fix(sandbox): require literal words for the whole AST call (#473 review)

astCommandFields guarded only the program word, then ran every argument
through wordText, which keeps literal/quoted parts and silently drops
CmdSubst/ParamExp. A dynamic ARGUMENT was therefore reconstructed lossily:
`git $(printf foo)rebase -i HEAD~1` runs as `git foorebase -i` (a
non-existent, non-interactive subcommand) but collapsed to `git rebase -i`
and was blocked -- a false positive on a command the user never wrote, and
new on this branch (the base correctly reports not-interactive).

Extend the literalness guard to every word in the call: if any word carries
an expansion, skip that AST command rather than classify a reconstruction
whose runtime value is unknowable. Skipping is the safe direction -- the
hand-written passes still run first, and a miss falls through to the normal
permission prompt instead of hard-blocking.

Genuine detection is unchanged: `git rebase -i HEAD~1` and the #473 bypass
cases still classify exactly as before.

.coderabbit.yaml

@@ -29,9 +29,6 @@ reviews:
     - path: "tests/**/*.ts"
       instructions: |
         Review tests for Bun test idioms, deterministic behavior, and meaningful coverage of safety decisions, provider/runtime flows, session events, and TUI command behavior.
-    - path: "**/*.go"
-      instructions: |
-        Do not request Plan 9 or other unsupported GOOS/GOARCH shims. The five native prebuilt release targets are linux-x64, linux-arm64, macos-arm64, macos-x64, and windows-x64. Android/Termux is also a supported runtime through the documented android-arm64 source build and Linux artifact fallback. Other GOOS/GOARCH combinations are not a review criterion.
   tools:
     github-checks:
       timeout_ms: 300000

.gitattributes

@@ -1,3 +0,0 @@
-*.go text eol=lf
-*.mod text eol=lf
-*.sum text eol=lf

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +1,11 @@
 blank_issues_enabled: false
 contact_links:
   - name: Questions and setup help
-    url: https://github.com/Twigpine/zero/discussions/categories/q-a
+    url: https://github.com/Gitlawb/zero/discussions/categories/q-a
     about: Ask in Discussions Q&A. Include zero --version, your OS, provider/model, and zero doctor output for setup problems.
   - name: Feature ideas
-    url: https://github.com/Twigpine/zero/discussions/categories/ideas
+    url: https://github.com/Gitlawb/zero/discussions/categories/ideas
     about: Propose and discuss ideas in Discussions before opening a PR (Zero is in controlled development, see CONTRIBUTING.md).
   - name: Security vulnerability
-    url: https://github.com/Twigpine/zero/security/advisories/new
+    url: https://github.com/Gitlawb/zero/security/advisories/new
     about: Report security issues privately via GitHub Security Advisories (see SECURITY.md). Do not file a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -5,7 +5,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        New feature ideas start in [Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
+        New feature ideas start in [Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
         not here. This form is for the step after that: an idea that gained traction in Discussions,
         or one a maintainer asked to have tracked as an issue. Please link the discussion below.
         Do not begin implementation until the issue has been reviewed and marked with the

.github/workflows/ci.yml

@@ -6,109 +6,10 @@ on:
     branches:
       - main
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-permissions:
-  contents: read
-
 jobs:
-  quality:
-    name: Code Quality & Lint
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Check formatting
-        run: make fmt-check
-
-      - name: Vet
-        run: go vet ./...
-
-      - name: deadcode (advisory)
-        continue-on-error: true
-        run: make deadcode
-
-      - name: golangci-lint (advisory)
-        continue-on-error: true
-        run: make lint-static
-
-  test:
-    name: Unit Tests & Coverage
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Test with coverage
-        run: |
-          go test -count=1 -coverprofile=coverage.out -covermode=atomic ./...
-
-      - name: Publish coverage summary
-        if: always()
-        shell: bash
-        run: |
-          if [ -f coverage.out ]; then
-            go tool cover -func=coverage.out | awk '
-            BEGIN {
-              total = "unknown"
-              rows = ""
-            }
-            $1 == "total:" {
-              total = $3
-              next
-            }
-            {
-              rows = rows sprintf("| `%s` | `%s` | **%s** |\n", $1, $2, $3)
-            }
-            END {
-              print "### 📊 Test Coverage Summary: **" total "**"
-              print "<details><summary>Coverage per function</summary>\n"
-              print "| File | Function | Coverage |"
-              print "| :--- | :--- | :--- |"
-              printf "%s", rows
-              print "</details>"
-            }' >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-      - name: Upload coverage artifact
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: zero-coverage-report
-          path: coverage.out
-          if-no-files-found: warn
-
   smoke:
     name: Smoke (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -117,40 +18,6 @@ jobs:
           - macos-latest
           - windows-latest
 
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
-        with:
-          go-version-file: go.mod
-          cache: true
-
-      - name: Test (Fast Non-Race)
-        run: go test ./...
-
-      - name: Build binary
-        run: go run ./cmd/zero-release build
-
-      - name: Smoke binary
-        run: go run ./cmd/zero-release smoke
-
-  race:
-    name: Race Detector
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    # A race the detector newly reports can present as a deadlock rather than a
-    # failure, and the default job timeout is six hours. This job is expected to
-    # be the longest in the workflow, so the ceiling is generous but finite.
-    timeout-minutes: 30
-
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -163,29 +30,42 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      # Invoke the Makefile target rather than repeating its flags. `make test`
-      # is already `go test ./... -race -count=1`, so running it here is what
-      # stops the project's declared test command and what CI actually runs
-      # from drifting apart again. The race detector needs cgo, which the
-      # hosted ubuntu runner supplies without an extra setup step.
-      - name: Test with the race detector
-        run: make test
+      - name: Check formatting
+        if: matrix.os == 'ubuntu-latest'
+        shell: bash
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "gofmt needed on:" >&2
+            echo "$unformatted" >&2
+            exit 1
+          fi
+
+      - name: Vet
+        if: matrix.os == 'ubuntu-latest'
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
+      - name: Build binary
+        run: go run ./cmd/zero-release build
+
+      - name: Smoke binary
+        run: go run ./cmd/zero-release smoke
 
   performance:
     name: Performance Smoke
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
         with:
           go-version-file: go.mod
           cache: true
@@ -194,39 +74,60 @@ jobs:
         run: go run ./cmd/zero-release build
 
       - name: Performance smoke
-        run: |
-          mkdir -p dist/perf
-          go run ./cmd/zero-perf-bench --output dist/perf/perf-bench.json --ci
+        run: go run ./cmd/zero-perf-bench --output dist/perf/perf-bench.json --ci
 
       - name: Upload performance report
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: zero-performance-smoke
           path: dist/perf/perf-bench.json
           if-no-files-found: warn
 
   security:
-    name: Security & Code Health
+    name: Security & code health
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.3.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
         with:
           go-version-file: go.mod
           cache: true
 
-      - name: govulncheck (linux)
-        run: make vulncheck
+      # govulncheck, deadcode, and golangci-lint each resolve a toolchain from
+      # their own modules, which can drop below the version go.mod requires and
+      # then fail to load our packages. Pin GOTOOLCHAIN to the go.mod toolchain
+      # so all three run under it.
+      - name: Pin toolchain from go.mod
+        run: |
+          toolchain="$(awk '/^toolchain /{print $2}' go.mod)"
+          echo "GOTOOLCHAIN=${toolchain:-auto}" >> "$GITHUB_ENV"
 
-      - name: govulncheck (windows)
-        run: make vulncheck-windows
+      # Hard gate: fails the build when code reaches a known vulnerability. A stdlib
+      # CVE is cleared by a toolchain bump (see go.mod). May also flag a newly
+      # published advisory on an unrelated PR — intentional: do not ship known vulns.
+      - name: govulncheck
+        run: go run golang.org/x/vuln/cmd/[email protected] ./...
+
+      # Advisory: reports functions unreachable from any cmd/* main so dormant
+      # code is visible in CI. Non-blocking while the dormant subsystems are
+      # still being wired or removed.
+      - name: deadcode (advisory)
+        continue-on-error: true
+        run: go run golang.org/x/tools/cmd/[email protected] -test=false ./...
+
+      # Advisory: catches what deadcode's whole-program reachability analysis
+      # doesn't, unused private functions/assignments reachable within a
+      # package but never actually called, plus staticcheck-style correctness
+      # and readability issues. Scoped to a few linters rather than the full
+      # default battery, and non-blocking, while the existing findings across
+      # the repo are cleaned up incrementally (see #527).
+      - name: golangci-lint (advisory)
+        continue-on-error: true
+        run: go run github.com/golangci/golangci-lint/v2/cmd/[email protected] run --enable-only unused,ineffassign,staticcheck ./...

.github/workflows/pr-auto-review.yml

@@ -24,7 +24,6 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
-          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff

.github/workflows/release-artifacts.yml

@@ -34,15 +34,12 @@ jobs:
       - name: Checkout
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.ref == '' }}
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
 
       - name: Checkout requested ref
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.ref != '' }}
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ inputs.ref }}
-          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
@@ -100,21 +97,19 @@ jobs:
           gh release create "$tag" --repo "$GITHUB_REPOSITORY" --title "$tag" --generate-notes 2>/dev/null || true
           gh release upload "$tag" dist/release/* --repo "$GITHUB_REPOSITORY" --clobber
 
-  # Publishes the npm package named in package.json (@twigpine/zero): first
-  # the five platform payloads (versions of the SAME package at suffixed
-  # versions like X.Y.Z-linux-x64, carrying the native binary + vendored
-  # helpers), then the wrapper at X.Y.Z whose optionalDependencies alias those
-  # platform versions. Platform versions MUST publish first — the wrapper pins
-  # them exactly, so the reverse order would open a window where installs
-  # resolve aliases that 404. See docs/NPM_PACKAGING.md for the full contract.
+  # Publishes @gitlawb/zero to npm: first the five platform payloads (versions
+  # of the SAME package at suffixed versions like X.Y.Z-linux-x64, carrying the
+  # native binary + vendored helpers), then the wrapper at X.Y.Z whose
+  # optionalDependencies alias those platform versions. Platform versions MUST
+  # publish first — the wrapper pins them exactly, so the reverse order would
+  # open a window where installs resolve aliases that 404. See
+  # docs/NPM_PACKAGING.md for the full contract.
   #
   # Auth is npm OIDC trusted publishing: no NPM_TOKEN secret. The package's
-  # npmjs.com settings must list this repo + workflow file + the npm-publish
-  # environment as a trusted publisher, and provenance is then generated
-  # automatically. npm checks provenance against package.json `repository`,
-  # so that must name this repository. Note npm only allows configuring a
-  # trusted publisher on an EXISTING package, so a new package name starts
-  # with a one-time manual `npm publish` of an empty 0.0.0 placeholder.
+  # npmjs.com settings must list this repo + workflow file as a trusted
+  # publisher, and provenance is then generated automatically. Note npm only
+  # allows configuring a trusted publisher on an EXISTING package, so the very
+  # first @gitlawb/zero publish is a one-time manual `npm publish` bootstrap.
   # Because the platform payloads are versions of the same package, they reuse
   # that single trusted-publisher configuration.
   publish-npm:
@@ -127,15 +122,13 @@ jobs:
     # maintainer approves it in the Actions UI before anything reaches npm.
     environment:
       name: npm-publish
-      url: https://www.npmjs.com/package/@twigpine/zero
+      url: https://www.npmjs.com/package/@gitlawb/zero
     permissions:
       contents: read
       id-token: write # OIDC token exchange for npm trusted publishing + provenance
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
 
       # No registry-url here on purpose: setup-node's registry-url writes an
       # .npmrc line referencing $NODE_AUTH_TOKEN, and npm hard-fails on the
@@ -203,13 +196,47 @@ jobs:
       - name: Assemble npm packages
         run: node scripts/npm/build-platform-packages.mjs --artifacts-dir dist/artifacts --out-dir dist/npm
 
-      # Platform payloads first under the `platform` dist-tag, then the wrapper,
-      # with the `latest` dist-tag checked before and after (platform versions
-      # are semver PRERELEASES of the wrapper version and must never become
-      # `latest`). npm applies publishes asynchronously, so the script waits
-      # until npm shows every platform version before the wrapper goes out,
-      # and until `latest` moves after it. Versions already on the registry
-      # are skipped, so "Re-run failed jobs" is safe after a partial publish.
-      - name: Publish npm packages
+      # Platform versions are semver PRERELEASES of the wrapper version
+      # (X.Y.Z-linux-x64), so they must never publish under the default
+      # `latest` dist-tag — that would make `npm install @gitlawb/zero`
+      # deliver a platform payload as the CLI. Publish them under a dedicated
+      # tag and assert `latest` survived before the wrapper goes out.
+      - name: Publish platform packages to npm
         shell: bash
-        run: scripts/npm/publish-packages.sh dist/npm
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          for dir in dist/npm/platforms/*/; do
+            echo "publishing ${dir}"
+            (cd "$dir" && npm publish --access public --tag platform)
+          done
+          # Tolerate a failed lookup (registry lag, or no latest tag yet on a
+          # bootstrap publish): under set -e a bare failure here would abort
+          # AFTER the platform payloads went out, leaving no wrapper and a
+          # re-run that fails on republishing existing versions. An empty
+          # value falls through the guard below.
+          latest="$(npm view @gitlawb/zero dist-tags.latest || true)"
+          case "$latest" in
+            "${version}-"*)
+              echo "::error::dist-tag latest points at platform version ${latest} — a platform publish clobbered it. Fix the dist-tag before the wrapper publish." >&2
+              exit 1
+              ;;
+          esac
+          echo "dist-tag latest is ${latest} (unchanged by platform publishes)."
+
+      - name: Publish wrapper to npm
+        shell: bash
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          (cd dist/npm/wrapper && npm publish --access public)
+          # Confirm the wrapper owns `latest` (retry: registry metadata can lag
+          # a publish by a few seconds).
+          for attempt in 1 2 3 4 5; do
+            latest="$(npm view @gitlawb/zero dist-tags.latest || true)"
+            if [ "$latest" = "$version" ]; then
+              echo "dist-tag latest is ${version}."
+              exit 0
+            fi
+            sleep 5
+          done
+          echo "::error::dist-tag latest is ${latest}, expected ${version} after the wrapper publish." >&2
+          exit 1

.github/workflows/zero-action-smoke.yml

@@ -5,8 +5,6 @@ on:
     paths:
       - action.yml
       - docs/GITHUB_ACTION.md
-      - scripts/action-summary.mjs
-      - scripts/action-summary.test.mjs
       - .github/workflows/zero-action-smoke.yml
   push:
     branches:
@@ -14,13 +12,8 @@ on:
     paths:
       - action.yml
       - docs/GITHUB_ACTION.md
-      - scripts/action-summary.mjs
-      - scripts/action-summary.test.mjs
       - .github/workflows/zero-action-smoke.yml
 
-permissions:
-  contents: read
-
 jobs:
   validate:
     name: Validate action.yml
@@ -31,14 +24,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 24
-
-      - name: Run action-summary test suite
-        run: node --test scripts/action-summary.test.mjs
-
       - name: Parse action.yml and assert documented inputs
         shell: bash
         run: |

.release-please-manifest.json

@@ -1 +1 @@
-{".":"0.12.0"}
+{".":"0.4.0"}

AGENTS.md

@@ -51,8 +51,10 @@ request, or completing an implementation task:
    or run focused tests with `-race`, when concurrency is affected.
 4. **Build**: `go run ./cmd/zero-release build`.
 5. **Smoke test**: `go run ./cmd/zero-release smoke`.
-6. **Advisory lint**: `make lint-static`.
-7. **Security**: `make vulncheck`.
+6. **Advisory lint**:
+   `go run github.com/golangci/golangci-lint/v2/cmd/[email protected] run --enable-only unused,ineffassign,staticcheck ./...`.
+7. **Security**:
+   `go run golang.org/x/vuln/cmd/[email protected] ./...`.
 8. **Diff hygiene**: `git diff HEAD --check` (covers staged and unstaged
    tracked changes).
 
@@ -67,93 +69,3 @@ requirements. If a related check fails, fix it. If a required check cannot run
 because of the environment or fails for an unrelated external reason, report
 the exact failure and obtain maintainer direction rather than silently ignoring
 it.
-
-## 4. Common Review Blockers
-
-These classes drive multi-round reviews. Fix them before requesting review:
-
-- **Fresh base:** Rebase onto the current PR base (`main` or stacked target)
-  before review. A stale head that rolls back mainline commits is a hard
-  blocker, not a merge-time detail. Resolve conflicts by keeping upstream
-  behavior unless the PR intentionally changes it.
-- **Platform truth:** Code and tests must pass on Linux, macOS, and Windows.
-  Compare paths after canonicalization (physical/`EvalSymlinks` form); never
-  assert raw `t.TempDir()` spellings (`/var` vs `/private/var` on macOS, short
-  paths on Windows). Prefer one cross-platform function with small `GOOS`
-  checks over duplicated helpers that drift.
-- **Supported targets only:** CONTRIBUTING.md names the five native prebuilt
-  release artifacts (`linux-x64`, `linux-arm64`, `macos-arm64`, `macos-x64`,
-  `windows-x64`) and the additional supported Android/Termux source-build and
-  artifact-fallback path. Other `GOOS`/`GOARCH` combinations, including
-  `plan9`, are unsupported and are not a review criterion. Do not block a PR
-  for failing to compile on an unsupported `GOOS`/`GOARCH`. Tests may use
-  `plan9` as a fixture for "unsupported".
-- **Security edges:** Keep secrets out of argv, env dumps, and logs. Redact
-  success and error paths (including stderr). Fail closed on ownership, lease,
-  and permission checks. Do not rely on pre-open path resolution
-  (`EvalSymlinks` then open) for containment: that is a check-to-use race.
-  Bind containment at open/use time with rooted or handle-relative,
-  traversal-resistant APIs. If a no-follow API is used, apply it to every
-  traversed component and enforce the platform's reparse-point protections;
-  final-component-only no-follow is insufficient. On multi-step setup, roll back
-  only what this run created; never destroy pre-existing resources you did
-  not create; never report success when cleanup or unlock failed.
-- **Normalize before matching:** Any transform that REMOVES bytes without
-  leaving a gap is also a reassembler, so it has to run before whatever matches
-  on the result. Redacting by shape and then stripping control bytes lets a
-  credential split by a NUL, an ESC or a C1 byte pass the patterns as two
-  fragments and be rejoined on the way out; comparing a path against a form
-  produced by the same resolver the kernel just used makes a redirect agree with
-  itself. Strip, decode, or canonicalize first, then match. The unsplit value
-  passing is not evidence, so the test needs a split case.
-- **Atomic shared state:** Write a complete temporary file, then atomically
-  replace the destination so concurrent readers never see a partial write.
-  Exclusive create or a write lock alone is not enough for readers. Serialize
-  the full read-modify-write sequence for lockfiles and shared stores.
-- **Tests match the claim:** Every behavior or security-boundary change needs a
-  regression test, including the failure path. Path-sensitive logic needs at
-  least one non-Linux path case (or a hermetic fake that exercises the same
-  normalization).
-- **Honest scope:** PR description, help text, and comments must match what
-  shipped. Wire advertised entry points or shrink the claim. Do not bundle
-  unrelated fixes. Do not widen security allowlists by name alone; check
-  classification and side effects too.
-- **Host tool version floors:** Zero shells out to `git` and other host tools,
-  and the project does not declare a minimum version for any of them. A flag,
-  subcommand, or config key that is not long-established therefore raises that
-  floor silently, and the failure on an older host is an unhelpful usage error
-  rather than a clear message. Before adding one, check when it landed and say
-  so where a caller would look. Record the floor for the exact subcommand you
-  call, not for the flag in general: `--end-of-options` reached Git's shared
-  parser in 2.24, but `git rev-parse` only accepted it from 2.30, and
-  `git checkout` and `git reset` later still. Likewise `--show-current` is
-  `git branch` 2.22, and `branch.autoSetupMerge=inherit` is 2.35. Then either
-  keep a fallback for older versions or gate the call. A test that depends on a
-  newer feature must skip below its floor instead of failing, and say which
-  version it needs.
-- **Prove the test fails without the change:** A regression test earns its
-  place only if it fails on the unfixed code, for the reason it claims. Run it
-  both ways and quote the failure in the PR. The recurring miss is not a
-  missing test but a test that never reaches the behavior it names, because an
-  earlier guard rejects the input first, so it passes with and without the fix.
-  When a test targets a specific layer, call that layer directly rather than
-  relying on a public entry point that may refuse earlier.
-- **Hermetic tests:** Tests must not read or write the developer's real config,
-  cache, or state directories. Redirect every root the code under test
-  resolves, not just config. `os.UserConfigDir` and `os.UserCacheDir` read
-  `XDG_CONFIG_HOME` and `XDG_CACHE_HOME` only on Linux and the BSDs. On macOS
-  they derive from `HOME`, and on Windows from `%AppData%` and `%LocalAppData%`.
-  Setting the XDG variables alone still leaves a macOS run writing to the real
-  home, so set `HOME` as well, or take the directory as a parameter. Apply it to
-  every test that reaches the same storage, not only the one where it was first
-  needed; a test that passes on a clean machine and pollutes a real one is a
-  blocker.
-- **Error codes vary by platform and by flag combination:** A check written
-  against the code one target returns can be silently inert on another while
-  still looking correct. `openat(O_DIRECTORY|O_NOFOLLOW)` on a symlink may
-  report `ENOTDIR` or `ELOOP` depending on the platform, because the kernel can
-  reject the directory mismatch before it ever resolves the link; accept both
-  rather than assuming the one POSIX names. On Windows, `\\?\` and `\\.\`
-  prefixes are not UNC paths, and an `NtCreateFile` information class must match
-  the struct actually passed. Confirm the code each supported target returns
-  instead of reasoning from the man page.

CHANGELOG.md

@@ -6,284 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once the first release is
 tagged. Until then, source builds report the version `dev`.
 
-## [0.12.0](https://github.com/Twigpine/zero/compare/v0.11.0...v0.12.0) (2026-11-02)
-
-
-### Features
-
-* **providers:** add MiniMax-M3.1-Flash to catalog ([#1180](https://github.com/Twigpine/zero/issues/1180)) ([d99f92b](https://github.com/Twigpine/zero/commit/d99f92b81a671f186cede81614c89b8e8a7f9451))
-* **sandbox:** support self-exec pattern to eliminate separate helper binary ([#946](https://github.com/Twigpine/zero/issues/946)) ([8c4e759](https://github.com/Twigpine/zero/commit/8c4e7597989ef9b3ca67b7703dfd15d92372aed2))
-* **skills:** install a skill's bundled files and point the skill tool at them ([#1167](https://github.com/Twigpine/zero/issues/1167)) ([1641506](https://github.com/Twigpine/zero/commit/164150633a8b2e6ae864ae02fd7105b201eeb68e))
-
-
-### Bug Fixes
-
-* **agent:** mark headless guardrail stops incomplete ([#1182](https://github.com/Twigpine/zero/issues/1182)) ([5aa54fe](https://github.com/Twigpine/zero/commit/5aa54fe1d2b419c9bbef73605a77919c9007cf7b))
-* bump Go to 1.26.10 for GO-2026-6809 ([#1168](https://github.com/Twigpine/zero/issues/1168)) ([6393a90](https://github.com/Twigpine/zero/commit/6393a90ed618a3536e09c02852f4ec829b97545b))
-* **chatgpt:** refresh subscription defaults and compatibility version ([#1179](https://github.com/Twigpine/zero/issues/1179)) ([f912f80](https://github.com/Twigpine/zero/commit/f912f80d002602e11ba0ef8548ecee58442874aa))
-* **deps:** refresh the lockfile to hono 4.13.13 ([#1171](https://github.com/Twigpine/zero/issues/1171)) ([de1443b](https://github.com/Twigpine/zero/commit/de1443b2edb44fd3747cc77200d54dc8cffcd0a7))
-* **oauth:** reuse the crash-safe secret store and sync encrypted publications ([#1165](https://github.com/Twigpine/zero/issues/1165)) ([84c1b15](https://github.com/Twigpine/zero/commit/84c1b1554076679a342e9cac61f8f8cdbaf3a429))
-* **redaction:** redact credentials whose trigger a greedy span swallowed ([#1158](https://github.com/Twigpine/zero/issues/1158)) ([a97db88](https://github.com/Twigpine/zero/commit/a97db8832fdba077f2d31bdf03ecef8d7c774fe1))
-* **sessions:** capture freeform apply_patch checkpoints ([#1183](https://github.com/Twigpine/zero/issues/1183)) ([6396208](https://github.com/Twigpine/zero/commit/63962081cf130c2171407936ce3beb7021d238b8))
-* **sessions:** preserve image attachment summaries on resume ([#1152](https://github.com/Twigpine/zero/issues/1152)) ([1e84849](https://github.com/Twigpine/zero/commit/1e848492e5c1919d187fb5e1eb5e7ef9bc6140dc)), closes [#1135](https://github.com/Twigpine/zero/issues/1135)
-* **tools:** grep stops where a file's line breaks stop ([#1160](https://github.com/Twigpine/zero/issues/1160)) ([aa9ba84](https://github.com/Twigpine/zero/commit/aa9ba8412eb8917daa2ca5cb3fdbd0a39276fa88))
-* **workspaceindex:** import gitsafe under the Twigpine module path ([#1153](https://github.com/Twigpine/zero/issues/1153)) ([ef4da13](https://github.com/Twigpine/zero/commit/ef4da1323f1097863ae278224b5f304c2fff909a))
-* **workspaceindex:** run Scan's git calls through gitsafe ([#1149](https://github.com/Twigpine/zero/issues/1149)) ([2ffe183](https://github.com/Twigpine/zero/commit/2ffe1831b0950b1463ec46d487d03a5fcb679cc6))
-
-## [0.11.0](https://github.com/Twigpine/zero/compare/v0.10.0...v0.11.0) (2026-10-15)
-
-
-### Features
-
-* **providers:** add Concentrate provider preset ([#1147](https://github.com/Twigpine/zero/issues/1147)) ([61b0936](https://github.com/Twigpine/zero/commit/61b09364f0f45b0fa8aebaf0a6c3d1c55dbe01c3))
-
-
-### Bug Fixes
-
-* **cli:** let providers subcommands run with no active provider ([#1143](https://github.com/Twigpine/zero/issues/1143)) ([d1a0d04](https://github.com/Twigpine/zero/commit/d1a0d048ee2c1e7cbfb75160ec4c9f099f3c4472))
-* **npm:** wait for npm to apply each publish, and drop the one-time @gitlawb/zero steps ([#1145](https://github.com/Twigpine/zero/issues/1145)) ([8e363fc](https://github.com/Twigpine/zero/commit/8e363fcaa5d51bf5b5b244692dc61bf8d4ae8799))
-* **tui,cli:** stop a repository's git config from running programs in Zero's own git calls ([#1133](https://github.com/Twigpine/zero/issues/1133)) ([640d936](https://github.com/Twigpine/zero/commit/640d936bfbe00c4cd3017ca35fb7b5c15d91a1c5))
-* **workspaceindex:** skip git-ignored and build-cache dirs in Scan only ([#1117](https://github.com/Twigpine/zero/issues/1117)) ([c88c77b](https://github.com/Twigpine/zero/commit/c88c77bf701039dca01d9786bf5648d779c949b3))
-
-
-### Performance Improvements
-
-* **redaction:** add fast-path byte checks to eliminate regex allocations on clean strings ([#945](https://github.com/Twigpine/zero/issues/945)) ([ce2fcff](https://github.com/Twigpine/zero/commit/ce2fcffaf10d8e8c8c5a13e06fd7809f09fc9867))
-
-## [0.10.0](https://github.com/Twigpine/zero/compare/v0.9.0...v0.10.0) (2026-10-15)
-
-
-### Features
-
-* **notify:** make permission-prompt alerts on by default and discoverable ([#1001](https://github.com/Twigpine/zero/issues/1001)) ([7f8e5f0](https://github.com/Twigpine/zero/commit/7f8e5f08bb83371ce16cc54c97ab032a010026cf))
-* **npm:** publish as @twigpine/zero ([#1142](https://github.com/Twigpine/zero/issues/1142)) ([530563a](https://github.com/Twigpine/zero/commit/530563a0bb58d3cbadceb97b3ee234ef763124df))
-* **providers:** add GMI Cloud provider preset and partner listing ([#1127](https://github.com/Twigpine/zero/issues/1127)) ([1335ca6](https://github.com/Twigpine/zero/commit/1335ca6671023ecda81a3cfaae7e9f2ff5d6e0de))
-* **providers:** opt-in ZERO_RESPONSE_HEADER_TIMEOUT override for slow first-byte deployments ([#1106](https://github.com/Twigpine/zero/issues/1106)) ([ddc45f2](https://github.com/Twigpine/zero/commit/ddc45f2c8152fdd04b45dc11ed20d246fe7740a5))
-* **runtime:** add process-local per-model RPM admission limits ([#1116](https://github.com/Twigpine/zero/issues/1116)) ([eebb384](https://github.com/Twigpine/zero/commit/eebb384676fb567acc1f5a20dcbb17df8a03dc42))
-* **sessions:** add zero sessions prune, which never removes a session another process has open ([#1089](https://github.com/Twigpine/zero/issues/1089)) ([23c27e0](https://github.com/Twigpine/zero/commit/23c27e0778e3af54c04b8749d1eda846d3253f4e))
-
-
-### Bug Fixes
-
-* **acp:** persist the session permission mode across restarts ([#1134](https://github.com/Twigpine/zero/issues/1134)) ([bb96206](https://github.com/Twigpine/zero/commit/bb96206c2781e846fd13437113eec5790afe9c81)), closes [#1125](https://github.com/Twigpine/zero/issues/1125)
-* **acp:** persist token usage events for ACP sessions ([#1137](https://github.com/Twigpine/zero/issues/1137)) ([300cf62](https://github.com/Twigpine/zero/commit/300cf6275f8c94f06da3f00197d21cb8771842d9)), closes [#1118](https://github.com/Twigpine/zero/issues/1118)
-* **acp:** publish sub-run sessions loaded over ACP as view-only ([#1078](https://github.com/Twigpine/zero/issues/1078)) ([7f11491](https://github.com/Twigpine/zero/commit/7f11491078662b2d389c278f3ce5d41d956670c4))
-* **agent:** retry mid-stream transport aborts before tool dispatch ([#1076](https://github.com/Twigpine/zero/issues/1076)) ([b9ef1d2](https://github.com/Twigpine/zero/commit/b9ef1d271aa6ebc6d9adad2ef4ff0d695bb40da5))
-* **config:** sync atomic config replacements ([#1093](https://github.com/Twigpine/zero/issues/1093)) ([4d2e9f0](https://github.com/Twigpine/zero/commit/4d2e9f0d08472f7304652ef7896df587e1cc6c21))
-* **cron:** bound run history and read recent records from the tail ([#1094](https://github.com/Twigpine/zero/issues/1094)) ([42eb6ab](https://github.com/Twigpine/zero/commit/42eb6ab5fbe4ae9037f1f4cd42a00243c456a22e))
-* **cron:** preserve newer claims when overlapping runs complete ([#1090](https://github.com/Twigpine/zero/issues/1090)) ([2eb9d94](https://github.com/Twigpine/zero/commit/2eb9d94fac56d91d749ea4f96edcf1c87f79b48c))
-* **daemon:** bound pending sessions and prune on completion ([#1091](https://github.com/Twigpine/zero/issues/1091)) ([8a68660](https://github.com/Twigpine/zero/commit/8a68660161b04ce9668363faa14ff72c9fbad223))
-* **daemon:** do not retry workers that finished with a final exit code ([#1112](https://github.com/Twigpine/zero/issues/1112)) ([eefa978](https://github.com/Twigpine/zero/commit/eefa978f6183332b7416c70c25242bcdfba1a75c)), closes [#1100](https://github.com/Twigpine/zero/issues/1100)
-* **daemon:** stop worker process groups by their launch-time identity ([#1088](https://github.com/Twigpine/zero/issues/1088)) ([ab018b3](https://github.com/Twigpine/zero/commit/ab018b3098b5cb103cf8f90b8698d32a6687bdf7)), closes [#861](https://github.com/Twigpine/zero/issues/861)
-* **deps:** refresh the lockfile to patched hono and @hono/node-server ([#1080](https://github.com/Twigpine/zero/issues/1080)) ([aa52040](https://github.com/Twigpine/zero/commit/aa52040498e012c41d5e8f6027a91c18eff861d4))
-* **deps:** refresh the lockfile to patched shell-quote ([#1131](https://github.com/Twigpine/zero/issues/1131)) ([c56a4c4](https://github.com/Twigpine/zero/commit/c56a4c4e6e598504ab417e8cc4f5ab8d69f1b42f))
-* **execution:** reserve process capacity before launching ([#1092](https://github.com/Twigpine/zero/issues/1092)) ([bb3346a](https://github.com/Twigpine/zero/commit/bb3346a82883c19ed8815fe1e874f54950711d69))
-* **mcp:** forward image tool results on the existing image channel ([#1077](https://github.com/Twigpine/zero/issues/1077)) ([0324c1d](https://github.com/Twigpine/zero/commit/0324c1d4103328eb90cb24a0b582dba335255b5c))
-* **mcp:** refresh OAuth tokens for discovered endpoints and registered clients ([#1113](https://github.com/Twigpine/zero/issues/1113)) ([571af70](https://github.com/Twigpine/zero/commit/571af701bd3d8dfaf40f87b5b112b25e7def5b29)), closes [#1101](https://github.com/Twigpine/zero/issues/1101)
-* **oauth:** give every loopback callback server the bounded shutdown ([#1079](https://github.com/Twigpine/zero/issues/1079)) ([5473301](https://github.com/Twigpine/zero/commit/547330197b20ece591e077e876a4b8ffd015cb6e))
-* **providers:** send stable session headers to OpenCode ([#1060](https://github.com/Twigpine/zero/issues/1060)) ([99721c7](https://github.com/Twigpine/zero/commit/99721c762f37cd43ac511007a5f51d1846df959e))
-* **redaction:** redact adjacent AWS keys glued end to end ([#1095](https://github.com/Twigpine/zero/issues/1095)) ([df67ede](https://github.com/Twigpine/zero/commit/df67edec13345b73a85327adc003cacc7bdd8009))
-* **redaction:** redact credentials split by an invisible character ([#1067](https://github.com/Twigpine/zero/issues/1067)) ([e20b762](https://github.com/Twigpine/zero/commit/e20b7624261cef8336a8eb0fbdd44d536ad77fc2))
-* **sandbox:** say when a session's sandbox enforcement is degraded ([#1082](https://github.com/Twigpine/zero/issues/1082)) ([6b5852d](https://github.com/Twigpine/zero/commit/6b5852dc18bb256af1f25745697c2f2e3ea6f112))
-* **search:** redact every text field of session metadata, not ten of thirty ([#1073](https://github.com/Twigpine/zero/issues/1073)) ([9520f2b](https://github.com/Twigpine/zero/commit/9520f2bad7e09ce4a8d0d42be7ce77d2ae928ddd))
-* **security:** harden shell flag parsing, write roots, and formatters ([#1066](https://github.com/Twigpine/zero/issues/1066)) ([ac5fe0d](https://github.com/Twigpine/zero/commit/ac5fe0d21849b0f74af428dd3ca12e3b80a8b7aa))
-* **sessions:** keep a session lease for the life of the process, not of the Store ([#1144](https://github.com/Twigpine/zero/issues/1144)) ([883e5be](https://github.com/Twigpine/zero/commit/883e5bec24dac791d1d60618c7f4927f4659b687))
-* **tools:** hint when Windows resolves POSIX paths under root ([#1063](https://github.com/Twigpine/zero/issues/1063)) ([0c6f179](https://github.com/Twigpine/zero/commit/0c6f179a8443d4dfdfbbefe5cc6caf11c2a525f0))
-* **tui:** bound live dictation regions ([#985](https://github.com/Twigpine/zero/issues/985)) ([feb9927](https://github.com/Twigpine/zero/commit/feb992757c582c68f0397e070e206d4bf07071e1))
-* **tui:** show provider ownership in Recent and Favorites ([#1083](https://github.com/Twigpine/zero/issues/1083)) ([1697b7a](https://github.com/Twigpine/zero/commit/1697b7a5ce948e781877cdbe9223adac62c3fde6))
-* **tui:** stop held peer message Allow/Deny from deadlocking Update ([#1111](https://github.com/Twigpine/zero/issues/1111)) ([a195e88](https://github.com/Twigpine/zero/commit/a195e8848cec1a27b4fe1789ecc572b943c32186)), closes [#1099](https://github.com/Twigpine/zero/issues/1099)
-* unbreak main CI (cron claim tests, Go 1.26.9) ([#1124](https://github.com/Twigpine/zero/issues/1124)) ([2c418fc](https://github.com/Twigpine/zero/commit/2c418fc8ff6763de16703128f372fe526fddd331))
-
-## [0.9.0](https://github.com/Gitlawb/zero/compare/v0.8.0...v0.9.0) (2026-09-15)
-
-
-### Features
-
-* **acp:** add standard session list and resume ([#914](https://github.com/Gitlawb/zero/issues/914)) ([c1937df](https://github.com/Gitlawb/zero/commit/c1937dfac72e6ad0e5ade6e48e2d9c17d9c3e5d6))
-* **acp:** emit structured file changes in tool updates ([#999](https://github.com/Gitlawb/zero/issues/999)) ([faec8ee](https://github.com/Gitlawb/zero/commit/faec8ee2017fdd6d0c2c347add892cb73eb413d7))
-* **acp:** surface safe browser tool metadata ([#1000](https://github.com/Gitlawb/zero/issues/1000)) ([a6ec043](https://github.com/Gitlawb/zero/commit/a6ec0435e36b9bea9793b2fd97f2ecd30e3a0f9b))
-* **exec:** default headless runs to the turn-budget ceiling ([#1049](https://github.com/Gitlawb/zero/issues/1049)) ([9e609c5](https://github.com/Gitlawb/zero/commit/9e609c52420fd322f047fc238c04ac81dd623fdd))
-* **tui:** interactive terminal attach for tty exec sessions ([#1055](https://github.com/Gitlawb/zero/issues/1055)) ([d73ec81](https://github.com/Gitlawb/zero/commit/d73ec81e2d3facb5377bc9ad0fe2aa314628a0c0))
-* **tui:** offer mid-run model escalation behind --allow-escalation ([#1019](https://github.com/Gitlawb/zero/issues/1019)) ([91d921f](https://github.com/Gitlawb/zero/commit/91d921f4c5b8289a9e437f786218f1b48f2add5a))
-* **tui:** richer /resume session browser ([#1047](https://github.com/Gitlawb/zero/issues/1047)) ([2f53117](https://github.com/Gitlawb/zero/commit/2f531178f614e587b629e4f81e0470adda647fbd))
-
-
-### Bug Fixes
-
-* **acp:** make configured MCP tools callable ([#1003](https://github.com/Gitlawb/zero/issues/1003)) ([7f5e5af](https://github.com/Gitlawb/zero/commit/7f5e5af7bbdbe5bb4d91706146072d461c0234a4))
-* **agent:** stop the tool-schema ratchet meaning a different thing per host ([#1017](https://github.com/Gitlawb/zero/issues/1017)) ([f909266](https://github.com/Gitlawb/zero/commit/f9092668a832ea73a69551f0ea2df4f6eaf356df))
-* **background:** treat POSIX zombie leader as already-exited ([#981](https://github.com/Gitlawb/zero/issues/981)) ([1aacf38](https://github.com/Gitlawb/zero/commit/1aacf38b727d31b5ca09949316d6afa8292aec46))
-* **config:** lock config read-modify-write across processes ([#960](https://github.com/Gitlawb/zero/issues/960)) ([b04fe96](https://github.com/Gitlawb/zero/commit/b04fe96e9ef3f2deda4fb2a972270300629079d2))
-* **config:** preserve unknown top-level fields ([#984](https://github.com/Gitlawb/zero/issues/984)) ([488def6](https://github.com/Gitlawb/zero/commit/488def68dcc6d36701fdf171e94a74a436b090fc))
-* **daemon:** publish status files atomically ([#949](https://github.com/Gitlawb/zero/issues/949)) ([9001421](https://github.com/Gitlawb/zero/commit/90014210d2ada2e3d61f4eca5087d3f35a3c4b8b))
-* **installtxn:** put back an install a killed commit left behind ([#997](https://github.com/Gitlawb/zero/issues/997)) ([2837f5e](https://github.com/Gitlawb/zero/commit/2837f5efb38dcd3c69771b0ba31565f98a206120))
-* let the configured forward proxy through the loopback guard ([#1025](https://github.com/Gitlawb/zero/issues/1025)) ([1e4db7c](https://github.com/Gitlawb/zero/commit/1e4db7c6643ca7e2c3d8e4b8b30371cfbe43561e))
-* **lockutil:** use kernel-held advisory locks ([#950](https://github.com/Gitlawb/zero/issues/950)) ([6fe0d1e](https://github.com/Gitlawb/zero/commit/6fe0d1edcdbadea6d566800fbcca739c1cd54ea1))
-* **mcp:** discover OAuth through protected resource metadata ([#991](https://github.com/Gitlawb/zero/issues/991)) ([1b5db17](https://github.com/Gitlawb/zero/commit/1b5db1765672820caac1684b168c9898b5ba3593))
-* **mcp:** reject a server-initiated request as a streamable-HTTP response ([#1054](https://github.com/Gitlawb/zero/issues/1054)) ([2479d94](https://github.com/Gitlawb/zero/commit/2479d946c15dbf74ee3c04a637e97181d1786f08))
-* **oauth:** force-close loopback callback connections past the shutdown deadline ([#1051](https://github.com/Gitlawb/zero/issues/1051)) ([176f5a2](https://github.com/Gitlawb/zero/commit/176f5a242b754a86ea4c7121a8dcc1c0d72cf2e4))
-* **oauth:** Split an oversized keyring token blob across entries ([#1007](https://github.com/Gitlawb/zero/issues/1007)) ([275e248](https://github.com/Gitlawb/zero/commit/275e2486695338ce38193a6e3319f8b6a9a5c33c))
-* **providerio:** close idle connections periodically to prevent HTTP/2 PROTOCOL_ERROR ([#1058](https://github.com/Gitlawb/zero/issues/1058)) ([b76c764](https://github.com/Gitlawb/zero/commit/b76c764b77926891aa67163e6605a2d8540aacaa))
-* **providers:** register Atomic Chat as local OpenAI-compatible runtime ([#550](https://github.com/Gitlawb/zero/issues/550)) ([79fa142](https://github.com/Gitlawb/zero/commit/79fa1422ef1a3691b93342788453ebc284d57f9c))
-* **redaction:** split camelCase keys in normalizeKey ([#994](https://github.com/Gitlawb/zero/issues/994)) ([08fbea7](https://github.com/Gitlawb/zero/commit/08fbea7a3221d2061d88038924f90a4cba9af1ac))
-* **sandbox:** keep a derived ACL target inside the write root it came from ([#1040](https://github.com/Gitlawb/zero/issues/1040)) ([3b43c43](https://github.com/Gitlawb/zero/commit/3b43c43eca968c8619adadc81fcc1a17e220216a))
-* **sandbox:** keep Windows restricted-token SIDs narrow and fail closed on DenyRead ([#1006](https://github.com/Gitlawb/zero/issues/1006)) ([0207f2b](https://github.com/Gitlawb/zero/commit/0207f2b2697149a73ecc89a5ab5db0bd665f1911))
-* **sandbox:** Make WSL backend tests deterministic. ([#948](https://github.com/Gitlawb/zero/issues/948)) ([e59bf78](https://github.com/Gitlawb/zero/commit/e59bf78cabc2703678778b904c27c8bc8ef82bc8))
-* **sandbox:** protect worktree git pointers ([#805](https://github.com/Gitlawb/zero/issues/805)) ([f30f550](https://github.com/Gitlawb/zero/commit/f30f550e6037c53f8521ba2d59c984ae6c574917))
-* **sandbox:** refcount temporary roots so one holder's cleanup cannot revoke another's ([#911](https://github.com/Gitlawb/zero/issues/911)) ([7acac7a](https://github.com/Gitlawb/zero/commit/7acac7acee65565e25089f2a7b5813c086ce65eb))
-* **sessions:** carry an interrupted turn's work into the resume prompt ([#1016](https://github.com/Gitlawb/zero/issues/1016)) ([6ae8396](https://github.com/Gitlawb/zero/commit/6ae8396f0282a5f18a431f0c0ef1a272ecc2ca2b))
-* **sessions:** render resume context fields in key order ([#1043](https://github.com/Gitlawb/zero/issues/1043)) ([da244bc](https://github.com/Gitlawb/zero/commit/da244bcbfcfa05e414567ac0acc3cf8ba745ad7d))
-* **specialist:** keep the pinned model when a specialist is resumed ([#1009](https://github.com/Gitlawb/zero/issues/1009)) ([aadb4a2](https://github.com/Gitlawb/zero/commit/aadb4a27e9cdb41e774e8e1a8f23cf9c2fb50db2))
-* **swarm:** stop original member before handoff ([#957](https://github.com/Gitlawb/zero/issues/957)) ([0021475](https://github.com/Gitlawb/zero/commit/0021475d4c58c91911098f414795512cf60a0b56))
-* **tools:** an edit keeps the reads it did not disturb ([#908](https://github.com/Gitlawb/zero/issues/908)) ([1649008](https://github.com/Gitlawb/zero/commit/1649008506da0e675431dc056251a01891b15cc8))
-* **tools:** make apply_patch tolerant and re-expose edit_file ([#956](https://github.com/Gitlawb/zero/issues/956)) ([2749447](https://github.com/Gitlawb/zero/commit/2749447cdce4ae5dd333538b36fa919b80ecc66d))
-* **tools:** reject fuzzy edits with drifted content ([#983](https://github.com/Gitlawb/zero/issues/983)) ([8b3d1b1](https://github.com/Gitlawb/zero/commit/8b3d1b1597b04bfa6d4bc7f912abc13ca80a6298))
-* **tools:** say when format-on-write ran out of time ([#1044](https://github.com/Gitlawb/zero/issues/1044)) ([6937a30](https://github.com/Gitlawb/zero/commit/6937a309cf00825572210a7610a1f3ea8b74c2f9))
-* **tui:** move voice capture to Ctrl+Space ([#968](https://github.com/Gitlawb/zero/issues/968)) ([eeea330](https://github.com/Gitlawb/zero/commit/eeea3308fed38b37b203522624babaf2f30df91f))
-* **update:** keep Windows failed-restore state in trusted recovery records ([#979](https://github.com/Gitlawb/zero/issues/979)) ([a3852ba](https://github.com/Gitlawb/zero/commit/a3852bac595e06c5d3ca9da22212b281b8796802))
-
-
-### Performance Improvements
-
-* **agent:** cheap compaction — dedicated summarizer model, input cap… ([#532](https://github.com/Gitlawb/zero/issues/532)) ([6645f97](https://github.com/Gitlawb/zero/commit/6645f9744b37dda4d52ecc4631578d62cefc89de))
-* **providers:** parallelize isolated provider unit tests and shrink retry backoffs ([#955](https://github.com/Gitlawb/zero/issues/955)) ([d6b25fc](https://github.com/Gitlawb/zero/commit/d6b25fc3039a6b7d72a5703a87a097449792b102))
-* reduce startup and turn overhead ([#932](https://github.com/Gitlawb/zero/issues/932)) ([1fde941](https://github.com/Gitlawb/zero/commit/1fde941803c4295c11a4a14559f3c5217d1a9e69))
-
-## [0.8.0](https://github.com/Gitlawb/zero/compare/v0.7.0...v0.8.0) (2026-08-21)
-
-
-### Features
-
-* **security:** path-jail primitive, credential-store locking, worktree git hardening ([#891](https://github.com/Gitlawb/zero/issues/891)) ([060d38c](https://github.com/Gitlawb/zero/commit/060d38ce716feb7c5b6657b082cd35cb8dda3d75))
-* **update:** recognise Homebrew installs and add mise, go install docs ([#910](https://github.com/Gitlawb/zero/issues/910)) ([01c3498](https://github.com/Gitlawb/zero/commit/01c3498205e69d26e5f929225f9455b276444f39))
-* use Exa as default search provider ([#926](https://github.com/Gitlawb/zero/issues/926)) ([1ec7219](https://github.com/Gitlawb/zero/commit/1ec7219aee7b2840481ab0905f131644e27d2a4e))
-* **zerogit:** auto-create a conventional branch before push/pr on default branch ([#671](https://github.com/Gitlawb/zero/issues/671)) ([d065467](https://github.com/Gitlawb/zero/commit/d065467cd3ec3ed91c5dc60554c36fc4b4d6de4c))
-
-
-### Bug Fixes
-
-* **acp:** three defects a desktop ACP client hits ([#915](https://github.com/Gitlawb/zero/issues/915)) ([a78c6c3](https://github.com/Gitlawb/zero/commit/a78c6c357e1d21146d7cd2e8030a754e06f7f1f5))
-* bump Go to 1.26.6 for stdlib vulnerability fixes ([#903](https://github.com/Gitlawb/zero/issues/903)) ([dc15e82](https://github.com/Gitlawb/zero/commit/dc15e822987d8d7de467c62c375518f435b74d8c))
-* **daemon:** clean up child after startup timeout ([#774](https://github.com/Gitlawb/zero/issues/774)) ([9c29209](https://github.com/Gitlawb/zero/commit/9c292092a26c9092fd873d072b0af1b0d9d39ef0))
-* **dictation:** redact API keys from streaming transcriber errors ([#852](https://github.com/Gitlawb/zero/issues/852)) ([64a783b](https://github.com/Gitlawb/zero/commit/64a783b08caa2c7b21f188033b9ed84a14e00e84))
-* **modelregistry:** expose reasoning effort for DeepSeek V4 models ([#931](https://github.com/Gitlawb/zero/issues/931)) ([90dcfd1](https://github.com/Gitlawb/zero/commit/90dcfd127e8a6d9902ec9f4e72f6d03fef1a0fc6))
-* **providers:** discover ChatGPT capabilities ([#890](https://github.com/Gitlawb/zero/issues/890)) ([2d2450e](https://github.com/Gitlawb/zero/commit/2d2450e9a744349f0d01b1d4e9ba29c24ba5650d))
-* **sandbox:** normalize launcher names before the command-prefix denylist ([#934](https://github.com/Gitlawb/zero/issues/934)) ([6edf9a8](https://github.com/Gitlawb/zero/commit/6edf9a8b78dc030dc44598919db1c7fa9d4f809a))
-
-## [0.7.0](https://github.com/Gitlawb/zero/compare/v0.6.0...v0.7.0) (2026-08-10)
-
-
-### Features
-
-* **agent:** add PermissionModePlan for interactive read-only planning ([#853](https://github.com/Gitlawb/zero/issues/853)) ([0176ee4](https://github.com/Gitlawb/zero/commit/0176ee49ffddcff6f7edf6ae2ade4967e5b22cc3))
-* **providers:** live model lists for OpenRouter and OpenGateway ([#860](https://github.com/Gitlawb/zero/issues/860)) ([fb4f293](https://github.com/Gitlawb/zero/commit/fb4f293c20eb860ca388a10d22fd566ce282ba1f))
-* **tools:** give tool results an image channel and add view_image ([#843](https://github.com/Gitlawb/zero/issues/843)) ([cd0eb19](https://github.com/Gitlawb/zero/commit/cd0eb194e4df4b844785796c0701216740a56344))
-* **tui:** replace /retitle with local /rename ([#826](https://github.com/Gitlawb/zero/issues/826)) ([5886354](https://github.com/Gitlawb/zero/commit/588635487f22ef4d62d350140a219b7b8bb24119))
-
-
-### Bug Fixes
-
-* **agent:** end the additional_permissions retry loop ([#864](https://github.com/Gitlawb/zero/issues/864)) ([4ca4fa7](https://github.com/Gitlawb/zero/commit/4ca4fa75d31b139dbe55a3badf17da86892ab001))
-* **agent:** tell the user a prefix approval leaves the sandbox ([#885](https://github.com/Gitlawb/zero/issues/885)) ([2ec5c3a](https://github.com/Gitlawb/zero/commit/2ec5c3ae6b8fb543887bdeafdb34c4da057b8d36))
-* **cli:** report MCP servers that failed to start ([#822](https://github.com/Gitlawb/zero/issues/822)) ([#827](https://github.com/Gitlawb/zero/issues/827)) ([021281e](https://github.com/Gitlawb/zero/commit/021281ebbab3f2bbe6a77b2dab4bf121bcfe6b52))
-* **lsp:** dispatch notifications off read loop ([#759](https://github.com/Gitlawb/zero/issues/759)) ([936aa4e](https://github.com/Gitlawb/zero/commit/936aa4e77cf49738560a89395b8ba4d22263a396))
-* **mcp:** name the non-text blocks a tool result drops ([#874](https://github.com/Gitlawb/zero/issues/874)) ([027a670](https://github.com/Gitlawb/zero/commit/027a67080bea511b876c284bc911ef011eceb308))
-* **sandbox:** deny reads of Zero credential stores ([#681](https://github.com/Gitlawb/zero/issues/681)) ([55fa05f](https://github.com/Gitlawb/zero/commit/55fa05f0ab5a01b495345d43464606cd19a31b4f))
-* **sandbox:** stop the Windows write jail honouring Everyone-granted paths ([#865](https://github.com/Gitlawb/zero/issues/865)) ([91b413c](https://github.com/Gitlawb/zero/commit/91b413c514cc1607d5b4e7936780d40569239814))
-* **secrets,worktrees:** fix secret redaction leakage and prune stale worktrees ([#855](https://github.com/Gitlawb/zero/issues/855)) ([ff62f73](https://github.com/Gitlawb/zero/commit/ff62f73b7f4dc5e2472db21acba43cf6140c06d1))
-* **specialist:** make overwrites atomic ([#757](https://github.com/Gitlawb/zero/issues/757)) ([30f6d8f](https://github.com/Gitlawb/zero/commit/30f6d8f591a0b81638b4182ff56c86c8a50a5c70))
-* suppress gosec G204 warning for trusted local config commands ([#848](https://github.com/Gitlawb/zero/issues/848)) ([c52db05](https://github.com/Gitlawb/zero/commit/c52db055b0b213758a33c5c5627a411e052f8de4))
-* **tui:** a copied NUL byte no longer panics the TUI on Windows ([#876](https://github.com/Gitlawb/zero/issues/876)) ([cae0269](https://github.com/Gitlawb/zero/commit/cae0269e77e7a0a493cf799b41c653c9ff9a19de)), closes [#875](https://github.com/Gitlawb/zero/issues/875)
-* **tui:** exclude permission waits from turn time ([#820](https://github.com/Gitlawb/zero/issues/820)) ([15eb16f](https://github.com/Gitlawb/zero/commit/15eb16f736f903c94203207032f98aacbcf06318))
-* **tui:** fall back to CellMotion where AllMotion is unreliable ([#872](https://github.com/Gitlawb/zero/issues/872)) ([7fbd864](https://github.com/Gitlawb/zero/commit/7fbd864e91433441489902571ea394ebc5b7bd0d))
-* **tui:** fill alt-screen frame with theme panel background ([#850](https://github.com/Gitlawb/zero/issues/850)) ([020c28e](https://github.com/Gitlawb/zero/commit/020c28eaf95e2f38853f99fc06a13cd1568bf3c9))
-* **tui:** hide unavailable sidebar shortcut ([#821](https://github.com/Gitlawb/zero/issues/821)) ([845df6c](https://github.com/Gitlawb/zero/commit/845df6c7d28e02f475e90acfe838733eb37e6aa2))
-* use OAuth credentials in provider health checks ([#828](https://github.com/Gitlawb/zero/issues/828)) ([d37de92](https://github.com/Gitlawb/zero/commit/d37de9214b1ba86542f4f5ef3b060bb96849763b))
-
-
-### Performance Improvements
-
-* compact common test output ([#846](https://github.com/Gitlawb/zero/issues/846)) ([edf660a](https://github.com/Gitlawb/zero/commit/edf660ab85131f90a452cee51dc2c3a5cf62d632))
-* improve harness context efficiency ([#838](https://github.com/Gitlawb/zero/issues/838)) ([8e26679](https://github.com/Gitlawb/zero/commit/8e266797a8305e689806eadcf9698da2796481ab))
-
-## [0.6.0](https://github.com/Gitlawb/zero/compare/v0.5.0...v0.6.0) (2026-07-29)
-
-
-### Features
-
-* add persistent session goals ([#803](https://github.com/Gitlawb/zero/issues/803)) ([5d1869e](https://github.com/Gitlawb/zero/commit/5d1869e7bc193c97e07418b57b823905c1151d5d))
-* **providers:** add Fireworks AI provider preset ([#772](https://github.com/Gitlawb/zero/issues/772)) ([58daea7](https://github.com/Gitlawb/zero/commit/58daea7a482927e5ab35afaf97761c60bb35e113))
-* **skills:** report hash drift in skill info ([#795](https://github.com/Gitlawb/zero/issues/795)) ([9fbdc34](https://github.com/Gitlawb/zero/commit/9fbdc341551601c13434cf7b9b6f5e4ea4c483b1))
-
-
-### Bug Fixes
-
-* **acp:** interrupt idle reads on cancellation ([#782](https://github.com/Gitlawb/zero/issues/782)) ([15b7a54](https://github.com/Gitlawb/zero/commit/15b7a5475cfeefddbc59634551451a8872b996b7))
-* **cli:** include plugins info in shell completions ([#794](https://github.com/Gitlawb/zero/issues/794)) ([fa8734f](https://github.com/Gitlawb/zero/commit/fa8734f17927de8832dfe041e043cfb86f93d12a))
-* **config:** kill provider-command process tree via job object on Windows ([#690](https://github.com/Gitlawb/zero/issues/690)) ([5c58256](https://github.com/Gitlawb/zero/commit/5c58256abc29c185b449f8ce79647eb3fae61882))
-* **config:** make the provider-command timeout an upper bound ([#811](https://github.com/Gitlawb/zero/issues/811)) ([#813](https://github.com/Gitlawb/zero/issues/813)) ([1c38e8c](https://github.com/Gitlawb/zero/commit/1c38e8cba50db255f3cda8b7cf4298712b2933e1))
-* **config:** stop billing provider-command fixtures to the 5s timeout ([#810](https://github.com/Gitlawb/zero/issues/810)) ([f5fa4ff](https://github.com/Gitlawb/zero/commit/f5fa4ffc64537897aa78a56edca36d8f1dacd021))
-* **cron:** reserve job IDs atomically ([#686](https://github.com/Gitlawb/zero/issues/686)) ([d9b882e](https://github.com/Gitlawb/zero/commit/d9b882eb0a94f38de8447cb54b57860ccd8ed053))
-* **lint:** resolve static analysis baseline ([#769](https://github.com/Gitlawb/zero/issues/769)) ([583e653](https://github.com/Gitlawb/zero/commit/583e6530bd849a8efcb2b88bbe8c297e8592e62c))
-* **providers:** retry provably pre-send transport failures ([#447](https://github.com/Gitlawb/zero/issues/447)) ([#750](https://github.com/Gitlawb/zero/issues/750)) ([8acd42a](https://github.com/Gitlawb/zero/commit/8acd42a3bd743a35807d762f23a33fb61c171839))
-* **sandbox:** add platform-specific write lock around grant state file ([#752](https://github.com/Gitlawb/zero/issues/752)) ([#755](https://github.com/Gitlawb/zero/issues/755)) ([88fb7b6](https://github.com/Gitlawb/zero/commit/88fb7b6192c1ac8173089967d5e9119f92d7a101))
-* **sandbox:** clarify scoped permission prompts ([#798](https://github.com/Gitlawb/zero/issues/798)) ([9fe02ae](https://github.com/Gitlawb/zero/commit/9fe02ae52e3234cb9dae76e0c5594a287ccbb52a))
-* **sandbox:** deny reads of git's credential stores ([#815](https://github.com/Gitlawb/zero/issues/815)) ([#816](https://github.com/Gitlawb/zero/issues/816)) ([33c94ec](https://github.com/Gitlawb/zero/commit/33c94ec7a3e7987e6e36b5fd5e037ff4e6e84c26))
-* **sandbox:** preserve user config and retry denied writes ([#801](https://github.com/Gitlawb/zero/issues/801)) ([81a5e6c](https://github.com/Gitlawb/zero/commit/81a5e6cb716ba4b7ecf7ff3ff261dfa51fd01098))
-* **sandbox:** scrub the daemon token file pointer ([#677](https://github.com/Gitlawb/zero/issues/677)) ([#818](https://github.com/Gitlawb/zero/issues/818)) ([3e7692d](https://github.com/Gitlawb/zero/commit/3e7692d8f0885d346809869935c81a9cf055d89e))
-* **swarm:** close lifecycle admission on shutdown ([#776](https://github.com/Gitlawb/zero/issues/776)) ([bdbda89](https://github.com/Gitlawb/zero/commit/bdbda89f3e42d93e8058ab3e1e9ef402659530cd))
-* **tui:** fix rendering corruption over multipass + Windows Terminal ([#709](https://github.com/Gitlawb/zero/issues/709)) ([5bb1bc1](https://github.com/Gitlawb/zero/commit/5bb1bc11c3188dcea7709ff07c8b25dda3541de8))
-* **tui:** paste clipboard images with Ctrl+V ([#534](https://github.com/Gitlawb/zero/issues/534)) ([#807](https://github.com/Gitlawb/zero/issues/807)) ([ec3b822](https://github.com/Gitlawb/zero/commit/ec3b8225050eb62f0f41a9582ed2881d2f9dcc8e))
-* **tui:** reset quiet clock for new runs ([#799](https://github.com/Gitlawb/zero/issues/799)) ([a4a805a](https://github.com/Gitlawb/zero/commit/a4a805a6c82c51cb255e909bd87ca183c8805cf2))
-* **windows:** use PowerShell for command execution ([#804](https://github.com/Gitlawb/zero/issues/804)) ([518d2e5](https://github.com/Gitlawb/zero/commit/518d2e53ba3fa073090a9b41c278face85b59b64))
-
-## [0.5.0](https://github.com/Gitlawb/zero/compare/v0.4.0...v0.5.0) (2026-07-22)
-
-
-### Features
-
-* **plugins:** add zero plugins info command ([#773](https://github.com/Gitlawb/zero/issues/773)) ([2479884](https://github.com/Gitlawb/zero/commit/2479884dea49580c853a53536c3bbab22ce8a2bf))
-* **sandbox:** disable the sandbox via config ([#687](https://github.com/Gitlawb/zero/issues/687)) ([#746](https://github.com/Gitlawb/zero/issues/746)) ([a21a052](https://github.com/Gitlawb/zero/commit/a21a052a4a32ce9cb3c93c94350cd24e138532cd))
-* **sandbox:** unify command execution and enforcement ([#781](https://github.com/Gitlawb/zero/issues/781)) ([96859c9](https://github.com/Gitlawb/zero/commit/96859c9bd16f6dad4e332efc7e68178b9116118a))
-* **tui:** add /undo as an alias for /rewind ([#698](https://github.com/Gitlawb/zero/issues/698)) ([#747](https://github.com/Gitlawb/zero/issues/747)) ([8c6d302](https://github.com/Gitlawb/zero/commit/8c6d3022bd7801eaad6a0440bb21a27221887297))
-* **tui:** add isolated /btw conversations ([#748](https://github.com/Gitlawb/zero/issues/748)) ([2e267bd](https://github.com/Gitlawb/zero/commit/2e267bdbee4a77813e93a7ab51f0c575b66cee8c))
-* **tui:** permission prompt takes free-text feedback inline ([#780](https://github.com/Gitlawb/zero/issues/780)) ([3967d49](https://github.com/Gitlawb/zero/commit/3967d49d64998341af8ef6d7523fc63aeb2a5a7a))
-
-
-### Bug Fixes
-
-* **agent:** stop write_stdin session_id probing thrash ([#702](https://github.com/Gitlawb/zero/issues/702)) ([#749](https://github.com/Gitlawb/zero/issues/749)) ([fbf8598](https://github.com/Gitlawb/zero/commit/fbf85984f679058125951fe2d5e4f200e09a3e2f))
-* **cli:** warn when ZERO_PROVIDER overrides a providers-use selection ([#767](https://github.com/Gitlawb/zero/issues/767)) ([3524f79](https://github.com/Gitlawb/zero/commit/3524f795e5fdbb827166a84f03351cedfc9eba30))
-* **doctor:** detect missing native binary during runtime checks ([#450](https://github.com/Gitlawb/zero/issues/450)) ([7796022](https://github.com/Gitlawb/zero/commit/77960229b839dca856616f846839aa773f2923f7))
-* **lsp:** make the real-gopls check opt-in so a broken gopls can't fail the suite ([#684](https://github.com/Gitlawb/zero/issues/684)) ([#766](https://github.com/Gitlawb/zero/issues/766)) ([b1f4173](https://github.com/Gitlawb/zero/commit/b1f41735a7f6b7928a1875e986a4dca39d106cb9))
-* make extension installs transactional ([#762](https://github.com/Gitlawb/zero/issues/762)) ([baa4be1](https://github.com/Gitlawb/zero/commit/baa4be13ac5321da4e9f53e864dd1cd395481200))
-* **oauth:** refuse redirects on credential POSTs ([#729](https://github.com/Gitlawb/zero/issues/729)) ([#741](https://github.com/Gitlawb/zero/issues/741)) ([974fc03](https://github.com/Gitlawb/zero/commit/974fc036c2f9a194722f2e8fddbb4fdbf797effe))
-* **oauth:** validate discovered endpoints before merge/use ([#511](https://github.com/Gitlawb/zero/issues/511)) ([#739](https://github.com/Gitlawb/zero/issues/739)) ([ce4a996](https://github.com/Gitlawb/zero/commit/ce4a996ffac4482e704f0fd61b3e442398fb2401))
-* **perfbench:** absolutize the bench binary and make errored tasks first-class ([#730](https://github.com/Gitlawb/zero/issues/730)) ([dbd9443](https://github.com/Gitlawb/zero/commit/dbd94430143df6754d68551d1028ad8f15b82f1b))
-* **perfbench:** grant write tools so mutating tasks measure real edits ([#763](https://github.com/Gitlawb/zero/issues/763)) ([e1975c1](https://github.com/Gitlawb/zero/commit/e1975c1b396b3236ed648870230b4f85863b1d03))
-* **perfbench:** keep the stamped answer file out of negative oracle greps ([#737](https://github.com/Gitlawb/zero/issues/737)) ([015452c](https://github.com/Gitlawb/zero/commit/015452c1c98a39eabb021324182094e188a8bd47))
-* **providers:** stop "provider not found" for env-derived profiles ([#716](https://github.com/Gitlawb/zero/issues/716)) ([4cbd144](https://github.com/Gitlawb/zero/commit/4cbd144d11e5cb67bc5fea46f5b294562dac7a1a))
-* **sandbox:** AST second opinion for interactive-command bypasses ([#473](https://github.com/Gitlawb/zero/issues/473)) ([#745](https://github.com/Gitlawb/zero/issues/745)) ([f079b90](https://github.com/Gitlawb/zero/commit/f079b90f82dac7b7ae0864b279dc9094e31a6627))
-* **sandbox:** bind Windows elevated ACL setup to one no-follow handle ([#765](https://github.com/Gitlawb/zero/issues/765)) ([4945684](https://github.com/Gitlawb/zero/commit/4945684fa26aa5994eda59dcabedc817423c535d))
-* **sandbox:** don't auto-allow shell when re-entrancy skips wrapping ([#727](https://github.com/Gitlawb/zero/issues/727)) ([#744](https://github.com/Gitlawb/zero/issues/744)) ([6849011](https://github.com/Gitlawb/zero/commit/684901165d1b7f50a8bb4af31b1c1951e6926a79))
-* **tools:** give write_stdin's invalid-session errors the same recovery guidance ([#749](https://github.com/Gitlawb/zero/issues/749) follow-up) ([#768](https://github.com/Gitlawb/zero/issues/768)) ([da9fb50](https://github.com/Gitlawb/zero/commit/da9fb50f549f6701eb136fc99f6178d0772d9334))
-* **tools:** read_file recovers a backwards line range instead of erroring ([#779](https://github.com/Gitlawb/zero/issues/779)) ([89bdc67](https://github.com/Gitlawb/zero/commit/89bdc6719a1e1b3a3ef0e36b91a7839b3efdfba9))
-* **tui:** cache settled alt-screen transcript ([#647](https://github.com/Gitlawb/zero/issues/647)) ([d74ceb1](https://github.com/Gitlawb/zero/commit/d74ceb11271ed68a21c19248210e098f411805fb))
-* **tui:** model rows labelled by id when the description is prose; keep the sidebar under the / palette ([#775](https://github.com/Gitlawb/zero/issues/775)) ([b30c397](https://github.com/Gitlawb/zero/commit/b30c3971b40b06ba52ad649ba9dc0ad560d4be4c))
-* **tui:** stop the permission card clashing on cool themes ([#778](https://github.com/Gitlawb/zero/issues/778)) ([722bb31](https://github.com/Gitlawb/zero/commit/722bb3121682d9cd9cd4bc6c127e9014d719262a))
-
-
-### Performance Improvements
-
-* **agent:** concurrent read-only tool batches via capability gate ([#715](https://github.com/Gitlawb/zero/issues/715)) ([31d45d5](https://github.com/Gitlawb/zero/commit/31d45d5f14e915acb9946e8b8eb81632c48f126a))
-* **agent:** execution profiles with one-shot posture escalation (PR10b+PR10c) ([#740](https://github.com/Gitlawb/zero/issues/740)) ([378d538](https://github.com/Gitlawb/zero/commit/378d538e240c289e57821e9f9628f76034419d01))
-* **agent:** posture-escalation signals and controller (PR10a) ([#736](https://github.com/Gitlawb/zero/issues/736)) ([af875df](https://github.com/Gitlawb/zero/commit/af875df58775484304fc65586bd6c74552ad01a2))
-* **agent:** preserve prompt cache prefixes ([#760](https://github.com/Gitlawb/zero/issues/760)) ([739a47e](https://github.com/Gitlawb/zero/commit/739a47e3eac92c3decc8734f52a4d99c7480c3ca))
-* **openai:** optimized turn session — background prewarm and prefix telemetry (PR8) ([#723](https://github.com/Gitlawb/zero/issues/723)) ([60dc84e](https://github.com/Gitlawb/zero/commit/60dc84e7a38c5544ebc047f3cfaf4625dd1e83b5))
-* **output:** add token-aware semantic output budgeting (PR11) ([#717](https://github.com/Gitlawb/zero/issues/717)) ([e5670c4](https://github.com/Gitlawb/zero/commit/e5670c427ff39c628fb0822fd5c9317ee2174583))
-* **providers:** provider capabilities and default turn-session adapter (PR7) ([#720](https://github.com/Gitlawb/zero/issues/720)) ([30e2c3f](https://github.com/Gitlawb/zero/commit/30e2c3f7ffa1d5e487bd10b59d4e823cda191d48))
-* **turn-bench:** Phase 0 — strengthen oracles so pass rate can't be misread as correctness ([#712](https://github.com/Gitlawb/zero/issues/712)) ([727ad4d](https://github.com/Gitlawb/zero/commit/727ad4d321fab45d0cf40f8535522e3d94e55c4a))
-
 ## [0.4.0](https://github.com/Gitlawb/zero/compare/v0.3.0...v0.4.0) (2026-07-17)
 
 

CONTRIBUTING.md

@@ -9,9 +9,9 @@ reports, feature requests, reproduction details, logs, and discussion on existin
 issues.
 
 Questions and setup help belong in
-[GitHub Discussions](https://github.com/Twigpine/zero/discussions) (see
+[GitHub Discussions](https://github.com/Gitlawb/zero/discussions) (see
 [SUPPORT.md](SUPPORT.md)), not in the issue tracker. Feature ideas start in the
-[Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) category;
+[Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas) category;
 an idea that gains traction there is the path to an approved issue and,
 eventually, an accepted PR.
 
@@ -41,7 +41,7 @@ There are three primary ways to contribute:
 
 1. Open a bug report with clear reproduction steps.
 2. Propose a feature in
-   [Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
+   [Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
    describing the problem, use case, and expected behavior. A feature-request
    issue is filed only after the idea gains traction there or a maintainer asks
    for one.
@@ -67,28 +67,6 @@ An approved issue means only that the specific issue has been accepted for work.
 It does not approve unrelated future work, future pull requests, or future issues
 from the same author. Each issue is reviewed case by case.
 
-## Contribution Volume and Batching
-
-To keep triage and review sustainable while the project stabilizes, please keep
-your contribution flow to a size the core team can realistically work through:
-
-- One issue per bug. File each defect as its own issue with its own
-  reproduction. Please do not bundle several unrelated findings into a single
-  "audit" issue; separate issues are far easier to triage, approve, and close
-  individually.
-- Keep only a few items open at a time. If you already have several issues or
-  pull requests awaiting review, let those move through the queue before opening
-  more. A large simultaneous burst from one contributor slows review for
-  everyone, even when each item is valid.
-- AI-assisted contributions are welcome, held to the same bar. Automated audits
-  and generated patches are fine, but each issue and pull request must be
-  individually verified, scoped, and reproducible before you open it. Please do
-  not post bulk machine-generated findings unfiltered.
-
-These apply to all contributors and are about review bandwidth, not the value of
-any single report. Maintainers may ask you to consolidate, split, or hold
-submissions to keep the queue manageable.
-
 ## Pull Request Requirements
 
 Before opening a community pull request, make sure all of the following are true:
@@ -126,31 +104,6 @@ not enough. Dependency changes need a clear project benefit, such as fixing a
 specific bug, addressing a security issue, improving compatibility, or supporting
 an approved feature.
 
-## Supported platforms
-
-Zero publishes five native prebuilt artifacts from
-`.github/workflows/release-artifacts.yml`:
-
-- `linux-x64` (`linux/amd64`)
-- `linux-arm64` (`linux/arm64`)
-- `macos-arm64` (`darwin/arm64`)
-- `macos-x64` (`darwin/amd64`)
-- `windows-x64` (`windows/amd64`)
-
-The shell installer and npm wrapper resolve the applicable artifacts from that
-list. The PowerShell installer supports the published `windows-x64` artifact;
-there is no native Windows ARM64 artifact. Windows on ARM users can run the x64
-build under emulation or build from source.
-
-Android/Termux is also supported even though it has no distinct release
-artifact. The npm wrapper maps Android to the Linux artifact, and
-`docs/INSTALL.md` documents the native `android/arm64` source build needed on
-devices whose seccomp policy blocks the Linux build's syscall path.
-
-Other `GOOS`/`GOARCH` values, including Plan 9, are unsupported. They are not a
-review criterion. Do not block a pull request for failing to compile on an
-unsupported target. Tests may use `plan9` as a fixture for an unsupported OS.
-
 ## What We Prioritize
 
 The core team will prioritize:
@@ -193,7 +146,7 @@ Clear bug reports are the most useful way to help the project during this phase.
 ## Submitting a Feature Request
 
 Feature requests start as a thread in
-[Discussions Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas),
+[Discussions Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas),
 not as an issue. The feature-request issue form exists for the step AFTER that:
 when an idea has gained traction in Discussions or a maintainer has asked for an
 issue to track it. Whether in the discussion or the eventual issue, please
@@ -222,7 +175,7 @@ contribution phase.
 
 General questions, setup help, and "is this a bug or my config" uncertainty all
 go to
-[Discussions Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a).
+[Discussions Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a).
 If you are unsure whether a proposed code change is appropriate, raise it in
 Discussions Ideas or on the relevant issue first and ask. Please keep discussion
 focused, specific, and respectful of maintainer time.

Makefile

@@ -1,13 +1,7 @@
-# Zero build/test/lint targets. AGENTS.md says to build and run quality checks
-# with `make` — these targets back those instructions.
+# Zero build/test/lint targets. AGENTS.md says "Build with `make`" and "Run `make
+# lint` before opening a PR" — these targets back those instructions.
 .DEFAULT_GOAL := build
-GO_VERSION = $(word 2,$(shell git grep -G -h "^go[[:space:]]" -- go.mod))
-GO_TOOLCHAIN = go$(GO_VERSION)
-DEADCODE_VERSION := v0.46.0
-GOLANGCI_LINT_VERSION := v2.12.2
-GOVULNCHECK_VERSION := v1.3.0
-
-.PHONY: build build-all test test-race vet fmt fmt-check lint lint-static deadcode vulncheck vulncheck-windows tidy clean baseline help
+.PHONY: build build-all test test-race vet fmt fmt-check lint tidy clean baseline help
 
 # Build the main CLI binary into ./zero.
 build:
@@ -39,28 +33,6 @@ fmt-check:
 # Lint = formatting check + vet (no extra tooling required).
 lint: fmt-check vet
 
-# Versioned tools select the toolchain from their own modules when invoked with
-# package@version. Read this module's go directive directly, without invoking
-# the possibly stale Go toolchain or consulting a multi-module GOWORK. git grep
-# works with both POSIX shells and cmd.exe, including GNU Make 3.81 on macOS.
-# The target-specific export is shell-independent.
-lint-static deadcode vulncheck vulncheck-windows: export GOTOOLCHAIN = $(GO_TOOLCHAIN)
-lint-static deadcode vulncheck vulncheck-windows: export GOWORK = off
-
-lint-static:
-	go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) run --enable-only unused,ineffassign,staticcheck ./...
-
-deadcode:
-	go run golang.org/x/tools/cmd/deadcode@$(DEADCODE_VERSION) -test=false ./...
-
-vulncheck:
-	go run golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION) ./...
-
-vulncheck-windows:
-	mkdir -p "$(CURDIR)/.cache/gobin"
-	GOBIN="$(CURDIR)/.cache/gobin" go install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
-	GOOS=windows "$(CURDIR)/.cache/gobin/govulncheck" ./...
-
 tidy:
 	go mod tidy
 
@@ -83,4 +55,4 @@ baseline: build
 		--output internal/perfbench/reports/baseline.json
 
 help:
-	@echo "Targets: build (default), build-all, test, test-quick, vet, fmt, fmt-check, lint, lint-static, deadcode, vulncheck, vulncheck-windows, tidy, clean, baseline"
+	@echo "Targets: build (default), build-all, test, test-quick, vet, fmt, fmt-check, lint, tidy, clean, baseline"

README.md

@@ -4,18 +4,10 @@
 
 <p align="center"><strong>A terminal coding agent you own.</strong></p>
 
-<p align="center">
-  <a href="https://trendshift.io/repositories/70679?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/70679/daily?language=Go" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/70679?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/70679/weekly?language=Go" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/70679?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/70679" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-</p>
-
 <p align="center">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.10+" src="https://img.shields.io/badge/Go-1.26.10+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.5+" src="https://img.shields.io/badge/Go-1.26.5+-00ADD8?logo=go&logoColor=white">
   <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
-  <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
-  <a href="https://vercel.com/open-source-program"><img alt="Vercel OSS Program" src="https://vercel.com/oss/program-badge-2026.svg"></a>
   <br>
   <strong>English</strong> | <a href="README_ZH.md">中文</a>
 </p>
@@ -30,83 +22,10 @@ zero exec "fix the failing test in ./pkg"
 zero exec --output-format stream-json < turns.jsonl
 ```
 
-## Partners
-
-<table align="center">
-  <tr>
-    <td align="center" width="150" height="80">
-      <a href="https://twigpine.com">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="https://twigpine.com/logo-dark.png">
-          <img src="https://twigpine.com/logo.png" alt="Twigpine logo" width="72">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://mimo.mi.com">
-        <img src="https://mimo.xiaomi.com/mimo-v2-pro/assets/logo.svg" alt="Xiaomi MiMo logo" width="136">
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://novita.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/novita-logo-dark.svg">
-          <img src="docs/assets/novita-logo.svg" alt="Novita AI logo" width="136">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://concentrate.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/concentrate-logo-dark.svg">
-          <img src="docs/assets/concentrate-logo.svg" alt="Concentrate logo" width="64">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://exa.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/exa-logo-dark.svg">
-          <img src="docs/assets/exa-logo.svg" alt="Exa logo" width="110">
-        </picture>
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center"><a href="https://twigpine.com"><strong>Twigpine</strong></a></td>
-    <td align="center"><a href="https://mimo.mi.com"><strong>Xiaomi MiMo</strong></a></td>
-    <td align="center"><a href="https://novita.ai/"><strong>Novita AI</strong></a></td>
-    <td align="center"><a href="https://concentrate.ai/"><strong>Concentrate</strong></a></td>
-    <td align="center"><a href="https://exa.ai/"><strong>Exa</strong></a></td>
-  </tr>
-  <tr>
-    <td align="center" width="150" height="80">
-      <a href="https://www.gmicloud.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/gmi-cloud-logo-dark.svg">
-          <img src="docs/assets/gmi-cloud-logo.svg" alt="GMI Cloud logo" width="120">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://vercel.com/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/vercel-logo-dark.svg">
-          <img src="docs/assets/vercel-logo.svg" alt="Vercel logo" width="120">
-        </picture>
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center"><a href="https://www.gmicloud.ai/"><strong>GMI Cloud</strong></a></td>
-    <td align="center"><a href="https://vercel.com/"><strong>Vercel</strong></a></td>
-  </tr>
-</table>
-
 ## Why Zero
 
 - **Use the model you want.** Bring OpenAI, Anthropic, Gemini, Groq, OpenRouter,
-  DeepSeek, Mistral, xAI, Qwen, Kimi, GitHub Models, Ollama, LM Studio, Atomic Chat, or any
+  DeepSeek, Mistral, xAI, Qwen, Kimi, GitHub Models, Ollama, LM Studio, or any
   OpenAI-/Anthropic-compatible endpoint.
 - **Stay in control.** File writes, shell commands, network access, and
   out-of-workspace writes go through Zero's permission and sandbox policy.
@@ -126,7 +45,7 @@ zero exec --output-format stream-json < turns.jsonl
 ### npm
 
 ```bash
-npm install -g @twigpine/zero
+npm install -g @gitlawb/zero
 zero
 ```
 
@@ -140,38 +59,26 @@ matching GitHub Release whenever it is missing. Windows on ARM runs the x64
 build under emulation. See [docs/NPM_PACKAGING.md](docs/NPM_PACKAGING.md) for
 how the package is put together.
 
-Installed Zero as `@gitlawb/zero`? The package moved to `@twigpine/zero` in
-0.10.0 and the old name gets no further releases. Both packages provide the
-`zero` command, so quit any running `zero`, then remove the old package first:
-
-```bash
-npm uninstall -g @gitlawb/zero
-npm install -g @twigpine/zero
-```
-
-Your config, sessions, and logins are kept; they live outside the package. For
-Bun, pnpm, and yarn, see [docs/INSTALL.md](docs/INSTALL.md#moving-from-gitlawbzero).
-
 ### Install scripts
 
 Linux/macOS:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
 ```
 
 Windows PowerShell:
 
 ```powershell
-irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
 ```
 
 ### From source
 
-Source builds require Go 1.26.10+.
+Source builds require Go 1.26.5+.
 
 ```bash
-git clone https://github.com/Twigpine/zero.git
+git clone https://github.com/Gitlawb/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -183,18 +90,17 @@ If you are testing before the first public release, build from source:
 go build -o zero ./cmd/zero
 ```
 
-On Linux, native sandboxing needs Bubblewrap. The main `zero` binary re-executes
-itself as the helper when `zero-linux-sandbox` is absent. A separate helper next
-to `zero` or on `PATH` still takes precedence:
+On Linux, build the sandbox helper too if you want native sandboxing:
 
 ```bash
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # optional
-go build -o zero-seccomp ./cmd/zero-seccomp               # optional compatibility wrapper
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
+go build -o zero-seccomp ./cmd/zero-seccomp   # optional compatibility wrapper
 ```
 
-Put `zero` on `PATH` (`~/.local/bin` is a good default). macOS does not need an
-extra helper binary. Windows source builds can use the main `zero.exe` as their
-sandbox helper; release archives still ship standalone Windows helper executables.
+Put `zero` and `zero-linux-sandbox` in the same directory on `PATH`
+(`~/.local/bin` is a good default). macOS does not need an extra helper binary.
+Windows source builds can use the main `zero.exe` as their sandbox helper; release
+archives still ship standalone Windows helper executables.
 
 More install details: [docs/INSTALL.md](docs/INSTALL.md).
 
@@ -225,9 +131,6 @@ export ANTHROPIC_API_KEY=...
 export GEMINI_API_KEY=...
 export AIMLAPI_API_KEY=...
 export LONGCAT_API_KEY=...
-export FIREWORKS_API_KEY=...
-export GMI_API_KEY=...
-export CONCENTRATE_API_KEY=...
 export MINIMAX_API_KEY=...
 export MINIMAXI_API_KEY=...
 ```
@@ -244,24 +147,6 @@ To configure Meituan LongCat (LongCat-2.0) directly, run:
 zero providers setup longcat --set-active
 ```
 
-To configure Fireworks AI directly, run:
-
-```bash
-zero providers setup fireworks --set-active
-```
-
-To configure GMI Cloud directly, run:
-
-```bash
-zero providers setup gmicloud --set-active
-```
-
-To configure Concentrate directly, run:
-
-```bash
-zero providers setup concentrate --set-active
-```
-
 MiniMax presets use the Anthropic-compatible endpoints for the global and China
 regions:
 
@@ -289,12 +174,8 @@ zero providers add custom-openai-compatible \
   --set-active
 ```
 
-For local models, run Ollama, LM Studio, or the [Atomic Chat](https://atomic.chat)
-desktop app, then use `zero setup` or `zero providers detect`. For Atomic Chat,
-load a model and enable its local OpenAI-compatible API (default
-`http://127.0.0.1:1337/v1`). Choose `atomic-chat-local`; detection includes the
-loaded model ID in the add command. If no usable ID is discovered, load a model
-and retry. Model IDs requiring shell-specific quoting use interactive setup.
+For local models, run Ollama or LM Studio and then use `zero setup` or
+`zero providers detect`.
 
 ## Daily Use
 
@@ -314,7 +195,7 @@ Useful controls:
 | `Ctrl+P` / `Ctrl+N` | previous / next item in menus (arrows still work) |
 | `Shift+Tab` | cycle permission mode |
 | `Ctrl+B` | show/hide the sidebar |
-| `Ctrl+C` | cancel, exit, or return from a `/btw` conversation |
+| `Ctrl+C` | cancel or exit |
 
 Common slash commands:
 
@@ -324,8 +205,6 @@ Common slash commands:
 | `/spec`, `/plan` | draft and review a plan before building |
 | `/image` | attach an image for vision-capable models |
 | `/resume`, `/rewind` | continue or roll back local sessions |
-| `/new` | start a fresh session in place (previous session stays on disk) |
-| `/btw [question]` | ask in an isolated fork without adding the side conversation to the main session |
 | `/loop` | repeat a prompt or custom `/command` on an interval (`/loop 5m /babysit-prs`) or self-paced |
 | `/compact`, `/context` | manage context usage |
 | `/permissions`, `/tools` | inspect available tools and policy |
@@ -384,89 +263,6 @@ zero sandbox grants list
 Zero includes local file/search/edit/shell tools, `web_fetch` for public URLs,
 and MCP support for additional tools.
 
-`web_fetch` refuses loopback, private and other special-use addresses: it checks
-the URL before asking permission, resolves the host, and dials the address it
-validated so a name cannot resolve to something else in between.
-
-If `HTTP_PROXY`/`HTTPS_PROXY` is set, `web_fetch` and the provider connectivity
-probe use it, and that last step changes: the proxy is dialed and the target
-hostname is sent to it, so the proxy decides which address the request actually
-reaches. The URL is still checked and resolved locally first, but a proxy that
-answers differently can reach a private service. A forward proxy already sees
-and can rewrite every request through it, so this is the trust you accept by
-configuring one. Leave the variables unset for the checks to be enforced end to
-end.
-
-The built-in `web_search` tool is registered only when a search backend is
-configured: `ZERO_WEBSEARCH_BASE_URL` (with an optional `ZERO_WEBSEARCH_API_KEY`)
-for a generic JSON endpoint, `ZERO_WEBSEARCH_PROVIDER=searxng` with a SearXNG
-base URL, or the AI/ML API Toolbox:
-
-```bash
-export ZERO_WEBSEARCH_PROVIDER=aimlapi
-```
-
-The AI/ML API backend runs the Toolbox tool `web/search`, and every search is
-billed to your AI/ML API balance: about $0.0013 per result, with a documented
-minimum of $0.0091 per search. Each search is sent with a $0.025 spending cap,
-which the Toolbox enforces. It is used only when
-`ZERO_WEBSEARCH_PROVIDER` is set to `aimlapi`; an AI/ML API key alone never
-enables it. The key is read from your user configuration only; provider
-profiles in a project `.zero` config are not used. It is the aimlapi profile's
-key (the active profile when it is aimlapi, otherwise the first aimlapi
-profile), including a key in the credential store, or `AIMLAPI_API_KEY` when no
-aimlapi profile exists. It is resolved again on every search;
-`ZERO_WEBSEARCH_API_KEY` is not used. When any aimlapi profile, or any profile
-that reads `AIMLAPI_API_KEY`, points at a base URL other than
-`https://api.aimlapi.com/v1`, or `AIMLAPI_INFERENCE_URL` is overridden, the key
-may belong to a proxy, so it is not sent and the search fails without a request.
-Requests go only to
-`https://tools.aimlapi.com` (`ZERO_WEBSEARCH_BASE_URL` is ignored and redirects
-are refused) and carry `X-AIMLAPI-Source: agent/zero` and an
-`X-AIMLAPI-Partner-ID` header. The `domains` argument is sent to the Toolbox as
-`include_domains`, and results are still filtered locally.
-
-### AI/ML API Toolbox backend for `web_fetch`
-
-`web_fetch` can fetch pages through the AI/ML API Toolbox tool
-`search1api/crawl` instead of a direct HTTP GET. It is off unless you choose it:
-
-```bash
-export ZERO_WEBFETCH_PROVIDER=aimlapi
-```
-
-Having an AI/ML API key never switches it on by itself, and any other value (or
-none) keeps the direct fetch. The variable is read on every fetch.
-
-- **Billing:** Toolbox runs are billed to your AI/ML API balance, about
-  $0.0013 per run. Each run is sent with `max_cost_usd` 0.005, so a run
-  priced above that is refused before it starts and not charged. Rate-limited
-  or gateway-failed requests are retried with the same idempotency key, so a
-  retry is never billed twice.
-- **Key:** the key comes from your `aimlapi` provider profile (including a key
-  in the credential store), or from `AIMLAPI_API_KEY` when there is no such
-  profile. It is withheld, and `web_fetch` returns an error, when any `aimlapi`
-  profile or any profile using `AIMLAPI_API_KEY` points at a base URL other than
-  `https://api.aimlapi.com/v1`, or when `AIMLAPI_INFERENCE_URL` is overridden:
-  the key may then belong to a proxy.
-- **Destination:** requests go only to the fixed `https://tools.aimlapi.com`
-  endpoint, with `Authorization: Bearer <key>` and the attribution headers
-  `X-AIMLAPI-Source: agent/zero` and `X-AIMLAPI-Partner-ID`. Redirects are
-  refused. `HTTP_PROXY`/`HTTPS_PROXY` apply to these requests as to Zero's other
-  aimlapi.com calls.
-- **No fallback:** without a usable key, or when the run fails, `web_fetch`
-  returns an error and does not fetch the page directly. Unset the variable to
-  go back to direct fetches.
-- **Remote fetch:** the page is fetched by a remote service, which may serve a
-  cached copy, and the full URL (query string included) is sent to it. The URL
-  checks above still run first, so loopback, private and metadata URLs are
-  never handed to it. The result is Markdown with a
-  `Backend: aimlapi (search1api/crawl)` line; `max_bytes` cuts the Markdown,
-  and `format: "raw"` is refused because the original response is not
-  available. The complete Toolbox run response is limited to 8 MiB before JSON
-  decoding; larger responses return an error even if `max_bytes` is smaller.
-  The remote run may already have been billed when this limit is detected.
-
 For local dev servers, use shell commands such as `curl` through `exec_command`
 so the normal sandbox and permission policy applies. Long-running commands stay
 attached to a background terminal session and can be listed or stopped from the
@@ -490,7 +286,7 @@ zero context          context-budget report
 zero repo-map         deterministic repository map
 zero repo-info        local repository summary
 zero search | find    search local session history
-zero sessions         inspect, resume, fork, rewind, and prune sessions
+zero sessions         inspect, resume, fork, and rewind sessions
 zero spec             manage spec-mode drafts
 zero specialist       manage specialist subagents
 zero skills           manage markdown instruction skills
@@ -504,17 +300,9 @@ zero verify           detect and run local verification checks
 zero changes          inspect and commit local git changes
 zero usage            token usage and estimated cost
 zero cron             scheduled agent jobs
-zero update --check   check for newer releases
-zero upgrade          download, verify, and install the latest release
+zero update           check for newer releases
 ```
 
-Cron keeps the newest 1,000 run outcomes per job in `runs.jsonl`. Each new run
-atomically replaces the history with the retained tail; existing larger histories
-are trimmed on their next run. Archive the file before that run if you need older
-outcomes. This retention does not delete session directories or reset fire counts.
-Malformed records and legacy lines of 1 MiB or more are skipped when reading or
-compacting history; new records of that size are rejected.
-
 ## Extending Zero
 
 ### Project and personal instructions
@@ -572,34 +360,27 @@ go run ./cmd/zero-perf-bench
 
 Experimental: `ZERO_OPENAI_TURN_SESSION=1` enables the optimized OpenAI turn
 session (background connection prewarm + request-prefix telemetry) for headless
-`zero exec` runs against official OpenAI profiles. Off by default; `0`, `false`,
-or `off` disable it. A/B-benchmark it by running the same `zero-perf-bench` suite
-with the variable unset and set.
-
-Native ChatGPT Responses sessions are enabled by default. Set
-`ZERO_CHATGPT_TURN_SESSION=0`, `false`, or `off` to restore stateless HTTP/SSE
-transport.
+`zero exec` runs against official OpenAI profiles. Off by default; `0`/`false`
+disable. A/B-benchmark it by running the same `zero-perf-bench` suite with the
+variable unset and set.
 
 ### Code Quality and Security Checks
 
-Before committing any changes, ensure all Go code quality and security checks pass. The `make` targets below pin each tool to this module's Go version, so they load correctly even when your default `go` toolchain is older — running the plain `go run ...@version` form yourself can select the tool module's own (older) toolchain and fail to load this module instead.
+Before committing any changes, ensure all Go code quality and security checks pass. Pinned `go run` commands matching CI constraints can be used directly without prior installation:
 
-1. **Formatting**: Run `make fmt` (or `go fmt ./...`).
-2. **Vetting**: Run `make vet` (or `go vet ./...`).
-3. **Linting**: Run `make lint-static`.
-4. **Vulnerability Scan**: Run `make vulncheck`.
+1. **Formatting**: Run `go fmt ./...` (or `make fmt`).
+2. **Vetting**: Run `go vet ./...` (or `make vet`).
+3. **Linting**: Run `go run github.com/golangci/golangci-lint/v2/cmd/[email protected] run --enable-only unused,ineffassign,staticcheck ./...`.
+4. **Vulnerability Scan**: Run `go run golang.org/x/vuln/cmd/[email protected] ./...`.
 
-Use the repository-managed targets rather than globally installed binaries:
-the targets apply the module's required Go toolchain as well as the reviewed,
-pinned tool versions.
-
-The installed binaries land in `$GOBIN` when it is set, otherwise in
-`$GOPATH/bin` (default `~/go/bin`). That directory must be on your `PATH` to
-run them directly. If it isn't, add it:
+If you prefer to install these tools globally on your path, you can run:
 
 ```bash
-gobin="$(go env GOBIN)"; [ -z "$gobin" ] && gobin="$(go env GOPATH)/bin"
-case ":$PATH:" in *":$gobin:"*) ;; *) export PATH="$PATH:$gobin" ;; esac
+# Install golangci-lint
+go install github.com/golangci/golangci-lint/v2/cmd/[email protected]
+
+# Install govulncheck
+go install golang.org/x/vuln/cmd/[email protected]
 ```
 
 ### Cross-Compile Examples
@@ -623,22 +404,20 @@ go run ./cmd/zero-release build --goos windows --goarch amd64 --output dist/zero
 
 ## Community
 
-Real-time chat happens on the [Discord server](https://discord.gg/CaQDS6wdFn).
-
 Questions, setup help, ideas, and sharing all live in
-[GitHub Discussions](https://github.com/Twigpine/zero/discussions):
+[GitHub Discussions](https://github.com/Gitlawb/zero/discussions):
 
 | Category | Use it for |
 |---|---|
-| [Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) | Setup help, provider/model configuration, "how do I" questions |
-| [Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) | Feature proposals and design discussion before any PR |
-| [Show and tell](https://github.com/Twigpine/zero/discussions/categories/show-and-tell) | Your skills, plugins, MCP setups, themes, and workflows |
-| [Announcements](https://github.com/Twigpine/zero/discussions/categories/announcements) | Releases and project news from the maintainers |
+| [Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a) | Setup help, provider/model configuration, "how do I" questions |
+| [Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas) | Feature proposals and design discussion before any PR |
+| [Show and tell](https://github.com/Gitlawb/zero/discussions/categories/show-and-tell) | Your skills, plugins, MCP setups, themes, and workflows |
+| [Announcements](https://github.com/Gitlawb/zero/discussions/categories/announcements) | Releases and project news from the maintainers |
 
 For a good Q&A answer fast, include `zero --version`, your OS and install
 method, the provider/model in use, and `zero doctor` output. See
 [SUPPORT.md](SUPPORT.md). Bugs belong in
-[issues](https://github.com/Twigpine/zero/issues/new/choose); security reports
+[issues](https://github.com/Gitlawb/zero/issues/new/choose); security reports
 follow [SECURITY.md](SECURITY.md), never a public thread.
 
 ## Contributing

README_ZH.md

@@ -4,18 +4,10 @@
 
 <p align="center"><strong>一个独属于你的终端编码智能体。</strong></p>
 
-<p align="center">
-  <a href="https://trendshift.io/repositories/70679?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/70679/daily?language=Go" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/70679?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/70679/weekly?language=Go" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-  <a href="https://trendshift.io/repositories/70679?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-70679" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/70679" alt="Twigpine/zero | Trendshift" width="250" height="55"/></a>
-</p>
-
 <p align="center">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.10+" src="https://img.shields.io/badge/Go-1.26.10+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.5+" src="https://img.shields.io/badge/Go-1.26.5+-00ADD8?logo=go&logoColor=white">
   <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
-  <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
-  <a href="https://vercel.com/open-source-program"><img alt="Vercel OSS Program" src="https://vercel.com/oss/program-badge-2026.svg"></a>
   <br>
   <a href="README.md">English</a> | <strong>中文</strong>
 </p>
@@ -28,82 +20,9 @@ zero exec "修复 ./pkg 中失败的测试"
 zero exec --output-format stream-json < turns.jsonl
 ```
 
-## 合作伙伴
-
-<table align="center">
-  <tr>
-    <td align="center" width="150" height="80">
-      <a href="https://twigpine.com">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="https://twigpine.com/logo-dark.png">
-          <img src="https://twigpine.com/logo.png" alt="Twigpine logo" width="72">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://mimo.mi.com">
-        <img src="https://mimo.xiaomi.com/mimo-v2-pro/assets/logo.svg" alt="Xiaomi MiMo logo" width="136">
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://novita.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/novita-logo-dark.svg">
-          <img src="docs/assets/novita-logo.svg" alt="Novita AI logo" width="136">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://concentrate.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/concentrate-logo-dark.svg">
-          <img src="docs/assets/concentrate-logo.svg" alt="Concentrate logo" width="64">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://exa.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/exa-logo-dark.svg">
-          <img src="docs/assets/exa-logo.svg" alt="Exa logo" width="110">
-        </picture>
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center"><a href="https://twigpine.com"><strong>Twigpine</strong></a></td>
-    <td align="center"><a href="https://mimo.mi.com"><strong>Xiaomi MiMo</strong></a></td>
-    <td align="center"><a href="https://novita.ai/"><strong>Novita AI</strong></a></td>
-    <td align="center"><a href="https://concentrate.ai/"><strong>Concentrate</strong></a></td>
-    <td align="center"><a href="https://exa.ai/"><strong>Exa</strong></a></td>
-  </tr>
-  <tr>
-    <td align="center" width="150" height="80">
-      <a href="https://www.gmicloud.ai/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/gmi-cloud-logo-dark.svg">
-          <img src="docs/assets/gmi-cloud-logo.svg" alt="GMI Cloud logo" width="120">
-        </picture>
-      </a>
-    </td>
-    <td align="center" width="150" height="80">
-      <a href="https://vercel.com/">
-        <picture>
-          <source media="(prefers-color-scheme: dark)" srcset="docs/assets/vercel-logo-dark.svg">
-          <img src="docs/assets/vercel-logo.svg" alt="Vercel logo" width="120">
-        </picture>
-      </a>
-    </td>
-  </tr>
-  <tr>
-    <td align="center"><a href="https://www.gmicloud.ai/"><strong>GMI Cloud</strong></a></td>
-    <td align="center"><a href="https://vercel.com/"><strong>Vercel</strong></a></td>
-  </tr>
-</table>
-
 ## 为什么选择 Zero
 
-- **使用你想要的模型。** 支持 OpenAI、Anthropic、Gemini、Groq、OpenRouter、DeepSeek、Mistral、xAI、Qwen、Kimi、GitHub Models、Ollama、LM Studio、Atomic Chat，或任何 OpenAI/Anthropic 兼容端点。
+- **使用你想要的模型。** 支持 OpenAI、Anthropic、Gemini、Groq、OpenRouter、DeepSeek、Mistral、xAI、Qwen、Kimi、GitHub Models、Ollama、LM Studio，或任何 OpenAI/Anthropic 兼容端点。
 - **保持控制权。** 文件写入、Shell 命令、网络访问和工作区外写入都经过 Zero 的权限和沙箱策略。
 - **在终端中工作。** TUI 具有模型/提供商选择器、图片输入、斜杠命令、实时计划/工具渲染、回滚滚动、主题以及恢复/分叉支持。
 - **无 TUI 也能工作。** `zero exec` 可脚本化，支持文本/JSON/stream-JSON I/O、隔离的工作树、规范优先运行，以及用于 CI 的有意义的退出码。
@@ -115,41 +34,32 @@ zero exec --output-format stream-json < turns.jsonl
 ### npm
 
 ```bash
-npm install -g @twigpine/zero
+npm install -g @gitlawb/zero
 zero
 ```
 
 npm 包是一个小型包装器，其平台构建（Linux 和 macOS 的 x64/arm64、Windows 的 x64，包含浏览器/终端控制辅助工具）作为可选依赖直接从 npm registry 安装——没有安装脚本，也不会从 npm 之外下载任何内容。Bun、pnpm 和 yarn 的行为完全一致，无需任何信任或批准步骤。跳过可选依赖的安装（`--omit=optional`）也能工作：只要二进制文件缺失，包装器就会从对应的 GitHub Release 下载。Windows on ARM 通过模拟运行 x64 构建。详见 [docs/NPM_PACKAGING.md](docs/NPM_PACKAGING.md)。
 
-之前通过 `@gitlawb/zero` 安装过 Zero？从 0.10.0 起，npm 包已迁移到 `@twigpine/zero`，旧包名不再发布新版本。两个包都提供 `zero` 命令，所以请先退出正在运行的 `zero`，再卸载旧包：
-
-```bash
-npm uninstall -g @gitlawb/zero
-npm install -g @twigpine/zero
-```
-
-配置、会话和登录信息都会保留，它们存放在包之外。Bun、pnpm 和 yarn 的命令见 [docs/INSTALL.md](docs/INSTALL.md#moving-from-gitlawbzero)。
-
 ### 安装脚本
 
 Linux/macOS：
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
 ```
 
 Windows PowerShell：
 
 ```powershell
-irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
 ```
 
 ### 从源码构建
 
-源码构建需要 Go 1.26.10+。
+源码构建需要 Go 1.26.5+。
 
 ```bash
-git clone https://github.com/Twigpine/zero.git
+git clone https://github.com/Gitlawb/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -160,14 +70,14 @@ go run ./cmd/zero
 go build -o zero ./cmd/zero
 ```
 
-在 Linux 上，原生沙箱需要 Bubblewrap。主程序 `zero` 在找不到 `zero-linux-sandbox` 时会以自身作为辅助进程重新执行。同目录或 PATH 上的独立 helper 仍优先：
+在 Linux 上，如果你需要原生沙箱，还需要构建沙箱辅助程序：
 
 ```bash
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # 可选
-go build -o zero-seccomp ./cmd/zero-seccomp               # 可选的兼容性包装器
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
+go build -o zero-seccomp ./cmd/zero-seccomp   # 可选的兼容性包装器
 ```
 
-将 `zero` 放在 `PATH` 上（`~/.local/bin` 是一个好的默认选择）。macOS 不需要额外的辅助二进制文件。Windows 源码构建可以使用主 `zero.exe` 作为沙箱辅助程序；发布包仍然附带独立的 Windows 辅助可执行文件。
+将 `zero` 和 `zero-linux-sandbox` 放在 `PATH` 上的同一目录中（`~/.local/bin` 是一个好的默认选择）。macOS 不需要额外的辅助二进制文件。Windows 源码构建可以使用主 `zero.exe` 作为沙箱辅助程序；发布包仍然附带独立的 Windows 辅助可执行文件。
 
 更多安装细节：[docs/INSTALL.md](docs/INSTALL.md)。
 
@@ -195,8 +105,6 @@ export OPENAI_API_KEY=sk-...
 export ANTHROPIC_API_KEY=...
 export GEMINI_API_KEY=...
 export LONGCAT_API_KEY=...
-export GMI_API_KEY=...
-export CONCENTRATE_API_KEY=...
 ```
 
 要直接配置美团 LongCat（LongCat-2.0），运行：
@@ -205,23 +113,7 @@ export CONCENTRATE_API_KEY=...
 zero providers setup longcat --set-active
 ```
 
-要直接配置 GMI Cloud，运行：
-
-```bash
-zero providers setup gmicloud --set-active
-```
-
-要直接配置 Concentrate，运行：
-
-```bash
-zero providers setup concentrate --set-active
-```
-
-对于本地模型，运行 Ollama、LM Studio 或 [Atomic Chat](https://atomic.chat) 桌面应用，
-然后使用 `zero setup` 或 `zero providers detect`。使用 Atomic Chat 时，请先加载模型并启用
-本地 OpenAI 兼容 API（默认地址为 `http://127.0.0.1:1337/v1`），再选择 `atomic-chat-local`。
-检测生成的添加命令会包含已加载的模型 ID；如果未发现可用的 ID，请加载模型后重试。
-对于需要特定 Shell 转义的模型 ID，请使用交互式设置。
+对于本地模型，运行 Ollama 或 LM Studio，然后使用 `zero setup` 或 `zero providers detect`。
 
 ## 日常使用
 
@@ -249,7 +141,6 @@ zero
 | `/spec`、`/plan` | 在构建之前起草和审查计划 |
 | `/image` | 为视觉模型附加图片 |
 | `/resume`、`/rewind` | 继续或回滚本地会话 |
-| `/new` | 原地开始一个新会话（之前的会话仍保留在磁盘上） |
 | `/compact`、`/context` | 管理上下文使用 |
 | `/permissions`、`/tools` | 检查可用工具和策略 |
 | `/add-dir` | 为此会话授予额外的写入目录 |
@@ -321,7 +212,7 @@ zero context          上下文预算报告
 zero repo-map         确定性仓库映射
 zero repo-info        本地仓库摘要
 zero search | find    搜索本地会话历史
-zero sessions         检查、恢复、分叉、回滚和清理会话
+zero sessions         检查、恢复、分叉和回滚会话
 zero spec             管理规范模式草稿
 zero specialist       管理专业子智能体
 zero skills           管理 Markdown 指令技能
@@ -335,8 +226,7 @@ zero verify           检测和运行本地验证检查
 zero changes          检查和提交本地 Git 变更
 zero usage            Token 使用量和估算成本
 zero cron             定时智能体任务
-zero update --check   检查更新版本
-zero upgrade          下载、验证并安装最新版本
+zero update           检查更新版本
 ```
 
 ## 外观和无障碍
@@ -379,20 +269,6 @@ go run ./cmd/zero-release build --goos windows --goarch amd64 --output dist/zero
 - [性能](docs/PERFORMANCE.md)
 - [智能体评估](docs/AGENT_EVALS.md)
 
-## 社区
-
-实时交流在 [Discord 服务器](https://discord.gg/CaQDS6wdFn) 进行。
-
-提问、安装帮助、想法和分享都在
-[GitHub Discussions](https://github.com/Twigpine/zero/discussions)：
-
-| 分类 | 用途 |
-|---|---|
-| [Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) | 安装帮助、提供商/模型配置、"如何做"类问题 |
-| [Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas) | 功能提议和 PR 之前的设计讨论 |
-| [Show and tell](https://github.com/Twigpine/zero/discussions/categories/show-and-tell) | 你的技能、插件、MCP 配置、主题和工作流 |
-| [Announcements](https://github.com/Twigpine/zero/discussions/categories/announcements) | 维护者发布的版本和项目动态 |
-
 ## 贡献
 
 欢迎贡献。阅读 [CONTRIBUTING.md](CONTRIBUTING.md)，运行相关测试，然后提交一个聚焦的拉取请求。

SECURITY.md

@@ -33,16 +33,4 @@ Please include, where possible:
   depend on a user explicitly disabling the sandbox (`--skip-permissions-unsafe`), are generally
   out of scope — but please report anything you are unsure about.
 - Zero sends no telemetry. Network calls go to the model/tool providers you configure (and, for
-  keyless web search, to Exa's hosted MCP endpoint at `https://mcp.exa.ai/mcp`). The built-in
-  AI/ML API MCP server (`https://mcp.aimlapi.com/mcp`) is off until you run
-  `zero mcp enable aimlapi`. Once enabled, the Bearer key follows the aimlapi
-  profile resolution order (inline key, then the profile's `apiKeyEnv` — default
-  `AIMLAPI_API_KEY` — then the credential store), or `AIMLAPI_API_KEY` alone when
-  no aimlapi profile exists; a non-empty `AIMLAPI_API_KEY` can override a stored
-  profile key for MCP billing. The automatic key is withheld if an aimlapi profile
-  (or a profile reading `AIMLAPI_API_KEY`) uses a base URL other than
-  `https://api.aimlapi.com/v1`, `AIMLAPI_INFERENCE_URL` points elsewhere, a
-  non-empty user Authorization header is configured, OAuth is selected, project
-  config has touched the server, or the key is missing or not a single token
-  (including Unicode whitespace). See
-  [docs/EXTENDING.md](docs/EXTENDING.md#built-in-servers).
+  keyless web search, to the documented Firecrawl endpoint — see the README).

SUPPORT.md

@@ -2,8 +2,8 @@
 
 ## Questions, setup help, configuration
 
-Ask in [GitHub Discussions](https://github.com/Twigpine/zero/discussions). Use
-[Q&A](https://github.com/Twigpine/zero/discussions/categories/q-a) so answers can
+Ask in [GitHub Discussions](https://github.com/Gitlawb/zero/discussions). Use
+[Q&A](https://github.com/Gitlawb/zero/discussions/categories/q-a) so answers can
 be marked and found by the next person.
 
 The fastest way to a useful answer is to include:
@@ -18,19 +18,19 @@ The fastest way to a useful answer is to include:
 ## Bugs
 
 If Zero does something wrong (crashes, wrong output, broken behavior), file a
-[bug report](https://github.com/Twigpine/zero/issues/new/choose). If you are not
+[bug report](https://github.com/Gitlawb/zero/issues/new/choose). If you are not
 sure whether it is a bug or a setup problem, start in Discussions and we will
 promote it to an issue if it is one.
 
 ## Feature ideas
 
 Start a thread in
-[Ideas](https://github.com/Twigpine/zero/discussions/categories/ideas). Zero is
+[Ideas](https://github.com/Gitlawb/zero/discussions/categories/ideas). Zero is
 in controlled development (see CONTRIBUTING.md), so discussing an idea first is
 also the path to getting a PR accepted.
 
 ## Security issues
 
 Never file a public issue or discussion. Report privately via
-[GitHub Security Advisories](https://github.com/Twigpine/zero/security/advisories/new)
+[GitHub Security Advisories](https://github.com/Gitlawb/zero/security/advisories/new)
 (see SECURITY.md).

action.yml

@@ -2,7 +2,7 @@ name: ZERO
 description: >-
   Run the ZERO coding agent headlessly in a GitHub workflow. ZERO is
   model- and provider-agnostic: you supply the provider and API key as inputs.
-author: Twigpine
+author: Gitlawb
 
 branding:
   icon: terminal
@@ -110,7 +110,7 @@ inputs:
   zero-repo:
     description: Repository to install the ZERO release from (owner/repo).
     required: false
-    default: Twigpine/zero
+    default: Gitlawb/zero
 
 outputs:
   exit-code:

bin/zero.js

@@ -1,63 +1,11 @@
 #!/usr/bin/env node
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, writeSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-
-const CURRENT_PACKAGE_NAME = '@twigpine/zero';
-// The npm package moved from @gitlawb/zero to @twigpine/zero in 0.10.0. That
-// release was also published once under the old name, so 0.9.0's `zero
-// upgrade` and anyone still installing the old name land on a working build
-// that says where the package went (docs/NPM_PACKAGING.md). Nothing is
-// published under the old name after that.
-const LEGACY_PACKAGE_NAME = '@gitlawb/zero';
-
-// The npm name this wrapper was published under, read from its own
-// package.json so the name lives in one place. The platform payload alias and
-// every reinstall hint below derive from it.
-function readPackageName(root) {
-  try {
-    const { name } = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
-    if (typeof name === 'string' && name !== '') return name;
-  } catch {
-    // An unreadable manifest must not stop the CLI from launching.
-  }
-  return CURRENT_PACKAGE_NAME;
-}
-
-const packageName = readPackageName(packageRoot);
-
-// Same note as legacyPackageSwitchMessage in internal/update/installmethod.go.
-// Uninstalling first is the only safe order: both packages own the `zero` bin,
-// so npm refuses to install the new one over the old (EEXIST), and forcing it
-// lets a later uninstall of the old package delete the shared bin.
-function legacyPackageNotice() {
-  return (
-    `[zero] Zero has moved to ${CURRENT_PACKAGE_NAME} on npm, and ${LEGACY_PACKAGE_NAME} gets no further releases.\n` +
-    'To keep getting updates, quit zero and run:\n' +
-    `  npm uninstall -g ${LEGACY_PACKAGE_NAME}\n` +
-    `  npm install -g ${CURRENT_PACKAGE_NAME}\n` +
-    'Uninstall first: both packages provide the `zero` command. With bun, pnpm or yarn, use its global remove and add commands instead.\n'
-  );
-}
-
-// Printed when the wrapper exits rather than before zero starts, because the
-// TUI takes over the screen and would hide anything printed first. Only on a
-// terminal, so scripts that capture stderr see nothing new. `zero update` and
-// `zero upgrade` print the same note themselves.
-if (packageName === LEGACY_PACKAGE_NAME && !['update', 'upgrade'].includes(process.argv[2])) {
-  process.on('exit', () => {
-    if (process.stderr.isTTY || process.env.ZERO_WRAPPER_SIMULATE_TTY === '1') {
-      // Synchronous: an exit handler cannot wait for an asynchronous write.
-      writeSync(2, legacyPackageNotice());
-    }
-  });
-}
-
 function zeroBinaryName(platform = process.platform) {
   return platform === 'win32' ? 'zero.exe' : 'zero';
 }
@@ -133,10 +81,10 @@ function bunRecoveryParagraph() {
   return (
     'You installed with Bun, which does not run dependency lifecycle scripts\n' +
     'by default. Trust the package to run the blocked postinstall:\n' +
-    `  bun pm trust ${packageName}       (project install)\n` +
-    `  bun pm -g trust ${packageName}    (global install)\n` +
+    '  bun pm trust @gitlawb/zero       (project install)\n' +
+    '  bun pm -g trust @gitlawb/zero    (global install)\n' +
     'On Bun versions without `bun pm trust`, add\n' +
-    `  "trustedDependencies": ["${packageName}"]\n` +
+    '  "trustedDependencies": ["@gitlawb/zero"]\n' +
     'to your project package.json and reinstall.\n' +
     '\n'
   );
@@ -145,14 +93,14 @@ function bunRecoveryParagraph() {
 function buildFromSourceParagraph() {
   return (
     'If this platform has no prebuilt binary, build from source:\n' +
-    'https://github.com/Twigpine/zero (go run ./cmd/zero, requires Go 1.26+).'
+    'https://github.com/Gitlawb/zero (go run ./cmd/zero, requires Go 1.26+).'
   );
 }
 
 function missingBinaryContextParagraph() {
   return (
-    `Normally npm installs it as an optional dependency of ${packageName}\n` +
-    `(${packageName}-${process.platform}-${process.arch}), and the wrapper can\n` +
+    'Normally npm installs it as an optional dependency of @gitlawb/zero\n' +
+    `(@gitlawb/zero-${process.platform}-${process.arch}), and the wrapper can\n` +
     'also download it from the GitHub Release when it is missing.'
   );
 }
@@ -165,7 +113,7 @@ function missingNativeRecoveryParagraphs(postinstallScript) {
     '\n' +
     'Things to try:\n' +
     '  - reinstall without omitting optional dependencies:\n' +
-    `      npm install -g ${packageName}\n` +
+    '      npm install -g @gitlawb/zero\n' +
     '  - run the downloader manually (needs write access to the package dir):\n' +
     `      node "${postinstallScript}"\n` +
     '\n' +
@@ -234,12 +182,12 @@ function missingNativeDoctorTextReport(postinstallScript) {
   );
 }
 
-// The platform payload is a version of this same package, installed under an
-// npm: alias (see docs/NPM_PACKAGING.md). The alias name is derived from
+// The platform payload is a version of @gitlawb/zero itself, installed under
+// an npm: alias (see docs/NPM_PACKAGING.md). The alias name is derived from
 // process.platform/process.arch, so an unsupported platform simply fails to
 // resolve and we fall through to the downloader.
 function platformPackageBinary() {
-  const aliasedName = `${packageName}-${process.platform}-${process.arch}`;
+  const aliasedName = `@gitlawb/zero-${process.platform}-${process.arch}`;
   let manifestPath;
   try {
     manifestPath = createRequire(import.meta.url).resolve(`${aliasedName}/package.json`);
@@ -279,6 +227,8 @@ function downloadMissingBinary(packageRoot) {
   });
 }
 
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+
 function resolveNativeBinary() {
   const fromPlatformPackage = platformPackageBinary();
   if (fromPlatformPackage) return fromPlatformPackage;

cmd/zero-linux-sandbox/main.go

@@ -5,7 +5,7 @@ package main
 import (
 	"os"
 
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 func main() {

cmd/zero-perf-bench/main.go

@@ -11,7 +11,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/perfbench"
+	"github.com/Gitlawb/zero/internal/perfbench"
 )
 
 const (

cmd/zero-perf-bench/main_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/perfbench"
+	"github.com/Gitlawb/zero/internal/perfbench"
 )
 
 func TestParseArgsUsesCliAndEnvOverrides(t *testing.T) {

cmd/zero-perf-bench/tasks.go

@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/perfbench"
+	"github.com/Gitlawb/zero/internal/perfbench"
 )
 
 // taskOptions configures the `zero-perf-bench tasks` subcommand: the reproducible

cmd/zero-perf-bench/turn.go

@@ -9,8 +9,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/execprofile"
-	"github.com/Twigpine/zero/internal/perfbench"
+	"github.com/Gitlawb/zero/internal/execprofile"
+	"github.com/Gitlawb/zero/internal/perfbench"
 )
 
 // turnOptions configures the `zero-perf-bench turn` subcommand: the per-turn

cmd/zero-pr-review/main.go

@@ -6,7 +6,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/review"
+	"github.com/Gitlawb/zero/internal/review"
 )
 
 func main() {

cmd/zero-release/main.go

@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/release"
+	"github.com/Gitlawb/zero/internal/release"
 )
 
 func main() {

cmd/zero-seccomp/main.go

@@ -12,7 +12,7 @@ import (
 	"os/exec"
 	"syscall"
 
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 func main() {

cmd/zero-windows-command-runner/main.go

@@ -3,7 +3,7 @@ package main
 import (
 	"os"
 
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 func main() {

cmd/zero-windows-sandbox-setup/main.go

@@ -3,7 +3,7 @@ package main
 import (
 	"os"
 
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/sandbox"
 )
 
 func main() {

cmd/zero/main.go

@@ -3,13 +3,9 @@ package main
 import (
 	"os"
 
-	"github.com/Twigpine/zero/internal/cli"
-	"github.com/Twigpine/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/cli"
 )
 
 func main() {
-	if len(os.Args) > 1 && os.Args[1] == sandbox.LinuxSandboxHelperSubcommand {
-		os.Exit(sandbox.RunLinuxSandboxHelper(os.Args[1:], os.Stderr))
-	}
 	os.Exit(cli.Run(os.Args[1:], os.Stdout, os.Stderr))
 }

docs/EXTENDING.md

@@ -108,12 +108,10 @@ Discovery roots (earlier wins on name collisions):
 2. **Shared multi-agent dir** — `~/.agents/skills/` when present (read-only discovery; never an install target)
 3. **Plugin skill roots** — skills bundled by active plugins (section 6)
 
-A missing directory is fine — Zero just omits it. Management commands (`zero skill add` / `zero skill remove`) always write to the primary Zero dir only; `list` / `info` search primary + `~/.agents/skills`. `skill info` reports lock source/hash when present and whether the on-disk `SKILL.md` has drifted from the recorded hash.
-
-For a skill installed since Zero started installing bundled files, `skill info` also reports drift in any file installed with it.
+A missing directory is fine — Zero just omits it. Management commands (`zero skills add` / `remove` / `lock`) always write to the primary Zero dir only; `list` / `info` search primary + `~/.agents/skills`.
 
 ```text
-~/.local/share/zero/skills/          # primary (install/remove target)
+~/.local/share/zero/skills/          # primary (install/remove/lock target)
   run-benchmarks/
     SKILL.md
   write-changelog/
@@ -142,15 +140,6 @@ Only `name` and `description` are recognized in the frontmatter today. The `name
 
 The `skill` tool lets the agent load any discovered skill by name (primary, agents, or plugin).
 
-A skill can ship files beside its `SKILL.md`, in the [agentskills.io](https://agentskills.io/specification) layout: `scripts/`, `references/`, `assets/` or anything else the instructions refer to. `zero skill add` installs the whole skill directory, leaving out hidden entries such as `.git` and not following or copying symlinks (it lists any it skipped). A skill larger than 1,000 files or 32 MiB is refused. When the `skill` tool loads a skill that has such files, its output ends with the skill's directory and a list of the files, so instructions like "run `scripts/fill.py`" can be followed. Running a bundled script goes through the normal tool permissions; installing or loading a skill never runs anything.
-
-```text
-pdf/
-  SKILL.md
-  scripts/fill.py
-  references/form-fields.md
-```
-
 ## 4. Hooks
 
 Hooks fire shell commands on lifecycle events. Configure them in JSON:
@@ -203,11 +192,7 @@ Events the agent emits (in dispatch order):
 | `specialistStart` | A sub-agent is spawned | yes (specialist name) |
 | `specialistStop` | A sub-agent ends | yes (specialist name) |
 
-For swarm members the matcher subject is the **agent type** (`subagent`, `teammate`, …), not a registered specialist profile name — swarm members run from an inline manifest keyed by agent type.
-
-`specialistStart` fires once the child process has actually started; a launch that fails before exec (missing binary, spawn error) records no public lifecycle hooks. `specialistStop` fires once per terminal stop: completion, error, explicit stop of a recovered task, and a background task reaped by a later `TaskOutput` all share one durable claim, so a hook that notifies or cleans up does not run twice for the same sub-agent run.
-
-A hook's exit code decides what happens next: `0` continues, non-zero blocks the tool call (`beforeTool`) or surfaces an error (`afterTool`). `sessionStart` / `sessionEnd` / `specialistStart` / `specialistStop` hooks are advisory (failures are audited but do not interrupt the run). Hook execution is recorded in the audit log; the audit is reachable from the agent's view of past actions, not from a dedicated `zero doctor` check.
+A hook's exit code decides what happens next: `0` continues, non-zero blocks the tool call (`beforeTool`) or surfaces an error (`afterTool`). Hook execution is recorded in the audit log; the audit is reachable from the agent's view of past actions, not from a dedicated `zero doctor` check.
 
 > **Roadmap.** An in-UI hooks manager is on the backlog. Today you edit the JSON directly.
 
@@ -261,52 +246,6 @@ or use a new server name. OAuth tokens are bound to the resolved server identity
 so changing a server target can require `zero mcp oauth login <server>` again.
 OAuth server names ending in `.<32 hex chars>` are reserved for token storage.
 
-#### Built-in servers
-
-Zero seeds two MCP servers before your config is merged. Both show up in
-`zero mcp list`, and any field can be overridden in your user config.
-
-- `exa` (`https://mcp.exa.ai/mcp`) is on by default for keyless web search.
-  `zero mcp disable exa` turns it off.
-- `aimlapi` (`https://mcp.aimlapi.com/mcp`, the AI/ML API Toolbox, model
-  discovery, image/video/audio generation, chat, embeddings and balance tools)
-  is **off by default**, because its tool runs and generations are billed to
-  your AI/ML API balance. Turn it on with `zero mcp enable aimlapi`, which
-  writes only `"disabled": false` to your user config, and off again with
-  `zero mcp disable aimlapi`. A project config cannot turn it on.
-
-When `aimlapi` connects, Zero sends your AI/ML API key as
-`Authorization: Bearer <key>`. The key is resolved again on every request and
-is never written to `config.json`. With an aimlapi.com provider profile
-(`zero providers setup aimlapi`), the key is chosen in this order:
-
-1. An inline key on the profile (if set in config).
-2. Otherwise the environment variable named by the profile's `apiKeyEnv`
-   (the catalog default is `AIMLAPI_API_KEY`).
-3. Otherwise the key held in the credential store when the profile uses
-   `apiKeyStored`.
-
-When there is no aimlapi profile, Zero uses `AIMLAPI_API_KEY` alone. If both
-`AIMLAPI_API_KEY` and a stored profile key exist, step 2 wins over the store
-whenever the inline key is empty — MCP requests may bill the environment key's
-account, not the stored key.
-
-No automatic key is sent when an aimlapi profile, or any profile reading
-`AIMLAPI_API_KEY`, uses a base URL other than `https://api.aimlapi.com/v1`, or
-when `AIMLAPI_INFERENCE_URL` is overridden, because that credential may belong
-to a proxy. No key is sent when the resolved value is not a single token (for
-example a comma- or newline-separated pool), when you set your own
-non-empty `Authorization` header, when the server uses `"auth": "oauth"`, or
-when project config touched the server. Without a key the server answers 401.
-To sign in with your aimlapi.com account instead, set `"auth": "oauth"` on the
-server and run `zero mcp oauth login aimlapi`.
-
-Every request to exactly `https://mcp.aimlapi.com` (https, default port,
-whatever the server is named, including one you add by hand) also carries the
-attribution headers `X-AIMLAPI-Source: agent/zero` and `X-AIMLAPI-Partner-ID`,
-and gets the key under the rules above. Other MCP servers never receive these
-headers or the key.
-
 ### As a server — expose Zero's tools to another agent
 
 ```bash
@@ -350,13 +289,10 @@ Install and manage:
 ```bash
 zero plugins add ./github-pr-review      # copy into ~/.config/zero/plugins/ or ./.zero/plugins/
 zero plugins list
-zero plugins info github-pr-review       # show manifest path, enabled state, lock metadata
-zero plugins disable github-pr-review   # sets "enabled": false in plugin.json
-zero plugins enable github-pr-review    # sets "enabled": true in plugin.json
 zero plugins remove github-pr-review    # alias: rm
 ```
 
-A plugin is active when it is present under a plugins directory and its `plugin.json` has `"enabled": true` (the default when the field is omitted). Use `zero plugins disable <id>` / `zero plugins enable <id>` to toggle that field without removing the plugin. Pass `--user` to target only user plugins and ignore `./.zero/plugins`; without it, a project plugin with the same id takes precedence. The toggle edits the `enabled` value in place — the rest of the manifest keeps its formatting, field order, and numeric literals — and serializes with `plugins add` / `plugins remove` on the same plugins root. Zero reads plugins when it starts, so the change applies to the next `zero exec` run or interactive session; an interactive session that is already running keeps the plugin tools, hooks, and skills it started with until you restart it.
+A plugin is enabled by being present in the plugins directory and disabled by removing it (or by the user setting `"enabled": false` in its `plugin.json`). Plugins are not enabled or disabled by a CLI subcommand today.
 
 Plugin commands run with the plugin directory as their working directory. Use relative paths; the loader resolves them at activation time.
 

docs/GITHUB_ACTION.md

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: Twigpine/zero@v1
+      - uses: Gitlawb/zero@v1
         with:
           prompt: ${{ inputs.task }}
           provider: openai
@@ -66,7 +66,7 @@ jobs:
 | `github-token` | no | `${{ github.token }}` | Token used to post a PR comment. Requires `pull-requests: write`. |
 | `working-directory` | no | `${{ github.workspace }}` | Directory to run ZERO in. |
 | `zero-version` | no | (action ref → `latest`) | ZERO release version/tag to install, e.g. `v1.2.3` or `latest`. |
-| `zero-repo` | no | `Twigpine/zero` | Repository to install the ZERO release from. |
+| `zero-repo` | no | `Gitlawb/zero` | Repository to install the ZERO release from. |
 
 ## Outputs
 
@@ -101,7 +101,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: Twigpine/zero@v1
+      - uses: Gitlawb/zero@v1
         with:
           prompt: |
             Investigate this issue and propose a fix.
@@ -134,7 +134,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: Twigpine/zero@v1
+      - uses: Gitlawb/zero@v1
         id: zero
         with:
           prompt-file: .github/zero/upgrade-deps.md
@@ -176,7 +176,7 @@ jobs:
 - **Least-privilege tokens.** Grant only the permissions the workflow needs
   (`contents: write` to edit files, `pull-requests: write` to comment). The
   default `GITHUB_TOKEN` is scoped to the repository.
-- **Pin the action.** Reference a tag (`Twigpine/zero@v1`) or a commit SHA so a
+- **Pin the action.** Reference a tag (`Gitlawb/zero@v1`) or a commit SHA so a
   workflow run uses a known ZERO version. `zero-version` lets you pin the
   installed binary independently of the action ref.
 - **Linux and macOS runners** are supported; Windows runners are rejected with a

docs/HOW_ZERO_WORKS.md

@@ -302,9 +302,8 @@ Conceptually, one requested tool goes through these phases:
    the model can inspect it and decide what to do next.
 6. **Render and persist** — the result is surfaced to the TUI, stream-JSON
    writer, or ACP client. TUI and exec record rich tool/session events for
-   resume/history; ACP persists conversational messages and completed tool-call
-   starts/results for load replay. Live streaming details and permission
-   exchanges remain client notifications rather than durable history.
+   resume/history; ACP currently persists conversational messages and streams
+   tool/permission updates to the client.
 
 Tool success and failure are both informative context. A successful `read_file`
 result gives the model file contents; a failed `edit_file` result gives the model
@@ -628,16 +627,7 @@ Core tool groups include:
   skills, `ask_user`, permission requests.
 - **Write tools**: `write_file`, `edit_file`, `apply_patch`, `update_plan`.
 - **Shell tools**: `exec_command`, `write_stdin`, legacy `bash`.
-- **Network tools**: `web_fetch` and optional web search backend. `web_fetch`
-  validates the URL before the permission prompt, refuses loopback/private/
-  special-use addresses, and dials the address it resolved. With
-  `HTTP_PROXY`/`HTTPS_PROXY` set, the proxy is dialed instead and resolves the
-  target itself, so destination enforcement ends at the proxy; see the note in
-  the README.
-  With `ZERO_WEBFETCH_PROVIDER=aimlapi` (opt-in; a key alone does not select
-  it), the same URL checks run and the page is then fetched as Markdown by the
-  billed AI/ML API Toolbox tool `search1api/crawl`, with no fallback to a
-  direct fetch; see the README.
+- **Network tools**: `web_fetch` and optional web search backend.
 - **Local-control tools**: config-gated wrappers for browser, terminal, desktop,
   and artifact helpers backed by packages such as `internal/localcontrol` and
   `internal/browser`.
@@ -759,7 +749,7 @@ flowchart TD
 - **Plugins** can add tools, hooks, and skill roots. Bootstrap always registers a
   multi-root skill tool: primary Zero skills dir, optional `~/.agents/skills`,
   then plugin skill roots (earlier wins). `internal/skills` owns that merge via
-  `LoadFromRoots`; single-root `Load` remains for install/write.
+  `LoadFromRoots` / `DiscoveryRoots`; single-root `Load` remains for install/write.
 - **Hooks** can observe or block tool lifecycle events.
 
 ## End-to-End Data Flow

docs/INSTALL.md

@@ -1,35 +1,19 @@
 # Installing Zero
 
-Pick whichever fits how you already install things. None of these is the
-blessed one.
+Zero is distributed as:
 
-| Method | Command | Self-update |
-| --- | --- | --- |
-| Install script (Linux, macOS) | `curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh \| bash` | `zero upgrade` |
-| Install script (Windows) | `irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 \| iex` | `zero upgrade` |
-| npm | `npm install -g @twigpine/zero` | `zero upgrade` (runs npm) |
-| Release archive | download from [Releases](https://github.com/Twigpine/zero/releases) | `zero upgrade` |
-| mise | `mise use -g ubi:Twigpine/zero` | `mise upgrade` |
-| `go install` | `go install github.com/Gitlawb/zero/cmd/zero@latest` | rerun the command |
-| Source | `go build -o zero ./cmd/zero` | rebuild |
+- an npm package, `@gitlawb/zero`
+- release archives on GitHub Releases
+- source builds with Go 1.26.5+
 
-`zero upgrade` follows whatever owns the binary, with one exception it cannot
-detect. It delegates to npm for an npm install, refuses outright for a Homebrew
-keg and names `brew upgrade zero`, and replaces the binary in place for
-everything else — including a mise-managed one, which is the exception.
-
-mise is the one case it cannot detect: a mise-managed binary is an ordinary
-standalone install on disk, so `zero upgrade` will replace it and leave mise
-describing a version that is no longer there. Use `mise upgrade` instead.
-
-Release archives are the substrate for most of the above: the install scripts
-and the npm fallback both download a platform archive from a published GitHub
-Release and verify its checksum.
+The install scripts download a platform-specific release archive and require a
+published GitHub Release for the requested version. The npm package is
+self-contained: the platform binary installs from the npm registry.
 
 ## npm
 
 ```bash
-npm install -g @twigpine/zero
+npm install -g @gitlawb/zero
 zero
 ```
 
@@ -56,47 +40,15 @@ cannot write to keeps failing — rerun the install or the command below with
 sufficient permissions). To trigger the fetch manually:
 
 ```bash
-node "$(npm root -g)/@twigpine/zero/scripts/postinstall.mjs"
+node "$(npm root -g)/@gitlawb/zero/scripts/postinstall.mjs"
 ```
 
-### Moving from @gitlawb/zero
-
-Zero was published as `@gitlawb/zero` up to 0.9.0. From 0.10.0 it is
-`@twigpine/zero`, and the old name gets no further releases.
-
-Both packages provide the `zero` command, so npm refuses to install the new
-one while the old one is installed (`EEXIST`). Forcing it is worse: a later
-uninstall of the old package removes the shared `zero` command. Quit any
-running `zero` (on Windows a running `zero.exe` cannot be removed), then
-uninstall the old package before installing the new one:
-
-```bash
-npm uninstall -g @gitlawb/zero
-npm install -g @twigpine/zero
-```
-
-With another package manager, the same two steps:
-
-```bash
-bun remove -g @gitlawb/zero && bun add -g @twigpine/zero
-pnpm remove -g @gitlawb/zero && pnpm add -g @twigpine/zero
-yarn global remove @gitlawb/zero && yarn global add @twigpine/zero
-```
-
-Config, sessions, logins, and plugins live in your user config and home
-directories, not in the package, so they carry over unchanged.
-
-0.10.0 was also published once as `@gitlawb/zero`, so an old install that
-updates lands on a working build. That build prints these steps when `zero`
-exits in a terminal, and `zero upgrade` and `zero update --check` print them
-too.
-
 ## Linux And macOS Script
 
 Install the latest release:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh | bash
 ```
 
 From a checkout:
@@ -121,7 +73,7 @@ scripts/install.sh --install-dir "$HOME/bin"
 
 Defaults:
 
-- Repository: `Twigpine/zero`
+- Repository: `Gitlawb/zero`
 - Version: latest GitHub release
 - Install path: `~/.local/bin/zero`
 
@@ -132,7 +84,7 @@ Requirements: Bash, `curl` or `wget`, `tar`, and `shasum` or `sha256sum`.
 Install the latest release:
 
 ```powershell
-irm https://raw.githubusercontent.com/Twigpine/zero/main/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | iex
 ```
 
 From a checkout:
@@ -155,59 +107,14 @@ powershell -ExecutionPolicy Bypass -File scripts/install.ps1 -InstallDir "$env:U
 
 Defaults:
 
-- Repository: `Twigpine/zero`
+- Repository: `Gitlawb/zero`
 - Version: latest GitHub release
 - Install path: `%LOCALAPPDATA%\zero\bin\zero.exe`
 
-## mise
-
-[mise](https://mise.jdx.dev/) installs Zero straight from the GitHub Release
-archives through its `ubi` backend, so there is nothing extra to publish and no
-registry in the middle:
-
-```bash
-mise use -g ubi:Twigpine/zero
-```
-
-Pin a version the same way you would any other tool:
-
-```bash
-mise use -g ubi:Twigpine/[email protected]
-```
-
-Updates come from `mise upgrade`. `zero upgrade` also works, because a
-mise-managed binary is an ordinary standalone install, but then mise's records
-describe a version that is no longer on disk. Prefer `mise upgrade`.
-
-## go install
-
-```bash
-go install github.com/Gitlawb/zero/cmd/zero@latest
-```
-
-Every release so far declares the module path `github.com/Gitlawb/zero`, so
-`go install` has to use that path; `github.com/Twigpine/zero/cmd/zero@latest`
-fails with "module declares its path as" until a release is tagged with the new
-module path.
-
-This builds from source, so it needs Go 1.26.10+ and it does not go through the
-release archives. Two consequences worth knowing before you pick it:
-
-- On Linux, Bubblewrap is still required for native sandboxing. Zero resolves
-  the helper in this order: an executable `zero-linux-sandbox` next to `zero`,
-  then `PATH`, then self-exec of the main binary. Standalone helpers remain
-  optional and preferred. See
-  [Sandbox Helpers For Source Builds](#sandbox-helpers-for-source-builds).
-- `zero upgrade` treats the result as a standalone install and will replace the
-  binary with a release build rather than rebuilding from source. If you chose
-  `go install` deliberately, rerun it instead.
-
-macOS and Windows need no extra helper.
-
 ## From Source
 
 ```bash
-git clone https://github.com/Twigpine/zero.git
+git clone https://github.com/Gitlawb/zero.git
 cd zero
 go run ./cmd/zero
 ```
@@ -218,32 +125,25 @@ Build a local binary:
 go build -o zero ./cmd/zero
 ```
 
-Source builds require Go 1.26.10+.
+Source builds require Go 1.26.5+.
 
 ### Sandbox Helpers For Source Builds
 
-Release archives include the platform sandbox helpers. A source build of the
-main `zero` binary is enough for Linux native sandboxing. Zero resolves the
-helper in this order:
+Release archives include the platform sandbox helpers. If you build directly
+from source, build the helpers you need:
 
-1. an executable `zero-linux-sandbox` next to `zero`
-2. then `PATH`
-3. then self-exec of the main binary
-
-Bubblewrap must still be installed. Standalone helpers remain optional and
-preferred.
-
-A separate helper remains supported if it sits next to `zero` or on `PATH`:
+Linux:
 
 ```bash
 go build -o zero ./cmd/zero
-go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox   # optional
-go build -o zero-seccomp ./cmd/zero-seccomp               # optional compatibility wrapper
+go build -o zero-linux-sandbox ./cmd/zero-linux-sandbox
+go build -o zero-seccomp ./cmd/zero-seccomp
 ```
 
-Put `zero` on `PATH`, for example `~/.local/bin`. `zero-seccomp` is kept as a
-compatibility wrapper; the sandbox helper applies the Unix-socket filter itself
-when that sandbox option is enabled.
+Put `zero` and `zero-linux-sandbox` in the same directory on `PATH`, for example
+`~/.local/bin`. `zero-seccomp` is kept as a compatibility wrapper; the sandbox
+helper applies the Unix-socket filter itself when that sandbox option is enabled.
+Linux native sandboxing also requires Bubblewrap to be installed.
 
 macOS uses the system sandbox and does not need an extra helper binary.
 
@@ -258,7 +158,7 @@ seccomp filter on Android:
 pkg install golang
 
 # Build Zero for Android
-git clone https://github.com/Twigpine/zero.git
+git clone https://github.com/Gitlawb/zero.git
 cd zero
 CGO_ENABLED=0 GOOS=android GOARCH=arm64 go build -ldflags="-s -w" -o zero ./cmd/zero
 
@@ -334,34 +234,10 @@ directory.
 
 ## Updating
 
-Check for a newer release, then download, verify, and install it in place:
+Check for a newer release:
 
 ```bash
 zero update --check
-zero upgrade
 ```
 
-See the [update guide](UPDATE.md) for update modes, flags, and platform details.
-
-`zero upgrade` behaves differently depending on how Zero was installed, because
-overwriting a binary a package manager owns leaves that manager describing a
-version that is no longer there:
-
-- **npm**: runs `npm install -g @twigpine/zero@latest` for you. An install of
-  the old `@gitlawb/zero` package refuses instead and prints the steps in
-  [Moving from @gitlawb/zero](#moving-from-gitlawbzero): that name gets no
-  further releases, so npm would only reinstall the same version.
-- **Homebrew**: refuses, and tells you to run `brew upgrade zero`. Replacing the
-  keg binary directly would be reverted by the next `brew upgrade` or
-  `brew reinstall`.
-- **everything else**: downloads the verified release archive and replaces the
-  binary in place.
-
-Homebrew is detected by the binary living inside a Cellar keg that carries
-Homebrew's own `INSTALL_RECEIPT.json`. The keg shape alone is not enough: a
-directory tree you built yourself can have exactly that shape, and refusing to
-update an install Homebrew never touched would be a real cost for a made-up
-reason. The receipt is the thing only Homebrew writes.
-
-An ordinary install under `/usr/local/bin` is left alone even on an Intel Mac
-where that is also the Homebrew prefix.
+Then reinstall with npm or rerun the install script for the version you want.

docs/MODEL_RPM.md

@@ -1,26 +0,0 @@
-# Local per-model completion limits
-
-Add `modelRPM` to the existing Zero config file:
-
-```json
-{"modelRPM": {"gpt-4.1": 30, "claude-sonnet-4.5": 15}}
-```
-
-Keys resolve through the model registry; custom IDs match exactly after trimming
-whitespace. Missing keys and zero mean unlimited. Negative limits and conflicting
-aliases are configuration errors. Project config may add or tighten a user cap,
-but cannot relax it. Changes take effect on the next Zero process start.
-
-For `zero exec` and interactive agent turns, admission happens immediately before
-the wrapped turn session's `Stream`. N admissions fit in any sliding 60-second
-window; N+1 returns a local rate-limit error before entering that method. The
-error reports when a slot expires. Exec uses its existing provider-error exit
-code plus a local-limit hint. There is no sleep or hidden retry. Failed admitted
-requests still consume a slot.
-
-Sessions and model switches share a limiter in one process. Separate processes
-have independent windows; restarting clears them. This is not an account-wide
-cap. It counts Stream admissions, not all HTTP requests: setup/prewarm,
-compaction, provider-internal retries, discovery and direct calls outside that
-boundary are not counted. No TPM, cost budgets, persistence, cross-process
-coordination or new runtime/Python dependency is introduced.

docs/NPM_PACKAGING.md

@@ -1,6 +1,6 @@
 # npm packaging
 
-How `@twigpine/zero` is put together on npm, why it is shaped this way, and the
+How `@gitlawb/zero` is put together on npm, why it is shaped this way, and the
 rules the release pipeline must follow. Read this before touching
 `package.json`, `bin/zero.js`, `scripts/postinstall.mjs`,
 `scripts/npm/build-platform-packages.mjs`, or the npm-publish steps of
@@ -8,7 +8,7 @@ rules the release pipeline must follow. Read this before touching
 
 ## Goals
 
-A `npm install -g @twigpine/zero` must be **silent and self-contained**:
+A `npm install -g @gitlawb/zero` must be **silent and self-contained**:
 
 - No `EBADENGINE` warnings — ours or from any package in the dependency tree.
 - No install scripts anywhere in the tree, so npm's `allow-scripts` gating,
@@ -25,15 +25,15 @@ The model is the one used by Codex, esbuild, and Biome: a tiny wrapper package
 plus per-platform payloads carrying the native binaries.
 
 ```
-@twigpine/zero                    <- wrapper: bin/zero.js + optionalDependencies
-├─ @twigpine/zero-darwin-arm64 -> npm:@twigpine/zero@{version}-darwin-arm64
-├─ @twigpine/zero-darwin-x64   -> npm:@twigpine/zero@{version}-darwin-x64
-├─ @twigpine/zero-linux-arm64  -> npm:@twigpine/zero@{version}-linux-arm64
-├─ @twigpine/zero-linux-x64    -> npm:@twigpine/zero@{version}-linux-x64
-└─ @twigpine/zero-win32-x64    -> npm:@twigpine/zero@{version}-win32-x64
+@gitlawb/zero                    <- wrapper: bin/zero.js + optionalDependencies
+├─ @gitlawb/zero-darwin-arm64 -> npm:@gitlawb/zero@{version}-darwin-arm64
+├─ @gitlawb/zero-darwin-x64   -> npm:@gitlawb/zero@{version}-darwin-x64
+├─ @gitlawb/zero-linux-arm64  -> npm:@gitlawb/zero@{version}-linux-arm64
+├─ @gitlawb/zero-linux-x64    -> npm:@gitlawb/zero@{version}-linux-x64
+└─ @gitlawb/zero-win32-x64    -> npm:@gitlawb/zero@{version}-win32-x64
 ```
 
-- The platform "packages" are **versions of the same `@twigpine/zero` package**,
+- The platform "packages" are **versions of the same `@gitlawb/zero` package**,
   published at suffixed versions (`0.4.0-linux-x64`) and referenced through
   `npm:` aliases in `optionalDependencies`. One package name means one npm
   trusted-publisher configuration — no new publish credentials per platform.
@@ -56,7 +56,7 @@ plus per-platform payloads carrying the native binaries.
 
 ### Binary resolution in `bin/zero.js`
 
-1. Resolve `@twigpine/zero-<platform>-<arch>` and exec the `zero` binary from
+1. Resolve `@gitlawb/zero-<platform>-<arch>` and exec the `zero` binary from
    it. This wins over any previously downloaded copy — the platform version is
    pinned to the wrapper release.
 2. Fall back to a binary previously downloaded next to the wrapper.
@@ -103,22 +103,10 @@ dependencies of the wrapper:
   platform binary (plus the musl variant on linux, which its launcher detects
   at runtime) — about 65 MB saved per platform package.
 
-### One package name
-
-The npm name lives in `package.json` and nothing else repeats it:
-`scripts/npm/build-platform-packages.mjs` names the wrapper, the platform
-versions, the alias names, and the alias targets from it, and `bin/zero.js`
-reads its own `package.json` to derive the alias it resolves. The Go side
-needs the name as a constant (`npmPackageName` in
-`internal/update/installmethod.go`), and a test holds it equal to
-`package.json`.
-
 ## Publishing rules (release pipeline)
 
 These are the invariants `release-artifacts.yml` must hold. Breaking the first
-one is user-visible immediately. `scripts/npm/publish-packages.sh` implements
-them, and `internal/npmwrapper/publish_test.go` runs it against a fake
-registry.
+one is user-visible immediately.
 
 1. **Platform versions must never become `latest`.** `0.4.0-linux-x64` is a
    semver *prerelease* of `0.4.0`; publishing it without an explicit
@@ -130,67 +118,20 @@ registry.
    bootstrap publish) — a missing value must not abort the job between the
    platform and wrapper publishes, which would strand a half-published
    release.
-2. **Platform versions are on the registry before the wrapper.** The
-   wrapper's `optionalDependencies` pin exact suffixed versions; publishing
-   the wrapper first would create a window where installs resolve aliases
-   that 404. Ordering the uploads is not enough: npm applies a publish
-   asynchronously, and in 0.10.0 a platform version appeared ten minutes
-   after its upload returned, after the wrapper. The publish script waits
-   until npm shows every platform version before it publishes the wrapper,
-   and waits the same way for `latest` afterwards (up to 30 minutes in all).
+2. **Platform versions publish before the wrapper.** The wrapper's
+   `optionalDependencies` pin exact suffixed versions; publishing the wrapper
+   first would create a window where installs resolve aliases that 404.
 3. **Exact-version pinning.** The wrapper at `X.Y.Z` references platform
    versions `X.Y.Z-<platform>-<arch>` exactly — never ranges — so a wrapper
-   and its binaries can never skew. The publish script refuses to start when
-   the wrapper's aliases do not match the platform payloads beside it.
+   and its binaries can never skew.
 4. All publishes go through the existing npm OIDC trusted-publishing flow and
    the `npm-publish` environment gate; no tokens. Because the platform
    payloads are versions of the same package, they reuse the single
-   trusted-publisher configuration. npm checks provenance against
-   `package.json` `repository`, so it must name the repository the workflow
-   runs in.
-5. **Re-runs are safe.** A version already on the registry is skipped rather
-   than republished, so re-running a job that failed between the platform and
-   wrapper publishes finishes the release. Only npm's E404 counts as "not
-   published"; a lookup that fails any other way is retried and then stops the
-   job before anything is published.
+   trusted-publisher configuration.
 
 `zero update` keeps working unchanged: it detects an npm install by finding a
-`package.json` named `@twigpine/zero` next to the running binary — true inside
-a platform payload too — and updates via `npm install -g @twigpine/zero@latest`.
-
-## The move from `@gitlawb/zero`
-
-Zero was published as `@gitlawb/zero` up to 0.9.0 and as `@twigpine/zero`
-from 0.10.0. There is no in-place migration: both packages own the `zero`
-bin, so npm refuses to install one over the other (`EEXIST`), and forcing it
-lets a later uninstall of the old package delete the shared bin. The user
-has to uninstall the old package and install the new one, in that order.
-
-Deprecating the old package alone would not have reached existing users.
-0.9.0's `zero upgrade` runs `npm install -g @gitlawb/zero@latest`; with
-nothing newer under that name, npm reinstalls nothing, prints no deprecation
-warning (it only warns when it installs something), and Zero reports the
-update as done. So 0.10.0 was published once more under the old name, as a
-bridge:
-
-- The release job assembled the same verified artifacts a second time with
-  `build-platform-packages.mjs --package-name @gitlawb/zero` and published
-  them with the same script, after the `@twigpine/zero` publish. The steps
-  that did this ran once and have been removed from `release-artifacts.yml`.
-- The bridge build knows its name from the `package.json` beside it. The Go
-  binary reports it as `InstallMethodNpmLegacy`: `zero upgrade` refuses
-  with the switch steps instead of reinstalling it, and `zero update --check`
-  adds them. `bin/zero.js` prints the same steps after `zero` exits, on a
-  terminal only. This handling stays in the code, since only a build
-  installed under the old name ever triggers it.
-- Updating from 0.9.0 installs that bridge build, so npm also shows the
-  deprecation message.
-
-`@gitlawb/zero` is deprecated on every version and no longer has a trusted
-publisher, so this release workflow cannot publish it again; another version
-would take a maintainer publishing by hand. Its versions stay on the
-registry: existing installs resolve their platform payload through them, so
-they must never be unpublished.
+`package.json` named `@gitlawb/zero` next to the running binary — true inside
+a platform payload too — and updates via `npm install -g @gitlawb/zero@latest`.
 
 ## Runbook: bumping the vendored helpers
 

docs/NPM_WRAPPER_SMOKE.md

@@ -2,8 +2,7 @@
 
 Run this checklist when a PR changes npm distribution files such as
 `package.json`, `bin/zero.js`, `scripts/npm/build-platform-packages.mjs`,
-`scripts/npm/publish-packages.sh`, Go build or release tooling, or the npm
-`bin` wrapper.
+Go build or release tooling, or the npm `bin` wrapper.
 
 ## Required Checks
 
@@ -38,24 +37,24 @@ path:
 
 ```bash
 # platform-package path
-mkdir -p /tmp/zero-sim/node_modules/@twigpine
-cp -R dist/npm/wrapper /tmp/zero-sim/node_modules/@twigpine/zero
+mkdir -p /tmp/zero-sim/node_modules/@gitlawb
+cp -R dist/npm/wrapper /tmp/zero-sim/node_modules/@gitlawb/zero
 cp -R dist/npm/platforms/zero-<platform>-<arch> \
-  "/tmp/zero-sim/node_modules/@twigpine/zero-<platform>-<arch>"
-node /tmp/zero-sim/node_modules/@twigpine/zero/bin/zero.js --version
+  "/tmp/zero-sim/node_modules/@gitlawb/zero-<platform>-<arch>"
+node /tmp/zero-sim/node_modules/@gitlawb/zero/bin/zero.js --version
 
 # first-run download fallback (delete the platform package first)
-rm -rf "/tmp/zero-sim/node_modules/@twigpine/zero-<platform>-<arch>"
-node /tmp/zero-sim/node_modules/@twigpine/zero/bin/zero.js --version
+rm -rf "/tmp/zero-sim/node_modules/@gitlawb/zero-<platform>-<arch>"
+node /tmp/zero-sim/node_modules/@gitlawb/zero/bin/zero.js --version
 ```
 
 ## Checklist
 
-- `package.json` has the expected package name (`@twigpine/zero`), version,
+- `package.json` has the expected package name (`@gitlawb/zero`), version,
   `bin.zero` entry, and NO `scripts` entries — the published package must be
   free of lifecycle scripts (see NPM_PACKAGING.md).
 - `scripts/npm/build-platform-packages.mjs` emits platform payloads whose
-  `package.json` is `@twigpine/zero@<version>-<platform>-<arch>` with matching
+  `package.json` is `@gitlawb/zero@<version>-<platform>-<arch>` with matching
   `os`/`cpu`, contains the executable binary and the vendored `helpers/` tree
   with regular-file (non-symlink) `.bin` shims, and a wrapper payload with no
   scripts, no dependencies, and the full five-alias `optionalDependencies`

docs/README.md

@@ -6,7 +6,6 @@ Zero.
 ## User Docs
 
 - [Install](INSTALL.md)
-- [Local per-model completion limits](MODEL_RPM.md)
 - [Update flow](UPDATE.md)
 - [OAuth logins and subscription-backed providers](oauth-subscriptions.md)
 

docs/SPECIALISTS.md

@@ -138,45 +138,3 @@ output or stop a still-running task by id.
 If Zero is restarted while a background task is still marked `running`, the new
 manager marks that task `error` and clears its PID. This avoids sending
 `TaskStop` to a stale PID that may now belong to an unrelated process.
-
-## Recovering an Interrupted Overwrite
-
-Zero writes and flushes a complete temporary file before publishing an overwrite,
-so a write failure before publication leaves the existing manifest unchanged
-instead of truncating it. On Unix, publication uses a same-directory rename and
-preserves the existing file's permission bits.
-
-On Windows, Zero uses `ReplaceFileW` to preserve the destination DACL instead of
-silently replacing it with the temporary file's inherited DACL. `ReplaceFileW`
-is not observer-atomic: another process can briefly observe the destination path
-as absent during replacement. Zero serializes specialist loads and managed
-mutations within one process, but cannot synchronize external processes or
-editors.
-
-Windows errors 1176 (`ERROR_UNABLE_TO_MOVE_REPLACEMENT`) and 1177
-(`ERROR_UNABLE_TO_MOVE_REPLACEMENT_2`) are partial replacement failures. With
-Zero's managed backup, 1176 leaves the original names intact and needs no manual
-recovery. For 1177, Zero has moved the original aside and tries to move it back.
-That rollback almost always succeeds, and the failed write changes nothing.
-
-If the rollback itself fails — typically because another process is holding a
-lock on the file — the original is not lost, but it is left under a name Zero
-does not read:
-
-```text
-<specialist dir>/.zero-replace-<random>.backup
-```
-
-Only `*.md` files are loaded as specialists, so until that file is renamed the
-specialist will not appear in `zero specialist list` or resolve by name. Zero's
-error message includes both the backup path and destination path. Recover by
-closing whatever holds the lock and renaming the backup back:
-
-```powershell
-Move-Item .zero-replace-<random>.backup <name>.md
-```
-
-A `.zero-replace-*.backup` can also linger after a *successful* overwrite if the
-backup could not be deleted afterward. That case is reported as a warning rather
-than an error — the new manifest is already in place, and the leftover file is
-safe to delete.

docs/UPDATE.md

@@ -1,23 +1,16 @@
 # Update Flow
 
 `zero update --check` checks the latest GitHub release and compares it with the
-local CLI version. `zero update --apply` (or its shorthand, `zero upgrade`)
-downloads, verifies, and installs it.
+local CLI version.
 
 ```bash
 zero update --check
 zero update --check --json
-zero update --check --repo Twigpine/zero
+zero update --check --repo Gitlawb/zero
 zero update --check --target windows-x64
-
-zero upgrade
-zero update --apply
 ```
 
-`--check` and `--apply` are mutually exclusive. `zero update` requires one of
-them explicitly; `zero upgrade` is `zero update` with `--apply` implied.
-
-`--check` is check-only:
+The command is intentionally check-only:
 
 - It does not replace the running binary.
 - It exits with code `0` when the check succeeds, even when an update is
@@ -26,39 +19,14 @@ them explicitly; `zero upgrade` is `zero update` with `--apply` implied.
 - `--json` prints the same result in a machine-readable format for scripts and
   CI.
 
-`--apply` installs the update in place:
-
-- npm installs delegate to `npm install -g @twigpine/zero@latest`. An install
-  of the old `@gitlawb/zero` package refuses, without a release check, and
-  prints the steps to switch to `@twigpine/zero` (see
-  [INSTALL.md](INSTALL.md#moving-from-gitlawbzero)); `--check` prints them
-  too.
-- Standalone installs download the release archive, verify its checksum,
-  extract it, and atomically replace the running binary plus any installed
-  optional sandbox helpers.
-- On Windows, the running executable is renamed aside and cleaned up on the
-  next `zero update --apply` or `zero upgrade`, since it can't be overwritten
-  while running.
-- `--target` cannot be combined with `--apply`; it only applies to `--check`,
-  since applying always installs onto the current machine.
-- `--repo` and `--endpoint` are ignored when applying to an npm-managed
-  install: that path delegates to `npm install -g @twigpine/zero@latest` and
-  takes its release from the npm registry, not from GitHub. They still apply to
-  `--check` there.
-- `--json` serializes Zero's final result. For npm-managed installs, npm may
-  also write progress output to stdout, so neither
-  `zero update --apply --json` nor `zero upgrade --json` is guaranteed to
-  produce a single parseable JSON document. Use `--check --json` for
-  machine-readable automation.
-
 Useful flags:
 
 | Flag | Purpose |
 |---|---|
-| `--repo <owner/repo>` | Use another GitHub repository for `--check` and `--apply`/`upgrade`. Ignored by an npm-managed apply. |
-| `--endpoint <url\|owner/repo>` | Use a specific release API URL or repository slug for `--check` and `--apply`/`upgrade`. Ignored by an npm-managed apply. |
+| `--repo <owner/repo>` | Check another GitHub repository. |
+| `--endpoint <url|owner/repo>` | Check a specific release API URL or repository slug. |
 | `--timeout <duration>` | Override the default release check timeout. |
-| `--target <platform-arch>` | Validate release metadata for another supported target (`--check` only). |
+| `--target <platform-arch>` | Validate release metadata for another supported target. |
 
 Supported targets are `linux-x64`, `linux-arm64`, `macos-x64`, `macos-arm64`,
 `windows-x64`, and `windows-arm64`. Without `--target`, Zero checks the current
@@ -69,58 +37,8 @@ Endpoint resolution order:
 1. `--endpoint`
 2. `ZERO_UPDATE_RELEASE_URL`
 3. `--repo`
-4. `https://api.github.com/repos/Twigpine/zero/releases/latest`
+4. `https://api.github.com/repos/Gitlawb/zero/releases/latest`
 
 Installer scripts download the matching release asset for the local platform and
-verify its `.sha256` file. If Zero is already installed, run `zero upgrade`
-instead of reinstalling.
-
-## Windows recovery state (standalone installs)
-
-This section describes Windows only. On Linux and macOS a standalone update
-renames the staged file directly over the executable path through the
-installation directory's file descriptor, so the replacement is atomic and no
-aside copy, marker, or recovery record is ever created — a failed update leaves
-the previous binary in place and nothing to resolve.
-
-On Windows, a running executable cannot be replaced in place, so the previous
-binary is moved aside to `<binary>.zero-update-<random>.old` first. The updater
-records that exact file — bound to its filesystem identity, in per-user state
-outside the installation directory — and deletes only that recorded copy after
-the next update is verified in place. Backups it did not create are never
-removed, so a file such as `zero.exe.before-manual-patch.old` is left alone. A
-recorded copy that something else holds open (an on-access scanner, an editor)
-stays recorded and is removed by a later update instead.
-
-An update **refuses to run** while unresolved recovery state exists beside the
-binary:
-
-| State on disk | Meaning |
-|---|---|
-| `<binary>.old` (or `<binary>.<suffix>.old`) plus a `.keep` marker, or a per-user update-recovery record naming that copy | A previous update could not restore the original binary. The `.old` file may be the last binary the updater verified; the installed one may be unverified. The `.keep` marker is in the installation directory and can be deleted; the identity-bound record is not, so deleting the marker alone does not end the refusal. |
-| `<binary>.…old.<suffix>.recovery` | A previous update could not even write the marker, so it moved the last verified binary to that name. |
-| The binary is missing and one or more `*.old` files exist | The previous attempt was interrupted between moves. |
-
-The refusal names the paths involved and the two moves that end the state:
-either move the recovery binary back over the executable path, or — if the
-installed binary is the one you want — delete the recovery copy itself (not
-only the `.keep` marker) after verifying the installed binary, then update
-again. Deleting the marker alone is not enough: a failed restore also records
-that copy in per-user state outside the installation directory, and the next
-update consults that record even if the marker is gone.
-
-That trusted record lives under `%AppData%\zero\update-recovery` (per-user).
-The recovery copy and its `.keep` marker sit in the installation directory
-(per-machine). A second Windows account on the same machine does not see the
-first account's unresolved record; the sibling marker is the machine-visible
-signal for every account. There is no separate machine-wide store: writing one
-would need a shared writable location and ACL rules the updater does not own.
-
-This is deliberately fail-closed and differs from older releases, which deleted
-`<binary>.old` and proceeded. The trade-off is that anyone who can write in the
-installation directory can plant `<binary>.old` and `<binary>.old.keep` there
-and make every subsequent update refuse until an operator clears them. That is
-the safe direction: the alternative is an update that overwrites the only
-verified copy of the previous binary. If updates start refusing, inspect those
-files before removing them — an installation directory that a lower-privileged
-account can write to is itself worth fixing.
+verify its `.sha256` file. If Zero is already installed, run `zero update --check`
+before reinstalling.

docs/assets/concentrate-logo-dark.svg

@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80" width="80" height="80">
-      <circle cx="6.4" cy="6.4" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="6.4" r="1.3440793933950872" fill="#FFFFFF"/><circle cx="25.6" cy="6.4" r="2.03724340327418" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="6.4" r="2.5983501502741575" fill="#FFFFFF"/><circle cx="44.8" cy="6.4" r="3.087883576356698" fill="#FFFFFF"/><circle cx="54.4" cy="6.4" r="3.530261898078346" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="6.4" r="3.938362368365323" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="6.4" r="4.32" fill="#FFFFFF"/><circle cx="6.4" cy="16" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="16" r="1.2253406720005793" fill="#FFFFFF"/><circle cx="25.6" cy="16" r="1.8572691561702617" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="16" r="2.3688065860361402" fill="#FFFFFF"/><circle cx="44.8" cy="16" r="2.8150936284760535" fill="#FFFFFF"/><circle cx="54.4" cy="16" r="3.2183913448763177" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="16" r="3.5904393853139163" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="16" r="3.9383623683653233" fill="#FFFFFF"/><circle cx="6.4" cy="25.6" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="25.6" r="1.0983685811330859" fill="#FFFFFF"/><circle cx="25.6" cy="25.6" r="1.6648154545579388" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="25.6" r="2.1233464197636582" fill="#FFFFFF"/><circle cx="44.8" cy="25.6" r="2.5233883646560065" fill="#FFFFFF"/><circle cx="54.4" cy="25.6" r="2.8848956178295655" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="25.6" r="3.2183913448763177" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="25.6" r="3.530261898078346" fill="#FFFFFF"/><circle cx="6.4" cy="35.199999999999996" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="35.199999999999996" r="0.9607316398574451" fill="#FFFFFF"/><circle cx="25.6" cy="35.199999999999996" r="1.456196862502631" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="35.199999999999996" r="1.8572691561702614" fill="#FFFFFF"/><circle cx="44.8" cy="35.199999999999996" r="2.2071817085957024" fill="#FFFFFF"/><circle cx="54.4" cy="35.199999999999996" r="2.5233883646560065" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="35.199999999999996" r="2.815093628476053" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="35.199999999999996" r="3.087883576356698" fill="#FFFFFF"/><circle cx="6.4" cy="44.8" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="44.8" r="0.8084233550482692" fill="#FFFFFF"/><circle cx="25.6" cy="44.8" r="1.2253406720005793" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="44.8" r="1.56282951468281" fill="#FFFFFF"/><circle cx="44.8" cy="44.8" r="1.8572691561702617" fill="#FFFFFF"/><circle cx="54.4" cy="44.8" r="2.1233464197636582" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="44.8" r="2.3688065860361402" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="44.8" r="2.5983501502741584" fill="#FFFFFF"/><circle cx="6.4" cy="54.4" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="54.4" r="0.633846499460857" fill="#FFFFFF"/><circle cx="25.6" cy="54.4" r="0.9607316398574451" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="54.4" r="1.225340672000579" fill="#FFFFFF"/><circle cx="44.8" cy="54.4" r="1.456196862502631" fill="#FFFFFF"/><circle cx="54.4" cy="54.4" r="1.6648154545579388" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="54.4" r="1.8572691561702614" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="54.4" r="2.03724340327418" fill="#FFFFFF"/><circle cx="6.4" cy="63.99999999999999" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="63.99999999999999" r="0.4181827351271541" fill="#FFFFFF"/><circle cx="25.6" cy="63.99999999999999" r="0.6338464994608571" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="63.99999999999999" r="0.8084233550482695" fill="#FFFFFF"/><circle cx="44.8" cy="63.99999999999999" r="0.9607316398574454" fill="#FFFFFF"/><circle cx="54.4" cy="63.99999999999999" r="1.0983685811330863" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="63.99999999999999" r="1.2253406720005795" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="63.99999999999999" r="1.3440793933950876" fill="#FFFFFF"/><circle cx="6.4" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="16" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="25.6" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="35.199999999999996" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="44.8" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="54.4" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="63.99999999999999" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/><circle cx="73.60000000000001" cy="73.60000000000001" r="0.3456" fill="#FFFFFF"/>
-    </svg>

docs/assets/concentrate-logo.svg

@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80" width="80" height="80">
-      <circle cx="6.4" cy="6.4" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="6.4" r="1.3440793933950872" fill="#0D0E10"/><circle cx="25.6" cy="6.4" r="2.03724340327418" fill="#0D0E10"/><circle cx="35.199999999999996" cy="6.4" r="2.5983501502741575" fill="#0D0E10"/><circle cx="44.8" cy="6.4" r="3.087883576356698" fill="#0D0E10"/><circle cx="54.4" cy="6.4" r="3.530261898078346" fill="#0D0E10"/><circle cx="63.99999999999999" cy="6.4" r="3.938362368365323" fill="#0D0E10"/><circle cx="73.60000000000001" cy="6.4" r="4.32" fill="#0D0E10"/><circle cx="6.4" cy="16" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="16" r="1.2253406720005793" fill="#0D0E10"/><circle cx="25.6" cy="16" r="1.8572691561702617" fill="#0D0E10"/><circle cx="35.199999999999996" cy="16" r="2.3688065860361402" fill="#0D0E10"/><circle cx="44.8" cy="16" r="2.8150936284760535" fill="#0D0E10"/><circle cx="54.4" cy="16" r="3.2183913448763177" fill="#0D0E10"/><circle cx="63.99999999999999" cy="16" r="3.5904393853139163" fill="#0D0E10"/><circle cx="73.60000000000001" cy="16" r="3.9383623683653233" fill="#0D0E10"/><circle cx="6.4" cy="25.6" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="25.6" r="1.0983685811330859" fill="#0D0E10"/><circle cx="25.6" cy="25.6" r="1.6648154545579388" fill="#0D0E10"/><circle cx="35.199999999999996" cy="25.6" r="2.1233464197636582" fill="#0D0E10"/><circle cx="44.8" cy="25.6" r="2.5233883646560065" fill="#0D0E10"/><circle cx="54.4" cy="25.6" r="2.8848956178295655" fill="#0D0E10"/><circle cx="63.99999999999999" cy="25.6" r="3.2183913448763177" fill="#0D0E10"/><circle cx="73.60000000000001" cy="25.6" r="3.530261898078346" fill="#0D0E10"/><circle cx="6.4" cy="35.199999999999996" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="35.199999999999996" r="0.9607316398574451" fill="#0D0E10"/><circle cx="25.6" cy="35.199999999999996" r="1.456196862502631" fill="#0D0E10"/><circle cx="35.199999999999996" cy="35.199999999999996" r="1.8572691561702614" fill="#0D0E10"/><circle cx="44.8" cy="35.199999999999996" r="2.2071817085957024" fill="#0D0E10"/><circle cx="54.4" cy="35.199999999999996" r="2.5233883646560065" fill="#0D0E10"/><circle cx="63.99999999999999" cy="35.199999999999996" r="2.815093628476053" fill="#0D0E10"/><circle cx="73.60000000000001" cy="35.199999999999996" r="3.087883576356698" fill="#0D0E10"/><circle cx="6.4" cy="44.8" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="44.8" r="0.8084233550482692" fill="#0D0E10"/><circle cx="25.6" cy="44.8" r="1.2253406720005793" fill="#0D0E10"/><circle cx="35.199999999999996" cy="44.8" r="1.56282951468281" fill="#0D0E10"/><circle cx="44.8" cy="44.8" r="1.8572691561702617" fill="#0D0E10"/><circle cx="54.4" cy="44.8" r="2.1233464197636582" fill="#0D0E10"/><circle cx="63.99999999999999" cy="44.8" r="2.3688065860361402" fill="#0D0E10"/><circle cx="73.60000000000001" cy="44.8" r="2.5983501502741584" fill="#0D0E10"/><circle cx="6.4" cy="54.4" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="54.4" r="0.633846499460857" fill="#0D0E10"/><circle cx="25.6" cy="54.4" r="0.9607316398574451" fill="#0D0E10"/><circle cx="35.199999999999996" cy="54.4" r="1.225340672000579" fill="#0D0E10"/><circle cx="44.8" cy="54.4" r="1.456196862502631" fill="#0D0E10"/><circle cx="54.4" cy="54.4" r="1.6648154545579388" fill="#0D0E10"/><circle cx="63.99999999999999" cy="54.4" r="1.8572691561702614" fill="#0D0E10"/><circle cx="73.60000000000001" cy="54.4" r="2.03724340327418" fill="#0D0E10"/><circle cx="6.4" cy="63.99999999999999" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="63.99999999999999" r="0.4181827351271541" fill="#0D0E10"/><circle cx="25.6" cy="63.99999999999999" r="0.6338464994608571" fill="#0D0E10"/><circle cx="35.199999999999996" cy="63.99999999999999" r="0.8084233550482695" fill="#0D0E10"/><circle cx="44.8" cy="63.99999999999999" r="0.9607316398574454" fill="#0D0E10"/><circle cx="54.4" cy="63.99999999999999" r="1.0983685811330863" fill="#0D0E10"/><circle cx="63.99999999999999" cy="63.99999999999999" r="1.2253406720005795" fill="#0D0E10"/><circle cx="73.60000000000001" cy="63.99999999999999" r="1.3440793933950876" fill="#0D0E10"/><circle cx="6.4" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="16" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="25.6" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="35.199999999999996" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="44.8" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="54.4" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="63.99999999999999" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/><circle cx="73.60000000000001" cy="73.60000000000001" r="0.3456" fill="#0D0E10"/>
-    </svg>

docs/assets/exa-logo-dark.svg

@@ -1,6 +0,0 @@
-<svg width="128" height="40" viewBox="0 0 413 129" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M106.417 9.30741C106.417 9.57392 106.324 9.83227 106.155 10.0388L61.5395 64.5L106.155 118.96C106.324 119.166 106.417 119.425 106.417 119.691V127.843C106.417 128.482 105.897 129 105.255 129H1.16175C0.520132 129 0 128.482 0 127.843V1.15695C0 0.517982 0.520131 0 1.16174 0H105.255C105.897 0 106.417 0.517984 106.417 1.15695V9.30741ZM19.0364 116.382H87.6921L53.363 74.4795L19.0364 116.382ZM12.6699 104.192L40.1426 70.6585H12.6699V104.192ZM12.6699 58.0409H39.8964L12.6699 24.8064V58.0409ZM53.363 54.5193L87.6921 12.6176H19.0364L53.363 54.5193Z" fill="white"/>
-<path d="M176.198 117.65C166.094 117.65 157.323 115.553 149.886 111.36C142.588 107.167 136.905 101.017 132.835 92.911C128.906 84.8045 126.941 75.0208 126.941 63.5599C126.941 53.3569 128.976 44.2022 133.046 36.0957C137.256 27.9892 143.01 21.6298 150.307 17.0175C157.744 12.4052 166.024 10.099 175.146 10.099C185.109 10.099 193.599 12.3353 200.616 16.8078C207.633 21.1406 212.965 27.3602 216.614 35.4667C220.263 43.4334 222.087 52.8677 222.087 63.7695V66.1766C222.087 66.8156 221.567 67.3336 220.925 67.3336H145.044C145.185 74.881 146.588 81.3802 149.254 86.8311C152.061 92.282 155.78 96.475 160.411 99.4101C165.182 102.205 170.515 103.603 176.409 103.603C183.285 103.603 189.179 102.066 194.091 98.9908C198.779 95.9225 201.741 91.008 202.977 84.2471C203.08 83.6853 203.565 83.267 204.139 83.267H219.737C220.429 83.267 220.969 83.8669 220.871 84.5494C220.038 90.3376 217.988 95.6406 214.72 100.458C211.211 105.63 206.159 109.823 199.564 113.037C193.108 116.112 185.32 117.65 176.198 117.65ZM202.721 54.5449C202.721 45.3203 200.265 37.9825 195.354 32.5316C190.582 27.0807 183.846 24.3552 175.146 24.3552C166.866 24.3552 160.06 27.2205 154.727 32.9509C149.395 38.6813 146.377 45.8794 145.676 54.5449H202.721Z" fill="white"/>
-<path d="M364.585 117.65C358.13 117.65 352.236 116.392 346.903 113.876C341.571 111.36 337.361 107.796 334.273 103.184C331.186 98.4317 329.642 92.9808 329.642 86.8311C329.642 77.7462 332.73 70.688 338.904 65.6564C345.219 60.485 353.359 57.0607 363.322 55.3835L385.004 52.0291C387.67 51.6098 389.705 51.0507 391.108 50.3519C392.652 49.5133 393.704 48.465 394.266 47.2071C394.967 45.8095 395.318 44.0624 395.318 41.9659C395.318 36.515 393.424 32.2521 389.635 29.1772C385.846 25.9626 380.934 24.3552 374.9 24.3552C367.322 24.3552 361.498 26.2421 357.428 30.0158C353.595 33.4387 351.443 38.1016 350.971 44.0046C350.922 44.622 350.412 45.1106 349.79 45.1106H334.014C333.353 45.1106 332.823 44.5605 332.872 43.9032C333.312 38.0771 335.042 32.6792 338.062 27.7096C341.29 22.3985 345.921 18.1356 351.955 14.921C358.13 11.7063 365.287 10.099 373.426 10.099C381.706 10.099 388.793 11.6364 394.687 14.7113C400.721 17.7862 405.282 22.1888 408.369 27.9193C411.456 33.6497 413 40.4284 413 48.2554V113.348C413 113.987 412.48 114.505 411.838 114.505H396.901C396.259 114.505 395.739 113.987 395.739 113.348V109.473C395.739 108.076 395.739 106.678 395.739 105.28C395.739 103.743 395.739 102.275 395.739 100.878C393.213 106.189 389.214 110.312 383.741 113.247C378.408 116.182 372.023 117.65 364.585 117.65ZM367.111 103.603C372.444 103.603 377.215 102.485 381.425 100.249C385.775 97.8727 389.143 94.6581 391.529 90.6048C394.055 86.4118 395.318 81.6597 395.318 76.3486V61.4634C394.757 62.302 393.564 63.0707 391.74 63.7695C389.915 64.4684 387.389 65.1672 384.162 65.866L369.427 68.5915C362.971 69.8494 357.849 71.9459 354.06 74.881C350.271 77.8161 348.377 81.7995 348.377 86.8311C348.377 91.8627 350.131 95.916 353.639 98.9908C357.288 102.066 361.779 103.603 367.111 103.603Z" fill="white"/>
-<path d="M285.673 62.9573L325.127 112.948C325.726 113.707 325.183 114.82 324.213 114.82H305.929C305.572 114.82 305.235 114.657 305.015 114.378L275.053 76.414L245.093 114.378C244.872 114.657 244.536 114.82 244.179 114.82H225.893C224.924 114.82 224.381 113.707 224.98 112.948L264.433 62.9573L227.177 15.7512C226.578 14.9921 227.121 13.8793 228.091 13.8793H246.375C246.732 13.8793 247.068 14.0423 247.289 14.3214L275.053 49.5006L302.818 14.3214C303.038 14.0423 303.375 13.8793 303.731 13.8793H322.016C322.985 13.8793 323.528 14.9921 322.929 15.7512L285.673 62.9573Z" fill="white"/>
-</svg>

docs/assets/exa-logo.svg

@@ -1,6 +0,0 @@
-<svg width="128" height="40" viewBox="0 0 413 129" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M106.417 9.30741C106.417 9.57392 106.324 9.83227 106.155 10.0388L61.5395 64.5L106.155 118.96C106.324 119.166 106.417 119.425 106.417 119.691V127.843C106.417 128.482 105.897 129 105.255 129H1.16175C0.520132 129 0 128.482 0 127.843V1.15695C0 0.517982 0.520131 0 1.16174 0H105.255C105.897 0 106.417 0.517984 106.417 1.15695V9.30741ZM19.0364 116.382H87.6921L53.363 74.4795L19.0364 116.382ZM12.6699 104.192L40.1426 70.6585H12.6699V104.192ZM12.6699 58.0409H39.8964L12.6699 24.8064V58.0409ZM53.363 54.5193L87.6921 12.6176H19.0364L53.363 54.5193Z" fill="#0143D9"/>
-<path d="M176.198 117.65C166.094 117.65 157.323 115.553 149.886 111.36C142.588 107.167 136.905 101.017 132.835 92.911C128.906 84.8045 126.941 75.0208 126.941 63.5599C126.941 53.3569 128.976 44.2022 133.046 36.0957C137.256 27.9892 143.01 21.6298 150.307 17.0175C157.744 12.4052 166.024 10.099 175.146 10.099C185.109 10.099 193.599 12.3353 200.616 16.8078C207.633 21.1406 212.965 27.3602 216.614 35.4667C220.263 43.4334 222.087 52.8677 222.087 63.7695V66.1766C222.087 66.8156 221.567 67.3336 220.925 67.3336H145.044C145.185 74.881 146.588 81.3802 149.254 86.8311C152.061 92.282 155.78 96.475 160.411 99.4101C165.182 102.205 170.515 103.603 176.409 103.603C183.285 103.603 189.179 102.066 194.091 98.9908C198.779 95.9225 201.741 91.008 202.977 84.2471C203.08 83.6853 203.565 83.267 204.139 83.267H219.737C220.429 83.267 220.969 83.8669 220.871 84.5494C220.038 90.3376 217.988 95.6406 214.72 100.458C211.211 105.63 206.159 109.823 199.564 113.037C193.108 116.112 185.32 117.65 176.198 117.65ZM202.721 54.5449C202.721 45.3203 200.265 37.9825 195.354 32.5316C190.582 27.0807 183.846 24.3552 175.146 24.3552C166.866 24.3552 160.06 27.2205 154.727 32.9509C149.395 38.6813 146.377 45.8794 145.676 54.5449H202.721Z" fill="black"/>
-<path d="M364.585 117.65C358.13 117.65 352.236 116.392 346.903 113.876C341.571 111.36 337.361 107.796 334.273 103.184C331.186 98.4317 329.642 92.9808 329.642 86.8311C329.642 77.7462 332.73 70.688 338.904 65.6564C345.219 60.485 353.359 57.0607 363.322 55.3835L385.004 52.0291C387.67 51.6098 389.705 51.0507 391.108 50.3519C392.652 49.5133 393.704 48.465 394.266 47.2071C394.967 45.8095 395.318 44.0624 395.318 41.9659C395.318 36.515 393.424 32.2521 389.635 29.1772C385.846 25.9626 380.934 24.3552 374.9 24.3552C367.322 24.3552 361.498 26.2421 357.428 30.0158C353.595 33.4387 351.443 38.1016 350.971 44.0046C350.922 44.622 350.412 45.1106 349.79 45.1106H334.014C333.353 45.1106 332.823 44.5605 332.872 43.9032C333.312 38.0771 335.042 32.6792 338.062 27.7096C341.29 22.3985 345.921 18.1356 351.955 14.921C358.13 11.7063 365.287 10.099 373.426 10.099C381.706 10.099 388.793 11.6364 394.687 14.7113C400.721 17.7862 405.282 22.1888 408.369 27.9193C411.456 33.6497 413 40.4284 413 48.2554V113.348C413 113.987 412.48 114.505 411.838 114.505H396.901C396.259 114.505 395.739 113.987 395.739 113.348V109.473C395.739 108.076 395.739 106.678 395.739 105.28C395.739 103.743 395.739 102.275 395.739 100.878C393.213 106.189 389.214 110.312 383.741 113.247C378.408 116.182 372.023 117.65 364.585 117.65ZM367.111 103.603C372.444 103.603 377.215 102.485 381.425 100.249C385.775 97.8727 389.143 94.6581 391.529 90.6048C394.055 86.4118 395.318 81.6597 395.318 76.3486V61.4634C394.757 62.302 393.564 63.0707 391.74 63.7695C389.915 64.4684 387.389 65.1672 384.162 65.866L369.427 68.5915C362.971 69.8494 357.849 71.9459 354.06 74.881C350.271 77.8161 348.377 81.7995 348.377 86.8311C348.377 91.8627 350.131 95.916 353.639 98.9908C357.288 102.066 361.779 103.603 367.111 103.603Z" fill="black"/>
-<path d="M285.673 62.9573L325.127 112.948C325.726 113.707 325.183 114.82 324.213 114.82H305.929C305.572 114.82 305.235 114.657 305.015 114.378L275.053 76.414L245.093 114.378C244.872 114.657 244.536 114.82 244.179 114.82H225.893C224.924 114.82 224.381 113.707 224.98 112.948L264.433 62.9573L227.177 15.7512C226.578 14.9921 227.121 13.8793 228.091 13.8793H246.375C246.732 13.8793 247.068 14.0423 247.289 14.3214L275.053 49.5006L302.818 14.3214C303.038 14.0423 303.375 13.8793 303.731 13.8793H322.016C322.985 13.8793 323.528 14.9921 322.929 15.7512L285.673 62.9573Z" fill="black"/>
-</svg>

docs/assets/gmi-cloud-logo-dark.svg

@@ -1,7 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 34 718 165" width="718" height="165" fill="#fff">
-  <path d="M123.292 132.486h-33.1c-2.644 0-4.808-2.395-4.808-5.363v-21.436c0-2.95 2.148-5.363 4.809-5.363h33.099c2.645 0 4.808-2.395 4.808-5.363V73.525c0-2.95 2.147-5.363 4.808-5.363h33.099c2.646 0 4.809-2.395 4.809-5.363V41.363c0-2.95-2.148-5.363-4.809-5.363H90.208c-2.645 0-4.808 2.395-4.808 5.363V62.8c0 2.95-2.147 5.363-4.808 5.363h-33.1c-2.645 0-4.808 2.395-4.808 5.363v21.436c0 2.95-2.147 5.363-4.808 5.363H4.808c-2.645 0-4.808 2.395-4.808 5.363v21.436c0 2.95 2.147 5.363 4.808 5.363h33.1c2.645 0 4.808 2.395 4.808 5.363v21.436c0 2.95 2.147 5.363 4.808 5.363h33.099c2.645 0 4.808 2.395 4.808 5.363v21.436c0 2.95 2.148 5.363 4.809 5.363h75.798c2.646 0 4.809-2.395 4.809-5.363v-21.436c0-2.95-2.148-5.363-4.809-5.363H132.94c-2.646 0-4.809-2.395-4.809-5.363v-21.436c0-2.95-2.147-5.363-4.808-5.363z"/>
-  <path d="M251.408 100.341c2.646 0 4.809 2.395 4.809 5.363v21.436c0 2.95-2.148 5.363-4.809 5.363H218.31c-2.646 0-4.809 2.395-4.809 5.363v21.436c0 2.95-2.147 5.363-4.808 5.363h-33.099c-2.645 0-4.808-2.395-4.808-5.363v-53.58c0-2.951 2.147-5.364 4.808-5.364h75.799zM510.68 40.105h-28.795v153.33h28.795zM717.43 40.105h-28.795v153.33h28.795z"/>
-  <path d="M532.41 40.105h-28.83l35.391 153.33H567.8zM653.242 40.105h-28.795v153.33h28.795z"/>
-  <path d="M596.594 193.435h-28.795l35.39-153.33h28.795zM452.028 114.062v27.042s-.139.174-.191.261h-83.069V114.08h83.295-.035z"/>
-  <path d="M452.028 141.347v35.651c-17.479 12.306-39.834 19.769-62.953 19.769-59.673 0-97.858-35.981-97.858-80.362s34.54-80.362 97.858-80.362c22.511 0 45.127 7.689 62.953 20.36v35.685c-13.105-16.42-37.856-28.743-62.953-28.743-44.052 0-70.695 20.846-70.695 53.077 0 32.232 28.691 53.077 70.695 53.077 25.323 0 49.727-11.906 62.744-28.1h.191v-.035z"/>
-</svg>

docs/assets/gmi-cloud-logo.svg

@@ -1,7 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 34 718 165" width="718" height="165" fill="#0D0E10">
-  <path d="M123.292 132.486h-33.1c-2.644 0-4.808-2.395-4.808-5.363v-21.436c0-2.95 2.148-5.363 4.809-5.363h33.099c2.645 0 4.808-2.395 4.808-5.363V73.525c0-2.95 2.147-5.363 4.808-5.363h33.099c2.646 0 4.809-2.395 4.809-5.363V41.363c0-2.95-2.148-5.363-4.809-5.363H90.208c-2.645 0-4.808 2.395-4.808 5.363V62.8c0 2.95-2.147 5.363-4.808 5.363h-33.1c-2.645 0-4.808 2.395-4.808 5.363v21.436c0 2.95-2.147 5.363-4.808 5.363H4.808c-2.645 0-4.808 2.395-4.808 5.363v21.436c0 2.95 2.147 5.363 4.808 5.363h33.1c2.645 0 4.808 2.395 4.808 5.363v21.436c0 2.95 2.147 5.363 4.808 5.363h33.099c2.645 0 4.808 2.395 4.808 5.363v21.436c0 2.95 2.148 5.363 4.809 5.363h75.798c2.646 0 4.809-2.395 4.809-5.363v-21.436c0-2.95-2.148-5.363-4.809-5.363H132.94c-2.646 0-4.809-2.395-4.809-5.363v-21.436c0-2.95-2.147-5.363-4.808-5.363z"/>
-  <path d="M251.408 100.341c2.646 0 4.809 2.395 4.809 5.363v21.436c0 2.95-2.148 5.363-4.809 5.363H218.31c-2.646 0-4.809 2.395-4.809 5.363v21.436c0 2.95-2.147 5.363-4.808 5.363h-33.099c-2.645 0-4.808-2.395-4.808-5.363v-53.58c0-2.951 2.147-5.364 4.808-5.364h75.799zM510.68 40.105h-28.795v153.33h28.795zM717.43 40.105h-28.795v153.33h28.795z"/>
-  <path d="M532.41 40.105h-28.83l35.391 153.33H567.8zM653.242 40.105h-28.795v153.33h28.795z"/>
-  <path d="M596.594 193.435h-28.795l35.39-153.33h28.795zM452.028 114.062v27.042s-.139.174-.191.261h-83.069V114.08h83.295-.035z"/>
-  <path d="M452.028 141.347v35.651c-17.479 12.306-39.834 19.769-62.953 19.769-59.673 0-97.858-35.981-97.858-80.362s34.54-80.362 97.858-80.362c22.511 0 45.127 7.689 62.953 20.36v35.685c-13.105-16.42-37.856-28.743-62.953-28.743-44.052 0-70.695 20.846-70.695 53.077 0 32.232 28.691 53.077 70.695 53.077 25.323 0 49.727-11.906 62.744-28.1h.191v-.035z"/>
-</svg>

docs/assets/novita-logo-dark.svg

@@ -1,11 +0,0 @@
-<svg width="151" height="30" viewBox="0 0 151 30" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_novita_dark)">
-<path d="M17.2639 0.640625V12.1297L0.03125 29.363H17.2639V17.8739H17.7376L28.7529 29.363H45.9875L17.2639 0.640625Z" fill="white"/>
-</g>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M126.329 25.5459H131.778V28.9895H127.454C124.427 28.9895 122.523 27.3247 122.523 24.2256V15.0698H119.438V11.5974H122.523L123.417 7.03393H126.3V11.5974H131.778V15.0698H126.329V25.5459ZM61.9158 6.0293L69.8449 23.7083H70.0753V6.0293H74.1983V28.9895H67.97L60.0409 11.3105H59.8105V28.9895H55.6875V6.0293H61.9158ZM84.78 29.334C79.734 29.334 76.5052 25.804 76.5052 20.3223C76.5052 14.8406 79.6764 11.2529 84.78 11.2529C89.8836 11.2529 92.9971 14.6966 92.9971 20.3223C92.9971 25.948 89.826 29.334 84.78 29.334ZM84.78 25.8904C87.0293 25.8904 88.903 25.115 88.9606 22.9053V17.7393C88.9606 15.4719 87.0581 14.6966 84.78 14.6966C82.5019 14.6966 80.5418 15.4719 80.5418 17.7393V22.9053C80.5994 25.1438 82.5307 25.8904 84.78 25.8904ZM97.4094 11.5686L101.907 25.3443H102.137L106.635 11.5686H110.787L104.587 28.9607H99.4547L93.284 11.5686H97.407H97.4094ZM112.922 11.5974H116.728V28.9895H112.922V11.5974ZM112.69 6.0293H116.957V9.30127H112.69V6.0293ZM141.12 29.3628C136.477 29.3628 133.508 25.8328 133.508 20.3223C133.508 14.8118 136.42 11.2817 141.12 11.2817C143.312 11.2817 145.099 12.1423 146.166 13.7495H146.397L147.147 11.5974H150.03V28.9895H147.147L146.397 26.8938H146.166C145.013 28.4146 143.081 29.3616 141.12 29.3616V29.3628ZM141.898 25.8904C144.176 25.8904 146.165 25.1726 146.223 22.9053V17.7393C146.223 15.4143 144.146 14.7542 141.812 14.7542C139.477 14.7542 137.545 15.4719 137.545 17.7393V22.9053C137.602 25.2014 139.592 25.8904 141.898 25.8904Z" fill="white"/>
-<defs>
-<clipPath id="clip0_novita_dark">
-<rect width="45.9562" height="28.7223" fill="white" transform="translate(0.0292969 0.640625)"/>
-</clipPath>
-</defs>
-</svg>

docs/assets/novita-logo.svg

@@ -1,11 +0,0 @@
-<svg width="151" height="30" viewBox="0 0 151 30" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_125_11573)">
-<path d="M17.2639 0.640625V12.1297L0.03125 29.363H17.2639V17.8739H17.7376L28.7529 29.363H45.9875L17.2639 0.640625Z" fill="black"/>
-</g>
-<path fill-rule="evenodd" clip-rule="evenodd" d="M126.329 25.5459H131.778V28.9895H127.454C124.427 28.9895 122.523 27.3247 122.523 24.2256V15.0698H119.438V11.5974H122.523L123.417 7.03393H126.3V11.5974H131.778V15.0698H126.329V25.5459ZM61.9158 6.0293L69.8449 23.7083H70.0753V6.0293H74.1983V28.9895H67.97L60.0409 11.3105H59.8105V28.9895H55.6875V6.0293H61.9158ZM84.78 29.334C79.734 29.334 76.5052 25.804 76.5052 20.3223C76.5052 14.8406 79.6764 11.2529 84.78 11.2529C89.8836 11.2529 92.9971 14.6966 92.9971 20.3223C92.9971 25.948 89.826 29.334 84.78 29.334ZM84.78 25.8904C87.0293 25.8904 88.903 25.115 88.9606 22.9053V17.7393C88.9606 15.4719 87.0581 14.6966 84.78 14.6966C82.5019 14.6966 80.5418 15.4719 80.5418 17.7393V22.9053C80.5994 25.1438 82.5307 25.8904 84.78 25.8904ZM97.4094 11.5686L101.907 25.3443H102.137L106.635 11.5686H110.787L104.587 28.9607H99.4547L93.284 11.5686H97.407H97.4094ZM112.922 11.5974H116.728V28.9895H112.922V11.5974ZM112.69 6.0293H116.957V9.30127H112.69V6.0293ZM141.12 29.3628C136.477 29.3628 133.508 25.8328 133.508 20.3223C133.508 14.8118 136.42 11.2817 141.12 11.2817C143.312 11.2817 145.099 12.1423 146.166 13.7495H146.397L147.147 11.5974H150.03V28.9895H147.147L146.397 26.8938H146.166C145.013 28.4146 143.081 29.3616 141.12 29.3616V29.3628ZM141.898 25.8904C144.176 25.8904 146.165 25.1726 146.223 22.9053V17.7393C146.223 15.4143 144.146 14.7542 141.812 14.7542C139.477 14.7542 137.545 15.4719 137.545 17.7393V22.9053C137.602 25.2014 139.592 25.8904 141.898 25.8904Z" fill="black"/>
-<defs>
-<clipPath id="clip0_125_11573">
-<rect width="45.9562" height="28.7223" fill="white" transform="translate(0.0292969 0.640625)"/>
-</clipPath>
-</defs>
-</svg>

docs/assets/vercel-logo-dark.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="261" height="52" fill="none" viewBox="0 0 261 52"><path fill="white" d="M59.8 52H0L29.9 0zm67.82-38.45q4.9 0 8.81 2.13a15.5 15.5 0 0 1 6.22 6.32q2.3 4.2 2.38 10.26v2.06h-26.35q.27 4.4 2.58 6.92 2.38 2.47 6.36 2.47a8.4 8.4 0 0 0 7.76-4.93l9.16.67q-1.68 4.98-6.29 7.99t-10.63 3q-5.53 0-9.64-2.27a16 16 0 0 1-6.43-6.46 20 20 0 0 1-2.31-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26m62.55 0q4.47 0 8.18 1.66a15.3 15.3 0 0 1 6.15 4.6q2.38 3 2.87 7.05l-9.23.47a8 8 0 0 0-2.8-5 7.7 7.7 0 0 0-5.17-1.86q-4.33 0-6.7 3-2.4 3-2.39 8.52t2.38 8.52q2.37 3 6.71 3 3.15 0 5.39-1.87 2.24-1.92 2.72-5.46l9.3.4a14.7 14.7 0 0 1-2.87 7.33 16 16 0 0 1-6.15 4.86 21 21 0 0 1-8.39 1.66q-5.53 0-9.64-2.26a16 16 0 0 1-6.44-6.46 20 20 0 0 1-2.3-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26m38.66 0q4.9 0 8.8 2.13a15.5 15.5 0 0 1 6.22 6.32q2.31 4.2 2.38 10.26v2.06h-26.35q.28 4.4 2.58 6.92 2.38 2.47 6.36 2.47a8.4 8.4 0 0 0 7.77-4.93l9.15.67q-1.68 5-6.29 7.99t-10.62 3q-5.53 0-9.65-2.27a16 16 0 0 1-6.43-6.46 20 20 0 0 1-2.31-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26M86.9 36.69l17.24-34.33h10.8L89.96 49.63h-6.12L58.85 2.36h10.81zm71.62-15.55a11 11 0 0 1 2.47-4.48q2.28-2.31 6.38-2.31h3.4v7.26h-3.47q-2.91 0-4.79.8a5.8 5.8 0 0 0-2.77 2.5q-.9 1.72-.9 4.37v20.35h-8.89V14.35h8.33zm101.73 28.5h-8.95V2.35h8.95zM127.62 20.26q-3.7 0-6 2.2-2.32 2.2-2.87 6.2h17.05q-.48-4.34-2.72-6.33a7.8 7.8 0 0 0-5.46-2.07m101.2 0q-3.7 0-6 2.2-2.31 2.2-2.87 6.2H237q-.5-4.34-2.73-6.33a7.8 7.8 0 0 0-5.46-2.07" style="fill:white;fill-opacity:1;"/></svg>

docs/assets/vercel-logo.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="261" height="52" fill="none" viewBox="0 0 261 52"><path fill="black" d="M59.8 52H0L29.9 0zm67.82-38.45q4.9 0 8.81 2.13a15.5 15.5 0 0 1 6.22 6.32q2.3 4.2 2.38 10.26v2.06h-26.35q.27 4.4 2.58 6.92 2.38 2.47 6.36 2.47a8.4 8.4 0 0 0 7.76-4.93l9.16.67q-1.68 4.98-6.29 7.99t-10.63 3q-5.53 0-9.64-2.27a16 16 0 0 1-6.43-6.46 20 20 0 0 1-2.31-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26m62.55 0q4.47 0 8.18 1.66a15.3 15.3 0 0 1 6.15 4.6q2.38 3 2.87 7.05l-9.23.47a8 8 0 0 0-2.8-5 7.7 7.7 0 0 0-5.17-1.86q-4.33 0-6.7 3-2.4 3-2.39 8.52t2.38 8.52q2.37 3 6.71 3 3.15 0 5.39-1.87 2.24-1.92 2.72-5.46l9.3.4a14.7 14.7 0 0 1-2.87 7.33 16 16 0 0 1-6.15 4.86 21 21 0 0 1-8.39 1.66q-5.53 0-9.64-2.26a16 16 0 0 1-6.44-6.46 20 20 0 0 1-2.3-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26m38.66 0q4.9 0 8.8 2.13a15.5 15.5 0 0 1 6.22 6.32q2.31 4.2 2.38 10.26v2.06h-26.35q.28 4.4 2.58 6.92 2.38 2.47 6.36 2.47a8.4 8.4 0 0 0 7.77-4.93l9.15.67q-1.68 5-6.29 7.99t-10.62 3q-5.53 0-9.65-2.27a16 16 0 0 1-6.43-6.46 20 20 0 0 1-2.31-9.72q0-5.52 2.3-9.72a16 16 0 0 1 6.44-6.46 20 20 0 0 1 9.64-2.26M86.9 36.69l17.24-34.33h10.8L89.96 49.63h-6.12L58.85 2.36h10.81zm71.62-15.55a11 11 0 0 1 2.47-4.48q2.28-2.31 6.38-2.31h3.4v7.26h-3.47q-2.91 0-4.79.8a5.8 5.8 0 0 0-2.77 2.5q-.9 1.72-.9 4.37v20.35h-8.89V14.35h8.33zm101.73 28.5h-8.95V2.35h8.95zM127.62 20.26q-3.7 0-6 2.2-2.32 2.2-2.87 6.2h17.05q-.48-4.34-2.72-6.33a7.8 7.8 0 0 0-5.46-2.07m101.2 0q-3.7 0-6 2.2-2.31 2.2-2.87 6.2H237q-.5-4.34-2.73-6.33a7.8 7.8 0 0 0-5.46-2.07" style="fill:black;fill-opacity:1;"/></svg>

go.mod

@@ -1,28 +1,25 @@
-module github.com/Twigpine/zero
+module github.com/Gitlawb/zero
 
-go 1.26.10
+go 1.26.5
 
 require (
 	charm.land/bubbles/v2 v2.1.1
-	charm.land/bubbletea/v2 v2.0.9
+	charm.land/bubbletea/v2 v2.0.8
 	charm.land/lipgloss/v2 v2.0.5
-	github.com/Microsoft/go-winio v0.6.2
 	github.com/alecthomas/chroma/v2 v2.27.0
 	github.com/atotto/clipboard v0.1.4
 	github.com/aymanbagabas/go-udiff v0.4.1
 	github.com/charmbracelet/colorprofile v0.4.3
-	github.com/charmbracelet/ultraviolet v0.0.0-20260703014108-f5a850f9c2b7
 	github.com/charmbracelet/x/ansi v0.11.7
 	github.com/charmbracelet/x/term v0.2.2
 	github.com/coder/websocket v1.8.15
 	github.com/ledongthuc/pdf v0.0.0-20250511090121-5959a4027728
-	golang.org/x/image v0.45.0
 	golang.org/x/sys v0.47.0
-	gopkg.in/yaml.v3 v3.0.1
 	mvdan.cc/sh/v3 v3.13.1
 )
 
 require (
+	github.com/charmbracelet/ultraviolet v0.0.0-20260703014108-f5a850f9c2b7 // indirect
 	github.com/charmbracelet/x/exp/golden v0.0.0-20260615092313-b57e5e6d29bb // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect

go.sum

@@ -1,11 +1,9 @@
 charm.land/bubbles/v2 v2.1.1 h1:7r55WzBxpo/R3z98hGmY7KKPd3ET6vsf0Fb9sDHOV60=
 charm.land/bubbles/v2 v2.1.1/go.mod h1:GE6M31gaWZVXzGw73OeuTTgy4lX+OtkH0E5ymnNsHxo=
-charm.land/bubbletea/v2 v2.0.9 h1:DpJCMWKgzQK8SJv4zbKKFHAI10ymWy/evClPFk0k0f8=
-charm.land/bubbletea/v2 v2.0.9/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
+charm.land/bubbletea/v2 v2.0.8 h1:SxTJMhCAI3lbPmy4SgX5LWZ24AdINr4I6UEqzZvYJuY=
+charm.land/bubbletea/v2 v2.0.8/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
 charm.land/lipgloss/v2 v2.0.5 h1:kbNxgeeUOYv5J0YdpxFjfvf3dFvqH8Aci4zB6xqFtrY=
 charm.land/lipgloss/v2 v2.0.5/go.mod h1:9oqhxt4yxIMe6q5A4kHr44DremZk7J9UNh74GlWa5nc=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs=
@@ -64,15 +62,9 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 golang.org/x/exp v0.0.0-20260611194520-c48552f49976 h1:X8Hz2ImujgbmetVuW+w2YkyZChE3cBpZi2P158rTG9M=
 golang.org/x/exp v0.0.0-20260611194520-c48552f49976/go.mod h1:vnf4pv9iKZXY58sQE1L86zmNWJ4159e1RkcWiLCkeEY=
-golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
-golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 mvdan.cc/sh/v3 v3.13.1 h1:DP3TfgZhDkT7lerUdnp6PTGKyxxzz6T+cOlY/xEvfWk=
 mvdan.cc/sh/v3 v3.13.1/go.mod h1:lXJ8SexMvEVcHCoDvAGLZgFJ9Wsm2sulmoNEXGhYZD0=

internal/acp/desktopinterop_test.go

@@ -1,217 +0,0 @@
-package acp
-
-// desktopinterop_test.go covers three defects found by driving the real `zero
-// acp` binary from a desktop ACP client. Each is a case where ZERO and a
-// conforming client disagreed about the wire, and none of them failed loudly —
-// they produced a silent denial, a spurious crash, or two buttons the user
-// could not tell apart.
-//
-// A fourth, session/load restoring history without replaying it, is fixed by
-// #914 rather than here: that one also gives the replayed messages stable ids
-// and keeps session/resume replay-free, which this did not.
-
-import (
-	"errors"
-	"fmt"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/agent"
-)
-
-// ---- an offered option is an acceptable answer ----
-
-// The list the options were BUILT from and the list the answer was CHECKED
-// against were different whenever ZERO did not enumerate: the client was sent
-// Allow and Reject, and its reply was validated against an empty slice, so
-// every button it could possibly show failed closed to deny. The user clicked
-// Allow and ZERO recorded a denial, with nothing on screen to say so.
-func TestAnOfferedOptionIsAccepted(t *testing.T) {
-	// No AvailableDecisions: the fallback path, which is every permission event
-	// that is not a prompt.
-	req := agent.PermissionRequest{ToolName: "bash"}
-
-	options := buildPermissionOptions(req)
-	if len(options) == 0 {
-		t.Fatal("no options were offered")
-	}
-
-	for _, option := range options {
-		decision := decisionFromOutcome(
-			RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: option.OptionID},
-			buildPermissionOptions(req),
-		)
-		if string(decision.Action) != option.OptionID {
-			t.Fatalf("option %q was answered with %q (%s) — an offered option must be accepted",
-				option.OptionID, decision.Action, decision.Reason)
-		}
-	}
-}
-
-// The narrowing this validation exists for still holds: a client must not be
-// able to return a broader grant than it was shown.
-func TestAnOptionThatWasNotOfferedIsStillRefused(t *testing.T) {
-	req := agent.PermissionRequest{ToolName: "bash"}
-
-	decision := decisionFromOutcome(
-		RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(agent.PermissionDecisionAlwaysAllow)},
-		buildPermissionOptions(req),
-	)
-	if decision.Action != agent.PermissionDecisionDeny {
-		t.Fatalf("an unoffered broader grant was accepted as %q", decision.Action)
-	}
-}
-
-// The resolver is the single source of truth for both sides, which is what
-// makes the two agree by construction rather than by being kept in step.
-func TestOfferedDecisionsMatchWhatWasSent(t *testing.T) {
-	for _, req := range []agent.PermissionRequest{
-		{ToolName: "bash"},
-		{ToolName: "bash", AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowForSession,
-			agent.PermissionDecisionDeny,
-		}},
-	} {
-		offered := buildPermissionOptions(req)
-		for _, option := range buildPermissionOptions(req) {
-			if !actionOffered(option.OptionID, offered) {
-				t.Fatalf("option %q was sent but is not in the offered set %v", option.OptionID, offered)
-			}
-		}
-	}
-}
-
-// ---- two options the user can tell apart ----
-
-// request_permissions offers plain allow and strict-review allow together, and
-// both were labelled "Allow". The label is the only thing an ACP client shows,
-// so the panel presented two identical buttons where one silently enabled
-// strict auto-review of what was granted.
-func TestEveryOfferedOptionHasADistinctLabel(t *testing.T) {
-	req := agent.PermissionRequest{
-		ToolName: "request_permissions",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowStrict,
-			agent.PermissionDecisionAllowForSession,
-			agent.PermissionDecisionDeny,
-		},
-	}
-
-	seen := map[string]string{}
-	for _, option := range buildPermissionOptions(req) {
-		if previous, clash := seen[option.Name]; clash {
-			t.Fatalf("options %q and %q share the label %q — a user cannot tell them apart",
-				previous, option.OptionID, option.Name)
-		}
-		seen[option.Name] = option.OptionID
-	}
-}
-
-// The two remain distinct decisions: the label changed, the round trip did not.
-func TestStrictAllowStillRoundTrips(t *testing.T) {
-	req := agent.PermissionRequest{
-		ToolName: "request_permissions",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowStrict,
-		},
-	}
-	decision := decisionFromOutcome(
-		RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(agent.PermissionDecisionAllowStrict)},
-		buildPermissionOptions(req),
-	)
-	if decision.Action != agent.PermissionDecisionAllowStrict {
-		t.Fatalf("strict allow round-tripped as %q", decision.Action)
-	}
-}
-
-// ---- cancelling a permission is a cancellation, not a crash ----
-
-// Only context.Canceled was recognised, so dismissing a permission dialog came
-// back as JSON-RPC -32603 carrying the internal sentinel text. Clients render
-// that as a failed turn, so declining a tool looked like ZERO falling over —
-// and for apply_patch, dismissing is the ONLY refusal a client is offered.
-func TestCancellingAPermissionEndsTheTurnAsCancelled(t *testing.T) {
-	canceled := fmt.Errorf("%w for apply_patch", agent.ErrPermissionApprovalCanceled)
-
-	reason, err := stopReasonFor(agent.Result{}, canceled)
-	if err != nil {
-		t.Fatalf("stopReasonFor returned an error for a cancellation: %v", err)
-	}
-	if reason != StopCancelled {
-		t.Fatalf("stop reason = %q, want %q", reason, StopCancelled)
-	}
-}
-
-// A genuine failure must still be an error. Mapping too much to cancelled would
-// hide real faults behind a clean ending, which is the opposite mistake.
-func TestARealFailureIsStillAnError(t *testing.T) {
-	failure := errors.New("provider exploded")
-
-	if _, err := stopReasonFor(agent.Result{}, failure); !errors.Is(err, failure) {
-		t.Fatalf("stopReasonFor(%v) = %v, want the failure preserved", failure, err)
-	}
-}
-
-// The sentinel is matched through errors.Is, so it survives the wrapping every
-// return site applies — each one adds the tool name.
-func TestPermissionCancellationSurvivesWrapping(t *testing.T) {
-	if !errors.Is(fmt.Errorf("%w for bash", agent.ErrPermissionApprovalCanceled), agent.ErrPermissionApprovalCanceled) {
-		t.Fatal("a wrapped permission cancellation was not recognised")
-	}
-	if errors.Is(errors.New("something else"), agent.ErrPermissionApprovalCanceled) {
-		t.Fatal("an unrelated error was reported as a permission cancellation")
-	}
-}
-
-// A decision that never became an option cannot be selected.
-//
-// PermissionDecisionCancel is the case that exists today: optionKindFor drops
-// it because ACP expresses cancellation through the outcome, yet ZERO
-// enumerates it in AvailableDecisions for shell commands and apply_patch. While
-// the reply was validated against the DECISIONS rather than the sent options, a
-// client could return {"outcome":"selected","optionId":"cancel"} — an id it was
-// never shown — and abort the whole turn.
-//
-// Written over every option-less decision rather than over "cancel", so a
-// future action that optionKindFor declines to render is covered the day it is
-// added rather than the day someone remembers this test.
-func TestADecisionThatIsNotAnOptionCannotBeSelected(t *testing.T) {
-	for _, toolName := range []string{"bash", "apply_patch"} {
-		req := agent.PermissionRequest{
-			ToolName: toolName,
-			AvailableDecisions: []agent.PermissionDecisionAction{
-				agent.PermissionDecisionAllow,
-				agent.PermissionDecisionDeny,
-				agent.PermissionDecisionCancel,
-			},
-		}
-		options := buildPermissionOptions(req)
-
-		for _, action := range req.AvailableDecisions {
-			if actionOffered(string(action), options) {
-				continue // it was sent; selecting it is legitimate
-			}
-			decision := decisionFromOutcome(
-				RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(action)},
-				options,
-			)
-			if decision.Action != agent.PermissionDecisionDeny {
-				t.Fatalf("%s: %q was never sent as an option but was accepted as %q",
-					toolName, action, decision.Action)
-			}
-		}
-	}
-}
-
-// Cancelling is still reachable — through the outcome, which is where ACP puts
-// it. Closing the selected-id route must not close the real one.
-func TestCancellingThroughTheOutcomeStillWorks(t *testing.T) {
-	options := buildPermissionOptions(agent.PermissionRequest{ToolName: "apply_patch"})
-
-	decision := decisionFromOutcome(RequestPermissionOutcome{Outcome: OutcomeCancelled}, options)
-	if decision.Action != agent.PermissionDecisionCancel {
-		t.Fatalf("outcome=cancelled gave %q, want cancel", decision.Action)
-	}
-}

internal/acp/export_test.go

@@ -1,11 +0,0 @@
-// Test seams: helpers only test code uses, kept out of the production binary.
-package acp
-
-import "context"
-
-// Serve runs the connection read loop until the stream closes or ctx is done.
-func (a *Agent) Serve(ctx context.Context) error { return a.conn.Serve(ctx) }
-
-func ImageBlock(base64Data, mimeType string) ContentBlock {
-	return ContentBlock{Type: "image", Data: base64Data, MimeType: mimeType}
-}

internal/acp/image_history_test.go

@@ -1,181 +0,0 @@
-package acp
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/providermodeldiscovery"
-	"github.com/Twigpine/zero/internal/sessions"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-func TestACPImageAttachmentHistory(t *testing.T) {
-	for _, tc := range []struct {
-		name          string
-		text          string
-		images        int
-		withoutVision bool
-		want          string
-	}{
-		{name: "image only", images: 1, want: "[1 image]"},
-		{name: "text and images", text: "compare these", images: 2, want: "compare these [2 images]"},
-		{name: "ignored by model", images: 1, withoutVision: true, want: ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			deps := testDeps(t)
-			deps.DiscoverModels = func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error) {
-				modalities := []string{"text", "image"}
-				if tc.withoutVision {
-					modalities = []string{"text"}
-				}
-				return []providermodeldiscovery.Model{{ID: "fake-model", InputModalities: modalities}}, nil
-			}
-			type observedTurn struct {
-				prompt string
-				images int
-			}
-			turns := make(chan observedTurn, 8)
-			deps.RunAgent = func(_ context.Context, prompt string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-				turns <- observedTurn{prompt: prompt, images: len(opts.Images)}
-				return agent.Result{FinalAnswer: "received"}, nil
-			}
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			defer cancel()
-			workspace := t.TempDir()
-			h := newHarness(t, deps)
-			defer h.stop()
-			var created NewSessionResult
-			if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: workspace}, &created); err != nil {
-				t.Fatal(err)
-			}
-			const imageData = "image-history-bytes-not-for-storage"
-			encoded := base64.StdEncoding.EncodeToString([]byte(imageData))
-			var blocks []ContentBlock
-			if tc.text != "" {
-				blocks = append(blocks, TextBlock(tc.text))
-			}
-			for range tc.images {
-				blocks = append(blocks, ImageBlock(encoded, "image/png"))
-			}
-			if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: blocks}, &PromptResult{}); err != nil {
-				t.Fatal(err)
-			}
-			live := <-turns
-			wantLiveImages := tc.images
-			if tc.withoutVision {
-				wantLiveImages = 0
-			}
-			if live.images != wantLiveImages {
-				t.Fatalf("live images = %d, want %d", live.images, wantLiveImages)
-			}
-			events, err := deps.Store.ReadEvents(created.SessionID)
-			if err != nil || len(events) < 2 {
-				t.Fatalf("read completed turn: events=%+v err=%v", events, err)
-			}
-			var user struct {
-				Role        string `json:"role"`
-				Content     string `json:"content"`
-				Attachments struct {
-					Images int `json:"images"`
-				} `json:"attachments"`
-			}
-			if err := json.Unmarshal(events[0].Payload, &user); err != nil {
-				t.Fatal(err)
-			}
-			if user.Role != "user" || user.Content != tc.text || user.Attachments.Images != wantLiveImages {
-				t.Errorf("stored user event = %s, want original text and attachments.images=%d", events[0].Payload, wantLiveImages)
-			}
-			for _, event := range events {
-				if bytes.Contains(event.Payload, []byte(encoded)) || bytes.Contains(event.Payload, []byte(imageData)) {
-					t.Errorf("image data leaked into session event: %s", event.Payload)
-				}
-			}
-			followUp := func(t *testing.T, client *clientHarness) {
-				t.Helper()
-				if err := client.client.Call(ctx, MethodSessionPrompt, PromptParams{
-					SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("what did I send?")},
-				}, &PromptResult{}); err != nil {
-					t.Fatal(err)
-				}
-				got := <-turns
-				if want := "User: " + tc.want + "\n"; !strings.Contains(got.prompt, want) {
-					t.Errorf("seeded prompt missing user history %q: %q", want, got.prompt)
-				}
-				if got.images != 0 {
-					t.Errorf("historical images reattached: %d", got.images)
-				}
-			}
-			followUp(t, h)
-			h.stop()
-			// Fresh agents and stores reproduce a process restart, with no shared
-			// in-memory history to hide a missing attachment in the event log.
-			for _, method := range []string{MethodSessionLoad, MethodSessionResume} {
-				t.Run(method, func(t *testing.T) {
-					restoredDeps := deps
-					restoredDeps.Store = sessions.NewStore(sessions.StoreOptions{RootDir: deps.Store.RootDir})
-					loader := newHarness(t, restoredDeps)
-					defer loader.stop()
-					if err := loader.client.Call(ctx, method, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace}, &LoadSessionResult{}); err != nil {
-						t.Fatal(err)
-					}
-					if method == MethodSessionLoad {
-						select {
-						case update := <-loader.notifications:
-							if update.SessionUpdate != UpdateUserMessageChunk || update.Content.Text != tc.want {
-								t.Errorf("replayed user = %+v, want %q", update, tc.want)
-							}
-						case <-ctx.Done():
-							t.Fatal("user turn was not replayed")
-						}
-					} else {
-						select {
-						case update := <-loader.notifications:
-							t.Errorf("resume replayed transcript: %+v", update)
-						default:
-						}
-					}
-					followUp(t, loader)
-				})
-			}
-		})
-	}
-}
-
-func TestACPAttachmentHistoryReadsExistingSessionMessages(t *testing.T) {
-	deps := testDeps(t)
-	meta, err := deps.Store.Create(sessions.CreateInput{SessionID: "attachment-compatibility", Cwd: t.TempDir()})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for i, payload := range []string{
-		`{"role":"user","content":"old text"}`,
-		`{"role":"user","content":"","attachments":{"images":1,"documents":2}}`,
-		`{"role":"user","content":"still text","attachments":{"images":-1,"documents":1.5}}`,
-		`{"role":"assistant","content":"answer","attachments":{"images":1}}`,
-	} {
-		if _, err := deps.Store.AppendEvent(meta.SessionID, sessions.AppendEventInput{Type: sessions.EventMessage, Payload: json.RawMessage(payload)}); err != nil {
-			t.Fatalf("append message %d: %v", i, err)
-		}
-	}
-	a := &Agent{deps: deps}
-	_, messages, _, err := a.loadHistory(meta.SessionID, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := []string{"old text", "[1 image] [2 documents]", "still text", "answer"}
-	if len(messages) != len(want) {
-		t.Fatalf("messages = %+v", messages)
-	}
-	for i, text := range want {
-		if messages[i].content != text {
-			t.Errorf("message %d = %q, want %q", i, messages[i].content, text)
-		}
-	}
-}

internal/acp/jsonrpc.go

@@ -17,7 +17,6 @@ import (
 	"fmt"
 	"io"
 	"sync"
-	"sync/atomic"
 )
 
 // JSON-RPC 2.0 standard error codes.
@@ -81,21 +80,13 @@ type NotifyFunc func(ctx context.Context, params json.RawMessage)
 // requests/notifications — needed because ACP is bidirectional (the agent calls
 // the client for session/request_permission, fs/*, terminal/*).
 type Conn struct {
-	rawReader    io.Reader // wrapped lazily in Serve, once ctx is known — see interruptibleReader
-	readerCloser io.Closer
-	w            io.Writer
+	reader *bufio.Reader
+	w      io.Writer
 
 	writeMu sync.Mutex // serializes all writes to w
 
 	handlers  map[string]HandlerFunc
 	notifiers map[string]NotifyFunc
-	// Notifications for one method are an ordered stream: session/update in
-	// particular is stateful, so dispatching every frame in an unrelated
-	// goroutine can make a later chunk overtake an earlier one. Different
-	// methods retain independent tails, keeping session/cancel responsive while
-	// an update handler is busy.
-	notifyMu    sync.Mutex
-	notifyTails map[string]chan struct{}
 
 	mu      sync.Mutex
 	nextID  int64
@@ -105,35 +96,17 @@ type Conn struct {
 	wg sync.WaitGroup // tracks in-flight inbound handlers
 }
 
-// NewConn builds a peer reading ndjson from r and writing ndjson to w. This
-// Conn does not own r: cancelling Serve's context cannot forcibly close it, so
-// a Read on r that's genuinely idle (never returns on its own) leaves Serve
-// blocked until r itself produces something — e.g. a test that closes r's own
-// write side to unblock it. Use NewOwnedConn when this Conn should own r's
-// lifetime.
+// NewConn builds a peer reading ndjson from r and writing ndjson to w.
 func NewConn(r io.Reader, w io.Writer) *Conn {
 	return &Conn{
-		rawReader:   r,
-		w:           w,
-		handlers:    make(map[string]HandlerFunc),
-		notifiers:   make(map[string]NotifyFunc),
-		notifyTails: make(map[string]chan struct{}),
-		pending:     make(map[int64]chan rpcMessage),
+		reader:    bufio.NewReader(r),
+		w:         w,
+		handlers:  make(map[string]HandlerFunc),
+		notifiers: make(map[string]NotifyFunc),
+		pending:   make(map[int64]chan rpcMessage),
 	}
 }
 
-// NewOwnedConn is like NewConn but declares that this Conn exclusively owns r:
-// if r implements io.Closer, Serve closes it on context cancellation to
-// interrupt an otherwise-idle blocking Read. Only pass a reader whose lifetime
-// this Conn should control — e.g. the process's own stdin — never a reader a
-// caller retains or shares elsewhere, since cancellation tears it down
-// permanently for every consumer, not just this Conn.
-func NewOwnedConn(r io.Reader, w io.Writer) *Conn {
-	c := NewConn(r, w)
-	c.readerCloser, _ = r.(io.Closer)
-	return c
-}
-
 // Handle registers a request handler for method.
 func (c *Conn) Handle(method string, fn HandlerFunc) { c.handlers[method] = fn }
 
@@ -155,36 +128,17 @@ func (c *Conn) Serve(ctx context.Context) error {
 		c.wg.Wait()
 	}()
 
-	interruptible := newInterruptibleReader(ctx, c.rawReader, c.readerCloser)
-	reader := bufio.NewReader(interruptible)
-
 	for {
 		// One ndjson value per line. Framing per line (rather than streaming the
 		// decoder) keeps a single malformed line from making the whole connection
 		// unrecoverable — we report -32700 and continue.
-		//
-		// generation brackets this SPECIFIC ReadBytes call: bufio may invoke
-		// interruptible.Read zero or more times underneath it (zero when the
-		// answer is already sitting in bufio's own buffer — including a
-		// previously-buffered, not-yet-surfaced error: bufio can return a
-		// complete line with a nil error while quietly caching an error it
-		// received ALONGSIDE that line's bytes, which then surfaces on the VERY
-		// NEXT call with no further contact with interruptible.Read at all). The
-		// generation only advances inside interruptible.Read's own cancellation
-		// branch, so "unchanged across this call" is proof this call's outcome
-		// didn't pass through that branch — whether because it was answered from
-		// the buffer or because it raced ctx.Done() and won. Only that proof
-		// makes it safe to call the outcome genuine.
-		before := interruptible.generation()
-		line, err := reader.ReadBytes('\n')
-		interrupted := interruptible.generation() != before
-
+		line, err := c.reader.ReadBytes('\n')
 		if len(bytes.TrimSpace(line)) > 0 {
 			c.handleLine(ctx, line)
 		}
 		if err != nil {
 			c.failAllPending(err)
-			if errors.Is(err, io.EOF) || interrupted {
+			if errors.Is(err, io.EOF) || ctx.Err() != nil {
 				return nil
 			}
 			return err
@@ -192,100 +146,6 @@ func (c *Conn) Serve(ctx context.Context) error {
 	}
 }
 
-// interruptibleReader wraps a reader so a context cancellation can unblock a
-// currently in-flight Read without ever discarding — or misattributing — the
-// real outcome of a call that wasn't actually blocked.
-//
-// Each Read runs the underlying call on its own goroutine and races it against
-// ctx.Done(). If the underlying call finishes first, its result is returned
-// exactly as received; ctx being cancelled a moment later has no bearing on a
-// call that already had its answer. If ctx.Done() fires first, closer (when
-// non-nil) is closed to nudge a genuinely blocked read, the generation counter
-// is bumped, and the call STILL waits for and returns the underlying call's own
-// result — never a synthesized one — since closing a reader's outcome is
-// whatever the reader itself reports for it, not ours to invent.
-//
-// The counter is what lets Serve tell a call that was actually raced against
-// cancellation apart from one merely answered while cancellation happened to be
-// pending — the distinction the read loop's own doc comment explains.
-type interruptibleReader struct {
-	inner  io.Reader
-	closer io.Closer
-	ctx    context.Context
-
-	closeOnce sync.Once
-	gen       atomic.Int64
-}
-
-func newInterruptibleReader(ctx context.Context, inner io.Reader, closer io.Closer) *interruptibleReader {
-	return &interruptibleReader{inner: inner, closer: closer, ctx: ctx}
-}
-
-func (r *interruptibleReader) generation() int64 { return r.gen.Load() }
-
-type interruptibleReadResult struct {
-	n   int
-	err error
-}
-
-// interruptibleReadDecision arbitrates whether an underlying Read completed or
-// cancellation claimed it first. Completion is recorded before the result is
-// published so cancellation cannot misclassify a finished read merely because
-// its goroutine has not sent the result yet.
-type interruptibleReadDecision struct {
-	once sync.Once
-}
-
-func (d *interruptibleReadDecision) complete() { d.once.Do(func() {}) }
-
-func (d *interruptibleReadDecision) interrupt() (claimed bool) {
-	d.once.Do(func() { claimed = true })
-	return claimed
-}
-
-// readInner records completion in the Read call's deferred epilogue. It also
-// converts a reader panic into a terminal error so the helper goroutine always
-// publishes a result for Read to join.
-func (r *interruptibleReader) readInner(p []byte, decision *interruptibleReadDecision) (res interruptibleReadResult) {
-	defer func() {
-		if recovered := recover(); recovered != nil {
-			res = interruptibleReadResult{err: fmt.Errorf("acp: reader panicked: %v", recovered)}
-		}
-		decision.complete()
-	}()
-	res.n, res.err = r.inner.Read(p)
-	return res
-}
-
-func (r *interruptibleReader) Read(p []byte) (int, error) {
-	resultCh := make(chan interruptibleReadResult, 1)
-	var decision interruptibleReadDecision
-	go func() {
-		resultCh <- r.readInner(p, &decision)
-	}()
-	select {
-	case res := <-resultCh:
-		return res.n, res.err
-	case <-r.ctx.Done():
-		// resultCh may not be readable yet even when inner.Read has returned: its
-		// goroutine can be descheduled between recording completion and publishing
-		// the result. Only interrupt a call that cancellation actually claims.
-		if decision.interrupt() {
-			r.gen.Add(1)
-			if r.closer != nil {
-				r.closeOnce.Do(func() { _ = r.closer.Close() })
-			}
-		}
-		// Wait for the real result rather than returning synthetically: p is
-		// still being written by the goroutine above until it does, so returning
-		// early would race that write, and the actual error (whatever closing
-		// the reader produced, or whatever the reader was already about to
-		// report) is what the caller should see.
-		res := <-resultCh
-		return res.n, res.err
-	}
-}
-
 // handleLine decodes and dispatches one ndjson frame. A parse failure replies
 // with -32700 (id null) and keeps the connection alive.
 func (c *Conn) handleLine(ctx context.Context, line []byte) {
@@ -311,7 +171,11 @@ func (c *Conn) handleLine(ctx context.Context, line []byte) {
 		}(msg)
 	case msg.isNotify():
 		if fn := c.notifiers[msg.Method]; fn != nil {
-			c.dispatchNotification(ctx, msg, fn)
+			c.wg.Add(1)
+			go func(m rpcMessage) {
+				defer c.wg.Done()
+				fn(ctx, m.Params)
+			}(msg)
 		}
 	default:
 		// Malformed frame; reply only if we can identify a request id.
@@ -321,35 +185,6 @@ func (c *Conn) handleLine(ctx context.Context, line []byte) {
 	}
 }
 
-// dispatchNotification preserves wire order within one method without making
-// unrelated notification methods wait for each other. The read loop installs
-// each tail before starting its goroutine, so goroutine scheduling cannot
-// reorder the chain it observes.
-func (c *Conn) dispatchNotification(ctx context.Context, msg rpcMessage, fn NotifyFunc) {
-	c.notifyMu.Lock()
-	previous := c.notifyTails[msg.Method]
-	done := make(chan struct{})
-	c.notifyTails[msg.Method] = done
-	c.notifyMu.Unlock()
-
-	c.wg.Add(1)
-	go func() {
-		defer c.wg.Done()
-		defer func() {
-			close(done)
-			c.notifyMu.Lock()
-			if c.notifyTails[msg.Method] == done {
-				delete(c.notifyTails, msg.Method)
-			}
-			c.notifyMu.Unlock()
-		}()
-		if previous != nil {
-			<-previous
-		}
-		fn(ctx, msg.Params)
-	}()
-}
-
 func (c *Conn) dispatchRequest(ctx context.Context, msg rpcMessage) {
 	fn := c.handlers[msg.Method]
 	if fn == nil {

internal/acp/jsonrpc_test.go

@@ -3,30 +3,11 @@ package acp
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"io"
-	"sync"
-	"sync/atomic"
 	"testing"
 	"time"
 )
 
-type testReadCloser struct {
-	read  func([]byte) (int, error)
-	close func() error
-}
-
-func (r testReadCloser) Read(p []byte) (int, error) { return r.read(p) }
-func (r testReadCloser) Close() error               { return r.close() }
-
-type testReader func([]byte) (int, error)
-
-func (r testReader) Read(p []byte) (int, error) { return r(p) }
-
-type testWriter func([]byte) (int, error)
-
-func (w testWriter) Write(p []byte) (int, error) { return w(p) }
-
 // connPair wires two Conns together over in-memory pipes and serves both.
 func connPair(t *testing.T) (a, b *Conn, stop func()) {
 	t.Helper()
@@ -44,275 +25,6 @@ func connPair(t *testing.T) (a, b *Conn, stop func()) {
 	}
 }
 
-func TestConnServeCancellationInterruptsIdleRead(t *testing.T) {
-	pipeReader, writer := io.Pipe()
-	t.Cleanup(func() { _ = writer.Close() })
-	// Buffered + non-blocking send, not close: interruptibleReader retries each
-	// underlying Read on its own goroutine, so if bufio ever calls this more than
-	// once, a close() here would panic on the second call.
-	readStarted := make(chan struct{}, 1)
-	closeCalls := make(chan struct{}, 2)
-	reader := testReadCloser{
-		read: func(p []byte) (int, error) {
-			select {
-			case readStarted <- struct{}{}:
-			default:
-			}
-			return pipeReader.Read(p)
-		},
-		close: func() error {
-			closeCalls <- struct{}{}
-			return pipeReader.Close()
-		},
-	}
-	conn := NewOwnedConn(reader, io.Discard)
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan error, 1)
-	go func() { done <- conn.Serve(ctx) }()
-
-	<-readStarted
-	cancel()
-	select {
-	case err := <-done:
-		if err != nil {
-			t.Fatalf("Serve returned %v after cancellation, want nil", err)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("Serve did not return after cancelling an idle connection")
-	}
-	if got := len(closeCalls); got != 1 {
-		t.Fatalf("reader Close calls = %d, want 1", got)
-	}
-}
-
-func TestConnServePreservesTerminalReadErrorDuringCancellation(t *testing.T) {
-	for _, closable := range []bool{false, true} {
-		name := "non-closable"
-		if closable {
-			name = "closable"
-		}
-		t.Run(name, func(t *testing.T) {
-			wantErr := errors.New("read failed")
-			read := testReader(func(p []byte) (int, error) {
-				return copy(p, "not json"), wantErr
-			})
-			closeCalls := make(chan struct{}, 1)
-			var reader io.Reader = read
-			if closable {
-				reader = testReadCloser{
-					read: read,
-					close: func() error {
-						closeCalls <- struct{}{}
-						return nil
-					},
-				}
-			}
-			// Buffered + non-blocking send, not close: a later change adding a
-			// second write (e.g. an additional error frame) must not panic on a
-			// repeated close of an already-closed channel.
-			writeStarted := make(chan struct{}, 1)
-			releaseWrite := make(chan struct{})
-			writer := testWriter(func(p []byte) (int, error) {
-				select {
-				case writeStarted <- struct{}{}:
-				default:
-				}
-				<-releaseWrite
-				return len(p), nil
-			})
-			newConn := NewConn
-			if closable {
-				// Ownership matters here: this case exists to prove that even a
-				// Conn entitled to close its reader on cancellation still
-				// preserves a terminal error that was already decided.
-				newConn = NewOwnedConn
-			}
-			conn := newConn(reader, writer)
-			ctx, cancel := context.WithCancel(context.Background())
-			done := make(chan error, 1)
-			go func() { done <- conn.Serve(ctx) }()
-
-			<-writeStarted
-			cancel()
-			close(releaseWrite)
-			select {
-			case err := <-done:
-				if !errors.Is(err, wantErr) {
-					t.Fatalf("Serve returned %v, want terminal read error %v", err, wantErr)
-				}
-			case <-time.After(time.Second):
-				t.Fatal("Serve did not return after terminal read error")
-			}
-			if got := len(closeCalls); got != 0 {
-				t.Fatalf("reader Close calls = %d, want 0 after terminal read", got)
-			}
-		})
-	}
-}
-
-// TestConnServePreservesReadErrorBufferedAlongsideAPriorLine is the deterministic
-// regression test for jatmn's #782 finding: a real, non-EOF ReadBytes failure can
-// be DECIDED before cancellation ever happens, yet only SURFACE afterward, and
-// must still be reported rather than swallowed as a clean shutdown.
-//
-// bufio.Reader can obtain data AND a terminal error from ONE underlying Read call
-// (io.Reader explicitly permits returning (n>0, err) together). If a delimiter is
-// found within that data, ReadBytes returns the line with a nil error for THIS
-// call, but bufio caches the error internally and returns it — WITHOUT calling the
-// underlying reader again — on the very next ReadBytes call. This test forces that
-// exact sequence: the underlying reader hands back one complete, validly-framed
-// line together with wantErr in a SINGLE call (asserted below to be its ONLY
-// call), the loop dispatches that line through a synchronous path that blocks the
-// read loop, cancellation is asserted to have happened before the loop attempts
-// its next read, and only then is the block released. By the time the read loop
-// asks for more input, cancellation is already in effect and the underlying
-// reader is never touched again — so if Serve attributed the resulting error to
-// cancellation merely because ctx was already done, it would incorrectly return
-// nil. It must instead recognize that this read was answered entirely from
-// bufio's own cache, never raced against ctx.Done(), and report wantErr.
-func TestConnServePreservesReadErrorBufferedAlongsideAPriorLine(t *testing.T) {
-	wantErr := errors.New("read failed")
-	var readCalls atomic.Int32
-	read := testReader(func(p []byte) (int, error) {
-		readCalls.Add(1)
-		// An unsupported jsonrpc version with an id takes the SYNCHRONOUS
-		// writeError path in handleLine (not a dispatched goroutine), giving this
-		// test a reliable blocking point between processing this line and the
-		// loop's next ReadBytes call.
-		return copy(p, `{"jsonrpc":"1.0","id":1}`+"\n"), wantErr
-	})
-	writeStarted := make(chan struct{}, 1)
-	releaseWrite := make(chan struct{})
-	var releaseWriteOnce sync.Once
-	release := func() { releaseWriteOnce.Do(func() { close(releaseWrite) }) }
-	t.Cleanup(release)
-	writer := testWriter(func(p []byte) (int, error) {
-		select {
-		case writeStarted <- struct{}{}:
-		default:
-		}
-		<-releaseWrite
-		return len(p), nil
-	})
-	conn := NewConn(read, writer)
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan error, 1)
-	go func() { done <- conn.Serve(ctx) }()
-
-	// The synchronous write confirms the first (and, per the panic guard above,
-	// only) read has already returned and is being processed — cancelling now
-	// lands squarely in the gap between that read and the loop's next one, never
-	// racing an in-flight interruptibleReader.Read call.
-	select {
-	case <-writeStarted:
-	case <-time.After(time.Second):
-		t.Fatal("Serve did not reach the synchronous write")
-	}
-	cancel()
-	release()
-
-	select {
-	case err := <-done:
-		if !errors.Is(err, wantErr) {
-			t.Fatalf("Serve returned %v, want the buffered terminal read error %v", err, wantErr)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("Serve did not return after the buffered terminal read error")
-	}
-	if got := readCalls.Load(); got != 1 {
-		t.Fatalf("underlying Read calls = %d, want exactly 1 (bufio must have served the second ReadBytes from its cache)", got)
-	}
-}
-
-// TestInterruptibleReaderPrefersDecidedResultOverCancellation is the regression
-// test for jatmn's second #782 finding: interruptibleReader.Read's select
-// between resultCh and ctx.Done() chooses pseudo-randomly when both are ready,
-// so a real, already-decided outcome (e.g. a terminal transport error) could be
-// misattributed to cancellation purely because ctx also happened to be done by
-// the time the select ran. Each iteration lets the underlying Read return (so
-// resultCh already holds the real outcome) before cancelling, maximizing the
-// odds of landing exactly in that ambiguous window; the generation counter must
-// never advance when the real, already-decided result is what gets returned.
-func TestInterruptibleReaderPrefersDecidedResultOverCancellation(t *testing.T) {
-	wantErr := errors.New("read failed")
-	for i := 0; i < 100; i++ {
-		resultReady := make(chan struct{})
-		read := testReader(func(p []byte) (int, error) {
-			defer close(resultReady)
-			return copy(p, "x"), wantErr
-		})
-		ctx, cancel := context.WithCancel(context.Background())
-		r := newInterruptibleReader(ctx, read, nil)
-
-		readDone := make(chan interruptibleReadResult, 1)
-		go func() {
-			n, err := r.Read(make([]byte, 8))
-			readDone <- interruptibleReadResult{n, err}
-		}()
-
-		<-resultReady
-		time.Sleep(time.Millisecond) // bias resultCh's send ahead of cancel
-		cancel()
-
-		res := <-readDone
-		if !errors.Is(res.err, wantErr) {
-			t.Fatalf("iteration %d: Read returned %v, want %v", i, res.err, wantErr)
-		}
-		if got := r.generation(); got != 0 {
-			t.Fatalf("iteration %d: generation = %d, want 0 (a decided result must never be attributed to cancellation)", i, got)
-		}
-		cancel()
-	}
-}
-
-// TestInterruptibleReadCompletionWinsBeforeResultPublication exercises the
-// actual inner-read wrapper at the handoff between the underlying Read and the
-// helper goroutine's result publication. Cancellation must not reclassify a
-// result returned by this wrapper as interrupted.
-func TestInterruptibleReadCompletionWinsBeforeResultPublication(t *testing.T) {
-	wantErr := errors.New("read failed")
-	read := testReader(func(p []byte) (int, error) {
-		return copy(p, "x"), wantErr
-	})
-	r := newInterruptibleReader(context.Background(), read, nil)
-	var decision interruptibleReadDecision
-	readComplete := make(chan struct{})
-	resultCh := make(chan interruptibleReadResult)
-	go func() {
-		res := r.readInner(make([]byte, 8), &decision)
-		close(readComplete)
-		resultCh <- res
-	}()
-
-	<-readComplete
-	if decision.interrupt() {
-		t.Fatal("cancellation claimed a read that completed before result publication")
-	}
-	res := <-resultCh
-	if res.n != 1 || !errors.Is(res.err, wantErr) {
-		t.Fatalf("inner read result = (%d, %v), want (1, %v)", res.n, res.err, wantErr)
-	}
-}
-
-func TestConnServeReportsReaderPanicAsTerminalError(t *testing.T) {
-	read := testReader(func([]byte) (int, error) {
-		panic("boom")
-	})
-	conn := NewConn(read, io.Discard)
-	done := make(chan error, 1)
-	go func() { done <- conn.Serve(context.Background()) }()
-
-	select {
-	case err := <-done:
-		const want = "acp: reader panicked: boom"
-		if err == nil || err.Error() != want {
-			t.Fatalf("Serve returned %v, want %q", err, want)
-		}
-	case <-time.After(time.Second):
-		t.Fatal("Serve did not return after reader panic")
-	}
-}
-
 func TestConnRequestResponse(t *testing.T) {
 	a, b, stop := connPair(t)
 	defer stop()
@@ -360,86 +72,6 @@ func TestConnNotification(t *testing.T) {
 	}
 }
 
-func TestConnNotificationsForOneMethodStayInWireOrder(t *testing.T) {
-	a, b, stop := connPair(t)
-	defer stop()
-
-	firstStarted := make(chan struct{})
-	releaseFirst := make(chan struct{})
-	delivered := make(chan int, 2)
-	b.HandleNotify("update", func(_ context.Context, params json.RawMessage) {
-		var in struct{ Sequence int }
-		_ = json.Unmarshal(params, &in)
-		if in.Sequence == 1 {
-			close(firstStarted)
-			<-releaseFirst
-		}
-		delivered <- in.Sequence
-	})
-
-	if err := a.Notify("update", map[string]int{"Sequence": 1}); err != nil {
-		t.Fatalf("first notify: %v", err)
-	}
-	select {
-	case <-firstStarted:
-	case <-time.After(2 * time.Second):
-		t.Fatal("first notification did not start")
-	}
-	if err := a.Notify("update", map[string]int{"Sequence": 2}); err != nil {
-		t.Fatalf("second notify: %v", err)
-	}
-	select {
-	case sequence := <-delivered:
-		t.Fatalf("notification %d overtook the blocked first notification", sequence)
-	case <-time.After(25 * time.Millisecond):
-	}
-	close(releaseFirst)
-	for want := 1; want <= 2; want++ {
-		select {
-		case got := <-delivered:
-			if got != want {
-				t.Fatalf("notification order = ...,%d; want %d", got, want)
-			}
-		case <-time.After(2 * time.Second):
-			t.Fatalf("notification %d was not delivered", want)
-		}
-	}
-}
-
-func TestConnDifferentNotificationMethodsStayConcurrent(t *testing.T) {
-	a, b, stop := connPair(t)
-	defer stop()
-
-	updateStarted := make(chan struct{})
-	releaseUpdate := make(chan struct{})
-	cancelDelivered := make(chan struct{})
-	b.HandleNotify("update", func(context.Context, json.RawMessage) {
-		close(updateStarted)
-		<-releaseUpdate
-	})
-	b.HandleNotify("cancel", func(context.Context, json.RawMessage) {
-		close(cancelDelivered)
-	})
-
-	if err := a.Notify("update", nil); err != nil {
-		t.Fatalf("update notify: %v", err)
-	}
-	select {
-	case <-updateStarted:
-	case <-time.After(2 * time.Second):
-		t.Fatal("update notification did not start")
-	}
-	if err := a.Notify("cancel", nil); err != nil {
-		t.Fatalf("cancel notify: %v", err)
-	}
-	select {
-	case <-cancelDelivered:
-	case <-time.After(2 * time.Second):
-		t.Fatal("different notification method was blocked behind update")
-	}
-	close(releaseUpdate)
-}
-
 func TestConnMethodNotFound(t *testing.T) {
 	a, _, stop := connPair(t)
 	defer stop()

internal/acp/mode_persistence_test.go

@@ -1,213 +0,0 @@
-package acp
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/sessions"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-// captureAgentOptions makes every turn record the agent.Options it was built
-// with, so a test can assert the permission mode the next prompt actually runs
-// with rather than only what the wire reports.
-func captureAgentOptions(deps *Deps) *agent.Options {
-	var captured agent.Options
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		captured = opts
-		return agent.Result{FinalAnswer: "ok"}, nil
-	}
-	return &captured
-}
-
-func newHarnessT(t *testing.T, deps Deps) *clientHarness {
-	t.Helper()
-	h := newHarness(t, deps)
-	t.Cleanup(h.stop)
-	return h
-}
-
-func mustCall(t *testing.T, ctx context.Context, h *clientHarness, method string, params any, result any) {
-	t.Helper()
-	if err := h.client.Call(ctx, method, params, result); err != nil {
-		t.Fatalf("%s: %v", method, err)
-	}
-}
-
-// restartHarness replaces the live agent with a fresh one over the same store,
-// which is the process restart the persisted mode has to survive.
-func restartHarness(t *testing.T, h *clientHarness, deps Deps) *clientHarness {
-	t.Helper()
-	h.stop()
-	return newHarnessT(t, deps)
-}
-
-func modeOptionValue(t *testing.T, options []SessionConfigOption) string {
-	t.Helper()
-	for _, option := range options {
-		if option.ID == configIDMode {
-			return option.CurrentValue
-		}
-	}
-	t.Fatalf("no mode config option in %+v", options)
-	return ""
-}
-
-func assertModeReported(t *testing.T, result LoadSessionResult, want agent.PermissionMode) {
-	t.Helper()
-	if result.Modes == nil || result.Modes.CurrentModeID != string(want) {
-		t.Fatalf("modes = %+v, want currentModeId %q", result.Modes, want)
-	}
-	if got := modeOptionValue(t, result.ConfigOptions); got != string(want) {
-		t.Fatalf("mode config option = %q, want %q", got, want)
-	}
-}
-
-func TestACPModePersistsAcrossRestartLoadAndResume(t *testing.T) {
-	deps := testDeps(t)
-	captured := captureAgentOptions(&deps)
-	h := newHarnessT(t, deps)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	workspace := t.TempDir()
-	var created NewSessionResult
-	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
-
-	mustCall(t, ctx, h, MethodSessionSetMode, SetSessionModeParams{SessionID: created.SessionID, ModeID: string(agent.PermissionModePlan)}, &SetSessionModeResult{})
-	meta, err := deps.Store.Get(created.SessionID)
-	if err != nil || meta == nil {
-		t.Fatalf("store.Get: %v", err)
-	}
-	if meta.PermissionMode != string(agent.PermissionModePlan) {
-		t.Fatalf("stored mode = %q, want plan", meta.PermissionMode)
-	}
-
-	// LOAD after a restart: the response must report the stored mode, and the
-	// next prompt must actually run with it.
-	h = restartHarness(t, h, deps)
-	var loaded LoadSessionResult
-	mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
-	assertModeReported(t, loaded, agent.PermissionModePlan)
-	mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("continue")}}, &PromptResult{})
-	if captured.PermissionMode != agent.PermissionModePlan {
-		t.Fatalf("after load, agent.Options.PermissionMode = %q, want plan", captured.PermissionMode)
-	}
-
-	// RESUME after another restart reports the same.
-	h = restartHarness(t, h, deps)
-	var resumed ResumeSessionResult
-	mustCall(t, ctx, h, MethodSessionResume, ResumeSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &resumed)
-	assertModeReported(t, resumed, agent.PermissionModePlan)
-}
-
-func TestACPModePersistsViaSetConfigOption(t *testing.T) {
-	deps := testDeps(t)
-	h := newHarnessT(t, deps)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	workspace := t.TempDir()
-	var created NewSessionResult
-	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
-
-	var configured SetSessionConfigOptionResult
-	mustCall(t, ctx, h, MethodSessionSetConfigOption, SetSessionConfigOptionParams{
-		SessionID: created.SessionID, ConfigID: configIDMode, Value: string(agent.PermissionModeAsk),
-	}, &configured)
-	if got := modeOptionValue(t, configured.ConfigOptions); got != string(agent.PermissionModeAsk) {
-		t.Fatalf("configured mode = %q, want ask", got)
-	}
-	meta, err := deps.Store.Get(created.SessionID)
-	if err != nil || meta == nil {
-		t.Fatalf("store.Get: %v", err)
-	}
-	if meta.PermissionMode != string(agent.PermissionModeAsk) {
-		t.Fatalf("stored mode = %q, want ask", meta.PermissionMode)
-	}
-
-	h = restartHarness(t, h, deps)
-	var loaded LoadSessionResult
-	mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
-	assertModeReported(t, loaded, agent.PermissionModeAsk)
-}
-
-// TestACPModeRestoreFallback pins the restore boundary: no stored value keeps
-// the historical auto default, and a stored value outside the three offered
-// modes must never come back weaker than ask (and never unsafe).
-func TestACPModeRestoreFallback(t *testing.T) {
-	cases := []struct {
-		name string
-		seed string // "" means metadata written before modes were persisted
-		want agent.PermissionMode
-	}{
-		{name: "unset keeps auto", want: agent.PermissionModeAuto},
-		{name: "ask preserved", seed: string(agent.PermissionModeAsk), want: agent.PermissionModeAsk},
-		{name: "unknown falls back to ask", seed: "bogus", want: agent.PermissionModeAsk},
-		{name: "unsafe never restored", seed: string(agent.PermissionModeUnsafe), want: agent.PermissionModeAsk},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			deps := testDeps(t)
-			captured := captureAgentOptions(&deps)
-			h := newHarnessT(t, deps)
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			defer cancel()
-
-			workspace := t.TempDir()
-			var created NewSessionResult
-			mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created)
-			if tc.seed != "" {
-				if _, err := deps.Store.UpdateMode(created.SessionID, tc.seed); err != nil {
-					t.Fatalf("seed mode: %v", err)
-				}
-			}
-
-			h = restartHarness(t, h, deps)
-			var loaded LoadSessionResult
-			mustCall(t, ctx, h, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &loaded)
-			assertModeReported(t, loaded, tc.want)
-
-			mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("go")}}, &PromptResult{})
-			if captured.PermissionMode != tc.want {
-				t.Fatalf("next prompt PermissionMode = %q, want %q", captured.PermissionMode, tc.want)
-			}
-		})
-	}
-}
-
-// TestACPSetModeWriteFailureKeepsLiveMode pins the store-first order: when the
-// mode cannot be saved the request fails and the live session is untouched.
-func TestACPSetModeWriteFailureKeepsLiveMode(t *testing.T) {
-	deps := testDeps(t)
-	captured := captureAgentOptions(&deps)
-	h := newHarnessT(t, deps)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	var created NewSessionResult
-	mustCall(t, ctx, h, MethodSessionNew, NewSessionParams{Cwd: t.TempDir(), McpServers: []McpServer{}}, &created)
-
-	// Remove the metadata file so UpdateMode fails but the live session stays
-	// promptable (turn persistence only warns when the file is gone).
-	metadataPath := filepath.Join(deps.Store.RootDir, created.SessionID, sessions.MetadataFile)
-	if err := os.Remove(metadataPath); err != nil {
-		t.Fatalf("remove metadata: %v", err)
-	}
-
-	err := h.client.Call(ctx, MethodSessionSetMode, SetSessionModeParams{SessionID: created.SessionID, ModeID: string(agent.PermissionModePlan)}, &SetSessionModeResult{})
-	var rpcErr *rpcError
-	if !errors.As(err, &rpcErr) || rpcErr.Code != codeInternalError {
-		t.Fatalf("set_mode with an unsavable mode = %v, want internal error", err)
-	}
-
-	mustCall(t, ctx, h, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("still auto")}}, &PromptResult{})
-	if captured.PermissionMode != agent.PermissionModeAuto {
-		t.Fatalf("failed set_mode changed the live mode: PermissionMode = %q, want auto", captured.PermissionMode)
-	}
-}

internal/acp/permission.go

@@ -3,7 +3,7 @@ package acp
 import (
 	"encoding/json"
 
-	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/agent"
 )
 
 // permission.go maps ZERO's permission prompt model onto ACP's
@@ -15,10 +15,17 @@ import (
 // PermissionOptions. Only the actions ZERO actually presented (AvailableDecisions)
 // are surfaced; the optionId is the ZERO action string for a clean round-trip.
 func buildPermissionOptions(req agent.PermissionRequest) []PermissionOption {
-	actions := offeredDecisions(req)
+	actions := req.AvailableDecisions
+	if len(actions) == 0 {
+		// Sensible default if ZERO didn't enumerate: allow once / reject.
+		actions = []agent.PermissionDecisionAction{
+			agent.PermissionDecisionAllow,
+			agent.PermissionDecisionDeny,
+		}
+	}
 	options := make([]PermissionOption, 0, len(actions))
 	for _, action := range actions {
-		kind, name := optionKindFor(action, req.PrefixApprovalEscalates)
+		kind, name := optionKindFor(action)
 		if kind == "" {
 			continue // skip actions that have no clean ACP option (e.g. cancel)
 		}
@@ -31,61 +38,21 @@ func buildPermissionOptions(req agent.PermissionRequest) []PermissionOption {
 	return options
 }
 
-// offeredDecisions resolves what this request actually offers the client.
-//
-// ONE RESOLVER, USED BY BOTH SIDES, and that is the entire point of it existing.
-// The fallback below used to live inside buildPermissionOptions while
-// requestPermission validated the client's answer against the raw
-// req.AvailableDecisions. When ZERO did not enumerate — which is every
-// permission event that is not a prompt, and includes a shell call whose sandbox
-// decision came back deny — the two disagreed completely: the client was sent
-// "Allow" and "Reject", and validation was performed against an EMPTY list, so
-// every option the client could possibly click failed closed to deny with
-// "permission option was not offered".
-//
-// The user clicked Allow and ZERO recorded a denial. Nothing surfaced it,
-// because a denial is a legitimate answer — the tool was simply refused and the
-// turn carried on as though the user had rejected it.
-func offeredDecisions(req agent.PermissionRequest) []agent.PermissionDecisionAction {
-	if len(req.AvailableDecisions) > 0 {
-		return req.AvailableDecisions
-	}
-	// Sensible default if ZERO didn't enumerate: allow once / reject.
-	return []agent.PermissionDecisionAction{
-		agent.PermissionDecisionAllow,
-		agent.PermissionDecisionDeny,
-	}
-}
-
 // optionKindFor maps a ZERO decision action to an ACP PermissionOptionKind and a
 // human label. Returns an empty kind for actions that ACP expresses through the
 // outcome rather than an option (cancel).
-//
-// escalates reports that approving a command prefix will also run the command
-// outside the sandbox. The two prefix options say so in their label, since the
-// label is all an ACP client shows and the option id carries no room for it. An
-// editor user is deciding on exactly the same terms as a terminal user, so the
-// disclosure cannot be TUI-only.
-func optionKindFor(action agent.PermissionDecisionAction, escalates bool) (kind, name string) {
+func optionKindFor(action agent.PermissionDecisionAction) (kind, name string) {
 	switch action {
-	case agent.PermissionDecisionAllow:
+	case agent.PermissionDecisionAllow, agent.PermissionDecisionAllowStrict:
 		return PermAllowOnce, "Allow"
-	case agent.PermissionDecisionAllowStrict:
-		// SPLIT FROM PLAIN ALLOW because the label is the only thing an ACP
-		// client shows. Both were labelled "Allow", and request_permissions
-		// offers them together — so the panel presented two identical buttons,
-		// and whichever the user picked looked the same while one of them
-		// silently turned on strict auto-review of what was granted. The option
-		// id carries no room for the distinction, so it has to be in the name.
-		return PermAllowOnce, "Allow with strict review"
 	case agent.PermissionDecisionAllowForSession:
 		return PermAllowAlways, "Allow for this session"
 	case agent.PermissionDecisionAllowPrefix:
-		return PermAllowAlways, withSandboxEscalationNote("Allow this command for the session", escalates)
+		return PermAllowAlways, "Allow this command for the session"
 	case agent.PermissionDecisionAlwaysAllow:
 		return PermAllowAlways, "Always allow"
 	case agent.PermissionDecisionAlwaysAllowPrefix:
-		return PermAllowAlways, withSandboxEscalationNote("Always allow this command", escalates)
+		return PermAllowAlways, "Always allow this command"
 	case agent.PermissionDecisionDeny:
 		return PermRejectOnce, "Reject"
 	case agent.PermissionDecisionCancel:
@@ -97,31 +64,19 @@ func optionKindFor(action agent.PermissionDecisionAction, escalates bool) (kind,
 
 // decisionFromOutcome maps the client's permission outcome back to a ZERO
 // decision. A cancelled outcome cancels the run; a selected option id is the ZERO
-// action verbatim (validated against what was actually sent); anything
-// unrecognized fails closed to deny.
-//
-// IT TAKES THE OPTIONS THAT WERE SENT, not the decisions the request offered,
-// and the two are not the same list. Some actions never become options —
-// PermissionDecisionCancel is dropped by optionKindFor because ACP expresses
-// cancellation through the outcome instead — yet it IS enumerated in
-// AvailableDecisions for shell commands and apply_patch, the two commonest
-// prompts. Validating against the decisions therefore accepted
-// {"outcome":"selected","optionId":"cancel"}: an identifier no client was ever
-// shown, aborting the whole turn.
-//
-// Passing the sent options makes "what we offered" and "what we accept" the
-// same slice rather than two things kept in step, so anything optionKindFor
-// declines to render is excluded structurally instead of by name.
-func decisionFromOutcome(outcome RequestPermissionOutcome, offered []PermissionOption) agent.PermissionDecision {
+// action verbatim (validated against what was offered); anything unrecognized
+// fails closed to deny.
+func decisionFromOutcome(outcome RequestPermissionOutcome, offered []agent.PermissionDecisionAction) agent.PermissionDecision {
 	switch outcome.Outcome {
 	case OutcomeCancelled:
 		return agent.PermissionDecision{Action: agent.PermissionDecisionCancel, Reason: "client cancelled"}
 	case OutcomeSelected:
+		action := agent.PermissionDecisionAction(outcome.OptionID)
 		// Bind to what was actually offered for THIS call: a client must not be able
 		// to return a broader grant (always_allow / allow_for_session) that wasn't
 		// presented. Anything not offered fails closed to deny.
-		if actionOffered(outcome.OptionID, offered) {
-			return agent.PermissionDecision{Action: agent.PermissionDecisionAction(outcome.OptionID)}
+		if actionOffered(action, offered) {
+			return agent.PermissionDecision{Action: action}
 		}
 		return agent.PermissionDecision{Action: agent.PermissionDecisionDeny, Reason: "permission option was not offered"}
 	default:
@@ -129,9 +84,9 @@ func decisionFromOutcome(outcome RequestPermissionOutcome, offered []PermissionO
 	}
 }
 
-func actionOffered(optionID string, offered []PermissionOption) bool {
-	for _, option := range offered {
-		if option.OptionID == optionID {
+func actionOffered(action agent.PermissionDecisionAction, offered []agent.PermissionDecisionAction) bool {
+	for _, a := range offered {
+		if a == action {
 			return true
 		}
 	}
@@ -142,15 +97,13 @@ func actionOffered(optionID string, offered []PermissionOption) bool {
 // session/request_permission request from a ZERO permission request.
 func permissionToolCall(req agent.PermissionRequest) ToolCallUpdate {
 	args := marshalArgs(req.Args)
-	upd := ToolCallUpdate{
+	return ToolCallUpdate{
 		ToolCallID: req.ToolCallID,
 		Title:      toolTitle(req.ToolName, string(args)),
 		Kind:       toolKindFor(req.ToolName),
 		Status:     ToolStatusPending,
 		RawInput:   rawInputBytes(args),
 	}
-	attachBrowserToolDetails(&upd, req.ToolName)
-	return upd
 }
 
 func marshalArgs(args map[string]any) []byte {
@@ -170,13 +123,3 @@ func rawInputBytes(data []byte) json.RawMessage {
 	}
 	return json.RawMessage(data)
 }
-
-// withSandboxEscalationNote appends the escalation disclosure to a prefix
-// option's label. Kept parallel to the TUI's wording so the same consequence is
-// not described two different ways depending on which client the user runs.
-func withSandboxEscalationNote(name string, escalates bool) string {
-	if !escalates {
-		return name
-	}
-	return name + " (runs outside the sandbox)"
-}

internal/acp/permission_escalation_test.go

@@ -1,69 +0,0 @@
-package acp
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/agent"
-)
-
-func escalationRequest(escalates bool) agent.PermissionRequest {
-	return agent.PermissionRequest{
-		ToolName: "bash",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowPrefix,
-			agent.PermissionDecisionAlwaysAllowPrefix,
-			agent.PermissionDecisionDeny,
-		},
-		PrefixApprovalEscalates: escalates,
-	}
-}
-
-// An ACP client renders only Name, so if the escalation is not in the label the
-// editor user approves it blind. They face exactly the outcome a terminal user
-// faces, so the disclosure has to reach both clients or it is not a fix.
-func TestACPPrefixOptionsDiscloseLeavingTheSandbox(t *testing.T) {
-	found := 0
-	for _, option := range buildPermissionOptions(escalationRequest(true)) {
-		action := agent.PermissionDecisionAction(option.OptionID)
-		if action != agent.PermissionDecisionAllowPrefix && action != agent.PermissionDecisionAlwaysAllowPrefix {
-			if strings.Contains(option.Name, "sandbox") {
-				t.Errorf("option %q carries the disclosure but does not escalate", option.Name)
-			}
-			continue
-		}
-		found++
-		if !strings.Contains(option.Name, "outside the sandbox") {
-			t.Errorf("prefix option %q does not say the command leaves the sandbox", option.Name)
-		}
-	}
-	if found != 2 {
-		t.Fatalf("expected both prefix options, saw %d", found)
-	}
-}
-
-func TestACPPrefixOptionsStaySilentWithoutEscalation(t *testing.T) {
-	for _, option := range buildPermissionOptions(escalationRequest(false)) {
-		if strings.Contains(option.Name, "sandbox") {
-			t.Errorf("option %q warns about the sandbox when approving would not leave it", option.Name)
-		}
-	}
-}
-
-// The disclosure must live in the label only. The option id is the decision
-// action round-tripped verbatim, and decisionFromOutcome matches it against
-// what was offered, so decorating it would fail every prefix approval closed.
-func TestACPDisclosureDoesNotDisturbTheOptionIDRoundTrip(t *testing.T) {
-	request := escalationRequest(true)
-	options := buildPermissionOptions(request)
-	for _, option := range options {
-		decision := decisionFromOutcome(
-			RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: option.OptionID},
-			options,
-		)
-		if string(decision.Action) != option.OptionID {
-			t.Errorf("option id %q round-tripped to %q (%s)", option.OptionID, decision.Action, decision.Reason)
-		}
-	}
-}

internal/acp/permission_test.go

@@ -3,7 +3,7 @@ package acp
 import (
 	"testing"
 
-	"github.com/Twigpine/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/agent"
 )
 
 func TestBuildPermissionOptions(t *testing.T) {
@@ -39,14 +39,11 @@ func TestBuildPermissionOptionsDefault(t *testing.T) {
 }
 
 func TestDecisionFromOutcome(t *testing.T) {
-	offered := buildPermissionOptions(agent.PermissionRequest{
-		ToolName: "bash",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAlwaysAllow,
-			agent.PermissionDecisionDeny,
-		},
-	})
+	offered := []agent.PermissionDecisionAction{
+		agent.PermissionDecisionAllow,
+		agent.PermissionDecisionAlwaysAllow,
+		agent.PermissionDecisionDeny,
+	}
 	if d := decisionFromOutcome(RequestPermissionOutcome{Outcome: OutcomeCancelled}, offered); d.Action != agent.PermissionDecisionCancel {
 		t.Errorf("cancelled -> %q, want cancel", d.Action)
 	}
@@ -82,17 +79,3 @@ func TestPermissionToolCall(t *testing.T) {
 		t.Error("expected rawInput from args")
 	}
 }
-
-func TestPermissionToolCallKeepsTheBrowserDescriptor(t *testing.T) {
-	call := permissionToolCall(agent.PermissionRequest{
-		ToolCallID: "browser-1",
-		ToolName:   "browser_connect",
-		Args:       map[string]any{"target": "127.0.0.1:9222"},
-	})
-	if got := browserDescriptor(t, call); got != (BrowserToolDetails{Version: 1, Command: "connect"}) {
-		t.Fatalf("browser descriptor = %#v", got)
-	}
-	if call.Title != "browser connect" {
-		t.Fatalf("title = %q", call.Title)
-	}
-}

internal/acp/translate.go

@@ -2,14 +2,11 @@ package acp
 
 import (
 	"encoding/json"
-	"net/url"
-	"path/filepath"
 	"strings"
-	"unicode"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 // translate.go maps ZERO's agent events onto ACP session/update payloads. The
@@ -20,14 +17,6 @@ func agentMessageChunk(delta string) ContentChunk {
 	return ContentChunk{SessionUpdate: UpdateAgentMessageChunk, Content: TextBlock(delta)}
 }
 
-func replayMessageChunk(role, messageID, text string) ContentChunk {
-	update := UpdateAgentMessageChunk
-	if role == "user" {
-		update = UpdateUserMessageChunk
-	}
-	return ContentChunk{SessionUpdate: update, MessageID: messageID, Content: TextBlock(text)}
-}
-
 func agentThoughtChunk(delta string) ContentChunk {
 	return ContentChunk{SessionUpdate: UpdateAgentThoughtChunk, Content: TextBlock(delta)}
 }
@@ -55,125 +44,12 @@ func toolKindFor(name string) string {
 
 // toolTitle builds a concise human title, e.g. "read_file src/main.go".
 func toolTitle(name, rawArgs string) string {
-	if browser, ok := browserToolDetails(name); ok {
-		return browserToolTitle(browser.Command, rawArgs)
-	}
 	if hint := primaryArgHint(rawArgs); hint != "" {
 		return name + " " + hint
 	}
 	return name
 }
 
-// browserToolDetails identifies ZERO's local browser helpers without treating
-// similarly named MCP tools as browser automation. The descriptor intentionally
-// contains no request data: ACP tool input is already protocol-visible, but a
-// durable UI must not need to retain text, local CDP targets, or full URLs just
-// to recognise the browser operation.
-func browserToolDetails(name string) (*BrowserToolDetails, bool) {
-	const prefix = "browser_"
-	command, ok := strings.CutPrefix(name, prefix)
-	if !ok {
-		return nil, false
-	}
-	switch command {
-	case "install", "launch", "connect", "open", "snapshot", "click", "type", "press", "action":
-		return &BrowserToolDetails{Version: 1, Command: command}, true
-	default:
-		return nil, false
-	}
-}
-
-const zeroBrowserMetaKey = "github.com/Twigpine/zero/browser"
-
-// attachBrowserToolDetails stores ZERO's browser descriptor in ACP's reserved
-// extension channel. Keeping this in one helper prevents start, result, and
-// permission payloads from drifting onto different wire shapes.
-func attachBrowserToolDetails(update *ToolCallUpdate, name string) {
-	browser, ok := browserToolDetails(name)
-	if !ok {
-		return
-	}
-	raw, err := json.Marshal(browser)
-	if err != nil {
-		return
-	}
-	update.Meta = map[string]json.RawMessage{zeroBrowserMetaKey: raw}
-}
-
-// browserToolTitle avoids putting browser_type text, an attached DevTools
-// endpoint, or a URL query/fragment in a tool-card title. Those values can
-// carry credentials or session data; the UI only needs the operation and, for
-// navigation, a human-recognisable origin.
-func browserToolTitle(command, rawArgs string) string {
-	switch command {
-	case "action":
-		action, ok := exactJSONStringArg(rawArgs, "command")
-		if !ok {
-			return "browser action"
-		}
-		if action, ok := tools.NormalizedBrowserActionCommand(action); ok {
-			return "browser action " + action
-		}
-		return "browser action"
-	case "open":
-		rawURL, ok := exactJSONStringArg(rawArgs, "url")
-		if !ok {
-			return "browser open"
-		}
-		normalized, err := tools.NormalizeBrowserOpenURL(rawURL)
-		if err != nil {
-			return "browser open"
-		}
-		u, err := url.Parse(normalized)
-		if err != nil || u.Scheme == "" || u.Host == "" {
-			return "browser open"
-		}
-		origin := u.Scheme + "://" + u.Host
-		if !browserTitleTextSafe(origin) {
-			return "browser open"
-		}
-		return "browser open " + truncateHint(origin)
-	default:
-		return "browser " + command
-	}
-}
-
-// browserTitleTextSafe validates text after URL parsing has decoded escaped
-// UTF-8 in the host. Valid UTF-8 alone is not presentation-safe: whitespace, control,
-// format/bidi, and line/paragraph separator runes can reorder or split the
-// permission label shown to a user. The execution URL remains unchanged.
-func browserTitleTextSafe(text string) bool {
-	if !utf8.ValidString(text) {
-		return false
-	}
-	for _, r := range text {
-		if unicode.IsSpace(r) || unicode.IsControl(r) || unicode.Is(unicode.Cf, r) || unicode.Is(unicode.Zl, r) || unicode.Is(unicode.Zp, r) {
-			return false
-		}
-	}
-	return true
-}
-
-// exactJSONStringArg mirrors ZERO's map-based tool argument decoding: only the
-// exact JSON key is considered, and a non-string value is invalid. In
-// particular, an incidental "URL" key must not change a permission title when
-// browser_open will only read "url".
-func exactJSONStringArg(rawArgs, key string) (string, bool) {
-	var args map[string]json.RawMessage
-	if json.Unmarshal([]byte(rawArgs), &args) != nil {
-		return "", false
-	}
-	raw, ok := args[key]
-	if !ok {
-		return "", false
-	}
-	var value string
-	if json.Unmarshal(raw, &value) != nil {
-		return "", false
-	}
-	return value, true
-}
-
 // primaryArgHint extracts the most relevant argument (path/pattern/command) from
 // raw JSON arguments. Best-effort; returns "" when it can't parse.
 func primaryArgHint(rawArgs string) string {
@@ -213,7 +89,7 @@ func rawInput(args string) json.RawMessage {
 // toolCallStart maps an advertised ZERO tool call to the initial ACP "tool_call"
 // update (status in_progress — ZERO executes immediately after advertising).
 func toolCallStart(call agent.ToolCall) ToolCallUpdate {
-	upd := ToolCallUpdate{
+	return ToolCallUpdate{
 		SessionUpdate: UpdateToolCall,
 		ToolCallID:    call.ID,
 		Title:         toolTitle(call.Name, call.Arguments),
@@ -221,8 +97,6 @@ func toolCallStart(call agent.ToolCall) ToolCallUpdate {
 		Status:        ToolStatusInProgress,
 		RawInput:      rawInput(call.Arguments),
 	}
-	attachBrowserToolDetails(&upd, call.Name)
-	return upd
 }
 
 // toolCallResult maps a finished ZERO tool result to a "tool_call_update".
@@ -242,64 +116,26 @@ func toolCallResult(result agent.ToolResult) ToolCallUpdate {
 	if locs := toolResultLocations(result); len(locs) > 0 {
 		upd.Locations = locs
 	}
-	attachBrowserToolDetails(&upd, result.Name)
 	return upd
 }
 
 func toolResultContent(result agent.ToolResult) []ToolCallContent {
-	content := make([]ToolCallContent, 0, 1+len(result.FileDiffs))
 	text := strings.TrimRight(result.Output, "\n")
 	if text == "" {
 		text = result.Display.Summary
 	}
 	if text == "" {
-		return appendToolResultDiffs(content, result.FileDiffs)
+		return nil
 	}
-	content = append(content, ToolContent(TextBlock(text)))
-	return appendToolResultDiffs(content, result.FileDiffs)
-}
-
-func appendToolResultDiffs(content []ToolCallContent, diffs []tools.FileDiff) []ToolCallContent {
-	for _, diff := range diffs {
-		if !filepath.IsAbs(diff.Path) || (!diff.OldExists && !diff.NewExists) {
-			continue
-		}
-		var oldText *string
-		if diff.OldExists {
-			old := diff.OldText
-			oldText = &old
-		}
-		var newText *string
-		if diff.NewExists {
-			updated := diff.NewText
-			newText = &updated
-		}
-		content = append(content, ToolCallContent{Type: "diff", Path: diff.Path, OldText: oldText, NewText: newText})
-	}
-	return content
+	return []ToolCallContent{ToolContent(TextBlock(text))}
 }
 
 func toolResultLocations(result agent.ToolResult) []ToolCallLocation {
-	locs := make([]ToolCallLocation, 0, len(result.FileDiffs)+len(result.ChangedFiles))
-	seen := make(map[string]bool, len(result.FileDiffs)+len(result.ChangedFiles))
-	for _, diff := range result.FileDiffs {
-		path := diff.Path
-		if path == "" || seen[path] {
-			continue
-		}
-		seen[path] = true
-		locs = append(locs, ToolCallLocation{Path: path})
-	}
-	// FileDiff.Path is canonical absolute path data while ChangedFiles is
-	// normally workspace-relative. Without the trusted workspace root these
-	// coordinate systems cannot be correlated safely: a suffix match would let
-	// /workspace/sub/a.go consume the fallback for a distinct root a.go. The
-	// shared seen set deduplicates only identities already exactly comparable.
+	locs := make([]ToolCallLocation, 0, len(result.ChangedFiles))
 	for _, f := range result.ChangedFiles {
-		if f == "" || seen[f] {
+		if strings.TrimSpace(f) == "" {
 			continue
 		}
-		seen[f] = true
 		locs = append(locs, ToolCallLocation{Path: f})
 	}
 	return locs

internal/acp/translate_test.go

@@ -1,30 +1,14 @@
 package acp
 
 import (
-	"encoding/json"
-	"path/filepath"
 	"strings"
 	"testing"
-	"unicode"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/agent"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
-func browserDescriptor(t *testing.T, update ToolCallUpdate) BrowserToolDetails {
-	t.Helper()
-	raw, ok := update.Meta[zeroBrowserMetaKey]
-	if !ok {
-		t.Fatalf("browser metadata = %#v, want %q", update.Meta, zeroBrowserMetaKey)
-	}
-	var details BrowserToolDetails
-	if err := json.Unmarshal(raw, &details); err != nil {
-		t.Fatalf("decode browser metadata: %v", err)
-	}
-	return details
-}
-
 func TestAgentMessageAndThoughtChunks(t *testing.T) {
 	m := agentMessageChunk("hello")
 	if m.SessionUpdate != UpdateAgentMessageChunk || m.Content.Type != "text" || m.Content.Text != "hello" {
@@ -72,223 +56,6 @@ func TestToolTitleAndHint(t *testing.T) {
 	}
 }
 
-func TestBrowserToolUpdatesAreStructuredAndPresentationSafe(t *testing.T) {
-	start := toolCallStart(agent.ToolCall{
-		ID:        "browser-1",
-		Name:      "browser_open",
-		Arguments: `{"url":"https://example.com/settings?token=not-for-a-title#account"}`,
-	})
-	if got := browserDescriptor(t, start); got != (BrowserToolDetails{Version: 1, Command: "open"}) {
-		t.Fatalf("browser descriptor = %#v, want open", got)
-	}
-	if start.Title != "browser open https://example.com" {
-		t.Fatalf("browser title = %q", start.Title)
-	}
-	if strings.Contains(start.Title, "token=") || strings.Contains(start.Title, "#account") {
-		t.Fatalf("browser title leaked URL-sensitive data: %q", start.Title)
-	}
-	encoded, err := json.Marshal(start)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var wire struct {
-		Meta map[string]json.RawMessage `json:"_meta"`
-	}
-	if err := json.Unmarshal(encoded, &wire); err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := wire.Meta[zeroBrowserMetaKey]; !ok {
-		t.Fatalf("browser wire metadata = %#v", wire.Meta)
-	}
-
-	typed := toolCallStart(agent.ToolCall{
-		ID:        "browser-2",
-		Name:      "browser_type",
-		Arguments: `{"ref":"email","text":"[email protected]"}`,
-	})
-	if got := browserDescriptor(t, typed); got.Command != "type" {
-		t.Fatalf("browser type descriptor = %#v", got)
-	}
-	if typed.Title != "browser type" || strings.Contains(typed.Title, "[email protected]") {
-		t.Fatalf("browser type title = %q", typed.Title)
-	}
-
-	action := toolCallStart(agent.ToolCall{
-		ID:        "browser-3",
-		Name:      "browser_action",
-		Arguments: `{"command":"keyboard_insert_text","args":["[email protected]"]}`,
-	})
-	if action.Title != "browser action keyboard_insert_text" {
-		t.Fatalf("browser action title = %q", action.Title)
-	}
-
-	result := toolCallResult(agent.ToolResult{
-		ToolCallID: "browser-2",
-		Name:       "browser_type",
-		Status:     tools.StatusOK,
-	})
-	if got := browserDescriptor(t, result); got.Command != "type" {
-		t.Fatalf("browser result descriptor = %#v", got)
-	}
-}
-
-func TestBrowserDescriptorSurvivesProtocolShapedRoundTrip(t *testing.T) {
-	updates := []ToolCallUpdate{
-		toolCallStart(agent.ToolCall{
-			ID:        "start",
-			Name:      "browser_open",
-			Arguments: `{"url":"https://user:[email protected]/private?token=secret#fragment"}`,
-		}),
-		toolCallResult(agent.ToolResult{
-			ToolCallID: "result",
-			Name:       "browser_type",
-			Status:     tools.StatusOK,
-		}),
-		permissionToolCall(agent.PermissionRequest{
-			ToolCallID: "permission",
-			ToolName:   "browser_connect",
-			Args:       map[string]any{"target": "127.0.0.1:9222"},
-		}),
-	}
-
-	type protocolToolCallUpdate struct {
-		SessionUpdate string                     `json:"sessionUpdate,omitempty"`
-		ToolCallID    string                     `json:"toolCallId"`
-		Title         string                     `json:"title,omitempty"`
-		Kind          string                     `json:"kind,omitempty"`
-		Status        string                     `json:"status,omitempty"`
-		RawInput      json.RawMessage            `json:"rawInput,omitempty"`
-		Content       []ToolCallContent          `json:"content,omitempty"`
-		Locations     []ToolCallLocation         `json:"locations,omitempty"`
-		Meta          map[string]json.RawMessage `json:"_meta,omitempty"`
-	}
-
-	for _, update := range updates {
-		encoded, err := json.Marshal(update)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var root map[string]json.RawMessage
-		if err := json.Unmarshal(encoded, &root); err != nil {
-			t.Fatal(err)
-		}
-		if _, ok := root["browser"]; ok {
-			t.Fatalf("browser descriptor escaped ACP _meta: %s", encoded)
-		}
-
-		var protocol protocolToolCallUpdate
-		if err := json.Unmarshal(encoded, &protocol); err != nil {
-			t.Fatal(err)
-		}
-		forwarded, err := json.Marshal(protocol)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var roundTripped ToolCallUpdate
-		if err := json.Unmarshal(forwarded, &roundTripped); err != nil {
-			t.Fatal(err)
-		}
-		details := browserDescriptor(t, roundTripped)
-		if details.Version != 1 || details.Command == "" {
-			t.Fatalf("round-tripped browser descriptor = %#v", details)
-		}
-		descriptorJSON := string(roundTripped.Meta[zeroBrowserMetaKey])
-		for _, secret := range []string{"password", "private", "token", "fragment", "127.0.0.1", "9222"} {
-			if strings.Contains(descriptorJSON, secret) {
-				t.Fatalf("browser descriptor leaked %q: %s", secret, descriptorJSON)
-			}
-		}
-	}
-}
-
-func TestBrowserPermissionTitlesMirrorSafeToolArguments(t *testing.T) {
-	if got := browserToolTitle("open", `{"url":"evil.example.test/pay?token=hidden#fragment"}`); got != "browser open https://evil.example.test" {
-		t.Fatalf("bare-host title = %q", got)
-	}
-	if got := browserToolTitle("open", `{"URL":"https://different.example.test"}`); got != "browser open" {
-		t.Fatalf("case-variant URL title = %q", got)
-	}
-	if got := browserToolTitle("open", `{"URL":"https://different.example.test","url":"https://actual.example.test/path"}`); got != "browser open https://actual.example.test" {
-		t.Fatalf("exact URL key title = %q", got)
-	}
-	if got := browserToolTitle("action", `{"command":"not an action"}`); got != "browser action" {
-		t.Fatalf("unknown browser action title = %q", got)
-	}
-
-	longHost := "https://" + strings.Repeat("a", 200) + ".example.test/path?token=hidden"
-	title := browserToolTitle("open", `{"url":"`+longHost+`"}`)
-	if !utf8.ValidString(title) || utf8.RuneCountInString(title) > len("browser open ")+61 || strings.Contains(title, "token=") {
-		t.Fatalf("bounded browser origin title = %q", title)
-	}
-}
-
-func TestBrowserOpenTitlesRejectDecodedUnicodePresentationControls(t *testing.T) {
-	for _, rawURL := range []string{
-		"https://safe.example%C2%A0evil.test/path",
-		"https://safe.example%E2%80%83evil.test/path",
-		"https://safe.example%E3%80%80evil.test/path",
-		"https://safe.example%E2%80%AEevil.test/path",
-		"https://safe.example%E2%81%A6evil.test/path",
-		"https://safe.example%C2%85evil.test/path",
-		"https://safe.example%E2%80%A8evil.test/path",
-		"https://safe.example%E2%80%A9evil.test/path",
-	} {
-		t.Run(rawURL, func(t *testing.T) {
-			normalized, err := tools.NormalizeBrowserOpenURL(rawURL)
-			if err != nil {
-				t.Fatalf("execution URL rejected: %v", err)
-			}
-			if normalized != rawURL {
-				t.Fatalf("execution URL = %q, want unchanged %q", normalized, rawURL)
-			}
-
-			args, err := json.Marshal(map[string]any{"url": rawURL})
-			if err != nil {
-				t.Fatal(err)
-			}
-			if title := browserToolTitle("open", string(args)); title != "browser open" {
-				t.Errorf("unsafe origin accepted before permission translation: %q", title)
-			}
-			updates := []ToolCallUpdate{
-				toolCallStart(agent.ToolCall{ID: "start", Name: "browser_open", Arguments: string(args)}),
-				permissionToolCall(agent.PermissionRequest{ToolCallID: "permission", ToolName: "browser_open", Args: map[string]any{"url": rawURL}}),
-			}
-			for _, update := range updates {
-				encoded, err := json.Marshal(update)
-				if err != nil {
-					t.Fatal(err)
-				}
-				var decoded ToolCallUpdate
-				if err := json.Unmarshal(encoded, &decoded); err != nil {
-					t.Fatal(err)
-				}
-				if decoded.Title != "browser open" {
-					t.Fatalf("unsafe browser title survived wire round trip: %q", decoded.Title)
-				}
-				for _, r := range decoded.Title {
-					if unicode.IsControl(r) || unicode.Is(unicode.Cf, r) || unicode.Is(unicode.Zl, r) || unicode.Is(unicode.Zp, r) {
-						t.Fatalf("browser title contains unsafe presentation rune %U: %q", r, decoded.Title)
-					}
-				}
-			}
-		})
-	}
-}
-
-func TestBrowserDescriptorDoesNotClaimSimilarlyNamedMCPTools(t *testing.T) {
-	start := toolCallStart(agent.ToolCall{ID: "mcp-1", Name: "browser_plugin_open", Arguments: `{}`})
-	if len(start.Meta) != 0 {
-		t.Fatalf("MCP-like tool received built-in browser metadata: %#v", start.Meta)
-	}
-	encoded, err := json.Marshal(start)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(encoded), `"browser"`) {
-		t.Fatalf("non-browser tool encoded browser field: %s", encoded)
-	}
-}
-
 func TestToolCallStart(t *testing.T) {
 	upd := toolCallStart(agent.ToolCall{ID: "tc1", Name: "read_file", Arguments: `{"path":"a.go"}`})
 	if upd.SessionUpdate != UpdateToolCall {
@@ -307,26 +74,21 @@ func TestToolCallStart(t *testing.T) {
 }
 
 func TestToolCallResult(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "a.go")
 	ok := toolCallResult(agent.ToolResult{
 		ToolCallID:   "tc1",
 		Name:         "edit_file",
 		Status:       tools.StatusOK,
 		Output:       "applied\n",
 		ChangedFiles: []string{"a.go", ""},
-		FileDiffs:    []tools.FileDiff{{Path: path, OldExists: true, NewExists: true, OldText: "before\n", NewText: "after\n"}},
 	})
 	if ok.SessionUpdate != UpdateToolCallUpdate || ok.Status != ToolStatusCompleted {
 		t.Fatalf("unexpected ok result: %+v", ok)
 	}
-	if len(ok.Content) != 2 || ok.Content[0].Type != "content" || ok.Content[0].Content.Text != "applied" {
+	if len(ok.Content) != 1 || ok.Content[0].Type != "content" || ok.Content[0].Content.Text != "applied" {
 		t.Fatalf("unexpected content: %+v", ok.Content)
 	}
-	if diff := ok.Content[1]; diff.Type != "diff" || diff.Path != path || diff.OldText == nil || *diff.OldText != "before\n" || diff.NewText == nil || *diff.NewText != "after\n" {
-		t.Fatalf("unexpected diff content: %+v", diff)
-	}
-	if len(ok.Locations) != 2 || ok.Locations[0].Path != path || ok.Locations[1].Path != "a.go" {
-		t.Fatalf("unproven absolute/relative aliases must both remain visible, got %+v", ok.Locations)
+	if len(ok.Locations) != 1 || ok.Locations[0].Path != "a.go" {
+		t.Fatalf("blank changed files should be dropped, got %+v", ok.Locations)
 	}
 
 	failed := toolCallResult(agent.ToolResult{ToolCallID: "tc2", Status: tools.StatusError, Output: "boom"})
@@ -335,190 +97,6 @@ func TestToolCallResult(t *testing.T) {
 	}
 }
 
-func TestToolCallDiffJSONDistinguishesEmptyFilesAndDeletion(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "empty.txt")
-	content := appendToolResultDiffs(nil, []tools.FileDiff{
-		{Path: path, OldExists: false, NewExists: true, NewText: ""},
-		{Path: path, OldExists: true, NewExists: true, OldText: "before", NewText: ""},
-		{Path: path, OldExists: true, NewExists: false, OldText: "before"},
-	})
-	if len(content) != 3 {
-		t.Fatalf("diff content = %#v", content)
-	}
-	for index, diff := range content {
-		encoded, err := json.Marshal(diff)
-		if err != nil {
-			t.Fatal(err)
-		}
-		var wire map[string]any
-		if err := json.Unmarshal(encoded, &wire); err != nil {
-			t.Fatal(err)
-		}
-		if wire["path"] != path {
-			t.Fatalf("wire diff %d = %s", index, encoded)
-		}
-		switch index {
-		case 0:
-			oldText, present := wire["oldText"]
-			if !present || oldText != nil || wire["newText"] != "" {
-				t.Fatalf("create diff = %s, want null oldText and empty newText", encoded)
-			}
-		case 1:
-			if wire["oldText"] != "before" || wire["newText"] != "" {
-				t.Fatalf("empty replacement diff = %s", encoded)
-			}
-		case 2:
-			newText, present := wire["newText"]
-			if wire["oldText"] != "before" || !present || newText != nil {
-				t.Fatalf("deletion diff = %s, want oldText and null newText", encoded)
-			}
-		}
-	}
-}
-
-func TestToolResultLocationsPreserveDistinctPathIdentities(t *testing.T) {
-	root := t.TempDir()
-	rootPath := filepath.Join(root, "a.go")
-	nestedPath := filepath.Join(root, "sub", "a.go")
-	diff := func(path string) tools.FileDiff {
-		return tools.FileDiff{Path: path, OldExists: true, NewExists: true, OldText: "before", NewText: "after"}
-	}
-	for _, tc := range []struct {
-		name  string
-		diffs []tools.FileDiff
-		want  []string
-	}{
-		{name: "both rich", diffs: []tools.FileDiff{diff(rootPath), diff(nestedPath)}, want: []string{rootPath, nestedPath, "a.go", filepath.Join("sub", "a.go")}},
-		{name: "root rich", diffs: []tools.FileDiff{diff(rootPath)}, want: []string{rootPath, "a.go", filepath.Join("sub", "a.go")}},
-		{name: "nested rich", diffs: []tools.FileDiff{diff(nestedPath)}, want: []string{nestedPath, "a.go", filepath.Join("sub", "a.go")}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			locations := toolResultLocations(agent.ToolResult{
-				ChangedFiles: []string{"a.go", filepath.Join("sub", "a.go")},
-				FileDiffs:    tc.diffs,
-			})
-			if len(locations) != len(tc.want) {
-				t.Fatalf("locations = %#v, want %#v", locations, tc.want)
-			}
-			for index := range tc.want {
-				if locations[index].Path != tc.want[index] {
-					t.Fatalf("locations = %#v, want %#v", locations, tc.want)
-				}
-			}
-		})
-	}
-}
-
-func TestToolCallResultPreservesWhitespaceInFilePaths(t *testing.T) {
-	relativePath := " report.txt "
-	absolutePath := filepath.Join(t.TempDir(), relativePath)
-	update := toolCallResult(agent.ToolResult{
-		ChangedFiles: []string{relativePath},
-		FileDiffs: []tools.FileDiff{{
-			Path: absolutePath, OldExists: true, NewExists: true, OldText: "before", NewText: "after",
-		}},
-	})
-	if len(update.Content) != 1 || update.Content[0].Path != absolutePath {
-		t.Fatalf("diff content path = %#v, want %q", update.Content, absolutePath)
-	}
-	if len(update.Locations) != 2 || update.Locations[0].Path != absolutePath || update.Locations[1].Path != relativePath {
-		t.Fatalf("locations = %#v, want exact paths %q and %q", update.Locations, absolutePath, relativePath)
-	}
-}
-
-func TestToolResultLocationsDeduplicateOnlyExactPaths(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "a.go")
-	locations := toolResultLocations(agent.ToolResult{
-		ChangedFiles: []string{path, path},
-		FileDiffs:    []tools.FileDiff{{Path: path, OldExists: true, NewExists: true, OldText: "before", NewText: "after"}},
-	})
-	if len(locations) != 1 || locations[0].Path != path {
-		t.Fatalf("exact duplicate locations = %#v", locations)
-	}
-}
-
-func TestDeletedFileEmitsDiffAndKeepsLocations(t *testing.T) {
-	relativePath := "deleted.go"
-	absolutePath := filepath.Join(t.TempDir(), relativePath)
-	update := toolCallResult(agent.ToolResult{
-		ChangedFiles: []string{relativePath},
-		FileDiffs: []tools.FileDiff{{
-			Path: absolutePath, OldExists: true, NewExists: false, OldText: "before",
-		}},
-	})
-	if len(update.Content) != 1 || update.Content[0].OldText == nil || *update.Content[0].OldText != "before" || update.Content[0].NewText != nil {
-		t.Fatalf("deleted file diff = %#v, want oldText with null newText", update.Content)
-	}
-	if len(update.Locations) != 2 || update.Locations[0].Path != absolutePath || update.Locations[1].Path != relativePath {
-		t.Fatalf("deleted file locations = %#v", update.Locations)
-	}
-}
-
-func TestToolCallResultEmitsOnlyRedactedFileDiffs(t *testing.T) {
-	secret := "sk-proj-abcdefghijklmnopqrstuvwxyz"
-	path := filepath.Join(t.TempDir(), "secret.txt")
-	scrubbed := tools.ScrubResultSecrets(tools.Result{FileDiffs: []tools.FileDiff{{
-		Path: path, OldExists: true, NewExists: true, OldText: "token=" + secret, NewText: "safe",
-	}}})
-	update := toolCallResult(agent.ToolResult{ToolCallID: "call", Status: tools.StatusError, FileDiffs: scrubbed.FileDiffs})
-	if len(update.Content) != 1 || update.Content[0].OldText == nil || strings.Contains(*update.Content[0].OldText, secret) {
-		t.Fatalf("ACP content leaked unredacted diff: %#v", update.Content)
-	}
-}
-
-func TestToolCallResultOmitsSemanticallyUnchangedRedactedDiff(t *testing.T) {
-	oldSecret := "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-	newSecret := "ghp_9876543210ZYXWVUTSRQPONMLKJIHGFEDCBA"
-	scrubbed := tools.ScrubResultSecrets(tools.Result{
-		ChangedFiles: []string{"credentials.txt"},
-		FileDiffs: []tools.FileDiff{{
-			Path: filepath.Join(t.TempDir(), "credentials.txt"), OldExists: true, NewExists: true,
-			OldText: "token=" + oldSecret, NewText: "token=" + newSecret,
-		}},
-	})
-	update := toolCallResult(agent.ToolResult{
-		ToolCallID: "call", Status: tools.StatusOK,
-		ChangedFiles: scrubbed.ChangedFiles, FileDiffs: scrubbed.FileDiffs,
-	})
-	if len(update.Content) != 0 {
-		t.Fatalf("ACP emitted semantically unchanged redacted diff: %#v", update.Content)
-	}
-	if len(update.Locations) != 1 || update.Locations[0].Path != "credentials.txt" {
-		t.Fatalf("ACP path fallback = %#v", update.Locations)
-	}
-}
-
-func TestToolCallResultOmitsDefaultIgnorableSplitSecretsOnEitherSide(t *testing.T) {
-	secret := "sk-ant-api03-AAAABBBBCCCCDDDDEEEEFFFFGGGG"
-	for name, separator := range map[string]string{
-		"combining grapheme joiner": "\u034f",
-		"variation selector":        "\ufe0f",
-	} {
-		for _, side := range []string{"old", "new"} {
-			t.Run(name+" "+side, func(t *testing.T) {
-				obfuscated := secret[:20] + separator + secret[20:]
-				diff := tools.FileDiff{
-					Path: filepath.Join(t.TempDir(), "secret.txt"), OldExists: true, NewExists: true,
-					OldText: "safe old", NewText: "safe new",
-				}
-				if side == "old" {
-					diff.OldText = obfuscated
-				} else {
-					diff.NewText = obfuscated
-				}
-				scrubbed := tools.ScrubResultSecrets(tools.Result{FileDiffs: []tools.FileDiff{diff}})
-				if !scrubbed.Redacted || len(scrubbed.FileDiffs) != 0 {
-					t.Fatalf("registry boundary retained an obfuscated secret: %#v", scrubbed)
-				}
-				update := toolCallResult(agent.ToolResult{ToolCallID: "call", Status: tools.StatusOK, FileDiffs: scrubbed.FileDiffs})
-				if len(update.Content) != 0 {
-					t.Fatalf("ACP content retained an obfuscated secret: %#v", update.Content)
-				}
-			})
-		}
-	}
-}
-
 func TestPlanUpdateAndStatus(t *testing.T) {
 	upd := planUpdate([]tools.PlanItem{
 		{Content: "step a", Status: "completed"},

internal/acp/types.go

@@ -12,8 +12,6 @@ const (
 	MethodAuthenticate           = "authenticate"
 	MethodSessionNew             = "session/new"
 	MethodSessionLoad            = "session/load"
-	MethodSessionList            = "session/list"
-	MethodSessionResume          = "session/resume"
 	MethodSessionPrompt          = "session/prompt"
 	MethodSessionCancel          = "session/cancel" // notification
 	MethodSessionUpdate          = "session/update" // notification (agent -> client)
@@ -64,16 +62,8 @@ type PromptCapabilities struct {
 }
 
 type AgentCapabilities struct {
-	LoadSession         bool                 `json:"loadSession"`
-	PromptCapabilities  PromptCapabilities   `json:"promptCapabilities"`
-	SessionCapabilities *SessionCapabilities `json:"sessionCapabilities,omitempty"`
-}
-
-// Empty capability objects are presence flags in ACP v1. Pointers preserve
-// the wire distinction between an advertised `{}` and an omitted capability.
-type SessionCapabilities struct {
-	List   *struct{} `json:"list,omitempty"`
-	Resume *struct{} `json:"resume,omitempty"`
+	LoadSession        bool               `json:"loadSession"`
+	PromptCapabilities PromptCapabilities `json:"promptCapabilities"`
 }
 
 type AuthMethod struct {
@@ -113,6 +103,10 @@ type ContentBlock struct {
 
 func TextBlock(text string) ContentBlock { return ContentBlock{Type: "text", Text: text} }
 
+func ImageBlock(base64Data, mimeType string) ContentBlock {
+	return ContentBlock{Type: "image", Data: base64Data, MimeType: mimeType}
+}
+
 // ---- sessions ----
 
 // McpServer mirrors the editor-provided MCP server entry. ZERO owns its own MCP
@@ -127,14 +121,9 @@ type McpServer struct {
 }
 
 type NewSessionParams struct {
-	Cwd        string      `json:"cwd"`
-	McpServers []McpServer `json:"mcpServers"`
-	// AdditionalDirectories is declared by the protocol and consumed nowhere in
-	// this repo yet. When it is wired up it must go through requestedWorkspace
-	// like Cwd does: these are client-supplied paths with no absoluteness rule of
-	// their own, which is the same shape as the resume-cwd hole that made
-	// {"sessionId":"known"} activate a session against this process's directory.
-	AdditionalDirectories []string `json:"additionalDirectories,omitempty"`
+	Cwd                   string      `json:"cwd"`
+	McpServers            []McpServer `json:"mcpServers"`
+	AdditionalDirectories []string    `json:"additionalDirectories,omitempty"`
 }
 
 type NewSessionResult struct {
@@ -155,39 +144,6 @@ type LoadSessionResult struct {
 	Modes         *SessionModeState     `json:"modes,omitempty"`
 }
 
-// ListSessionsParams and the following types implement ACP v1 session/list.
-// Transcript contents stay behind session/load; this method returns metadata
-// only and leaves the optional pagination cursor opaque.
-type ListSessionsParams struct {
-	Cwd    string `json:"cwd,omitempty"`
-	Cursor string `json:"cursor,omitempty"`
-}
-
-type SessionInfoMeta struct {
-	ModelID   string `json:"modelId,omitempty"`
-	CreatedAt string `json:"createdAt,omitempty"`
-}
-
-type SessionInfo struct {
-	SessionID string           `json:"sessionId"`
-	Cwd       string           `json:"cwd"`
-	Title     string           `json:"title,omitempty"`
-	UpdatedAt string           `json:"updatedAt,omitempty"`
-	Meta      *SessionInfoMeta `json:"_meta,omitempty"`
-}
-
-type ListSessionsResult struct {
-	Sessions   []SessionInfo `json:"sessions"`
-	NextCursor string        `json:"nextCursor,omitempty"`
-}
-
-// session/resume takes session/load's wire shape, so its cwd is a plain string
-// too and an omitted one decodes exactly like an empty one. Sharing the type is
-// safe only because activatePersistedSession requires an absolute cwd from the
-// request itself — nothing downstream may supply a default for either method.
-type ResumeSessionParams = LoadSessionParams
-type ResumeSessionResult = LoadSessionResult
-
 // ---- prompt turn ----
 
 type PromptParams struct {
@@ -222,7 +178,6 @@ type SessionNotification struct {
 // ContentBlock under "content"; the variant is set via SessionUpdate.
 type ContentChunk struct {
 	SessionUpdate string       `json:"sessionUpdate"`
-	MessageID     string       `json:"messageId,omitempty"`
 	Content       ContentBlock `json:"content"`
 }
 
@@ -259,21 +214,6 @@ type ToolCallUpdate struct {
 	RawInput      json.RawMessage    `json:"rawInput,omitempty"`
 	Content       []ToolCallContent  `json:"content,omitempty"`
 	Locations     []ToolCallLocation `json:"locations,omitempty"`
-	// Meta is ACP's extension channel. ZERO-owned values must remain beneath a
-	// namespaced key so protocol-shaped clients can preserve them while decoding
-	// and re-encoding a tool call.
-	Meta map[string]json.RawMessage `json:"_meta,omitempty"`
-}
-
-// BrowserToolDetails identifies the browser helper operation behind a tool
-// call. Version is the schema version for this optional ZERO extension;
-// Command is one of install, launch, connect, open, snapshot, click, type,
-// press, or action. Future fields must remain display-safe and must not
-// include browser profile data, cookies, typed text, URL paths/queries, or
-// DevTools endpoints.
-type BrowserToolDetails struct {
-	Version int    `json:"version"`
-	Command string `json:"command"`
 }
 
 // ToolCallContent is a tool call's rendered output. ZERO emits "content" (a
@@ -284,36 +224,19 @@ type ToolCallContent struct {
 	// type == "content"
 	Content *ContentBlock `json:"content,omitempty"`
 	// type == "diff"
-	Path    string  `json:"path,omitempty"`
-	OldText *string `json:"oldText,omitempty"`
-	NewText *string `json:"newText,omitempty"`
-}
-
-// MarshalJSON preserves ACP's discriminated content union. A diff always has
-// path, while nullable oldText/newText distinguish creation, deletion, and an
-// existing file replaced with empty content. Other content variants omit all
-// diff fields rather than serializing irrelevant nulls.
-func (content ToolCallContent) MarshalJSON() ([]byte, error) {
-	if content.Type == "diff" {
-		return json.Marshal(struct {
-			Type    string  `json:"type"`
-			Path    string  `json:"path"`
-			OldText *string `json:"oldText"`
-			NewText *string `json:"newText"`
-		}{
-			Type: content.Type, Path: content.Path, OldText: content.OldText, NewText: content.NewText,
-		})
-	}
-	return json.Marshal(struct {
-		Type    string        `json:"type"`
-		Content *ContentBlock `json:"content,omitempty"`
-	}{Type: content.Type, Content: content.Content})
+	Path    string `json:"path,omitempty"`
+	OldText string `json:"oldText,omitempty"`
+	NewText string `json:"newText,omitempty"`
 }
 
 func ToolContent(block ContentBlock) ToolCallContent {
 	return ToolCallContent{Type: "content", Content: &block}
 }
 
+func ToolDiff(path, oldText, newText string) ToolCallContent {
+	return ToolCallContent{Type: "diff", Path: path, OldText: oldText, NewText: newText}
+}
+
 type ToolCallLocation struct {
 	Path string `json:"path"`
 	Line *int   `json:"line,omitempty"`
@@ -414,22 +337,19 @@ type SetSessionModeParams struct {
 
 type SetSessionModeResult struct{}
 
-// ---- session config options ----
+// ---- session config options (model selection) ----
 
 type SessionConfigOptionValue struct {
-	Value       string `json:"value"`
-	Name        string `json:"name"`
-	Description string `json:"description,omitempty"`
+	ID   string `json:"id"`
+	Name string `json:"name"`
 }
 
 type SessionConfigOption struct {
-	ID           string                     `json:"id"`
-	Name         string                     `json:"name"`
-	Description  string                     `json:"description,omitempty"`
-	Category     string                     `json:"category,omitempty"`
-	Type         string                     `json:"type"`
-	CurrentValue string                     `json:"currentValue"`
-	Options      []SessionConfigOptionValue `json:"options"`
+	ID          string                     `json:"id"`
+	Name        string                     `json:"name"`
+	Description string                     `json:"description,omitempty"`
+	Value       string                     `json:"value"`
+	Values      []SessionConfigOptionValue `json:"values,omitempty"`
 }
 
 type SetSessionConfigOptionParams struct {
@@ -453,11 +373,6 @@ type ZeroSetModelResult struct {
 	Model string `json:"model"`
 }
 
-const (
-	configIDModel = "model"
-	configIDMode  = "mode"
-
-	configOptionTypeSelect = "select"
-	configCategoryModel    = "model"
-	configCategoryMode     = "mode"
-)
+// configIDModel is the SessionConfigOption id ZERO uses to expose model choice
+// through the standard session/set_config_option method.
+const configIDModel = "model"

internal/acp/usage_test.go

@@ -1,309 +0,0 @@
-package acp
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/sessions"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-// `zero exec` persists every provider usage report as a session usage event, so
-// `zero usage report --session <id>` can total a run. The ACP agent did not set
-// OnUsage, which dropped the token counts of every ACP session. A turn with two
-// provider requests (a tool round trip) must leave two usage events, in the shape
-// the usage report reads, next to the turn's messages.
-func TestACPPromptPersistsProviderUsage(t *testing.T) {
-	deps := testDeps(t)
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		if opts.OnUsage == nil {
-			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
-			return agent.Result{FinalAnswer: "done"}, nil
-		}
-		opts.OnUsage(agent.Usage{InputTokens: 1200, OutputTokens: 34})
-		opts.OnUsage(agent.Usage{InputTokens: 1300, OutputTokens: 21, CachedInputTokens: 900})
-		return agent.Result{FinalAnswer: "done"}, nil
-	}
-
-	h := newHarness(t, deps)
-	defer h.stop()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var created NewSessionResult
-	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
-		t.Fatal(err)
-	}
-	var result PromptResult
-	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("count my tokens")},
-	}, &result); err != nil {
-		t.Fatalf("session/prompt: %v", err)
-	}
-
-	events, err := deps.Store.ReadEvents(created.SessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	type usagePayload struct {
-		PromptTokens      int `json:"promptTokens"`
-		CompletionTokens  int `json:"completionTokens"`
-		TotalTokens       int `json:"totalTokens"`
-		CachedInputTokens int `json:"cachedInputTokens"`
-	}
-	var got []usagePayload
-	messages := 0
-	for _, event := range events {
-		switch event.Type {
-		case sessions.EventUsage:
-			var payload usagePayload
-			if err := json.Unmarshal(event.Payload, &payload); err != nil {
-				t.Fatalf("usage payload %s: %v", event.Payload, err)
-			}
-			assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
-			got = append(got, payload)
-		case sessions.EventMessage:
-			messages++
-		}
-	}
-	want := []usagePayload{
-		{PromptTokens: 1200, CompletionTokens: 34, TotalTokens: 1234},
-		{PromptTokens: 1300, CompletionTokens: 21, TotalTokens: 1321, CachedInputTokens: 900},
-	}
-	if len(got) != len(want) {
-		t.Fatalf("usage events = %+v, want %+v", got, want)
-	}
-	for i := range want {
-		if got[i] != want[i] {
-			t.Fatalf("usage event %d = %+v, want %+v", i, got[i], want[i])
-		}
-	}
-	if messages != 2 {
-		t.Fatalf("message events = %d, want the user and assistant messages of the turn", messages)
-	}
-}
-
-// Usage joins the turn's buffered batch, so a hard run failure that aborts the
-// turn leaves nothing durable, exactly as it does for the turn's messages.
-func TestACPHardTurnFailureDropsItsUsageWithTheTurn(t *testing.T) {
-	deps := testDeps(t)
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		if opts.OnUsage == nil {
-			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
-			return agent.Result{}, errors.New("injected hard run failure")
-		}
-		opts.OnUsage(agent.Usage{InputTokens: 500, OutputTokens: 5})
-		return agent.Result{}, errors.New("injected hard run failure")
-	}
-
-	h := newHarness(t, deps)
-	defer h.stop()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var created NewSessionResult
-	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
-		t.Fatal(err)
-	}
-	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("failing turn")},
-	}, &PromptResult{}); err == nil {
-		t.Fatal("hard RunAgent failure was reported as a successful turn")
-	}
-	events, err := deps.Store.ReadEvents(created.SessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(events) != 0 {
-		t.Fatalf("aborted turn left durable events: %+v", events)
-	}
-}
-
-// StopCancelled is a successful ACP outcome: the turn commits. Tokens the
-// provider already reported were spent, so they stay in the session log even
-// though the client cancelled. A hard error (the test above) is the path that
-// drops them.
-func TestACPCancelledTurnKeepsReportedUsage(t *testing.T) {
-	deps := testDeps(t)
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		if opts.OnUsage == nil {
-			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
-			return agent.Result{}, context.Canceled
-		}
-		opts.OnUsage(agent.Usage{InputTokens: 80, OutputTokens: 3})
-		return agent.Result{FinalAnswer: "partial"}, context.Canceled
-	}
-
-	h := newHarness(t, deps)
-	defer h.stop()
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var created NewSessionResult
-	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: t.TempDir()}, &created); err != nil {
-		t.Fatal(err)
-	}
-	var result PromptResult
-	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("cancelled turn")},
-	}, &result); err != nil {
-		t.Fatalf("cancelled turn returned an RPC error: %v", err)
-	}
-	if result.StopReason != StopCancelled {
-		t.Fatalf("stop reason = %q, want %q", result.StopReason, StopCancelled)
-	}
-	events, err := deps.Store.ReadEvents(created.SessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	usageEvents := 0
-	for _, event := range events {
-		if event.Type != sessions.EventUsage {
-			continue
-		}
-		usageEvents++
-		assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
-		var payload struct {
-			PromptTokens     int `json:"promptTokens"`
-			CompletionTokens int `json:"completionTokens"`
-			TotalTokens      int `json:"totalTokens"`
-		}
-		if err := json.Unmarshal(event.Payload, &payload); err != nil {
-			t.Fatal(err)
-		}
-		if payload.PromptTokens != 80 || payload.CompletionTokens != 3 || payload.TotalTokens != 83 {
-			t.Fatalf("cancelled-turn usage = %+v, want 80/3/83", payload)
-		}
-	}
-	if usageEvents != 1 {
-		t.Fatalf("usage events = %d, want the one report from the cancelled turn", usageEvents)
-	}
-}
-
-// Usage events sit in the same log session/load and session/resume read, but
-// history reconstruction skips them. The wire replay stays the conversation,
-// and the next turn's prompt stays the conversation: token counts never become
-// context and never cross the ACP wire.
-func TestACPLoadAndResumeIgnoreUsageEvents(t *testing.T) {
-	const userLine = "unique-acp-user-line"
-	const answer = "unique-acp-answer"
-	deps := testDeps(t)
-	deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-		if opts.OnUsage == nil {
-			t.Errorf("agent.Options.OnUsage is not wired: the ACP agent drops provider token usage")
-			return agent.Result{FinalAnswer: answer}, nil
-		}
-		opts.OnUsage(agent.Usage{InputTokens: 1200, OutputTokens: 34})
-		return agent.Result{FinalAnswer: answer}, nil
-	}
-
-	workspace := t.TempDir()
-	h := newHarness(t, deps)
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var created NewSessionResult
-	if err := h.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: workspace}, &created); err != nil {
-		t.Fatal(err)
-	}
-	if err := h.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock(userLine)},
-	}, &PromptResult{}); err != nil {
-		t.Fatalf("session/prompt: %v", err)
-	}
-	h.stop()
-
-	events, err := deps.Store.ReadEvents(created.SessionID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	sawUsage := false
-	for _, event := range events {
-		if event.Type == sessions.EventUsage {
-			sawUsage = true
-			assertUsagePayloadIsTokenCountsOnly(t, event.Payload)
-		}
-	}
-	if !sawUsage {
-		t.Fatal("session log has no usage event to ignore")
-	}
-
-	loader := newHarness(t, deps)
-	if err := loader.client.Call(ctx, MethodSessionLoad, LoadSessionParams{
-		SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{},
-	}, &LoadSessionResult{}); err != nil {
-		t.Fatalf("session/load: %v", err)
-	}
-	var replayed []string
-	for {
-		select {
-		case update := <-loader.notifications:
-			replayed = append(replayed, update.Content.Text)
-		case <-time.After(150 * time.Millisecond):
-			goto drained
-		}
-	}
-drained:
-	loader.stop()
-	if len(replayed) != 2 || replayed[0] != userLine || replayed[1] != answer {
-		t.Fatalf("session/load replay = %#v, want the user line and the answer only", replayed)
-	}
-	for _, text := range replayed {
-		if strings.Contains(text, "promptTokens") || strings.Contains(text, "1200") {
-			t.Fatalf("session/load replayed usage onto the wire: %q", text)
-		}
-	}
-
-	var gotPrompt string
-	deps.RunAgent = func(_ context.Context, prompt string, _ zeroruntime.Provider, _ agent.Options) (agent.Result, error) {
-		gotPrompt = prompt
-		return agent.Result{FinalAnswer: "continued"}, nil
-	}
-	resumer := newHarness(t, deps)
-	defer resumer.stop()
-	if err := resumer.client.Call(ctx, MethodSessionResume, ResumeSessionParams{
-		SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{},
-	}, &ResumeSessionResult{}); err != nil {
-		t.Fatalf("session/resume: %v", err)
-	}
-	if err := resumer.client.Call(ctx, MethodSessionPrompt, PromptParams{
-		SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("carry on")},
-	}, &PromptResult{}); err != nil {
-		t.Fatalf("resumed session/prompt: %v", err)
-	}
-	if !strings.Contains(gotPrompt, userLine) || !strings.Contains(gotPrompt, answer) {
-		t.Fatalf("resumed prompt = %q, want the prior conversation", gotPrompt)
-	}
-	if strings.Contains(gotPrompt, "promptTokens") || strings.Contains(gotPrompt, "1200") {
-		t.Fatalf("resumed prompt contains persisted usage: %q", gotPrompt)
-	}
-}
-
-// usagePayloadAllowedKeys is the non-escalating EventUsagePayload shape. ACP
-// has no model escalation, and the writer must not grow a prompt, tool
-// argument, or other raw field.
-var usagePayloadAllowedKeys = map[string]bool{
-	"promptTokens":      true,
-	"completionTokens":  true,
-	"totalTokens":       true,
-	"cachedInputTokens": true,
-	"cacheWriteTokens":  true,
-	"reasoningTokens":   true,
-}
-
-func assertUsagePayloadIsTokenCountsOnly(t *testing.T, payload json.RawMessage) {
-	t.Helper()
-	var raw map[string]json.RawMessage
-	if err := json.Unmarshal(payload, &raw); err != nil {
-		t.Fatalf("usage payload %s: %v", payload, err)
-	}
-	if len(raw) == 0 {
-		t.Fatalf("usage payload is empty: %s", payload)
-	}
-	for key := range raw {
-		if !usagePayloadAllowedKeys[key] {
-			t.Fatalf("usage payload key %q is not a token count: %s", key, payload)
-		}
-	}
-}

internal/agent/acceptance_gate_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func enabledSelfCorrector(t *testing.T) *SelfCorrector {

internal/agent/additional_permissions_validation_test.go

@@ -5,29 +5,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
-type normalizationRecordingShellTool struct {
-	calls []map[string]any
-}
-
-func (tool *normalizationRecordingShellTool) Name() string { return "bash" }
-func (tool *normalizationRecordingShellTool) Description() string {
-	return "record normalized shell arguments"
-}
-func (tool *normalizationRecordingShellTool) Parameters() tools.Schema {
-	return tools.Schema{Type: "object", AdditionalProperties: true}
-}
-func (tool *normalizationRecordingShellTool) Safety() tools.Safety {
-	return tools.Safety{SideEffect: tools.SideEffectShell, Permission: tools.PermissionAllow}
-}
-func (tool *normalizationRecordingShellTool) Run(_ context.Context, args map[string]any) tools.Result {
-	tool.calls = append(tool.calls, cloneArgs(args))
-	return tools.Result{Status: tools.StatusOK}
-}
-
 // A shell call that sets sandbox_permissions: with_additional_permissions but
 // omits (or malforms) additional_permissions can never succeed: the same
 // validation runs again at grant time regardless of the user's decision. It
@@ -36,7 +16,7 @@ func (tool *normalizationRecordingShellTool) Run(_ context.Context, args map[str
 func TestExecuteToolCallRejectsMissingAdditionalPermissionsBeforePrompt(t *testing.T) {
 	root := t.TempDir()
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedBashTool(root, nil))
+	registry.Register(tools.NewBashTool(root))
 
 	promptCalls := 0
 	result, err := executeToolCall(
@@ -71,7 +51,7 @@ func TestExecuteToolCallRejectsMissingAdditionalPermissionsBeforePrompt(t *testi
 func TestExecuteToolCallRejectsAdditionalPermissionsWithoutFlagBeforePrompt(t *testing.T) {
 	root := t.TempDir()
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedBashTool(root, nil))
+	registry.Register(tools.NewBashTool(root))
 
 	promptCalls := 0
 	result, err := executeToolCall(
@@ -108,7 +88,7 @@ func TestExecuteToolCallRejectsAdditionalPermissionsWithoutFlagBeforePrompt(t *t
 func TestExecuteToolCallMissingAdditionalPermissionsErrorIsActionable(t *testing.T) {
 	root := t.TempDir()
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedBashTool(root, nil))
+	registry.Register(tools.NewBashTool(root))
 
 	result, err := executeToolCall(
 		context.Background(),
@@ -127,7 +107,9 @@ func TestExecuteToolCallMissingAdditionalPermissionsErrorIsActionable(t *testing
 	if !strings.Contains(result.Output, `{"network": {"enabled": true}}`) {
 		t.Fatalf("output = %q, want a concrete additional_permissions example", result.Output)
 	}
-	assertNamesOmitRemedy(t, "missing additional_permissions", result.Output)
+	if !strings.Contains(result.Output, "omit sandbox_permissions") {
+		t.Fatalf("output = %q, want guidance that the flag can simply be omitted", result.Output)
+	}
 }
 
 // A well-formed additional_permissions payload must still reach the normal
@@ -135,7 +117,7 @@ func TestExecuteToolCallMissingAdditionalPermissionsErrorIsActionable(t *testing
 func TestExecuteToolCallStillPromptsForValidAdditionalPermissions(t *testing.T) {
 	root := t.TempDir()
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedBashTool(root, nil))
+	registry.Register(tools.NewBashTool(root))
 
 	promptCalls := 0
 	_, err := executeToolCall(
@@ -162,237 +144,3 @@ func TestExecuteToolCallStillPromptsForValidAdditionalPermissions(t *testing.T)
 		t.Fatalf("OnPermissionRequest called %d times, want exactly 1 for a valid elevation request", promptCalls)
 	}
 }
-
-// runShellCall drives one shell tool call through the real registry (and so
-// through Registry.RunWithOptions) exactly as the agent loop would.
-func runShellCall(t *testing.T, root string, arguments string) ToolResult {
-	t.Helper()
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedExecCommandTool(root, nil, nil))
-	result, err := executeToolCall(
-		context.Background(),
-		registry,
-		ToolCall{ID: "c1", Name: "exec_command", Arguments: arguments},
-		PermissionModeUnsafe,
-		Options{Cwd: root},
-	)
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	return result
-}
-
-// TestAdditionalPermissionsRejectionsConverge is the regression guard for
-// #845/#847. A model that attaches a permission object to a command needing
-// none used to be told only "set sandbox_permissions", which pushed it into the
-// OTHER invalid shape (flag set, payload empty) and its "include a permission"
-// error pushed it straight back — the reported loop that burned turns on
-// `git branch --show-current`.
-//
-// The contract this pins is convergence, not tolerance: both shapes are still
-// REJECTED (nothing here grants access), but each rejection must name the one
-// follow-up call that works, and that follow-up must actually succeed.
-func TestAdditionalPermissionsRejectionsConverge(t *testing.T) {
-	root := t.TempDir()
-	const readOnly = `"cmd":"git --version"`
-
-	// Step 1 of the reported loop: a permission object with no flag.
-	first := runShellCall(t, root, `{`+readOnly+`,"additional_permissions":{"network":{"enabled":true}}}`)
-	if first.Status != tools.StatusError {
-		t.Fatalf("unflagged additional_permissions status = %q, want error (rejecting is correct)", first.Status)
-	}
-	assertNamesOmitRemedy(t, "unflagged additional_permissions", first.Output)
-
-	// Step 2 of the reported loop: the model keeps the flag but empties the
-	// payload. This must not be the dead end it was.
-	second := runShellCall(t, root, `{`+readOnly+`,"sandbox_permissions":"with_additional_permissions"}`)
-	if second.Status != tools.StatusError {
-		t.Fatalf("flag without payload status = %q, want error", second.Status)
-	}
-	assertNamesOmitRemedy(t, "flag without payload", second.Output)
-
-	// The call both errors point at must actually work.
-	converged := runShellCall(t, root, `{`+readOnly+`}`)
-	if converged.Status != tools.StatusOK {
-		t.Fatalf("the call both errors instruct the model to make failed: status=%q output=%q", converged.Status, converged.Output)
-	}
-}
-
-// assertNamesOmitRemedy pins the actionable half of the error text: the message
-// must spell out that BOTH fields can simply be dropped. "Set the flag" or
-// "include a permission" alone is what made the two errors chase each other.
-func assertNamesOmitRemedy(t *testing.T, label string, output string) {
-	t.Helper()
-	if !strings.Contains(output, "omit both sandbox_permissions and additional_permissions") {
-		t.Fatalf("%s error = %q, want it to say to omit both fields entirely", label, output)
-	}
-	if !strings.Contains(output, "retry") {
-		t.Fatalf("%s error = %q, want it to tell the model to retry", label, output)
-	}
-}
-
-// The empty-payload rejection carries the same remedy. It is pinned on the
-// validator directly because normalizeNoopAdditionalPermissions absorbs the
-// empty payload before executeToolCall reaches this branch;
-// inlineAdditionalPermissionsProfile is still the shared source of truth that
-// buildPermissionEvent and the grant path re-run, so its text must converge too.
-func TestEmptyAdditionalPermissionsErrorNamesOmitRemedy(t *testing.T) {
-	args := map[string]any{
-		"cmd":                 "git --version",
-		"sandbox_permissions": string(tools.SandboxPermissionsWithAdditionalPermissions),
-		"additional_permissions": map[string]any{
-			"network":     map[string]any{"enabled": false},
-			"file_system": map[string]any{"read": []any{}, "write": []any{}},
-		},
-	}
-	_, requested, err := inlineAdditionalPermissionsProfile(args, t.TempDir())
-	if !requested {
-		t.Fatal("requested = false, want true for an explicit with_additional_permissions call")
-	}
-	if err == nil {
-		t.Fatal("an empty additional_permissions payload was accepted; it must still be rejected")
-	}
-	assertNamesOmitRemedy(t, "empty payload", err.Error())
-}
-
-// A provider that materializes every optional property may send
-// "additional_permissions": null. That grants nothing and carries no flag, so it
-// is the field omitted — rejecting it stalled an ordinary command behind an
-// error the model could not act on.
-func TestExecuteToolCallTreatsNullAdditionalPermissionsAsOmitted(t *testing.T) {
-	result := runShellCall(t, t.TempDir(), `{"cmd":"git --version","additional_permissions":null}`)
-	if result.Status != tools.StatusOK {
-		t.Fatalf("null additional_permissions was rejected: status=%q output=%q", result.Status, result.Output)
-	}
-}
-
-// A null payload alongside the flag must still be rejected, and must land on
-// the same error as an absent payload rather than being quietly downgraded.
-func TestExecuteToolCallRejectsFlaggedNullAdditionalPermissions(t *testing.T) {
-	result := runShellCall(t, t.TempDir(),
-		`{"cmd":"git --version","sandbox_permissions":"with_additional_permissions","additional_permissions":null}`)
-	if result.Status != tools.StatusError {
-		t.Fatalf("flagged null status = %q, want error", result.Status)
-	}
-	if !strings.Contains(result.Output, "no additional_permissions object was provided") {
-		t.Fatalf("output = %q, want the missing-payload error", result.Output)
-	}
-	assertNamesOmitRemedy(t, "flagged null", result.Output)
-}
-
-func TestNormalizeProviderExpandedEmptyAdditionalPermissions(t *testing.T) {
-	for _, mode := range []string{
-		string(tools.SandboxPermissionsUseDefault),
-		string(tools.SandboxPermissionsWithAdditionalPermissions),
-	} {
-		args := map[string]any{
-			"command":             "./zero --version",
-			"sandbox_permissions": mode,
-			"additional_permissions": map[string]any{
-				"file_system": map[string]any{
-					"deny_read": []any{},
-					"entries":   []any{},
-					"read":      []any{},
-					"write":     []any{},
-				},
-				"network": map[string]any{"enabled": false},
-			},
-		}
-		normalizeNoopAdditionalPermissions(args, t.TempDir(), nil)
-		if _, exists := args["additional_permissions"]; exists {
-			t.Fatalf("mode %q retained empty additional_permissions: %#v", mode, args)
-		}
-		if got := args["sandbox_permissions"]; got != string(tools.SandboxPermissionsUseDefault) {
-			t.Fatalf("mode %q normalized to %q, want use_default", mode, got)
-		}
-	}
-}
-
-func TestExecuteToolCallNormalizesProviderExpandedEmptyAdditionalPermissions(t *testing.T) {
-	tool := &normalizationRecordingShellTool{}
-	registry := tools.NewRegistry()
-	registry.Register(tool)
-
-	result, err := executeToolCall(
-		context.Background(),
-		registry,
-		ToolCall{
-			ID:   "c1",
-			Name: "bash",
-			Arguments: `{"command":"./zero --version","sandbox_permissions":"with_additional_permissions",` +
-				`"additional_permissions":{"file_system":{"deny_read":[],"entries":[],"read":[],"write":[]},"network":{"enabled":false}}}`,
-		},
-		PermissionModeAuto,
-		Options{Cwd: t.TempDir()},
-	)
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusOK {
-		t.Fatalf("provider-expanded empty permissions were rejected: %s", result.Output)
-	}
-	if len(tool.calls) != 1 {
-		t.Fatalf("shell tool calls = %d, want 1", len(tool.calls))
-	}
-	args := tool.calls[0]
-	if _, exists := args["additional_permissions"]; exists {
-		t.Fatalf("executeToolCall retained empty additional_permissions: %#v", args)
-	}
-	if got := args["sandbox_permissions"]; got != string(tools.SandboxPermissionsUseDefault) {
-		t.Fatalf("sandbox mode = %q, want use_default", got)
-	}
-}
-
-func TestNormalizeAdditionalPermissionsPreservesRealRequest(t *testing.T) {
-	args := map[string]any{
-		"sandbox_permissions": string(tools.SandboxPermissionsWithAdditionalPermissions),
-		"additional_permissions": map[string]any{
-			"network": map[string]any{"enabled": true},
-		},
-	}
-	normalizeNoopAdditionalPermissions(args, t.TempDir(), nil)
-	if _, exists := args["additional_permissions"]; !exists {
-		t.Fatal("non-empty additional_permissions was removed")
-	}
-	if got := args["sandbox_permissions"]; got != string(tools.SandboxPermissionsWithAdditionalPermissions) {
-		t.Fatalf("sandbox mode changed to %q", got)
-	}
-}
-
-func TestNormalizeAdditionalPermissionsRemovesWorkspaceReadAlreadyCoveredBySandbox(t *testing.T) {
-	root := t.TempDir()
-	engine := sandbox.NewEngine(sandbox.EngineOptions{
-		WorkspaceRoot: root,
-		Policy:        sandbox.DefaultPolicy(),
-	})
-	args := map[string]any{
-		"command":             "./zero --version",
-		"sandbox_permissions": string(tools.SandboxPermissionsWithAdditionalPermissions),
-		"additional_permissions": map[string]any{
-			"file_system": map[string]any{
-				"entries": []any{
-					map[string]any{
-						"access": "read",
-						"path": map[string]any{
-							"type": "path",
-							"path": ".",
-						},
-					},
-				},
-				"deny_read": []any{},
-				"read":      []any{},
-				"write":     []any{},
-			},
-			"network": map[string]any{"enabled": false},
-		},
-	}
-
-	normalizeNoopAdditionalPermissions(args, root, engine)
-
-	if _, exists := args["additional_permissions"]; exists {
-		t.Fatalf("already-covered additional_permissions was retained: %#v", args)
-	}
-	if got := args["sandbox_permissions"]; got != string(tools.SandboxPermissionsUseDefault) {
-		t.Fatalf("sandbox mode changed to %q", got)
-	}
-}

internal/agent/ask_user_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // providerCallingAskUserThenAnswer returns a mock provider whose first turn calls

internal/agent/async_diagnostics_test.go

@@ -8,9 +8,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Twigpine/zero/internal/testutil"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestAsyncDiagnosticsNilCollectorNoOps(t *testing.T) {
@@ -112,11 +111,7 @@ func TestAsyncDiagnosticsReEditReplacesResult(t *testing.T) {
 	diagnostics := newAsyncDiagnostics(check, "/ws")
 
 	diagnostics.enqueue(context.Background(), []string{"a.go"})
-	testutil.WaitFor(t, "worker idle", func() bool {
-		diagnostics.mu.Lock()
-		defer diagnostics.mu.Unlock()
-		return diagnostics.working == nil
-	})
+	waitForIdle(t, diagnostics)
 	mu.Lock()
 	response = "ERR new"
 	mu.Unlock()
@@ -128,6 +123,23 @@ func TestAsyncDiagnosticsReEditReplacesResult(t *testing.T) {
 	}
 }
 
+func waitForIdle(t *testing.T, diagnostics *asyncDiagnostics) {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		diagnostics.mu.Lock()
+		busy := diagnostics.working
+		diagnostics.mu.Unlock()
+		if busy == nil {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("worker never went idle")
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+}
+
 // changedFilesTool is a fake mutating tool reporting a changed file without
 // touching the filesystem.
 type changedFilesTool struct{}

internal/agent/checkpoint_targets.go

@@ -1,34 +0,0 @@
-package agent
-
-import "github.com/Twigpine/zero/internal/tools"
-
-// CheckpointTargets returns the workspace-relative paths a tool call will mutate,
-// resolving its arguments exactly as executeToolCall does. Freeform apply_patch
-// input is normalized through the registered built-in tool, so absolute headers
-// are rewritten relative to the selected write root and cwd is set: checkpoint
-// capture and execution therefore agree on the files at stake.
-//
-// Best-effort: nil when the call has no capture targets or its arguments cannot
-// be resolved. Checkpoint capture never fails a run.
-func CheckpointTargets(workspaceRoot string, registry *tools.Registry, call ToolCall) []string {
-	if registry == nil {
-		return nil
-	}
-	args := map[string]any{}
-	if call.Freeform {
-		tool, ok := registry.Get(call.Name)
-		if !ok || !tools.IsBuiltInApplyPatch(tool) {
-			return nil
-		}
-		prepared, err := tools.PrepareFreeformApplyPatchArguments(tool, call.Arguments)
-		if err != nil {
-			return nil
-		}
-		args = prepared
-	} else if call.Arguments != "" {
-		if err := decodeToolArguments(call.Arguments, &args); err != nil {
-			return nil
-		}
-	}
-	return tools.MutationTargets(workspaceRoot, call.Name, args)
-}

internal/agent/checkpoint_targets_test.go

@@ -1,99 +0,0 @@
-package agent
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"slices"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-func TestCheckpointTargets(t *testing.T) {
-	root := t.TempDir()
-	// Absolute headers must be compared against the physical root: t.TempDir
-	// differs from it on macOS (/var -> /private/var) and via Windows short names.
-	if resolved, err := filepath.EvalSymlinks(root); err == nil {
-		root = resolved
-	}
-	if err := os.WriteFile(filepath.Join(root, "main.txt"), []byte("before\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	relativePatch := "*** Begin Patch\n*** Update File: main.txt\n@@\n-before\n+after\n*** End Patch\n"
-	absolutePatch := "*** Begin Patch\n*** Update File: " + filepath.Join(root, "main.txt") + "\n@@\n-before\n+after\n*** End Patch\n"
-	multiFilePatch := "*** Begin Patch\n*** Update File: main.txt\n@@\n-before\n+after\n*** Add File: notes.txt\n+new\n*** End Patch\n"
-	jsonArgs, err := json.Marshal(map[string]any{"patch": relativePatch})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, nil))
-	unbuiltinRegistry := tools.NewRegistry()
-	unbuiltinRegistry.Register(&customApplyPatchTool{})
-
-	for _, tc := range []struct {
-		name     string
-		registry *tools.Registry
-		call     ToolCall
-		want     []string
-	}{
-		{
-			name: "freeform relative header",
-			call: ToolCall{Name: "apply_patch", Arguments: relativePatch, Freeform: true},
-			want: []string{"main.txt"},
-		},
-		{
-			name: "freeform absolute header stays workspace-relative",
-			call: ToolCall{Name: "apply_patch", Arguments: absolutePatch, Freeform: true},
-			want: []string{"main.txt"},
-		},
-		{
-			name: "freeform multi-file patch",
-			call: ToolCall{Name: "apply_patch", Arguments: multiFilePatch, Freeform: true},
-			want: []string{"main.txt", "notes.txt"},
-		},
-		{
-			name: "json arguments",
-			call: ToolCall{Name: "apply_patch", Arguments: string(jsonArgs)},
-			want: []string{"main.txt"},
-		},
-		{
-			name: "freeform traversal is rejected",
-			call: ToolCall{Name: "apply_patch", Arguments: "*** Begin Patch\n*** Update File: ../escape.txt\n@@\n-x\n+y\n*** End Patch\n", Freeform: true},
-			want: nil,
-		},
-		{
-			name:     "freeform custom apply_patch is not prepared",
-			registry: unbuiltinRegistry,
-			call:     ToolCall{Name: "apply_patch", Arguments: relativePatch, Freeform: true},
-			want:     nil,
-		},
-		{
-			name: "unknown freeform tool",
-			call: ToolCall{Name: "read_file", Arguments: "raw", Freeform: true},
-			want: nil,
-		},
-		{
-			name: "malformed json arguments",
-			call: ToolCall{Name: "apply_patch", Arguments: "{"},
-			want: nil,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			reg := registry
-			if tc.registry != nil {
-				reg = tc.registry
-			}
-			got := CheckpointTargets(root, reg, tc.call)
-			if !slices.Equal(got, tc.want) {
-				t.Fatalf("CheckpointTargets() = %#v, want %#v", got, tc.want)
-			}
-		})
-	}
-
-	if got := CheckpointTargets(root, nil, ToolCall{Name: "apply_patch", Arguments: relativePatch}); got != nil {
-		t.Fatalf("CheckpointTargets(nil registry) = %#v, want nil", got)
-	}
-}

internal/agent/command_prefix.go

@@ -5,8 +5,8 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
 	"mvdan.cc/sh/v3/syntax"
 )
 
@@ -501,3 +501,15 @@ func hasStringPrefix(values []string, prefix []string) bool {
 	}
 	return true
 }
+
+func equalStringSlices(left []string, right []string) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}

internal/agent/command_prefix_test.go

@@ -4,8 +4,8 @@ import (
 	"runtime"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 func TestProposedCommandPrefixUsesSafeSimpleCommands(t *testing.T) {
@@ -99,43 +99,6 @@ func TestProposedCommandPrefixRejectsUnsafeRequestedPrefix(t *testing.T) {
 	}
 }
 
-// The launcher denylist is only worth anything if it holds on the path a user
-// actually sees. A model naming its own prefix_rule is that path: before
-// launcher names were normalized, "python3.11" was offered as a one-token
-// grant, and hasStringPrefix then matched every later python3.11 invocation.
-func TestProposedCommandPrefixRejectsLauncherSpellingsInRequestedPrefix(t *testing.T) {
-	for _, testCase := range []struct {
-		command string
-		rule    []any
-	}{
-		{"python3.11 script.py", []any{"python3.11"}},
-		{"python.exe script.py", []any{"python.exe"}},
-		{"node.exe app.js", []any{"node.exe"}},
-		{"cmd /c whoami", []any{"cmd"}},
-		{"busybox sh -c id", []any{"busybox"}},
-		{"uv run main.py", []any{"uv", "run"}},
-		{"python3.11 -c import_os", []any{"python3.11", "-c"}},
-	} {
-		got := proposedCommandPrefix("bash", map[string]any{
-			"command":     testCase.command,
-			"prefix_rule": testCase.rule,
-		})
-		if got != nil {
-			t.Errorf("prefix_rule %v for %q was offered as %#v, want rejected", testCase.rule, testCase.command, got)
-		}
-	}
-}
-
-func TestProposedCommandPrefixStillOffersOrdinaryCommands(t *testing.T) {
-	got := proposedCommandPrefix("bash", map[string]any{
-		"command":     "cargo build --release",
-		"prefix_rule": []any{"cargo", "build"},
-	})
-	if len(got) != 2 || got[0] != "cargo" || got[1] != "build" {
-		t.Fatalf("ordinary prefix rule = %#v, want [cargo build]", got)
-	}
-}
-
 func TestProposedCommandPrefixRejectsUnsafeShellForms(t *testing.T) {
 	cases := []string{
 		"cat < in > out",

internal/agent/compaction.go

@@ -4,12 +4,10 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"strconv"
 	"strings"
-	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/trace"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/trace"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // Session compaction.
@@ -40,9 +38,8 @@ const compactionTriggerRatio = 0.7
 // transcript (and so tests can assert on it).
 const summaryLabel = "[Summary of earlier conversation]"
 
-// CompactionSummaryInstructions is the system prompt handed to both automatic
-// and manually requested compaction summarizers.
-const CompactionSummaryInstructions = "You are compacting a coding-assistant conversation to save context. " +
+// summaryInstructions is the system prompt handed to the summarizer model.
+const summaryInstructions = "You are compacting a coding-assistant conversation to save context. " +
 	"Write a dense, factual summary of the conversation so far. Preserve: the user's goals and explicit constraints; " +
 	"decisions made and why; files created or modified (with paths) and key code changes; commands run and their important " +
 	"results; and anything still in progress or unresolved. Omit pleasantries. Use terse bullet points. Do not invent details. " +
@@ -59,10 +56,6 @@ type CompactionOptions struct {
 	// injected so Compact stays pure and testable; the agent loop wires it to a
 	// real provider call.
 	Summarize func(toSummarize []zeroruntime.Message) (string, error)
-	// taskState is a snapshot supplied by the running agent. Its immutable
-	// objective is always preserved; mutable fields are admitted only when its
-	// plan projection still matches the transcript.
-	taskState *taskStateSnapshot
 }
 
 // CompactionResult is the metadata-bearing result returned by CompactMessages.
@@ -78,12 +71,6 @@ type CompactionResult struct {
 	// summary message also includes summaryLabel and any preserved structured
 	// state needed by later compactions.
 	SummaryText string
-	// ProjectedChars is the text content sent to the summarizer after semantic
-	// projection, excluding provider protocol framing.
-	ProjectedChars int
-	// Truncated reports whether projection dropped content to satisfy its
-	// bounded brief or previous-summary limits.
-	Truncated bool
 	// Compacted reports whether Messages contains an injected summary.
 	Compacted bool
 }
@@ -146,17 +133,11 @@ func estimateToolDefTokens(tools []zeroruntime.ToolDefinition) int {
 	for _, tool := range tools {
 		total += ApproxTextTokens(tool.Name)
 		total += ApproxTextTokens(tool.Description)
-		total += ApproxTextTokens(string(tool.Type))
 		if len(tool.Parameters) > 0 {
 			if encoded, err := json.Marshal(tool.Parameters); err == nil {
 				total += ApproxTextTokens(string(encoded))
 			}
 		}
-		if tool.Format != nil {
-			total += ApproxTextTokens(tool.Format.Type)
-			total += ApproxTextTokens(tool.Format.Syntax)
-			total += ApproxTextTokens(tool.Format.Definition)
-		}
 		total += 4 // per-tool overhead
 	}
 	return total
@@ -231,15 +212,15 @@ func CompactMessages(messages []zeroruntime.Message, opts CompactionOptions) (Co
 		}, nil
 	}
 
-	summaryResult, err := SummarizeCompactionMessages(middle, opts.Summarize)
+	summary, err := opts.Summarize(middle)
 	if err != nil {
 		return CompactionResult{}, err
 	}
-	summary := summaryResult.SummaryText
+	summary = strings.TrimSpace(summary)
 
 	// Preserve structured state (active plan + loaded skills) from the elided
 	// middle verbatim, so it is not lost or paraphrased away by the prose summary.
-	content := appendPreservedState(summaryLabel+"\n"+summary, middle, opts.taskState)
+	content := appendPreservedState(summaryLabel+"\n"+summary, middle)
 
 	compacted := make([]zeroruntime.Message, 0, systemEnd+1+(len(messages)-boundary))
 	compacted = append(compacted, messages[:systemEnd]...)
@@ -253,53 +234,10 @@ func CompactMessages(messages []zeroruntime.Message, opts CompactionOptions) (Co
 		RemovedCount:   len(middle),
 		PreservedCount: len(messages) - len(middle),
 		SummaryText:    summary,
-		ProjectedChars: summaryResult.ProjectedChars,
-		Truncated:      summaryResult.Truncated,
 		Compacted:      true,
 	}, nil
 }
 
-// CompactionSummaryResult describes the shared summarization input and output.
-type CompactionSummaryResult struct {
-	SummaryText    string
-	ProjectedChars int
-	Truncated      bool
-}
-
-// SummarizeCompactionMessages applies the shared semantic projection before
-// invoking a caller-supplied summarizer. Automatic context-pressure compaction
-// and manual session compaction both use this path.
-func SummarizeCompactionMessages(messages []zeroruntime.Message, summarize func([]zeroruntime.Message) (string, error)) (CompactionSummaryResult, error) {
-	if summarize == nil {
-		return CompactionSummaryResult{}, errors.New("compaction requires a Summarize function")
-	}
-	projection := projectCompactionInput(messages)
-	summaryInput := projection.messages
-	if len(summaryInput) == 0 {
-		summaryInput = messages
-	}
-	summary, err := summarize(summaryInput)
-	if err != nil {
-		return CompactionSummaryResult{}, err
-	}
-	return CompactionSummaryResult{
-		SummaryText:    strings.TrimSpace(summary),
-		ProjectedChars: compactionMessageChars(summaryInput),
-		Truncated:      projection.truncated,
-	}, nil
-}
-
-func compactionMessageChars(messages []zeroruntime.Message) int {
-	total := 0
-	for _, message := range messages {
-		total += len(message.Content)
-		for _, call := range message.ToolCalls {
-			total += len(call.Name) + len(call.Arguments)
-		}
-	}
-	return total
-}
-
 // safeSuffixBoundary walks the preserve boundary backward (toward systemEnd) so
 // the preserved suffix begins on a user or assistant message rather than a
 // tool/tool_result message. A tool result with no preceding assistant tool call
@@ -388,9 +326,6 @@ type compactionState struct {
 	// OnText is deliberately NOT forwarded (compaction stays invisible to the user),
 	// but its token COST must still be counted so usage reports and budgets include it.
 	onUsage func(Usage)
-	task    *taskState
-	planner *contextPlanner
-	trace   *trace.Recorder
 
 	// calibrationRatio scales the raw byte/4 token estimate toward the provider's
 	// real prompt-token count. ApproxTextTokens over-counts code-heavy content by
@@ -398,27 +333,6 @@ type compactionState struct {
 	// starts at 1.0 and converges via an EMA as each turn reports actual usage, so
 	// later turns compact nearer to real capacity. Zero is treated as 1.0.
 	calibrationRatio float64
-
-	// summarizerFactory lazily builds the dedicated (cheap) summarizer provider
-	// (Options.Summarizer) for the current main model. summarizerProvider
-	// memoizes the built provider and summarizerResolved records that the
-	// factory ran (it may legitimately return no provider: the main model is
-	// already the cheap one). summarizerBroken is the sticky fallback: once a
-	// build or call fails, the run stays on the main provider until the next
-	// model switch — a misconfigured cheap model must never break (or
-	// repeatedly delay) compaction.
-	summarizerFactory  func(ctx context.Context, mainModelID string) (Provider, error)
-	summarizerProvider Provider
-	summarizerResolved bool
-	summarizerBroken   bool
-	// window is the context window the threshold was derived from. The
-	// reactive free-prune stage compares against it (the limit the provider
-	// enforces), not against the 70% proactive threshold — a pruned history
-	// between the two would still succeed on retry.
-	window int
-	// mainModel is the model the run currently streams on; the summarizer
-	// choice is made against it and remade after a mid-run switch.
-	mainModel string
 }
 
 // calibrate folds one turn's (rawEstimate, actualPromptTokens) sample into the
@@ -451,88 +365,13 @@ func (state *compactionState) calibratedTokens(raw int) int {
 	return int(float64(raw) * state.calibrationRatio)
 }
 
-func newCompactionState(options Options, task *taskState) *compactionState {
-	state := &compactionState{
-		enabled:           options.ContextWindow > 0,
-		threshold:         compactionThreshold(options.ContextWindow),
-		window:            options.ContextWindow,
-		mainModel:         options.Model,
-		preserveLast:      options.CompactionPreserveLast,
-		onUsage:           options.OnUsage,
-		task:              task,
-		planner:           newContextPlanner(contextPlannerConfig{contextWindow: options.ContextWindow, serviceTier: options.ServiceTier}),
-		trace:             options.Trace,
-		summarizerFactory: options.Summarizer,
+func newCompactionState(options Options) *compactionState {
+	return &compactionState{
+		enabled:      options.ContextWindow > 0,
+		threshold:    compactionThreshold(options.ContextWindow),
+		preserveLast: options.CompactionPreserveLast,
+		onUsage:      options.OnUsage,
 	}
-	return state
-}
-
-// updateWindow re-derives the compaction threshold after a mid-run model
-// switch. The low-water mark is reset: it was measured against the old
-// threshold, and keeping it could suppress a compaction the smaller window
-// now requires. <= 0 (unknown model) leaves everything unchanged.
-func (state *compactionState) updateWindow(window int) {
-	if window <= 0 {
-		return
-	}
-	state.enabled = true
-	state.window = window
-	state.threshold = compactionThreshold(window)
-	state.lowWaterMark = 0
-	if state.planner != nil {
-		state.planner.config.contextWindow = window
-	}
-}
-
-// switchModel records a mid-run model switch: the window is re-derived
-// (window <= 0 keeps the old one) and the summarizer choice is forgotten so
-// the next compaction re-resolves it against the new main model. A run that
-// started on the cheap model (no dedicated summarizer) and escalated to an
-// expensive one therefore regains cheap summaries — the exact workflow a
-// dedicated summarizer exists for.
-func (state *compactionState) switchModel(modelID string, window int) {
-	state.mainModel = modelID
-	state.updateWindow(window)
-	state.summarizerProvider = nil
-	state.summarizerResolved = false
-	state.summarizerBroken = false
-}
-
-// summarizeProvider returns the provider summarization calls should use and
-// whether it is the dedicated summarizer: that one when it applies to the
-// current main model and is healthy, else the main provider. The factory runs
-// at most once per main model; a build error marks the summarizer broken for
-// that model. Callers branch on the boolean rather than comparing Provider
-// values — interface comparison panics on a non-comparable dynamic type.
-func (state *compactionState) summarizeProvider(ctx context.Context, main Provider) (Provider, bool) {
-	if state.summarizerFactory == nil || state.summarizerBroken {
-		return main, false
-	}
-	if !state.summarizerResolved {
-		state.summarizerResolved = true
-		built, err := state.summarizerFactory(ctx, state.mainModel)
-		if err != nil {
-			state.summarizerBroken = true
-			return main, false
-		}
-		state.summarizerProvider = built
-	}
-	if state.summarizerProvider == nil {
-		return main, false
-	}
-	return state.summarizerProvider, true
-}
-
-// fitsWindow reports whether a calibrated size is safely under the limit the
-// provider enforces. The proactive threshold (70% of the window) is a trigger
-// for the paid summarizer, not the hard limit; the reactive path compares
-// against the window itself, with a small margin for estimate error, so a
-// history pruned to, say, 85% of the window takes the free retry.
-func (state *compactionState) fitsWindow(size int) bool {
-	if state.window <= 0 {
-		return size <= state.threshold
-	}
-	return size <= state.window-state.window/20
 }
 
 // maybeCompact runs proactive compaction at the top of a turn. It returns the
@@ -567,14 +406,6 @@ func (state *compactionState) maybeCompact(
 	// the bodies of old, large tool results (the model has already acted on
 	// them). If that brings us back under threshold, skip the paid summarizer
 	// entirely and preserve recent turns verbatim.
-	if pruned, reclaimed := pruneSupersededReadResults(messages); reclaimed > 0 {
-		messages = pruned
-		size = state.calibratedTokens(estimateTokens(messages) + toolTokens)
-		if size <= state.threshold {
-			state.lowWaterMark = size
-			return messages
-		}
-	}
 	if pruned, reclaimed := pruneStaleToolOutput(messages, state.preserveLast); reclaimed > 0 {
 		messages = pruned
 		size = state.calibratedTokens(estimateTokens(messages) + toolTokens)
@@ -586,8 +417,7 @@ func (state *compactionState) maybeCompact(
 
 	compacted, err := Compact(messages, CompactionOptions{
 		PreserveLast: state.preserveLast,
-		Summarize:    state.summarizeClosure(ctx, provider),
-		taskState:    state.task.snapshotForCompaction(messages),
+		Summarize:    summarizeClosure(ctx, provider, state.onUsage),
 	})
 	if err != nil {
 		// Summarizer failed: keep the original history. The reactive path (or a
@@ -628,41 +458,16 @@ func (state *compactionState) recover(
 		// context-limit error never triggers an unexpected summarization call.
 		return messages, false, nil
 	}
-	if !isContextLimitError(errorMessage) {
+	if state.reactiveAttempted {
 		return messages, false, nil
 	}
-
-	// CHEAP FIRST STAGE (mirrors maybeCompact): a context-limit failure can
-	// often be fixed for free by dropping superseded reads and pruning old
-	// tool-result bodies. It runs regardless of the one-shot reactive budget
-	// (it costs nothing and cannot loop: a second pass finds nothing left to
-	// prune). The free retry is taken only when the pruned history fits the
-	// window the provider enforces — otherwise a retry would fail the same
-	// way, so fall through to the paid summarizer in this same call.
-	toolTokens := estimateToolDefTokens(tools)
-	prunedAny := false
-	if pruned, reclaimed := pruneSupersededReadResults(messages); reclaimed > 0 {
-		messages, prunedAny = pruned, true
-	}
-	if pruned, reclaimed := pruneStaleToolOutput(messages, state.preserveLast); reclaimed > 0 {
-		messages, prunedAny = pruned, true
-	}
-	if prunedAny {
-		size := state.calibratedTokens(estimateTokens(messages) + toolTokens)
-		if state.fitsWindow(size) {
-			state.lowWaterMark = size
-			return messages, true, nil
-		}
-	}
-
-	if state.reactiveAttempted {
+	if !isContextLimitError(errorMessage) {
 		return messages, false, nil
 	}
 
 	result, compactErr := Compact(messages, CompactionOptions{
 		PreserveLast: state.preserveLast,
-		Summarize:    state.summarizeClosure(ctx, provider),
-		taskState:    state.task.snapshotForCompaction(messages),
+		Summarize:    summarizeClosure(ctx, provider, state.onUsage),
 	})
 	if compactErr != nil {
 		// A genuine compaction attempt was made (and failed): the budget is spent
@@ -695,22 +500,9 @@ func (state *compactionState) recover(
 // provider call. The summary stream intentionally does NOT forward OnText (so
 // compaction stays invisible on the user-facing surface), but it DOES forward
 // OnUsage so the summarizer's token cost is still counted by usage/budgeting.
-// The call goes to the dedicated (cheap) summarizer when one applies; if that
-// call fails the summarizer is marked broken for the current model and the
-// same slice is retried once on the main provider, so the caller sees at most
-// one (main-provider-quality) error.
-func (state *compactionState) summarizeClosure(ctx context.Context, provider Provider) func([]zeroruntime.Message) (string, error) {
-	if state.planner == nil {
-		state.planner = newContextPlanner(contextPlannerConfig{})
-	}
+func summarizeClosure(ctx context.Context, provider Provider, onUsage func(Usage)) func([]zeroruntime.Message) (string, error) {
 	return func(toSummarize []zeroruntime.Message) (string, error) {
-		chosen, dedicated := state.summarizeProvider(ctx, provider)
-		summary, err := summarizeWithPlanner(ctx, chosen, toSummarize, state.onUsage, state.planner, state.trace)
-		if err == nil || !dedicated {
-			return summary, err
-		}
-		state.summarizerBroken = true
-		return summarizeWithPlanner(ctx, provider, toSummarize, state.onUsage, state.planner, state.trace)
+		return summarizeWithFallback(ctx, provider, toSummarize, onUsage)
 	}
 }
 
@@ -722,11 +514,7 @@ func (state *compactionState) summarizeClosure(ctx context.Context, provider Pro
 // Non-context-limit errors (and a single message that still won't fit) surface
 // to the caller unchanged.
 func summarizeWithFallback(ctx context.Context, provider Provider, messages []zeroruntime.Message, onUsage func(Usage)) (string, error) {
-	return summarizeWithPlanner(ctx, provider, messages, onUsage, newContextPlanner(contextPlannerConfig{}), nil)
-}
-
-func summarizeWithPlanner(ctx context.Context, provider Provider, messages []zeroruntime.Message, onUsage func(Usage), planner *contextPlanner, recorder *trace.Recorder) (string, error) {
-	summary, err := summarizeMessagesOnce(ctx, provider, messages, onUsage, planner, recorder)
+	summary, err := summarizeMessagesOnce(ctx, provider, messages, onUsage)
 	if err == nil {
 		return summary, nil
 	}
@@ -735,11 +523,11 @@ func summarizeWithPlanner(ctx context.Context, provider Provider, messages []zer
 	}
 
 	mid := len(messages) / 2
-	left, leftErr := summarizeWithPlanner(ctx, provider, messages[:mid], onUsage, planner, recorder)
+	left, leftErr := summarizeWithFallback(ctx, provider, messages[:mid], onUsage)
 	if leftErr != nil {
 		return "", leftErr
 	}
-	right, rightErr := summarizeWithPlanner(ctx, provider, messages[mid:], onUsage, planner, recorder)
+	right, rightErr := summarizeWithFallback(ctx, provider, messages[mid:], onUsage)
 	if rightErr != nil {
 		return "", rightErr
 	}
@@ -752,7 +540,7 @@ func summarizeWithPlanner(ctx context.Context, provider Provider, messages []zer
 	combined := strings.TrimSpace(left + "\n\n" + right)
 	reduced, reduceErr := summarizeMessagesOnce(ctx, provider, []zeroruntime.Message{
 		{Role: zeroruntime.MessageRoleUser, Content: combined},
-	}, onUsage, planner, recorder)
+	}, onUsage)
 	if reduceErr != nil {
 		if isContextLimitError(reduceErr.Error()) {
 			// Even the two combined partials don't fit (extreme): fall back to the
@@ -768,15 +556,15 @@ func summarizeWithPlanner(ctx context.Context, provider Provider, messages []zer
 }
 
 // summarizeMessagesOnce performs a single tool-less summarization call.
-func summarizeMessagesOnce(ctx context.Context, provider Provider, messages []zeroruntime.Message, onUsage func(Usage), planner *contextPlanner, recorder *trace.Recorder) (string, error) {
-	requestMessages := []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: CompactionSummaryInstructions},
-		{Role: zeroruntime.MessageRoleUser, Content: "Summarize this conversation:\n\n" + renderTranscript(messages)},
+func summarizeMessagesOnce(ctx context.Context, provider Provider, messages []zeroruntime.Message, onUsage func(Usage)) (string, error) {
+	request := zeroruntime.CompletionRequest{
+		Messages: []zeroruntime.Message{
+			{Role: zeroruntime.MessageRoleSystem, Content: summaryInstructions},
+			{Role: zeroruntime.MessageRoleUser, Content: "Summarize this conversation:\n\n" + renderTranscript(messages)},
+		},
+		// No tools: this is a plain text summarization call.
 	}
-	parts := systemPromptParts{prompt: CompactionSummaryInstructions, baseInstructions: CompactionSummaryInstructions}
-	plan := planner.planWithPromptParts(requestMessages, nil, "", parts)
-	recordContextPlanTrace(recorder, plan)
-	stream, err := provider.StreamCompletion(ctx, plan.Request)
+	stream, err := provider.StreamCompletion(ctx, request)
 	if err != nil {
 		return "", err
 	}
@@ -793,41 +581,8 @@ func summarizeMessagesOnce(ctx context.Context, provider Provider, messages []ze
 	return summary, nil
 }
 
-// summaryToolResultClamp bounds each tool-result body in the summarizer input.
-// Tool outputs dominate the elided middle's bulk (build logs, file reads,
-// search results), yet the summary instructions only need their gist — the
-// model that ACTED on the full output already turned it into decisions the
-// surrounding messages record. 2,000 chars (~500 tokens) keeps the useful
-// head+tail of a result while cutting the summarizer input by 5-10x on
-// tool-heavy sessions; the summarizer's own cost is the price being cut.
-const summaryToolResultClamp = 2000
-
-// summaryToolArgsClamp bounds each tool-call argument blob in the transcript:
-// a write_file call carries the whole file body in its arguments.
-const summaryToolArgsClamp = 500
-
-// clampForSummary head+tail-truncates text for the summarizer transcript,
-// snapping to rune boundaries so the clamp never splits a UTF-8 sequence.
-func clampForSummary(text string, max int) string {
-	if max <= 0 || len(text) <= max {
-		return text
-	}
-	head := max * 3 / 4
-	tail := max - head
-	for head > 0 && !utf8.RuneStart(text[head]) {
-		head--
-	}
-	start := len(text) - tail
-	for start < len(text) && !utf8.RuneStart(text[start]) {
-		start++
-	}
-	return text[:head] + "\n…[" + strconv.Itoa(len(text)-head-(len(text)-start)) + " chars omitted for summarization]…\n" + text[start:]
-}
-
 // renderTranscript flattens messages into a plain-text transcript for the
 // summarizer. Secret scrubbing already happened upstream at the tool boundary.
-// Tool-result bodies and tool-call arguments are clamped (see the constants
-// above): the summary needs what was done and decided, not the raw payloads.
 func renderTranscript(messages []zeroruntime.Message) string {
 	lines := make([]string, 0, len(messages))
 	for _, message := range messages {
@@ -837,13 +592,13 @@ func renderTranscript(messages []zeroruntime.Message) string {
 			if len(message.ToolCalls) > 0 {
 				calls := make([]string, 0, len(message.ToolCalls))
 				for _, call := range message.ToolCalls {
-					calls = append(calls, call.Name+"("+clampForSummary(call.Arguments, summaryToolArgsClamp)+")")
+					calls = append(calls, call.Name+"("+call.Arguments+")")
 				}
 				line += "\n[tool calls: " + strings.Join(calls, "; ") + "]"
 			}
 			lines = append(lines, line)
 		case zeroruntime.MessageRoleTool:
-			lines = append(lines, "tool result: "+clampForSummary(message.Content, summaryToolResultClamp))
+			lines = append(lines, "tool result: "+message.Content)
 		default:
 			lines = append(lines, string(message.Role)+": "+message.Content)
 		}

internal/agent/compaction_cheap_test.go

@@ -1,469 +0,0 @@
-package agent
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-// compactableHistory returns a history whose middle is large enough to trip
-// the proactive threshold for a 1000-token window.
-func compactableHistory() []zeroruntime.Message {
-	return []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: "sys"},
-		{Role: zeroruntime.MessageRoleUser, Content: strings.Repeat("u", 4000)},
-		{Role: zeroruntime.MessageRoleAssistant, Content: strings.Repeat("a", 4000)},
-		{Role: zeroruntime.MessageRoleUser, Content: "u2"},
-		{Role: zeroruntime.MessageRoleAssistant, Content: "a2"},
-		{Role: zeroruntime.MessageRoleUser, Content: "u3"},
-	}
-}
-
-// Summarization must run on the dedicated (cheap) summarizer when one is
-// configured — the main provider sees no summarize traffic at all.
-func TestMaybeCompactUsesDedicatedSummarizer(t *testing.T) {
-	cheap := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "CHEAP SUMMARY"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	main := &mockProvider{}
-	factoryCalls := 0
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer: func(context.Context, string) (Provider, error) {
-			factoryCalls++
-			return cheap, nil
-		},
-	}, nil)
-
-	compacted := state.maybeCompact(context.Background(), main, compactableHistory(), nil)
-
-	if len(cheap.requests) == 0 {
-		t.Fatal("dedicated summarizer never received the summarize call")
-	}
-	if len(main.requests) != 0 {
-		t.Fatalf("main provider must see no summarize traffic, got %d requests", len(main.requests))
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("summarizer factory calls = %d, want 1 (lazy, memoized)", factoryCalls)
-	}
-	if estimateTokens(compacted) >= estimateTokens(compactableHistory()) {
-		t.Fatal("compaction did not shrink the history")
-	}
-	found := false
-	for _, message := range compacted {
-		if strings.Contains(message.Content, "CHEAP SUMMARY") {
-			found = true
-		}
-	}
-	if !found {
-		t.Fatal("cheap summarizer's summary missing from the compacted history")
-	}
-}
-
-// A failing summarizer falls back to the main provider for the SAME slice and
-// stays broken for the rest of the run — no repeated failed cheap calls.
-func TestSummarizerFailureFallsBackToMainAndSticks(t *testing.T) {
-	broken := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventError, Error: "boom: model not found"},
-	}}}
-	main := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY"}, {Type: zeroruntime.StreamEventDone}},
-		{{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY 2"}, {Type: zeroruntime.StreamEventDone}},
-	}}
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer:             func(context.Context, string) (Provider, error) { return broken, nil },
-	}, nil)
-	summarize := state.summarizeClosure(context.Background(), main)
-	input := []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}}
-
-	summary, err := summarize(input)
-	if err != nil {
-		t.Fatalf("fallback must succeed via the main provider: %v", err)
-	}
-	if summary != "MAIN SUMMARY" {
-		t.Fatalf("summary = %q, want the main provider's", summary)
-	}
-	if len(broken.requests) != 1 {
-		t.Fatalf("broken summarizer requests = %d, want exactly 1", len(broken.requests))
-	}
-	if !state.summarizerBroken {
-		t.Fatal("a failed summarizer must be marked broken for the run")
-	}
-
-	// Second summarization: straight to main, no cheap retry.
-	if _, err := summarize(input); err != nil {
-		t.Fatal(err)
-	}
-	if len(broken.requests) != 1 {
-		t.Fatalf("broken summarizer was retried (%d requests)", len(broken.requests))
-	}
-	if len(main.requests) != 2 {
-		t.Fatalf("main provider requests = %d, want 2", len(main.requests))
-	}
-}
-
-// A factory that errors (misconfigured model) is equivalent to no summarizer:
-// main provider used, factory not retried.
-func TestSummarizerFactoryErrorFallsBack(t *testing.T) {
-	main := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "MAIN SUMMARY"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	factoryCalls := 0
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer: func(context.Context, string) (Provider, error) {
-			factoryCalls++
-			return nil, errors.New("unknown model")
-		},
-	}, nil)
-	summarize := state.summarizeClosure(context.Background(), main)
-
-	summary, err := summarize([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}})
-	if err != nil || summary != "MAIN SUMMARY" {
-		t.Fatalf("summary = %q, err = %v; want main provider fallback", summary, err)
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("factory calls = %d, want 1 (sticky failure)", factoryCalls)
-	}
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("after a factory failure the run must stay on the main provider")
-	}
-	if factoryCalls != 1 {
-		t.Fatalf("factory retried after failure (%d calls)", factoryCalls)
-	}
-}
-
-// Tool payloads are clamped in the summarizer transcript: results to
-// summaryToolResultClamp, call arguments to summaryToolArgsClamp.
-func TestRenderTranscriptClampsToolPayloads(t *testing.T) {
-	bigResult := strings.Repeat("r", 50_000)
-	bigArgs := strings.Repeat("w", 20_000)
-	transcript := renderTranscript([]zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleAssistant, Content: "editing", ToolCalls: []zeroruntime.ToolCall{
-			{ID: "c1", Name: "write_file", Arguments: bigArgs},
-		}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "c1", Content: bigResult},
-		{Role: zeroruntime.MessageRoleUser, Content: "keep going"},
-	})
-
-	if len(transcript) > summaryToolResultClamp+summaryToolArgsClamp+1024 {
-		t.Fatalf("transcript is %d bytes; clamps did not apply", len(transcript))
-	}
-	if !strings.Contains(transcript, "chars omitted for summarization") {
-		t.Fatal("clamped transcript must carry the omission marker")
-	}
-	if !strings.Contains(transcript, "keep going") {
-		t.Fatal("non-tool content must survive unclamped")
-	}
-	// Head AND tail of the clamped payloads survive.
-	if !strings.HasPrefix(transcript[strings.Index(transcript, "tool result: ")+len("tool result: "):], "r") ||
-		!strings.Contains(transcript, "rrr\n\nuser: keep going") {
-		t.Fatalf("head/tail of the tool result lost:\n%s", transcript[:200])
-	}
-}
-
-// bigToolHistory returns a history with n large tool results (~40k estimated
-// tokens each): the trailing protection window keeps the newest verbatim,
-// the older ones are prunable.
-func bigToolHistory(n int) []zeroruntime.Message {
-	bigBody := strings.Repeat("x", 160_000)
-	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleSystem, Content: "sys"}}
-	for i := 0; i < n; i++ {
-		id := string(rune('a' + i))
-		messages = append(messages,
-			zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{{ID: id, Name: "read_file", Arguments: "{\"path\":\"" + id + "\"}"}}},
-			zeroruntime.Message{Role: zeroruntime.MessageRoleTool, ToolCallID: id, Content: bigBody},
-		)
-	}
-	return append(messages, zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "go"})
-}
-
-func summaryProvider(text string) *mockProvider {
-	return &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{{Type: zeroruntime.StreamEventText, Content: text}, {Type: zeroruntime.StreamEventDone}},
-		{{Type: zeroruntime.StreamEventText, Content: text}, {Type: zeroruntime.StreamEventDone}},
-	}}
-}
-
-// A context-limit error is first answered with the free prune stage; when the
-// pruned history fits the window the retry is free (no summarizer call) and
-// the one-shot reactive budget is untouched. The paid summarizer only runs
-// when a later error finds nothing left to prune.
-func TestRecoverPrunesBeforeSummarizing(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	// The protected trailing tool output (~40k tokens) must fit the window.
-	state := newCompactionState(Options{ContextWindow: 200_000, CompactionPreserveLast: 2}, nil)
-	messages := bigToolHistory(5)
-
-	pruned, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("prunable history that fits must produce a free retry")
-	}
-	if len(provider.requests) != 0 {
-		t.Fatalf("free prune stage must not call the summarizer (%d requests)", len(provider.requests))
-	}
-	if state.reactiveAttempted {
-		t.Fatal("a free prune retry must not consume the reactive budget")
-	}
-	if estimateTokens(pruned) >= estimateTokens(messages) {
-		t.Fatal("prune did not shrink the history")
-	}
-
-	// Second context-limit error on the pruned history: nothing meaningfully
-	// prunable remains, so the paid summarizer fires and consumes the budget.
-	_, retried, err = state.recover(context.Background(), provider, pruned, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("second recover must compact and retry")
-	}
-	if len(provider.requests) == 0 {
-		t.Fatal("second recover must reach the summarizer")
-	}
-	if !state.reactiveAttempted {
-		t.Fatal("a paid recover must consume the reactive budget")
-	}
-}
-
-// When pruning reclaims something but the pruned history still exceeds the
-// window, recover falls through to the paid summarizer in the SAME call
-// instead of spending a retry that would fail the same way.
-func TestRecoverFallsThroughToSummarizerWhenPruneIsInsufficient(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	// A 1,000-token window: even the protected trailing output overflows it.
-	state := newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2}, nil)
-	messages := bigToolHistory(5)
-
-	compacted, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried {
-		t.Fatal("insufficient prune must still end in a retry via summarization")
-	}
-	if len(provider.requests) == 0 {
-		t.Fatal("insufficient prune must reach the summarizer in the same recover call")
-	}
-	if !state.reactiveAttempted {
-		t.Fatal("the paid summarizer consumes the reactive budget")
-	}
-	if estimateTokens(compacted) >= estimateTokens(messages) {
-		t.Fatal("recover did not shrink the history")
-	}
-}
-
-// The free prune stage is not gated behind the one-shot budget: after a paid
-// reactive compaction, a later context-limit error still gets a free retry
-// when pruning makes the history fit.
-func TestRecoverFreePruneRunsAfterBudgetIsSpent(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	state := newCompactionState(Options{ContextWindow: 200_000, CompactionPreserveLast: 2}, nil)
-	state.reactiveAttempted = true
-	messages := bigToolHistory(5)
-
-	pruned, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried || len(provider.requests) != 0 {
-		t.Fatalf("free prune must retry without the summarizer even when the budget is spent (retried=%v, requests=%d)", retried, len(provider.requests))
-	}
-	if estimateTokens(pruned) >= estimateTokens(messages) {
-		t.Fatal("prune did not shrink the history")
-	}
-	// With nothing left to prune and the budget spent, the caller keeps its
-	// original error — recover neither loops nor summarizes.
-	_, retried, err = state.recover(context.Background(), provider, pruned, nil, "maximum context length exceeded")
-	if err != nil || retried || len(provider.requests) != 0 {
-		t.Fatalf("spent budget must not summarize again (retried=%v, requests=%d, err=%v)", retried, len(provider.requests), err)
-	}
-}
-
-// The free-retry gate compares against the window the provider enforces, not
-// the 70% proactive threshold: a history pruned to ~80% of the window still
-// takes the free retry.
-func TestRecoverFreeRetryGateUsesWindowNotThreshold(t *testing.T) {
-	provider := summaryProvider("SUMMARY")
-	messages := bigToolHistory(5)
-	pruned, _ := pruneStaleToolOutput(messages, 2)
-	prunedTokens := estimateTokens(pruned)
-	// Choose a window so the pruned size sits between 70% and 95% of it.
-	window := prunedTokens * 100 / 80
-	state := newCompactionState(Options{ContextWindow: window, CompactionPreserveLast: 2}, nil)
-	if prunedTokens <= state.threshold {
-		t.Fatalf("test setup: pruned size %d must exceed the proactive threshold %d", prunedTokens, state.threshold)
-	}
-
-	_, retried, err := state.recover(context.Background(), provider, messages, nil, "maximum context length exceeded")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !retried || len(provider.requests) != 0 {
-		t.Fatalf("a history that fits the window must take the free retry (retried=%v, requests=%d)", retried, len(provider.requests))
-	}
-}
-
-// After a mid-run model switch the summarizer is re-resolved against the new
-// main model: a run that started on the cheap model (no dedicated summarizer)
-// and escalated gets a cheap summarizer, and a previously broken one is
-// retried for the new model.
-func TestSwitchModelReresolvesSummarizer(t *testing.T) {
-	cheap := summaryProvider("CHEAP SUMMARY")
-	main := summaryProvider("MAIN SUMMARY")
-	var factoryModels []string
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Model:                  "cheap-model",
-		Summarizer: func(_ context.Context, mainModelID string) (Provider, error) {
-			factoryModels = append(factoryModels, mainModelID)
-			if mainModelID == "cheap-model" {
-				return nil, nil // main already is the cheap model
-			}
-			return cheap, nil
-		},
-	}, nil)
-
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("on the cheap model the main provider must summarize")
-	}
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated || len(factoryModels) != 1 {
-		t.Fatalf("factory must run once per main model, calls=%v", factoryModels)
-	}
-
-	state.switchModel("big-model", 400_000)
-	if state.threshold != compactionThreshold(400_000) || state.window != 400_000 {
-		t.Fatalf("switchModel must re-derive the window, got threshold=%d window=%d", state.threshold, state.window)
-	}
-	if got, dedicated := state.summarizeProvider(context.Background(), main); !dedicated || got != Provider(cheap) {
-		t.Fatal("after escalating to an expensive model the dedicated cheap summarizer must be used")
-	}
-	if len(factoryModels) != 2 || factoryModels[1] != "big-model" {
-		t.Fatalf("factory must be re-invoked with the new main model, calls=%v", factoryModels)
-	}
-
-	// A broken summarizer is retried after the next switch.
-	state.summarizerBroken = true
-	if _, dedicated := state.summarizeProvider(context.Background(), main); dedicated {
-		t.Fatal("a broken summarizer must fall back to main")
-	}
-	state.switchModel("other-model", 0)
-	if got, dedicated := state.summarizeProvider(context.Background(), main); !dedicated || got != Provider(cheap) {
-		t.Fatal("a model switch must clear the broken flag and rebuild the summarizer")
-	}
-}
-
-func TestCompactionUpdateWindow(t *testing.T) {
-	state := newCompactionState(Options{ContextWindow: 100_000, CompactionPreserveLast: 2}, nil)
-	state.lowWaterMark = 50_000
-	before := state.threshold
-
-	state.updateWindow(0) // unknown model: unchanged
-	if state.threshold != before || state.lowWaterMark != 50_000 {
-		t.Fatal("updateWindow(0) must be a no-op")
-	}
-
-	state.updateWindow(10_000)
-	if state.threshold >= before {
-		t.Fatalf("threshold = %d, want re-derived below %d", state.threshold, before)
-	}
-	if state.lowWaterMark != 0 {
-		t.Fatal("low-water mark must reset on a window change")
-	}
-	if !state.enabled {
-		t.Fatal("a positive window must keep compaction enabled")
-	}
-}
-
-// End-to-end: after escalate_model switches providers, the loop re-derives the
-// context window via ContextWindowFor, visible in the OnContext report.
-func TestRunEscalationRederivesContextWindow(t *testing.T) {
-	registry := tools.NewRegistry()
-	registry.Register(escalatingTool{target: "big-model"})
-	switched := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventText, Content: "done"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call-1", ToolName: "escalate"},
-		{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call-1", ArgumentsFragment: `{}`},
-		{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call-1"},
-		{Type: zeroruntime.StreamEventDone},
-	}}}
-
-	var windows []int
-	result, err := Run(context.Background(), "go", provider, Options{
-		Registry:      registry,
-		ContextWindow: 100_000,
-		Model:         "small-model",
-		ModelSwitcher: func(context.Context, string) (Provider, error) { return switched, nil },
-		ContextWindowFor: func(modelID string) int {
-			if modelID == "big-model" {
-				return 400_000
-			}
-			return 0
-		},
-		OnContext: func(breakdown ContextBreakdown) { windows = append(windows, breakdown.ContextWindow) },
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if result.FinalAnswer != "done" {
-		t.Fatalf("final answer = %q", result.FinalAnswer)
-	}
-	if len(windows) < 2 {
-		t.Fatalf("expected at least 2 OnContext reports, got %d", len(windows))
-	}
-	if windows[0] != 100_000 {
-		t.Fatalf("turn 1 window = %d, want the original 100000", windows[0])
-	}
-	if windows[len(windows)-1] != 400_000 {
-		t.Fatalf("post-escalation window = %d, want 400000", windows[len(windows)-1])
-	}
-}
-
-// nonComparableProvider has a slice field, so comparing two Provider interface
-// values holding it would panic; the summarizer path must never compare them.
-type nonComparableProvider struct {
-	inner *mockProvider
-	tags  []string
-}
-
-func (p nonComparableProvider) StreamCompletion(ctx context.Context, request zeroruntime.CompletionRequest) (<-chan zeroruntime.StreamEvent, error) {
-	return p.inner.StreamCompletion(ctx, request)
-}
-
-func TestSummarizeClosureNeverComparesProviderValues(t *testing.T) {
-	broken := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
-		{Type: zeroruntime.StreamEventError, Error: "boom: model not found"},
-	}}}
-	main := nonComparableProvider{inner: summaryProvider("MAIN SUMMARY"), tags: []string{"x"}}
-	state := newCompactionState(Options{
-		ContextWindow:          1000,
-		CompactionPreserveLast: 2,
-		Summarizer:             func(context.Context, string) (Provider, error) { return nonComparableProvider{inner: broken}, nil },
-	}, nil)
-	summary, err := state.summarizeClosure(context.Background(), main)([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}})
-	if err != nil || summary != "MAIN SUMMARY" {
-		t.Fatalf("fallback with non-comparable providers must not panic and must use main, got %q err=%v", summary, err)
-	}
-	// And with no dedicated summarizer at all the closure still works.
-	state = newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2}, nil)
-	if _, err := state.summarizeClosure(context.Background(), main)([]zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "history"}}); err != nil {
-		t.Fatal(err)
-	}
-}

internal/agent/compaction_metadata_test.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestCompactMessagesReturnsMetadataForManualCompaction(t *testing.T) {
@@ -43,14 +43,8 @@ func TestCompactMessagesReturnsMetadataForManualCompaction(t *testing.T) {
 	if result.SummaryText != "manual summary" {
 		t.Fatalf("SummaryText = %q, want trimmed summary", result.SummaryText)
 	}
-	if result.ProjectedChars != compactionMessageChars(captured) || result.ProjectedChars == 0 {
-		t.Fatalf("ProjectedChars = %d, want %d", result.ProjectedChars, compactionMessageChars(captured))
-	}
-	if result.Truncated {
-		t.Fatal("Truncated = true for a projection within its limits")
-	}
-	if len(captured) != 1 || !strings.Contains(captured[0].Content, "first question") || !strings.Contains(captured[0].Content, "second question") {
-		t.Fatalf("summarized projection = %#v, want intent from the non-preserved middle", captured)
+	if len(captured) != 3 || captured[0].Content != "first question" || captured[2].Content != "second question" {
+		t.Fatalf("summarized middle = %#v, want the three non-preserved non-system messages", captured)
 	}
 	if len(result.Messages) != 4 {
 		t.Fatalf("compacted message count = %d, want 4", len(result.Messages))
@@ -102,46 +96,11 @@ func TestCompactMessagesNoopReturnsUncompactedMetadata(t *testing.T) {
 	if result.SummaryText != "" {
 		t.Fatalf("SummaryText = %q, want empty", result.SummaryText)
 	}
-	if result.ProjectedChars != 0 || result.Truncated {
-		t.Fatalf("no-op projection metadata = (%d, %t), want zero values", result.ProjectedChars, result.Truncated)
-	}
 	if !reflect.DeepEqual(result.Messages, messages) {
 		t.Fatalf("Messages changed on no-op: %#v", result.Messages)
 	}
 }
 
-func TestCompactMessagesReturnsTruncatedProjectionMetadata(t *testing.T) {
-	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleSystem, Content: "system"}}
-	for index := range 20 {
-		messages = append(messages, zeroruntime.Message{
-			Role:    zeroruntime.MessageRoleUser,
-			Content: strings.Repeat("contextword ", 256) + string(rune('a'+index)),
-		})
-	}
-	messages = append(messages,
-		zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: "recent answer"},
-		zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "latest question"},
-	)
-
-	var captured []zeroruntime.Message
-	result, err := CompactMessages(messages, CompactionOptions{
-		PreserveLast: 2,
-		Summarize: func(toSummarize []zeroruntime.Message) (string, error) {
-			captured = append([]zeroruntime.Message(nil), toSummarize...)
-			return "bounded summary", nil
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !result.Compacted || !result.Truncated {
-		t.Fatalf("compaction metadata = compacted %t, truncated %t; want both true", result.Compacted, result.Truncated)
-	}
-	if result.ProjectedChars != compactionMessageChars(captured) || result.ProjectedChars == 0 {
-		t.Fatalf("ProjectedChars = %d, want %d", result.ProjectedChars, compactionMessageChars(captured))
-	}
-}
-
 func TestCompactMessagesPropagatesSummarizeError(t *testing.T) {
 	messages := []zeroruntime.Message{
 		{Role: zeroruntime.MessageRoleSystem, Content: "system"},

internal/agent/compaction_preserve.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // Compaction preservation.
@@ -30,10 +30,6 @@ const (
 const (
 	maxRecentEdits   = 20
 	maxEditNoteBytes = 160
-	// maxTaskObjectiveBytes keeps the original objective recognizable after
-	// compaction without allowing an unusually large prompt to recreate the
-	// context pressure the compaction just removed.
-	maxTaskObjectiveBytes = 512
 )
 
 const (
@@ -80,14 +76,32 @@ func extractLatestPlan(messages []zeroruntime.Message) string {
 // ({"plan":[{content,status,...}]}) as terse status-tagged bullet lines. Returns
 // "" on malformed arguments or an empty plan.
 func formatPlanArguments(arguments string) string {
-	plan, ok := parseTaskPlan(arguments)
-	if !ok {
+	var parsed struct {
+		Plan []struct {
+			Content string `json:"content"`
+			Step    string `json:"step"`
+			Status  string `json:"status"`
+			Notes   string `json:"notes"`
+		} `json:"plan"`
+	}
+	if err := json.Unmarshal([]byte(strings.TrimSpace(arguments)), &parsed); err != nil {
 		return ""
 	}
-	lines := make([]string, 0, len(plan))
-	for _, item := range plan {
-		line := "- [" + item.Status + "] " + item.Content
-		if notes := item.Notes; notes != "" {
+	lines := make([]string, 0, len(parsed.Plan))
+	for _, item := range parsed.Plan {
+		content := strings.TrimSpace(item.Content)
+		if content == "" {
+			content = strings.TrimSpace(item.Step)
+		}
+		if content == "" {
+			continue
+		}
+		status := strings.TrimSpace(item.Status)
+		if status == "" {
+			status = "pending"
+		}
+		line := "- [" + status + "] " + content
+		if notes := strings.TrimSpace(item.Notes); notes != "" {
 			line += "\n  Notes: " + notes
 		}
 		lines = append(lines, line)
@@ -102,7 +116,7 @@ type skillEntry struct {
 	body string
 }
 
-// recentEdits returns files mutated by editing calls in messages
+// recentEdits returns the files mutated by write_file/edit_file calls in messages
 // — latest note per path, in last-seen order — as skillEntry{name: path, body:
 // note}. After compaction elides the editing turns, this tells the model WHAT it
 // changed in each file (from the tool's result) so it need not re-read to
@@ -113,7 +127,6 @@ type skillEntry struct {
 // rather than an earlier, now-stale entry.
 func recentEdits(messages []zeroruntime.Message) []skillEntry {
 	pathByID := map[string]string{}
-	noteByPath := map[string]string{}
 	sequence := make([]string, 0)
 	for _, message := range messages {
 		for _, call := range message.ToolCalls {
@@ -130,24 +143,12 @@ func recentEdits(messages []zeroruntime.Message) []skillEntry {
 			sequence = append(sequence, path)
 		}
 	}
-	for _, message := range messages {
-		if message.Role != zeroruntime.MessageRoleTool || len(message.ChangedFiles) == 0 {
-			continue
-		}
-		for _, path := range message.ChangedFiles {
-			path = strings.TrimSpace(path)
-			if path == "" {
-				continue
-			}
-			sequence = append(sequence, path)
-			noteByPath[path] = editNote(message.Content)
-		}
-	}
 	order := lastSeenOrder(sequence)
 	if len(order) == 0 {
 		return nil
 	}
 
+	noteByPath := map[string]string{}
 	for _, message := range messages {
 		if message.Role != zeroruntime.MessageRoleTool || message.ToolCallID == "" {
 			continue
@@ -430,30 +431,12 @@ func capBody(body string) string {
 // preservedState is the JSON shape of the carried-across-compaction block.
 type preservedState struct {
 	Plan                string                 `json:"plan,omitempty"`
-	Task                *preservedTaskState    `json:"task,omitempty"`
 	RecentEdits         []preservedEdit        `json:"recent_edits,omitempty"`
 	Tools               []preservedTool        `json:"tools,omitempty"`
 	Skills              []preservedSkill       `json:"skills,omitempty"`
 	ProjectInstructions []preservedInstruction `json:"project_instructions,omitempty"`
 }
 
-type preservedTaskState struct {
-	Objective           string              `json:"objective"`
-	Status              taskStatus          `json:"status,omitempty"`
-	Pending             int                 `json:"pending,omitempty"`
-	InProgress          int                 `json:"in_progress,omitempty"`
-	Completed           int                 `json:"completed,omitempty"`
-	Failed              int                 `json:"failed,omitempty"`
-	VerificationPassed  int                 `json:"verification_passed,omitempty"`
-	VerificationFailed  int                 `json:"verification_failed,omitempty"`
-	VerificationOutcome Outcome             `json:"verification_outcome,omitempty"`
-	Constraints         []string            `json:"constraints,omitempty"`
-	ChangedFiles        []string            `json:"changed_files,omitempty"`
-	UnresolvedFailures  []taskFailureState  `json:"unresolved_failures,omitempty"`
-	Approvals           []taskApprovalState `json:"approvals,omitempty"`
-	Artifacts           []taskArtifactState `json:"artifacts,omitempty"`
-}
-
 type preservedEdit struct {
 	Path string `json:"path"`
 	Note string `json:"note,omitempty"`
@@ -481,39 +464,8 @@ type preservedInstruction struct {
 // may live only inside the injected summary message, which on a later compaction
 // lands in middle with no real tool calls left to extract. Fresh tool calls and
 // instruction blocks override the carried-forward copy by name/source.
-func appendPreservedState(summary string, middle []zeroruntime.Message, taskSnapshot *taskStateSnapshot) string {
+func appendPreservedState(summary string, middle []zeroruntime.Message) string {
 	priorState := parsePreservedStateBlock(latestSummaryContent(middle))
-	task := priorState.Task
-	if taskSnapshot != nil {
-		task = &preservedTaskState{
-			Objective:          capTaskObjective(taskSnapshot.Objective),
-			Constraints:        mergeBoundedComparable(priorTaskConstraints(priorState.Task), taskSnapshot.Constraints, maxTaskConstraints),
-			ChangedFiles:       mergeBoundedComparable(priorTaskChangedFiles(priorState.Task), taskSnapshot.ChangedFiles, maxTaskEvidenceEntries),
-			UnresolvedFailures: mergeTaskFailures(priorTaskFailures(priorState.Task), taskSnapshot.UnresolvedFailures, taskSnapshot.ResolvedFailureKeys),
-			Approvals:          mergeBoundedComparable(priorTaskApprovals(priorState.Task), taskSnapshot.Approvals, maxTaskEvidenceEntries),
-			Artifacts:          mergeBoundedComparable(priorTaskArtifacts(priorState.Task), taskSnapshot.Artifacts, maxTaskEvidenceEntries),
-		}
-		// Plan parity corroborates only the mutable task projection. The objective
-		// comes directly from the run prompt and is immutable, so it must survive
-		// even after compaction removes the plan tool call needed for comparison.
-		if taskSnapshot.PlanParity == taskPlanParityMatch {
-			task.Status = taskSnapshot.Status
-			task.Pending = taskSnapshot.Plan.Pending
-			task.InProgress = taskSnapshot.Plan.InProgress
-			task.Completed = taskSnapshot.Plan.Completed
-			task.Failed = taskSnapshot.Plan.Failed
-			task.VerificationPassed = taskSnapshot.Verification.Passed
-			task.VerificationFailed = taskSnapshot.Verification.Failed
-			task.VerificationOutcome = taskSnapshot.Verification.LastOutcome
-		}
-	}
-	freshConstraints := explicitConstraintsFromMessages(middle)
-	if len(freshConstraints) > 0 {
-		if task == nil {
-			task = &preservedTaskState{}
-		}
-		task.Constraints = mergeBoundedComparable(task.Constraints, freshConstraints, maxTaskConstraints)
-	}
 
 	// Plan: a fresh update_plan in middle is authoritative; otherwise carry the
 	// plan preserved by an earlier compaction.
@@ -541,114 +493,12 @@ func appendPreservedState(summary string, middle []zeroruntime.Message, taskSnap
 		projectInstructionEntries(middle),
 	)
 
-	if block := formatPreservedState(plan, task, edits, tools, skills, instructions); block != "" {
+	if block := formatPreservedState(plan, edits, tools, skills, instructions); block != "" {
 		summary += "\n\n" + block
 	}
 	return summary
 }
 
-func explicitConstraintsFromMessages(messages []zeroruntime.Message) []string {
-	var constraints []string
-	for _, message := range messages {
-		if message.Role != zeroruntime.MessageRoleUser || strings.Contains(message.Content, preservedStateLabel) {
-			continue
-		}
-		if _, body := projectInstructionBlock(message.Content); body != "" {
-			continue
-		}
-		constraints = mergeBoundedComparable(constraints, extractExplicitConstraints(message.Content), maxTaskConstraints)
-	}
-	return constraints
-}
-
-func priorTaskConstraints(task *preservedTaskState) []string {
-	if task == nil {
-		return nil
-	}
-	return task.Constraints
-}
-
-func priorTaskChangedFiles(task *preservedTaskState) []string {
-	if task == nil {
-		return nil
-	}
-	return task.ChangedFiles
-}
-
-func priorTaskFailures(task *preservedTaskState) []taskFailureState {
-	if task == nil {
-		return nil
-	}
-	return task.UnresolvedFailures
-}
-
-func priorTaskApprovals(task *preservedTaskState) []taskApprovalState {
-	if task == nil {
-		return nil
-	}
-	return task.Approvals
-}
-
-func priorTaskArtifacts(task *preservedTaskState) []taskArtifactState {
-	if task == nil {
-		return nil
-	}
-	return task.Artifacts
-}
-
-func mergeTaskFailures(older, newer []taskFailureState, resolved []string) []taskFailureState {
-	resolvedSet := make(map[string]struct{}, len(resolved))
-	for _, key := range resolved {
-		resolvedSet[key] = struct{}{}
-	}
-	merged := make([]taskFailureState, 0, len(older)+len(newer))
-	for _, failure := range append(append([]taskFailureState(nil), older...), newer...) {
-		if _, ok := resolvedSet[failure.Key]; ok {
-			continue
-		}
-		withoutSameKey := make([]taskFailureState, 0, len(merged))
-		for _, existing := range merged {
-			if existing.Key != failure.Key {
-				withoutSameKey = append(withoutSameKey, existing)
-			}
-		}
-		merged = append(withoutSameKey, failure)
-	}
-	if len(merged) > maxTaskEvidenceEntries {
-		merged = merged[len(merged)-maxTaskEvidenceEntries:]
-	}
-	return merged
-}
-
-func mergeBoundedComparable[T comparable](older, newer []T, limit int) []T {
-	merged := make([]T, 0, len(older)+len(newer))
-	seen := make(map[T]struct{}, len(older)+len(newer))
-	for _, value := range append(append([]T(nil), older...), newer...) {
-		if _, ok := seen[value]; ok {
-			continue
-		}
-		seen[value] = struct{}{}
-		merged = append(merged, value)
-	}
-	if len(merged) > limit {
-		merged = merged[len(merged)-limit:]
-	}
-	return merged
-}
-
-func capTaskObjective(objective string) string {
-	objective = strings.TrimSpace(objective)
-	if len(objective) <= maxTaskObjectiveBytes {
-		return objective
-	}
-	const suffix = "…"
-	limit := maxTaskObjectiveBytes - len(suffix)
-	for limit > 0 && !utf8.RuneStart(objective[limit]) {
-		limit--
-	}
-	return strings.TrimSpace(objective[:limit]) + suffix
-}
-
 // mergeRecentEdits overlays fresh edits onto edits preserved by an earlier
 // compaction. Unlike mergeSkillEntries (which keeps refreshed entries in their
 // original slot), a path touched again by a fresh edit MOVES to the newest
@@ -705,11 +555,11 @@ func preservedEditsToEntries(edits []preservedEdit) []skillEntry {
 
 // formatPreservedState renders state as the labelled, single-line
 // JSON block. Returns "" when there is nothing to preserve.
-func formatPreservedState(plan string, task *preservedTaskState, edits, tools, skills, instructions []skillEntry) string {
-	if plan == "" && task == nil && len(edits) == 0 && len(tools) == 0 && len(skills) == 0 && len(instructions) == 0 {
+func formatPreservedState(plan string, edits, tools, skills, instructions []skillEntry) string {
+	if plan == "" && len(edits) == 0 && len(tools) == 0 && len(skills) == 0 && len(instructions) == 0 {
 		return ""
 	}
-	state := preservedState{Plan: plan, Task: task}
+	state := preservedState{Plan: plan}
 	for _, e := range edits {
 		state.RecentEdits = append(state.RecentEdits, preservedEdit{Path: e.name, Note: e.body})
 	}
@@ -729,6 +579,15 @@ func formatPreservedState(plan string, task *preservedTaskState, edits, tools, s
 	return preservedStateLabel + "\n" + string(encoded)
 }
 
+// parsePreservedState recovers the plan + skills from a prior summary's preserved
+// block. JSON escaping makes this lossless even when a skill body contains
+// markdown headings, code fences, or quotes. Returns ("", nil) when absent or
+// malformed.
+func parsePreservedState(summaryContent string) (string, []skillEntry) {
+	state := parsePreservedStateBlock(summaryContent)
+	return state.Plan, preservedSkillsToEntries(state.Skills)
+}
+
 func parsePreservedStateBlock(summaryContent string) preservedState {
 	idx := strings.LastIndex(summaryContent, preservedStateLabel)
 	if idx < 0 {

internal/agent/compaction_preserve_test.go

@@ -1,13 +1,11 @@
 package agent
 
 import (
-	"encoding/json"
 	"strings"
 	"testing"
 	"unicode/utf8"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // stateConversation is a long enough conversation that Compact elides a middle
@@ -61,169 +59,6 @@ func TestCompactPreservesActivePlan(t *testing.T) {
 	}
 }
 
-func TestCompactPreservesBoundedTaskContext(t *testing.T) {
-	objective := strings.Repeat("世", maxTaskObjectiveBytes)
-	task := newTaskState(objective, nil)
-	task.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"write code","status":"in_progress"},{"content":"add tests","status":"pending"}]}`})
-	task.observe(taskStateEvent{kind: taskStateEventToolResult, arguments: `{"patch":"*** Update File: internal/db.go"}`, toolResult: ToolResult{
-		Name: "apply_patch", Status: tools.StatusOK, Output: "Done!", ChangedFiles: []string{"internal/db.go"},
-	}})
-	messages := stateConversation()
-	compacted, err := Compact(messages, CompactionOptions{
-		PreserveLast: 2,
-		Summarize:    func([]zeroruntime.Message) (string, error) { return "SUMMARY", nil },
-		taskState:    task.snapshotForCompaction(messages),
-	})
-	if err != nil {
-		t.Fatalf("Compact: %v", err)
-	}
-	state := parsePreservedStateBlock(compacted[1].Content)
-	if state.Task == nil || state.Task.Status != taskStatusActive || state.Task.InProgress != 1 || state.Task.Pending != 1 {
-		t.Fatalf("unexpected compact task state: %#v", state.Task)
-	}
-	if len(state.Task.Objective) > maxTaskObjectiveBytes || !utf8.ValidString(state.Task.Objective) {
-		t.Fatalf("objective was not safely bounded: %d bytes %q", len(state.Task.Objective), state.Task.Objective)
-	}
-	if len(state.Task.ChangedFiles) != 1 || state.Task.ChangedFiles[0] != "internal/db.go" {
-		t.Fatalf("changed files were not preserved: %#v", state.Task.ChangedFiles)
-	}
-}
-
-func TestCompactPreservesRuntimeEvidenceAcrossRepeatedCompaction(t *testing.T) {
-	task := newTaskState("Please keep the change focused.", nil)
-	task.observe(taskStateEvent{kind: taskStateEventToolResult, arguments: `{"cmd":"go test ./..."}`, toolResult: ToolResult{
-		Name: "exec_command", Status: tools.StatusError, Output: "Error: tests failed",
-		Meta: map[string]string{"spill_path": ".zero/artifacts/tests.txt"},
-	}})
-	task.observe(taskStateEvent{kind: taskStateEventPermission, permission: PermissionEvent{
-		ToolName: "exec_command", DecisionAction: PermissionDecisionAllowForSession, Scope: "/tmp",
-	}})
-	messages := stateConversation()
-
-	first, err := Compact(messages, CompactionOptions{
-		PreserveLast: 2,
-		Summarize:    func([]zeroruntime.Message) (string, error) { return "FIRST", nil },
-		taskState:    task.snapshotForCompaction(messages),
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	task.observe(taskStateEvent{kind: taskStateEventToolResult, arguments: `{"cmd":"go test ./..."}`, toolResult: ToolResult{
-		Name: "exec_command", Status: tools.StatusError, Output: "Error: tests still fail with newer evidence",
-		Meta: map[string]string{"spill_path": ".zero/artifacts/tests.txt"},
-	}})
-	secondInput := append(append([]zeroruntime.Message{}, first...),
-		zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "Never add background memory models."},
-		zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: "understood"},
-		zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "continue"},
-		zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: "working"},
-	)
-	second, err := Compact(secondInput, CompactionOptions{
-		PreserveLast: 2,
-		Summarize:    func([]zeroruntime.Message) (string, error) { return "SECOND", nil },
-		taskState:    task.snapshotForCompaction(secondInput),
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	state := parsePreservedStateBlock(second[1].Content)
-	if state.Task == nil || len(state.Task.UnresolvedFailures) != 1 || len(state.Task.Approvals) != 1 || len(state.Task.Artifacts) != 1 {
-		t.Fatalf("runtime evidence did not survive repeated compaction: %#v", state.Task)
-	}
-	if got := state.Task.UnresolvedFailures[0].Summary; got != "Error: tests still fail with newer evidence" {
-		t.Fatalf("newer failure evidence did not replace the older summary: %#v", state.Task.UnresolvedFailures)
-	}
-	for _, want := range []string{"Please keep the change focused.", "Never add background memory models."} {
-		if !containsString(state.Task.Constraints, want) {
-			t.Fatalf("constraint %q missing after repeated compaction: %#v", want, state.Task.Constraints)
-		}
-	}
-}
-
-func containsString(values []string, want string) bool {
-	for _, value := range values {
-		if value == want {
-			return true
-		}
-	}
-	return false
-}
-
-func TestCompactPreservesObjectiveAfterPlanParityMismatch(t *testing.T) {
-	prior := preservedState{Task: &preservedTaskState{Objective: "stale objective", Status: taskStatusActive, Pending: 1}}
-	encoded, err := json.Marshal(prior)
-	if err != nil {
-		t.Fatal(err)
-	}
-	messages := []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: "system"},
-		{Role: zeroruntime.MessageRoleUser, Content: summaryLabel + "\nold\n\n" + preservedStateLabel + "\n" + string(encoded)},
-		{Role: zeroruntime.MessageRoleAssistant, Content: "continuing"},
-		{Role: zeroruntime.MessageRoleUser, Content: "more"},
-		{Role: zeroruntime.MessageRoleAssistant, Content: "working"},
-		{Role: zeroruntime.MessageRoleUser, Content: "again"},
-		{Role: zeroruntime.MessageRoleAssistant, Content: "done"},
-	}
-	compacted, err := Compact(messages, CompactionOptions{
-		PreserveLast: 2,
-		Summarize:    func([]zeroruntime.Message) (string, error) { return "SUMMARY", nil },
-		taskState: &taskStateSnapshot{
-			Objective:  "current objective",
-			PlanParity: taskPlanParityMismatch,
-		},
-	})
-	if err != nil {
-		t.Fatalf("Compact: %v", err)
-	}
-	state := parsePreservedStateBlock(compacted[1].Content)
-	if state.Task == nil || state.Task.Objective != "current objective" {
-		t.Fatalf("immutable objective was lost on plan mismatch: %#v", state.Task)
-	}
-	if state.Task.Status != "" || state.Task.Pending != 0 {
-		t.Fatalf("uncorroborated mutable task fields survived plan mismatch: %#v", state.Task)
-	}
-}
-
-func TestTaskObjectiveSurvivesRepeatedCompactionWithoutPlanRefresh(t *testing.T) {
-	task := newTaskState("keep this objective", nil)
-	task.observe(taskStateEvent{kind: taskStateEventPlan, arguments: `{"plan":[{"content":"write code","status":"in_progress"},{"content":"add tests","status":"pending"}]}`})
-	messages := stateConversation()
-
-	first, err := Compact(messages, CompactionOptions{
-		PreserveLast: 2,
-		Summarize:    func([]zeroruntime.Message) (string, error) { return "FIRST", nil },
-		taskState:    task.snapshotForCompaction(messages),
-	})
-	if err != nil {
-		t.Fatalf("first Compact: %v", err)
-	}
-	secondInput := append(append([]zeroruntime.Message{}, first...),
-		zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "more"},
-		zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: "working"},
-		zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "again"},
-		zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: "done"},
-	)
-	snapshot := task.snapshotForCompaction(secondInput)
-	if snapshot.PlanParity != taskPlanParityMismatch {
-		t.Fatalf("plan call should be absent after first compaction, parity=%q", snapshot.PlanParity)
-	}
-	second, err := Compact(secondInput, CompactionOptions{
-		PreserveLast: 2,
-		Summarize:    func([]zeroruntime.Message) (string, error) { return "SECOND", nil },
-		taskState:    snapshot,
-	})
-	if err != nil {
-		t.Fatalf("second Compact: %v", err)
-	}
-	state := parsePreservedStateBlock(second[1].Content)
-	if state.Task == nil || state.Task.Objective != "keep this objective" {
-		t.Fatalf("objective lost after second compaction: %#v", state.Task)
-	}
-	if state.Task.Status != "" || state.Task.InProgress != 0 {
-		t.Fatalf("uncorroborated mutable fields survived second compaction: %#v", state.Task)
-	}
-}
-
 func TestCompactPreservesLoadedSkills(t *testing.T) {
 	summary := compactStateConversation(t, stateConversation())
 	if !strings.Contains(summary, preservedStateLabel) {
@@ -448,10 +283,12 @@ func TestExtractLatestPlanReturnsMostRecent(t *testing.T) {
 	}
 }
 
-func TestFormatPlanArgumentsRejectsUnsupportedStepAlias(t *testing.T) {
+func TestFormatPlanArgumentsAcceptsStepAlias(t *testing.T) {
 	got := formatPlanArguments(`{"plan":[{"step":"write failing test","status":"in_progress"},{"content":"keep existing shape","status":"pending"}]}`)
-	if got != "" {
-		t.Fatalf("unsupported alias should reject the whole plan like update_plan, got %q", got)
+	for _, want := range []string{"- [in_progress] write failing test", "- [pending] keep existing shape"} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("expected %q in formatted plan, got %q", want, got)
+		}
 	}
 }
 

internal/agent/compaction_projection.go

@@ -1,318 +0,0 @@
-package agent
-
-import (
-	"encoding/json"
-	"fmt"
-	"regexp"
-	"strings"
-
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-const (
-	compactionUserWordBudget       = 256
-	compactionAssistantWordBudget  = 200
-	compactionToolCallsPerTurn     = 8
-	compactionToolArgumentBytes    = 120
-	compactionErrorBytes           = 150
-	compactionResultBytes          = 1200
-	compactionPreviousSummaryBytes = 16 * 1024
-	compactionBriefMaxBytes        = 24 * 1024
-)
-
-var compactionWordPattern = regexp.MustCompile(`[\p{L}\p{N}]+`)
-
-type compactionProjection struct {
-	messages  []zeroruntime.Message
-	truncated bool
-}
-
-// projectCompactionInput removes reconstructible tool output before the model
-// summary call. It retains a bounded transcript of user intent, assistant
-// decisions, tool actions, and concise errors. Exact durable state is appended
-// separately from the original messages after the summary returns.
-func projectCompactionInput(messages []zeroruntime.Message) compactionProjection {
-	sections := make([]string, 0, len(messages))
-	previousSummary := ""
-	truncated := false
-	for index, message := range messages {
-		switch message.Role {
-		case zeroruntime.MessageRoleUser:
-			content := message.Content
-			if marker := strings.Index(content, preservedStateLabel); marker >= 0 {
-				content = content[:marker]
-			}
-			trimmed := strings.TrimSpace(content)
-			if strings.HasPrefix(trimmed, summaryLabel) {
-				fullSummary := strings.TrimSpace(strings.TrimPrefix(trimmed, summaryLabel))
-				previousSummary = clipHeadTailBytes(fullSummary, compactionPreviousSummaryBytes)
-				truncated = truncated || len(fullSummary) > compactionPreviousSummaryBytes
-				continue
-			}
-			if content = clipInformativeWords(content, compactionUserWordBudget); content != "" {
-				sections = append(sections, fmt.Sprintf("[user #%d]\n%s", index, content))
-			}
-		case zeroruntime.MessageRoleAssistant:
-			lines := make([]string, 0, 1+len(message.ToolCalls))
-			if content := clipInformativeWords(message.Content, compactionAssistantWordBudget); content != "" {
-				lines = append(lines, content)
-			}
-			calls := message.ToolCalls
-			omitted := 0
-			if len(calls) > compactionToolCallsPerTurn {
-				omitted = len(calls) - compactionToolCallsPerTurn
-				calls = calls[omitted:]
-			}
-			if omitted > 0 {
-				lines = append(lines, fmt.Sprintf("* (%d earlier tool calls omitted)", omitted))
-			}
-			for _, call := range calls {
-				lines = append(lines, compactionToolCallLine(call))
-			}
-			if len(lines) > 0 {
-				sections = append(sections, fmt.Sprintf("[assistant #%d]\n%s", index, strings.Join(lines, "\n")))
-			}
-		case zeroruntime.MessageRoleTool:
-			// New tool-result messages carry the execution status directly, as the
-			// source ToolResult does. Keep the text check for older session history
-			// created before Message exposed IsError.
-			name := toolNameForResult(messages, index)
-			mustPreserve := name == "ask_user" || len(message.ChangedFiles) > 0
-			if !mustPreserve && !message.IsError && !isLikelyToolError(message.Content) {
-				continue
-			}
-			if name == "" {
-				name = "tool"
-			}
-			switch {
-			case message.IsError || isLikelyToolError(message.Content):
-				sections = append(sections, fmt.Sprintf("[tool_error #%d] %s\n%s", index, name, clipBytes(firstLine(message.Content), compactionErrorBytes)))
-			case name == "ask_user":
-				sections = append(sections, fmt.Sprintf("[user_answer #%d] %s\n%s", index, name, clipBytes(message.Content, compactionResultBytes)))
-			default:
-				sections = append(sections, fmt.Sprintf("[tool_result #%d] %s changed %s\n%s", index, name,
-					clipBytes(strings.Join(message.ChangedFiles, ", "), compactionToolArgumentBytes), clipBytes(firstLine(message.Content), compactionErrorBytes)))
-			}
-		}
-	}
-	if len(sections) == 0 && previousSummary == "" {
-		return compactionProjection{}
-	}
-	brief, briefTruncated := capCompactionBrief(strings.Join(sections, "\n\n"))
-	truncated = truncated || briefTruncated
-	if previousSummary != "" {
-		brief = "[previous summary]\n" + previousSummary + "\n\n" + brief
-	}
-	return compactionProjection{
-		messages:  []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: strings.TrimSpace(brief)}},
-		truncated: truncated,
-	}
-}
-
-func capCompactionBrief(brief string) (string, bool) {
-	if len(brief) <= compactionBriefMaxBytes {
-		return brief, false
-	}
-	marker := "\n\n...[middle transcript omitted to fit compaction budget]...\n\n"
-	available := compactionBriefMaxBytes - len(marker)
-	// Keep both chronological edges: the oldest material has not necessarily
-	// been summarized before, while the newest material is most actionable.
-	headBytes := available * 2 / 5
-	tailBytes := available - headBytes
-	head := clipPrefixAtBoundary(brief, headBytes)
-	tail := clipSuffixAtBoundary(brief, tailBytes)
-	return strings.TrimSpace(head) + marker + strings.TrimSpace(tail), true
-}
-
-func compactionToolCallLine(call zeroruntime.ToolCall) string {
-	detail := ""
-	if call.Freeform && call.Name == "apply_patch" {
-		detail = strings.Join(patchPaths(call.Arguments), ", ")
-	}
-	var arguments map[string]any
-	if detail == "" && json.Unmarshal([]byte(strings.TrimSpace(call.Arguments)), &arguments) == nil {
-		for _, key := range []string{"file_path", "path", "url", "query", "pattern", "prompt", "description", "question"} {
-			if value, ok := arguments[key].(string); ok && strings.TrimSpace(value) != "" {
-				detail = value
-				break
-			}
-		}
-		if detail == "" && call.Name == "ask_user" {
-			detail = askUserQuestionsDetail(arguments)
-		}
-		if detail == "" && call.Name == "apply_patch" {
-			if patch, ok := arguments["patch"].(string); ok {
-				detail = strings.Join(patchPaths(patch), ", ")
-			}
-		}
-	}
-	if detail == "" {
-		detail = commandFromArguments(call.Arguments)
-	}
-	if detail == "" {
-		return "* " + call.Name
-	}
-	return fmt.Sprintf("* %s %q", call.Name, clipBytes(detail, compactionToolArgumentBytes))
-}
-
-func isLikelyToolError(content string) bool {
-	prefix := strings.TrimSpace(content)
-	if len(prefix) > compactionErrorBytes {
-		prefix = prefix[:compactionErrorBytes]
-	}
-	lower := strings.ToLower(prefix)
-	for _, prefix := range []string{"error:", "tool error:", "failed:", "permission denied", "command failed"} {
-		if strings.HasPrefix(lower, prefix) {
-			return true
-		}
-	}
-	return false
-}
-
-func clipInformativeWords(text string, limit int) string {
-	flat := strings.Join(strings.Fields(text), " ")
-	if flat == "" || limit <= 0 {
-		return ""
-	}
-	count := 0
-	for _, location := range compactionWordPattern.FindAllStringIndex(flat, -1) {
-		word := strings.ToLower(flat[location[0]:location[1]])
-		if compactionStopWords[word] {
-			continue
-		}
-		count++
-		if count > limit {
-			end := location[0]
-			return strings.TrimSpace(flat[:end]) + "...(truncated)"
-		}
-	}
-	return flat
-}
-
-func clipBytes(text string, limit int) string {
-	text = strings.TrimSpace(text)
-	if limit <= 0 {
-		return ""
-	}
-	if len(text) <= limit {
-		return text
-	}
-	if limit <= 3 {
-		end := limit
-		for end > 0 && end < len(text) && text[end]&0xc0 == 0x80 {
-			end--
-		}
-		return text[:end]
-	}
-	end := limit - 3
-	for end > 0 && end < len(text) && text[end]&0xc0 == 0x80 {
-		end--
-	}
-	return strings.TrimSpace(text[:end]) + "..."
-}
-
-func clipHeadTailBytes(text string, limit int) string {
-	text = strings.TrimSpace(text)
-	if len(text) <= limit {
-		return text
-	}
-	if limit <= 0 {
-		return ""
-	}
-	marker := "\n...[middle omitted]...\n"
-	if limit <= len(marker) {
-		return clipBytes(text, limit)
-	}
-	available := limit - len(marker)
-	head := clipPrefixAtBoundary(text, available/2)
-	tail := clipSuffixAtBoundary(text, available-available/2)
-	return strings.TrimSpace(head) + marker + strings.TrimSpace(tail)
-}
-
-func clipPrefixAtBoundary(text string, limit int) string {
-	if limit <= 0 {
-		return ""
-	}
-	if len(text) <= limit {
-		return text
-	}
-	end := limit
-	for end > 0 && text[end]&0xc0 == 0x80 {
-		end--
-	}
-	if boundary := strings.LastIndex(text[:end], "\n\n["); boundary > 0 {
-		end = boundary
-	}
-	return text[:end]
-}
-
-func clipSuffixAtBoundary(text string, limit int) string {
-	if limit <= 0 {
-		return ""
-	}
-	if len(text) <= limit {
-		return text
-	}
-	start := len(text) - limit
-	for start < len(text) && text[start]&0xc0 == 0x80 {
-		start++
-	}
-	if boundary := strings.Index(text[start:], "\n\n["); boundary >= 0 {
-		start += boundary + 2
-	}
-	return text[start:]
-}
-
-func askUserQuestionsDetail(arguments map[string]any) string {
-	raw, ok := arguments["questions"].([]any)
-	if !ok {
-		return ""
-	}
-	questions := make([]string, 0, len(raw))
-	for _, item := range raw {
-		object, ok := item.(map[string]any)
-		if !ok {
-			continue
-		}
-		if question, ok := object["question"].(string); ok && strings.TrimSpace(question) != "" {
-			questions = append(questions, strings.TrimSpace(question))
-		}
-	}
-	return strings.Join(questions, " | ")
-}
-
-func patchPaths(patch string) []string {
-	var paths []string
-	seen := map[string]bool{}
-	for _, line := range strings.Split(patch, "\n") {
-		for _, prefix := range []string{"*** Add File: ", "*** Update File: ", "*** Delete File: ", "*** Move to: "} {
-			if !strings.HasPrefix(line, prefix) {
-				continue
-			}
-			path := strings.TrimSpace(strings.TrimPrefix(line, prefix))
-			if path != "" && !seen[path] {
-				seen[path] = true
-				paths = append(paths, path)
-			}
-		}
-	}
-	return paths
-}
-
-var compactionStopWords = map[string]bool{
-	"a": true, "an": true, "the": true, "is": true, "are": true, "was": true, "were": true,
-	"be": true, "been": true, "being": true, "have": true, "has": true, "had": true,
-	"do": true, "does": true, "did": true, "will": true, "would": true, "could": true,
-	"should": true, "may": true, "might": true, "shall": true, "can": true, "need": true, "must": true,
-	"to": true, "of": true, "in": true, "for": true, "on": true, "with": true, "at": true,
-	"by": true, "from": true, "as": true, "into": true, "through": true, "during": true,
-	"before": true, "after": true, "above": true, "below": true, "between": true, "under": true, "over": true,
-	"and": true, "but": true, "or": true, "nor": true, "not": true, "so": true, "yet": true,
-	"both": true, "either": true, "neither": true, "each": true, "every": true, "all": true,
-	"any": true, "few": true, "more": true, "most": true, "other": true, "some": true, "such": true, "no": true,
-	"that": true, "this": true, "these": true, "those": true, "it": true, "its": true,
-	"i": true, "me": true, "my": true, "we": true, "our": true, "you": true, "your": true,
-	"he": true, "him": true, "his": true, "she": true, "her": true, "they": true, "them": true, "their": true,
-	"who": true, "which": true, "what": true, "if": true, "then": true, "than": true,
-	"when": true, "where": true, "how": true, "just": true, "also": true,
-}

internal/agent/compaction_projection_test.go

@@ -1,131 +0,0 @@
-package agent
-
-import (
-	"strings"
-	"testing"
-	"unicode/utf8"
-
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-func TestClipBytesHandlesTinyLimitsOnRuneBoundaries(t *testing.T) {
-	for _, limit := range []int{0, 1, 2, 3} {
-		if clipped := clipBytes("世界", limit); len(clipped) > limit || !utf8.ValidString(clipped) {
-			t.Fatalf("clipBytes limit %d returned invalid result %q", limit, clipped)
-		}
-	}
-}
-
-func TestBoundaryClippersHandleNonPositiveLimits(t *testing.T) {
-	for _, clip := range []func(string, int) string{clipPrefixAtBoundary, clipSuffixAtBoundary} {
-		for _, limit := range []int{-1, 0} {
-			if got := clip("世界", limit); got != "" {
-				t.Fatalf("clipper limit %d = %q, want empty", limit, got)
-			}
-		}
-	}
-}
-
-func TestProjectCompactionInputDropsRecoverableToolBodies(t *testing.T) {
-	largeBody := strings.Repeat("recoverable source line\n", 1000)
-	messages := []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleUser, Content: "Inspect the parser and preserve its current behavior."},
-		{Role: zeroruntime.MessageRoleAssistant, Content: "I will inspect before editing.", ToolCalls: []zeroruntime.ToolCall{{ID: "read", Name: "read_file", Arguments: `{"path":"internal/parser.go"}`}}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "read", Content: largeBody},
-		{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{{ID: "test", Name: "exec_command", Arguments: `{"cmd":"go test ./internal/parser"}`}}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "test", Content: "Error: parser regression\nlong diagnostic details"},
-	}
-
-	projection := projectCompactionInput(messages)
-	projected := projection.messages
-	if len(projected) != 1 {
-		t.Fatalf("projection = %#v, want one compact message", projected)
-	}
-	content := projected[0].Content
-	for _, want := range []string{"Inspect the parser", `read_file "internal/parser.go"`, `exec_command "go test ./internal/parser"`, "Error: parser regression"} {
-		if !strings.Contains(content, want) {
-			t.Fatalf("projection missing %q: %q", want, content)
-		}
-	}
-	if strings.Contains(content, "recoverable source line") || strings.Contains(content, "long diagnostic details") {
-		t.Fatalf("projection retained reconstructible or overlong tool output: %q", content)
-	}
-	if estimateTokens(projected)*20 >= estimateTokens(messages) {
-		t.Fatalf("projection did not materially reduce tokens: before=%d after=%d", estimateTokens(messages), estimateTokens(projected))
-	}
-}
-
-func TestProjectCompactionInputRetainsStructurallyMarkedToolErrors(t *testing.T) {
-	messages := []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{{ID: "git", Name: "exec_command", Arguments: `{"cmd":"git status"}`}}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "git", Content: "fatal: not a git repository", IsError: true},
-	}
-
-	projected := projectCompactionInput(messages).messages
-	if len(projected) != 1 || !strings.Contains(projected[0].Content, "fatal: not a git repository") {
-		t.Fatalf("structured tool error was dropped from projection: %#v", projected)
-	}
-}
-
-func TestProjectCompactionInputRetainsAskUserExchangeAndSemanticArguments(t *testing.T) {
-	messages := []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{{ID: "ask", Name: "ask_user", Arguments: `{"questions":[{"question":"Which database should remain?"}]}`}}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "ask", Content: "Which database should remain?: Postgres only; do not touch MySQL."},
-		{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{
-			{ID: "patch", Name: "apply_patch", Arguments: `{"patch":"*** Begin Patch\n*** Update File: internal/db.go\n*** End Patch"}`},
-			{ID: "raw-patch", Name: "apply_patch", Freeform: true, Arguments: "*** Begin Patch\n*** Update File: internal/api.go\n*** Add File: internal/config.go\n*** End Patch\n"},
-			{ID: "fetch", Name: "web_fetch", Arguments: `{"url":"https://example.com/spec"}`},
-			{ID: "task", Name: "task", Arguments: `{"prompt":"Inspect the Windows implementation"}`},
-		}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "patch", Content: "Done!", ChangedFiles: []string{"internal/db.go"}},
-	}
-
-	content := projectCompactionInput(messages).messages[0].Content
-	for _, want := range []string{"Which database should remain?", "Postgres only; do not touch MySQL", "internal/db.go", "internal/api.go", "internal/config.go", "https://example.com/spec", "Inspect the Windows implementation"} {
-		if !strings.Contains(content, want) {
-			t.Fatalf("projection missing %q: %q", want, content)
-		}
-	}
-}
-
-func TestProjectCompactionInputCapsToolCallsPerTurn(t *testing.T) {
-	calls := make([]zeroruntime.ToolCall, 12)
-	for index := range calls {
-		calls[index] = zeroruntime.ToolCall{Name: "read_file", Arguments: `{"path":"file.go"}`}
-	}
-	projected := projectCompactionInput([]zeroruntime.Message{{Role: zeroruntime.MessageRoleAssistant, ToolCalls: calls}}).messages
-	content := projected[0].Content
-	if strings.Count(content, "* read_file") != compactionToolCallsPerTurn || !strings.Contains(content, "4 earlier tool calls omitted") {
-		t.Fatalf("tool-call tail was not bounded: %q", content)
-	}
-}
-
-func TestProjectCompactionInputCarriesPreviousSummaryOutsideBriefCap(t *testing.T) {
-	previous := "keep the earlier architecture decision\n" + strings.Repeat("prior detail ", 2000) + "\nkeep the newest prior decision"
-	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: summaryLabel + "\n" + previous + "\n\n" + preservedStateLabel + "\n{}"}}
-	for index := range 500 {
-		messages = append(messages, zeroruntime.Message{Role: zeroruntime.MessageRoleAssistant, Content: strings.Repeat("later transcript detail ", 20)})
-		messages = append(messages, zeroruntime.Message{Role: zeroruntime.MessageRoleUser, Content: "later request " + strings.Repeat("context ", 20) + string(rune('a'+index%26))})
-	}
-
-	projection := projectCompactionInput(messages)
-	content := projection.messages[0].Content
-	if !strings.Contains(content, "[previous summary]\nkeep the earlier architecture decision") || !strings.Contains(content, "keep the newest prior decision") {
-		t.Fatalf("previous summary was lost when the brief tail was capped: %q", content)
-	}
-	if !strings.Contains(content, "middle transcript omitted to fit compaction budget") {
-		t.Fatalf("oversized brief was not head/tail capped: %q", content)
-	}
-	if !projection.truncated {
-		t.Fatal("projection did not structurally report truncation")
-	}
-}
-
-func TestProjectCompactionInputDoesNotInferTruncationFromUserText(t *testing.T) {
-	projection := projectCompactionInput([]zeroruntime.Message{{
-		Role: zeroruntime.MessageRoleUser, Content: "Keep this literal marker: [middle omitted]",
-	}})
-	if projection.truncated {
-		t.Fatal("literal user text produced a false truncation signal")
-	}
-}

internal/agent/compaction_recent_edits_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // recentEdits extracts each mutated file's path and a one-line note from the
@@ -20,15 +20,11 @@ func TestRecentEditsExtractsPathsAndNotes(t *testing.T) {
 			{ID: "e2", Name: "edit_file", Arguments: `{"path":"internal/bar.go","old_string":"a","new_string":"b"}`},
 		}},
 		{Role: zeroruntime.MessageRoleTool, ToolCallID: "e2", Content: "Applied edit to internal/bar.go"},
-		{Role: zeroruntime.MessageRoleAssistant, ToolCalls: []zeroruntime.ToolCall{
-			{ID: "e3", Name: "apply_patch", Arguments: `{"patch":"*** Update File: internal/baz.go"}`},
-		}},
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "e3", Content: "Done!", ChangedFiles: []string{"internal/baz.go"}},
 	}
 
 	edits := recentEdits(messages)
-	if len(edits) != 3 {
-		t.Fatalf("expected 3 edited files, got %d: %#v", len(edits), edits)
+	if len(edits) != 2 {
+		t.Fatalf("expected 2 edited files, got %d: %#v", len(edits), edits)
 	}
 	if edits[0].name != "internal/foo.go" || !strings.Contains(edits[0].body, "12 lines") {
 		t.Fatalf("first edit = %#v, want foo.go with its note", edits[0])
@@ -36,9 +32,6 @@ func TestRecentEditsExtractsPathsAndNotes(t *testing.T) {
 	if edits[1].name != "internal/bar.go" || !strings.Contains(edits[1].body, "Applied edit") {
 		t.Fatalf("second edit = %#v, want bar.go with its note", edits[1])
 	}
-	if edits[2].name != "internal/baz.go" || edits[2].body != "Done!" {
-		t.Fatalf("third edit = %#v, want apply_patch changed file with its note", edits[2])
-	}
 }
 
 // After compaction elides the editing turns, the preserved-state block still

internal/agent/compaction_summarizer_test.go

@@ -8,7 +8,7 @@ import (
 	"sync/atomic"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 var markerPattern = regexp.MustCompile(`msg-\d+`)

internal/agent/compaction_test.go

@@ -6,9 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/trace"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // --- Pure Compact() tests -------------------------------------------------
@@ -59,15 +58,12 @@ func TestCompactKeepsSystemAndPreservedSuffix(t *testing.T) {
 	if last.Content != "most recent question" {
 		t.Fatalf("expected most recent message preserved, got %q", last.Content)
 	}
-	// The summarizer receives a compact semantic projection of the middle rather
-	// than reconstructible raw tool output.
-	if len(captured) != 1 || captured[0].Role != zeroruntime.MessageRoleUser {
-		t.Fatalf("expected one projected summary input, got %#v", captured)
+	// The summarized middle excludes system and preserved suffix.
+	if len(captured) != 3 {
+		t.Fatalf("expected 3 summarized messages, got %d: %#v", len(captured), captured)
 	}
-	for _, want := range []string{"[user #0]", "first question", "[assistant #1]", "first answer", "second question"} {
-		if !strings.Contains(captured[0].Content, want) {
-			t.Fatalf("projected summary input missing %q: %q", want, captured[0].Content)
-		}
+	if captured[0].Content != "first question" {
+		t.Fatalf("expected oldest non-system message first, got %#v", captured[0])
 	}
 	// Compaction must shrink the conversation.
 	if estimateTokens(result) >= estimateTokens(messages) {
@@ -275,27 +271,6 @@ func TestEstimateToolDefTokensCountsDefinitions(t *testing.T) {
 	if estimateToolDefTokens(one) <= 0 {
 		t.Fatal("a tool definition (name + description + schema) should estimate > 0 tokens")
 	}
-	typed := append([]zeroruntime.ToolDefinition(nil), one...)
-	typed[0].Type = zeroruntime.ToolDefinitionFreeform
-	if estimateToolDefTokens(typed) <= estimateToolDefTokens(one) {
-		t.Fatal("a non-empty tool type must increase the estimated request cost")
-	}
-	for _, test := range []struct {
-		name   string
-		format zeroruntime.ToolDefinitionFormat
-	}{
-		{name: "type", format: zeroruntime.ToolDefinitionFormat{Type: "grammar"}},
-		{name: "syntax", format: zeroruntime.ToolDefinitionFormat{Syntax: "lark"}},
-		{name: "definition", format: zeroruntime.ToolDefinitionFormat{Definition: "start: WORD"}},
-	} {
-		t.Run("format "+test.name, func(t *testing.T) {
-			formatted := append([]zeroruntime.ToolDefinition(nil), one...)
-			formatted[0].Format = &test.format
-			if estimateToolDefTokens(formatted) <= estimateToolDefTokens(one) {
-				t.Fatalf("a non-empty format %s must increase the estimated request cost", test.name)
-			}
-		})
-	}
 	two := append(append([]zeroruntime.ToolDefinition{}, one...), zeroruntime.ToolDefinition{
 		Name:        "write_file",
 		Description: "Write contents to a file in the workspace.",
@@ -361,7 +336,7 @@ func TestRunProactiveCompactionTriggers(t *testing.T) {
 	}
 
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(t.TempDir(), nil))
+	registry.Register(tools.NewReadFileTool(t.TempDir()))
 
 	result, err := Run(context.Background(), strings.Repeat("y", 8000), provider, Options{
 		Registry:               registry,
@@ -389,7 +364,7 @@ func TestRunNoCompactionWhenContextWindowZero(t *testing.T) {
 		},
 	}
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(t.TempDir(), nil))
+	registry.Register(tools.NewReadFileTool(t.TempDir()))
 
 	_, err := Run(context.Background(), strings.Repeat("y", 8000), provider, Options{
 		Registry:       registry,
@@ -404,43 +379,6 @@ func TestRunNoCompactionWhenContextWindowZero(t *testing.T) {
 	}
 }
 
-func TestMaybeCompactStopsAfterSupersededReadsReachThreshold(t *testing.T) {
-	body := strings.Repeat("same source line\n", 1000)
-	messages := []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: "system"},
-		toolCallWithArgs("old", "read_file", `{"path":"a.go"}`),
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "old", Content: body},
-		toolCallWithArgs("new", "read_file", `{"path":"a.go"}`),
-		{Role: zeroruntime.MessageRoleTool, ToolCallID: "new", Content: body},
-	}
-	pruned, reclaimed := pruneSupersededReadResults(messages)
-	if reclaimed <= 0 {
-		t.Fatal("test setup did not reclaim superseded read output")
-	}
-	prunedSize := estimateTokens(pruned)
-	if estimateTokens(messages) <= prunedSize {
-		t.Fatal("test setup does not cross the compaction threshold")
-	}
-
-	provider := &summarizeRecordingProvider{}
-	state := &compactionState{
-		enabled:      true,
-		threshold:    prunedSize,
-		preserveLast: 2,
-	}
-	got := state.maybeCompact(context.Background(), provider, messages, nil)
-
-	if provider.summarizeCalls != 0 {
-		t.Fatalf("cheap pruning should avoid the summarizer, got %d calls", provider.summarizeCalls)
-	}
-	if state.lowWaterMark != prunedSize {
-		t.Fatalf("lowWaterMark = %d, want %d", state.lowWaterMark, prunedSize)
-	}
-	if !strings.Contains(got[2].Content, "superseded identical") || got[4].Content != body {
-		t.Fatalf("unexpected pruned messages: %#v", got)
-	}
-}
-
 // reactiveProvider builds up history with a tool call on turn 1, then errors
 // with a context-limit message on turn 2 (once the history is large enough that
 // compaction can shrink it), then succeeds on the same-turn retry. Summary
@@ -450,7 +388,6 @@ type reactiveProvider struct {
 	summarizeCalls int
 	turnRequests   int
 	failedOnce     bool
-	connectError   bool
 	bigText        string
 	finalText      string
 }
@@ -472,9 +409,6 @@ func (provider *reactiveProvider) StreamCompletion(ctx context.Context, request
 		return streamEvents(toolTurnWithText(provider.bigText, "1", "read_file", `{"path":"x"}`)), nil
 	case provider.turnRequests == 2 && !provider.failedOnce:
 		provider.failedOnce = true
-		if provider.connectError {
-			return nil, errors.New("context_length_exceeded")
-		}
 		return streamEvents([]zeroruntime.StreamEvent{
 			{Type: zeroruntime.StreamEventError, Error: "This model's maximum context length is 1000 tokens. Please reduce the length of the messages."},
 		}), nil
@@ -483,39 +417,6 @@ func (provider *reactiveProvider) StreamCompletion(ctx context.Context, request
 	}
 }
 
-func TestRunConnectErrorCompactionRecordsReplacementPlan(t *testing.T) {
-	provider := &reactiveProvider{
-		connectError: true,
-		bigText:      strings.Repeat("b", 6000),
-		finalText:    "recovered",
-	}
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(t.TempDir(), nil))
-	recorder := trace.NewRecorder("connect-compaction", "run-1", "test")
-	var contextPlans []ContextBreakdown
-
-	result, err := Run(context.Background(), strings.Repeat("z", 6000), provider, Options{
-		Registry:               registry,
-		PermissionMode:         PermissionModeUnsafe,
-		ContextWindow:          10_000_000,
-		CompactionPreserveLast: 2,
-		Trace:                  recorder,
-		OnContext: func(breakdown ContextBreakdown) {
-			contextPlans = append(contextPlans, breakdown)
-		},
-	})
-	if err != nil || result.FinalAnswer != "recovered" {
-		t.Fatalf("connect-error compaction failed: result=%#v err=%v", result, err)
-	}
-	if len(contextPlans) != 3 || contextPlans[2].MessageTokens >= contextPlans[1].MessageTokens {
-		t.Fatalf("replacement request context not reported: %#v", contextPlans)
-	}
-	gotTrace := recorder.Finish()
-	if len(gotTrace.PrefixHashes) != 4 || gotTrace.PrefixHashes[3].InvalidationReason != "unchanged" {
-		t.Fatalf("replacement request trace not recorded: %#v", gotTrace.PrefixHashes)
-	}
-}
-
 func TestRunReactiveCompactionRecovers(t *testing.T) {
 	provider := &reactiveProvider{
 		bigText:   strings.Repeat("b", 6000),
@@ -526,9 +427,7 @@ func TestRunReactiveCompactionRecovers(t *testing.T) {
 	// the compaction closure. read_file also returns a sizeable result that
 	// bloats the history.
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(t.TempDir(), nil))
-	recorder := trace.NewRecorder("reactive-compaction", "run-1", "test")
-	var contextPlans []ContextBreakdown
+	registry.Register(tools.NewReadFileTool(t.TempDir()))
 
 	// ContextWindow large enough that proactive compaction never triggers, so
 	// only the reactive path can save the run.
@@ -537,10 +436,6 @@ func TestRunReactiveCompactionRecovers(t *testing.T) {
 		PermissionMode:         PermissionModeUnsafe,
 		ContextWindow:          10_000_000,
 		CompactionPreserveLast: 2,
-		Trace:                  recorder,
-		OnContext: func(breakdown ContextBreakdown) {
-			contextPlans = append(contextPlans, breakdown)
-		},
 	})
 	if err != nil {
 		t.Fatalf("expected reactive compaction to recover the run, got error: %v", err)
@@ -551,25 +446,6 @@ func TestRunReactiveCompactionRecovers(t *testing.T) {
 	if provider.summarizeCalls == 0 {
 		t.Fatal("expected reactive compaction to invoke the summarizer")
 	}
-	if len(contextPlans) != 3 {
-		t.Fatalf("main request context callbacks = %d, want initial turns plus compacted retry", len(contextPlans))
-	}
-	if contextPlans[2].MessageTokens >= contextPlans[1].MessageTokens {
-		t.Fatalf("retry context was not updated after compaction: before=%d after=%d", contextPlans[1].MessageTokens, contextPlans[2].MessageTokens)
-	}
-	gotTrace := recorder.Finish()
-	if len(gotTrace.PrefixHashes) != 4 {
-		t.Fatalf("prefix evidence count = %d, want two turns, compaction, and retry: %#v", len(gotTrace.PrefixHashes), gotTrace.PrefixHashes)
-	}
-	if gotTrace.PrefixHashes[0].InvalidationReason != "initial" ||
-		gotTrace.PrefixHashes[1].InvalidationReason != "unchanged" ||
-		gotTrace.PrefixHashes[2].InvalidationReason != "initial" ||
-		gotTrace.PrefixHashes[3].InvalidationReason != "unchanged" {
-		t.Fatalf("unexpected request-specific invalidation evidence: %#v", gotTrace.PrefixHashes)
-	}
-	if gotTrace.PrefixHashes[2].CompletePrefixHash == gotTrace.PrefixHashes[1].CompletePrefixHash {
-		t.Fatalf("compaction fingerprint reused the main request prefix: %#v", gotTrace.PrefixHashes)
-	}
 }
 
 // midStreamReactiveProvider forwards some text BEFORE surfacing a context-limit
@@ -615,7 +491,7 @@ func TestRunReactiveRetryDoesNotDoubleEmitText(t *testing.T) {
 		finalText:   "recovered",
 	}
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(t.TempDir(), nil))
+	registry.Register(tools.NewReadFileTool(t.TempDir()))
 
 	var deltas []string
 	result, err := Run(context.Background(), strings.Repeat("z", 6000), provider, Options{
@@ -705,7 +581,7 @@ func TestCompactNeverProducesConsecutiveUserMessages(t *testing.T) {
 }
 
 func TestRecoverNoopDoesNotConsumeReactiveBudget(t *testing.T) {
-	st := newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2}, nil)
+	st := newCompactionState(Options{ContextWindow: 1000, CompactionPreserveLast: 2})
 	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{{
 		{Type: zeroruntime.StreamEventText, Content: "SUMMARY"}, {Type: zeroruntime.StreamEventDone},
 	}}}
@@ -752,7 +628,7 @@ func TestRecoverNoopDoesNotConsumeReactiveBudget(t *testing.T) {
 }
 
 func TestRecoverDisabledIsNoop(t *testing.T) {
-	st := newCompactionState(Options{ContextWindow: 0}, nil)
+	st := newCompactionState(Options{ContextWindow: 0})
 	msgs := []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "x"}}
 	called := false
 	// recover must not invoke the provider/summarize when disabled, even on a

internal/agent/completion_gate_test.go

@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // someRequestContains reports whether any message sent to the provider across all

internal/agent/completion_policy.go

@@ -39,7 +39,7 @@ func newCompletionPolicy(requireSemanticCheck bool) *completionPolicy {
 	return &completionPolicy{requireSemanticCheck: requireSemanticCheck}
 }
 
-func (policy *completionPolicy) evaluate(text string, context completionContext) completionEvaluation {
+func (policy *completionPolicy) evaluate(text string, planPending bool) completionEvaluation {
 	// A direct admission is strong local evidence and takes precedence over all
 	// weaker signals, avoiding both continuation nudges and semantic checks.
 	if reason := selfReportedIncompletion(text); reason != "" {
@@ -50,7 +50,7 @@ func (policy *completionPolicy) evaluate(text string, context completionContext)
 	// weak evidence because bookkeeping can be stale. Both get a bounded chance
 	// to continue, but only a persisted cue is ultimately incomplete.
 	cue := endsWithContinuationCue(text)
-	if cue || context.PlanPending {
+	if cue || planPending {
 		if policy.continueNudges < maxContinueNudges {
 			policy.continueNudges++
 			reason := "your message ended mid-step"

internal/agent/completion_policy_test.go

@@ -1,19 +1,16 @@
 package agent
 
-import (
-	"strings"
-	"testing"
-)
+import "testing"
 
 func TestCompletionPolicyLocalEvidenceDecidesWithoutSemanticCheck(t *testing.T) {
 	policy := newCompletionPolicy(false)
 
-	complete := policy.evaluate("Done. All required checks pass.", completionContext{})
+	complete := policy.evaluate("Done. All required checks pass.", false)
 	if complete.Decision != CompletionComplete {
 		t.Fatalf("confident completion decision = %q, want %q", complete.Decision, CompletionComplete)
 	}
 
-	incomplete := policy.evaluate("I couldn't verify the result, so this is my best guess.", completionContext{})
+	incomplete := policy.evaluate("I couldn't verify the result, so this is my best guess.", false)
 	if incomplete.Decision != CompletionIncomplete {
 		t.Fatalf("admitted failure decision = %q, want %q", incomplete.Decision, CompletionIncomplete)
 	}
@@ -22,13 +19,13 @@ func TestCompletionPolicyLocalEvidenceDecidesWithoutSemanticCheck(t *testing.T)
 func TestCompletionPolicyPreservesBoundedPlanStallProtection(t *testing.T) {
 	policy := newCompletionPolicy(false)
 	for attempt := 0; attempt < maxContinueNudges; attempt++ {
-		got := policy.evaluate("Let me inspect the remaining configuration:", completionContext{PlanPending: true})
+		got := policy.evaluate("Let me inspect the remaining configuration:", true)
 		if got.Decision != CompletionUncertain || got.Action != completionActionContinue {
 			t.Fatalf("attempt %d = (%q, %q), want uncertain continue", attempt+1, got.Decision, got.Action)
 		}
 	}
 
-	got := policy.evaluate("Let me inspect the remaining configuration:", completionContext{PlanPending: true})
+	got := policy.evaluate("Let me inspect the remaining configuration:", true)
 	if got.Decision != CompletionIncomplete {
 		t.Fatalf("decision after nudge budget = %q, want %q", got.Decision, CompletionIncomplete)
 	}
@@ -37,13 +34,13 @@ func TestCompletionPolicyPreservesBoundedPlanStallProtection(t *testing.T) {
 func TestCompletionPolicyTreatsPendingPlanAsWeakEvidence(t *testing.T) {
 	policy := newCompletionPolicy(false)
 	for attempt := 0; attempt < maxContinueNudges; attempt++ {
-		got := policy.evaluate("All set.", completionContext{PlanPending: true})
+		got := policy.evaluate("All set.", true)
 		if got.Decision != CompletionUncertain || got.Action != completionActionContinue {
 			t.Fatalf("attempt %d = (%q, %q), want uncertain continue", attempt+1, got.Decision, got.Action)
 		}
 	}
 
-	got := policy.evaluate("All set.", completionContext{PlanPending: true})
+	got := policy.evaluate("All set.", true)
 	if got.Decision != CompletionComplete {
 		t.Fatalf("stale plan decision after nudge budget = %q, want %q", got.Decision, CompletionComplete)
 	}
@@ -52,12 +49,12 @@ func TestCompletionPolicyTreatsPendingPlanAsWeakEvidence(t *testing.T) {
 func TestCompletionPolicyAllowsExactlyOneRequiredSemanticCheck(t *testing.T) {
 	policy := newCompletionPolicy(true)
 
-	first := policy.evaluate("Implemented and tested.", completionContext{})
+	first := policy.evaluate("Implemented and tested.", false)
 	if first.Decision != CompletionUncertain || first.Action != completionActionSemanticCheck {
 		t.Fatalf("first decision = (%q, %q), want uncertain semantic check", first.Decision, first.Action)
 	}
 
-	second := policy.evaluate("PASS. The result meets the task criterion.", completionContext{})
+	second := policy.evaluate("PASS. The result meets the task criterion.", false)
 	if second.Decision != CompletionComplete {
 		t.Fatalf("post-check decision = %q, want %q", second.Decision, CompletionComplete)
 	}
@@ -65,11 +62,3 @@ func TestCompletionPolicyAllowsExactlyOneRequiredSemanticCheck(t *testing.T) {
 		t.Fatal("semantic check was requested more than once")
 	}
 }
-
-func TestAcceptanceVerificationNudgeIncludesBoundedObjective(t *testing.T) {
-	objective := "make the requested behavior observable"
-	nudge := acceptanceVerificationNudge(objective)
-	if !strings.Contains(nudge, "Task objective: "+objective) {
-		t.Fatalf("semantic check was not grounded in the objective: %q", nudge)
-	}
-}

internal/agent/context_measurement.go

@@ -3,7 +3,7 @@ package agent
 import (
 	"encoding/json"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // Context budget.
@@ -23,24 +23,6 @@ type ContextBreakdown struct {
 	TotalTokens   int     // SystemTokens + ToolTokens + MessageTokens
 	ContextWindow int     // model context window; 0 when unknown
 	UsedFraction  float64 // TotalTokens / ContextWindow; 0 when window unknown
-	// Blocks explain why each model-visible category is present without exposing
-	// its content. The planner currently preserves all three categories.
-	Blocks []ContextBlock
-	// CompletePrefixHash identifies the provider-visible system+tool prefix.
-	CompletePrefixHash string
-	// PrefixInvalidationReason is "initial", "unchanged", or a stable comma-
-	// separated list of changed prefix categories.
-	PrefixInvalidationReason string
-}
-
-// ContextBlock is content-free evidence for one model-visible context category.
-type ContextBlock struct {
-	Kind        string
-	Tokens      int
-	CacheClass  string
-	Authority   string
-	Recoverable bool
-	Reason      string
 }
 
 // MeasureContext estimates the per-category token footprint of a request: the
@@ -59,24 +41,6 @@ func MeasureContext(messages []zeroruntime.Message, tools []zeroruntime.ToolDefi
 		ContextWindow: contextWindow,
 	}
 	breakdown.TotalTokens = breakdown.SystemTokens + breakdown.ToolTokens + breakdown.MessageTokens
-	if breakdown.SystemTokens > 0 {
-		breakdown.Blocks = append(breakdown.Blocks, ContextBlock{
-			Kind: "system", Tokens: breakdown.SystemTokens, CacheClass: "stable_prefix",
-			Authority: "required", Reason: "instructions, workspace policy, and safety policy",
-		})
-	}
-	if breakdown.ToolTokens > 0 {
-		breakdown.Blocks = append(breakdown.Blocks, ContextBlock{
-			Kind: "tools", Tokens: breakdown.ToolTokens, CacheClass: "stable_prefix",
-			Authority: "capability", Reason: "currently permitted and selected tool definitions",
-		})
-	}
-	if breakdown.MessageTokens > 0 {
-		breakdown.Blocks = append(breakdown.Blocks, ContextBlock{
-			Kind: "conversation", Tokens: breakdown.MessageTokens, CacheClass: "dynamic_tail",
-			Authority: "transcript", Reason: "valid provider replay history and current task context",
-		})
-	}
 	if contextWindow > 0 {
 		breakdown.UsedFraction = float64(breakdown.TotalTokens) / float64(contextWindow)
 	}

internal/agent/context_measurement_test.go

@@ -3,7 +3,7 @@ package agent
 import (
 	"testing"
 
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestMeasureContextSplitsByCategory(t *testing.T) {
@@ -32,9 +32,6 @@ func TestMeasureContextSplitsByCategory(t *testing.T) {
 	if breakdown.UsedFraction != wantFraction {
 		t.Fatalf("UsedFraction = %v, want %v", breakdown.UsedFraction, wantFraction)
 	}
-	if len(breakdown.Blocks) != 3 {
-		t.Fatalf("Blocks = %#v, want system/tools/conversation", breakdown.Blocks)
-	}
 }
 
 func TestMeasureContextUnknownWindowHasZeroFraction(t *testing.T) {

internal/agent/context_planner.go

@@ -1,189 +0,0 @@
-package agent
-
-import (
-	"strings"
-
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-type contextPlannerConfig struct {
-	contextWindow  int
-	promptCacheKey string
-	serviceTier    string
-	promptParts    systemPromptParts
-}
-
-// contextPlanner is the single seam for constructing model-visible requests.
-// Planning is deterministic and does not retrieve content, execute tools, or
-// change permissions. The initial implementation deliberately preserves every
-// message and tool definition while making composition and cache drift
-// inspectable; later selection policies must continue to cross this seam.
-type contextPlanner struct {
-	config          contextPlannerConfig
-	previousPrefix  prefixFingerprint
-	hasPrevious     bool
-	toolSnapshotKey string
-	toolSnapshot    []zeroruntime.ToolDefinition
-}
-
-type contextPlan struct {
-	Request           zeroruntime.CompletionRequest
-	Breakdown         ContextBreakdown
-	PrefixFingerprint prefixFingerprint
-}
-
-func newContextPlanner(config contextPlannerConfig) *contextPlanner {
-	return &contextPlanner{config: config}
-}
-
-// Plan returns a provider request snapshot plus content-free accounting.
-// It intentionally performs no relevance filtering: preserving current model
-// capability is the baseline contract for future planner policies.
-func (planner *contextPlanner) Plan(messages []zeroruntime.Message, toolDefs []zeroruntime.ToolDefinition, reasoningEffort string) contextPlan {
-	return planner.plan(messages, toolDefs, reasoningEffort, planner.config.promptParts)
-}
-
-// planWithPromptParts plans a request whose stable system sections differ from
-// the planner's configured main-run prompt, such as a compaction summary call.
-func (planner *contextPlanner) planWithPromptParts(messages []zeroruntime.Message, toolDefs []zeroruntime.ToolDefinition, reasoningEffort string, parts systemPromptParts) contextPlan {
-	return planner.plan(messages, toolDefs, reasoningEffort, parts)
-}
-
-func (planner *contextPlanner) plan(messages []zeroruntime.Message, toolDefs []zeroruntime.ToolDefinition, reasoningEffort string, parts systemPromptParts) contextPlan {
-	requestMessages := copyMessages(messages)
-	requestSystemPrompt := leadingSystemContent(requestMessages)
-	if parts.prompt != requestSystemPrompt {
-		// Component boundaries from a different request would make the detailed
-		// invalidation reason misleading. Retain the exact request prefix and
-		// classify it conservatively as an unstructured system prompt instead.
-		parts = systemPromptParts{prompt: requestSystemPrompt}
-	}
-	fingerprint := computePrefixFingerprint(buildPromptSubstringsFromParts(parts, toolDefs))
-	request := zeroruntime.CompletionRequest{
-		Messages:        requestMessages,
-		Tools:           planner.snapshotTools(toolDefs, fingerprint),
-		ReasoningEffort: reasoningEffort,
-		ServiceTier:     planner.config.serviceTier,
-		PromptCacheKey:  planner.config.promptCacheKey,
-	}
-	breakdown := MeasureContext(request.Messages, request.Tools, planner.config.contextWindow)
-	breakdown.CompletePrefixHash = fingerprint.CompletePrefixHash
-	var previous *prefixFingerprint
-	if planner.hasPrevious {
-		previous = &planner.previousPrefix
-	}
-	breakdown.PrefixInvalidationReason = explainPrefixChange(previous, fingerprint)
-	planner.previousPrefix = fingerprint
-	planner.hasPrevious = true
-	return contextPlan{
-		Request:           request,
-		Breakdown:         breakdown,
-		PrefixFingerprint: fingerprint,
-	}
-}
-
-// snapshotTools freezes provider-visible tool definitions when their semantic
-// fingerprint changes. Stable turns reuse the frozen schemas instead of
-// recursively cloning every map and slice for every request.
-func (planner *contextPlanner) snapshotTools(toolDefs []zeroruntime.ToolDefinition, fingerprint prefixFingerprint) []zeroruntime.ToolDefinition {
-	key := fingerprint.ToolsHash + "\x00" + fingerprint.SchemaHash
-	if planner.toolSnapshotKey != key {
-		planner.toolSnapshot = copyToolDefinitions(toolDefs)
-		planner.toolSnapshotKey = key
-	}
-	return planner.toolSnapshot
-}
-
-func copyToolDefinitions(toolDefs []zeroruntime.ToolDefinition) []zeroruntime.ToolDefinition {
-	if toolDefs == nil {
-		return nil
-	}
-	copied := make([]zeroruntime.ToolDefinition, len(toolDefs))
-	for index, definition := range toolDefs {
-		copied[index] = definition
-		copied[index].Parameters = copySchemaMap(definition.Parameters)
-		if definition.Format != nil {
-			format := *definition.Format
-			copied[index].Format = &format
-		}
-	}
-	return copied
-}
-
-func copySchemaMap(schema map[string]any) map[string]any {
-	if schema == nil {
-		return nil
-	}
-	copied := make(map[string]any, len(schema))
-	for key, value := range schema {
-		copied[key] = copySchemaValue(value)
-	}
-	return copied
-}
-
-func copySchemaValue(value any) any {
-	switch typed := value.(type) {
-	case map[string]any:
-		return copySchemaMap(typed)
-	case []any:
-		copied := make([]any, len(typed))
-		for index, item := range typed {
-			copied[index] = copySchemaValue(item)
-		}
-		return copied
-	case []string:
-		return append([]string(nil), typed...)
-	default:
-		return value
-	}
-}
-
-func leadingSystemContent(messages []zeroruntime.Message) string {
-	contents := make([]string, 0, 1)
-	for _, message := range messages {
-		if message.Role != zeroruntime.MessageRoleSystem {
-			break
-		}
-		contents = append(contents, message.Content)
-	}
-	return strings.Join(contents, "\n\n")
-}
-
-func explainPrefixChange(previous *prefixFingerprint, current prefixFingerprint) string {
-	if previous == nil {
-		return "initial"
-	}
-	if previous.CompletePrefixHash == current.CompletePrefixHash {
-		return "unchanged"
-	}
-	reasons := make([]string, 0, 3)
-	if previous.SystemPromptHash != current.SystemPromptHash {
-		parts := make([]string, 0, 4)
-		if previous.BaseInstructionsHash != current.BaseInstructionsHash {
-			parts = append(parts, "base_instructions")
-		}
-		if previous.ConfirmationPolicyHash != current.ConfirmationPolicyHash {
-			parts = append(parts, "confirmation_policy")
-		}
-		if previous.ProjectContextHash != current.ProjectContextHash {
-			parts = append(parts, "project_context")
-		}
-		if previous.SkillsHash != current.SkillsHash {
-			parts = append(parts, "skills")
-		}
-		if len(parts) == 0 {
-			parts = append(parts, "system_prompt")
-		}
-		reasons = append(reasons, parts...)
-	}
-	if previous.ToolsHash != current.ToolsHash {
-		reasons = append(reasons, "tools")
-	}
-	if previous.SchemaHash != current.SchemaHash {
-		reasons = append(reasons, "schema")
-	}
-	if len(reasons) == 0 {
-		return "prefix_changed"
-	}
-	return strings.Join(reasons, ",")
-}

internal/agent/context_planner_test.go

@@ -1,190 +0,0 @@
-package agent
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-func TestContextPlannerPreservesProviderRequest(t *testing.T) {
-	messages := []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: "system"},
-		{Role: zeroruntime.MessageRoleUser, Content: "inspect this", Images: []zeroruntime.ImageBlock{{MediaType: "image/png", Data: []byte{1, 2, 3}}}},
-		{Role: zeroruntime.MessageRoleAssistant, Content: "working", ToolCalls: []zeroruntime.ToolCall{{ID: "call-1", Name: "read_file", Arguments: `{"path":"main.go"}`}}, Reasoning: []zeroruntime.ReasoningBlock{{Provider: "test", Type: "thinking", Signature: "sig"}}},
-	}
-	toolDefs := []zeroruntime.ToolDefinition{{
-		Name: "read_file", Description: "Read a file",
-		Format: &zeroruntime.ToolDefinitionFormat{Type: "grammar", Syntax: "lark", Definition: "start: PATH"},
-		Parameters: map[string]any{
-			"type":       "object",
-			"required":   []string{"path"},
-			"properties": map[string]any{"path": map[string]any{"type": "string"}},
-			"anyOf":      []any{map[string]any{"type": "object"}},
-		},
-	}}
-	planner := newContextPlanner(contextPlannerConfig{
-		contextWindow:  128_000,
-		promptCacheKey: "session-1",
-		serviceTier:    "priority",
-		promptParts:    systemPromptParts{prompt: "system", baseInstructions: "system"},
-	})
-
-	plan := planner.Plan(messages, toolDefs, "medium")
-	want := zeroruntime.CompletionRequest{
-		Messages:        copyMessages(messages),
-		Tools:           toolDefs,
-		ReasoningEffort: "medium",
-		ServiceTier:     "priority",
-		PromptCacheKey:  "session-1",
-	}
-	if !reflect.DeepEqual(plan.Request, want) {
-		t.Fatalf("planned request changed provider input:\n got: %#v\nwant: %#v", plan.Request, want)
-	}
-	stable := planner.Plan(messages, toolDefs, "medium")
-	if &stable.Request.Tools[0] != &plan.Request.Tools[0] {
-		t.Fatal("stable tool fingerprint rebuilt the immutable schema snapshot")
-	}
-
-	// A plan owns its request snapshot; later caller mutation cannot change its
-	// messages or its recursively nested tool schema.
-	messages[1].Content = "changed"
-	messages[1].Images[0].Data[0] = 9
-	toolDefs[0].Name = "changed_tool"
-	toolDefs[0].Parameters["required"].([]string)[0] = "other"
-	toolDefs[0].Parameters["properties"].(map[string]any)["path"].(map[string]any)["type"] = "integer"
-	toolDefs[0].Parameters["anyOf"].([]any)[0].(map[string]any)["type"] = "array"
-	toolDefs[0].Format.Definition = "changed"
-	if plan.Request.Messages[1].Content != "inspect this" || plan.Request.Messages[1].Images[0].Data[0] != 1 {
-		t.Fatalf("planned messages alias caller state: %#v", plan.Request.Messages[1])
-	}
-	if plan.Request.Tools[0].Name != "read_file" ||
-		plan.Request.Tools[0].Format == nil || plan.Request.Tools[0].Format.Definition != "start: PATH" ||
-		plan.Request.Tools[0].Parameters["required"].([]string)[0] != "path" ||
-		plan.Request.Tools[0].Parameters["properties"].(map[string]any)["path"].(map[string]any)["type"] != "string" ||
-		plan.Request.Tools[0].Parameters["anyOf"].([]any)[0].(map[string]any)["type"] != "object" {
-		t.Fatalf("planned tools alias caller state: %#v", plan.Request.Tools[0])
-	}
-
-	next := planner.Plan(messages, toolDefs, "medium")
-	if next.PrefixFingerprint == plan.PrefixFingerprint || next.Request.Tools[0].Name != "changed_tool" {
-		t.Fatalf("changed tool schema did not refresh snapshot: %#v", next)
-	}
-	if plan.Request.Tools[0].Name != "read_file" {
-		t.Fatalf("refresh mutated earlier request: %#v", plan.Request.Tools[0])
-	}
-}
-
-func TestContextPlannerReportsInspectableBlocks(t *testing.T) {
-	planner := newContextPlanner(contextPlannerConfig{contextWindow: 100_000})
-	plan := planner.Plan([]zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: filler(400)},
-		{Role: zeroruntime.MessageRoleUser, Content: filler(200)},
-	}, []zeroruntime.ToolDefinition{{Name: "read_file", Description: "Read a file"}}, "")
-
-	if plan.Breakdown.PrefixInvalidationReason != "initial" || plan.Breakdown.CompletePrefixHash == "" {
-		t.Fatalf("prefix evidence = %#v", plan.Breakdown)
-	}
-	if len(plan.Breakdown.Blocks) != 3 {
-		t.Fatalf("blocks = %#v, want system/tools/conversation", plan.Breakdown.Blocks)
-	}
-	wantKinds := []string{"system", "tools", "conversation"}
-	total := 0
-	for index, block := range plan.Breakdown.Blocks {
-		if block.Kind != wantKinds[index] || block.Tokens <= 0 || block.Reason == "" || block.Authority == "" || block.CacheClass == "" {
-			t.Fatalf("block %d = %#v", index, block)
-		}
-		total += block.Tokens
-	}
-	if total != plan.Breakdown.TotalTokens {
-		t.Fatalf("block tokens = %d, want total %d", total, plan.Breakdown.TotalTokens)
-	}
-}
-
-func TestContextPlannerFingerprintsActualRequestSystemPrompt(t *testing.T) {
-	planner := newContextPlanner(contextPlannerConfig{promptParts: systemPromptParts{
-		prompt: "configured system", baseInstructions: "configured system",
-	}})
-	messages := []zeroruntime.Message{
-		{Role: zeroruntime.MessageRoleSystem, Content: "request-specific system"},
-		{Role: zeroruntime.MessageRoleUser, Content: "task"},
-	}
-
-	plan := planner.Plan(messages, nil, "")
-	want := computePrefixFingerprint(buildPromptSubstringsFromParts(
-		systemPromptParts{prompt: "request-specific system"}, nil,
-	))
-	if plan.PrefixFingerprint != want {
-		t.Fatalf("fingerprint describes configured prompt instead of request:\n got: %#v\nwant: %#v", plan.PrefixFingerprint, want)
-	}
-}
-
-func TestContextPlannerExplainsPrefixInvalidation(t *testing.T) {
-	planner := newContextPlanner(contextPlannerConfig{promptParts: systemPromptParts{
-		prompt: "system", baseInstructions: "base", projectContext: "project",
-	}})
-	messages := []zeroruntime.Message{{Role: zeroruntime.MessageRoleSystem, Content: "system"}, {Role: zeroruntime.MessageRoleUser, Content: "task"}}
-	tools := []zeroruntime.ToolDefinition{{Name: "read_file", Description: "Read", Parameters: map[string]any{"type": "object"}}}
-
-	if got := planner.Plan(messages, tools, "").Breakdown.PrefixInvalidationReason; got != "initial" {
-		t.Fatalf("first reason = %q, want initial", got)
-	}
-	if got := planner.Plan(messages, tools, "").Breakdown.PrefixInvalidationReason; got != "unchanged" {
-		t.Fatalf("stable reason = %q, want unchanged", got)
-	}
-	tools[0].Description = "Read an exact file"
-	if got := planner.Plan(messages, tools, "").Breakdown.PrefixInvalidationReason; got != "tools" {
-		t.Fatalf("tool reason = %q, want tools", got)
-	}
-	tools[0].Parameters["required"] = []any{"path"}
-	if got := planner.Plan(messages, tools, "").Breakdown.PrefixInvalidationReason; got != "schema" {
-		t.Fatalf("schema reason = %q, want schema", got)
-	}
-	planner.config.promptParts.prompt = "system with changed project"
-	planner.config.promptParts.projectContext = "changed project"
-	messages[0].Content = "system with changed project"
-	if got := planner.Plan(messages, tools, "").Breakdown.PrefixInvalidationReason; got != "project_context" {
-		t.Fatalf("project reason = %q, want project_context", got)
-	}
-}
-
-func TestExplainPrefixChangeNamesEveryChangedComponent(t *testing.T) {
-	baseline := prefixFingerprint{
-		SystemPromptHash:       "system",
-		BaseInstructionsHash:   "base",
-		ConfirmationPolicyHash: "policy",
-		ProjectContextHash:     "project",
-		SkillsHash:             "skills",
-		ToolsHash:              "tools",
-		SchemaHash:             "schema",
-		CompletePrefixHash:     "complete",
-	}
-	tests := []struct {
-		name   string
-		mutate func(*prefixFingerprint)
-		want   string
-	}{
-		{name: "base instructions", mutate: func(value *prefixFingerprint) {
-			value.SystemPromptHash, value.BaseInstructionsHash = "changed", "changed"
-		}, want: "base_instructions"},
-		{name: "confirmation policy", mutate: func(value *prefixFingerprint) {
-			value.SystemPromptHash, value.ConfirmationPolicyHash = "changed", "changed"
-		}, want: "confirmation_policy"},
-		{name: "project context", mutate: func(value *prefixFingerprint) {
-			value.SystemPromptHash, value.ProjectContextHash = "changed", "changed"
-		}, want: "project_context"},
-		{name: "skills", mutate: func(value *prefixFingerprint) { value.SystemPromptHash, value.SkillsHash = "changed", "changed" }, want: "skills"},
-		{name: "unclassified system prompt", mutate: func(value *prefixFingerprint) { value.SystemPromptHash = "changed" }, want: "system_prompt"},
-		{name: "tools and schema", mutate: func(value *prefixFingerprint) { value.ToolsHash, value.SchemaHash = "changed", "changed" }, want: "tools,schema"},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			current := baseline
-			test.mutate(&current)
-			current.CompletePrefixHash = "changed"
-			if got := explainPrefixChange(&baseline, current); got != test.want {
-				t.Fatalf("reason = %q, want %q", got, test.want)
-			}
-		})
-	}
-}

internal/agent/defer_savings_test.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 // richMCPTool mimics a real MCP tool's schema (Exa/Firecrawl-style search): an

internal/agent/deferred_loop_test.go

@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 func TestOptionsDeferThresholdFieldExists(t *testing.T) {
@@ -150,7 +150,7 @@ func assertNoDeferredDiscoveryMessage(t *testing.T, request zeroruntime.Completi
 func TestPartitionToolsInactiveIsByteIdenticalAndDropsToolSearch(t *testing.T) {
 	root := t.TempDir()
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(root, nil))
+	registry.Register(tools.NewReadFileTool(root))
 	registry.Register(fakeDeferredTool{name: "mcp__srv__a", desc: "tool a"})
 	registry.Register(fakeToolSearchTool{})
 
@@ -305,8 +305,8 @@ func TestPartitionToolsActiveExcludesDisabledDeferredFromDiscoveryAndExposed(t *
 func TestPartitionToolsActiveHidesUnloadedExposesLoaded(t *testing.T) {
 	root := t.TempDir()
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(root, nil)) // non-deferred builtin
-	registry.Register(fakeToolSearchTool{})                   // non-deferred, must stay exposed
+	registry.Register(tools.NewReadFileTool(root)) // non-deferred builtin
+	registry.Register(fakeToolSearchTool{})        // non-deferred, must stay exposed
 	registry.Register(fakeDeferredTool{name: "mcp__srv__alpha", desc: "alpha tool"})
 	registry.Register(fakeDeferredTool{name: "mcp__srv__beta", desc: "beta tool"})
 
@@ -341,15 +341,15 @@ func TestPartitionToolsActiveHidesUnloadedExposesLoaded(t *testing.T) {
 	if search.Description != discovery || !strings.Contains(search.Description, "mcp") {
 		t.Fatalf("tool_search description must carry discovery source, got %q", search.Description)
 	}
-	if !strings.Contains(search.Description, "mcp__srv__alpha") {
-		t.Fatalf("stable tool_search catalog must retain already-loaded tool names, got %q", search.Description)
+	if strings.Contains(search.Description, "mcp__srv__alpha") {
+		t.Fatalf("tool_search description must not list already-loaded tool names, got %q", search.Description)
 	}
 	if !strings.Contains(search.Description, "mcp__srv__beta") {
 		t.Fatalf("tool_search description must list exact hidden tool names, got %q", search.Description)
 	}
 }
 
-func TestPartitionToolsActiveNothingHiddenKeepsStableCatalog(t *testing.T) {
+func TestPartitionToolsActiveNothingHiddenEmptyReminder(t *testing.T) {
 	registry := tools.NewRegistry()
 	registry.Register(fakeDeferredTool{name: "mcp__srv__alpha", desc: "alpha"})
 	registry.Register(fakeDeferredTool{name: "mcp__srv__beta", desc: "beta"})
@@ -368,8 +368,9 @@ func TestPartitionToolsActiveNothingHiddenKeepsStableCatalog(t *testing.T) {
 	if !exposedNames["tool_search"] {
 		t.Fatalf("expected tool_search exposed on active path, got %#v", exposed)
 	}
-	if !strings.Contains(reminder, "mcp__srv__alpha") || !strings.Contains(reminder, "mcp__srv__beta") {
-		t.Fatalf("stable catalog must retain all deferred names after loading, got %q", reminder)
+	// No hidden tools means no dynamic discovery text is needed.
+	if reminder != "" {
+		t.Fatalf("expected empty discovery text when nothing is hidden, got %q", reminder)
 	}
 }
 
@@ -797,98 +798,3 @@ func TestDisabledToolSearchFallsBackToEager(t *testing.T) {
 		t.Fatalf("deferred tool must be callable under eager fallback, got status=%s output=%q", result.Status, result.Output)
 	}
 }
-
-// fakeDeferredMutatorTool is a deferred-eligible tool with mutating Safety
-// (SideEffectWrite), standing in for a real write/mutator MCP tool that would
-// be hidden behind tool_search once deferral activates.
-type fakeDeferredMutatorTool struct{ name string }
-
-func (t fakeDeferredMutatorTool) Name() string        { return t.name }
-func (t fakeDeferredMutatorTool) Description() string { return "mutates the workspace, deferred" }
-func (t fakeDeferredMutatorTool) Parameters() tools.Schema {
-	return tools.Schema{Type: "object", AdditionalProperties: false}
-}
-func (t fakeDeferredMutatorTool) Safety() tools.Safety {
-	return tools.Safety{SideEffect: tools.SideEffectWrite, Permission: tools.PermissionPrompt, Reason: "mutates"}
-}
-func (t fakeDeferredMutatorTool) Run(_ context.Context, _ map[string]any) tools.Result {
-	return tools.Result{Status: tools.StatusOK, Output: "mutated"}
-}
-func (t fakeDeferredMutatorTool) Deferred() bool { return true }
-
-// TestPlanModeToolSearchNeverLeaksDeferredMutatorSchema guards the concern
-// raised in PR #642 review (jatmn, P2): that tool_search filters deferred
-// candidates only by EnabledTools/DisabledTools, not by plan-mode visibility,
-// so a plan-mode model could call `tool_search select:<deferred write tool>`
-// and receive that tool's full schema even though a direct call to it is
-// correctly denied the following turn.
-//
-// tool_search's own Safety is SideEffectNone, and ToolAdvertisedForPermissionMode (the
-// same gate executeToolCall uses to deny a direct call) requires
-// SideEffect==Read to advertise a tool in plan mode. That means tool_search
-// itself is never advertised, never activates deferral (loaderUsable in
-// partitionToolsCached requires ToolAdvertised(loader, permissionMode)), and
-// is denied at dispatch like any other hidden tool if a stale/adversarial
-// call reaches it anyway — so a deferred mutator's schema can never reach the
-// model through tool_search while in plan mode. This test pins that
-// end-to-end: tool_search is absent from the advertised tool list, and a
-// forced call to it is denied before rendering any tool schema.
-func TestPlanModeToolSearchNeverLeaksDeferredMutatorSchema(t *testing.T) {
-	root := t.TempDir()
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewReadFileTool(root))
-	registry.Register(fakeDeferredMutatorTool{name: "mcp__srv__mutate"})
-	registry.Register(fakeDeferredMutatorTool{name: "mcp__srv__mutate2"})
-	registry.Register(tools.NewToolSearchTool(registry))
-
-	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{ // turn 1: force a call to tool_search even though it should not be advertised.
-			{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "c1", ToolName: tools.ToolSearchToolName},
-			{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "c1", ArgumentsFragment: `{"query":"select:mcp__srv__mutate"}`},
-			{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "c1"},
-			{Type: zeroruntime.StreamEventDone},
-		},
-		{ // turn 2: final answer.
-			{Type: zeroruntime.StreamEventText, Content: "done"},
-			{Type: zeroruntime.StreamEventDone},
-		},
-	}}
-
-	result, err := Run(context.Background(), "plan", provider, Options{
-		Registry:       registry,
-		PermissionMode: PermissionModePlan,
-		DeferThreshold: 2, // 2 deferred mutators registered => eligible for deferral.
-		MaxTurns:       2,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// tool_search (and the deferred mutators) must not be advertised in plan
-	// mode's turn 1 tool list at all.
-	for _, def := range provider.requests[0].Tools {
-		if def.Name == tools.ToolSearchToolName {
-			t.Fatalf("plan mode must not advertise tool_search, got %#v", provider.requests[0].Tools)
-		}
-		if def.Name == "mcp__srv__mutate" || def.Name == "mcp__srv__mutate2" {
-			t.Fatalf("plan mode must not advertise a deferred mutator, got %#v", provider.requests[0].Tools)
-		}
-	}
-
-	// The forced call must be denied outright, never a loaded-schema result:
-	// the tool result must not mention the mutator's name or carry a
-	// load_tools signal.
-	var toolMessage string
-	for _, message := range result.Messages {
-		if message.Role == zeroruntime.MessageRoleTool {
-			toolMessage = message.Content
-			break
-		}
-	}
-	if !strings.Contains(toolMessage, "not available in plan mode") {
-		t.Fatalf("expected tool_search call denied in plan mode, got %q", toolMessage)
-	}
-	if strings.Contains(toolMessage, "mcp__srv__mutate") {
-		t.Fatalf("denial must not leak the deferred mutator's name/schema, got %q", toolMessage)
-	}
-}

internal/agent/denial_test.go

@@ -4,14 +4,14 @@ import (
 	"context"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/sandbox"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 func TestExecuteToolCallCategorizesFilteredDenial(t *testing.T) {
 	root := t.TempDir()
 	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedReadFileTool(root, nil))
+	registry.Register(tools.NewReadFileTool(root))
 
 	result, _ := executeToolCall(context.Background(), registry, ToolCall{ID: "c1", Name: "read_file", Arguments: `{"path":"x"}`}, PermissionModeAuto, Options{
 		DisabledTools: []string{"read_file"},

internal/agent/effective_permission_test.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/tools"
 )
 
 // argsPermTool implements tools.ArgsPermissioner; plainTool does not.

internal/agent/escalate_loop_test.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
+	"github.com/Gitlawb/zero/internal/tools"
+	"github.com/Gitlawb/zero/internal/zeroruntime"
 )
 
 // TestOptionsModelSwitcherFieldExists asserts the escalation hook is an
@@ -144,10 +144,9 @@ func TestRunSwitchesProviderOnEscalationRequest(t *testing.T) {
 	var switchedTo string
 	switchCount := 0
 	result, err := Run(context.Background(), "go", firstProvider, Options{
-		Registry:    registry,
-		Model:       "claude-sonnet-4.5",
-		ServiceTier: "priority",
-		MaxTurns:    4,
+		Registry: registry,
+		Model:    "claude-sonnet-4.5",
+		MaxTurns: 4,
 		ModelSwitcher: func(_ context.Context, modelID string) (Provider, error) {
 			switchCount++
 			switchedTo = modelID
@@ -168,15 +167,9 @@ func TestRunSwitchesProviderOnEscalationRequest(t *testing.T) {
 	if len(firstProvider.requests) != 1 {
 		t.Fatalf("expected first provider to handle exactly the escalation turn, got %d requests", len(firstProvider.requests))
 	}
-	if got := firstProvider.requests[0].ServiceTier; got != "priority" {
-		t.Fatalf("initial request service tier = %q, want priority", got)
-	}
 	if len(secondProvider.requests) != 1 {
 		t.Fatalf("expected second provider to handle the post-switch turn, got %d requests", len(secondProvider.requests))
 	}
-	if got := secondProvider.requests[0].ServiceTier; got != "" {
-		t.Fatalf("post-switch request retained service tier %q", got)
-	}
 	if result.FinalAnswer != "answered on the upgraded model" {
 		t.Fatalf("expected final answer from the swapped provider, got %q", result.FinalAnswer)
 	}
@@ -218,10 +211,9 @@ func TestRunEscalationSwitcherErrorIsNonFatal(t *testing.T) {
 	provider := &mockProvider{turns: escalateThenAnswerTurns("recovered")}
 
 	result, err := Run(context.Background(), "go", provider, Options{
-		Registry:    registry,
-		Model:       "claude-sonnet-4.5",
-		ServiceTier: "priority",
-		MaxTurns:    4,
+		Registry: registry,
+		Model:    "claude-sonnet-4.5",
+		MaxTurns: 4,
 		ModelSwitcher: func(_ context.Context, _ string) (Provider, error) {
 			return nil, errors.New("provider build blew up")
 		},
@@ -233,9 +225,6 @@ func TestRunEscalationSwitcherErrorIsNonFatal(t *testing.T) {
 	if len(provider.requests) != 2 {
 		t.Fatalf("expected the run to continue on the original provider, got %d requests", len(provider.requests))
 	}
-	if got := provider.requests[1].ServiceTier; got != "priority" {
-		t.Fatalf("failed-switch request service tier = %q, want priority", got)
-	}
 	if result.FinalAnswer != "recovered" {
 		t.Fatalf("expected final answer after non-fatal switch error, got %q", result.FinalAnswer)
 	}

internal/agent/export_test.go

@@ -1,41 +0,0 @@
-// Test seams: helpers only test code uses, kept out of the production binary.
-package agent
-
-import (
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-func equalStringSlices(left []string, right []string) bool {
-	if len(left) != len(right) {
-		return false
-	}
-	for index := range left {
-		if left[index] != right[index] {
-			return false
-		}
-	}
-	return true
-}
-
-// parsePreservedState recovers the plan + skills from a prior summary's preserved
-// block. JSON escaping makes this lossless even when a skill body contains
-// markdown headings, code fences, or quotes. Returns ("", nil) when absent or
-// malformed.
-func parsePreservedState(summaryContent string) (string, []skillEntry) {
-	state := parsePreservedStateBlock(summaryContent)
-	return state.Plan, preservedSkillsToEntries(state.Skills)
-}
-
-// partitionTools builds the per-turn advertised tool list and optional
-// tool_search discovery text. INACTIVE (DeferThreshold <= 0 or the eligible count is
-// below it): every visible tool is exposed with its full schema EXCEPT tool_search
-// (dropped so it is never advertised when it cannot help), and the discovery text is
-// empty — byte-identical to the pre-deferral output. ACTIVE: a deferred-eligible
-// tool is exposed only when loaded[name]; otherwise it is hidden and searchable
-// through tool_search. Non-deferred tools (including tool_search) are always
-// exposed. The exposed slice is alpha-sorted by name, matching the legacy order
-// so the inactive path is stable.
-func partitionTools(registry *tools.Registry, permissionMode PermissionMode, options Options, loaded map[string]bool) ([]zeroruntime.ToolDefinition, string) {
-	return partitionToolsCached(registry, permissionMode, options, loaded, nil)
-}

internal/agent/file_diagnostics.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/Twigpine/zero/internal/lsp"
+	"github.com/Gitlawb/zero/internal/lsp"
 )
 
 // fileDiagnosticsTimeout bounds one inline post-edit diagnostics check so a

internal/agent/freeform_tool_test.go

@@ -1,378 +0,0 @@
-package agent
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/sandbox"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-type customApplyPatchTool struct {
-	calls int
-}
-
-type fixedPathScope struct {
-	roots []string
-}
-
-func (scope fixedPathScope) Roots() []string {
-	return append([]string(nil), scope.roots...)
-}
-
-func newFixedPathScope(t *testing.T, roots ...string) fixedPathScope {
-	t.Helper()
-	resolved := make([]string, 0, len(roots))
-	for _, root := range roots {
-		absolute, err := filepath.Abs(root)
-		if err != nil {
-			t.Fatalf("Abs(%q): %v", root, err)
-		}
-		if physical, err := filepath.EvalSymlinks(absolute); err == nil {
-			absolute = physical
-		}
-		resolved = append(resolved, absolute)
-	}
-	return fixedPathScope{roots: resolved}
-}
-
-func (*customApplyPatchTool) Name() string        { return "apply_patch" }
-func (*customApplyPatchTool) Description() string { return "custom JSON tool" }
-func (*customApplyPatchTool) Parameters() tools.Schema {
-	return tools.Schema{Type: "object", Properties: map[string]tools.PropertySchema{"value": {Type: "string"}}}
-}
-func (*customApplyPatchTool) Safety() tools.Safety {
-	return tools.Safety{Permission: tools.PermissionAllow, SideEffect: tools.SideEffectRead}
-}
-func (tool *customApplyPatchTool) Run(context.Context, map[string]any) tools.Result {
-	tool.calls++
-	return tools.Result{Status: tools.StatusOK}
-}
-
-func TestFreeformApplyPatchUsesExistingToolExecutionPath(t *testing.T) {
-	root := t.TempDir()
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, nil))
-	patch := "*** Begin Patch\n*** Add File: hello.txt\n+hello\n*** End Patch\n"
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID:        "call-1",
-		Name:      "apply_patch",
-		Arguments: patch,
-		Freeform:  true,
-	}, PermissionModeUnsafe, Options{Cwd: root, FileTracker: tools.NewFileTracker()})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusOK {
-		t.Fatalf("freeform apply_patch status = %s: %s", result.Status, result.Output)
-	}
-	content, err := os.ReadFile(filepath.Join(root, "hello.txt"))
-	if err != nil {
-		t.Fatalf("read patched file: %v", err)
-	}
-	if string(content) != "hello\n" {
-		t.Fatalf("patched content = %q, want hello newline", content)
-	}
-}
-
-func TestFreeformApplyPatchSupportsGrantedExtraRoot(t *testing.T) {
-	root := t.TempDir()
-	extra := t.TempDir()
-	scope, err := sandbox.NewScope(root, []string{extra})
-	if err != nil {
-		t.Fatalf("NewScope: %v", err)
-	}
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, scope))
-	target := filepath.Join(extra, "hello.txt")
-	patch := "*** Begin Patch\n*** Add File: " + target + "\n+hello\n*** End Patch\n"
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID: "call-1", Name: "apply_patch", Arguments: patch, Freeform: true,
-	}, PermissionModeUnsafe, Options{Cwd: root, FileTracker: tools.NewFileTracker()})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusOK {
-		t.Fatalf("freeform extra-root apply_patch status = %s: %s", result.Status, result.Output)
-	}
-	content, err := os.ReadFile(target)
-	if err != nil {
-		t.Fatalf("read extra-root patched file: %v", err)
-	}
-	if string(content) != "hello\n" {
-		t.Fatalf("patched content = %q, want hello newline", content)
-	}
-}
-
-func TestFreeformApplyPatchRejectsMixedWorkspaceAndExtraRoots(t *testing.T) {
-	for _, extraHasMatchingPath := range []bool{false, true} {
-		name := "extra target missing"
-		if extraHasMatchingPath {
-			name = "extra target exists"
-		}
-		t.Run(name, func(t *testing.T) {
-			workspace := t.TempDir()
-			extra := t.TempDir()
-			if err := os.MkdirAll(filepath.Join(workspace, "src"), 0o755); err != nil {
-				t.Fatal(err)
-			}
-			workspaceTarget := filepath.Join(workspace, "src", "a.go")
-			if err := os.WriteFile(workspaceTarget, []byte("old\n"), 0o644); err != nil {
-				t.Fatal(err)
-			}
-			extraTarget := filepath.Join(extra, "src", "a.go")
-			if extraHasMatchingPath {
-				if err := os.MkdirAll(filepath.Dir(extraTarget), 0o755); err != nil {
-					t.Fatal(err)
-				}
-				if err := os.WriteFile(extraTarget, []byte("old\n"), 0o644); err != nil {
-					t.Fatal(err)
-				}
-			}
-			scope, err := sandbox.NewScope(workspace, []string{extra})
-			if err != nil {
-				t.Fatal(err)
-			}
-			registry := tools.NewRegistry()
-			registry.Register(tools.NewScopedApplyPatchTool(workspace, scope))
-			extraCreated := filepath.Join(extra, "b.go")
-			patch := strings.Join([]string{
-				"*** Begin Patch",
-				"*** Update File: src/a.go",
-				"@@",
-				"-old",
-				"+new",
-				"*** Add File: " + extraCreated,
-				"+extra",
-				"*** End Patch",
-			}, "\n")
-
-			result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-				ID: "call-1", Name: "apply_patch", Arguments: patch, Freeform: true,
-			}, PermissionModeUnsafe, Options{Cwd: workspace, FileTracker: tools.NewFileTracker()})
-			if err != nil {
-				t.Fatalf("executeToolCall: %v", err)
-			}
-			if result.Status != tools.StatusError || !strings.Contains(result.Output, "mixes workspace-relative paths with an extra write root") {
-				t.Fatalf("mixed-root patch result = %s: %s", result.Status, result.Output)
-			}
-			if content, err := os.ReadFile(workspaceTarget); err != nil || string(content) != "old\n" {
-				t.Fatalf("workspace target changed: content=%q err=%v", content, err)
-			}
-			if extraHasMatchingPath {
-				if content, err := os.ReadFile(extraTarget); err != nil || string(content) != "old\n" {
-					t.Fatalf("extra-root target changed: content=%q err=%v", content, err)
-				}
-			}
-			if _, err := os.Stat(extraCreated); !os.IsNotExist(err) {
-				t.Fatalf("mixed-root patch created extra file: %v", err)
-			}
-		})
-	}
-}
-
-func TestFreeformApplyPatchAcceptsOneSemanticRoot(t *testing.T) {
-	for _, test := range []struct {
-		name         string
-		useExtraRoot bool
-	}{
-		{name: "workspace"},
-		{name: "extra root", useExtraRoot: true},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			workspace := t.TempDir()
-			extra := t.TempDir()
-			scope, err := sandbox.NewScope(workspace, []string{extra})
-			if err != nil {
-				t.Fatal(err)
-			}
-			root := workspace
-			if test.useExtraRoot {
-				root = extra
-			}
-			if err := os.MkdirAll(filepath.Join(root, "src"), 0o755); err != nil {
-				t.Fatal(err)
-			}
-			target := filepath.Join(root, "src", "a.go")
-			if err := os.WriteFile(target, []byte("old\n"), 0o644); err != nil {
-				t.Fatal(err)
-			}
-			updatePath := target
-			if !test.useExtraRoot {
-				updatePath = filepath.Join("src", "a.go")
-			}
-			created := filepath.Join(root, "b.go")
-			patch := strings.Join([]string{
-				"*** Begin Patch",
-				"*** Update File: " + updatePath,
-				"@@",
-				"-old",
-				"+new",
-				"*** Add File: " + created,
-				"+created",
-				"*** End Patch",
-			}, "\n")
-			registry := tools.NewRegistry()
-			registry.Register(tools.NewScopedApplyPatchTool(workspace, scope))
-			result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-				ID: "call-1", Name: "apply_patch", Arguments: patch, Freeform: true,
-			}, PermissionModeUnsafe, Options{Cwd: workspace, FileTracker: tools.NewFileTracker()})
-			if err != nil {
-				t.Fatalf("executeToolCall: %v", err)
-			}
-			if result.Status != tools.StatusOK {
-				t.Fatalf("single-root patch status = %s: %s", result.Status, result.Output)
-			}
-			if content, err := os.ReadFile(target); err != nil || string(content) != "new\n" {
-				t.Fatalf("updated content=%q err=%v", content, err)
-			}
-			if content, err := os.ReadFile(created); err != nil || string(content) != "created\n" {
-				t.Fatalf("created content=%q err=%v", content, err)
-			}
-		})
-	}
-}
-
-func TestFreeformApplyPatchRejectsAbsolutePathOutsideGrantedRoots(t *testing.T) {
-	root := t.TempDir()
-	granted := t.TempDir()
-	outside := t.TempDir()
-	scope := newFixedPathScope(t, root, granted)
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, scope))
-	target := filepath.Join(outside, "blocked.txt")
-	patch := "*** Begin Patch\n*** Add File: " + target + "\n+blocked\n*** End Patch\n"
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID: "call-1", Name: "apply_patch", Arguments: patch, Freeform: true,
-	}, PermissionModeUnsafe, Options{Cwd: root})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusError {
-		t.Fatalf("ungranted absolute patch status = %s, want error: %s", result.Status, result.Output)
-	}
-	if _, err := os.Stat(target); !os.IsNotExist(err) {
-		t.Fatalf("ungranted absolute patch created target: %v", err)
-	}
-}
-
-func TestPreparedFreeformPatchRejectsIntermediateSymlinkSwap(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("creating directory symlinks requires privileges on Windows")
-	}
-	root := t.TempDir()
-	extra := t.TempDir()
-	outside := t.TempDir()
-	intermediate := filepath.Join(extra, "nested")
-	if err := os.Mkdir(intermediate, 0o755); err != nil {
-		t.Fatalf("Mkdir: %v", err)
-	}
-	scope := newFixedPathScope(t, root, extra)
-	tool := tools.NewScopedApplyPatchTool(root, scope)
-	target := filepath.Join(intermediate, "blocked.txt")
-	patch := "*** Begin Patch\n*** Add File: " + target + "\n+blocked\n*** End Patch\n"
-	args, err := tools.PrepareFreeformApplyPatchArguments(tool, patch)
-	if err != nil {
-		t.Fatalf("PrepareFreeformApplyPatchArguments: %v", err)
-	}
-
-	if err := os.Remove(intermediate); err != nil {
-		t.Fatalf("Remove intermediate: %v", err)
-	}
-	if err := os.Symlink(outside, intermediate); err != nil {
-		t.Fatalf("Symlink: %v", err)
-	}
-	result := tool.Run(context.Background(), args)
-	if result.Status != tools.StatusError {
-		t.Fatalf("symlink-swapped patch status = %s, want error: %s", result.Status, result.Output)
-	}
-	if _, err := os.Stat(filepath.Join(outside, "blocked.txt")); !os.IsNotExist(err) {
-		t.Fatalf("symlink-swapped patch wrote outside root: %v", err)
-	}
-}
-
-func TestUnknownFreeformToolFailsClosed(t *testing.T) {
-	result, err := executeToolCall(context.Background(), tools.NewRegistry(), zeroruntime.ToolCall{
-		ID: "call-1", Name: "unknown", Arguments: "raw", Freeform: true,
-	}, PermissionModeUnsafe, Options{})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusError {
-		t.Fatalf("unknown freeform status = %s, want error", result.Status)
-	}
-}
-
-func TestCustomApplyPatchCannotUseFreeformContract(t *testing.T) {
-	custom := &customApplyPatchTool{}
-	registry := tools.NewRegistry()
-	registry.Register(custom)
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID: "call-1", Name: "apply_patch", Arguments: "raw patch", Freeform: true,
-	}, PermissionModeUnsafe, Options{})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusError || !strings.Contains(result.Output, "Unsupported freeform tool call") {
-		t.Fatalf("custom freeform apply_patch result = %#v, want unsupported error", result)
-	}
-	if custom.calls != 0 {
-		t.Fatalf("custom apply_patch executed %d times", custom.calls)
-	}
-}
-
-func TestDeniedFreeformApplyPatchDoesNotWrite(t *testing.T) {
-	root := t.TempDir()
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedApplyPatchTool(root, nil))
-	patch := "*** Begin Patch\n*** Add File: denied.txt\n+must not exist\n*** End Patch\n"
-
-	result, err := executeToolCall(context.Background(), registry, zeroruntime.ToolCall{
-		ID:        "call-1",
-		Name:      "apply_patch",
-		Arguments: patch,
-		Freeform:  true,
-	}, PermissionModeAsk, Options{
-		Cwd: root,
-		OnPermissionRequest: func(context.Context, PermissionRequest) (PermissionDecision, error) {
-			return PermissionDecision{Action: PermissionDecisionDeny, Reason: "test denial"}, nil
-		},
-	})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if result.Status != tools.StatusError {
-		t.Fatalf("denied freeform status = %s, want error", result.Status)
-	}
-	if _, err := os.Stat(filepath.Join(root, "denied.txt")); !os.IsNotExist(err) {
-		t.Fatalf("denied freeform patch changed the workspace: %v", err)
-	}
-}
-
-func TestHistorySafeToolCallsPreservesRawFreeformArguments(t *testing.T) {
-	raw := "*** Begin Patch\n*** Update File: internal/main.go\n@@\n-old\n+new\n*** End Patch\n"
-	safe := historySafeToolCalls([]ToolCall{{
-		ID: "call-1", ProviderCallID: "provider-1", Name: "apply_patch", Arguments: raw, Freeform: true,
-	}})
-	if len(safe) != 1 || safe[0].Arguments != raw || safe[0].ProviderCallID != "provider-1" || !safe[0].Freeform {
-		t.Fatalf("freeform history changed raw call: %#v", safe)
-	}
-}
-
-func TestAbortedToolResultPreservesProviderCallID(t *testing.T) {
-	messages := appendAbortedToolResults(nil, []ToolCall{{
-		ID: "call-1", ProviderCallID: "provider-1", Name: "read_file",
-	}})
-	if len(messages) != 1 || messages[0].ToolCallID != "call-1" || messages[0].ToolCallProviderID != "provider-1" || !messages[0].IsError {
-		t.Fatalf("aborted tool result lost provider identity: %#v", messages)
-	}
-}