docs(agents): record the normalize-before-match blocker

Three separate changes hit this in a fortnight, each written by someone being careful about exactly the thing that got them. A transform that removes bytes without leaving a gap is also a reassembler. Redaction that matches by shape, run before a sanitizer that strips control bytes, lets a credential split by a NUL or an ESC pass the patterns as two fragments and be rejoined on the way out: the MCP failure reason in #835, and the imported-transcript chokepoint in #878. The path form of the same mistake is comparing where a handle landed against a value produced by the same resolver the kernel just used, so a redirect agrees with itself: the ACL guard in #808, where junctions were caught only by an accident of Go's mode bits and directory symlinks were not caught at all. The unsplit value passing is what makes it survive review, so the note says the test needs a split case.
2026-11-08 09:49:34 -10:00 · 2026-08-13 10:40:51 +05:30
189 changed files with 2639 additions and 16517 deletions
@@ -1 +1 @@
-{".":"0.8.0"}
+{".":"0.7.0"}
@@ -111,42 +111,3 @@ These classes drive multi-round reviews. Fix them before requesting review:
  shipped. Wire advertised entry points or shrink the claim. Do not bundle
  unrelated fixes. Do not widen security allowlists by name alone; check
  classification and side effects too.
- **Host tool version floors:** Zero shells out to `git` and other host tools,
-  and the project does not declare a minimum version for any of them. A flag,
-  subcommand, or config key that is not long-established therefore raises that
-  floor silently, and the failure on an older host is an unhelpful usage error
-  rather than a clear message. Before adding one, check when it landed and say
-  so where a caller would look. Record the floor for the exact subcommand you
-  call, not for the flag in general: `--end-of-options` reached Git's shared
-  parser in 2.24, but `git rev-parse` only accepted it from 2.30, and
-  `git checkout` and `git reset` later still. Likewise `--show-current` is
-  `git branch` 2.22, and `branch.autoSetupMerge=inherit` is 2.35. Then either
-  keep a fallback for older versions or gate the call. A test that depends on a
-  newer feature must skip below its floor instead of failing, and say which
-  version it needs.
- **Prove the test fails without the change:** A regression test earns its
-  place only if it fails on the unfixed code, for the reason it claims. Run it
-  both ways and quote the failure in the PR. The recurring miss is not a
-  missing test but a test that never reaches the behavior it names, because an
-  earlier guard rejects the input first, so it passes with and without the fix.
-  When a test targets a specific layer, call that layer directly rather than
-  relying on a public entry point that may refuse earlier.
- **Hermetic tests:** Tests must not read or write the developer's real config,
-  cache, or state directories. Redirect every root the code under test
-  resolves, not just config. `os.UserConfigDir` and `os.UserCacheDir` read
-  `XDG_CONFIG_HOME` and `XDG_CACHE_HOME` only on Linux and the BSDs. On macOS
-  they derive from `HOME`, and on Windows from `%AppData%` and `%LocalAppData%`.
-  Setting the XDG variables alone still leaves a macOS run writing to the real
-  home, so set `HOME` as well, or take the directory as a parameter. Apply it to
-  every test that reaches the same storage, not only the one where it was first
-  needed; a test that passes on a clean machine and pollutes a real one is a
-  blocker.
- **Error codes vary by platform and by flag combination:** A check written
-  against the code one target returns can be silently inert on another while
-  still looking correct. `openat(O_DIRECTORY|O_NOFOLLOW)` on a symlink may
-  report `ENOTDIR` or `ELOOP` depending on the platform, because the kernel can
-  reject the directory mismatch before it ever resolves the link; accept both
-  rather than assuming the one POSIX names. On Windows, `\\?\` and `\\.\`
-  prefixes are not UNC paths, and an `NtCreateFile` information class must match
-  the struct actually passed. Confirm the code each supported target returns
-  instead of reasoning from the man page.
@@ -6,27 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once the first release is
 tagged. Until then, source builds report the version `dev`.

-## [0.8.0](https://github.com/Gitlawb/zero/compare/v0.7.0...v0.8.0) (2026-08-21)
-
-
-### Features
-
-* **security:** path-jail primitive, credential-store locking, worktree git hardening ([#891](https://github.com/Gitlawb/zero/issues/891)) ([060d38c](https://github.com/Gitlawb/zero/commit/060d38ce716feb7c5b6657b082cd35cb8dda3d75))
-* **update:** recognise Homebrew installs and add mise, go install docs ([#910](https://github.com/Gitlawb/zero/issues/910)) ([01c3498](https://github.com/Gitlawb/zero/commit/01c3498205e69d26e5f929225f9455b276444f39))
-* use Exa as default search provider ([#926](https://github.com/Gitlawb/zero/issues/926)) ([1ec7219](https://github.com/Gitlawb/zero/commit/1ec7219aee7b2840481ab0905f131644e27d2a4e))
-* **zerogit:** auto-create a conventional branch before push/pr on default branch ([#671](https://github.com/Gitlawb/zero/issues/671)) ([d065467](https://github.com/Gitlawb/zero/commit/d065467cd3ec3ed91c5dc60554c36fc4b4d6de4c))
-
-
-### Bug Fixes
-
-* **acp:** three defects a desktop ACP client hits ([#915](https://github.com/Gitlawb/zero/issues/915)) ([a78c6c3](https://github.com/Gitlawb/zero/commit/a78c6c357e1d21146d7cd2e8030a754e06f7f1f5))
-* bump Go to 1.26.6 for stdlib vulnerability fixes ([#903](https://github.com/Gitlawb/zero/issues/903)) ([dc15e82](https://github.com/Gitlawb/zero/commit/dc15e822987d8d7de467c62c375518f435b74d8c))
-* **daemon:** clean up child after startup timeout ([#774](https://github.com/Gitlawb/zero/issues/774)) ([9c29209](https://github.com/Gitlawb/zero/commit/9c292092a26c9092fd873d072b0af1b0d9d39ef0))
-* **dictation:** redact API keys from streaming transcriber errors ([#852](https://github.com/Gitlawb/zero/issues/852)) ([64a783b](https://github.com/Gitlawb/zero/commit/64a783b08caa2c7b21f188033b9ed84a14e00e84))
-* **modelregistry:** expose reasoning effort for DeepSeek V4 models ([#931](https://github.com/Gitlawb/zero/issues/931)) ([90dcfd1](https://github.com/Gitlawb/zero/commit/90dcfd127e8a6d9902ec9f4e72f6d03fef1a0fc6))
-* **providers:** discover ChatGPT capabilities ([#890](https://github.com/Gitlawb/zero/issues/890)) ([2d2450e](https://github.com/Gitlawb/zero/commit/2d2450e9a744349f0d01b1d4e9ba29c24ba5650d))
-* **sandbox:** normalize launcher names before the command-prefix denylist ([#934](https://github.com/Gitlawb/zero/issues/934)) ([6edf9a8](https://github.com/Gitlawb/zero/commit/6edf9a8b78dc030dc44598919db1c7fa9d4f809a))
-
 ## [0.7.0](https://github.com/Gitlawb/zero/compare/v0.6.0...v0.7.0) (2026-08-10)


@@ -6,7 +6,7 @@

 <p align="center">
  <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.6+" src="https://img.shields.io/badge/Go-1.26.6+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.5+" src="https://img.shields.io/badge/Go-1.26.5+-00ADD8?logo=go&logoColor=white">
  <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
  <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
  <br>
@@ -76,7 +76,7 @@ irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | ie

 ### From source

-Source builds require Go 1.26.6+.
+Source builds require Go 1.26.5+.

 ```bash
 git clone https://github.com/Gitlawb/zero.git
@@ -6,7 +6,7 @@

 <p align="center">
  <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-MIT-blue"></a>
-  <img alt="Go 1.26.6+" src="https://img.shields.io/badge/Go-1.26.6+-00ADD8?logo=go&logoColor=white">
+  <img alt="Go 1.26.5+" src="https://img.shields.io/badge/Go-1.26.5+-00ADD8?logo=go&logoColor=white">
  <img alt="25+ providers" src="https://img.shields.io/badge/providers-25+-34E2EA">
  <a href="https://discord.gg/CaQDS6wdFn"><img alt="Discord" src="https://img.shields.io/badge/Discord-join-5865F2?logo=discord&logoColor=white"></a>
  <br>
@@ -57,7 +57,7 @@ irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 | ie

 ### 从源码构建

-源码构建需要 Go 1.26.6+。
+源码构建需要 Go 1.26.5+。

 ```bash
 git clone https://github.com/Gitlawb/zero.git
@@ -33,4 +33,4 @@ Please include, where possible:
  depend on a user explicitly disabling the sandbox (`--skip-permissions-unsafe`), are generally
  out of scope — but please report anything you are unsure about.
 - Zero sends no telemetry. Network calls go to the model/tool providers you configure (and, for
-  keyless web search, to Exa's hosted MCP endpoint at `https://mcp.exa.ai/mcp`).
+  keyless web search, to the documented Firecrawl endpoint — see the README).
@@ -1,30 +1,14 @@
 # Installing Zero

-Pick whichever fits how you already install things. None of these is the
-blessed one.
+Zero is distributed as:

-| Method | Command | Self-update |
-| --- | --- | --- |
-| Install script (Linux, macOS) | `curl -fsSL https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.sh \| bash` | `zero upgrade` |
-| Install script (Windows) | `irm https://raw.githubusercontent.com/Gitlawb/zero/main/scripts/install.ps1 \| iex` | `zero upgrade` |
-| npm | `npm install -g @gitlawb/zero` | `zero upgrade` (runs npm) |
-| Release archive | download from [Releases](https://github.com/Gitlawb/zero/releases) | `zero upgrade` |
-| mise | `mise use -g ubi:Gitlawb/zero` | `mise upgrade` |
-| `go install` | `go install github.com/Gitlawb/zero/cmd/zero@latest` | rerun the command |
-| Source | `go build -o zero ./cmd/zero` | rebuild |
+- an npm package, `@gitlawb/zero`
+- release archives on GitHub Releases
+- source builds with Go 1.26.5+

-`zero upgrade` follows whatever owns the binary, with one exception it cannot
-detect. It delegates to npm for an npm install, refuses outright for a Homebrew
-keg and names `brew upgrade zero`, and replaces the binary in place for
-everything else — including a mise-managed one, which is the exception.
-
-mise is the one case it cannot detect: a mise-managed binary is an ordinary
-standalone install on disk, so `zero upgrade` will replace it and leave mise
-describing a version that is no longer there. Use `mise upgrade` instead.
-
-Release archives are the substrate for most of the above: the install scripts
-and the npm fallback both download a platform archive from a published GitHub
-Release and verify its checksum.
+The install scripts download a platform-specific release archive and require a
+published GitHub Release for the requested version. The npm package is
+self-contained: the platform binary installs from the npm registry.

 ## npm

@@ -127,45 +111,6 @@ Defaults:
 - Version: latest GitHub release
 - Install path: `%LOCALAPPDATA%\zero\bin\zero.exe`

-## mise
-
-[mise](https://mise.jdx.dev/) installs Zero straight from the GitHub Release
-archives through its `ubi` backend, so there is nothing extra to publish and no
-registry in the middle:
-
-```bash
-mise use -g ubi:Gitlawb/zero
-```
-
-Pin a version the same way you would any other tool:
-
-```bash
-mise use -g ubi:Gitlawb/[email protected]
-```
-
-Updates come from `mise upgrade`. `zero upgrade` also works, because a
-mise-managed binary is an ordinary standalone install, but then mise's records
-describe a version that is no longer on disk. Prefer `mise upgrade`.
-
-## go install
-
-```bash
-go install github.com/Gitlawb/zero/cmd/zero@latest
-```
-
-This builds from source, so it needs Go 1.26.6+ and it does not go through the
-release archives. Two consequences worth knowing before you pick it:
-
- On Linux you also need the sandbox helper, which is a separate binary and is
-  not installed by this command. See
-  [Sandbox Helpers For Source Builds](#sandbox-helpers-for-source-builds).
-  Without it, native sandboxing is unavailable.
- `zero upgrade` treats the result as a standalone install and will replace the
-  binary with a release build rather than rebuilding from source. If you chose
-  `go install` deliberately, rerun it instead.
-
-macOS and Windows need no extra helper.
-
 ## From Source

 ```bash
@@ -180,7 +125,7 @@ Build a local binary:
 go build -o zero ./cmd/zero
 ```

-Source builds require Go 1.26.6+.
+Source builds require Go 1.26.5+.

 ### Sandbox Helpers For Source Builds

@@ -297,23 +242,3 @@ zero upgrade
 ```

 See the [update guide](UPDATE.md) for update modes, flags, and platform details.
-
-`zero upgrade` behaves differently depending on how Zero was installed, because
-overwriting a binary a package manager owns leaves that manager describing a
-version that is no longer there:
-
- **npm**: runs `npm install -g @gitlawb/zero@latest` for you.
- **Homebrew**: refuses, and tells you to run `brew upgrade zero`. Replacing the
-  keg binary directly would be reverted by the next `brew upgrade` or
-  `brew reinstall`.
- **everything else**: downloads the verified release archive and replaces the
-  binary in place.
-
-Homebrew is detected by the binary living inside a Cellar keg that carries
-Homebrew's own `INSTALL_RECEIPT.json`. The keg shape alone is not enough: a
-directory tree you built yourself can have exactly that shape, and refusing to
-update an install Homebrew never touched would be a real cost for a made-up
-reason. The receipt is the thing only Homebrew writes.
-
-An ordinary install under `/usr/local/bin` is left alone even on an Intel Mac
-where that is also the Homebrew prefix.
@@ -1,6 +1,6 @@
 module github.com/Gitlawb/zero

-go 1.26.6
+go 1.26.5

 require (
 	charm.land/bubbles/v2 v2.1.1
@@ -16,7 +16,7 @@ require (
 	github.com/charmbracelet/x/term v0.2.2
 	github.com/coder/websocket v1.8.15
 	github.com/ledongthuc/pdf v0.0.0-20250511090121-5959a4027728
-	golang.org/x/image v0.45.0
+	golang.org/x/image v0.44.0
 	golang.org/x/sys v0.47.0
 	mvdan.cc/sh/v3 v3.13.1
 )
@@ -66,8 +66,6 @@ golang.org/x/exp v0.0.0-20260611194520-c48552f49976 h1:X8Hz2ImujgbmetVuW+w2YkyZC
 golang.org/x/exp v0.0.0-20260611194520-c48552f49976/go.mod h1:vnf4pv9iKZXY58sQE1L86zmNWJ4159e1RkcWiLCkeEY=
 golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
 golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
-golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
-golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
@@ -296,16 +296,6 @@ func stopReasonFor(result agent.Result, err error) (string, error) {
 		if errors.Is(err, context.Canceled) {
 			return StopCancelled, nil
 		}
-		// A CLIENT THAT CANCELLED A PERMISSION PROMPT DID NOT FAIL. Only
-		// context.Canceled was matched here, so dismissing a permission dialog —
-		// a deliberate action, and for apply_patch the only refusal a client is
-		// offered — came back as JSON-RPC -32603 carrying the internal sentinel
-		// text. Editors and the desktop app both render that as a crashed turn,
-		// so declining a tool looked like ZERO falling over. It is a
-		// cancellation, and StopCancelled is what ACP has for saying so.
-		if errors.Is(err, agent.ErrPermissionApprovalCanceled) {
-			return StopCancelled, nil
-		}
 		return "", err
 	}
 	if result.FinishReason == "length" {
@@ -321,14 +311,10 @@ func stopReasonFor(result agent.Result, err error) (string, error) {
 // session/request_permission request and maps the outcome back. Failure to reach
 // the client fails closed to deny.
 func (a *Agent) requestPermission(ctx context.Context, sessionID string, req agent.PermissionRequest) (agent.PermissionDecision, error) {
-	// Built ONCE and used for both halves. Sending one list and validating the
-	// reply against another is the defect this whole path had; see
-	// decisionFromOutcome.
-	options := buildPermissionOptions(req)
 	params := RequestPermissionParams{
 		SessionID: sessionID,
 		ToolCall:  permissionToolCall(req),
-		Options:   options,
+		Options:   buildPermissionOptions(req),
 	}
 	var result RequestPermissionResult
 	if err := a.conn.Call(ctx, MethodSessionRequestPerm, params, &result); err != nil {
@@ -337,7 +323,7 @@ func (a *Agent) requestPermission(ctx context.Context, sessionID string, req age
 		}
 		return agent.PermissionDecision{Action: agent.PermissionDecisionDeny, Reason: "permission request failed: " + err.Error()}, nil
 	}
-	return decisionFromOutcome(result.Outcome, options), nil
+	return decisionFromOutcome(result.Outcome, req.AvailableDecisions), nil
 }

 func (a *Agent) emitPlan(registry *tools.Registry, note *notifier) {
@@ -1,217 +0,0 @@
-package acp
-
-// desktopinterop_test.go covers three defects found by driving the real `zero
-// acp` binary from a desktop ACP client. Each is a case where ZERO and a
-// conforming client disagreed about the wire, and none of them failed loudly —
-// they produced a silent denial, a spurious crash, or two buttons the user
-// could not tell apart.
-//
-// A fourth, session/load restoring history without replaying it, is fixed by
-// #914 rather than here: that one also gives the replayed messages stable ids
-// and keeps session/resume replay-free, which this did not.
-
-import (
-	"errors"
-	"fmt"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/agent"
-)
-
-// ---- an offered option is an acceptable answer ----
-
-// The list the options were BUILT from and the list the answer was CHECKED
-// against were different whenever ZERO did not enumerate: the client was sent
-// Allow and Reject, and its reply was validated against an empty slice, so
-// every button it could possibly show failed closed to deny. The user clicked
-// Allow and ZERO recorded a denial, with nothing on screen to say so.
-func TestAnOfferedOptionIsAccepted(t *testing.T) {
-	// No AvailableDecisions: the fallback path, which is every permission event
-	// that is not a prompt.
-	req := agent.PermissionRequest{ToolName: "bash"}
-
-	options := buildPermissionOptions(req)
-	if len(options) == 0 {
-		t.Fatal("no options were offered")
-	}
-
-	for _, option := range options {
-		decision := decisionFromOutcome(
-			RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: option.OptionID},
-			buildPermissionOptions(req),
-		)
-		if string(decision.Action) != option.OptionID {
-			t.Fatalf("option %q was answered with %q (%s) — an offered option must be accepted",
-				option.OptionID, decision.Action, decision.Reason)
-		}
-	}
-}
-
-// The narrowing this validation exists for still holds: a client must not be
-// able to return a broader grant than it was shown.
-func TestAnOptionThatWasNotOfferedIsStillRefused(t *testing.T) {
-	req := agent.PermissionRequest{ToolName: "bash"}
-
-	decision := decisionFromOutcome(
-		RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(agent.PermissionDecisionAlwaysAllow)},
-		buildPermissionOptions(req),
-	)
-	if decision.Action != agent.PermissionDecisionDeny {
-		t.Fatalf("an unoffered broader grant was accepted as %q", decision.Action)
-	}
-}
-
-// The resolver is the single source of truth for both sides, which is what
-// makes the two agree by construction rather than by being kept in step.
-func TestOfferedDecisionsMatchWhatWasSent(t *testing.T) {
-	for _, req := range []agent.PermissionRequest{
-		{ToolName: "bash"},
-		{ToolName: "bash", AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowForSession,
-			agent.PermissionDecisionDeny,
-		}},
-	} {
-		offered := buildPermissionOptions(req)
-		for _, option := range buildPermissionOptions(req) {
-			if !actionOffered(option.OptionID, offered) {
-				t.Fatalf("option %q was sent but is not in the offered set %v", option.OptionID, offered)
-			}
-		}
-	}
-}
-
-// ---- two options the user can tell apart ----
-
-// request_permissions offers plain allow and strict-review allow together, and
-// both were labelled "Allow". The label is the only thing an ACP client shows,
-// so the panel presented two identical buttons where one silently enabled
-// strict auto-review of what was granted.
-func TestEveryOfferedOptionHasADistinctLabel(t *testing.T) {
-	req := agent.PermissionRequest{
-		ToolName: "request_permissions",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowStrict,
-			agent.PermissionDecisionAllowForSession,
-			agent.PermissionDecisionDeny,
-		},
-	}
-
-	seen := map[string]string{}
-	for _, option := range buildPermissionOptions(req) {
-		if previous, clash := seen[option.Name]; clash {
-			t.Fatalf("options %q and %q share the label %q — a user cannot tell them apart",
-				previous, option.OptionID, option.Name)
-		}
-		seen[option.Name] = option.OptionID
-	}
-}
-
-// The two remain distinct decisions: the label changed, the round trip did not.
-func TestStrictAllowStillRoundTrips(t *testing.T) {
-	req := agent.PermissionRequest{
-		ToolName: "request_permissions",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAllowStrict,
-		},
-	}
-	decision := decisionFromOutcome(
-		RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(agent.PermissionDecisionAllowStrict)},
-		buildPermissionOptions(req),
-	)
-	if decision.Action != agent.PermissionDecisionAllowStrict {
-		t.Fatalf("strict allow round-tripped as %q", decision.Action)
-	}
-}
-
-// ---- cancelling a permission is a cancellation, not a crash ----
-
-// Only context.Canceled was recognised, so dismissing a permission dialog came
-// back as JSON-RPC -32603 carrying the internal sentinel text. Clients render
-// that as a failed turn, so declining a tool looked like ZERO falling over —
-// and for apply_patch, dismissing is the ONLY refusal a client is offered.
-func TestCancellingAPermissionEndsTheTurnAsCancelled(t *testing.T) {
-	canceled := fmt.Errorf("%w for apply_patch", agent.ErrPermissionApprovalCanceled)
-
-	reason, err := stopReasonFor(agent.Result{}, canceled)
-	if err != nil {
-		t.Fatalf("stopReasonFor returned an error for a cancellation: %v", err)
-	}
-	if reason != StopCancelled {
-		t.Fatalf("stop reason = %q, want %q", reason, StopCancelled)
-	}
-}
-
-// A genuine failure must still be an error. Mapping too much to cancelled would
-// hide real faults behind a clean ending, which is the opposite mistake.
-func TestARealFailureIsStillAnError(t *testing.T) {
-	failure := errors.New("provider exploded")
-
-	if _, err := stopReasonFor(agent.Result{}, failure); !errors.Is(err, failure) {
-		t.Fatalf("stopReasonFor(%v) = %v, want the failure preserved", failure, err)
-	}
-}
-
-// The sentinel is matched through errors.Is, so it survives the wrapping every
-// return site applies — each one adds the tool name.
-func TestPermissionCancellationSurvivesWrapping(t *testing.T) {
-	if !errors.Is(fmt.Errorf("%w for bash", agent.ErrPermissionApprovalCanceled), agent.ErrPermissionApprovalCanceled) {
-		t.Fatal("a wrapped permission cancellation was not recognised")
-	}
-	if errors.Is(errors.New("something else"), agent.ErrPermissionApprovalCanceled) {
-		t.Fatal("an unrelated error was reported as a permission cancellation")
-	}
-}
-
-// A decision that never became an option cannot be selected.
-//
-// PermissionDecisionCancel is the case that exists today: optionKindFor drops
-// it because ACP expresses cancellation through the outcome, yet ZERO
-// enumerates it in AvailableDecisions for shell commands and apply_patch. While
-// the reply was validated against the DECISIONS rather than the sent options, a
-// client could return {"outcome":"selected","optionId":"cancel"} — an id it was
-// never shown — and abort the whole turn.
-//
-// Written over every option-less decision rather than over "cancel", so a
-// future action that optionKindFor declines to render is covered the day it is
-// added rather than the day someone remembers this test.
-func TestADecisionThatIsNotAnOptionCannotBeSelected(t *testing.T) {
-	for _, toolName := range []string{"bash", "apply_patch"} {
-		req := agent.PermissionRequest{
-			ToolName: toolName,
-			AvailableDecisions: []agent.PermissionDecisionAction{
-				agent.PermissionDecisionAllow,
-				agent.PermissionDecisionDeny,
-				agent.PermissionDecisionCancel,
-			},
-		}
-		options := buildPermissionOptions(req)
-
-		for _, action := range req.AvailableDecisions {
-			if actionOffered(string(action), options) {
-				continue // it was sent; selecting it is legitimate
-			}
-			decision := decisionFromOutcome(
-				RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: string(action)},
-				options,
-			)
-			if decision.Action != agent.PermissionDecisionDeny {
-				t.Fatalf("%s: %q was never sent as an option but was accepted as %q",
-					toolName, action, decision.Action)
-			}
-		}
-	}
-}
-
-// Cancelling is still reachable — through the outcome, which is where ACP puts
-// it. Closing the selected-id route must not close the real one.
-func TestCancellingThroughTheOutcomeStillWorks(t *testing.T) {
-	options := buildPermissionOptions(agent.PermissionRequest{ToolName: "apply_patch"})
-
-	decision := decisionFromOutcome(RequestPermissionOutcome{Outcome: OutcomeCancelled}, options)
-	if decision.Action != agent.PermissionDecisionCancel {
-		t.Fatalf("outcome=cancelled gave %q, want cancel", decision.Action)
-	}
-}
@@ -15,7 +15,14 @@ import (
 // PermissionOptions. Only the actions ZERO actually presented (AvailableDecisions)
 // are surfaced; the optionId is the ZERO action string for a clean round-trip.
 func buildPermissionOptions(req agent.PermissionRequest) []PermissionOption {
-	actions := offeredDecisions(req)
+	actions := req.AvailableDecisions
+	if len(actions) == 0 {
+		// Sensible default if ZERO didn't enumerate: allow once / reject.
+		actions = []agent.PermissionDecisionAction{
+			agent.PermissionDecisionAllow,
+			agent.PermissionDecisionDeny,
+		}
+	}
 	options := make([]PermissionOption, 0, len(actions))
 	for _, action := range actions {
 		kind, name := optionKindFor(action, req.PrefixApprovalEscalates)
@@ -31,32 +38,6 @@ func buildPermissionOptions(req agent.PermissionRequest) []PermissionOption {
 	return options
 }

-// offeredDecisions resolves what this request actually offers the client.
-//
-// ONE RESOLVER, USED BY BOTH SIDES, and that is the entire point of it existing.
-// The fallback below used to live inside buildPermissionOptions while
-// requestPermission validated the client's answer against the raw
-// req.AvailableDecisions. When ZERO did not enumerate — which is every
-// permission event that is not a prompt, and includes a shell call whose sandbox
-// decision came back deny — the two disagreed completely: the client was sent
-// "Allow" and "Reject", and validation was performed against an EMPTY list, so
-// every option the client could possibly click failed closed to deny with
-// "permission option was not offered".
-//
-// The user clicked Allow and ZERO recorded a denial. Nothing surfaced it,
-// because a denial is a legitimate answer — the tool was simply refused and the
-// turn carried on as though the user had rejected it.
-func offeredDecisions(req agent.PermissionRequest) []agent.PermissionDecisionAction {
-	if len(req.AvailableDecisions) > 0 {
-		return req.AvailableDecisions
-	}
-	// Sensible default if ZERO didn't enumerate: allow once / reject.
-	return []agent.PermissionDecisionAction{
-		agent.PermissionDecisionAllow,
-		agent.PermissionDecisionDeny,
-	}
-}
-
 // optionKindFor maps a ZERO decision action to an ACP PermissionOptionKind and a
 // human label. Returns an empty kind for actions that ACP expresses through the
 // outcome rather than an option (cancel).
@@ -68,16 +49,8 @@ func offeredDecisions(req agent.PermissionRequest) []agent.PermissionDecisionAct
 // disclosure cannot be TUI-only.
 func optionKindFor(action agent.PermissionDecisionAction, escalates bool) (kind, name string) {
 	switch action {
-	case agent.PermissionDecisionAllow:
+	case agent.PermissionDecisionAllow, agent.PermissionDecisionAllowStrict:
 		return PermAllowOnce, "Allow"
-	case agent.PermissionDecisionAllowStrict:
-		// SPLIT FROM PLAIN ALLOW because the label is the only thing an ACP
-		// client shows. Both were labelled "Allow", and request_permissions
-		// offers them together — so the panel presented two identical buttons,
-		// and whichever the user picked looked the same while one of them
-		// silently turned on strict auto-review of what was granted. The option
-		// id carries no room for the distinction, so it has to be in the name.
-		return PermAllowOnce, "Allow with strict review"
 	case agent.PermissionDecisionAllowForSession:
 		return PermAllowAlways, "Allow for this session"
 	case agent.PermissionDecisionAllowPrefix:
@@ -97,31 +70,19 @@ func optionKindFor(action agent.PermissionDecisionAction, escalates bool) (kind,

 // decisionFromOutcome maps the client's permission outcome back to a ZERO
 // decision. A cancelled outcome cancels the run; a selected option id is the ZERO
-// action verbatim (validated against what was actually sent); anything
-// unrecognized fails closed to deny.
-//
-// IT TAKES THE OPTIONS THAT WERE SENT, not the decisions the request offered,
-// and the two are not the same list. Some actions never become options —
-// PermissionDecisionCancel is dropped by optionKindFor because ACP expresses
-// cancellation through the outcome instead — yet it IS enumerated in
-// AvailableDecisions for shell commands and apply_patch, the two commonest
-// prompts. Validating against the decisions therefore accepted
-// {"outcome":"selected","optionId":"cancel"}: an identifier no client was ever
-// shown, aborting the whole turn.
-//
-// Passing the sent options makes "what we offered" and "what we accept" the
-// same slice rather than two things kept in step, so anything optionKindFor
-// declines to render is excluded structurally instead of by name.
-func decisionFromOutcome(outcome RequestPermissionOutcome, offered []PermissionOption) agent.PermissionDecision {
+// action verbatim (validated against what was offered); anything unrecognized
+// fails closed to deny.
+func decisionFromOutcome(outcome RequestPermissionOutcome, offered []agent.PermissionDecisionAction) agent.PermissionDecision {
 	switch outcome.Outcome {
 	case OutcomeCancelled:
 		return agent.PermissionDecision{Action: agent.PermissionDecisionCancel, Reason: "client cancelled"}
 	case OutcomeSelected:
+		action := agent.PermissionDecisionAction(outcome.OptionID)
 		// Bind to what was actually offered for THIS call: a client must not be able
 		// to return a broader grant (always_allow / allow_for_session) that wasn't
 		// presented. Anything not offered fails closed to deny.
-		if actionOffered(outcome.OptionID, offered) {
-			return agent.PermissionDecision{Action: agent.PermissionDecisionAction(outcome.OptionID)}
+		if actionOffered(action, offered) {
+			return agent.PermissionDecision{Action: action}
 		}
 		return agent.PermissionDecision{Action: agent.PermissionDecisionDeny, Reason: "permission option was not offered"}
 	default:
@@ -129,9 +90,9 @@ func decisionFromOutcome(outcome RequestPermissionOutcome, offered []PermissionO
 	}
 }

-func actionOffered(optionID string, offered []PermissionOption) bool {
-	for _, option := range offered {
-		if option.OptionID == optionID {
+func actionOffered(action agent.PermissionDecisionAction, offered []agent.PermissionDecisionAction) bool {
+	for _, a := range offered {
+		if a == action {
 			return true
 		}
 	}
@@ -56,11 +56,10 @@ func TestACPPrefixOptionsStaySilentWithoutEscalation(t *testing.T) {
 // what was offered, so decorating it would fail every prefix approval closed.
 func TestACPDisclosureDoesNotDisturbTheOptionIDRoundTrip(t *testing.T) {
 	request := escalationRequest(true)
-	options := buildPermissionOptions(request)
-	for _, option := range options {
+	for _, option := range buildPermissionOptions(request) {
 		decision := decisionFromOutcome(
 			RequestPermissionOutcome{Outcome: OutcomeSelected, OptionID: option.OptionID},
-			options,
+			request.AvailableDecisions,
 		)
 		if string(decision.Action) != option.OptionID {
 			t.Errorf("option id %q round-tripped to %q (%s)", option.OptionID, decision.Action, decision.Reason)
@@ -39,14 +39,11 @@ func TestBuildPermissionOptionsDefault(t *testing.T) {
 }

 func TestDecisionFromOutcome(t *testing.T) {
-	offered := buildPermissionOptions(agent.PermissionRequest{
-		ToolName: "bash",
-		AvailableDecisions: []agent.PermissionDecisionAction{
-			agent.PermissionDecisionAllow,
-			agent.PermissionDecisionAlwaysAllow,
-			agent.PermissionDecisionDeny,
-		},
-	})
+	offered := []agent.PermissionDecisionAction{
+		agent.PermissionDecisionAllow,
+		agent.PermissionDecisionAlwaysAllow,
+		agent.PermissionDecisionDeny,
+	}
 	if d := decisionFromOutcome(RequestPermissionOutcome{Outcome: OutcomeCancelled}, offered); d.Action != agent.PermissionDecisionCancel {
 		t.Errorf("cancelled -> %q, want cancel", d.Action)
 	}
@@ -99,43 +99,6 @@ func TestProposedCommandPrefixRejectsUnsafeRequestedPrefix(t *testing.T) {
 	}
 }

-// The launcher denylist is only worth anything if it holds on the path a user
-// actually sees. A model naming its own prefix_rule is that path: before
-// launcher names were normalized, "python3.11" was offered as a one-token
-// grant, and hasStringPrefix then matched every later python3.11 invocation.
-func TestProposedCommandPrefixRejectsLauncherSpellingsInRequestedPrefix(t *testing.T) {
-	for _, testCase := range []struct {
-		command string
-		rule    []any
-	}{
-		{"python3.11 script.py", []any{"python3.11"}},
-		{"python.exe script.py", []any{"python.exe"}},
-		{"node.exe app.js", []any{"node.exe"}},
-		{"cmd /c whoami", []any{"cmd"}},
-		{"busybox sh -c id", []any{"busybox"}},
-		{"uv run main.py", []any{"uv", "run"}},
-		{"python3.11 -c import_os", []any{"python3.11", "-c"}},
-	} {
-		got := proposedCommandPrefix("bash", map[string]any{
-			"command":     testCase.command,
-			"prefix_rule": testCase.rule,
-		})
-		if got != nil {
-			t.Errorf("prefix_rule %v for %q was offered as %#v, want rejected", testCase.rule, testCase.command, got)
-		}
-	}
-}
-
-func TestProposedCommandPrefixStillOffersOrdinaryCommands(t *testing.T) {
-	got := proposedCommandPrefix("bash", map[string]any{
-		"command":     "cargo build --release",
-		"prefix_rule": []any{"cargo", "build"},
-	})
-	if len(got) != 2 || got[0] != "cargo" || got[1] != "build" {
-		t.Fatalf("ordinary prefix rule = %#v, want [cargo build]", got)
-	}
-}
-
 func TestProposedCommandPrefixRejectsUnsafeShellForms(t *testing.T) {
 	cases := []string{
 		"cat < in > out",
@@ -40,15 +40,7 @@ const (
 	toolResultControlSpecReview = "spec_review_required"
 )

-// ErrPermissionApprovalCanceled ends a run because the caller cancelled a
-// permission prompt, rather than because anything failed.
-//
-// EXPORTED FOR THE SURFACES. A cancel is a normal ending and each surface says
-// so its own way — the TUI unwinds, and ACP has a "cancelled" stop reason for
-// exactly this. While it was unexported ACP could not distinguish it from a
-// fault and reported it as an internal error, so declining a tool looked like
-// the agent crashing.
-var ErrPermissionApprovalCanceled = errors.New("permission approval cancelled")
+var errPermissionApprovalCanceled = errors.New("permission approval cancelled")

 // isImageRejectionError reports whether err is a provider 400 that rejects
 // image/multimodal content. This is checked BEFORE the compaction-retry path
@@ -1372,7 +1364,7 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 			}
 		case PermissionDecisionCancel:
 			emitCanceledPermission(options, call, requestEvent, decisionReason)
-			return canceledPermissionResult(call, decisionReason, requestEvent), fmt.Errorf("%w for %s", ErrPermissionApprovalCanceled, call.Name)
+			return canceledPermissionResult(call, decisionReason, requestEvent), fmt.Errorf("%w for %s", errPermissionApprovalCanceled, call.Name)
 		default:
 			emitDeniedPermission(options, call, requestEvent, decisionReason)
 			return deniedPermissionResult(call, decisionReason, requestEvent), nil
@@ -1556,7 +1548,7 @@ func maybeRetryUnsandboxedAfterSandboxRestriction(ctx context.Context, registry
 	case PermissionDecisionCancel:
 		emitCanceledPermission(options, call, requestEvent, reason)
 		canceled := canceledPermissionResult(call, reason, requestEvent)
-		return result, &canceled, true, decision.Action, reason, nil, fmt.Errorf("%w for %s", ErrPermissionApprovalCanceled, call.Name)
+		return result, &canceled, true, decision.Action, reason, nil, fmt.Errorf("%w for %s", errPermissionApprovalCanceled, call.Name)
 	default:
 		emitDeniedPermission(options, call, requestEvent, reason)
 		denied := deniedPermissionResult(call, reason, requestEvent)
@@ -1604,7 +1596,7 @@ func maybeRetryWithNetworkAfterSandboxDenial(ctx context.Context, registry *tool
 	case PermissionDecisionCancel:
 		emitCanceledPermission(options, call, requestEvent, reason)
 		canceled := canceledPermissionResult(call, reason, requestEvent)
-		return result, &canceled, true, decision.Action, reason, fmt.Errorf("%w for %s", ErrPermissionApprovalCanceled, call.Name)
+		return result, &canceled, true, decision.Action, reason, fmt.Errorf("%w for %s", errPermissionApprovalCanceled, call.Name)
 	default:
 		emitDeniedPermission(options, call, requestEvent, reason)
 		denied := deniedPermissionResult(call, reason, requestEvent)
@@ -3095,15 +3087,13 @@ func partitionToolsCached(registry *tools.Registry, permissionMode PermissionMod
 	// Deferral may activate only when tool_search is actually runnable; otherwise
 	// the loop would hide deferred tools behind a loader the dispatch gate rejects
 	// — an inescapable dead-end. "Runnable" mirrors executeToolCall's gate:
-	// registered, model-visible, not in DisabledTools, and advertised in the
-	// current permission mode (e.g. not spec-draft, where tool_search is not
-	// advertised). The
+	// registered, not in DisabledTools, and advertised in the current permission
+	// mode (e.g. not spec-draft, where tool_search is not advertised). The
 	// EnabledTools allowlist is intentionally NOT checked here — tool_search is
 	// exempt from the allowlist at dispatch, so an allowlist that omits it must
 	// not disable deferral.
 	loader, loaderFound := registry.Get(tools.ToolSearchToolName)
 	loaderUsable := loaderFound &&
-		tools.ModelVisible(loader) &&
 		!containsToolName(options.DisabledTools, tools.ToolSearchToolName) &&
 		ToolAdvertised(loader, permissionMode)

@@ -3218,9 +3208,7 @@ func runtimeToolDefinition(tool tools.Tool) zeroruntime.ToolDefinition {
 }

 func ToolVisible(tool tools.Tool, permissionMode PermissionMode, enabledTools []string, disabledTools []string) bool {
-	return tools.ModelVisible(tool) &&
-		ToolAllowedByFilters(tool.Name(), enabledTools, disabledTools) &&
-		ToolAdvertised(tool, permissionMode)
+	return ToolAllowedByFilters(tool.Name(), enabledTools, disabledTools) && ToolAdvertised(tool, permissionMode)
 }

 func ToolAllowedByFilters(name string, enabledTools []string, disabledTools []string) bool {
@@ -1853,7 +1853,7 @@ func TestRunAbortsWhenPermissionRequestCanceled(t *testing.T) {
 		},
 	})

-	if !errors.Is(err, ErrPermissionApprovalCanceled) {
+	if !errors.Is(err, errPermissionApprovalCanceled) {
 		t.Fatalf("expected permission approval cancel error, got %v", err)
 	}
 	if result.FinalAnswer != "" {
@@ -4340,95 +4340,3 @@ func TestPlanModeHonorsBeforeToolVeto(t *testing.T) {
 		t.Fatalf("expected tool result to mention the beforeTool veto, got %q", combined)
 	}
 }
-
-// A cancelled permission on either sandbox-retry path must abort the run with a
-// recognisable cancellation, and must not run the escalated retry.
-//
-// BOTH PATHS, because both wrap ErrPermissionApprovalCanceled and each is
-// reached by a different kind of denial: one by an unrestricted platform denial
-// asking for approval, the other by an external-network denial. Surfaces map
-// this sentinel onto their own idea of a cancel — ACP returns stopReason
-// "cancelled" for it — so a path that produced a bare error instead would show
-// the user a crash where they had simply declined.
-func TestCancellingASandboxRetryAbortsWithoutRetrying(t *testing.T) {
-	denial := func(capability execution.CapabilityKind, scope string) tools.Result {
-		return tools.Result{
-			Status: tools.StatusError,
-			ExecutionOutcome: &execution.Outcome{
-				State: execution.StateDenied,
-				Kind:  execution.OutcomeEnforcementDenied,
-				Denial: &execution.Denial{
-					Capability:  execution.Capability{Kind: capability, Scope: scope},
-					Source:      execution.DenialSourcePlatformSandbox,
-					Reason:      "denied by the sandbox",
-					Recoverable: true,
-					NextAction:  execution.DenialNextActionRequestApproval,
-				},
-			},
-		}
-	}
-
-	for _, testCase := range []struct {
-		name   string
-		result tools.Result
-		run    func(context.Context, *tools.Registry, ToolCall, tools.Tool, map[string]any, tools.Result, Options) error
-	}{
-		{
-			name:   "unsandboxed retry",
-			result: denial(execution.CapabilityUnrestricted, "host"),
-			run: func(ctx context.Context, registry *tools.Registry, call ToolCall, tool tools.Tool, args map[string]any, result tools.Result, options Options) error {
-				_, _, _, _, _, _, abortErr := maybeRetryUnsandboxedAfterSandboxRestriction(
-					ctx, registry, call, tool, args, result, PermissionModeAsk, options, nil)
-				return abortErr
-			},
-		},
-		{
-			name:   "network retry",
-			result: denial(execution.CapabilityExternalNetwork, ""),
-			run: func(ctx context.Context, registry *tools.Registry, call ToolCall, tool tools.Tool, args map[string]any, result tools.Result, options Options) error {
-				_, _, _, _, _, abortErr := maybeRetryWithNetworkAfterSandboxDenial(
-					ctx, registry, call, tool, args, result, PermissionModeAsk, options, nil)
-				return abortErr
-			},
-		},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			retryTool := &sandboxNamespaceLimitedRetryTool{}
-			registry := tools.NewRegistry()
-			registry.Register(retryTool)
-
-			asked := 0
-			options := Options{
-				Registry:       registry,
-				PermissionMode: PermissionModeAsk,
-				Autonomy:       "medium",
-				Sandbox: sandbox.NewEngine(sandbox.EngineOptions{
-					WorkspaceRoot: t.TempDir(),
-					Policy:        sandbox.DefaultPolicy(),
-				}),
-				OnPermissionRequest: func(context.Context, PermissionRequest) (PermissionDecision, error) {
-					asked++
-					return PermissionDecision{Action: PermissionDecisionCancel, Reason: "client cancelled"}, nil
-				},
-			}
-
-			call := ToolCall{ID: "call-1", Name: "bash", Arguments: `{"command":"curl example.com"}`}
-			args := map[string]any{"command": "curl example.com"}
-
-			abortErr := testCase.run(context.Background(), registry, call, retryTool, args, testCase.result, options)
-
-			if asked != 1 {
-				t.Fatalf("permission was requested %d times, want exactly 1", asked)
-			}
-			if !errors.Is(abortErr, ErrPermissionApprovalCanceled) {
-				t.Fatalf("abort error = %v, want it to match ErrPermissionApprovalCanceled", abortErr)
-			}
-			// The escalated retry is the thing the permission was gating. A
-			// cancelled prompt that still ran it would have run the command the
-			// user just declined.
-			if len(retryTool.calls) != 0 {
-				t.Fatalf("the escalated retry ran %d times after a cancel: %+v", len(retryTool.calls), retryTool.calls)
-			}
-		})
-	}
-}
@@ -67,21 +67,3 @@ func TestEagerToolSchemaTokenBudget(t *testing.T) {
 		t.Fatalf("eager tool schemas are %d tokens, over the %d ceiling — trim a schema, drop a core tool, or raise the ceiling deliberately (deferring will NOT help: this test disables deferral)", got, maxEagerToolSchemaTokens)
 	}
 }
-
-func TestAgentAdvertisesPatchInsteadOfAmbiguousStringReplacement(t *testing.T) {
-	registry := tools.NewRegistry()
-	for _, tool := range tools.CoreToolsScoped(t.TempDir(), nil) {
-		registry.Register(tool)
-	}
-	exposed, _ := partitionTools(registry, PermissionModeAsk, Options{}, map[string]bool{})
-	names := make(map[string]bool, len(exposed))
-	for _, definition := range exposed {
-		names[definition.Name] = true
-	}
-	if !names["apply_patch"] {
-		t.Fatal("agent must retain apply_patch for existing-file changes")
-	}
-	if names["edit_file"] {
-		t.Fatal("agent must not receive the ambiguous string-replacement tool")
-	}
-}
@@ -52,7 +52,7 @@ work.

 - Choose the narrowest tool that safely accomplishes the step. Prefer native
  file tools - read_file, read_minified_file, list_directory, glob, grep,
-  write_file, apply_patch - over shelling out to
+  write_file, edit_file, apply_patch - over shelling out to
  cat/sed/awk/python for file operations.
  They are safer, reviewable, and produce clean diffs.
 - Prefer read_minified_file when initially exploring source code; it preserves
@@ -61,11 +61,10 @@ work.
 - Keep edits focused and reviewable. A single patch may update several related
  files when they form one coherent change; do not hide unrelated edits in a
  bulk shell or script rewrite.
- For edits to existing files, prefer apply_patch with minimal, targeted hunks
-  and enough unchanged context to identify the intended location. Match the
-  existing indentation, imports, and idioms. Match the file's comment density:
-  do not add explanatory comments unless the user asks or the code is already
-  comment-dense.
+- For edits to existing files, prefer edit_file or apply_patch with minimal,
+  targeted diffs. Match the existing indentation, imports, and idioms. Match the
+  file's comment density: do not add explanatory comments unless the user asks or
+  the code is already comment-dense.
 - Solve the problem as posed, not a more general version of it. Add no
  speculative abstraction, configurability, or handling for cases that cannot
  occur, and nothing the user did not ask for. A small diff can still be
@@ -105,7 +104,7 @@ work.
  you need to clean up a running foreground command yourself, use write_stdin.
 - write_stdin's session_id is only ever an id returned by a still-running
  exec_command; never guess or probe ids. If you have no such session, start one
-  with exec_command, or use write_file/apply_patch for file changes.
+  with exec_command, or use write_file/edit_file/apply_patch for file changes.
 - write_stdin with empty input polls an existing exec_command session, and
  `\u0003` interrupts it. Sending other stdin bytes may require approval because
  it can drive the running process beyond the original command. Non-tty sessions
@@ -60,14 +60,14 @@ const openAIPromptAddendum = `<model_guidance>
  longer answers, fenced code blocks for code, and ` + "`inline code`" + ` for paths,
  commands, and symbols.
 - Strongly prefer the native file tools (read_file, list_directory, grep, glob,
-  write_file, apply_patch) over shelling out to cat/sed/awk/python for
+  write_file, edit_file, apply_patch) over shelling out to cat/sed/awk/python for
  file work. Make one tool call per file; do not batch file writes into a script.
 - Persist until the task is fully handled this turn: gather context, implement,
  run the validators, and report — do not stop at a partial result.
 </model_guidance>`

 const geminiPromptAddendum = `<model_guidance>
- Prefer the dedicated tools (read_file, grep, glob, apply_patch) over
+- Prefer the dedicated tools (read_file, grep, glob, edit_file, apply_patch) over
  equivalent shell commands; they are safer and produce cleaner diffs.
 - Be concise and concrete. When you run a shell command with side effects, state
  in one short clause why it is needed.
@@ -36,7 +36,7 @@ func TestCoreSystemPromptIncludesCodingQualityRules(t *testing.T) {
 		"inspect the target file",
 		"plan then act",
 		"choose the narrowest tool",
-		"for edits to existing files, prefer apply_patch",
+		"prefer edit_file or apply_patch",
 		"verify after edits",
 		"honor the active permission mode",
 		"avoid broad refactors",
@@ -29,6 +29,10 @@ func ParseTraceEventKeys(stdout string) []string {
 	return keys
 }

+func TraceEventKeys(stdout string) []string {
+	return ParseTraceEventKeys(stdout)
+}
+
 func MissingTraceEvents(required []string, stdout string) []string {
 	seen := map[string]bool{}
 	for _, key := range ParseTraceEventKeys(stdout) {
@@ -453,12 +453,7 @@ func (manager *Manager) normalizeLoadedTask(fileTaskID string, task Task) (Task,
 	}
 	outputFile, err := manager.outputFile(task.ID, task.OutputFile)
 	if err != nil {
-		var migrated bool
-		outputFile, migrated = manager.migrateLegacyOutputFile(task.ID, task.OutputFile)
-		if !migrated {
-			return Task{}, false, err
-		}
-		changed = true
+		return Task{}, false, err
 	}
 	if outputFile != task.OutputFile {
 		changed = true
@@ -567,32 +562,6 @@ func (manager *Manager) outputFile(taskID string, requested string) (string, err
 	return path, nil
 }

-// migrateLegacyOutputFile recovers task metadata written under a previous home
-// or XDG data root. It accepts only the canonical per-task output
-// name in the historic zero/background layout, and only when the corresponding
-// regular file already exists inside the active manager root.
-func (manager *Manager) migrateLegacyOutputFile(taskID string, requested string) (string, bool) {
-	requested = strings.TrimSpace(requested)
-	if !filepath.IsAbs(requested) {
-		return "", false
-	}
-	requested = filepath.Clean(requested)
-	expectedName := taskID + ".ndjson"
-	if filepath.Base(requested) != expectedName {
-		return "", false
-	}
-	legacyRoot := filepath.Dir(requested)
-	if filepath.Base(legacyRoot) != "background" || filepath.Base(filepath.Dir(legacyRoot)) != "zero" {
-		return "", false
-	}
-	canonical := filepath.Join(manager.rootDir, expectedName)
-	info, err := os.Lstat(canonical)
-	if err != nil || !info.Mode().IsRegular() {
-		return "", false
-	}
-	return canonical, true
-}
-
 func validTaskID(taskID string) bool {
 	return taskIDPattern.MatchString(strings.TrimSpace(taskID))
 }
@@ -1,7 +1,6 @@
 package background

 import (
-	"encoding/json"
 	"errors"
 	"os"
 	"path/filepath"
@@ -192,88 +191,6 @@ func TestManagerSkipsInvalidPersistedMetadata(t *testing.T) {
 	}
 }

-func TestManagerMigratesLegacyOutputPathWhenCanonicalOutputExists(t *testing.T) {
-	root := t.TempDir()
-	const taskID = "legacy_task"
-	canonicalOutput := filepath.Join(root, taskID+".ndjson")
-	if err := os.WriteFile(canonicalOutput, []byte("legacy output\n"), 0o600); err != nil {
-		t.Fatalf("write canonical output: %v", err)
-	}
-	legacyOutput := filepath.Join(t.TempDir(), "zero", "background", taskID+".ndjson")
-	metadata, err := json.Marshal(Task{
-		ID:         taskID,
-		Type:       "specialist",
-		Status:     StatusCompleted,
-		OutputFile: legacyOutput,
-		StartedAt:  time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC),
-	})
-	if err != nil {
-		t.Fatalf("marshal legacy metadata: %v", err)
-	}
-	if err := os.WriteFile(filepath.Join(root, taskID+".json"), append(metadata, '\n'), 0o600); err != nil {
-		t.Fatalf("write legacy metadata: %v", err)
-	}
-
-	manager, err := NewManager(root)
-	if err != nil {
-		t.Fatalf("NewManager returned error: %v", err)
-	}
-	task, ok := manager.Get(taskID)
-	if !ok {
-		t.Fatal("manager did not load migrated task")
-	}
-	if task.OutputFile != canonicalOutput {
-		t.Fatalf("migrated output file = %q, want %q", task.OutputFile, canonicalOutput)
-	}
-	if warnings := manager.LoadWarnings(); len(warnings) != 0 {
-		t.Fatalf("migration produced load warnings: %#v", warnings)
-	}
-
-	persisted, err := os.ReadFile(filepath.Join(root, taskID+".json"))
-	if err != nil {
-		t.Fatalf("read migrated metadata: %v", err)
-	}
-	var saved Task
-	if err := json.Unmarshal(persisted, &saved); err != nil {
-		t.Fatalf("decode migrated metadata: %v", err)
-	}
-	if saved.OutputFile != canonicalOutput {
-		t.Fatalf("persisted output file = %q, want %q", saved.OutputFile, canonicalOutput)
-	}
-}
-
-func TestManagerRejectsUnrelatedAbsoluteOutputPathDuringMigration(t *testing.T) {
-	root := t.TempDir()
-	const taskID = "legacy_task"
-	if err := os.WriteFile(filepath.Join(root, taskID+".ndjson"), []byte("output\n"), 0o600); err != nil {
-		t.Fatalf("write canonical output: %v", err)
-	}
-	metadata, err := json.Marshal(Task{
-		ID:         taskID,
-		Type:       "specialist",
-		Status:     StatusCompleted,
-		OutputFile: filepath.Join(t.TempDir(), taskID+".ndjson"),
-		StartedAt:  time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC),
-	})
-	if err != nil {
-		t.Fatalf("marshal metadata: %v", err)
-	}
-	if err := os.WriteFile(filepath.Join(root, taskID+".json"), append(metadata, '\n'), 0o600); err != nil {
-		t.Fatalf("write metadata: %v", err)
-	}
-
-	manager, err := NewManager(root)
-	if err != nil {
-		t.Fatalf("NewManager returned error: %v", err)
-	}
-	if _, ok := manager.Get(taskID); ok {
-		t.Fatal("manager loaded task with an unrelated absolute output path")
-	}
-	if warnings := strings.Join(manager.LoadWarnings(), "\n"); !strings.Contains(warnings, "output file must be inside") {
-		t.Fatalf("load warnings = %q, want containment rejection", warnings)
-	}
-}
-
 func TestManagerMarksReloadedRunningTaskNonKillable(t *testing.T) {
 	root := t.TempDir()
 	manager, err := NewManager(root)
@@ -39,21 +39,3 @@ func ConfigureChildProcessGroup(cmd *exec.Cmd) {
 func terminateProcess(pid int) error {
 	return execution.TerminateProcessTree(pid, terminationGracePeriod, terminationPollInterval)
 }
-
-// terminateOwnedProcess terminates cmd's process group directly when its launch
-// configuration proves it was made a group leader. This avoids fragile Getpgid
-// rediscovery after an owned leader exits. Ordinary commands fall back to the
-// safe PID/tree path rather than assuming their PID is also a process-group ID.
-//
-// The Setpgid && Pgid == 0 guard only recognizes ConfigureChildProcessGroup's
-// own convention. A command made its own session leader via Setsid (as opposed
-// to Setpgid) is also its own process-group leader in practice, but takes the
-// slower rediscovery path here since Setsid isn't checked. Harmless today
-// because TerminateCommand has exactly one caller in this codebase; worth
-// covering explicitly if Setsid-configured commands start using this path too.
-func terminateOwnedProcess(cmd *exec.Cmd) (bool, error) {
-	if cmd.SysProcAttr != nil && cmd.SysProcAttr.Setpgid && cmd.SysProcAttr.Pgid == 0 {
-		return false, execution.TerminateProcessGroup(cmd.Process.Pid, terminationGracePeriod, terminationPollInterval)
-	}
-	return false, terminateProcess(cmd.Process.Pid)
-}
@@ -147,12 +147,11 @@ func TestTerminateProcessKillsForkedChildren(t *testing.T) {
 		t.Fatalf("terminateProcess: %v", err)
 	}

-	// The forked child must no longer be running. An orphaned zombie is already
-	// dead but may remain visible briefly until the platform's init reaps it.
+	// The forked child must be gone too (poll until reaped by init).
 	deadline := time.Now().Add(2 * time.Second)
-	// processStopped treats only ESRCH or an observed zombie state as stopped;
-	// other errors (for example EPERM) remain live and keep polling.
-	for !processStopped(childPID) {
+	// Only ESRCH proves the child is gone; any other error (e.g. EPERM) would
+	// wrongly pass the test, so treat it as still-present and keep polling.
+	for !errors.Is(syscall.Kill(childPID, syscall.Signal(0)), syscall.ESRCH) {
 		if time.Now().After(deadline) {
 			_ = syscall.Kill(childPID, syscall.SIGKILL)
 			t.Fatalf("forked child %d survived terminateProcess — group kill failed", childPID)
@@ -160,73 +159,3 @@ func TestTerminateProcessKillsForkedChildren(t *testing.T) {
 		time.Sleep(20 * time.Millisecond)
 	}
 }
-
-func TestTerminateCommandStopsUnconfiguredCommand(t *testing.T) {
-	cmd := exec.Command("sleep", "30")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	t.Cleanup(func() {
-		if cmd.ProcessState == nil {
-			_ = cmd.Process.Kill()
-		}
-	})
-
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("unconfigured command was not reaped")
-	}
-}
-
-func TestTerminateCommandKillsChildAfterLeaderExits(t *testing.T) {
-	grace, poll := terminationGracePeriod, terminationPollInterval
-	terminationGracePeriod, terminationPollInterval = 2*time.Second, 20*time.Millisecond
-	t.Cleanup(func() { terminationGracePeriod, terminationPollInterval = grace, poll })
-
-	// The leader exits immediately after launching the child. TerminateCommand
-	// must capture and signal the process group before Wait reaps the leader and
-	// makes its group identity unavailable.
-	cmd := exec.Command("sh", "-c", "sleep 300 & echo $!; exit 0")
-	ConfigureChildProcessGroup(cmd)
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		t.Fatalf("stdout pipe: %v", err)
-	}
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	line, err := bufio.NewReader(stdout).ReadString('\n')
-	if err != nil {
-		t.Fatalf("read forked child pid: %v", err)
-	}
-	childPID, err := strconv.Atoi(strings.TrimSpace(line))
-	if err != nil {
-		t.Fatalf("parse forked child pid %q: %v", line, err)
-	}
-
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v", err)
-	}
-
-	deadline := time.Now().Add(2 * time.Second)
-	for !processStopped(childPID) {
-		if time.Now().After(deadline) {
-			_ = syscall.Kill(childPID, syscall.SIGKILL)
-			t.Fatalf("forked child %d survived TerminateCommand", childPID)
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-}
-
-func processStopped(pid int) bool {
-	if errors.Is(syscall.Kill(pid, syscall.Signal(0)), syscall.ESRCH) {
-		return true
-	}
-	state, err := exec.Command("ps", "-o", "stat=", "-p", strconv.Itoa(pid)).Output()
-	if err != nil {
-		return errors.Is(syscall.Kill(pid, syscall.Signal(0)), syscall.ESRCH)
-	}
-	return strings.HasPrefix(strings.TrimSpace(string(state)), "Z")
-}
@@ -3,20 +3,11 @@
 package background

 import (
-	"fmt"
 	"os/exec"

 	"github.com/Gitlawb/zero/internal/execution"
-	"golang.org/x/sys/windows"
 )

-// stillActiveExitCode is the documented GetExitCodeProcess value for a process
-// that has not terminated. x/sys/windows does not expose Windows' STILL_ACTIVE
-// constant.
-const stillActiveExitCode uint32 = 259
-
-var terminateProcessForTest = terminateProcess
-
 // ConfigureChildProcessGroup is a no-op on Windows: process-tree termination is
 // delegated to execution.TerminateProcessTree, so no launch-time process-group
 // setup is required (the POSIX build sets Setpgid here instead).
@@ -25,28 +16,3 @@ func ConfigureChildProcessGroup(cmd *exec.Cmd) { execution.ConfigureProcessGroup
 func terminateProcess(pid int) error {
 	return execution.TerminateProcessTree(pid, 0, 0)
 }
-
-// terminateOwnedProcess asks taskkill /T to terminate the tree rooted at cmd,
-// with KillProcessTree's direct Process.Kill fallback if taskkill fails. taskkill
-// can discover descendants only while the root PID still exists; unlike a POSIX
-// process group, a Windows tree has no independently addressable identity after
-// its root exits.
-func terminateOwnedProcess(cmd *exec.Cmd) (bool, error) {
-	var (
-		alreadyExited bool
-		terminateErr  error
-	)
-	err := cmd.Process.WithHandle(func(handle uintptr) {
-		var exitCode uint32
-		if windows.GetExitCodeProcess(windows.Handle(handle), &exitCode) == nil {
-			alreadyExited = exitCode != stillActiveExitCode
-		}
-		// Keep the exact process identity pinned while the PID-based taskkill
-		// operation runs, preventing the PID from being recycled underneath it.
-		terminateErr = terminateProcessForTest(cmd.Process.Pid)
-	})
-	if err != nil {
-		return false, fmt.Errorf("pin process %d for termination: %w", cmd.Process.Pid, err)
-	}
-	return alreadyExited, terminateErr
-}
@@ -1,106 +0,0 @@
-//go:build windows
-
-package background
-
-import (
-	"bufio"
-	"errors"
-	"os/exec"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestTerminateCommandReturnsTreeFailureAfterRootFallbackReaps(t *testing.T) {
-	cmd := exec.Command("powershell.exe", "-NoProfile", "-NonInteractive", "-Command", "Start-Sleep -Seconds 300")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	treeErr := errors.New("taskkill /T failed")
-	originalTerminateProcess := terminateProcessForTest
-	terminateProcessForTest = func(pid int) error {
-		if err := cmd.Process.Kill(); err != nil {
-			return errors.Join(treeErr, err)
-		}
-		return treeErr
-	}
-	t.Cleanup(func() { terminateProcessForTest = originalTerminateProcess })
-
-	err := TerminateCommand(cmd)
-	if !errors.Is(err, treeErr) {
-		t.Fatalf("TerminateCommand error = %v, want tree failure", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("root process was not reaped")
-	}
-}
-
-func TestTerminateCommandReapsExitedLeader(t *testing.T) {
-	cmd := exec.Command("cmd.exe", "/c", "exit", "0")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	// Let the child exit without calling Wait so cleanup exercises the Windows
-	// taskkill/TerminateProcess race while it still owns the process handle.
-	time.Sleep(500 * time.Millisecond)
-
-	// jatmn's #774 finding: taskkill /T racing an already-exited PID (and the
-	// Process.Kill fallback) both fail here, but the reap below still succeeds —
-	// the process-handle exit-code check proves the leader was already gone, so
-	// TerminateCommand must not surface the expected kill-attempt error.
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v, want nil (leader was already gone and got reaped)", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("exited process was not reaped")
-	}
-}
-
-func TestTerminateCommandDeadLeaderCannotIdentifyDescendantTree(t *testing.T) {
-	cmd := exec.Command("powershell.exe", "-NoProfile", "-NonInteractive", "-Command",
-		`$p = Start-Process powershell.exe -ArgumentList '-NoProfile','-Command','Start-Sleep -Seconds 300' -PassThru; $p.Id`)
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		t.Fatalf("stdout pipe: %v", err)
-	}
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	line, err := bufio.NewReader(stdout).ReadString('\n')
-	if err != nil {
-		t.Fatalf("read descendant pid: %v", err)
-	}
-	descendantPID, err := strconv.Atoi(strings.TrimSpace(line))
-	if err != nil {
-		t.Fatalf("parse descendant pid %q: %v", line, err)
-	}
-	t.Cleanup(func() {
-		_ = exec.Command("taskkill.exe", "/F", "/PID", strconv.Itoa(descendantPID)).Run()
-	})
-
-	// Wait until the leader is observably exited but deliberately leave it
-	// unreaped, matching the POSIX regression's ordering.
-	deadline := time.Now().Add(5 * time.Second)
-	for processExistsOnWindows(cmd.Process.Pid) {
-		if time.Now().After(deadline) {
-			t.Fatal("leader did not exit")
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	if err := TerminateCommand(cmd); err != nil {
-		t.Fatalf("TerminateCommand: %v", err)
-	}
-
-	// Windows has no persistent group ID analogous to POSIX: once the leader is
-	// gone, taskkill /T cannot rediscover this descendant. Assert that platform
-	// distinction rather than claiming TerminateCommand can provide it here.
-	if !processExistsOnWindows(descendantPID) {
-		t.Fatal("descendant unexpectedly stopped after its root exited")
-	}
-}
-
-func processExistsOnWindows(pid int) bool {
-	return exec.Command("powershell.exe", "-NoProfile", "-NonInteractive", "-Command",
-		"Get-Process -Id "+strconv.Itoa(pid)+" -ErrorAction Stop | Out-Null").Run() == nil
-}
@@ -1,14 +1,5 @@
 package background

-import (
-	"errors"
-	"fmt"
-	"os/exec"
-	"time"
-)
-
-const commandReapTimeout = 3 * time.Second
-
 // TerminateProcess stops a background process by PID — on Windows its process
 // tree; on POSIX its whole process group when the PID leads its own group (the
 // invariant ConfigureChildProcessGroup establishes for processes started through
@@ -21,69 +12,3 @@ const commandReapTimeout = 3 * time.Second
 func TerminateProcess(pid int) error {
 	return terminateProcess(pid)
 }
-
-// TerminateCommand stops a started command and reaps its leader. The caller must
-// have exclusive ownership of cmd: it must not have previously called Wait or
-// Process.Release, and no goroutine may call either concurrently. On POSIX it
-// stops the whole group when the command was configured as its leader; ordinary
-// commands safely fall back to PID/tree discovery. On Windows, success for a
-// leader that was already dead confirms only that the leader was reaped;
-// descendants may survive because Windows cannot rediscover a tree from a dead
-// root. `zero daemon start` needs this operation when readiness times out: it
-// launched the child, so it must both stop the tree and collect the leader.
-//
-// The order matters: the tree is signalled first, because Wait releases the
-// leader's PID and a later group lookup could then resolve to nothing (or, worse,
-// to a recycled PID). Termination stays in the shared execution lifecycle
-// primitives rather than introducing a second platform-specific killer.
-//
-// If the bounded reap times out, the Wait call already started by this function
-// continues in its goroutine. From that point onward the caller must not access
-// cmd at all, including ProcessState, because that would race with Wait.
-func TerminateCommand(cmd *exec.Cmd) error {
-	if cmd == nil || cmd.Process == nil {
-		return errors.New("terminate command: process was never started")
-	}
-	leaderAlreadyExited, terminateErr := terminateOwnedProcess(cmd)
-	reapErr := waitForTerminatedCommandWithin(cmd, commandReapTimeout)
-	if reapErr != nil {
-		if terminateErr != nil {
-			return fmt.Errorf("%v (reap failed: %w)", terminateErr, reapErr)
-		}
-		return reapErr
-	}
-	if terminateErr != nil && !leaderAlreadyExited {
-		return terminateErr
-	}
-	// Only discard a termination error when the platform demonstrated before
-	// attempting termination that the leader had already exited. A successful
-	// reap alone says nothing about whether a live descendant tree was stopped.
-	return nil
-}
-
-// classifyWaitError treats a non-zero exit status as success: a process being
-// terminated is expected to report one (or a signal), so the only interesting
-// failure is Wait itself not working.
-func classifyWaitError(waitErr error) error {
-	var exitErr *exec.ExitError
-	if waitErr != nil && !errors.As(waitErr, &exitErr) {
-		return fmt.Errorf("reap process: %w", waitErr)
-	}
-	return nil
-}
-
-// waitForTerminatedCommandWithin bounds the reap so a child that somehow survives
-// termination cannot hang the caller — the daemon-start cleanup path runs while a
-// user waits at the CLI. On timeout its Wait goroutine is intentionally left to
-// finish: exec.Cmd permits only one Wait call, and abandoning it without a reaper
-// would leak the child once it eventually exits.
-func waitForTerminatedCommandWithin(cmd *exec.Cmd, timeout time.Duration) error {
-	waitDone := make(chan error, 1)
-	go func() { waitDone <- cmd.Wait() }()
-	select {
-	case waitErr := <-waitDone:
-		return classifyWaitError(waitErr)
-	case <-time.After(timeout):
-		return fmt.Errorf("process %d did not reap after termination", cmd.Process.Pid)
-	}
-}
@@ -64,53 +64,38 @@ type appDeps struct {
 	// getenv reads a process environment variable (production: os.Getenv, set in
 	// defaultAppDeps — deliberately NOT filled by fillAppDeps, so tests are hermetic
 	// against ambient vars like ZERO_PROVIDER unless they inject it). nil ⇒ empty.
-	getenv                       func(string) string
-	probeProviderHealth          func(context.Context, providerhealth.Options) providerhealth.Result
-	discoverProviderModels       func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error)
-	detectLocalRuntimes          func(context.Context, provideronboarding.LocalDetectOptions) []provideronboarding.DetectedLocalRuntime
-	openRouterLogin              func(context.Context, provideroauth.OpenRouterOptions) (string, error)
-	newSessionStore              func() *sessions.Store
-	loadPlugins                  func(plugins.LoadOptions) (plugins.LoadResult, error)
-	loadHooks                    func(hooks.LoadOptions) (hooks.LoadResult, error)
-	skillsDir                    func() string
-	pluginsDir                   func() string
-	toolsDir                     func() string
-	newMCPStore                  func() (*mcp.PermissionStore, error)
-	newMCPTokenStore             func() (*mcp.TokenStore, error)
-	newSandboxStore              func() (*sandbox.GrantStore, error)
-	selectSandboxBackend         func(sandbox.BackendOptions) sandbox.Backend
-	runSandboxSetupHelper        func(path string, args []string, stdout io.Writer, stderr io.Writer) error
-	registerMCPTools             func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error)
-	prepareWorktree              func(context.Context, worktrees.Options) (worktrees.Result, error)
-	releaseWorktree              func(context.Context, worktrees.Options, string) error
-	detectVerifyPlan             func(string) (verify.Plan, error)
-	runVerify                    func(context.Context, verify.Plan, verify.RunOptions) verify.Report
-	runSelfVerify                func(context.Context, verify.Plan, selfverify.Options) selfverify.Report
-	runAgentEval                 func(context.Context, agentEvalOptions) (agentEvalReport, error)
-	inspectChanges               func(context.Context, zerogit.InspectOptions) (zerogit.ChangeSummary, error)
-	commitChanges                func(context.Context, zerogit.CommitOptions) (zerogit.CommitResult, error)
-	pushChanges                  func(context.Context, zerogit.PushOptions) (zerogit.PushResult, error)
-	createPR                     func(context.Context, zerogit.PROptions) (zerogit.PRResult, error)
-	createBranch                 func(context.Context, zerogit.BranchOptions) (zerogit.BranchResult, error)
-	isDefaultBranch              func(context.Context, zerogit.DefaultBranchOptions) (bool, string, string, error)
-	currentGitUser               func(context.Context, string) string
-	headCommitSubject            func(context.Context, string) string
-	commitsAhead                 func(context.Context, string, string, string) (int, error)
-	isUnbornRemote               func(context.Context, string, string) (bool, error)
-	refreshTrackingRef           func(context.Context, string, string, string) error
-	branchUpstreamRemote         func(context.Context, string, string) string
-	branchUpstreamRemoteAndMerge func(context.Context, string, string) (string, string)
-	resolveRemoteBranchTip       func(context.Context, string, string, string) (string, error)
-	remoteHasBranch              func(context.Context, string, string, string) (bool, error)
-	currentGitBranch             func(context.Context, string) string
-	currentBranchTip             func(context.Context, string) string
-	deleteBranch                 func(context.Context, string, string, string) error
-	resetBranchRef               func(context.Context, string, string, string, string) error
-	runTUI                       func(context.Context, tui.Options) int
-	runEditor                    func(string) error
-	checkUpdate                  func(context.Context, update.Options) (update.Result, error)
-	applyUpdate                  func(context.Context, update.Options) (update.ApplyResult, error)
-	now                          func() time.Time
+	getenv                 func(string) string
+	probeProviderHealth    func(context.Context, providerhealth.Options) providerhealth.Result
+	discoverProviderModels func(context.Context, config.ProviderProfile) ([]providermodeldiscovery.Model, error)
+	detectLocalRuntimes    func(context.Context, provideronboarding.LocalDetectOptions) []provideronboarding.DetectedLocalRuntime
+	openRouterLogin        func(context.Context, provideroauth.OpenRouterOptions) (string, error)
+	newSessionStore        func() *sessions.Store
+	loadPlugins            func(plugins.LoadOptions) (plugins.LoadResult, error)
+	loadHooks              func(hooks.LoadOptions) (hooks.LoadResult, error)
+	skillsDir              func() string
+	pluginsDir             func() string
+	toolsDir               func() string
+	newMCPStore            func() (*mcp.PermissionStore, error)
+	newMCPTokenStore       func() (*mcp.TokenStore, error)
+	newSandboxStore        func() (*sandbox.GrantStore, error)
+	selectSandboxBackend   func(sandbox.BackendOptions) sandbox.Backend
+	runSandboxSetupHelper  func(path string, args []string, stdout io.Writer, stderr io.Writer) error
+	registerMCPTools       func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error)
+	prepareWorktree        func(context.Context, worktrees.Options) (worktrees.Result, error)
+	releaseWorktree        func(context.Context, worktrees.Options, string) error
+	detectVerifyPlan       func(string) (verify.Plan, error)
+	runVerify              func(context.Context, verify.Plan, verify.RunOptions) verify.Report
+	runSelfVerify          func(context.Context, verify.Plan, selfverify.Options) selfverify.Report
+	runAgentEval           func(context.Context, agentEvalOptions) (agentEvalReport, error)
+	inspectChanges         func(context.Context, zerogit.InspectOptions) (zerogit.ChangeSummary, error)
+	commitChanges          func(context.Context, zerogit.CommitOptions) (zerogit.CommitResult, error)
+	pushChanges            func(context.Context, zerogit.PushOptions) (zerogit.PushResult, error)
+	createPR               func(context.Context, zerogit.PROptions) (zerogit.PRResult, error)
+	runTUI                 func(context.Context, tui.Options) int
+	runEditor              func(string) error
+	checkUpdate            func(context.Context, update.Options) (update.Result, error)
+	applyUpdate            func(context.Context, update.Options) (update.ApplyResult, error)
+	now                    func() time.Time
 }

 type mcpToolRuntime interface {
@@ -213,52 +198,11 @@ func defaultAppDeps() appDeps {
 		commitChanges:    zerogit.Commit,
 		pushChanges:      zerogit.Push,
 		createPR:         zerogit.CreatePR,
-		createBranch:     zerogit.CreateBranch,
-		isDefaultBranch:  zerogit.IsDefaultBranch,
-		currentGitUser: func(ctx context.Context, cwd string) string {
-			return zerogit.CurrentGitUser(ctx, cwd, nil)
-		},
-		headCommitSubject: func(ctx context.Context, cwd string) string {
-			return zerogit.HeadCommitSubject(ctx, cwd, nil)
-		},
-		commitsAhead: func(ctx context.Context, cwd, remote, branch string) (int, error) {
-			return zerogit.CommitsAhead(ctx, cwd, remote, branch, nil)
-		},
-		isUnbornRemote: func(ctx context.Context, cwd, remote string) (bool, error) {
-			return zerogit.IsUnbornRemote(ctx, cwd, remote, nil)
-		},
-		refreshTrackingRef: func(ctx context.Context, cwd, remote, branch string) error {
-			return zerogit.RefreshTrackingRef(ctx, cwd, remote, branch, nil)
-		},
-		branchUpstreamRemote: func(ctx context.Context, cwd, branch string) string {
-			return zerogit.UpstreamRemote(ctx, cwd, branch, nil)
-		},
-		branchUpstreamRemoteAndMerge: func(ctx context.Context, cwd, branch string) (string, string) {
-			return zerogit.UpstreamRemoteAndMergeBranch(ctx, cwd, branch, nil)
-		},
-		resolveRemoteBranchTip: func(ctx context.Context, cwd, remote, branch string) (string, error) {
-			return zerogit.ResolveRemoteBranchTip(ctx, cwd, remote, branch, nil)
-		},
-		remoteHasBranch: func(ctx context.Context, cwd, remote, branch string) (bool, error) {
-			return zerogit.RemoteHasBranch(ctx, cwd, remote, branch, nil)
-		},
-		currentGitBranch: func(ctx context.Context, cwd string) string {
-			return zerogit.CurrentBranch(ctx, cwd, nil)
-		},
-		currentBranchTip: func(ctx context.Context, cwd string) string {
-			return zerogit.CurrentBranchTip(ctx, cwd, nil)
-		},
-		deleteBranch: func(ctx context.Context, cwd, fallbackBranch, branchToDelete string) error {
-			return zerogit.DeleteBranch(ctx, cwd, fallbackBranch, branchToDelete, nil)
-		},
-		resetBranchRef: func(ctx context.Context, cwd, branch, newTip, expectedOld string) error {
-			return zerogit.ResetBranchRef(ctx, cwd, branch, newTip, nil, expectedOld)
-		},
-		runTUI:      tui.Run,
-		runEditor:   openEditor,
-		checkUpdate: update.Check,
-		applyUpdate: update.Apply,
-		now:         time.Now,
+		runTUI:           tui.Run,
+		runEditor:        openEditor,
+		checkUpdate:      update.Check,
+		applyUpdate:      update.Apply,
+		now:              time.Now,
 	}
 }

@@ -618,45 +562,6 @@ func fillAppDeps(deps appDeps) appDeps {
 	if deps.createPR == nil {
 		deps.createPR = defaults.createPR
 	}
-	if deps.createBranch == nil {
-		deps.createBranch = defaults.createBranch
-	}
-	if deps.isDefaultBranch == nil {
-		deps.isDefaultBranch = defaults.isDefaultBranch
-	}
-	if deps.currentGitUser == nil {
-		deps.currentGitUser = defaults.currentGitUser
-	}
-	if deps.headCommitSubject == nil {
-		deps.headCommitSubject = defaults.headCommitSubject
-	}
-	if deps.commitsAhead == nil {
-		deps.commitsAhead = defaults.commitsAhead
-	}
-	if deps.isUnbornRemote == nil {
-		deps.isUnbornRemote = defaults.isUnbornRemote
-	}
-	if deps.refreshTrackingRef == nil {
-		deps.refreshTrackingRef = defaults.refreshTrackingRef
-	}
-	if deps.branchUpstreamRemote == nil {
-		deps.branchUpstreamRemote = defaults.branchUpstreamRemote
-	}
-	if deps.branchUpstreamRemoteAndMerge == nil {
-		deps.branchUpstreamRemoteAndMerge = defaults.branchUpstreamRemoteAndMerge
-	}
-	if deps.remoteHasBranch == nil {
-		deps.remoteHasBranch = defaults.remoteHasBranch
-	}
-	if deps.currentGitBranch == nil {
-		deps.currentGitBranch = defaults.currentGitBranch
-	}
-	if deps.currentBranchTip == nil {
-		deps.currentBranchTip = defaults.currentBranchTip
-	}
-	// resolveRemoteBranchTip, deleteBranch, and resetBranchRef stay nil when
-	// unset so unit tests that mock createBranch without a real git tree do not
-	// hit real git restore/delete commands.
 	if deps.runTUI == nil {
 		deps.runTUI = defaults.runTUI
 	}
@@ -856,7 +761,7 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 	// A server that could not be reached or validated is skipped, not fatal (one
 	// bad MCP server must not abort startup) — surface each so a missing tool set is
 	// explained rather than silently absent. A built-in default the user never
-	// configured (e.g. keyless Exa with no credentials) is the exception: it
+	// configured (e.g. keyless Firecrawl with no credentials) is the exception: it
 	// was never asked for, so its failure is not worth a startup warning — only
 	// servers the user actually configured warn on failure (issue #552).
 	for _, skipped := range mcpRuntime.Skipped() {
@@ -211,12 +211,12 @@ func TestTUIStartupSuppressesWarningForUnconfiguredDefaultServer(t *testing.T) {
 		},
 		resolveMCPConfig: func(workspaceRoot string, excludeProject bool) (config.MCPConfig, error) {
 			return config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-				"exa": config.DefaultMCPServers()["exa"],
+				"firecrawl": config.DefaultMCPServers()["firecrawl"],
 			}}, nil
 		},
 		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
 			return fakeMCPRuntimeWithSkips{skipped: []mcp.SkippedServer{
-				{Name: "exa", Err: errors.New("returned HTTP 401"), UnconfiguredDefault: true},
+				{Name: "firecrawl", Err: errors.New("returned HTTP 401"), UnconfiguredDefault: true},
 			}}, nil
 		},
 		runTUI: func(ctx context.Context, options tui.Options) int {
@@ -227,7 +227,7 @@ func TestTUIStartupSuppressesWarningForUnconfiguredDefaultServer(t *testing.T) {
 	if exitCode != 0 {
 		t.Fatalf("exitCode = %d stderr=%s", exitCode, stderr.String())
 	}
-	if strings.Contains(stderr.String(), "exa") {
+	if strings.Contains(stderr.String(), "firecrawl") {
 		t.Fatalf("stderr = %q, want no warning for an unconfigured default server", stderr.String())
 	}
 }
@@ -1,7 +1,6 @@
 package cli

 import (
-	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -161,61 +160,20 @@ func runDaemonStartDetached(paths daemon.Paths, stdout io.Writer, stderr io.Writ
 	cmd.Stdout = logFile
 	cmd.Stderr = logFile
 	background.ConfigureChildProcessGroup(cmd) // own process group: outlives this shell
-	if err := startAndAwaitDaemonProcess(cmd, func() bool { return daemonReachable(paths) }, 5*time.Second, 25*time.Millisecond); err != nil {
-		if errors.Is(err, errDaemonStartTimeout) {
-			return writeAppError(stderr, err.Error()+"; see "+logPath, exitCrash)
-		}
+	if err := cmd.Start(); err != nil {
 		return writeAppError(stderr, err.Error(), exitCrash)
 	}
-	fmt.Fprintf(stdout, "zero daemon started (socket %s)\n", paths.Socket)
-	return exitSuccess
-}
+	_ = cmd.Process.Release()

-var errDaemonStartTimeout = errors.New("daemon did not come up within timeout")
-
-func startAndAwaitDaemonProcess(cmd *exec.Cmd, reachable func() bool, timeout time.Duration, pollInterval time.Duration) error {
-	if err := cmd.Start(); err != nil {
-		return err
-	}
-	if waitForDaemonReadiness(reachable, timeout, pollInterval) {
-		if err := cmd.Process.Release(); err != nil {
-			cleanupErr := terminateAndReapDaemonProcess(cmd)
-			if cleanupErr != nil {
-				return fmt.Errorf("release daemon process: %w (cleanup failed: %v)", err, cleanupErr)
-			}
-			return fmt.Errorf("release daemon process: %w", err)
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if daemonReachable(paths) {
+			fmt.Fprintf(stdout, "zero daemon started (socket %s)\n", paths.Socket)
+			return exitSuccess
 		}
-		return nil
+		time.Sleep(25 * time.Millisecond)
 	}
-	if err := terminateAndReapDaemonProcess(cmd); err != nil {
-		return fmt.Errorf("%w; cleanup failed: %v", errDaemonStartTimeout, err)
-	}
-	return errDaemonStartTimeout
-}
-
-func waitForDaemonReadiness(reachable func() bool, timeout time.Duration, pollInterval time.Duration) bool {
-	deadline := time.Now().Add(timeout)
-	for {
-		if reachable() {
-			return true
-		}
-		remaining := time.Until(deadline)
-		if remaining <= 0 {
-			break
-		}
-		time.Sleep(min(pollInterval, remaining))
-	}
-	// The loop's last reachable() call already ran immediately before this one
-	// (right after the final Sleep, with the same deadline check separating
-	// them), so this adds no extra waiting time and is not a grace window for a
-	// slow-starting daemon — it only re-checks the same instant in case
-	// reachable() itself is non-deterministic. To tolerate a genuinely slow
-	// start, raise the timeout passed to startAndAwaitDaemonProcess instead.
-	return reachable()
-}
-
-func terminateAndReapDaemonProcess(cmd *exec.Cmd) error {
-	return background.TerminateCommand(cmd)
+	return writeAppError(stderr, "daemon did not come up within timeout; see "+logPath, exitCrash)
 }

 func runDaemonStop(args []string, stdout io.Writer, stderr io.Writer) int {
@@ -2,15 +2,8 @@ package cli

 import (
 	"bytes"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
 	"strings"
 	"testing"
-	"time"
-
-	"github.com/Gitlawb/zero/internal/background"
 )

 // isolateDaemonPaths points DefaultPaths at a temp dir so the test never touches
@@ -128,84 +121,3 @@ func TestDaemonSubcommandsRejectExtraArgs(t *testing.T) {
 		}
 	}
 }
-
-func TestWaitForDaemonReadinessChecksTimeoutBoundary(t *testing.T) {
-	checks := 0
-	ready := waitForDaemonReadiness(func() bool {
-		checks++
-		return checks == 2
-	}, 0, time.Millisecond)
-	if !ready {
-		t.Fatal("daemon that became reachable at the timeout boundary was not detected")
-	}
-	if checks != 2 {
-		t.Fatalf("reachability checks = %d, want initial and final checks", checks)
-	}
-}
-
-func TestTerminateAndReapDaemonProcess(t *testing.T) {
-	cmd := daemonDetachedChildCommand("hang")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start helper process: %v", err)
-	}
-
-	if err := terminateAndReapDaemonProcess(cmd); err != nil {
-		t.Fatalf("terminate and reap helper process: %v", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatalf("helper process was not reaped: state=%v", cmd.ProcessState)
-	}
-	if cmd.ProcessState.Success() {
-		t.Fatalf("helper process unexpectedly exited successfully: %v", cmd.ProcessState)
-	}
-}
-
-func TestStartAndAwaitDaemonProcessTimeoutTerminatesAndReaps(t *testing.T) {
-	cmd := daemonDetachedChildCommand("hang")
-	if err := startAndAwaitDaemonProcess(cmd, func() bool { return false }, 0, time.Millisecond); !errors.Is(err, errDaemonStartTimeout) {
-		t.Fatalf("start and await error = %v, want timeout", err)
-	}
-	if cmd.ProcessState == nil {
-		t.Fatal("timed-out helper process was not reaped")
-	}
-}
-
-func TestStartAndAwaitDaemonProcessReleasesReadyChild(t *testing.T) {
-	marker := filepath.Join(t.TempDir(), "child-finished")
-	cmd := daemonDetachedChildCommand("mark", "ZERO_TEST_DAEMON_CHILD_MARKER="+marker)
-	if err := startAndAwaitDaemonProcess(cmd, func() bool { return true }, time.Second, time.Millisecond); err != nil {
-		t.Fatalf("start and await ready helper: %v", err)
-	}
-
-	deadline := time.Now().Add(5 * time.Second)
-	for time.Now().Before(deadline) {
-		if _, err := os.Stat(marker); err == nil {
-			return
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	t.Fatal("released helper process did not remain alive to write its marker")
-}
-
-func daemonDetachedChildCommand(mode string, extraEnv ...string) *exec.Cmd {
-	cmd := exec.Command(os.Args[0], "-test.run=TestDaemonDetachedChildProcess")
-	cmd.Env = append(os.Environ(), "ZERO_TEST_DAEMON_DETACHED_CHILD="+mode)
-	cmd.Env = append(cmd.Env, extraEnv...)
-	background.ConfigureChildProcessGroup(cmd)
-	return cmd
-}
-
-func TestDaemonDetachedChildProcess(t *testing.T) {
-	switch os.Getenv("ZERO_TEST_DAEMON_DETACHED_CHILD") {
-	case "":
-		return
-	case "mark":
-		if err := os.WriteFile(os.Getenv("ZERO_TEST_DAEMON_CHILD_MARKER"), []byte("ready"), 0o600); err != nil {
-			os.Exit(2)
-		}
-		os.Exit(0)
-	}
-	for {
-		time.Sleep(time.Hour)
-	}
-}
@@ -9,15 +9,15 @@ import (
 	"github.com/Gitlawb/zero/internal/config"
 )

-// `zero mcp disable exa` must work even though exa is a built-in
+// `zero mcp disable firecrawl` must work even though firecrawl is a built-in
 // default that is not written to the user's config file until overridden.
-func TestRunMCPDisableSeededExaDefault(t *testing.T) {
+func TestRunMCPDisableSeededFirecrawlDefault(t *testing.T) {
 	configPath := filepath.Join(t.TempDir(), "zero", "config.json")
-	// A config with no Exa entry — the default lives in code, not the file.
+	// A config with no firecrawl entry — the default lives in code, not the file.
 	writeMCPCommandRawConfig(t, configPath, `{"activeProvider":"fast"}`)

 	var out, errBuf bytes.Buffer
-	code := runWithDeps([]string{"mcp", "disable", "exa", "--json"}, &out, &errBuf, appDeps{
+	code := runWithDeps([]string{"mcp", "disable", "firecrawl", "--json"}, &out, &errBuf, appDeps{
 		userConfigPath: func() (string, error) { return configPath, nil },
 	})
 	if code != exitSuccess {
@@ -31,8 +31,8 @@ func TestRunMCPDisableSeededExaDefault(t *testing.T) {
 	if err := json.Unmarshal(out.Bytes(), &payload); err != nil {
 		t.Fatalf("decode disable JSON: %v\n%s", err, out.String())
 	}
-	if payload.ServerName != "exa" || !payload.Disabled || !payload.Changed {
-		t.Fatalf("disable payload = %#v, want exa disabled+changed", payload)
+	if payload.ServerName != "firecrawl" || !payload.Disabled || !payload.Changed {
+		t.Fatalf("disable payload = %#v, want firecrawl disabled+changed", payload)
 	}

 	// End-to-end: resolving that config now turns the default off.
@@ -40,7 +40,7 @@ func TestRunMCPDisableSeededExaDefault(t *testing.T) {
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	if !cfg.Servers["exa"].Disabled {
-		t.Fatal("expected `mcp disable exa` to turn the seeded default off in the resolved config")
+	if !cfg.Servers["firecrawl"].Disabled {
+		t.Fatal("expected `mcp disable firecrawl` to turn the seeded default off in the resolved config")
 	}
 }
@@ -2,12 +2,9 @@ package cli

 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
-	"path"
 	"path/filepath"
-	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -605,20 +602,18 @@ func parseChangesArgs(args []string, command string) (changesCommandOptions, boo
 			return options, false, execUsageError{fmt.Sprintf("unexpected changes argument %q", arg)}
 		}
 	}
-	if command != "commit" && options.hasMessage {
+	if command != "commit" && options.message != "" {
 		return options, false, execUsageError{"--message is only valid with `zero changes commit`"}
 	}
+	if command != "commit" && (options.hasMessage || options.dryRun || options.auto) {
+		return options, false, execUsageError{"--message, --dry-run, and --auto are only valid with `zero changes commit`"}
+	}
 	if command == "commit" && options.hasMessage && options.auto {
 		return options, false, execUsageError{"cannot specify both --message and --auto"}
 	}
 	if command != "commit" && command != "push" && options.dryRun {
 		return options, false, execUsageError{"--dry-run is only valid with commit or push"}
 	}
-	// --auto on push/pr is the explicit opt-in for LLM branch naming (see
-	// ensureFeatureBranch); on commit it opts into the LLM commit message.
-	if command != "commit" && command != "push" && command != "pr" && options.auto {
-		return options, false, execUsageError{"--auto is only valid with commit, push, or pr"}
-	}
 	if command != "inspect" && options.baseRef != "" {
 		return options, false, execUsageError{"--base is only valid with `zero changes inspect`"}
 	}
@@ -939,7 +934,8 @@ Flags:
      --fill              Automatically populate PR title and body from commits
      --draft             Create PR as a draft
      --yes               Confirm pushing to a default/protected branch
-  -a, --auto              Use the LLM: commit generates the message, push/pr name the auto-created branch (sends the diff to the provider)
+  -a, --auto              Auto-generate commit message using LLM (use --dry-run to preview)
+      --dry-run           Preview commit metadata without mutating git state
      --json              Print JSON output
  -h, --help              Show this help
 `)
@@ -962,31 +958,11 @@ func runChangesPush(args []string, stdout io.Writer, stderr io.Writer, deps appD
 		return writeExecUsageError(stderr, err.Error())
 	}

-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	defer cancel()
-
-	branch, remote, created, err := ensureFeatureBranch(ctx, stdout, workspaceRoot, options.remote, featureBranchOptions{
-		JSONMode:           options.json,
-		AllowDefaultBranch: options.yes,
-		DryRun:             options.dryRun,
-		AutoNaming:         options.auto,
-		MaxDiffBytes:       options.maxDiffBytes,
-	}, deps)
-	if err != nil {
-		return writeExecUsageError(stderr, err.Error())
-	}
-
-	// context.Background() is deliberate: the 2-minute ctx above is the
-	// feature-branch preflight (inspection, remote probes, branch creation).
-	// The push itself must not be cancelled mid-transfer just because the
-	// preflight budget elapsed; a large push can legitimately take longer.
 	result, err := deps.pushChanges(context.Background(), zerogit.PushOptions{
 		Cwd:                    workspaceRoot,
-		Remote:                 firstNonEmptyString(options.remote, remote),
-		Branch:                 branch,
+		Remote:                 options.remote,
 		Force:                  options.force,
 		DryRun:                 options.dryRun,
-		RequireNewRemoteBranch: created,
 		AllowPushDefaultBranch: options.yes,
 	})
 	if err != nil {
@@ -1034,62 +1010,15 @@ func runChangesPR(args []string, stdout io.Writer, stderr io.Writer, deps appDep
 		return writeExecUsageError(stderr, err.Error())
 	}

-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	defer cancel()
-
-	branch, remote, created, err := ensureFeatureBranch(ctx, stdout, workspaceRoot, options.remote, featureBranchOptions{
-		JSONMode:           options.json,
-		AllowDefaultBranch: options.yes,
-		DryRun:             false,
-		AutoNaming:         options.auto,
-		MaxDiffBytes:       options.maxDiffBytes,
-	}, deps)
-	if err != nil {
-		return writeExecUsageError(stderr, err.Error())
-	}
-
-	// Resolve the target remote for the unborn-remote check. Explicit --remote wins,
-	// followed by the remote resolved by ensureFeatureBranch. When --yes is set,
-	// fall back to the branch upstream or "origin".
-	targetRemote := strings.TrimSpace(options.remote)
-	if targetRemote == "" {
-		targetRemote = remote
-	}
-	if targetRemote == "" {
-		currentBranch := ""
-		if deps.currentGitBranch != nil {
-			currentBranch = deps.currentGitBranch(context.Background(), workspaceRoot)
-		}
-		if deps.branchUpstreamRemote != nil && currentBranch != "" {
-			targetRemote = deps.branchUpstreamRemote(context.Background(), workspaceRoot, currentBranch)
-		}
-		if targetRemote == "" {
-			targetRemote = "origin"
-		}
-	}
-
-	// Probe errors are intentionally ignored so the flow can continue; if the
-	// probe fails, the subsequent push or PR operation provides fail-closed behavior.
-	if deps.isUnbornRemote != nil {
-		if unborn, unbornErr := deps.isUnbornRemote(context.Background(), workspaceRoot, targetRemote); unbornErr == nil && unborn {
-			return writeExecUsageError(stderr, fmt.Sprintf("cannot create pull request on unborn remote %s: push the initial default branch first", targetRemote))
-		}
-	}
-
 	if !options.json {
 		if _, err := fmt.Fprintln(stdout, "Pushing current branch to set upstream..."); err != nil {
 			return exitCrash
 		}
 	}
-	// context.Background() is deliberate here too: runChangesPR reuses the
-	// 2-minute ctx for preflight (branch creation and remote probes), but the
-	// push must not be cancelled mid-transfer if that budget elapsed.
 	pushResult, err := deps.pushChanges(context.Background(), zerogit.PushOptions{
 		Cwd:                    workspaceRoot,
-		Remote:                 firstNonEmptyString(options.remote, remote),
-		Branch:                 branch,
+		Remote:                 options.remote,
 		Force:                  options.force,
-		RequireNewRemoteBranch: created,
 		AllowPushDefaultBranch: options.yes,
 	})
 	if err != nil {
@@ -1171,462 +1100,3 @@ func generateAutoCommitMessage(ctx context.Context, provider zeroruntime.Provide
 	}
 	return msg, nil
 }
-
-type featureBranchOptions struct {
-	JSONMode           bool
-	AllowDefaultBranch bool
-	DryRun             bool
-	AutoNaming         bool
-	MaxDiffBytes       int
-}
-
-// branchPushPlan holds the resolved parameters for a push or PR workflow
-// before any branches are created or refs mutated. Separating plan resolution
-// from mutation allows tests to assert the resolution matrix directly without
-// touching a git repository.
-type branchPushPlan struct {
-	ShouldBranch           bool
-	CurrentBranch          string
-	PushRemote             string
-	RequireNewRemoteBranch bool
-	TrackingRemote         string
-	TrackingBranch         string
-	RestoreTip             string
-	PublishabilityBase     string
-	Summary                zerogit.ChangeSummary
-	Slug                   string
-}
-
-// resolveBranchPushPlan resolves the branch, remotes, restore tip, and naming
-// slug for changes push / pr workflows. It performs all checks (clean working
-// tree, unborn remote detection, ahead count, restore tip resolution) but
-// executes no mutation (no branch creation, ref resets, or deletions).
-func resolveBranchPushPlan(ctx context.Context, stdout io.Writer, workspaceRoot string, requestedRemote string, opts featureBranchOptions, deps appDeps) (branchPushPlan, error) {
-	if opts.AllowDefaultBranch || opts.DryRun {
-		return branchPushPlan{
-			ShouldBranch:           false,
-			PushRemote:             strings.TrimSpace(requestedRemote),
-			RequireNewRemoteBranch: false,
-		}, nil
-	}
-
-	if deps.isDefaultBranch == nil {
-		return branchPushPlan{}, fmt.Errorf("isDefaultBranch dependency missing")
-	}
-	isDefault, currentBranch, remote, err := deps.isDefaultBranch(ctx, zerogit.DefaultBranchOptions{Cwd: workspaceRoot, Remote: requestedRemote})
-	if err != nil {
-		return branchPushPlan{}, err
-	}
-	if !isDefault {
-		// Whether this push needs the nonexistence lease is decided by one
-		// live check against the destination remote, not by inference from
-		// local git state (upstream config, a generated-branch marker):
-		// every local signal that stood in for that check turned out to be
-		// wrong in some ordering (inherited config from checkout -b, a
-		// config write that failed after a successful push, a push aimed at
-		// a different remote than the one local config describes). A branch
-		// missing on the remote gets the nonexistence lease, protecting a
-		// concurrent creator of the same name; a branch already there gets a
-		// plain push, and git's own fast-forward check is the safety net —
-		// if the remote history isn't ours, the push fails with a clear
-		// non-fast-forward error instead of an attempted silent recovery.
-		if deps.remoteHasBranch == nil {
-			return branchPushPlan{
-				ShouldBranch:           false,
-				CurrentBranch:          currentBranch,
-				PushRemote:             remote,
-				RequireNewRemoteBranch: true,
-			}, nil
-		}
-		targetRemote := firstNonEmptyString(requestedRemote, remote)
-		exists, existsErr := deps.remoteHasBranch(ctx, workspaceRoot, targetRemote, currentBranch)
-		if existsErr != nil {
-			return branchPushPlan{}, fmt.Errorf("cannot check whether %s already exists on remote %s: %w", currentBranch, targetRemote, existsErr)
-		}
-		return branchPushPlan{
-			ShouldBranch:           false,
-			CurrentBranch:          currentBranch,
-			PushRemote:             remote,
-			RequireNewRemoteBranch: !exists,
-		}, nil
-	}
-
-	// CreateBranch and Push publish commits only. A dirty working tree would
-	// leave uncommitted edits behind under a branch/PR that does not include
-	// them, so refuse until the tree is clean (commit or stash first).
-	workingTree, err := deps.inspectChanges(ctx, zerogit.InspectOptions{Cwd: workspaceRoot})
-	if err != nil {
-		return branchPushPlan{}, fmt.Errorf("failed to inspect working tree: %w", err)
-	}
-	if !workingTree.Clean {
-		return branchPushPlan{}, fmt.Errorf("working tree has uncommitted changes; commit or stash them before pushing from the default branch")
-	}
-
-	// Capture the source default branch's own upstream before refreshing or
-	// leaving it. --remote selects the push destination; restore must not
-	// rewrite local main to upstream/main when main still tracks origin/main
-	// (fork setups), and refreshing must update the exact tracking ref that
-	// will supply both the ahead count and the restore target.
-	trackingRemote := remote
-	trackingBranch := currentBranch
-	if deps.branchUpstreamRemoteAndMerge != nil {
-		if r, m := deps.branchUpstreamRemoteAndMerge(ctx, workspaceRoot, currentBranch); r != "" && m != "" {
-			trackingRemote = r
-			trackingBranch = m
-		}
-	}
-
-	// Refresh the local remote-tracking ref before trusting it: IsDefaultBranch
-	// already contacted the remote for its symref check, but the tracking ref
-	// commitsAhead reads from is only a local cache (written at clone or the
-	// last fetch) and can sit behind the remote's live tip. Left stale, a real
-	// publishable range could look like zero commits ahead, and the diff
-	// derived below (which reuses this same ref as its base) would be stale
-	// too. A failure here (offline, or a genuinely unborn remote with no such
-	// ref to fetch yet) is folded into the same fail-closed path as an
-	// unresolvable ahead count below.
-	var fetchErr error
-	if deps.refreshTrackingRef != nil {
-		fetchErr = deps.refreshTrackingRef(ctx, workspaceRoot, trackingRemote, trackingBranch)
-	}
-
-	// The ahead check gates on the source upstream (trackingRemote), but the
-	// feature branch is pushed to `pushRemote`, which can be a different
-	// destination (--remote on a fork). Refuse to auto-branch onto an unborn
-	// destination: without an initial default branch the new feature branch
-	// becomes the destination's first ref and its HEAD is left pointing at it.
-	// This is checked once, here, against the push destination, before resolving
-	// commit tips or creating any branches.
-	pushRemote := firstNonEmptyString(requestedRemote, remote)
-	if deps.isUnbornRemote != nil {
-		if unbornDest, unbornDestErr := deps.isUnbornRemote(ctx, workspaceRoot, pushRemote); unbornDestErr == nil && unbornDest {
-			return branchPushPlan{}, fmt.Errorf("remote %s has no branches yet; push the initial default branch first with --yes (`zero changes push --yes`), then use auto-branching for subsequent work", pushRemote)
-		}
-	}
-
-	// Branching off the default branch only makes sense when HEAD carries a
-	// commit that is not already on the remote default branch. A clean,
-	// up-to-date default branch would otherwise publish a feature branch at the
-	// exact default tip. If the ahead count cannot be determined (for example
-	// the remote-tracking ref was never fetched), fail rather than guess. When
-	// the remote is confirmed unborn, refuse auto-branching entirely: the
-	// initial default branch must be established first (changes push --yes)
-	// so the remote has a real HEAD before any feature branch is published.
-	ahead, aheadErr := deps.commitsAhead(ctx, workspaceRoot, trackingRemote, trackingBranch)
-	if fetchErr != nil || aheadErr != nil {
-		var unbornRemote bool
-		var unbornErr error
-		if deps.isUnbornRemote != nil {
-			unbornRemote, unbornErr = deps.isUnbornRemote(ctx, workspaceRoot, trackingRemote)
-		}
-		if unbornErr == nil && unbornRemote {
-			return branchPushPlan{}, fmt.Errorf("remote %s has no branches yet; push the initial default branch first with --yes (`zero changes push --yes`), then use auto-branching for subsequent work", trackingRemote)
-		}
-		cause := aheadErr
-		if cause == nil {
-			cause = fetchErr
-		}
-		return branchPushPlan{}, fmt.Errorf("cannot determine whether HEAD is ahead of %s/%s: %w; fetch the remote tracking branch first", trackingRemote, trackingBranch, cause)
-	}
-	if ahead == 0 {
-		return branchPushPlan{}, fmt.Errorf("no changes to publish: HEAD is not ahead of %s/%s; commit your work before pushing", trackingRemote, trackingBranch)
-	}
-
-	// Resolve the restore tip to a concrete commit before creating any branch.
-	// It must never be a bare local branch name: resolving "main" yields the
-	// very commit the feature branch is about to own, so restore becomes a
-	// silent no-op and the publishable commits stay on the default branch. A
-	// named remote resolves through its just-refreshed remote-tracking ref; a
-	// direct URL or path asks the remote itself. Fail closed rather than
-	// substitute a local branch name.
-	restoreTip := ""
-	if deps.resolveRemoteBranchTip != nil {
-		tip, tipErr := deps.resolveRemoteBranchTip(ctx, workspaceRoot, trackingRemote, trackingBranch)
-		if tipErr != nil {
-			return branchPushPlan{}, fmt.Errorf("cannot resolve restore tip for %s/%s: %w", trackingRemote, trackingBranch, tipErr)
-		}
-		restoreTip = tip
-	}
-	if restoreTip == "" {
-		restoreTip = trackingRemote + "/" + trackingBranch
-	}
-
-	// Name the branch (and, with --auto, send the provider) from what HEAD is
-	// actually ahead of the resolved remote branch by, using the same ref
-	// commitsAhead just checked. A working-tree snapshot can describe edits a
-	// commit-only push will never include.
-	baseRef := restoreTip
-	summary, err := deps.inspectChanges(ctx, zerogit.InspectOptions{Cwd: workspaceRoot, BaseRef: baseRef, MaxDiffBytes: opts.MaxDiffBytes})
-	if err != nil {
-		return branchPushPlan{}, fmt.Errorf("failed to inspect changes: %w", err)
-	}
-
-	slug := fallbackBranchSlug(summary)
-	if len(summary.Files) == 0 {
-		// An empty commit (or one whose only content the diff omits) leaves
-		// nothing to derive a slug from; name the branch from the commit
-		// subject instead.
-		if subject := deps.headCommitSubject(ctx, workspaceRoot); subject != "" {
-			slug = zerogit.SlugifyBranchComponent(subject)
-		}
-	}
-	if opts.AutoNaming && strings.TrimSpace(summary.Diff) != "" {
-		llmSlug := ""
-		if resolved, cfgErr := deps.resolveConfig(workspaceRoot, config.Overrides{}); cfgErr == nil && config.HasProviderProfile(resolved.Provider) {
-			if provider, provErr := deps.newProvider(resolved.Provider); provErr == nil {
-				if !opts.JSONMode {
-					fmt.Fprintln(stdout, "Generating branch name using LLM...")
-				}
-				genCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
-				generated, genErr := generateAutoBranchSlug(genCtx, provider, resolved.Provider.Model, redactChangeSummary(summary))
-				cancel()
-				if genErr == nil && generated != "" {
-					llmSlug = generated
-				}
-			}
-		}
-		if llmSlug != "" {
-			slug = llmSlug
-		} else if !opts.JSONMode {
-			// Cover resolveConfig failures, missing provider profiles,
-			// newProvider errors, generation errors, and empty results so the
-			// user is not left guessing after "Generating..." or silence.
-			fmt.Fprintln(stdout, "LLM branch naming unavailable; using deterministic name.")
-		}
-	}
-
-	return branchPushPlan{
-		ShouldBranch:           true,
-		CurrentBranch:          currentBranch,
-		PushRemote:             pushRemote,
-		RequireNewRemoteBranch: true,
-		TrackingRemote:         trackingRemote,
-		TrackingBranch:         trackingBranch,
-		RestoreTip:             restoreTip,
-		PublishabilityBase:     baseRef,
-		Summary:                summary,
-		Slug:                   slug,
-	}, nil
-}
-
-// ensureFeatureBranch is the branch-naming step `zero changes push`/`pr` run
-// before pushing: pushing straight to the default branch is refused deeper in
-// zerogit.Push, so rather than surface that as a dead end, create and switch
-// to a conventionally named "<user>/<slug>" branch first. It returns the
-// branch push/pr should target, or "" to mean "current HEAD branch, unchanged"
-// (zerogit.Push already treats an empty Branch that way), plus the remote the
-// preflight resolved (requestedRemote, then the original branch's configured
-// upstream, then "origin"), plus whether Push should require that branch not
-// already exist on that remote. Callers must pass the remote to Push: a
-// freshly created branch has no tracking configuration, so Push's own
-// fallback would silently retarget "origin" even when the work came from a
-// branch tracking a different remote. Callers must also pass that third value
-// through as Push's RequireNewRemoteBranch: CreateBranch's own
-// remote-collision probe runs before this returns, and closing that race
-// requires Push's push itself to assert the destination is still new. That
-// requirement also carries across a retry: if the current branch is already
-// non-default (this call didn't create it) but has not been successfully
-// published to the exact target remote under the same branch name, keep the
-// nonexistence lease. branch.<name>.remote alone is not enough: with
-// branch.autoSetupMerge=inherit, checkout -b copies remote=origin from the
-// source branch before any push. After a successful create, the original
-// default branch ref is moved back to its own upstream tip (not necessarily
-// the push destination) so the feature branch exclusively owns the
-// publishable commits; a failed restore rolls the feature branch back.
-// allowDefaultBranch (the --yes flag) and dryRun both opt out via the ""
-// branch / false return, leaving Push's own guard/preview behavior on the
-// default branch unaffected.
-//
-// autoNaming gates the LLM naming path (--auto): these commands were
-// git-only, and sending the change diff to a configured provider on every
-// default-branch push would silently export source code nobody asked to
-// share. Without the opt-in the name comes from deterministic local
-// information only. maxDiffBytes caps the committed-range diff Inspect
-// returns, so a user who passed --diff-bytes to bound the proprietary source
-// sent for LLM naming has that cap honored here just as the commit path does.
-// The working tree must be clean and HEAD must be ahead of the resolved
-// remote branch; both are verified before any branch is created. The
-// inspectChanges, commitsAhead, headCommitSubject, currentGitUser, and
-// createBranch dependencies are required on the default-branch path and are
-// called without nil guards; fillAppDeps populates all of them. The
-// refreshTrackingRef, resolveRemoteBranchTip, isUnbornRemote, resetBranchRef,
-// and deleteBranch dependencies are optional and are skipped when nil.
-func ensureFeatureBranch(ctx context.Context, stdout io.Writer, workspaceRoot string, requestedRemote string, opts featureBranchOptions, deps appDeps) (string, string, bool, error) {
-	plan, err := resolveBranchPushPlan(ctx, stdout, workspaceRoot, requestedRemote, opts, deps)
-	if err != nil {
-		return "", "", false, err
-	}
-	if !plan.ShouldBranch {
-		return plan.CurrentBranch, plan.PushRemote, plan.RequireNewRemoteBranch, nil
-	}
-
-	expectedRestoreTip := ""
-	if deps.currentBranchTip != nil {
-		expectedRestoreTip = deps.currentBranchTip(ctx, workspaceRoot)
-	}
-
-	name := zerogit.BuildBranchName(deps.currentGitUser(ctx, workspaceRoot), plan.Slug)
-	result, err := deps.createBranch(ctx, zerogit.BranchOptions{Cwd: workspaceRoot, Name: name, Remote: plan.PushRemote})
-	if err != nil {
-		return "", "", false, fmt.Errorf("failed to create branch: %w", err)
-	}
-	// The normal flow commits on the default branch first, then creates the
-	// feature branch at the same HEAD. Without moving the original default
-	// ref back, local main keeps the pre-squash commits and diverges from
-	// its upstream after a squash-merge (and a later pull/push can re-publish
-	// them). Once the feature branch owns those commits, restore the default
-	// branch to the source branch's own upstream tip captured above.
-	// Failure-safe: if the restore fails, delete the feature branch and
-	// check the default branch back out so the tree is not left half-moved.
-	if deps.resetBranchRef != nil {
-		if err := deps.resetBranchRef(ctx, workspaceRoot, plan.CurrentBranch, plan.RestoreTip, expectedRestoreTip); err != nil {
-			// A compare-and-swap conflict means the default branch moved
-			// while we were branching, so restoreTip is no longer the tip we
-			// meant to restore. The rollback below deletes the branch that
-			// now exclusively owns the user's commits, which would destroy
-			// work to recover from a race we can simply report. Keep the
-			// branch and let the user reconcile the default branch.
-			if errors.Is(err, zerogit.ErrCompareAndSwapConflict) {
-				return "", "", false, fmt.Errorf("failed to restore default branch %s to %s after auto-branching: %w; generated branch %s was preserved because the default branch changed concurrently", plan.CurrentBranch, plan.RestoreTip, err, result.Branch)
-			}
-			var rollbackErr error
-			if deps.deleteBranch != nil {
-				rollbackErr = deps.deleteBranch(ctx, workspaceRoot, plan.CurrentBranch, result.Branch)
-			}
-			if rollbackErr != nil {
-				return "", "", false, fmt.Errorf("failed to restore default branch %s to %s after auto-branching: %w; rollback of %s also failed: %v", plan.CurrentBranch, plan.RestoreTip, err, result.Branch, rollbackErr)
-			}
-			return "", "", false, fmt.Errorf("failed to restore default branch %s to %s after auto-branching: %w", plan.CurrentBranch, plan.RestoreTip, err)
-		}
-	}
-	if !opts.JSONMode {
-		fmt.Fprintf(stdout, "Created branch %s (was on %s)\n", result.Branch, plan.CurrentBranch)
-	}
-	return result.Branch, plan.PushRemote, true, nil
-}
-
-// fallbackBranchSlug derives a deterministic branch-name slug from a change
-// summary without calling an LLM, so ensureFeatureBranch still works when no
-// provider is configured.
-func fallbackBranchSlug(summary zerogit.ChangeSummary) string {
-	switch len(summary.Files) {
-	case 0:
-		return "changes"
-	case 1:
-		// Git paths are always slash-separated regardless of platform, so
-		// path.Base (not filepath.Base) extracts the filename portably.
-		return zerogit.SlugifyBranchComponent(path.Base(summary.Files[0].Path))
-	default:
-		return fmt.Sprintf("update-%d-files", len(summary.Files))
-	}
-}
-
-// generateAutoBranchSlug asks the model for a short kebab-case slug
-// describing the diff, mirroring generateAutoCommitMessage's prompt shape.
-func generateAutoBranchSlug(ctx context.Context, provider zeroruntime.Provider, model string, summary zerogit.ChangeSummary) (string, error) {
-	var promptBuilder strings.Builder
-	promptBuilder.WriteString("Analyze the following git diff and generate a short git branch name slug for it.\n")
-	promptBuilder.WriteString("The slug must be 2 to 5 lowercase words separated by hyphens (kebab-case), using only letters, digits, and hyphens, with no prefix like \"feature/\" or \"fix/\" and no surrounding quotes.\n")
-	promptBuilder.WriteString("Output ONLY the raw slug text, nothing else.\n\n")
-	promptBuilder.WriteString("Git Diff:\n")
-	promptBuilder.WriteString(summary.Diff)
-
-	request := zeroruntime.CompletionRequest{
-		Messages: []zeroruntime.Message{
-			{Role: zeroruntime.MessageRoleUser, Content: promptBuilder.String()},
-		},
-	}
-	stream, err := provider.StreamCompletion(ctx, request)
-	if err != nil {
-		return "", err
-	}
-	collected := zeroruntime.CollectStream(ctx, stream)
-	if collected.Error != "" {
-		return "", fmt.Errorf("%s", collected.Error)
-	}
-
-	slug := zerogit.SlugifyBranchComponent(extractBranchSlug(collected.Text))
-	if slug == "" {
-		return "", fmt.Errorf("provider returned empty branch slug")
-	}
-	return slug, nil
-}
-
-// slugLineRe matches a line that already reads as a kebab-case slug (letters,
-// digits, and internal single hyphens only). extractBranchSlug prefers such a
-// line so a preamble sentence is never mistaken for the slug.
-var slugLineRe = regexp.MustCompile(`^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$`)
-
-func isPreambleText(s string) bool {
-	lower := strings.ToLower(strings.TrimSpace(s))
-	if strings.HasSuffix(lower, ":") || strings.HasSuffix(lower, ".") || strings.HasSuffix(lower, "!") || strings.HasSuffix(lower, "?") {
-		return true
-	}
-	preambles := []string{
-		"here is", "here's", "below is", "below are", "sure", "certainly",
-		"i suggest", "suggested branch", "branch name", "recommended branch",
-		"how about", "you could use",
-	}
-	for _, p := range preambles {
-		if strings.HasPrefix(lower, p) {
-			return true
-		}
-	}
-	return false
-}
-
-// extractBranchSlug pulls the intended slug out of a model response that didn't
-// follow the "output only the raw slug" instruction exactly. It drops Markdown
-// code-fence lines, then prefers a line that already looks like a kebab-case
-// slug: that skips a leading preamble such as "Here is a suggested branch
-// name:" in favor of the "add-login-page" line that follows it. One-word
-// acknowledgements that happen to match the slug regex ("Sure", "Certainly")
-// are filtered as preamble before the early return, so "Sure\nadd login page"
-// yields the real suggestion. Inline labeled forms ("Branch name: add-login-page")
-// still work: the preamble check runs on the extracted value after the label
-// is stripped. If no line is strictly kebab-cased, it prefers a plausible
-// non-preamble line so plain multi-word replies still slugify correctly.
-func extractBranchSlug(text string) string {
-	var firstLine string
-
-	for _, line := range strings.Split(text, "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "```") {
-			continue
-		}
-		line = strings.TrimSpace(strings.Trim(line, `"'`))
-		if line == "" {
-			continue
-		}
-
-		candidate := line
-		if idx := strings.Index(line, ":"); idx != -1 {
-			after := strings.TrimSpace(strings.Trim(line[idx+1:], `"'`))
-			if after != "" {
-				candidate = after
-			}
-		}
-		// Models often terminate a suggestion with sentence punctuation;
-		// strip it so "add login page." is recovered as the slug rather than
-		// rejected as preamble (isPreambleText treats a trailing '.' as a
-		// full sentence). True preamble lines still match the prefix list.
-		candidate = strings.TrimSpace(strings.TrimRight(candidate, ".!?"))
-		if candidate == "" {
-			continue
-		}
-
-		// Preamble classification runs before accepting a slug-shaped line so
-		// "Sure" does not win over a later "add-login-page". The check is on
-		// candidate (post label-strip) so "Branch name: add-login-page" still
-		// returns the extracted slug.
-		if slugLineRe.MatchString(candidate) && !isPreambleText(candidate) {
-			return candidate
-		}
-
-		if firstLine == "" && !isPreambleText(candidate) {
-			firstLine = candidate
-		}
-	}
-
-	return firstLine
-}
@@ -105,17 +105,7 @@ func TestLoadProviderCommandTimeout(t *testing.T) {
 //
 // This is a hang-breaker, not a tuned margin. Nothing in a healthy run waits on
 // it, since both tests return about one WaitDelay after the fixture exits.
-const (
-	providerCommandTestBudget        = 90 * time.Second
-	providerCommandReadyWaitAttempts = 45
-)
-
-func TestProviderCommandBudgetLeavesCleanupMargin(t *testing.T) {
-	readyWaitCeiling := time.Duration(providerCommandReadyWaitAttempts) * time.Second
-	if providerCommandTestBudget < 2*readyWaitCeiling {
-		t.Fatalf("provider command test budget %s leaves less than one readiness window for cleanup after %s", providerCommandTestBudget, readyWaitCeiling)
-	}
-}
+const providerCommandTestBudget = 60 * time.Second

 // backgroundChildLifetime must exceed providerCommandTestBudget so that a child
 // dying of old age is unobservable: any run where runProviderCommand has not
@@ -351,15 +341,15 @@ func writeCommand(t *testing.T, script commandScript) string {
 			// assertion fail is far more diagnosable than blocking until the
 			// timeout fires and reporting an unrelated error. Each iteration is
 			// about a second, since `ping -n 2` sleeps between its two echoes,
-			// so the ceiling is roughly 45s: enough for a heavily loaded Windows
-			// runner while leaving the other half of providerCommandTestBudget for
-			// process exit, PID-file verification, and cleanup. Giving up surfaces a legible
+			// so the ceiling is roughly 15s: far longer than any cold PowerShell
+			// start seen on a runner, and far shorter than
+			// providerCommandTestBudget, so giving up surfaces a legible
 			// PID-file failure rather than a timeout that hides the real cause.
 			lines = append(lines,
 				":zeroWaitReady",
 				"if exist \""+readyFile+"\" goto zeroReady",
 				"set /a ZERO_READY_TRIES+=1",
-				"if %ZERO_READY_TRIES% GEQ "+itoa(providerCommandReadyWaitAttempts)+" goto zeroReady",
+				"if %ZERO_READY_TRIES% GEQ 15 goto zeroReady",
 				"ping -n 2 127.0.0.1 >nul",
 				"goto zeroWaitReady",
 				":zeroReady",
@@ -5,20 +5,22 @@ import (
 	"strings"
 )

-// DefaultMCPServers returns the MCP servers Zero ships ENABLED by default so
-// web search and page fetching work out of the box with no setup and no API
-// key. They are seeded before user/project config is merged (see ResolveMCP),
-// so a user can override any field — for example add an API-key header to lift
-// Exa's anonymous rate limit — or disable it entirely with
+// DefaultMCPServers returns the MCP servers Zero ships ENABLED by default so web
+// search and scraping work out of the box with no setup and no API key. They are
+// seeded before user/project config is merged (see ResolveMCP), so a user can
+// override any field — for example point firecrawl at a self-hosted instance, or
+// add an API-key header to lift the free-tier limit — or disable it entirely with
 // `zero mcp disable <name>` (which writes `"disabled": true`).
 //
-// Exa's hosted MCP server works anonymously with rate limits. Users can add an
-// Exa API key for higher limits.
+// Keyless Firecrawl routes requests through firecrawl.dev (1,000 free credits per
+// month, no account). Self-host Firecrawl (AGPL-3.0) for unlimited and private
+// use. Zero only calls it over the network, so Firecrawl's license never reaches
+// into Zero's own code.
 func DefaultMCPServers() map[string]MCPServerConfig {
 	return map[string]MCPServerConfig{
-		"exa": {
+		"firecrawl": {
 			Type: "http",
-			URL:  "https://mcp.exa.ai/mcp",
+			URL:  "https://mcp.firecrawl.dev/v2/mcp",
 		},
 	}
 }
@@ -33,13 +35,13 @@ func IsDefaultMCPServer(name string) bool {

 // IsUnconfiguredDefault reports whether server is one of Zero's built-in
 // defaults that the user never wrote an entry for in their config — i.e. it is
-// running with whatever Zero ships (e.g. keyless Exa, no credentials).
+// running with whatever Zero ships (e.g. keyless Firecrawl, no credentials).
 //
 // Both conditions below must hold:
 //   - !server.configured: the user's JSON never declared an object for this
 //     server key at all (set by MCPServerConfig.UnmarshalJSON only when it
 //     actually ran for this key). Any explicit action — including a
-//     disable/enable toggle like `zero mcp enable exa` that leaves the
+//     disable/enable toggle like `zero mcp enable firecrawl` that leaves the
 //     resolved value unchanged — sets configured, so it always counts as
 //     user-configured, even though the value comparison below could not tell
 //     the difference on its own.
@@ -56,90 +58,3 @@ func IsUnconfiguredDefault(name string, server MCPServerConfig) bool {
 	def, ok := DefaultMCPServers()[strings.TrimSpace(name)]
 	return ok && !server.configured && reflect.DeepEqual(def, server)
 }
-
-// retiredDefaultMCPServer describes a built-in default Zero no longer ships.
-type retiredDefaultMCPServer struct {
-	// successor is the default that replaced it.
-	successor string
-	// shipped is the value Zero used to seed for this name. A user entry
-	// written while the default was still shipped may name only an override
-	// (a header, say) and rely on these fields for the rest, so they have to
-	// outlive the default itself.
-	shipped MCPServerConfig
-}
-
-// retiredDefaultMCPServers maps a retired built-in default to what replaced it
-// and to the value Zero used to ship for it.
-var retiredDefaultMCPServers = map[string]retiredDefaultMCPServer{
-	"firecrawl": {
-		successor: "exa",
-		shipped: MCPServerConfig{
-			Type: "http",
-			URL:  "https://mcp.firecrawl.dev/v2/mcp",
-		},
-	},
-}
-
-// migrateRetiredDefaultMCPServers keeps an upgrade across a default-provider
-// swap from changing what the user's config means. It handles the two ways a
-// rename can break a config written against the old default:
-//
-//   - A user who ran `zero mcp disable <old default>` made an explicit choice
-//     not to open that outbound connection. Without carrying that decision to
-//     the successor, the upgrade re-opens it under the new name — and because
-//     the replacement looks like an untouched default, even the startup
-//     warning stays quiet (see IsUnconfiguredDefault and issue #552).
-//   - A user who customized the old default could name only the field they
-//     were changing, because the seeded default supplied the transport. Once
-//     the default stops being seeded that entry resolves to a server with no
-//     type, url, or command, which fails NormalizeConfig and takes the whole
-//     startup down rather than just that one server.
-//
-// It runs immediately after the user layer merges (see ResolveMCP), which
-// scopes it to user-level decisions — the only scope whose disable is sticky.
-// The carried-over disable applies only when the user never declared the
-// successor themselves: an explicit `exa` entry wins whether it enables or
-// disables. Because the disable is recorded as a user-level decision, the
-// lower-trust project layer cannot lift it, while `zero mcp enable exa` still
-// can (the CLI override scope merges with canReenable=true).
-func migrateRetiredDefaultMCPServers(cfg *MCPConfig) {
-	for name, retired := range retiredDefaultMCPServers {
-		entry, ok := cfg.Servers[name]
-		if !ok {
-			continue
-		}
-		if inheritsRetiredTransport(entry) {
-			// Re-seed what Zero used to ship underneath the user's fields, so a
-			// partial entry still resolves to the complete server it named when
-			// it was written. Their own values still win — this only fills the
-			// gap the retired default used to cover.
-			entry = mergeMCPServer(retired.shipped, entry, true)
-			cfg.Servers[name] = entry
-		}
-		if !entry.disabledSet || !entry.Disabled {
-			continue
-		}
-		replacement, ok := cfg.Servers[retired.successor]
-		if !ok || replacement.configured {
-			continue
-		}
-		replacement.Disabled = true
-		replacement.disabledSet = true
-		cfg.Servers[retired.successor] = replacement
-	}
-}
-
-// inheritsRetiredTransport reports whether entry named no transport of its own
-// — no type, url, command, or args — and so relied entirely on the retired
-// default to supply one.
-//
-// Anything else is a complete definition the user owns (a self-hosted url, a
-// stdio command) and must be left alone: grafting the retired default's http
-// type onto an entry that names a command produces a server that is rejected
-// outright, turning a working config into a startup failure.
-func inheritsRetiredTransport(entry MCPServerConfig) bool {
-	return strings.TrimSpace(entry.Type) == "" &&
-		strings.TrimSpace(entry.URL) == "" &&
-		strings.TrimSpace(entry.Command) == "" &&
-		len(entry.Args) == 0
-}
@@ -7,10 +7,10 @@ import (
 )

 func TestIsDefaultMCPServer(t *testing.T) {
-	if !IsDefaultMCPServer("exa") {
-		t.Fatal("exa should be a built-in default")
+	if !IsDefaultMCPServer("firecrawl") {
+		t.Fatal("firecrawl should be a built-in default")
 	}
-	if IsDefaultMCPServer("  exa  ") == false {
+	if IsDefaultMCPServer("  firecrawl  ") == false {
 		t.Fatal("IsDefaultMCPServer should trim whitespace")
 	}
 	if IsDefaultMCPServer("not-a-default") {
@@ -18,45 +18,45 @@ func TestIsDefaultMCPServer(t *testing.T) {
 	}
 }

-func TestResolveMCPSeedsEnabledExaDefault(t *testing.T) {
+func TestResolveMCPSeedsEnabledFirecrawlDefault(t *testing.T) {
 	cfg, err := ResolveMCP(ResolveOptions{})
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	exa, ok := cfg.Servers["exa"]
+	firecrawl, ok := cfg.Servers["firecrawl"]
 	if !ok {
-		t.Fatal("expected the exa default to be seeded with no user config")
+		t.Fatal("expected the firecrawl default to be seeded with no user config")
 	}
-	if exa.Type != "http" || exa.URL != "https://mcp.exa.ai/mcp" {
-		t.Fatalf("unexpected exa default: %#v", exa)
+	if firecrawl.Type != "http" || firecrawl.URL != "https://mcp.firecrawl.dev/v2/mcp" {
+		t.Fatalf("unexpected firecrawl default: %#v", firecrawl)
 	}
-	if exa.Disabled {
-		t.Fatal("the exa default must be enabled out of the box")
+	if firecrawl.Disabled {
+		t.Fatal("the firecrawl default must be enabled out of the box")
 	}
 }

 func TestResolveMCPUserCanDisableDefault(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"exa":{"disabled":true}}}}`), 0o600); err != nil {
+	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	if !cfg.Servers["exa"].Disabled {
+	if !cfg.Servers["firecrawl"].Disabled {
 		t.Fatal("a user must be able to disable the default by writing over it")
 	}
 }

 func TestIsUnconfiguredDefault(t *testing.T) {
-	if !IsUnconfiguredDefault("exa", DefaultMCPServers()["exa"]) {
-		t.Fatal("an untouched exa default should be reported as unconfigured")
+	if !IsUnconfiguredDefault("firecrawl", DefaultMCPServers()["firecrawl"]) {
+		t.Fatal("an untouched firecrawl default should be reported as unconfigured")
 	}
-	if IsUnconfiguredDefault("exa", MCPServerConfig{Type: "http", URL: "https://example.com/mcp"}) {
+	if IsUnconfiguredDefault("firecrawl", MCPServerConfig{Type: "http", URL: "http://localhost:3002/mcp"}) {
 		t.Fatal("a server overriding the default URL is no longer unconfigured")
 	}
-	if IsUnconfiguredDefault("exa", MCPServerConfig{Type: "http", URL: "https://mcp.exa.ai/mcp", Auth: "bearer"}) {
+	if IsUnconfiguredDefault("firecrawl", MCPServerConfig{Type: "http", URL: "https://mcp.firecrawl.dev/v2/mcp", Auth: "bearer"}) {
 		t.Fatal("a server with credentials added is no longer unconfigured")
 	}
 	if IsUnconfiguredDefault("not-a-default", MCPServerConfig{}) {
@@ -65,173 +65,57 @@ func TestIsUnconfiguredDefault(t *testing.T) {
 }

 func TestResolveMCPExplicitReenableIsNotUnconfiguredDefault(t *testing.T) {
-	// `zero mcp enable exa` after a prior disable writes {"disabled":false}
+	// `zero mcp enable firecrawl` after a prior disable writes {"disabled":false}
 	// explicitly. The resolved value is identical to the untouched default (both
 	// enabled, no credentials), but the user DID take an explicit action here, so
 	// IsUnconfiguredDefault must not treat it as untouched (issue #563 review).
 	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"exa":{"disabled":false}}}}`), 0o600); err != nil {
+	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":false}}}}`), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	exa := cfg.Servers["exa"]
-	if exa.Disabled {
-		t.Fatalf("explicit re-enable should leave the server enabled: %#v", exa)
+	firecrawl := cfg.Servers["firecrawl"]
+	if firecrawl.Disabled {
+		t.Fatalf("explicit re-enable should leave the server enabled: %#v", firecrawl)
 	}
-	if IsUnconfiguredDefault("exa", exa) {
+	if IsUnconfiguredDefault("firecrawl", firecrawl) {
 		t.Fatal("an explicit enable/disable toggle must count as user-configured, even though the resolved value matches the default")
 	}
 }

 func TestResolveMCPExplicitRedeclareOfDefaultValuesIsNotUnconfiguredDefault(t *testing.T) {
-	// A user who copies Exa's exact default type/url into their config
+	// A user who copies firecrawl's exact default type/url into their config
 	// (e.g. from an example file, planning to add credentials later) produces a
-	// resolved value byte-identical to DefaultMCPServers()["exa"] — the
+	// resolved value byte-identical to DefaultMCPServers()["firecrawl"] — the
 	// same trap TestResolveMCPExplicitReenableIsNotUnconfiguredDefault covers for
 	// the disabled toggle. IsUnconfiguredDefault must still treat this as
 	// user-configured because the user's JSON declared an entry for it, even
 	// though a plain resolved-value comparison could not tell the difference.
 	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"exa":{"type":"http","url":"https://mcp.exa.ai/mcp"}}}}`), 0o600); err != nil {
+	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"type":"http","url":"https://mcp.firecrawl.dev/v2/mcp"}}}}`), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
 	if err != nil {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
-	exa := cfg.Servers["exa"]
-	want := DefaultMCPServers()["exa"]
-	if exa.Type != want.Type || exa.URL != want.URL || exa.Disabled != want.Disabled {
-		t.Fatalf("expected the resolved value to match the default's fields exactly: %#v", exa)
+	firecrawl := cfg.Servers["firecrawl"]
+	want := DefaultMCPServers()["firecrawl"]
+	if firecrawl.Type != want.Type || firecrawl.URL != want.URL || firecrawl.Disabled != want.Disabled {
+		t.Fatalf("expected the resolved value to match the default's fields exactly: %#v", firecrawl)
 	}
-	if IsUnconfiguredDefault("exa", exa) {
+	if IsUnconfiguredDefault("firecrawl", firecrawl) {
 		t.Fatal("redeclaring the default's exact values is still an explicit user configuration, not an untouched default")
 	}
 }

 func TestResolveMCPUserCanOverrideDefaultURLKeepingOtherFields(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.json")
-	// Point Exa at a proxy; the default's Type must survive.
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"exa":{"url":"https://example.com/mcp"}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	exa := cfg.Servers["exa"]
-	if exa.URL != "https://example.com/mcp" {
-		t.Fatalf("user override of the default URL did not apply: %#v", exa)
-	}
-	if exa.Type != "http" {
-		t.Fatalf("override should keep the default's other fields (type), got %#v", exa)
-	}
-}
-
-func TestResolveMCPCarriesLegacyDefaultDisableToSuccessor(t *testing.T) {
-	// Upgrade path: the user disabled the firecrawl default Zero used to ship.
-	// Swapping the default to exa must not re-open an outbound connection they
-	// explicitly switched off.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	if !cfg.Servers["exa"].Disabled {
-		t.Fatalf("a prior disable of the retired default must carry to its replacement: %#v", cfg.Servers["exa"])
-	}
-}
-
-func TestResolveMCPExplicitSuccessorBeatsLegacyDefaultDisable(t *testing.T) {
-	// The user disabled the old default but has since explicitly configured exa.
-	// Their newer, explicit choice wins — the migration must not override it.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true},"exa":{"disabled":false}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	exa := cfg.Servers["exa"]
-	if exa.Disabled {
-		t.Fatalf("an explicit exa entry must survive the legacy-disable migration: %#v", exa)
-	}
-	if IsUnconfiguredDefault("exa", exa) {
-		t.Fatal("an explicitly configured exa is not an untouched default")
-	}
-}
-
-func TestResolveMCPLegacyDefaultLeftEnabledDoesNotDisableSuccessor(t *testing.T) {
-	// A user who configured firecrawl without disabling it (e.g. added a header)
-	// never opted out of the default search server, so exa stays enabled.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"headers":{"Authorization":"Bearer k"}}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	if cfg.Servers["exa"].Disabled {
-		t.Fatal("only an explicit disable of the retired default should carry over")
-	}
-}
-
-func TestResolveMCPLegacyDefaultDisableIsLiftableByOverride(t *testing.T) {
-	// The carried-over disable is a user-level decision, not a permanent one:
-	// `zero mcp enable exa` merges through the CLI override scope, which is the
-	// one layer allowed to re-enable.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	enabled := MCPServerConfig{Disabled: false, disabledSet: true}
-	cfg, err := ResolveMCP(ResolveOptions{
-		UserConfigPath: path,
-		Overrides:      Overrides{MCP: MCPConfig{Servers: map[string]MCPServerConfig{"exa": enabled}}},
-	})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	if cfg.Servers["exa"].Disabled {
-		t.Fatalf("an explicit enable must lift the carried-over disable: %#v", cfg.Servers["exa"])
-	}
-}
-
-func TestResolveMCPLegacyDisableSurvivesProjectReenable(t *testing.T) {
-	// The project layer is lower-trust and must not lift the carried-over
-	// user-level disable — the same guard a direct `zero mcp disable exa` gets.
-	dir := t.TempDir()
-	userPath := filepath.Join(dir, "config.json")
-	if err := os.WriteFile(userPath, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	projectPath := filepath.Join(dir, "project.json")
-	if err := os.WriteFile(projectPath, []byte(`{"mcp":{"servers":{"exa":{"disabled":false}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: userPath, ProjectConfigPath: projectPath})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	if !cfg.Servers["exa"].Disabled {
-		t.Fatal("project config must not re-enable a server the user disabled")
-	}
-}
-
-func TestResolveMCPKeepsRetiredDefaultTransportForPartialEntry(t *testing.T) {
-	// A user who added an API key to the firecrawl default wrote only the header
-	// — the seeded default supplied the http type and URL. Retiring the default
-	// must not strip those out from under them and leave an unusable server.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"headers":{"Authorization":"Bearer k"}}}}}`), 0o600); err != nil {
+	// Point firecrawl at a self-hosted instance; the default's Type must survive.
+	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"url":"http://localhost:3002/mcp"}}}}`), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
@@ -239,55 +123,10 @@ func TestResolveMCPKeepsRetiredDefaultTransportForPartialEntry(t *testing.T) {
 		t.Fatalf("ResolveMCP: %v", err)
 	}
 	firecrawl := cfg.Servers["firecrawl"]
-	if firecrawl.Type != "http" || firecrawl.URL != "https://mcp.firecrawl.dev/v2/mcp" {
-		t.Fatalf("a partial entry must keep the retired default's transport: %#v", firecrawl)
+	if firecrawl.URL != "http://localhost:3002/mcp" {
+		t.Fatalf("user override of the default URL did not apply: %#v", firecrawl)
 	}
-	if firecrawl.Headers["Authorization"] != "Bearer k" {
-		t.Fatalf("the user's own field must still win: %#v", firecrawl)
-	}
-}
-
-func TestResolveMCPDoesNotGraftRetiredDefaultOntoOwnTransport(t *testing.T) {
-	// A self-hosted firecrawl over stdio is a complete definition the user owns.
-	// Re-seeding the retired http default under it would produce an http server
-	// carrying a command, which NormalizeConfig rejects outright.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"command":"firecrawl-mcp"}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	firecrawl := cfg.Servers["firecrawl"]
-	if firecrawl.Type != "" || firecrawl.URL != "" {
-		t.Fatalf("an entry naming its own transport must be left alone: %#v", firecrawl)
-	}
-	if firecrawl.Command != "firecrawl-mcp" {
-		t.Fatalf("the user's command must survive: %#v", firecrawl)
-	}
-}
-
-func TestResolveMCPDisabledRetiredEntryStaysReEnableable(t *testing.T) {
-	// The disable carries to exa, and the retired entry itself keeps a usable
-	// transport so a later `zero mcp enable firecrawl` does not resolve to a
-	// server with no type, url, or command.
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := ResolveMCP(ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	firecrawl := cfg.Servers["firecrawl"]
-	if !firecrawl.Disabled {
-		t.Fatalf("the retired entry must stay disabled: %#v", firecrawl)
-	}
-	if firecrawl.Type != "http" || firecrawl.URL != "https://mcp.firecrawl.dev/v2/mcp" {
-		t.Fatalf("a disabled retired entry should still carry a usable transport: %#v", firecrawl)
-	}
-	if !cfg.Servers["exa"].Disabled {
-		t.Fatal("the disable must still carry to the successor")
+	if firecrawl.Type != "http" {
+		t.Fatalf("override should keep the default's other fields (type), got %#v", firecrawl)
 	}
 }
@@ -34,7 +34,7 @@ func TestResolveMCPExcludeProjectDropsProjectServers(t *testing.T) {
 		if _, ok := cfg.Servers["user-srv"]; !ok {
 			t.Fatal("the user server must always be present")
 		}
-		if _, ok := cfg.Servers["exa"]; !ok {
+		if _, ok := cfg.Servers["firecrawl"]; !ok {
 			t.Fatal("the built-in default must always be present")
 		}
 	})
@@ -54,7 +54,7 @@ func TestResolveMCPExcludeProjectDropsProjectServers(t *testing.T) {
 		if _, ok := cfg.Servers["user-srv"]; !ok {
 			t.Fatal("the user server must survive when the project layer is dropped")
 		}
-		if _, ok := cfg.Servers["exa"]; !ok {
+		if _, ok := cfg.Servers["firecrawl"]; !ok {
 			t.Fatal("the built-in default must survive when the project layer is dropped")
 		}
 	})
@@ -180,7 +180,7 @@ func Resolve(options ResolveOptions) (ResolvedConfig, error) {
 }

 func ResolveMCP(options ResolveOptions) (MCPConfig, error) {
-	// Seed Zero's built-in default MCP servers (e.g. keyless Exa for free,
+	// Seed Zero's built-in default MCP servers (e.g. keyless Firecrawl for free,
 	// no-setup web search/scrape) BEFORE merging user/project config, so the user
 	// can override any field or disable a default by writing over it.
 	cfg := FileConfig{MCP: MCPConfig{Servers: DefaultMCPServers()}}
@@ -194,10 +194,6 @@ func ResolveMCP(options ResolveOptions) (MCPConfig, error) {
 		// server the user disabled (a user-level disable is sticky, but the user
 		// scope itself may lift it).
 		mergeMCPConfig(&cfg.MCP, fileConfig.MCP, true)
-		// Reconcile config written against a default Zero has since retired,
-		// here while the user layer is the only one merged — so a carried-over
-		// disable counts as a user-level decision the project layer cannot lift.
-		migrateRetiredDefaultMCPServers(&cfg.MCP)
 	}
 	// Drop the project layer when the workspace is untrusted, so a cloned repo's
 	// ./.zero/config.json cannot register (and spawn) MCP servers. Fail-closed:
@@ -151,8 +151,7 @@ type KeyBindingsConfig struct {
 	ToggleMouse KeyBindingDef `json:"toggleMouse,omitempty"`
 	// CycleReasoning cycles through reasoning effort levels (default: ctrl+t).
 	CycleReasoning KeyBindingDef `json:"cycleReasoning,omitempty"`
-	// TogglePlan is retained for configuration compatibility. Plan updates render
-	// in the transcript and no longer have a persistent panel to toggle.
+	// TogglePlan toggles the plan panel expansion (default: ctrl+p).
 	TogglePlan KeyBindingDef `json:"togglePlan,omitempty"`
 	// ToggleSidebar toggles the right context sidebar (default: ctrl+b).
 	ToggleSidebar KeyBindingDef `json:"toggleSidebar,omitempty"`
@@ -465,7 +464,7 @@ type MCPServerConfig struct {
 	// fields it set or what values they hold. A built-in default seeded by
 	// DefaultMCPServers() is never unmarshaled from JSON, so it starts false;
 	// any explicit entry in the user/project file — even one that happens to
-	// repeat a default's exact field values (e.g. re-declaring Exa's
+	// repeat a default's exact field values (e.g. re-declaring firecrawl's
 	// default URL) — sets it true. IsUnconfiguredDefault checks this alongside
 	// a resolved-value comparison, so redeclaring default values verbatim still
 	// counts as user-configured.
@@ -1,246 +0,0 @@
-package credstore
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-)
-
-func fileStore(t *testing.T, dir string) *Store {
-	t.Helper()
-	store, err := New(Options{Dir: dir, Storage: "file"})
-	if err != nil {
-		t.Fatalf("New: %v", err)
-	}
-	return store
-}
-
-// THE REPRODUCTION, kept as the regression. Before the lock this reliably kept
-// 1 of 100: every writer read the same map, added its own provider, and the
-// last rename published a file missing all the others.
-func TestConcurrentSetKeepsEveryKey(t *testing.T) {
-	dir := t.TempDir()
-	store := fileStore(t, dir)
-
-	const n = 100
-	var wg sync.WaitGroup
-	errs := make(chan error, n)
-	for i := 0; i < n; i++ {
-		wg.Add(1)
-		go func(i int) {
-			defer wg.Done()
-			if err := store.Set(fmt.Sprintf("p%03d", i), fmt.Sprintf("k%03d", i)); err != nil {
-				errs <- err
-			}
-		}(i)
-	}
-	wg.Wait()
-	close(errs)
-	for err := range errs {
-		t.Fatalf("Set: %v", err)
-	}
-
-	got, err := store.Providers()
-	if err != nil {
-		t.Fatalf("Providers: %v", err)
-	}
-	if len(got) != n {
-		t.Fatalf("kept %d of %d concurrent writes", len(got), n)
-	}
-	// ...and every value is the one its own writer wrote, not a neighbour's.
-	for i := 0; i < n; i++ {
-		key, ok, err := store.Get(fmt.Sprintf("p%03d", i))
-		if err != nil {
-			t.Fatalf("Get: %v", err)
-		}
-		if !ok || key != fmt.Sprintf("k%03d", i) {
-			t.Fatalf("p%03d = %q (present=%v); a writer's own value must survive", i, key, ok)
-		}
-	}
-}
-
-// DELETE RACES SET, and an unlocked delete loses the other writer's key.
-//
-// A first version of this only checked that keys nobody deleted survived — and
-// every reader sees those, so it passed with the lock removed from Delete. The
-// case that actually breaks is a Delete whose stale read predates a concurrent
-// Set: it writes back a map that never contained the new key, and the Set is
-// gone. So the assertion is on the SETS surviving, not on the bystanders.
-func TestADeleteCannotClobberAConcurrentSet(t *testing.T) {
-	dir := t.TempDir()
-	store := fileStore(t, dir)
-
-	// Throwaway keys for the deleters to remove, written first so a delete
-	// always has something to do.
-	const churn = 40
-	for i := 0; i < churn; i++ {
-		if err := store.Set(fmt.Sprintf("churn%02d", i), "v"); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	const adds = 60
-	var wg sync.WaitGroup
-	for i := 0; i < adds; i++ {
-		wg.Add(1)
-		go func(i int) {
-			defer wg.Done()
-			_ = store.Set(fmt.Sprintf("added%02d", i), "v")
-		}(i)
-	}
-	for i := 0; i < churn; i++ {
-		wg.Add(1)
-		go func(i int) {
-			defer wg.Done()
-			_, _ = store.Delete(fmt.Sprintf("churn%02d", i))
-		}(i)
-	}
-	wg.Wait()
-
-	got, err := store.Providers()
-	if err != nil {
-		t.Fatal(err)
-	}
-	survivors := map[string]bool{}
-	for _, name := range got {
-		survivors[name] = true
-	}
-	missing := []string{}
-	for i := 0; i < adds; i++ {
-		name := fmt.Sprintf("added%02d", i)
-		if !survivors[name] {
-			missing = append(missing, name)
-		}
-	}
-	if len(missing) > 0 {
-		t.Fatalf("%d of %d concurrent Set calls were clobbered by a racing Delete: %v",
-			len(missing), adds, missing)
-	}
-	// ...and every churn key really was removed, so the deletes were not
-	// no-ops that would make the check above vacuous.
-	for i := 0; i < churn; i++ {
-		if survivors[fmt.Sprintf("churn%02d", i)] {
-			t.Fatalf("churn%02d survived; the deletes did nothing and this test proves nothing", i)
-		}
-	}
-}
-
-// ACROSS PROCESSES, which is the case that matters: a plan running with
-// max_workers > 1 spawns child PROCESSES, and an in-process mutex would not
-// have helped any of them. The race detector cannot see this one either — it is
-// two OS processes — so it is driven for real.
-func TestConcurrentSetAcrossProcesses(t *testing.T) {
-	if testing.Short() {
-		t.Skip("spawns processes")
-	}
-	helper := os.Getenv("ZERO_CREDSTORE_HELPER_DIR")
-	if helper != "" {
-		// Child mode: write our slice of the keys and exit.
-		store, err := New(Options{Dir: helper, Storage: "file"})
-		if err != nil {
-			os.Exit(3)
-		}
-		prefix := os.Getenv("ZERO_CREDSTORE_HELPER_PREFIX")
-		for i := 0; i < 25; i++ {
-			if err := store.Set(fmt.Sprintf("%s%02d", prefix, i), "v"); err != nil {
-				os.Exit(4)
-			}
-		}
-		os.Exit(0)
-	}
-
-	dir := t.TempDir()
-	const children = 4
-	var wg sync.WaitGroup
-	failures := make(chan string, children)
-	for c := 0; c < children; c++ {
-		wg.Add(1)
-		go func(c int) {
-			defer wg.Done()
-			cmd := exec.Command(os.Args[0], "-test.run=TestConcurrentSetAcrossProcesses", "-test.v")
-			cmd.Env = append(os.Environ(),
-				"ZERO_CREDSTORE_HELPER_DIR="+dir,
-				fmt.Sprintf("ZERO_CREDSTORE_HELPER_PREFIX=c%d_", c),
-			)
-			if out, err := cmd.CombinedOutput(); err != nil {
-				failures <- fmt.Sprintf("child %d: %v\n%s", c, err, out)
-			}
-		}(c)
-	}
-	wg.Wait()
-	close(failures)
-	for failure := range failures {
-		t.Fatal(failure)
-	}
-
-	store := fileStore(t, dir)
-	got, err := store.Providers()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != children*25 {
-		t.Fatalf("kept %d of %d keys written by %d concurrent processes", len(got), children*25, children)
-	}
-}
-
-// The lock lives BESIDE the data file, never on it. write publishes by rename,
-// so a lock taken on the data file would be attached to an inode the next
-// writer has already replaced — every writer would appear to hold it.
-func TestTheLockIsNotTheDataFile(t *testing.T) {
-	dir := t.TempDir()
-	store := fileStore(t, dir)
-	if store.lockPath() == store.file {
-		t.Fatal("the lock is the data file; rename would carry it away")
-	}
-	if !strings.HasPrefix(filepath.Base(store.lockPath()), filepath.Base(store.file)) {
-		t.Fatalf("lock %q is not beside the data file %q", store.lockPath(), store.file)
-	}
-	if err := store.Set("p", "k"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(store.lockPath()); err != nil {
-		t.Fatalf("the lock file was not created: %v", err)
-	}
-	// ...and it survives a write, since the rename replaces only the data file.
-	if err := store.Set("q", "k"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(store.lockPath()); err != nil {
-		t.Fatalf("the lock file did not survive a write: %v", err)
-	}
-}
-
-// The lock is a security boundary, so the path where it CANNOT be taken needs
-// coverage too: an operation that could not lock must report that, never proceed
-// unserialized and never report success. Replacing the credential directory with
-// a regular file makes the lock's MkdirAll fail on every platform.
-func TestOperationsFailWhenTheLockCannotBeAcquired(t *testing.T) {
-	base := t.TempDir()
-	dir := filepath.Join(base, "creds")
-	store := fileStore(t, dir)
-	// Where the store expects its directory, put a regular file.
-	if err := os.WriteFile(dir, []byte("not a directory"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := store.Set("openai", "sk-test"); err == nil {
-		t.Error("Set reported success although the lock could not be acquired")
-	}
-	if _, err := store.Delete("openai"); err == nil {
-		t.Error("Delete reported success although the lock could not be acquired")
-	}
-	if _, _, err := store.Get("openai"); err == nil {
-		t.Error("Get reported success although the lock could not be acquired")
-	}
-	if _, err := store.Providers(); err == nil {
-		t.Error("Providers reported success although the lock could not be acquired")
-	}
-	// And nothing may have been written through the failed path.
-	if raw, err := os.ReadFile(dir); err != nil || string(raw) != "not a directory" {
-		t.Errorf("the blocking file was modified: %q (err %v)", raw, err)
-	}
-}
@@ -9,7 +9,6 @@ package credstore

 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -126,27 +125,14 @@ func (s *Store) Backend() string { return s.backend }
 func (s *Store) Encrypted() bool { return s.backend == "keyring" || s.backend == "encrypted-file" }

 // Set stores (or overwrites) the API key for provider.
-func (s *Store) Set(provider, key string) (err error) {
+func (s *Store) Set(provider, key string) error {
 	provider = normalizeProvider(provider)
 	if provider == "" {
 		return fmt.Errorf("credstore: provider is required")
 	}
 	if s.backend == "keyring" {
-		// The OS keyring serializes its own writes; the file lock guards the
-		// file backends only.
 		return s.kr.Set(keyringService, keyringPrefix+provider, key)
 	}
-	// READ AND WRITE UNDER ONE LOCK. Separately locking each half would still
-	// lose keys: two writers would each read the same map, each add their own
-	// provider, and the second rename would publish a file missing the first.
-	// Measured before this existed: 1 of 100 concurrent Set calls survived.
-	release, err := s.acquireFileLock(true)
-	if err != nil {
-		return err
-	}
-	// Joined, not chosen between: a release failure annotates the result instead
-	// of masking the write error that actually explains what went wrong.
-	defer func() { err = errors.Join(err, release()) }()
 	data, err := s.read()
 	if err != nil {
 		return err
@@ -156,7 +142,7 @@ func (s *Store) Set(provider, key string) (err error) {
 }

 // Get returns the API key for provider and whether one is stored.
-func (s *Store) Get(provider string) (value string, found bool, err error) {
+func (s *Store) Get(provider string) (string, bool, error) {
 	provider = normalizeProvider(provider)
 	if provider == "" {
 		return "", false, nil
@@ -164,15 +150,6 @@ func (s *Store) Get(provider string) (value string, found bool, err error) {
 	if s.backend == "keyring" {
 		return s.kr.Get(keyringService, keyringPrefix+provider)
 	}
-	// A shared lock, so a read serializes against a writer's publish. On unix
-	// the rename is atomic and this only prevents reading an empty file mid-swap;
-	// on Windows an unsynchronized reader holding the file open would block the
-	// writer's rename outright, so readers must coordinate through the same lock.
-	release, err := s.acquireFileLock(false)
-	if err != nil {
-		return "", false, err
-	}
-	defer func() { err = errors.Join(err, release()) }()
 	data, err := s.read()
 	if err != nil {
 		return "", false, err
@@ -182,7 +159,7 @@ func (s *Store) Get(provider string) (value string, found bool, err error) {
 }

 // Delete removes the API key for provider, reporting whether one existed.
-func (s *Store) Delete(provider string) (existed bool, err error) {
+func (s *Store) Delete(provider string) (bool, error) {
 	provider = normalizeProvider(provider)
 	if provider == "" {
 		return false, nil
@@ -190,13 +167,6 @@ func (s *Store) Delete(provider string) (existed bool, err error) {
 	if s.backend == "keyring" {
 		return s.kr.Delete(keyringService, keyringPrefix+provider)
 	}
-	// The same lock as Set: a delete is a read-modify-write too, and one racing
-	// a set would otherwise resurrect or erase an unrelated provider.
-	release, err := s.acquireFileLock(true)
-	if err != nil {
-		return false, err
-	}
-	defer func() { err = errors.Join(err, release()) }()
 	data, err := s.read()
 	if err != nil {
 		return false, err
@@ -209,22 +179,17 @@ func (s *Store) Delete(provider string) (existed bool, err error) {
 }

 // Providers lists providers with a stored key (sorted), for display/audit.
-func (s *Store) Providers() (names []string, err error) {
+func (s *Store) Providers() ([]string, error) {
 	if s.backend == "keyring" {
 		// The OS keyring has no enumerate-by-prefix in our minimal surface; callers
 		// that need a list pass known provider names to Get. Return empty here.
 		return nil, nil
 	}
-	release, err := s.acquireFileLock(false)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { err = errors.Join(err, release()) }()
 	data, err := s.read()
 	if err != nil {
 		return nil, err
 	}
-	names = make([]string, 0, len(data))
+	names := make([]string, 0, len(data))
 	for name := range data {
 		names = append(names, name)
 	}
@@ -299,15 +264,6 @@ func (s *Store) write(data map[string]string) error {
 	return nil
 }

-// lockPath is the advisory lock guarding a read-modify-write of the credential
-// file. Beside the data file, never the data file itself — write publishes by
-// rename and would carry the lock away with the old inode.
-func (s *Store) lockPath() string { return s.file + ".lock" }
-
-// filepathDir is filepath.Dir, named locally so the two platform lock files can
-// share it without either importing path/filepath for one call.
-func filepathDir(path string) string { return filepath.Dir(path) }
-
 func normalizeProvider(provider string) string {
 	return strings.ToLower(strings.TrimSpace(provider))
 }
@@ -1,55 +0,0 @@
-//go:build !windows
-
-package credstore
-
-import (
-	"errors"
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/unix"
-)
-
-// acquireFileLock takes an exclusive advisory lock (flock) so a read-modify-write
-// of the credential file is serialized against every other one — across
-// processes AND across goroutines, since flock is held per open file
-// description and two opens in one process contend exactly as two processes do.
-//
-// THE LOCK FILE IS SEPARATE FROM THE DATA FILE, and that is not tidiness. write
-// publishes by os.Rename, which replaces the inode; a lock taken on the data
-// file would be attached to an inode that the next writer has already replaced,
-// so every writer would appear to hold it. The lock lives on a file nothing
-// renames.
-func (s *Store) acquireFileLock(exclusive bool) (func() error, error) {
-	path := s.lockPath()
-	if err := os.MkdirAll(filepathDir(path), 0o700); err != nil {
-		return nil, fmt.Errorf("credstore: lock dir: %w", err)
-	}
-	file, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE, 0o600)
-	if err != nil {
-		return nil, fmt.Errorf("credstore: open lock: %w", err)
-	}
-	// Writers take LOCK_EX; readers take LOCK_SH so they run concurrently with
-	// each other but still serialize against a writer's publish (see Get).
-	how := unix.LOCK_SH
-	if exclusive {
-		how = unix.LOCK_EX
-	}
-	if err := unix.Flock(int(file.Fd()), how); err != nil {
-		_ = file.Close()
-		return nil, fmt.Errorf("credstore: lock: %w", err)
-	}
-	return func() error {
-		// Close alone drops the flock, so the explicit unlock is belt-and-braces —
-		// but its failure is reported rather than swallowed, because a cleanup that
-		// did not complete must not be indistinguishable from one that did. The
-		// callers join this into their result, so it annotates a successful write
-		// instead of masking it.
-		unlockErr := unix.Flock(int(file.Fd()), unix.LOCK_UN)
-		closeErr := file.Close()
-		if err := errors.Join(unlockErr, closeErr); err != nil {
-			return fmt.Errorf("credstore: release lock: %w", err)
-		}
-		return nil
-	}, nil
-}
@@ -1,55 +0,0 @@
-//go:build windows
-
-package credstore
-
-import (
-	"errors"
-	"fmt"
-	"os"
-
-	"golang.org/x/sys/windows"
-)
-
-// acquireFileLock takes an exclusive OS lock (LockFileEx) so a read-modify-write
-// of the credential file is serialized, matching the flock behaviour on unix.
-//
-// The lock file is SEPARATE from the data file for the same reason: write
-// publishes by rename, and a lock on the renamed file would be attached to
-// something the next writer has already replaced.
-func (s *Store) acquireFileLock(exclusive bool) (func() error, error) {
-	path := s.lockPath()
-	if err := os.MkdirAll(filepathDir(path), 0o700); err != nil {
-		return nil, fmt.Errorf("credstore: lock dir: %w", err)
-	}
-	file, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE, 0o600)
-	if err != nil {
-		return nil, fmt.Errorf("credstore: open lock: %w", err)
-	}
-	handle := windows.Handle(file.Fd())
-	overlapped := new(windows.Overlapped)
-	// A fixed 1-byte region, blocking (no LOCKFILE_FAIL_IMMEDIATELY) so a
-	// waiter queues rather than failing the operation. Writers pass
-	// LOCKFILE_EXCLUSIVE_LOCK; readers omit it (a shared lock) so they still
-	// serialize against a writer's publish — which matters more on Windows,
-	// where an unsynchronized reader holding the file open blocks the rename.
-	flags := uint32(0)
-	if exclusive {
-		flags = windows.LOCKFILE_EXCLUSIVE_LOCK
-	}
-	if err := windows.LockFileEx(handle, flags, 0, 1, 0, overlapped); err != nil {
-		_ = file.Close()
-		return nil, fmt.Errorf("credstore: lock: %w", err)
-	}
-	return func() error {
-		// Reported rather than swallowed, for the same reason as the unix side: a
-		// cleanup that did not complete must not look identical to one that did.
-		// It matters more here — on Windows the handle staying open is what blocks
-		// the next writer's rename, so a failed release has a visible consequence.
-		unlockErr := windows.UnlockFileEx(handle, 0, 1, 0, overlapped)
-		closeErr := file.Close()
-		if err := errors.Join(unlockErr, closeErr); err != nil {
-			return fmt.Errorf("credstore: release lock: %w", err)
-		}
-		return nil
-	}, nil
-}
@@ -9,7 +9,6 @@ import (
 	"strconv"
 	"strings"

-	"github.com/Gitlawb/zero/internal/providers/providerio"
 	"github.com/coder/websocket"
 )

@@ -61,15 +60,7 @@ func (d *deepgramTranscriber) StreamTranscribe(ctx context.Context, chunks <-cha
 		HTTPHeader: http.Header{"Authorization": {"Token " + d.cfg.APIKey}},
 	})
 	if err != nil {
-		// Preserve the context.Canceled sentinel (it carries no key) so an
-		// Esc-abort during dial still matches the UI's errors.Is check. Key
-		// on ctx.Err() itself rather than unwrapping err: a cancellation can
-		// surface as a plain transport error (e.g. "closed network
-		// connection") rather than context.Canceled directly.
-		if ctx.Err() != nil {
-			return "", ctx.Err()
-		}
-		return "", fmt.Errorf("connecting to Deepgram: %s", providerio.Redact(err.Error(), d.cfg.APIKey))
+		return "", fmt.Errorf("connecting to Deepgram: %w", err)
 	}
 	defer conn.CloseNow()

@@ -77,26 +68,15 @@ func (d *deepgramTranscriber) StreamTranscribe(ctx context.Context, chunks <-cha
 	// so no conversion (unlike sherpa-onnx, which wants float32).
 	writeErrCh := make(chan error, 1)
 	go func() {
-		// Select on ctx.Done() while waiting for the next chunk so a cancelled
-		// session does not leave this goroutine blocked on an open idle channel.
-		for {
-			select {
-			case <-ctx.Done():
-				writeErrCh <- ctx.Err()
+		for chunk := range chunks {
+			if err := conn.Write(ctx, websocket.MessageBinary, chunk); err != nil {
+				writeErrCh <- err
 				return
-			case chunk, ok := <-chunks:
-				if !ok {
-					// CloseStream flushes any buffered audio and returns final
-					// results before Deepgram closes the socket.
-					writeErrCh <- conn.Write(ctx, websocket.MessageText, []byte(`{"type":"CloseStream"}`))
-					return
-				}
-				if err := conn.Write(ctx, websocket.MessageBinary, chunk); err != nil {
-					writeErrCh <- err
-					return
-				}
 			}
 		}
+		// CloseStream flushes any buffered audio and returns final results before
+		// Deepgram closes the socket.
+		writeErrCh <- conn.Write(ctx, websocket.MessageText, []byte(`{"type":"CloseStream"}`))
 	}()

 	// Deepgram results are per-utterance segments, not cumulative: accumulate the
@@ -120,18 +100,7 @@ func (d *deepgramTranscriber) StreamTranscribe(ctx context.Context, chunks <-cha
 				}
 			default:
 			}
-			// A user abort cancels the streaming context; the UI matches it
-			// with errors.Is(err, context.Canceled), so return the sentinel
-			// itself (it carries no key) instead of a flat redacted string.
-			// Key on ctx.Err() rather than unwrapping err: the writeErrCh
-			// swap above can replace err with a plain transport error (e.g.
-			// "closed network connection") that doesn't itself unwrap to
-			// context.Canceled even though the cancellation is what caused it.
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
-			//nolint:staticcheck // Preserve established user-facing error text.
-			return compose(), fmt.Errorf("Deepgram stream error: %s", providerio.Redact(err.Error(), d.cfg.APIKey))
+			return compose(), fmt.Errorf("Deepgram stream error: %w", err) //nolint:staticcheck // Preserve established user-facing error text.
 		}
 		if typ != websocket.MessageText {
 			continue
@@ -1,278 +0,0 @@
-package dictation
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/coder/websocket"
-)
-
-// Non-cancellation dial failure: handshake returns 101 with an Upgrade header
-// equal to the API key so the dial error embeds the key and redaction must strip it.
-func TestDeepgramDialFailureRedactsKey(t *testing.T) {
-	const key = "sk-test-dial-key-abcdef"
-	baseURL := dialFailServerWithUpgrade(t, key)
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: key, BaseURL: baseURL})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, nil)
-	if ferr == nil {
-		t.Fatal("expected dial failure")
-	}
-	if errors.Is(ferr, context.Canceled) {
-		t.Fatalf("dial failure should not be context.Canceled: %v", ferr)
-	}
-	if strings.Contains(ferr.Error(), key) {
-		t.Errorf("API key leaked from dial failure: %v", ferr)
-	}
-	if !strings.Contains(ferr.Error(), "connecting to Deepgram") {
-		t.Errorf("expected dial-path error prefix, got: %v", ferr)
-	}
-}
-
-// dialFailServerWithUpgrade returns a ws URL whose handshake responds 101 with
-// Upgrade set to upgradeValue (not "websocket"), so websocket.Dial fails with
-// that value in the error string. Hijacks and closes immediately to avoid the
-// library's 3s body-drain timeout on failed dials.
-func dialFailServerWithUpgrade(t *testing.T, upgradeValue string) string {
-	t.Helper()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		hj, ok := w.(http.Hijacker)
-		if !ok {
-			http.Error(w, "hijack not supported", http.StatusInternalServerError)
-			return
-		}
-		conn, bufrw, err := hj.Hijack()
-		if err != nil {
-			return
-		}
-		defer conn.Close()
-		_, _ = bufrw.WriteString("HTTP/1.1 101 Switching Protocols\r\n")
-		_, _ = bufrw.WriteString("Connection: Upgrade\r\n")
-		_, _ = bufrw.WriteString("Upgrade: " + upgradeValue + "\r\n\r\n")
-		_ = bufrw.Flush()
-	}))
-	t.Cleanup(srv.Close)
-	return "ws" + strings.TrimPrefix(srv.URL, "http")
-}
-
-func TestDeepgramStreamTranscribeErrorRedaction(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Drain the client's audio frames, then wait for CloseStream so the
-		// client has flushed its writes before we reject the connection. Closing
-		// immediately (before CloseStream) risks the client failing on a write
-		// error and never observing this API-key-bearing close reason.
-		for {
-			typ, data, err := c.Read(ctx)
-			if err != nil {
-				return
-			}
-			if typ == websocket.MessageText && strings.Contains(string(data), "CloseStream") {
-				break
-			}
-		}
-		c.Close(websocket.StatusPolicyViolation, "invalid key sk-test-key")
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 320)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-	if ferr == nil {
-		t.Fatal("expected error")
-	}
-	if strings.Contains(ferr.Error(), "sk-test-key") {
-		t.Errorf("API key leaked: %v", ferr)
-	}
-}
-
-func TestDeepgramStreamTranscribeCancelKeepsSentinel(t *testing.T) {
-	firstFrame := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Hold the connection open, never answering, so the client blocks in
-		// Read until its context is cancelled (the Esc-abort path).
-		var once sync.Once
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-			once.Do(func() { close(firstFrame) })
-		}
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	chunks <- make([]byte, 320)
-	// The channel stays open: the session is live when the user aborts.
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-firstFrame:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("cancelled stream error lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed early instead of blocking: %v", ferr)
-	}
-}
-
-// Esc can cancel while the WebSocket dial is still pending. The dial error is
-// redacted with %s, so we must return ctx.Err() rather than a flat string.
-func TestDeepgramStreamTranscribeDialCancelKeepsSentinel(t *testing.T) {
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{
-		APIKey:  "sk-test-key",
-		BaseURL: "ws://127.0.0.1:1", // never reached; ctx is already cancelled
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	chunks := make(chan []byte)
-	defer close(chunks)
-
-	_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-	if !errors.Is(ferr, context.Canceled) {
-		t.Fatalf("dial-cancel lost the context.Canceled sentinel: %v", ferr)
-	}
-}
-
-// Esc right after accept can race the first write or the first Read; both
-// setup/write redaction sites must still yield context.Canceled.
-func TestDeepgramStreamTranscribeStartupCancelKeepsSentinel(t *testing.T) {
-	accepted := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		close(accepted)
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-		}
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	// No frames yet: the writer blocks on chunks or the reader blocks on Read.
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-accepted:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("startup-cancel lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed before accept: %v", ferr)
-	}
-}
-
-// TestDeepgramStreamErrorRedactsHeaderShapedKey exercises the same stream-error
-// redaction path as TestDeepgramStreamTranscribeErrorRedaction, with a close
-// reason that embeds the key next to an X-Api-Key-shaped header label.
-func TestDeepgramStreamErrorRedactsHeaderShapedKey(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		for {
-			typ, data, err := c.Read(ctx)
-			if err != nil {
-				return
-			}
-			if typ == websocket.MessageText && strings.Contains(string(data), "CloseStream") {
-				break
-			}
-		}
-		c.Close(websocket.StatusPolicyViolation, "X-Api-Key: sk-custom-secret-key-1234567890 failed")
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-custom-secret-key-1234567890", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 320)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-	if ferr == nil {
-		t.Fatal("expected error")
-	}
-	if strings.Contains(ferr.Error(), "sk-custom-secret-key-1234567890") {
-		t.Errorf("Custom header API key leaked: %v", ferr)
-	}
-}
-
-func TestDeepgramSinglePassRedaction(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		for {
-			typ, data, err := c.Read(ctx)
-			if err != nil {
-				return
-			}
-			if typ == websocket.MessageText && strings.Contains(string(data), "CloseStream") {
-				break
-			}
-		}
-		c.Close(websocket.StatusPolicyViolation, "error with sk-key1234567890abcdef1234")
-	})
-
-	tr, err := NewDeepgramTranscriber(DeepgramConfig{APIKey: "sk-key1234567890abcdef1234", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 320)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-	if ferr == nil {
-		t.Fatal("expected error")
-	}
-	got := ferr.Error()
-	if strings.Contains(got, "sk-key1234567890abcdef1234") {
-		t.Fatalf("API key leaked into stream error: %q", got)
-	}
-	// One key occurrence must produce exactly one redaction marker (no double wrap).
-	if strings.Count(got, "[REDACTED]") != 1 {
-		t.Fatalf("redaction markers in %q: want exactly 1 [REDACTED]", got)
-	}
-}
@@ -8,7 +8,6 @@ import (
 	"net/http"
 	"strings"

-	"github.com/Gitlawb/zero/internal/providers/providerio"
 	"github.com/coder/websocket"
 )

@@ -23,10 +22,6 @@ type OpenAIRealtimeConfig struct {
 	Model  string // default "gpt-4o-transcribe"
 	// BaseURL overrides the wss endpoint (tests point it at a fake server).
 	BaseURL string
-	// writeErrInjector, when set, is consulted before each JSON websocket write.
-	// Used by same-package tests to force controllable write failures that embed
-	// secrets; production callers leave it nil.
-	writeErrInjector func() error
 }

 type openAIRealtimeTranscriber struct {
@@ -64,15 +59,7 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 		},
 	})
 	if err != nil {
-		// Preserve the context.Canceled sentinel (it carries no key) so an
-		// Esc-abort during dial still matches the UI's errors.Is check. Key
-		// on ctx.Err() itself rather than unwrapping err: a cancellation can
-		// surface as a plain transport error (e.g. "closed network
-		// connection") rather than context.Canceled directly.
-		if ctx.Err() != nil {
-			return "", ctx.Err()
-		}
-		return "", fmt.Errorf("connecting to OpenAI Realtime: %s", providerio.Redact(err.Error(), o.cfg.APIKey))
+		return "", fmt.Errorf("connecting to OpenAI Realtime: %w", err)
 	}
 	defer conn.CloseNow()

@@ -86,53 +73,24 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 			},
 		},
 	}
-	if err := o.writeJSON(ctx, conn, sessionUpdate); err != nil {
-		// Same cancellation short-circuit as the dial above: an Esc-abort
-		// while the session update is in flight must stay context.Canceled.
-		if ctx.Err() != nil {
-			return "", ctx.Err()
-		}
-		return "", fmt.Errorf("configuring OpenAI Realtime session: %s", providerio.Redact(err.Error(), o.cfg.APIKey))
+	if err := writeJSON(ctx, conn, sessionUpdate); err != nil {
+		return "", fmt.Errorf("configuring OpenAI Realtime session: %w", err)
 	}

 	writeErrCh := make(chan error, 1)
 	go func() {
-		// Select on ctx.Done() while waiting for the next chunk so a cancelled
-		// session does not leave this goroutine blocked on an open idle channel.
-		for {
-			select {
-			case <-ctx.Done():
-				writeErrCh <- ctx.Err()
+		for chunk := range chunks {
+			appendMsg := map[string]any{
+				"type":  "input_audio_buffer.append",
+				"audio": base64.StdEncoding.EncodeToString(chunk),
+			}
+			if err := writeJSON(ctx, conn, appendMsg); err != nil {
+				writeErrCh <- err
 				return
-			case chunk, ok := <-chunks:
-				if !ok {
-					// Commit the buffered audio to force final transcription.
-					if err := o.writeJSON(ctx, conn, map[string]any{"type": "input_audio_buffer.commit"}); err != nil {
-						writeErrCh <- err
-						// Unblock the reader: without a close, conn.Read stays
-						// parked on a silent peer and the error is never drained
-						// from writeErrCh. CloseNow aborts instead of waiting on
-						// the close handshake, which a silent peer never answers.
-						conn.CloseNow()
-						return
-					}
-					writeErrCh <- nil
-					return
-				}
-				appendMsg := map[string]any{
-					"type":  "input_audio_buffer.append",
-					"audio": base64.StdEncoding.EncodeToString(chunk),
-				}
-				if err := o.writeJSON(ctx, conn, appendMsg); err != nil {
-					writeErrCh <- err
-					// Same unblocking close as the commit path: a server that
-					// goes silent after session setup would otherwise leave the
-					// reader blocked in conn.Read with the error undrained.
-					conn.CloseNow()
-					return
-				}
 			}
 		}
+		// Commit the buffered audio to force final transcription of the utterance.
+		writeErrCh <- writeJSON(ctx, conn, map[string]any{"type": "input_audio_buffer.commit"})
 	}()

 	// OpenAI deltas are incremental (append), unlike Deepgram/sherpa's cumulative
@@ -155,17 +113,7 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 				}
 			default:
 			}
-			// A user abort cancels the streaming context; the UI matches it
-			// with errors.Is(err, context.Canceled), so return the sentinel
-			// itself (it carries no key) instead of a flat redacted string.
-			// Key on ctx.Err() rather than unwrapping err: the writeErrCh
-			// swap above can replace err with a plain transport error (e.g.
-			// "closed network connection") that doesn't itself unwrap to
-			// context.Canceled even though the cancellation is what caused it.
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
-			return compose(), fmt.Errorf("OpenAI Realtime stream error: %s", providerio.Redact(err.Error(), o.cfg.APIKey))
+			return compose(), fmt.Errorf("OpenAI Realtime stream error: %w", err)
 		}
 		if typ != websocket.MessageText {
 			continue
@@ -177,12 +125,6 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 			if onPartial != nil {
 				onPartial(compose(), false)
 			}
-			// onPartial may deliver the partial that makes the TUI cancel
-			// (Esc). Observe that before the next Read, which can already
-			// have a racing OpenAI error frame buffered.
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
 		case realtimeCompleted:
 			// A completed item replaces the in-progress delta buffer with the
 			// server's authoritative transcript for that segment.
@@ -196,9 +138,6 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 			if onPartial != nil {
 				onPartial(compose(), true)
 			}
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
 			// Once we've committed the buffer (user stopped) and the server has
 			// returned a completed transcription, the utterance is done.
 			if committed {
@@ -208,15 +147,7 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 		case realtimeCommitted:
 			committed = true
 		case realtimeError:
-			// Esc can race an incoming error event: conn.Read may already have
-			// the OpenAI error in hand by the time cancellation lands. Key on
-			// ctx.Err() first, same as every other return point in this loop,
-			// so a cancel that wins the race still surfaces as context.Canceled
-			// instead of a spurious redacted failure alongside it.
-			if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			}
-			return compose(), fmt.Errorf("OpenAI Realtime error: %s", providerio.Redact(evt.text, o.cfg.APIKey))
+			return compose(), fmt.Errorf("OpenAI Realtime error: %s", evt.text)
 		}
 		// The writer signals commit completion out of band; observe it so a
 		// stop with no further audio still flips `committed`.
@@ -224,10 +155,6 @@ func (o *openAIRealtimeTranscriber) StreamTranscribe(ctx context.Context, chunks
 		case werr := <-writeErrCh:
 			if werr == nil {
 				committed = true
-			} else if ctx.Err() != nil {
-				return compose(), ctx.Err()
-			} else {
-				return compose(), fmt.Errorf("OpenAI Realtime stream error: %s", providerio.Redact(werr.Error(), o.cfg.APIKey))
 			}
 		default:
 		}
@@ -274,15 +201,6 @@ func parseRealtimeEvent(data []byte) realtimeEvent {
 	return realtimeEvent{kind: realtimeOther}
 }

-func (o *openAIRealtimeTranscriber) writeJSON(ctx context.Context, conn *websocket.Conn, v any) error {
-	if o.cfg.writeErrInjector != nil {
-		if err := o.cfg.writeErrInjector(); err != nil {
-			return err
-		}
-	}
-	return writeJSON(ctx, conn, v)
-}
-
 func writeJSON(ctx context.Context, conn *websocket.Conn, v any) error {
 	data, err := json.Marshal(v)
 	if err != nil {
@@ -1,437 +0,0 @@
-package dictation
-
-import (
-	"context"
-	"errors"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/coder/websocket"
-)
-
-// Non-cancellation dial failure: handshake returns 101 with an Upgrade header
-// equal to the API key so the dial error embeds the key and redaction must strip it.
-func TestOpenAIRealtimeDialFailureRedactsKey(t *testing.T) {
-	const key = "sk-test-dial-key-abcdef"
-	baseURL := dialFailServerWithUpgrade(t, key)
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: key, BaseURL: baseURL})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, nil)
-	if ferr == nil {
-		t.Fatal("expected dial failure")
-	}
-	if errors.Is(ferr, context.Canceled) {
-		t.Fatalf("dial failure should not be context.Canceled: %v", ferr)
-	}
-	if strings.Contains(ferr.Error(), key) {
-		t.Errorf("API key leaked from dial failure: %v", ferr)
-	}
-	if !strings.Contains(ferr.Error(), "connecting to OpenAI Realtime") {
-		t.Errorf("expected dial-path error prefix, got: %v", ferr)
-	}
-}
-
-// Session-configuration write fails after dial: inject a write error that embeds
-// the API key (peer close cannot reach this path reliably — the session write
-// always lands in the kernel buffer first) and assert redaction.
-func TestOpenAIRealtimeSessionConfigFailureRedactsKey(t *testing.T) {
-	const key = "sk-test-session-key-abcdef"
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Hold open; the client fails on the injected session write before reading.
-		<-ctx.Done()
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{
-		APIKey:  key,
-		BaseURL: url,
-		writeErrInjector: func() error {
-			return errors.New("invalid API key " + key)
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, nil)
-	if ferr == nil {
-		t.Fatal("expected session-config failure")
-	}
-	if errors.Is(ferr, context.Canceled) {
-		t.Fatalf("session-config failure should not be context.Canceled: %v", ferr)
-	}
-	if strings.Contains(ferr.Error(), key) {
-		t.Errorf("API key leaked from session-config failure: %v", ferr)
-	}
-	if !strings.Contains(ferr.Error(), "configuring OpenAI Realtime session") {
-		t.Errorf("expected session-config error prefix, got: %v", ferr)
-	}
-}
-
-// Asynchronous writer failure: session update succeeds, then the audio writer
-// injects a key-bearing write error. The server keeps the connection open and
-// emits a delta so the reader loop observes writeErrCh (not a peer close).
-func TestOpenAIRealtimeWriterFailureRedactsKey(t *testing.T) {
-	const key = "sk-test-writer-key-abcdef"
-	sessionDone := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		if _, _, err := c.Read(ctx); err != nil {
-			return
-		}
-		close(sessionDone)
-		// Keep reading and emit a delta so the client processes an event and
-		// drains writeErrCh while the connection is still open.
-		_ = c.Write(ctx, websocket.MessageText, []byte(
-			`{"type":"conversation.item.input_audio_transcription.delta","delta":"hi"}`,
-		))
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-		}
-	})
-
-	var writes atomic.Int32
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{
-		APIKey:  key,
-		BaseURL: url,
-		writeErrInjector: func() error {
-			// First write is session.update; fail subsequent audio/commit writes.
-			if writes.Add(1) == 1 {
-				return nil
-			}
-			return errors.New("invalid API key " + key)
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 480)
-	// Leave open after the first frame so the writer hits the injected error
-	// on that append rather than a clean commit.
-
-	done := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-		done <- ferr
-	}()
-
-	var ferr error
-	select {
-	case ferr = <-done:
-	case <-time.After(5 * time.Second):
-		close(chunks)
-		t.Fatal("StreamTranscribe did not complete after writer failure")
-	}
-	close(chunks)
-
-	if ferr == nil {
-		t.Fatal("expected writer failure")
-	}
-	if errors.Is(ferr, context.Canceled) {
-		t.Fatalf("writer failure should not be context.Canceled: %v", ferr)
-	}
-	if strings.Contains(ferr.Error(), key) {
-		t.Errorf("API key leaked from writer failure: %v", ferr)
-	}
-	if !strings.Contains(ferr.Error(), "OpenAI Realtime stream error") {
-		t.Errorf("expected stream/writer error prefix, got: %v", ferr)
-	}
-	select {
-	case <-sessionDone:
-	default:
-		// Session may race the injected audio write; prefix assertion above is enough.
-	}
-}
-
-// Writer failure with a silent server: the peer never sends a frame after
-// session setup, so the reader is parked in conn.Read. The writer must close
-// the connection on failure or the writeErrCh error is never observed and
-// StreamTranscribe blocks forever.
-func TestOpenAIRealtimeWriterFailureUnblocksSilentServer(t *testing.T) {
-	const key = "sk-test-silent-writer-key-abcdef"
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Hold the connection open without ever writing a frame.
-		<-ctx.Done()
-	})
-
-	var writes atomic.Int32
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{
-		APIKey:  key,
-		BaseURL: url,
-		writeErrInjector: func() error {
-			// First write is session.update; fail the subsequent append write.
-			if writes.Add(1) == 1 {
-				return nil
-			}
-			return errors.New("invalid API key " + key)
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 480)
-	// Leave the channel open: the writer must fail on the append, not the commit.
-	done := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, func(string, bool) {})
-		done <- ferr
-	}()
-
-	select {
-	case ferr := <-done:
-		if ferr == nil {
-			t.Fatal("expected writer failure")
-		}
-		if errors.Is(ferr, context.Canceled) {
-			t.Fatalf("writer failure should not be context.Canceled: %v", ferr)
-		}
-		if strings.Contains(ferr.Error(), key) {
-			t.Errorf("API key leaked from writer failure: %v", ferr)
-		}
-		if !strings.Contains(ferr.Error(), "OpenAI Realtime stream error") {
-			t.Errorf("expected stream/writer error prefix, got: %v", ferr)
-		}
-	case <-time.After(5 * time.Second):
-		close(chunks)
-		t.Fatal("StreamTranscribe did not unblock after writer failure with a silent server")
-	}
-}
-
-func TestOpenAIRealtimeStreamTranscribeErrorRedaction(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		defer c.Close(websocket.StatusNormalClosure, "")
-		for {
-			typ, _, err := c.Read(ctx)
-			if err != nil {
-				return
-			}
-			if typ != websocket.MessageText {
-				continue
-			}
-			_ = c.Write(ctx, websocket.MessageText, []byte(`{"type":"error","error":{"message":"invalid API key sk-test-key"}}`))
-		}
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 480)
-	close(chunks)
-	_, ferr := tr.StreamTranscribe(context.Background(), chunks, func(string, bool) {})
-	if ferr == nil {
-		t.Fatal("expected error")
-	}
-	if strings.Contains(ferr.Error(), "sk-test-key") {
-		t.Errorf("API key leaked: %v", ferr)
-	}
-}
-
-func TestOpenAIRealtimeStreamTranscribeCancelKeepsSentinel(t *testing.T) {
-	firstFrame := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		// Hold the connection open, never answering, so the client blocks in
-		// Read until its context is cancelled (the Esc-abort path).
-		var once sync.Once
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-			once.Do(func() { close(firstFrame) })
-		}
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	chunks <- make([]byte, 480)
-	// The channel stays open: the session is live when the user aborts.
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-firstFrame:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("cancelled stream error lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed early instead of blocking: %v", ferr)
-	}
-}
-
-// Esc can cancel while the WebSocket dial is still pending. The dial error is
-// redacted with %s, so we must return ctx.Err() rather than a flat string.
-func TestOpenAIRealtimeStreamTranscribeDialCancelKeepsSentinel(t *testing.T) {
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{
-		APIKey:  "sk-test-key",
-		BaseURL: "ws://127.0.0.1:1", // never reached; ctx is already cancelled
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	chunks := make(chan []byte)
-	defer close(chunks)
-
-	_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-	if !errors.Is(ferr, context.Canceled) {
-		t.Fatalf("dial-cancel lost the context.Canceled sentinel: %v", ferr)
-	}
-}
-
-// Esc right after accept can hit the session-update write or the first Read;
-// both redaction sites must still yield context.Canceled.
-func TestOpenAIRealtimeStreamTranscribeStartupCancelKeepsSentinel(t *testing.T) {
-	accepted := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		close(accepted)
-		// Do not read: leave the client in session-update write or first Read.
-		<-ctx.Done()
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-accepted:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("startup-cancel lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed before accept: %v", ferr)
-	}
-}
-
-// Cancel while the writer is blocked on more chunks. Whichever path observes
-// the cancellation first (the blocked conn.Read or the writeErrCh drain) must
-// return context.Canceled rather than a redacted flat string.
-func TestOpenAIRealtimeStreamTranscribeWriteCancelKeepsSentinel(t *testing.T) {
-	sessionReceived := make(chan struct{})
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		if _, _, err := c.Read(ctx); err != nil {
-			return
-		}
-		close(sessionReceived)
-		for {
-			if _, _, err := c.Read(ctx); err != nil {
-				return
-			}
-		}
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	chunks <- make([]byte, 480)
-	defer close(chunks)
-
-	errCh := make(chan error, 1)
-	go func() {
-		_, ferr := tr.StreamTranscribe(ctx, chunks, nil)
-		errCh <- ferr
-	}()
-
-	select {
-	case <-sessionReceived:
-		cancel()
-		ferr := <-errCh
-		if !errors.Is(ferr, context.Canceled) {
-			t.Fatalf("write-path cancel lost the context.Canceled sentinel: %v", ferr)
-		}
-	case ferr := <-errCh:
-		t.Fatalf("StreamTranscribe failed early instead of blocking: %v", ferr)
-	}
-}
-
-// Esc can race an incoming OpenAI error event. conn.Read may already have
-// the error frame in hand by the time the cancellation lands. The server
-// fires a delta immediately followed by the error, back to back. Cancel from
-// inside the delta callback (same path the TUI uses when a partial triggers
-// Esc handling) so the cancel is observed before the next event is processed.
-// The returned error must still be context.Canceled, not the redacted OpenAI
-// error.
-func TestOpenAIRealtimeStreamTranscribeErrorRaceKeepsSentinel(t *testing.T) {
-	url := wsTestServer(t, func(ctx context.Context, c *websocket.Conn) {
-		if _, _, err := c.Read(ctx); err != nil {
-			return
-		}
-		_ = c.Write(ctx, websocket.MessageText, []byte(
-			`{"type":"conversation.item.input_audio_transcription.delta","delta":"hi"}`,
-		))
-		_ = c.Write(ctx, websocket.MessageText, []byte(
-			`{"type":"error","error":{"message":"invalid API key sk-test-key"}}`,
-		))
-		<-ctx.Done()
-	})
-
-	tr, err := NewOpenAIRealtimeTranscriber(OpenAIRealtimeConfig{APIKey: "sk-test-key", BaseURL: url})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	chunks := make(chan []byte, 1)
-	defer close(chunks)
-	chunks <- make([]byte, 480)
-	var once sync.Once
-	_, ferr := tr.StreamTranscribe(ctx, chunks, func(string, bool) {
-		// Cancel synchronously from the partial callback, before the
-		// stream loop continues to the already-buffered error frame.
-		once.Do(cancel)
-	})
-	if !errors.Is(ferr, context.Canceled) {
-		t.Fatalf("StreamTranscribe error = %v, want context.Canceled (cancel must win over a racing OpenAI error event)", ferr)
-	}
-}
@@ -9,16 +9,7 @@ import (
 	"strings"
 )

-// PolicyVersion is the version of the approval policy that recorded grants were
-// evaluated under. Bump it whenever a change narrows what may be approved: the
-// grant store then backs the file up, keeps deny grants, invalidates prior
-// approvals, and tells the user once, instead of silently honoring approvals
-// that the current rules would have refused.
-//
-// v2 tightened command-prefix validation so a launcher spelled with a version
-// or an executable extension ("python3.11", "python.exe") can no longer be
-// approved as an ordinary command.
-const PolicyVersion = 2
+const PolicyVersion = 1

 type Origin string

@@ -6,8 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"os/exec"
-	"strconv"
-	"strings"
 	"syscall"
 	"time"
 )
@@ -40,45 +38,12 @@ func KillProcessTree(pid int) error {
 // TerminateProcessTree requests graceful termination, then force-kills the
 // process tree after grace. Callers retain their distinct persistence models;
 // this function owns only the OS lifecycle primitive.
-//
-// The signal target is REDISCOVERED here via processSignalTarget(pid), which
-// asks the OS for pid's current group. A caller that already knows pid was
-// configured as its own group leader at launch (e.g. via ConfigureProcessGroup)
-// should use TerminateProcessGroup instead — see its doc comment for why this
-// rediscovery is fragile once the leader may have already exited.
 func TerminateProcessTree(pid int, grace, poll time.Duration) error {
 	target, err := processSignalTarget(pid)
 	if err != nil {
 		return err
 	}
-	return terminateTarget(pid, target, grace, poll)
-}
-
-// TerminateProcessGroup is like TerminateProcessTree, but for a caller that
-// already knows pid is (or was, at launch) its own process-group leader — e.g.
-// a command started after ConfigureProcessGroup(cmd), which sets Setpgid so
-// cmd.Process.Pid always leads its own group at the moment it is signalled.
-//
-// TerminateProcessTree instead rediscovers the group via syscall.Getpgid(pid)
-// at call time. On Darwin, that lookup can return ESRCH once an unreaped group
-// leader has already exited, even though live descendants remain in the group
-// it configured — TerminateProcessTree would then silently fall back to
-// signalling only the (already dead) leader PID and leave those descendants
-// running. Skipping rediscovery in favor of the launch-time invariant avoids
-// that: the negative PID is used directly, regardless of whether the leader is
-// still alive to be looked up.
-func TerminateProcessGroup(pid int, grace, poll time.Duration) error {
-	if pid <= 1 {
-		return fmt.Errorf("refusing to signal invalid pid %d", pid)
-	}
-	return terminateTarget(pid, -pid, grace, poll)
-}
-
-// terminateTarget signals target (an individual PID or, negative, a process
-// group) with SIGTERM then, after grace, SIGKILL. reportPid identifies the
-// original process in error messages regardless of which form target takes.
-func terminateTarget(reportPid, target int, grace, poll time.Duration) error {
-	alive := func() bool { return signalTargetRunning(target) }
+	alive := func() bool { return syscall.Kill(target, syscall.Signal(0)) == nil }
 	if err := syscall.Kill(target, syscall.SIGTERM); err != nil {
 		if errors.Is(err, syscall.ESRCH) {
 			return nil
@@ -112,91 +77,11 @@ func terminateTarget(reportPid, target int, grace, poll time.Duration) error {
 		time.Sleep(poll)
 	}
 	if alive() {
-		return fmt.Errorf("process %d did not exit after SIGKILL", reportPid)
+		return fmt.Errorf("process %d did not exit after SIGKILL", pid)
 	}
 	return nil
 }

-// signalTargetRunning reports whether the signal target still has a process that
-// is actually RUNNING, as opposed to one waiting to be reaped.
-//
-// kill(2) with signal 0 succeeds for a zombie: the PID still exists until its
-// parent collects it. That matters because the target here is usually a process
-// GROUP, and a terminated leader's child is briefly a zombie before init/launchd
-// reaps it. Treating that window as "still alive" made termination sit through
-// both grace periods, SIGKILL an already-dead group, and then report
-// "did not exit after SIGKILL" for a tree that had in fact stopped — turning a
-// successful cleanup into a spurious failure (and a flaky one, since it depends on
-// reap timing).
-//
-// Zombie detection goes through ps, which is available on every Unix we target and
-// avoids a /proc dependency Darwin does not have. It is only consulted when the
-// cheap kill check says something is still there, so the common path costs nothing
-// extra. If ps cannot be run or its output cannot be parsed, the conservative
-// pre-existing answer (the kill result) stands.
-func signalTargetRunning(target int) bool {
-	if syscall.Kill(target, syscall.Signal(0)) != nil {
-		return false
-	}
-	// A negative target is a process GROUP: check whether any member is
-	// non-zombie. A positive target is an individual PID that is NOT its own
-	// group leader (processSignalTarget's fallback) — its actual PGID differs
-	// from its own PID, so matching rows by PGID here would look for a group
-	// that doesn't exist and always report "unknown" (conservatively alive).
-	// Check its own PID's state instead.
-	var running, ok bool
-	if target < 0 {
-		running, ok = processGroupHasRunningMember(-target)
-	} else {
-		running, ok = processIsRunning(target)
-	}
-	if !ok {
-		return true
-	}
-	return running
-}
-
-// processGroupHasRunningMember reports whether any member of pgid is in a state
-// other than zombie. ok is false when the group's states could not be determined.
-func processGroupHasRunningMember(pgid int) (running bool, ok bool) {
-	return processTableStateMatches(func(_, rowPgid int) bool { return rowPgid == pgid })
-}
-
-// processIsRunning reports whether pid itself is in a state other than zombie.
-// ok is false when pid's state could not be determined.
-func processIsRunning(pid int) (running bool, ok bool) {
-	return processTableStateMatches(func(rowPid, _ int) bool { return rowPid == pid })
-}
-
-// processTableStateMatches scans the process table once, via ps, and reports
-// whether any row satisfying match is non-zombie, and whether at least one
-// matching row was found at all (ok). No rows found means either the process
-// (or group) genuinely doesn't exist (a race with exit) or ps's output was
-// unparseable/restricted; either way, the caller should not claim knowledge.
-func processTableStateMatches(match func(pid, pgid int) bool) (running bool, ok bool) {
-	output, err := exec.Command("ps", "-A", "-o", "pid=,pgid=,stat=").Output()
-	if err != nil {
-		return false, false
-	}
-	found := false
-	for line := range strings.SplitSeq(string(output), "\n") {
-		fields := strings.Fields(line)
-		if len(fields) < 3 {
-			continue
-		}
-		rowPid, errPid := strconv.Atoi(fields[0])
-		rowPgid, errPgid := strconv.Atoi(fields[1])
-		if errPid != nil || errPgid != nil || !match(rowPid, rowPgid) {
-			continue
-		}
-		found = true
-		if !strings.HasPrefix(fields[2], "Z") {
-			return true, true
-		}
-	}
-	return false, found
-}
-
 func processSignalTarget(pid int) (int, error) {
 	if pid <= 1 {
 		return 0, fmt.Errorf("refusing to signal invalid pid %d", pid)
@@ -206,14 +91,10 @@ func processSignalTarget(pid int) (int, error) {
 		if pgid == pid {
 			target = -pid
 		}
-	} else {
-		if errors.Is(err, syscall.ESRCH) {
-			// Preserve the individual target; the signal call below treats ESRCH as
-			// already gone, which is a successful lifecycle outcome.
-			return pid, nil
-		}
-		// Conservatively retain the individual PID after other lookup failures;
-		// guessing and signalling a process group could affect unrelated processes.
+	} else if errors.Is(err, syscall.ESRCH) {
+		// Preserve the individual target; the signal call below treats ESRCH as
+		// already gone, which is a successful lifecycle outcome.
+		return pid, nil
 	}
 	return target, nil
 }
@@ -1,133 +0,0 @@
-//go:build !windows
-
-package execution
-
-import (
-	"os/exec"
-	"strconv"
-	"syscall"
-	"testing"
-	"time"
-)
-
-// TestTerminateProcessTreeTreatsZombieGroupAsExited is the regression test for
-// counting unreaped processes as alive: kill(2) with signal 0 succeeds for a
-// zombie, so a group whose only remaining member is waiting to be reaped used to
-// sit through both grace periods, take a pointless SIGKILL, and then be reported
-// as "did not exit after SIGKILL" — a spurious cleanup failure whose timing
-// depended on when the reaper ran.
-func TestTerminateProcessTreeTreatsZombieGroupAsExited(t *testing.T) {
-	cmd := exec.Command("sh", "-c", "exit 0")
-	ConfigureProcessGroup(cmd)
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	pid := cmd.Process.Pid
-	// Deliberately do NOT Wait: the child stays a zombie in its own group, which
-	// is exactly the state a terminated tree passes through.
-	t.Cleanup(func() { _ = cmd.Wait() })
-
-	deadline := time.Now().Add(5 * time.Second)
-	for {
-		if zombie, ok := processIsZombie(pid); ok && zombie {
-			break
-		}
-		if time.Now().After(deadline) {
-			t.Skip("child did not reach the zombie state; ps output is unavailable in this environment")
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	if syscall.Kill(-pid, syscall.Signal(0)) != nil {
-		t.Skip("the zombie group is no longer signalable; cannot exercise the case")
-	}
-
-	if signalTargetRunning(-pid) {
-		t.Fatal("a group holding only a zombie must not count as running")
-	}
-	if err := TerminateProcessTree(pid, 50*time.Millisecond, 10*time.Millisecond); err != nil {
-		t.Fatalf("TerminateProcessTree on an already-exited tree: %v", err)
-	}
-}
-
-// TestTerminateProcessTreeStopsRunningGroup is the positive control: a group with
-// a live member must still be seen as running and then actually stopped, so the
-// zombie tolerance above cannot degrade into ignoring real processes.
-func TestTerminateProcessTreeStopsRunningGroup(t *testing.T) {
-	cmd := exec.Command("sh", "-c", "sleep 30")
-	ConfigureProcessGroup(cmd)
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	pid := cmd.Process.Pid
-	defer func() { _ = cmd.Wait() }()
-
-	if !signalTargetRunning(-pid) {
-		t.Fatal("a group with a live member must count as running")
-	}
-	if err := TerminateProcessTree(pid, time.Second, 10*time.Millisecond); err != nil {
-		t.Fatalf("TerminateProcessTree: %v", err)
-	}
-	if running, ok := processGroupHasRunningMember(pid); ok && running {
-		t.Fatal("the group still has a running member after termination")
-	}
-}
-
-// TestSignalTargetRunningTreatsZombieIndividualPIDAsExited is the regression
-// test for jatmn's second #774 finding: signalTargetRunning's zombie check
-// matched the individual-PID fallback target (a process that is NOT its own
-// group leader — processSignalTarget's positive-PID case) against process-table
-// rows by PGID. That target's actual PGID differs from its own PID by
-// definition (that's exactly why processSignalTarget fell back to the
-// individual PID instead of a negative group target), so no row ever matched,
-// "unknown" resulted every time, and signalTargetRunning conservatively (and
-// incorrectly) treated a zombie individual-PID target as still running.
-func TestSignalTargetRunningTreatsZombieIndividualPIDAsExited(t *testing.T) {
-	cmd := exec.Command("sh", "-c", "exit 0")
-	// Deliberately do NOT call ConfigureProcessGroup: the child inherits this
-	// test process's group, so it is not its own leader and processSignalTarget
-	// falls back to the individual (positive) PID.
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start: %v", err)
-	}
-	pid := cmd.Process.Pid
-	t.Cleanup(func() { _ = cmd.Wait() })
-
-	deadline := time.Now().Add(5 * time.Second)
-	for {
-		if zombie, ok := processIsZombie(pid); ok && zombie {
-			break
-		}
-		if time.Now().After(deadline) {
-			t.Skip("child did not reach the zombie state; ps output is unavailable in this environment")
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	target, err := processSignalTarget(pid)
-	if err != nil {
-		t.Fatalf("processSignalTarget: %v", err)
-	}
-	if target != pid {
-		t.Skip("child unexpectedly became its own group leader; cannot exercise the individual-PID fallback")
-	}
-	if signalTargetRunning(target) {
-		t.Fatal("a zombie individual-PID target must not count as running")
-	}
-}
-
-// processIsZombie reports a process's zombie state via ps. ok is false when the
-// state could not be read.
-func processIsZombie(pid int) (zombie bool, ok bool) {
-	output, err := exec.Command("ps", "-o", "stat=", "-p", strconv.Itoa(pid)).Output()
-	if err != nil {
-		return false, false
-	}
-	state := string(output)
-	for len(state) > 0 && (state[0] == ' ' || state[0] == '\n' || state[0] == '\t') {
-		state = state[1:]
-	}
-	if state == "" {
-		return false, false
-	}
-	return state[0] == 'Z', true
-}
@@ -3,8 +3,6 @@
 package execution

 import (
-	"errors"
-	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -14,34 +12,10 @@ import (

 func ConfigureProcessGroup(cmd *exec.Cmd) {}

-// KillProcessTree asks taskkill /T to kill pid and descendants it can still
-// discover from that live root. If taskkill fails, it falls back to killing pid
-// alone but still returns the tree error because descendants may have survived.
-// Neither path can recover descendants after the root has exited.
 func KillProcessTree(pid int) error {
-	return killProcessTree(pid, runTaskkill, killRootProcess)
-}
-
-func killProcessTree(pid int, killTree, killRoot func(int) error) error {
-	treeErr := killTree(pid)
-	if treeErr == nil {
+	if err := exec.Command(taskkillPath(), "/T", "/F", "/PID", strconv.Itoa(pid)).Run(); err == nil {
 		return nil
 	}
-	rootErr := killRoot(pid)
-	if rootErr != nil {
-		return errors.Join(
-			fmt.Errorf("kill process tree rooted at %d: %w", pid, treeErr),
-			fmt.Errorf("kill root process %d: %w", pid, rootErr),
-		)
-	}
-	return fmt.Errorf("kill process tree rooted at %d (root process killed directly): %w", pid, treeErr)
-}
-
-func runTaskkill(pid int) error {
-	return exec.Command(taskkillPath(), "/T", "/F", "/PID", strconv.Itoa(pid)).Run()
-}
-
-func killRootProcess(pid int) error {
 	process, err := os.FindProcess(pid)
 	if err != nil {
 		return err
@@ -1,29 +0,0 @@
-//go:build windows
-
-package execution
-
-import (
-	"errors"
-	"strings"
-	"testing"
-)
-
-func TestKillProcessTreeRetainsTreeErrorWhenRootFallbackSucceeds(t *testing.T) {
-	treeErr := errors.New("taskkill failed")
-	err := killProcessTree(42, func(int) error { return treeErr }, func(int) error { return nil })
-	if !errors.Is(err, treeErr) {
-		t.Fatalf("killProcessTree error = %v, want tree error", err)
-	}
-	if !strings.Contains(err.Error(), "root process killed directly") {
-		t.Fatalf("killProcessTree error = %q, want fallback context", err)
-	}
-}
-
-func TestKillProcessTreeJoinsTreeAndRootErrors(t *testing.T) {
-	treeErr := errors.New("taskkill failed")
-	rootErr := errors.New("root kill failed")
-	err := killProcessTree(42, func(int) error { return treeErr }, func(int) error { return rootErr })
-	if !errors.Is(err, treeErr) || !errors.Is(err, rootErr) {
-		t.Fatalf("killProcessTree error = %v, want both failures", err)
-	}
-}
@@ -35,7 +35,7 @@ type Server struct {
 	// credential lookup uses it to avoid reusing legacy user tokens by name.
 	ProjectConfigured bool
 	// UnconfiguredDefault is true when this server is one of Zero's built-in
-	// defaults (e.g. keyless Exa) that the user never touched in their
+	// defaults (e.g. keyless Firecrawl) that the user never touched in their
 	// config — no credentials, no overrides. Callers use it to avoid warning
 	// loudly when a server nobody configured fails to connect.
 	UnconfiguredDefault bool
@@ -1,8 +1,6 @@
 package mcp

 import (
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"

@@ -92,7 +90,7 @@ func TestNormalizeConfigValidatesTransportBoundaries(t *testing.T) {

 func TestNormalizeConfigFlagsUnconfiguredDefault(t *testing.T) {
 	cfg := config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"exa": config.DefaultMCPServers()["exa"],
+		"firecrawl": config.DefaultMCPServers()["firecrawl"],
 		"web": {
 			Type: "http",
 			URL:  "https://example.com/mcp",
@@ -109,8 +107,8 @@ func TestNormalizeConfigFlagsUnconfiguredDefault(t *testing.T) {
 		byName[server.Name] = server
 	}

-	if !byName["exa"].UnconfiguredDefault {
-		t.Fatal("an untouched exa default should be flagged UnconfiguredDefault")
+	if !byName["firecrawl"].UnconfiguredDefault {
+		t.Fatal("an untouched firecrawl default should be flagged UnconfiguredDefault")
 	}
 	if byName["web"].UnconfiguredDefault {
 		t.Fatal("a server the user configured must not be flagged UnconfiguredDefault")
@@ -242,116 +240,3 @@ func TestCopyStringMapTrimsKeysAndPreservesValues(t *testing.T) {
 		t.Fatalf("copied[TOKEN] = %q, want value preserved verbatim", copied["TOKEN"])
 	}
 }
-
-// Startup behavior for the firecrawl -> exa default migration: a user who
-// disabled the retired default must end up with no Exa server to connect to,
-// not merely a disabled entry in the resolved config.
-func TestNormalizeConfigSkipsExaAfterLegacyFirecrawlDisable(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"disabled":true}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.ResolveMCP(config.ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	servers, err := NormalizeConfig(cfg)
-	if err != nil {
-		t.Fatalf("NormalizeConfig: %v", err)
-	}
-	for _, server := range servers {
-		if server.Name == "exa" {
-			t.Fatalf("exa must not be started after the user disabled the default it replaced: %#v", server)
-		}
-	}
-}
-
-// The same path with no legacy disable still starts Exa, so the migration
-// cannot quietly switch off the default for everyone else.
-func TestNormalizeConfigStartsExaWithoutLegacyDisable(t *testing.T) {
-	cfg, err := config.ResolveMCP(config.ResolveOptions{})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	servers, err := NormalizeConfig(cfg)
-	if err != nil {
-		t.Fatalf("NormalizeConfig: %v", err)
-	}
-	for _, server := range servers {
-		if server.Name == "exa" {
-			if !server.UnconfiguredDefault {
-				t.Fatalf("an untouched exa default should be flagged unconfigured: %#v", server)
-			}
-			return
-		}
-	}
-	t.Fatal("expected the exa default to be started out of the box")
-}
-
-// The failure path CodeRabbit flagged: a firecrawl entry that named only a
-// header relied on the retired default for its transport. Resolving it must
-// still produce a complete server — an incomplete one fails NormalizeConfig,
-// which takes down every other server's startup with it, not just this one.
-func TestNormalizeConfigResolvesPartialRetiredDefaultEntry(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"headers":{"Authorization":"Bearer k"}}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.ResolveMCP(config.ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	servers, err := NormalizeConfig(cfg)
-	if err != nil {
-		t.Fatalf("a header-only legacy entry must not break startup: %v", err)
-	}
-	var firecrawl *Server
-	var sawExa bool
-	for i := range servers {
-		switch servers[i].Name {
-		case "firecrawl":
-			firecrawl = &servers[i]
-		case "exa":
-			sawExa = true
-		}
-	}
-	if firecrawl == nil {
-		t.Fatalf("expected the customized firecrawl server to survive: %#v", servers)
-	}
-	if firecrawl.Type != ServerTypeHTTP || firecrawl.URL != "https://mcp.firecrawl.dev/v2/mcp" {
-		t.Fatalf("firecrawl lost the transport its entry relied on: %#v", *firecrawl)
-	}
-	if firecrawl.Headers["Authorization"] != "Bearer k" {
-		t.Fatalf("firecrawl lost the user's header: %#v", *firecrawl)
-	}
-	if !sawExa {
-		t.Fatal("the new exa default should still start alongside it")
-	}
-}
-
-// The mirror case: an entry that names its own stdio transport must not have
-// the retired http default grafted onto it, which would be rejected outright.
-func TestNormalizeConfigLeavesRetiredEntryWithOwnTransportAlone(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "config.json")
-	if err := os.WriteFile(path, []byte(`{"mcp":{"servers":{"firecrawl":{"command":"firecrawl-mcp"}}}}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	cfg, err := config.ResolveMCP(config.ResolveOptions{UserConfigPath: path})
-	if err != nil {
-		t.Fatalf("ResolveMCP: %v", err)
-	}
-	servers, err := NormalizeConfig(cfg)
-	if err != nil {
-		t.Fatalf("a self-hosted stdio entry must keep working: %v", err)
-	}
-	for _, server := range servers {
-		if server.Name != "firecrawl" {
-			continue
-		}
-		if server.Type != ServerTypeStdio || server.Command != "firecrawl-mcp" {
-			t.Fatalf("the user's own stdio transport was corrupted: %#v", server)
-		}
-		return
-	}
-	t.Fatalf("expected the self-hosted firecrawl server to survive: %#v", servers)
-}
@@ -153,16 +153,16 @@ func TestRegisterToolsSkipsUnreachableServerAndKeepsOthers(t *testing.T) {
 }

 func TestRegisterToolsFlagsUnconfiguredDefaultOnSkip(t *testing.T) {
-	// Exa is seeded by config.DefaultMCPServers with no credentials; when a
-	// user never configures it, a connect failure must be recorded as
-	// UnconfiguredDefault so callers can avoid
+	// firecrawl is seeded by config.DefaultMCPServers with no credentials; when a
+	// user never configures it, a connect failure (e.g. the real HTTP 401 from
+	// issue #552) must be recorded as UnconfiguredDefault so callers can avoid
 	// warning about a server the user never asked for. "custom" is configured by
 	// the user and must NOT be flagged even though it also fails to connect.
 	registry := tools.NewRegistry()

 	runtime, err := RegisterTools(context.Background(), registry, config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"exa":    config.DefaultMCPServers()["exa"],
-		"custom": {Type: "stdio", Command: "custom-mcp"},
+		"firecrawl": config.DefaultMCPServers()["firecrawl"],
+		"custom":    {Type: "stdio", Command: "custom-mcp"},
 	}}, RegisterOptions{
 		ClientFactory: func(_ context.Context, server Server) (ToolClient, error) {
 			return nil, errors.New(server.Name + " connect failed")
@@ -177,12 +177,12 @@ func TestRegisterToolsFlagsUnconfiguredDefaultOnSkip(t *testing.T) {
 	for _, skipped := range runtime.Skipped() {
 		byName[skipped.Name] = skipped
 	}
-	exa, ok := byName["exa"]
+	firecrawl, ok := byName["firecrawl"]
 	if !ok {
-		t.Fatalf("Skipped() = %#v, want an entry for exa", runtime.Skipped())
+		t.Fatalf("Skipped() = %#v, want an entry for firecrawl", runtime.Skipped())
 	}
-	if !exa.UnconfiguredDefault {
-		t.Fatalf("Skipped()[exa] = %#v, want UnconfiguredDefault", exa)
+	if !firecrawl.UnconfiguredDefault {
+		t.Fatalf("Skipped()[firecrawl] = %#v, want UnconfiguredDefault", firecrawl)
 	}
 	custom, ok := byName["custom"]
 	if !ok {
@@ -231,12 +231,6 @@ func reasoningEffortsForModelName(name string) []ReasoningEffort {
 		// the gateway's translation concern — unknown fields are ignored, so the
 		// worst case is a silent no-op rather than a 400.
 		return []ReasoningEffort{ReasoningEffortLow, ReasoningEffortMedium, ReasoningEffortHigh}
-	case strings.Contains(n, "deepseek"):
-		// DeepSeek V4 (deepseek-v4-flash / deepseek-v4-pro) exposes thinking-mode
-		// effort control through the OpenAI-compatible reasoning_effort parameter.
-		// The API accepts low/high/max and maps medium/xhigh onto high, so only
-		// the three distinct tiers are advertised.
-		return []ReasoningEffort{ReasoningEffortLow, ReasoningEffortHigh, ReasoningEffortMax}
 	default:
 		return nil
 	}
@@ -20,10 +20,6 @@ func TestReasoningEffortsFallbackForGPT5AndOSeries(t *testing.T) {
 		{"hy3", []ReasoningEffort{ReasoningEffortLow, ReasoningEffortMedium, ReasoningEffortHigh}},
 		{"hunyuan-t1", []ReasoningEffort{ReasoningEffortLow, ReasoningEffortMedium, ReasoningEffortHigh}},
 		{"openai/o3-mini", []ReasoningEffort{ReasoningEffortLow, ReasoningEffortMedium, ReasoningEffortHigh}}, // github-style vendor/ id
-		{"deepseek-v4-flash", []ReasoningEffort{ReasoningEffortLow, ReasoningEffortHigh, ReasoningEffortMax}},
-		{"deepseek-v4-pro", []ReasoningEffort{ReasoningEffortLow, ReasoningEffortHigh, ReasoningEffortMax}},
-		{"deepseek-reasoner", []ReasoningEffort{ReasoningEffortLow, ReasoningEffortHigh, ReasoningEffortMax}},
-		{"deepseek-chat", []ReasoningEffort{ReasoningEffortLow, ReasoningEffortHigh, ReasoningEffortMax}},
 		{"gpt-4.1", nil}, // non-reasoning, registered: stays empty
 		{"gpt-4o-mini", nil},
 		{"ollama/llama3.1", nil},
@@ -1,177 +0,0 @@
-// Package pathjail confines file operations to a directory tree.
-//
-// It exists because the obvious guard does not work. Checking a path with
-// Lstat and then handing the same string to MkdirAll, CreateTemp, Rename or
-// Remove is two independent resolutions with a gap between them, and every
-// operation after the check re-resolves the ANCESTORS as well. A store that
-// verified only its own directory and file was therefore writable outside its
-// tree whenever any component above them was a link: the check passed, and the
-// syscall that followed went somewhere else.
-//
-// On Windows the same guard failed for a second, independent reason. A junction
-// is a reparse point but NOT a symlink, so os.Lstat reports it as ModeIrregular
-// with ModeSymlink clear, and a guard testing only ModeSymlink returns "not a
-// link" when pointed straight at one. Junctions also need no privilege to
-// create, unlike Windows symlinks, so this is reachable by exactly the
-// unprivileged user a workspace guard is meant to contain.
-//
-// The fix for both is to stop naming things by path. Open a handle on the root
-// once and address everything below it relative to that handle, so the kernel
-// resolves each component against an object that cannot be swapped underneath.
-// os.Root is that handle: it refuses any component that would escape, including
-// a Windows reparse point, and it is the same idea the sandbox uses for ACL
-// materialization.
-package pathjail
-
-import (
-	"crypto/rand"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// ErrEscapes reports a target that is not inside the root it was confined to.
-// Returned before anything is opened, so a caller cannot act on the path first.
-var ErrEscapes = errors.New("path escapes its root")
-
-// ErrReparse reports a link or reparse point where a real file or directory was
-// required.
-var ErrReparse = errors.New("refusing to write through a link")
-
-// Open confines dir to root and returns a handle on root plus dir expressed
-// relative to it. The caller closes the handle.
-//
-// root is resolved normally, because it is the boundary the caller chose and
-// trusts (a workspace the operator opened, say, which may legitimately sit under
-// a link). Everything BELOW it is resolved against the returned handle and
-// cannot escape.
-func Open(root, dir string) (*os.Root, string, error) {
-	// Only a genuinely EMPTY value is treated as missing; every other spelling is
-	// used verbatim. Testing TrimSpace(...) == "" instead would retarget the very
-	// paths this guards: " " is a legal directory name on unix, so trimming would
-	// reject it as "no root" or silently swap dir for root, which is the same
-	// retargeting bug as trimming "root " down to "root".
-	if root == "" {
-		return nil, "", fmt.Errorf("%w: no root to confine %q to", ErrEscapes, dir)
-	}
-	if dir == "" {
-		dir = root
-	}
-	// Rel before Open, so an escaping target is refused without opening
-	// anything. filepath.Rel is lexical, which is the right test here: it says
-	// what the caller ASKED for, and the handle enforces what actually happens.
-	relative, err := filepath.Rel(root, dir)
-	if err != nil {
-		return nil, "", fmt.Errorf("%w: %q against %q: %v", ErrEscapes, dir, root, err)
-	}
-	if relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
-		return nil, "", fmt.Errorf("%w: %q is outside %q", ErrEscapes, dir, root)
-	}
-	// The root is created if it is missing, by ordinary pathname, because it is
-	// the boundary the caller declared rather than anything being confined. The
-	// stores this replaced called MkdirAll on the whole tree, so this creates
-	// strictly less by pathname than before, and everything BELOW root is opened
-	// relative to the handle.
-	if err := os.MkdirAll(root, 0o700); err != nil {
-		return nil, "", fmt.Errorf("create %s: %w", root, err)
-	}
-	handle, err := os.OpenRoot(root)
-	if err != nil {
-		return nil, "", fmt.Errorf("open %s: %w", root, err)
-	}
-	return handle, relative, nil
-}
-
-// RefuseReparse fails when relative names a link or reparse point.
-//
-// Absent is fine: a name that does not exist yet is what a create is for.
-//
-// This is belt to os.Root's braces. The handle already refuses to traverse a
-// reparse point, so this exists to give the FINAL component a clear error
-// instead of an "escapes from parent" one, and to keep the refusal explicit at
-// the point a reader looks for it.
-//
-// ModeIrregular is tested alongside ModeSymlink deliberately: that is what a
-// Windows junction reports, and a guard checking only ModeSymlink lets one
-// straight through.
-func RefuseReparse(handle *os.Root, relative string) error {
-	// A trailing separator makes os.Root.Lstat resolve the terminal component on
-	// Windows (doInRootAlwaysResolveTerminalSlash), so a junction named with a
-	// trailing slash would be stat'd as its target and wave through as "not a
-	// link". Strip it so the final component itself is the thing inspected.
-	//
-	// os.IsPathSeparator rather than a literal `/\` set, because backslash is a
-	// separator only on Windows: on unix it is an ordinary filename character, and
-	// trimming it would inspect "linked" when asked about a symlink genuinely
-	// named `linked\` — reporting "not a link" for one that is.
-	if trimmed := trimTrailingSeparators(relative); trimmed != "" {
-		relative = trimmed
-	}
-	info, err := handle.Lstat(relative)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			return nil
-		}
-		return fmt.Errorf("inspect %s: %w", relative, err)
-	}
-	if info.Mode()&(os.ModeSymlink|os.ModeIrregular) != 0 {
-		return fmt.Errorf("%w: %s", ErrReparse, relative)
-	}
-	return nil
-}
-
-// trimTrailingSeparators drops the path separators at the end of a name, using
-// the ACTIVE platform's definition of one: `/` and `\` on Windows, `/` only on
-// unix, where a backslash is a legal character in a filename.
-func trimTrailingSeparators(path string) string {
-	end := len(path)
-	for end > 0 && os.IsPathSeparator(path[end-1]) {
-		end--
-	}
-	return path[:end]
-}
-
-// randomBytes fills b with cryptographic randomness. A variable rather than a
-// direct crypto/rand call so a test can force the name collision that exercises
-// the O_EXCL retry below — the branch that matters, and one a real random source
-// will not reach on demand.
-var randomBytes = rand.Read
-
-// CreateTemp makes an O_EXCL temp file named prefix.<random>suffix inside dir,
-// relative to handle, and returns it with its relative path.
-//
-// O_EXCL rather than a fixed name: a link planted at a predictable temp path
-// between the check and the create is the same race this package exists to
-// close, and O_EXCL makes the kernel refuse it rather than us.
-func CreateTemp(handle *os.Root, dir, prefix, suffix string) (*os.File, string, error) {
-	// prefix and suffix are NAME fragments, not path fragments. A separator or a
-	// "."/".." in either would relocate the file out of dir — a prefix of
-	// "../escaped", or a suffix of ".tmp/../evil" that also erases the random
-	// component and with it the O_EXCL unpredictability the file relies on.
-	// Reject them up front so the file lands where dir promises.
-	for _, fragment := range []string{prefix, suffix} {
-		if strings.ContainsAny(fragment, `/\`) || fragment == "." || fragment == ".." {
-			return nil, "", fmt.Errorf("%w: temporary name fragment %q must be a single path component", ErrEscapes, fragment)
-		}
-	}
-	for attempt := 0; attempt < 10; attempt++ {
-		noise := make([]byte, 8)
-		if _, err := randomBytes(noise); err != nil {
-			return nil, "", fmt.Errorf("generate a temporary name: %w", err)
-		}
-		relative := filepath.Join(dir, prefix+"."+hex.EncodeToString(noise)+suffix)
-		file, err := handle.OpenFile(relative, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o600)
-		if err == nil {
-			return file, relative, nil
-		}
-		if errors.Is(err, fs.ErrExist) {
-			continue
-		}
-		return nil, "", err
-	}
-	return nil, "", errors.New("could not create a temporary file with an unused name")
-}
@@ -1,360 +0,0 @@
-package pathjail
-
-import (
-	"encoding/hex"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"testing"
-)
-
-// linkDir points link at target, using whatever kind of link this platform lets
-// an unprivileged process create.
-//
-// On Windows that is a JUNCTION, not a symlink, and the difference is the whole
-// reason this package exists twice over. A symlink needs
-// SeCreateSymbolicLinkPrivilege, which an ordinary account does not hold, so a
-// test written with os.Symlink silently skips on Windows and proves nothing
-// there. A junction needs no privilege at all, so it is both the reachable
-// attack and the only one that can be tested.
-func linkDir(t *testing.T, target, link string) {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		if out, err := exec.Command("cmd", "/c", "mklink", "/J", link, target).CombinedOutput(); err != nil {
-			t.Skipf("cannot create a junction: %v %s", err, out)
-		}
-		return
-	}
-	if err := os.Symlink(target, link); err != nil {
-		t.Skipf("cannot create a symlink: %v", err)
-	}
-}
-
-// The reported defect: a link in an ANCESTOR of the target, not at the target
-// itself. Every guard that checked only the final directory and file passed
-// this, because the components it checked were genuinely not links; the ones
-// the syscall then traversed were.
-func TestAnAncestorLinkCannotRedirectAWrite(t *testing.T) {
-	base := t.TempDir()
-	outside := filepath.Join(base, "outside")
-	workspace := filepath.Join(base, "workspace")
-	for _, dir := range []string{outside, workspace} {
-		if err := os.MkdirAll(dir, 0o700); err != nil {
-			t.Fatal(err)
-		}
-	}
-	linkDir(t, outside, filepath.Join(workspace, ".zero"))
-
-	handle, relative, err := Open(workspace, filepath.Join(workspace, ".zero", "store"))
-	if err != nil {
-		t.Fatalf("Open should confine, not refuse outright: %v", err)
-	}
-	defer handle.Close()
-
-	if err := handle.MkdirAll(relative, 0o700); err == nil {
-		t.Fatal("created a directory through a linked ancestor, so a write can still leave the workspace")
-	}
-	if _, err := os.Stat(filepath.Join(outside, "store")); !os.IsNotExist(err) {
-		t.Errorf("something was created outside the workspace, stat error = %v", err)
-	}
-}
-
-// RefuseReparse has to catch a junction, which is the case os.ModeSymlink alone
-// misses. Asserted through the exported helper rather than by reading the mode,
-// so the test fails if the predicate is ever narrowed back.
-func TestRefuseReparseCatchesAJunctionNotJustASymlink(t *testing.T) {
-	base := t.TempDir()
-	target := filepath.Join(base, "target")
-	inside := filepath.Join(base, "inside")
-	for _, dir := range []string{target, inside} {
-		if err := os.MkdirAll(dir, 0o700); err != nil {
-			t.Fatal(err)
-		}
-	}
-	linkDir(t, target, filepath.Join(inside, "linked"))
-
-	handle, relative, err := Open(inside, inside)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer handle.Close()
-
-	err = RefuseReparse(handle, filepath.Join(relative, "linked"))
-	if !errors.Is(err, ErrReparse) {
-		t.Fatalf("RefuseReparse(link) = %v, want ErrReparse; on Windows a junction reports ModeIrregular, so a ModeSymlink-only check returns nil here", err)
-	}
-}
-
-// A name that does not exist yet is what a create is for, so it must not be
-// refused. Without this the guard above would be satisfied by refusing
-// everything.
-func TestRefuseReparseAllowsAnAbsentName(t *testing.T) {
-	base := t.TempDir()
-	handle, relative, err := Open(base, base)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer handle.Close()
-	if err := RefuseReparse(handle, filepath.Join(relative, "not-there.md")); err != nil {
-		t.Errorf("an absent name was refused: %v", err)
-	}
-	if err := RefuseReparse(handle, relative); err != nil {
-		t.Errorf("an ordinary directory was refused: %v", err)
-	}
-}
-
-// Open refuses a target outside its root before opening anything, so a caller
-// cannot act on the path first.
-func TestOpenRefusesATargetOutsideTheRoot(t *testing.T) {
-	base := t.TempDir()
-	inside := filepath.Join(base, "inside")
-	if err := os.MkdirAll(inside, 0o700); err != nil {
-		t.Fatal(err)
-	}
-	for _, target := range []string{
-		filepath.Join(base, "sibling"),
-		filepath.Join(inside, "..", "..", "escape"),
-	} {
-		if _, _, err := Open(inside, target); !errors.Is(err, ErrEscapes) {
-			t.Errorf("Open(%q, %q) = %v, want ErrEscapes", inside, target, err)
-		}
-	}
-	if _, _, err := Open("", filepath.Join(base, "anything")); !errors.Is(err, ErrEscapes) {
-		t.Error("an empty root was accepted; a boundary is not optional")
-	}
-}
-
-// CreateTemp must use O_EXCL and an unpredictable name, so a link planted at a
-// guessable temp path is refused by the kernel rather than followed.
-func TestCreateTempIsExclusiveAndUnpredictable(t *testing.T) {
-	base := t.TempDir()
-	handle, relative, err := Open(base, base)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer handle.Close()
-
-	seen := map[string]bool{}
-	for i := 0; i < 8; i++ {
-		file, name, err := CreateTemp(handle, relative, "note", ".tmp")
-		if err != nil {
-			t.Fatal(err)
-		}
-		file.Close()
-		if seen[name] {
-			t.Fatalf("CreateTemp reused the name %q, so two concurrent writes would stomp each other", name)
-		}
-		seen[name] = true
-		if filepath.Ext(name) != ".tmp" {
-			t.Errorf("temp name %q lost its suffix, so a listing may pick it up as real content", name)
-		}
-	}
-}
-
-// A legitimate directory whose name carries a space must be confined as spelled.
-// Trimming it would open a different filesystem object.
-//
-// A LEADING space, deliberately: Win32 normalizes a component's trailing spaces
-// and dots away, so "root " and "root" are one object there and a trailing-space
-// case cannot express the bug on Windows. A leading space survives on every
-// platform, so this runs everywhere rather than being gated to unix.
-// The path is RELATIVE, under t.Chdir, so the leading space sits at the start of
-// the whole string. An absolute filepath.Join(base, " root") would put the space
-// in the middle, where TrimSpace cannot reach it — the test would then pass
-// against the very guard it exists to catch, on every platform.
-func TestOpenPreservesSpaceInPaths(t *testing.T) {
-	base := t.TempDir()
-	t.Chdir(base)
-	const spaced = " root" // the leading space is part of the name
-
-	handle, relative, err := Open(spaced, spaced)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer handle.Close()
-
-	// Write through the handle, then confirm the bytes landed under the spelling
-	// the caller asked for — the property that actually matters, and one
-	// handle.Name() alone would not prove.
-	file, _, err := CreateTemp(handle, relative, "probe", ".tmp")
-	if err != nil {
-		t.Fatal(err)
-	}
-	name := file.Name()
-	if err := file.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(filepath.Join(base, spaced, filepath.Base(name))); err != nil {
-		t.Errorf("a file created through the handle is not under %q: %v — the leading space was trimmed away", spaced, err)
-	}
-	if _, err := os.Stat(filepath.Join(base, "root")); err == nil {
-		t.Error(`a trimmed "root" was created instead of the requested " root"`)
-	}
-}
-
-// A whitespace-only name is a legal directory on unix, so it must be confined as
-// given rather than treated as "no root" or silently swapped for the root.
-func TestOpenAcceptsAWhitespaceOnlyComponent(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("Win32 normalizes a whitespace-only component away; the name is not expressible there")
-	}
-	// The path must be whitespace-only IN FULL for this to bite, so it has to be
-	// relative: an absolute path ending in " " still has a non-empty TrimSpace and
-	// would sail past the old guard, making the test prove nothing.
-	t.Chdir(t.TempDir())
-	handle, _, err := Open(" ", " ")
-	if err != nil {
-		t.Fatalf("a whitespace-only path was rejected as missing: %v", err)
-	}
-	defer handle.Close()
-	if _, err := os.Stat(" "); err != nil {
-		t.Errorf("the whitespace-only directory was not created as spelled: %v", err)
-	}
-}
-
-// prefix and suffix are name fragments. A separator or traversal in either must
-// be refused, or the file lands outside dir and (for a suffix erasing the random
-// component) loses the O_EXCL unpredictability it depends on.
-func TestCreateTempRejectsPathFragmentsThatEscapeTheDir(t *testing.T) {
-	base := t.TempDir()
-	inside := filepath.Join(base, "inside")
-	if err := os.MkdirAll(inside, 0o700); err != nil {
-		t.Fatal(err)
-	}
-	// root is base, dir is the subdirectory: a "../escaped" fragment lands in
-	// base — still inside the os.Root, so os.Root does NOT catch it — but outside
-	// the dir CreateTemp promised. This is the case the reviewers reproduced.
-	handle, relative, err := Open(base, inside)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer handle.Close()
-	cases := []struct{ prefix, suffix string }{
-		{"../escaped", ".tmp"},
-		{`..\sibling`, ".tmp"},
-		{"note", ".tmp/../evil"},
-		{"note", ".."},
-		{"..", ".tmp"},
-	}
-	for _, c := range cases {
-		if _, _, err := CreateTemp(handle, relative, c.prefix, c.suffix); !errors.Is(err, ErrEscapes) {
-			t.Errorf("CreateTemp(prefix=%q, suffix=%q) = %v, want ErrEscapes", c.prefix, c.suffix, err)
-		}
-	}
-	// Nothing may have leaked into base above the promised dir.
-	entries, _ := os.ReadDir(base)
-	for _, entry := range entries {
-		if entry.Name() != "inside" {
-			t.Errorf("a temp fragment escaped into the parent: %q", entry.Name())
-		}
-	}
-}
-
-// A junction named with a trailing separator must still be refused. On Windows
-// os.Root.Lstat resolves the terminal component when the name ends in a
-// separator, so without trimming it the link is stat'd as its target and waved
-// through.
-func TestRefuseReparseCatchesALinkNamedWithATrailingSeparator(t *testing.T) {
-	base := t.TempDir()
-	target := filepath.Join(base, "target")
-	inside := filepath.Join(base, "inside")
-	for _, dir := range []string{target, inside} {
-		if err := os.MkdirAll(dir, 0o700); err != nil {
-			t.Fatal(err)
-		}
-	}
-	linkDir(t, target, filepath.Join(inside, "linked"))
-	handle, relative, err := Open(inside, inside)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer handle.Close()
-	name := filepath.Join(relative, "linked") + string(filepath.Separator)
-	if err := RefuseReparse(handle, name); !errors.Is(err, ErrReparse) {
-		t.Fatalf("RefuseReparse(%q) = %v, want ErrReparse", name, err)
-	}
-}
-
-// The O_EXCL retry is the branch that protects an existing file, and a real
-// random source will not collide on demand — so force it. The first two draws
-// return the same bytes: the name is pre-created, CreateTemp must refuse to
-// reuse it, leave its contents alone, and come back with a different name.
-func TestCreateTempRetriesWithoutClobberingAnExistingName(t *testing.T) {
-	base := t.TempDir()
-	handle, relative, err := Open(base, base)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer handle.Close()
-
-	draws := [][]byte{
-		{1, 1, 1, 1, 1, 1, 1, 1}, // collides with the pre-created file
-		{1, 1, 1, 1, 1, 1, 1, 1}, // and again, so the retry must keep trying
-		{2, 2, 2, 2, 2, 2, 2, 2}, // finally a free name
-	}
-	previous := randomBytes
-	t.Cleanup(func() { randomBytes = previous })
-	call := 0
-	randomBytes = func(b []byte) (int, error) {
-		copy(b, draws[min(call, len(draws)-1)])
-		call++
-		return len(b), nil
-	}
-
-	taken := filepath.Join(base, "note."+hex.EncodeToString(draws[0])+".tmp")
-	if err := os.WriteFile(taken, []byte("do not clobber me"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	file, name, err := CreateTemp(handle, relative, "note", ".tmp")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer file.Close()
-
-	if filepath.Base(name) == filepath.Base(taken) {
-		t.Fatalf("CreateTemp returned the name that was already taken (%q), so O_EXCL did not protect it", name)
-	}
-	kept, err := os.ReadFile(taken)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(kept) != "do not clobber me" {
-		t.Errorf("the pre-existing file was overwritten: %q", kept)
-	}
-	if call < 2 {
-		t.Errorf("the random source was drawn %d time(s); the collision path never ran", call)
-	}
-}
-
-// On unix a backslash is an ordinary filename character, not a separator, so a
-// link genuinely named `linked\` must still be refused. Trimming backslashes
-// unconditionally would inspect "linked" instead and report "not a link" for one
-// that is.
-func TestRefuseReparseKeepsABackslashInAUnixName(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip(`backslash is a separator on Windows, so this name is not expressible there`)
-	}
-	base := t.TempDir()
-	target := filepath.Join(base, "target")
-	inside := filepath.Join(base, "inside")
-	for _, dir := range []string{target, inside} {
-		if err := os.MkdirAll(dir, 0o700); err != nil {
-			t.Fatal(err)
-		}
-	}
-	linkDir(t, target, filepath.Join(inside, `linked\`))
-
-	handle, relative, err := Open(inside, inside)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer handle.Close()
-
-	name := filepath.Join(relative, `linked\`)
-	if err := RefuseReparse(handle, name); !errors.Is(err, ErrReparse) {
-		t.Fatalf("RefuseReparse(%q) = %v, want ErrReparse — the backslash is part of the name here, not a separator", name, err)
-	}
-}
@@ -104,7 +104,7 @@ func windowsTokenOwner(token windows.Token) (*windows.SID, error) {
 	}
 	owner := (*windowsTokenOwnerInfo)(unsafe.Pointer(&buffer[0])).owner
 	if owner == nil {
-		return nil, errors.New("windows access token has no default owner")
+		return nil, errors.New("Windows access token has no default owner")
 	}
 	return owner.Copy()
 }
@@ -184,10 +184,6 @@ func parseOpenAIStyleModelList(body []byte) ([]remoteModel, error) {

 func ModelsDevProviderID(provider providercatalog.Descriptor) string {
 	switch strings.TrimSpace(provider.ID) {
-	case "chatgpt":
-		// ChatGPT authenticates against the Codex backend, while its public
-		// model metadata is published under the OpenAI provider on models.dev.
-		return "openai"
 	case "dashscope":
 		return "alibaba"
 	case "github":
@@ -241,7 +241,6 @@ func TestPublicLiveCatalog(t *testing.T) {

 func TestModelsDevProviderIDMapsZeroAliases(t *testing.T) {
 	tests := map[string]string{
-		"chatgpt":      "openai",
 		"github":       "github-models",
 		"moonshot":     "moonshotai",
 		"nvidia-nim":   "nvidia",
@@ -539,8 +539,7 @@ func mergeLiveModels(provider providercatalog.Descriptor, liveModels []Model, ca
 	hasCatalog := len(byID) > 0
 	// Aggregators publish the live list as the source of truth. Keep live-only
 	// ids even when a remote catalog also loaded, instead of intersecting.
-	preferLive := provider.Local ||
-		providermodelcatalog.PublicLiveCatalog(provider.ID) ||
+	preferLive := providermodelcatalog.PublicLiveCatalog(provider.ID) ||
 		providercatalog.NormalizeID(provider.ID) == "chatgpt"
 	result := make([]Model, 0, len(liveModels))
 	for _, live := range liveModels {
@@ -139,68 +139,6 @@ func TestMergeChatGPTModelsKeepsLiveOnlyEntries(t *testing.T) {
 	}
 }

-func TestDiscoverCatalogChatGPTMergesOpenAIModelsDevMetadata(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/api.json":
-			_, _ = w.Write([]byte(`{
-				"openai": {"models": {
-					"gpt-5.6-sol": {
-						"id": "gpt-5.6-sol",
-						"name": "GPT-5.6 Sol",
-						"description": "Frontier coding model",
-						"tool_call": true,
-						"reasoning": true,
-						"reasoning_efforts": ["low", "high", "max"],
-						"limit": {"context": 1050000},
-						"modalities": {"input": ["text", "image", "pdf"], "output": ["text"]}
-					}
-				}}
-			}`))
-		case "/backend-api/codex/models":
-			_, _ = w.Write([]byte(`{"data":[{"id":"gpt-5.6-sol"}]}`))
-		default:
-			t.Errorf("unexpected request path %q", r.URL.Path)
-			http.NotFound(w, r)
-			return
-		}
-	}))
-	defer server.Close()
-
-	provider, ok := providercatalog.Get("chatgpt")
-	if !ok {
-		t.Fatal("ChatGPT provider missing from catalog")
-	}
-	models, err := DiscoverCatalog(context.Background(), provider, config.ProviderProfile{
-		Name:         "chatgpt",
-		CatalogID:    "chatgpt",
-		ProviderKind: config.ProviderKindOpenAICompatible,
-		BaseURL:      server.URL + "/backend-api/codex",
-	}, Options{
-		HTTPClient:   server.Client(),
-		ModelsDevURL: server.URL + "/api.json",
-		OAuthResolver: func(context.Context, bool) (string, string, bool, error) {
-			return "Authorization", "Bearer test", true, nil
-		},
-	})
-	if err != nil {
-		t.Fatalf("DiscoverCatalog returned error: %v", err)
-	}
-	if len(models) != 1 {
-		t.Fatalf("models = %#v, want one ChatGPT live model", models)
-	}
-	model := models[0]
-	if model.ID != "gpt-5.6-sol" || model.ContextWindow != 1050000 || !model.ToolCall || !model.Reasoning {
-		t.Fatalf("merged ChatGPT model = %#v, want models.dev metadata", model)
-	}
-	if got := strings.Join(model.InputModalities, ","); got != "text,image,pdf" {
-		t.Fatalf("input modalities = %q, want text,image,pdf", got)
-	}
-	if got := strings.Join(model.ReasoningEfforts, ","); got != "low,high,max" {
-		t.Fatalf("reasoning efforts = %q, want low,high,max", got)
-	}
-}
-
 func TestMergeLiveModelsUsesLiveDefaultsAndReasoningCapability(t *testing.T) {
 	models := mergeLiveModels(
 		providercatalog.Descriptor{ID: "chatgpt"},
@@ -226,29 +164,6 @@ func TestMergeLiveModelsUsesLiveDefaultsAndReasoningCapability(t *testing.T) {
 	}
 }

-func TestMergeLocalModelsKeepsLiveOnlyEntries(t *testing.T) {
-	models := mergeLiveModels(
-		providercatalog.Descriptor{ID: "lmstudio", Local: true},
-		[]Model{
-			{ID: "qwen3-coder-30b", ContextWindow: 32768},
-			{ID: "text-embedding-local"},
-			{ID: "qwen2.5-coder-32b-instruct", Description: "live description"},
-		},
-		[]Model{{ID: "qwen2.5-coder-32b-instruct", Description: "catalog description", ToolCall: true}},
-	)
-
-	if got, want := strings.Join(modelIDs(models), ","), "qwen3-coder-30b,qwen2.5-coder-32b-instruct"; got != want {
-		t.Fatalf("models = %q, want %q", got, want)
-	}
-	for _, model := range models {
-		if model.ID == "qwen2.5-coder-32b-instruct" {
-			if model.Description != "catalog description" || !model.ToolCall {
-				t.Fatalf("merged catalog metadata = %#v", model)
-			}
-		}
-	}
-}
-
 func TestDiscoverCatalogOpenGatewayUsesLiveListWithoutKey(t *testing.T) {
 	// Catalog and live endpoints return distinct payloads so the merge must keep
 	// live-only ids that are absent from the remote catalog response.
@@ -486,7 +486,7 @@ func (provider *Provider) openAIRequest(request zeroruntime.CompletionRequest) c
 				Function: toolFunction{
 					Name:        tool.Name,
 					Description: tool.Description,
-					Parameters:  normalizeToolParameters(tool.Parameters),
+					Parameters:  tool.Parameters,
 				},
 			})
 		}
@@ -494,21 +494,6 @@ func (provider *Provider) openAIRequest(request zeroruntime.CompletionRequest) c
 	return mapped
 }

-// normalizeToolParameters keeps schemas accepted by strict OpenAI-compatible
-// servers such as LM Studio. No-argument tools still need an object-valued
-// parameters.properties field instead of an omitted field.
-func normalizeToolParameters(parameters map[string]any) map[string]any {
-	normalized := make(map[string]any, len(parameters)+1)
-	for key, value := range parameters {
-		normalized[key] = value
-	}
-	properties, ok := normalized["properties"].(map[string]any)
-	if !ok || properties == nil {
-		normalized["properties"] = map[string]any{}
-	}
-	return normalized
-}
-
 // promptCacheKeyDisabled reports whether the ZERO_DISABLE_PROMPT_CACHE_KEY
 // kill switch is set to a truthy value. "0" and "false" (any case) are
 // no-ops, matching how ZERO_FORMAT_ON_WRITE parses boolean flags, so an
@@ -3,7 +3,6 @@ package openai
 import (
 	"context"
 	"encoding/json"
-	"io"
 	"net/http"
 	"net/http/httptest"
 	"reflect"
@@ -106,72 +105,6 @@ func TestStreamCompletionPostsChatCompletionRequest(t *testing.T) {
 	if tool["type"] != "function" {
 		t.Fatalf("unexpected tool wrapper: %#v", tool)
 	}
-	functionDefinition := tool["function"].(map[string]any)
-	parameters := functionDefinition["parameters"].(map[string]any)
-	properties, ok := parameters["properties"].(map[string]any)
-	if !ok || len(properties) != 0 {
-		t.Fatalf("parameters.properties = %#v, want empty object", parameters["properties"])
-	}
-}
-
-// TestStreamCompletionSerializesTypedNilPropertiesAsEmptyObject locks in the
-// normalizeToolParameters fix: a tool whose parameters carry a typed-nil
-// properties map must serialize "properties":{} on the wire, never
-// "properties":null, because strict OpenAI-compatible servers (LM Studio)
-// reject the null form.
-func TestStreamCompletionSerializesTypedNilPropertiesAsEmptyObject(t *testing.T) {
-	var gotBody map[string]any
-	var gotRaw []byte
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		raw, err := io.ReadAll(r.Body)
-		if err != nil {
-			t.Fatalf("read request body: %v", err)
-		}
-		gotRaw = raw
-		if err := json.Unmarshal(raw, &gotBody); err != nil {
-			t.Fatalf("decode request body: %v", err)
-		}
-		writeSSE(w, `{"choices":[]}`)
-		writeSSE(w, `[DONE]`)
-	}))
-	defer server.Close()
-
-	provider, err := New(Options{
-		APIKey:  "sk-secret",
-		BaseURL: server.URL + "/",
-		Model:   "gpt-test",
-	})
-	if err != nil {
-		t.Fatalf("New returned error: %v", err)
-	}
-
-	stream, err := provider.StreamCompletion(context.Background(), zeroruntime.CompletionRequest{
-		Messages: []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "hi"}},
-		Tools: []zeroruntime.ToolDefinition{{
-			Name:        "no_args",
-			Description: "Takes no arguments",
-			Parameters:  map[string]any{"type": "object", "properties": map[string]any(nil)},
-		}},
-	})
-	if err != nil {
-		t.Fatalf("StreamCompletion returned error: %v", err)
-	}
-	drain(stream)
-
-	if !strings.Contains(string(gotRaw), `"properties":{}`) {
-		t.Fatalf("request body must serialize properties as an empty object, got: %s", gotRaw)
-	}
-	if strings.Contains(string(gotRaw), `"properties":null`) {
-		t.Fatalf("request body must not serialize properties as null, got: %s", gotRaw)
-	}
-	tools := gotBody["tools"].([]any)
-	tool := tools[0].(map[string]any)
-	functionDefinition := tool["function"].(map[string]any)
-	parameters := functionDefinition["parameters"].(map[string]any)
-	properties, ok := parameters["properties"].(map[string]any)
-	if !ok || len(properties) != 0 {
-		t.Fatalf("parameters.properties = %#v, want empty object", parameters["properties"])
-	}
 }

 func TestNewRequiresModelButNotAPIKey(t *testing.T) {
@@ -1546,66 +1479,3 @@ func TestOpenAIRequestPreservesCacheablePrefixAcrossTurns(t *testing.T) {
 		t.Fatalf("wire prompt cache key must remain stable: first=%#v second=%#v", first["prompt_cache_key"], second["prompt_cache_key"])
 	}
 }
-
-// TestStreamCompletionSerializesNonMapPropertiesAsEmptyObject locks in the
-// normalizeToolParameters type-assert branch: when a tool's parameters carry a
-// `properties` field whose value is a non-map (e.g., an empty slice), it must
-// be normalized to "properties":{} on the wire, never "properties":[] or
-// "properties":null.
-func TestStreamCompletionSerializesNonMapPropertiesAsEmptyObject(t *testing.T) {
-	var gotBody map[string]any
-	var gotRaw []byte
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		raw, err := io.ReadAll(r.Body)
-		if err != nil {
-			t.Fatalf("read request body: %v", err)
-		}
-		gotRaw = raw
-		if err := json.Unmarshal(raw, &gotBody); err != nil {
-			t.Fatalf("decode request body: %v", err)
-		}
-		writeSSE(w, `{"choices":[]}`)
-		writeSSE(w, `[DONE]`)
-	}))
-	defer server.Close()
-
-	provider, err := New(Options{
-		APIKey:  "sk-secret",
-		BaseURL: server.URL + "/",
-		Model:   "gpt-test",
-	})
-	if err != nil {
-		t.Fatalf("New returned error: %v", err)
-	}
-
-	stream, err := provider.StreamCompletion(context.Background(), zeroruntime.CompletionRequest{
-		Messages: []zeroruntime.Message{{Role: zeroruntime.MessageRoleUser, Content: "hi"}},
-		Tools: []zeroruntime.ToolDefinition{{
-			Name:        "no_args",
-			Description: "Takes no arguments",
-			Parameters:  map[string]any{"type": "object", "properties": []any{}},
-		}},
-	})
-	if err != nil {
-		t.Fatalf("StreamCompletion returned error: %v", err)
-	}
-	drain(stream)
-
-	if !strings.Contains(string(gotRaw), `"properties":{}`) {
-		t.Fatalf("request body must serialize properties as an empty object, got: %s", gotRaw)
-	}
-	if strings.Contains(string(gotRaw), `"properties":null`) {
-		t.Fatalf("request body must not serialize properties as null, got: %s", gotRaw)
-	}
-	if strings.Contains(string(gotRaw), `"properties":[]`) {
-		t.Fatalf("request body must not serialize properties as an empty array, got: %s", gotRaw)
-	}
-	tools := gotBody["tools"].([]any)
-	tool := tools[0].(map[string]any)
-	functionDefinition := tool["function"].(map[string]any)
-	parameters := functionDefinition["parameters"].(map[string]any)
-	properties, ok := parameters["properties"].(map[string]any)
-	if !ok || len(properties) != 0 {
-		t.Fatalf("parameters.properties = %#v, want empty object", parameters["properties"])
-	}
-}
@@ -0,0 +1,14 @@
+// Test seams: helpers only test code uses, kept out of the production binary.
+package providerio
+
+import (
+	"bufio"
+	"io"
+)
+
+// ScanSSEData parses Server-Sent Event data fields from a streaming response.
+func ScanSSEData(reader io.Reader, handle func(data string) bool) error {
+	scanner := bufio.NewScanner(reader)
+	scanner.Buffer(make([]byte, 0, 4096), maxSSELineBytes)
+	return scanSSEPayloads(scanner, handle, nil)
+}
@@ -148,10 +148,8 @@ func unsafeCommandPrefix(prefix []string) bool {
 			return true
 		}
 	}
-	normalized := append([]string(nil), prefix...)
-	normalized[0] = normalizeLauncherName(normalized[0])
 	for _, banned := range bannedCommandPrefixSuggestions {
-		if sameStringSlice(prefix, banned) || sameStringSlice(normalized, banned) {
+		if sameStringSlice(prefix, banned) {
 			return true
 		}
 	}
@@ -167,118 +165,25 @@ func unsafeCommandPrefixPart(part string) bool {
 }

 func unsafeCommandPrefixLauncher(program string) bool {
-	// A path is already refused. ":" and "~" are refused for the same reason:
-	// on Windows they introduce names that resolve to a different file than the
-	// one matched here, and no list can keep up with them. "PYTHON~1.EXE" is
-	// python.exe under an 8.3 short name, and 8.3 truncates the stem, so
-	// "POWERS~1.EXE" cannot be recognized by name at all; "python.exe::$DATA"
-	// names the same executable through its default stream. Refusing the shape
-	// costs a permission prompt on names no real command uses.
-	if strings.ContainsAny(program, `/\:~`) {
+	program = strings.ToLower(strings.TrimSpace(program))
+	if strings.ContainsAny(program, `/\`) {
 		return true
 	}
-	name := normalizeLauncherName(program)
-	return bannedLauncherName(name) || bannedLauncherName(strings.TrimRight(name, "0123456789"))
-}
-
-func bannedLauncherName(name string) bool {
-	switch name {
-	case "bash", "sh", "zsh", "dash", "ash", "ksh", "csh", "tcsh", "fish", "busybox",
-		"pwsh", "powershell", "cmd", "wsl",
-		"env", "sudo", "sudoedit", "doas", "su", "run0", "osascript",
+	switch program {
+	case "bash", "sh", "zsh", "/bin/bash", "/bin/zsh",
+		"pwsh", "powershell", "powershell.exe",
+		"env", "sudo", "doas", "su", "run0", "osascript",
 		"command", "eval", "exec", "time",
 		"find", "xargs", "timeout", "nice", "nohup", "watch", "setsid", "stdbuf", "ionice",
-		"ssh", "make", "npm", "npx", "pnpm", "yarn", "bunx",
-		"python", "py", "pythonw", "pyw", "pypy", "uv", "uvx",
-		"node", "nodejs", "perl", "ruby", "php", "lua", "deno", "bun":
+		"ssh", "make", "npm", "npx",
+		"python", "python3", "py", "pythonw", "pyw", "pypy", "pypy3",
+		"node", "perl", "ruby", "php", "lua", "deno", "bun":
 		return true
 	default:
 		return false
 	}
 }

-// normalizeLauncherName reduces a program name to the launcher it actually runs
-// so the list above cannot be stepped around by spelling the same interpreter
-// differently: "python3.11", "python.exe" and "PYTHON3" all reach it as a name
-// the list matches. internal/agent's commandName already normalizes case and
-// Windows executable extensions on the allow side; this side matched raw, so
-// every versioned or .exe-suffixed launcher validated as an ordinary command
-// and persisted as a prefix grant that auto-allows every later invocation.
-//
-// A name is only ever narrowed toward an existing entry, so the failure
-// direction is an extra permission prompt, never a silent grant.
-func normalizeLauncherName(program string) string {
-	name := strings.ToLower(strings.TrimSpace(program))
-	// Windows discards trailing dots and spaces when resolving a filename, so
-	// "python." starts python.exe. Drop them before anything matches on the
-	// result, on every platform: the deny side must not depend on which OS is
-	// reading the grant, since the grants file travels with a synced home
-	// directory.
-	name = strings.TrimRight(name, ". ")
-	for _, suffix := range []string{".exe", ".cmd", ".bat", ".com", ".ps1"} {
-		if strings.HasSuffix(name, suffix) {
-			name = strings.TrimSuffix(name, suffix)
-			name = strings.TrimRight(name, ". ")
-			break
-		}
-	}
-	return trimLauncherVersion(trimLauncherABISuffix(trimLauncherBuildSuffix(name)))
-}
-
-// trimLauncherBuildSuffix drops the build-channel suffixes distributions and
-// upstreams append to an otherwise unchanged interpreter, so "python3.11-dbg",
-// "bash-static" and "pwsh-preview" are the launchers they say they are. The set
-// is closed on purpose: a general "-word" strip would also swallow
-// "node-gyp", "python3-config" and "ruby-lsp", which are ordinary tools a user
-// should still be able to approve.
-func trimLauncherBuildSuffix(name string) string {
-	for _, suffix := range []string{"-dbg", "-debug", "-static", "-nightly", "-preview", "-beta"} {
-		if strings.HasSuffix(name, suffix) {
-			return strings.TrimSuffix(name, suffix)
-		}
-	}
-	return name
-}
-
-// trimLauncherABISuffix drops CPython's ABI flags from a versioned interpreter
-// name, so "python3.7m" and "python3.6dm" reduce to their version, and the
-// free-threaded builds "python3.13t" and "python3.13td" reduce to theirs. The
-// flags are only removed when a digit sits underneath them, which leaves
-// ordinary names that happen to end in those letters alone: "sha256sum" keeps
-// its "sum", "zstd" its "td", "cat" its "t".
-func trimLauncherABISuffix(name string) string {
-	trimmed := strings.TrimRight(name, "dmut")
-	if trimmed == name || trimmed == "" {
-		return name
-	}
-	if last := trimmed[len(trimmed)-1]; last < '0' || last > '9' {
-		return name
-	}
-	return trimmed
-}
-
-// trimLauncherVersion drops a trailing "<separator><digits>" version from a
-// program name, so "python3.11" becomes "python3" and "python2.7" becomes
-// "python2". Digits without a separator are part of the name, which keeps
-// "base64", "7z" and "sha256sum" intact; the caller handles the "python3" shape
-// by also testing the digit-stripped form.
-func trimLauncherVersion(name string) string {
-	for {
-		trimmed := strings.TrimRight(name, "0123456789")
-		if trimmed == name || trimmed == "" {
-			return name
-		}
-		if !strings.HasSuffix(trimmed, ".") && !strings.HasSuffix(trimmed, "-") {
-			return name
-		}
-		next := trimmed[:len(trimmed)-1]
-		if next == "" {
-			return name
-		}
-		name = next
-	}
-}
-
 func sameStringSlice(left []string, right []string) bool {
 	if len(left) != len(right) {
 		return false
@@ -1,115 +0,0 @@
-package sandbox
-
-import "testing"
-
-func TestUnsafeCommandPrefixLauncherIgnoresVersionAndExtension(t *testing.T) {
-	for _, program := range []string{
-		"python3", "python", "node", "git", "sh", "bash", "sudo",
-		"python3.11", "python3.12", "python2.7", "python3.13.1",
-		"python.exe", "python3.exe", "node.exe", "git.exe", "bash.exe",
-		"PYTHON3.11", "Node.EXE",
-		"cmd", "cmd.exe", "wsl", "wsl.exe",
-		// Windows resolves these to the same executable.
-		"python.", "python3.", "python3.11.", "python.exe.", "PYTHON.",
-		"python.cmd", "python.bat", "python.com", "python.ps1",
-		"PYTHON~1.EXE", "POWERS~1.EXE", "python.exe::$DATA",
-		// Versioned and ABI-suffixed interpreters.
-		"python3.7m", "python3.6dm", "pythonw3.11", "python-3.11",
-		// Free-threaded CPython (PEP 703) ships beside the GIL build.
-		"python3.13t", "python3.13t.exe", "python3.14t", "python3.13td",
-		// Distribution and build-channel spellings of the same interpreter.
-		"nodejs", "nodejs.exe", "node-nightly", "python3-dbg", "python3.11-dbg",
-		"python3.13t-dbg", "python3-debug", "python3.11-debug", "node-beta",
-		"pwsh-preview", "bash-static", "sudoedit",
-		// Twins of npm and npx, which the list already refuses.
-		"pnpm", "yarn", "bunx", "pnpm.cmd", "yarn.exe",
-		"perl5.36", "ruby3.2", "php8", "lua5.4", "node22.exe", "bash5",
-	} {
-		if !unsafeCommandPrefix([]string{program}) {
-			t.Errorf("unsafeCommandPrefix([%q]) = false, want true", program)
-		}
-	}
-}
-
-func TestUnsafeCommandPrefixKeepsOrdinaryCommandsGrantable(t *testing.T) {
-	for _, prefix := range [][]string{
-		{"cargo", "build"},
-		{"go", "test"},
-		{"ls", "-la"},
-		{"rg", "--json"},
-		{"7z", "l"},
-		{"base64", "-d"},
-		{"kubectl", "get", "pods"},
-		{"docker", "ps"},
-		{"sha256sum", "file"},
-		{"gcc-13", "-c"},
-		{"node-gyp", "build"},
-		{"python3-config", "--includes"},
-		{"s3cmd", "ls"},
-		{"cat", "file"},
-		{"zstd", "-d"},
-		{"sqlite3", "db"},
-		{"yt-dlp", "url"},
-		{"perl-doc", "-h"},
-		{"php-fpm", "-t"},
-		{"ruby-lsp", "--version"},
-		{"lua-language-server", "--check"},
-		{"nodemon", "app.js"},
-	} {
-		if unsafeCommandPrefix(prefix) {
-			t.Errorf("unsafeCommandPrefix(%q) = true, want false", prefix)
-		}
-	}
-}
-func TestNormalizeLauncherName(t *testing.T) {
-	for _, testCase := range []struct{ in, want string }{
-		{"python3.11", "python3"},
-		{"python2.7", "python2"},
-		{"pypy3", "pypy3"},
-		{"node.exe", "node"},
-		{"POWERSHELL.EXE", "powershell"},
-		{"7z", "7z"},
-		{"base64", "base64"},
-		{"sha256sum", "sha256sum"},
-		{"python.", "python"},
-		{"python3.11.exe.", "python3"},
-		{"python3.7m", "python3"},
-		{"python3.6dm", "python3"},
-		{"python3.13t", "python3"},
-		{"python3.13td", "python3"},
-		{"python3.11-dbg", "python3"},
-		{"node-nightly", "node"},
-		{"node-gyp", "node-gyp"},
-		{"python3-config", "python3-config"},
-		{"zstd", "zstd"},
-		{"cat", "cat"},
-		{"cargo", "cargo"},
-		{"", ""},
-	} {
-		if got := normalizeLauncherName(testCase.in); got != testCase.want {
-			t.Errorf("normalizeLauncherName(%q) = %q, want %q", testCase.in, got, testCase.want)
-		}
-	}
-}
-
-// Session-scoped grants are the agent's other entry point (loop.go grants them
-// for a single turn without touching the store), so they must refuse the same
-// launcher spellings the persisted path does.
-func TestGrantCommandPrefixForSessionRefusesLauncherVariants(t *testing.T) {
-	engine := &Engine{commandPrefixes: newCommandPrefixGrantSet()}
-	engine.GrantCommandPrefixForSession("bash", []string{"cargo", "build"})
-	if _, ok := engine.LookupCommandPrefixForSession("bash", []string{"cargo", "build", "--release"}); !ok {
-		t.Fatal("CONTROL BROKEN: an ordinary session prefix grant did not match")
-	}
-	for _, prefix := range [][]string{
-		{"python3.11", "-c"},
-		{"python.exe", "-c"},
-		{"cmd", "/c"},
-	} {
-		engine.GrantCommandPrefixForSession("bash", prefix)
-		command := append(append([]string(nil), prefix...), "whatever")
-		if _, ok := engine.LookupCommandPrefixForSession("bash", command); ok {
-			t.Errorf("session grant %q matched %q, want refused", prefix, command)
-		}
-	}
-}
@@ -242,7 +242,6 @@ func TestEngineAutoAllowsWorkspaceFileMutationTools(t *testing.T) {
 		{name: "write_file", args: map[string]any{"path": "notes.txt"}},
 		{name: "edit_file", args: map[string]any{"path": "notes.txt"}},
 		{name: "apply_patch", args: map[string]any{"patch": "diff --git a/notes.txt b/notes.txt\n"}},
-		{name: "apply_patch", args: map[string]any{"patch": "*** Begin Patch\n*** Add File: notes.txt\n+x\n*** End Patch\n"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			decision := engine.Evaluate(context.Background(), Request{
@@ -316,27 +315,6 @@ func TestEngineDeniesApplyPatchEscapesFromPatchBody(t *testing.T) {
 	}
 }

-func TestEngineDeniesStructuredApplyPatchEscapesFromPatchBody(t *testing.T) {
-	root := t.TempDir()
-	engine := NewEngine(EngineOptions{WorkspaceRoot: root, Policy: DefaultPolicy()})
-
-	for _, patch := range []string{
-		"*** Begin Patch\n*** Add File: ../escape.txt\n+x\n*** End Patch\n",
-		"*** Begin Patch\n*** Add File: ..\\escape.txt\n+x\n*** End Patch\n",
-	} {
-		decision := engine.Evaluate(context.Background(), Request{
-			ToolName:       "apply_patch",
-			SideEffect:     SideEffectWrite,
-			Permission:     PermissionPrompt,
-			PermissionMode: PermissionModeAsk,
-			Args:           map[string]any{"patch": patch},
-		})
-		if decision.Action != ActionDeny || decision.Block == nil || decision.Block.Code != BlockOutsideWorkspace {
-			t.Fatalf("escaping structured apply_patch decision = %#v, want outside-workspace deny", decision)
-		}
-	}
-}
-
 func TestEngineSessionGrantDoesNotMatchSiblingFile(t *testing.T) {
 	root := t.TempDir()
 	engine := NewEngine(EngineOptions{WorkspaceRoot: root, Policy: promptWorkspaceWritePolicy()})
@@ -2,15 +2,12 @@ package sandbox

 import (
 	"errors"
-	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/Gitlawb/zero/internal/execution"
 )

 func TestGrantStorePersistsListsRevokesAndClears(t *testing.T) {
@@ -346,8 +343,7 @@ func TestGrantStoreMigratesExactV1GrantAndReportsOnce(t *testing.T) {
 	if err != nil {
 		t.Fatalf("read rewritten grant file: %v", err)
 	}
-	policyLine := fmt.Sprintf(`"policyVersion": %d`, execution.PolicyVersion)
-	if !strings.Contains(string(raw), `"schemaVersion": 3`) || !strings.Contains(string(raw), policyLine) || !strings.Contains(string(raw), `"write_file": [`) {
+	if !strings.Contains(string(raw), `"schemaVersion": 3`) || !strings.Contains(string(raw), `"policyVersion": 1`) || !strings.Contains(string(raw), `"write_file": [`) {
 		t.Fatalf("grant file was not rewritten as a versioned grant store:\n%s", raw)
 	}
 	backup, err := os.ReadFile(path + ".v1.backup")
@@ -410,62 +406,6 @@ func TestGrantStorePolicyChangePreservesDeniesAndInvalidatesApprovals(t *testing
 	}
 }

-// A prefix grant recorded before launcher-name normalization existed (a
-// versioned or .exe-suffixed interpreter) no longer validates. It must reach
-// the user through the policy migration — backup, denies preserved, one notice
-// — and never make the whole grants file unreadable, which would silently drop
-// their persisted deny grants too.
-func TestGrantStoreMigratesPreNormalizationPrefixInsteadOfRejectingTheFile(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "sandbox-grants.json")
-	original := `{"schemaVersion":3,"policyVersion":1,"grants":{"bash":[{"toolName":"bash","decision":"deny","approvedAt":"2026-06-05T14:30:00Z"}]},"commandPrefixes":{"bash":[{"toolName":"bash","prefix":["python3.11","-c"],"approvedAt":"2026-06-05T14:30:00Z"},{"toolName":"bash","prefix":["cargo","build"],"approvedAt":"2026-06-05T14:30:00Z"}]}}`
-	if err := writeText(path, original); err != nil {
-		t.Fatal(err)
-	}
-	store, err := NewGrantStore(StoreOptions{FilePath: path})
-	if err != nil {
-		t.Fatal(err)
-	}
-	grants, err := store.List()
-	if err != nil || len(grants) != 1 || grants[0].Decision != GrantDeny {
-		t.Fatalf("grants after migration = %#v err=%v, want the deny preserved", grants, err)
-	}
-	prefixes, err := store.ListCommandPrefixes()
-	if err != nil || len(prefixes) != 0 {
-		t.Fatalf("prefixes after migration = %#v err=%v, want all re-approved", prefixes, err)
-	}
-	if notice, err := store.ConsumeMigrationNotice(); err != nil || !strings.Contains(notice, "invalidated 2") {
-		t.Fatalf("notice = %q err=%v", notice, err)
-	}
-	if backup, err := os.ReadFile(path + ".policy-v1.backup"); err != nil || string(backup) != original {
-		t.Fatalf("backup = %q err=%v", backup, err)
-	}
-}
-
-// The legacy-schema path is a separate migration from the policy bump above and
-// prunes per grant rather than wholesale, so a pre-normalization prefix must be
-// dropped there while the valid prefix beside it survives.
-func TestGrantStoreLegacyMigrationDropsOnlyThePreNormalizationPrefix(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "sandbox-grants.json")
-	original := `{"schemaVersion":2,"grants":{},"commandPrefixes":{"bash":[{"toolName":"bash","prefix":["python3.11","-c"],"approvedAt":"2026-06-05T14:30:00Z"},{"toolName":"bash","prefix":["git","status"],"approvedAt":"2026-06-05T14:30:00Z"}]}}`
-	if err := writeText(path, original); err != nil {
-		t.Fatal(err)
-	}
-	store, err := NewGrantStore(StoreOptions{FilePath: path})
-	if err != nil {
-		t.Fatal(err)
-	}
-	prefixes, err := store.ListCommandPrefixes()
-	if err != nil {
-		t.Fatalf("ListCommandPrefixes after legacy migration returned error: %v", err)
-	}
-	if len(prefixes) != 1 || !sameStringSlice(prefixes[0].Prefix, []string{"git", "status"}) {
-		t.Fatalf("prefixes = %#v, want only [git status]", prefixes)
-	}
-	if notice, err := store.ConsumeMigrationNotice(); err != nil || !strings.Contains(notice, "migrated 1, invalidated 1") {
-		t.Fatalf("notice = %q err=%v", notice, err)
-	}
-}
-
 func TestGrantStorePersistsCommandPrefixes(t *testing.T) {
 	store, err := NewGrantStore(StoreOptions{
 		FilePath: filepath.Join(t.TempDir(), "sandbox-grants.json"),
@@ -541,11 +481,6 @@ func TestGrantStoreRejectsUnsafeCommandPrefixes(t *testing.T) {
 		{"python", "script.py"},
 		{"./script.sh"},
 		{"git"},
-		{"python3.11", "-c"},
-		{"python.exe", "-c"},
-		{"node.exe", "-e"},
-		{"git.exe"},
-		{"cmd", "/c"},
 	} {
 		if _, err := store.GrantCommandPrefix(CommandPrefixInput{ToolName: "bash", Prefix: prefix}); err == nil {
 			t.Fatalf("GrantCommandPrefix(%#v) succeeded, want validation error", prefix)
@@ -261,7 +261,7 @@ func applyPatchRequestPaths(args map[string]any) []string {
 	}
 	cwd := firstArgString(args, "cwd")
 	var paths []string
-	for _, path := range applyPatchPaths(patch) {
+	for _, path := range patchHeaderPaths(patch) {
 		if path == "" || path == "/dev/null" {
 			continue
 		}
@@ -281,7 +281,7 @@ func applyPatchPathBlock(request Request) *pathBlock {
 	if patch == "" {
 		return nil
 	}
-	for _, path := range applyPatchPaths(patch) {
+	for _, path := range patchHeaderPaths(patch) {
 		if path == "" || path == "/dev/null" {
 			continue
 		}
@@ -296,34 +296,6 @@ func applyPatchPathBlock(request Request) *pathBlock {
 	return nil
 }

-func applyPatchPaths(patch string) []string {
-	if strings.HasPrefix(strings.TrimSpace(strings.TrimPrefix(patch, "\ufeff")), "*** Begin Patch") {
-		return structuredPatchHeaderPaths(patch)
-	}
-	return patchHeaderPaths(patch)
-}
-
-// structuredPatchHeaderPaths is intentionally a small, conservative scanner for
-// the sandbox boundary. The executor validates the complete hunk grammar before
-// writing; the sandbox only needs every possible target path so it can reject an
-// unsafe request before the tool runs.
-func structuredPatchHeaderPaths(patch string) []string {
-	var paths []string
-	for _, line := range strings.Split(strings.ReplaceAll(patch, "\r\n", "\n"), "\n") {
-		trimmed := strings.TrimSpace(line)
-		for _, prefix := range []string{"*** Add File: ", "*** Delete File: ", "*** Update File: ", "*** Move to: "} {
-			if path, ok := strings.CutPrefix(trimmed, prefix); ok {
-				path = strings.ReplaceAll(filepath.ToSlash(strings.TrimSpace(path)), "\\", "/")
-				if path != "" {
-					paths = append(paths, path)
-				}
-				break
-			}
-		}
-	}
-	return paths
-}
-
 func patchHeaderPaths(patch string) []string {
 	var paths []string
 	oldRemaining, newRemaining := 0, 0
@@ -20,11 +20,11 @@ func NewScopedApplyPatchTool(workspaceRoot string, scope PathScope) Tool {
 	return applyPatchTool{
 		baseTool: baseTool{
 			name:        "apply_patch",
-			description: "Apply a patch inside the workspace or an explicitly granted extra write root.",
+			description: "Apply a unified diff patch inside the workspace or an explicitly granted extra write root.",
 			parameters: Schema{
 				Type: "object",
 				Properties: map[string]PropertySchema{
-					"patch": {Type: "string", Description: "A unified diff or a structured *** Begin Patch patch to apply."},
+					"patch": {Type: "string", Description: "Unified diff patch to apply."},
 					"cwd":   {Type: "string", Description: "Directory where the patch should be applied. Relative paths stay in the workspace; use an absolute path to target a granted extra write root. Defaults to workspace root.", Default: "."},
 				},
 				Required:             []string{"patch"},
@@ -56,9 +56,6 @@ func (tool applyPatchTool) RunWithOptions(ctx context.Context, args map[string]a
 	if err != nil {
 		return errorResult("Error applying patch: " + err.Error())
 	}
-	if isStructuredPatch(patch) {
-		return tool.runStructuredPatch(applyRoot, relativeRoot, patch, options)
-	}
 	if err := validatePatchPaths(applyRoot, patch); err != nil {
 		return errorResult("Error applying patch: " + err.Error())
 	}
@@ -162,3 +162,11 @@ func ValidateCapabilities(name string, caps ToolCapabilities) []string {
 	}
 	return problems
 }
+
+// ValidateToolCapabilities validates CapabilitiesOf(tool) for a registered tool.
+func ValidateToolCapabilities(tool Tool) []string {
+	if tool == nil {
+		return []string{"<nil tool>"}
+	}
+	return ValidateCapabilities(tool.Name(), CapabilitiesOf(tool))
+}
@@ -231,25 +231,6 @@ func TestApplyPatchResourceKeysFromDiffAndCwd(t *testing.T) {
 	}
 }

-func TestApplyPatchResourceKeysFromStructuredPatchAndCwd(t *testing.T) {
-	patch := "*** Begin Patch\n*** Update File: old.go\n*** Move to: new.go\n@@\n-old\n+new\n*** End Patch\n"
-	keys := applyPatchResourceKeys(map[string]any{"patch": patch, "cwd": "pkg"})
-	want := map[string]bool{
-		ResourceKeyDirectory + "pkg":   true,
-		ResourceKeyFile + "pkg/old.go": true,
-		ResourceKeyFile + "pkg/new.go": true,
-	}
-	for _, key := range keys {
-		if !want[key] {
-			t.Fatalf("unexpected key %q in %v", key, keys)
-		}
-		delete(want, key)
-	}
-	if len(want) != 0 {
-		t.Fatalf("missing keys %v from %v", want, keys)
-	}
-}
-
 func TestDeclaredMutatorThreadSafeIsReportedByCatalogValidation(t *testing.T) {
 	// Runtime CapabilitiesOf clears ThreadSafe on mutators; catalog validation
 	// must still see the raw declaration so miswired constructors fail the gate.
@@ -221,112 +221,6 @@ func TestApplyPatchCompleteCreationCreditsSuppliedFile(t *testing.T) {
 	}
 }

-func TestStructuredPatchDoesNotCreditUnreadFileForOverwrite(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "f.txt")
-	if err := os.WriteFile(path, []byte("alpha\nbeta\ngamma\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	registry := safetyRegistry(t, dir)
-	registry.Register(NewScopedApplyPatchTool(dir, nil))
-	tracker := NewFileTracker()
-	opts := grantedOpts(tracker)
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: f.txt",
-		"@@",
-		"-beta",
-		"+updated",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	if result := registry.RunWithOptions(context.Background(), "apply_patch", map[string]any{"patch": patch}, opts); result.Status != StatusOK {
-		t.Fatalf("structured patch failed: %s", result.Output)
-	}
-	trackedPath, err := filepath.EvalSymlinks(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if tracker.SeenWhole(trackedPath) {
-		t.Fatal("a partial structured patch credited the unread file as fully seen")
-	}
-	result := registry.RunWithOptions(context.Background(), "write_file", map[string]any{
-		"path": "f.txt", "content": "blind overwrite\n", "overwrite": true,
-	}, opts)
-	if result.Status != StatusError || !strings.Contains(result.Output, "has not been read exactly") {
-		t.Fatalf("blind overwrite after a partial patch was not refused: %#v", result)
-	}
-	if got, want := mustReadTestFile(t, path), "alpha\nupdated\ngamma\n"; got != want {
-		t.Fatalf("file = %q, want %q", got, want)
-	}
-}
-
-func TestStructuredPatchPreservesWholeFileObservation(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "f.txt")
-	if err := os.WriteFile(path, []byte("alpha\nbeta\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	registry := safetyRegistry(t, dir)
-	registry.Register(NewScopedApplyPatchTool(dir, nil))
-	tracker := NewFileTracker()
-	opts := grantedOpts(tracker)
-	if result := registry.RunWithOptions(context.Background(), "read_file", map[string]any{"path": "f.txt"}, opts); result.Status != StatusOK {
-		t.Fatalf("read_file failed: %s", result.Output)
-	}
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: f.txt",
-		"@@",
-		"-alpha",
-		"+updated",
-		"*** End Patch",
-		"",
-	}, "\n")
-	if result := registry.RunWithOptions(context.Background(), "apply_patch", map[string]any{"patch": patch}, opts); result.Status != StatusOK {
-		t.Fatalf("structured patch failed: %s", result.Output)
-	}
-	trackedPath, err := filepath.EvalSymlinks(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !tracker.SeenWhole(trackedPath) {
-		t.Fatal("structured patch discarded an existing whole-file observation")
-	}
-	result := registry.RunWithOptions(context.Background(), "write_file", map[string]any{
-		"path": "f.txt", "content": "known overwrite\n", "overwrite": true,
-	}, opts)
-	if result.Status != StatusOK {
-		t.Fatalf("overwrite after a whole-file read was refused: %s", result.Output)
-	}
-}
-
-func TestStructuredPatchCreationCreditsSuppliedFile(t *testing.T) {
-	dir := t.TempDir()
-	registry := safetyRegistry(t, dir)
-	registry.Register(NewScopedApplyPatchTool(dir, nil))
-	tracker := NewFileTracker()
-	opts := grantedOpts(tracker)
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Add File: created.txt",
-		"+supplied",
-		"*** End Patch",
-		"",
-	}, "\n")
-	if result := registry.RunWithOptions(context.Background(), "apply_patch", map[string]any{"patch": patch}, opts); result.Status != StatusOK {
-		t.Fatalf("structured patch failed: %s", result.Output)
-	}
-	path, err := filepath.EvalSymlinks(filepath.Join(dir, "created.txt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !tracker.SeenWhole(path) {
-		t.Fatal("a fully supplied structured add was not credited as fully seen")
-	}
-}
-
 func TestWriteFileOverwriteRefusedWhenChangedOnDisk(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "f.txt")
@@ -78,16 +78,14 @@ func maybeFormatWrittenFile(ctx context.Context, absolutePath string, writtenCon
 	if !ok {
 		return writtenContent
 	}
-	binaryPath, err := exec.LookPath(command[0])
-	if err != nil {
+	if _, err := exec.LookPath(command[0]); err != nil {
 		return writtenContent
 	}
 	formatCtx, cancel := context.WithTimeout(ctx, formatOnWriteTimeout)
 	defer cancel()
 	arguments := append(append([]string(nil), command[1:]...), absolutePath)
-	formatter := exec.CommandContext(formatCtx, binaryPath, arguments...)
+	formatter := exec.CommandContext(formatCtx, command[0], arguments...)
 	formatter.Dir = filepath.Dir(absolutePath)
-	formatter.Stdin = strings.NewReader("")
 	if err := formatter.Run(); err != nil {
 		return writtenContent
 	}
@@ -102,17 +102,3 @@ func TestFormatOnWriteSkipsUnknownExtensions(t *testing.T) {
 		t.Fatalf("unknown extension must pass through: %q", content)
 	}
 }
-
-func TestFormatOnWriteFormatterLookupFailure(t *testing.T) {
-	t.Setenv("ZERO_FORMAT_ON_WRITE", "1")
-	t.Setenv("PATH", t.TempDir())
-	targetPath := filepath.Join(t.TempDir(), "a.go")
-	uglyContent := "package a\n\nfunc  A( ) {   }\n"
-	if err := os.WriteFile(targetPath, []byte(uglyContent), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	content := maybeFormatWrittenFile(context.Background(), targetPath, uglyContent)
-	if content != uglyContent {
-		t.Fatalf("missing formatter must return written content, got %q", content)
-	}
-}
@@ -1,9 +0,0 @@
-package tools
-
-// ModelVisible reports whether a registered tool is advertised to an agent.
-// edit_file remains implemented for compatibility with existing integrations,
-// but its text-only replacement contract cannot safely disambiguate repeated
-// source fragments. Agents use apply_patch for contextual existing-file edits.
-func ModelVisible(tool Tool) bool {
-	return tool != nil && tool.Name() != "edit_file"
-}
@@ -1,18 +0,0 @@
-package tools
-
-import "testing"
-
-func TestToolSearchDoesNotSurfaceLegacyStringReplacement(t *testing.T) {
-	registry := NewRegistry()
-	registry.Register(NewScopedEditFileTool(t.TempDir(), nil))
-	registry.Register(NewScopedApplyPatchTool(t.TempDir(), nil))
-	search := NewToolSearchTool(registry).(toolSearchTool)
-
-	eager := search.visibleEagerToolNames(nil, nil, "ask")
-	if eager["edit_file"] {
-		t.Fatal("tool_search must not describe edit_file as available to the model")
-	}
-	if !eager["apply_patch"] {
-		t.Fatal("tool_search must retain apply_patch as the available edit tool")
-	}
-}
@@ -1,7 +1,5 @@
 package tools

-import "path/filepath"
-
 // MutationTargets returns the workspace-relative paths a tool call will write to,
 // so the session layer can snapshot their before-state for safe rewind. It is a
 // pure helper (no I/O beyond path resolution) and returns nil for read-only tools
@@ -38,19 +36,6 @@ func MutationTargets(workspaceRoot string, name string, args map[string]any) []s
 		if err != nil {
 			return nil
 		}
-		if isStructuredPatch(patch) {
-			operations, err := parseStructuredPatch(patch)
-			if err != nil {
-				return nil
-			}
-			paths := structuredPatchOperationPaths(operations)
-			for _, path := range paths {
-				if _, _, err := resolveWorkspaceTargetPath(applyRoot, path); err != nil {
-					return nil
-				}
-			}
-			return prefixPatchPaths(relativeRoot, paths)
-		}
 		// Enforce the same workspace confinement apply_patch applies (against the
 		// resolved apply dir), so a patch with a traversal path (../x) never yields
 		// an out-of-workspace target.
@@ -66,22 +51,3 @@ func MutationTargets(workspaceRoot string, name string, args map[string]any) []s
 		return nil
 	}
 }
-
-func prefixPatchPaths(relativeRoot string, paths []string) []string {
-	if len(paths) == 0 {
-		return nil
-	}
-	seen := make(map[string]bool)
-	var out []string
-	for _, path := range paths {
-		workspacePath := path
-		if relativeRoot != "" && relativeRoot != "." {
-			workspacePath = filepath.ToSlash(filepath.Join(relativeRoot, path))
-		}
-		if !seen[workspacePath] {
-			seen[workspacePath] = true
-			out = append(out, workspacePath)
-		}
-	}
-	return out
-}
@@ -17,7 +17,6 @@ func TestMutationTargets(t *testing.T) {
 		{"write_file", map[string]any{"path": "a/b.txt", "content": "x"}, []string{"a/b.txt"}},
 		{"edit_file", map[string]any{"path": "c.txt", "old_string": "x", "new_string": "y"}, []string{"c.txt"}},
 		{"apply_patch", map[string]any{"patch": "--- a/d.txt\n+++ b/d.txt\n@@ -1 +1 @@\n-x\n+y\n"}, []string{"d.txt"}},
-		{"apply_patch", map[string]any{"patch": "*** Begin Patch\n*** Add File: nested/new.txt\n+x\n*** Update File: old.txt\n*** Move to: moved.txt\n@@\n-old\n+new\n*** End Patch\n"}, []string{"nested/new.txt", "old.txt", "moved.txt"}},
 		{"bash", map[string]any{"command": "echo hi"}, nil},
 		{"read_file", map[string]any{"path": "e.txt"}, nil},
 		{"grep", map[string]any{"pattern": "x"}, nil},
@@ -63,10 +62,6 @@ func TestMutationTargetsRejectsEscapingPaths(t *testing.T) {
 	if got := MutationTargets(root, "apply_patch", map[string]any{"patch": escapePatch}); len(got) != 0 {
 		t.Errorf("expected no targets for escaping apply_patch, got %v", got)
 	}
-	structuredEscapePatch := "*** Begin Patch\n*** Add File: ../escape.txt\n+x\n*** End Patch\n"
-	if got := MutationTargets(root, "apply_patch", map[string]any{"patch": structuredEscapePatch}); len(got) != 0 {
-		t.Errorf("expected no targets for escaping structured apply_patch, got %v", got)
-	}
 }

 // Finding 3: with cwd != ".", apply_patch's MutationTargets must return
@@ -87,12 +82,6 @@ func TestMutationTargetsApplyPatchPrefixesCwd(t *testing.T) {
 		t.Fatalf("got %v, want %v", got, want)
 	}

-	structuredPatch := "*** Begin Patch\n*** Update File: d.txt\n@@\n-x\n+y\n*** End Patch\n"
-	got = MutationTargets(root, "apply_patch", map[string]any{"patch": structuredPatch, "cwd": "sub/dir"})
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("structured cwd: got %v, want %v", got, want)
-	}
-
 	// cwd "." (the default) must keep paths unprefixed.
 	got = MutationTargets(root, "apply_patch", map[string]any{"patch": patch, "cwd": "."})
 	if !reflect.DeepEqual(got, []string{"d.txt"}) {
@@ -178,7 +178,7 @@ func applyPatchResourceKeys(args map[string]any) []string {
 	keys = append(keys, multiFileResourceKeys(args)...)
 	cwd := firstStringArg(args, "cwd", "workdir")
 	patch := firstStringArg(args, "patch", "diff")
-	for _, p := range pathsFromApplyPatch(patch) {
+	for _, p := range pathsFromUnifiedDiff(patch) {
 		joined := joinUnderResourceCwd(cwd, p)
 		if n := NormalizeResourcePath(joined); n != "" {
 			keys = append(keys, ResourceKeyFile+n)
@@ -191,17 +191,6 @@ func applyPatchResourceKeys(args map[string]any) []string {
 	return keys
 }

-func pathsFromApplyPatch(patch string) []string {
-	if !isStructuredPatch(patch) {
-		return pathsFromUnifiedDiff(patch)
-	}
-	operations, err := parseStructuredPatch(patch)
-	if err != nil {
-		return nil
-	}
-	return structuredPatchOperationPaths(operations)
-}
-
 // joinUnderResourceCwd joins a relative path under cwd for resource keys only.
 // Absolute paths are left unchanged. Empty cwd or "." leaves rel as-is.
 // Never touches the filesystem.
@@ -1,763 +0,0 @@
-package tools
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/Gitlawb/zero/internal/pathjail"
-)
-
-const (
-	structuredPatchBegin  = "*** Begin Patch"
-	structuredPatchEnd    = "*** End Patch"
-	structuredAddFile     = "*** Add File: "
-	structuredDeleteFile  = "*** Delete File: "
-	structuredUpdateFile  = "*** Update File: "
-	structuredMoveTo      = "*** Move to: "
-	structuredEndOfFile   = "*** End of File"
-	structuredHunkContext = "@@ "
-)
-
-type structuredPatchKind uint8
-
-const (
-	structuredPatchAdd structuredPatchKind = iota
-	structuredPatchDelete
-	structuredPatchUpdate
-)
-
-type structuredPatchOperation struct {
-	kind     structuredPatchKind
-	path     string
-	movePath string
-	contents string
-	chunks   []structuredPatchChunk
-	line     int
-}
-
-type structuredPatchChunk struct {
-	context          string
-	hasContext       bool
-	old              []string
-	new              []string
-	newSourceOffsets []int
-	endOfFile        bool
-}
-
-type structuredPatchTarget struct {
-	requested string
-	absolute  string
-	relative  string
-}
-
-type structuredPatchChange struct {
-	kind   structuredPatchKind
-	from   structuredPatchTarget
-	to     structuredPatchTarget
-	before string
-	after  string
-	mode   os.FileMode
-}
-
-func isStructuredPatch(patch string) bool {
-	return strings.HasPrefix(strings.TrimSpace(strings.TrimPrefix(patch, "\ufeff")), structuredPatchBegin)
-}
-
-func (tool applyPatchTool) runStructuredPatch(applyRoot, relativeRoot, patch string, options RunOptions) Result {
-	operations, err := parseStructuredPatch(patch)
-	if err != nil {
-		return errorResult("Error applying patch: " + err.Error())
-	}
-	workspace, err := os.OpenRoot(applyRoot)
-	if err != nil {
-		return errorResult("Error applying patch: " + err.Error())
-	}
-	defer workspace.Close()
-	changes, err := planStructuredPatch(workspace, operations, options.FileTracker)
-	if err != nil {
-		return errorResult("Error applying patch: " + err.Error())
-	}
-	wholeBefore := make(map[string]bool, len(changes))
-	if options.FileTracker != nil {
-		for _, change := range changes {
-			if change.kind == structuredPatchUpdate {
-				wholeBefore[change.from.absolute] = options.FileTracker.SeenWhole(change.from.absolute)
-			}
-		}
-	}
-	if err := applyStructuredPatchChanges(workspace, changes, options.FileTracker); err != nil {
-		return errorResult("Error applying patch: " + err.Error())
-	}
-
-	for _, change := range changes {
-		switch change.kind {
-		case structuredPatchDelete:
-			options.FileTracker.Forget(change.from.absolute)
-		case structuredPatchAdd:
-			recordStructuredPatchFile(options.FileTracker, change.to.absolute, true, true)
-		case structuredPatchUpdate:
-			wasWhole := wholeBefore[change.from.absolute]
-			options.FileTracker.Forget(change.from.absolute)
-			recordStructuredPatchFile(options.FileTracker, change.to.absolute, false, wasWhole)
-		}
-	}
-
-	summary := "Patch applied successfully."
-	if relativeRoot != "." {
-		summary = "Patch applied successfully in " + relativeRoot + "."
-	}
-	result := okResult(summary)
-	result.ChangedFiles = changedFilesFromStructuredPatch(relativeRoot, changes)
-	result.Display = Display{Summary: summary, Kind: "diff", Preview: structuredPatchPreview(changes)}
-	return result
-}
-
-func parseStructuredPatch(patch string) ([]structuredPatchOperation, error) {
-	normalized := strings.TrimSpace(strings.TrimPrefix(strings.ReplaceAll(patch, "\r\n", "\n"), "\ufeff"))
-	if normalized == "" {
-		return nil, fmt.Errorf("structured patch is empty")
-	}
-	lines := strings.Split(normalized, "\n")
-	if strings.TrimSpace(lines[0]) != structuredPatchBegin {
-		return nil, fmt.Errorf("the first line of a structured patch must be %q", structuredPatchBegin)
-	}
-	if strings.TrimSpace(lines[len(lines)-1]) != structuredPatchEnd {
-		return nil, fmt.Errorf("the last line of a structured patch must be %q", structuredPatchEnd)
-	}
-
-	var operations []structuredPatchOperation
-	for index := 1; index < len(lines)-1; {
-		header := strings.TrimSpace(lines[index])
-		lineNumber := index + 1
-		if header == "" {
-			index++
-			continue
-		}
-		switch {
-		case strings.HasPrefix(header, structuredAddFile):
-			path, err := structuredPatchPath(header, structuredAddFile, lineNumber)
-			if err != nil {
-				return nil, err
-			}
-			op := structuredPatchOperation{kind: structuredPatchAdd, path: path, line: lineNumber}
-			index++
-			var content []string
-			for index < len(lines)-1 && !isStructuredPatchHeader(lines[index]) {
-				if !strings.HasPrefix(lines[index], "+") {
-					return nil, structuredPatchLineError(index+1, "added-file contents must start with '+'")
-				}
-				content = append(content, strings.TrimPrefix(lines[index], "+"))
-				index++
-			}
-			if len(content) > 0 {
-				op.contents = strings.Join(content, "\n") + "\n"
-			}
-			operations = append(operations, op)
-		case strings.HasPrefix(header, structuredDeleteFile):
-			path, err := structuredPatchPath(header, structuredDeleteFile, lineNumber)
-			if err != nil {
-				return nil, err
-			}
-			operations = append(operations, structuredPatchOperation{kind: structuredPatchDelete, path: path, line: lineNumber})
-			index++
-		case strings.HasPrefix(header, structuredUpdateFile):
-			path, err := structuredPatchPath(header, structuredUpdateFile, lineNumber)
-			if err != nil {
-				return nil, err
-			}
-			op := structuredPatchOperation{kind: structuredPatchUpdate, path: path, line: lineNumber}
-			index++
-			if index < len(lines)-1 && strings.HasPrefix(strings.TrimSpace(lines[index]), structuredMoveTo) {
-				op.movePath, err = structuredPatchPath(strings.TrimSpace(lines[index]), structuredMoveTo, index+1)
-				if err != nil {
-					return nil, err
-				}
-				index++
-			}
-			for index < len(lines)-1 && !isStructuredPatchHeader(lines[index]) {
-				line := lines[index]
-				trimmed := strings.TrimSpace(line)
-				if trimmed == structuredEndOfFile {
-					if len(op.chunks) == 0 || (!hasStructuredPatchContent(op.chunks[len(op.chunks)-1])) {
-						return nil, structuredPatchLineError(index+1, "*** End of File must follow an update hunk")
-					}
-					op.chunks[len(op.chunks)-1].endOfFile = true
-					index++
-					continue
-				}
-				if trimmed == "@@" || strings.HasPrefix(trimmed, structuredHunkContext) {
-					chunk := structuredPatchChunk{}
-					if trimmed != "@@" {
-						chunk.context = strings.TrimPrefix(trimmed, structuredHunkContext)
-						chunk.hasContext = true
-					}
-					op.chunks = append(op.chunks, chunk)
-					index++
-					continue
-				}
-				if len(op.chunks) == 0 {
-					op.chunks = append(op.chunks, structuredPatchChunk{})
-				}
-				chunk := &op.chunks[len(op.chunks)-1]
-				switch {
-				case line == "":
-					sourceOffset := len(chunk.old)
-					chunk.old = append(chunk.old, "")
-					chunk.new = append(chunk.new, "")
-					chunk.newSourceOffsets = append(chunk.newSourceOffsets, sourceOffset)
-				case strings.HasPrefix(line, " "):
-					content := strings.TrimPrefix(line, " ")
-					sourceOffset := len(chunk.old)
-					chunk.old = append(chunk.old, content)
-					chunk.new = append(chunk.new, content)
-					chunk.newSourceOffsets = append(chunk.newSourceOffsets, sourceOffset)
-				case strings.HasPrefix(line, "+"):
-					chunk.new = append(chunk.new, strings.TrimPrefix(line, "+"))
-					chunk.newSourceOffsets = append(chunk.newSourceOffsets, -1)
-				case strings.HasPrefix(line, "-"):
-					chunk.old = append(chunk.old, strings.TrimPrefix(line, "-"))
-				default:
-					return nil, structuredPatchLineError(index+1, "update lines must start with ' ', '+', or '-'")
-				}
-				index++
-			}
-			if len(op.chunks) == 0 || !allStructuredPatchChunksHaveContent(op.chunks) {
-				return nil, structuredPatchLineError(lineNumber, "update file hunk is empty")
-			}
-			operations = append(operations, op)
-		default:
-			return nil, structuredPatchLineError(lineNumber, "expected an Add File, Delete File, or Update File header")
-		}
-	}
-	if len(operations) == 0 {
-		return nil, fmt.Errorf("structured patch contains no file operations")
-	}
-	return operations, nil
-}
-
-func structuredPatchPath(header, prefix string, line int) (string, error) {
-	path := strings.TrimSpace(strings.TrimPrefix(header, prefix))
-	if path == "" {
-		return "", structuredPatchLineError(line, "file path is required")
-	}
-	return path, nil
-}
-
-func isStructuredPatchHeader(line string) bool {
-	return line == structuredPatchEnd || strings.HasPrefix(line, structuredAddFile) || strings.HasPrefix(line, structuredDeleteFile) || strings.HasPrefix(line, structuredUpdateFile)
-}
-
-func structuredPatchLineError(line int, message string) error {
-	return fmt.Errorf("invalid structured patch at line %d: %s", line, message)
-}
-
-func hasStructuredPatchContent(chunk structuredPatchChunk) bool {
-	return len(chunk.old) > 0 || len(chunk.new) > 0
-}
-
-func allStructuredPatchChunksHaveContent(chunks []structuredPatchChunk) bool {
-	for _, chunk := range chunks {
-		if !hasStructuredPatchContent(chunk) {
-			return false
-		}
-	}
-	return true
-}
-
-func structuredPatchOperationPaths(operations []structuredPatchOperation) []string {
-	seen := make(map[string]bool)
-	var paths []string
-	for _, operation := range operations {
-		for _, path := range []string{operation.path, operation.movePath} {
-			if path == "" || seen[path] {
-				continue
-			}
-			seen[path] = true
-			paths = append(paths, path)
-		}
-	}
-	return paths
-}
-
-func planStructuredPatch(root *os.Root, operations []structuredPatchOperation, tracker *FileTracker) ([]structuredPatchChange, error) {
-	seen := make(map[string]struct{})
-	var changes []structuredPatchChange
-	for _, operation := range operations {
-		from, err := resolveStructuredPatchTarget(root.Name(), operation.path)
-		if err != nil {
-			return nil, err
-		}
-		to := from
-		if operation.movePath != "" {
-			to, err = resolveStructuredPatchTarget(root.Name(), operation.movePath)
-			if err != nil {
-				return nil, err
-			}
-		}
-		targets := []structuredPatchTarget{from}
-		if to.absolute != from.absolute {
-			targets = append(targets, to)
-		}
-		for _, target := range targets {
-			if _, exists := seen[target.absolute]; exists {
-				return nil, fmt.Errorf("structured patch changes %q more than once", target.relative)
-			}
-			seen[target.absolute] = struct{}{}
-		}
-
-		change := structuredPatchChange{kind: operation.kind, from: from, to: to, mode: 0o644}
-		switch operation.kind {
-		case structuredPatchAdd:
-			if _, err := root.Lstat(to.relative); err == nil {
-				return nil, fmt.Errorf("cannot add %s because it already exists", to.relative)
-			} else if !os.IsNotExist(err) {
-				return nil, err
-			}
-			change.after = operation.contents
-		case structuredPatchDelete, structuredPatchUpdate:
-			info, err := root.Stat(from.relative)
-			if err != nil {
-				return nil, fmt.Errorf("stating %s: %w", from.relative, err)
-			}
-			change.mode = info.Mode()
-			content, err := root.ReadFile(from.relative)
-			if err != nil {
-				return nil, fmt.Errorf("reading %s: %w", from.relative, err)
-			}
-			if err := tracker.CheckConflict(from.absolute, content); err != nil {
-				return nil, fmt.Errorf("%s", fileConflictMessage(from.relative))
-			}
-			change.before = string(content)
-			if operation.kind == structuredPatchUpdate {
-				updated, err := applyStructuredPatchUpdate(change.before, from.relative, operation.chunks)
-				if err != nil {
-					return nil, err
-				}
-				change.after = updated
-				if from.absolute != to.absolute {
-					if _, err := root.Lstat(to.relative); err == nil {
-						return nil, fmt.Errorf("cannot move %s to %s because the destination already exists", from.relative, to.relative)
-					} else if !os.IsNotExist(err) {
-						return nil, err
-					}
-				}
-			}
-		}
-		changes = append(changes, change)
-	}
-	return changes, nil
-}
-
-func resolveStructuredPatchTarget(root, path string) (structuredPatchTarget, error) {
-	if filepath.IsAbs(path) || path == ".." || strings.HasPrefix(filepath.ToSlash(path), "../") {
-		return structuredPatchTarget{}, fmt.Errorf("patch path %q must stay inside the workspace", path)
-	}
-	absolute, relative, err := resolveWorkspaceTargetPath(root, path)
-	if err != nil {
-		return structuredPatchTarget{}, err
-	}
-	return structuredPatchTarget{requested: path, absolute: absolute, relative: relative}, nil
-}
-
-func applyStructuredPatchUpdate(content, path string, chunks []structuredPatchChunk) (string, error) {
-	lineEnding := structuredPatchLineEnding(content)
-	if lineEnding == "\r\n" {
-		content = strings.ReplaceAll(content, "\r\n", "\n")
-	}
-	lines := strings.Split(content, "\n")
-	trailingNewline := content != "" && len(lines) > 0 && lines[len(lines)-1] == ""
-	if len(lines) > 0 && lines[len(lines)-1] == "" {
-		lines = lines[:len(lines)-1]
-	}
-	replacements := make([]structuredReplacement, 0, len(chunks))
-	lineIndex := 0
-	for _, chunk := range chunks {
-		if chunk.hasContext {
-			index, ambiguous := findStructuredPatchSequence(lines, []string{chunk.context}, lineIndex, false)
-			if ambiguous {
-				return "", fmt.Errorf("context %q is ambiguous in %s; provide a more specific hunk header", chunk.context, path)
-			}
-			if index < 0 {
-				return "", fmt.Errorf("could not find context %q in %s", chunk.context, path)
-			}
-			lineIndex = index + 1
-		}
-		if len(chunk.old) == 0 {
-			// A context anchor identifies the line immediately before a pure
-			// insertion. Only an explicit end-of-file hunk (or an unanchored
-			// insertion) belongs at the file end.
-			start := lineIndex
-			if chunk.endOfFile || !chunk.hasContext {
-				start = len(lines)
-			}
-			if start > len(lines) {
-				start = len(lines)
-			}
-			replacement, err := structuredPatchReplacement(chunk, lines, start)
-			if err != nil {
-				return "", fmt.Errorf("building replacement for %s: %w", path, err)
-			}
-			replacements = append(replacements, structuredReplacement{start: start, replacement: replacement})
-			lineIndex = start
-			continue
-		}
-		index, ambiguous := findStructuredPatchSequence(lines, chunk.old, lineIndex, chunk.endOfFile)
-		if ambiguous {
-			return "", fmt.Errorf("expected lines are ambiguous in %s; provide more surrounding context:\n%s", path, strings.Join(chunk.old, "\n"))
-		}
-		if index < 0 {
-			return "", fmt.Errorf("could not find expected lines in %s:\n%s", path, strings.Join(chunk.old, "\n"))
-		}
-		replacement, err := structuredPatchReplacement(chunk, lines, index)
-		if err != nil {
-			return "", fmt.Errorf("building replacement for %s: %w", path, err)
-		}
-		replacements = append(replacements, structuredReplacement{start: index, length: len(chunk.old), replacement: replacement})
-		lineIndex = index + len(chunk.old)
-	}
-	for index := 1; index < len(replacements); index++ {
-		previous := replacements[index-1]
-		current := replacements[index]
-		if current.start < previous.start+previous.length {
-			return "", fmt.Errorf("overlapping or out-of-order hunks in %s; provide non-overlapping context", path)
-		}
-	}
-	for index := len(replacements) - 1; index >= 0; index-- {
-		replacement := replacements[index]
-		lines = append(lines[:replacement.start], append(replacement.replacement, lines[replacement.start+replacement.length:]...)...)
-	}
-	if len(lines) == 0 {
-		return "", nil
-	}
-	updated := strings.Join(lines, lineEnding)
-	if trailingNewline {
-		updated += lineEnding
-	}
-	return updated, nil
-}
-
-func structuredPatchReplacement(chunk structuredPatchChunk, source []string, start int) ([]string, error) {
-	if len(chunk.newSourceOffsets) != len(chunk.new) {
-		return nil, fmt.Errorf("context mapping has %d entries for %d output lines", len(chunk.newSourceOffsets), len(chunk.new))
-	}
-	replacement := append([]string(nil), chunk.new...)
-	for outputIndex, sourceOffset := range chunk.newSourceOffsets {
-		if sourceOffset < 0 {
-			continue
-		}
-		sourceIndex := start + sourceOffset
-		if sourceIndex < 0 || sourceIndex >= len(source) {
-			return nil, fmt.Errorf("context source index %d is outside the matched file", sourceIndex)
-		}
-		replacement[outputIndex] = source[sourceIndex]
-	}
-	return replacement, nil
-}
-
-func structuredPatchLineEnding(content string) string {
-	if strings.Contains(content, "\r\n") && !strings.Contains(strings.ReplaceAll(content, "\r\n", ""), "\n") {
-		return "\r\n"
-	}
-	return "\n"
-}
-
-type structuredReplacement struct {
-	start       int
-	length      int
-	replacement []string
-}
-
-func findStructuredPatchSequence(lines, wanted []string, start int, endOfFile bool) (int, bool) {
-	if len(wanted) == 0 {
-		return start, false
-	}
-	if len(wanted) > len(lines) {
-		return -1, false
-	}
-	searchStart := start
-	if endOfFile {
-		searchStart = len(lines) - len(wanted)
-		if searchStart < start {
-			searchStart = start
-		}
-	}
-	for _, equal := range []func(string, string) bool{
-		func(left, right string) bool { return left == right },
-		func(left, right string) bool {
-			return strings.TrimRight(left, " \t") == strings.TrimRight(right, " \t")
-		},
-		func(left, right string) bool { return strings.TrimSpace(left) == strings.TrimSpace(right) },
-	} {
-		match := -1
-		for index := searchStart; index+len(wanted) <= len(lines); index++ {
-			matched := true
-			for offset, line := range wanted {
-				if !equal(lines[index+offset], line) {
-					matched = false
-					break
-				}
-			}
-			if matched {
-				if match >= 0 {
-					return -1, true
-				}
-				match = index
-			}
-		}
-		if match >= 0 {
-			return match, false
-		}
-	}
-	return -1, false
-}
-
-func applyStructuredPatchChanges(root *os.Root, changes []structuredPatchChange, tracker *FileTracker) error {
-	mutated := false
-	for _, change := range changes {
-		committed, err := applyStructuredPatchChange(root, change)
-		mutated = mutated || committed
-		if err != nil {
-			forgetStructuredPatchFiles(tracker, changes)
-			if mutated {
-				return fmt.Errorf("%w; structured patch was partially applied; re-read affected files before retrying", err)
-			}
-			return err
-		}
-	}
-	return nil
-}
-
-func forgetStructuredPatchFiles(tracker *FileTracker, changes []structuredPatchChange) {
-	if tracker == nil {
-		return
-	}
-	for _, change := range changes {
-		tracker.Forget(change.from.absolute)
-		if change.to.absolute != change.from.absolute {
-			tracker.Forget(change.to.absolute)
-		}
-	}
-}
-
-func applyStructuredPatchChange(root *os.Root, change structuredPatchChange) (bool, error) {
-	switch change.kind {
-	case structuredPatchDelete:
-		if err := root.Remove(change.from.relative); err != nil {
-			return false, fmt.Errorf("deleting %s: %w", change.from.relative, err)
-		}
-		return true, nil
-	case structuredPatchAdd:
-		return writeStructuredPatchFile(root, change.to, change.after, change.mode, true)
-	case structuredPatchUpdate:
-		moving := change.from.absolute != change.to.absolute
-		committed, err := writeStructuredPatchFile(root, change.to, change.after, change.mode, moving)
-		if err != nil {
-			return committed, err
-		}
-		if moving {
-			if err := root.Remove(change.from.relative); err != nil {
-				return true, fmt.Errorf("removing moved source %s: %w", change.from.relative, err)
-			}
-		}
-		return true, nil
-	}
-	return false, fmt.Errorf("unsupported structured patch operation")
-}
-
-func writeStructuredPatchFile(root *os.Root, target structuredPatchTarget, content string, mode os.FileMode, createOnly bool) (bool, error) {
-	parent := filepath.Dir(target.relative)
-	if err := root.MkdirAll(parent, 0o755); err != nil {
-		return false, fmt.Errorf("creating parent directory for %s: %w", target.relative, err)
-	}
-	temp, tempName, err := pathjail.CreateTemp(root, parent, "zero-patch", ".tmp")
-	if err != nil {
-		return false, fmt.Errorf("writing %s: %w", target.relative, err)
-	}
-	defer func() { _ = removeStructuredPatchTemp(root, tempName) }()
-	if _, err := temp.WriteString(content); err != nil {
-		_ = temp.Close()
-		return false, fmt.Errorf("writing %s: %w", target.relative, err)
-	}
-	if err := temp.Chmod(mode.Perm()); err != nil {
-		_ = temp.Close()
-		return false, fmt.Errorf("writing %s: %w", target.relative, err)
-	}
-	if err := temp.Close(); err != nil {
-		return false, fmt.Errorf("writing %s: %w", target.relative, err)
-	}
-	if createOnly {
-		return publishStructuredPatchNoReplace(root, tempName, target.relative, mode)
-	}
-	if err := root.Rename(tempName, target.relative); err != nil {
-		return false, fmt.Errorf("writing %s: %w", target.relative, err)
-	}
-	return true, nil
-}
-
-func publishStructuredPatchNoReplace(root *os.Root, source, target string, mode os.FileMode) (bool, error) {
-	return publishStructuredPatchNoReplaceWith(root, source, target, mode, root.Link)
-}
-
-func publishStructuredPatchNoReplaceWith(root *os.Root, source, target string, mode os.FileMode, link func(string, string) error) (bool, error) {
-	if linkErr := link(source, target); linkErr == nil {
-		cleanupErr := removeStructuredPatchTemp(root, source)
-		chmodErr := root.Chmod(target, mode.Perm())
-		if cleanupErr != nil || chmodErr != nil {
-			return true, fmt.Errorf("publishing %s: %w", target, errors.Join(cleanupErr, chmodErr))
-		}
-		return true, nil
-	} else if errors.Is(linkErr, os.ErrExist) {
-		return false, fmt.Errorf("creating %s: %w", target, linkErr)
-	} else {
-		committed, copyErr := copyStructuredPatchNoReplace(root, source, target, mode)
-		if copyErr != nil {
-			return committed, fmt.Errorf("creating %s without overwrite: hard link failed: %w; exclusive-copy fallback failed: %w", target, linkErr, copyErr)
-		}
-		return committed, nil
-	}
-}
-
-func copyStructuredPatchNoReplace(root *os.Root, source, target string, mode os.FileMode) (bool, error) {
-	return copyStructuredPatchNoReplaceWith(root, source, target, mode, io.Copy, removeStructuredPatchTemp)
-}
-
-func copyStructuredPatchNoReplaceWith(
-	root *os.Root,
-	source, target string,
-	mode os.FileMode,
-	copyFile func(io.Writer, io.Reader) (int64, error),
-	cleanup func(*os.Root, string) error,
-) (bool, error) {
-	sourceFile, err := root.Open(source)
-	if err != nil {
-		return false, err
-	}
-	sourceClosed := false
-	defer func() {
-		if !sourceClosed {
-			_ = sourceFile.Close()
-		}
-	}()
-	targetFile, err := root.OpenFile(target, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
-	if err != nil {
-		return false, err
-	}
-	committed := true
-	cleanupTarget := func(cause error) (bool, error) {
-		_ = targetFile.Close()
-		if cleanupErr := cleanup(root, target); cleanupErr == nil {
-			return false, cause
-		} else {
-			return committed, errors.Join(cause, fmt.Errorf("cleaning partial target: %w", cleanupErr))
-		}
-	}
-	if _, err := copyFile(targetFile, sourceFile); err != nil {
-		return cleanupTarget(err)
-	}
-	if err := sourceFile.Close(); err != nil {
-		sourceClosed = true
-		return cleanupTarget(err)
-	}
-	sourceClosed = true
-	if err := targetFile.Chmod(mode.Perm()); err != nil {
-		return cleanupTarget(err)
-	}
-	if err := targetFile.Close(); err != nil {
-		if cleanupErr := cleanup(root, target); cleanupErr == nil {
-			return false, err
-		} else {
-			return true, errors.Join(err, fmt.Errorf("cleaning target after close failure: %w", cleanupErr))
-		}
-	}
-	if err := cleanup(root, source); err != nil {
-		return true, fmt.Errorf("removing published source: %w", err)
-	}
-	return true, nil
-}
-
-func removeStructuredPatchTemp(root *os.Root, name string) error {
-	chmodErr := root.Chmod(name, 0o600)
-	if os.IsNotExist(chmodErr) {
-		return nil
-	}
-	removeErr := root.Remove(name)
-	if os.IsNotExist(removeErr) {
-		removeErr = nil
-	}
-	if removeErr == nil {
-		return nil
-	}
-	return errors.Join(chmodErr, removeErr)
-}
-
-func recordStructuredPatchFile(tracker *FileTracker, absolute string, created, seenWhole bool) {
-	if tracker == nil {
-		return
-	}
-	content, err := os.ReadFile(absolute)
-	if err != nil {
-		tracker.Forget(absolute)
-		return
-	}
-	info, _ := os.Stat(absolute)
-	tracker.Record(absolute, content, info)
-	if seenWhole {
-		lines := lineCount(string(content))
-		tracker.RecordSeenRange(absolute, 1, lines, lines)
-	}
-	if created {
-		tracker.RecordCreated(absolute)
-	}
-}
-
-func changedFilesFromStructuredPatch(relativeRoot string, changes []structuredPatchChange) []string {
-	seen := make(map[string]bool)
-	var paths []string
-	for _, change := range changes {
-		targets := []structuredPatchTarget{change.to}
-		if change.from.absolute != change.to.absolute {
-			targets = append([]structuredPatchTarget{change.from}, targets...)
-		}
-		for _, target := range targets {
-			path := target.relative
-			if relativeRoot != "" && relativeRoot != "." {
-				path = filepath.ToSlash(filepath.Join(relativeRoot, path))
-			}
-			if !seen[path] {
-				seen[path] = true
-				paths = append(paths, path)
-			}
-		}
-	}
-	return paths
-}
-
-func structuredPatchPreview(changes []structuredPatchChange) string {
-	var preview strings.Builder
-	for _, change := range changes {
-		path := change.to.relative
-		if change.kind == structuredPatchDelete {
-			path = change.from.relative
-		}
-		before, after := change.before, change.after
-		if change.kind == structuredPatchDelete {
-			after = ""
-		}
-		diff := boundedUnifiedDiff(path, before, after)
-		if diff == "" {
-			continue
-		}
-		if preview.Len()+len(diff)+1 > maxToolPreviewBytes {
-			break
-		}
-		if preview.Len() > 0 {
-			preview.WriteByte('\n')
-		}
-		preview.WriteString(diff)
-	}
-	return capPreviewDiff(preview.String())
-}
@@ -130,9 +130,6 @@ func (tool toolSearchTool) visibleDeferredTools(enabled []string, disabled []str
 	var deferred []Tool
 	if tool.registry != nil {
 		for _, candidate := range tool.registry.All() {
-			if !ModelVisible(candidate) {
-				continue
-			}
 			if !IsDeferred(candidate) {
 				continue
 			}
@@ -161,9 +158,6 @@ func (tool toolSearchTool) visibleEagerToolNames(enabled []string, disabled []st
 		return names
 	}
 	for _, candidate := range tool.registry.All() {
-		if !ModelVisible(candidate) {
-			continue
-		}
 		if IsDeferred(candidate) || candidate.Name() == ToolSearchToolName {
 			continue
 		}
@@ -2,23 +2,12 @@ package tools

 import (
 	"context"
-	"errors"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )

-func mustReadTestFile(t *testing.T, path string) string {
-	t.Helper()
-	content, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return string(content)
-}
-
 func TestCoreToolsExposeWriteAndPlanTools(t *testing.T) {
 	toolset := CoreToolsScoped(t.TempDir(), nil)
 	byName := make(map[string]Tool, len(toolset))
@@ -524,532 +513,6 @@ func TestApplyPatchToolAppliesUnifiedDiff(t *testing.T) {
 	}
 }

-func TestApplyPatchToolAppliesStructuredPatch(t *testing.T) {
-	root := t.TempDir()
-	writeTestFile(t, filepath.Join(root, "hello.txt"), "hello\nold\n")
-
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: hello.txt",
-		"@@",
-		" hello",
-		"-old",
-		"+new",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured patch should apply, got %s: %s", result.Status, result.Output)
-	}
-	content, err := os.ReadFile(filepath.Join(root, "hello.txt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := strings.ReplaceAll(string(content), "\r\n", "\n"); got != "hello\nnew\n" {
-		t.Fatalf("structured patch content = %q", got)
-	}
-}
-
-func TestApplyPatchToolAppliesStructuredAddAndMove(t *testing.T) {
-	root := t.TempDir()
-	writeTestFile(t, filepath.Join(root, "old.txt"), "old\n")
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Add File: nested/new.txt",
-		"+created",
-		"*** Update File: old.txt",
-		"*** Move to: moved.txt",
-		"@@",
-		"-old",
-		"+moved",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured patch should apply, got %s: %s", result.Status, result.Output)
-	}
-	if got, err := os.ReadFile(filepath.Join(root, "nested", "new.txt")); err != nil || string(got) != "created\n" {
-		t.Fatalf("added file = %q, err = %v", got, err)
-	}
-	if got, err := os.ReadFile(filepath.Join(root, "moved.txt")); err != nil || string(got) != "moved\n" {
-		t.Fatalf("moved file = %q, err = %v", got, err)
-	}
-	if _, err := os.Stat(filepath.Join(root, "old.txt")); !os.IsNotExist(err) {
-		t.Fatalf("old source should be removed, stat err = %v", err)
-	}
-	if got := result.ChangedFiles; strings.Join(got, ",") != "nested/new.txt,old.txt,moved.txt" {
-		t.Fatalf("ChangedFiles = %v", got)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchMatchesWhitespaceTolerantly(t *testing.T) {
-	root := t.TempDir()
-	writeTestFile(t, filepath.Join(root, "hello.txt"), "  hello   \n")
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: hello.txt",
-		"@@",
-		"-hello",
-		"+goodbye",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured patch should tolerate surrounding whitespace, got %s: %s", result.Status, result.Output)
-	}
-	content, err := os.ReadFile(filepath.Join(root, "hello.txt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := string(content); got != "goodbye\n" {
-		t.Fatalf("structured patch content = %q", got)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchPreservesWhitespaceTolerantContext(t *testing.T) {
-	root := t.TempDir()
-	path := filepath.Join(root, "example.go")
-	original := "func f() {\n\tif cond {\n\t\tdoWork()\n\t\tlogIt()\n\t}\n}\n"
-	writeTestFile(t, path, original)
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: example.go",
-		"@@",
-		"     if cond {",
-		"         doWork()",
-		"-\t\tlogIt()",
-		"+\t\tlogIt(ctx)",
-		"     }",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured patch failed: %s", result.Output)
-	}
-	want := "func f() {\n\tif cond {\n\t\tdoWork()\n\t\tlogIt(ctx)\n\t}\n}\n"
-	if got := mustReadTestFile(t, path); got != want {
-		t.Fatalf("structured patch rewrote unchanged context:\n got %q\nwant %q", got, want)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchPreservesMixedContextLineEndings(t *testing.T) {
-	root := t.TempDir()
-	path := filepath.Join(root, "example.txt")
-	original := "alpha\r\n\tcontext\r\n\told\nomega\r\n"
-	writeTestFile(t, path, original)
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: example.txt",
-		"@@",
-		" alpha",
-		"     context",
-		"-\told",
-		"+\tnew",
-		" omega",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured patch failed: %s", result.Output)
-	}
-	want := "alpha\r\n\tcontext\r\n\tnew\nomega\r\n"
-	if got := mustReadTestFile(t, path); got != want {
-		t.Fatalf("structured patch rewrote context line endings:\n got %q\nwant %q", got, want)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchInsertsAtContext(t *testing.T) {
-	root := t.TempDir()
-	writeTestFile(t, filepath.Join(root, "example.txt"), "anchor\nmiddle\nremove\n")
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: example.txt",
-		"@@ anchor",
-		"+inserted",
-		"@@ middle",
-		"-remove",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured insertion failed: %s", result.Output)
-	}
-	content, err := os.ReadFile(filepath.Join(root, "example.txt"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := string(content), "anchor\ninserted\nmiddle\n"; got != want {
-		t.Fatalf("structured insertion content = %q, want %q", got, want)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchRejectsAmbiguousMatch(t *testing.T) {
-	root := t.TempDir()
-	path := filepath.Join(root, "example.go")
-	original := "func a() {\n\treturn nil\n}\n\nfunc b() {\n\treturn nil\n}\n"
-	writeTestFile(t, path, original)
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: example.go",
-		"@@",
-		"-\treturn nil",
-		"+\treturn errNotFound",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusError || !strings.Contains(strings.ToLower(result.Output), "ambiguous") {
-		t.Fatalf("ambiguous structured patch should be refused, got %s: %s", result.Status, result.Output)
-	}
-	if got := mustReadTestFile(t, path); got != original {
-		t.Fatalf("ambiguous structured patch changed the file: %q", got)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchPreservesCRLF(t *testing.T) {
-	root := t.TempDir()
-	path := filepath.Join(root, "example.txt")
-	writeTestFile(t, path, "alpha\r\nbravo\r\ncharlie\r\n")
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: example.txt",
-		"@@",
-		"-bravo",
-		"+BRAVO",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured patch failed: %s", result.Output)
-	}
-	if got, want := mustReadTestFile(t, path), "alpha\r\nBRAVO\r\ncharlie\r\n"; got != want {
-		t.Fatalf("structured patch content = %q, want %q", got, want)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchPreservesMissingFinalNewline(t *testing.T) {
-	root := t.TempDir()
-	path := filepath.Join(root, "example.txt")
-	writeTestFile(t, path, "alpha\nbravo")
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: example.txt",
-		"@@",
-		"-alpha",
-		"+ALPHA",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured patch failed: %s", result.Output)
-	}
-	if got, want := mustReadTestFile(t, path), "ALPHA\nbravo"; got != want {
-		t.Fatalf("structured patch content = %q, want %q", got, want)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchKeepsInsertedEmptyFileWithoutFinalNewline(t *testing.T) {
-	root := t.TempDir()
-	path := filepath.Join(root, "empty.txt")
-	writeTestFile(t, path, "")
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: empty.txt",
-		"@@",
-		"+content",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusOK {
-		t.Fatalf("structured patch failed: %s", result.Output)
-	}
-	if got, want := mustReadTestFile(t, path), "content"; got != want {
-		t.Fatalf("structured patch content = %q, want %q", got, want)
-	}
-}
-
-func TestApplyPatchToolStructuredPatchRejectsOutOfOrderEndHunk(t *testing.T) {
-	root := t.TempDir()
-	path := filepath.Join(root, "example.txt")
-	original := "alpha\nbravo\ncharlie\ndelta\necho\n"
-	writeTestFile(t, path, original)
-	patch := strings.Join([]string{
-		"*** Begin Patch",
-		"*** Update File: example.txt",
-		"@@",
-		"-delta",
-		"+DELTA",
-		"@@",
-		"-delta",
-		"-echo",
-		"+tail",
-		"*** End of File",
-		"*** End Patch",
-		"",
-	}, "\n")
-
-	result := NewScopedApplyPatchTool(root, nil).Run(context.Background(), map[string]any{"patch": patch})
-	if result.Status != StatusError {
-		t.Fatalf("out-of-order structured patch should be refused, got %s: %s", result.Status, result.Output)
-	}
-	if got := mustReadTestFile(t, path); got != original {
-		t.Fatalf("out-of-order structured patch changed the file: %q", got)
-	}
-}
-
-func TestStructuredPatchAddDoesNotOverwriteRacedDestination(t *testing.T) {
-	root := t.TempDir()
-	targetPath := filepath.Join(root, "created.txt")
-	writeTestFile(t, targetPath, "other writer\n")
-	workspace, err := os.OpenRoot(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer workspace.Close()
-	change := structuredPatchChange{
-		kind:  structuredPatchAdd,
-		to:    structuredPatchTarget{absolute: targetPath, relative: "created.txt"},
-		after: "patch content\n", mode: 0o644,
-	}
-
-	err = applyStructuredPatchChanges(workspace, []structuredPatchChange{change}, nil)
-	if err == nil || !errors.Is(err, os.ErrExist) {
-		t.Fatalf("raced add destination = %v, want os.ErrExist", err)
-	}
-	if strings.Contains(err.Error(), "exclusive-copy fallback") {
-		t.Fatalf("existing destination should be reported directly: %v", err)
-	}
-	if got := mustReadTestFile(t, targetPath); got != "other writer\n" {
-		t.Fatalf("raced add overwrote another writer's file: %q", got)
-	}
-}
-
-func TestStructuredPatchFailedDeleteDoesNotRecreateMissingFile(t *testing.T) {
-	root := t.TempDir()
-	workspace, err := os.OpenRoot(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer workspace.Close()
-	missingPath := filepath.Join(root, "missing.txt")
-	change := structuredPatchChange{
-		kind:   structuredPatchDelete,
-		from:   structuredPatchTarget{absolute: missingPath, relative: "missing.txt"},
-		before: "removed by another writer\n", mode: 0o644,
-	}
-
-	err = applyStructuredPatchChanges(workspace, []structuredPatchChange{change}, nil)
-	if err == nil {
-		t.Fatal("delete of an already removed file should fail")
-	}
-	if _, statErr := os.Stat(missingPath); !os.IsNotExist(statErr) {
-		t.Fatalf("failed delete recreated the missing file: %v", statErr)
-	}
-}
-
-func TestStructuredPatchMoveFailureLeavesPublishedDestination(t *testing.T) {
-	root := t.TempDir()
-	workspace, err := os.OpenRoot(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer workspace.Close()
-	sourcePath := filepath.Join(root, "source.txt")
-	destinationPath := filepath.Join(root, "destination.txt")
-	change := structuredPatchChange{
-		kind:   structuredPatchUpdate,
-		from:   structuredPatchTarget{absolute: sourcePath, relative: "source.txt"},
-		to:     structuredPatchTarget{absolute: destinationPath, relative: "destination.txt"},
-		before: "removed source\n", after: "moved content\n", mode: 0o644,
-	}
-
-	err = applyStructuredPatchChanges(workspace, []structuredPatchChange{change}, nil)
-	if err == nil || !strings.Contains(err.Error(), "partially applied") {
-		t.Fatalf("move with a missing source = %v, want partial-application error", err)
-	}
-	if _, statErr := os.Stat(sourcePath); !os.IsNotExist(statErr) {
-		t.Fatalf("failed move recreated a missing source: %v", statErr)
-	}
-	if got := mustReadTestFile(t, destinationPath); got != "moved content\n" {
-		t.Fatalf("published move destination = %q", got)
-	}
-}
-
-func TestStructuredPatchCreateOnlyFallsBackWhenHardLinksUnsupported(t *testing.T) {
-	root := t.TempDir()
-	workspace, err := os.OpenRoot(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer workspace.Close()
-	sourcePath := filepath.Join(root, "source.tmp")
-	writeTestFile(t, sourcePath, "complete content\n")
-	if err := workspace.Chmod("source.tmp", 0o444); err != nil {
-		t.Fatal(err)
-	}
-	committed, err := publishStructuredPatchNoReplaceWith(
-		workspace,
-		"source.tmp",
-		"target.txt",
-		0o444,
-		func(string, string) error { return errors.New("hard links unsupported") },
-	)
-	if err != nil || !committed {
-		t.Fatalf("fallback publish = committed %v, error %v", committed, err)
-	}
-	if got := mustReadTestFile(t, filepath.Join(root, "target.txt")); got != "complete content\n" {
-		t.Fatalf("fallback target content = %q", got)
-	}
-	if _, statErr := os.Stat(sourcePath); !os.IsNotExist(statErr) {
-		t.Fatalf("read-only source was not cleaned up: %v", statErr)
-	}
-}
-
-func TestStructuredPatchCopyFailureReportsSurvivingPartialTarget(t *testing.T) {
-	root := t.TempDir()
-	workspace, err := os.OpenRoot(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer workspace.Close()
-	sourcePath := filepath.Join(root, "source.tmp")
-	writeTestFile(t, sourcePath, "complete content\n")
-	copyErr := errors.New("injected copy failure")
-	cleanupErr := errors.New("injected target cleanup failure")
-	committed, err := copyStructuredPatchNoReplaceWith(
-		workspace,
-		"source.tmp",
-		"target.txt",
-		0o644,
-		func(destination io.Writer, _ io.Reader) (int64, error) {
-			written, writeErr := io.WriteString(destination, "partial")
-			if writeErr != nil {
-				return int64(written), writeErr
-			}
-			return int64(written), copyErr
-		},
-		func(root *os.Root, name string) error {
-			if name == "target.txt" {
-				return cleanupErr
-			}
-			return removeStructuredPatchTemp(root, name)
-		},
-	)
-	if !committed || !errors.Is(err, copyErr) || !errors.Is(err, cleanupErr) {
-		t.Fatalf("copy failure = committed %v, error %v", committed, err)
-	}
-	targetPath := filepath.Join(root, "target.txt")
-	if got := mustReadTestFile(t, targetPath); got != "partial" {
-		t.Fatalf("partial target content = %q", got)
-	}
-}
-
-func TestStructuredPatchPartialFailureLeavesCompletedChangeAndClearsTrackedState(t *testing.T) {
-	root := t.TempDir()
-	trackedPath := filepath.Join(root, "tracked.txt")
-	writeTestFile(t, trackedPath, "original\n")
-	workspace, err := os.OpenRoot(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer workspace.Close()
-
-	trackedPath, err = filepath.EvalSymlinks(trackedPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	info, err := os.Stat(trackedPath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	tracker := NewFileTracker()
-	tracker.Record(trackedPath, []byte("original\n"), info)
-	tracker.RecordSeenRange(trackedPath, 1, 1, 1)
-	trackedTarget := structuredPatchTarget{absolute: trackedPath, relative: "tracked.txt"}
-	blockedPath := filepath.Join(root, "blocked")
-	if err := os.Mkdir(blockedPath, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	writeTestFile(t, filepath.Join(blockedPath, "sentinel"), "keep\n")
-	changes := []structuredPatchChange{
-		{
-			kind: structuredPatchUpdate, from: trackedTarget, to: trackedTarget,
-			before: "original\n", after: "updated\n", mode: 0o644,
-		},
-		{
-			kind:  structuredPatchAdd,
-			to:    structuredPatchTarget{absolute: blockedPath, relative: "blocked"},
-			after: "cannot replace a non-empty directory\n", mode: 0o644,
-		},
-	}
-
-	err = applyStructuredPatchChanges(workspace, changes, tracker)
-	if err == nil || !strings.Contains(err.Error(), "partially applied") {
-		t.Fatalf("second change = %v, want partial-application error", err)
-	}
-	if got := mustReadTestFile(t, trackedPath); got != "updated\n" {
-		t.Fatalf("completed change was unexpectedly altered: %q", got)
-	}
-	if _, tracked := tracker.Version(trackedPath); tracked || tracker.SeenWhole(trackedPath) {
-		t.Fatal("partial failure retained stale file-tracker state")
-	}
-}
-
-func TestApplyPatchToolRejectsMalformedOrEscapingStructuredPatchBeforeWriting(t *testing.T) {
-	root := t.TempDir()
-	tool := NewScopedApplyPatchTool(root, nil)
-	for name, patch := range map[string]string{
-		"empty update": strings.Join([]string{
-			"*** Begin Patch",
-			"*** Update File: target.txt",
-			"*** End Patch",
-		}, "\n"),
-		"escape": strings.Join([]string{
-			"*** Begin Patch",
-			"*** Add File: ../outside.txt",
-			"+nope",
-			"*** End Patch",
-		}, "\n"),
-	} {
-		t.Run(name, func(t *testing.T) {
-			result := tool.Run(context.Background(), map[string]any{"patch": patch})
-			if result.Status != StatusError {
-				t.Fatalf("expected error, got %s: %s", result.Status, result.Output)
-			}
-			if strings.Contains(result.Output, "No valid patches") {
-				t.Fatalf("structured patch should fail before git apply, got %q", result.Output)
-			}
-			if name == "empty update" {
-				if _, err := os.Stat(filepath.Join(root, "target.txt")); !os.IsNotExist(err) {
-					t.Fatalf("empty update must not write target file, stat err = %v", err)
-				}
-			}
-		})
-	}
-	if _, err := os.Stat(filepath.Join(filepath.Dir(root), "outside.txt")); !os.IsNotExist(err) {
-		t.Fatalf("escaping patch must not write outside workspace, stat err = %v", err)
-	}
-}
-
 // A hunk-body line that removes content beginning with "-- " appears in the diff
 // as "--- ..."; it must NOT be mistaken for a file header (which previously made
 // apply_patch reject a valid patch as targeting an outside path).
@@ -22,7 +22,7 @@ func (m model) handleAddDirCommand(arg string) model {
 	if err != nil {
 		return m.appendSystemNotice("add-dir: " + err.Error())
 	}
-	return m.showTransientNoticeInline("Write access added: "+root+" (this session only).", transientNoticeSuccess)
+	return m.appendSystemNotice("write access added: " + root + " (this session only)")
 }

 // appendSystemNotice appends a system transcript line and returns the updated
@@ -42,8 +42,8 @@ func TestHandleAddDirCommand(t *testing.T) {
 	if roots := scope.Roots(); len(roots) != initialRootCount+1 {
 		t.Fatalf("expected one additional write root after grant, got %#v", roots)
 	}
-	notice := next.transientNotice.text
-	if !strings.Contains(notice, "Write access added") || !strings.Contains(notice, "session only") {
+	notice := lastTranscriptText(next)
+	if !strings.Contains(notice, "write access added") || !strings.Contains(notice, "session only") {
 		t.Fatalf("grant notice = %q, want it to mention the grant and its session-only lifetime", notice)
 	}

@@ -18,8 +18,6 @@ const (
 	markdownTableRuleBodyRows    = 4
 	markdownBoldStart            = "\x1b[1m"
 	markdownBoldEnd              = "\x1b[22m"
-	markdownCodeStart            = "\x1b[7m"
-	markdownCodeEnd              = "\x1b[27m"
 )

 type markdownDisplayStyle int
@@ -27,7 +25,6 @@ type markdownDisplayStyle int
 const (
 	markdownDisplayNormal markdownDisplayStyle = iota
 	markdownDisplayBold
-	markdownDisplayCode
 	markdownDisplayRule
 )

@@ -265,8 +262,6 @@ func styleAssistantMarkdownLine(line string, base lipgloss.Style) string {
 		case markdownDisplayBold:
 			// Emphasis is weight-only (no colour) — dark-mode-friendly and calm.
 			builder.WriteString(zeroTheme.ink.Bold(true).Render(text))
-		case markdownDisplayCode:
-			builder.WriteString(inlineCodeStyle().Render(text))
 		case markdownDisplayRule:
 			builder.WriteString(zeroTheme.lineStrong.Render(text))
 		default:
@@ -287,16 +282,6 @@ func styleAssistantMarkdownLine(line string, base lipgloss.Style) string {
 			style = markdownDisplayNormal
 			index += len(markdownBoldEnd)
 			continue
-		case strings.HasPrefix(line[index:], markdownCodeStart):
-			flush()
-			style = markdownDisplayCode
-			index += len(markdownCodeStart)
-			continue
-		case strings.HasPrefix(line[index:], markdownCodeEnd):
-			flush()
-			style = markdownDisplayNormal
-			index += len(markdownCodeEnd)
-			continue
 		case line[index] == '\x1b':
 			// Already-styled input (highlighted code, headings, tables) carries real
 			// ANSI. Emit each escape verbatim instead of treating its bytes as runes
@@ -328,13 +313,6 @@ func styleAssistantMarkdownLine(line string, base lipgloss.Style) string {
 	return builder.String()
 }

-func hasMarkdownDisplayControls(line string) bool {
-	return strings.Contains(line, markdownBoldStart) ||
-		strings.Contains(line, markdownBoldEnd) ||
-		strings.Contains(line, markdownCodeStart) ||
-		strings.Contains(line, markdownCodeEnd)
-}
-
 func hasExternalANSIStyle(line string) bool {
 	for index := 0; index < len(line); {
 		if line[index] != '\x1b' {
@@ -347,7 +325,7 @@ func hasExternalANSIStyle(line string) bool {
 			continue
 		}
 		seq := line[index:end]
-		if seq != markdownBoldStart && seq != markdownBoldEnd && seq != markdownCodeStart && seq != markdownCodeEnd {
+		if seq != markdownBoldStart && seq != markdownBoldEnd {
 			return true
 		}
 		index = end
@@ -356,9 +334,6 @@ func hasExternalANSIStyle(line string) bool {
 }

 func markdownDisplayStyleForRune(r rune, current markdownDisplayStyle) markdownDisplayStyle {
-	if current == markdownDisplayCode {
-		return current
-	}
 	switch r {
 	case '│', '─', '┼', '╭', '╮', '╰', '╯', '├', '┤', '┬', '┴':
 		return markdownDisplayRule
@@ -1005,7 +980,6 @@ func renderMarkdownStandaloneLine(line string) string {
 type markdownInlineSegment struct {
 	text string
 	bold bool
-	code bool
 }

 func wrapMarkdownInline(text string, measure int) []string {
@@ -1054,7 +1028,7 @@ func wrapMarkdownInlineWithPrefixes(firstPrefix string, continuationPrefix strin
 				flush()
 			}
 			head, tail := splitAtWidth(word.text, available)
-			lines = append(lines, prefix+renderMarkdownInlineSegment(markdownInlineSegment{text: head, bold: word.bold, code: word.code}))
+			lines = append(lines, prefix+renderMarkdownInlineSegment(markdownInlineSegment{text: head, bold: word.bold}))
 			word.text = tail
 			prefix = continuationPrefix
 			available = maxInt(1, measure-lipgloss.Width(prefix))
@@ -1089,14 +1063,8 @@ func wrapMarkdownInlineWithPrefixes(firstPrefix string, continuationPrefix strin
 func markdownInlineWords(segments []markdownInlineSegment) []markdownInlineSegment {
 	words := []markdownInlineSegment{}
 	for _, segment := range segments {
-		if segment.code {
-			if segment.text != "" {
-				words = append(words, segment)
-			}
-			continue
-		}
 		for _, word := range strings.Fields(segment.text) {
-			words = append(words, markdownInlineSegment{text: word, bold: segment.bold, code: segment.code})
+			words = append(words, markdownInlineSegment{text: word, bold: segment.bold})
 		}
 	}
 	return words
@@ -1110,9 +1078,6 @@ func renderMarkdownInlineSegment(segment markdownInlineSegment) string {
 	if segment.text == "" {
 		return ""
 	}
-	if segment.code {
-		return markdownCodeStart + segment.text + markdownCodeEnd
-	}
 	if segment.bold {
 		return renderMarkdownBoldText(segment.text)
 	}
@@ -1142,7 +1107,7 @@ func parseMarkdownInline(text string) []markdownInlineSegment {
 		if builder.Len() == 0 {
 			return
 		}
-		segments = append(segments, markdownInlineSegment{text: builder.String(), bold: bold && !code, code: code})
+		segments = append(segments, markdownInlineSegment{text: builder.String(), bold: bold && !code})
 		builder.Reset()
 	}

@@ -1,110 +0,0 @@
-package tui
-
-import (
-	"strings"
-
-	"github.com/Gitlawb/zero/internal/terminalpet"
-)
-
-const (
-	attachmentImageID             = uint32(0xC0E0)
-	attachmentPreviewCols         = 10
-	attachmentPreviewRows         = 4
-	attachmentPreviewHeightPixels = 64
-	attachmentPreviewMaxImages    = 4
-)
-
-// attachmentThumbnailVisible deliberately has a conservative layout gate. The
-// image is an enhancement to the existing attachment chips, not a reason to
-// crowd a narrow or modal surface.
-func (m model) attachmentThumbnailVisible(width int) bool {
-	if len(m.attachmentRenderers) == 0 || !m.altScreen ||
-		m.height < attachmentPreviewRows+10 || width < attachmentPreviewCols+28 {
-		return false
-	}
-	if m.pendingPermission != nil || m.pendingAskUser != nil || m.pendingSpecReview != nil ||
-		m.providerWizard != nil || m.mcpAddWizard != nil || m.mcpManager != nil || m.picker != nil ||
-		m.sttKeyPrompt != nil || m.renamePrompt != nil || m.setup.visible || m.helpOverlay || m.leaderHelpOverlay {
-		return false
-	}
-	for index := 0; index < m.attachmentThumbnailSlots(width); index++ {
-		if index < len(m.pendingImageThumbnails) && m.pendingImageThumbnails[index] != nil &&
-			index < len(m.attachmentRenderers) && m.attachmentRenderers[index].Support().Supported() {
-			return true
-		}
-	}
-	return false
-}
-
-func (m model) attachmentThumbnailSlots(width int) int {
-	innerWidth := maxInt(1, width-m.petComposerReservedColumns(width)-4)
-	slots := maxInt(1, innerWidth/(attachmentPreviewCols+1))
-	return min(attachmentPreviewMaxImages, min(slots, len(m.attachmentRenderers)))
-}
-
-func (m model) attachmentThumbnailLines(width int) []string {
-	left := strings.Repeat(" ", attachmentPreviewCols+1)
-	lines := make([]string, attachmentPreviewRows)
-	for index := range lines {
-		lines[index] = left
-	}
-	for index, line := range lines {
-		lines[index] = fitStyledLine(line, width)
-	}
-	return lines
-}
-
-func (m model) attachmentThumbnailSupplementalChips() string {
-	if len(m.pendingImageLabels) <= 1 && len(m.pendingDocuments) == 0 {
-		return ""
-	}
-	return renderAttachmentChips(m.pendingImageLabels, m.pendingDocuments)
-}
-
-func (m model) attachmentComposerPrefixRows(width int) int {
-	if m.attachmentThumbnailVisible(width) {
-		rows := attachmentPreviewRows
-		if m.attachmentThumbnailSupplementalChips() != "" {
-			rows++
-		}
-		return rows
-	}
-	if renderAttachmentChips(m.pendingImageLabels, m.pendingDocuments) != "" {
-		return 1
-	}
-	return 0
-}
-
-// attachmentImageDraw places one gallery thumbnail inside the reserved top rows
-// of the composer. The position comes from the same footer layout used for mouse
-// input, so it follows sidebar changes and terminal resizes instead of relying on
-// a brittle absolute bottom-right calculation.
-func (m model) attachmentImageDraw(index int) *terminalpet.ImageDraw {
-	width := m.chatColumnWidth()
-	if !m.attachmentThumbnailVisible(width) || index < 0 || index >= m.attachmentThumbnailSlots(width) ||
-		index >= len(m.pendingImageThumbnails) || m.pendingImageThumbnails[index] == nil {
-		return nil
-	}
-	frame := m.scrollableTranscriptFrame(m.pinnedTitleBar(width), m.footerView(width))
-	if frame.composerRect.height < attachmentPreviewRows+2 {
-		return nil
-	}
-	return &terminalpet.ImageDraw{
-		ID:           attachmentImageID + uint32(index),
-		Animation:    m.pendingImageThumbnails[index],
-		State:        terminalpet.Idle,
-		X:            frame.composerRect.x + 2 + index*(attachmentPreviewCols+1),
-		Y:            frame.composerRect.y + 1,
-		Columns:      attachmentPreviewCols,
-		Rows:         attachmentPreviewRows,
-		HeightPixels: attachmentPreviewHeightPixels,
-	}
-}
-
-func attachmentPreviewImageIDs() []uint32 {
-	ids := make([]uint32, attachmentPreviewMaxImages)
-	for index := range ids {
-		ids[index] = attachmentImageID + uint32(index)
-	}
-	return ids
-}
@@ -1,168 +0,0 @@
-package tui
-
-import (
-	"bytes"
-	"context"
-	"image"
-	"image/color"
-	"image/png"
-	"os"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/Gitlawb/zero/internal/terminalpet"
-	"github.com/Gitlawb/zero/internal/zeroruntime"
-)
-
-func previewImageBlock(t *testing.T) zeroruntime.ImageBlock {
-	t.Helper()
-	frame := image.NewNRGBA(image.Rect(0, 0, 8, 6))
-	for y := 0; y < 6; y++ {
-		for x := 0; x < 8; x++ {
-			frame.Set(x, y, color.NRGBA{R: 60, G: 170, B: 220, A: 255})
-		}
-	}
-	var encoded bytes.Buffer
-	if err := png.Encode(&encoded, frame); err != nil {
-		t.Fatal(err)
-	}
-	return zeroruntime.ImageBlock{MediaType: "image/png", Data: encoded.Bytes()}
-}
-
-func TestAttachmentThumbnailRendersInsideComposerWhenSupported(t *testing.T) {
-	m := newModel(context.Background(), Options{})
-	m.width, m.height = 100, 30
-	m.altScreen = true
-	m.headerPrinted = true
-	m.attachmentRenderers = []*terminalpet.ImageRenderer{terminalpet.NewImageRenderer(terminalpet.ImageSupport{Protocol: terminalpet.ImageProtocolKitty})}
-	m.pendingImages = []zeroruntime.ImageBlock{previewImageBlock(t)}
-	m.pendingImageLabels = []string{"diagram.png"}
-	m.refreshPendingImageThumbnail()
-	if len(m.pendingImageThumbnails) != 1 || m.pendingImageThumbnails[0] == nil {
-		t.Fatal("expected staged image thumbnail")
-	}
-
-	view := m.View()
-	plain := plainRender(t, view.Content)
-	if strings.Contains(plain, "[Image #1]") {
-		t.Fatalf("supported terminal should use thumbnail strip, got:\n%s", plain)
-	}
-	if strings.Contains(plain, "Image #1 attached") {
-		t.Fatalf("thumbnail strip should not duplicate a text attachment label, got:\n%s", plain)
-	}
-
-	var output bytes.Buffer
-	if err := m.attachmentRenderers[0].Render(&output); err != nil {
-		t.Fatal(err)
-	}
-	if got := output.String(); !strings.Contains(got, "_Ga=T,t=d,f=100,c=10,r=4") {
-		t.Fatalf("thumbnail did not schedule a compact Kitty image: %q", got)
-	}
-}
-
-func TestAttachmentThumbnailKeepsAdditionalImagesVisibleWhenSupported(t *testing.T) {
-	m := newModel(context.Background(), Options{})
-	m.width, m.height = 100, 30
-	m.altScreen = true
-	m.attachmentRenderers = []*terminalpet.ImageRenderer{
-		terminalpet.NewImageRenderer(terminalpet.ImageSupport{Protocol: terminalpet.ImageProtocolKitty}),
-		terminalpet.NewImageRenderer(terminalpet.ImageSupport{Protocol: terminalpet.ImageProtocolKitty}),
-	}
-	m.pendingImages = []zeroruntime.ImageBlock{previewImageBlock(t), previewImageBlock(t)}
-	m.pendingImageLabels = []string{"first.png", "second.png"}
-	m.refreshPendingImageThumbnail()
-
-	plain := plainRender(t, m.composerBox(m.width))
-	if !strings.Contains(plain, "[Image #2]") {
-		t.Fatalf("a supported terminal must keep a second staged image visible, got:\n%s", plain)
-	}
-	_ = m.View()
-	for index, renderer := range m.attachmentRenderers {
-		var output bytes.Buffer
-		if err := renderer.Render(&output); err != nil {
-			t.Fatal(err)
-		}
-		id := "i=" + strconv.FormatUint(uint64(attachmentImageID+uint32(index)), 10)
-		if !strings.Contains(output.String(), id) {
-			t.Fatalf("thumbnail %d was not rendered, got %q", index+1, output.String())
-		}
-	}
-}
-
-func TestAttachmentThumbnailFallsBackToChipsWithoutTerminalGraphics(t *testing.T) {
-	m := newModel(context.Background(), Options{})
-	m.width, m.height = 100, 30
-	m.altScreen = true
-	m.pendingImages = []zeroruntime.ImageBlock{previewImageBlock(t)}
-	m.pendingImageLabels = []string{"diagram.png"}
-	m.refreshPendingImageThumbnail()
-
-	plain := plainRender(t, m.composerBox(m.width))
-	if !strings.Contains(plain, "[Image #1]") {
-		t.Fatalf("unsupported terminal should retain text attachment chip, got:\n%s", plain)
-	}
-	if strings.Contains(plain, "Image #1 attached") {
-		t.Fatalf("unsupported terminal should not reserve thumbnail rows, got:\n%s", plain)
-	}
-}
-
-func TestAttachmentThumbnailClearsWithPendingImage(t *testing.T) {
-	m := newModel(context.Background(), Options{})
-	m.width, m.height = 100, 30
-	m.altScreen = true
-	m.headerPrinted = true
-	m.attachmentRenderers = []*terminalpet.ImageRenderer{terminalpet.NewImageRenderer(terminalpet.ImageSupport{Protocol: terminalpet.ImageProtocolKitty})}
-	m.pendingImages = []zeroruntime.ImageBlock{previewImageBlock(t)}
-	m.pendingImageLabels = []string{"diagram.png"}
-	m.refreshPendingImageThumbnail()
-	_ = m.View()
-	var first bytes.Buffer
-	if err := m.attachmentRenderers[0].Render(&first); err != nil {
-		t.Fatal(err)
-	}
-
-	m.pendingImages = nil
-	m.pendingImageLabels = nil
-	m.pendingImageThumbnails = nil
-	_ = m.View()
-	var cleared bytes.Buffer
-	if err := m.attachmentRenderers[0].Render(&cleared); err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(cleared.String(), "a=d,d=I,i=49376") {
-		t.Fatalf("clearing pending image should delete its Kitty placement, got %q", cleared.String())
-	}
-}
-
-func TestPetOutputCompositesAttachmentAndPetInOneFrame(t *testing.T) {
-	animation, err := terminalpet.ThumbnailAnimation(image.NewNRGBA(image.Rect(0, 0, 2, 2)))
-	if err != nil {
-		t.Fatal(err)
-	}
-	pet := terminalpet.NewImageRenderer(terminalpet.ImageSupport{Protocol: terminalpet.ImageProtocolKitty})
-	attachment := terminalpet.NewImageRenderer(terminalpet.ImageSupport{Protocol: terminalpet.ImageProtocolKitty})
-	pet.Set(&terminalpet.ImageDraw{ID: petAmbientImageID, Animation: animation, State: terminalpet.Idle, Columns: 4, Rows: 3})
-	attachment.Set(&terminalpet.ImageDraw{ID: attachmentImageID, Animation: animation, State: terminalpet.Idle, Columns: 10, Rows: 4})
-	sink, err := os.CreateTemp(t.TempDir(), "image-output-*")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = sink.Close() })
-	if _, err := newPetImageOutput(sink, pet, attachment).Write([]byte(terminalSyncStart + "frame" + terminalSyncEnd)); err != nil {
-		t.Fatal(err)
-	}
-	data, err := os.ReadFile(sink.Name())
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := string(data)
-	if strings.Count(got, terminalSyncStart) != 1 || strings.Count(got, terminalSyncEnd) != 1 {
-		t.Fatalf("graphics should share Bubble Tea's synchronized frame: %q", got)
-	}
-	for _, id := range []string{"i=49374", "i=49376"} {
-		if !strings.Contains(got, id) {
-			t.Fatalf("missing image placement %s: %q", id, got)
-		}
-	}
-}
@@ -136,7 +136,6 @@ func (m model) handleBTWCommand(question string) (model, tea.Cmd) {
 	if question == "" {
 		side.pendingImages = nil
 		side.pendingImageLabels = nil
-		side.pendingImageThumbnails = nil
 		side.pendingDocuments = nil
 	}
 	side.loops = nil
@@ -107,6 +107,7 @@ func (m model) routePaste(content string) (tea.Model, tea.Cmd) {
 			return m, nil
 		}
 		m.picker.appendQuery([]rune(sanitizeComposerInput(content)))
+		m.previewSelectedTheme()
 		if m.picker.kind == pickerPet {
 			return m.schedulePetPreview()
 		}
@@ -121,59 +121,3 @@ func TestToolResultRowExposesClickToggle(t *testing.T) {
 		t.Fatalf("tool result visible body/footer must stay selectable, got %#v", selectable)
 	}
 }
-
-func TestAlwaysExpandedToolResultHeaderIsNotToggleable(t *testing.T) {
-	m := transcriptViewTestModel()
-	for _, tool := range []string{"edit_file", "apply_patch", "write_file"} {
-		row := transcriptRow{
-			kind:   rowToolResult,
-			id:     "diff",
-			tool:   tool,
-			status: tools.StatusOK,
-			detail: "--- a/example.go\n+++ b/example.go\n@@ -1 +1 @@\n-old\n+new",
-		}
-		_, selectable := m.renderSelectableToolResultRow(0, row, m.width, buildRowContext(nil), 0)
-		if len(selectable) == 0 {
-			t.Fatalf("%s: expected a visible diff result row", tool)
-		}
-		if selectable[0].toggle {
-			t.Fatalf("%s header must not advertise a collapse toggle: %#v", tool, selectable[0])
-		}
-	}
-}
-
-func TestToolResultOutputCannotCreateToggle(t *testing.T) {
-	m := transcriptViewTestModel()
-	row := transcriptRow{
-		kind:   rowToolResult,
-		id:     "custom",
-		tool:   "custom_tool",
-		status: tools.StatusOK,
-		detail: "the file literally says: click to expand",
-	}
-	_, selectable := m.renderSelectableToolResultRow(0, row, m.width, buildRowContext(nil), 0)
-	if len(selectable) == 0 {
-		t.Fatal("expected a visible tool result row")
-	}
-	if selectable[0].toggle {
-		t.Fatalf("tool-output text must not create a header toggle: %#v", selectable[0])
-	}
-}
-
-func TestCollapsedExploreToolResultHeaderIsToggleable(t *testing.T) {
-	m := transcriptViewTestModel()
-	row := transcriptRow{
-		kind:   rowToolResult,
-		id:     "read",
-		tool:   "read_file",
-		status: tools.StatusOK,
-		detail: numberedLines(cardBodyMaxLines + 5),
-	}
-	_, selectable := m.renderSelectableToolResultRow(0, row, m.width, buildRowContext(nil), 0)
-	if len(selectable) == 0 {
-		t.Fatal("expected a visible explore result row")
-	}
-	if !selectable[0].toggle {
-		t.Fatalf("collapsed explore card header must remain toggleable: %#v", selectable[0])
-	}
-}
@@ -15,7 +15,6 @@ import (
 	"github.com/Gitlawb/zero/internal/doctor"
 	"github.com/Gitlawb/zero/internal/modelregistry"
 	"github.com/Gitlawb/zero/internal/oauth"
-	"github.com/Gitlawb/zero/internal/providercatalog"
 	"github.com/Gitlawb/zero/internal/providermodelcatalog"
 	"github.com/Gitlawb/zero/internal/providers"
 	"github.com/Gitlawb/zero/internal/redaction"
@@ -732,16 +731,14 @@ func (m model) resolveModelSwitchTarget(registry modelregistry.Registry, args st
 		}, true
 	}
 	if provider, ok := m.activeProviderDescriptor(); ok {
-		for _, candidate := range providerModelSwitchCandidates(provider.ID, args) {
-			for _, model := range m.modelPickerLiveByProvider[provider.ID] {
-				if strings.EqualFold(model.ID, candidate) {
-					return modelSwitchTarget{modelID: model.ID}, true
-				}
+		for _, model := range m.modelPickerLiveByProvider[provider.ID] {
+			if strings.EqualFold(model.ID, strings.TrimSpace(args)) {
+				return modelSwitchTarget{modelID: model.ID}, true
 			}
-			for _, model := range providermodelcatalog.Models(provider) {
-				if strings.EqualFold(model.ID, candidate) {
-					return modelSwitchTarget{modelID: model.ID}, true
-				}
+		}
+		for _, model := range providermodelcatalog.Models(provider) {
+			if strings.EqualFold(model.ID, strings.TrimSpace(args)) {
+				return modelSwitchTarget{modelID: model.ID}, true
 			}
 		}
 		if genericProviderCatalogID(provider.ID) && strings.TrimSpace(args) != "" {
@@ -751,24 +748,6 @@ func (m model) resolveModelSwitchTarget(registry modelregistry.Registry, args st
 	return modelSwitchTarget{}, false
 }

-// providerModelSwitchCandidates preserves provider-owned model IDs while
-// accepting the models.dev OpenAI namespace for ChatGPT subscription models.
-// The ChatGPT backend itself publishes bare model IDs (for example,
-// "gpt-5.6-sol"); gateway providers may legitimately require "openai/..."
-// as part of their model ID, so the alias is deliberately provider-specific.
-func providerModelSwitchCandidates(providerID string, input string) []string {
-	requested := strings.TrimSpace(input)
-	candidates := []string{requested}
-	const openAIPrefix = "openai/"
-	if providercatalog.NormalizeID(providerID) != "chatgpt" || len(requested) <= len(openAIPrefix) || !strings.EqualFold(requested[:len(openAIPrefix)], openAIPrefix) {
-		return candidates
-	}
-	if bare := strings.TrimSpace(requested[len(openAIPrefix):]); bare != "" {
-		candidates = append(candidates, bare)
-	}
-	return candidates
-}
-
 func (m model) requestCompactionBeforeModelSwitch(request modelSwitchCompactionRequest, title string) (model, string, bool) {
 	if modelSwitchCompactionGuard == nil {
 		return m, "", false
@@ -269,7 +269,10 @@ func (m model) composerPositionAtMouse(msg tea.MouseMsg) (int, bool) {
 	if width < 8 {
 		return m.composerPositionAtVisualCell(localX, localY, width)
 	}
-	contentY := localY - 1 - m.attachmentComposerPrefixRows(width)
+	contentY := localY - 1
+	if renderAttachmentChips(m.pendingImageLabels, m.pendingDocuments) != "" {
+		contentY--
+	}
 	if contentY < 0 {
 		return 0, false
 	}
@@ -61,7 +61,6 @@ type dictationController struct {
 	browseVariants []dictation.ModelVariant

 	// in-flight session state
-	sessionID   int64
 	streaming   bool
 	recorder    Recorder
 	transcriber Transcriber
@@ -102,17 +101,13 @@ type dictationController struct {
 }

 // dictationStartedMsg reports the outcome of Recorder.Start().
-// sessionID must match the dictation controller's current session so a late
-// start result after cancel/reset cannot reset a newer recording.
 type dictationStartedMsg struct {
-	sessionID int64
-	err       error
+	err error
 }

 // dictationTranscribedMsg carries the final transcript of a batch (or a
 // completed streaming) recording.
 type dictationTranscribedMsg struct {
-	sessionID int64
 	text      string
 	err       error
 	submit    bool
@@ -130,7 +125,6 @@ func newDictationController(opts Options) dictationController {
 		platform:       dictation.DetectPlatform(),
 		downloadRoot:   opts.STTDownloadRoot,
 		userConfigPath: opts.UserConfigPath,
-		sessionID:      1,
 	}
 }

@@ -201,13 +195,13 @@ func (m model) toggleVoiceMode() (model, tea.Cmd) {
 	}
 	m.dictation.voiceModeEnabled = !m.dictation.voiceModeEnabled
 	if m.dictation.voiceModeEnabled {
-		return m.showTransientNoticeInline("Voice mode on — hold Space to dictate; run /voice again to turn it off.", transientNoticeSuccess), nil
+		return m.appendSystemNotice("Voice mode on (" + m.dictation.currentModelLabel() + ") — hold Space to dictate, release to transcribe. Run /voice again to turn it off (so Space types normally)."), nil
 	}
 	// Turning voice off is the "done dictating" signal, so release the warm sherpa
 	// streaming server — otherwise a loaded model keeps idling in RAM (and holding
 	// its port) until the app exits. It respawns lazily on the next streaming
 	// recording. Skip while a recording is still in flight so we don't kill it.
-	next := m.showTransientNoticeInline("Voice mode off.", transientNoticeInfo)
+	next := m.appendSystemNotice("Voice mode off.")
 	if next.dictation.active() {
 		return next, nil
 	}
@@ -268,7 +262,7 @@ func (m model) startDictation() (model, tea.Cmd) {
 	if streaming {
 		return m.startStreamingDictation()
 	}
-	return m, startBatchRecordingCmd(m.dictation.sessionID, rec)
+	return m, startBatchRecordingCmd(rec)
 }

 // stopDictation ends a recording. For batch it triggers Stop()+Transcribe(); for
@@ -282,7 +276,7 @@ func (m model) stopDictation() (model, tea.Cmd) {
 		}
 		return m, nil // final text arrives via the streaming command already running
 	}
-	return m, transcribeBatchCmd(m.dictation.sessionID, m.dictation.ctx, m.dictation.recorder, m.dictation.transcriber, m.dictation.cfg.AutoSubmitEnabled())
+	return m, transcribeBatchCmd(m.dictation.ctx, m.dictation.recorder, m.dictation.transcriber, m.dictation.cfg.AutoSubmitEnabled())
 }

 // cancelDictation aborts an in-flight recording without transcribing. Bound to
@@ -299,7 +293,7 @@ func (m model) cancelDictation() (model, tea.Cmd) {
 	}
 	m = m.discardDictationRegion()
 	m.dictation.reset()
-	return m.showTransientNoticeInline("Dictation cancelled.", transientNoticeInfo), nil
+	return m.appendSystemNotice("Dictation cancelled."), nil
 }

 // wantStreaming decides whether this recording uses the streaming pipeline:
@@ -317,7 +311,6 @@ func (d dictationController) maxDuration() time.Duration {
 }

 func (d *dictationController) reset() {
-	d.sessionID++
 	d.phase = dictIdle
 	d.recorder = nil
 	d.transcriber = nil
@@ -333,36 +326,31 @@ func (d *dictationController) reset() {

 // startBatchRecordingCmd starts the record-to-file capture off the UI goroutine
 // (Start spawns a subprocess and may briefly block or fail on a missing tool).
-func startBatchRecordingCmd(sessionID int64, rec Recorder) tea.Cmd {
+func startBatchRecordingCmd(rec Recorder) tea.Cmd {
 	return func() tea.Msg {
-		return dictationStartedMsg{sessionID: sessionID, err: rec.Start()}
+		return dictationStartedMsg{err: rec.Start()}
 	}
 }

 // transcribeBatchCmd stops the recording, transcribes the audio, and reports the
 // final text. Runs off the UI goroutine — Stop waits on the capture tool and
 // Transcribe does a network round-trip or a local exec.
-func transcribeBatchCmd(sessionID int64, ctx context.Context, rec Recorder, transcriber Transcriber, submit bool) tea.Cmd {
+func transcribeBatchCmd(ctx context.Context, rec Recorder, transcriber Transcriber, submit bool) tea.Cmd {
 	if ctx == nil {
 		ctx = context.Background()
 	}
 	return func() tea.Msg {
 		audio, err := rec.Stop()
 		if err != nil {
-			return dictationTranscribedMsg{sessionID: sessionID, err: err}
+			return dictationTranscribedMsg{err: err}
 		}
 		text, err := transcriber.Transcribe(ctx, audio)
-		return dictationTranscribedMsg{sessionID: sessionID, text: text, err: err, submit: submit}
+		return dictationTranscribedMsg{text: text, err: err, submit: submit}
 	}
 }

 // handleDictationStarted transitions to recording (or reports a start failure).
 func (m model) handleDictationStarted(msg dictationStartedMsg) (model, tea.Cmd) {
-	if msg.sessionID != m.dictation.sessionID {
-		// Stale startup from a cancelled session must not reset or re-arm a
-		// newer recording that already owns the controller.
-		return m, nil
-	}
 	if msg.err != nil {
 		m = m.discardDictationRegion()
 		m.dictation.reset()
@@ -387,9 +375,6 @@ func (m model) handleDictationStarted(msg dictationStartedMsg) (model, tea.Cmd)
 // handleDictationTranscribed inserts the final transcript into the composer (or
 // submits it when stt.autoSubmit is on), then returns to idle.
 func (m model) handleDictationTranscribed(msg dictationTranscribedMsg) (tea.Model, tea.Cmd) {
-	if msg.sessionID != m.dictation.sessionID {
-		return m, nil
-	}
 	streaming := m.dictation.streaming || msg.streaming
 	m = m.commitDictationRegion()
 	// A streaming session can end via a transcriber error (not just a user stop), so
@@ -407,17 +392,7 @@ func (m model) handleDictationTranscribed(msg dictationTranscribedMsg) (tea.Mode
 	}
 	m.dictation.reset()

-	if errors.Is(msg.err, context.Canceled) {
-		// cancelDictation already discarded the live region, reset the
-		// session, and posted "Dictation cancelled." A streaming transcriber
-		// can still race a buffered event past that cancel and report back a
-		// nonempty compose()+context.Canceled; treat that as terminal here,
-		// before the auto-submit branch below, so Esc can never fall through
-		// to msg.submit and fire the composer's restored pre-existing text.
-		return m, nil
-	}
-
-	if msg.err != nil {
+	if msg.err != nil && !errors.Is(msg.err, context.Canceled) {
 		// A cloud auth failure (missing/invalid key) is fixable in place: reopen the
 		// API-key prompt for the current provider so the user can paste a key and
 		// retry, instead of hitting a dead-end "run zero auth" line.
@@ -438,7 +413,7 @@ func (m model) handleDictationTranscribed(msg dictationTranscribedMsg) (tea.Mode
 		if streaming {
 			return m, nil // streaming already rendered live; nothing to add
 		}
-		return m.showTransientNoticeInline("No speech detected.", transientNoticeInfo), nil
+		return m.appendSystemNotice("No speech detected."), nil
 	}
 	if !streaming {
 		m = m.insertDictatedText(msg.text)