fix(tui): keep long shells alive, and attach a dropped image

A foreground command that outlives its wait moves to the background with
the output so far and a task id. It is not killed for running long. Jobs
lists only real background shells, and the card names the command instead
of a Ctrl+B hint. The model is pointed at tool_search and task_shell_wait,
because Bash is hidden.

A paste or leading drop of an existing image path attaches it. read and
read_media can open that exact attached file outside the workspace, and an
oversized screenshot is downscaled. codewhale doctor names the environment
variable that holds a key, never the value, and a live probe decides the
verdict.

Validation: direct rerun of the lane-1 test binary, 13 passed and 0 failed
(lowercase bash description and detach, foreground move-to-background,
origin identity, doctor_verdict_tests). A broader filter of image_attach,
shell, history, jobs and doctor tests was green before a 60-second
work-surface test was still running when the watch ended. Conformance
goldens re-recorded for the changed tool descriptions. cargo fmt clean on
the lane files. clippy -D warnings not run for this slice.

crates/tui/src/config.rs

@@ -11492,21 +11492,35 @@ pub fn active_provider_has_config_api_key(config: &Config) -> bool {
 
 #[must_use]
 pub fn active_provider_has_env_api_key(config: &Config) -> bool {
-    let Ok(identity) = config.active_provider_identity() else {
-        return false;
-    };
+    active_provider_env_api_key_source(config).is_some()
+}
+
+/// Where the active provider's environment key comes from, in the resolver's
+/// env precedence (`credential_resolve` steps 2-4): `--api-key`, the route's
+/// `api_key_env` variable, or the provider's own ambient variable. Returns the
+/// place's name only; any value read to test presence is dropped here.
+#[must_use]
+pub(crate) fn active_provider_env_api_key_source(config: &Config) -> Option<String> {
+    let identity = config.active_provider_identity().ok()?;
     let provider = identity.provider;
     if provider == ProviderKind::OpenaiCodex && !config.provider_uses_custom_endpoint(&identity) {
-        return false;
+        return None;
     }
     if auth_mode_disables_api_key(config.auth_mode_for_provider(&identity).as_deref()) {
-        return false;
+        return None;
     }
-    (!provider_uses_oauth_credentials(config, &identity)
-        && explicit_cli_api_key_override().is_some())
-        || provider_config_env_api_key(config, &identity).is_some()
-        || (!config.should_skip_secret_store_for_provider(&identity)
-            && provider_env_api_key(provider).is_some())
+    if !provider_uses_oauth_credentials(config, &identity)
+        && explicit_cli_api_key_override().is_some()
+    {
+        return Some("--api-key".to_string());
+    }
+    if provider_config_env_api_key(config, &identity).is_some() {
+        return bound_provider_api_key_env_name(config, &identity);
+    }
+    if config.should_skip_secret_store_for_provider(&identity) {
+        return None;
+    }
+    provider_env_api_key_named(provider).map(|(name, _)| name.to_string())
 }
 
 #[must_use]
@@ -12259,8 +12273,10 @@ fn provider_config_table_name(identity: &ProviderIdentity) -> Result<String> {
     Ok(format!("providers.{}", provider_config_key(identity)?))
 }
 
-fn provider_env_api_key(provider: ProviderKind) -> Option<String> {
-    provider_env_api_key_named(provider).map(|(_, value)| value)
+/// Name of the ambient provider variable that currently holds a non-empty key
+/// for `provider`. Presence only: the value is dropped here.
+pub(crate) fn provider_env_api_key_var(provider: ProviderKind) -> Option<&'static str> {
+    provider_env_api_key_named(provider).map(|(name, _)| name)
 }
 
 /// The provider's ambient env key and the variable that supplied it,

crates/tui/src/image_attach.rs

@@ -51,7 +51,7 @@ use image::codecs::png::{CompressionType, FilterType as PngFilter, PngEncoder};
 use image::imageops::FilterType;
 use image::{DynamicImage, ExtendedColorType, GenericImageView, ImageEncoder, ImageReader, Limits};
 use std::io::Cursor;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use base64::{Engine as _, engine::general_purpose::STANDARD};
 
@@ -296,6 +296,26 @@ pub struct PreparedToolImage {
 #[must_use]
 pub fn prepare_tool_image_bytes(bytes: &[u8], mime_type: &str) -> PreparedToolImage {
     let mime_type = mime_type.split(';').next().unwrap_or(mime_type).trim();
+    // A Retina screenshot is routinely over the inline limit as PNG. Fit it
+    // on the attach-time ladder instead of omitting it, so `read` on a
+    // screenshot behaves like dropping the same file into the composer.
+    if bytes.len() > MAX_IMAGE_BYTES
+        && sniff_media_type(bytes) == Some(mime_type)
+        && let Ok(fitted) = fit_image_bytes(bytes, Path::new("image"))
+        && let Some((fitted_mime, payload)) = parse_data_url(&fitted.data_url)
+    {
+        return PreparedToolImage {
+            block: Some(codewhale_tools::ToolResultContentBlock::Image {
+                mime_type: fitted_mime.to_string(),
+                data: payload.to_string(),
+            }),
+            note: format!(
+                "Read image file [{mime_type}] (downscaled from {} to a {} {fitted_mime} to fit the inline image limit)",
+                human_bytes(bytes.len()),
+                human_bytes(fitted.source_bytes),
+            ),
+        };
+    }
     let valid = bytes.len() <= MAX_IMAGE_BYTES
         && sniff_media_type(bytes) == Some(mime_type)
         && decode_and_guard_image(bytes).is_ok();
@@ -573,29 +593,243 @@ pub fn attach_image_from_path(path: &Path) -> Result<AttachedImage, ImageAttachE
             limit: source_limit,
         });
     }
-    let oversized_edge = ImageReader::new(Cursor::new(&bytes))
+    fit_image_bytes(&bytes, path)
+}
+
+/// The size/edge policy of [`attach_image_from_path`] over bytes already in
+/// memory, shared with the `read` tool so both deliver the same image.
+fn fit_image_bytes(bytes: &[u8], path: &Path) -> Result<AttachedImage, ImageAttachError> {
+    let display = path.display().to_string();
+    let oversized_edge = ImageReader::new(Cursor::new(bytes))
         .with_guessed_format()
         .ok()
         .and_then(|reader| reader.into_dimensions().ok())
         .is_some_and(|(width, height)| width.max(height) > ATTACH_MAX_EDGE_PX);
     if bytes.len() <= MAX_IMAGE_BYTES && !oversized_edge {
-        return encode_image_bytes(&bytes, &display);
+        return encode_image_bytes(bytes, &display);
     }
-    if sniff_media_type(&bytes).is_none() {
-        return Err(format_error(&bytes, &display));
+    if sniff_media_type(bytes).is_none() {
+        return Err(format_error(bytes, &display));
     }
     let unreadable = |reason: String| ImageAttachError::Unreadable {
         path: display.clone(),
         reason,
     };
     let (image, _, _) =
-        decode_and_guard_image(&bytes).map_err(|error| unreadable(error.to_string()))?;
+        decode_and_guard_image(bytes).map_err(|error| unreadable(error.to_string()))?;
     let (encoded, _) =
         crate::tools::read_media::fit_and_encode(&image, ATTACH_MAX_EDGE_PX, MAX_IMAGE_BYTES, path)
             .map_err(|error| unreadable(error.to_string()))?;
     encode_image_bytes(&encoded, &display)
 }
 
+/// Upper bound on a paste considered as a list of dropped file paths.
+const MAX_PASTED_PATHS_BYTES: usize = 16 * 1024;
+
+/// The local image files a pasted string names, or `None` when the paste is
+/// anything else and belongs in the composer as text.
+///
+/// Terminals deliver a drag-and-drop as a paste of the file's path, in
+/// whatever spelling the terminal prefers: Terminal.app and iTerm2
+/// shell-escape (`/var/folders/…/Screenshot\ 2026-10-04\ at\ 22.25.47.png`),
+/// others quote, some hand over a `file://` URL, and several files arrive as
+/// one space-separated line. Without this, that path reached the model as
+/// prose and the model had no way to look at the picture.
+///
+/// The paste converts only when *every* path in it is absolute and names an
+/// existing file whose bytes are PNG, JPEG, GIF or WebP, so a sentence that
+/// merely mentions a path, a relative name, or a pasted non-image stays text.
+///
+/// Known limits: a path typed or pasted inside prose is not converted (the
+/// drop is the gesture, not the mention); on Windows a paste is read as one
+/// path verbatim, without shell unescaping.
+#[must_use]
+pub fn pasted_image_paths(text: &str) -> Option<Vec<PathBuf>> {
+    pasted_paths_matching(text, |path| sniff_image_file(path).is_some())
+}
+
+/// A local image path leading a submitted message, and the text after it.
+///
+/// The paste-time check ([`pasted_image_paths`]) only sees a paste that is
+/// nothing but paths. A drop can still reach the composer as typed keys, or
+/// be followed by the question on the same line before Enter. So at submit a
+/// message that *starts* with an existing image path (escaped, quoted, a
+/// `file://` URL, or unescaped with spaces) attaches it and keeps the rest as
+/// the prompt — the same rule Hermes Agent's `_detect_file_drop` applies.
+#[must_use]
+pub fn leading_dropped_image(text: &str) -> Option<(PathBuf, String)> {
+    leading_path_matching(text, |path| sniff_image_file(path).is_some())
+}
+
+fn leading_path_matching(
+    text: &str,
+    is_image: impl Fn(&Path) -> bool,
+) -> Option<(PathBuf, String)> {
+    let text = text.trim_start();
+    let (line, after) = text.split_once('\n').unwrap_or((text, ""));
+    let line = line.trim_end();
+    if line.is_empty() || line.len() > MAX_PASTED_PATHS_BYTES {
+        return None;
+    }
+    let bare = line.trim_start_matches(['"', '\'']);
+    if !(bare.starts_with('/') || bare.starts_with("file://") || Path::new(bare).is_absolute()) {
+        return None;
+    }
+    let accept = |raw: &str, unescape: bool| {
+        let path = pasted_path(raw, unescape);
+        (path.is_absolute() && is_image(&path)).then_some(path)
+    };
+    let found = (|| {
+        // A quoted path ends at its closing quote.
+        if let Some(quote) = line.chars().next().filter(|c| *c == '"' || *c == '\'')
+            && let Some(end) = line[1..].find(quote)
+        {
+            let end = end + 2;
+            return accept(&line[..end], false).map(|path| (path, end));
+        }
+        // A shell-escaped path ends at its first unescaped space.
+        let mut escaped = false;
+        let token_end = line
+            .char_indices()
+            .find(|&(_, ch)| {
+                let stop = ch == ' ' && !escaped;
+                escaped = ch == '\\' && !escaped;
+                stop
+            })
+            .map_or(line.len(), |(index, _)| index);
+        if let Some(path) = accept(&line[..token_end], true) {
+            return Some((path, token_end));
+        }
+        // An unescaped path with spaces: the longest prefix that is a file.
+        let mut cuts: Vec<usize> = line.match_indices(' ').map(|(index, _)| index).collect();
+        cuts.push(line.len());
+        cuts.into_iter()
+            .rev()
+            .filter(|&cut| cut > token_end)
+            .find_map(|cut| accept(&line[..cut], false).map(|path| (path, cut)))
+    })()?;
+    let (path, end) = found;
+    let rest = format!("{}\n{after}", &line[end..]);
+    Some((path, rest.trim().to_string()))
+}
+
+fn pasted_paths_matching(text: &str, is_image: impl Fn(&Path) -> bool) -> Option<Vec<PathBuf>> {
+    let text = text.trim();
+    if text.is_empty() || text.len() > MAX_PASTED_PATHS_BYTES {
+        return None;
+    }
+    let accept = |path: PathBuf| (path.is_absolute() && is_image(&path)).then_some(path);
+    // The whole paste as one path first: a dropped file whose name has
+    // spaces is one path even when the terminal did not escape it.
+    if let Some(path) = accept(pasted_path(text, true)) {
+        return Some(vec![path]);
+    }
+    if cfg!(windows) {
+        return None;
+    }
+    // Several dropped files: shlex has already removed quotes and escapes.
+    let paths = shlex::split(text)?
+        .iter()
+        .map(|token| accept(pasted_path(token, false)))
+        .collect::<Option<Vec<_>>>()?;
+    (!paths.is_empty()).then_some(paths)
+}
+
+/// One pasted path spelling (quoted, shell-escaped, or a `file://` URL) as
+/// a filesystem path. `unescape` is false for a token shlex already split.
+fn pasted_path(raw: &str, unescape: bool) -> PathBuf {
+    let unquoted = ['"', '\'']
+        .iter()
+        .find_map(|quote| {
+            raw.strip_prefix(*quote)
+                .and_then(|rest| rest.strip_suffix(*quote))
+        })
+        .unwrap_or(raw);
+    if let Ok(url) = url::Url::parse(unquoted)
+        && url.scheme() == "file"
+        && let Ok(path) = url.to_file_path()
+    {
+        return path;
+    }
+    if cfg!(windows) || !unescape {
+        return PathBuf::from(unquoted);
+    }
+    let mut unescaped = String::with_capacity(unquoted.len());
+    let mut chars = unquoted.chars();
+    while let Some(ch) = chars.next() {
+        if ch == '\\'
+            && let Some(next) = chars.next()
+        {
+            unescaped.push(next);
+        } else {
+            unescaped.push(ch);
+        }
+    }
+    PathBuf::from(unescaped)
+}
+
+/// The accepted image format of a regular file, judged by its leading bytes.
+fn sniff_image_file(path: &Path) -> Option<&'static str> {
+    use std::io::Read as _;
+    // stat before open: opening a FIFO (or other special file) a paste named
+    // blocks until a writer appears, which would freeze the composer.
+    if !std::fs::metadata(path).ok()?.is_file() {
+        return None;
+    }
+    let file = std::fs::File::open(path).ok()?;
+    if !file.metadata().ok()?.is_file() {
+        return None;
+    }
+    let mut head = Vec::with_capacity(16);
+    file.take(16).read_to_end(&mut head).ok()?;
+    sniff_media_type(&head)
+}
+
+/// Paths of the images the user attached in this session's own prompts.
+///
+/// Reads only `[Attached image: …]` lines in user-role text — the logged
+/// record of what the user put in the composer — and never tool output or
+/// model text, so a tool result cannot widen what a read may open. Pure
+/// string work; [`resolve_user_attached_image`] does the filesystem half.
+#[must_use]
+pub fn user_attached_image_references(messages: &[codewhale_models::Message]) -> Vec<String> {
+    messages
+        .iter()
+        .filter(|message| message.role == codewhale_models::Role::User)
+        .flat_map(|message| &message.content)
+        .filter_map(|block| match block {
+            ContentBlock::Text { text, .. } => Some(text.as_str()),
+            _ => None,
+        })
+        .flat_map(codewhale_core::media_attachment_references)
+        .filter(|reference| reference.kind == "image")
+        .map(|reference| reference.path)
+        .collect()
+}
+
+/// Admit `raw` for a read-only image tool when it is exactly a file the user
+/// attached (see [`user_attached_image_references`]).
+///
+/// The workspace boundary keeps the model from wandering the disk; a
+/// screenshot the user dropped into the composer from a temp directory is not
+/// wandering, and refusing it is what sent a model to OCR and computer-use
+/// screenshots instead of looking. Admission stays narrow: the exact file
+/// (compared after canonicalization, so `/var` and `/private/var` agree), not
+/// its directory, and only while its bytes are an accepted image format.
+/// Callers still apply the credential and read deny-list checks.
+#[must_use]
+pub fn resolve_user_attached_image(references: &[String], raw: &str) -> Option<PathBuf> {
+    let requested = Path::new(raw);
+    if !requested.is_absolute() {
+        return None;
+    }
+    let requested = std::fs::canonicalize(requested).ok()?;
+    let attached = references
+        .iter()
+        .any(|reference| std::fs::canonicalize(reference).is_ok_and(|path| path == requested));
+    (attached && sniff_image_file(&requested).is_some()).then_some(requested)
+}
+
 /// Image blocks sent from the latest user prompt onward: this turn's
 /// attachments and tool-result images, not ones replayed from history.
 #[must_use]

crates/tui/src/image_attach/tests.rs

@@ -881,3 +881,208 @@ fn only_images_since_the_latest_prompt_count_as_this_turns() {
     ];
     assert_eq!(images_since_last_user_prompt(&fresh), 2);
 }
+
+/// The founder's failing drop: a macOS screencaptureui temp file whose name
+/// has spaces, delivered as a shell-escaped path.
+fn dropped_screenshot(dir: &std::path::Path) -> std::path::PathBuf {
+    write_png(dir, "Screenshot 2026-10-04 at 22.25.47.png")
+}
+
+#[cfg(not(windows))]
+#[test]
+fn a_dropped_path_in_every_terminal_spelling_is_an_image() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dropped_screenshot(dir.path());
+    let plain = shot.display().to_string();
+    let escaped = plain.replace(' ', "\\ ");
+    let file_url = url::Url::from_file_path(&shot)
+        .expect("file url")
+        .to_string();
+    assert!(file_url.contains("%20"), "{file_url}");
+
+    for spelling in [
+        escaped.clone(),
+        plain.clone(),
+        format!("\"{plain}\""),
+        format!("'{plain}'"),
+        file_url,
+        format!("  {escaped}\n"),
+    ] {
+        assert_eq!(
+            pasted_image_paths(&spelling),
+            Some(vec![shot.clone()]),
+            "{spelling}"
+        );
+    }
+}
+
+#[cfg(not(windows))]
+#[test]
+fn several_dropped_images_attach_in_order() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dropped_screenshot(dir.path());
+    let second = write_png(dir.path(), "second.png");
+    let text = format!(
+        "{} {}",
+        shot.display().to_string().replace(' ', "\\ "),
+        second.display()
+    );
+    assert_eq!(pasted_image_paths(&text), Some(vec![shot, second]));
+}
+
+#[test]
+fn a_paste_that_is_not_only_image_paths_stays_text() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dropped_screenshot(dir.path());
+    let notes = dir.path().join("notes.txt");
+    std::fs::write(&notes, "hello").expect("write notes");
+    let escaped = shot.display().to_string().replace(' ', "\\ ");
+
+    for text in [
+        format!("look at {escaped}"),
+        "shot.png".to_string(),
+        notes.display().to_string(),
+        dir.path().join("missing.png").display().to_string(),
+        format!("{escaped} {}", notes.display()),
+        String::new(),
+    ] {
+        assert_eq!(pasted_image_paths(&text), None, "{text}");
+    }
+}
+
+#[cfg(not(windows))]
+#[test]
+fn a_dropped_screenshot_becomes_an_image_part_or_a_text_only_notice() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dropped_screenshot(dir.path());
+    let paths = pasted_image_paths(&shot.display().to_string().replace(' ', "\\ "))
+        .expect("dropped path is an image");
+    let text = format!(
+        "what is wrong here?\n[Attached image: {}]",
+        paths[0].display()
+    );
+
+    let expanded = expand_attachment_blocks(&text);
+    assert!(expanded.notices.is_empty(), "{expanded:?}");
+    let mut messages = vec![codewhale_models::Message {
+        role: Role::User,
+        content: expanded.blocks,
+    }];
+    assert!(
+        messages[0]
+            .content
+            .iter()
+            .any(|block| matches!(block, ContentBlock::ImageUrl { image_url } if image_url.url.starts_with("data:image/png;base64,"))),
+        "a vision route receives the image itself"
+    );
+
+    let stripped =
+        strip_images_when_unsupported(&mut messages, SupportState::Unsupported, "text-only-model");
+    assert_eq!(stripped, 1);
+    assert!(messages[0].content.iter().any(|block| matches!(
+        block,
+        ContentBlock::Text { text, .. } if text.contains("text-only-model") && text.contains("does not accept image input")
+    )));
+}
+
+#[test]
+fn only_an_image_the_user_attached_is_admitted_outside_the_workspace() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dropped_screenshot(dir.path());
+    let other = write_png(dir.path(), "other.png");
+    let text = |text: String| ContentBlock::Text {
+        text,
+        cache_control: None,
+    };
+    let messages = vec![
+        codewhale_models::Message {
+            role: Role::User,
+            content: vec![text(format!("see\n[Attached image: {}]", shot.display()))],
+        },
+        codewhale_models::Message {
+            role: Role::Assistant,
+            content: vec![text(format!("[Attached image: {}]", other.display()))],
+        },
+    ];
+
+    let references = user_attached_image_references(&messages);
+    assert_eq!(references, vec![shot.display().to_string()]);
+    let canonical = std::fs::canonicalize(&shot).expect("canonical");
+    assert_eq!(
+        resolve_user_attached_image(&references, &shot.display().to_string()),
+        Some(canonical)
+    );
+    assert_eq!(
+        resolve_user_attached_image(&references, &other.display().to_string()),
+        None,
+        "model-authored text never widens what a read may open"
+    );
+    assert_eq!(
+        resolve_user_attached_image(&references, "Screenshot.png"),
+        None
+    );
+
+    std::fs::write(&shot, b"no longer an image").expect("overwrite");
+    assert_eq!(
+        resolve_user_attached_image(&references, &shot.display().to_string()),
+        None,
+        "admission requires image bytes, not just an attached name"
+    );
+}
+
+#[test]
+fn read_downscales_an_oversized_screenshot_instead_of_omitting_it() {
+    let png = noise_png(2880, 1800);
+    assert!(png.len() > MAX_IMAGE_BYTES, "fixture must exceed the limit");
+
+    let prepared = prepare_tool_image_bytes(&png, "image/png");
+    let codewhale_tools::ToolResultContentBlock::Image { mime_type, data } = prepared
+        .block
+        .expect("oversized screenshot is still delivered");
+    let bytes = STANDARD.decode(data).expect("base64");
+    assert!(bytes.len() <= MAX_IMAGE_BYTES);
+    assert_eq!(sniff_media_type(&bytes), Some(mime_type.as_str()));
+    assert!(prepared.note.contains("downscaled"), "{}", prepared.note);
+}
+
+#[cfg(not(windows))]
+#[test]
+fn a_message_that_starts_with_a_dropped_image_attaches_it_and_keeps_the_question() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dropped_screenshot(dir.path());
+    let plain = shot.display().to_string();
+    let escaped = plain.replace(' ', "\\ ");
+    let question = "why does it show jobs 2?";
+
+    for message in [
+        format!("{escaped}  {question}"),
+        format!("{plain} {question}"),
+        format!("'{plain}' {question}"),
+        format!("{escaped}\n{question}"),
+    ] {
+        assert_eq!(
+            leading_dropped_image(&message),
+            Some((shot.clone(), question.to_string())),
+            "{message}"
+        );
+    }
+    assert_eq!(leading_dropped_image(&escaped), Some((shot, String::new())));
+}
+
+#[test]
+fn a_message_that_only_mentions_an_image_is_left_alone() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dropped_screenshot(dir.path());
+    let notes = dir.path().join("notes.txt");
+    std::fs::write(&notes, "hello").expect("write notes");
+
+    for message in [
+        format!("look at {}", shot.display()),
+        format!("{} what is this", notes.display()),
+        format!("{} what is this", dir.path().join("missing.png").display()),
+        "/model".to_string(),
+        "shot.png what".to_string(),
+    ] {
+        assert_eq!(leading_dropped_image(&message), None, "{message}");
+    }
+}

crates/tui/src/lib.rs

@@ -4761,14 +4761,42 @@ async fn run_doctor(
             .bold()
     );
     println!("{}", "==================".truecolor(sky_r, sky_g, sky_b));
-    // Verdict first (U7): the answer and the next step, before the detail.
+    // The answer comes before the detail (U7). A requested live probe runs
+    // first so that answer can include it; the probe line is the only thing
+    // printed while that check is in flight.
     let (verdict_state, _) = doctor_setup_state(config, workspace);
     let identity = config.active_provider_identity().ok();
+    let api_target = doctor_api_target(config);
+    let live_api_requested = identity.as_ref().is_some_and(|identity| {
+        doctor_should_probe_api(identity.provider, &api_target.base_url, probes)
+    });
+    // The opt-in live check runs once, before the verdict, so the verdict,
+    // the credential lines and API Connectivity all report the same result.
+    let live_probe = if doctor_should_probe_auth(config) && live_api_requested {
+        println!("{} Testing connection...", "·".dimmed());
+        // Resolve a credential through the diagnostic-only store first, then
+        // probe with an in-memory clone. Constructing the normal client from
+        // the original config could otherwise trigger its legacy secret-store
+        // migration while a user merely asks doctor to test connectivity.
+        Some(match config.with_read_only_api_key_for_diagnostic() {
+            Ok(diagnostic_config) => test_api_connectivity(&diagnostic_config).await,
+            Err(error) => Err(error),
+        })
+    } else {
+        None
+    };
+    // Presence and variable name only; the value is never held here.
+    let env_key_source = crate::config::active_provider_env_api_key_source(config);
     let verdict = doctor_verdict(
         &verdict_state,
         identity
             .as_ref()
             .map_or("unavailable", |identity| identity.key.as_str()),
+        &DoctorVerdictFacts {
+            onboarded: crate::tui::onboarding::is_onboarded(),
+            env_key_source: env_key_source.clone(),
+            live_probe: live_probe.as_ref().map(Result::is_ok),
+        },
     );
     println!("{}", verdict.truecolor(aqua_r, aqua_g, aqua_b).bold());
     println!();
@@ -4942,10 +4970,19 @@ async fn run_doctor(
                     == crate::config::ConfigApiKeyValueKind::Literal
             })
         });
-        let env_source_declared = provider_config
+        let declared_env = provider_config
             .and_then(|entry| entry.api_key_env.as_deref())
-            .is_some_and(|name| !name.trim().is_empty());
-        let icon = if config_declared || env_source_declared {
+            .map(str::trim)
+            .filter(|name| !name.is_empty());
+        let env_source_declared = declared_env.is_some();
+        // Presence only: name the variable that holds a key, never its value.
+        let env_set = declared_env
+            .filter(|name| {
+                std::env::var_os(name)
+                    .is_some_and(|value| !value.to_string_lossy().trim().is_empty())
+            })
+            .or_else(|| crate::config::provider_env_api_key_var(provider));
+        let icon = if config_declared || env_source_declared || env_set.is_some() {
             "·".truecolor(aqua_r, aqua_g, aqua_b)
         } else {
             "·".dimmed()
@@ -4953,10 +4990,10 @@ async fn run_doctor(
         println!(
             "  {} {slot}: env_source={}, config_source={}",
             icon,
-            if env_source_declared {
-                "declared (value not inspected)"
-            } else {
-                "not inspected"
+            match env_set {
+                Some(var) => doctor_env_key_label(var),
+                None if env_source_declared => "declared (value not inspected)".to_string(),
+                None => "not inspected".to_string(),
             },
             if config_declared {
                 "declared (value not inspected)"
@@ -5001,19 +5038,36 @@ async fn run_doctor(
         ApiKeySource::LocalRuntime => "local runtime; credentials not required",
         ApiKeySource::Unknown => "unknown; credential environment and stores not inspected",
     };
-    println!(
-        "  {} active provider credential source: {source_label}",
-        "·".dimmed()
-    );
+    match env_key_source.as_deref() {
+        Some(source) => println!(
+            "  {} active provider credential source: {}",
+            "·".dimmed(),
+            doctor_env_key_label(source)
+        ),
+        None => println!(
+            "  {} active provider credential source: {source_label}",
+            "·".dimmed()
+        ),
+    }
     println!(
         "  · active provider credential availability: {}",
         credential.availability.label()
     );
+    match &live_probe {
+        Some(Ok(())) => println!(
+            "  {} active provider credential: accepted by the live API check",
+            "✓".truecolor(aqua_r, aqua_g, aqua_b)
+        ),
+        Some(Err(_)) => println!(
+            "  {} active provider credential: live API check failed (see API Connectivity)",
+            "✗".truecolor(red_r, red_g, red_b)
+        ),
+        None => {}
+    }
 
     // API connectivity test
     println!();
     println!("{}", "API Connectivity:".bold());
-    let api_target = doctor_api_target(config);
     // Configured-vs-active honesty (DGF-01): doctor describes the route a
     // session launched NOW would resolve. It cannot see inside an already
     // running session, which keeps the route it resolved at its own launch.
@@ -5069,50 +5123,41 @@ async fn run_doctor(
             alias.alias, alias.retirement_date, alias.replacement
         );
     }
-    let live_api_requested = identity.as_ref().is_some_and(|identity| {
-        doctor_should_probe_api(identity.provider, &api_target.base_url, probes)
-    });
     let endpoint_is_local = identity.as_ref().is_some_and(|identity| {
         crate::config::provider_route_is_keyless_self_hosted(
             identity.provider,
             &api_target.base_url,
         ) || crate::config::base_url_uses_local_host(&api_target.base_url)
     });
-    if doctor_should_probe_auth(config) && live_api_requested {
-        print!("  {} Testing connection...", "·".dimmed());
-        use std::io::Write;
-        std::io::stdout().flush().ok();
-
-        // Resolve a credential through the diagnostic-only store first, then
-        // probe with an in-memory clone. Constructing the normal client from
-        // the original config could otherwise trigger its legacy secret-store
-        // migration while a user merely asks doctor to test connectivity.
-        let connectivity_result = match config.with_read_only_api_key_for_diagnostic() {
-            Ok(diagnostic_config) => test_api_connectivity(&diagnostic_config).await,
-            Err(error) => Err(error),
-        };
+    if let Some(connectivity_result) = &live_probe {
         match connectivity_result {
             Ok(()) => {
                 println!(
-                    "\r  {} API connection successful",
+                    "  {} API connection successful",
                     "✓".truecolor(aqua_r, aqua_g, aqua_b)
                 );
             }
             Err(e) => {
                 let error_msg = e.to_string();
                 println!(
-                    "\r  {} API connection failed",
+                    "  {} API connection failed",
                     "✗".truecolor(red_r, red_g, red_b)
                 );
                 let names_status =
                     |status| crate::mcp::oauth::text_names_http_status(&error_msg, status);
+                let provider = identity
+                    .as_ref()
+                    .map(|identity| identity.provider)
+                    .unwrap_or(crate::config::ProviderKind::Deepseek);
                 if names_status("401") || error_msg.contains("Unauthorized") {
                     println!(
-                        "    Invalid API key. Check `codewhale auth status`, DEEPSEEK_API_KEY, or config.toml"
+                        "    Invalid API key. Check `codewhale auth status`, {}, or config.toml",
+                        doctor_provider_key_place(provider)
                     );
                 } else if names_status("403") || error_msg.contains("Forbidden") {
                     println!(
-                        "    API key lacks permissions. Verify key is active at platform.deepseek.com"
+                        "    API key lacks permissions. Verify the {} key is active.",
+                        provider.provider().display_name()
                     );
                 } else if error_msg.contains("timeout") || error_msg.contains("Timeout") {
                     for line in doctor_timeout_recovery_lines(config) {
@@ -5859,29 +5904,97 @@ async fn run_doctor(
     println!("{}", verdict.truecolor(aqua_r, aqua_g, aqua_b).bold());
 }
 
+/// Human-facing facts the verdict uses beyond the setup-state record. None of
+/// these change structural Setup/Fleet readiness (the JSON contract): a set
+/// environment variable is reported, never certified, until a live probe.
+#[derive(Debug, Clone, Default)]
+struct DoctorVerdictFacts {
+    /// The TUI's own first-run receipt (`.onboarded`). TUI onboarding finishes
+    /// after its key gate but never fills the `/setup` wizard's language and
+    /// constitution steps, so `first_run_ready()` alone misreads it.
+    onboarded: bool,
+    /// Name of the env place holding the active provider's key, from
+    /// `config::active_provider_env_api_key_source`; never the value.
+    env_key_source: Option<String>,
+    /// Outcome of the opt-in live API check; `None` when it did not run.
+    live_probe: Option<bool>,
+}
+
+/// `set via <VAR> (value not shown; not checked offline)`.
+fn doctor_env_key_label(source: &str) -> String {
+    format!("set via {source} (value not shown; not checked offline)")
+}
+
+/// Where a rejected key might live, named without reading it. A route that
+/// binds `api_key_env` is named by that variable; otherwise the provider's
+/// first ambient variable.
+fn doctor_provider_key_place(provider: crate::config::ProviderKind) -> String {
+    provider
+        .provider()
+        .env_vars()
+        .first()
+        .copied()
+        .unwrap_or("the provider environment variable")
+        .to_string()
+}
+
 /// Doctor's one-line answer: ready, or the single next step (U7). Readiness
-/// is the setup lane's own verdict; doctor never reads the environment or the
-/// secret store to decide it, so a key saved outside setup shows as an
-/// unverified route (`credential: availability=not_probed`), not a missing one.
-fn doctor_verdict(state: &codewhale_config::SetupState, provider: &str) -> String {
+/// starts from the setup lane's record. Offline doctor never reads the secret
+/// store, so a stored key is "not checked", not missing; "Not ready" is kept
+/// for a missing route, a key nothing can account for, or a failed probe.
+fn doctor_verdict(
+    state: &codewhale_config::SetupState,
+    provider: &str,
+    facts: &DoctorVerdictFacts,
+) -> String {
     use codewhale_config::StepStatus;
+    const PROBE_HINT: &str = "run `codewhale doctor --probe-api` to verify";
+    match facts.live_probe {
+        Some(false) => {
+            return format!(
+                "Not ready: the live {provider} API check failed → see API Connectivity below; `codewhale auth set --provider {provider}` replaces a rejected key."
+            );
+        }
+        Some(true) => return format!("Ready: the live {provider} API check passed."),
+        None => {}
+    }
+    let env_ready = facts.env_key_source.as_deref().map(|source| {
+        format!("Ready: {provider} key is set via {source} (not checked offline; {PROBE_HINT}).")
+    });
     // NeedsAction means a named route exists but its key is missing, unchecked
     // or failed. Configured routes can be used without a prior probe.
     // `first_run_ready` accepts NeedsAction (a failed key still reaches the
     // wizard's ready screen), so check the provider first.
     match state.status(codewhale_config::SetupStep::ProviderModel) {
-        StepStatus::Configured | StepStatus::Verified => {
-            if state.first_run_ready() {
-                "Ready: setup is complete.".to_string()
-            } else {
-                "Not ready: first-run setup is unfinished → run `codewhale setup`.".to_string()
-            }
+        StepStatus::Verified if state.first_run_ready() || facts.onboarded => {
+            "Ready: setup is complete.".to_string()
         }
-        StepStatus::NeedsAction => format!(
-            "Not ready: the {provider} route has no verified key → save one with /provider in Codewhale or `codewhale auth set --provider {provider}`; `codewhale doctor --probe-api` checks a key already saved."
-        ),
-        _ => "Not ready: no model provider set up → run /provider in Codewhale, or `codewhale setup`."
-            .to_string(),
+        StepStatus::Configured | StepStatus::Verified
+            if state.first_run_ready() || facts.onboarded =>
+        {
+            format!("Ready: setup is complete (saved key not checked offline; {PROBE_HINT}).")
+        }
+        StepStatus::Configured | StepStatus::Verified => env_ready.unwrap_or_else(|| {
+            "Not ready: first-run setup is unfinished → run `codewhale setup`.".to_string()
+        }),
+        StepStatus::NeedsAction => env_ready.unwrap_or_else(|| {
+            // A derived NeedsAction only means offline doctor cannot see the
+            // stored key; onboarding already gated on one. A NeedsAction the
+            // setup lane persisted is a real missing or failed key.
+            if state.inherited && facts.onboarded {
+                format!(
+                    "Ready: onboarding is complete (saved {provider} key not checked offline; {PROBE_HINT})."
+                )
+            } else {
+                format!(
+                    "Not ready: the {provider} route has no verified key → save one with /provider in Codewhale or `codewhale auth set --provider {provider}`; `codewhale doctor --probe-api` checks a key already saved."
+                )
+            }
+        }),
+        _ => env_ready.unwrap_or_else(|| {
+            "Not ready: no model provider set up → run /provider in Codewhale, or `codewhale setup`."
+                .to_string()
+        }),
     }
 }
 
@@ -5889,7 +6002,11 @@ fn doctor_verdict(state: &codewhale_config::SetupState, provider: &str) -> Strin
 mod doctor_verdict_tests {
     #[test]
     fn a_fresh_home_is_not_ready_and_names_the_provider_step() {
-        let verdict = super::doctor_verdict(&codewhale_config::SetupState::default(), "deepseek");
+        let verdict = super::doctor_verdict(
+            &codewhale_config::SetupState::default(),
+            "deepseek",
+            &super::DoctorVerdictFacts::default(),
+        );
         assert!(verdict.starts_with("Not ready"), "{verdict}");
         assert!(verdict.contains("/provider"), "{verdict}");
     }
@@ -5905,7 +6022,8 @@ mod doctor_verdict_tests {
             SetupStep::ProviderModel,
             StepEntry::new(StepStatus::NeedsAction, true, "inherited"),
         );
-        let verdict = super::doctor_verdict(&state, "deepseek");
+        let verdict =
+            super::doctor_verdict(&state, "deepseek", &super::DoctorVerdictFacts::default());
         assert!(verdict.starts_with("Not ready"), "{verdict}");
         assert!(!verdict.contains("no model provider"), "{verdict}");
         assert!(
@@ -5932,7 +6050,8 @@ mod doctor_verdict_tests {
         state.runtime_posture_source = RuntimePostureSource::Confirmed;
         state.constitution_choice = ConstitutionChoice::Bundled;
         assert!(state.first_run_ready(), "fixture must be wizard-ready");
-        let verdict = super::doctor_verdict(&state, "deepseek");
+        let verdict =
+            super::doctor_verdict(&state, "deepseek", &super::DoctorVerdictFacts::default());
         assert!(verdict.starts_with("Not ready"), "{verdict}");
         assert!(verdict.contains("/provider"), "{verdict}");
 
@@ -5941,10 +6060,139 @@ mod doctor_verdict_tests {
             StepEntry::new(StepStatus::Verified, true, "0.10.1"),
         );
         assert_eq!(
-            super::doctor_verdict(&state, "deepseek"),
+            super::doctor_verdict(&state, "deepseek", &super::DoctorVerdictFacts::default()),
             "Ready: setup is complete."
         );
     }
+
+    fn facts(
+        onboarded: bool,
+        env_key_source: Option<&str>,
+        live_probe: Option<bool>,
+    ) -> super::DoctorVerdictFacts {
+        super::DoctorVerdictFacts {
+            onboarded,
+            env_key_source: env_key_source.map(str::to_string),
+            live_probe,
+        }
+    }
+
+    #[test]
+    fn completed_tui_onboarding_is_not_unfinished_setup() {
+        // TUI onboarding records the route step only; never the wizard's
+        // language/constitution steps.
+        use codewhale_config::{SetupState, SetupStep, StepEntry, StepStatus};
+        let mut state = SetupState::default();
+        state.set_step(
+            SetupStep::ProviderModel,
+            StepEntry::new(StepStatus::Configured, true, "0.10.1"),
+        );
+        assert!(!state.first_run_ready(), "fixture is not wizard-ready");
+        let verdict = super::doctor_verdict(&state, "openai", &facts(true, None, None));
+        assert!(verdict.starts_with("Ready: setup is complete"), "{verdict}");
+        assert!(verdict.contains("--probe-api"), "{verdict}");
+        assert!(!verdict.contains("unfinished"), "{verdict}");
+
+        // Without the receipt (or a key) the wizard's verdict stands.
+        let verdict = super::doctor_verdict(&state, "openai", &facts(false, None, None));
+        assert!(
+            verdict.contains("first-run setup is unfinished"),
+            "{verdict}"
+        );
+    }
+
+    #[test]
+    fn onboarded_home_without_a_record_is_ready_but_a_recorded_failure_is_not() {
+        use codewhale_config::{InheritedConfigFacts, SetupState};
+        let derived = SetupState::derive_inherited(&InheritedConfigFacts {
+            has_provider_route: true,
+            ..Default::default()
+        });
+        let verdict = super::doctor_verdict(&derived, "openai", &facts(true, None, None));
+        assert!(
+            verdict.starts_with("Ready: onboarding is complete"),
+            "{verdict}"
+        );
+
+        let mut recorded = derived.clone();
+        recorded.inherited = false;
+        let verdict = super::doctor_verdict(&recorded, "openai", &facts(true, None, None));
+        assert!(verdict.starts_with("Not ready"), "{verdict}");
+    }
+
+    #[test]
+    fn a_set_env_key_is_ready_and_named_for_any_provider() {
+        use codewhale_config::{InheritedConfigFacts, SetupState};
+        // Structural derivation keeps NeedsAction: env never certifies it.
+        let derived = SetupState::derive_inherited(&InheritedConfigFacts {
+            has_provider_route: true,
+            ..Default::default()
+        });
+        let verdict = super::doctor_verdict(
+            &derived,
+            "anthropic",
+            &facts(false, Some("ANTHROPIC_API_KEY"), None),
+        );
+        assert_eq!(
+            verdict,
+            "Ready: anthropic key is set via ANTHROPIC_API_KEY (not checked offline; run `codewhale doctor --probe-api` to verify)."
+        );
+    }
+
+    #[test]
+    fn the_live_probe_result_decides_the_verdict() {
+        use codewhale_config::{SetupState, SetupStep, StepEntry, StepStatus};
+        let mut state = SetupState::default();
+        state.set_step(
+            SetupStep::ProviderModel,
+            StepEntry::new(StepStatus::NeedsAction, true, "0.10.1"),
+        );
+        let verdict = super::doctor_verdict(&state, "openai", &facts(false, None, Some(true)));
+        assert!(
+            verdict.starts_with("Ready: the live openai API check passed"),
+            "{verdict}"
+        );
+
+        let verdict = super::doctor_verdict(
+            &state,
+            "openai",
+            &facts(true, Some("OPENAI_API_KEY"), Some(false)),
+        );
+        assert!(verdict.starts_with("Not ready"), "{verdict}");
+        assert!(verdict.contains("API Connectivity"), "{verdict}");
+    }
+
+    #[test]
+    fn env_key_source_names_the_providers_own_variable_without_its_value() {
+        let _lock = crate::test_support::lock_test_env();
+        let _cli = crate::test_support::EnvVarGuard::remove(codewhale_config::CLI_API_KEY_ENV);
+        let _openai = crate::test_support::EnvVarGuard::set("OPENAI_API_KEY", "MUST-NOT-BE-SHOWN");
+        let config = crate::config::Config {
+            provider: Some("openai".to_string()),
+            ..Default::default()
+        };
+        let source = crate::config::active_provider_env_api_key_source(&config)
+            .expect("ambient key present");
+        assert_eq!(source, "OPENAI_API_KEY");
+        let label = super::doctor_env_key_label(&source);
+        assert_eq!(
+            label,
+            "set via OPENAI_API_KEY (value not shown; not checked offline)"
+        );
+        assert!(!label.contains("MUST-NOT-BE-SHOWN"));
+        // The structural contract is untouched: env presence is not readiness.
+        assert!(
+            !super::resolve_credential_diagnostic(&config)
+                .availability
+                .certifies_ready()
+        );
+
+        let _openai = crate::test_support::EnvVarGuard::remove("OPENAI_API_KEY");
+        assert_eq!(
+            crate::config::active_provider_env_api_key_source(&config),
+            None
+        );
+    }
 }
 
 const DOCTOR_LEGACY_STATE_ITEMS: &[&str] = &[

crates/tui/src/tools/file.rs

@@ -471,6 +471,45 @@ pub(crate) fn resolve_guarded_read_path(
     Ok(path)
 }
 
+/// Workspace-escape fallback for the read-only image tools (`read`,
+/// `read_media`): admit `raw` only when it is exactly an image the user
+/// attached in this session's prompts. See
+/// [`crate::image_attach::resolve_user_attached_image`] for the admission
+/// rule; the credential and deny-list guards still apply here. `Ok(None)`
+/// means "not admitted" and the caller keeps its original refusal.
+///
+/// Known limit: a path the user mentioned only in prose, never attached, is
+/// not admitted; `/trust add` remains the way to open a directory.
+pub(crate) async fn user_attached_image_read_path(
+    context: &ToolContext,
+    raw: &str,
+    tool: &str,
+) -> Result<Option<PathBuf>, ToolError> {
+    let Some(snapshot) = context.session_objects.as_ref() else {
+        return Ok(None);
+    };
+    let references = crate::image_attach::user_attached_image_references(&snapshot.messages);
+    if references.is_empty() {
+        return Ok(None);
+    }
+    let raw_owned = raw.to_string();
+    let admitted = tokio::task::spawn_blocking(move || {
+        crate::image_attach::resolve_user_attached_image(&references, &raw_owned)
+    })
+    .await
+    .map_err(|error| ToolError::execution_failed(format!("Failed to resolve {raw}: {error}")))?;
+    let Some(path) = admitted else {
+        return Ok(None);
+    };
+    if is_codewhale_credential_path(&path) {
+        return Err(ToolError::permission_denied(format!(
+            "{tool} cannot expose Codewhale configuration or credential-store files; use `codewhale config list` or `codewhale auth status` for safe inspection"
+        )));
+    }
+    enforce_read_denylist(&path, tool)?;
+    Ok(Some(path))
+}
+
 /// Refuse a read the sandbox read deny-list blocks (S1).
 ///
 /// `read_file`, `read`, and `read_media` all run *in-process*: they call
@@ -912,7 +951,15 @@ impl ReadFileTool {
         // raw spelling still matches by its target; the resolved check after
         // `resolve_path` stays as defense in depth for callers whose process
         // cwd is not the workspace.
-        let file_path = resolve_guarded_read_path(context, path_str, "read")?;
+        let file_path = match resolve_guarded_read_path(context, path_str, "read") {
+            Ok(path) => path,
+            Err(error @ ToolError::PathEscape { .. }) => {
+                user_attached_image_read_path(context, path_str, "read")
+                    .await?
+                    .ok_or(error)?
+            }
+            Err(error) => return Err(error),
+        };
         check_file_operation_cancelled(context)?;
         let bytes = load_contract_source(&file_path, false, context)
             .await?
@@ -928,7 +975,15 @@ impl ReadFileTool {
         let size_bytes = bytes.len();
         check_file_operation_cancelled(context)?;
         if let Some(mime_type) = primitive_image_mime(&bytes) {
-            let prepared = crate::image_attach::prepare_tool_image_bytes(&bytes, mime_type);
+            // Decoding and any downscale are CPU-bound; keep them off the
+            // runtime worker (#6149).
+            let prepared = tokio::task::spawn_blocking(move || {
+                crate::image_attach::prepare_tool_image_bytes(&bytes, mime_type)
+            })
+            .await
+            .map_err(|error| {
+                ToolError::execution_failed(format!("Failed to prepare image: {error}"))
+            })?;
             context.note_file_read(&file_path);
             return Ok(RichToolResult::with_content_blocks(
                 ToolResult::success(prepared.note).with_metadata(json!({

crates/tui/src/tools/file/tests.rs

@@ -1096,3 +1096,41 @@ async fn contract_edit_rejects_oversized_intermediate_replacement_even_if_later_
     assert!(error.to_string().contains("16 MiB processing cap"));
     assert_eq!(fs::read(&path).unwrap(), b"ab");
 }
+
+#[tokio::test]
+async fn contract_read_admits_only_an_image_the_user_attached_from_outside_the_workspace() {
+    let workspace = tempfile::tempdir().expect("workspace");
+    let outside = tempfile::tempdir().expect("outside");
+    let shot = outside.path().join("Screenshot 2026-10-04 at 22.25.47.png");
+    std::fs::write(&shot, crate::image_attach::tests::PNG_1X1).expect("fixture");
+    let stray = outside.path().join("stray.png");
+    std::fs::write(&stray, crate::image_attach::tests::PNG_1X1).expect("fixture");
+    let prompt = codewhale_models::Message {
+        role: codewhale_models::Role::User,
+        content: vec![codewhale_models::ContentBlock::Text {
+            text: format!("what is this?\n[Attached image: {}]", shot.display()),
+            cache_control: None,
+        }],
+    };
+    let context = ToolContext::new(workspace.path()).with_session_objects(
+        crate::rlm::session::SessionObjectSnapshot::new(
+            "session".to_string(),
+            "model".to_string(),
+            workspace.path().to_path_buf(),
+            None,
+            vec![prompt],
+        ),
+    );
+
+    let image =
+        ReadFileTool::execute_contract_read(json!({"path": shot.display().to_string()}), &context)
+            .await
+            .expect("the attached screenshot is readable");
+    assert_eq!(image.content_blocks.len(), 1);
+
+    let error =
+        ReadFileTool::execute_contract_read(json!({"path": stray.display().to_string()}), &context)
+            .await
+            .expect_err("an outside image the user never attached stays refused");
+    assert!(matches!(error, ToolError::PathEscape { .. }), "{error:?}");
+}

crates/tui/src/tools/file_tool.rs

@@ -60,7 +60,7 @@ impl ToolSpec for ReadTool {
     }
 
     fn description(&self) -> &'static str {
-        "Read a text file. The whole file comes back in one call when it fits this call's output budget — 100000 bytes by default, raisable to 500000 with max_bytes. There is no line cap. Use offset and limit for an exact line range; when output is budget-limited the footer names the exact offset to continue from. Every response reports the file's byte size, line count, and whether output was truncated."
+        "Read a file. A text file comes back whole in one call when it fits this call's output budget — 100000 bytes by default, raisable to 500000 with max_bytes. There is no line cap. Use offset and limit for an exact line range; when output is budget-limited the footer names the exact offset to continue from. Every text response reports the file's byte size, line count, and whether output was truncated. A PNG, JPEG, GIF or WebP image comes back as image content you can see (large images are downscaled), including one the user attached from outside the workspace; read an image instead of running OCR or taking screenshots of it."
     }
 
     fn input_schema(&self) -> Value {

crates/tui/src/tools/image_ocr.rs

@@ -31,7 +31,7 @@ impl ToolSpec for ImageOcrTool {
     }
 
     fn description(&self) -> &'static str {
-        "Extract text from an image (PNG, JPEG, or TIFF) via local OCR. On macOS this uses the built-in Vision framework; otherwise it uses local tesseract when available. Use this for screenshots, scanned receipts/whiteboards, image-only PDFs, or any visual that contains text the model needs to read. Returns the extracted text inline; no file is written."
+        "Extract text from an image (PNG, JPEG, or TIFF) via local OCR. On macOS this uses the built-in Vision framework; otherwise it uses local tesseract when available. To look at an image, `read` it instead: a vision-capable model receives the image itself. Use OCR when the active model is text-only, or when you need the exact text of a scanned receipt/whiteboard or an image-only PDF. Returns the extracted text inline; no file is written."
     }
 
     fn input_schema(&self) -> Value {

crates/tui/src/tools/read_media.rs

@@ -325,7 +325,7 @@ pub(crate) async fn execute_read_media(
             // Read-back fallback for tool-owned stored originals: the store
             // only holds image bytes that already passed the guards above,
             // named by content hash, so admitting it widens nothing.
-            match context
+            let stored = context
                 .runtime
                 .media_originals_dir
                 .as_deref()
@@ -335,8 +335,20 @@ pub(crate) async fn execute_read_media(
                         &context.workspace,
                         dir,
                     )
-                }) {
+                });
+            match stored {
                 Some(path) => path,
+                // An image the user attached from outside the workspace
+                // (a dropped screenshot in a temp directory) stays viewable.
+                None if matches!(primary_err, ToolError::PathEscape { .. }) => {
+                    crate::tools::file::user_attached_image_read_path(
+                        context,
+                        path_str,
+                        "read_media",
+                    )
+                    .await?
+                    .ok_or(primary_err)?
+                }
                 None => return Err(primary_err),
             }
         }

crates/tui/src/tools/shell.rs

@@ -3834,9 +3834,18 @@ fn load_default_policy() -> anyhow::Result<Option<ExecPolicyConfig>> {
     Ok(Some(config))
 }
 
-const FOREGROUND_TIMEOUT_RECOVERY_HINT: &str = "Foreground Bash is for bounded commands. \
-The timed-out process was killed; rerun long work as Bash action=\"run\" background=true, \
-then poll with Bash action=\"wait\" task_id=\"<id>\".";
+/// The last `n` lines of `text`, marking how many were left out.
+fn tail_lines(text: &str, n: usize) -> String {
+    let lines: Vec<&str> = text.lines().collect();
+    if lines.len() <= n {
+        return text.to_string();
+    }
+    format!(
+        "[{} earlier lines]\n{}",
+        lines.len() - n,
+        lines[lines.len() - n..].join("\n")
+    )
+}
 
 const MACOS_PROVENANCE_HINT: &str = "Docker buildx failed to update its activity file due to a macOS \
 com.apple.provenance restriction. Files created by Docker Desktop's signed process carry a \
@@ -5042,16 +5051,23 @@ async fn execute_foreground_via_background(
             return Ok(snapshot);
         }
 
+        // The foreground budget is how long the turn waits, never how long
+        // the command may live. Past it the process keeps running as a
+        // background job — exactly as Ctrl+B would move it — and the model
+        // gets the output so far plus the job id to wait on, read, or cancel.
+        // Killing here threw away minutes of a build or test run and made the
+        // model start it over.
         if deadline.is_some_and(|deadline| Instant::now() >= deadline) {
             let mut manager = context
                 .shell_manager
                 .lock()
                 .map_err(|_| anyhow!("shell manager lock poisoned"))?;
-            let mut result = manager.kill(&task_id)?;
-            manager.acknowledge_foreground_completion(&task_id);
-            result.status = ShellStatus::TimedOut;
+            if let Some(process) = manager.processes.get_mut(&task_id) {
+                process.background = true;
+            }
+            let snapshot = manager.get_output(&task_id, false, 0)?;
             foreground.armed = false;
-            return Ok(result);
+            return Ok(snapshot);
         }
 
         tokio::time::sleep(Duration::from_millis(poll_tick_ms)).await;
@@ -5222,11 +5238,10 @@ const CONTRACT_BASH_FOREGROUND_DEFAULT_TIMEOUT_MS: u64 = 120_000;
 /// `BASH_MAX_TIMEOUT_MS` (~24.8 days), so a command that blocked on an
 /// interactive prompt or a hung network call pinned the turn indefinitely —
 /// the tool row just counted seconds while the model waited. The tool's own
-/// schema already promises `action=run 120000`, and its description already
-/// says foreground is for bounded commands, so honor that: an omitted
-/// timeout takes the advertised default, which lets
-/// `FOREGROUND_TIMEOUT_RECOVERY_HINT` kill the process and tell the model to
-/// rerun with `background=true`.
+/// schema already promises `action=run 120000`, so an omitted timeout takes
+/// that default as the foreground wait. Past it the command moves to the
+/// background (it is never killed for running long) and the model gets its
+/// output so far and task id.
 ///
 /// An explicit `timeout_ms` is still honored up to the full contract ceiling,
 /// and background and interactive runs keep their own lifetimes: their
@@ -5290,10 +5305,14 @@ fn finish_contract_bash_result(
     }
     if result.status == ShellStatus::Running {
         let task_id = result.task_id.as_deref().unwrap_or("unknown");
-        let partial = (!output.is_empty()).then(|| format!("\n\nOutput so far:\n{output}"));
+        let so_far = if output.trim().is_empty() {
+            "(no output yet)".to_string()
+        } else {
+            tail_lines(output.trim(), 20)
+        };
         return Ok(ToolResult::success(format!(
-            "Foreground shell wait moved to /jobs: {task_id}{}\n\nThe command is still running; completion will appear as a runtime event.",
-            partial.as_deref().unwrap_or_default()
+            "Still running after {}s; moved to the background as {task_id} (not killed).\n\nOutput so far:\n{so_far}\n\nCompletion will appear as a runtime event. To see more output or block until it finishes, call `tool_search` for `task_shell_wait`, then `task_shell_wait` with task_id=\"{task_id}\". It stops when the session ends.",
+            result.duration_ms / 1_000
         )).with_metadata(metadata));
     }
     if result.status != ShellStatus::Completed {
@@ -5338,7 +5357,7 @@ impl ToolSpec for LowercaseBashTool {
             "type": "object",
             "properties": {
                 "command": { "type": "string", "description": guidance::runtime_command_guidance() },
-                "timeout": { "type": "number", "description": "Optional timeout in seconds; when omitted the command is killed after 120 seconds." },
+                "timeout": { "type": "number", "description": "Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it." },
                 "read_only": { "type": "boolean", "description": "Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation." },
                 "sandbox_permissions": {
                     "type": "string",
@@ -5460,7 +5479,7 @@ pub(crate) fn readonly_bash_input_schema() -> serde_json::Value {
             "command": { "type": "string", "description": "A classifier-approved read command, or analysis code with read_only=true" },
             "read_only": { "type": "boolean", "description": "Require native filesystem read-only and no-network enforcement for analysis code; unavailable sandboxes fail closed." },
             "cwd": { "type": "string", "description": "Workspace-relative working directory" },
-            "timeout_ms": { "type": "integer", "description": "Timeout in milliseconds (1000-600000)" }
+            "timeout_ms": { "type": "integer", "description": "Foreground wait in milliseconds (1000-600000). A command still running then moves to the background; it is not killed." }
         },
         "required": ["command"],
         "additionalProperties": false
@@ -5542,7 +5561,7 @@ impl ToolSpec for BashTool {
                 "read_only": { "type": "boolean", "description": "Set true to require native filesystem read-only and no-network execution. Only foreground run with command, cwd and timeout_ms; unavailable enforcement fails closed." },
                 "timeout_ms": {
                     "type": "integer",
-                    "description": "Timeout in milliseconds. The default depends on the action: action=run 120000 (the standalone Bash tool caps it at 600000), action=wait 30000, action=interact 1000. A foreground action=run that omits this is bounded by that default and killed with a background-rerun hint; pass an explicit value for longer foreground work, or background=true. For action=wait, `timeout_secs` (seconds) and `timeout` (milliseconds) are accepted aliases."
+                    "description": "How long to wait, in milliseconds. action=run: how long the turn waits in the foreground (default 120000, max 600000); a command still running then is NOT killed — it moves to the background and you get its output so far and task_id. action=wait 30000, action=interact 1000. For action=wait, `timeout_secs` (seconds) and `timeout` (milliseconds) are accepted aliases."
                 },
                 "background": {
                     "type": "boolean",
@@ -6387,12 +6406,23 @@ impl ToolSpec for BashTool {
                         "completion is delivered to the model as an internal runtime event and shown in task/status state."
                     };
                     if backgrounded_foreground {
+                        let seconds = result.duration_ms / 1_000;
+                        let so_far = match (result.stdout.trim(), result.stderr.trim()) {
+                            ("", "") => "(no output yet)".to_string(),
+                            (out, "") => tail_lines(out, 20),
+                            ("", err) => format!("STDERR:\n{}", tail_lines(err, 20)),
+                            (out, err) => format!(
+                                "{}\n\nSTDERR:\n{}",
+                                tail_lines(out, 20),
+                                tail_lines(err, 20)
+                            ),
+                        };
                         format!(
-                            "Foreground shell wait moved to /jobs: {task_id_str}\n\nReturns immediately; {completion_contract} Keep working; call Bash action=\"wait\" task_id=\"{task_id_str}\" at a true dependency to block until completion or timeout."
+                            "Still running after {seconds}s; moved to the background as {task_id_str} (not killed).\n\nOutput so far:\n{so_far}\n\n{completion_contract} Keep working if you can. To decide: call `tool_search` for `task_shell_wait`, then `task_shell_wait` with task_id=\"{task_id_str}\" for more output or completion. It stops when the session ends."
                         )
                     } else {
                         format!(
-                            "Background task started: {task_id_str}\n\nReturns immediately; {completion_contract} Codewhale terminates this task when the session exits. If a service must survive a successful headless exec, start it with background=true and persist=true. Keep working; call Bash action=\"wait\" task_id=\"{task_id_str}\" at a true dependency to block until completion or timeout."
+                            "Background task started: {task_id_str}\n\nReturns immediately; {completion_contract} Codewhale terminates this task when the session exits. If a service must survive a successful headless exec, start it with background=true and persist=true. Keep working; call `tool_search` for `task_shell_wait`, then `task_shell_wait` with task_id=\"{task_id_str}\" at a true dependency to block until completion or timeout."
                         )
                     }
                 } else if result.status == ShellStatus::Killed && was_cancelled {
@@ -6402,7 +6432,7 @@ impl ToolSpec for BashTool {
                     )
                 } else if result.status == ShellStatus::TimedOut {
                     format!(
-                        "Command timed out after {timeout_value_ms}ms; process killed.\n\n{FOREGROUND_TIMEOUT_RECOVERY_HINT}\n\nSTDOUT:\n{}\n\nSTDERR:\n{}",
+                        "Command timed out after {timeout_value_ms}ms; process killed.\n\nSTDOUT:\n{}\n\nSTDERR:\n{}",
                         result.stdout, result.stderr
                     )
                 } else {
@@ -6495,18 +6525,6 @@ impl ToolSpec for BashTool {
                     };
                     metadata["background_policy"] = json!("nonblocking");
                 }
-                if result.status == ShellStatus::TimedOut && !background && !interactive {
-                    metadata["foreground_timeout_recovery"] = json!({
-                        "process_killed": true,
-                        "hint": FOREGROUND_TIMEOUT_RECOVERY_HINT,
-                        "recommended_tools": ["Bash", "task_shell_start", "task_shell_wait"],
-                        "rerun_as": {"tool": "Bash", "action": "run", "background": true},
-                        "poll_with": [
-                            {"tool": "Bash", "action": "wait"},
-                            {"tool": "task_shell_wait"}
-                        ]
-                    });
-                }
                 if let Some(hint) = network_restricted_hint {
                     metadata["sandbox_network_restricted"] = json!(true);
                     metadata["sandbox_network_denied_hint"] = json!(hint);

crates/tui/src/tools/shell/guidance.rs

@@ -108,7 +108,7 @@ pub(super) fn description() -> &'static str {
 // Interpreter syntax lives on the command parameter. Repeating it in the
 // tool description adds the same bytes to every active request.
 pub(super) fn foreground_description() -> &'static str {
-    "Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."
+    "Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."
 }
 
 #[cfg(test)]

crates/tui/src/tools/shell/tests.rs

@@ -126,8 +126,8 @@ fn lowercase_bash_description_matches_the_timeout_it_actually_applies() {
     };
 
     // `bash {command}` with no `timeout` translates to a legacy input carrying
-    // no `timeout_ms`, and the contract delegate then bounds the foreground run
-    // at the 120 s default and kills the process there.
+    // no `timeout_ms`. The contract delegate waits the 120 s default in the
+    // foreground, then moves a still-running process to the background.
     let translated =
         contract_bash_legacy_input(&json!({"command": "sleep 600"})).expect("translated input");
     assert!(
@@ -142,7 +142,8 @@ fn lowercase_bash_description_matches_the_timeout_it_actually_applies() {
     // The tool description is the only place the model learns this. It used to
     // say "when omitted there is no default timeout", so a model running a
     // four-minute build had every reason not to pass a timeout, and got the
-    // process killed at two minutes anyway.
+    // process killed at two minutes anyway. It now names that wait and says
+    // the process is not killed there.
     let description = LowercaseBashTool.description();
     assert!(
         !description.contains("no default timeout"),
@@ -688,27 +689,6 @@ fn shell_execution_failure_names_resource_exhaustion_and_says_retry() {
     );
 }
 
-#[tokio::test]
-async fn lowercase_bash_timeout_uses_seconds_and_fails() {
-    let workspace = tempdir().expect("workspace");
-    let context = ToolContext::new(workspace.path());
-    let error = LowercaseBashTool
-        .execute(
-            json!({"command": sleep_command(2), "timeout": 0.01}),
-            &context,
-        )
-        .await
-        .expect_err("timeout must fail");
-    assert!(
-        error
-            .to_string()
-            .contains("Command timed out after 0.01 seconds"),
-        "{error}"
-    );
-    let metadata = error.metadata().expect("timeout metadata");
-    assert_eq!(metadata["status"], "TimedOut");
-}
-
 fn execute_shell(
     manager: &mut ShellManager,
     command: &str,
@@ -2163,7 +2143,11 @@ async fn background_shell_job_preserves_origin_identity() {
         "owned background work must describe its real completion route: {}",
         result.content
     );
-    assert!(result.content.contains("Bash action=\"wait\""));
+    assert!(
+        result.content.contains("`tool_search`") && result.content.contains("task_shell_wait"),
+        "owned background work must name a callable wait tool: {}",
+        result.content
+    );
     assert_eq!(
         metadata
             .get("auto_resume_on_completion")
@@ -3240,66 +3224,6 @@ async fn test_exec_shell_combined_output_uses_single_stream() {
     );
 }
 
-#[tokio::test]
-async fn test_exec_shell_foreground_timeout_guides_background_rerun() {
-    let tmp = tempdir().expect("tempdir");
-    let ctx = ToolContext::new(tmp.path());
-    let tool = BashTool::new("Bash");
-
-    let result = tool
-        .execute(
-            json!({
-                "command": sleep_command(10),
-                "timeout_ms": 1000
-            }),
-            &ctx,
-        )
-        .await
-        .expect("execute");
-
-    assert!(!result.success);
-    // The rerun instruction has to be spelled in the canonical action form:
-    // `exec_shell` / `task_shell_start` are not both dispatchable, and the
-    // model can only reach the shell through `Bash`.
-    assert!(
-        result
-            .content
-            .contains("Bash action=\"run\" background=true")
-    );
-    assert!(result.content.contains("Bash action=\"wait\""));
-    assert!(!result.content.contains("exec_shell"));
-    assert!(result.content.contains("process killed"));
-    let meta = result.metadata.expect("metadata");
-    assert_eq!(meta.get("status").and_then(Value::as_str), Some("TimedOut"));
-    let recovery = meta
-        .get("foreground_timeout_recovery")
-        .expect("timeout recovery metadata");
-    assert_eq!(
-        recovery
-            .get("rerun_as")
-            .and_then(|rerun| rerun.get("background"))
-            .and_then(Value::as_bool),
-        Some(true)
-    );
-    assert_eq!(
-        recovery
-            .get("rerun_as")
-            .and_then(|rerun| rerun.get("tool"))
-            .and_then(Value::as_str),
-        Some("Bash")
-    );
-    let hint = recovery
-        .get("hint")
-        .and_then(Value::as_str)
-        .unwrap_or_default();
-    assert!(hint.contains("Bash action=\"wait\""), "{hint}");
-    assert!(!hint.contains("exec_shell"), "{hint}");
-    // The structured tool list is read by the model too; it must not hand
-    // over names the registry does not resolve.
-    let recommended = recovery.to_string();
-    assert!(!recommended.contains("exec_shell"), "{recommended}");
-}
-
 #[test]
 fn background_schema_distinguishes_temporary_jobs_from_persistent_services() {
     let schema = BashTool::new("Bash").input_schema();
@@ -3377,15 +3301,11 @@ async fn test_exec_shell_foreground_can_move_to_background() {
         .expect("task should not panic");
 
     assert!(result.success);
+    assert!(result.content.contains("moved to the background"));
+    // The detach message points the model at a tool it can actually call.
+    // `Bash` is hidden; `task_shell_wait` is deferred behind `tool_search`.
     assert!(
-        result
-            .content
-            .contains("Foreground shell wait moved to /jobs")
-    );
-    // The detach message points the model at the wait action for early
-    // output, and hands over the task_id it needs to make that call.
-    assert!(
-        result.content.contains("Bash action=\"wait\""),
+        result.content.contains("`tool_search`") && result.content.contains("task_shell_wait"),
         "{}",
         result.content
     );
@@ -3498,7 +3418,10 @@ async fn lowercase_bash_foreground_detach_is_a_successful_running_receipt() {
 
     assert!(result.success, "{}", result.content);
     assert!(
-        result.content.contains("moved to /jobs"),
+        result.content.contains("moved to the background")
+            && result.content.contains("not killed")
+            && result.content.contains("`tool_search`")
+            && result.content.contains("task_shell_wait"),
         "{}",
         result.content
     );
@@ -4430,44 +4353,6 @@ fn shell_escaped_grandchild_helper_process() {
     std::thread::sleep(Duration::from_secs(30));
 }
 
-/// Required regression: a foreground command that ignores SIGTERM must be
-/// dead and the tool must have returned within timeout + a small grace
-/// (2s timeout, assert wall < 10s).
-#[cfg(unix)]
-#[tokio::test]
-async fn foreground_timeout_kills_sigterm_ignoring_command_within_grace() {
-    let tmp = tempdir().expect("tempdir");
-    let pid_file = tmp.path().join("sigterm-helper.pid");
-    let test_binary = std::env::current_exe().expect("current test binary");
-    let command = format!(
-        "{SHELL_SIGTERM_HELPER_ENV}=1 {SHELL_DESCENDANT_PID_FILE_ENV}={} exec {} --exact {} --nocapture",
-        shell_words::quote(&pid_file.display().to_string()),
-        shell_words::quote(&test_binary.display().to_string()),
-        shell_words::quote("tools::shell::tests::shell_sigterm_ignoring_helper_process"),
-    );
-    let ctx = ToolContext::new(tmp.path());
-
-    let started = Instant::now();
-    let result = BashTool::new("Bash")
-        .execute(json!({"command": command, "timeout_ms": 2_000}), &ctx)
-        .await
-        .expect("execute");
-    let wall = started.elapsed();
-
-    assert!(!result.success);
-    let meta = result.metadata.expect("metadata");
-    assert_eq!(meta.get("status").and_then(Value::as_str), Some("TimedOut"));
-    assert!(
-        wall < Duration::from_secs(10),
-        "kill path overshot the 2s timeout: wall {wall:?}"
-    );
-    let helper_pid = wait_for_shell_pid_file(&pid_file);
-    assert!(
-        wait_for_shell_pid_exit(helper_pid),
-        "SIGTERM-ignoring helper {helper_pid} survived the timeout kill"
-    );
-}
-
 /// Regression for the ~180s kill-path overshoot: a descendant that escaped
 /// the process group keeps the output pipe open after the group is killed.
 /// kill() must still return within a bounded grace instead of blocking on
@@ -4834,15 +4719,6 @@ fn bash_required_groups_survive_a_provider_that_drops_root_composition() {
     assert!(schema["properties"]["command"].is_object());
 }
 
-/// Every hint in this file has to name a tool the model can actually call.
-/// `exec_shell` / `exec_shell_wait` were retired in v0.9.3.
-#[test]
-fn shell_recovery_hints_name_only_dispatchable_tools() {
-    assert!(!FOREGROUND_TIMEOUT_RECOVERY_HINT.contains("exec_shell"));
-    assert!(FOREGROUND_TIMEOUT_RECOVERY_HINT.contains("Bash"));
-    assert!(FOREGROUND_TIMEOUT_RECOVERY_HINT.contains("action=\"wait\""));
-}
-
 /// One documented default hid three real ones: `wait` uses 30s and
 /// `interact` 1s, so a model omitting `timeout_ms` on `wait` got a quarter of
 /// the timeout the schema promised.
@@ -5806,3 +5682,29 @@ async fn note_tool_refuses_symlinked_targets_that_leave_the_workspace() {
             .contains("kept")
     );
 }
+
+#[tokio::test]
+async fn a_foreground_command_past_its_wait_moves_to_the_background_alive() {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    let ctx = ToolContext::new(tmp.path());
+    let result = BashTool::new("Bash")
+        .execute(
+            json!({"command": "echo started; sleep 3; echo finished", "timeout_ms": 1_000}),
+            &ctx,
+        )
+        .await
+        .expect("bash");
+    assert!(result.success, "{}", result.content);
+    assert!(result.content.contains("not killed"), "{}", result.content);
+    assert!(result.content.contains("started"), "{}", result.content);
+    let task_id = result.metadata.as_ref().expect("metadata")["task_id"]
+        .as_str()
+        .expect("task_id")
+        .to_string();
+    let mut manager = ctx.shell_manager.lock().expect("shell manager lock");
+    assert_eq!(
+        manager.poll_status(&task_id).expect("status"),
+        ShellStatus::Running
+    );
+    assert!(manager.processes.get(&task_id).expect("tracked").background);
+}

crates/tui/src/tui/app/composer.rs

@@ -738,6 +738,10 @@ impl App {
         if let Some(pending) = self.paste_burst.flush_before_modified_input() {
             self.insert_str(&pending);
         }
+        if self.attach_pasted_image_paths(text) {
+            self.paste_burst.clear_after_explicit_paste();
+            return;
+        }
         let normalized = normalize_paste_text(text);
         if !normalized.is_empty() {
             self.insert_str(&normalized);
@@ -750,6 +754,32 @@ impl App {
         // self.consolidate_large_input_if_oversized(); // deferred to submit time
     }
 
+    /// A file dragged onto the terminal arrives as a paste of its path. When
+    /// the whole paste names local image files, attach them on the same
+    /// `[Attached image: …]` line a clipboard image gets, so each shows as a
+    /// composer attachment and is sent to the model as an image part (the
+    /// engine expands the line when it builds the user message, and the
+    /// route's vision capability decides per request; a text-only route gets
+    /// the omission notice there). Returns whether the paste was consumed.
+    ///
+    /// A command line (`/…`) or shell line (`!…`) keeps the literal path.
+    pub(crate) fn attach_pasted_image_paths(&mut self, text: &str) -> bool {
+        if self.input.trim_start().starts_with(['/', '!']) {
+            return false;
+        }
+        let Some(paths) = crate::image_attach::pasted_image_paths(text) else {
+            return false;
+        };
+        for path in &paths {
+            self.insert_media_attachment("image", path, None);
+        }
+        self.status_message = Some(match paths.as_slice() {
+            [path] => format!("Attached image: {}", path.display()),
+            paths => format!("Attached {} images", paths.len()),
+        });
+        true
+    }
+
     pub fn insert_media_attachment(&mut self, kind: &str, path: &Path, description: Option<&str>) {
         let reference = media_attachment_reference(kind, path, description);
         let cursor = self.cursor_position.min(char_count(&self.input));
@@ -1699,6 +1729,20 @@ impl App {
         // bytes lost after the composer accepted them — never fall through
         // to the prose-prompt branch; hold it instead.
         let claimed_command = self.command_line_claimed();
+        // A dropped image path that was not converted at paste time (typed
+        // keys, or the question written on the same line) still attaches.
+        if !claimed_command
+            && !self.input.trim_start().starts_with('!')
+            && let Some((path, rest)) = crate::image_attach::leading_dropped_image(&self.input)
+        {
+            let reference = media_attachment_reference("image", &path, None);
+            self.input = if rest.is_empty() {
+                reference
+            } else {
+                format!("{reference}\n{rest}")
+            };
+            self.cursor_position = char_count(&self.input);
+        }
         // Safety net: if any earlier path filled the buffer above the
         // safety cap without going through `insert_paste_text`, fold it
         // into a workspace paste file now (#553). Bracketed pastes hit

crates/tui/src/tui/app/tests.rs

@@ -8012,3 +8012,84 @@ fn oversized_paste_is_not_written_through_a_linked_pastes_directory() {
         "the pasted text must not land outside the workspace"
     );
 }
+
+#[cfg(not(windows))]
+#[test]
+fn dropped_screenshot_path_becomes_an_image_attachment() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dir.path().join("Screenshot 2026-10-04 at 22.25.47.png");
+    std::fs::write(&shot, crate::image_attach::tests::PNG_1X1).expect("fixture");
+    // Terminal.app / iTerm2 deliver a drop as a shell-escaped paste.
+    let dropped = shot.display().to_string().replace(' ', "\\ ");
+    let mut app = App::new(test_options(false), &Config::default());
+    app.input = "what is wrong here?".to_string();
+    app.cursor_position = app.input.chars().count();
+
+    app.insert_paste_text(&dropped);
+
+    let line = format!("[Attached image: {}]", shot.display());
+    assert!(app.input.contains(&line), "{}", app.input);
+    assert!(!app.input.contains("\\ "), "{}", app.input);
+    assert_eq!(app.composer_attachment_count(), 1);
+    assert_eq!(
+        app.status_message.as_deref(),
+        Some(format!("Attached image: {}", shot.display()).as_str())
+    );
+    let expanded = crate::image_attach::expand_attachment_blocks(&app.input);
+    assert!(expanded.notices.is_empty(), "{expanded:?}");
+    assert!(
+        expanded
+            .blocks
+            .iter()
+            .any(|block| matches!(block, codewhale_models::ContentBlock::ImageUrl { .. }))
+    );
+}
+
+#[test]
+fn image_path_pasted_on_a_command_line_stays_literal() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dir.path().join("shot.png");
+    std::fs::write(&shot, crate::image_attach::tests::PNG_1X1).expect("fixture");
+    let mut app = App::new(test_options(false), &Config::default());
+    app.input = "/rename ".to_string();
+    app.cursor_position = app.input.chars().count();
+
+    app.insert_paste_text(&shot.display().to_string());
+
+    assert_eq!(app.input, format!("/rename {}", shot.display()));
+    assert_eq!(app.composer_attachment_count(), 0);
+}
+
+#[cfg(not(windows))]
+#[test]
+fn a_typed_drop_with_the_question_on_its_line_still_sends_the_image() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let shot = dir.path().join("Screenshot 2026-10-04 at 22.25.47.png");
+    std::fs::write(&shot, crate::image_attach::tests::PNG_1X1).expect("fixture");
+    let mut app = App::new(test_options(false), &Config::default());
+    // Arrived as keystrokes, so the paste-time check never saw it.
+    app.input = format!(
+        "{}  why does it show jobs 2?",
+        shot.display().to_string().replace(' ', "\\ ")
+    );
+    app.cursor_position = app.input.chars().count();
+
+    let submitted = app.submit_input().expect("submitted");
+
+    assert!(
+        submitted.starts_with(&format!("[Attached image: {}]\n", shot.display())),
+        "{submitted}"
+    );
+    assert!(
+        submitted.ends_with("why does it show jobs 2?"),
+        "{submitted}"
+    );
+    let expanded = crate::image_attach::expand_attachment_blocks(&submitted);
+    assert!(expanded.notices.is_empty(), "{expanded:?}");
+    assert!(
+        expanded
+            .blocks
+            .iter()
+            .any(|block| matches!(block, codewhale_models::ContentBlock::ImageUrl { .. }))
+    );
+}

crates/tui/src/tui/file_mention.rs

@@ -747,7 +747,8 @@ fn extract_media_attachment_references(input: &str) -> Vec<MediaAttachmentRefere
 // ---------------------------------------------------------------------------
 //
 // macOS parks dragged-out screenshots under a per-capture temp directory like
-// `/var/folders/…/T/Temporary Items/NSIRD_screencaptureui_XXXX/` and deletes
+// `/var/folders/…/T/Temporary Items/NSIRD_screencaptureui_XXXX/` (recent
+// releases spell it `TemporaryItems`, without the space) and deletes
 // it minutes later. Inbound references to such files are copied to a stable
 // directory the moment the message is received, so the agent later reads a
 // path that still exists.
@@ -755,6 +756,9 @@ fn extract_media_attachment_references(input: &str) -> Vec<MediaAttachmentRefere
 /// Marker fragments of the macOS screencapture temp directory layout.
 const SCREENCAPTURE_TEMP_DIR_MARKERS: [&str; 2] = ["Temporary Items", "screencaptureui"];
 
+/// The `Temporary Items` component as recent macOS releases spell it.
+const SCREENCAPTURE_TEMP_DIR_COMPACT: &str = "TemporaryItems";
+
 /// Stable per-session directory for stabilized screencapture files. Follows
 /// the same home-first convention as `clipboard.rs`'s clipboard-images dir.
 pub(crate) fn screenshot_stabilization_dir(workspace: &Path) -> PathBuf {
@@ -775,7 +779,7 @@ fn is_screencapture_temp_path(path: &Path) -> bool {
         .collect();
     components
         .iter()
-        .any(|c| c == SCREENCAPTURE_TEMP_DIR_MARKERS[0])
+        .any(|c| c == SCREENCAPTURE_TEMP_DIR_MARKERS[0] || c == SCREENCAPTURE_TEMP_DIR_COMPACT)
         && components
             .iter()
             .any(|c| c.contains(SCREENCAPTURE_TEMP_DIR_MARKERS[1]))
@@ -2417,6 +2421,13 @@ mod tests {
         assert!(is_screencapture_temp_path(Path::new(
             "/var/folders/x/T/Temporary Items/NSIRD_screencaptureui_ABC/Shot.png"
         )));
+        // The spelling in the founder's failing drop (macOS 26).
+        assert!(is_screencapture_temp_path(Path::new(
+            "/var/folders/gc/x/T/TemporaryItems/NSIRD_screencaptureui_IqPorQ/Screenshot 2026-10-04 at 22.25.47.png"
+        )));
+        assert!(!is_screencapture_temp_path(Path::new(
+            "/tmp/TemporaryItems/Shot.png"
+        )));
         let (tmp, source, _) = screencapture_fixture();
         assert!(is_screencapture_temp_path(&source));
         // Only one marker is not a screencapture temp location.
@@ -2511,6 +2522,30 @@ mod tests {
         let _ = tmp;
     }
 
+    #[test]
+    fn stabilizes_a_dropped_attachment_under_compact_temporary_items() {
+        let tmp = TempDir::new().expect("tempdir");
+        let source_dir = tmp
+            .path()
+            .join("TemporaryItems")
+            .join("NSIRD_screencaptureui_IqPorQ");
+        std::fs::create_dir_all(&source_dir).expect("mkdir");
+        let source = source_dir.join("Screenshot 2026-10-04 at 22.25.47.png");
+        std::fs::write(&source, b"screenshot").expect("write");
+        let artifact_dir = tmp.path().join("attachments");
+        let input = format!("what is this?\n[Attached image: {}]\n", source.display());
+
+        let out = stabilize_screenshot_references(&input, &artifact_dir);
+
+        let stable = artifact_dir.join("Screenshot 2026-10-04-22.25.47.png");
+        assert!(stable.is_file(), "stable copy must exist");
+        assert!(
+            out.contains(&format!("[Attached image: {}]", stable.display())),
+            "got: {out}"
+        );
+        let _ = tmp;
+    }
+
     #[test]
     fn handles_a_multibyte_final_filename_char() {
         let tmp = TempDir::new().expect("tempdir");

crates/tui/src/tui/history.rs

@@ -41,10 +41,9 @@ use checklist::{
 #[cfg(test)]
 use checklist::{ChecklistChange, ChecklistItemSnapshot, ChecklistSnapshot};
 use constants::{
-    ASSISTANT_GLYPH, FOREGROUND_SHELL_WAIT_HINT, TOOL_COMMAND_LINE_LIMIT, TOOL_DONE_SYMBOL,
-    TOOL_FAILED_SYMBOL, TOOL_FAILURE_PREVIEW_LINES, TOOL_HEADER_SUMMARY_LIMIT,
-    TOOL_OUTPUT_LINE_LIMIT, TOOL_SUCCESS_OUTPUT_PREVIEW_LINES, TOOL_SUMMARY_CARD_LINES,
-    TRANSCRIPT_RAIL, USER_GLYPH,
+    ASSISTANT_GLYPH, TOOL_COMMAND_LINE_LIMIT, TOOL_DONE_SYMBOL, TOOL_FAILED_SYMBOL,
+    TOOL_FAILURE_PREVIEW_LINES, TOOL_HEADER_SUMMARY_LIMIT, TOOL_OUTPUT_LINE_LIMIT,
+    TOOL_SUCCESS_OUTPUT_PREVIEW_LINES, TOOL_SUMMARY_CARD_LINES, TRANSCRIPT_RAIL, USER_GLYPH,
 };
 #[cfg(test)]
 use constants::{TOOL_RUNNING_SYMBOLS, TOOL_STATUS_SYMBOL_MS};
@@ -1026,7 +1025,7 @@ impl ExecCell {
         self.render(width, low_motion, RenderMode::Live)
     }
 
-    /// Foreground `exec_shell` blocking the turn — eligible for Ctrl+B detach.
+    /// Foreground `exec_shell` blocking the turn.
     fn is_foreground_shell_wait(&self) -> bool {
         self.status == ToolStatus::Running
             && self.source == ExecSource::Assistant
@@ -1052,14 +1051,13 @@ impl ExecCell {
     ) -> Vec<Line<'static>> {
         let mut lines = Vec::new();
         let command_summary = command_header_summary(&self.command);
-        let compact_foreground_wait = self.is_foreground_shell_wait();
-        let header_summary = if compact_foreground_wait {
-            Some(FOREGROUND_SHELL_WAIT_HINT)
-        } else {
-            self.interaction
-                .as_deref()
-                .or(Some(command_summary.as_str()))
-        };
+        // The header names the command, always. A long wait moves itself to
+        // the background (see `execute_foreground_via_background`), so the
+        // card never needs to advertise a key to rescue the turn.
+        let header_summary = self
+            .interaction
+            .as_deref()
+            .or(Some(command_summary.as_str()));
         let stale_status = self
             .stale_elapsed_since_output_ms
             .map(stale_shell_status_label);
@@ -1082,11 +1080,10 @@ impl ExecCell {
             low_motion || stale_status.is_some(),
         ));
 
-        // Foreground shell waits block the turn but do not need a verbose
-        // transcript card — spinner + running badge + Ctrl+B hint only.
-        // Command, live output, and artifact paths belong in the Activity sidebar
-        // and `/jobs` detail surfaces.
-        if compact_foreground_wait {
+        // A foreground shell wait stays a compact card — command, spinner and
+        // running badge. Live output and artifact paths belong in the
+        // Activity sidebar and `/jobs` detail surfaces.
+        if self.is_foreground_shell_wait() {
             return wrap_card_rail(lines, self.status);
         }
 
@@ -1167,12 +1164,6 @@ impl ExecCell {
                     TOOL_OUTPUT_LINE_LIMIT,
                     mode,
                 ));
-            } else if self.status == ToolStatus::Running && self.source == ExecSource::Assistant {
-                lines.extend(wrap_plain_line(
-                    "  Ctrl+B moves this shell wait to /jobs.",
-                    Style::default().fg(palette::TEXT_MUTED),
-                    width,
-                ));
             } else if self.status != ToolStatus::Running && mode == RenderMode::Transcript {
                 // #3031: Suppress "(no output)" in compact/Live mode;
                 // the success header is enough signal. Transcript still

crates/tui/src/tui/history/constants.rs

@@ -98,5 +98,3 @@ pub(super) const TOOL_SUMMARY_CARD_LINES: usize = 6;
 
 pub(super) const TOOL_DONE_SYMBOL: &str = crate::tui::glyphs::DONE;
 pub(super) const TOOL_FAILED_SYMBOL: &str = crate::tui::glyphs::FAILED;
-/// Compact Ctrl+B affordance for foreground shell waits in the live transcript.
-pub(super) const FOREGROUND_SHELL_WAIT_HINT: &str = "Ctrl+B → /jobs";

crates/tui/src/tui/history/tests.rs

@@ -689,7 +689,7 @@ fn streaming_reasoning_shows_its_newest_line_not_a_placeholder() {
 ///
 /// Replaces three tests.
 #[test]
-fn a_foreground_shell_wait_offers_the_escape_hatch_not_the_command_echo() {
+fn a_foreground_shell_wait_names_its_command_without_a_key_hint() {
     let command = "cargo test --workspace --all-features";
     let running = {
         let mut exec = exec_tool(command, ToolStatus::Running);
@@ -706,18 +706,17 @@ fn a_foreground_shell_wait_offers_the_escape_hatch_not_the_command_echo() {
         ),
     ] {
         assert!(
-            text.contains("Ctrl+B"),
-            "[{label}] the backgrounding chord is the point of the card: {text}"
+            text.contains(command),
+            "[{label}] the card names what is running: {text}"
+        );
+        assert!(
+            !text.contains("Ctrl+B"),
+            "[{label}] a long wait moves itself to the background: {text}"
         );
         assert!(
             !text.contains("running line 1"),
             "[{label}] the live tail belongs to the sidebar and /jobs: {text}"
         );
-        assert!(
-            !text.contains(command),
-            "[{label}] the header already carries the summary; do not echo the \
-             command target: {text}"
-        );
         assert!(!text.contains("command:"), "[{label}] {text}");
     }
 

crates/tui/src/tui/ui/event_loop.rs

@@ -444,7 +444,11 @@ pub(super) fn flush_paste_burst_before_composer(app: &mut App, now: Instant) ->
     }
     match app.take_paste_burst_flush_if_enabled(now) {
         crate::tui::paste_burst::FlushResult::Paste(text) => {
-            app.insert_str(&text);
+            // Terminals without bracketed paste deliver a dropped file the
+            // same way; attach it exactly as `insert_paste_text` would.
+            if !app.attach_pasted_image_paths(&text) {
+                app.insert_str(&text);
+            }
             true
         }
         crate::tui::paste_burst::FlushResult::Typed(' ')

crates/tui/src/tui/ui/task_projection.rs

@@ -244,9 +244,16 @@ pub(super) fn project_shell_jobs(
         files_touched: 0,
         exit_code: job.exit_code,
     };
+    // Only shells that really run in the background are jobs. A foreground
+    // Bash wait is already the live tool card in the transcript; listing it
+    // here too counted one command as a `1 shell` footer chip, a `Shells 1`
+    // row and the tool card at once. A wait that outlives its foreground
+    // budget (or Ctrl+B) flips `background`, and the shell then appears here.
     entries.extend(
         jobs.iter()
-            .filter(|job| matches!(job.status, crate::tools::shell::ShellStatus::Running))
+            .filter(|job| {
+                job.background && matches!(job.status, crate::tools::shell::ShellStatus::Running)
+            })
             .map(shell_entry),
     );
     // Finished shells in the order they finished, so the list is stable and

crates/tui/src/tui/ui/tests.rs

@@ -33523,3 +33523,22 @@ fn engine_retry_receipt_projection_keeps_quiet_history_without_internal_status_r
     ));
     assert_eq!(app.history.len(), before + 1);
 }
+
+#[test]
+fn a_foreground_shell_wait_is_one_tool_card_not_also_a_background_job() {
+    use super::task_projection::project_shell_jobs;
+    use crate::tools::shell::ShellStatus;
+    let mut app = create_test_app();
+    app.current_session_id = Some("fg".into());
+    let mut foreground = shell_job("shell_fg", "ls | head -40", ShellStatus::Running, None);
+    foreground.background = false;
+    foreground.finished_at = None;
+    let mut entries = Vec::new();
+    project_shell_jobs(&mut app, &mut entries, std::slice::from_ref(&foreground));
+    assert!(entries.is_empty(), "{entries:?}");
+
+    // Ctrl+B detaches it into /jobs: now it is exactly one background job.
+    foreground.background = true;
+    project_shell_jobs(&mut app, &mut entries, &[foreground]);
+    assert_eq!(entries.len(), 1);
+}

crates/tui/src/tui/work_surface/render/dock_tabs_tests.rs

@@ -99,3 +99,25 @@ fn native_dock_zero_viewport_retires_every_painted_target() {
     assert!(actual.1.is_empty());
     assert!(actual.2.is_empty());
 }
+
+#[test]
+fn jobs_tab_counts_one_running_shell_as_one_job() {
+    let mut app = app();
+    app.task_panel.push(crate::tui::app::TaskPanelEntry {
+        exit_code: None,
+        id: "shell_a1b2c3d4".to_string(),
+        status: "running".to_string(),
+        prompt_summary: "shell: ls | head -40".to_string(),
+        duration_ms: Some(34_000),
+        kind: crate::tui::app::TaskPanelEntryKind::Shell,
+        stale: false,
+        elapsed_since_output_ms: None,
+        owner_agent_id: None,
+        owner_agent_name: None,
+        current_tool: None,
+        role: None,
+        files_touched: 0,
+    });
+    // The `▾ Shells 1` heading is a selectable door, not a second job.
+    assert_eq!(dock_tab_count(&mut app, RailPanel::Background), Some(1));
+}

crates/tui/src/tui/work_surface/render/mod.rs

@@ -693,10 +693,11 @@ fn dock_tab_count(app: &mut App, panel: RailPanel) -> Option<usize> {
                 .filter(|row| row.id.0.starts_with("graph:"))
                 .count(),
         ),
+        // Group headings (`▾ Shells N`) are selectable doors, not jobs.
         RailPanel::Background => Some(
             visible_rows_for(app, panel)
                 .iter()
-                .filter(|row| row.selectable)
+                .filter(|row| row.selectable && !row.id.0.starts_with("section:"))
                 .count(),
         ),
         RailPanel::Files => Some(super::views::files_touched_count(app)),

crates/tui/tests/fixtures/conformance/events/approval_denied.golden.jsonl

@@ -1,8 +1,8 @@
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: 4e8d682c1289","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: 498df32b23bb","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":150,"output_tokens":15}}
 {"event":"tool_call_started","input":{"command":"touch denied.txt"},"tool_call_id":"<uuid:2>","tool_name":"Bash"}
@@ -12,12 +12,12 @@
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_touch","input":{"command":"touch denied.txt"},"name":"Bash","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"Error: Tool 'Bash' denied by user — the call was not approved. Do not retry the same call; present what you intended and wait for the user's approval or new instructions.","execution_id":"<uuid:2>","is_error":true,"tool_use_id":"call_touch","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"event":"status","message":"Continuing — tool results"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"message_started","index":0}
 {"delta":"Understood, I did not create it.","event":"response_delta","index":0}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":200,"output_tokens":6}}
 {"event":"message_complete","index":0}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Create denied.txt with touch.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_touch","input":{"command":"touch denied.txt"},"name":"Bash","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"Error: Tool 'Bash' denied by user — the call was not approved. Do not retry the same call; present what you intended and wait for the user's approval or new instructions.","execution_id":"<uuid:2>","is_error":true,"tool_use_id":"call_touch","type":"tool_result"}],"role":"user"},{"content":[{"text":"Understood, I did not create it.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"Line truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, extLine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":350,"output_tokens":21},"routed_usage_dropped_records":0,"status":"completed","tool_catalog":"<pinned by the prompt family>","usage":{"input_tokens":350,"output_tokens":21}}
 {"harness_summary":{"model_requests":2,"non_streaming_requests":0,"workspace_after":{".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/cancel_midstream.golden.jsonl

@@ -1,15 +1,15 @@
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Tell me a long story.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: f6a46d239d58","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: f5cae348cb41","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"event":"message_started","index":0}
 {"delta":"Here is a partial","event":"response_delta","index":0}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":120,"output_tokens":0}}
 {"event":"status","message":"Request cancelled"}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Tell me a long story.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"text":"Here is a partial","type":"text"}],"role":"assistant_interrupted"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":null,"last_reported_input_tokens":120,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":null,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"interrupted","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"interrupted","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissioLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":null,"last_reported_input_tokens":120,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":null,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"interrupted","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"interrupted","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\"Line truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":120,"output_tokens":0},"routed_usage_dropped_records":0,"status":"interrupted","tool_catalog":"<pinned by the prompt family>","usage":{"input_tokens":120,"output_tokens":0}}
 {"event":"status","message":"Turn interrupted."}
 {"harness_summary":{"model_requests":1,"non_streaming_requests":0,"workspace_after":{".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/one_tool_call.golden.jsonl

@@ -1,8 +1,8 @@
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: f6a46d239d58","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: f5cae348cb41","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":150,"output_tokens":20}}
 {"event":"tool_call_started","input":{"action":"read","path":"README.md"},"tool_call_id":"<uuid:2>","tool_name":"File"}
@@ -13,12 +13,12 @@
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_readme","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_readme","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"event":"status","message":"Continuing — tool results"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"message_started","index":0}
 {"delta":"It says: conformance fixture.","event":"response_delta","index":0}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":200,"output_tokens":6}}
 {"event":"message_complete","index":0}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"What does README.md say?","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_readme","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_readme","type":"tool_result"}],"role":"user"},{"content":[{"text":"It says: conformance fixture.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"Line truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, extLine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":350,"output_tokens":26},"routed_usage_dropped_records":0,"status":"completed","tool_catalog":"<pinned by the prompt family>","usage":{"input_tokens":350,"output_tokens":26}}
 {"harness_summary":{"model_requests":2,"non_streaming_requests":0,"workspace_after":{".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/parallel_tool_calls.golden.jsonl

@@ -1,8 +1,8 @@
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: f6a46d239d58","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: f5cae348cb41","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":160,"output_tokens":40}}
 {"event":"tool_call_started","input":{"action":"read","path":"README.md"},"tool_call_id":"<uuid:2>","tool_name":"File"}
@@ -19,12 +19,12 @@
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_a","type":"tool_result"}],"role":"user"},{"content":[{"content":"content_hash=\"sha256:f957b19529906961933c5c30f8713c500a9bb5d9d0695c40d48c97a26a3594ec\"\nsecond file","execution_id":"<uuid:3>","tool_use_id":"call_read_b","type":"tool_result"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"event":"status","message":"Continuing — tool results"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"message_started","index":0}
 {"delta":"Both files read.","event":"response_delta","index":0}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":200,"output_tokens":6}}
 {"event":"message_complete","index":0}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Read README.md and NOTES.md.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nActive paths (prioritize these):\n- NOTES.md (file)\n- README.md (file)\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"execution_id":"<uuid:2>","id":"call_read_a","input":{"action":"read","path":"README.md"},"name":"File","type":"tool_use"},{"execution_id":"<uuid:3>","id":"call_read_b","input":{"action":"read","path":"NOTES.md"},"name":"File","type":"tool_use"}],"role":"assistant"},{"content":[{"content":"content_hash=\"sha256:41f49bffb38de5ba88945f09121ffc590f9d7f6ff80fdb9ea8ad10224fecea61\"\nconformance fixture","execution_id":"<uuid:2>","tool_use_id":"call_read_a","type":"tool_result"}],"role":"user"},{"content":[{"content":"content_hash=\"sha256:f957b19529906961933c5c30f8713c500a9bb5d9d0695c40d48c97a26a3594ec\"\nsecond file","execution_id":"<uuid:3>","tool_use_id":"call_read_b","type":"tool_result"}],"role":"user"},{"content":[{"text":"Both files read.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"Line truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":1,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":200,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":2,"model_step_index":1,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, extLine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":360,"output_tokens":46},"routed_usage_dropped_records":0,"status":"completed","tool_catalog":"<pinned by the prompt family>","usage":{"input_tokens":360,"output_tokens":46}}
 {"harness_summary":{"model_requests":2,"non_streaming_requests":0,"workspace_after":{".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/plain_answer.golden.jsonl

@@ -1,8 +1,8 @@
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Say hello.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: f6a46d239d58","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: f5cae348cb41","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"event":"message_started","index":0}
 {"delta":"Hello","event":"response_delta","index":0}
@@ -10,6 +10,6 @@
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":120,"output_tokens":4}}
 {"event":"message_complete","index":0}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Say hello.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Ask\nCurrent sandbox posture: workspace-write (writes inside the workspace; network blocked) (local OS sandbox applied)\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"},{"content":[{"text":"Hello there.","type":"text"}],"role":"assistant"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":120,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"Line truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":{"truncated":false,"value":"end_turn"},"last_reported_input_tokens":120,"last_response_tool_calls":0,"last_response_tool_calls_suppressed":0,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"provider_no_tool_call","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"completed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, extLine truncated
 {"event":"turn_complete","parent_route_usage":{"input_tokens":120,"output_tokens":4},"routed_usage_dropped_records":0,"status":"completed","tool_catalog":"<pinned by the prompt family>","usage":{"input_tokens":120,"output_tokens":4}}
 {"harness_summary":{"model_requests":1,"non_streaming_requests":0,"workspace_after":{".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/events/provider_error_after_tool_call.golden.jsonl

@@ -1,13 +1,13 @@
 {"created_at":"<masked>","event":"turn_started","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"engine_session_id":"conformance-session","event":"session_updated","messages":[{"content":[{"text":"Write c0205.txt.","type":"text"},{"text":"<turn_meta>\nCurrent local date: <today>\nCurrent workspace: <WORKSPACE>\nCurrent permission posture: Full Access\nCurrent sandbox posture: full access (sandbox disabled)\n## Repo Working Set\nKey files: README.md\nWhen in doubt, use tools to verify and keep changes focused on the working set.\n</turn_meta>","type":"text"}],"role":"user"}],"model":"deepseek-v4-pro","system_prompt":"<pinned by the prompt family>","workspace":"<WORKSPACE>"}
 {"changed":false,"context_updates":0,"description":"","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"changed":false,"context_updates":0,"description":"frozen: f6a46d239d58","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional timeout in seconds; when omitted the command is killed after 120 seconds.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool name","status":"unknown"},"model_visible":{"status":"known","value":true},"name":{"truncated":false,"value":"bash"},"ordinal":1,"provenance":{"status":"known","value":"builtin"},"strict":{"reason":"request fielLine truncated
+{"changed":false,"context_updates":0,"description":"frozen: f5cae348cb41","event":"prefix_cache_change","last_miss_reason":"","pin_reason":"initial","pinned_combined_hash":"<masked>","stability_pct":100,"system_prompt_changed":false,"tools_changed":false}
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"description\":\"The wider sandbox mode this exact command needs. Use only as a one-shot retry after a sandbox denial; requires justification and user approval in Ask.\",\"enum\":[\"workspace-write\",\"danger-full-access\"],\"type\":\"string\"},\"timeout\":{\"description\":\"Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.\",\"type\":\"number\"}},\"required\":[\"command\"],\"type\":\"object\"}"},"mcp_server":{"reason":"the MCP pool did not attribute this tool naLine truncated
 {"event":"route_dispatched","route":{"auto_model":false,"base_url":"https://api.deepseek.com/beta","billing":{"billing_mode":"metered","dispatched_at":"<timestamp>"},"billing_product":{"kind":"unproven"},"model":"deepseek-v4-pro","provider":"deepseek","provider_identity":"deepseek"},"turn_id":"<uuid:1>"}
 {"category":"invalid_input","code":"invalid_input","event":"error","message":"Model not exist.","recoverable":false,"severity":"error"}
 {"duration_ms":"<masked>","event":"turn_usage","first_token_ms":"<masked>","request_ms":"<masked>","usage":{"input_tokens":120,"output_tokens":0}}
 {"event":"tool_call_started","input":{"action":"write","content":"side effect\n","path":"c0205.txt"},"tool_call_id":"<uuid:2>","tool_name":"File"}
 {"event":"tool_call_complete","result":{"content":"Not executed: the provider stream failed before the model response completed (Model not exist.).","metadata":{"error_category":"model_stream_failed","model_output_incomplete":true,"side_effect_status":"not_started"},"outcome":"ok","success":false},"tool_call_id":"<uuid:2>","tool_name":"File"}
-{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"9ba63a034e00ace25bd09b80c67515c2e966234a72dabbdb426a2fd3d33a28f9","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":12818,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":null,"last_reported_input_tokens":120,"last_response_tool_calls":1,"last_response_tool_calls_suppressed":1,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"failed","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"failed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":false,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user."},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"boolean\"},\"sandbox_permissions\":{\"descrLine truncated
+{"event":"tool_request_snapshot","snapshot":{"active_tool_catalog_sha256":"dea40ffa2f613e639312df9ce2e56ea009939a79b3bf3e3c819e4d6c348b6271","capture_source":"prepared model-client request","delivery_status":"unknown (capture does not prove provider delivery)","omitted_tool_count":0,"payload_json_bytes":13382,"payload_measurement_status":"exact (within 1048576-byte measurement bound)","provider":{"model":"deepseek-v4-pro","provider":"Deepseek","status":"available"},"registry_facts_present":true,"registry_only_tools":{"status":"known","value":{"count":43,"omitted":11,"rendered":[{"truncated":false,"value":"Git"},{"truncated":false,"value":"Run"},{"truncated":false,"value":"Web"},{"truncated":false,"value":"apply_patch"},{"truncated":false,"value":"automation"},{"truncated":false,"value":"diagnostics"},{"truncated":false,"value":"file_search"},{"truncated":false,"value":"fim_edit"},{"truncated":false,"value":"finance"},{"truncated":false,"value":"github"},{"truncated":false,"value":"grep_files"},{"truncated":false,"value":"handle_read"},{"truncated":false,"value":"harness"},{"truncated":false,"value":"image_ocr"},{"truncated":false,"value":"list_dir"},{"truncated":false,"value":"lsp"},{"truncated":false,"value":"note"},{"truncated":false,"value":"notify"},{"truncated":false,"value":"pandoc_convert"},{"truncated":false,"value":"project_map"},{"truncated":false,"value":"registry_sync"},{"truncated":false,"value":"request_plugin_install"},{"truncated":false,"value":"request_user_input"},{"truncated":false,"value":"retrieve_tool_result"},{"truncated":false,"value":"revert_turn"},{"truncated":false,"value":"review"},{"truncated":false,"value":"send_later"},{"truncated":false,"value":"session_get"},{"truncated":false,"value":"session_search"},{"truncated":false,"value":"start_mcp_server"},{"truncated":false,"value":"start_registry_mcp_server"},{"truncated":false,"value":"task_shell_start"}]}},"registry_tool_count":{"status":"known","value":64},"rendered_tool_count":11,"schema_version":1,"step":0,"terminal":{"automatic_compaction_attempts":0,"effective_max_steps":null,"emergency_compaction_attempts":0,"empty_stop_retries":0,"final_report_requested":false,"last_prepared_output_limit_tokens":65536,"last_provider_finish_reason":null,"last_reported_input_tokens":120,"last_response_tool_calls":1,"last_response_tool_calls_suppressed":1,"model_requests_started":1,"model_step_index":0,"permission_denial_rounds_without_progress":0,"permission_strategy_switches":0,"reason":"failed","reasoning_only_reprompts":0,"route_context_window_tokens":1000000,"soft_landing_sent":false,"status":"failed","step_budget_source":"max_steps","stream_resumes":0,"transparent_stream_retries":0,"transport_retries":0},"tool_count":11,"tools":[{"allowed_callers":{"status":"known","value":{"count":1,"omitted":0,"rendered":[{"truncated":false,"value":"direct"}]}},"approval":{"status":"known","value":{"truncated":false,"value":"Required"}},"cache_control_type":{"reason":"request field absent","status":"unknown"},"capabilities":{"status":"known","value":{"count":3,"omitted":0,"rendered":[{"truncated":false,"value":"ExecutesCode"},{"truncated":false,"value":"Sandboxable"},{"truncated":false,"value":"RequiresApproval"}]}},"defer_loading":{"status":"known","value":false},"description":{"truncated":true,"value":"Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandb"},"input_examples":{"reason":"request field absent","status":"unknown"},"input_schema_json":{"truncated":false,"value":"{\"additionalProperties\":false,\"properties\":{\"command\":{\"description\":\"The command to execute. Actual execution shell: `/bin/bash`. Use Bash syntax: pipelines, redirections, $(command), and && / || are supported. Quote paths and variable expansions, such as \\\"$path\\\"; use single quotes for literal text. For literal multiline input, use a quoted heredoc delimiter (<<'EOF') with its closing delimiter on a separate line. Use only installed programs; do not assume GNU-specific flags on macOS/BSD. Example: printf '%s\\\\n' 'sample'.\",\"type\":\"string\"},\"justification\":{\"description\":\"Required with sandbox_permissions: one sentence explaining why this exact command needs wider access.\",\"type\":\"string\"},\"read_only\":{\"description\":\"Set true to run analysis code (including Python/SQLite) with mandatory native filesystem read-only isolation and no network. Available during peer writes. Refused when native enforcement is unavailable; no background, stdin, external backend, or sandbox escalation.\",\"type\":\"bLine truncated
 {"error":"Model not exist.","event":"turn_complete","parent_route_usage":{"input_tokens":120,"output_tokens":0},"routed_usage_dropped_records":0,"status":"failed","tool_catalog":"<pinned by the prompt family>","usage":{"input_tokens":120,"output_tokens":0}}
 {"harness_summary":{"model_requests":1,"non_streaming_requests":0,"workspace_after":{".codewhale/state/subagents.v1.lock":"e3b0c44298fc1c14","NOTES.md":"f957b19529906961","README.md":"41f49bffb38de5ba"}}}

crates/tui/tests/fixtures/conformance/prompt/agent_suggest.golden.json

@@ -2,8 +2,8 @@
   "system_sha256": "8ff744b8ed90564a8c4754ac79cdbaf05df69ed024cc2ec154abfe581ed72d7f",
   "system_bytes": 9183,
   "system_blocks": 5,
-  "tools_sha256": "9808d142bfc2598b935865f370e2d42a52cd3dfcd9678d7c7cc51c3d34ecb610",
-  "tools_bytes": 12818,
+  "tools_sha256": "8e17dd357e63f10e60d98dcdb8e5075d68c5391f47d8822a7d5f7b948325aeec",
+  "tools_bytes": 13382,
   "tool_count": 11,
   "tool_names": [
     "bash",
@@ -18,7 +18,7 @@
     "execute_tools",
     "tool_search"
   ],
-  "prefix_sha256": "bd6f3709ea8d9be4d348d92a673b428aad2e6af5fc6e198cb418de11d13c4b4d",
+  "prefix_sha256": "7af1828555cbefe3de76a15639ff0c4f3a2670dcb9e1a5985b4cc24c7ff41dae",
   "masks": [
     "<WORKSPACE>",
     "<HOME>",

crates/tui/tests/fixtures/conformance/prompt/agent_suggest.tools.golden.json

@@ -1,7 +1,7 @@
 [
   {
     "name": "bash",
-    "description": "Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user.",
+    "description": "Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -26,7 +26,7 @@
           "type": "string"
         },
         "timeout": {
-          "description": "Optional timeout in seconds; when omitted the command is killed after 120 seconds.",
+          "description": "Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.",
           "type": "number"
         }
       },
@@ -147,7 +147,7 @@
   },
   {
     "name": "read",
-    "description": "Read a text file. The whole file comes back in one call when it fits this call's output budget — 100000 bytes by default, raisable to 500000 with max_bytes. There is no line cap. Use offset and limit for an exact line range; when output is budget-limited the footer names the exact offset to continue from. Every response reports the file's byte size, line count, and whether output was truncated.",
+    "description": "Read a file. A text file comes back whole in one call when it fits this call's output budget — 100000 bytes by default, raisable to 500000 with max_bytes. There is no line cap. Use offset and limit for an exact line range; when output is budget-limited the footer names the exact offset to continue from. Every text response reports the file's byte size, line count, and whether output was truncated. A PNG, JPEG, GIF or WebP image comes back as image content you can see (large images are downscaled), including one the user attached from outside the workspace; read an image instead of running OCR or taking screenshots of it.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {

crates/tui/tests/fixtures/conformance/prompt/plan_mode.golden.json

@@ -2,8 +2,8 @@
   "system_sha256": "8ff744b8ed90564a8c4754ac79cdbaf05df69ed024cc2ec154abfe581ed72d7f",
   "system_bytes": 9183,
   "system_blocks": 5,
-  "tools_sha256": "0a6f823e32dd7b667d959b1458be91cd9188f2dae47de54ee617b07c43b87db8",
-  "tools_bytes": 11288,
+  "tools_sha256": "658017d8a796e344a07b247e02fd2d81cd40d6218b1867b299a028220ecc0efe",
+  "tools_bytes": 11852,
   "tool_count": 10,
   "tool_names": [
     "bash",
@@ -17,7 +17,7 @@
     "write",
     "tool_search"
   ],
-  "prefix_sha256": "1419f253b9645bed321d09a125def6966210705ef00fd70dc5da0b0df94a3411",
+  "prefix_sha256": "a9c7253aa5977817d1dd19c2a5fe36a2cab6dff1971bc385b66869344ac0af6b",
   "masks": [
     "<WORKSPACE>",
     "<HOME>",

crates/tui/tests/fixtures/conformance/prompt/plan_mode.tools.golden.json

@@ -1,7 +1,7 @@
 [
   {
     "name": "bash",
-    "description": "Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user.",
+    "description": "Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -26,7 +26,7 @@
           "type": "string"
         },
         "timeout": {
-          "description": "Optional timeout in seconds; when omitted the command is killed after 120 seconds.",
+          "description": "Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.",
           "type": "number"
         }
       },
@@ -147,7 +147,7 @@
   },
   {
     "name": "read",
-    "description": "Read a text file. The whole file comes back in one call when it fits this call's output budget — 100000 bytes by default, raisable to 500000 with max_bytes. There is no line cap. Use offset and limit for an exact line range; when output is budget-limited the footer names the exact offset to continue from. Every response reports the file's byte size, line count, and whether output was truncated.",
+    "description": "Read a file. A text file comes back whole in one call when it fits this call's output budget — 100000 bytes by default, raisable to 500000 with max_bytes. There is no line cap. Use offset and limit for an exact line range; when output is budget-limited the footer names the exact offset to continue from. Every text response reports the file's byte size, line count, and whether output was truncated. A PNG, JPEG, GIF or WebP image comes back as image content you can see (large images are downscaled), including one the user attached from outside the workspace; read an image instead of running OCR or taking screenshots of it.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {

crates/tui/tests/fixtures/conformance/prompt/trusted_project_instructions.golden.json

@@ -2,8 +2,8 @@
   "system_sha256": "cd367daa552060c0b30a60263a509fdd25a0d92c89f24aa9f69c174d52076f3d",
   "system_bytes": 8757,
   "system_blocks": 5,
-  "tools_sha256": "9808d142bfc2598b935865f370e2d42a52cd3dfcd9678d7c7cc51c3d34ecb610",
-  "tools_bytes": 12818,
+  "tools_sha256": "8e17dd357e63f10e60d98dcdb8e5075d68c5391f47d8822a7d5f7b948325aeec",
+  "tools_bytes": 13382,
   "tool_count": 11,
   "tool_names": [
     "bash",
@@ -18,7 +18,7 @@
     "execute_tools",
     "tool_search"
   ],
-  "prefix_sha256": "70ff84fa54a85205846c4655523d4ce75f4a313c102df451949e90450104e147",
+  "prefix_sha256": "5187d49eac3981905f368356f1a2355e311c3a6608c502c23d5564fd91848b1a",
   "masks": [
     "<WORKSPACE>",
     "<HOME>",

crates/tui/tests/fixtures/conformance/prompt/trusted_project_instructions.tools.golden.json

@@ -1,7 +1,7 @@
 [
   {
     "name": "bash",
-    "description": "Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is expressed in seconds; when omitted the command is killed after 120 seconds, so pass an explicit timeout for work expected to take longer. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user.",
+    "description": "Execute a shell command in the workspace and return stdout and stderr. Output keeps the last 2000 lines or 50KB. An optional timeout is the seconds to wait in the foreground (default 120 seconds); a command still running then is never killed for time: it moves to the background and you get its output so far and a task_id, so long builds and tests need no special timeout. Find task_shell_wait with tool_search to read more or wait for it. In Ask, after a sandbox denial, retry the exact command once with sandbox_permissions (the narrowest wider mode that suffices) and a one-sentence justification; the approval prompt asks the user.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {
@@ -26,7 +26,7 @@
           "type": "string"
         },
         "timeout": {
-          "description": "Optional timeout in seconds; when omitted the command is killed after 120 seconds.",
+          "description": "Optional seconds to wait in the foreground (default 120 seconds). A command still running then is not killed: it moves to the background and you get its output so far and a task_id. Find task_shell_wait with tool_search to read more or wait for it.",
           "type": "number"
         }
       },
@@ -147,7 +147,7 @@
   },
   {
     "name": "read",
-    "description": "Read a text file. The whole file comes back in one call when it fits this call's output budget — 100000 bytes by default, raisable to 500000 with max_bytes. There is no line cap. Use offset and limit for an exact line range; when output is budget-limited the footer names the exact offset to continue from. Every response reports the file's byte size, line count, and whether output was truncated.",
+    "description": "Read a file. A text file comes back whole in one call when it fits this call's output budget — 100000 bytes by default, raisable to 500000 with max_bytes. There is no line cap. Use offset and limit for an exact line range; when output is budget-limited the footer names the exact offset to continue from. Every text response reports the file's byte size, line count, and whether output was truncated. A PNG, JPEG, GIF or WebP image comes back as image content you can see (large images are downscaled), including one the user attached from outside the workspace; read an image instead of running OCR or taking screenshots of it.",
     "input_schema": {
       "additionalProperties": false,
       "properties": {

crates/tui/tests/integration/diagnostic_read_only.rs

@@ -475,11 +475,19 @@ fn doctor_text_probe_uses_a_legacy_key_without_migrating_it() {
         String::from_utf8_lossy(&output.stdout),
         String::from_utf8_lossy(&output.stderr)
     );
+    let stdout = String::from_utf8_lossy(&output.stdout);
     assert!(
-        String::from_utf8_lossy(&output.stdout).contains("API connection successful"),
-        "stdout:\n{}",
-        String::from_utf8_lossy(&output.stdout)
+        stdout.contains("API connection successful"),
+        "stdout:\n{stdout}"
     );
+    // The probe runs before the verdict, and the verdict reports its result.
+    let verdict = stdout
+        .find("Ready: the live deepseek API check passed")
+        .unwrap_or_else(|| panic!("verdict must use the probe result\nstdout:\n{stdout}"));
+    let connectivity = stdout
+        .find("API Connectivity")
+        .expect("connectivity section");
+    assert!(verdict < connectivity, "stdout:\n{stdout}");
     let requests = server.received_requests();
     assert_eq!(
         requests.len(),

docs/INSTALL.md

@@ -650,9 +650,10 @@ codewhale doctor --probe-api
 #   · Testing connection...  ✓ API connection successful
 ```
 
-Use `auth status`. Plain `codewhale doctor` does **not** tell you: it prints
-`deepseek: env_source=not inspected` even when the key is set, and it exits 0
-even when no key is found.
+Plain `codewhale doctor` names an environment key it can see
+(`deepseek: env_source=set via DEEPSEEK_API_KEY (value not shown; not checked offline)`)
+but does not read the secret store or check the key; `--probe-api` does both.
+Doctor exits 0 even when no key is found, so scripts should use `auth status`.
 
 ### Remove a stored key
 

docs/READ_MEDIA.md

@@ -14,6 +14,11 @@
 
 - Paste a clipboard image into the composer with the normal terminal paste
   shortcut, or run `/attach <path>` for an existing PNG, JPEG, GIF, or WebP.
+- Drag an image file onto the terminal, or paste its absolute path (plain,
+  quoted, shell-escaped, or as a `file://` URL), and it attaches the same way.
+  A paste becomes an attachment only when every path in it names an existing
+  image; otherwise it stays text. A text-only model gets a notice instead of
+  the image.
 - A visible attachment row appears above the composer before the turn is sent.
   Temporary macOS `NSIRD_screencaptureui` paths are copied into Codewhale's
   stable attachment store when ingested.
@@ -23,6 +28,10 @@
 
 `read_media` is the corresponding agent-side path for inspecting another
 image later in the task without requiring the operator to attach it again.
+The everyday `read` tool also returns a PNG, JPEG, GIF, or WebP as image
+content (downscaled when over the inline limit). Both may open an image the
+user attached from outside the workspace — that exact file, not its
+directory.
 
 ---
 

docs/zh_hans/INSTALL.md

@@ -489,7 +489,7 @@ codewhale doctor --probe-api
 #   · Testing connection...  ✓ API connection successful
 ```
 
-请用 `auth status`。单独运行 `codewhale doctor` **不会**告诉你：即使密钥已设置，它也会打印 `deepseek: env_source=not inspected`；即使找不到密钥，它也以 0 退出。
+单独运行 `codewhale doctor` 会列出它能看到的环境变量密钥（`deepseek: env_source=set via DEEPSEEK_API_KEY (value not shown; not checked offline)`），但不会读取密钥存储或验证密钥；`--probe-api` 会两者都做。即使找不到密钥，doctor 也以 0 退出，所以脚本请用 `auth status`。
 
 ### 删除已保存的密钥
 

scripts/check-blocking-calls-budget.json

@@ -210,7 +210,7 @@
     "std_fs": 2
   },
   "crates/tui/src/image_attach.rs": {
-    "std_fs": 2
+    "std_fs": 5
   },
   "crates/tui/src/import_claude.rs": {
     "std_fs": 2