Every Orca release, in order.

Goal Mode no longer has a fixed outer-turn or continuation ceiling. RuntimeHost admits the next turn from semantic state, cancellation, pending interactions, workflow ownership, progress, and token budget; continuation_count remains only persisted ledger and event telemetry. This removes the false Paused(NoProgress) terminal that could appear after 64 otherwise valid turns without weakening budget, stall, or user-control boundaries.

Goal Mode now has one runtime owner for lifecycle, continuation admission, cancellation, recovery, usage, and persistence. Terminal model claims are typed intents audited at turn end, SQLite replaces direct JSON mutation with migration and crash recovery, and role-safe context plus semantic events keep TUI and ACP projections consistent. Five real DeepSeek scenarios verify completion, rejected completion, genuine blocking, cancellation, and resume with no stale continuation or in-flight run.

ACP initialization now reports the Orca binary release version from RunConfig instead of the internal orca-runtime crate version. Integration coverage also isolates ORCA_HOME, verifies that each session keeps its requested working directory, and exercises cancellation arriving before the hosted operation handle is installed.

Orca now exposes an additive Agent Client Protocol adapter over stdio with --mode=acp. ACP sessions and prompts project directly onto RuntimeHost threads and hosted turns, EventEnvelope streams become standard session/update notifications, and cancellation reaches the active Generation Fence through OperationHandle. The existing internal JSONL server protocol remains unchanged.

Goal Mode control tools now execute through the runtime that advertised them. get_goal, create_goal, and update_goal use the recorded session and live extension context before any normal-tool worker boundary, with the old thread-local callback removed. Invalid model arguments remain recoverable, while missing control-plane ownership or persistence failures stop one turn, atomically stall an active goal, and clear stale Goal context. A billed DeepSeek gate verifies one non-goal tool, exactly one terminal update_goal call, and zero eligible continuations.

Approval modes now match their execution boundaries: auto-edit runs autonomously inside the workspace sandbox, while full-auto combines automatic approval with danger-full-access and no post-failure sandbox escape prompt.

macOS Sequoia sandbox shell resolution is fixed. sandbox-exec invocations now use /bin/sh instead of bare sh, bypassing the /private/var/select/sh kernel lookup that macOS 15 blocks inside a seatbelt sandbox. This eliminates the spurious Unsandboxed Shell Required approval prompt that appeared on every tool call in full-auto mode.

Linux fail-closed enforcement is now scoped to strict restricted-read policies, so untrusted-folder and strict read-only modes still refuse to run when neither bubblewrap nor Landlock can enforce them. Non-strict capability modes (workspace write and global read-only) keep their established Landlock-plus-seccomp or plain compatibility fallback when a policy needs bwrap-only features and no bwrap is on PATH, matching the reference agents' fail-open-for-built-ins behavior. The release test runner no longer installs bubblewrap, so CI exercises the Landlock plus seccomp fallback path directly.

Linux command isolation now prefers bubblewrap for mount, namespace, capability, and network boundaries, then falls back to Landlock plus seccomp when the policy is expressible. Strict restricted-read policies refuse to run when neither backend can enforce them. Folder trust persists user decisions outside the repository: untrusted folders do not load project config, instructions, skills, or named workflows and receive a read-only, no-network default, while explicit capability modes, permission rules, and network-proxy grants keep their existing authority. Runtime lifecycle tests now use an explicit danger-full-access capability profile, proving that this established override remains authoritative without weakening the Linux fail-closed default.

Foreground subagents now have one runtime-owned invocation lifetime for admission, child cancellation, worker join, panic classification, schema validation, worktree completion, usage, and exactly-once terminal selection. Interrupting a synchronous delegation waits for child cleanup before the turn settles or the next prompt starts, while a child panic becomes an indeterminate result instead of escaping RuntimeHost. Async delegation now projects its durable task to the TUI immediately without creating an unmatched foreground lifecycle; atomic PID adoption prevents a fast worker from being overwritten, and foreground interrupt remains independent from explicit task_stop cancellation. The inline single-child loop, scoped batch runtime, duplicate formatting, stale adoption path, and source-shape ownership tests are removed; cross-process leases and stale-owner takeover remain P1.4.

Sequential normal tools now run as runtime-owned child lifetimes. RuntimeToolCallRuntime owns admission, started state, cancellation policy, the worker, join, panic classification, permission deltas, and the exactly-once terminal while bounded typed bridges carry output, approval, and MCP elicitation. Interrupting bash, external tools, or MCP calls waits for cleanup before the turn settles or the next prompt starts; WaitForTerminal preserves an observed mutation, and a worker panic after start becomes indeterminate. Turn permission grants are merged before later sibling calls. The borrowed normal executor, fallback owner, inline path, and source-shape tests are removed; subagents remain the explicit P1.2c boundary.

Interrupting a TUI or server turn now reaches parallel read-only tool calls that have already started, waits for every worker and transport to clean up, and only then publishes the operation terminal or admits the next prompt. RuntimeToolCallRuntime owns each invocation's concurrency permit, cancellation, started state, blocking task, join, panic classification, and exactly-once terminal while preserving provider order. MCP resource list, template, and read requests are cancellable; stdio reconnects after cancellation and SSE remains reusable. The old orca-tools batch scheduler is removed. Normal tools and subagents remain explicit P1.2 follow-ups.

A submitted prompt now has one admission owner and one durable user row. Hosted turn preparation persists the identified user message before committing it to model context, while agent-loop bootstrap explicitly distinguishes owned child-agent conversations from borrowed hosted sessions and never replays borrowed initial history. Live thread reads, turn pagination, item pagination, cold ThreadStore reads, restart, and resume now expose one user item per logical turn with stable turn and item ids. Existing duplicate history remains readable without a projection-time deduplication layer.

Completed DeepSeek responses now have one durable canonical fact. Agent-message, reasoning, and proposed-plan ids are allocated before streaming and stay identical through live projection, approval suspension and continuation, restart, pagination, and resume. Runtime persists one typed model.response.completed event instead of a second assistant record, and model replay plus ThreadStore history reduce that same event. Legacy combined assistant records remain readable through one isolated reducer, while malformed current completions fail closed. The real DeepSeek gate now compares complete persisted item objects and internal/external ids across processes.

Recorded conversations now keep opaque turn and item identities across reload, resume, compaction, repair, pagination, rename, archive, and compression. Logical turn ids are separate from runtime task ids, so concurrent first turns cannot collide in server control routing. New records use typed UUIDv7 identities, tool and workflow items retain their domain ids, and legacy histories remain readable through one isolated fallback. A real DeepSeek gate now records a turn, restarts the process, resumes the same thread, and proves both context continuity and stable prior ids.

The production TUI now runs foreground turns, interrupted streams, approvals, user input, MCP elicitation, background providers, and saved workflows through one process-owned RuntimeHost. RuntimeHost owns cancellation, joins, terminal events, usage commits, and shutdown cleanup; the duplicate TUI provider/tool/workflow loops and TaskSupervisor are removed. A cancelled live DeepSeek stream releases the foreground operation and the next submit starts cleanly, while repeated idle Goal refreshes no longer duplicate the same notice.

Runtime now has a process-owned RuntimeHost and one bounded ThreadActor per conversation, with typed operation handles and completion terminals so headless and TUI turns share one ownership boundary. Structured @ mention bindings now resolve exact files, skills, plugins, and MCP resources, recover rejected submissions, and keep mention search and history isolated from user data. TUI selection, clipboard, input history, status formatting, and submission hints are also refined.

Server turn cancellation is now generation-owned. Interrupt permanently cancels the current DeepSeek execution; resume waits for it to return, starts a fresh scope on the same logical turn id, and never appends the original prompt twice. Permission, user-input, and MCP waiters are cancellation-aware and generation-fenced, stale steer and responses are rejected, and a replaced generation cannot publish stale cancellation errors or a stale terminal event. The first interaction request id remains compatible; resumed generations receive an internal generation suffix. A real DeepSeek gate interrupts after the first stream delta and verifies one successful terminal event.

Every submitted TUI turn, manual compaction, Goal operation, and approved background continuation now receives a fresh one-shot cancellation scope with a stable operation id. Esc and Ctrl+C cancel only the active scope, so interrupting a DeepSeek stream cannot be undone by a later reset or leave the next turn born cancelled. All production TUI reset calls are gone, and an agent-loop behavior test cancels a delayed first turn before proving that a second submit gets a different scope, produces output, and completes successfully. CLI arguments, TUI keys and flows, server JSONL, persisted records, and DeepSeek behavior remain compatible. The server turn/resume reset path remains an explicit actor-owned follow-up rather than a permanent compatibility layer.

The TUI now admits runtime events through a 256-item mailbox and user actions through a 64-item mailbox with blocking backpressure, so a slow or paused renderer cannot grow an unbounded queue and admitted output, approvals, errors, and terminal state keep FIFO order. Runtime compaction and approved background continuation project the original typed EventEnvelope through EventObserver instead of serializing JSONL into a partial-frame buffer and parsing it back. Provider streaming, mention catalog refresh, and silent child-agent event disposal also use explicit bounded ownership, with the silent drain thread joined before return. CLI/server JSONL, persisted records, DeepSeek behavior, TUI keys, and interaction flows remain compatible.

Network-restricted TUI bash and server command sessions now own every proxy connection through one managed supervisor. Admission is capped at 32 concurrent connections; excess clients receive a bounded connection-limit response instead of spawning another worker. Request and header framing is bounded before parsing, network-block reports use a fixed-capacity non-blocking queue, and DNS lookup, upstream connect, and socket I/O have explicit deadlines. Stopping a command, cancelling a turn, or dropping the proxy stops admission, aborts and awaits every active connection, closes both ends of CONNECT tunnels, and joins the supervisor thread. CLI flags, permission profiles, proxy environment variables, TUI flows, server/JSONL shapes, and persisted records remain compatible.

Every accepted tool invocation now reaches one truthful terminal result, including interruption, pre-execution rejection, and siblings that never started. Incomplete legacy history is repaired as indeterminate without replaying old calls. Ordinary process stdout and stderr are capped at 1 MiB per stream, while file reads and exact edits reject non-regular, binary, invalid UTF-8, growing, and oversized inputs before unsafe admission. External tools, MCP servers, workflows, async subagents, verifier commands, server turns, shells, and search managers now have explicit cleanup or reaper ownership; MCP and WorkflowHost transports and shutdown paths are bounded; observed completion wins cancellation and timeout races; and internal worker API keys no longer persist or appear in process arguments. Windows descendant-tree parity, a total WorkflowHost deadline, and a managed-proxy connection ceiling remain follow-up work.

The Orca TUI gains native-feeling mouse text interaction. Drag over the transcript to select text with an editor-style theme-aware highlight that preserves syntax foregrounds; releasing the button copies the selection to the system clipboard through OSC 52 (VS Code, iTerm2, kitty, WezTerm, and SSH sessions) with a pbcopy fallback on macOS, and a transient `copied N chars to clipboard` notice appears on the status line. Selections are anchored in content space rather than screen space, so streaming output and scrolling never shift what was selected. Soft-wrapped prose copies back as one line with the wrap-dropped whitespace restored, while hard-split long words such as URLs stay unbroken. Double-click selects the word under the cursor and copies it immediately; dragging onto the transcript's first or last row auto-scrolls on the animation timer so the selection keeps growing while the pointer sits still; and a floating `Jump to bottom` pill appears whenever auto-follow is disarmed and re-arms it on click. The obsolete `shift+drag to copy` status hint is gone, and the mouse wheel keeps its existing scroll behavior.

Orca's `@` mention now spans multiple workspace roots and every candidate kind at once. `orca-file-search` sessions accept one or more roots, so equal relative paths from different roots stay distinct while browse, fuzzy, exclude, Git-ignore, cancellation, and million-path bounds keep working unchanged. Files, Skills, Plugins, MCP Resources, and Resource Templates now share one typed `MentionCandidate`/`MentionTarget` model with stable ids derived from the full target rather than display text, so same-name results never collapse. Selecting a candidate records a hidden atomic binding: it rebases across earlier edits, invalidates on overlapping edits, and expands the exact selected root, Skill path, plugin manifest, or MCP resource at submission time instead of re-resolving visible text. The Codex-compatible `fuzzyFileSearch/*` app-server contract now takes explicit multi-root input, and a new thread-bound `mention/search/*` contract discovers and expands candidates against a live thread's own workspace roots and MCP registry. TUI and app-server submissions share the same expansion and validation code, legacy unbound `@file`/`$skill` input remains valid, and search-session reapers are retained and joined on stop/shutdown so late output can never race a stopped session.

DeepSeek turns that end without visible content or a tool call now receive one bounded semantic recovery request instead of an identical replay. The request-local correction preserves valid tool-call reasoning and tool results, never persists the incomplete response, avoids replaying recovery reasoning already shown in the TUI, and preserves usage reported by both attempts. Foreground budgeted requests use serialized admission and later-turn preflight, while detached completions persist priced usage and redacted diagnostics through the task-correlated background_task.provider_response record without overwriting global session completion. Resume accounting now uses session.usage_baseline, and Goal tokens count input plus output without adding cache hits twice. The release also updates the tag-driven GitHub Actions pipeline to current v5 artifact, checkout, and Node setup actions.

The TUI now keeps long sessions compact across the full interaction loop. Large pastes stay collapsed in the composer and transcript while the complete prompt reaches the model; Goal objectives and notices, task-plan steps, and tool targets use display-width-aware ellipses; long approval content cannot push decisions away; slash and file menus follow the selected row; and the responsive footer preserves permission mode and context before optional metadata. Permission modes now use blue, violet, red, and teal semantic accents.

macOS Seatbelt now lets sandboxed test runners signal only their own child workers, so Vitest, Tinypool, Jest, and similar pools can clean up after failures and shutdown. The incident behind this fix left 10 Node workers using 40.51 GiB while Orca native used about 30.2 MiB and its npm wrapper about 11.8 MiB; it was not an Orca transcript-heap leak. Workspace-write and read-only profiles keep unrelated processes outside the signal boundary.

Unknown or malformed DeepSeek function names now become recorded, failed tool results that the model can correct inside the same agent turn instead of terminal provider errors that pause Goal mode. Orca preserves the original call id, name, and raw arguments across streaming and non-streaming responses, but never infers or executes bash from command-shaped names; registry validation rejects them before approval, hooks, task creation, or execution.

Active Goal activity time now stays cumulative across automatic continuations by combining persisted completed-turn time with the current turn delta. /goal resume preserves the objective, budget, token usage, elapsed time, and creation timestamp; same- and cross-session restoration use one atomic migration with an occupied-target guard and unchanged state on failure. Restored history projects the preserved Goal before TurnStarted so the first running frame includes the persisted base.

TUI context compaction now has a visible, interruptible lifecycle. Automatic soft-limit, hard-limit, and prompt-too-long recovery show Compacting context before hooks or remote summary work; manual /compact uses the same state. Ctrl+C, Esc, and Ctrl+G cancel hooks and the streaming DeepSeek summary, while completion appears only after persistence and post-compact hooks finish. DeepSeek header waits, retry delays, error-body reads, and SSE reads now race cancellation through a joined provider worker, including between events from one SSE frame. Malformed or prematurely ended streams fail explicitly and retry only before visible output; malformed JSON for a known tool is preserved, validated before approval, hooks, task creation, or execution, and returned as a corrective tool failure. Older compacted events remain compatible.

TUI resume now drops legacy reasoning-only assistant turns before replaying history to DeepSeek. New provider responses that contain reasoning but no visible content or tool calls are retried instead of being persisted, while valid reasoning attached to tool calls remains intact. The release gate now exercises this malformed-history recovery against the real DeepSeek API.

Server-mode MCP elicitation now matches the TUI interaction path. When an stdio MCP tool sends elicitation/create during a turn, Orca emits a turn-scoped mcp_elicitation_request event, accepts mcp_elicitation/respond by requestId, writes accept/decline back to the MCP server, and then continues the original tool call. turn/interrupt now cancels unanswered MCP elicitation prompts, MCP transport cancellation returns promptly across stdio and SSE paths, and server shell/list stops reaping command/exec-owned backing shells.

Runtime task output now flows through a bounded, UTF-8-safe task-output store. Long-running TUI bash and command/exec sessions avoid unbounded stdout/stderr retention, command/exec streaming keeps cumulative output caps correct after retained-output rebases, and terminal command paths evict retained output after completion, stop, or permission denial.

TUI scroll performance gets a full overhaul so long sessions stay responsive. A frame scheduler coalesces wheel events and caps per-batch processing, message rendering flows through a version-based cache instead of redrawing the whole transcript each frame, and a virtual viewport renders only the visible messages. Scroll offsets widen to usize so sessions past 65,535 lines scroll correctly, and the bottom status line drops the scroll: N/total indicator.

TUI keyboard handling now runs through a context-aware shortcut resolver. Global, composer, running-turn, and approval-dialog keys keep the same behavior, but the resolver, tests, and shortcut help path now share one binding boundary so future keymap and task-control changes are easier to verify.

TUI compacted-context notices now keep the runtime compaction reason and strategy. Long DeepSeek sessions can show when Orca compacted near the token limit, at the hard limit, or after prompt-too-long recovery, including the collapsed message count, instead of only showing a generic before/after message total.

TUI automatic compaction and prompt-too-long retry recovery now run through the runtime compaction boundary. The visible context meter, compacted-context notice, and failed compaction errors keep the same TUI shape, but the main TUI loop no longer owns context-pressure decisions or retry state, reducing drift from server and child-agent compaction paths.

Command/exec sandbox and permission-profile resolution now lives behind a focused server module instead of the generic server loop. TUI bash and server command/exec still share the same sandbox behavior and JSON wire shapes, while the permission-profile boundary is easier to test before future network, filesystem, and task-control changes.

Core now owns the reusable thread-item projection types for user, persisted, assistant-message, proposed-plan, and reasoning transcript items. Runtime projection still emits the same TUI/server JSON, but live streams, active steer messages, and resumed history now share one typed item boundary before serialization, reducing drift in the transcript cards users see.

TUI proposed plans now render as their own scrollback message instead of leaking <proposed_plan> tags into assistant text. The server and TUI share one UTF-8-safe parser, so split tags and Chinese streaming text keep the same tested behavior across local TUI and server projection.

Server command/exec network-policy denials now use the same runtime permission evaluation boundary as TUI bash. Requestable blocked hosts still open the existing permission-request and retry flow, while configured denylist hosts now surface a clear policy-denial error instead of falling through as an unpromptable missing request.

TUI bash network-policy denials are now explicit. Runtime permission policy returns a structured Request or Deny evaluation for network blocks, so requestable hosts still open the normal approval flow while configured denylist blocks end as a clear denied tool result instead of being represented as a missing prompt.

TUI MCP tool calls can now surface real stdio elicitation requests instead of silently dropping them. When an MCP server sends elicitation/create during a tool call, Orca projects the URL or form request through the runtime pending-interaction store, shows a TUI waiting-input prompt keyed by the runtime id, writes accept or decline back to the server, and then continues the original tool call.

DeepSeek tool-call compatibility gets hardened. update_goal and update_plan normalize the status aliases and boolean status flags DeepSeek emits before validation, the glob and update_goal JSON Schemas support nullable/anyOf parameters, and tool validation errors now list the allowed and required properties. The system prompt stops inlining full tool schemas in favor of concise examples, and the line adds reasoning-content replay, a tool-count cap, and empty-response retry for DeepSeek turns.

Server interactive responses now stay with their focused processors. permission/respond resolves pending permission grants inside the permission processor, user_input/respond resolves runtime user-input waiters inside the user-input processor, and ownership tests guard that the generic server module does not reclaim those response paths.

Permission approval dialogs now name the requested risk directly. Network blocks, filesystem write grants, and unsandboxed shell retries keep their runtime permission kind through pending interactions, so the TUI modal can show Network Permission Required, Filesystem Permission Required, or Unsandboxed Shell Required instead of a generic approval title. request_permissions also reaches the runtime permission handler instead of being intercepted as an ordinary tool approval, making TUI and server permission grants more reliable.

RuntimeProviderResponseStep now consumes RuntimeProviderResponseInput directly instead of flattening the response handoff. Child-agent executors travel through RuntimeProviderResponseExecutors, so provider final-message and tool-turn dispatch keep one named response boundary while behavior stays unchanged.

RuntimeProviderTurnStep now receives provider-call state through a named RuntimeProviderTurnInput. Provider-turn I/O refs live behind RuntimeProviderTurnIo, so conversation, history, events, sink, and cost tracking are handed into provider execution as one boundary while provider behavior stays unchanged.

RuntimeProviderResponseInput now carries provider-response I/O refs through a named RuntimeProviderResponseIo bundle. RuntimeTurnKernel assembles events, sink, conversation, history, cost tracking, and background workflow handles as one handoff, and provider response handling destructures that bundle only at the execution boundary.

RuntimeProviderCycleInput now reuses RuntimeStepCapabilitySnapshot for provider-cycle capability refs. runtime_turn_iteration assembles that bundle once, provider_turn passes it into RuntimeStepContext without expanding flat capability fields, and provider/tool behavior stays unchanged while the provider-cycle boundary gets smaller.

RuntimeStepSnapshot now carries request-scoped capability refs through a named RuntimeStepCapabilitySnapshot. Tool dispatch reads instructions, memory, MCP registry, hooks, cancel state, task registry, workflow IPC, and interaction handlers through that capability bundle, keeping provider/tool behavior unchanged while shrinking the next Codex-style step-context boundary.

Runtime request_user_input handling now shares RuntimeTurnInteractionState with permission requests. ThreadTurnRequest can carry a runtime user-input handler, the provider/tool cycle passes it through RuntimeStepSnapshot and ToolExecutionContext, and RuntimeToolRouter treats request_user_input as a runtime special dispatch instead of a normal tool fallback.

Runtime turn-scoped interaction handlers now flow through RuntimeTurnInteractionState. AgentLoopContext, runtime_turn_loop, and runtime_turn_iteration carry the permission-request handler through one grouped boundary, preserving current approval behavior while preparing request-user-input and other interaction waiters to share the same turn-owned surface.

RuntimeStepContext now carries request-scoped runtime inputs through a named RuntimeStepSnapshot. Provider response handling reads final-response settings through the snapshot, and tool dispatch splits the step context into snapshot plus extension binding before routing normal, readonly, workflow, and subagent tool turns.

Runtime directives now flow through a named RuntimeCapabilitySnapshot. Switch-model, allowed-tool, and runtime system-message patches share one capability contract, and RuntimeDirectiveState exposes that snapshot so later skill, hook, MCP, and tool-policy work can derive from the same state surface.

RuntimeTurnKernel now owns turn-loop state assembly as an instance handoff. RuntimeTurnState creates the kernel from scoped extension stores and asks that instance to build RuntimeTurnLoopState, while shared extension stores keep the kernel-owned borrow boundary compatible with the loop state it hands forward.

RuntimeTurnKernel now assembles the lifecycle-owned RuntimeTurnLoopState. RuntimeTurnState no longer expands loop runtime and extension-state fields itself, continuing the turn-state consolidation started around provider response handling.

RuntimeTurnKernel now assembles the provider-response input object itself. Provider response handling no longer exposes kernel-owned sampling state or step-context binding as separate fields, tightening the turn-state handoff while preserving behavior.

RuntimeTurnKernel now retains the extension stores used by its reducer and binds provider-response RuntimeStepContext extensions through the same kernel. Provider response handling no longer wires extension stores directly, tightening the Codex-style turn-state boundary without changing behavior.

RuntimeTurnKernel now owns the per-sampling request state together with the runtime turn reducer. Provider response handling constructs tool-dispatch state through that kernel before passing it into tool turns, preserving behavior while giving the next Codex-style turn-state consolidation a named boundary.

command/exec/list snapshots now include the backing shellId, taskId, requestedTerminalMode, and effectiveTerminalMode. Reconnecting app-server clients can restore active command/exec display and PTY or pipe semantics with the same task identity used by shell/list.

Server-mode clients can now call command/exec/list to recover active command/exec process handles. The listed snapshots include processId, command, cwd, running status, stream output settings, output cap, and stdout/stderr byte counters, and completed processes are drained out before the next list response.

Server-mode command/exec/read now accepts outputBytesCap. Read requests can tighten the active streaming process output cap before the normal pre-dispatch drain, so bounded polling returns UTF-8-safe deltas with capReached metadata instead of leaking a larger burst.

Server-mode command/exec now accepts command/exec/read for client-driven drains of long-running streaming process handles. The read request acknowledges the active process and reuses the existing outputDelta stream, cap metadata, and completion path.

Server-mode shell/read now accepts outputBytesCap for bounded incremental shell output. stdout/stderr deltas and shell_updated or shell_completed responses are truncated on UTF-8 boundaries and include capReached metadata when the read budget is reached.

Server-mode clients can now query shell/capabilities before starting shell or command/exec PTY work. The response reports the current platform, whether native PTY and PTY resize are available, accepted terminal modes, pipe fallback behavior, and the processId requirement for streaming command/exec sessions.

Bash sandbox recovery now handles pathless macOS sandbox denials such as GitHub HTTPS credential prompts: runtime, JSONL command/exec, and the TUI can ask to re-run the command without the filesystem sandbox after approval. Shell task session state also moves to ORCA_HOME with migration from legacy project .orca/task-sessions directories.

RuntimeSamplingRequestState now records normal tool results and owns the approval-required and subagent-failure terminal folding for single-tool turns. Normal tool execution borrows its permission overlay and records its result through the same request state, leaving tool_turn to delegate without changing user-visible behavior.

RuntimeSamplingRequestState now produces clamped RuntimeToolDispatchWindow values for readonly and subagent batches. Tool turns no longer read raw cursor positions or slice batch windows directly, and a stalled batch collector still advances over the current request instead of risking a stuck dispatch loop.

RuntimeSamplingRequestState now owns the tool-dispatch cursor as well as the per-sampling permission overlay. Tool turns read and advance the current request through sampling state instead of keeping a separate ToolRequestCursor, so Codex-style request-scoped runtime state has one clearer owner without changing tool execution behavior.

RuntimeSamplingRequestState now owns the per-sampling permission overlay. Provider response handling creates the sampling state and tool turns borrow its overlay instead of allocating local permission state, giving the next Codex-style request-state split a concrete home without changing tool behavior.

Runtime turn-loop input construction now lives behind a focused run_agent_turn_loop entrypoint. agent_loop passes a RuntimeAgentTurnLoopInput launch object instead of constructing the wide RuntimeTurnLoopInput directly, leaving runtime_turn_loop as the owner of the internal turn-loop handoff.

RuntimeTurnLoopState now owns the directive-resolved loop policy surface. agent_loop no longer destructures loop state or reads directive accessors directly; lifecycle resolves tool policy, runtime system messages, model override, cost/cancel/task refs, and grouped extension context for each turn-loop iteration.

RuntimeTurnState now hands agent_loop a lifecycle-owned RuntimeTurnLoopState, separating runtime directives from the mutable turn-loop runtime refs. RuntimeTurnLoopInput owns that grouped runtime handoff and derives RuntimeExtensionContext at the iteration boundary, so agent_loop no longer destructures extension registry/thread/turn fields or reconstructs extension context from raw parts.

RuntimeTurnState now exposes the grouped RuntimeExtensionContext boundary and owns the registry/store composition helper used by agent_loop. The loop still passes the same registry, thread store, and turn store into RuntimeTurnLoopInput, but extension-context construction no longer lives directly in the loop body.

Runtime turn-loop, iteration, and provider-cycle inputs now carry one RuntimeExtensionContext instead of parallel extension registry, thread store, and turn store fields. agent_loop creates the grouped context once, and provider turns reuse it when building RuntimeStepContext, preserving lifecycle notifications while narrowing the runtime extension boundary.

RuntimeStepContext and RuntimeNormalToolTurnContext now carry a grouped RuntimeExtensionContext instead of parallel extension registry, thread store, and turn store fields. Provider turns still build the same stores once, while normal tool execution receives the same lifecycle data through a narrower extension boundary.

ToolExecutionContext now carries grouped RuntimeExtensionStores instead of reconstructing them from parallel thread/turn references. Tool lifecycle contributors, goal progress recording, and router dispatch keep the same behavior while the normal tool execution entrypoint has a smaller extension-store API.

Permission-sensitive tool contexts now pass grouped RuntimeExtensionStores instead of parallel thread/turn extension references. RuntimeTurnReducer can be constructed from that grouped store boundary, so request_permissions, bash auto-escalation, router overlay transfer, and direct runtime-tool actor compatibility keep the same behavior while the runtime state API gets smaller.

Permission reduction is now consistently instance-owned by RuntimeTurnReducer. The old static permission reducer accessor is gone, while request_permissions, bash auto-escalation, router overlay transfer, and direct runtime-tool actor calls keep their existing behavior through turn/thread extension stores.

Permission overlay requests and merges now reduce through RuntimeTurnReducer. request_permissions, bash auto-escalation, and router overlay transfer keep the same behavior while permission state mutation leaves the direct call sites.

Runtime directives now reduce through RuntimeTurnReducer. Model switches, allowed-tool replacement, and injected runtime system messages keep the same behavior while RuntimeTurnState no longer writes directive state directly.

RuntimeTurnReducer now owns completed-tool goal progress recording. TUI completed normal tools route through that reducer instead of writing goal progress directly, keeping the live thread extension guard in one runtime-owned state boundary.

Goal terminal updates now consult live runtime thread extension state. TUI turns record completed normal tools into the same goal progress store, and update_goal refuses complete or blocked claims until the live thread has observed real non-goal tool progress.

RuntimeThread now owns the thread-scoped extension store and hands it to each RuntimeTurnState, while every RuntimeThread turn receives a fresh turn extension store id. Goal and future runtime contributors can now keep stable thread-level state across headless, TUI, and server turns without leaking turn-local data.

RuntimeTurnState now owns the default extension registry plus thread and turn extension stores, installs the goal tool lifecycle contributor, and threads that state through the provider/tool turn path into normal tool execution. Goal progress can now observe real normal-tool completions from the live runtime path without changing CLI, TUI, server, JSONL, or goal storage behavior.

ToolExecutionContext can now carry an extension registry plus thread and turn extension stores, and ToolExecutionActor notifies lifecycle contributors around normal tool execution. This makes completed, blocked, aborted, and not-implemented tool outcomes visible at the extension boundary without changing CLI, TUI, server, or JSONL wire behavior.

Orca now has a runtime extension contributor kernel with typed per-scope ExtensionData and ordered tool lifecycle contributors. Goal tool progress has the first real contributor seed, so future goal, memory, task, and tool lifecycle work can move out of the main runtime loop without changing CLI or app-server behavior.

Realtime server item projection now lives behind a shared RuntimeEventProjector reducer. Assistant messages, proposed plans, reasoning, command execution, MCP/dynamic tools, file changes, and workflow lifecycle events keep the same app-server wire shape while ServerRequestWriter no longer owns the projection state maps.

Async subagent worker entrypoints now use grouped AsyncSubagentWorkerInput, AsyncSubagentWorkerContext, AsyncSubagentLaunchContext, and spawn context objects instead of long argument lists or clippy allowances. CLI worker startup, parent async launch, task registry state, worktree handoff, async completion payloads, subagent contracts, and TUI async subagent behavior stay unchanged.

Child-agent runtime constructor inputs now flow through a grouped ChildAgentRuntimeContext instead of a long cwd/events/sink/instructions/memory/MCP/hooks/cancel/lifecycle/executor argument list. Existing orca_runtime::agent_child re-exports remain available, while child-agent loop setup, provider turns, compaction, response folding, tool execution, sync and async subagent contracts, workflow child agents, and TUI child-agent delegation behavior stay unchanged.

Child-agent loop runner inputs now flow through a grouped ChildAgentLoopContext instead of a long request/cwd/instructions/memory/hooks/cost-tracker argument list. Existing orca_runtime::agent_child re-exports remain available, while loop setup, provider turns, compaction, response folding, tool execution, subagent contracts, workflow child agents, and TUI child-agent delegation behavior stay unchanged.

Child-agent prompt entrypoint inputs now flow through a grouped ChildAgentPromptContext instead of a long argument list. Existing orca_runtime::agent_child re-exports remain available, while prompt-to-request construction, model override, child cost tracking, subagent contracts, workflow child agents, and TUI child-agent delegation behavior stay unchanged.

Child-agent public entrypoints now live in a focused child_agent_entrypoints module instead of the agent_child facade. Existing orca_runtime::agent_child imports remain available through re-exports, while model override, child cost tracking, prompt-to-request construction, subagent contracts, workflow child agents, and TUI child-agent delegation behavior stay unchanged.

Child-agent behavior tests now live in a focused child_agent_tests module instead of the agent_child facade. Existing orca_runtime::agent_child imports remain available through re-exports, while child-agent setup, provider turns, response folding, loop running, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent request, result, runtime, and executor types now live in a focused child_agent_types module. Existing orca_runtime::agent_child imports remain available through re-exports, while loop setup, provider turns, response folding, loop running, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent loop orchestration now lives in a focused child_agent_loop_runner module. Existing orca_runtime::agent_child imports remain available through re-exports, while loop setup, provider turns, response folding, tool-result folding, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent provider response folding, tool request extraction, tool execution context, and tool-result folding now live in a focused child_agent_response_folding module. Existing orca_runtime::agent_child imports remain available through re-exports, while child-agent loop orchestration, provider turns, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent model routing, provider hook execution, provider call dispatch, child compaction, and prompt-too-long retry/failure handling now live in a focused child_agent_provider_turn module. Existing orca_runtime::agent_child imports remain available through re-exports, while provider response folding, tool request extraction, tool result folding, subagent contracts, and TUI child-agent delegation behavior stay unchanged.

Child-agent loop setup, provider bootstrap, conversation seed, approval policy seed, and child turn-budget state now live in a focused child_agent_loop_setup module. Existing orca_runtime::agent_child imports remain available through re-exports, while child-agent model routing, provider turns, tool folding, subagent contracts, and TUI delegation behavior stay unchanged.

Runtime approval decisions, approval handlers, and config-backed interactive approval handling now live in a focused runtime_approval module. Existing orca_runtime::lifecycle imports remain available through re-exports, while approval policy resolution and interactive approval behavior stay unchanged.

Runtime permission requests now live in a focused runtime_permission module. The existing orca_runtime::lifecycle imports remain available through re-exports, while request_permissions execution and turn permission overlay behavior keep the same runtime shape.

Runtime request_user_input handling now lives in a focused runtime_user_input module. The existing orca_runtime::lifecycle imports remain available through re-exports, while request parsing, handler dispatch, answer completion, and cancellation failure behavior keep the same runtime and TUI shape.

Runtime ORCA_HOME-scoped tests now share a poison-tolerant test environment lock helper. If one test panics while holding the shared environment mutex, later history, server, session, thread-store, and workflow-host tests can recover the lock instead of cascading into misleading PoisonError failures.

Sandbox bash command construction now uses grouped WorkspaceWriteSandboxCommandContext and ReadOnlySandboxCommandContext inputs, with the macOS Seatbelt profile helpers also receiving focused profile contexts. Shell sessions, command/exec, bash sandboxing, network and filesystem policy flags, Unix socket allowlists, and non-interactive process preparation keep the same behavior while the sandbox API no longer exposes long argument lists.

Runtime bash sandbox execution and one-shot shell spawning now use focused RuntimeBashSandboxContext and RuntimeBashOnceContext inputs. The model-visible bash flow still owns permission-profile sandboxing, network and filesystem permission retries, cancellation, task-registry handoff, output truncation, and diagnostics while runtime_bash.rs no longer needs internal long-argument helper escape hatches.

Readonly tool-turn batch execution now lives in a focused runtime_readonly_tool_turn module with grouped readonly batch and tool-turn contexts. The main tool_turn dispatcher still owns request cursoring, child-tool policy checks, subagent batching, readonly batch selection, and normal tool turns while readonly hook gating, parallel execution, and result recording keep the same runtime behavior.

Async subagent worker launch and completion now live in a focused subagent_async_worker module. The parent subagent executor still owns sync and batch execution, while worker spawn, task-registry usage writes, worktree handoff, and async result payloads keep the same CLI and subagent_status behavior.

Server shell-session state now lives in a focused shell_manager module. Optional runtime shell session storage, lazy task-registry-backed initialization, shell CRUD/read/kill/reap/wait calls, and command/exec drain compatibility keep the same server shell protocol shape.

Server pending-permission request state now lives in a focused permission_manager module. Runtime request_permissions waits, command/exec permission retry records, pending request removal, and permission request handler registration keep the same server permission protocol shape.

Server active-turn lifecycle state now lives in a focused active_turn_manager module. Active turn controls, running turn handles, finished-turn reclamation, thread-specific reclaim waits, and session permission metadata merge keep the same server turn protocol shape.

Server command/exec active process state now lives in a focused command_exec_manager module. Buffered output, streaming deltas, stdin writes, PTY resize, termination, output caps, sandbox diagnostics, and permission retry behavior keep the same server protocol shape.

RuntimeToolActorContext now lives in a focused runtime_tool_actor module. Existing orca_runtime::lifecycle imports remain available through a re-export, while approval, hook, user-input, normal-tool, permission-overlay, and active-task behavior keep the same runtime shape.

Runtime lifecycle state machine types now live in a focused runtime_lifecycle module. The existing orca_runtime::lifecycle imports remain available through re-exports, while task/turn ids, status mapping, event payloads, and RuntimeTurnRunner behavior stay unchanged.

Runtime turn setup now lives in a focused runtime_turn_setup module. Agent loop still delegates through RuntimeTurnSetupStep, and the new module owns context budget setup, tool approval policy construction, and provider config composition while lifecycle.rs keeps actor/lifecycle primitives.

Runtime conversation bootstrap now lives in a focused runtime_conversation_bootstrap module. Agent loop still delegates through RuntimeConversationBootstrapStep, and the new module owns RuntimePreparedConversation, borrowed-or-owned conversation storage, session bootstrap composition, and initial history recording while lifecycle.rs keeps actor/lifecycle primitives.

Runtime steer application now lives in a focused runtime_steer module with a grouped RuntimeSteerInput boundary. RuntimeTurnOpeningStep and RuntimeProviderTurnStep still drain pending steer inputs into the conversation and history before the model call, while lifecycle.rs keeps ThreadSteerHandle storage and sheds another reducer slice.

Runtime model-route orchestration now lives in a focused runtime_model_route module with a grouped RuntimeModelRouteInput boundary. RuntimeTurnOpeningStep still composes compaction, turn start, model routing, and steering in the same order, while lifecycle.rs keeps the actor/lifecycle primitives and sheds another reducer slice without adding a new long-argument surface.

Runtime turn-start orchestration now lives in a focused runtime_turn_start module instead of lifecycle.rs. RuntimeTurnOpeningStep still composes compaction, turn start, model routing, and steering in the same order, while lifecycle.rs keeps the actor/lifecycle primitives and sheds another lower-level reducer slice.

Runtime turn-opening orchestration now lives in a focused runtime_turn_opening module with a grouped RuntimeTurnOpeningInput boundary. RuntimeTurnIterationStep still composes opening and provider-cycle execution in the same order, while lifecycle.rs keeps the lower-level start/model-route/steer steps and sheds another reducer-sized layer.

Runtime turn-iteration orchestration now lives in a focused runtime_turn_iteration module instead of lifecycle.rs. The outer runtime_turn_loop still delegates through RuntimeTurnIterationStep, provider-cycle behavior still lives in provider_turn, and lifecycle.rs keeps the opening/start/model-route pieces while getting smaller for the next reducer-style split.

Runtime turn-loop orchestration now lives in a focused runtime_turn_loop module instead of lifecycle.rs. Agent loop still delegates through RuntimeTurnLoopStep with the same grouped input/executor objects and the same iteration retry/return behavior, while lifecycle.rs gets smaller for the next Codex/package-3-inspired reducer split.

Shell-session bash execution now receives one grouped RuntimeBashInvocationContext instead of a long execute_bash_with_shell_session argument list. RuntimeNormalToolExecutor still owns the bash branch, permission overlays, cancellation, output truncation, task registry handoff, and network/filesystem permission retries keep the same behavior, while the bash boundary gets smaller for the next shell/session and async-subagent slices.

Filesystem sandbox denials now recover more clearly across server command/exec and model-visible bash. Orca diagnoses macOS Seatbelt write blocks such as nested .git/index.lock failures, explains when they are sandbox scope issues rather than stale locks, requests a turn-scoped filesystem write grant when an approval handler is available, and retries the original command with the granted root.

Tool-turn dispatch now receives one grouped RuntimeToolTurnsContext from provider response handling instead of a long run_tool_turns call. RuntimeStepContext, events, sink, conversation, history writer, tool requests, cost tracking, background workflow state, and child executors still flow unchanged while the provider-to-tool boundary gets smaller.

Normal tool-turn execution now receives one grouped RuntimeNormalToolTurnContext instead of a long run_normal_tool_turn argument list. Tool execution, approval, result recording, plan-state recording, permission overlays, workflow/background state, and child executor handoff keep the same runtime behavior while the tool-turn boundary gets smaller.

Tool approval gate inputs now move through one grouped ToolApprovalGateContext instead of a long handle_approval argument list. Config, events, sink, tool request, invocation, policy, strict auto-review, and delta emission still flow unchanged, while approval allow/ask/deny behavior and tool-call item emission keep the same public shape.

Historical projected tool completions now rebuild through the shared complete_projected_tool_item helper in tool_item_projection.rs instead of thread_store/projection.rs calling MCP, dynamic, commandExecution, and fileChange completed-item constructors directly. Realtime and persisted history stay behavior-compatible while the remaining tool-item schema drift has one smaller ownership point.

Runtime normal-tool routing now passes a grouped RuntimeNormalToolInvocation from the router into lifecycle actors instead of calling the long roots/cancel method directly. Bash shell-session execution, MCP/external fallback, permission overlays, cancellation, and output truncation keep the same behavior while the common tool path gets a smaller call surface for later shell and async-subagent work.

Normal tool invocation now funnels through one runtime_normal_tool helper instead of letting lifecycle.rs instantiate the executor directly. RuntimeTaskActor and RuntimeToolActorContext still preserve the same bash, MCP, external, cancellation, and permission-overlay behavior, but the next shell-session and async subagent slices have a smaller call surface to build on.

Tool-call argument streaming now reports progress end to end: a new tool.call.progress event and ToolCallProgress provider step flow through runtime and server, and the TUI renders received-bytes progress with cache-friendly updates. Adds an SSE streaming idle-timeout guard and fixes environment-variable proxy configuration and hook-timeout output handling.

The normal-tool fallback path is now injectable through a focused RuntimeNormalToolFallbackExecutor boundary. MCP, TOML external, and built-in tool execution still use the same default orca-tools path, but the runtime can now test fallback context handoff without hardcoding that implementation.

Normal tool execution now lives behind a focused RuntimeNormalToolExecutor boundary. The shell-session bash branch and the MCP/external/built-in fallback path move out of lifecycle.rs, while CLI, TUI, server, workflow, permission, and model-visible tool behavior stay unchanged.

Runtime tool invocation dispatch now lives behind a focused RuntimeToolRouter boundary. ToolExecutionActor keeps invocation prep, approval, hooks, and result finalization, while workflow, subagent, task, permission, workflow IPC, and normal-tool routing move into the router without changing model-visible behavior.

Runtime turn execution now carries cleaner grouped inputs: turn iteration, provider cycle, provider response, and tool turns share request-scoped context boundaries. This Codex/package-3-inspired slice reduces repeated runtime state plumbing while preserving CLI, TUI, server, tool, workflow, and history behavior.

TUI child-agent execution now flows through runtime-owned request construction, model/cost setup, loop orchestration, provider handling, tool request extraction, and tool-result folding while TUI keeps only the interactive tool adapter. This keeps the new reasoning-effort configuration intact across child provider calls.

Reasoning effort is now configurable (high or max, default max) via env vars, config file, and CLI arguments, carried on DeepSeek API requests. The TUI /model command becomes a two-step picker — choose the model, then the reasoning effort — with deferred apply, clean Esc cancellation, and a status bar that shows both.

TUI polish: inline scrolling now detects real overflow via rendered-line-info, keeps auto-follow armed until content actually overflows, fixes CJK-aware wrap heights, moves memory extraction off the render thread, adds a live activity bar, and debounces inertial mouse scroll right after a turn completes.

Runtime-special tool dispatch and small executors now live in a focused runtime_special module, keeping request_permissions, workflow IPC, subagent status, task list/stop, and workflow draft preview behavior intact while shrinking lifecycle.rs.

Server submit-family dispatch now routes through a focused submit processor, preserving legacy submit, thread-bound turns, thread/start, thread/resume, and thread/fork behavior while leaving the generic router as a pure operation-family dispatcher.

Server permission/respond dispatch now routes through a focused permission processor, preserving turn/session grants, strict auto-review, filesystem overlays, and network allow/deny behavior while shrinking the generic router.

Server command/exec dispatch now routes through a focused command-exec processor, preserving buffered, streaming, stdin, resize, terminate, sandbox, and permission-profile behavior while shrinking the generic router.

Server shell-session dispatch now routes through a focused shell processor, preserving shell start, write, update, close, resize, list, read, and kill behavior while shrinking the generic router.

Server turn-control dispatch now routes through a focused turn processor, keeping interrupt, resume, and steer behavior intact while shrinking the generic router.

Synchronous server thread query and metadata operations now route through a focused thread processor, shrinking the generic router while preserving thread/read, list, search, turns, items, and metadata behavior.

Server-mode operation dispatch now lives behind a focused router boundary, preserving every existing wire method while opening the next request-processor refactor path.

Runtime permission requests now share one overlay merge path for file-system grants, network domain grants, and strict auto-review, keeping request_permissions and bash retry behavior aligned.

Model-visible bash now inherits the active permission profile's managed network policy, turns eligible proxy blocks into permission requests, and retries after a turn-scoped network allow.

Streaming command/exec processes now share the managed network permission flow: eligible proxy blocks request a session-scoped allow, then restart the same processId and stream output after the grant.

Command/exec can now turn managed network proxy blocks into a network permission request and retry the command after a session-scoped allow response, while denylist blocks remain final diagnostics.

Managed command/exec network blocks now include the normalized blocked host in proxy diagnostics, giving clients a stable attribution hook for upcoming automatic network permission prompts.

Session-scoped request_permissions network denials now override permission-profile allow entries, so interactive deny decisions can tighten later command/exec proxy policy.

Session-scoped request_permissions network domain grants now persist on server threads and feed command/exec's managed proxy, so later commands inherit interactive allowlist decisions.

Permission-profile Unix socket allowlists now flow into command/exec sandboxing on macOS, allowing configured AF_UNIX socket paths without enabling full network access.

The managed command/exec network proxy now checks resolved socket addresses before connecting, blocking DNS names that resolve to local, private, reserved, or otherwise non-public targets.

The managed command/exec network proxy now blocks local and private IP targets unless they are explicitly allowlisted, matching Codex's local-network guard while keeping allowlisted loopback workflows working.

Permission-profile network blocks now preserve Codex-style proxy reasons, so command/exec clients can distinguish denylist hits from allowlist misses instead of seeing only a generic policy 403.

The TUI conversation session now owns RuntimeThread instead of rebuilding InteractiveSession and RuntimeSessionLifecycle locally, completing the first headless/server/TUI runtime-state convergence pass while preserving TUI behavior.

Headless exec now creates and runs long-lived agent state through RuntimeThread, aligning CLI turns with server-mode ownership while preserving JSONL sequencing, session hooks, history, verifier, and npm behavior.

Server-mode threads now store their long-lived agent state through RuntimeThread, removing duplicated session/lifecycle/executor assembly while preserving thread projection, resume/fork, cancellation, and permission behavior.

RuntimeThread now groups the runtime-owned interactive session and lifecycle state behind one boundary, creating the next convergence point for server, TUI, and headless execution without changing public behavior.

The runtime protocol boundary now uses a small facade backed by focused command_exec, events, permissions, shell, thread, turn, and wire modules, preserving the public protocol API while making the next server dispatch split easier.

ThreadStore now has a focused storage facade backed by separate types, local JSONL, writer, projection, pagination, and live-thread modules, preserving the public runtime API while shrinking the monolithic store file.

Permission-profile network domain policies now run through a managed loopback HTTP proxy for command/exec, so allowed hosts can pass and denied hosts return a policy 403.

Permission-profile filesystem globs now support configurable scan depth through glob_scan_max_depth / globScanMaxDepth, with inherited profile defaults and child-profile overrides.

Permission profiles now expand bounded read/write/read-write filesystem globs into concrete command sandbox roots, keeping Codex-style split filesystem policies usable without weakening broad-glob safety checks.

Runtime compaction now lives in a dedicated module, keeping prompt-budget hooks, summary persistence, and prompt-too-long recovery out of the lifecycle orchestration module.

TUI history splits into native terminal scrollback for settled transcript output and a live bottom viewport for streaming content, plans, input, status, and modal/full-panel states.

Tool-turn execution now lives in a dedicated runtime module, separating provider tool schema/invocation preparation from cursoring, batching, execution, and result folding.

TUI tool approval gating now lives in the runtime interaction adapter, keeping approval request construction, preview generation, and interactive waits out of bridge orchestration.

TUI runtime approval and request-user-input handlers now live in a dedicated interaction adapter module, and the site build includes the server prerender entry used by crawler-visible HTML generation.

TUI runtime event projection now lives in a dedicated module, keeping EventEnvelope-to-TuiEvent mapping and workflow notification prompt shaping out of bridge orchestration.

Persisted edit and write_file history items now project as Codex-style fileChange items, aligning thread-read history with realtime server streams.

Persisted commandExecution history items now use shared projection builders while preserving command metadata placeholders and failed-command diagnostics.

Realtime commandExecution lifecycle items now use shared projection builders, closing another app-server item-shape drift point.

Realtime agent, plan, and reasoning lifecycle items now use shared projection builders, further tightening the app-server protocol boundary.

Realtime fileChange and workflow lifecycle items now use shared projection builders, and the tag release gate runs server-heavy Rust tests serially on CI.

MCP/dynamic completed-item projection is shared across realtime streams and history, and CI stdio MCP fixtures now launch through /bin/sh to avoid Linux ETXTBSY release flakes.

MCP and dynamic tool completed-item construction now uses shared projection builders across realtime streams and persisted history, with failed command projection guarded against output-shape regression.

Realtime streams and persisted history now share MCP and dynamic tool started-item builders, keeping first-class tool-call item shape aligned at creation time.

Realtime and persisted tool item projections now share exit-code error normalization and completed-status checks, reducing the remaining mcpToolCall/dynamicToolCall schema drift.

Realtime server streams and persisted thread projections now share MCP tool parsing, JSON argument parsing, MCP result shaping, and camelCase tool error helpers, with CI JSONL polling hardened for active background turns.

Realtime mcpToolCall and dynamicToolCall item errors now include exitCode when tool completion reports one, keeping server streams aligned with persisted thread item projections.

MCP initialize capabilities are now cached per server, so all-server resource/template discovery skips tools-only servers while explicit server filters still report that server's real error.

MCP resource and template discovery now includes registry-level startup errors in all-server results, so failed MCP servers stay visible alongside healthy resource context.

MCP resource templates are now model-visible through list_mcp_resource_templates, with resources/templates/list wired through stdio/SSE and partial per-server error reporting.

MCP resource discovery now returns available resources even when another server fails, with per-server errors surfaced in the list_mcp_resources result.

MCP resource tools ship with a hardened server-mode JSONL test harness, so noisy child-process output no longer flakes task_stop shell-session release coverage.

MCP resources are now model-visible through read-only list_mcp_resources and read_mcp_resource tools, with stdio/SSE resources/list and resources/read support wired through the shared registry.

Structured hook JSON stdout now validates declared actions and required string fields, so typoed or malformed hook outputs fail visibly instead of being silently injected or ignored.

Tool argument validation now evaluates JSON Schema oneOf and anyOf branches before execution, keeping runtime rejection behavior aligned with advertised provider schemas.

Model-facing file discovery now supports fuzzy path queries through glob mode=fuzzy, while preserving existing glob pattern behavior and list_files compatibility.

Runtime turn orchestration now lives behind lifecycle-owned turn opening, provider cycle, iteration, loop, and loop-input boundaries, shrinking the agent loop entrypoint while preserving behavior.

Claude Code-style workflow parity loop: generated drafts, edit/save/run controls, reusable workflow commands, evidence-bound reports, and process-tree timeout cleanup.

Workflow concurrency control rewrite (Promise.allSettled with fail-fast), structured failure taxonomy (tool/MCP/token/schema), concurrency metrics in evidence bundles, and stress-test coverage.

Workflow evidence bundles with standardized reporting (Markdown + JSON), automatic evidence capture at lifecycle checkpoints, and contract validation tests.

Workflow child task list tools, typed output schemas for subagents, team tool allowlists, durable IPC state, and agent lifecycle observability.

History/session persistence now flows through a dedicated SessionStore boundary, with runtime session/controller call sites aligned to the same entry point.

Shell execution now honors the configurable timeout, with timeout-aware child process waiting shared by bash and external tools.

Workflow agent runs now support worktree isolation, async handle recovery, and continue-on-failure phase fallback in the TUI workflow view.

Bracketed paste support in TUI input; textarea soft-wrap rendering rewritten with accurate height calculation.

Add a reusable real API release gate that verifies provider summary costs, CLI JSONL output, and server-mode streaming before tagging.

Centralize runtime tool invocation records, approval request construction, and hook-modified request validation across built-in, MCP, and external tools.

Add a typed runtime protocol boundary for server submissions and events while preserving the existing flat JSON wire format.

Runtime-owned interactive sessions now centralize conversation, history, instructions, memory, hooks, MCP, cost tracking, and workflow task state before the protocol split.

Workflow DSL and multi-stage runtime overhaul; TUI now shows workflow/task progress, elapsed time, notifications, and clearer approval choices.

Refactor TUI session preloading for clarity; extract goal session ID helper; add unit tests for session restoration and goal control flow.

Drop legacy deepseek-chat / deepseek-reasoner; tool arguments are JSON-Schema validated before any call; TUI text-wrap rewritten for wide chars and ANSI.

Kill the cache-compaction storm: wire-equivalent gating + 60% hysteresis, persist inherited summary state across --continue and --fork.

Update check falls back to npm registry (no rate limit); table rendering rewritten with progressive degradation down to narrow terminals.