test(acp): require nullable diff fields on wire

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +1,11 @@
 blank_issues_enabled: false
 contact_links:
   - name: Questions and setup help
-    url: https://github.com/Twigpine/zero/discussions/categories/q-a
+    url: https://github.com/Gitlawb/zero/discussions/categories/q-a
     about: Ask in Discussions Q&A. Include zero --version, your OS, provider/model, and zero doctor output for setup problems.
   - name: Feature ideas
-    url: https://github.com/Twigpine/zero/discussions/categories/ideas
+    url: https://github.com/Gitlawb/zero/discussions/categories/ideas
     about: Propose and discuss ideas in Discussions before opening a PR (Zero is in controlled development, see CONTRIBUTING.md).
   - name: Security vulnerability
-    url: https://github.com/Twigpine/zero/security/advisories/new
+    url: https://github.com/Gitlawb/zero/security/advisories/new
     about: Report security issues privately via GitHub Security Advisories (see SECURITY.md). Do not file a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -5,7 +5,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        New feature ideas start in [Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
+        New feature ideas start in [Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
         not here. This form is for the step after that: an idea that gained traction in Discussions,
         or one a maintainer asked to have tracked as an issue. Please link the discussion below.
         Do not begin implementation until the issue has been reviewed and marked with the

.github/workflows/pr-auto-review.yml

@@ -24,7 +24,6 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
-          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff

.github/workflows/release-artifacts.yml

@@ -34,15 +34,12 @@ jobs:
       - name: Checkout
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.ref == '' }}
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
 
       - name: Checkout requested ref
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.ref != '' }}
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ inputs.ref }}
-          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
@@ -100,21 +97,19 @@ jobs:
           gh release create "$tag" --repo "$GITHUB_REPOSITORY" --title "$tag" --generate-notes 2>/dev/null || true
           gh release upload "$tag" dist/release/* --repo "$GITHUB_REPOSITORY" --clobber
 
-  # Publishes the npm package named in package.json (@twigpine/zero): first
-  # the five platform payloads (versions of the SAME package at suffixed
-  # versions like X.Y.Z-linux-x64, carrying the native binary + vendored
-  # helpers), then the wrapper at X.Y.Z whose optionalDependencies alias those
-  # platform versions. Platform versions MUST publish first — the wrapper pins
-  # them exactly, so the reverse order would open a window where installs
-  # resolve aliases that 404. See docs/NPM_PACKAGING.md for the full contract.
+  # Publishes @gitlawb/zero to npm: first the five platform payloads (versions
+  # of the SAME package at suffixed versions like X.Y.Z-linux-x64, carrying the
+  # native binary + vendored helpers), then the wrapper at X.Y.Z whose
+  # optionalDependencies alias those platform versions. Platform versions MUST
+  # publish first — the wrapper pins them exactly, so the reverse order would
+  # open a window where installs resolve aliases that 404. See
+  # docs/NPM_PACKAGING.md for the full contract.
   #
   # Auth is npm OIDC trusted publishing: no NPM_TOKEN secret. The package's
-  # npmjs.com settings must list this repo + workflow file + the npm-publish
-  # environment as a trusted publisher, and provenance is then generated
-  # automatically. npm checks provenance against package.json `repository`,
-  # so that must name this repository. Note npm only allows configuring a
-  # trusted publisher on an EXISTING package, so a new package name starts
-  # with a one-time manual `npm publish` of an empty 0.0.0 placeholder.
+  # npmjs.com settings must list this repo + workflow file as a trusted
+  # publisher, and provenance is then generated automatically. Note npm only
+  # allows configuring a trusted publisher on an EXISTING package, so the very
+  # first @gitlawb/zero publish is a one-time manual `npm publish` bootstrap.
   # Because the platform payloads are versions of the same package, they reuse
   # that single trusted-publisher configuration.
   publish-npm:
@@ -127,15 +122,13 @@ jobs:
     # maintainer approves it in the Actions UI before anything reaches npm.
     environment:
       name: npm-publish
-      url: https://www.npmjs.com/package/@twigpine/zero
+      url: https://www.npmjs.com/package/@gitlawb/zero
     permissions:
       contents: read
       id-token: write # OIDC token exchange for npm trusted publishing + provenance
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
 
       # No registry-url here on purpose: setup-node's registry-url writes an
       # .npmrc line referencing $NODE_AUTH_TOKEN, and npm hard-fails on the
@@ -203,13 +196,47 @@ jobs:
       - name: Assemble npm packages
         run: node scripts/npm/build-platform-packages.mjs --artifacts-dir dist/artifacts --out-dir dist/npm
 
-      # Platform payloads first under the `platform` dist-tag, then the wrapper,
-      # with the `latest` dist-tag checked before and after (platform versions
-      # are semver PRERELEASES of the wrapper version and must never become
-      # `latest`). npm applies publishes asynchronously, so the script waits
-      # until npm shows every platform version before the wrapper goes out,
-      # and until `latest` moves after it. Versions already on the registry
-      # are skipped, so "Re-run failed jobs" is safe after a partial publish.
-      - name: Publish npm packages
+      # Platform versions are semver PRERELEASES of the wrapper version
+      # (X.Y.Z-linux-x64), so they must never publish under the default
+      # `latest` dist-tag — that would make `npm install @gitlawb/zero`
+      # deliver a platform payload as the CLI. Publish them under a dedicated
+      # tag and assert `latest` survived before the wrapper goes out.
+      - name: Publish platform packages to npm
         shell: bash
-        run: scripts/npm/publish-packages.sh dist/npm
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          for dir in dist/npm/platforms/*/; do
+            echo "publishing ${dir}"
+            (cd "$dir" && npm publish --access public --tag platform)
+          done
+          # Tolerate a failed lookup (registry lag, or no latest tag yet on a
+          # bootstrap publish): under set -e a bare failure here would abort
+          # AFTER the platform payloads went out, leaving no wrapper and a
+          # re-run that fails on republishing existing versions. An empty
+          # value falls through the guard below.
+          latest="$(npm view @gitlawb/zero dist-tags.latest || true)"
+          case "$latest" in
+            "${version}-"*)
+              echo "::error::dist-tag latest points at platform version ${latest} — a platform publish clobbered it. Fix the dist-tag before the wrapper publish." >&2
+              exit 1
+              ;;
+          esac
+          echo "dist-tag latest is ${latest} (unchanged by platform publishes)."
+
+      - name: Publish wrapper to npm
+        shell: bash
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          (cd dist/npm/wrapper && npm publish --access public)
+          # Confirm the wrapper owns `latest` (retry: registry metadata can lag
+          # a publish by a few seconds).
+          for attempt in 1 2 3 4 5; do
+            latest="$(npm view @gitlawb/zero dist-tags.latest || true)"
+            if [ "$latest" = "$version" ]; then
+              echo "dist-tag latest is ${version}."
+              exit 0
+            fi
+            sleep 5
+          done
+          echo "::error::dist-tag latest is ${latest}, expected ${version} after the wrapper publish." >&2
+          exit 1

.github/workflows/zero-action-smoke.yml

@@ -5,8 +5,6 @@ on:
     paths:
       - action.yml
       - docs/GITHUB_ACTION.md
-      - scripts/action-summary.mjs
-      - scripts/action-summary.test.mjs
       - .github/workflows/zero-action-smoke.yml
   push:
     branches:
@@ -14,8 +12,6 @@ on:
     paths:
       - action.yml
       - docs/GITHUB_ACTION.md
-      - scripts/action-summary.mjs
-      - scripts/action-summary.test.mjs
       - .github/workflows/zero-action-smoke.yml
 
 permissions:
@@ -31,14 +27,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 24
-
-      - name: Run action-summary test suite
-        run: node --test scripts/action-summary.test.mjs
-
       - name: Parse action.yml and assert documented inputs
         shell: bash
         run: |

.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.12.0"}
+{".":"0.8.0"}

CHANGELOG.md

@@ -6,149 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once the first release is
 tagged. Until then, source builds report the version `dev`.
 
-## [0.12.0](https://github.com/Twigpine/zero/compare/v0.11.0...v0.12.0) (2026-11-02)
-
-
-### Features
-
-* **providers:** add MiniMax-M3.1-Flash to catalog ([#1180](https://github.com/Twigpine/zero/issues/1180)) ([d99f92b](https://github.com/Twigpine/zero/commit/d99f92b81a671f186cede81614c89b8e8a7f9451))
-* **sandbox:** support self-exec pattern to eliminate separate helper binary ([#946](https://github.com/Twigpine/zero/issues/946)) ([8c4e759](https://github.com/Twigpine/zero/commit/8c4e7597989ef9b3ca67b7703dfd15d92372aed2))
-* **skills:** install a skill's bundled files and point the skill tool at them ([#1167](https://github.com/Twigpine/zero/issues/1167)) ([1641506](https://github.com/Twigpine/zero/commit/164150633a8b2e6ae864ae02fd7105b201eeb68e))
-
-
-### Bug Fixes
-
-* **agent:** mark headless guardrail stops incomplete ([#1182](https://github.com/Twigpine/zero/issues/1182)) ([5aa54fe](https://github.com/Twigpine/zero/commit/5aa54fe1d2b419c9bbef73605a77919c9007cf7b))
-* bump Go to 1.26.10 for GO-2026-6809 ([#1168](https://github.com/Twigpine/zero/issues/1168)) ([6393a90](https://github.com/Twigpine/zero/commit/6393a90ed618a3536e09c02852f4ec829b97545b))
-* **chatgpt:** refresh subscription defaults and compatibility version ([#1179](https://github.com/Twigpine/zero/issues/1179)) ([f912f80](https://github.com/Twigpine/zero/commit/f912f80d002602e11ba0ef8548ecee58442874aa))
-* **deps:** refresh the lockfile to hono 4.13.13 ([#1171](https://github.com/Twigpine/zero/issues/1171)) ([de1443b](https://github.com/Twigpine/zero/commit/de1443b2edb44fd3747cc77200d54dc8cffcd0a7))
-* **oauth:** reuse the crash-safe secret store and sync encrypted publications ([#1165](https://github.com/Twigpine/zero/issues/1165)) ([84c1b15](https://github.com/Twigpine/zero/commit/84c1b1554076679a342e9cac61f8f8cdbaf3a429))
-* **redaction:** redact credentials whose trigger a greedy span swallowed ([#1158](https://github.com/Twigpine/zero/issues/1158)) ([a97db88](https://github.com/Twigpine/zero/commit/a97db8832fdba077f2d31bdf03ecef8d7c774fe1))
-* **sessions:** capture freeform apply_patch checkpoints ([#1183](https://github.com/Twigpine/zero/issues/1183)) ([6396208](https://github.com/Twigpine/zero/commit/63962081cf130c2171407936ce3beb7021d238b8))
-* **sessions:** preserve image attachment summaries on resume ([#1152](https://github.com/Twigpine/zero/issues/1152)) ([1e84849](https://github.com/Twigpine/zero/commit/1e848492e5c1919d187fb5e1eb5e7ef9bc6140dc)), closes [#1135](https://github.com/Twigpine/zero/issues/1135)
-* **tools:** grep stops where a file's line breaks stop ([#1160](https://github.com/Twigpine/zero/issues/1160)) ([aa9ba84](https://github.com/Twigpine/zero/commit/aa9ba8412eb8917daa2ca5cb3fdbd0a39276fa88))
-* **workspaceindex:** import gitsafe under the Twigpine module path ([#1153](https://github.com/Twigpine/zero/issues/1153)) ([ef4da13](https://github.com/Twigpine/zero/commit/ef4da1323f1097863ae278224b5f304c2fff909a))
-* **workspaceindex:** run Scan's git calls through gitsafe ([#1149](https://github.com/Twigpine/zero/issues/1149)) ([2ffe183](https://github.com/Twigpine/zero/commit/2ffe1831b0950b1463ec46d487d03a5fcb679cc6))
-
-## [0.11.0](https://github.com/Twigpine/zero/compare/v0.10.0...v0.11.0) (2026-10-15)
-
-
-### Features
-
-* **providers:** add Concentrate provider preset ([#1147](https://github.com/Twigpine/zero/issues/1147)) ([61b0936](https://github.com/Twigpine/zero/commit/61b09364f0f45b0fa8aebaf0a6c3d1c55dbe01c3))
-
-
-### Bug Fixes
-
-* **cli:** let providers subcommands run with no active provider ([#1143](https://github.com/Twigpine/zero/issues/1143)) ([d1a0d04](https://github.com/Twigpine/zero/commit/d1a0d048ee2c1e7cbfb75160ec4c9f099f3c4472))
-* **npm:** wait for npm to apply each publish, and drop the one-time @gitlawb/zero steps ([#1145](https://github.com/Twigpine/zero/issues/1145)) ([8e363fc](https://github.com/Twigpine/zero/commit/8e363fcaa5d51bf5b5b244692dc61bf8d4ae8799))
-* **tui,cli:** stop a repository's git config from running programs in Zero's own git calls ([#1133](https://github.com/Twigpine/zero/issues/1133)) ([640d936](https://github.com/Twigpine/zero/commit/640d936bfbe00c4cd3017ca35fb7b5c15d91a1c5))
-* **workspaceindex:** skip git-ignored and build-cache dirs in Scan only ([#1117](https://github.com/Twigpine/zero/issues/1117)) ([c88c77b](https://github.com/Twigpine/zero/commit/c88c77bf701039dca01d9786bf5648d779c949b3))
-
-
-### Performance Improvements
-
-* **redaction:** add fast-path byte checks to eliminate regex allocations on clean strings ([#945](https://github.com/Twigpine/zero/issues/945)) ([ce2fcff](https://github.com/Twigpine/zero/commit/ce2fcffaf10d8e8c8c5a13e06fd7809f09fc9867))
-
-## [0.10.0](https://github.com/Twigpine/zero/compare/v0.9.0...v0.10.0) (2026-10-15)
-
-
-### Features
-
-* **notify:** make permission-prompt alerts on by default and discoverable ([#1001](https://github.com/Twigpine/zero/issues/1001)) ([7f8e5f0](https://github.com/Twigpine/zero/commit/7f8e5f08bb83371ce16cc54c97ab032a010026cf))
-* **npm:** publish as @twigpine/zero ([#1142](https://github.com/Twigpine/zero/issues/1142)) ([530563a](https://github.com/Twigpine/zero/commit/530563a0bb58d3cbadceb97b3ee234ef763124df))
-* **providers:** add GMI Cloud provider preset and partner listing ([#1127](https://github.com/Twigpine/zero/issues/1127)) ([1335ca6](https://github.com/Twigpine/zero/commit/1335ca6671023ecda81a3cfaae7e9f2ff5d6e0de))
-* **providers:** opt-in ZERO_RESPONSE_HEADER_TIMEOUT override for slow first-byte deployments ([#1106](https://github.com/Twigpine/zero/issues/1106)) ([ddc45f2](https://github.com/Twigpine/zero/commit/ddc45f2c8152fdd04b45dc11ed20d246fe7740a5))
-* **runtime:** add process-local per-model RPM admission limits ([#1116](https://github.com/Twigpine/zero/issues/1116)) ([eebb384](https://github.com/Twigpine/zero/commit/eebb384676fb567acc1f5a20dcbb17df8a03dc42))
-* **sessions:** add zero sessions prune, which never removes a session another process has open ([#1089](https://github.com/Twigpine/zero/issues/1089)) ([23c27e0](https://github.com/Twigpine/zero/commit/23c27e0778e3af54c04b8749d1eda846d3253f4e))
-
-
-### Bug Fixes
-
-* **acp:** persist the session permission mode across restarts ([#1134](https://github.com/Twigpine/zero/issues/1134)) ([bb96206](https://github.com/Twigpine/zero/commit/bb96206c2781e846fd13437113eec5790afe9c81)), closes [#1125](https://github.com/Twigpine/zero/issues/1125)
-* **acp:** persist token usage events for ACP sessions ([#1137](https://github.com/Twigpine/zero/issues/1137)) ([300cf62](https://github.com/Twigpine/zero/commit/300cf6275f8c94f06da3f00197d21cb8771842d9)), closes [#1118](https://github.com/Twigpine/zero/issues/1118)
-* **acp:** publish sub-run sessions loaded over ACP as view-only ([#1078](https://github.com/Twigpine/zero/issues/1078)) ([7f11491](https://github.com/Twigpine/zero/commit/7f11491078662b2d389c278f3ce5d41d956670c4))
-* **agent:** retry mid-stream transport aborts before tool dispatch ([#1076](https://github.com/Twigpine/zero/issues/1076)) ([b9ef1d2](https://github.com/Twigpine/zero/commit/b9ef1d271aa6ebc6d9adad2ef4ff0d695bb40da5))
-* **config:** sync atomic config replacements ([#1093](https://github.com/Twigpine/zero/issues/1093)) ([4d2e9f0](https://github.com/Twigpine/zero/commit/4d2e9f0d08472f7304652ef7896df587e1cc6c21))
-* **cron:** bound run history and read recent records from the tail ([#1094](https://github.com/Twigpine/zero/issues/1094)) ([42eb6ab](https://github.com/Twigpine/zero/commit/42eb6ab5fbe4ae9037f1f4cd42a00243c456a22e))
-* **cron:** preserve newer claims when overlapping runs complete ([#1090](https://github.com/Twigpine/zero/issues/1090)) ([2eb9d94](https://github.com/Twigpine/zero/commit/2eb9d94fac56d91d749ea4f96edcf1c87f79b48c))
-* **daemon:** bound pending sessions and prune on completion ([#1091](https://github.com/Twigpine/zero/issues/1091)) ([8a68660](https://github.com/Twigpine/zero/commit/8a68660161b04ce9668363faa14ff72c9fbad223))
-* **daemon:** do not retry workers that finished with a final exit code ([#1112](https://github.com/Twigpine/zero/issues/1112)) ([eefa978](https://github.com/Twigpine/zero/commit/eefa978f6183332b7416c70c25242bcdfba1a75c)), closes [#1100](https://github.com/Twigpine/zero/issues/1100)
-* **daemon:** stop worker process groups by their launch-time identity ([#1088](https://github.com/Twigpine/zero/issues/1088)) ([ab018b3](https://github.com/Twigpine/zero/commit/ab018b3098b5cb103cf8f90b8698d32a6687bdf7)), closes [#861](https://github.com/Twigpine/zero/issues/861)
-* **deps:** refresh the lockfile to patched hono and @hono/node-server ([#1080](https://github.com/Twigpine/zero/issues/1080)) ([aa52040](https://github.com/Twigpine/zero/commit/aa52040498e012c41d5e8f6027a91c18eff861d4))
-* **deps:** refresh the lockfile to patched shell-quote ([#1131](https://github.com/Twigpine/zero/issues/1131)) ([c56a4c4](https://github.com/Twigpine/zero/commit/c56a4c4e6e598504ab417e8cc4f5ab8d69f1b42f))
-* **execution:** reserve process capacity before launching ([#1092](https://github.com/Twigpine/zero/issues/1092)) ([bb3346a](https://github.com/Twigpine/zero/commit/bb3346a82883c19ed8815fe1e874f54950711d69))
-* **mcp:** forward image tool results on the existing image channel ([#1077](https://github.com/Twigpine/zero/issues/1077)) ([0324c1d](https://github.com/Twigpine/zero/commit/0324c1d4103328eb90cb24a0b582dba335255b5c))
-* **mcp:** refresh OAuth tokens for discovered endpoints and registered clients ([#1113](https://github.com/Twigpine/zero/issues/1113)) ([571af70](https://github.com/Twigpine/zero/commit/571af701bd3d8dfaf40f87b5b112b25e7def5b29)), closes [#1101](https://github.com/Twigpine/zero/issues/1101)
-* **oauth:** give every loopback callback server the bounded shutdown ([#1079](https://github.com/Twigpine/zero/issues/1079)) ([5473301](https://github.com/Twigpine/zero/commit/547330197b20ece591e077e876a4b8ffd015cb6e))
-* **providers:** send stable session headers to OpenCode ([#1060](https://github.com/Twigpine/zero/issues/1060)) ([99721c7](https://github.com/Twigpine/zero/commit/99721c762f37cd43ac511007a5f51d1846df959e))
-* **redaction:** redact adjacent AWS keys glued end to end ([#1095](https://github.com/Twigpine/zero/issues/1095)) ([df67ede](https://github.com/Twigpine/zero/commit/df67edec13345b73a85327adc003cacc7bdd8009))
-* **redaction:** redact credentials split by an invisible character ([#1067](https://github.com/Twigpine/zero/issues/1067)) ([e20b762](https://github.com/Twigpine/zero/commit/e20b7624261cef8336a8eb0fbdd44d536ad77fc2))
-* **sandbox:** say when a session's sandbox enforcement is degraded ([#1082](https://github.com/Twigpine/zero/issues/1082)) ([6b5852d](https://github.com/Twigpine/zero/commit/6b5852dc18bb256af1f25745697c2f2e3ea6f112))
-* **search:** redact every text field of session metadata, not ten of thirty ([#1073](https://github.com/Twigpine/zero/issues/1073)) ([9520f2b](https://github.com/Twigpine/zero/commit/9520f2bad7e09ce4a8d0d42be7ce77d2ae928ddd))
-* **security:** harden shell flag parsing, write roots, and formatters ([#1066](https://github.com/Twigpine/zero/issues/1066)) ([ac5fe0d](https://github.com/Twigpine/zero/commit/ac5fe0d21849b0f74af428dd3ca12e3b80a8b7aa))
-* **sessions:** keep a session lease for the life of the process, not of the Store ([#1144](https://github.com/Twigpine/zero/issues/1144)) ([883e5be](https://github.com/Twigpine/zero/commit/883e5bec24dac791d1d60618c7f4927f4659b687))
-* **tools:** hint when Windows resolves POSIX paths under root ([#1063](https://github.com/Twigpine/zero/issues/1063)) ([0c6f179](https://github.com/Twigpine/zero/commit/0c6f179a8443d4dfdfbbefe5cc6caf11c2a525f0))
-* **tui:** bound live dictation regions ([#985](https://github.com/Twigpine/zero/issues/985)) ([feb9927](https://github.com/Twigpine/zero/commit/feb992757c582c68f0397e070e206d4bf07071e1))
-* **tui:** show provider ownership in Recent and Favorites ([#1083](https://github.com/Twigpine/zero/issues/1083)) ([1697b7a](https://github.com/Twigpine/zero/commit/1697b7a5ce948e781877cdbe9223adac62c3fde6))
-* **tui:** stop held peer message Allow/Deny from deadlocking Update ([#1111](https://github.com/Twigpine/zero/issues/1111)) ([a195e88](https://github.com/Twigpine/zero/commit/a195e8848cec1a27b4fe1789ecc572b943c32186)), closes [#1099](https://github.com/Twigpine/zero/issues/1099)
-* unbreak main CI (cron claim tests, Go 1.26.9) ([#1124](https://github.com/Twigpine/zero/issues/1124)) ([2c418fc](https://github.com/Twigpine/zero/commit/2c418fc8ff6763de16703128f372fe526fddd331))
-
-## [0.9.0](https://github.com/Gitlawb/zero/compare/v0.8.0...v0.9.0) (2026-09-15)
-
-
-### Features
-
-* **acp:** add standard session list and resume ([#914](https://github.com/Gitlawb/zero/issues/914)) ([c1937df](https://github.com/Gitlawb/zero/commit/c1937dfac72e6ad0e5ade6e48e2d9c17d9c3e5d6))
-* **acp:** emit structured file changes in tool updates ([#999](https://github.com/Gitlawb/zero/issues/999)) ([faec8ee](https://github.com/Gitlawb/zero/commit/faec8ee2017fdd6d0c2c347add892cb73eb413d7))
-* **acp:** surface safe browser tool metadata ([#1000](https://github.com/Gitlawb/zero/issues/1000)) ([a6ec043](https://github.com/Gitlawb/zero/commit/a6ec0435e36b9bea9793b2fd97f2ecd30e3a0f9b))
-* **exec:** default headless runs to the turn-budget ceiling ([#1049](https://github.com/Gitlawb/zero/issues/1049)) ([9e609c5](https://github.com/Gitlawb/zero/commit/9e609c52420fd322f047fc238c04ac81dd623fdd))
-* **tui:** interactive terminal attach for tty exec sessions ([#1055](https://github.com/Gitlawb/zero/issues/1055)) ([d73ec81](https://github.com/Gitlawb/zero/commit/d73ec81e2d3facb5377bc9ad0fe2aa314628a0c0))
-* **tui:** offer mid-run model escalation behind --allow-escalation ([#1019](https://github.com/Gitlawb/zero/issues/1019)) ([91d921f](https://github.com/Gitlawb/zero/commit/91d921f4c5b8289a9e437f786218f1b48f2add5a))
-* **tui:** richer /resume session browser ([#1047](https://github.com/Gitlawb/zero/issues/1047)) ([2f53117](https://github.com/Gitlawb/zero/commit/2f531178f614e587b629e4f81e0470adda647fbd))
-
-
-### Bug Fixes
-
-* **acp:** make configured MCP tools callable ([#1003](https://github.com/Gitlawb/zero/issues/1003)) ([7f5e5af](https://github.com/Gitlawb/zero/commit/7f5e5af7bbdbe5bb4d91706146072d461c0234a4))
-* **agent:** stop the tool-schema ratchet meaning a different thing per host ([#1017](https://github.com/Gitlawb/zero/issues/1017)) ([f909266](https://github.com/Gitlawb/zero/commit/f9092668a832ea73a69551f0ea2df4f6eaf356df))
-* **background:** treat POSIX zombie leader as already-exited ([#981](https://github.com/Gitlawb/zero/issues/981)) ([1aacf38](https://github.com/Gitlawb/zero/commit/1aacf38b727d31b5ca09949316d6afa8292aec46))
-* **config:** lock config read-modify-write across processes ([#960](https://github.com/Gitlawb/zero/issues/960)) ([b04fe96](https://github.com/Gitlawb/zero/commit/b04fe96e9ef3f2deda4fb2a972270300629079d2))
-* **config:** preserve unknown top-level fields ([#984](https://github.com/Gitlawb/zero/issues/984)) ([488def6](https://github.com/Gitlawb/zero/commit/488def68dcc6d36701fdf171e94a74a436b090fc))
-* **daemon:** publish status files atomically ([#949](https://github.com/Gitlawb/zero/issues/949)) ([9001421](https://github.com/Gitlawb/zero/commit/90014210d2ada2e3d61f4eca5087d3f35a3c4b8b))
-* **installtxn:** put back an install a killed commit left behind ([#997](https://github.com/Gitlawb/zero/issues/997)) ([2837f5e](https://github.com/Gitlawb/zero/commit/2837f5efb38dcd3c69771b0ba31565f98a206120))
-* let the configured forward proxy through the loopback guard ([#1025](https://github.com/Gitlawb/zero/issues/1025)) ([1e4db7c](https://github.com/Gitlawb/zero/commit/1e4db7c6643ca7e2c3d8e4b8b30371cfbe43561e))
-* **lockutil:** use kernel-held advisory locks ([#950](https://github.com/Gitlawb/zero/issues/950)) ([6fe0d1e](https://github.com/Gitlawb/zero/commit/6fe0d1edcdbadea6d566800fbcca739c1cd54ea1))
-* **mcp:** discover OAuth through protected resource metadata ([#991](https://github.com/Gitlawb/zero/issues/991)) ([1b5db17](https://github.com/Gitlawb/zero/commit/1b5db1765672820caac1684b168c9898b5ba3593))
-* **mcp:** reject a server-initiated request as a streamable-HTTP response ([#1054](https://github.com/Gitlawb/zero/issues/1054)) ([2479d94](https://github.com/Gitlawb/zero/commit/2479d946c15dbf74ee3c04a637e97181d1786f08))
-* **oauth:** force-close loopback callback connections past the shutdown deadline ([#1051](https://github.com/Gitlawb/zero/issues/1051)) ([176f5a2](https://github.com/Gitlawb/zero/commit/176f5a242b754a86ea4c7121a8dcc1c0d72cf2e4))
-* **oauth:** Split an oversized keyring token blob across entries ([#1007](https://github.com/Gitlawb/zero/issues/1007)) ([275e248](https://github.com/Gitlawb/zero/commit/275e2486695338ce38193a6e3319f8b6a9a5c33c))
-* **providerio:** close idle connections periodically to prevent HTTP/2 PROTOCOL_ERROR ([#1058](https://github.com/Gitlawb/zero/issues/1058)) ([b76c764](https://github.com/Gitlawb/zero/commit/b76c764b77926891aa67163e6605a2d8540aacaa))
-* **providers:** register Atomic Chat as local OpenAI-compatible runtime ([#550](https://github.com/Gitlawb/zero/issues/550)) ([79fa142](https://github.com/Gitlawb/zero/commit/79fa1422ef1a3691b93342788453ebc284d57f9c))
-* **redaction:** split camelCase keys in normalizeKey ([#994](https://github.com/Gitlawb/zero/issues/994)) ([08fbea7](https://github.com/Gitlawb/zero/commit/08fbea7a3221d2061d88038924f90a4cba9af1ac))
-* **sandbox:** keep a derived ACL target inside the write root it came from ([#1040](https://github.com/Gitlawb/zero/issues/1040)) ([3b43c43](https://github.com/Gitlawb/zero/commit/3b43c43eca968c8619adadc81fcc1a17e220216a))
-* **sandbox:** keep Windows restricted-token SIDs narrow and fail closed on DenyRead ([#1006](https://github.com/Gitlawb/zero/issues/1006)) ([0207f2b](https://github.com/Gitlawb/zero/commit/0207f2b2697149a73ecc89a5ab5db0bd665f1911))
-* **sandbox:** Make WSL backend tests deterministic. ([#948](https://github.com/Gitlawb/zero/issues/948)) ([e59bf78](https://github.com/Gitlawb/zero/commit/e59bf78cabc2703678778b904c27c8bc8ef82bc8))
-* **sandbox:** protect worktree git pointers ([#805](https://github.com/Gitlawb/zero/issues/805)) ([f30f550](https://github.com/Gitlawb/zero/commit/f30f550e6037c53f8521ba2d59c984ae6c574917))
-* **sandbox:** refcount temporary roots so one holder's cleanup cannot revoke another's ([#911](https://github.com/Gitlawb/zero/issues/911)) ([7acac7a](https://github.com/Gitlawb/zero/commit/7acac7acee65565e25089f2a7b5813c086ce65eb))
-* **sessions:** carry an interrupted turn's work into the resume prompt ([#1016](https://github.com/Gitlawb/zero/issues/1016)) ([6ae8396](https://github.com/Gitlawb/zero/commit/6ae8396f0282a5f18a431f0c0ef1a272ecc2ca2b))
-* **sessions:** render resume context fields in key order ([#1043](https://github.com/Gitlawb/zero/issues/1043)) ([da244bc](https://github.com/Gitlawb/zero/commit/da244bcbfcfa05e414567ac0acc3cf8ba745ad7d))
-* **specialist:** keep the pinned model when a specialist is resumed ([#1009](https://github.com/Gitlawb/zero/issues/1009)) ([aadb4a2](https://github.com/Gitlawb/zero/commit/aadb4a27e9cdb41e774e8e1a8f23cf9c2fb50db2))
-* **swarm:** stop original member before handoff ([#957](https://github.com/Gitlawb/zero/issues/957)) ([0021475](https://github.com/Gitlawb/zero/commit/0021475d4c58c91911098f414795512cf60a0b56))
-* **tools:** an edit keeps the reads it did not disturb ([#908](https://github.com/Gitlawb/zero/issues/908)) ([1649008](https://github.com/Gitlawb/zero/commit/1649008506da0e675431dc056251a01891b15cc8))
-* **tools:** make apply_patch tolerant and re-expose edit_file ([#956](https://github.com/Gitlawb/zero/issues/956)) ([2749447](https://github.com/Gitlawb/zero/commit/2749447cdce4ae5dd333538b36fa919b80ecc66d))
-* **tools:** reject fuzzy edits with drifted content ([#983](https://github.com/Gitlawb/zero/issues/983)) ([8b3d1b1](https://github.com/Gitlawb/zero/commit/8b3d1b1597b04bfa6d4bc7f912abc13ca80a6298))
-* **tools:** say when format-on-write ran out of time ([#1044](https://github.com/Gitlawb/zero/issues/1044)) ([6937a30](https://github.com/Gitlawb/zero/commit/6937a309cf00825572210a7610a1f3ea8b74c2f9))
-* **tui:** move voice capture to Ctrl+Space ([#968](https://github.com/Gitlawb/zero/issues/968)) ([eeea330](https://github.com/Gitlawb/zero/commit/eeea3308fed38b37b203522624babaf2f30df91f))
-* **update:** keep Windows failed-restore state in trusted recovery records ([#979](https://github.com/Gitlawb/zero/issues/979)) ([a3852ba](https://github.com/Gitlawb/zero/commit/a3852bac595e06c5d3ca9da22212b281b8796802))
-
-
-### Performance Improvements
-
-* **agent:** cheap compaction — dedicated summarizer model, input cap… ([#532](https://github.com/Gitlawb/zero/issues/532)) ([6645f97](https://github.com/Gitlawb/zero/commit/6645f9744b37dda4d52ecc4631578d62cefc89de))
-* **providers:** parallelize isolated provider unit tests and shrink retry backoffs ([#955](https://github.com/Gitlawb/zero/issues/955)) ([d6b25fc](https://github.com/Gitlawb/zero/commit/d6b25fc3039a6b7d72a5703a87a097449792b102))
-* reduce startup and turn overhead ([#932](https://github.com/Gitlawb/zero/issues/932)) ([1fde941](https://github.com/Gitlawb/zero/commit/1fde941803c4295c11a4a14559f3c5217d1a9e69))
-
 ## [0.8.0](https://github.com/Gitlawb/zero/compare/v0.7.0...v0.8.0) (2026-08-21)
 
 

CONTRIBUTING.md

@@ -9,9 +9,9 @@ reports, feature requests, reproduction details, logs, and discussion on existin
 issues.
 
 Questions and setup help belong in
-[GitHub Discussions](https://github.com/Twigpine/zero/discussions) (see
+[GitHub Discussions](https://github.com/Gitlawb/zero/discussions) (see
 [SUPPORT.md](SUPPORT.md)), not in the issue tracker. Feature ideas start in the
-[Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) category;
+[Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas) category;
 an idea that gains traction there is the path to an approved issue and,
 eventually, an accepted PR.
 
@@ -41,7 +41,7 @@ There are three primary ways to contribute:
 
 1. Open a bug report with clear reproduction steps.
 2. Propose a feature in
-   [Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
+   [Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
    describing the problem, use case, and expected behavior. A feature-request
    issue is filed only after the idea gains traction there or a maintainer asks
    for one.
@@ -193,7 +193,7 @@ Clear bug reports are the most useful way to help the project during this phase.
 ## Submitting a Feature Request
 
 Feature requests start as a thread in
-[Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
+[Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
 not as an issue. The feature-request issue form exists for the step AFTER that:
 when an idea has gained traction in Discussions or a maintainer has asked for an
 issue to track it. Whether in the discussion or the eventual issue, please
@@ -222,7 +222,7 @@ contribution phase.
 
 General questions, setup help, and "is this a bug or my config" uncertainty all
 go to
-[Discussions Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a).
+[Discussions Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a).
 If you are unsure whether a proposed code change is appropriate, raise it in
 Discussions Ideas or on the relevant issue first and ask. Please keep discussion
 focused, specific, and respectful of maintainer time.

README.md

@@ -4,18 +4,11 @@
 
 <p align="center"><strong>A terminal coding agent you own.</strong></p>
 
-<p align="center">
-  <a href="https://trendshift.io/repositories/70679?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/70679/daily?language=Go" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/70679?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/70679/weekly?language=Go" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/70679?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/70679" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-</p>
-
 <p align="center">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.10+" src="https://img.shields.io/badge/Go-1.26.10+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.6+" src="https://img.shields.io/badge/Go-1.26.6+-00ADD8?logo=go&logoColor=white">
   <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
   <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
-  <a href="https://vercel.com/open-source-program"><img alt="Vercel OSS Program" src="https://vercel.com/oss/program-badge-2026.svg"></a>
   <br>
   <strong>English</strong> | <a href="README_ZH.md">中文</a>
 </p>
@@ -30,79 +23,6 @@ zero exec "fix the failing test in ./pkg"
 zero exec --output-format stream-json < turns.jsonl
 ```
 
-## Partners
-
-<table align="center">
-  <tr>
-    <td align="center" width="150" height="80">
-      <a href="https://twigpine.com">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="https://twigpine.com/logo-dark.png">
-          <img src="https://twigpine.com/logo.png" alt="Twigpine logo" width="72">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://mimo.mi.com">
-        <img src="https://mimo.xiaomi.com/mimo-v2-pro/assets/logo.svg" alt="Xiaomi MiMo logo" width="136">
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://novita.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/novita-logo-dark.svg">
-          <img src="docs/assets/novita-logo.svg" alt="Novita AI logo" width="136">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://concentrate.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/concentrate-logo-dark.svg">
-          <img src="docs/assets/concentrate-logo.svg" alt="Concentrate logo" width="64">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://exa.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/exa-logo-dark.svg">
-          <img src="docs/assets/exa-logo.svg" alt="Exa logo" width="110">
-        </picture>
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center"><a href="https://twigpine.com"><strong>Twigpine</strong></a></td>
-    <td align="center"><a href="https://mimo.mi.com"><strong>Xiaomi MiMo</strong></a></td>
-    <td align="center"><a href="https://novita.ai/"><strong>Novita AI</strong></a></td>
-    <td align="center"><a href="https://concentrate.ai/"><strong>Concentrate</strong></a></td>
-    <td align="center"><a href="https://exa.ai/"><strong>Exa</strong></a></td>
-  </tr>
-  <tr>
-    <td align="center" width="150" height="80">
-      <a href="https://www.gmicloud.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/gmi-cloud-logo-dark.svg">
-          <img src="docs/assets/gmi-cloud-logo.svg" alt="GMI Cloud logo" width="120">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://vercel.com/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/vercel-logo-dark.svg">
-          <img src="docs/assets/vercel-logo.svg" alt="Vercel logo" width="120">
-        </picture>
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center"><a href="https://www.gmicloud.ai/"><strong>GMI Cloud</strong></a></td>
-    <td align="center"><a href="https://vercel.com/"><strong>Vercel</strong></a></td>
-  </tr>
-</table>
-
 ## Why Zero
 
 - **Use the model you want.** Bring OpenAI, Anthropic, Gemini, Groq, OpenRouter,
@@ -126,7 +46,7 @@ zero exec --output-format stream-json < turns.jsonl
 ### npm
 
 ```bash
-npm install -g @twigpine/zero
+npm install -g @gitlawb/zero
 zero
 ```
 
@@ -140,38 +60,26 @@ matching GitHub Release whenever it is missing. Windows on ARM runs the x64
 build under emulation. See [docs/NPM_PACKAGING.md](docs/NPM_PACKAGING.md) for
 how the package is put together.
 
-Installed Zero as `@gitlawb/zero`? The package moved to `@twigpine/zero` in
-0.10.0 and the old name gets no further releases. Both packages provide the
-`zero` command, so quit any running `zero`, then remove the old package first:
-
-```bash
-npm uninstall -g @gitlawb/zero
-npm install -g @twigpine/zero
-```
-
-Your config, sessions, and logins are kept; they live outside the package. For
-Bun, pnpm, and yarn, see [docs/INSTALL.md](docs/INSTALL.md#moving-from-gitlawbzero).
-
 ### Install scripts
 
 Linux/macOS:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
 ```
 
 Windows PowerShell:
 
 ```powershell
-irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
 ```
 
 ### From source
 
-Source builds require Go 1.26.10+.
+Source builds require Go 1.26.6+.
 
 ```bash
-git clone https://github.com/Twigpine/zero.git
+git clone https://github.com/Gitlawb/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -183,18 +91,17 @@ If you are testing before the first public release, build from source:
 go build -o zero ./cmd/zero
 ```
 
-On Linux, native sandboxing needs Bubblewrap. The main `zero` binary re-executes
-itself as the helper when `zero-linux-sandbox` is absent. A separate helper next
-to `zero` or on `PATH` still takes precedence:
+On Linux, build the sandbox helper too if you want native sandboxing:
 
 ```bash
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # optional
-go build -o zero-seccomp ./cmd/zero-seccomp               # optional compatibility wrapper
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
+go build -o zero-seccomp ./cmd/zero-seccomp   # optional compatibility wrapper
 ```
 
-Put `zero` on `PATH` (`~/.local/bin` is a good default). macOS does not need an
-extra helper binary. Windows source builds can use the main `zero.exe` as their
-sandbox helper; release archives still ship standalone Windows helper executables.
+Put `zero` and `zero-linux-sandbox` in the same directory on `PATH`
+(`~/.local/bin` is a good default). macOS does not need an extra helper binary.
+Windows source builds can use the main `zero.exe` as their sandbox helper; release
+archives still ship standalone Windows helper executables.
 
 More install details: [docs/INSTALL.md](docs/INSTALL.md).
 
@@ -226,8 +133,6 @@ export GEMINI_API_KEY=...
 export AIMLAPI_API_KEY=...
 export LONGCAT_API_KEY=...
 export FIREWORKS_API_KEY=...
-export GMI_API_KEY=...
-export CONCENTRATE_API_KEY=...
 export MINIMAX_API_KEY=...
 export MINIMAXI_API_KEY=...
 ```
@@ -250,18 +155,6 @@ To configure Fireworks AI directly, run:
 zero providers setup fireworks --set-active
 ```
 
-To configure GMI Cloud directly, run:
-
-```bash
-zero providers setup gmicloud --set-active
-```
-
-To configure Concentrate directly, run:
-
-```bash
-zero providers setup concentrate --set-active
-```
-
 MiniMax presets use the Anthropic-compatible endpoints for the global and China
 regions:
 
@@ -397,76 +290,6 @@ and can rewrite every request through it, so this is the trust you accept by
 configuring one. Leave the variables unset for the checks to be enforced end to
 end.
 
-The built-in `web_search` tool is registered only when a search backend is
-configured: `ZERO_WEBSEARCH_BASE_URL` (with an optional `ZERO_WEBSEARCH_API_KEY`)
-for a generic JSON endpoint, `ZERO_WEBSEARCH_PROVIDER=searxng` with a SearXNG
-base URL, or the AI/ML API Toolbox:
-
-```bash
-export ZERO_WEBSEARCH_PROVIDER=aimlapi
-```
-
-The AI/ML API backend runs the Toolbox tool `web/search`, and every search is
-billed to your AI/ML API balance: about $0.0013 per result, with a documented
-minimum of $0.0091 per search. Each search is sent with a $0.025 spending cap,
-which the Toolbox enforces. It is used only when
-`ZERO_WEBSEARCH_PROVIDER` is set to `aimlapi`; an AI/ML API key alone never
-enables it. The key is read from your user configuration only; provider
-profiles in a project `.zero` config are not used. It is the aimlapi profile's
-key (the active profile when it is aimlapi, otherwise the first aimlapi
-profile), including a key in the credential store, or `AIMLAPI_API_KEY` when no
-aimlapi profile exists. It is resolved again on every search;
-`ZERO_WEBSEARCH_API_KEY` is not used. When any aimlapi profile, or any profile
-that reads `AIMLAPI_API_KEY`, points at a base URL other than
-`https://api.aimlapi.com/v1`, or `AIMLAPI_INFERENCE_URL` is overridden, the key
-may belong to a proxy, so it is not sent and the search fails without a request.
-Requests go only to
-`https://tools.aimlapi.com` (`ZERO_WEBSEARCH_BASE_URL` is ignored and redirects
-are refused) and carry `X-AIMLAPI-Source: agent/zero` and an
-`X-AIMLAPI-Partner-ID` header. The `domains` argument is sent to the Toolbox as
-`include_domains`, and results are still filtered locally.
-
-### AI/ML API Toolbox backend for `web_fetch`
-
-`web_fetch` can fetch pages through the AI/ML API Toolbox tool
-`search1api/crawl` instead of a direct HTTP GET. It is off unless you choose it:
-
-```bash
-export ZERO_WEBFETCH_PROVIDER=aimlapi
-```
-
-Having an AI/ML API key never switches it on by itself, and any other value (or
-none) keeps the direct fetch. The variable is read on every fetch.
-
-- **Billing:** Toolbox runs are billed to your AI/ML API balance, about
-  $0.0013 per run. Each run is sent with `max_cost_usd` 0.005, so a run
-  priced above that is refused before it starts and not charged. Rate-limited
-  or gateway-failed requests are retried with the same idempotency key, so a
-  retry is never billed twice.
-- **Key:** the key comes from your `aimlapi` provider profile (including a key
-  in the credential store), or from `AIMLAPI_API_KEY` when there is no such
-  profile. It is withheld, and `web_fetch` returns an error, when any `aimlapi`
-  profile or any profile using `AIMLAPI_API_KEY` points at a base URL other than
-  `https://api.aimlapi.com/v1`, or when `AIMLAPI_INFERENCE_URL` is overridden:
-  the key may then belong to a proxy.
-- **Destination:** requests go only to the fixed `https://tools.aimlapi.com`
-  endpoint, with `Authorization: Bearer <key>` and the attribution headers
-  `X-AIMLAPI-Source: agent/zero` and `X-AIMLAPI-Partner-ID`. Redirects are
-  refused. `HTTP_PROXY`/`HTTPS_PROXY` apply to these requests as to Zero's other
-  aimlapi.com calls.
-- **No fallback:** without a usable key, or when the run fails, `web_fetch`
-  returns an error and does not fetch the page directly. Unset the variable to
-  go back to direct fetches.
-- **Remote fetch:** the page is fetched by a remote service, which may serve a
-  cached copy, and the full URL (query string included) is sent to it. The URL
-  checks above still run first, so loopback, private and metadata URLs are
-  never handed to it. The result is Markdown with a
-  `Backend: aimlapi (search1api/crawl)` line; `max_bytes` cuts the Markdown,
-  and `format: "raw"` is refused because the original response is not
-  available. The complete Toolbox run response is limited to 8 MiB before JSON
-  decoding; larger responses return an error even if `max_bytes` is smaller.
-  The remote run may already have been billed when this limit is detected.
-
 For local dev servers, use shell commands such as `curl` through `exec_command`
 so the normal sandbox and permission policy applies. Long-running commands stay
 attached to a background terminal session and can be listed or stopped from the
@@ -490,7 +313,7 @@ zero context          context-budget report
 zero repo-map         deterministic repository map
 zero repo-info        local repository summary
 zero search | find    search local session history
-zero sessions         inspect, resume, fork, rewind, and prune sessions
+zero sessions         inspect, resume, fork, and rewind sessions
 zero spec             manage spec-mode drafts
 zero specialist       manage specialist subagents
 zero skills           manage markdown instruction skills
@@ -508,13 +331,6 @@ zero update --check   check for newer releases
 zero upgrade          download, verify, and install the latest release
 ```
 
-Cron keeps the newest 1,000 run outcomes per job in `runs.jsonl`. Each new run
-atomically replaces the history with the retained tail; existing larger histories
-are trimmed on their next run. Archive the file before that run if you need older
-outcomes. This retention does not delete session directories or reset fire counts.
-Malformed records and legacy lines of 1 MiB or more are skipped when reading or
-compacting history; new records of that size are rejected.
-
 ## Extending Zero
 
 ### Project and personal instructions
@@ -626,19 +442,19 @@ go run ./cmd/zero-release build --goos windows --goarch amd64 --output dist/zero
 Real-time chat happens on the [Discord server](https://discord.gg/CaQDS6wdFn).
 
 Questions, setup help, ideas, and sharing all live in
-[GitHub Discussions](https://github.com/Twigpine/zero/discussions):
+[GitHub Discussions](https://github.com/Gitlawb/zero/discussions):
 
 | Category | Use it for |
 |---|---|
-| [Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) | Setup help, provider/model configuration, "how do I" questions |
-| [Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) | Feature proposals and design discussion before any PR |
-| [Show and tell](https://github.com/Twigpine/zero/discussions/categories/show-and-tell) | Your skills, plugins, MCP setups, themes, and workflows |
-| [Announcements](https://github.com/Twigpine/zero/discussions/categories/announcements) | Releases and project news from the maintainers |
+| [Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a) | Setup help, provider/model configuration, "how do I" questions |
+| [Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas) | Feature proposals and design discussion before any PR |
+| [Show and tell](https://github.com/Gitlawb/zero/discussions/categories/show-and-tell) | Your skills, plugins, MCP setups, themes, and workflows |
+| [Announcements](https://github.com/Gitlawb/zero/discussions/categories/announcements) | Releases and project news from the maintainers |
 
 For a good Q&A answer fast, include `zero --version`, your OS and install
 method, the provider/model in use, and `zero doctor` output. See
 [SUPPORT.md](SUPPORT.md). Bugs belong in
-[issues](https://github.com/Twigpine/zero/issues/new/choose); security reports
+[issues](https://github.com/Gitlawb/zero/issues/new/choose); security reports
 follow [SECURITY.md](SECURITY.md), never a public thread.
 
 ## Contributing

README_ZH.md

@@ -4,18 +4,11 @@
 
 <p align="center"><strong>一个独属于你的终端编码智能体。</strong></p>
 
-<p align="center">
-  <a href="https://trendshift.io/repositories/70679?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/70679/daily?language=Go" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/70679?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/70679/weekly?language=Go" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/70679?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/70679" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-</p>
-
 <p align="center">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.10+" src="https://img.shields.io/badge/Go-1.26.10+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.6+" src="https://img.shields.io/badge/Go-1.26.6+-00ADD8?logo=go&logoColor=white">
   <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
   <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
-  <a href="https://vercel.com/open-source-program"><img alt="Vercel OSS Program" src="https://vercel.com/oss/program-badge-2026.svg"></a>
   <br>
   <a href="README.md">English</a> | <strong>中文</strong>
 </p>
@@ -28,79 +21,6 @@ zero exec "修复 ./pkg 中失败的测试"
 zero exec --output-format stream-json < turns.jsonl
 ```
 
-## 合作伙伴
-
-<table align="center">
-  <tr>
-    <td align="center" width="150" height="80">
-      <a href="https://twigpine.com">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="https://twigpine.com/logo-dark.png">
-          <img src="https://twigpine.com/logo.png" alt="Twigpine logo" width="72">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://mimo.mi.com">
-        <img src="https://mimo.xiaomi.com/mimo-v2-pro/assets/logo.svg" alt="Xiaomi MiMo logo" width="136">
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://novita.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/novita-logo-dark.svg">
-          <img src="docs/assets/novita-logo.svg" alt="Novita AI logo" width="136">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://concentrate.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/concentrate-logo-dark.svg">
-          <img src="docs/assets/concentrate-logo.svg" alt="Concentrate logo" width="64">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://exa.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/exa-logo-dark.svg">
-          <img src="docs/assets/exa-logo.svg" alt="Exa logo" width="110">
-        </picture>
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center"><a href="https://twigpine.com"><strong>Twigpine</strong></a></td>
-    <td align="center"><a href="https://mimo.mi.com"><strong>Xiaomi MiMo</strong></a></td>
-    <td align="center"><a href="https://novita.ai/"><strong>Novita AI</strong></a></td>
-    <td align="center"><a href="https://concentrate.ai/"><strong>Concentrate</strong></a></td>
-    <td align="center"><a href="https://exa.ai/"><strong>Exa</strong></a></td>
-  </tr>
-  <tr>
-    <td align="center" width="150" height="80">
-      <a href="https://www.gmicloud.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/gmi-cloud-logo-dark.svg">
-          <img src="docs/assets/gmi-cloud-logo.svg" alt="GMI Cloud logo" width="120">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://vercel.com/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/vercel-logo-dark.svg">
-          <img src="docs/assets/vercel-logo.svg" alt="Vercel logo" width="120">
-        </picture>
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center"><a href="https://www.gmicloud.ai/"><strong>GMI Cloud</strong></a></td>
-    <td align="center"><a href="https://vercel.com/"><strong>Vercel</strong></a></td>
-  </tr>
-</table>
-
 ## 为什么选择 Zero
 
 - **使用你想要的模型。** 支持 OpenAI、Anthropic、Gemini、Groq、OpenRouter、DeepSeek、Mistral、xAI、Qwen、Kimi、GitHub Models、Ollama、LM Studio、Atomic Chat，或任何 OpenAI/Anthropic 兼容端点。
@@ -115,41 +35,32 @@ zero exec --output-format stream-json < turns.jsonl
 ### npm
 
 ```bash
-npm install -g @twigpine/zero
+npm install -g @gitlawb/zero
 zero
 ```
 
 npm 包是一个小型包装器，其平台构建（Linux 和 macOS 的 x64/arm64、Windows 的 x64，包含浏览器/终端控制辅助工具）作为可选依赖直接从 npm registry 安装——没有安装脚本，也不会从 npm 之外下载任何内容。Bun、pnpm 和 yarn 的行为完全一致，无需任何信任或批准步骤。跳过可选依赖的安装（`--omit=optional`）也能工作：只要二进制文件缺失，包装器就会从对应的 GitHub Release 下载。Windows on ARM 通过模拟运行 x64 构建。详见 [docs/NPM_PACKAGING.md](docs/NPM_PACKAGING.md)。
 
-之前通过 `@gitlawb/zero` 安装过 Zero？从 0.10.0 起，npm 包已迁移到 `@twigpine/zero`，旧包名不再发布新版本。两个包都提供 `zero` 命令，所以请先退出正在运行的 `zero`，再卸载旧包：
-
-```bash
-npm uninstall -g @gitlawb/zero
-npm install -g @twigpine/zero
-```
-
-配置、会话和登录信息都会保留，它们存放在包之外。Bun、pnpm 和 yarn 的命令见 [docs/INSTALL.md](docs/INSTALL.md#moving-from-gitlawbzero)。
-
 ### 安装脚本
 
 Linux/macOS：
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
 ```
 
 Windows PowerShell：
 
 ```powershell
-irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
 ```
 
 ### 从源码构建
 
-源码构建需要 Go 1.26.10+。
+源码构建需要 Go 1.26.6+。
 
 ```bash
-git clone https://github.com/Twigpine/zero.git
+git clone https://github.com/Gitlawb/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -160,14 +71,14 @@ go run ./cmd/zero
 go build -o zero ./cmd/zero
 ```
 
-在 Linux 上，原生沙箱需要 Bubblewrap。主程序 `zero` 在找不到 `zero-linux-sandbox` 时会以自身作为辅助进程重新执行。同目录或 PATH 上的独立 helper 仍优先：
+在 Linux 上，如果你需要原生沙箱，还需要构建沙箱辅助程序：
 
 ```bash
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # 可选
-go build -o zero-seccomp ./cmd/zero-seccomp               # 可选的兼容性包装器
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
+go build -o zero-seccomp ./cmd/zero-seccomp   # 可选的兼容性包装器
 ```
 
-将 `zero` 放在 `PATH` 上（`~/.local/bin` 是一个好的默认选择）。macOS 不需要额外的辅助二进制文件。Windows 源码构建可以使用主 `zero.exe` 作为沙箱辅助程序；发布包仍然附带独立的 Windows 辅助可执行文件。
+将 `zero` 和 `zero-linux-sandbox` 放在 `PATH` 上的同一目录中（`~/.local/bin` 是一个好的默认选择）。macOS 不需要额外的辅助二进制文件。Windows 源码构建可以使用主 `zero.exe` 作为沙箱辅助程序；发布包仍然附带独立的 Windows 辅助可执行文件。
 
 更多安装细节：[docs/INSTALL.md](docs/INSTALL.md)。
 
@@ -195,8 +106,6 @@ export OPENAI_API_KEY=sk-...
 export ANTHROPIC_API_KEY=...
 export GEMINI_API_KEY=...
 export LONGCAT_API_KEY=...
-export GMI_API_KEY=...
-export CONCENTRATE_API_KEY=...
 ```
 
 要直接配置美团 LongCat（LongCat-2.0），运行：
@@ -205,18 +114,6 @@ export CONCENTRATE_API_KEY=...
 zero providers setup longcat --set-active
 ```
 
-要直接配置 GMI Cloud，运行：
-
-```bash
-zero providers setup gmicloud --set-active
-```
-
-要直接配置 Concentrate，运行：
-
-```bash
-zero providers setup concentrate --set-active
-```
-
 对于本地模型，运行 Ollama、LM Studio 或 [Atomic Chat](https://atomic.chat) 桌面应用，
 然后使用 `zero setup` 或 `zero providers detect`。使用 Atomic Chat 时，请先加载模型并启用
 本地 OpenAI 兼容 API（默认地址为 `http://127.0.0.1:1337/v1`），再选择 `atomic-chat-local`。
@@ -321,7 +218,7 @@ zero context          上下文预算报告
 zero repo-map         确定性仓库映射
 zero repo-info        本地仓库摘要
 zero search | find    搜索本地会话历史
-zero sessions         检查、恢复、分叉、回滚和清理会话
+zero sessions         检查、恢复、分叉和回滚会话
 zero spec             管理规范模式草稿
 zero specialist       管理专业子智能体
 zero skills           管理 Markdown 指令技能
@@ -384,14 +281,14 @@ go run ./cmd/zero-release build --goos windows --goarch amd64 --output dist/zero
 实时交流在 [Discord 服务器](https://discord.gg/CaQDS6wdFn) 进行。
 
 提问、安装帮助、想法和分享都在
-[GitHub Discussions](https://github.com/Twigpine/zero/discussions)：
+[GitHub Discussions](https://github.com/Gitlawb/zero/discussions)：
 
 | 分类 | 用途 |
 |---|---|
-| [Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) | 安装帮助、提供商/模型配置、"如何做"类问题 |
-| [Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) | 功能提议和 PR 之前的设计讨论 |
-| [Show and tell](https://github.com/Twigpine/zero/discussions/categories/show-and-tell) | 你的技能、插件、MCP 配置、主题和工作流 |
-| [Announcements](https://github.com/Twigpine/zero/discussions/categories/announcements) | 维护者发布的版本和项目动态 |
+| [Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a) | 安装帮助、提供商/模型配置、"如何做"类问题 |
+| [Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas) | 功能提议和 PR 之前的设计讨论 |
+| [Show and tell](https://github.com/Gitlawb/zero/discussions/categories/show-and-tell) | 你的技能、插件、MCP 配置、主题和工作流 |
+| [Announcements](https://github.com/Gitlawb/zero/discussions/categories/announcements) | 维护者发布的版本和项目动态 |
 
 ## 贡献
 

SECURITY.md

@@ -33,16 +33,4 @@ Please include, where possible:
   depend on a user explicitly disabling the sandbox (`--skip-permissions-unsafe`), are generally
   out of scope — but please report anything you are unsure about.
 - Zero sends no telemetry. Network calls go to the model/tool providers you configure (and, for
-  keyless web search, to Exa's hosted MCP endpoint at `https://mcp.exa.ai/mcp`). The built-in
-  AI/ML API MCP server (`https://mcp.aimlapi.com/mcp`) is off until you run
-  `zero mcp enable aimlapi`. Once enabled, the Bearer key follows the aimlapi
-  profile resolution order (inline key, then the profile's `apiKeyEnv` — default
-  `AIMLAPI_API_KEY` — then the credential store), or `AIMLAPI_API_KEY` alone when
-  no aimlapi profile exists; a non-empty `AIMLAPI_API_KEY` can override a stored
-  profile key for MCP billing. The automatic key is withheld if an aimlapi profile
-  (or a profile reading `AIMLAPI_API_KEY`) uses a base URL other than
-  `https://api.aimlapi.com/v1`, `AIMLAPI_INFERENCE_URL` points elsewhere, a
-  non-empty user Authorization header is configured, OAuth is selected, project
-  config has touched the server, or the key is missing or not a single token
-  (including Unicode whitespace). See
-  [docs/EXTENDING.md](docs/EXTENDING.md#built-in-servers).
+  keyless web search, to Exa's hosted MCP endpoint at `https://mcp.exa.ai/mcp`).

SUPPORT.md

@@ -2,8 +2,8 @@
 
 ## Questions, setup help, configuration
 
-Ask in [GitHub Discussions](https://github.com/Twigpine/zero/discussions). Use
-[Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) so answers can
+Ask in [GitHub Discussions](https://github.com/Gitlawb/zero/discussions). Use
+[Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a) so answers can
 be marked and found by the next person.
 
 The fastest way to a useful answer is to include:
@@ -18,19 +18,19 @@ The fastest way to a useful answer is to include:
 ## Bugs
 
 If Zero does something wrong (crashes, wrong output, broken behavior), file a
-[bug report](https://github.com/Twigpine/zero/issues/new/choose). If you are not
+[bug report](https://github.com/Gitlawb/zero/issues/new/choose). If you are not
 sure whether it is a bug or a setup problem, start in Discussions and we will
 promote it to an issue if it is one.
 
 ## Feature ideas
 
 Start a thread in
-[Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas). Zero is
+[Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas). Zero is
 in controlled development (see CONTRIBUTING.md), so discussing an idea first is
 also the path to getting a PR accepted.
 
 ## Security issues
 
 Never file a public issue or discussion. Report privately via
-[GitHub Security Advisories](https://github.com/Twigpine/zero/security/advisories/new)
+[GitHub Security Advisories](https://github.com/Gitlawb/zero/security/advisories/new)
 (see SECURITY.md).

action.yml

@@ -2,7 +2,7 @@ name: ZERO
 description: >-
   Run the ZERO coding agent headlessly in a GitHub workflow. ZERO is
   model- and provider-agnostic: you supply the provider and API key as inputs.
-author: Twigpine
+author: Gitlawb
 
 branding:
   icon: terminal
@@ -110,7 +110,7 @@ inputs:
   zero-repo:
     description: Repository to install the ZERO release from (owner/repo).
     required: false
-    default: Twigpine/zero
+    default: Gitlawb/zero
 
 outputs:
   exit-code:

bin/zero.js

@@ -1,63 +1,11 @@
 #!/usr/bin/env node
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, writeSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-
-const CURRENT_PACKAGE_NAME = '@twigpine/zero';
-// The npm package moved from @gitlawb/zero to @twigpine/zero in 0.10.0. That
-// release was also published once under the old name, so 0.9.0's `zero
-// upgrade` and anyone still installing the old name land on a working build
-// that says where the package went (docs/NPM_PACKAGING.md). Nothing is
-// published under the old name after that.
-const LEGACY_PACKAGE_NAME = '@gitlawb/zero';
-
-// The npm name this wrapper was published under, read from its own
-// package.json so the name lives in one place. The platform payload alias and
-// every reinstall hint below derive from it.
-function readPackageName(root) {
-  try {
-    const { name } = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
-    if (typeof name === 'string' && name !== '') return name;
-  } catch {
-    // An unreadable manifest must not stop the CLI from launching.
-  }
-  return CURRENT_PACKAGE_NAME;
-}
-
-const packageName = readPackageName(packageRoot);
-
-// Same note as legacyPackageSwitchMessage in internal/update/installmethod.go.
-// Uninstalling first is the only safe order: both packages own the `zero` bin,
-// so npm refuses to install the new one over the old (EEXIST), and forcing it
-// lets a later uninstall of the old package delete the shared bin.
-function legacyPackageNotice() {
-  return (
-    `[zero] Zero has moved to ${CURRENT_PACKAGE_NAME} on npm, and ${LEGACY_PACKAGE_NAME} gets no further releases.\n` +
-    'To keep getting updates, quit zero and run:\n' +
-    `  npm uninstall -g ${LEGACY_PACKAGE_NAME}\n` +
-    `  npm install -g ${CURRENT_PACKAGE_NAME}\n` +
-    'Uninstall first: both packages provide the `zero` command. With bun, pnpm or yarn, use its global remove and add commands instead.\n'
-  );
-}
-
-// Printed when the wrapper exits rather than before zero starts, because the
-// TUI takes over the screen and would hide anything printed first. Only on a
-// terminal, so scripts that capture stderr see nothing new. `zero update` and
-// `zero upgrade` print the same note themselves.
-if (packageName === LEGACY_PACKAGE_NAME && !['update', 'upgrade'].includes(process.argv[2])) {
-  process.on('exit', () => {
-    if (process.stderr.isTTY || process.env.ZERO_WRAPPER_SIMULATE_TTY === '1') {
-      // Synchronous: an exit handler cannot wait for an asynchronous write.
-      writeSync(2, legacyPackageNotice());
-    }
-  });
-}
-
 function zeroBinaryName(platform = process.platform) {
   return platform === 'win32' ? 'zero.exe' : 'zero';
 }
@@ -133,10 +81,10 @@ function bunRecoveryParagraph() {
   return (
     'You installed with Bun, which does not run dependency lifecycle scripts\n' +
     'by default. Trust the package to run the blocked postinstall:\n' +
-    `  bun pm trust ${packageName}       (project install)\n` +
-    `  bun pm -g trust ${packageName}    (global install)\n` +
+    '  bun pm trust @gitlawb/zero       (project install)\n' +
+    '  bun pm -g trust @gitlawb/zero    (global install)\n' +
     'On Bun versions without `bun pm trust`, add\n' +
-    `  "trustedDependencies": ["${packageName}"]\n` +
+    '  "trustedDependencies": ["@gitlawb/zero"]\n' +
     'to your project package.json and reinstall.\n' +
     '\n'
   );
@@ -145,14 +93,14 @@ function bunRecoveryParagraph() {
 function buildFromSourceParagraph() {
   return (
     'If this platform has no prebuilt binary, build from source:\n' +
-    'https://github.com/Twigpine/zero (go run ./cmd/zero, requires Go 1.26+).'
+    'https://github.com/Gitlawb/zero (go run ./cmd/zero, requires Go 1.26+).'
   );
 }
 
 function missingBinaryContextParagraph() {
   return (
-    `Normally npm installs it as an optional dependency of ${packageName}\n` +
-    `(${packageName}-${process.platform}-${process.arch}), and the wrapper can\n` +
+    'Normally npm installs it as an optional dependency of @gitlawb/zero\n' +
+    `(@gitlawb/zero-${process.platform}-${process.arch}), and the wrapper can\n` +
     'also download it from the GitHub Release when it is missing.'
   );
 }
@@ -165,7 +113,7 @@ function missingNativeRecoveryParagraphs(postinstallScript) {
     '\n' +
     'Things to try:\n' +
     '  - reinstall without omitting optional dependencies:\n' +
-    `      npm install -g ${packageName}\n` +
+    '      npm install -g @gitlawb/zero\n' +
     '  - run the downloader manually (needs write access to the package dir):\n' +
     `      node "${postinstallScript}"\n` +
     '\n' +
@@ -234,12 +182,12 @@ function missingNativeDoctorTextReport(postinstallScript) {
   );
 }
 
-// The platform payload is a version of this same package, installed under an
-// npm: alias (see docs/NPM_PACKAGING.md). The alias name is derived from
+// The platform payload is a version of @gitlawb/zero itself, installed under
+// an npm: alias (see docs/NPM_PACKAGING.md). The alias name is derived from
 // process.platform/process.arch, so an unsupported platform simply fails to
 // resolve and we fall through to the downloader.
 function platformPackageBinary() {
-  const aliasedName = `${packageName}-${process.platform}-${process.arch}`;
+  const aliasedName = `@gitlawb/zero-${process.platform}-${process.arch}`;
   let manifestPath;
   try {
     manifestPath = createRequire(import.meta.url).resolve(`${aliasedName}/package.json`);
@@ -279,6 +227,8 @@ function downloadMissingBinary(packageRoot) {
   });
 }
 
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
 function resolveNativeBinary() {
   const fromPlatformPackage = platformPackageBinary();
   if (fromPlatformPackage) return fromPlatformPackage;

cmd/zero-linux-sandbox/main.go

@@ -5,7 +5,7 @@ package main
 import (
 	"os"
 
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 func main() {

cmd/zero-perf-bench/main.go

@@ -11,7 +11,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/perfbench"
+	"github.com/Gitlawb/zero/internal/perfbench"
 )
 
 const (

cmd/zero-perf-bench/main_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/perfbench"
+	"github.com/Gitlawb/zero/internal/perfbench"
 )
 
 func TestParseArgsUsesCliAndEnvOverrides(t *testing.T) {

cmd/zero-perf-bench/tasks.go

@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/perfbench"
+	"github.com/Gitlawb/zero/internal/perfbench"
 )
 
 // taskOptions configures the `zero-perf-bench tasks` subcommand: the reproducible

cmd/zero-perf-bench/turn.go

@@ -9,8 +9,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/execprofile"
-	"github.com/Twigpine/zero/internal/perfbench"
+	"github.com/Gitlawb/zero/internal/execprofile"
+	"github.com/Gitlawb/zero/internal/perfbench"
 )
 
 // turnOptions configures the `zero-perf-bench turn` subcommand: the per-turn

cmd/zero-pr-review/main.go

@@ -6,7 +6,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/review"
+	"github.com/Gitlawb/zero/internal/review"
 )
 
 func main() {

cmd/zero-release/main.go

@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/release"
+	"github.com/Gitlawb/zero/internal/release"
 )
 
 func main() {

cmd/zero-seccomp/main.go

@@ -12,7 +12,7 @@ import (
 	"os/exec"
 	"syscall"
 
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 func main() {

cmd/zero-windows-command-runner/main.go

@@ -3,7 +3,7 @@ package main
 import (
 	"os"
 
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 func main() {

cmd/zero-windows-sandbox-setup/main.go

@@ -3,7 +3,7 @@ package main
 import (
 	"os"
 
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 func main() {

cmd/zero/main.go

@@ -3,13 +3,9 @@ package main
 import (
 	"os"
 
-	"github.com/Twigpine/zero/internal/cli"
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/cli"
 )
 
 func main() {
-	if len(os.Args) > 1 && os.Args[1] == sandbox.LinuxSandboxHelperSubcommand {
-		os.Exit(sandbox.RunLinuxSandboxHelper(os.Args[1:], os.Stderr))
-	}
 	os.Exit(cli.Run(os.Args[1:], os.Stdout, os.Stderr))
 }

docs/EXTENDING.md

@@ -110,8 +110,6 @@ Discovery roots (earlier wins on name collisions):
 
 A missing directory is fine — Zero just omits it. Management commands (`zero skill add` / `zero skill remove`) always write to the primary Zero dir only; `list` / `info` search primary + `~/.agents/skills`. `skill info` reports lock source/hash when present and whether the on-disk `SKILL.md` has drifted from the recorded hash.
 
-For a skill installed since Zero started installing bundled files, `skill info` also reports drift in any file installed with it.
-
 ```text
 ~/.local/share/zero/skills/          # primary (install/remove target)
   run-benchmarks/
@@ -142,15 +140,6 @@ Only `name` and `description` are recognized in the frontmatter today. The `name
 
 The `skill` tool lets the agent load any discovered skill by name (primary, agents, or plugin).
 
-A skill can ship files beside its `SKILL.md`, in the [agentskills.io](https://agentskills.io/specification) layout: `scripts/`, `references/`, `assets/` or anything else the instructions refer to. `zero skill add` installs the whole skill directory, leaving out hidden entries such as `.git` and not following or copying symlinks (it lists any it skipped). A skill larger than 1,000 files or 32 MiB is refused. When the `skill` tool loads a skill that has such files, its output ends with the skill's directory and a list of the files, so instructions like "run `scripts/fill.py`" can be followed. Running a bundled script goes through the normal tool permissions; installing or loading a skill never runs anything.
-
-```text
-pdf/
-  SKILL.md
-  scripts/fill.py
-  references/form-fields.md
-```
-
 ## 4. Hooks
 
 Hooks fire shell commands on lifecycle events. Configure them in JSON:
@@ -203,11 +192,7 @@ Events the agent emits (in dispatch order):
 | `specialistStart` | A sub-agent is spawned | yes (specialist name) |
 | `specialistStop` | A sub-agent ends | yes (specialist name) |
 
-For swarm members the matcher subject is the **agent type** (`subagent`, `teammate`, …), not a registered specialist profile name — swarm members run from an inline manifest keyed by agent type.
-
-`specialistStart` fires once the child process has actually started; a launch that fails before exec (missing binary, spawn error) records no public lifecycle hooks. `specialistStop` fires once per terminal stop: completion, error, explicit stop of a recovered task, and a background task reaped by a later `TaskOutput` all share one durable claim, so a hook that notifies or cleans up does not run twice for the same sub-agent run.
-
-A hook's exit code decides what happens next: `0` continues, non-zero blocks the tool call (`beforeTool`) or surfaces an error (`afterTool`). `sessionStart` / `sessionEnd` / `specialistStart` / `specialistStop` hooks are advisory (failures are audited but do not interrupt the run). Hook execution is recorded in the audit log; the audit is reachable from the agent's view of past actions, not from a dedicated `zero doctor` check.
+A hook's exit code decides what happens next: `0` continues, non-zero blocks the tool call (`beforeTool`) or surfaces an error (`afterTool`). Hook execution is recorded in the audit log; the audit is reachable from the agent's view of past actions, not from a dedicated `zero doctor` check.
 
 > **Roadmap.** An in-UI hooks manager is on the backlog. Today you edit the JSON directly.
 
@@ -261,52 +246,6 @@ or use a new server name. OAuth tokens are bound to the resolved server identity
 so changing a server target can require `zero mcp oauth login <server>` again.
 OAuth server names ending in `.<32 hex chars>` are reserved for token storage.
 
-#### Built-in servers
-
-Zero seeds two MCP servers before your config is merged. Both show up in
-`zero mcp list`, and any field can be overridden in your user config.
-
-- `exa` (`https://mcp.exa.ai/mcp`) is on by default for keyless web search.
-  `zero mcp disable exa` turns it off.
-- `aimlapi` (`https://mcp.aimlapi.com/mcp`, the AI/ML API Toolbox, model
-  discovery, image/video/audio generation, chat, embeddings and balance tools)
-  is **off by default**, because its tool runs and generations are billed to
-  your AI/ML API balance. Turn it on with `zero mcp enable aimlapi`, which
-  writes only `"disabled": false` to your user config, and off again with
-  `zero mcp disable aimlapi`. A project config cannot turn it on.
-
-When `aimlapi` connects, Zero sends your AI/ML API key as
-`Authorization: Bearer <key>`. The key is resolved again on every request and
-is never written to `config.json`. With an aimlapi.com provider profile
-(`zero providers setup aimlapi`), the key is chosen in this order:
-
-1. An inline key on the profile (if set in config).
-2. Otherwise the environment variable named by the profile's `apiKeyEnv`
-   (the catalog default is `AIMLAPI_API_KEY`).
-3. Otherwise the key held in the credential store when the profile uses
-   `apiKeyStored`.
-
-When there is no aimlapi profile, Zero uses `AIMLAPI_API_KEY` alone. If both
-`AIMLAPI_API_KEY` and a stored profile key exist, step 2 wins over the store
-whenever the inline key is empty — MCP requests may bill the environment key's
-account, not the stored key.
-
-No automatic key is sent when an aimlapi profile, or any profile reading
-`AIMLAPI_API_KEY`, uses a base URL other than `https://api.aimlapi.com/v1`, or
-when `AIMLAPI_INFERENCE_URL` is overridden, because that credential may belong
-to a proxy. No key is sent when the resolved value is not a single token (for
-example a comma- or newline-separated pool), when you set your own
-non-empty `Authorization` header, when the server uses `"auth": "oauth"`, or
-when project config touched the server. Without a key the server answers 401.
-To sign in with your aimlapi.com account instead, set `"auth": "oauth"` on the
-server and run `zero mcp oauth login aimlapi`.
-
-Every request to exactly `https://mcp.aimlapi.com` (https, default port,
-whatever the server is named, including one you add by hand) also carries the
-attribution headers `X-AIMLAPI-Source: agent/zero` and `X-AIMLAPI-Partner-ID`,
-and gets the key under the rules above. Other MCP servers never receive these
-headers or the key.
-
 ### As a server — expose Zero's tools to another agent
 
 ```bash
@@ -351,12 +290,10 @@ Install and manage:
 zero plugins add ./github-pr-review      # copy into ~/.config/zero/plugins/ or ./.zero/plugins/
 zero plugins list
 zero plugins info github-pr-review       # show manifest path, enabled state, lock metadata
-zero plugins disable github-pr-review   # sets "enabled": false in plugin.json
-zero plugins enable github-pr-review    # sets "enabled": true in plugin.json
 zero plugins remove github-pr-review    # alias: rm
 ```
 
-A plugin is active when it is present under a plugins directory and its `plugin.json` has `"enabled": true` (the default when the field is omitted). Use `zero plugins disable <id>` / `zero plugins enable <id>` to toggle that field without removing the plugin. Pass `--user` to target only user plugins and ignore `./.zero/plugins`; without it, a project plugin with the same id takes precedence. The toggle edits the `enabled` value in place — the rest of the manifest keeps its formatting, field order, and numeric literals — and serializes with `plugins add` / `plugins remove` on the same plugins root. Zero reads plugins when it starts, so the change applies to the next `zero exec` run or interactive session; an interactive session that is already running keeps the plugin tools, hooks, and skills it started with until you restart it.
+A plugin is enabled by being present in the plugins directory and disabled by removing it (or by the user setting `"enabled": false` in its `plugin.json`). Plugins are not enabled or disabled by a CLI subcommand today.
 
 Plugin commands run with the plugin directory as their working directory. Use relative paths; the loader resolves them at activation time.
 

docs/GITHUB_ACTION.md

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: Twigpine/zero@v1
+      - uses: Gitlawb/zero@v1
         with:
           prompt: ${{ inputs.task }}
           provider: openai
@@ -66,7 +66,7 @@ jobs:
 | `github-token` | no | `${{ github.token }}` | Token used to post a PR comment. Requires `pull-requests: write`. |
 | `working-directory` | no | `${{ github.workspace }}` | Directory to run ZERO in. |
 | `zero-version` | no | (action ref → `latest`) | ZERO release version/tag to install, e.g. `v1.2.3` or `latest`. |
-| `zero-repo` | no | `Twigpine/zero` | Repository to install the ZERO release from. |
+| `zero-repo` | no | `Gitlawb/zero` | Repository to install the ZERO release from. |
 
 ## Outputs
 
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: Twigpine/zero@v1
+      - uses: Gitlawb/zero@v1
         with:
           prompt: |
             Investigate this issue and propose a fix.
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: Twigpine/zero@v1
+      - uses: Gitlawb/zero@v1
         id: zero
         with:
           prompt-file: .github/zero/upgrade-deps.md
@@ -176,7 +176,7 @@ jobs:
 - **Least-privilege tokens.** Grant only the permissions the workflow needs
   (`contents: write` to edit files, `pull-requests: write` to comment). The
   default `GITHUB_TOKEN` is scoped to the repository.
-- **Pin the action.** Reference a tag (`Twigpine/zero@v1`) or a commit SHA so a
+- **Pin the action.** Reference a tag (`Gitlawb/zero@v1`) or a commit SHA so a
   workflow run uses a known ZERO version. `zero-version` lets you pin the
   installed binary independently of the action ref.
 - **Linux and macOS runners** are supported; Windows runners are rejected with a

docs/HOW_ZERO_WORKS.md

@@ -302,9 +302,8 @@ Conceptually, one requested tool goes through these phases:
    the model can inspect it and decide what to do next.
 6. **Render and persist** — the result is surfaced to the TUI, stream-JSON
    writer, or ACP client. TUI and exec record rich tool/session events for
-   resume/history; ACP persists conversational messages and completed tool-call
-   starts/results for load replay. Live streaming details and permission
-   exchanges remain client notifications rather than durable history.
+   resume/history; ACP currently persists conversational messages and streams
+   tool/permission updates to the client.
 
 Tool success and failure are both informative context. A successful `read_file`
 result gives the model file contents; a failed `edit_file` result gives the model
@@ -634,10 +633,6 @@ Core tool groups include:
   `HTTP_PROXY`/`HTTPS_PROXY` set, the proxy is dialed instead and resolves the
   target itself, so destination enforcement ends at the proxy; see the note in
   the README.
-  With `ZERO_WEBFETCH_PROVIDER=aimlapi` (opt-in; a key alone does not select
-  it), the same URL checks run and the page is then fetched as Markdown by the
-  billed AI/ML API Toolbox tool `search1api/crawl`, with no fallback to a
-  direct fetch; see the README.
 - **Local-control tools**: config-gated wrappers for browser, terminal, desktop,
   and artifact helpers backed by packages such as `internal/localcontrol` and
   `internal/browser`.

docs/INSTALL.md

@@ -5,11 +5,11 @@ blessed one.
 
 | Method | Command | Self-update |
 | --- | --- | --- |
-| Install script (Linux, macOS) | `curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh \| bash` | `zero upgrade` |
-| Install script (Windows) | `irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 \| iex` | `zero upgrade` |
-| npm | `npm install -g @twigpine/zero` | `zero upgrade` (runs npm) |
-| Release archive | download from [Releases](https://github.com/Twigpine/zero/releases) | `zero upgrade` |
-| mise | `mise use -g ubi:Twigpine/zero` | `mise upgrade` |
+| Install script (Linux, macOS) | `curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh \| bash` | `zero upgrade` |
+| Install script (Windows) | `irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 \| iex` | `zero upgrade` |
+| npm | `npm install -g @gitlawb/zero` | `zero upgrade` (runs npm) |
+| Release archive | download from [Releases](https://github.com/Gitlawb/zero/releases) | `zero upgrade` |
+| mise | `mise use -g ubi:Gitlawb/zero` | `mise upgrade` |
 | `go install` | `go install github.com/Gitlawb/zero/cmd/zero@latest` | rerun the command |
 | Source | `go build -o zero ./cmd/zero` | rebuild |
 
@@ -29,7 +29,7 @@ Release and verify its checksum.
 ## npm
 
 ```bash
-npm install -g @twigpine/zero
+npm install -g @gitlawb/zero
 zero
 ```
 
@@ -56,47 +56,15 @@ cannot write to keeps failing — rerun the install or the command below with
 sufficient permissions). To trigger the fetch manually:
 
 ```bash
-node "$(npm root -g)/@twigpine/zero/scripts/postinstall.mjs"
+node "$(npm root -g)/@gitlawb/zero/scripts/postinstall.mjs"
 ```
 
-### Moving from @gitlawb/zero
-
-Zero was published as `@gitlawb/zero` up to 0.9.0. From 0.10.0 it is
-`@twigpine/zero`, and the old name gets no further releases.
-
-Both packages provide the `zero` command, so npm refuses to install the new
-one while the old one is installed (`EEXIST`). Forcing it is worse: a later
-uninstall of the old package removes the shared `zero` command. Quit any
-running `zero` (on Windows a running `zero.exe` cannot be removed), then
-uninstall the old package before installing the new one:
-
-```bash
-npm uninstall -g @gitlawb/zero
-npm install -g @twigpine/zero
-```
-
-With another package manager, the same two steps:
-
-```bash
-bun remove -g @gitlawb/zero && bun add -g @twigpine/zero
-pnpm remove -g @gitlawb/zero && pnpm add -g @twigpine/zero
-yarn global remove @gitlawb/zero && yarn global add @twigpine/zero
-```
-
-Config, sessions, logins, and plugins live in your user config and home
-directories, not in the package, so they carry over unchanged.
-
-0.10.0 was also published once as `@gitlawb/zero`, so an old install that
-updates lands on a working build. That build prints these steps when `zero`
-exits in a terminal, and `zero upgrade` and `zero update --check` print them
-too.
-
 ## Linux And macOS Script
 
 Install the latest release:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
 ```
 
 From a checkout:
@@ -121,7 +89,7 @@ scripts/install.sh --install-dir "$HOME/bin"
 
 Defaults:
 
-- Repository: `Twigpine/zero`
+- Repository: `Gitlawb/zero`
 - Version: latest GitHub release
 - Install path: `~/.local/bin/zero`
 
@@ -132,7 +100,7 @@ Requirements: Bash, `curl` or `wget`, `tar`, and `shasum` or `sha256sum`.
 Install the latest release:
 
 ```powershell
-irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
 ```
 
 From a checkout:
@@ -155,7 +123,7 @@ powershell -ExecutionPolicy Bypass -File scripts/install.ps1 -InstallDir "$env:U
 
 Defaults:
 
-- Repository: `Twigpine/zero`
+- Repository: `Gitlawb/zero`
 - Version: latest GitHub release
 - Install path: `%LOCALAPPDATA%\zero\bin\zero.exe`
 
@@ -166,13 +134,13 @@ archives through its `ubi` backend, so there is nothing extra to publish and no
 registry in the middle:
 
 ```bash
-mise use -g ubi:Twigpine/zero
+mise use -g ubi:Gitlawb/zero
 ```
 
 Pin a version the same way you would any other tool:
 
 ```bash
-mise use -g ubi:Twigpine/[email protected]
+mise use -g ubi:Gitlawb/[email protected]
 ```
 
 Updates come from `mise upgrade`. `zero upgrade` also works, because a
@@ -185,19 +153,13 @@ describe a version that is no longer on disk. Prefer `mise upgrade`.
 go install github.com/Gitlawb/zero/cmd/zero@latest
 ```
 
-Every release so far declares the module path `github.com/Gitlawb/zero`, so
-`go install` has to use that path; `github.com/Twigpine/zero/cmd/zero@latest`
-fails with "module declares its path as" until a release is tagged with the new
-module path.
-
-This builds from source, so it needs Go 1.26.10+ and it does not go through the
+This builds from source, so it needs Go 1.26.6+ and it does not go through the
 release archives. Two consequences worth knowing before you pick it:
 
-- On Linux, Bubblewrap is still required for native sandboxing. Zero resolves
-  the helper in this order: an executable `zero-linux-sandbox` next to `zero`,
-  then `PATH`, then self-exec of the main binary. Standalone helpers remain
-  optional and preferred. See
+- On Linux you also need the sandbox helper, which is a separate binary and is
+  not installed by this command. See
   [Sandbox Helpers For Source Builds](#sandbox-helpers-for-source-builds).
+  Without it, native sandboxing is unavailable.
 - `zero upgrade` treats the result as a standalone install and will replace the
   binary with a release build rather than rebuilding from source. If you chose
   `go install` deliberately, rerun it instead.
@@ -207,7 +169,7 @@ macOS and Windows need no extra helper.
 ## From Source
 
 ```bash
-git clone https://github.com/Twigpine/zero.git
+git clone https://github.com/Gitlawb/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -218,32 +180,25 @@ Build a local binary:
 go build -o zero ./cmd/zero
 ```
 
-Source builds require Go 1.26.10+.
+Source builds require Go 1.26.6+.
 
 ### Sandbox Helpers For Source Builds
 
-Release archives include the platform sandbox helpers. A source build of the
-main `zero` binary is enough for Linux native sandboxing. Zero resolves the
-helper in this order:
+Release archives include the platform sandbox helpers. If you build directly
+from source, build the helpers you need:
 
-1. an executable `zero-linux-sandbox` next to `zero`
-2. then `PATH`
-3. then self-exec of the main binary
-
-Bubblewrap must still be installed. Standalone helpers remain optional and
-preferred.
-
-A separate helper remains supported if it sits next to `zero` or on `PATH`:
+Linux:
 
 ```bash
 go build -o zero ./cmd/zero
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # optional
-go build -o zero-seccomp ./cmd/zero-seccomp               # optional compatibility wrapper
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
+go build -o zero-seccomp ./cmd/zero-seccomp
 ```
 
-Put `zero` on `PATH`, for example `~/.local/bin`. `zero-seccomp` is kept as a
-compatibility wrapper; the sandbox helper applies the Unix-socket filter itself
-when that sandbox option is enabled.
+Put `zero` and `zero-linux-sandbox` in the same directory on `PATH`, for example
+`~/.local/bin`. `zero-seccomp` is kept as a compatibility wrapper; the sandbox
+helper applies the Unix-socket filter itself when that sandbox option is enabled.
+Linux native sandboxing also requires Bubblewrap to be installed.
 
 macOS uses the system sandbox and does not need an extra helper binary.
 
@@ -258,7 +213,7 @@ seccomp filter on Android:
 pkg install golang
 
 # Build Zero for Android
-git clone https://github.com/Twigpine/zero.git
+git clone https://github.com/Gitlawb/zero.git
 cd zero
 CGO_ENABLED=0 GOOS=android GOARCH=arm64 go build -ldflags="-s -w" -o zero ./cmd/zero
 
@@ -347,10 +302,7 @@ See the [update guide](UPDATE.md) for update modes, flags, and platform details.
 overwriting a binary a package manager owns leaves that manager describing a
 version that is no longer there:
 
-- **npm**: runs `npm install -g @twigpine/zero@latest` for you. An install of
-  the old `@gitlawb/zero` package refuses instead and prints the steps in
-  [Moving from @gitlawb/zero](#moving-from-gitlawbzero): that name gets no
-  further releases, so npm would only reinstall the same version.
+- **npm**: runs `npm install -g @gitlawb/zero@latest` for you.
 - **Homebrew**: refuses, and tells you to run `brew upgrade zero`. Replacing the
   keg binary directly would be reverted by the next `brew upgrade` or
   `brew reinstall`.

docs/MODEL_RPM.md

@@ -1,26 +0,0 @@
-# Local per-model completion limits
-
-Add `modelRPM` to the existing Zero config file:
-
-```json
-{"modelRPM": {"gpt-4.1": 30, "claude-sonnet-4.5": 15}}
-```
-
-Keys resolve through the model registry; custom IDs match exactly after trimming
-whitespace. Missing keys and zero mean unlimited. Negative limits and conflicting
-aliases are configuration errors. Project config may add or tighten a user cap,
-but cannot relax it. Changes take effect on the next Zero process start.
-
-For `zero exec` and interactive agent turns, admission happens immediately before
-the wrapped turn session's `Stream`. N admissions fit in any sliding 60-second
-window; N+1 returns a local rate-limit error before entering that method. The
-error reports when a slot expires. Exec uses its existing provider-error exit
-code plus a local-limit hint. There is no sleep or hidden retry. Failed admitted
-requests still consume a slot.
-
-Sessions and model switches share a limiter in one process. Separate processes
-have independent windows; restarting clears them. This is not an account-wide
-cap. It counts Stream admissions, not all HTTP requests: setup/prewarm,
-compaction, provider-internal retries, discovery and direct calls outside that
-boundary are not counted. No TPM, cost budgets, persistence, cross-process
-coordination or new runtime/Python dependency is introduced.

docs/NPM_PACKAGING.md

@@ -1,6 +1,6 @@
 # npm packaging
 
-How `@twigpine/zero` is put together on npm, why it is shaped this way, and the
+How `@gitlawb/zero` is put together on npm, why it is shaped this way, and the
 rules the release pipeline must follow. Read this before touching
 `package.json`, `bin/zero.js`, `scripts/postinstall.mjs`,
 `scripts/npm/build-platform-packages.mjs`, or the npm-publish steps of
@@ -8,7 +8,7 @@ rules the release pipeline must follow. Read this before touching
 
 ## Goals
 
-A `npm install -g @twigpine/zero` must be **silent and self-contained**:
+A `npm install -g @gitlawb/zero` must be **silent and self-contained**:
 
 - No `EBADENGINE` warnings — ours or from any package in the dependency tree.
 - No install scripts anywhere in the tree, so npm's `allow-scripts` gating,
@@ -25,15 +25,15 @@ The model is the one used by Codex, esbuild, and Biome: a tiny wrapper package
 plus per-platform payloads carrying the native binaries.
 
 ```
-@twigpine/zero                    <- wrapper: bin/zero.js + optionalDependencies
-├─ @twigpine/zero-darwin-arm64 -> npm:@twigpine/zero@{version}-darwin-arm64
-├─ @twigpine/zero-darwin-x64   -> npm:@twigpine/zero@{version}-darwin-x64
-├─ @twigpine/zero-linux-arm64  -> npm:@twigpine/zero@{version}-linux-arm64
-├─ @twigpine/zero-linux-x64    -> npm:@twigpine/zero@{version}-linux-x64
-└─ @twigpine/zero-win32-x64    -> npm:@twigpine/zero@{version}-win32-x64
+@gitlawb/zero                    <- wrapper: bin/zero.js + optionalDependencies
+├─ @gitlawb/zero-darwin-arm64 -> npm:@gitlawb/zero@{version}-darwin-arm64
+├─ @gitlawb/zero-darwin-x64   -> npm:@gitlawb/zero@{version}-darwin-x64
+├─ @gitlawb/zero-linux-arm64  -> npm:@gitlawb/zero@{version}-linux-arm64
+├─ @gitlawb/zero-linux-x64    -> npm:@gitlawb/zero@{version}-linux-x64
+└─ @gitlawb/zero-win32-x64    -> npm:@gitlawb/zero@{version}-win32-x64
 ```
 
-- The platform "packages" are **versions of the same `@twigpine/zero` package**,
+- The platform "packages" are **versions of the same `@gitlawb/zero` package**,
   published at suffixed versions (`0.4.0-linux-x64`) and referenced through
   `npm:` aliases in `optionalDependencies`. One package name means one npm
   trusted-publisher configuration — no new publish credentials per platform.
@@ -56,7 +56,7 @@ plus per-platform payloads carrying the native binaries.
 
 ### Binary resolution in `bin/zero.js`
 
-1. Resolve `@twigpine/zero-<platform>-<arch>` and exec the `zero` binary from
+1. Resolve `@gitlawb/zero-<platform>-<arch>` and exec the `zero` binary from
    it. This wins over any previously downloaded copy — the platform version is
    pinned to the wrapper release.
 2. Fall back to a binary previously downloaded next to the wrapper.
@@ -103,22 +103,10 @@ dependencies of the wrapper:
   platform binary (plus the musl variant on linux, which its launcher detects
   at runtime) — about 65 MB saved per platform package.
 
-### One package name
-
-The npm name lives in `package.json` and nothing else repeats it:
-`scripts/npm/build-platform-packages.mjs` names the wrapper, the platform
-versions, the alias names, and the alias targets from it, and `bin/zero.js`
-reads its own `package.json` to derive the alias it resolves. The Go side
-needs the name as a constant (`npmPackageName` in
-`internal/update/installmethod.go`), and a test holds it equal to
-`package.json`.
-
 ## Publishing rules (release pipeline)
 
 These are the invariants `release-artifacts.yml` must hold. Breaking the first
-one is user-visible immediately. `scripts/npm/publish-packages.sh` implements
-them, and `internal/npmwrapper/publish_test.go` runs it against a fake
-registry.
+one is user-visible immediately.
 
 1. **Platform versions must never become `latest`.** `0.4.0-linux-x64` is a
    semver *prerelease* of `0.4.0`; publishing it without an explicit
@@ -130,67 +118,20 @@ registry.
    bootstrap publish) — a missing value must not abort the job between the
    platform and wrapper publishes, which would strand a half-published
    release.
-2. **Platform versions are on the registry before the wrapper.** The
-   wrapper's `optionalDependencies` pin exact suffixed versions; publishing
-   the wrapper first would create a window where installs resolve aliases
-   that 404. Ordering the uploads is not enough: npm applies a publish
-   asynchronously, and in 0.10.0 a platform version appeared ten minutes
-   after its upload returned, after the wrapper. The publish script waits
-   until npm shows every platform version before it publishes the wrapper,
-   and waits the same way for `latest` afterwards (up to 30 minutes in all).
+2. **Platform versions publish before the wrapper.** The wrapper's
+   `optionalDependencies` pin exact suffixed versions; publishing the wrapper
+   first would create a window where installs resolve aliases that 404.
 3. **Exact-version pinning.** The wrapper at `X.Y.Z` references platform
    versions `X.Y.Z-<platform>-<arch>` exactly — never ranges — so a wrapper
-   and its binaries can never skew. The publish script refuses to start when
-   the wrapper's aliases do not match the platform payloads beside it.
+   and its binaries can never skew.
 4. All publishes go through the existing npm OIDC trusted-publishing flow and
    the `npm-publish` environment gate; no tokens. Because the platform
    payloads are versions of the same package, they reuse the single
-   trusted-publisher configuration. npm checks provenance against
-   `package.json` `repository`, so it must name the repository the workflow
-   runs in.
-5. **Re-runs are safe.** A version already on the registry is skipped rather
-   than republished, so re-running a job that failed between the platform and
-   wrapper publishes finishes the release. Only npm's E404 counts as "not
-   published"; a lookup that fails any other way is retried and then stops the
-   job before anything is published.
+   trusted-publisher configuration.
 
 `zero update` keeps working unchanged: it detects an npm install by finding a
-`package.json` named `@twigpine/zero` next to the running binary — true inside
-a platform payload too — and updates via `npm install -g @twigpine/zero@latest`.
-
-## The move from `@gitlawb/zero`
-
-Zero was published as `@gitlawb/zero` up to 0.9.0 and as `@twigpine/zero`
-from 0.10.0. There is no in-place migration: both packages own the `zero`
-bin, so npm refuses to install one over the other (`EEXIST`), and forcing it
-lets a later uninstall of the old package delete the shared bin. The user
-has to uninstall the old package and install the new one, in that order.
-
-Deprecating the old package alone would not have reached existing users.
-0.9.0's `zero upgrade` runs `npm install -g @gitlawb/zero@latest`; with
-nothing newer under that name, npm reinstalls nothing, prints no deprecation
-warning (it only warns when it installs something), and Zero reports the
-update as done. So 0.10.0 was published once more under the old name, as a
-bridge:
-
-- The release job assembled the same verified artifacts a second time with
-  `build-platform-packages.mjs --package-name @gitlawb/zero` and published
-  them with the same script, after the `@twigpine/zero` publish. The steps
-  that did this ran once and have been removed from `release-artifacts.yml`.
-- The bridge build knows its name from the `package.json` beside it. The Go
-  binary reports it as `InstallMethodNpmLegacy`: `zero upgrade` refuses
-  with the switch steps instead of reinstalling it, and `zero update --check`
-  adds them. `bin/zero.js` prints the same steps after `zero` exits, on a
-  terminal only. This handling stays in the code, since only a build
-  installed under the old name ever triggers it.
-- Updating from 0.9.0 installs that bridge build, so npm also shows the
-  deprecation message.
-
-`@gitlawb/zero` is deprecated on every version and no longer has a trusted
-publisher, so this release workflow cannot publish it again; another version
-would take a maintainer publishing by hand. Its versions stay on the
-registry: existing installs resolve their platform payload through them, so
-they must never be unpublished.
+`package.json` named `@gitlawb/zero` next to the running binary — true inside
+a platform payload too — and updates via `npm install -g @gitlawb/zero@latest`.
 
 ## Runbook: bumping the vendored helpers
 

docs/NPM_WRAPPER_SMOKE.md

@@ -2,8 +2,7 @@
 
 Run this checklist when a PR changes npm distribution files such as
 `package.json`, `bin/zero.js`, `scripts/npm/build-platform-packages.mjs`,
-`scripts/npm/publish-packages.sh`, Go build or release tooling, or the npm
-`bin` wrapper.
+Go build or release tooling, or the npm `bin` wrapper.
 
 ## Required Checks
 
@@ -38,24 +37,24 @@ path:
 
 ```bash
 # platform-package path
-mkdir -p /tmp/zero-sim/node_modules/@twigpine
-cp -R dist/npm/wrapper /tmp/zero-sim/node_modules/@twigpine/zero
+mkdir -p /tmp/zero-sim/node_modules/@gitlawb
+cp -R dist/npm/wrapper /tmp/zero-sim/node_modules/@gitlawb/zero
 cp -R dist/npm/platforms/zero-<platform>-<arch> \
-  "/tmp/zero-sim/node_modules/@twigpine/zero-<platform>-<arch>"
-node /tmp/zero-sim/node_modules/@twigpine/zero/bin/zero.js --version
+  "/tmp/zero-sim/node_modules/@gitlawb/zero-<platform>-<arch>"
+node /tmp/zero-sim/node_modules/@gitlawb/zero/bin/zero.js --version
 
 # first-run download fallback (delete the platform package first)
-rm -rf "/tmp/zero-sim/node_modules/@twigpine/zero-<platform>-<arch>"
-node /tmp/zero-sim/node_modules/@twigpine/zero/bin/zero.js --version
+rm -rf "/tmp/zero-sim/node_modules/@gitlawb/zero-<platform>-<arch>"
+node /tmp/zero-sim/node_modules/@gitlawb/zero/bin/zero.js --version
 ```
 
 ## Checklist
 
-- `package.json` has the expected package name (`@twigpine/zero`), version,
+- `package.json` has the expected package name (`@gitlawb/zero`), version,
   `bin.zero` entry, and NO `scripts` entries — the published package must be
   free of lifecycle scripts (see NPM_PACKAGING.md).
 - `scripts/npm/build-platform-packages.mjs` emits platform payloads whose
-  `package.json` is `@twigpine/zero@<version>-<platform>-<arch>` with matching
+  `package.json` is `@gitlawb/zero@<version>-<platform>-<arch>` with matching
   `os`/`cpu`, contains the executable binary and the vendored `helpers/` tree
   with regular-file (non-symlink) `.bin` shims, and a wrapper payload with no
   scripts, no dependencies, and the full five-alias `optionalDependencies`

docs/README.md

@@ -6,7 +6,6 @@ Zero.
 ## User Docs
 
 - [Install](INSTALL.md)
-- [Local per-model completion limits](MODEL_RPM.md)
 - [Update flow](UPDATE.md)
 - [OAuth logins and subscription-backed providers](oauth-subscriptions.md)
 

docs/UPDATE.md

@@ -7,7 +7,7 @@ downloads, verifies, and installs it.
 ```bash
 zero update --check
 zero update --check --json
-zero update --check --repo Twigpine/zero
+zero update --check --repo Gitlawb/zero
 zero update --check --target windows-x64
 
 zero upgrade
@@ -28,11 +28,7 @@ them explicitly; `zero upgrade` is `zero update` with `--apply` implied.
 
 `--apply` installs the update in place:
 
-- npm installs delegate to `npm install -g @twigpine/zero@latest`. An install
-  of the old `@gitlawb/zero` package refuses, without a release check, and
-  prints the steps to switch to `@twigpine/zero` (see
-  [INSTALL.md](INSTALL.md#moving-from-gitlawbzero)); `--check` prints them
-  too.
+- npm installs delegate to `npm install -g @gitlawb/zero@latest`.
 - Standalone installs download the release archive, verify its checksum,
   extract it, and atomically replace the running binary plus any installed
   optional sandbox helpers.
@@ -42,7 +38,7 @@ them explicitly; `zero upgrade` is `zero update` with `--apply` implied.
 - `--target` cannot be combined with `--apply`; it only applies to `--check`,
   since applying always installs onto the current machine.
 - `--repo` and `--endpoint` are ignored when applying to an npm-managed
-  install: that path delegates to `npm install -g @twigpine/zero@latest` and
+  install: that path delegates to `npm install -g @gitlawb/zero@latest` and
   takes its release from the npm registry, not from GitHub. They still apply to
   `--check` there.
 - `--json` serializes Zero's final result. For npm-managed installs, npm may
@@ -69,7 +65,7 @@ Endpoint resolution order:
 1. `--endpoint`
 2. `ZERO_UPDATE_RELEASE_URL`
 3. `--repo`
-4. `https://api.github.com/repos/Twigpine/zero/releases/latest`
+4. `https://api.github.com/repos/Gitlawb/zero/releases/latest`
 
 Installer scripts download the matching release asset for the local platform and
 verify its `.sha256` file. If Zero is already installed, run `zero upgrade`

docs/assets/concentrate-logo-dark.svg

@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80" width="80" height="80">
-      <circle cx="6.4" cy="6.4" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="6.4" r="1.3440793933950872" fill="#FFFFFF"/><circle cx="25.6" cy="6.4" r="2.03724340327418" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="6.4" r="2.5983501502741575" fill="#FFFFFF"/><circle cx="44.8" cy="6.4" r="3.087883576356698" fill="#FFFFFF"/><circle cx="54.4" cy="6.4" r="3.530261898078346" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="6.4" r="3.938362368365323" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="6.4" r="4.32" fill="#FFFFFF"/><circle cx="6.4" cy="16" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="16" r="1.2253406720005793" fill="#FFFFFF"/><circle cx="25.6" cy="16" r="1.8572691561702617" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="16" r="2.3688065860361402" fill="#FFFFFF"/><circle cx="44.8" cy="16" r="2.8150936284760535" fill="#FFFFFF"/><circle cx="54.4" cy="16" r="3.2183913448763177" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="16" r="3.5904393853139163" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="16" r="3.9383623683653233" fill="#FFFFFF"/><circle cx="6.4" cy="25.6" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="25.6" r="1.0983685811330859" fill="#FFFFFF"/><circle cx="25.6" cy="25.6" r="1.6648154545579388" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="25.6" r="2.1233464197636582" fill="#FFFFFF"/><circle cx="44.8" cy="25.6" r="2.5233883646560065" fill="#FFFFFF"/><circle cx="54.4" cy="25.6" r="2.8848956178295655" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="25.6" r="3.2183913448763177" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="25.6" r="3.530261898078346" fill="#FFFFFF"/><circle cx="6.4" cy="35.199999999999996" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="35.199999999999996" r="0.9607316398574451" fill="#FFFFFF"/><circle cx="25.6" cy="35.199999999999996" r="1.456196862502631" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="35.199999999999996" r="1.8572691561702614" fill="#FFFFFF"/><circle cx="44.8" cy="35.199999999999996" r="2.2071817085957024" fill="#FFFFFF"/><circle cx="54.4" cy="35.199999999999996" r="2.5233883646560065" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="35.199999999999996" r="2.815093628476053" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="35.199999999999996" r="3.087883576356698" fill="#FFFFFF"/><circle cx="6.4" cy="44.8" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="44.8" r="0.8084233550482692" fill="#FFFFFF"/><circle cx="25.6" cy="44.8" r="1.2253406720005793" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="44.8" r="1.56282951468281" fill="#FFFFFF"/><circle cx="44.8" cy="44.8" r="1.8572691561702617" fill="#FFFFFF"/><circle cx="54.4" cy="44.8" r="2.1233464197636582" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="44.8" r="2.3688065860361402" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="44.8" r="2.5983501502741584" fill="#FFFFFF"/><circle cx="6.4" cy="54.4" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="54.4" r="0.633846499460857" fill="#FFFFFF"/><circle cx="25.6" cy="54.4" r="0.9607316398574451" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="54.4" r="1.225340672000579" fill="#FFFFFF"/><circle cx="44.8" cy="54.4" r="1.456196862502631" fill="#FFFFFF"/><circle cx="54.4" cy="54.4" r="1.6648154545579388" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="54.4" r="1.8572691561702614" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="54.4" r="2.03724340327418" fill="#FFFFFF"/><circle cx="6.4" cy="63.99999999999999" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="63.99999999999999" r="0.4181827351271541" fill="#FFFFFF"/><circle cx="25.6" cy="63.99999999999999" r="0.6338464994608571" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="63.99999999999999" r="0.8084233550482695" fill="#FFFFFF"/><circle cx="44.8" cy="63.99999999999999" r="0.9607316398574454" fill="#FFFFFF"/><circle cx="54.4" cy="63.99999999999999" r="1.0983685811330863" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="63.99999999999999" r="1.2253406720005795" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="63.99999999999999" r="1.3440793933950876" fill="#FFFFFF"/><circle cx="6.4" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="25.6" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="44.8" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="54.4" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/>
-    </svg>

docs/assets/concentrate-logo.svg

@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80" width="80" height="80">
-      <circle cx="6.4" cy="6.4" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="6.4" r="1.3440793933950872" fill="#0D0E10"/><circle cx="25.6" cy="6.4" r="2.03724340327418" fill="#0D0E10"/><circle cx="35.199999999999996" cy="6.4" r="2.5983501502741575" fill="#0D0E10"/><circle cx="44.8" cy="6.4" r="3.087883576356698" fill="#0D0E10"/><circle cx="54.4" cy="6.4" r="3.530261898078346" fill="#0D0E10"/><circle cx="63.99999999999999" cy="6.4" r="3.938362368365323" fill="#0D0E10"/><circle cx="73.60000000000001" cy="6.4" r="4.32" fill="#0D0E10"/><circle cx="6.4" cy="16" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="16" r="1.2253406720005793" fill="#0D0E10"/><circle cx="25.6" cy="16" r="1.8572691561702617" fill="#0D0E10"/><circle cx="35.199999999999996" cy="16" r="2.3688065860361402" fill="#0D0E10"/><circle cx="44.8" cy="16" r="2.8150936284760535" fill="#0D0E10"/><circle cx="54.4" cy="16" r="3.2183913448763177" fill="#0D0E10"/><circle cx="63.99999999999999" cy="16" r="3.5904393853139163" fill="#0D0E10"/><circle cx="73.60000000000001" cy="16" r="3.9383623683653233" fill="#0D0E10"/><circle cx="6.4" cy="25.6" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="25.6" r="1.0983685811330859" fill="#0D0E10"/><circle cx="25.6" cy="25.6" r="1.6648154545579388" fill="#0D0E10"/><circle cx="35.199999999999996" cy="25.6" r="2.1233464197636582" fill="#0D0E10"/><circle cx="44.8" cy="25.6" r="2.5233883646560065" fill="#0D0E10"/><circle cx="54.4" cy="25.6" r="2.8848956178295655" fill="#0D0E10"/><circle cx="63.99999999999999" cy="25.6" r="3.2183913448763177" fill="#0D0E10"/><circle cx="73.60000000000001" cy="25.6" r="3.530261898078346" fill="#0D0E10"/><circle cx="6.4" cy="35.199999999999996" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="35.199999999999996" r="0.9607316398574451" fill="#0D0E10"/><circle cx="25.6" cy="35.199999999999996" r="1.456196862502631" fill="#0D0E10"/><circle cx="35.199999999999996" cy="35.199999999999996" r="1.8572691561702614" fill="#0D0E10"/><circle cx="44.8" cy="35.199999999999996" r="2.2071817085957024" fill="#0D0E10"/><circle cx="54.4" cy="35.199999999999996" r="2.5233883646560065" fill="#0D0E10"/><circle cx="63.99999999999999" cy="35.199999999999996" r="2.815093628476053" fill="#0D0E10"/><circle cx="73.60000000000001" cy="35.199999999999996" r="3.087883576356698" fill="#0D0E10"/><circle cx="6.4" cy="44.8" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="44.8" r="0.8084233550482692" fill="#0D0E10"/><circle cx="25.6" cy="44.8" r="1.2253406720005793" fill="#0D0E10"/><circle cx="35.199999999999996" cy="44.8" r="1.56282951468281" fill="#0D0E10"/><circle cx="44.8" cy="44.8" r="1.8572691561702617" fill="#0D0E10"/><circle cx="54.4" cy="44.8" r="2.1233464197636582" fill="#0D0E10"/><circle cx="63.99999999999999" cy="44.8" r="2.3688065860361402" fill="#0D0E10"/><circle cx="73.60000000000001" cy="44.8" r="2.5983501502741584" fill="#0D0E10"/><circle cx="6.4" cy="54.4" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="54.4" r="0.633846499460857" fill="#0D0E10"/><circle cx="25.6" cy="54.4" r="0.9607316398574451" fill="#0D0E10"/><circle cx="35.199999999999996" cy="54.4" r="1.225340672000579" fill="#0D0E10"/><circle cx="44.8" cy="54.4" r="1.456196862502631" fill="#0D0E10"/><circle cx="54.4" cy="54.4" r="1.6648154545579388" fill="#0D0E10"/><circle cx="63.99999999999999" cy="54.4" r="1.8572691561702614" fill="#0D0E10"/><circle cx="73.60000000000001" cy="54.4" r="2.03724340327418" fill="#0D0E10"/><circle cx="6.4" cy="63.99999999999999" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="63.99999999999999" r="0.4181827351271541" fill="#0D0E10"/><circle cx="25.6" cy="63.99999999999999" r="0.6338464994608571" fill="#0D0E10"/><circle cx="35.199999999999996" cy="63.99999999999999" r="0.8084233550482695" fill="#0D0E10"/><circle cx="44.8" cy="63.99999999999999" r="0.9607316398574454" fill="#0D0E10"/><circle cx="54.4" cy="63.99999999999999" r="1.0983685811330863" fill="#0D0E10"/><circle cx="63.99999999999999" cy="63.99999999999999" r="1.2253406720005795" fill="#0D0E10"/><circle cx="73.60000000000001" cy="63.99999999999999" r="1.3440793933950876" fill="#0D0E10"/><circle cx="6.4" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="25.6" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="35.199999999999996" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="44.8" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="54.4" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="63.99999999999999" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="73.60000000000001" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/>
-    </svg>

docs/assets/exa-logo-dark.svg

@@ -1,6 +0,0 @@
-<svg width="128" height="40" viewBox="0 0 413 129" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M106.417 9.30741C106.417 9.57392 106.324 9.83227 106.155 10.0388L61.5395 64.5L106.155 118.96C106.324 119.166 106.417 119.425 106.417 119.691V127.843C106.417 128.482 105.897 129 105.255 129H1.16175C0.520132 129 0 128.482 0 127.843V1.15695C0 0.517982 0.520131 0 1.16174 0H105.255C105.897 0 106.417 0.517984 106.417 1.15695V9.30741ZM19.0364 116.382H87.6921L53.363 74.4795L19.0364 116.382ZM12.6699 104.192L40.1426 70.6585H12.6699V104.192ZM12.6699 58.0409H39.8964L12.6699 24.8064V58.0409ZM53.363 54.5193L87.6921 12.6176H19.0364L53.363 54.5193Z" fill="white"/>
-<path d="M176.198 117.65C166.094 117.65 157.323 115.553 149.886 111.36C142.588 107.167 136.905 101.017 132.835 92.911C128.906 84.8045 126.941 75.0208 126.941 63.5599C126.941 53.3569 128.976 44.2022 133.046 36.0957C137.256 27.9892 143.01 21.6298 150.307 17.0175C157.744 12.4052 166.024 10.099 175.146 10.099C185.109 10.099 193.599 12.3353 200.616 16.8078C207.633 21.1406 212.965 27.3602 216.614 35.4667C220.263 43.4334 222.087 52.8677 222.087 63.7695V66.1766C222.087 66.8156 221.567 67.3336 220.925 67.3336H145.044C145.185 74.881 146.588 81.3802 149.254 86.8311C152.061 92.282 155.78 96.475 160.411 99.4101C165.182 102.205 170.515 103.603 176.409 103.603C183.285 103.603 189.179 102.066 194.091 98.9908C198.779 95.9225 201.741 91.008 202.977 84.2471C203.08 83.6853 203.565 83.267 204.139 83.267H219.737C220.429 83.267 220.969 83.8669 220.871 84.5494C220.038 90.3376 217.988 95.6406 214.72 100.458C211.211 105.63 206.159 109.823 199.564 113.037C193.108 116.112 185.32 117.65 176.198 117.65ZM202.721 54.5449C202.721 45.3203 200.265 37.9825 195.354 32.5316C190.582 27.0807 183.846 24.3552 175.146 24.3552C166.866 24.3552 160.06 27.2205 154.727 32.9509C149.395 38.6813 146.377 45.8794 145.676 54.5449H202.721Z" fill="white"/>
-<path d="M364.585 117.65C358.13 117.65 352.236 116.392 346.903 113.876C341.571 111.36 337.361 107.796 334.273 103.184C331.186 98.4317 329.642 92.9808 329.642 86.8311C329.642 77.7462 332.73 70.688 338.904 65.6564C345.219 60.485 353.359 57.0607 363.322 55.3835L385.004 52.0291C387.67 51.6098 389.705 51.0507 391.108 50.3519C392.652 49.5133 393.704 48.465 394.266 47.2071C394.967 45.8095 395.318 44.0624 395.318 41.9659C395.318 36.515 393.424 32.2521 389.635 29.1772C385.846 25.9626 380.934 24.3552 374.9 24.3552C367.322 24.3552 361.498 26.2421 357.428 30.0158C353.595 33.4387 351.443 38.1016 350.971 44.0046C350.922 44.622 350.412 45.1106 349.79 45.1106H334.014C333.353 45.1106 332.823 44.5605 332.872 43.9032C333.312 38.0771 335.042 32.6792 338.062 27.7096C341.29 22.3985 345.921 18.1356 351.955 14.921C358.13 11.7063 365.287 10.099 373.426 10.099C381.706 10.099 388.793 11.6364 394.687 14.7113C400.721 17.7862 405.282 22.1888 408.369 27.9193C411.456 33.6497 413 40.4284 413 48.2554V113.348C413 113.987 412.48 114.505 411.838 114.505H396.901C396.259 114.505 395.739 113.987 395.739 113.348V109.473C395.739 108.076 395.739 106.678 395.739 105.28C395.739 103.743 395.739 102.275 395.739 100.878C393.213 106.189 389.214 110.312 383.741 113.247C378.408 116.182 372.023 117.65 364.585 117.65ZM367.111 103.603C372.444 103.603 377.215 102.485 381.425 100.249C385.775 97.8727 389.143 94.6581 391.529 90.6048C394.055 86.4118 395.318 81.6597 395.318 76.3486V61.4634C394.757 62.302 393.564 63.0707 391.74 63.7695C389.915 64.4684 387.389 65.1672 384.162 65.866L369.427 68.5915C362.971 69.8494 357.849 71.9459 354.06 74.881C350.271 77.8161 348.377 81.7995 348.377 86.8311C348.377 91.8627 350.131 95.916 353.639 98.9908C357.288 102.066 361.779 103.603 367.111 103.603Z" fill="white"/>
-<path d="M285.673 62.9573L325.127 112.948C325.726 113.707 325.183 114.82 324.213 114.82H305.929C305.572 114.82 305.235 114.657 305.015 114.378L275.053 76.414L245.093 114.378C244.872 114.657 244.536 114.82 244.179 114.82H225.893C224.924 114.82 224.381 113.707 224.98 112.948L264.433 62.9573L227.177 15.7512C226.578 14.9921 227.121 13.8793 228.091 13.8793H246.375C246.732 13.8793 247.068 14.0423 247.289 14.3214L275.053 49.5006L302.818 14.3214C303.038 14.0423 303.375 13.8793 303.731 13.8793H322.016C322.985 13.8793 323.528 14.9921 322.929 15.7512L285.673 62.9573Z" fill="white"/>
-</svg>

docs/assets/exa-logo.svg

@@ -1,6 +0,0 @@
-<svg width="128" height="40" viewBox="0 0 413 129" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M106.417 9.30741C106.417 9.57392 106.324 9.83227 106.155 10.0388L61.5395 64.5L106.155 118.96C106.324 119.166 106.417 119.425 106.417 119.691V127.843C106.417 128.482 105.897 129 105.255 129H1.16175C0.520132 129 0 128.482 0 127.843V1.15695C0 0.517982 0.520131 0 1.16174 0H105.255C105.897 0 106.417 0.517984 106.417 1.15695V9.30741ZM19.0364 116.382H87.6921L53.363 74.4795L19.0364 116.382ZM12.6699 104.192L40.1426 70.6585H12.6699V104.192ZM12.6699 58.0409H39.8964L12.6699 24.8064V58.0409ZM53.363 54.5193L87.6921 12.6176H19.0364L53.363 54.5193Z" fill="#0143D9"/>
-<path d="M176.198 117.65C166.094 117.65 157.323 115.553 149.886 111.36C142.588 107.167 136.905 101.017 132.835 92.911C128.906 84.8045 126.941 75.0208 126.941 63.5599C126.941 53.3569 128.976 44.2022 133.046 36.0957C137.256 27.9892 143.01 21.6298 150.307 17.0175C157.744 12.4052 166.024 10.099 175.146 10.099C185.109 10.099 193.599 12.3353 200.616 16.8078C207.633 21.1406 212.965 27.3602 216.614 35.4667C220.263 43.4334 222.087 52.8677 222.087 63.7695V66.1766C222.087 66.8156 221.567 67.3336 220.925 67.3336H145.044C145.185 74.881 146.588 81.3802 149.254 86.8311C152.061 92.282 155.78 96.475 160.411 99.4101C165.182 102.205 170.515 103.603 176.409 103.603C183.285 103.603 189.179 102.066 194.091 98.9908C198.779 95.9225 201.741 91.008 202.977 84.2471C203.08 83.6853 203.565 83.267 204.139 83.267H219.737C220.429 83.267 220.969 83.8669 220.871 84.5494C220.038 90.3376 217.988 95.6406 214.72 100.458C211.211 105.63 206.159 109.823 199.564 113.037C193.108 116.112 185.32 117.65 176.198 117.65ZM202.721 54.5449C202.721 45.3203 200.265 37.9825 195.354 32.5316C190.582 27.0807 183.846 24.3552 175.146 24.3552C166.866 24.3552 160.06 27.2205 154.727 32.9509C149.395 38.6813 146.377 45.8794 145.676 54.5449H202.721Z" fill="black"/>
-<path d="M364.585 117.65C358.13 117.65 352.236 116.392 346.903 113.876C341.571 111.36 337.361 107.796 334.273 103.184C331.186 98.4317 329.642 92.9808 329.642 86.8311C329.642 77.7462 332.73 70.688 338.904 65.6564C345.219 60.485 353.359 57.0607 363.322 55.3835L385.004 52.0291C387.67 51.6098 389.705 51.0507 391.108 50.3519C392.652 49.5133 393.704 48.465 394.266 47.2071C394.967 45.8095 395.318 44.0624 395.318 41.9659C395.318 36.515 393.424 32.2521 389.635 29.1772C385.846 25.9626 380.934 24.3552 374.9 24.3552C367.322 24.3552 361.498 26.2421 357.428 30.0158C353.595 33.4387 351.443 38.1016 350.971 44.0046C350.922 44.622 350.412 45.1106 349.79 45.1106H334.014C333.353 45.1106 332.823 44.5605 332.872 43.9032C333.312 38.0771 335.042 32.6792 338.062 27.7096C341.29 22.3985 345.921 18.1356 351.955 14.921C358.13 11.7063 365.287 10.099 373.426 10.099C381.706 10.099 388.793 11.6364 394.687 14.7113C400.721 17.7862 405.282 22.1888 408.369 27.9193C411.456 33.6497 413 40.4284 413 48.2554V113.348C413 113.987 412.48 114.505 411.838 114.505H396.901C396.259 114.505 395.739 113.987 395.739 113.348V109.473C395.739 108.076 395.739 106.678 395.739 105.28C395.739 103.743 395.739 102.275 395.739 100.878C393.213 106.189 389.214 110.312 383.741 113.247C378.408 116.182 372.023 117.65 364.585 117.65ZM367.111 103.603C372.444 103.603 377.215 102.485 381.425 100.249C385.775 97.8727 389.143 94.6581 391.529 90.6048C394.055 86.4118 395.318 81.6597 395.318 76.3486V61.4634C394.757 62.302 393.564 63.0707 391.74 63.7695C389.915 64.4684 387.389 65.1672 384.162 65.866L369.427 68.5915C362.971 69.8494 357.849 71.9459 354.06 74.881C350.271 77.8161 348.377 81.7995 348.377 86.8311C348.377 91.8627 350.131 95.916 353.639 98.9908C357.288 102.066 361.779 103.603 367.111 103.603Z" fill="black"/>
-<path d="M285.673 62.9573L325.127 112.948C325.726 113.707 325.183 114.82 324.213 114.82H305.929C305.572 114.82 305.235 114.657 305.015 114.378L275.053 76.414L245.093 114.378C244.872 114.657 244.536 114.82 244.179 114.82H225.893C224.924 114.82 224.381 113.707 224.98 112.948L264.433 62.9573L227.177 15.7512C226.578 14.9921 227.121 13.8793 228.091 13.8793H246.375C246.732 13.8793 247.068 14.0423 247.289 14.3214L275.053 49.5006L302.818 14.3214C303.038 14.0423 303.375 13.8793 303.731 13.8793H322.016C322.985 13.8793 323.528 14.9921 322.929 15.7512L285.673 62.9573Z" fill="black"/>
-</svg>

docs/assets/gmi-cloud-logo-dark.svg

@@ -1,7 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 34 718 165" width="718" height="165" fill="#fff">
-  <path d="M123.292 132.486h-33.1c-2.644 0-4.808-2.395-4.808-5.363v-21.436c0-2.95 2.148-5.363 4.809-5.363h33.099c2.645 0 4.808-2.395 4.808-5.363V73.525c0-2.95 2.147-5.363 4.808-5.363h33.099c2.646 0 4.809-2.395 4.809-5.363V41.363c0-2.95-2.148-5.363-4.809-5.363H90.208c-2.645 0-4.808 2.395-4.808 5.363V62.8c0 2.95-2.147 5.363-4.808 5.363h-33.1c-2.645 0-4.808 2.395-4.808 5.363v21.436c0 2.95-2.147 5.363-4.808 5.363H4.808c-2.645 0-4.808 2.395-4.808 5.363v21.436c0 2.95 2.147 5.363 4.808 5.363h33.1c2.645 0 4.808 2.395 4.808 5.363v21.436c0 2.95 2.147 5.363 4.808 5.363h33.099c2.645 0 4.808 2.395 4.808 5.363v21.436c0 2.95 2.148 5.363 4.809 5.363h75.798c2.646 0 4.809-2.395 4.809-5.363v-21.436c0-2.95-2.148-5.363-4.809-5.363H132.94c-2.646 0-4.809-2.395-4.809-5.363v-21.436c0-2.95-2.147-5.363-4.808-5.363z"/>
-  <path d="M251.408 100.341c2.646 0 4.809 2.395 4.809 5.363v21.436c0 2.95-2.148 5.363-4.809 5.363H218.31c-2.646 0-4.809 2.395-4.809 5.363v21.436c0 2.95-2.147 5.363-4.808 5.363h-33.099c-2.645 0-4.808-2.395-4.808-5.363v-53.58c0-2.951 2.147-5.364 4.808-5.364h75.799zM510.68 40.105h-28.795v153.33h28.795zM717.43 40.105h-28.795v153.33h28.795z"/>
-  <path d="M532.41 40.105h-28.83l35.391 153.33H567.8zM653.242 40.105h-28.795v153.33h28.795z"/>
-  <path d="M596.594 193.435h-28.795l35.39-153.33h28.795zM452.028 114.062v27.042s-.139.174-.191.261h-83.069V114.08h83.295-.035z"/>
-  <path d="M452.028 141.347v35.651c-17.479 12.306-39.834 19.769-62.953 19.769-59.673 0-97.858-35.981-97.858-80.362s34.54-80.362 97.858-80.362c22.511 0 45.127 7.689 62.953 20.36v35.685c-13.105-16.42-37.856-28.743-62.953-28.743-44.052 0-70.695 20.846-70.695 53.077 0 32.232 28.691 53.077 70.695 53.077 25.323 0 49.727-11.906 62.744-28.1h.191v-.035z"/>
-</svg>

docs/assets/gmi-cloud-logo.svg

@@ -1,7 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 34 718 165" width="718" height="165" fill="#0D0E10">
-  <path d="M123.292 132.486h-33.1c-2.644 0-4.808-2.395-4.808-5.363v-21.436c0-2.95 2.148-5.363 4.809-5.363h33.099c2.645 0 4.808-2.395 4.808-5.363V73.525c0-2.95 2.147-5.363 4.808-5.363h33.099c2.646 0 4.809-2.395 4.809-5.363V41.363c0-2.95-2.148-5.363-4.809-5.363H90.208c-2.645 0-4.808 2.395-4.808 5.363V62.8c0 2.95-2.147 5.363-4.808 5.363h-33.1c-2.645 0-4.808 2.395-4.808 5.363v21.436c0 2.95-2.147 5.363-4.808 5.363H4.808c-2.645 0-4.808 2.395-4.808 5.363v21.436c0 2.95 2.147 5.363 4.808 5.363h33.1c2.645 0 4.808 2.395 4.808 5.363v21.436c0 2.95 2.147 5.363 4.808 5.363h33.099c2.645 0 4.808 2.395 4.808 5.363v21.436c0 2.95 2.148 5.363 4.809 5.363h75.798c2.646 0 4.809-2.395 4.809-5.363v-21.436c0-2.95-2.148-5.363-4.809-5.363H132.94c-2.646 0-4.809-2.395-4.809-5.363v-21.436c0-2.95-2.147-5.363-4.808-5.363z"/>
-  <path d="M251.408 100.341c2.646 0 4.809 2.395 4.809 5.363v21.436c0 2.95-2.148 5.363-4.809 5.363H218.31c-2.646 0-4.809 2.395-4.809 5.363v21.436c0 2.95-2.147 5.363-4.808 5.363h-33.099c-2.645 0-4.808-2.395-4.808-5.363v-53.58c0-2.951 2.147-5.364 4.808-5.364h75.799zM510.68 40.105h-28.795v153.33h28.795zM717.43 40.105h-28.795v153.33h28.795z"/>
-  <path d="M532.41 40.105h-28.83l35.391 153.33H567.8zM653.242 40.105h-28.795v153.33h28.795z"/>
-  <path d="M596.594 193.435h-28.795l35.39-153.33h28.795zM452.028 114.062v27.042s-.139.174-.191.261h-83.069V114.08h83.295-.035z"/>
-  <path d="M452.028 141.347v35.651c-17.479 12.306-39.834 19.769-62.953 19.769-59.673 0-97.858-35.981-97.858-80.362s34.54-80.362 97.858-80.362c22.511 0 45.127 7.689 62.953 20.36v35.685c-13.105-16.42-37.856-28.743-62.953-28.743-44.052 0-70.695 20.846-70.695 53.077 0 32.232 28.691 53.077 70.695 53.077 25.323 0 49.727-11.906 62.744-28.1h.191v-.035z"/>
-</svg>

docs/assets/novita-logo-dark.svg

@@ -1,11 +0,0 @@
-<svg width="151" height="30" viewBox="0 0 151 30" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_novita_dark)">
-<path d="M17.2639 0.640625V12.1297L0.03125 29.363H17.2639V17.8739H17.7376L28.7529 29.363H45.9875L17.2639 0.640625Z" fill="white"/>
-</g>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M126.329 25.5459H131.778V28.9895H127.454C124.427 28.9895 122.523 27.3247 122.523 24.2256V15.0698H119.438V11.5974H122.523L123.417 7.03393H126.3V11.5974H131.778V15.0698H126.329V25.5459ZM61.9158 6.0293L69.8449 23.7083H70.0753V6.0293H74.1983V28.9895H67.97L60.0409 11.3105H59.8105V28.9895H55.6875V6.0293H61.9158ZM84.78 29.334C79.734 29.334 76.5052 25.804 76.5052 20.3223C76.5052 14.8406 79.6764 11.2529 84.78 11.2529C89.8836 11.2529 92.9971 14.6966 92.9971 20.3223C92.9971 25.948 89.826 29.334 84.78 29.334ZM84.78 25.8904C87.0293 25.8904 88.903 25.115 88.9606 22.9053V17.7393C88.9606 15.4719 87.0581 14.6966 84.78 14.6966C82.5019 14.6966 80.5418 15.4719 80.5418 17.7393V22.9053C80.5994 25.1438 82.5307 25.8904 84.78 25.8904ZM97.4094 11.5686L101.907 25.3443H102.137L106.635 11.5686H110.787L104.587 28.9607H99.4547L93.284 11.5686H97.407H97.4094ZM112.922 11.5974H116.728V28.9895H112.922V11.5974ZM112.69 6.0293H116.957V9.30127H112.69V6.0293ZM141.12 29.3628C136.477 29.3628 133.508 25.8328 133.508 20.3223C133.508 14.8118 136.42 11.2817 141.12 11.2817C143.312 11.2817 145.099 12.1423 146.166 13.7495H146.397L147.147 11.5974H150.03V28.9895H147.147L146.397 26.8938H146.166C145.013 28.4146 143.081 29.3616 141.12 29.3616V29.3628ZM141.898 25.8904C144.176 25.8904 146.165 25.1726 146.223 22.9053V17.7393C146.223 15.4143 144.146 14.7542 141.812 14.7542C139.477 14.7542 137.545 15.4719 137.545 17.7393V22.9053C137.602 25.2014 139.592 25.8904 141.898 25.8904Z" fill="white"/>
-<defs>
-<clipPath id="clip0_novita_dark">
-<rect width="45.9562" height="28.7223" fill="white" transform="translate(0.0292969 0.640625)"/>
-</clipPath>
-</defs>
-</svg>

docs/assets/novita-logo.svg

@@ -1,11 +0,0 @@
-<svg width="151" height="30" viewBox="0 0 151 30" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_125_11573)">
-<path d="M17.2639 0.640625V12.1297L0.03125 29.363H17.2639V17.8739H17.7376L28.7529 29.363H45.9875L17.2639 0.640625Z" fill="black"/>
-</g>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M126.329 25.5459H131.778V28.9895H127.454C124.427 28.9895 122.523 27.3247 122.523 24.2256V15.0698H119.438V11.5974H122.523L123.417 7.03393H126.3V11.5974H131.778V15.0698H126.329V25.5459ZM61.9158 6.0293L69.8449 23.7083H70.0753V6.0293H74.1983V28.9895H67.97L60.0409 11.3105H59.8105V28.9895H55.6875V6.0293H61.9158ZM84.78 29.334C79.734 29.334 76.5052 25.804 76.5052 20.3223C76.5052 14.8406 79.6764 11.2529 84.78 11.2529C89.8836 11.2529 92.9971 14.6966 92.9971 20.3223C92.9971 25.948 89.826 29.334 84.78 29.334ZM84.78 25.8904C87.0293 25.8904 88.903 25.115 88.9606 22.9053V17.7393C88.9606 15.4719 87.0581 14.6966 84.78 14.6966C82.5019 14.6966 80.5418 15.4719 80.5418 17.7393V22.9053C80.5994 25.1438 82.5307 25.8904 84.78 25.8904ZM97.4094 11.5686L101.907 25.3443H102.137L106.635 11.5686H110.787L104.587 28.9607H99.4547L93.284 11.5686H97.407H97.4094ZM112.922 11.5974H116.728V28.9895H112.922V11.5974ZM112.69 6.0293H116.957V9.30127H112.69V6.0293ZM141.12 29.3628C136.477 29.3628 133.508 25.8328 133.508 20.3223C133.508 14.8118 136.42 11.2817 141.12 11.2817C143.312 11.2817 145.099 12.1423 146.166 13.7495H146.397L147.147 11.5974H150.03V28.9895H147.147L146.397 26.8938H146.166C145.013 28.4146 143.081 29.3616 141.12 29.3616V29.3628ZM141.898 25.8904C144.176 25.8904 146.165 25.1726 146.223 22.9053V17.7393C146.223 15.4143 144.146 14.7542 141.812 14.7542C139.477 14.7542 137.545 15.4719 137.545 17.7393V22.9053C137.602 25.2014 139.592 25.8904 141.898 25.8904Z" fill="black"/>
-<defs>
-<clipPath id="clip0_125_11573">
-<rect width="45.9562" height="28.7223" fill="white" transform="translate(0.0292969 0.640625)"/>
-</clipPath>
-</defs>
-</svg>

docs/assets/vercel-logo-dark.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="261" height="52" fill="none" viewBox="0 0 261 52"><path fill="white" d="M59.8 52H0L29.9 0zm67.82-38.45q4.9 0 8.81 2.13a15.5 15.5 0 0 1 6.22 6.32q2.3 4.2 2.38 10.26v2.06h-26.35q.27 4.4 2.58 6.92 2.38 2.47 6.36 2.47a8.4 8.4 0 0 0 7.76-4.93l9.16.67q-1.68 4.98-6.29 7.99t-10.63 3q-5.53 0-9.64-2.27a16 16 0 0 1-6.43-6.46 20 20 0 0 1-2.31-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26m62.55 0q4.47 0 8.18 1.66a15.3 15.3 0 0 1 6.15 4.6q2.38 3 2.87 7.05l-9.23.47a8 8 0 0 0-2.8-5 7.7 7.7 0 0 0-5.17-1.86q-4.33 0-6.7 3-2.4 3-2.39 8.52t2.38 8.52q2.37 3 6.71 3 3.15 0 5.39-1.87 2.24-1.92 2.72-5.46l9.3.4a14.7 14.7 0 0 1-2.87 7.33 16 16 0 0 1-6.15 4.86 21 21 0 0 1-8.39 1.66q-5.53 0-9.64-2.26a16 16 0 0 1-6.44-6.46 20 20 0 0 1-2.3-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26m38.66 0q4.9 0 8.8 2.13a15.5 15.5 0 0 1 6.22 6.32q2.31 4.2 2.38 10.26v2.06h-26.35q.28 4.4 2.58 6.92 2.38 2.47 6.36 2.47a8.4 8.4 0 0 0 7.77-4.93l9.15.67q-1.68 5-6.29 7.99t-10.62 3q-5.53 0-9.65-2.27a16 16 0 0 1-6.43-6.46 20 20 0 0 1-2.31-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26M86.9 36.69l17.24-34.33h10.8L89.96 49.63h-6.12L58.85 2.36h10.81zm71.62-15.55a11 11 0 0 1 2.47-4.48q2.28-2.31 6.38-2.31h3.4v7.26h-3.47q-2.91 0-4.79.8a5.8 5.8 0 0 0-2.77 2.5q-.9 1.72-.9 4.37v20.35h-8.89V14.35h8.33zm101.73 28.5h-8.95V2.35h8.95zM127.62 20.26q-3.7 0-6 2.2-2.32 2.2-2.87 6.2h17.05q-.48-4.34-2.72-6.33a7.8 7.8 0 0 0-5.46-2.07m101.2 0q-3.7 0-6 2.2-2.31 2.2-2.87 6.2H237q-.5-4.34-2.73-6.33a7.8 7.8 0 0 0-5.46-2.07" style="fill:white;fill-opacity:1;"/></svg>

docs/assets/vercel-logo.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="261" height="52" fill="none" viewBox="0 0 261 52"><path fill="black" d="M59.8 52H0L29.9 0zm67.82-38.45q4.9 0 8.81 2.13a15.5 15.5 0 0 1 6.22 6.32q2.3 4.2 2.38 10.26v2.06h-26.35q.27 4.4 2.58 6.92 2.38 2.47 6.36 2.47a8.4 8.4 0 0 0 7.76-4.93l9.16.67q-1.68 4.98-6.29 7.99t-10.63 3q-5.53 0-9.64-2.27a16 16 0 0 1-6.43-6.46 20 20 0 0 1-2.31-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26m62.55 0q4.47 0 8.18 1.66a15.3 15.3 0 0 1 6.15 4.6q2.38 3 2.87 7.05l-9.23.47a8 8 0 0 0-2.8-5 7.7 7.7 0 0 0-5.17-1.86q-4.33 0-6.7 3-2.4 3-2.39 8.52t2.38 8.52q2.37 3 6.71 3 3.15 0 5.39-1.87 2.24-1.92 2.72-5.46l9.3.4a14.7 14.7 0 0 1-2.87 7.33 16 16 0 0 1-6.15 4.86 21 21 0 0 1-8.39 1.66q-5.53 0-9.64-2.26a16 16 0 0 1-6.44-6.46 20 20 0 0 1-2.3-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26m38.66 0q4.9 0 8.8 2.13a15.5 15.5 0 0 1 6.22 6.32q2.31 4.2 2.38 10.26v2.06h-26.35q.28 4.4 2.58 6.92 2.38 2.47 6.36 2.47a8.4 8.4 0 0 0 7.77-4.93l9.15.67q-1.68 5-6.29 7.99t-10.62 3q-5.53 0-9.65-2.27a16 16 0 0 1-6.43-6.46 20 20 0 0 1-2.31-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26M86.9 36.69l17.24-34.33h10.8L89.96 49.63h-6.12L58.85 2.36h10.81zm71.62-15.55a11 11 0 0 1 2.47-4.48q2.28-2.31 6.38-2.31h3.4v7.26h-3.47q-2.91 0-4.79.8a5.8 5.8 0 0 0-2.77 2.5q-.9 1.72-.9 4.37v20.35h-8.89V14.35h8.33zm101.73 28.5h-8.95V2.35h8.95zM127.62 20.26q-3.7 0-6 2.2-2.32 2.2-2.87 6.2h17.05q-.48-4.34-2.72-6.33a7.8 7.8 0 0 0-5.46-2.07m101.2 0q-3.7 0-6 2.2-2.31 2.2-2.87 6.2H237q-.5-4.34-2.73-6.33a7.8 7.8 0 0 0-5.46-2.07" style="fill:black;fill-opacity:1;"/></svg>

go.mod

@@ -1,6 +1,6 @@
-module github.com/Twigpine/zero
+module github.com/Gitlawb/zero
 
-go 1.26.10
+go 1.26.6
 
 require (
 	charm.land/bubbles/v2 v2.1.1

internal/acp/agent.go

@@ -2,29 +2,23 @@ package acp
 
 import (
 	"context"
-	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"log"
-	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/modelregistry"
-	"github.com/Twigpine/zero/internal/providercatalog"
-	"github.com/Twigpine/zero/internal/providermodelcatalog"
-	"github.com/Twigpine/zero/internal/providermodeldiscovery"
-	"github.com/Twigpine/zero/internal/redaction"
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/sessions"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/usage"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/config"
+	"github.com/Gitlawb/zero/internal/providercatalog"
+	"github.com/Gitlawb/zero/internal/providermodelcatalog"
+	"github.com/Gitlawb/zero/internal/providermodeldiscovery"
+	"github.com/Gitlawb/zero/internal/redaction"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sessions"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // Deps are the ZERO capabilities the ACP Agent drives. The CLI fills these with
@@ -46,12 +40,8 @@ type Deps struct {
 	// ResolveWorkspaceRoot validates + normalizes a client-supplied cwd (must be an
 	// existing directory; never the bare root). It is the file-tool confinement root.
 	ResolveWorkspaceRoot func(cwd string) (string, error)
-	// PersistEvents is an optional test seam for injecting event-store failures.
-	// It receives a COMPLETED TURN as one batch, never one event at a time: the
-	// batch is the unit the shared store keeps contiguous (see persistTurn).
-	PersistEvents func(sessionID string, inputs []sessions.AppendEventInput) error
-	Store         *sessions.Store
-	AgentInfo     Implementation
+	Store                *sessions.Store
+	AgentInfo            Implementation
 }
 
 // Workspace is the per-turn execution environment passed to the agent. ACP does
@@ -108,14 +98,6 @@ type acpSession struct {
 	restrictModels bool
 	cancel         context.CancelFunc
 	history        []turnRecord
-
-	// readOnly marks a session published by session/load for a kind that is
-	// not resumable (a child, side or spec sub-run). Load still replays its
-	// transcript, which is the render-only use a client needs, but a prompt
-	// would continue the sub-run as a standalone conversation, which every
-	// other resume path refuses (sessions.IsResumableKind). Set once when the
-	// session is first registered and never changed, so it is read without mu.
-	readOnly bool
 }
 
 // NewAgent builds the ACP server and registers its method handlers on conn.
@@ -124,8 +106,6 @@ func NewAgent(conn *Conn, deps Deps) *Agent {
 	conn.Handle(MethodInitialize, a.handleInitialize)
 	conn.Handle(MethodSessionNew, a.handleSessionNew)
 	conn.Handle(MethodSessionLoad, a.handleSessionLoad)
-	conn.Handle(MethodSessionList, a.handleSessionList)
-	conn.Handle(MethodSessionResume, a.handleSessionResume)
 	conn.Handle(MethodSessionPrompt, a.handleSessionPrompt)
 	conn.Handle(MethodSessionSetMode, a.handleSetMode)
 	conn.Handle(MethodSessionSetConfigOption, a.handleSetConfigOption)
@@ -154,11 +134,11 @@ func (a *Agent) handleInitialize(_ context.Context, params json.RawMessage) (any
 	return InitializeResult{
 		ProtocolVersion: negotiated,
 		AgentCapabilities: AgentCapabilities{
-			// ACP v1 optional methods are advertised as empty capability objects;
-			// clients must gate session/list and session/resume on their presence.
-			LoadSession:         true,
-			PromptCapabilities:  PromptCapabilities{Image: true},
-			SessionCapabilities: &SessionCapabilities{List: &struct{}{}, Resume: &struct{}{}},
+			// Only advertise what ZERO actually implements: session/load (loadSession)
+			// and image prompts. session/resume + the session-capability sub-object
+			// are intentionally omitted since there is no resume handler yet.
+			LoadSession:        true,
+			PromptCapabilities: PromptCapabilities{Image: true},
 		},
 		AgentInfo: &info,
 		// ZERO owns credentials (BYOK) and does not delegate auth to the editor.
@@ -168,41 +148,12 @@ func (a *Agent) handleInitialize(_ context.Context, params json.RawMessage) (any
 
 // ---- session lifecycle ----
 
-// requestedWorkspace is the single rule for a cwd that arrived from the client,
-// applied before the value can reach ResolveWorkspaceRoot.
-//
-// THE REQUEST'S OWN CWD IS THE ONLY THING ALLOWED TO PICK A ROOT. Every params
-// type spells cwd as a plain string, so an absent field and an empty one decode
-// to exactly the same "", and the resolver treats "" as "use the directory this
-// process was started in" and joins a relative cwd onto it. Those two defaults
-// meet in the middle: `{"sessionId":"known"}` used to activate a persisted
-// session, and `{}` used to create one, both rooted at wherever the editor
-// happened to spawn `zero acp` — which then becomes the sandbox and file-tool
-// confinement root. The client never named that directory, so it is a root the
-// server invented, and ACP requires an absolute cwd on every method carrying
-// one. Rejecting here is what keeps a missing field from being answered with a
-// guess.
-func requestedWorkspace(cwd string) (string, error) {
-	trimmed := strings.TrimSpace(cwd)
-	if trimmed == "" {
-		return "", RPCError(codeInvalidParams, "cwd is required and must be an absolute path")
-	}
-	if !filepath.IsAbs(trimmed) {
-		return "", RPCError(codeInvalidParams, "cwd must be an absolute path: "+trimmed)
-	}
-	return trimmed, nil
-}
-
 func (a *Agent) handleSessionNew(ctx context.Context, params json.RawMessage) (any, error) {
 	var p NewSessionParams
 	if err := json.Unmarshal(params, &p); err != nil {
 		return nil, RPCError(codeInvalidParams, "invalid session/new params")
 	}
-	cwd, err := requestedWorkspace(p.Cwd)
-	if err != nil {
-		return nil, err
-	}
-	root, err := a.deps.ResolveWorkspaceRoot(cwd)
+	root, err := a.deps.ResolveWorkspaceRoot(p.Cwd)
 	if err != nil {
 		return nil, RPCError(codeInvalidParams, err.Error())
 	}
@@ -214,7 +165,7 @@ func (a *Agent) handleSessionNew(ctx context.Context, params json.RawMessage) (a
 	if err != nil {
 		return nil, RPCError(codeInternalError, "create session: "+err.Error())
 	}
-	sess, _ := a.registerSession(meta.SessionID, root, nil, model, models, restrictModels, false, agent.PermissionModeAuto)
+	sess := a.registerSession(meta.SessionID, root, nil, model, models, restrictModels)
 	return NewSessionResult{
 		SessionID:     sess.id,
 		ConfigOptions: a.configOptions(sess),
@@ -227,96 +178,22 @@ func (a *Agent) handleSessionLoad(ctx context.Context, params json.RawMessage) (
 	if err := json.Unmarshal(params, &p); err != nil {
 		return nil, RPCError(codeInvalidParams, "invalid session/load params")
 	}
-	return a.activatePersistedSession(ctx, p, persistedSessionLoad)
-}
-
-func (a *Agent) handleSessionResume(ctx context.Context, params json.RawMessage) (any, error) {
-	var p ResumeSessionParams
-	if err := json.Unmarshal(params, &p); err != nil {
-		return nil, RPCError(codeInvalidParams, "invalid session/resume params")
-	}
-	return a.activatePersistedSession(ctx, p, persistedSessionResume)
-}
-
-type persistedSessionOperation uint8
-
-const (
-	persistedSessionLoad persistedSessionOperation = iota
-	persistedSessionResume
-)
-
-// activatePersistedSession restores the agent's internal conversation context
-// for both lifecycle methods. session/load additionally replays user-visible
-// history as ordered session/update notifications; session/resume deliberately
-// does not, which makes it safe for an already-rendered desktop reconnect.
-func (a *Agent) activatePersistedSession(ctx context.Context, p LoadSessionParams, operation persistedSessionOperation) (any, error) {
-	// BOTH METHODS, BEFORE ANYTHING IS LOOKED UP. session/resume shares this
-	// params type with session/load, so the wire cannot tell an omitted cwd from
-	// an empty one; the blank case used to be answered with the persisted cwd,
-	// which made {"sessionId":"known"} a complete, successful activation request.
-	// Validating here rather than in one handler is what keeps the two entry
-	// points from drifting apart.
-	cwd, err := requestedWorkspace(p.Cwd)
-	if err != nil {
-		return nil, err
-	}
 	meta, err := a.deps.Store.Get(p.SessionID)
 	if err != nil || meta == nil {
 		return nil, RPCError(codeInvalidParams, "session not found: "+p.SessionID)
 	}
-	if operation == persistedSessionResume && !sessions.IsResumableKind(meta.SessionKind) {
-		return nil, RPCError(codeInvalidParams, "session is not resumable: "+p.SessionID)
+	cwdInput := p.Cwd
+	if strings.TrimSpace(cwdInput) == "" {
+		cwdInput = meta.Cwd
 	}
-	if strings.TrimSpace(meta.Cwd) == "" {
-		return nil, RPCError(codeInvalidParams, "session has no persisted workspace: "+p.SessionID)
-	}
-	// SAME RULE ON THE WAY IN. Omitting a relative entry from the listing is not
-	// enough: a stored "." still resolves against this process's directory, so a
-	// client that hands back that same directory as its cwd would be sold the
-	// invented root as a match. A workspace that cannot be identified is not one
-	// this session can be restored into.
-	if !filepath.IsAbs(meta.Cwd) {
-		return nil, RPCError(codeInvalidParams, "session workspace is not an absolute path, so it cannot be identified: "+p.SessionID)
-	}
-	persistedRoot, err := a.deps.ResolveWorkspaceRoot(meta.Cwd)
-	if err != nil {
-		return nil, RPCError(codeInvalidParams, "persisted session workspace is unavailable: "+err.Error())
-	}
-	root, err := a.deps.ResolveWorkspaceRoot(cwd)
+	root, err := a.deps.ResolveWorkspaceRoot(cwdInput)
 	if err != nil {
 		return nil, RPCError(codeInvalidParams, err.Error())
 	}
-	// ACP session cwd is immutable. Loading history under a different root
-	// would give a conversation from one workspace access to another
-	// workspace's configuration, files, and tools.
-	if !sameWorkspace(root, persistedRoot) {
-		return nil, RPCError(codeInvalidParams, "session cwd does not match its persisted workspace")
-	}
 	// Load history BEFORE publishing the session so no concurrent prompt observes
 	// a half-initialized session (registerSession sets history under the lock and
 	// reuses an already-live session rather than orphaning its in-flight turn).
-	requireHistoryLog := operation == persistedSessionResume && meta.EventCount > 0
-	history, messages, historyWarning, historyErr := a.loadHistory(meta.SessionID, requireHistoryLog)
-	// RESUME PROMISES RESTORED CONTEXT, SO A FAILED RESTORATION IS A FAILED
-	// RESUME. historyErr used to do nothing but suppress replay and raise a
-	// warning: the session was registered and reported ready regardless, so a
-	// corrupt record or an unreadable events file left the caller holding a live,
-	// promptable session ID whose next prompt ran as a brand-new conversation
-	// under the old identity. Nothing in the response said so.
-	//
-	// Publication is now gated on restoration for resume. LOAD keeps the
-	// best-effort policy deliberately rather than by inheriting this helper: it
-	// replays what it has and warns about the rest, which is the right trade for
-	// a client rebuilding a transcript it can still scroll. Reported by @jatmn.
-	if operation == persistedSessionResume && historyErr != nil {
-		return nil, RPCError(codeInternalError, "restore session history: "+historyErr.Error())
-	}
-	// Load stays best effort about a history it cannot read, but not about one
-	// prune holds: publishing it would leave the client using a session prune may
-	// be removing, one this process could not hold open.
-	if errors.Is(historyErr, sessions.ErrPruning) {
-		return nil, RPCError(codeInternalError, historyErr.Error())
-	}
+	history, historyErr := a.loadHistory(meta.SessionID)
 	model, models, restrictModels, err := a.resolveModelChoices(ctx, root)
 	if err != nil {
 		return nil, RPCError(codeInternalError, "config: "+err.Error())
@@ -327,39 +204,12 @@ func (a *Agent) activatePersistedSession(ctx context.Context, p LoadSessionParam
 			models = append(models, SessionConfigOptionValue{Value: persistedModel, Name: persistedModel})
 		}
 	}
-	// Resume has already refused a non-resumable kind above, so only load can
-	// reach here with one, and it publishes that session for viewing only.
-	readOnly := !sessions.IsResumableKind(meta.SessionKind)
-	sess, existed := a.registerSession(meta.SessionID, root, history, model, models, restrictModels, readOnly, restoredPermissionMode(meta.PermissionMode))
-	if existed {
-		_, messages, historyWarning, historyErr = a.refreshSessionHistory(sess, requireHistoryLog)
-		if operation == persistedSessionResume && historyErr != nil {
-			return nil, RPCError(codeInternalError, "restore session history: "+historyErr.Error())
-		}
-	}
-	note := &notifier{conn: a.conn, sessionID: sess.id}
-	if operation == persistedSessionLoad && historyErr == nil {
-		for _, message := range messages {
-			if message.tool != nil {
-				note.send(*message.tool)
-				continue
-			}
-			note.send(replayMessageChunk(message.role, replayMessageID(message.eventID), message.content))
-		}
-	}
+	sess := a.registerSession(meta.SessionID, root, history, model, models, restrictModels)
 	a.warnPersistence(
-		note,
-		"rehydrate session compaction",
-		"Could not apply session compaction. Raw session history was restored instead.",
-		historyWarning,
-		operation == persistedSessionLoad,
-	)
-	a.warnPersistence(
-		note,
+		&notifier{conn: a.conn, sessionID: sess.id},
 		"load session history",
 		"Could not load session history. The session is open, but earlier turns may be missing until storage recovers.",
 		historyErr,
-		operation == persistedSessionLoad,
 	)
 	return LoadSessionResult{
 		ConfigOptions: a.configOptions(sess),
@@ -367,80 +217,6 @@ func (a *Agent) activatePersistedSession(ctx context.Context, p LoadSessionParam
 	}, nil
 }
 
-func (a *Agent) handleSessionList(_ context.Context, params json.RawMessage) (any, error) {
-	var p ListSessionsParams
-	if len(params) > 0 {
-		if err := json.Unmarshal(params, &p); err != nil {
-			return nil, RPCError(codeInvalidParams, "invalid session/list params")
-		}
-	}
-	if p.Cursor != "" {
-		return nil, RPCError(codeInvalidParams, "invalid session/list cursor")
-	}
-	items, err := a.deps.Store.ListResumable()
-	if err != nil {
-		return nil, RPCError(codeInternalError, "list sessions: "+err.Error())
-	}
-	// The filter is the one cwd ACP leaves optional, so a blank one means "no
-	// filter" rather than an error — but a relative one is rebased onto this
-	// process's directory exactly like the others, and would then silently answer
-	// about a workspace the client never named.
-	var cwd string
-	if strings.TrimSpace(p.Cwd) != "" {
-		filter, err := requestedWorkspace(p.Cwd)
-		if err != nil {
-			return nil, err
-		}
-		cwd, err = a.deps.ResolveWorkspaceRoot(filter)
-		if err != nil {
-			return nil, RPCError(codeInvalidParams, err.Error())
-		}
-	}
-	result := ListSessionsResult{Sessions: make([]SessionInfo, 0, len(items))}
-	for _, item := range items {
-		// EVERY ENTRY IS RESOLVED, FILTER OR NO FILTER. Listing is a menu, and
-		// every item on it has to be orderable: activatePersistedSession
-		// resolves the persisted workspace and refuses what it cannot reach, so
-		// anything this loop cannot resolve is something the client would be
-		// offered and then denied.
-		//
-		// Resolving only when a cwd filter was supplied left two shapes through —
-		// a session whose workspace has since been deleted, and a legacy entry
-		// holding a relative path, which was then reported as cwd "." even though
-		// ACP requires SessionInfo.cwd to be absolute.
-		if strings.TrimSpace(item.Cwd) == "" {
-			continue
-		}
-		// A RELATIVE PERSISTED CWD HAS NO RECOVERABLE IDENTITY. Resolving one
-		// rebases it onto wherever this ACP server happens to be running and
-		// advertises that invented absolute path as the session's workspace — so a
-		// conversation created for one project could be resumed against another
-		// project's configuration, files and tools. The original base is not
-		// knowable from the metadata, so the honest answer is to omit the entry
-		// rather than to guess at it.
-		if !filepath.IsAbs(item.Cwd) {
-			continue
-		}
-		itemRoot, err := a.deps.ResolveWorkspaceRoot(item.Cwd)
-		if err != nil {
-			continue
-		}
-		if cwd != "" && !sameWorkspace(itemRoot, cwd) {
-			continue
-		}
-		result.Sessions = append(result.Sessions, SessionInfo{
-			SessionID: item.SessionID,
-			Title:     item.Title,
-			// The RESOLVED root, not the stored string: absolute as ACP
-			// requires, and the same value the client will hand back on resume.
-			Cwd:       itemRoot,
-			UpdatedAt: item.UpdatedAt,
-			Meta:      &SessionInfoMeta{ModelID: item.ModelID, CreatedAt: item.CreatedAt},
-		})
-	}
-	return result, nil
-}
-
 // ---- prompt turn ----
 
 func (a *Agent) handleSessionPrompt(ctx context.Context, params json.RawMessage) (any, error) {
@@ -452,9 +228,6 @@ func (a *Agent) handleSessionPrompt(ctx context.Context, params json.RawMessage)
 	if sess == nil {
 		return nil, RPCError(codeInvalidParams, "unknown session: "+p.SessionID)
 	}
-	if sess.readOnly {
-		return nil, RPCError(codeInvalidParams, "session is not resumable, so it was loaded for viewing only and cannot be prompted: "+p.SessionID)
-	}
 
 	// Serialize turns for this session so two prompts can't interleave history or
 	// fight over the single cancel slot. session/cancel still works concurrently
@@ -520,40 +293,6 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 			note.text("\n\n[zero warning] " + text + "\n")
 		}
 	}
-	// Buffer the complete turn until RunAgent has a valid ACP outcome. A hard run
-	// failure is an aborted turn: neither live history nor durable history may
-	// retain its user/tool prefix under an RPC error. StopCancelled is a valid
-	// outcome and commits through the same boundary below.
-	pendingEvents := make([]sessions.AppendEventInput, 0, 4)
-	queue := func(input sessions.AppendEventInput) {
-		pendingEvents = append(pendingEvents, input)
-	}
-	visionCache := make(map[string]bool)
-	var visionCacheMu sync.Mutex
-	supportsVision := func(modelID string) bool {
-		modelID = strings.TrimSpace(modelID)
-		if modelID == "" {
-			return false
-		}
-		visionCacheMu.Lock()
-		defer visionCacheMu.Unlock()
-		if cached, ok := visionCache[modelID]; ok {
-			return cached
-		}
-		supported := a.modelSupportsVision(ctx, resolved.Provider, modelID)
-		visionCache[modelID] = supported
-		return supported
-	}
-	effectivePrompt := userText
-	if len(images) > 0 && !supportsVision(resolved.Provider.Model) {
-		msg := fmt.Sprintf("Model %s does not support image input; ignoring %d prompt image(s).", resolved.Provider.Model, len(images))
-		note.text("[zero] " + msg + "\n\n")
-		effectivePrompt = fmt.Sprintf("[Note: %s]\n\n%s", msg, userText)
-		images = nil
-	}
-	// Match the TUI: only images actually sent to the model enter history.
-	attachments := sessions.MessageAttachments{Images: len(images)}
-	queue(messageEvent("user", userText, attachments))
 
 	opts := agent.Options{
 		Cwd:            sess.cwd,
@@ -566,21 +305,10 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 		DeferThreshold: workspace.DeferThreshold,
 		MaxTurns:       resolved.MaxTurns,
 		Images:         images,
-		SupportsVision: supportsVision,
 		OnText:         note.text,
 		OnReasoning:    note.thought,
-		// Persist token usage the same way `zero exec` does, so `zero usage report`
-		// sees ACP sessions too. It joins the turn's buffered batch: a hard run
-		// failure that aborts the turn drops its usage together with its history.
-		OnUsage: func(u agent.Usage) {
-			queue(usageEvent(u))
-		},
-		OnToolCall: func(call agent.ToolCall) {
-			queue(toolCallEvent(call))
-			note.toolCall(call)
-		},
+		OnToolCall:     note.toolCall,
 		OnToolResult: func(result agent.ToolResult) {
-			queue(toolResultEvent(result))
 			note.toolResult(result)
 			if result.Name == "update_plan" {
 				a.emitPlan(registry, note)
@@ -591,38 +319,21 @@ func (a *Agent) runTurn(ctx context.Context, sess *acpSession, userText string,
 		},
 	}
 
-	agentPrompt := buildPrompt(sess.snapshotHistory(), effectivePrompt)
+	agentPrompt := buildPrompt(sess.snapshotHistory(), userText)
 	result, runErr := a.deps.RunAgent(ctx, agentPrompt, provider, opts)
-	if result.FinalAnswer != "" {
-		queue(messageEvent("assistant", result.FinalAnswer, sessions.MessageAttachments{}))
-	}
+
 	reason, stopErr := stopReasonFor(result, runErr)
 	if stopErr != nil {
 		return "", RPCError(codeInternalError, stopErr.Error())
 	}
-	// ONE BATCH, ONE LOCK. The outcome gate above decides WHETHER the turn is
-	// committed; the store batch decides WHICH RECORDS STAY TOGETHER relative to
-	// other writers, and these are different guarantees. Persisting the buffer
-	// one event per call took and released the store's session lock between
-	// events, so a second ACP instance holding the same session — its turnMu is
-	// its own, only the store is shared — could append its whole turn in the
-	// gap: user A, user B, answer B, answer A. Every write was individually
-	// locked and the log was valid, but a fresh load pairs prose by order and
-	// reconstructed three wrong turns from two right ones. Before this branch,
-	// persistTurn handed the user and assistant events to AppendEvents together;
-	// buffering until the outcome is known was correct, splitting the commit
-	// into singleton writes was not. The store writes a batch under one lock and
-	// one file write, which is the contiguity restored here — not a disk
-	// transaction, and not a promise about crashes mid-fsync. Reported by @jatmn.
-	persistenceErr := a.persistTurn(sess.id, pendingEvents)
-	sess.appendHistory(turnRecord{user: attachments.WithContent(userText), assistant: result.FinalAnswer})
-	a.warnPersistence(
-		note,
-		"save session history",
-		"Could not save session history. This turn is available in memory, but future resume may miss it until storage recovers.",
-		persistenceErr,
-		true,
-	)
+	if err := a.persistTurn(sess, userText, result.FinalAnswer); err != nil {
+		a.warnPersistence(
+			note,
+			"save session history",
+			"Could not save session history. This turn is available in memory, but future resume may miss it until storage recovers.",
+			err,
+		)
+	}
 	return reason, nil
 }
 
@@ -703,9 +414,7 @@ func (a *Agent) handleSetMode(_ context.Context, params json.RawMessage) (any, e
 	mode := agent.PermissionMode(p.ModeID)
 	switch mode {
 	case agent.PermissionModeAuto, agent.PermissionModeAsk, agent.PermissionModePlan:
-		if err := a.updateMode(sess, mode); err != nil {
-			return nil, err
-		}
+		sess.setMode(mode)
 		(&notifier{conn: a.conn, sessionID: sess.id}).currentMode(string(mode))
 		return SetSessionModeResult{}, nil
 	case agent.PermissionModeUnsafe:
@@ -741,9 +450,7 @@ func (a *Agent) handleSetConfigOption(_ context.Context, params json.RawMessage)
 		mode := agent.PermissionMode(p.Value)
 		switch mode {
 		case agent.PermissionModeAuto, agent.PermissionModeAsk, agent.PermissionModePlan:
-			if err := a.updateMode(sess, mode); err != nil {
-				return nil, err
-			}
+			sess.setMode(mode)
 			(&notifier{conn: a.conn, sessionID: sess.id}).currentMode(string(mode))
 		case agent.PermissionModeUnsafe:
 			return nil, RPCError(codeInvalidParams, "mode not permitted over ACP: "+p.Value)
@@ -785,35 +492,6 @@ func (a *Agent) updateModel(sess *acpSession, model string, restrictModels bool)
 	return nil
 }
 
-// updateMode persists the mode BEFORE applying it, so a failed write fails the
-// request instead of leaving disk behind memory; the same order updateModel
-// uses. The caller holds sess.turnMu (both mode doors take it and it is not
-// reentrant, so this must not lock it again); the write under turnMu briefly
-// blocks that session's prompts, which is what makes the store authoritative.
-func (a *Agent) updateMode(sess *acpSession, mode agent.PermissionMode) error {
-	if _, err := a.deps.Store.UpdateMode(sess.id, string(mode)); err != nil {
-		return RPCError(codeInternalError, "save mode selection: "+err.Error())
-	}
-	sess.setMode(mode)
-	return nil
-}
-
-// restoredPermissionMode maps a persisted mode onto the modes ACP offers. A
-// session written before modes were persisted has none and keeps the historical
-// auto default. A stored value outside the three is never allowed to come back
-// weaker than ask, and unsafe can never be reached because ACP refuses to set
-// it in the first place.
-func restoredPermissionMode(saved string) agent.PermissionMode {
-	switch mode := agent.PermissionMode(strings.TrimSpace(saved)); mode {
-	case agent.PermissionModeAuto, agent.PermissionModeAsk, agent.PermissionModePlan:
-		return mode
-	case "":
-		return agent.PermissionModeAuto
-	default:
-		return agent.PermissionModeAsk
-	}
-}
-
 func (a *Agent) handleCancel(_ context.Context, params json.RawMessage) {
 	var p CancelParams
 	if err := json.Unmarshal(params, &p); err != nil {
@@ -914,183 +592,39 @@ func (a *Agent) configOptions(s *acpSession) []SessionConfigOption {
 
 // ---- persistence + continuity ----
 
-// persistTurn commits a completed turn's buffered events as one store batch, so
-// no other writer's records can land between them. A failure is the failure of
-// the whole batch: nothing after a failed prerequisite is appended on its own.
-func (a *Agent) persistTurn(sessionID string, inputs []sessions.AppendEventInput) error {
-	if len(inputs) == 0 {
-		return nil
-	}
-	if a.deps.PersistEvents != nil {
-		return a.deps.PersistEvents(sessionID, inputs)
-	}
+func (a *Agent) persistTurn(sess *acpSession, user, assistant string) error {
+	defer sess.appendHistory(turnRecord{user: user, assistant: assistant})
 	if a.deps.Store == nil {
 		return nil
 	}
-	_, err := a.deps.Store.AppendEvents(sessionID, inputs)
+	events := []sessions.AppendEventInput{
+		{
+			Type:    sessions.EventMessage,
+			Payload: map[string]any{"role": "user", "content": user},
+		},
+	}
+	if assistant != "" {
+		events = append(events, sessions.AppendEventInput{
+			Type:    sessions.EventMessage,
+			Payload: map[string]any{"role": "assistant", "content": assistant},
+		})
+	}
+	_, err := a.deps.Store.AppendEvents(sess.id, events)
 	return err
 }
 
-func messageEvent(role, content string, attachments sessions.MessageAttachments) sessions.AppendEventInput {
-	payload := map[string]any{"role": role, "content": content}
-	if role == "user" && (attachments.Images > 0 || attachments.Documents > 0) {
-		payload["attachments"] = attachments
-	}
-	return sessions.AppendEventInput{
-		Type:    sessions.EventMessage,
-		Payload: payload,
-	}
-}
-
-// usageEvent records one provider usage report in the same persisted shape the
-// exec runtime writes (usage.EventUsagePayload is the single writer).
-func usageEvent(u agent.Usage) sessions.AppendEventInput {
-	return sessions.AppendEventInput{
-		Type:    sessions.EventUsage,
-		Payload: usage.EventUsagePayload(u),
-	}
-}
-
-func toolCallEvent(call agent.ToolCall) sessions.AppendEventInput {
-	return sessions.AppendEventInput{
-		Type: sessions.EventToolCall,
-		Payload: map[string]any{
-			"toolCallId": call.ID,
-			"name":       call.Name,
-			"arguments":  call.Arguments,
-		},
-	}
-}
-
-func toolResultEvent(result agent.ToolResult) sessions.AppendEventInput {
-	return sessions.AppendEventInput{
-		Type: sessions.EventToolResult,
-		Payload: map[string]any{
-			"toolCallId":   result.ToolCallID,
-			"name":         result.Name,
-			"status":       result.Status,
-			"output":       result.Output,
-			"changedFiles": append([]string(nil), result.ChangedFiles...),
-		},
-	}
-}
-
-// persistedMessage is one entry of the restored transcript in stored order. It
-// is either a message (role/content) or a tool-call notification (tool), never
-// both: keeping them in ONE ordered slice is what preserves the interleaving a
-// client needs to redraw the conversation as it originally happened.
-type persistedMessage struct {
-	eventID string
-	role    string
-	content string
-	// tool is set for a replayed tool call or its result, and is already in wire
-	// shape — it comes from the same toolCallStart/toolCallResult mapping the
-	// live turn uses, so a replayed tool call renders identically to a fresh one
-	// and there is no second mapping to drift out of sync.
-	tool *ToolCallUpdate
-}
-
-func (a *Agent) loadHistory(sessionID string, requireHistoryLog bool) ([]turnRecord, []persistedMessage, error, error) {
+func (a *Agent) loadHistory(sessionID string) ([]turnRecord, error) {
 	if a.deps.Store == nil {
-		return nil, nil, nil, nil
+		return nil, nil
 	}
-	// THE EFFECTIVE CONVERSATION, NOT THE RAW LOG. A compacted session keeps its
-	// original prefix on disk alongside an EventCompaction that names the events
-	// it replaced and carries their durable summary. ReadEvents hands back both,
-	// so restoring from it replayed superseded turns AND dropped the summary that
-	// replaced them — resume then seeded the next turn with context the
-	// conversation had already moved past, and load visibly resurrected
-	// transcript entries the user had seen compacted away.
-	//
-	// ReadRehydratedEvents is the projection the TUI and exec paths already use
-	// (internal/tui/session.go, internal/sessions/exec_session.go), so all three
-	// now agree on what the conversation IS. Switching readers alone is not
-	// enough: rehydration substitutes the compaction event in place of the events
-	// it replaced, so a loop that skips everything but EventMessage would drop the
-	// summary exactly as before. It is projected below. Reported by @jatmn.
-	//
-	// The session was picked from its metadata a moment ago. Make sure it is
-	// still there, and held, before restoring it: see sessions.HoldToContinue.
-	if err := a.deps.Store.HoldToContinue(sessionID); err != nil {
-		return nil, nil, nil, err
-	}
-	events, eventLogPresent, err := a.deps.Store.ReadRehydratedEventsWithPresence(sessionID)
-	var rehydrateWarning error
+	events, err := a.deps.Store.ReadEvents(sessionID)
 	if err != nil {
-		if errors.Is(err, sessions.ErrPruning) {
-			// Not a rehydration failure: the raw read would continue the session
-			// without holding it while zero sessions prune may be removing it.
-			return nil, nil, nil, err
-		}
-		rehydrateWarning = err
-		events, eventLogPresent, err = a.deps.Store.ReadEventsWithPresence(sessionID)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-	}
-	if requireHistoryLog && !eventLogPresent {
-		return nil, nil, nil, fmt.Errorf("zero session %s event log is missing", sessionID)
+		return nil, err
 	}
 	var records []turnRecord
-	var messages []persistedMessage
-	activeToolCalls := make(map[string]string)
 	var pendingUser string
 	havePending := false
 	for _, e := range events {
-		if e.Type == sessions.EventCompaction {
-			// The summary stands in for the turns it replaced, so it enters the
-			// history as an assistant message: it is prior context the next turn
-			// must see, and the wire has no separate role for it.
-			raw, marshalErr := json.Marshal(e.Payload)
-			if marshalErr != nil {
-				continue
-			}
-			var payload struct {
-				Summary string `json:"summary"`
-			}
-			if json.Unmarshal(raw, &payload) != nil || strings.TrimSpace(payload.Summary) == "" {
-				continue
-			}
-			messages = append(messages, persistedMessage{
-				eventID: persistedMessageIdentity(sessionID, e),
-				role:    "assistant",
-				content: payload.Summary,
-			})
-			records = append(records, turnRecord{user: pendingUser, assistant: payload.Summary})
-			pendingUser = ""
-			havePending = false
-			continue
-		}
-		// TOOL ACTIVITY IS PART OF THE TRANSCRIPT, NOT DECORATION. A restored
-		// conversation that shows only the prose reads as if the agent asserted
-		// its edits and command output from nowhere: the user sees "I updated
-		// scope.go" with no record that any tool ran. These are collected for
-		// replay only. They deliberately do NOT enter turnRecord, so the prompt
-		// context a resumed turn receives stays byte-identical to what it was —
-		// load and resume continue to consume the SAME effective history, and
-		// only the wire rendering differs. Reported by @jatmn.
-		if e.Type == sessions.EventToolCall || e.Type == sessions.EventToolResult {
-			if upd := replayToolUpdate(e); upd != nil {
-				rawID := upd.ToolCallID
-				if e.Type == sessions.EventToolResult {
-					replayID, ok := activeToolCalls[rawID]
-					if !ok {
-						continue
-					}
-					upd.ToolCallID = replayID
-					delete(activeToolCalls, rawID)
-				} else {
-					replayID := replayToolCallID(persistedMessageIdentity(sessionID, e))
-					activeToolCalls[rawID] = replayID
-					upd.ToolCallID = replayID
-				}
-				messages = append(messages, persistedMessage{
-					eventID: persistedMessageIdentity(sessionID, e),
-					tool:    upd,
-				})
-			}
-			continue
-		}
 		if e.Type != sessions.EventMessage {
 			continue
 		}
@@ -1099,24 +633,20 @@ func (a *Agent) loadHistory(sessionID string, requireHistoryLog bool) ([]turnRec
 			continue
 		}
 		var msg struct {
-			Role        string                      `json:"role"`
-			Content     string                      `json:"content"`
-			Attachments sessions.MessageAttachments `json:"attachments"`
+			Role    string `json:"role"`
+			Content string `json:"content"`
 		}
 		if json.Unmarshal(raw, &msg) != nil {
 			continue
 		}
 		switch msg.Role {
 		case "user":
-			msg.Content = msg.Attachments.WithContent(msg.Content)
-			messages = append(messages, persistedMessage{eventID: persistedMessageIdentity(sessionID, e), role: msg.Role, content: msg.Content})
 			if havePending {
 				records = append(records, turnRecord{user: pendingUser})
 			}
 			pendingUser = msg.Content
 			havePending = true
 		case "assistant":
-			messages = append(messages, persistedMessage{eventID: persistedMessageIdentity(sessionID, e), role: msg.Role, content: msg.Content})
 			records = append(records, turnRecord{user: pendingUser, assistant: msg.Content})
 			pendingUser = ""
 			havePending = false
@@ -1125,89 +655,10 @@ func (a *Agent) loadHistory(sessionID string, requireHistoryLog bool) ([]turnRec
 	if havePending {
 		records = append(records, turnRecord{user: pendingUser})
 	}
-	return records, messages, rehydrateWarning, nil
+	return records, nil
 }
 
-// replayToolUpdate rebuilds the ACP notification for one stored tool event.
-//
-// The stored toolCallId is returned here as a correlation key. loadHistory maps
-// each call occurrence to a stable session-wide replay identity and applies that
-// identity to its result. Older records wrote the field as "id", so both
-// spellings are accepted — the TUI projection already does the same
-// (internal/tui/session.go).
-//
-// A record that carries no usable id is skipped rather than replayed under a
-// synthesized one: an unpairable update is worse than a missing row.
-func replayToolUpdate(event sessions.Event) *ToolCallUpdate {
-	raw, err := json.Marshal(event.Payload)
-	if err != nil {
-		return nil
-	}
-	var payload struct {
-		Name         string   `json:"name"`
-		ToolCallID   string   `json:"toolCallId"`
-		ID           string   `json:"id"`
-		Arguments    string   `json:"arguments"`
-		Status       string   `json:"status"`
-		Output       string   `json:"output"`
-		ChangedFiles []string `json:"changedFiles"`
-	}
-	if json.Unmarshal(raw, &payload) != nil {
-		return nil
-	}
-	id := payload.ToolCallID
-	if id == "" {
-		id = payload.ID
-	}
-	if id == "" {
-		return nil
-	}
-	if event.Type == sessions.EventToolCall {
-		upd := toolCallStart(agent.ToolCall{ID: id, Name: payload.Name, Arguments: payload.Arguments})
-		return &upd
-	}
-	status := tools.Status(payload.Status)
-	if status == "" {
-		status = tools.StatusOK
-	}
-	upd := toolCallResult(agent.ToolResult{
-		ToolCallID:   id,
-		Name:         payload.Name,
-		Status:       status,
-		Output:       payload.Output,
-		ChangedFiles: append([]string(nil), payload.ChangedFiles...),
-	})
-	return &upd
-}
-
-func persistedMessageIdentity(sessionID string, event sessions.Event) string {
-	if event.ID != "" {
-		return event.ID
-	}
-	return fmt.Sprintf("%s:%d", sessionID, event.Sequence)
-}
-
-// replayMessageID maps ZERO's stable event identity to a standards-shaped UUID
-// without leaking or parsing the event id on the wire. The same stored message
-// receives the same opaque id across loads, which also gives clients an exact
-// chunk boundary when two adjacent persisted messages have the same role.
-func replayMessageID(eventID string) string {
-	return replayOpaqueID("message", eventID)
-}
-
-func replayToolCallID(eventID string) string {
-	return replayOpaqueID("tool-call", eventID)
-}
-
-func replayOpaqueID(kind, eventID string) string {
-	sum := sha256.Sum256([]byte("zero-acp-" + kind + ":" + eventID))
-	b := sum[:16]
-	b[6] = (b[6] & 0x0f) | 0x50
-	b[8] = (b[8] & 0x3f) | 0x80
-	return fmt.Sprintf("%x-%x-%x-%x-%x", b[:4], b[4:6], b[6:8], b[8:10], b[10:16])
-}
-
-func (a *Agent) warnPersistence(note *notifier, action string, message string, err error, notify bool) {
+func (a *Agent) warnPersistence(note *notifier, action string, message string, err error) {
 	if err == nil {
 		return
 	}
@@ -1216,7 +667,7 @@ func (a *Agent) warnPersistence(note *notifier, action string, message string, e
 		sessionID = note.sessionID
 	}
 	log.Printf("zero acp: failed to %s for session %s: %v", action, sessionID, err)
-	if note != nil && notify {
+	if note != nil {
 		note.text("\n\n[zero warning] " + message + "\n")
 	}
 }
@@ -1263,35 +714,18 @@ func promptImages(blocks []ContentBlock) []zeroruntime.ImageBlock {
 
 // registerSession publishes a session under the agent's lock. If one is already
 // registered for id (e.g. a re-load of an in-flight session) the existing live
-// session is returned rather than orphaning its turn or resetting its mode/model.
-// The bool reports that case so persisted activation can re-read and apply disk
-// history under turnMu. history is set BEFORE first publication so no concurrent
-// prompt can read a half-initialized session. mode is the session's initial
-// permission mode: auto for a new session, the restored value for load/resume.
-func (a *Agent) registerSession(id, cwd string, history []turnRecord, model string, models []SessionConfigOptionValue, restrictModels bool, readOnly bool, mode agent.PermissionMode) (*acpSession, bool) {
+// session is returned unchanged rather than orphaning its turn or resetting its
+// mode/model. history is set BEFORE publishing so no concurrent prompt can read a
+// half-initialized session.
+func (a *Agent) registerSession(id, cwd string, history []turnRecord, model string, models []SessionConfigOptionValue, restrictModels bool) *acpSession {
 	a.mu.Lock()
 	defer a.mu.Unlock()
 	if existing := a.sessions[id]; existing != nil {
-		return existing, true
+		return existing
 	}
-	sess := &acpSession{id: id, cwd: cwd, mode: mode, model: model, models: models, restrictModels: restrictModels, history: history, readOnly: readOnly}
+	sess := &acpSession{id: id, cwd: cwd, mode: agent.PermissionModeAuto, model: model, models: models, restrictModels: restrictModels, history: history}
 	a.sessions[id] = sess
-	return sess, false
-}
-
-// refreshSessionHistory is the activation apply boundary for an already-live
-// session. The history is read while prompts are excluded, then applied to the
-// same object the prompt path uses. Re-reading here avoids overwriting a turn
-// that committed between activatePersistedSession's pre-publication read and
-// discovering that another activation had already registered the session.
-func (a *Agent) refreshSessionHistory(sess *acpSession, requireHistoryLog bool) ([]turnRecord, []persistedMessage, error, error) {
-	sess.turnMu.Lock()
-	defer sess.turnMu.Unlock()
-	history, messages, warning, err := a.loadHistory(sess.id, requireHistoryLog)
-	if err == nil {
-		sess.setHistory(history)
-	}
-	return history, messages, warning, err
+	return sess
 }
 
 func (a *Agent) session(id string) *acpSession {
@@ -1374,77 +808,8 @@ func (s *acpSession) appendHistory(rec turnRecord) {
 	s.mu.Unlock()
 }
 
-func (s *acpSession) setHistory(history []turnRecord) {
-	s.mu.Lock()
-	s.history = append([]turnRecord(nil), history...)
-	s.mu.Unlock()
-}
-
 func (s *acpSession) snapshotHistory() []turnRecord {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	return append([]turnRecord(nil), s.history...)
 }
-
-// sameWorkspace reports whether two resolved roots name the same directory.
-//
-// STRING EQUALITY IS NOT DIRECTORY IDENTITY. ResolveWorkspaceRoot is abs plus
-// filepath.Clean plus a stat: it does not fold case and does not resolve
-// junctions, so one directory reached by two spellings produces two different
-// roots. A session persisted from the TUI was then unresumable from an editor
-// holding a different spelling of the same project folder, and session/list
-// filtered by the other spelling returned nothing — not a failed resume but an
-// invisible one, on exactly the case this feature exists for.
-//
-// filepath.EvalSymlinks is NOT the fix on Windows: it normalises a drive letter
-// but returns a junction path unchanged, so the alias survives it. Junctions need
-// no privilege, so this is ordinary rather than exotic. os.SameFile compares the
-// filesystem's own identity for the two directories, which is the question being
-// asked.
-//
-// The string comparison stays as the fast path, and a stat failure falls back to
-// it rather than widening the match — this gate refuses access to another
-// workspace's files and configuration, so an unanswerable comparison denies.
-func sameWorkspace(left, right string) bool {
-	if left == right {
-		return true
-	}
-	leftInfo, err := os.Stat(left)
-	if err != nil {
-		return false
-	}
-	rightInfo, err := os.Stat(right)
-	if err != nil {
-		return false
-	}
-	return os.SameFile(leftInfo, rightInfo)
-}
-
-func (a *Agent) modelSupportsVision(ctx context.Context, profile config.ProviderProfile, modelID string) bool {
-	trimmed := strings.TrimSpace(modelID)
-	if trimmed == "" {
-		return false
-	}
-	if a.deps.DiscoverModels != nil {
-		if discovered, err := a.deps.DiscoverModels(ctx, profile); err == nil {
-			for _, dm := range discovered {
-				if strings.EqualFold(strings.TrimSpace(dm.ID), trimmed) {
-					if len(dm.InputModalities) > 0 {
-						for _, mod := range dm.InputModalities {
-							if strings.EqualFold(strings.TrimSpace(mod), "image") {
-								return true
-							}
-						}
-						return false
-					}
-					break
-				}
-			}
-		}
-	}
-	reg, _ := modelregistry.DefaultRegistry()
-	if entry, known := reg.Resolve(trimmed); known {
-		return entry.Supports(modelregistry.ModelCapabilityVision)
-	}
-	return modelregistry.SupportsVision(reg, trimmed)
-}

internal/acp/desktopinterop_test.go

@@ -15,7 +15,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/agent"
 )
 
 // ---- an offered option is an acceptable answer ----

internal/acp/image_history_test.go

@@ -1,181 +0,0 @@
-package acp
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/providermodeldiscovery"
-	"github.com/Twigpine/zero/internal/sessions"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-func TestACPImageAttachmentHistory(t *testing.T) {
-	for _, tc := range []struct {
-		name          string
-		text          string
-		images        int
-		withoutVision bool
-		want          string
-	}{
-		{name: "image only", images: 1, want: "[1 image]"},
-		{name: "text and images", text: "compare these", images: 2, want: "compare these [2 images]"},
-		{name: "ignored by model", images: 1, withoutVision: true, want: ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			deps := testDeps(t)
-			deps.DiscoverModels = func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error) {
-				modalities := []string{"text", "image"}
-				if tc.withoutVision {
-					modalities = []string{"text"}
-				}
-				return []providermodeldiscovery.Model{{ID: "fake-model", InputModalities: modalities}}, nil
-			}
-			type observedTurn struct {
-				prompt string
-				images int
-			}
-			turns := make(chan observedTurn, 8)
-			deps.RunAgent = func(_ context.Context, prompt string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-				turns <- observedTurn{prompt: prompt, images: len(opts.Images)}
-				return agent.Result{FinalAnswer: "received"}, nil
-			}
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			defer cancel()
-			workspace := t.TempDir()
-			h := newHarness(t, deps)
-			defer h.stop()
-			var created NewSessionResult
-			if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: workspace}, &created); err != nil {
-				t.Fatal(err)
-			}
-			const imageData = "image-history-bytes-not-for-storage"
-			encoded := base64.StdEncoding.EncodeToString([]byte(imageData))
-			var blocks []ContentBlock
-			if tc.text != "" {
-				blocks = append(blocks, TextBlock(tc.text))
-			}
-			for range tc.images {
-				blocks = append(blocks, ImageBlock(encoded, "image/png"))
-			}
-			if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: blocks}, &PromptResult{}); err != nil {
-				t.Fatal(err)
-			}
-			live := <-turns
-			wantLiveImages := tc.images
-			if tc.withoutVision {
-				wantLiveImages = 0
-			}
-			if live.images != wantLiveImages {
-				t.Fatalf("live images = %d, want %d", live.images, wantLiveImages)
-			}
-			events, err := deps.Store.ReadEvents(created.SessionID)
-			if err != nil || len(events) < 2 {
-				t.Fatalf("read completed turn: events=%+v err=%v", events, err)
-			}
-			var user struct {
-				Role        string `json:"role"`
-				Content     string `json:"content"`
-				Attachments struct {
-					Images int `json:"images"`
-				} `json:"attachments"`
-			}
-			if err := json.Unmarshal(events[0].Payload, &user); err != nil {
-				t.Fatal(err)
-			}
-			if user.Role != "user" || user.Content != tc.text || user.Attachments.Images != wantLiveImages {
-				t.Errorf("stored user event = %s, want original text and attachments.images=%d", events[0].Payload, wantLiveImages)
-			}
-			for _, event := range events {
-				if bytes.Contains(event.Payload, []byte(encoded)) || bytes.Contains(event.Payload, []byte(imageData)) {
-					t.Errorf("image data leaked into session event: %s", event.Payload)
-				}
-			}
-			followUp := func(t *testing.T, client *clientHarness) {
-				t.Helper()
-				if err := client.client.Call(ctx, MethodSessionPrompt, PromptParams{
-					SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("what did I send?")},
-				}, &PromptResult{}); err != nil {
-					t.Fatal(err)
-				}
-				got := <-turns
-				if want := "User: " + tc.want + "\n"; !strings.Contains(got.prompt, want) {
-					t.Errorf("seeded prompt missing user history %q: %q", want, got.prompt)
-				}
-				if got.images != 0 {
-					t.Errorf("historical images reattached: %d", got.images)
-				}
-			}
-			followUp(t, h)
-			h.stop()
-			// Fresh agents and stores reproduce a process restart, with no shared
-			// in-memory history to hide a missing attachment in the event log.
-			for _, method := range []string{MethodSessionLoad, MethodSessionResume} {
-				t.Run(method, func(t *testing.T) {
-					restoredDeps := deps
-					restoredDeps.Store = sessions.NewStore(sessions.StoreOptions{RootDir: deps.Store.RootDir})
-					loader := newHarness(t, restoredDeps)
-					defer loader.stop()
-					if err := loader.client.Call(ctx, method, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace}, &LoadSessionResult{}); err != nil {
-						t.Fatal(err)
-					}
-					if method == MethodSessionLoad {
-						select {
-						case update := <-loader.notifications:
-							if update.SessionUpdate != UpdateUserMessageChunk || update.Content.Text != tc.want {
-								t.Errorf("replayed user = %+v, want %q", update, tc.want)
-							}
-						case <-ctx.Done():
-							t.Fatal("user turn was not replayed")
-						}
-					} else {
-						select {
-						case update := <-loader.notifications:
-							t.Errorf("resume replayed transcript: %+v", update)
-						default:
-						}
-					}
-					followUp(t, loader)
-				})
-			}
-		})
-	}
-}
-
-func TestACPAttachmentHistoryReadsExistingSessionMessages(t *testing.T) {
-	deps := testDeps(t)
-	meta, err := deps.Store.Create(sessions.CreateInput{SessionID: "attachment-compatibility", Cwd: t.TempDir()})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for i, payload := range []string{
-		`{"role":"user","content":"old text"}`,
-		`{"role":"user","content":"","attachments":{"images":1,"documents":2}}`,
-		`{"role":"user","content":"still text","attachments":{"images":-1,"documents":1.5}}`,
-		`{"role":"assistant","content":"answer","attachments":{"images":1}}`,
-	} {
-		if _, err := deps.Store.AppendEvent(meta.SessionID, sessions.AppendEventInput{Type: sessions.EventMessage, Payload: json.RawMessage(payload)}); err != nil {
-			t.Fatalf("append message %d: %v", i, err)
-		}
-	}
-	a := &Agent{deps: deps}
-	_, messages, _, err := a.loadHistory(meta.SessionID, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := []string{"old text", "[1 image] [2 documents]", "still text", "answer"}
-	if len(messages) != len(want) {
-		t.Fatalf("messages = %+v", messages)
-	}
-	for i, text := range want {
-		if messages[i].content != text {
-			t.Errorf("message %d = %q, want %q", i, messages[i].content, text)
-		}
-	}
-}

internal/acp/jsonrpc.go

@@ -89,13 +89,6 @@ type Conn struct {
 
 	handlers  map[string]HandlerFunc
 	notifiers map[string]NotifyFunc
-	// Notifications for one method are an ordered stream: session/update in
-	// particular is stateful, so dispatching every frame in an unrelated
-	// goroutine can make a later chunk overtake an earlier one. Different
-	// methods retain independent tails, keeping session/cancel responsive while
-	// an update handler is busy.
-	notifyMu    sync.Mutex
-	notifyTails map[string]chan struct{}
 
 	mu      sync.Mutex
 	nextID  int64
@@ -113,12 +106,11 @@ type Conn struct {
 // lifetime.
 func NewConn(r io.Reader, w io.Writer) *Conn {
 	return &Conn{
-		rawReader:   r,
-		w:           w,
-		handlers:    make(map[string]HandlerFunc),
-		notifiers:   make(map[string]NotifyFunc),
-		notifyTails: make(map[string]chan struct{}),
-		pending:     make(map[int64]chan rpcMessage),
+		rawReader: r,
+		w:         w,
+		handlers:  make(map[string]HandlerFunc),
+		notifiers: make(map[string]NotifyFunc),
+		pending:   make(map[int64]chan rpcMessage),
 	}
 }
 
@@ -311,7 +303,11 @@ func (c *Conn) handleLine(ctx context.Context, line []byte) {
 		}(msg)
 	case msg.isNotify():
 		if fn := c.notifiers[msg.Method]; fn != nil {
-			c.dispatchNotification(ctx, msg, fn)
+			c.wg.Add(1)
+			go func(m rpcMessage) {
+				defer c.wg.Done()
+				fn(ctx, m.Params)
+			}(msg)
 		}
 	default:
 		// Malformed frame; reply only if we can identify a request id.
@@ -321,35 +317,6 @@ func (c *Conn) handleLine(ctx context.Context, line []byte) {
 	}
 }
 
-// dispatchNotification preserves wire order within one method without making
-// unrelated notification methods wait for each other. The read loop installs
-// each tail before starting its goroutine, so goroutine scheduling cannot
-// reorder the chain it observes.
-func (c *Conn) dispatchNotification(ctx context.Context, msg rpcMessage, fn NotifyFunc) {
-	c.notifyMu.Lock()
-	previous := c.notifyTails[msg.Method]
-	done := make(chan struct{})
-	c.notifyTails[msg.Method] = done
-	c.notifyMu.Unlock()
-
-	c.wg.Add(1)
-	go func() {
-		defer c.wg.Done()
-		defer func() {
-			close(done)
-			c.notifyMu.Lock()
-			if c.notifyTails[msg.Method] == done {
-				delete(c.notifyTails, msg.Method)
-			}
-			c.notifyMu.Unlock()
-		}()
-		if previous != nil {
-			<-previous
-		}
-		fn(ctx, msg.Params)
-	}()
-}
-
 func (c *Conn) dispatchRequest(ctx context.Context, msg rpcMessage) {
 	fn := c.handlers[msg.Method]
 	if fn == nil {

internal/acp/jsonrpc_test.go

@@ -360,86 +360,6 @@ func TestConnNotification(t *testing.T) {
 	}
 }
 
-func TestConnNotificationsForOneMethodStayInWireOrder(t *testing.T) {
-	a, b, stop := connPair(t)
-	defer stop()
-
-	firstStarted := make(chan struct{})
-	releaseFirst := make(chan struct{})
-	delivered := make(chan int, 2)
-	b.HandleNotify("update", func(_ context.Context, params json.RawMessage) {
-		var in struct{ Sequence int }
-		_ = json.Unmarshal(params, &in)
-		if in.Sequence == 1 {
-			close(firstStarted)
-			<-releaseFirst
-		}
-		delivered <- in.Sequence
-	})
-
-	if err := a.Notify("update", map[string]int{"Sequence": 1}); err != nil {
-		t.Fatalf("first notify: %v", err)
-	}
-	select {
-	case <-firstStarted:
-	case <-time.After(2 * time.Second):
-		t.Fatal("first notification did not start")
-	}
-	if err := a.Notify("update", map[string]int{"Sequence": 2}); err != nil {
-		t.Fatalf("second notify: %v", err)
-	}
-	select {
-	case sequence := <-delivered:
-		t.Fatalf("notification %d overtook the blocked first notification", sequence)
-	case <-time.After(25 * time.Millisecond):
-	}
-	close(releaseFirst)
-	for want := 1; want <= 2; want++ {
-		select {
-		case got := <-delivered:
-			if got != want {
-				t.Fatalf("notification order = ...,%d; want %d", got, want)
-			}
-		case <-time.After(2 * time.Second):
-			t.Fatalf("notification %d was not delivered", want)
-		}
-	}
-}
-
-func TestConnDifferentNotificationMethodsStayConcurrent(t *testing.T) {
-	a, b, stop := connPair(t)
-	defer stop()
-
-	updateStarted := make(chan struct{})
-	releaseUpdate := make(chan struct{})
-	cancelDelivered := make(chan struct{})
-	b.HandleNotify("update", func(context.Context, json.RawMessage) {
-		close(updateStarted)
-		<-releaseUpdate
-	})
-	b.HandleNotify("cancel", func(context.Context, json.RawMessage) {
-		close(cancelDelivered)
-	})
-
-	if err := a.Notify("update", nil); err != nil {
-		t.Fatalf("update notify: %v", err)
-	}
-	select {
-	case <-updateStarted:
-	case <-time.After(2 * time.Second):
-		t.Fatal("update notification did not start")
-	}
-	if err := a.Notify("cancel", nil); err != nil {
-		t.Fatalf("cancel notify: %v", err)
-	}
-	select {
-	case <-cancelDelivered:
-	case <-time.After(2 * time.Second):
-		t.Fatal("different notification method was blocked behind update")
-	}
-	close(releaseUpdate)
-}
-
 func TestConnMethodNotFound(t *testing.T) {
 	a, _, stop := connPair(t)
 	defer stop()

internal/acp/mode_persistence_test.go

@@ -1,213 +0,0 @@
-package acp
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/sessions"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-// captureAgentOptions makes every turn record the agent.Options it was built
-// with, so a test can assert the permission mode the next prompt actually runs
-// with rather than only what the wire reports.
-func captureAgentOptions(deps *Deps) *agent.Options {
-	var captured agent.Options
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		captured = opts
-		return agent.Result{FinalAnswer: "ok"}, nil
-	}
-	return &captured
-}
-
-func newHarnessT(t *testing.T, deps Deps) *clientHarness {
-	t.Helper()
-	h := newHarness(t, deps)
-	t.Cleanup(h.stop)
-	return h
-}
-
-func mustCall(t *testing.T, ctx context.Context, h *clientHarness, method string, params any, result any) {
-	t.Helper()
-	if err := h.client.Call(ctx, method, params, result); err != nil {
-		t.Fatalf("%s: %v", method, err)
-	}
-}
-
-// restartHarness replaces the live agent with a fresh one over the same store,
-// which is the process restart the persisted mode has to survive.
-func restartHarness(t *testing.T, h *clientHarness, deps Deps) *clientHarness {
-	t.Helper()
-	h.stop()
-	return newHarnessT(t, deps)
-}
-
-func modeOptionValue(t *testing.T, options []SessionConfigOption) string {
-	t.Helper()
-	for _, option := range options {
-		if option.ID == configIDMode {
-			return option.CurrentValue
-		}
-	}
-	t.Fatalf("no mode config option in %+v", options)
-	return ""
-}
-
-func assertModeReported(t *testing.T, result LoadSessionResult, want agent.PermissionMode) {
-	t.Helper()
-	if result.Modes == nil || result.Modes.CurrentModeID != string(want) {
-		t.Fatalf("modes = %+v, want currentModeId %q", result.Modes, want)
-	}
-	if got := modeOptionValue(t, result.ConfigOptions); got != string(want) {
-		t.Fatalf("mode config option = %q, want %q", got, want)
-	}
-}
-
-func TestACPModePersistsAcrossRestartLoadAndResume(t *testing.T) {
-	deps := testDeps(t)
-	captured := captureAgentOptions(&deps)
-	h := newHarnessT(t, deps)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	workspace := t.TempDir()
-	var created NewSessionResult
-	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
-
-	mustCall(t, ctx, h, MethodSessionSetMode, SetSessionModeParams{SessionID: created.SessionID, ModeID: string(agent.PermissionModePlan)}, &SetSessionModeResult{})
-	meta, err := deps.Store.Get(created.SessionID)
-	if err != nil || meta == nil {
-		t.Fatalf("store.Get: %v", err)
-	}
-	if meta.PermissionMode != string(agent.PermissionModePlan) {
-		t.Fatalf("stored mode = %q, want plan", meta.PermissionMode)
-	}
-
-	// LOAD after a restart: the response must report the stored mode, and the
-	// next prompt must actually run with it.
-	h = restartHarness(t, h, deps)
-	var loaded LoadSessionResult
-	mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
-	assertModeReported(t, loaded, agent.PermissionModePlan)
-	mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("continue")}}, &PromptResult{})
-	if captured.PermissionMode != agent.PermissionModePlan {
-		t.Fatalf("after load, agent.Options.PermissionMode = %q, want plan", captured.PermissionMode)
-	}
-
-	// RESUME after another restart reports the same.
-	h = restartHarness(t, h, deps)
-	var resumed ResumeSessionResult
-	mustCall(t, ctx, h, MethodSessionResume, ResumeSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &resumed)
-	assertModeReported(t, resumed, agent.PermissionModePlan)
-}
-
-func TestACPModePersistsViaSetConfigOption(t *testing.T) {
-	deps := testDeps(t)
-	h := newHarnessT(t, deps)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	workspace := t.TempDir()
-	var created NewSessionResult
-	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
-
-	var configured SetSessionConfigOptionResult
-	mustCall(t, ctx, h, MethodSessionSetConfigOption, SetSessionConfigOptionParams{
-		SessionID: created.SessionID, ConfigID: configIDMode, Value: string(agent.PermissionModeAsk),
-	}, &configured)
-	if got := modeOptionValue(t, configured.ConfigOptions); got != string(agent.PermissionModeAsk) {
-		t.Fatalf("configured mode = %q, want ask", got)
-	}
-	meta, err := deps.Store.Get(created.SessionID)
-	if err != nil || meta == nil {
-		t.Fatalf("store.Get: %v", err)
-	}
-	if meta.PermissionMode != string(agent.PermissionModeAsk) {
-		t.Fatalf("stored mode = %q, want ask", meta.PermissionMode)
-	}
-
-	h = restartHarness(t, h, deps)
-	var loaded LoadSessionResult
-	mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
-	assertModeReported(t, loaded, agent.PermissionModeAsk)
-}
-
-// TestACPModeRestoreFallback pins the restore boundary: no stored value keeps
-// the historical auto default, and a stored value outside the three offered
-// modes must never come back weaker than ask (and never unsafe).
-func TestACPModeRestoreFallback(t *testing.T) {
-	cases := []struct {
-		name string
-		seed string // "" means metadata written before modes were persisted
-		want agent.PermissionMode
-	}{
-		{name: "unset keeps auto", want: agent.PermissionModeAuto},
-		{name: "ask preserved", seed: string(agent.PermissionModeAsk), want: agent.PermissionModeAsk},
-		{name: "unknown falls back to ask", seed: "bogus", want: agent.PermissionModeAsk},
-		{name: "unsafe never restored", seed: string(agent.PermissionModeUnsafe), want: agent.PermissionModeAsk},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			deps := testDeps(t)
-			captured := captureAgentOptions(&deps)
-			h := newHarnessT(t, deps)
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			defer cancel()
-
-			workspace := t.TempDir()
-			var created NewSessionResult
-			mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
-			if tc.seed != "" {
-				if _, err := deps.Store.UpdateMode(created.SessionID, tc.seed); err != nil {
-					t.Fatalf("seed mode: %v", err)
-				}
-			}
-
-			h = restartHarness(t, h, deps)
-			var loaded LoadSessionResult
-			mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
-			assertModeReported(t, loaded, tc.want)
-
-			mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("go")}}, &PromptResult{})
-			if captured.PermissionMode != tc.want {
-				t.Fatalf("next prompt PermissionMode = %q, want %q", captured.PermissionMode, tc.want)
-			}
-		})
-	}
-}
-
-// TestACPSetModeWriteFailureKeepsLiveMode pins the store-first order: when the
-// mode cannot be saved the request fails and the live session is untouched.
-func TestACPSetModeWriteFailureKeepsLiveMode(t *testing.T) {
-	deps := testDeps(t)
-	captured := captureAgentOptions(&deps)
-	h := newHarnessT(t, deps)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	var created NewSessionResult
-	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: t.TempDir(), McpServers: []McpServer{}}, &created)
-
-	// Remove the metadata file so UpdateMode fails but the live session stays
-	// promptable (turn persistence only warns when the file is gone).
-	metadataPath := filepath.Join(deps.Store.RootDir, created.SessionID, sessions.MetadataFile)
-	if err := os.Remove(metadataPath); err != nil {
-		t.Fatalf("remove metadata: %v", err)
-	}
-
-	err := h.client.Call(ctx, MethodSessionSetMode, SetSessionModeParams{SessionID: created.SessionID, ModeID: string(agent.PermissionModePlan)}, &SetSessionModeResult{})
-	var rpcErr *rpcError
-	if !errors.As(err, &rpcErr) || rpcErr.Code != codeInternalError {
-		t.Fatalf("set_mode with an unsavable mode = %v, want internal error", err)
-	}
-
-	mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("still auto")}}, &PromptResult{})
-	if captured.PermissionMode != agent.PermissionModeAuto {
-		t.Fatalf("failed set_mode changed the live mode: PermissionMode = %q, want auto", captured.PermissionMode)
-	}
-}

internal/acp/permission.go

@@ -3,7 +3,7 @@ package acp
 import (
 	"encoding/json"
 
-	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/agent"
 )
 
 // permission.go maps ZERO's permission prompt model onto ACP's

internal/acp/permission_escalation_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/agent"
 )
 
 func escalationRequest(escalates bool) agent.PermissionRequest {

internal/acp/permission_test.go

@@ -3,7 +3,7 @@ package acp
 import (
 	"testing"
 
-	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/agent"
 )
 
 func TestBuildPermissionOptions(t *testing.T) {

internal/acp/translate.go

@@ -8,8 +8,8 @@ import (
 	"unicode"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 // translate.go maps ZERO's agent events onto ACP session/update payloads. The
@@ -20,14 +20,6 @@ func agentMessageChunk(delta string) ContentChunk {
 	return ContentChunk{SessionUpdate: UpdateAgentMessageChunk, Content: TextBlock(delta)}
 }
 
-func replayMessageChunk(role, messageID, text string) ContentChunk {
-	update := UpdateAgentMessageChunk
-	if role == "user" {
-		update = UpdateUserMessageChunk
-	}
-	return ContentChunk{SessionUpdate: update, MessageID: messageID, Content: TextBlock(text)}
-}
-
 func agentThoughtChunk(delta string) ContentChunk {
 	return ContentChunk{SessionUpdate: UpdateAgentThoughtChunk, Content: TextBlock(delta)}
 }
@@ -83,7 +75,7 @@ func browserToolDetails(name string) (*BrowserToolDetails, bool) {
 	}
 }
 
-const zeroBrowserMetaKey = "github.com/Twigpine/zero/browser"
+const zeroBrowserMetaKey = "github.com/Gitlawb/zero/browser"
 
 // attachBrowserToolDetails stores ZERO's browser descriptor in ACP's reserved
 // extension channel. Keeping this in one helper prevents start, result, and
@@ -139,7 +131,7 @@ func browserToolTitle(command, rawArgs string) string {
 }
 
 // browserTitleTextSafe validates text after URL parsing has decoded escaped
-// UTF-8 in the host. Valid UTF-8 alone is not presentation-safe: whitespace, control,
+// UTF-8 in the host. Valid UTF-8 alone is not presentation-safe: control,
 // format/bidi, and line/paragraph separator runes can reorder or split the
 // permission label shown to a user. The execution URL remains unchanged.
 func browserTitleTextSafe(text string) bool {
@@ -147,7 +139,7 @@ func browserTitleTextSafe(text string) bool {
 		return false
 	}
 	for _, r := range text {
-		if unicode.IsSpace(r) || unicode.IsControl(r) || unicode.Is(unicode.Cf, r) || unicode.Is(unicode.Zl, r) || unicode.Is(unicode.Zp, r) {
+		if unicode.IsControl(r) || unicode.Is(unicode.Cf, r) || unicode.Is(unicode.Zl, r) || unicode.Is(unicode.Zp, r) {
 			return false
 		}
 	}

internal/acp/translate_test.go

@@ -8,8 +8,8 @@ import (
 	"unicode"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 func browserDescriptor(t *testing.T, update ToolCallUpdate) BrowserToolDetails {
@@ -224,9 +224,6 @@ func TestBrowserPermissionTitlesMirrorSafeToolArguments(t *testing.T) {
 
 func TestBrowserOpenTitlesRejectDecodedUnicodePresentationControls(t *testing.T) {
 	for _, rawURL := range []string{
-		"https://safe.example%C2%A0evil.test/path",
-		"https://safe.example%E2%80%83evil.test/path",
-		"https://safe.example%E3%80%80evil.test/path",
 		"https://safe.example%E2%80%AEevil.test/path",
 		"https://safe.example%E2%81%A6evil.test/path",
 		"https://safe.example%C2%85evil.test/path",
@@ -246,9 +243,6 @@ func TestBrowserOpenTitlesRejectDecodedUnicodePresentationControls(t *testing.T)
 			if err != nil {
 				t.Fatal(err)
 			}
-			if title := browserToolTitle("open", string(args)); title != "browser open" {
-				t.Errorf("unsafe origin accepted before permission translation: %q", title)
-			}
 			updates := []ToolCallUpdate{
 				toolCallStart(agent.ToolCall{ID: "start", Name: "browser_open", Arguments: string(args)}),
 				permissionToolCall(agent.PermissionRequest{ToolCallID: "permission", ToolName: "browser_open", Args: map[string]any{"url": rawURL}}),

internal/acp/types.go

@@ -12,8 +12,6 @@ const (
 	MethodAuthenticate           = "authenticate"
 	MethodSessionNew             = "session/new"
 	MethodSessionLoad            = "session/load"
-	MethodSessionList            = "session/list"
-	MethodSessionResume          = "session/resume"
 	MethodSessionPrompt          = "session/prompt"
 	MethodSessionCancel          = "session/cancel" // notification
 	MethodSessionUpdate          = "session/update" // notification (agent -> client)
@@ -64,16 +62,8 @@ type PromptCapabilities struct {
 }
 
 type AgentCapabilities struct {
-	LoadSession         bool                 `json:"loadSession"`
-	PromptCapabilities  PromptCapabilities   `json:"promptCapabilities"`
-	SessionCapabilities *SessionCapabilities `json:"sessionCapabilities,omitempty"`
-}
-
-// Empty capability objects are presence flags in ACP v1. Pointers preserve
-// the wire distinction between an advertised `{}` and an omitted capability.
-type SessionCapabilities struct {
-	List   *struct{} `json:"list,omitempty"`
-	Resume *struct{} `json:"resume,omitempty"`
+	LoadSession        bool               `json:"loadSession"`
+	PromptCapabilities PromptCapabilities `json:"promptCapabilities"`
 }
 
 type AuthMethod struct {
@@ -127,14 +117,9 @@ type McpServer struct {
 }
 
 type NewSessionParams struct {
-	Cwd        string      `json:"cwd"`
-	McpServers []McpServer `json:"mcpServers"`
-	// AdditionalDirectories is declared by the protocol and consumed nowhere in
-	// this repo yet. When it is wired up it must go through requestedWorkspace
-	// like Cwd does: these are client-supplied paths with no absoluteness rule of
-	// their own, which is the same shape as the resume-cwd hole that made
-	// {"sessionId":"known"} activate a session against this process's directory.
-	AdditionalDirectories []string `json:"additionalDirectories,omitempty"`
+	Cwd                   string      `json:"cwd"`
+	McpServers            []McpServer `json:"mcpServers"`
+	AdditionalDirectories []string    `json:"additionalDirectories,omitempty"`
 }
 
 type NewSessionResult struct {
@@ -155,39 +140,6 @@ type LoadSessionResult struct {
 	Modes         *SessionModeState     `json:"modes,omitempty"`
 }
 
-// ListSessionsParams and the following types implement ACP v1 session/list.
-// Transcript contents stay behind session/load; this method returns metadata
-// only and leaves the optional pagination cursor opaque.
-type ListSessionsParams struct {
-	Cwd    string `json:"cwd,omitempty"`
-	Cursor string `json:"cursor,omitempty"`
-}
-
-type SessionInfoMeta struct {
-	ModelID   string `json:"modelId,omitempty"`
-	CreatedAt string `json:"createdAt,omitempty"`
-}
-
-type SessionInfo struct {
-	SessionID string           `json:"sessionId"`
-	Cwd       string           `json:"cwd"`
-	Title     string           `json:"title,omitempty"`
-	UpdatedAt string           `json:"updatedAt,omitempty"`
-	Meta      *SessionInfoMeta `json:"_meta,omitempty"`
-}
-
-type ListSessionsResult struct {
-	Sessions   []SessionInfo `json:"sessions"`
-	NextCursor string        `json:"nextCursor,omitempty"`
-}
-
-// session/resume takes session/load's wire shape, so its cwd is a plain string
-// too and an omitted one decodes exactly like an empty one. Sharing the type is
-// safe only because activatePersistedSession requires an absolute cwd from the
-// request itself — nothing downstream may supply a default for either method.
-type ResumeSessionParams = LoadSessionParams
-type ResumeSessionResult = LoadSessionResult
-
 // ---- prompt turn ----
 
 type PromptParams struct {
@@ -222,7 +174,6 @@ type SessionNotification struct {
 // ContentBlock under "content"; the variant is set via SessionUpdate.
 type ContentChunk struct {
 	SessionUpdate string       `json:"sessionUpdate"`
-	MessageID     string       `json:"messageId,omitempty"`
 	Content       ContentBlock `json:"content"`
 }
 

internal/acp/usage_test.go

@@ -1,309 +0,0 @@
-package acp
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/sessions"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-// `zero exec` persists every provider usage report as a session usage event, so
-// `zero usage report --session <id>` can total a run. The ACP agent did not set
-// OnUsage, which dropped the token counts of every ACP session. A turn with two
-// provider requests (a tool round trip) must leave two usage events, in the shape
-// the usage report reads, next to the turn's messages.
-func TestACPPromptPersistsProviderUsage(t *testing.T) {
-	deps := testDeps(t)
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		if opts.OnUsage == nil {
-			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
-			return agent.Result{FinalAnswer: "done"}, nil
-		}
-		opts.OnUsage(agent.Usage{InputTokens: 1200, OutputTokens: 34})
-		opts.OnUsage(agent.Usage{InputTokens: 1300, OutputTokens: 21, CachedInputTokens: 900})
-		return agent.Result{FinalAnswer: "done"}, nil
-	}
-
-	h := newHarness(t, deps)
-	defer h.stop()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var created NewSessionResult
-	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
-		t.Fatal(err)
-	}
-	var result PromptResult
-	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("count my tokens")},
-	}, &result); err != nil {
-		t.Fatalf("session/prompt: %v", err)
-	}
-
-	events, err := deps.Store.ReadEvents(created.SessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	type usagePayload struct {
-		PromptTokens      int `json:"promptTokens"`
-		CompletionTokens  int `json:"completionTokens"`
-		TotalTokens       int `json:"totalTokens"`
-		CachedInputTokens int `json:"cachedInputTokens"`
-	}
-	var got []usagePayload
-	messages := 0
-	for _, event := range events {
-		switch event.Type {
-		case sessions.EventUsage:
-			var payload usagePayload
-			if err := json.Unmarshal(event.Payload, &payload); err != nil {
-				t.Fatalf("usage payload %s: %v", event.Payload, err)
-			}
-			assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
-			got = append(got, payload)
-		case sessions.EventMessage:
-			messages++
-		}
-	}
-	want := []usagePayload{
-		{PromptTokens: 1200, CompletionTokens: 34, TotalTokens: 1234},
-		{PromptTokens: 1300, CompletionTokens: 21, TotalTokens: 1321, CachedInputTokens: 900},
-	}
-	if len(got) != len(want) {
-		t.Fatalf("usage events = %+v, want %+v", got, want)
-	}
-	for i := range want {
-		if got[i] != want[i] {
-			t.Fatalf("usage event %d = %+v, want %+v", i, got[i], want[i])
-		}
-	}
-	if messages != 2 {
-		t.Fatalf("message events = %d, want the user and assistant messages of the turn", messages)
-	}
-}
-
-// Usage joins the turn's buffered batch, so a hard run failure that aborts the
-// turn leaves nothing durable, exactly as it does for the turn's messages.
-func TestACPHardTurnFailureDropsItsUsageWithTheTurn(t *testing.T) {
-	deps := testDeps(t)
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		if opts.OnUsage == nil {
-			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
-			return agent.Result{}, errors.New("injected hard run failure")
-		}
-		opts.OnUsage(agent.Usage{InputTokens: 500, OutputTokens: 5})
-		return agent.Result{}, errors.New("injected hard run failure")
-	}
-
-	h := newHarness(t, deps)
-	defer h.stop()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var created NewSessionResult
-	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
-		t.Fatal(err)
-	}
-	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("failing turn")},
-	}, &PromptResult{}); err == nil {
-		t.Fatal("hard RunAgent failure was reported as a successful turn")
-	}
-	events, err := deps.Store.ReadEvents(created.SessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(events) != 0 {
-		t.Fatalf("aborted turn left durable events: %+v", events)
-	}
-}
-
-// StopCancelled is a successful ACP outcome: the turn commits. Tokens the
-// provider already reported were spent, so they stay in the session log even
-// though the client cancelled. A hard error (the test above) is the path that
-// drops them.
-func TestACPCancelledTurnKeepsReportedUsage(t *testing.T) {
-	deps := testDeps(t)
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		if opts.OnUsage == nil {
-			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
-			return agent.Result{}, context.Canceled
-		}
-		opts.OnUsage(agent.Usage{InputTokens: 80, OutputTokens: 3})
-		return agent.Result{FinalAnswer: "partial"}, context.Canceled
-	}
-
-	h := newHarness(t, deps)
-	defer h.stop()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var created NewSessionResult
-	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
-		t.Fatal(err)
-	}
-	var result PromptResult
-	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("cancelled turn")},
-	}, &result); err != nil {
-		t.Fatalf("cancelled turn returned an RPC error: %v", err)
-	}
-	if result.StopReason != StopCancelled {
-		t.Fatalf("stop reason = %q, want %q", result.StopReason, StopCancelled)
-	}
-	events, err := deps.Store.ReadEvents(created.SessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	usageEvents := 0
-	for _, event := range events {
-		if event.Type != sessions.EventUsage {
-			continue
-		}
-		usageEvents++
-		assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
-		var payload struct {
-			PromptTokens     int `json:"promptTokens"`
-			CompletionTokens int `json:"completionTokens"`
-			TotalTokens      int `json:"totalTokens"`
-		}
-		if err := json.Unmarshal(event.Payload, &payload); err != nil {
-			t.Fatal(err)
-		}
-		if payload.PromptTokens != 80 || payload.CompletionTokens != 3 || payload.TotalTokens != 83 {
-			t.Fatalf("cancelled-turn usage = %+v, want 80/3/83", payload)
-		}
-	}
-	if usageEvents != 1 {
-		t.Fatalf("usage events = %d, want the one report from the cancelled turn", usageEvents)
-	}
-}
-
-// Usage events sit in the same log session/load and session/resume read, but
-// history reconstruction skips them. The wire replay stays the conversation,
-// and the next turn's prompt stays the conversation: token counts never become
-// context and never cross the ACP wire.
-func TestACPLoadAndResumeIgnoreUsageEvents(t *testing.T) {
-	const userLine = "unique-acp-user-line"
-	const answer = "unique-acp-answer"
-	deps := testDeps(t)
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		if opts.OnUsage == nil {
-			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
-			return agent.Result{FinalAnswer: answer}, nil
-		}
-		opts.OnUsage(agent.Usage{InputTokens: 1200, OutputTokens: 34})
-		return agent.Result{FinalAnswer: answer}, nil
-	}
-
-	workspace := t.TempDir()
-	h := newHarness(t, deps)
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var created NewSessionResult
-	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: workspace}, &created); err != nil {
-		t.Fatal(err)
-	}
-	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock(userLine)},
-	}, &PromptResult{}); err != nil {
-		t.Fatalf("session/prompt: %v", err)
-	}
-	h.stop()
-
-	events, err := deps.Store.ReadEvents(created.SessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	sawUsage := false
-	for _, event := range events {
-		if event.Type == sessions.EventUsage {
-			sawUsage = true
-			assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
-		}
-	}
-	if !sawUsage {
-		t.Fatal("session log has no usage event to ignore")
-	}
-
-	loader := newHarness(t, deps)
-	if err := loader.client.Call(ctx, MethodSessionLoad, LoadSessionParams{
-		SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{},
-	}, &LoadSessionResult{}); err != nil {
-		t.Fatalf("session/load: %v", err)
-	}
-	var replayed []string
-	for {
-		select {
-		case update := <-loader.notifications:
-			replayed = append(replayed, update.Content.Text)
-		case <-time.After(150 * time.Millisecond):
-			goto drained
-		}
-	}
-drained:
-	loader.stop()
-	if len(replayed) != 2 || replayed[0] != userLine || replayed[1] != answer {
-		t.Fatalf("session/load replay = %#v, want the user line and the answer only", replayed)
-	}
-	for _, text := range replayed {
-		if strings.Contains(text, "promptTokens") || strings.Contains(text, "1200") {
-			t.Fatalf("session/load replayed usage onto the wire: %q", text)
-		}
-	}
-
-	var gotPrompt string
-	deps.RunAgent = func(_ context.Context, prompt string, _ zeroruntime.Provider, _ agent.Options) (agent.Result, error) {
-		gotPrompt = prompt
-		return agent.Result{FinalAnswer: "continued"}, nil
-	}
-	resumer := newHarness(t, deps)
-	defer resumer.stop()
-	if err := resumer.client.Call(ctx, MethodSessionResume, ResumeSessionParams{
-		SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{},
-	}, &ResumeSessionResult{}); err != nil {
-		t.Fatalf("session/resume: %v", err)
-	}
-	if err := resumer.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("carry on")},
-	}, &PromptResult{}); err != nil {
-		t.Fatalf("resumed session/prompt: %v", err)
-	}
-	if !strings.Contains(gotPrompt, userLine) || !strings.Contains(gotPrompt, answer) {
-		t.Fatalf("resumed prompt = %q, want the prior conversation", gotPrompt)
-	}
-	if strings.Contains(gotPrompt, "promptTokens") || strings.Contains(gotPrompt, "1200") {
-		t.Fatalf("resumed prompt contains persisted usage: %q", gotPrompt)
-	}
-}
-
-// usagePayloadAllowedKeys is the non-escalating EventUsagePayload shape. ACP
-// has no model escalation, and the writer must not grow a prompt, tool
-// argument, or other raw field.
-var usagePayloadAllowedKeys = map[string]bool{
-	"promptTokens":      true,
-	"completionTokens":  true,
-	"totalTokens":       true,
-	"cachedInputTokens": true,
-	"cacheWriteTokens":  true,
-	"reasoningTokens":   true,
-}
-
-func assertUsagePayloadIsTokenCountsOnly(t *testing.T, payload json.RawMessage) {
-	t.Helper()
-	var raw map[string]json.RawMessage
-	if err := json.Unmarshal(payload, &raw); err != nil {
-		t.Fatalf("usage payload %s: %v", payload, err)
-	}
-	if len(raw) == 0 {
-		t.Fatalf("usage payload is empty: %s", payload)
-	}
-	for key := range raw {
-		if !usagePayloadAllowedKeys[key] {
-			t.Fatalf("usage payload key %q is not a token count: %s", key, payload)
-		}
-	}
-}

internal/agent/acceptance_gate_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func enabledSelfCorrector(t *testing.T) *SelfCorrector {

internal/agent/additional_permissions_validation_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 type normalizationRecordingShellTool struct {

internal/agent/ask_user_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // providerCallingAskUserThenAnswer returns a mock provider whose first turn calls

internal/agent/async_diagnostics_test.go

@@ -8,9 +8,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Twigpine/zero/internal/testutil"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestAsyncDiagnosticsNilCollectorNoOps(t *testing.T) {
@@ -112,11 +111,7 @@ func TestAsyncDiagnosticsReEditReplacesResult(t *testing.T) {
 	diagnostics := newAsyncDiagnostics(check, "/ws")
 
 	diagnostics.enqueue(context.Background(), []string{"a.go"})
-	testutil.WaitFor(t, "worker idle", func() bool {
-		diagnostics.mu.Lock()
-		defer diagnostics.mu.Unlock()
-		return diagnostics.working == nil
-	})
+	waitForIdle(t, diagnostics)
 	mu.Lock()
 	response = "ERR new"
 	mu.Unlock()
@@ -128,6 +123,23 @@ func TestAsyncDiagnosticsReEditReplacesResult(t *testing.T) {
 	}
 }
 
+func waitForIdle(t *testing.T, diagnostics *asyncDiagnostics) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		diagnostics.mu.Lock()
+		busy := diagnostics.working
+		diagnostics.mu.Unlock()
+		if busy == nil {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("worker never went idle")
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+}
+
 // changedFilesTool is a fake mutating tool reporting a changed file without
 // touching the filesystem.
 type changedFilesTool struct{}

internal/agent/checkpoint_targets.go

@@ -1,34 +0,0 @@
-package agent
-
-import "github.com/Twigpine/zero/internal/tools"
-
-// CheckpointTargets returns the workspace-relative paths a tool call will mutate,
-// resolving its arguments exactly as executeToolCall does. Freeform apply_patch
-// input is normalized through the registered built-in tool, so absolute headers
-// are rewritten relative to the selected write root and cwd is set: checkpoint
-// capture and execution therefore agree on the files at stake.
-//
-// Best-effort: nil when the call has no capture targets or its arguments cannot
-// be resolved. Checkpoint capture never fails a run.
-func CheckpointTargets(workspaceRoot string, registry *tools.Registry, call ToolCall) []string {
-	if registry == nil {
-		return nil
-	}
-	args := map[string]any{}
-	if call.Freeform {
-		tool, ok := registry.Get(call.Name)
-		if !ok || !tools.IsBuiltInApplyPatch(tool) {
-			return nil
-		}
-		prepared, err := tools.PrepareFreeformApplyPatchArguments(tool, call.Arguments)
-		if err != nil {
-			return nil
-		}
-		args = prepared
-	} else if call.Arguments != "" {
-		if err := decodeToolArguments(call.Arguments, &args); err != nil {
-			return nil
-		}
-	}
-	return tools.MutationTargets(workspaceRoot, call.Name, args)
-}

internal/agent/checkpoint_targets_test.go

@@ -1,99 +0,0 @@
-package agent
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"slices"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-func TestCheckpointTargets(t *testing.T) {
-	root := t.TempDir()
-	// Absolute headers must be compared against the physical root: t.TempDir
-	// differs from it on macOS (/var -> /private/var) and via Windows short names.
-	if resolved, err := filepath.EvalSymlinks(root); err == nil {
-		root = resolved
-	}
-	if err := os.WriteFile(filepath.Join(root, "main.txt"), []byte("before\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	relativePatch := "*** Begin Patch\n*** Update File: main.txt\n@@\n-before\n+after\n*** End Patch\n"
-	absolutePatch := "*** Begin Patch\n*** Update File: " + filepath.Join(root, "main.txt") + "\n@@\n-before\n+after\n*** End Patch\n"
-	multiFilePatch := "*** Begin Patch\n*** Update File: main.txt\n@@\n-before\n+after\n*** Add File: notes.txt\n+new\n*** End Patch\n"
-	jsonArgs, err := json.Marshal(map[string]any{"patch": relativePatch})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, nil))
-	unbuiltinRegistry := tools.NewRegistry()
-	unbuiltinRegistry.Register(&customApplyPatchTool{})
-
-	for _, tc := range []struct {
-		name     string
-		registry *tools.Registry
-		call     ToolCall
-		want     []string
-	}{
-		{
-			name: "freeform relative header",
-			call: ToolCall{Name: "apply_patch", Arguments: relativePatch, Freeform: true},
-			want: []string{"main.txt"},
-		},
-		{
-			name: "freeform absolute header stays workspace-relative",
-			call: ToolCall{Name: "apply_patch", Arguments: absolutePatch, Freeform: true},
-			want: []string{"main.txt"},
-		},
-		{
-			name: "freeform multi-file patch",
-			call: ToolCall{Name: "apply_patch", Arguments: multiFilePatch, Freeform: true},
-			want: []string{"main.txt", "notes.txt"},
-		},
-		{
-			name: "json arguments",
-			call: ToolCall{Name: "apply_patch", Arguments: string(jsonArgs)},
-			want: []string{"main.txt"},
-		},
-		{
-			name: "freeform traversal is rejected",
-			call: ToolCall{Name: "apply_patch", Arguments: "*** Begin Patch\n*** Update File: ../escape.txt\n@@\n-x\n+y\n*** End Patch\n", Freeform: true},
-			want: nil,
-		},
-		{
-			name:     "freeform custom apply_patch is not prepared",
-			registry: unbuiltinRegistry,
-			call:     ToolCall{Name: "apply_patch", Arguments: relativePatch, Freeform: true},
-			want:     nil,
-		},
-		{
-			name: "unknown freeform tool",
-			call: ToolCall{Name: "read_file", Arguments: "raw", Freeform: true},
-			want: nil,
-		},
-		{
-			name: "malformed json arguments",
-			call: ToolCall{Name: "apply_patch", Arguments: "{"},
-			want: nil,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			reg := registry
-			if tc.registry != nil {
-				reg = tc.registry
-			}
-			got := CheckpointTargets(root, reg, tc.call)
-			if !slices.Equal(got, tc.want) {
-				t.Fatalf("CheckpointTargets() = %#v, want %#v", got, tc.want)
-			}
-		})
-	}
-
-	if got := CheckpointTargets(root, nil, ToolCall{Name: "apply_patch", Arguments: relativePatch}); got != nil {
-		t.Fatalf("CheckpointTargets(nil registry) = %#v, want nil", got)
-	}
-}

internal/agent/command_prefix.go

@@ -5,8 +5,8 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
 	"mvdan.cc/sh/v3/syntax"
 )
 

internal/agent/command_prefix_test.go

@@ -4,8 +4,8 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 func TestProposedCommandPrefixUsesSafeSimpleCommands(t *testing.T) {

internal/agent/compaction.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/trace"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/trace"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // Session compaction.

internal/agent/compaction_cheap_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // compactableHistory returns a history whose middle is large enough to trip

internal/agent/compaction_metadata_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestCompactMessagesReturnsMetadataForManualCompaction(t *testing.T) {

internal/agent/compaction_preserve.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // Compaction preservation.

internal/agent/compaction_preserve_test.go

@@ -6,8 +6,8 @@ import (
 	"testing"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // stateConversation is a long enough conversation that Compact elides a middle

internal/agent/compaction_projection.go

@@ -6,7 +6,7 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 const (

internal/agent/compaction_projection_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestClipBytesHandlesTinyLimitsOnRuneBoundaries(t *testing.T) {

internal/agent/compaction_recent_edits_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // recentEdits extracts each mutated file's path and a one-line note from the

internal/agent/compaction_summarizer_test.go

@@ -8,7 +8,7 @@ import (
 	"sync/atomic"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 var markerPattern = regexp.MustCompile(`msg-\d+`)

internal/agent/compaction_test.go

@@ -6,9 +6,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/trace"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/trace"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // --- Pure Compact() tests -------------------------------------------------

internal/agent/completion_gate_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // someRequestContains reports whether any message sent to the provider across all

internal/agent/context_measurement.go

@@ -3,7 +3,7 @@ package agent
 import (
 	"encoding/json"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // Context budget.

internal/agent/context_measurement_test.go

@@ -3,7 +3,7 @@ package agent
 import (
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestMeasureContextSplitsByCategory(t *testing.T) {

internal/agent/context_planner.go

@@ -3,7 +3,7 @@ package agent
 import (
 	"strings"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 type contextPlannerConfig struct {

internal/agent/context_planner_test.go

@@ -4,7 +4,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestContextPlannerPreservesProviderRequest(t *testing.T) {

internal/agent/defer_savings_test.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 // richMCPTool mimics a real MCP tool's schema (Exa/Firecrawl-style search): an

internal/agent/deferred_loop_test.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestOptionsDeferThresholdFieldExists(t *testing.T) {

internal/agent/denial_test.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 func TestExecuteToolCallCategorizesFilteredDenial(t *testing.T) {

internal/agent/effective_permission_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 // argsPermTool implements tools.ArgsPermissioner; plainTool does not.

internal/agent/escalate_loop_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // TestOptionsModelSwitcherFieldExists asserts the escalation hook is an

internal/agent/export_test.go

@@ -2,8 +2,8 @@
 package agent
 
 import (
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func equalStringSlices(left []string, right []string) bool {

internal/agent/file_diagnostics.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/Twigpine/zero/internal/lsp"
+	"github.com/Gitlawb/zero/internal/lsp"
 )
 
 // fileDiagnosticsTimeout bounds one inline post-edit diagnostics check so a

internal/agent/freeform_tool_test.go

@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 type customApplyPatchTool struct {

internal/agent/guardrails.go

@@ -4,7 +4,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // Guardrail thresholds for the agent loop. These keep a runaway model from

internal/agent/guardrails_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // emptyTurn is a stream that produces no visible text and no tool calls.
@@ -80,9 +80,6 @@ func TestRunStopsAfterConsecutiveEmptyTurns(t *testing.T) {
 	if result.FinalAnswer == maxTurnsAnswer {
 		t.Fatalf("no-output guard must stop before reaching maxTurns, got max-turns answer")
 	}
-	if result.Incomplete {
-		t.Fatalf("interactive run must not be marked Incomplete; reason=%q", result.IncompleteReason)
-	}
 }
 
 func TestRunResetsEmptyTurnCounterOnVisibleOutput(t *testing.T) {
@@ -516,22 +513,6 @@ func repeatedFlakyTurns(n int) [][]zeroruntime.StreamEvent {
 	return turns
 }
 
-// alwaysSucceedingTool is the successful counterpart to alwaysFailingTool, used
-// to put a productive tool turn before an empty-turn streak.
-type alwaysSucceedingTool struct{}
-
-func (alwaysSucceedingTool) Name() string        { return "ok" }
-func (alwaysSucceedingTool) Description() string { return "always succeeds for testing" }
-func (alwaysSucceedingTool) Parameters() tools.Schema {
-	return tools.Schema{Type: "object", AdditionalProperties: false}
-}
-func (alwaysSucceedingTool) Safety() tools.Safety {
-	return tools.Safety{SideEffect: tools.SideEffectRead, Permission: tools.PermissionAllow}
-}
-func (alwaysSucceedingTool) Run(context.Context, map[string]any) tools.Result {
-	return tools.Result{Status: tools.StatusOK, Output: "ok"}
-}
-
 func TestRunStopsAfterRepeatedToolFailures(t *testing.T) {
 	registry := tools.NewRegistry()
 	registry.Register(alwaysFailingTool{})
@@ -548,51 +529,6 @@ func TestRunStopsAfterRepeatedToolFailures(t *testing.T) {
 	if len(provider.requests) != toolFailureStopAt {
 		t.Fatalf("expected stop at %d failures, made %d requests", toolFailureStopAt, len(provider.requests))
 	}
-	if result.Incomplete {
-		t.Fatalf("interactive run must not be marked Incomplete; reason=%q", result.IncompleteReason)
-	}
-}
-
-// Under the headless completion gate both guardrail stops are unfinished runs,
-// so they must set Result.Incomplete and a reason; exec maps that to exit 4.
-// Thresholds and stop answers stay pinned by the two tests above.
-func TestHeadlessGuardStopsAreIncomplete(t *testing.T) {
-	for _, tc := range []struct {
-		name       string
-		turns      [][]zeroruntime.StreamEvent
-		wantTurns  int
-		wantReason string
-	}{
-		{"empty_turns", [][]zeroruntime.StreamEvent{emptyTurn(), emptyTurn(), emptyTurn()}, maxEmptyTurns, "3 consecutive turns with no output"},
-		{"empty_turns_after_progress", [][]zeroruntime.StreamEvent{
-			toolTurn("ok-1", "ok", "{}"),
-			emptyTurn(), emptyTurn(), emptyTurn(),
-		}, maxEmptyTurns + 1, "3 consecutive turns with no output"},
-		{"repeated_tool_failures", repeatedFlakyTurns(10), toolFailureStopAt, "flaky"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			registry := tools.NewRegistry()
-			registry.Register(alwaysFailingTool{})
-			registry.Register(alwaysSucceedingTool{})
-			result, err := Run(context.Background(), "go", &mockProvider{turns: tc.turns}, Options{
-				Registry:                registry,
-				MaxTurns:                12,
-				RequireCompletionSignal: true,
-			})
-			if err != nil {
-				t.Fatal(err)
-			}
-			if result.Turns != tc.wantTurns {
-				t.Fatalf("guard did not trigger: turns=%d want=%d", result.Turns, tc.wantTurns)
-			}
-			if !result.Incomplete {
-				t.Fatalf("guardrail stop under the headless gate must be Incomplete; final=%q", result.FinalAnswer)
-			}
-			if !strings.Contains(result.IncompleteReason, tc.wantReason) {
-				t.Fatalf("IncompleteReason = %q, want it to mention %q", result.IncompleteReason, tc.wantReason)
-			}
-		})
-	}
 }
 
 func TestRunInjectsToolFailureHintWithSchema(t *testing.T) {

internal/agent/hook_wiring_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/hooks"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/hooks"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 func TestAppendHookFeedbackFormatsOutput(t *testing.T) {

internal/agent/loop.go

@@ -11,33 +11,28 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/hooks"
-	"github.com/Twigpine/zero/internal/modelregistry"
-	"github.com/Twigpine/zero/internal/redaction"
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/streamjson"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/trace"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/execution"
+	"github.com/Gitlawb/zero/internal/hooks"
+	"github.com/Gitlawb/zero/internal/redaction"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/streamjson"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/trace"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 const maxTurnsAnswer = "Agent reached maximum number of turns without a final answer."
 const maxTurnsFinalAnswerPrompt = "You have reached the tool-turn limit. Do not call tools. Give a concise final answer now: summarize what you completed, what you found, and any remaining blockers."
 
 // maxStreamStallRetries bounds how many times a turn that timed out (idle/stall)
-// OR hit a mid-stream transport abort (#973) with no answer text yet is re-issued
-// on a fresh connection before giving up. Incomplete tool-call previews are
-// allowed through the gate (they are never dispatched before the error return).
-// The safety claim is only that visible answer prose is not duplicated on retry —
-// not that every partial stream shape is excluded. Covers a stalled/dead pooled
-// connection or a socket abort before tool dispatch.
+// WITH NO OUTPUT yet is re-issued on a fresh connection before giving up. Only
+// the no-output case is retried (a partial turn would duplicate), so this is a
+// safe recovery for a stalled/dead pooled connection.
 //
 // Set to 1 (not 2): each attempt can itself idle for the full stream timeout
 // (~5min) before the stall is even detected, so 2 retries left an interactive
 // session frozen for ~15min. One retry keeps the common single-hiccup recovery
-// while bounding the worst case to ~2× the idle timeout. Mid-stream transport
-// aborts share this bound (do not raise it for #973).
+// while bounding the worst case to ~2× the idle timeout.
 const maxStreamStallRetries = 1
 
 const (
@@ -379,11 +374,7 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 					rec.StampFirstToken()
 				}
 				if onText != nil {
-					// Zero-length chunks are not committed answer prose; counting
-					// them would block an eligible mid-stream abort retry.
-					if s != "" {
-						forwardedVisibleText = true
-					}
+					forwardedVisibleText = true
 					onText(s)
 				}
 			}
@@ -459,14 +450,9 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			result.Messages = copyMessages(messages)
 			return result, ctx.Err()
 		}
-		// A stream idle/stall timeout OR mid-stream transport abort (#973 — wsarecv /
-		// connection reset / unexpected EOF / connection closed / broken pipe) is
-		// safely re-issued when the turn committed NO answer text — no forwarded
-		// visible prose (forwardedVisibleText) and no collected final text
-		// (collected.Text). The abort gate matches midStreamAbortNeedles only, not
-		// the full shouldReconnect list: connect-phase timeouts and connection
-		// refused are NOT retried here (a slow healthy server must not cost a
-		// second prefill). This covers three cases:
+		// A stream idle/stall timeout is safely re-issued when the turn committed NO
+		// answer text — no forwarded visible prose (forwardedVisibleText) and no
+		// collected final text (collected.Text). This covers two cases:
 		//   1. Nothing streamed at all before the connection died (the original
 		//      macOS stale-pooled-connection hang past the response-header timeout).
 		//   2. The model streamed transient reasoning and began a tool call (e.g. a
@@ -477,27 +463,13 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 		//      re-render is transient previews, not duplicated answer text. This is
 		//      why the gate no longer excludes collected.ToolCalls: an incomplete
 		//      tool call from a timed-out stream is discard-and-retry, not output.
-		//   3. Mid-stream socket abort after connect succeeded (Windows WSAECONNABORTED /
-		//      wsarecv, connection reset by peer). Same no-tool-executed safety: the
-		//      error returns before tool dispatch, so a bounded retry is safe.
 		// A turn that forwarded real prose is NOT retried (it would duplicate visible
 		// answer text) and falls through to the error return below. Capped +
 		// exponential backoff, with a user-visible notice per attempt.
 		for attempt := 1; attempt <= maxStreamStallRetries &&
-			(isStreamTimeoutError(collected.Error) || isMidStreamTransportAbort(collected.Error)) &&
-			!forwardedVisibleText &&
+			isStreamTimeoutError(collected.Error) && !forwardedVisibleText &&
 			collected.Text == ""; attempt++ {
-			var notify reconnectNotifier
-			if isStreamTimeoutError(collected.Error) {
-				notify = stallRetryNoticeFor(options)
-			} else {
-				notify = reconnectNoticeFor(options)
-				// Count this post-connect reissue even when the replacement
-				// connect succeeds immediately. streamWithReconnect only
-				// increments reconnect_count after a failed connect attempt.
-				options.Trace.Counter(trace.CounterReconnectCount, 1)
-			}
-			if notify != nil {
+			if notify := stallRetryNoticeFor(options); notify != nil {
 				notify(attempt, maxStreamStallRetries)
 			}
 			if err := sleepWithContext(ctx, backoffFor(attempt)); err != nil {
@@ -510,22 +482,12 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			retryStream, retryErr := streamWithReconnect(ctx, provider, retryRequest, reconnectNoticeFor(options))
 			if retryErr != nil {
 				result.Messages = copyMessages(messages)
-				if ctx.Err() != nil {
-					return result, ctx.Err()
-				}
 				return result, retryErr
 			}
 			stallGenSpan := options.Trace.Span(trace.SpanGeneration)
 			collected = zeroruntime.CollectStreamWithOptions(ctx, retryStream, forwardingOpts)
 			stallGenSpan.End()
 		}
-		// Recheck ctx after a retried CollectStream: helpers.go stores
-		// ctx.Err().Error() in collected.Error, and errors.New of that string
-		// drops the context.Canceled sentinel ACP branches on.
-		if ctx.Err() != nil {
-			result.Messages = copyMessages(messages)
-			return result, ctx.Err()
-		}
 		if collected.Error != "" {
 			// Route a reissued stream's non-stall error through the SAME recovery as
 			// the initial stream (image-rejection wrapping / context-limit compaction)
@@ -536,10 +498,6 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				result.Messages = copyMessages(messages)
 				return result, stop
 			}
-			if ctx.Err() != nil {
-				result.Messages = copyMessages(messages)
-				return result, ctx.Err()
-			}
 			if collected.Error != "" {
 				result.Messages = copyMessages(messages)
 				return result, errors.New(collected.Error)
@@ -587,14 +545,6 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			// counted toward the runaway cap so we stop before burning maxTurns.
 			if guards.observeTurn(collected) {
 				result.FinalAnswer = noOutputStopAnswer(result.Turns)
-				// Under the headless completion gate this stop is unfinished work,
-				// not a successful final answer: the guard exists precisely because
-				// the model made no progress. Interactive runs keep the gate off, so
-				// their behavior is unchanged.
-				if options.RequireCompletionSignal {
-					result.Incomplete = true
-					result.IncompleteReason = "stopped after " + strconv.Itoa(guards.emptyTurns) + " consecutive turns with no output"
-				}
 				result.Messages = copyMessages(messages)
 				return result, nil
 			}
@@ -696,25 +646,9 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 		// recorded. They travel as user messages, and a user message between two
 		// tool_results breaks strict provider replay — Anthropic coalesces them
 		// into one user block list and requires the tool_result blocks first, so
-		// Images ride a following USER message rather than the tool result
-		// above. Every provider drops images on a tool-role message —
-		// Anthropic's tool_result content is a string, Gemini's is a
-		// functionResponse, and OpenAI guards its image parts to the user role
-		// — so attaching them there would silently deliver nothing. A separate
-		// message also keeps the one-tool-result-per-tool-call pairing intact,
-		// which the providers validate. Vision-gate evaluation is deferred until
-		// after any model switch this turn resolves, so images can reach an
-		// escalated vision-capable model.
-		var toolResultsWithImages []ToolResult
-		buildToolImageMessages := func() []zeroruntime.Message {
-			var out []zeroruntime.Message
-			for _, tr := range toolResultsWithImages {
-				if imageMessage, ok := toolResultImageMessage(tr, options); ok {
-					out = append(out, imageMessage)
-				}
-			}
-			return out
-		}
+		// interleaving yields [tool_result, text, image, tool_result] and a 400.
+		// Same reason the self-correction feedback below is deferred.
+		var toolImageMessages []zeroruntime.Message
 		// Parallel read-ahead state: results for calls[precomputedStart:precomputedEnd]
 		// executed concurrently, consumed strictly in order below.
 		var precomputed []precomputedToolResult
@@ -771,8 +705,15 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				IsError:            toolResult.Status == tools.StatusError,
 				ChangedFiles:       append([]string(nil), toolResult.ChangedFiles...),
 			})
-			if len(toolResult.Images) > 0 {
-				toolResultsWithImages = append(toolResultsWithImages, toolResult)
+			// Images ride a following USER message rather than the tool result
+			// above. Every provider drops images on a tool-role message —
+			// Anthropic's tool_result content is a string, Gemini's is a
+			// functionResponse, and OpenAI guards its image parts to the user role
+			// — so attaching them there would silently deliver nothing. A separate
+			// message also keeps the one-tool-result-per-tool-call pairing intact,
+			// which the providers validate.
+			if imageMessage, ok := toolResultImageMessage(toolResult); ok {
+				toolImageMessages = append(toolImageMessages, imageMessage)
 			}
 
 			// A tool may demand the run ABORT — a canceled/timed-out ask_user prompt
@@ -784,13 +725,13 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			}
 			if abortErr != nil {
 				messages = appendAbortedToolResults(messages, collected.ToolCalls[index+1:])
-				messages = append(messages, buildToolImageMessages()...)
+				messages = append(messages, toolImageMessages...)
 				result.Messages = copyMessages(messages)
 				return result, abortErr
 			}
 			if stopReason := stopReasonFromToolResult(toolResult); stopReason != "" {
 				messages = appendAbortedToolResults(messages, collected.ToolCalls[index+1:])
-				messages = append(messages, buildToolImageMessages()...)
+				messages = append(messages, toolImageMessages...)
 				result.FinalAnswer = toolResult.ModelOutput()
 				result.StopReason = stopReason
 				result.Messages = copyMessages(messages)
@@ -814,15 +755,8 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				// messages stay valid for a strict provider replay (Anthropic
 				// rejects a tool_use with no answering tool_result).
 				messages = appendAbortedToolResults(messages, collected.ToolCalls[index+1:])
-				messages = append(messages, buildToolImageMessages()...)
+				messages = append(messages, toolImageMessages...)
 				result.FinalAnswer = toolFailureStopAnswer(call.Name, outcome.Count)
-				// Same headless contract as the empty-turn guard: halting on a
-				// repeated failure is an unfinished run, not success. Gate-off
-				// (interactive / --no-completion-gate) keeps the old behavior.
-				if options.RequireCompletionSignal {
-					result.Incomplete = true
-					result.IncompleteReason = "the " + call.Name + " tool failed " + strconv.Itoa(outcome.Count) + " times in a row with the same error"
-				}
 				result.Messages = copyMessages(messages)
 				return result, nil
 			}
@@ -840,6 +774,10 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 				postEditDiagnostics.enqueue(ctx, toolResult.ChangedFiles)
 			}
 		}
+		// Every tool_result for this turn is now recorded, including aborted
+		// placeholders, so the images can follow without splitting them.
+		messages = append(messages, toolImageMessages...)
+		toolImageMessages = nil
 
 		// Run post-edit self-correction once over the union of files this turn
 		// changed, then append any feedback after every tool_result is recorded so
@@ -927,12 +865,6 @@ func Run(ctx context.Context, prompt string, provider Provider, options Options)
 			}
 		}
 
-		// Every tool_result, self-correct notice, and model-switch update for this
-		// turn is now in place; evaluate and append image messages against the
-		// effective (potentially escalated) model.
-		messages = append(messages, buildToolImageMessages()...)
-		toolResultsWithImages = nil
-
 		// A turn can mix valid tool calls with a dropped (nameless) one. The valid
 		// calls executed above; surface the dropped call too so it is never
 		// silently ignored just because the turn also did real work. This is
@@ -3532,10 +3464,8 @@ func copyMessages(messages []Message) []Message {
 //
 // The text names the tool so the model can tell which call an image came from
 // when several ran in one turn — the images arrive detached from their tool
-// result, so nothing else associates them. If the effective model cannot
-// accept images, the tool's text result is left unchanged and this follow-up
-// is a notice with no image parts, matching the CLI/TUI vision gate.
-func toolResultImageMessage(result ToolResult, options Options) (zeroruntime.Message, bool) {
+// result, so nothing else associates them.
+func toolResultImageMessage(result ToolResult) (zeroruntime.Message, bool) {
 	images := make([]zeroruntime.ImageBlock, 0, len(result.Images))
 	for _, image := range result.Images {
 		if len(image.Data) == 0 {
@@ -3556,26 +3486,9 @@ func toolResultImageMessage(result ToolResult, options Options) (zeroruntime.Mes
 	if label == "" {
 		label = "tool"
 	}
-	if !modelAcceptsToolImages(options) {
-		return zeroruntime.Message{
-			Role:    zeroruntime.MessageRoleUser,
-			Content: "Image output from " + label + " was not sent because the current model does not support image input. Switch to a vision-capable model before retrying image delivery, including any images skipped by the tool's image budget.",
-		}, true
-	}
 	return zeroruntime.Message{
 		Role:    zeroruntime.MessageRoleUser,
 		Content: "Image output from " + label + ":",
 		Images:  images,
 	}, true
 }
-
-func modelAcceptsToolImages(options Options) bool {
-	if options.SupportsVision != nil {
-		return options.SupportsVision(options.Model)
-	}
-	registry, err := modelregistry.DefaultRegistry()
-	if err != nil {
-		return modelregistry.VisionCapableByName(options.Model)
-	}
-	return modelregistry.SupportsVision(registry, options.Model)
-}

internal/agent/loop_images_test.go

@@ -5,7 +5,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // imageEchoProvider records the messages of the first request it receives, then

internal/agent/loop_test.go

@@ -13,13 +13,13 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/hooks"
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/specmode"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/trace"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/execution"
+	"github.com/Gitlawb/zero/internal/hooks"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/specmode"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/trace"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 type mockProvider struct {

internal/agent/member_auto_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 type safetyTool struct {

internal/agent/midstream_retry_test.go

@@ -1,487 +0,0 @@
-package agent
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/trace"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-// midStreamAbortProvider connects successfully but emits a transport-abort
-// StreamEventError on the first abortBefore calls, then succeeds with "done".
-// hangOnCall, if > 0, makes that 1-based call block until ctx is done so a
-// cancel during the retried CollectStream can be reproduced.
-// connectFailFrom, if > 0, makes that 1-based call and later return a
-// reconnectable connect error so streamWithReconnect enters its backoff.
-type midStreamAbortProvider struct {
-	calls           int32
-	abortBefore     int32
-	abortError      string
-	partialText     string
-	emptyTextEvent  bool
-	partialToolCall string
-	hangOnCall      int32
-	connectFailFrom int32
-	connectErr      string
-	started         chan struct{}
-}
-
-func (p *midStreamAbortProvider) StreamCompletion(ctx context.Context, _ zeroruntime.CompletionRequest) (<-chan zeroruntime.StreamEvent, error) {
-	n := atomic.AddInt32(&p.calls, 1)
-	if p.connectFailFrom > 0 && n >= p.connectFailFrom {
-		if p.started != nil {
-			select {
-			case <-p.started:
-			default:
-				close(p.started)
-			}
-		}
-		errMsg := p.connectErr
-		if errMsg == "" {
-			errMsg = "connection reset by peer"
-		}
-		return nil, errors.New(errMsg)
-	}
-	if p.hangOnCall > 0 && n == p.hangOnCall {
-		if p.started != nil {
-			close(p.started)
-		}
-		ch := make(chan zeroruntime.StreamEvent)
-		go func() {
-			<-ctx.Done()
-			close(ch)
-		}()
-		return ch, nil
-	}
-	ch := make(chan zeroruntime.StreamEvent, 5)
-	if n <= p.abortBefore {
-		if p.emptyTextEvent {
-			ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventText, Content: ""}
-		}
-		if p.partialText != "" {
-			ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventText, Content: p.partialText}
-		}
-		if p.partialToolCall != "" {
-			ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "tc_1", ToolName: p.partialToolCall}
-			ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "tc_1", ArgumentsFragment: `{"path":"x.html","content":"<!doctype`}
-		}
-		errMsg := p.abortError
-		if errMsg == "" {
-			errMsg = "provider stream error: read: connection reset by peer"
-		}
-		ch <- zeroruntime.StreamEvent{
-			Type:  zeroruntime.StreamEventError,
-			Error: errMsg,
-		}
-		close(ch)
-		return ch, nil
-	}
-	ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventText, Content: "done"}
-	ch <- zeroruntime.StreamEvent{Type: zeroruntime.StreamEventDone}
-	close(ch)
-	return ch, nil
-}
-
-func TestRunRetriesMidStreamConnectionReset(t *testing.T) {
-	p := &midStreamAbortProvider{abortBefore: 1}
-	result, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err != nil {
-		t.Fatalf("a mid-stream connection reset should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-}
-
-func TestRunRetriesMidStreamWindowsAbort(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider stream error: read: wsarecv: An established connection was aborted by the software in your host machine",
-	}
-	result, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err != nil {
-		t.Fatalf("a Windows mid-stream abort should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-}
-
-// wsarecv alone (no "connection was aborted" substring) must still retry, so
-// deleting the wsarecv needle cannot go green.
-func TestRunRetriesMidStreamWsarecvNeedle(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider stream error: read: wsarecv: 10053",
-	}
-	result, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err != nil {
-		t.Fatalf("wsarecv without 'connection was aborted' should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-}
-
-func TestRunDoesNotRetryMidStreamAbortAfterPartialOutput(t *testing.T) {
-	sawText := 0
-	p := &midStreamAbortProvider{abortBefore: 1, partialText: "partial"}
-	_, err := Run(context.Background(), "go", p, Options{
-		Registry: tools.NewRegistry(),
-		OnText:   func(string) { sawText++ },
-	})
-	if err == nil {
-		t.Fatal("a mid-stream abort after partial output must NOT be retried; want an error")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("partial-then-abort must not retry, got %d calls", got)
-	}
-	if sawText == 0 {
-		t.Fatal("OnText must have fired so forwardedVisibleText is the named guard")
-	}
-}
-
-// A zero-length OnText chunk is not committed answer prose, so an eligible
-// transport abort still retries.
-func TestRunRetriesMidStreamAbortAfterEmptyTextEvent(t *testing.T) {
-	p := &midStreamAbortProvider{abortBefore: 1, emptyTextEvent: true}
-	result, err := Run(context.Background(), "go", p, Options{
-		Registry: tools.NewRegistry(),
-		OnText:   func(string) {},
-	})
-	if err != nil {
-		t.Fatalf("empty OnText must not block mid-stream abort retry, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-}
-
-func TestRunRetriesMidStreamAbortAfterIncompleteToolCall(t *testing.T) {
-	starts := 0
-	dispatched := 0
-	p := &midStreamAbortProvider{abortBefore: 1, partialToolCall: "write_file"}
-	result, err := Run(context.Background(), "go", p, Options{
-		Registry:        tools.NewRegistry(),
-		OnToolCallStart: func(string, string) { starts++ },
-		OnToolCallDelta: func(string, string) {},
-		OnToolCall:      func(ToolCall) { dispatched++ },
-	})
-	if err != nil {
-		t.Fatalf("a mid-stream abort mid-incomplete-tool-call should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-	if starts != 1 {
-		t.Fatalf("the incomplete tool call should have been forwarded once before the abort, got %d starts", starts)
-	}
-	if dispatched != 0 {
-		t.Fatalf("OnToolCall must never fire for an incomplete aborted tool call (no dispatch), got %d", dispatched)
-	}
-}
-
-func TestRunGivesUpAfterMaxMidStreamAbortRetries(t *testing.T) {
-	if maxStreamStallRetries != 1 {
-		t.Fatalf("maxStreamStallRetries = %d, want 1 (#973 must not raise this bound)", maxStreamStallRetries)
-	}
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	p := &midStreamAbortProvider{abortBefore: 99}
-	_, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err == nil {
-		t.Fatal("a persistent mid-stream abort must surface an error after exhausting retries")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry); pin the bound at 1, got %d", got)
-	}
-}
-
-func TestRunMidStreamAbortUsesReconnectNotice(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	var notices string
-	p := &midStreamAbortProvider{abortBefore: 1}
-	result, err := Run(context.Background(), "go", p, Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	})
-	if err != nil {
-		t.Fatalf("retry should succeed, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	lower := strings.ToLower(notices)
-	if !strings.Contains(lower, "connection lost") || !strings.Contains(lower, "reconnecting") {
-		t.Fatalf("transport abort must use reconnect wording, notices = %q", notices)
-	}
-	if strings.Contains(lower, "model stalled") {
-		t.Fatalf("transport abort must not use stall wording, notices = %q", notices)
-	}
-}
-
-func TestRunCancelDuringMidStreamRetryPreservesContextCanceled(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	started := make(chan struct{})
-	p := &midStreamAbortProvider{abortBefore: 1, hangOnCall: 2, started: started}
-	errCh := make(chan error, 1)
-	go func() {
-		_, err := Run(ctx, "go", p, Options{Registry: tools.NewRegistry()})
-		errCh <- err
-	}()
-	select {
-	case <-started:
-	case <-time.After(5 * time.Second):
-		t.Fatal("timed out waiting for retried stream")
-	}
-	cancel()
-	err := <-errCh
-	if err == nil {
-		t.Fatal("want context.Canceled after cancel during retried stream")
-	}
-	if !errors.Is(err, context.Canceled) {
-		t.Fatalf("cancel during retried stream must keep the sentinel, got %q (errors.Is Canceled = false)", err)
-	}
-}
-
-func TestRunCancelDuringReplacementConnectBackoffPreservesContextCanceled(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = 200 * time.Millisecond
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	started := make(chan struct{})
-	p := &midStreamAbortProvider{abortBefore: 1, connectFailFrom: 2, started: started}
-	errCh := make(chan error, 1)
-	go func() {
-		_, err := Run(ctx, "go", p, Options{Registry: tools.NewRegistry()})
-		errCh <- err
-	}()
-	select {
-	case <-started:
-	case <-time.After(5 * time.Second):
-		t.Fatal("timed out waiting for replacement connect failure")
-	}
-	cancel()
-	err := <-errCh
-	if err == nil {
-		t.Fatal("want context.Canceled after cancel during replacement connect backoff")
-	}
-	if !errors.Is(err, context.Canceled) {
-		t.Fatalf("cancel during replacement connect backoff must keep the sentinel, got %q (errors.Is Canceled = false)", err)
-	}
-}
-
-func TestRunMidStreamAbortRecordsReconnectCountOnImmediateReplacement(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	rec := trace.NewRecorder("midstream-abort", "run-1", "test")
-	p := &midStreamAbortProvider{abortBefore: 1}
-	result, err := Run(context.Background(), "go", p, Options{
-		Registry: tools.NewRegistry(),
-		Trace:    rec,
-	})
-	if err != nil {
-		t.Fatalf("retry should succeed, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 immediate replacement), got %d", got)
-	}
-	gotTrace := rec.Finish()
-	if got := gotTrace.Counter(trace.CounterReconnectCount); got != 1 {
-		t.Fatalf("reconnect_count = %d, want 1 for a successful replacement connection", got)
-	}
-	if got := gotTrace.Counter(trace.CounterModelRequests); got != 2 {
-		t.Fatalf("model_requests = %d, want 2 (initial + replacement)", got)
-	}
-}
-
-func TestRunDoesNotRetryResponseHeaderTimeout(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 99,
-		abortError:  "net/http: timeout awaiting response headers",
-	}
-	_, err := Run(context.Background(), "go", p, Options{Registry: tools.NewRegistry()})
-	if err == nil {
-		t.Fatal("a response-header timeout must not be retried as a mid-stream abort")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("header timeout must not retry, got %d calls", got)
-	}
-}
-
-func TestIsMidStreamTransportAbort(t *testing.T) {
-	aborts := []string{
-		"provider stream error: read: connection reset by peer",
-		"provider stream error: unexpected EOF",
-		"provider stream error: read: wsarecv: 10053",
-		"provider stream error: read: wsarecv: An established connection was aborted by the software in your host machine",
-		"An existing connection was forcibly closed by the remote host",
-		"provider stream error: read: connection closed",
-		"write: broken pipe",
-		"provider stream error: server closed the connection",
-		"provider stream error: software caused connection abort",
-	}
-	for _, m := range aborts {
-		if !isMidStreamTransportAbort(m) {
-			t.Fatalf("want mid-stream transport abort: %q", m)
-		}
-	}
-	notAborts := []string{
-		"",
-		"context length exceeded",
-		"rate limit error: slow down",
-		"model not found",
-		"net/http: timeout awaiting response headers",
-		"dial tcp 10.0.0.1:443: connect: connection refused",
-		"i/o timeout",
-		"500 Internal Server Error",
-		"502 Bad Gateway",
-		"503 Service Unavailable",
-		"504 Gateway Timeout",
-		"provider request error: request does not satisfy oneOf schema",
-		"provider request error: connection closed is not a supported finish reason",
-		"provider error: connection closed is not a supported finish reason",
-		"provider error: upstream connection reset by peer",
-		"provider error: unexpected EOF while reading upstream response",
-		"provider error: 502 Bad Gateway",
-		"auth error: connection reset by peer",
-		"rate limit error: server closed",
-		"schema error: property oneOf is invalid",
-	}
-	for _, m := range notAborts {
-		if isMidStreamTransportAbort(m) {
-			t.Fatalf("must NOT classify as mid-stream transport abort: %q", m)
-		}
-	}
-}
-
-func TestRunDoesNotRetryClassifiedProviderErrorWithSocketPhrase(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider request error: connection closed is not a supported finish reason",
-	}
-	var notices string
-	opts := Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	}
-	_, err := Run(context.Background(), "go", p, opts)
-	if err == nil {
-		t.Fatal("expected application error, got nil")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("classified provider error with 'connection closed' must not retry (got %d calls, want 1)", got)
-	}
-	if notices != "" {
-		t.Fatalf("expected no reconnect notices, got %q", notices)
-	}
-	if !strings.Contains(err.Error(), "connection closed") {
-		t.Fatalf("expected original error preserved, got %v", err)
-	}
-}
-
-func TestRunDoesNotRetryProviderErrorWithSocketPhrase(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider error: unexpected EOF while reading upstream response",
-	}
-	var notices string
-	opts := Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	}
-	_, err := Run(context.Background(), "go", p, opts)
-	if err == nil {
-		t.Fatal("expected application error, got nil")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("provider error with 'unexpected EOF' must not retry (got %d calls, want 1)", got)
-	}
-	if notices != "" {
-		t.Fatalf("expected no reconnect notices, got %q", notices)
-	}
-	if got := err.Error(); got != p.abortError {
-		t.Fatalf("error = %q, want original provider error %q", got, p.abortError)
-	}
-}
-
-func TestRunDoesNotRetryApplicationErrorContainingEOFSubstring(t *testing.T) {
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider request error: request does not satisfy oneOf schema",
-	}
-	var notices string
-	opts := Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	}
-	_, err := Run(context.Background(), "go", p, opts)
-	if err == nil {
-		t.Fatal("expected application error, got nil")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 1 {
-		t.Fatalf("application error with 'oneOf' must not retry (got %d calls, want 1)", got)
-	}
-	if notices != "" {
-		t.Fatalf("expected no reconnect notices, got %q", notices)
-	}
-	if !strings.Contains(err.Error(), "oneOf") {
-		t.Fatalf("expected original error preserved, got %v", err)
-	}
-}
-
-func TestRunRetriesMidStreamUnexpectedEOF(t *testing.T) {
-	defer func(orig time.Duration) { streamReconnectBase = orig }(streamReconnectBase)
-	streamReconnectBase = time.Millisecond
-	p := &midStreamAbortProvider{
-		abortBefore: 1,
-		abortError:  "provider stream error: unexpected EOF",
-	}
-	var notices string
-	opts := Options{
-		Registry:    tools.NewRegistry(),
-		OnReasoning: func(s string) { notices += s },
-	}
-	result, err := Run(context.Background(), "go", p, opts)
-	if err != nil {
-		t.Fatalf("unexpected EOF should retry to success, got %v", err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q, want %q", result.FinalAnswer, "done")
-	}
-	if got := atomic.LoadInt32(&p.calls); got != 2 {
-		t.Fatalf("want 2 calls (1 abort + 1 retry), got %d", got)
-	}
-	lower := strings.ToLower(notices)
-	if !strings.Contains(lower, "connection lost") || !strings.Contains(lower, "reconnecting") {
-		t.Fatalf("expected reconnect notice, got %q", notices)
-	}
-}

internal/agent/output_budget_propagation_test.go

@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/hooks"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/trace"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/hooks"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/trace"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 type propagationOutputTool struct {

internal/agent/parallel_tools.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"sync"
 
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 // Parallel read-ahead for tool batches. When a turn requests several