:** bound pending sessions and prune on completion ([#1091](https://github.com/Twigpine/zero/issues/1091)) ([8a68660](https://github.com/Twigpine/zero/commit/8a68660161b04ce9668363faa14ff72c9fbad223))
+* **daemon:** do not retry workers that finished with a final exit code ([#1112](https://github.com/Twigpine/zero/issues/1112)) ([eefa978](https://github.com/Twigpine/zero/commit/eefa978f6183332b7416c70c25242bcdfba1a75c)), closes [#1100](https://github.com/Twigpine/zero/issues/1100)
+* **daemon:** stop worker process groups by their launch-time identity ([#1088](https://github.com/Twigpine/zero/issues/1088)) ([ab018b3](https://github.com/Twigpine/zero/commit/ab018b3098b5cb103cf8f90b8698d32a6687bdf7)), closes [#861](https://github.com/Twigpine/zero/issues/861)
+* **deps:** refresh the lockfile to patched hono and @hono/node-server ([#1080](https://github.com/Twigpine/zero/issues/1080)) ([aa52040](https://github.com/Twigpine/zero/commit/aa52040498e012c41d5e8f6027a91c18eff861d4))
+* **deps:** refresh the lockfile to patched shell-quote ([#1131](https://github.com/Twigpine/zero/issues/1131)) ([c56a4c4](https://github.com/Twigpine/zero/commit/c56a4c4e6e598504ab417e8cc4f5ab8d69f1b42f))
+* **execution:** reserve process capacity before launching ([#1092](https://github.com/Twigpine/zero/issues/1092)) ([bb3346a](https://github.com/Twigpine/zero/commit/bb3346a82883c19ed8815fe1e874f54950711d69))
+* **mcp:** forward image tool results on the existing image channel ([#1077](https://github.com/Twigpine/zero/issues/1077)) ([0324c1d](https://github.com/Twigpine/zero/commit/0324c1d4103328eb90cb24a0b582dba335255b5c))
+* **mcp:** refresh OAuth tokens for discovered endpoints and registered clients ([#1113](https://github.com/Twigpine/zero/issues/1113)) ([571af70](https://github.com/Twigpine/zero/commit/571af701bd3d8dfaf40f87b5b112b25e7def5b29)), closes [#1101](https://github.com/Twigpine/zero/issues/1101)
+* **oauth:** give every loopback callback server the bounded shutdown ([#1079](https://github.com/Twigpine/zero/issues/1079)) ([5473301](https://github.com/Twigpine/zero/commit/547330197b20ece591e077e876a4b8ffd015cb6e))
+* **providers:** send stable session headers to OpenCode ([#1060](https://github.com/Twigpine/zero/issues/1060)) ([99721c7](https://github.com/Twigpine/zero/commit/99721c762f37cd43ac511007a5f51d1846df959e))
+* **redaction:** redact adjacent AWS keys glued end to end ([#1095](https://github.com/Twigpine/zero/issues/1095)) ([df67ede](https://github.com/Twigpine/zero/commit/df67edec13345b73a85327adc003cacc7bdd8009))
+* **redaction:** redact credentials split by an invisible character ([#1067](https://github.com/Twigpine/zero/issues/1067)) ([e20b762](https://github.com/Twigpine/zero/commit/e20b7624261cef8336a8eb0fbdd44d536ad77fc2))
+* **sandbox:** say when a session's sandbox enforcement is degraded ([#1082](https://github.com/Twigpine/zero/issues/1082)) ([6b5852d](https://github.com/Twigpine/zero/commit/6b5852dc18bb256af1f25745697c2f2e3ea6f112))
+* **search:** redact every text field of session metadata, not ten of thirty ([#1073](https://github.com/Twigpine/zero/issues/1073)) ([9520f2b](https://github.com/Twigpine/zero/commit/9520f2bad7e09ce4a8d0d42be7ce77d2ae928ddd))
+* **security:** harden shell flag parsing, write roots, and formatters ([#1066](https://github.com/Twigpine/zero/issues/1066)) ([ac5fe0d](https://github.com/Twigpine/zero/commit/ac5fe0d21849b0f74af428dd3ca12e3b80a8b7aa))
+* **sessions:** keep a session lease for the life of the process, not of the Store ([#1144](https://github.com/Twigpine/zero/issues/1144)) ([883e5be](https://github.com/Twigpine/zero/commit/883e5bec24dac791d1d60618c7f4927f4659b687))
+* **tools:** hint when Windows resolves POSIX paths under root ([#1063](https://github.com/Twigpine/zero/issues/1063)) ([0c6f179](https://github.com/Twigpine/zero/commit/0c6f179a8443d4dfdfbbefe5cc6caf11c2a525f0))
+* **tui:** bound live dictation regions ([#985](https://github.com/Twigpine/zero/issues/985)) ([feb9927](https://github.com/Twigpine/zero/commit/feb992757c582c68f0397e070e206d4bf07071e1))
+* **tui:** show provider ownership in Recent and Favorites ([#1083](https://github.com/Twigpine/zero/issues/1083)) ([1697b7a](https://github.com/Twigpine/zero/commit/1697b7a5ce948e781877cdbe9223adac62c3fde6))
+* **tui:** stop held peer message Allow/Deny from deadlocking Update ([#1111](https://github.com/Twigpine/zero/issues/1111)) ([a195e88](https://github.com/Twigpine/zero/commit/a195e8848cec1a27b4fe1789ecc572b943c32186)), closes [#1099](https://github.com/Twigpine/zero/issues/1099)
+* unbreak main CI (cron claim tests, Go 1.26.9) ([#1124](https://github.com/Twigpine/zero/issues/1124)) ([2c418fc](https://github.com/Twigpine/zero/commit/2c418fc8ff6763de16703128f372fe526fddd331))
+
 ## [0.9.0](https://github.com/Gitlawb/zero/compare/v0.8.0...v0.9.0) (2026-09-15)


@@ -9,9 +9,9 @@ reports, feature requests, reproduction details, logs, and discussion on existin
 issues.

 Questions and setup help belong in
-[GitHub Discussions](https://github.com/Gitlawb/zero/discussions) (see
+[GitHub Discussions](https://github.com/Twigpine/zero/discussions) (see
 [SUPPORT.md](SUPPORT.md)), not in the issue tracker. Feature ideas start in the
-[Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas) category;
+[Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) category;
 an idea that gains traction there is the path to an approved issue and,
 eventually, an accepted PR.

@@ -41,7 +41,7 @@ There are three primary ways to contribute:

 1. Open a bug report with clear reproduction steps.
 2. Propose a feature in
-   [Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
+   [Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
   describing the problem, use case, and expected behavior. A feature-request
   issue is filed only after the idea gains traction there or a maintainer asks
   for one.
@@ -193,7 +193,7 @@ Clear bug reports are the most useful way to help the project during this phase.
 ## Submitting a Feature Request

 Feature requests start as a thread in
-[Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
+[Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
 not as an issue. The feature-request issue form exists for the step AFTER that:
 when an idea has gained traction in Discussions or a maintainer has asked for an
 issue to track it. Whether in the discussion or the eventual issue, please
@@ -222,7 +222,7 @@ contribution phase.

 General questions, setup help, and "is this a bug or my config" uncertainty all
 go to
-[Discussions Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a).
+[Discussions Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a).
 If you are unsure whether a proposed code change is appropriate, raise it in
 Discussions Ideas or on the relevant issue first and ask. Please keep discussion
 focused, specific, and respectful of maintainer time.
@@ -116,7 +116,7 @@ zero exec --output-format stream-json < turns.jsonl
 ### npm

 ```bash
-npm install -g @gitlawb/zero
+npm install -g @twigpine/zero
 zero
 ```

@@ -130,18 +130,30 @@ matching GitHub Release whenever it is missing. Windows on ARM runs the x64
 build under emulation. See [docs/NPM_PACKAGING.md](docs/NPM_PACKAGING.md) for
 how the package is put together.

+Installed Zero as `@gitlawb/zero`? The package moved to `@twigpine/zero` in
+0.10.0 and the old name gets no further releases. Both packages provide the
+`zero` command, so quit any running `zero`, then remove the old package first:
+
+```bash
+npm uninstall -g @gitlawb/zero
+npm install -g @twigpine/zero
+```
+
+Your config, sessions, and logins are kept; they live outside the package. For
+Bun, pnpm, and yarn, see [docs/INSTALL.md](docs/INSTALL.md#moving-from-gitlawbzero).
+
 ### Install scripts

 Linux/macOS:

 ```bash
-curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
 ```

 Windows PowerShell:

 ```powershell
-irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
 ```

 ### From source
@@ -149,7 +161,7 @@ irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | ie
 Source builds require Go 1.26.9+.

 ```bash
-git clone https://github.com/Gitlawb/zero.git
+git clone https://github.com/Twigpine/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -161,17 +173,18 @@ If you are testing before the first public release, build from source:
 go build -o zero ./cmd/zero
 ```

-On Linux, build the sandbox helper too if you want native sandboxing:
+On Linux, native sandboxing needs Bubblewrap. The main `zero` binary re-executes
+itself as the helper when `zero-linux-sandbox` is absent. A separate helper next
+to `zero` or on `PATH` still takes precedence:

 ```bash
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
-go build -o zero-seccomp ./cmd/zero-seccomp   # optional compatibility wrapper
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # optional
+go build -o zero-seccomp ./cmd/zero-seccomp               # optional compatibility wrapper
 ```

-Put `zero` and `zero-linux-sandbox` in the same directory on `PATH`
-(`~/.local/bin` is a good default). macOS does not need an extra helper binary.
-Windows source builds can use the main `zero.exe` as their sandbox helper; release
-archives still ship standalone Windows helper executables.
+Put `zero` on `PATH` (`~/.local/bin` is a good default). macOS does not need an
+extra helper binary. Windows source builds can use the main `zero.exe` as their
+sandbox helper; release archives still ship standalone Windows helper executables.

 More install details: [docs/INSTALL.md](docs/INSTALL.md).

@@ -204,6 +217,7 @@ export AIMLAPI_API_KEY=...
 export LONGCAT_API_KEY=...
 export FIREWORKS_API_KEY=...
 export GMI_API_KEY=...
+export CONCENTRATE_API_KEY=...
 export MINIMAX_API_KEY=...
 export MINIMAXI_API_KEY=...
 ```
@@ -232,6 +246,12 @@ To configure GMI Cloud directly, run:
 zero providers setup gmicloud --set-active
 ```

+To configure Concentrate directly, run:
+
+```bash
+zero providers setup concentrate --set-active
+```
+
 MiniMax presets use the Anthropic-compatible endpoints for the global and China
 regions:

@@ -526,19 +546,19 @@ go run ./cmd/zero-release build --goos windows --goarch amd64 --output dist/zero
 Real-time chat happens on the [Discord server](https://discord.gg/CaQDS6wdFn).

 Questions, setup help, ideas, and sharing all live in
-[GitHub Discussions](https://github.com/Gitlawb/zero/discussions):
+[GitHub Discussions](https://github.com/Twigpine/zero/discussions):

 | Category | Use it for |
 |---|---|
-| [Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a) | Setup help, provider/model configuration, "how do I" questions |
-| [Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas) | Feature proposals and design discussion before any PR |
-| [Show and tell](https://github.com/Gitlawb/zero/discussions/categories/show-and-tell) | Your skills, plugins, MCP setups, themes, and workflows |
-| [Announcements](https://github.com/Gitlawb/zero/discussions/categories/announcements) | Releases and project news from the maintainers |
+| [Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) | Setup help, provider/model configuration, "how do I" questions |
+| [Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) | Feature proposals and design discussion before any PR |
+| [Show and tell](https://github.com/Twigpine/zero/discussions/categories/show-and-tell) | Your skills, plugins, MCP setups, themes, and workflows |
+| [Announcements](https://github.com/Twigpine/zero/discussions/categories/announcements) | Releases and project news from the maintainers |

 For a good Q&A answer fast, include `zero --version`, your OS and install
 method, the provider/model in use, and `zero doctor` output. See
 [SUPPORT.md](SUPPORT.md). Bugs belong in
-[issues](https://github.com/Gitlawb/zero/issues/new/choose); security reports
+[issues](https://github.com/Twigpine/zero/issues/new/choose); security reports
 follow [SECURITY.md](SECURITY.md), never a public thread.

 ## Contributing
@@ -105,24 +105,33 @@ zero exec --output-format stream-json < turns.jsonl
 ### npm

 ```bash
-npm install -g @gitlawb/zero
+npm install -g @twigpine/zero
 zero
 ```

 npm 包是一个小型包装器，其平台构建（Linux 和 macOS 的 x64/arm64、Windows 的 x64，包含浏览器/终端控制辅助工具）作为可选依赖直接从 npm registry 安装——没有安装脚本，也不会从 npm 之外下载任何内容。Bun、pnpm 和 yarn 的行为完全一致，无需任何信任或批准步骤。跳过可选依赖的安装（`--omit=optional`）也能工作：只要二进制文件缺失，包装器就会从对应的 GitHub Release 下载。Windows on ARM 通过模拟运行 x64 构建。详见 [docs/NPM_PACKAGING.md](docs/NPM_PACKAGING.md)。

+之前通过 `@gitlawb/zero` 安装过 Zero？从 0.10.0 起，npm 包已迁移到 `@twigpine/zero`，旧包名不再发布新版本。两个包都提供 `zero` 命令，所以请先退出正在运行的 `zero`，再卸载旧包：
+
+```bash
+npm uninstall -g @gitlawb/zero
+npm install -g @twigpine/zero
+```
+
+配置、会话和登录信息都会保留，它们存放在包之外。Bun、pnpm 和 yarn 的命令见 [docs/INSTALL.md](docs/INSTALL.md#moving-from-gitlawbzero)。
+
 ### 安装脚本

 Linux/macOS：

 ```bash
-curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
 ```

 Windows PowerShell：

 ```powershell
-irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
 ```

 ### 从源码构建
@@ -130,7 +139,7 @@ irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | ie
 源码构建需要 Go 1.26.9+。

 ```bash
-git clone https://github.com/Gitlawb/zero.git
+git clone https://github.com/Twigpine/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -141,14 +150,14 @@ go run ./cmd/zero
 go build -o zero ./cmd/zero
 ```

-在 Linux 上，如果你需要原生沙箱，还需要构建沙箱辅助程序：
+在 Linux 上，原生沙箱需要 Bubblewrap。主程序 `zero` 在找不到 `zero-linux-sandbox` 时会以自身作为辅助进程重新执行。同目录或 PATH 上的独立 helper 仍优先：

 ```bash
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
-go build -o zero-seccomp ./cmd/zero-seccomp   # 可选的兼容性包装器
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # 可选
+go build -o zero-seccomp ./cmd/zero-seccomp               # 可选的兼容性包装器
 ```

-将 `zero` 和 `zero-linux-sandbox` 放在 `PATH` 上的同一目录中（`~/.local/bin` 是一个好的默认选择）。macOS 不需要额外的辅助二进制文件。Windows 源码构建可以使用主 `zero.exe` 作为沙箱辅助程序；发布包仍然附带独立的 Windows 辅助可执行文件。
+将 `zero` 放在 `PATH` 上（`~/.local/bin` 是一个好的默认选择）。macOS 不需要额外的辅助二进制文件。Windows 源码构建可以使用主 `zero.exe` 作为沙箱辅助程序；发布包仍然附带独立的 Windows 辅助可执行文件。

 更多安装细节：[docs/INSTALL.md](docs/INSTALL.md)。

@@ -177,6 +186,7 @@ export ANTHROPIC_API_KEY=...
 export GEMINI_API_KEY=...
 export LONGCAT_API_KEY=...
 export GMI_API_KEY=...
+export CONCENTRATE_API_KEY=...
 ```

 要直接配置美团 LongCat（LongCat-2.0），运行：
@@ -191,6 +201,12 @@ zero providers setup longcat --set-active
 zero providers setup gmicloud --set-active
 ```

+要直接配置 Concentrate，运行：
+
+```bash
+zero providers setup concentrate --set-active
+```
+
 对于本地模型，运行 Ollama、LM Studio 或 [Atomic Chat](https://atomic.chat) 桌面应用，
 然后使用 `zero setup` 或 `zero providers detect`。使用 Atomic Chat 时，请先加载模型并启用
 本地 OpenAI 兼容 API（默认地址为 `http://127.0.0.1:1337/v1`），再选择 `atomic-chat-local`。
@@ -358,14 +374,14 @@ go run ./cmd/zero-release build --goos windows --goarch amd64 --output dist/zero
 实时交流在 [Discord 服务器](https://discord.gg/CaQDS6wdFn) 进行。

 提问、安装帮助、想法和分享都在
-[GitHub Discussions](https://github.com/Gitlawb/zero/discussions)：
+[GitHub Discussions](https://github.com/Twigpine/zero/discussions)：

 | 分类 | 用途 |
 |---|---|
-| [Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a) | 安装帮助、提供商/模型配置、"如何做"类问题 |
-| [Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas) | 功能提议和 PR 之前的设计讨论 |
-| [Show and tell](https://github.com/Gitlawb/zero/discussions/categories/show-and-tell) | 你的技能、插件、MCP 配置、主题和工作流 |
-| [Announcements](https://github.com/Gitlawb/zero/discussions/categories/announcements) | 维护者发布的版本和项目动态 |
+| [Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) | 安装帮助、提供商/模型配置、"如何做"类问题 |
+| [Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) | 功能提议和 PR 之前的设计讨论 |
+| [Show and tell](https://github.com/Twigpine/zero/discussions/categories/show-and-tell) | 你的技能、插件、MCP 配置、主题和工作流 |
+| [Announcements](https://github.com/Twigpine/zero/discussions/categories/announcements) | 维护者发布的版本和项目动态 |

 ## 贡献

@@ -2,8 +2,8 @@

 ## Questions, setup help, configuration

-Ask in [GitHub Discussions](https://github.com/Gitlawb/zero/discussions). Use
-[Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a) so answers can
+Ask in [GitHub Discussions](https://github.com/Twigpine/zero/discussions). Use
+[Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) so answers can
 be marked and found by the next person.

 The fastest way to a useful answer is to include:
@@ -18,19 +18,19 @@ The fastest way to a useful answer is to include:
 ## Bugs

 If Zero does something wrong (crashes, wrong output, broken behavior), file a
-[bug report](https://github.com/Gitlawb/zero/issues/new/choose). If you are not
+[bug report](https://github.com/Twigpine/zero/issues/new/choose). If you are not
 sure whether it is a bug or a setup problem, start in Discussions and we will
 promote it to an issue if it is one.

 ## Feature ideas

 Start a thread in
-[Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas). Zero is
+[Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas). Zero is
 in controlled development (see CONTRIBUTING.md), so discussing an idea first is
 also the path to getting a PR accepted.

 ## Security issues

 Never file a public issue or discussion. Report privately via
-[GitHub Security Advisories](https://github.com/Gitlawb/zero/security/advisories/new)
+[GitHub Security Advisories](https://github.com/Twigpine/zero/security/advisories/new)
 (see SECURITY.md).
@@ -2,7 +2,7 @@ name: ZERO
 description: >-
  Run the ZERO coding agent headlessly in a GitHub workflow. ZERO is
  model- and provider-agnostic: you supply the provider and API key as inputs.
-author: Gitlawb
+author: Twigpine

 branding:
  icon: terminal
@@ -110,7 +110,7 @@ inputs:
  zero-repo:
    description: Repository to install the ZERO release from (owner/repo).
    required: false
-    default: Gitlawb/zero
+    default: Twigpine/zero

 outputs:
  exit-code:
@@ -1,11 +1,63 @@
 #!/usr/bin/env node

 import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync, writeSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';

+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
+const CURRENT_PACKAGE_NAME = '@twigpine/zero';
+// The npm package moved from @gitlawb/zero to @twigpine/zero in 0.10.0. That
+// release was also published once under the old name, so 0.9.0's `zero
+// upgrade` and anyone still installing the old name land on a working build
+// that says where the package went (docs/NPM_PACKAGING.md). Nothing is
+// published under the old name after that.
+const LEGACY_PACKAGE_NAME = '@gitlawb/zero';
+
+// The npm name this wrapper was published under, read from its own
+// package.json so the name lives in one place. The platform payload alias and
+// every reinstall hint below derive from it.
+function readPackageName(root) {
+  try {
+    const { name } = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+    if (typeof name === 'string' && name !== '') return name;
+  } catch {
+    // An unreadable manifest must not stop the CLI from launching.
+  }
+  return CURRENT_PACKAGE_NAME;
+}
+
+const packageName = readPackageName(packageRoot);
+
+// Same note as legacyPackageSwitchMessage in internal/update/installmethod.go.
+// Uninstalling first is the only safe order: both packages own the `zero` bin,
+// so npm refuses to install the new one over the old (EEXIST), and forcing it
+// lets a later uninstall of the old package delete the shared bin.
+function legacyPackageNotice() {
+  return (
+    `[zero] Zero has moved to ${CURRENT_PACKAGE_NAME} on npm, and ${LEGACY_PACKAGE_NAME} gets no further releases.\n` +
+    'To keep getting updates, quit zero and run:\n' +
+    `  npm uninstall -g ${LEGACY_PACKAGE_NAME}\n` +
+    `  npm install -g ${CURRENT_PACKAGE_NAME}\n` +
+    'Uninstall first: both packages provide the `zero` command. With bun, pnpm or yarn, use its global remove and add commands instead.\n'
+  );
+}
+
+// Printed when the wrapper exits rather than before zero starts, because the
+// TUI takes over the screen and would hide anything printed first. Only on a
+// terminal, so scripts that capture stderr see nothing new. `zero update` and
+// `zero upgrade` print the same note themselves.
+if (packageName === LEGACY_PACKAGE_NAME && !['update', 'upgrade'].includes(process.argv[2])) {
+  process.on('exit', () => {
+    if (process.stderr.isTTY || process.env.ZERO_WRAPPER_SIMULATE_TTY === '1') {
+      // Synchronous: an exit handler cannot wait for an asynchronous write.
+      writeSync(2, legacyPackageNotice());
+    }
+  });
+}
+
 function zeroBinaryName(platform = process.platform) {
  return platform === 'win32' ? 'zero.exe' : 'zero';
 }
@@ -81,10 +133,10 @@ function bunRecoveryParagraph() {
  return (
    'You installed with Bun, which does not run dependency lifecycle scripts\n' +
    'by default. Trust the package to run the blocked postinstall:\n' +
-    '  bun pm trust @gitlawb/zero       (project install)\n' +
-    '  bun pm -g trust @gitlawb/zero    (global install)\n' +
+    `  bun pm trust ${packageName}       (project install)\n` +
+    `  bun pm -g trust ${packageName}    (global install)\n` +
    'On Bun versions without `bun pm trust`, add\n' +
-    '  "trustedDependencies": ["@gitlawb/zero"]\n' +
+    `  "trustedDependencies": ["${packageName}"]\n` +
    'to your project package.json and reinstall.\n' +
    '\n'
  );
@@ -93,14 +145,14 @@ function bunRecoveryParagraph() {
 function buildFromSourceParagraph() {
  return (
    'If this platform has no prebuilt binary, build from source:\n' +
-    'https://github.com/Gitlawb/zero (go run ./cmd/zero, requires Go 1.26+).'
+    'https://github.com/Twigpine/zero (go run ./cmd/zero, requires Go 1.26+).'
  );
 }

 function missingBinaryContextParagraph() {
  return (
-    'Normally npm installs it as an optional dependency of @gitlawb/zero\n' +
-    `(@gitlawb/zero-${process.platform}-${process.arch}), and the wrapper can\n` +
+    `Normally npm installs it as an optional dependency of ${packageName}\n` +
+    `(${packageName}-${process.platform}-${process.arch}), and the wrapper can\n` +
    'also download it from the GitHub Release when it is missing.'
  );
 }
@@ -113,7 +165,7 @@ function missingNativeRecoveryParagraphs(postinstallScript) {
    '\n' +
    'Things to try:\n' +
    '  - reinstall without omitting optional dependencies:\n' +
-    '      npm install -g @gitlawb/zero\n' +
+    `      npm install -g ${packageName}\n` +
    '  - run the downloader manually (needs write access to the package dir):\n' +
    `      node "${postinstallScript}"\n` +
    '\n' +
@@ -182,12 +234,12 @@ function missingNativeDoctorTextReport(postinstallScript) {
  );
 }

-// The platform payload is a version of @gitlawb/zero itself, installed under
-// an npm: alias (see docs/NPM_PACKAGING.md). The alias name is derived from
+// The platform payload is a version of this same package, installed under an
+// npm: alias (see docs/NPM_PACKAGING.md). The alias name is derived from
 // process.platform/process.arch, so an unsupported platform simply fails to
 // resolve and we fall through to the downloader.
 function platformPackageBinary() {
-  const aliasedName = `@gitlawb/zero-${process.platform}-${process.arch}`;
+  const aliasedName = `${packageName}-${process.platform}-${process.arch}`;
  let manifestPath;
  try {
    manifestPath = createRequire(import.meta.url).resolve(`${aliasedName}/package.json`);
@@ -227,8 +279,6 @@ function downloadMissingBinary(packageRoot) {
  });
 }

-const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-
 function resolveNativeBinary() {
  const fromPlatformPackage = platformPackageBinary();
  if (fromPlatformPackage) return fromPlatformPackage;
@@ -5,7 +5,7 @@ package main
 import (
 	"os"

-	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sandbox"
 )

 func main() {
@@ -11,7 +11,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/Gitlawb/zero/internal/perfbench"
+	"github.com/Twigpine/zero/internal/perfbench"
 )

 const (
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/perfbench"
+	"github.com/Twigpine/zero/internal/perfbench"
 )

 func TestParseArgsUsesCliAndEnvOverrides(t *testing.T) {
@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"strings"

-	"github.com/Gitlawb/zero/internal/perfbench"
+	"github.com/Twigpine/zero/internal/perfbench"
 )

 // taskOptions configures the `zero-perf-bench tasks` subcommand: the reproducible
@@ -9,8 +9,8 @@ import (
 	"path/filepath"
 	"strings"

-	"github.com/Gitlawb/zero/internal/execprofile"
-	"github.com/Gitlawb/zero/internal/perfbench"
+	"github.com/Twigpine/zero/internal/execprofile"
+	"github.com/Twigpine/zero/internal/perfbench"
 )

 // turnOptions configures the `zero-perf-bench turn` subcommand: the per-turn
@@ -6,7 +6,7 @@ import (
 	"os"
 	"strings"

-	"github.com/Gitlawb/zero/internal/review"
+	"github.com/Twigpine/zero/internal/review"
 )

 func main() {
@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"strings"

-	"github.com/Gitlawb/zero/internal/release"
+	"github.com/Twigpine/zero/internal/release"
 )

 func main() {
@@ -12,7 +12,7 @@ import (
 	"os/exec"
 	"syscall"

-	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sandbox"
 )

 func main() {
@@ -3,7 +3,7 @@ package main
 import (
 	"os"

-	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sandbox"
 )

 func main() {
@@ -3,7 +3,7 @@ package main
 import (
 	"os"

-	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sandbox"
 )

 func main() {
@@ -3,9 +3,13 @@ package main
 import (
 	"os"

-	"github.com/Gitlawb/zero/internal/cli"
+	"github.com/Twigpine/zero/internal/cli"
+	"github.com/Twigpine/zero/internal/sandbox"
 )

 func main() {
+	if len(os.Args) > 1 && os.Args[1] == sandbox.LinuxSandboxHelperSubcommand {
+		os.Exit(sandbox.RunLinuxSandboxHelper(os.Args[1:], os.Stderr))
+	}
 	os.Exit(cli.Run(os.Args[1:], os.Stdout, os.Stderr))
 }
@@ -28,7 +28,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: Gitlawb/zero@v1
+      - uses: Twigpine/zero@v1
        with:
          prompt: ${{ inputs.task }}
          provider: openai
@@ -66,7 +66,7 @@ jobs:
 | `github-token` | no | `${{ github.token }}` | Token used to post a PR comment. Requires `pull-requests: write`. |
 | `working-directory` | no | `${{ github.workspace }}` | Directory to run ZERO in. |
 | `zero-version` | no | (action ref → `latest`) | ZERO release version/tag to install, e.g. `v1.2.3` or `latest`. |
-| `zero-repo` | no | `Gitlawb/zero` | Repository to install the ZERO release from. |
+| `zero-repo` | no | `Twigpine/zero` | Repository to install the ZERO release from. |

 ## Outputs

@@ -101,7 +101,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: Gitlawb/zero@v1
+      - uses: Twigpine/zero@v1
        with:
          prompt: |
            Investigate this issue and propose a fix.
@@ -134,7 +134,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: Gitlawb/zero@v1
+      - uses: Twigpine/zero@v1
        id: zero
        with:
          prompt-file: .github/zero/upgrade-deps.md
@@ -176,7 +176,7 @@ jobs:
 - **Least-privilege tokens.** Grant only the permissions the workflow needs
  (`contents: write` to edit files, `pull-requests: write` to comment). The
  default `GITHUB_TOKEN` is scoped to the repository.
- **Pin the action.** Reference a tag (`Gitlawb/zero@v1`) or a commit SHA so a
+- **Pin the action.** Reference a tag (`Twigpine/zero@v1`) or a commit SHA so a
  workflow run uses a known ZERO version. `zero-version` lets you pin the
  installed binary independently of the action ref.
 - **Linux and macOS runners** are supported; Windows runners are rejected with a
@@ -5,11 +5,11 @@ blessed one.

 | Method | Command | Self-update |
 | --- | --- | --- |
-| Install script (Linux, macOS) | `curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh \| bash` | `zero upgrade` |
-| Install script (Windows) | `irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 \| iex` | `zero upgrade` |
-| npm | `npm install -g @gitlawb/zero` | `zero upgrade` (runs npm) |
-| Release archive | download from [Releases](https://github.com/Gitlawb/zero/releases) | `zero upgrade` |
-| mise | `mise use -g ubi:Gitlawb/zero` | `mise upgrade` |
+| Install script (Linux, macOS) | `curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh \| bash` | `zero upgrade` |
+| Install script (Windows) | `irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 \| iex` | `zero upgrade` |
+| npm | `npm install -g @twigpine/zero` | `zero upgrade` (runs npm) |
+| Release archive | download from [Releases](https://github.com/Twigpine/zero/releases) | `zero upgrade` |
+| mise | `mise use -g ubi:Twigpine/zero` | `mise upgrade` |
 | `go install` | `go install github.com/Gitlawb/zero/cmd/zero@latest` | rerun the command |
 | Source | `go build -o zero ./cmd/zero` | rebuild |

@@ -29,7 +29,7 @@ Release and verify its checksum.
 ## npm

 ```bash
-npm install -g @gitlawb/zero
+npm install -g @twigpine/zero
 zero
 ```

@@ -56,15 +56,47 @@ cannot write to keeps failing — rerun the install or the command below with
 sufficient permissions). To trigger the fetch manually:

 ```bash
-node "$(npm root -g)/@gitlawb/zero/scripts/postinstall.mjs"
+node "$(npm root -g)/@twigpine/zero/scripts/postinstall.mjs"
 ```

+### Moving from @gitlawb/zero
+
+Zero was published as `@gitlawb/zero` up to 0.9.0. From 0.10.0 it is
+`@twigpine/zero`, and the old name gets no further releases.
+
+Both packages provide the `zero` command, so npm refuses to install the new
+one while the old one is installed (`EEXIST`). Forcing it is worse: a later
+uninstall of the old package removes the shared `zero` command. Quit any
+running `zero` (on Windows a running `zero.exe` cannot be removed), then
+uninstall the old package before installing the new one:
+
+```bash
+npm uninstall -g @gitlawb/zero
+npm install -g @twigpine/zero
+```
+
+With another package manager, the same two steps:
+
+```bash
+bun remove -g @gitlawb/zero && bun add -g @twigpine/zero
+pnpm remove -g @gitlawb/zero && pnpm add -g @twigpine/zero
+yarn global remove @gitlawb/zero && yarn global add @twigpine/zero
+```
+
+Config, sessions, logins, and plugins live in your user config and home
+directories, not in the package, so they carry over unchanged.
+
+0.10.0 was also published once as `@gitlawb/zero`, so an old install that
+updates lands on a working build. That build prints these steps when `zero`
+exits in a terminal, and `zero upgrade` and `zero update --check` print them
+too.
+
 ## Linux And macOS Script

 Install the latest release:

 ```bash
-curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
 ```

 From a checkout:
@@ -89,7 +121,7 @@ scripts/install.sh --install-dir "$HOME/bin"

 Defaults:

- Repository: `Gitlawb/zero`
+- Repository: `Twigpine/zero`
 - Version: latest GitHub release
 - Install path: `~/.local/bin/zero`

@@ -100,7 +132,7 @@ Requirements: Bash, `curl` or `wget`, `tar`, and `shasum` or `sha256sum`.
 Install the latest release:

 ```powershell
-irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
 ```

 From a checkout:
@@ -123,7 +155,7 @@ powershell -ExecutionPolicy Bypass -File scripts/install.ps1 -InstallDir "$env:U

 Defaults:

- Repository: `Gitlawb/zero`
+- Repository: `Twigpine/zero`
 - Version: latest GitHub release
 - Install path: `%LOCALAPPDATA%\zero\bin\zero.exe`

@@ -134,13 +166,13 @@ archives through its `ubi` backend, so there is nothing extra to publish and no
 registry in the middle:

 ```bash
-mise use -g ubi:Gitlawb/zero
+mise use -g ubi:Twigpine/zero
 ```

 Pin a version the same way you would any other tool:

 ```bash
-mise use -g ubi:Gitlawb/[email protected]
+mise use -g ubi:Twigpine/[email protected]
 ```

 Updates come from `mise upgrade`. `zero upgrade` also works, because a
@@ -153,13 +185,19 @@ describe a version that is no longer on disk. Prefer `mise upgrade`.
 go install github.com/Gitlawb/zero/cmd/zero@latest
 ```

+Every release so far declares the module path `github.com/Gitlawb/zero`, so
+`go install` has to use that path; `github.com/Twigpine/zero/cmd/zero@latest`
+fails with "module declares its path as" until a release is tagged with the new
+module path.
+
 This builds from source, so it needs Go 1.26.9+ and it does not go through the
 release archives. Two consequences worth knowing before you pick it:

- On Linux you also need the sandbox helper, which is a separate binary and is
-  not installed by this command. See
+- On Linux, Bubblewrap is still required for native sandboxing. Zero resolves
+  the helper in this order: an executable `zero-linux-sandbox` next to `zero`,
+  then `PATH`, then self-exec of the main binary. Standalone helpers remain
+  optional and preferred. See
  [Sandbox Helpers For Source Builds](#sandbox-helpers-for-source-builds).
-  Without it, native sandboxing is unavailable.
 - `zero upgrade` treats the result as a standalone install and will replace the
  binary with a release build rather than rebuilding from source. If you chose
  `go install` deliberately, rerun it instead.
@@ -169,7 +207,7 @@ macOS and Windows need no extra helper.
 ## From Source

 ```bash
-git clone https://github.com/Gitlawb/zero.git
+git clone https://github.com/Twigpine/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -184,21 +222,28 @@ Source builds require Go 1.26.9+.

 ### Sandbox Helpers For Source Builds

-Release archives include the platform sandbox helpers. If you build directly
-from source, build the helpers you need:
+Release archives include the platform sandbox helpers. A source build of the
+main `zero` binary is enough for Linux native sandboxing. Zero resolves the
+helper in this order:

-Linux:
+1. an executable `zero-linux-sandbox` next to `zero`
+2. then `PATH`
+3. then self-exec of the main binary
+
+Bubblewrap must still be installed. Standalone helpers remain optional and
+preferred.
+
+A separate helper remains supported if it sits next to `zero` or on `PATH`:

 ```bash
 go build -o zero ./cmd/zero
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
-go build -o zero-seccomp ./cmd/zero-seccomp
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # optional
+go build -o zero-seccomp ./cmd/zero-seccomp               # optional compatibility wrapper
 ```

-Put `zero` and `zero-linux-sandbox` in the same directory on `PATH`, for example
-`~/.local/bin`. `zero-seccomp` is kept as a compatibility wrapper; the sandbox
-helper applies the Unix-socket filter itself when that sandbox option is enabled.
-Linux native sandboxing also requires Bubblewrap to be installed.
+Put `zero` on `PATH`, for example `~/.local/bin`. `zero-seccomp` is kept as a
+compatibility wrapper; the sandbox helper applies the Unix-socket filter itself
+when that sandbox option is enabled.

 macOS uses the system sandbox and does not need an extra helper binary.

@@ -213,7 +258,7 @@ seccomp filter on Android:
 pkg install golang

 # Build Zero for Android
-git clone https://github.com/Gitlawb/zero.git
+git clone https://github.com/Twigpine/zero.git
 cd zero
 CGO_ENABLED=0 GOOS=android GOARCH=arm64 go build -ldflags="-s -w" -o zero ./cmd/zero

@@ -302,7 +347,10 @@ See the [update guide](UPDATE.md) for update modes, flags, and platform details.
 overwriting a binary a package manager owns leaves that manager describing a
 version that is no longer there:

- **npm**: runs `npm install -g @gitlawb/zero@latest` for you.
+- **npm**: runs `npm install -g @twigpine/zero@latest` for you. An install of
+  the old `@gitlawb/zero` package refuses instead and prints the steps in
+  [Moving from @gitlawb/zero](#moving-from-gitlawbzero): that name gets no
+  further releases, so npm would only reinstall the same version.
 - **Homebrew**: refuses, and tells you to run `brew upgrade zero`. Replacing the
  keg binary directly would be reverted by the next `brew upgrade` or
  `brew reinstall`.
@@ -1,6 +1,6 @@
 # npm packaging

-How `@gitlawb/zero` is put together on npm, why it is shaped this way, and the
+How `@twigpine/zero` is put together on npm, why it is shaped this way, and the
 rules the release pipeline must follow. Read this before touching
 `package.json`, `bin/zero.js`, `scripts/postinstall.mjs`,
 `scripts/npm/build-platform-packages.mjs`, or the npm-publish steps of
@@ -8,7 +8,7 @@ rules the release pipeline must follow. Read this before touching

 ## Goals

-A `npm install -g @gitlawb/zero` must be **silent and self-contained**:
+A `npm install -g @twigpine/zero` must be **silent and self-contained**:

 - No `EBADENGINE` warnings — ours or from any package in the dependency tree.
 - No install scripts anywhere in the tree, so npm's `allow-scripts` gating,
@@ -25,15 +25,15 @@ The model is the one used by Codex, esbuild, and Biome: a tiny wrapper package
 plus per-platform payloads carrying the native binaries.

 ```
-@gitlawb/zero                    <- wrapper: bin/zero.js + optionalDependencies
-├─ @gitlawb/zero-darwin-arm64 -> npm:@gitlawb/zero@{version}-darwin-arm64
-├─ @gitlawb/zero-darwin-x64   -> npm:@gitlawb/zero@{version}-darwin-x64
-├─ @gitlawb/zero-linux-arm64  -> npm:@gitlawb/zero@{version}-linux-arm64
-├─ @gitlawb/zero-linux-x64    -> npm:@gitlawb/zero@{version}-linux-x64
-└─ @gitlawb/zero-win32-x64    -> npm:@gitlawb/zero@{version}-win32-x64
+@twigpine/zero                    <- wrapper: bin/zero.js + optionalDependencies
+├─ @twigpine/zero-darwin-arm64 -> npm:@twigpine/zero@{version}-darwin-arm64
+├─ @twigpine/zero-darwin-x64   -> npm:@twigpine/zero@{version}-darwin-x64
+├─ @twigpine/zero-linux-arm64  -> npm:@twigpine/zero@{version}-linux-arm64
+├─ @twigpine/zero-linux-x64    -> npm:@twigpine/zero@{version}-linux-x64
+└─ @twigpine/zero-win32-x64    -> npm:@twigpine/zero@{version}-win32-x64
 ```

- The platform "packages" are **versions of the same `@gitlawb/zero` package**,
+- The platform "packages" are **versions of the same `@twigpine/zero` package**,
  published at suffixed versions (`0.4.0-linux-x64`) and referenced through
  `npm:` aliases in `optionalDependencies`. One package name means one npm
  trusted-publisher configuration — no new publish credentials per platform.
@@ -56,7 +56,7 @@ plus per-platform payloads carrying the native binaries.

 ### Binary resolution in `bin/zero.js`

-1. Resolve `@gitlawb/zero-<platform>-<arch>` and exec the `zero` binary from
+1. Resolve `@twigpine/zero-<platform>-<arch>` and exec the `zero` binary from
   it. This wins over any previously downloaded copy — the platform version is
   pinned to the wrapper release.
 2. Fall back to a binary previously downloaded next to the wrapper.
@@ -103,10 +103,22 @@ dependencies of the wrapper:
  platform binary (plus the musl variant on linux, which its launcher detects
  at runtime) — about 65 MB saved per platform package.

+### One package name
+
+The npm name lives in `package.json` and nothing else repeats it:
+`scripts/npm/build-platform-packages.mjs` names the wrapper, the platform
+versions, the alias names, and the alias targets from it, and `bin/zero.js`
+reads its own `package.json` to derive the alias it resolves. The Go side
+needs the name as a constant (`npmPackageName` in
+`internal/update/installmethod.go`), and a test holds it equal to
+`package.json`.
+
 ## Publishing rules (release pipeline)

 These are the invariants `release-artifacts.yml` must hold. Breaking the first
-one is user-visible immediately.
+one is user-visible immediately. `scripts/npm/publish-packages.sh` implements
+them, and `internal/npmwrapper/publish_test.go` runs it against a fake
+registry.

 1. **Platform versions must never become `latest`.** `0.4.0-linux-x64` is a
   semver *prerelease* of `0.4.0`; publishing it without an explicit
@@ -118,20 +130,67 @@ one is user-visible immediately.
   bootstrap publish) — a missing value must not abort the job between the
   platform and wrapper publishes, which would strand a half-published
   release.
-2. **Platform versions publish before the wrapper.** The wrapper's
-   `optionalDependencies` pin exact suffixed versions; publishing the wrapper
-   first would create a window where installs resolve aliases that 404.
+2. **Platform versions are on the registry before the wrapper.** The
+   wrapper's `optionalDependencies` pin exact suffixed versions; publishing
+   the wrapper first would create a window where installs resolve aliases
+   that 404. Ordering the uploads is not enough: npm applies a publish
+   asynchronously, and in 0.10.0 a platform version appeared ten minutes
+   after its upload returned, after the wrapper. The publish script waits
+   until npm shows every platform version before it publishes the wrapper,
+   and waits the same way for `latest` afterwards (up to 30 minutes in all).
 3. **Exact-version pinning.** The wrapper at `X.Y.Z` references platform
   versions `X.Y.Z-<platform>-<arch>` exactly — never ranges — so a wrapper
-   and its binaries can never skew.
+   and its binaries can never skew. The publish script refuses to start when
+   the wrapper's aliases do not match the platform payloads beside it.
 4. All publishes go through the existing npm OIDC trusted-publishing flow and
   the `npm-publish` environment gate; no tokens. Because the platform
   payloads are versions of the same package, they reuse the single
-   trusted-publisher configuration.
+   trusted-publisher configuration. npm checks provenance against
+   `package.json` `repository`, so it must name the repository the workflow
+   runs in.
+5. **Re-runs are safe.** A version already on the registry is skipped rather
+   than republished, so re-running a job that failed between the platform and
+   wrapper publishes finishes the release. Only npm's E404 counts as "not
+   published"; a lookup that fails any other way is retried and then stops the
+   job before anything is published.

 `zero update` keeps working unchanged: it detects an npm install by finding a
-`package.json` named `@gitlawb/zero` next to the running binary — true inside
-a platform payload too — and updates via `npm install -g @gitlawb/zero@latest`.
+`package.json` named `@twigpine/zero` next to the running binary — true inside
+a platform payload too — and updates via `npm install -g @twigpine/zero@latest`.
+
+## The move from `@gitlawb/zero`
+
+Zero was published as `@gitlawb/zero` up to 0.9.0 and as `@twigpine/zero`
+from 0.10.0. There is no in-place migration: both packages own the `zero`
+bin, so npm refuses to install one over the other (`EEXIST`), and forcing it
+lets a later uninstall of the old package delete the shared bin. The user
+has to uninstall the old package and install the new one, in that order.
+
+Deprecating the old package alone would not have reached existing users.
+0.9.0's `zero upgrade` runs `npm install -g @gitlawb/zero@latest`; with
+nothing newer under that name, npm reinstalls nothing, prints no deprecation
+warning (it only warns when it installs something), and Zero reports the
+update as done. So 0.10.0 was published once more under the old name, as a
+bridge:
+
+- The release job assembled the same verified artifacts a second time with
+  `build-platform-packages.mjs --package-name @gitlawb/zero` and published
+  them with the same script, after the `@twigpine/zero` publish. The steps
+  that did this ran once and have been removed from `release-artifacts.yml`.
+- The bridge build knows its name from the `package.json` beside it. The Go
+  binary reports it as `InstallMethodNpmLegacy`: `zero upgrade` refuses
+  with the switch steps instead of reinstalling it, and `zero update --check`
+  adds them. `bin/zero.js` prints the same steps after `zero` exits, on a
+  terminal only. This handling stays in the code, since only a build
+  installed under the old name ever triggers it.
+- Updating from 0.9.0 installs that bridge build, so npm also shows the
+  deprecation message.
+
+`@gitlawb/zero` is deprecated on every version and no longer has a trusted
+publisher, so this release workflow cannot publish it again; another version
+would take a maintainer publishing by hand. Its versions stay on the
+registry: existing installs resolve their platform payload through them, so
+they must never be unpublished.

 ## Runbook: bumping the vendored helpers

@@ -2,7 +2,8 @@

 Run this checklist when a PR changes npm distribution files such as
 `package.json`, `bin/zero.js`, `scripts/npm/build-platform-packages.mjs`,
-Go build or release tooling, or the npm `bin` wrapper.
+`scripts/npm/publish-packages.sh`, Go build or release tooling, or the npm
+`bin` wrapper.

 ## Required Checks

@@ -37,24 +38,24 @@ path:

 ```bash
 # platform-package path
-mkdir -p /tmp/zero-sim/node_modules/@gitlawb
-cp -R dist/npm/wrapper /tmp/zero-sim/node_modules/@gitlawb/zero
+mkdir -p /tmp/zero-sim/node_modules/@twigpine
+cp -R dist/npm/wrapper /tmp/zero-sim/node_modules/@twigpine/zero
 cp -R dist/npm/platforms/zero-<platform>-<arch> \
-  "/tmp/zero-sim/node_modules/@gitlawb/zero-<platform>-<arch>"
-node /tmp/zero-sim/node_modules/@gitlawb/zero/bin/zero.js --version
+  "/tmp/zero-sim/node_modules/@twigpine/zero-<platform>-<arch>"
+node /tmp/zero-sim/node_modules/@twigpine/zero/bin/zero.js --version

 # first-run download fallback (delete the platform package first)
-rm -rf "/tmp/zero-sim/node_modules/@gitlawb/zero-<platform>-<arch>"
-node /tmp/zero-sim/node_modules/@gitlawb/zero/bin/zero.js --version
+rm -rf "/tmp/zero-sim/node_modules/@twigpine/zero-<platform>-<arch>"
+node /tmp/zero-sim/node_modules/@twigpine/zero/bin/zero.js --version
 ```

 ## Checklist

- `package.json` has the expected package name (`@gitlawb/zero`), version,
+- `package.json` has the expected package name (`@twigpine/zero`), version,
  `bin.zero` entry, and NO `scripts` entries — the published package must be
  free of lifecycle scripts (see NPM_PACKAGING.md).
 - `scripts/npm/build-platform-packages.mjs` emits platform payloads whose
-  `package.json` is `@gitlawb/zero@<version>-<platform>-<arch>` with matching
+  `package.json` is `@twigpine/zero@<version>-<platform>-<arch>` with matching
  `os`/`cpu`, contains the executable binary and the vendored `helpers/` tree
  with regular-file (non-symlink) `.bin` shims, and a wrapper payload with no
  scripts, no dependencies, and the full five-alias `optionalDependencies`
@@ -7,7 +7,7 @@ downloads, verifies, and installs it.
 ```bash
 zero update --check
 zero update --check --json
-zero update --check --repo Gitlawb/zero
+zero update --check --repo Twigpine/zero
 zero update --check --target windows-x64

 zero upgrade
@@ -28,7 +28,11 @@ them explicitly; `zero upgrade` is `zero update` with `--apply` implied.

 `--apply` installs the update in place:

- npm installs delegate to `npm install -g @gitlawb/zero@latest`.
+- npm installs delegate to `npm install -g @twigpine/zero@latest`. An install
+  of the old `@gitlawb/zero` package refuses, without a release check, and
+  prints the steps to switch to `@twigpine/zero` (see
+  [INSTALL.md](INSTALL.md#moving-from-gitlawbzero)); `--check` prints them
+  too.
 - Standalone installs download the release archive, verify its checksum,
  extract it, and atomically replace the running binary plus any installed
  optional sandbox helpers.
@@ -38,7 +42,7 @@ them explicitly; `zero upgrade` is `zero update` with `--apply` implied.
 - `--target` cannot be combined with `--apply`; it only applies to `--check`,
  since applying always installs onto the current machine.
 - `--repo` and `--endpoint` are ignored when applying to an npm-managed
-  install: that path delegates to `npm install -g @gitlawb/zero@latest` and
+  install: that path delegates to `npm install -g @twigpine/zero@latest` and
  takes its release from the npm registry, not from GitHub. They still apply to
  `--check` there.
 - `--json` serializes Zero's final result. For npm-managed installs, npm may
@@ -65,7 +69,7 @@ Endpoint resolution order:
 1. `--endpoint`
 2. `ZERO_UPDATE_RELEASE_URL`
 3. `--repo`
-4. `https://api.github.com/repos/Gitlawb/zero/releases/latest`
+4. `https://api.github.com/repos/Twigpine/zero/releases/latest`

 Installer scripts download the matching release asset for the local platform and
 verify its `.sha256` file. If Zero is already installed, run `zero upgrade`
@@ -1,4 +1,4 @@
-module github.com/Gitlawb/zero
+module github.com/Twigpine/zero

 go 1.26.9

@@ -13,17 +13,18 @@ import (
 	"strings"
 	"sync"

-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/modelregistry"
-	"github.com/Gitlawb/zero/internal/providercatalog"
-	"github.com/Gitlawb/zero/internal/providermodelcatalog"
-	"github.com/Gitlawb/zero/internal/providermodeldiscovery"
-	"github.com/Gitlawb/zero/internal/redaction"
-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/sessions"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/config"
+	"github.com/Twigpine/zero/internal/modelregistry"
+	"github.com/Twigpine/zero/internal/providercatalog"
+	"github.com/Twigpine/zero/internal/providermodelcatalog"
+	"github.com/Twigpine/zero/internal/providermodeldiscovery"
+	"github.com/Twigpine/zero/internal/redaction"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sessions"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/usage"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // Deps are the ZERO capabilities the ACP Agent drives. The CLI fills these with
@@ -213,7 +214,7 @@ func (a *Agent) handleSessionNew(ctx context.Context, params json.RawMessage) (a
 	if err != nil {
 		return nil, RPCError(codeInternalError, "create session: "+err.Error())
 	}
-	sess, _ := a.registerSession(meta.SessionID, root, nil, model, models, restrictModels, false)
+	sess, _ := a.registerSession(meta.SessionID, root, nil, model, models, restrictModels, false, agent.PermissionModeAuto)
 	return NewSessionResult{
 		SessionID:     sess.id,
 		ConfigOptions: a.configOptions(sess),
@@ -329,7 +330,7 @@ func (a *Agent) activatePersistedSession(ctx context.Context, p LoadSessionParam
 	// Resume has already refused a non-resumable kind above, so only load can
 	// reach here with one, and it publishes that session for viewing only.
 	readOnly := !sessions.IsResumableKind(meta.SessionKind)
-	sess, existed := a.registerSession(meta.SessionID, root, history, model, models, restrictModels, readOnly)
+	sess, existed := a.registerSession(meta.SessionID, root, history, model, models, restrictModels, readOnly, restoredPermissionMode(meta.PermissionMode))
 	if existed {
 		_, messages, historyWarning, historyErr = a.refreshSessionHistory(sess, requireHistoryLog)
 		if operation == persistedSessionResume && historyErr != nil {
@@ -527,8 +528,6 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 	queue := func(input sessions.AppendEventInput) {
 		pendingEvents = append(pendingEvents, input)
 	}
-	queue(messageEvent("user", userText))
-
 	visionCache := make(map[string]bool)
 	var visionCacheMu sync.Mutex
 	supportsVision := func(modelID string) bool {
@@ -552,6 +551,9 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 		effectivePrompt = fmt.Sprintf("[Note: %s]\n\n%s", msg, userText)
 		images = nil
 	}
+	// Match the TUI: only images actually sent to the model enter history.
+	attachments := sessions.MessageAttachments{Images: len(images)}
+	queue(messageEvent("user", userText, attachments))

 	opts := agent.Options{
 		Cwd:            sess.cwd,
@@ -567,6 +569,12 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 		SupportsVision: supportsVision,
 		OnText:         note.text,
 		OnReasoning:    note.thought,
+		// Persist token usage the same way `zero exec` does, so `zero usage report`
+		// sees ACP sessions too. It joins the turn's buffered batch: a hard run
+		// failure that aborts the turn drops its usage together with its history.
+		OnUsage: func(u agent.Usage) {
+			queue(usageEvent(u))
+		},
 		OnToolCall: func(call agent.ToolCall) {
 			queue(toolCallEvent(call))
 			note.toolCall(call)
@@ -586,7 +594,7 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 	agentPrompt := buildPrompt(sess.snapshotHistory(), effectivePrompt)
 	result, runErr := a.deps.RunAgent(ctx, agentPrompt, provider, opts)
 	if result.FinalAnswer != "" {
-		queue(messageEvent("assistant", result.FinalAnswer))
+		queue(messageEvent("assistant", result.FinalAnswer, sessions.MessageAttachments{}))
 	}
 	reason, stopErr := stopReasonFor(result, runErr)
 	if stopErr != nil {
@@ -607,7 +615,7 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 	// one file write, which is the contiguity restored here — not a disk
 	// transaction, and not a promise about crashes mid-fsync. Reported by @jatmn.
 	persistenceErr := a.persistTurn(sess.id, pendingEvents)
-	sess.appendHistory(turnRecord{user: userText, assistant: result.FinalAnswer})
+	sess.appendHistory(turnRecord{user: attachments.WithContent(userText), assistant: result.FinalAnswer})
 	a.warnPersistence(
 		note,
 		"save session history",
@@ -695,7 +703,9 @@ func (a *Agent) handleSetMode(_ context.Context, params json.RawMessage) (any, e
 	mode := agent.PermissionMode(p.ModeID)
 	switch mode {
 	case agent.PermissionModeAuto, agent.PermissionModeAsk, agent.PermissionModePlan:
-		sess.setMode(mode)
+		if err := a.updateMode(sess, mode); err != nil {
+			return nil, err
+		}
 		(&notifier{conn: a.conn, sessionID: sess.id}).currentMode(string(mode))
 		return SetSessionModeResult{}, nil
 	case agent.PermissionModeUnsafe:
@@ -731,7 +741,9 @@ func (a *Agent) handleSetConfigOption(_ context.Context, params json.RawMessage)
 		mode := agent.PermissionMode(p.Value)
 		switch mode {
 		case agent.PermissionModeAuto, agent.PermissionModeAsk, agent.PermissionModePlan:
-			sess.setMode(mode)
+			if err := a.updateMode(sess, mode); err != nil {
+				return nil, err
+			}
 			(&notifier{conn: a.conn, sessionID: sess.id}).currentMode(string(mode))
 		case agent.PermissionModeUnsafe:
 			return nil, RPCError(codeInvalidParams, "mode not permitted over ACP: "+p.Value)
@@ -773,6 +785,35 @@ func (a *Agent) updateModel(sess *acpSession, model string, restrictModels bool)
 	return nil
 }

+// updateMode persists the mode BEFORE applying it, so a failed write fails the
+// request instead of leaving disk behind memory; the same order updateModel
+// uses. The caller holds sess.turnMu (both mode doors take it and it is not
+// reentrant, so this must not lock it again); the write under turnMu briefly
+// blocks that session's prompts, which is what makes the store authoritative.
+func (a *Agent) updateMode(sess *acpSession, mode agent.PermissionMode) error {
+	if _, err := a.deps.Store.UpdateMode(sess.id, string(mode)); err != nil {
+		return RPCError(codeInternalError, "save mode selection: "+err.Error())
+	}
+	sess.setMode(mode)
+	return nil
+}
+
+// restoredPermissionMode maps a persisted mode onto the modes ACP offers. A
+// session written before modes were persisted has none and keeps the historical
+// auto default. A stored value outside the three is never allowed to come back
+// weaker than ask, and unsafe can never be reached because ACP refuses to set
+// it in the first place.
+func restoredPermissionMode(saved string) agent.PermissionMode {
+	switch mode := agent.PermissionMode(strings.TrimSpace(saved)); mode {
+	case agent.PermissionModeAuto, agent.PermissionModeAsk, agent.PermissionModePlan:
+		return mode
+	case "":
+		return agent.PermissionModeAuto
+	default:
+		return agent.PermissionModeAsk
+	}
+}
+
 func (a *Agent) handleCancel(_ context.Context, params json.RawMessage) {
 	var p CancelParams
 	if err := json.Unmarshal(params, &p); err != nil {
@@ -890,10 +931,23 @@ func (a *Agent) persistTurn(sessionID string, inputs []sessions.AppendEventInput
 	return err
 }

-func messageEvent(role, content string) sessions.AppendEventInput {
+func messageEvent(role, content string, attachments sessions.MessageAttachments) sessions.AppendEventInput {
+	payload := map[string]any{"role": role, "content": content}
+	if role == "user" && (attachments.Images > 0 || attachments.Documents > 0) {
+		payload["attachments"] = attachments
+	}
 	return sessions.AppendEventInput{
 		Type:    sessions.EventMessage,
-		Payload: map[string]any{"role": role, "content": content},
+		Payload: payload,
+	}
+}
+
+// usageEvent records one provider usage report in the same persisted shape the
+// exec runtime writes (usage.EventUsagePayload is the single writer).
+func usageEvent(u agent.Usage) sessions.AppendEventInput {
+	return sessions.AppendEventInput{
+		Type:    sessions.EventUsage,
+		Payload: usage.EventUsagePayload(u),
 	}
 }

@@ -1045,14 +1099,16 @@ func (a *Agent) loadHistory(sessionID string, requireHistoryLog bool) ([]turnRec
 			continue
 		}
 		var msg struct {
-			Role    string `json:"role"`
-			Content string `json:"content"`
+			Role        string                      `json:"role"`
+			Content     string                      `json:"content"`
+			Attachments sessions.MessageAttachments `json:"attachments"`
 		}
 		if json.Unmarshal(raw, &msg) != nil {
 			continue
 		}
 		switch msg.Role {
 		case "user":
+			msg.Content = msg.Attachments.WithContent(msg.Content)
 			messages = append(messages, persistedMessage{eventID: persistedMessageIdentity(sessionID, e), role: msg.Role, content: msg.Content})
 			if havePending {
 				records = append(records, turnRecord{user: pendingUser})
@@ -1210,14 +1266,15 @@ func promptImages(blocks []ContentBlock) []zeroruntime.ImageBlock {
 // session is returned rather than orphaning its turn or resetting its mode/model.
 // The bool reports that case so persisted activation can re-read and apply disk
 // history under turnMu. history is set BEFORE first publication so no concurrent
-// prompt can read a half-initialized session.
-func (a *Agent) registerSession(id, cwd string, history []turnRecord, model string, models []SessionConfigOptionValue, restrictModels bool, readOnly bool) (*acpSession, bool) {
+// prompt can read a half-initialized session. mode is the session's initial
+// permission mode: auto for a new session, the restored value for load/resume.
+func (a *Agent) registerSession(id, cwd string, history []turnRecord, model string, models []SessionConfigOptionValue, restrictModels bool, readOnly bool, mode agent.PermissionMode) (*acpSession, bool) {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 	if existing := a.sessions[id]; existing != nil {
 		return existing, true
 	}
-	sess := &acpSession{id: id, cwd: cwd, mode: agent.PermissionModeAuto, model: model, models: models, restrictModels: restrictModels, history: history, readOnly: readOnly}
+	sess := &acpSession{id: id, cwd: cwd, mode: mode, model: model, models: models, restrictModels: restrictModels, history: history, readOnly: readOnly}
 	a.sessions[id] = sess
 	return sess, false
 }
@@ -19,13 +19,13 @@ import (
 	"testing"
 	"time"

-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/providermodeldiscovery"
-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/sessions"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/config"
+	"github.com/Twigpine/zero/internal/providermodeldiscovery"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sessions"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // fakeProvider streams a canned assistant message and ends the turn — enough to
@@ -960,7 +960,11 @@ func TestACPHardTurnFailureDoesNotCommitHistory(t *testing.T) {
 		t.Fatal(err)
 	}
 	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("failed question")},
+		SessionID: created.SessionID,
+		Prompt: []ContentBlock{
+			TextBlock("failed question"),
+			ImageBlock(base64.StdEncoding.EncodeToString([]byte("failed image")), "image/png"),
+		},
 	}, &PromptResult{}); err == nil {
 		t.Fatal("hard RunAgent failure was reported as a successful turn")
 	}
@@ -15,7 +15,7 @@ import (
 	"fmt"
 	"testing"

-	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/agent"
 )

 // ---- an offered option is an acceptable answer ----
@@ -0,0 +1,181 @@
+package acp
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/config"
+	"github.com/Twigpine/zero/internal/providermodeldiscovery"
+	"github.com/Twigpine/zero/internal/sessions"
+	"github.com/Twigpine/zero/internal/zeroruntime"
+)
+
+func TestACPImageAttachmentHistory(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		text          string
+		images        int
+		withoutVision bool
+		want          string
+	}{
+		{name: "image only", images: 1, want: "[1 image]"},
+		{name: "text and images", text: "compare these", images: 2, want: "compare these [2 images]"},
+		{name: "ignored by model", images: 1, withoutVision: true, want: ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			deps := testDeps(t)
+			deps.DiscoverModels = func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error) {
+				modalities := []string{"text", "image"}
+				if tc.withoutVision {
+					modalities = []string{"text"}
+				}
+				return []providermodeldiscovery.Model{{ID: "fake-model", InputModalities: modalities}}, nil
+			}
+			type observedTurn struct {
+				prompt string
+				images int
+			}
+			turns := make(chan observedTurn, 8)
+			deps.RunAgent = func(_ context.Context, prompt string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
+				turns <- observedTurn{prompt: prompt, images: len(opts.Images)}
+				return agent.Result{FinalAnswer: "received"}, nil
+			}
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+			workspace := t.TempDir()
+			h := newHarness(t, deps)
+			defer h.stop()
+			var created NewSessionResult
+			if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: workspace}, &created); err != nil {
+				t.Fatal(err)
+			}
+			const imageData = "image-history-bytes-not-for-storage"
+			encoded := base64.StdEncoding.EncodeToString([]byte(imageData))
+			var blocks []ContentBlock
+			if tc.text != "" {
+				blocks = append(blocks, TextBlock(tc.text))
+			}
+			for range tc.images {
+				blocks = append(blocks, ImageBlock(encoded, "image/png"))
+			}
+			if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: blocks}, &PromptResult{}); err != nil {
+				t.Fatal(err)
+			}
+			live := <-turns
+			wantLiveImages := tc.images
+			if tc.withoutVision {
+				wantLiveImages = 0
+			}
+			if live.images != wantLiveImages {
+				t.Fatalf("live images = %d, want %d", live.images, wantLiveImages)
+			}
+			events, err := deps.Store.ReadEvents(created.SessionID)
+			if err != nil || len(events) < 2 {
+				t.Fatalf("read completed turn: events=%+v err=%v", events, err)
+			}
+			var user struct {
+				Role        string `json:"role"`
+				Content     string `json:"content"`
+				Attachments struct {
+					Images int `json:"images"`
+				} `json:"attachments"`
+			}
+			if err := json.Unmarshal(events[0].Payload, &user); err != nil {
+				t.Fatal(err)
+			}
+			if user.Role != "user" || user.Content != tc.text || user.Attachments.Images != wantLiveImages {
+				t.Errorf("stored user event = %s, want original text and attachments.images=%d", events[0].Payload, wantLiveImages)
+			}
+			for _, event := range events {
+				if bytes.Contains(event.Payload, []byte(encoded)) || bytes.Contains(event.Payload, []byte(imageData)) {
+					t.Errorf("image data leaked into session event: %s", event.Payload)
+				}
+			}
+			followUp := func(t *testing.T, client *clientHarness) {
+				t.Helper()
+				if err := client.client.Call(ctx, MethodSessionPrompt, PromptParams{
+					SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("what did I send?")},
+				}, &PromptResult{}); err != nil {
+					t.Fatal(err)
+				}
+				got := <-turns
+				if want := "User: " + tc.want + "\n"; !strings.Contains(got.prompt, want) {
+					t.Errorf("seeded prompt missing user history %q: %q", want, got.prompt)
+				}
+				if got.images != 0 {
+					t.Errorf("historical images reattached: %d", got.images)
+				}
+			}
+			followUp(t, h)
+			h.stop()
+			// Fresh agents and stores reproduce a process restart, with no shared
+			// in-memory history to hide a missing attachment in the event log.
+			for _, method := range []string{MethodSessionLoad, MethodSessionResume} {
+				t.Run(method, func(t *testing.T) {
+					restoredDeps := deps
+					restoredDeps.Store = sessions.NewStore(sessions.StoreOptions{RootDir: deps.Store.RootDir})
+					loader := newHarness(t, restoredDeps)
+					defer loader.stop()
+					if err := loader.client.Call(ctx, method, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace}, &LoadSessionResult{}); err != nil {
+						t.Fatal(err)
+					}
+					if method == MethodSessionLoad {
+						select {
+						case update := <-loader.notifications:
+							if update.SessionUpdate != UpdateUserMessageChunk || update.Content.Text != tc.want {
+								t.Errorf("replayed user = %+v, want %q", update, tc.want)
+							}
+						case <-ctx.Done():
+							t.Fatal("user turn was not replayed")
+						}
+					} else {
+						select {
+						case update := <-loader.notifications:
+							t.Errorf("resume replayed transcript: %+v", update)
+						default:
+						}
+					}
+					followUp(t, loader)
+				})
+			}
+		})
+	}
+}
+
+func TestACPAttachmentHistoryReadsExistingSessionMessages(t *testing.T) {
+	deps := testDeps(t)
+	meta, err := deps.Store.Create(sessions.CreateInput{SessionID: "attachment-compatibility", Cwd: t.TempDir()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i, payload := range []string{
+		`{"role":"user","content":"old text"}`,
+		`{"role":"user","content":"","attachments":{"images":1,"documents":2}}`,
+		`{"role":"user","content":"still text","attachments":{"images":-1,"documents":1.5}}`,
+		`{"role":"assistant","content":"answer","attachments":{"images":1}}`,
+	} {
+		if _, err := deps.Store.AppendEvent(meta.SessionID, sessions.AppendEventInput{Type: sessions.EventMessage, Payload: json.RawMessage(payload)}); err != nil {
+			t.Fatalf("append message %d: %v", i, err)
+		}
+	}
+	a := &Agent{deps: deps}
+	_, messages, _, err := a.loadHistory(meta.SessionID, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"old text", "[1 image] [2 documents]", "still text", "answer"}
+	if len(messages) != len(want) {
+		t.Fatalf("messages = %+v", messages)
+	}
+	for i, text := range want {
+		if messages[i].content != text {
+			t.Errorf("message %d = %q, want %q", i, messages[i].content, text)
+		}
+	}
+}
@@ -0,0 +1,213 @@
+package acp
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/sessions"
+	"github.com/Twigpine/zero/internal/zeroruntime"
+)
+
+// captureAgentOptions makes every turn record the agent.Options it was built
+// with, so a test can assert the permission mode the next prompt actually runs
+// with rather than only what the wire reports.
+func captureAgentOptions(deps *Deps) *agent.Options {
+	var captured agent.Options
+	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
+		captured = opts
+		return agent.Result{FinalAnswer: "ok"}, nil
+	}
+	return &captured
+}
+
+func newHarnessT(t *testing.T, deps Deps) *clientHarness {
+	t.Helper()
+	h := newHarness(t, deps)
+	t.Cleanup(h.stop)
+	return h
+}
+
+func mustCall(t *testing.T, ctx context.Context, h *clientHarness, method string, params any, result any) {
+	t.Helper()
+	if err := h.client.Call(ctx, method, params, result); err != nil {
+		t.Fatalf("%s: %v", method, err)
+	}
+}
+
+// restartHarness replaces the live agent with a fresh one over the same store,
+// which is the process restart the persisted mode has to survive.
+func restartHarness(t *testing.T, h *clientHarness, deps Deps) *clientHarness {
+	t.Helper()
+	h.stop()
+	return newHarnessT(t, deps)
+}
+
+func modeOptionValue(t *testing.T, options []SessionConfigOption) string {
+	t.Helper()
+	for _, option := range options {
+		if option.ID == configIDMode {
+			return option.CurrentValue
+		}
+	}
+	t.Fatalf("no mode config option in %+v", options)
+	return ""
+}
+
+func assertModeReported(t *testing.T, result LoadSessionResult, want agent.PermissionMode) {
+	t.Helper()
+	if result.Modes == nil || result.Modes.CurrentModeID != string(want) {
+		t.Fatalf("modes = %+v, want currentModeId %q", result.Modes, want)
+	}
+	if got := modeOptionValue(t, result.ConfigOptions); got != string(want) {
+		t.Fatalf("mode config option = %q, want %q", got, want)
+	}
+}
+
+func TestACPModePersistsAcrossRestartLoadAndResume(t *testing.T) {
+	deps := testDeps(t)
+	captured := captureAgentOptions(&deps)
+	h := newHarnessT(t, deps)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	workspace := t.TempDir()
+	var created NewSessionResult
+	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
+
+	mustCall(t, ctx, h, MethodSessionSetMode, SetSessionModeParams{SessionID: created.SessionID, ModeID: string(agent.PermissionModePlan)}, &SetSessionModeResult{})
+	meta, err := deps.Store.Get(created.SessionID)
+	if err != nil || meta == nil {
+		t.Fatalf("store.Get: %v", err)
+	}
+	if meta.PermissionMode != string(agent.PermissionModePlan) {
+		t.Fatalf("stored mode = %q, want plan", meta.PermissionMode)
+	}
+
+	// LOAD after a restart: the response must report the stored mode, and the
+	// next prompt must actually run with it.
+	h = restartHarness(t, h, deps)
+	var loaded LoadSessionResult
+	mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
+	assertModeReported(t, loaded, agent.PermissionModePlan)
+	mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("continue")}}, &PromptResult{})
+	if captured.PermissionMode != agent.PermissionModePlan {
+		t.Fatalf("after load, agent.Options.PermissionMode = %q, want plan", captured.PermissionMode)
+	}
+
+	// RESUME after another restart reports the same.
+	h = restartHarness(t, h, deps)
+	var resumed ResumeSessionResult
+	mustCall(t, ctx, h, MethodSessionResume, ResumeSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &resumed)
+	assertModeReported(t, resumed, agent.PermissionModePlan)
+}
+
+func TestACPModePersistsViaSetConfigOption(t *testing.T) {
+	deps := testDeps(t)
+	h := newHarnessT(t, deps)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	workspace := t.TempDir()
+	var created NewSessionResult
+	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
+
+	var configured SetSessionConfigOptionResult
+	mustCall(t, ctx, h, MethodSessionSetConfigOption, SetSessionConfigOptionParams{
+		SessionID: created.SessionID, ConfigID: configIDMode, Value: string(agent.PermissionModeAsk),
+	}, &configured)
+	if got := modeOptionValue(t, configured.ConfigOptions); got != string(agent.PermissionModeAsk) {
+		t.Fatalf("configured mode = %q, want ask", got)
+	}
+	meta, err := deps.Store.Get(created.SessionID)
+	if err != nil || meta == nil {
+		t.Fatalf("store.Get: %v", err)
+	}
+	if meta.PermissionMode != string(agent.PermissionModeAsk) {
+		t.Fatalf("stored mode = %q, want ask", meta.PermissionMode)
+	}
+
+	h = restartHarness(t, h, deps)
+	var loaded LoadSessionResult
+	mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
+	assertModeReported(t, loaded, agent.PermissionModeAsk)
+}
+
+// TestACPModeRestoreFallback pins the restore boundary: no stored value keeps
+// the historical auto default, and a stored value outside the three offered
+// modes must never come back weaker than ask (and never unsafe).
+func TestACPModeRestoreFallback(t *testing.T) {
+	cases := []struct {
+		name string
+		seed string // "" means metadata written before modes were persisted
+		want agent.PermissionMode
+	}{
+		{name: "unset keeps auto", want: agent.PermissionModeAuto},
+		{name: "ask preserved", seed: string(agent.PermissionModeAsk), want: agent.PermissionModeAsk},
+		{name: "unknown falls back to ask", seed: "bogus", want: agent.PermissionModeAsk},
+		{name: "unsafe never restored", seed: string(agent.PermissionModeUnsafe), want: agent.PermissionModeAsk},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			deps := testDeps(t)
+			captured := captureAgentOptions(&deps)
+			h := newHarnessT(t, deps)
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+
+			workspace := t.TempDir()
+			var created NewSessionResult
+			mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
+			if tc.seed != "" {
+				if _, err := deps.Store.UpdateMode(created.SessionID, tc.seed); err != nil {
+					t.Fatalf("seed mode: %v", err)
+				}
+			}
+
+			h = restartHarness(t, h, deps)
+			var loaded LoadSessionResult
+			mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
+			assertModeReported(t, loaded, tc.want)
+
+			mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("go")}}, &PromptResult{})
+			if captured.PermissionMode != tc.want {
+				t.Fatalf("next prompt PermissionMode = %q, want %q", captured.PermissionMode, tc.want)
+			}
+		})
+	}
+}
+
+// TestACPSetModeWriteFailureKeepsLiveMode pins the store-first order: when the
+// mode cannot be saved the request fails and the live session is untouched.
+func TestACPSetModeWriteFailureKeepsLiveMode(t *testing.T) {
+	deps := testDeps(t)
+	captured := captureAgentOptions(&deps)
+	h := newHarnessT(t, deps)
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	var created NewSessionResult
+	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: t.TempDir(), McpServers: []McpServer{}}, &created)
+
+	// Remove the metadata file so UpdateMode fails but the live session stays
+	// promptable (turn persistence only warns when the file is gone).
+	metadataPath := filepath.Join(deps.Store.RootDir, created.SessionID, sessions.MetadataFile)
+	if err := os.Remove(metadataPath); err != nil {
+		t.Fatalf("remove metadata: %v", err)
+	}
+
+	err := h.client.Call(ctx, MethodSessionSetMode, SetSessionModeParams{SessionID: created.SessionID, ModeID: string(agent.PermissionModePlan)}, &SetSessionModeResult{})
+	var rpcErr *rpcError
+	if !errors.As(err, &rpcErr) || rpcErr.Code != codeInternalError {
+		t.Fatalf("set_mode with an unsavable mode = %v, want internal error", err)
+	}
+
+	mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("still auto")}}, &PromptResult{})
+	if captured.PermissionMode != agent.PermissionModeAuto {
+		t.Fatalf("failed set_mode changed the live mode: PermissionMode = %q, want auto", captured.PermissionMode)
+	}
+}
@@ -3,7 +3,7 @@ package acp
 import (
 	"encoding/json"

-	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/agent"
 )

 // permission.go maps ZERO's permission prompt model onto ACP's
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/agent"
 )

 func escalationRequest(escalates bool) agent.PermissionRequest {
@@ -3,7 +3,7 @@ package acp
 import (
 	"testing"

-	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/agent"
 )

 func TestBuildPermissionOptions(t *testing.T) {
@@ -8,8 +8,8 @@ import (
 	"unicode"
 	"unicode/utf8"

-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/tools"
 )

 // translate.go maps ZERO's agent events onto ACP session/update payloads. The
@@ -83,7 +83,7 @@ func browserToolDetails(name string) (*BrowserToolDetails, bool) {
 	}
 }

-const zeroBrowserMetaKey = "github.com/Gitlawb/zero/browser"
+const zeroBrowserMetaKey = "github.com/Twigpine/zero/browser"

 // attachBrowserToolDetails stores ZERO's browser descriptor in ACP's reserved
 // extension channel. Keeping this in one helper prevents start, result, and
@@ -8,8 +8,8 @@ import (
 	"unicode"
 	"unicode/utf8"

-	"github.com/Gitlawb/zero/internal/agent"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/tools"
 )

 func browserDescriptor(t *testing.T, update ToolCallUpdate) BrowserToolDetails {
@@ -0,0 +1,309 @@
+package acp
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Twigpine/zero/internal/sessions"
+	"github.com/Twigpine/zero/internal/zeroruntime"
+)
+
+// `zero exec` persists every provider usage report as a session usage event, so
+// `zero usage report --session <id>` can total a run. The ACP agent did not set
+// OnUsage, which dropped the token counts of every ACP session. A turn with two
+// provider requests (a tool round trip) must leave two usage events, in the shape
+// the usage report reads, next to the turn's messages.
+func TestACPPromptPersistsProviderUsage(t *testing.T) {
+	deps := testDeps(t)
+	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
+		if opts.OnUsage == nil {
+			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
+			return agent.Result{FinalAnswer: "done"}, nil
+		}
+		opts.OnUsage(agent.Usage{InputTokens: 1200, OutputTokens: 34})
+		opts.OnUsage(agent.Usage{InputTokens: 1300, OutputTokens: 21, CachedInputTokens: 900})
+		return agent.Result{FinalAnswer: "done"}, nil
+	}
+
+	h := newHarness(t, deps)
+	defer h.stop()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var created NewSessionResult
+	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
+		t.Fatal(err)
+	}
+	var result PromptResult
+	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
+		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("count my tokens")},
+	}, &result); err != nil {
+		t.Fatalf("session/prompt: %v", err)
+	}
+
+	events, err := deps.Store.ReadEvents(created.SessionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	type usagePayload struct {
+		PromptTokens      int `json:"promptTokens"`
+		CompletionTokens  int `json:"completionTokens"`
+		TotalTokens       int `json:"totalTokens"`
+		CachedInputTokens int `json:"cachedInputTokens"`
+	}
+	var got []usagePayload
+	messages := 0
+	for _, event := range events {
+		switch event.Type {
+		case sessions.EventUsage:
+			var payload usagePayload
+			if err := json.Unmarshal(event.Payload, &payload); err != nil {
+				t.Fatalf("usage payload %s: %v", event.Payload, err)
+			}
+			assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
+			got = append(got, payload)
+		case sessions.EventMessage:
+			messages++
+		}
+	}
+	want := []usagePayload{
+		{PromptTokens: 1200, CompletionTokens: 34, TotalTokens: 1234},
+		{PromptTokens: 1300, CompletionTokens: 21, TotalTokens: 1321, CachedInputTokens: 900},
+	}
+	if len(got) != len(want) {
+		t.Fatalf("usage events = %+v, want %+v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("usage event %d = %+v, want %+v", i, got[i], want[i])
+		}
+	}
+	if messages != 2 {
+		t.Fatalf("message events = %d, want the user and assistant messages of the turn", messages)
+	}
+}
+
+// Usage joins the turn's buffered batch, so a hard run failure that aborts the
+// turn leaves nothing durable, exactly as it does for the turn's messages.
+func TestACPHardTurnFailureDropsItsUsageWithTheTurn(t *testing.T) {
+	deps := testDeps(t)
+	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
+		if opts.OnUsage == nil {
+			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
+			return agent.Result{}, errors.New("injected hard run failure")
+		}
+		opts.OnUsage(agent.Usage{InputTokens: 500, OutputTokens: 5})
+		return agent.Result{}, errors.New("injected hard run failure")
+	}
+
+	h := newHarness(t, deps)
+	defer h.stop()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var created NewSessionResult
+	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
+		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("failing turn")},
+	}, &PromptResult{}); err == nil {
+		t.Fatal("hard RunAgent failure was reported as a successful turn")
+	}
+	events, err := deps.Store.ReadEvents(created.SessionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(events) != 0 {
+		t.Fatalf("aborted turn left durable events: %+v", events)
+	}
+}
+
+// StopCancelled is a successful ACP outcome: the turn commits. Tokens the
+// provider already reported were spent, so they stay in the session log even
+// though the client cancelled. A hard error (the test above) is the path that
+// drops them.
+func TestACPCancelledTurnKeepsReportedUsage(t *testing.T) {
+	deps := testDeps(t)
+	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
+		if opts.OnUsage == nil {
+			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
+			return agent.Result{}, context.Canceled
+		}
+		opts.OnUsage(agent.Usage{InputTokens: 80, OutputTokens: 3})
+		return agent.Result{FinalAnswer: "partial"}, context.Canceled
+	}
+
+	h := newHarness(t, deps)
+	defer h.stop()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var created NewSessionResult
+	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
+		t.Fatal(err)
+	}
+	var result PromptResult
+	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
+		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("cancelled turn")},
+	}, &result); err != nil {
+		t.Fatalf("cancelled turn returned an RPC error: %v", err)
+	}
+	if result.StopReason != StopCancelled {
+		t.Fatalf("stop reason = %q, want %q", result.StopReason, StopCancelled)
+	}
+	events, err := deps.Store.ReadEvents(created.SessionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	usageEvents := 0
+	for _, event := range events {
+		if event.Type != sessions.EventUsage {
+			continue
+		}
+		usageEvents++
+		assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
+		var payload struct {
+			PromptTokens     int `json:"promptTokens"`
+			CompletionTokens int `json:"completionTokens"`
+			TotalTokens      int `json:"totalTokens"`
+		}
+		if err := json.Unmarshal(event.Payload, &payload); err != nil {
+			t.Fatal(err)
+		}
+		if payload.PromptTokens != 80 || payload.CompletionTokens != 3 || payload.TotalTokens != 83 {
+			t.Fatalf("cancelled-turn usage = %+v, want 80/3/83", payload)
+		}
+	}
+	if usageEvents != 1 {
+		t.Fatalf("usage events = %d, want the one report from the cancelled turn", usageEvents)
+	}
+}
+
+// Usage events sit in the same log session/load and session/resume read, but
+// history reconstruction skips them. The wire replay stays the conversation,
+// and the next turn's prompt stays the conversation: token counts never become
+// context and never cross the ACP wire.
+func TestACPLoadAndResumeIgnoreUsageEvents(t *testing.T) {
+	const userLine = "unique-acp-user-line"
+	const answer = "unique-acp-answer"
+	deps := testDeps(t)
+	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
+		if opts.OnUsage == nil {
+			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
+			return agent.Result{FinalAnswer: answer}, nil
+		}
+		opts.OnUsage(agent.Usage{InputTokens: 1200, OutputTokens: 34})
+		return agent.Result{FinalAnswer: answer}, nil
+	}
+
+	workspace := t.TempDir()
+	h := newHarness(t, deps)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var created NewSessionResult
+	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: workspace}, &created); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
+		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock(userLine)},
+	}, &PromptResult{}); err != nil {
+		t.Fatalf("session/prompt: %v", err)
+	}
+	h.stop()
+
+	events, err := deps.Store.ReadEvents(created.SessionID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sawUsage := false
+	for _, event := range events {
+		if event.Type == sessions.EventUsage {
+			sawUsage = true
+			assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
+		}
+	}
+	if !sawUsage {
+		t.Fatal("session log has no usage event to ignore")
+	}
+
+	loader := newHarness(t, deps)
+	if err := loader.client.Call(ctx, MethodSessionLoad, LoadSessionParams{
+		SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{},
+	}, &LoadSessionResult{}); err != nil {
+		t.Fatalf("session/load: %v", err)
+	}
+	var replayed []string
+	for {
+		select {
+		case update := <-loader.notifications:
+			replayed = append(replayed, update.Content.Text)
+		case <-time.After(150 * time.Millisecond):
+			goto drained
+		}
+	}
+drained:
+	loader.stop()
+	if len(replayed) != 2 || replayed[0] != userLine || replayed[1] != answer {
+		t.Fatalf("session/load replay = %#v, want the user line and the answer only", replayed)
+	}
+	for _, text := range replayed {
+		if strings.Contains(text, "promptTokens") || strings.Contains(text, "1200") {
+			t.Fatalf("session/load replayed usage onto the wire: %q", text)
+		}
+	}
+
+	var gotPrompt string
+	deps.RunAgent = func(_ context.Context, prompt string, _ zeroruntime.Provider, _ agent.Options) (agent.Result, error) {
+		gotPrompt = prompt
+		return agent.Result{FinalAnswer: "continued"}, nil
+	}
+	resumer := newHarness(t, deps)
+	defer resumer.stop()
+	if err := resumer.client.Call(ctx, MethodSessionResume, ResumeSessionParams{
+		SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{},
+	}, &ResumeSessionResult{}); err != nil {
+		t.Fatalf("session/resume: %v", err)
+	}
+	if err := resumer.client.Call(ctx, MethodSessionPrompt, PromptParams{
+		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("carry on")},
+	}, &PromptResult{}); err != nil {
+		t.Fatalf("resumed session/prompt: %v", err)
+	}
+	if !strings.Contains(gotPrompt, userLine) || !strings.Contains(gotPrompt, answer) {
+		t.Fatalf("resumed prompt = %q, want the prior conversation", gotPrompt)
+	}
+	if strings.Contains(gotPrompt, "promptTokens") || strings.Contains(gotPrompt, "1200") {
+		t.Fatalf("resumed prompt contains persisted usage: %q", gotPrompt)
+	}
+}
+
+// usagePayloadAllowedKeys is the non-escalating EventUsagePayload shape. ACP
+// has no model escalation, and the writer must not grow a prompt, tool
+// argument, or other raw field.
+var usagePayloadAllowedKeys = map[string]bool{
+	"promptTokens":      true,
+	"completionTokens":  true,
+	"totalTokens":       true,
+	"cachedInputTokens": true,
+	"cacheWriteTokens":  true,
+	"reasoningTokens":   true,
+}
+
+func assertUsagePayloadIsTokenCountsOnly(t *testing.T, payload json.RawMessage) {
+	t.Helper()
+	var raw map[string]json.RawMessage
+	if err := json.Unmarshal(payload, &raw); err != nil {
+		t.Fatalf("usage payload %s: %v", payload, err)
+	}
+	if len(raw) == 0 {
+		t.Fatalf("usage payload is empty: %s", payload)
+	}
+	for key := range raw {
+		if !usagePayloadAllowedKeys[key] {
+			t.Fatalf("usage payload key %q is not a token count: %s", key, payload)
+		}
+	}
+}
@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func enabledSelfCorrector(t *testing.T) *SelfCorrector {
@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
 )

 type normalizationRecordingShellTool struct {
@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // providerCallingAskUserThenAnswer returns a mock provider whose first turn calls
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"

-	"github.com/Gitlawb/zero/internal/testutil"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/testutil"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func TestAsyncDiagnosticsNilCollectorNoOps(t *testing.T) {
@@ -5,8 +5,8 @@ import (
 	"runtime"
 	"strings"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
 	"mvdan.cc/sh/v3/syntax"
 )

@@ -4,8 +4,8 @@ import (
 	"runtime"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
 )

 func TestProposedCommandPrefixUsesSafeSimpleCommands(t *testing.T) {
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"unicode/utf8"

-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // Session compaction.
@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // compactableHistory returns a history whose middle is large enough to trip
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func TestCompactMessagesReturnsMetadataForManualCompaction(t *testing.T) {
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"unicode/utf8"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // Compaction preservation.
@@ -6,8 +6,8 @@ import (
 	"testing"
 	"unicode/utf8"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // stateConversation is a long enough conversation that Compact elides a middle
@@ -6,7 +6,7 @@ import (
 	"regexp"
 	"strings"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 const (
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"unicode/utf8"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func TestClipBytesHandlesTinyLimitsOnRuneBoundaries(t *testing.T) {
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // recentEdits extracts each mutated file's path and a one-line note from the
@@ -8,7 +8,7 @@ import (
 	"sync/atomic"
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 var markerPattern = regexp.MustCompile(`msg-\d+`)
@@ -6,9 +6,9 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // --- Pure Compact() tests -------------------------------------------------
@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // someRequestContains reports whether any message sent to the provider across all
@@ -3,7 +3,7 @@ package agent
 import (
 	"encoding/json"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // Context budget.
@@ -3,7 +3,7 @@ package agent
 import (
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func TestMeasureContextSplitsByCategory(t *testing.T) {
@@ -3,7 +3,7 @@ package agent
 import (
 	"strings"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 type contextPlannerConfig struct {
@@ -4,7 +4,7 @@ import (
 	"reflect"
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func TestContextPlannerPreservesProviderRequest(t *testing.T) {
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/tools"
 )

 // richMCPTool mimics a real MCP tool's schema (Exa/Firecrawl-style search): an
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func TestOptionsDeferThresholdFieldExists(t *testing.T) {
@@ -4,8 +4,8 @@ import (
 	"context"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
 )

 func TestExecuteToolCallCategorizesFilteredDenial(t *testing.T) {
@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/tools"
 )

 // argsPermTool implements tools.ArgsPermissioner; plainTool does not.
@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // TestOptionsModelSwitcherFieldExists asserts the escalation hook is an
@@ -2,8 +2,8 @@
 package agent

 import (
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func equalStringSlices(left []string, right []string) bool {
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"

-	"github.com/Gitlawb/zero/internal/lsp"
+	"github.com/Twigpine/zero/internal/lsp"
 )

 // fileDiagnosticsTimeout bounds one inline post-edit diagnostics check so a
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 type customApplyPatchTool struct {
@@ -4,7 +4,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // Guardrail thresholds for the agent loop. These keep a runaway model from
@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // emptyTurn is a stream that produces no visible text and no tool calls.
@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/hooks"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/hooks"
+	"github.com/Twigpine/zero/internal/tools"
 )

 func TestAppendHookFeedbackFormatsOutput(t *testing.T) {
@@ -11,15 +11,15 @@ import (
 	"strings"
 	"sync"

-	"github.com/Gitlawb/zero/internal/execution"
-	"github.com/Gitlawb/zero/internal/hooks"
-	"github.com/Gitlawb/zero/internal/modelregistry"
-	"github.com/Gitlawb/zero/internal/redaction"
-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/streamjson"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/execution"
+	"github.com/Twigpine/zero/internal/hooks"
+	"github.com/Twigpine/zero/internal/modelregistry"
+	"github.com/Twigpine/zero/internal/redaction"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/streamjson"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 const maxTurnsAnswer = "Agent reached maximum number of turns without a final answer."
@@ -5,7 +5,7 @@ import (
 	"context"
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // imageEchoProvider records the messages of the first request it receives, then
@@ -13,13 +13,13 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/execution"
-	"github.com/Gitlawb/zero/internal/hooks"
-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/specmode"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/execution"
+	"github.com/Twigpine/zero/internal/hooks"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/specmode"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 type mockProvider struct {
@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/tools"
 )

 type safetyTool struct {
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // midStreamAbortProvider connects successfully but emits a transport-abort
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/hooks"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/hooks"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 type propagationOutputTool struct {
@@ -4,7 +4,7 @@ import (
 	"context"
 	"sync"

-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/tools"
 )

 // Parallel read-ahead for tool batches. When a turn requests several
@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // probeTool records execution overlap and ordering so tests can assert what
@@ -3,7 +3,7 @@ package agent
 import (
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/tools"
 )

 func TestPartitionToolsActiveAppendsLoadedToolAfterEagerBlock(t *testing.T) {
@@ -5,8 +5,8 @@ import (
 	"reflect"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // countingSchemaTool records how many times its Parameters() schema is read, so a
@@ -4,8 +4,8 @@ import (
 	"context"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
 )

 // promptShellTool is a minimal shell-style tool whose Safety requires a prompt,
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sandbox"
 )

 func TestPermissionScope(t *testing.T) {
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func planUpdateTurn(status string) zeroruntime.CollectedStream {
@@ -4,8 +4,8 @@ import (
 	"path/filepath"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
 )

 // escalatingEngine allows unsandboxed escalation: no denied reads, so
@@ -1,7 +1,7 @@
 package agent

 import (
-	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sandbox"
 )

 // profileController observes per-turn run signals and decides at most one
@@ -5,10 +5,10 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func TestProfileControllerNilPolicyIsNoOp(t *testing.T) {
@@ -4,8 +4,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // These ceilings are a deliberate ratchet on Zero's fixed per-turn overhead — the
@@ -8,7 +8,7 @@ import (
 	"sort"
 	"strings"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // promptSubstrings are the cacheable components of the prompt a run sends to a
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // TestComputePrefixFingerprintStableAcrossCalls asserts the headline property
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"strings"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // Stale tool-output pruning reclaims context at ZERO token/latency cost before
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // bigToolResult builds a tool-result message with approximately tokens worth of
@@ -7,9 +7,9 @@ import (
 	"strings"
 	"time"

-	"github.com/Gitlawb/zero/internal/errhint"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/errhint"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // Mid-stream reconnect: a long autonomous task (a big refactor, a swarm member,
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"

-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // flakyProvider fails the first failBefore connect attempts with failErr, then
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 func TestRequestPermissionsTurnGrantAllowsLaterToolAndCleansUp(t *testing.T) {
@@ -7,10 +7,10 @@ import (
 	"path/filepath"
 	"strings"

-	"github.com/Gitlawb/zero/internal/lsp"
-	"github.com/Gitlawb/zero/internal/redaction"
-	"github.com/Gitlawb/zero/internal/trace"
-	"github.com/Gitlawb/zero/internal/verify"
+	"github.com/Twigpine/zero/internal/lsp"
+	"github.com/Twigpine/zero/internal/redaction"
+	"github.com/Twigpine/zero/internal/trace"
+	"github.com/Twigpine/zero/internal/verify"
 )

 // defaultSelfCorrectMaxAttempts bounds how many corrective rounds a single run
@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/lsp"
-	"github.com/Gitlawb/zero/internal/verify"
+	"github.com/Twigpine/zero/internal/lsp"
+	"github.com/Twigpine/zero/internal/verify"
 )

 type fakeVerifier struct {
@@ -5,8 +5,8 @@ import (
 	"sync/atomic"
 	"testing"

-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/zeroruntime"
 )

 // stallProvider connects successfully (HTTP 200) but the stream emits a stall/idle
@@ -9,10 +9,10 @@ import (
 	"strings"
 	"unicode/utf8"

-	"github.com/Gitlawb/zero/internal/config"
-	"github.com/Gitlawb/zero/internal/repomap"
-	"github.com/Gitlawb/zero/internal/tools"
-	"github.com/Gitlawb/zero/internal/workspaceseed"
+	"github.com/Twigpine/zero/internal/config"
+	"github.com/Twigpine/zero/internal/repomap"
+	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Twigpine/zero/internal/workspaceseed"
 )

 // coreSystemPrompt is the de-branded coding-craft instruction set: identity,
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"

-	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Twigpine/zero/internal/sandbox"
 )

 // TestMain points userConfigDirForPrompt at an empty, package-wide temp