Merge remote-tracking branch 'origin/main' into cl-6906-compaction-preserves-the-loop-and-drops-the-substance

# Conflicts:
#	CHANGELOG.md

Author: TheGreatAxios

CHANGELOG.md

@@ -21,6 +21,22 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
   closures count against `maxAnchorTurns`. The LLM summary is workflow-aware
   and skips degenerate assistant text.
 
+### Plugins
+
+- **`run_shell` no longer defaults to a 15s timeout.** Omitted timeout arms no
+  timer (match Pi). Pass a per-call `timeout`, or set `shell.timeoutMs` in
+  settings, to bound a command. `shell.maxTimeoutMs` still clamps a resolved
+  timeout and does not invent one on its own. Abort and the output-byte cap are
+  unchanged.
+
+### Sub-agents
+
+- **Sub-agent `maxTurns` no longer hard-caps at 100.** Default remains 30 when
+  unset; values must still be integers ≥1. `task(maxTurns)`, profile
+  `maxTurns`, and `settings.subagentMaxTurns` may exceed 100 for long jobs.
+
+## [0.2.104] - 2026-08-23
+
 ### TUI
 
 - **Taller live chain-of-thought preview.** Parent reasoning still paints
@@ -31,12 +47,81 @@ parallel copies under `docs/` or `scripts/notes/`. At cut time: rename
   unchanged. Assistant mid-turn text continues to grow the open streaming
   assistant row from `inference.text.delta`.
 
-### Fixed
+- **Live agents sit in a chrome strip above the prompt.** Running and
+  finished workers no longer compete with the transcript for vertical
+  space; the strip stays parked over the input, finished rows linger
+  briefly, then it clears when idle. Transcript task-row rewrites pause
+  while the strip owns live status.
+
+### Tools
+
+- **`edit_file` filler args no longer count as a second mode.** Models pad
+  the unused mode with `start_line: 0` / `end_line: 0` / `old_string: ""`.
+  Those now count as absent, so substring vs line-range is chosen from the
+  real fields. Mixed-mode calls still reject, and the error names exactly
+  which fields to drop so a retry can differ.
+
+- **`task` rejections name only the missing field.** A typed brief that
+  omitted `prompt` used to be told both `description` and `prompt` were
+  required, so the model retried the identical call. The error now names
+  the actual gap and echoes the valid field back.
+
+- **Truncation no longer promises a retrievable remainder.** Tool results
+  cut at 80,000 chars now say the discarded tail is gone and re-running
+  yields the same cut, instead of pointing at a `tool-output:///` blob that
+  only held the truncated text.
+
+### Sub-agents
+
+- **Parents and the TUI see why a child stopped.** Forced stops (repetition,
+  stall, deadline, turn-budget, no-progress, operator cancel, thrash) carry
+  a machine-readable `Stopped:` line on the report and a reason on the
+  child's session. Fleet rows announce `<lane> stopped — <reason>` instead
+  of a silent done/cancelled.
+
+- **Repetition detection covers short-phrase, counter, emoji, and
+  zero-width floods.** The periodic window floor drops to 8 chars (with a
+  higher repeat bar so healthy lists stay quiet). A digit-folded pass
+  catches incrementing counters and fence/emoji floods; a contentless-growth
+  check flags streams of invisibles that used to normalize to healthy text.
+
+### Providers
+
+- **Cross-provider replay no longer 400s the rest of the session.**
+  Switching model/provider mid-session used to replay foreign thinking
+  signatures and output-only blocks the new adapter cannot encode. Every
+  adapter now sanitizes persisted history before `buildRequest`: drop
+  unmappable blocks, strip foreign signatures, and synthesize dangling
+  `tool_result`s.
+
+- **Grok and OpenAI Responses set `prompt_cache_key` per session.** Codex
+  already did; xAI and Go Responses did not, so Grok threads cached at
+  ~66–72% versus Codex's 92%+. Parent and each sub-agent thread get a
+  stable, distinct key.
+
+- **TUI first inference waits for Codex instructions refresh.** The TUI
+  used to fire the refresh un-awaited, so turn 2's request prefix could
+  change under a live cache key and force a full miss. Delivery now waits
+  for that promise (non-Codex profiles skip it; a failed refresh still
+  falls back to cached/bundled copy).
 
 - **Codex Responses no longer sends `reasoning.summary: "auto"`.** ChatGPT
   Codex rejects that value for gpt-5.6-terra / gpt-5.3-codex family models
   (HTTP 400 at turn 0). The adapter now sends `{ effort }` only, matching
-  Codex CLI catalog `default_reasoning_summary=none` (CL-6893).
+  Codex CLI catalog `default_reasoning_summary=none`.
+
+- **Codex native tools proxy onto Corbits tools.** `apply_patch`,
+  `exec_command`, and `update_plan` from Codex-family models land on the
+  real file, shell, and `manage_tasks` handlers instead of being rejected
+  as unknown names.
+
+### CI
+
+- **Required checks are `prettier`, `eslint`, `typecheck`, and
+  `build-and-test`.** The old combined `lint` job (cached, continue-on-error)
+  never reported the status contexts the main ruleset required, so every PR
+  sat blocked. Lint result caches are gone in CI; local `bun run lint` still
+  uses `--cache`.
 
 ## [0.2.103] - 2026-08-23
 

docs/ARCHITECTURE.md

@@ -106,7 +106,7 @@ In TUI chat mode there is no completion gate — the session stays open across t
 Two directors, selected by role:
 
 - **ChatDirector** (interactive, `src/agent/director.ts`) — Extends `DefaultDirector` with task list tracking, workflow nudges, LSP auto-activation, and multi-turn chat semantics. It never terminates the session: operator declines are surfaced as replies and the reactor stays alive for the next message. Auto mode is toggled by CLI flags (`--auto` / `--no-auto`); there is currently no in-session key to toggle it (default on; constrained envelope — workspace writes and unconstrained shell auto-allow; installs, recursive rm, force/uncontained worktree changes, sensitive-path and opaque-wrapper shell still ask; contained non-force `git worktree add`/`remove`/`prune` and `list` auto-allow; shell file-mutation denied). It is not a separate edit/plan mode.
-- **SubAgentDirector** (delegated work, `src/subagent/index.ts`) — Drives a dispatched worker until a turn arrives with no tool calls, then replies with the final assistant text and ends the run. A tool-less turn **after tools** completes only with the four-heading envelope (Summary, Findings, Blockers, Paths); a missing envelope nudges once then salvages as **incomplete-report**. A tool-less completion with **zero tool calls in the entire run** is returned as a **never-acted** salvage report (not a successful implement). When `task(intent="implement")` is set, a tool-using run that never wrote/edited/deleted a file is returned as **never-edited** instead of complete — so a pure-explore "plan" cannot look shipped to the parent (tracked via `thrashState.editedPaths` from `edit_file` / `write_file` / `delete_file`). Explore/read-only workers that used tools then replied with findings remain normal completes. Hard stops also fire after 5 consecutive identical tool-call fingerprints (**no-progress**, mirroring the director-level `IDENTICAL_REPEAT_MIN` threshold), on progressive re-read pressure (**thrash** — the same path re-read past a limit amid enough tool volume, tracked by `src/subagent/thrash.ts`), or after the leaf turn budget (**turn-budget**, default 30, overridable via `task(maxTurns)`, agent profile `maxTurns`, or `settings.subagentMaxTurns`, capped at 100), each returning a structured salvage report (reason, partial findings, blockers) so a thrashing child cannot burn tokens indefinitely. Before hard thrash, a one-shot **re-read-nudge** fires when re-read pressure crosses a soft threshold (default 3 same-path reads with enough tool volume, still below the hard re-read limit of 4): the director injects an ephemeral redirect — implement leaves are asked to edit or wrap up; explore leaves are asked to expand findings / change approach / report, never forced into edit — then keeps running so hard thrash remains reachable if the leaf ignores it. A fourth hard stop, **repetition**, is detected outside the director entirely:
+- **SubAgentDirector** (delegated work, `src/subagent/index.ts`) — Drives a dispatched worker until a turn arrives with no tool calls, then replies with the final assistant text and ends the run. A tool-less turn **after tools** completes only with the four-heading envelope (Summary, Findings, Blockers, Paths); a missing envelope nudges once then salvages as **incomplete-report**. A tool-less completion with **zero tool calls in the entire run** is returned as a **never-acted** salvage report (not a successful implement). When `task(intent="implement")` is set, a tool-using run that never wrote/edited/deleted a file is returned as **never-edited** instead of complete — so a pure-explore "plan" cannot look shipped to the parent (tracked via `thrashState.editedPaths` from `edit_file` / `write_file` / `delete_file`). Explore/read-only workers that used tools then replied with findings remain normal completes. Hard stops also fire after 5 consecutive identical tool-call fingerprints (**no-progress**, mirroring the director-level `IDENTICAL_REPEAT_MIN` threshold), on progressive re-read pressure (**thrash** — the same path re-read past a limit amid enough tool volume, tracked by `src/subagent/thrash.ts`), or after the leaf turn budget (**turn-budget**, default 30, overridable via `task(maxTurns)`, agent profile `maxTurns`, or `settings.subagentMaxTurns`; floor ≥1, no hard upper cap), each returning a structured salvage report (reason, partial findings, blockers) so a thrashing child cannot burn tokens indefinitely. Before hard thrash, a one-shot **re-read-nudge** fires when re-read pressure crosses a soft threshold (default 3 same-path reads with enough tool volume, still below the hard re-read limit of 4): the director injects an ephemeral redirect — implement leaves are asked to edit or wrap up; explore leaves are asked to expand findings / change approach / report, never forced into edit — then keeps running so hard thrash remains reachable if the leaf ignores it. A fourth hard stop, **repetition**, is detected outside the director entirely:
   `runSubAgent`'s stream sink watches the streamed text of the in-flight cycle for degenerate token loops (`src/subagent/repetition.ts`) — format chars (ZWSP, BOM, bidi marks, soft hyphen, …) stripped then whitespace-collapsed raw text, a smallest-period KMP check over the probe tail, default window >= 16 chars repeated >= 8 times, evaluated every 256 streamed chars — and on a hit aborts the run controller mid-cycle, returning a `repetition` salvage report that leads with the looped window and warns the parent against re-dispatching the identical brief. `inference.thinking.delta` is sampled the same way on its own buffer, but with digit runs folded to one placeholder and a shorter window (>= 4 chars repeated >= 32 times), gated to periods <= 16 chars once folded: thinking is never rendered to the user, so a monotonic counter (e.g. `0/1 1/2 2/3 …`, which stays non-periodic and escapes the raw-text check) can be caught, but folding still erases real information — a healthy templated enumeration line becomes byte-identical to its neighbors once digits are erased, so the period-length cap only lets counter-shaped folded periods (a handful of chars) through and refuses the much longer periods a folded prose line produces. Because directors only see completed turns, this is the only stop that can catch a loop inside a single turn that never finishes. A one-shot **report-forced** signal fires a few turns before the cap while the leaf is still tooling — it is not a stop: the director injects a wrap-up nudge and lets the leaf finish on its own, so turn-budget stays reachable for a leaf still making progress. When both report-forced and re-read-nudge apply, report-forced wins (near-budget wrap-up is more urgent than a mid-run redirect). Operator/parent cancel after any progress likewise returns a **cancelled** salvage report (partial findings + tool activity) instead of a bare cancel string; cancel before progress still surfaces as cancelled-by-operator.
   Optional `task(tier=)` (`fast` | `standard` | `clever`) overrides profile inference, profile tier, and the parent provider for that spawn only, and fails closed when the tier is unconfigured. The parent `task` tool keeps a session-scoped brief-dispatch ledger (`src/subagent/brief-dispatch.ts`): fingerprints cover prompt + agent + intent + success_criteria + do_not (not maxTurns/description/tier). After thrash / no-progress / repetition / never-acted / never-edited salvage, an identical re-dispatch is hard-blocked for the rest of the parent chat; change at least one fingerprint field to force a re-run. Turn-budget salvage still invites a higher maxTurns for a few same-brief retries without a successful complete, then flips the parent hint to stop and change approach (soft — further identical dispatches are still admitted). A successful complete resets the same-brief retry budget.
 
@@ -354,7 +354,7 @@ tool call
 - **Secret Guard** (`secret-guard-plugin.ts`) — Hard-denies path-keyed tool calls (`read_file`, `write_file`, …) that would put a sensitive file into (or write it from) the model context. Runs before the permission plugin, so the path-arg deny holds even under `--dangerously-skip-permissions`. Shell commands that _reference_ a sensitive path (tokenized so `cat .env`, `bun --env-file=.env run …`, and quote/env-assignment forms are detected) are not hard-denied here: they require operator approval via the permission gate, and auto mode forces an ask through the auto-shell policy (`sensitive-path` rule). Once the operator approves, the command runs. Shell detection is best-effort: token matching defeats quoting and env-assignment/redirection forms but not dynamic path construction (variable indirection, `printf` assembly). Tool-result secret scrub still redacts credential-shaped output.
 - **Authorization** (`run-shell-authz.ts`, wired by `authz-plugin.ts`) — Denies catastrophic shell command patterns by regex, and hard-blocks shell `find`, head-position `rg`, and recursive `grep -r` (they can walk huge trees and OOM the host). Bounded `grep`/`search_files` tools remain practical alternatives (timeout + output caps); the patterns match those three command shapes only — an `ls -R`, `fd`, or scripted `os.walk` is just as unbounded and is not caught, so the block message tells the model not to substitute one. The permission gate’s shell auto-allow path consults the same policy so it never pre-approves a command authz would reject.
 - **Permission** (`permission-plugin.ts`) — Delegates consequential calls to the permission gate.
-- **Shell Guard** (`shell-guard-plugin.ts`) — Corbits Code-only replacement for stock `run_shell` (interchange stays unpatched): 15s default timeout, 512KB display cap with head+tail retention (the process keeps running when the cap is hit), process-group kill on timeout/abort only. Also applies a 10s wall-clock budget to `grep`/`search_files`.
+- **Shell Guard** (`shell-guard-plugin.ts`) — Corbits Code-only replacement for stock `run_shell` (interchange stays unpatched): no built-in default timeout (optional per-call or `settings.shell.timeoutMs`; `maxTimeoutMs` clamps only a resolved timeout), 512KB display cap with head+tail retention (the process keeps running when the cap is hit), process-group kill on timeout/abort only. Also applies a 10s wall-clock budget to `grep`/`search_files`.
 - **Read File Guard** (`read-file-guard-plugin.ts`) — Corbits Code-only short-circuit for `read_file` on real filesystem paths and configured `tool-output://` URIs (interchange stays unpatched): streaming reads that never decode the whole file in one pass, caps model-facing output at 50KB, defaults to 2000 lines, truncates long lines with recovery hints, samples the first chunk to reject binary, and stops at an 8MB scan ceiling. Emits `offset` continuation notices so the model can page without losing file or spill content on disk.
 - **Verify** (`verify-plugin.ts`) — Re-reads after `write_file` / `edit_file` and errors on mismatch. Per-path serialization (`file-mutation-lock.ts`) prevents parallel edits on one file from tripping verification.
 - **Edit file line range** (`edit-file-line-range-plugin.ts`) — Corbits Code-only short-circuit for `edit_file` mode B (`start_line`/`end_line`/`new_string`), same pattern as shell-guard; schema advertised via `advertiseEditFileLineRange`. Modes are mutually exclusive: a call supplying both `old_string` and `start_line`/`end_line` is rejected with a recoverable error naming which fields to omit (no file-content disambiguation).

docs/IMPLEMENTATION.md

@@ -246,7 +246,7 @@ Provider and model configuration lives in JSON settings files. The global file h
 
   On expiry the call returns a normal tool-error result ("MCP tool `<name>` timed out after `<n>`s — the server may be wedged; retry or continue without it") that the model can react to; the turn itself is never aborted. `tools.maxTimeoutMs`, if set, still caps `mcp.timeoutMs`.
 
-  Optional `subagentMaxTurns` (integer **1–100**, default **30**) sets the default inference-turn budget for dispatched workers (not the parent chat session limit). Per-dispatch `task(maxTurns)` and agent profile `maxTurns` override this default; values above **100** are rejected on `task` and clamped for profiles. Always applies — the primary session is always orchestrator-capable (CL-5814).
+  Optional `subagentMaxTurns` (integer **≥1**, default **30**) sets the default inference-turn budget for dispatched workers (not the parent chat session limit). Per-dispatch `task(maxTurns)` and agent profile `maxTurns` override this default; there is no hard upper cap (values are floor-sanitized to ≥1). Always applies — the primary session is always orchestrator-capable (CL-5814).
 
   Optional `sessionMode` is **deprecated**. Legacy values (`single` | `orchestrator`) may still appear on disk and load without error; resolve always returns **orchestrator**. There is no first-run mode picker and no Settings row. Both the interactive TUI (`runTUI`) and the non-TUI product path (`runExec` / `corbits exec`) are orchestrator-only. Exec bootstrap is otherwise a forked copy of the TUI path (shared stack, intentional deltas documented under Architecture → Exec Runner).