Lock in Linux hook stdin BrokenPipe coverage

Latest main already contains the functional BrokenPipe tolerance in
plugins::hooks::CommandWithStdin::output_with_stdin, but the only
coverage for the original CI failure was the higher-level plugin hook
test. Add a deterministic regression that exercises the exact low-level
EPIPE path by spawning a hook child that closes stdin immediately while
the parent writes an oversized payload.

This keeps the real root cause explicit: Linux surfaced BrokenPipe from
the parent's stdin write after the hook child closed fd 0 early. Missing
execute bits were not the primary bug.

Constraint: Keep the change surgical on top of latest main
Rejected: Re-open the production code path | latest main already contains the runtime fix
Rejected: Inflate HookRunner payloads in the regression | HOOK_* env injection hit ARG_MAX before the pipe path
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep BrokenPipe coverage near CommandWithStdin so future refactors do not regress the Linux EPIPE path
Tested: cargo test -p plugins hooks::tests::collects_and_runs_hooks_from_enabled_plugins -- --exact (10x)
Tested: cargo test -p plugins hooks::tests::output_with_stdin_tolerates_broken_pipe_when_child_closes_stdin_early -- --exact (10x)
Tested: cargo test --workspace
Not-tested: GitHub Actions rerun on the PR branch

.claw.json

@@ -1,5 +0,0 @@
-{
-  "aliases": {
-    "quick": "haiku"
-  }
-}

.gitignore

@@ -5,8 +5,3 @@ archive/
 # Claude Code local artifacts
 .claude/settings.local.json
 .claude/sessions/
-# Claw Code local artifacts
-.claw/settings.local.json
-.claw/sessions/
-.clawhip/
-status-help.txt

CLAUDE.md

@@ -7,7 +7,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - Frameworks: none detected from the supported starter markers.
 
 ## Verification
-- Run Rust verification from repo root: `scripts/fmt.sh --check`; for formatting use `scripts/fmt.sh`. Run Rust clippy/tests from `rust/`: `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace`
+- Run Rust verification from `rust/`: `cargo fmt`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace`
 - `src/` and `tests/` are both present; update both surfaces together when behavior changes.
 
 ## Repository shape

README.md

@@ -33,8 +33,6 @@ The canonical implementation lives in [`rust/`](./rust), and the current source
 
 > [!IMPORTANT]
 > Start with [`USAGE.md`](./USAGE.md) for build, auth, CLI, session, and parity-harness workflows. Make `claw doctor` your first health check after building, use [`rust/README.md`](./rust/README.md) for crate-level details, read [`PARITY.md`](./PARITY.md) for the current Rust-port checkpoint, and see [`docs/container.md`](./docs/container.md) for the container-first workflow.
->
-> **ACP / Zed status:** `claw-code` does not ship an ACP/Zed daemon entrypoint yet. Run `claw acp` (or `claw --acp`) for the current status instead of guessing from source layout; `claw acp serve` is currently a discoverability alias only, and real ACP support remains tracked separately in `ROADMAP.md`.
 
 ## Current repository shape
 
@@ -47,138 +45,23 @@ The canonical implementation lives in [`rust/`](./rust), and the current source
 
 ## Quick start
 
-> [!NOTE]
-> [!WARNING]
-> **`cargo install claw-code` installs the wrong thing.** The `claw-code` crate on crates.io is a deprecated stub that places `claw-code-deprecated.exe` — not `claw`. Running it only prints `"claw-code has been renamed to agent-code"`. **Do not use `cargo install claw-code`.** Either build from source (this repo) or install the upstream binary:
-> ```bash
-> cargo install agent-code   # upstream binary — installs 'agent.exe' (Windows) / 'agent' (Unix), NOT 'agent-code'
-> ```
-> This repo (`ultraworkers/claw-code`) is **build-from-source only** — follow the steps below.
-
 ```bash
-# 1. Clone and build
-git clone https://github.com/ultraworkers/claw-code
-cd claw-code/rust
+cd rust
 cargo build --workspace
+./target/debug/claw --help
+./target/debug/claw prompt "summarize this repository"
+```
 
-# 2. Set your API key (Anthropic API key — not a Claude subscription)
+Authenticate with either an API key or the built-in OAuth flow:
+
+```bash
 export ANTHROPIC_API_KEY="sk-ant-..."
-
-# 3. Verify everything is wired correctly
-./target/debug/claw doctor
-
-# 4. Run a prompt
-./target/debug/claw prompt "say hello"
+# or
+cd rust
+./target/debug/claw login
 ```
 
-> [!NOTE]
-> **Windows (PowerShell):** the binary is `claw.exe`, not `claw`. Use `.\target\debug\claw.exe` or run `cargo run -- prompt "say hello"` to skip the path lookup.
-
-### Windows setup
-
-**PowerShell is a supported Windows path.** Use whichever shell works for you. The common onboarding issues on Windows are:
-
-1. **Install Rust first** — download from <https://rustup.rs/> and run the installer. Close and reopen your terminal when it finishes.
-2. **Verify Rust is on PATH:**
-   ```powershell
-   cargo --version
-   ```
-   If this fails, reopen your terminal or run the PATH setup from the Rust installer output, then retry.
-3. **Clone and build** (works in PowerShell, Git Bash, or WSL):
-   ```powershell
-   git clone https://github.com/ultraworkers/claw-code
-   cd claw-code/rust
-   cargo build --workspace
-   ```
-4. **Run** (PowerShell — note `.exe` and backslash):
-   ```powershell
-   $env:ANTHROPIC_API_KEY = "sk-ant-..."
-   .\target\debug\claw.exe prompt "say hello"
-   ```
-
-**Git Bash / WSL** are optional alternatives, not requirements. If you prefer bash-style paths (`/c/Users/you/...` instead of `C:\Users\you\...`), Git Bash (ships with Git for Windows) works well. In Git Bash, the `MINGW64` prompt is expected and normal — not a broken install.
-
-## Post-build: locate the binary and verify
-
-After running `cargo build --workspace`, the `claw` binary is built but **not** automatically installed to your system. Here's where to find it and how to verify the build succeeded.
-
-### Binary location
-
-After `cargo build --workspace` in `claw-code/rust/`:
-
-**Debug build (default, faster compile):**
-- **macOS/Linux:** `rust/target/debug/claw`
-- **Windows:** `rust/target/debug/claw.exe`
-
-**Release build (optimized, slower compile):**
-- **macOS/Linux:** `rust/target/release/claw`
-- **Windows:** `rust/target/release/claw.exe`
-
-If you ran `cargo build` without `--release`, the binary is in the `debug/` folder.
-
-### Verify the build succeeded
-
-Test the binary directly using its path:
-
-```bash
-# macOS/Linux (debug build)
-./rust/target/debug/claw --help
-./rust/target/debug/claw doctor
-
-# Windows PowerShell (debug build)
-.\rust\target\debug\claw.exe --help
-.\rust\target\debug\claw.exe doctor
-```
-
-If these commands succeed, the build is working. `claw doctor` is your first health check — it validates your API key, model access, and tool configuration.
-
-### Optional: Add to PATH
-
-If you want to run `claw` from any directory without the full path, choose one of these approaches:
-
-**Option 1: Symlink (macOS/Linux)**
-```bash
-ln -s $(pwd)/rust/target/debug/claw /usr/local/bin/claw
-```
-Then reload your shell and test:
-```bash
-claw --help
-```
-
-**Option 2: Use `cargo install` (all platforms)**
-
-Build and install to Cargo's default location (`~/.cargo/bin/`, which is usually on PATH):
-```bash
-# From the claw-code/rust/ directory
-cargo install --path . --force
-
-# Then from anywhere
-claw --help
-```
-
-**Option 3: Update shell profile (bash/zsh)**
-
-Add this line to `~/.bashrc` or `~/.zshrc`:
-```bash
-export PATH="$(pwd)/rust/target/debug:$PATH"
-```
-
-Reload your shell:
-```bash
-source ~/.bashrc  # or source ~/.zshrc
-claw --help
-```
-
-### Troubleshooting
-
-- **"command not found: claw"** — The binary is in `rust/target/debug/claw`, but it's not on your PATH. Use the full path `./rust/target/debug/claw` or symlink/install as above.
-- **"permission denied"** — On macOS/Linux, you may need `chmod +x rust/target/debug/claw` if the executable bit isn't set (rare).
-- **Debug vs. release** — If the build is slow, you're in debug mode (default). Add `--release` to `cargo build` for faster runtime, but the build itself will take 5–10 minutes.
-
-> [!NOTE]
-> **Auth:** claw requires an **API key** (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, etc.) — Claude subscription login is not a supported auth path.
-
-Run the workspace test suite after verifying the binary works:
+Run the workspace test suite:
 
 ```bash
 cd rust

USAGE.md

@@ -21,7 +21,7 @@ cargo build --workspace
 - Rust toolchain with `cargo`
 - One of:
   - `ANTHROPIC_API_KEY` for direct API access
-  - `ANTHROPIC_AUTH_TOKEN` for bearer-token auth
+  - `claw login` for OAuth-based auth
 - Optional: `ANTHROPIC_BASE_URL` when targeting a proxy or local service
 
 ## Install / build the workspace
@@ -43,35 +43,6 @@ cd rust
 /doctor
 ```
 
-Or run doctor directly with JSON output for scripting:
-
-```bash
-cd rust
-./target/debug/claw doctor --output-format json
-```
-
-**Note:** Diagnostic verbs (`doctor`, `status`, `sandbox`, `version`) support `--output-format json` for machine-readable output. Invalid suffix arguments (e.g., `--json`) are now rejected at parse time rather than falling through to prompt dispatch.
-
-### Initialize a repository
-
-Set up a new repository with `.claw` config, `.claw.json`, `.gitignore` entries, and a `CLAUDE.md` guidance file:
-
-```bash
-cd /path/to/your/repo
-./target/debug/claw init
-```
-
-Text mode (human-readable) shows artifact creation summary with project path and next steps. Idempotent — running multiple times in the same repo marks already-created files as "skipped".
-
-JSON mode for scripting:
-```bash
-./target/debug/claw init --output-format json
-```
-
-Returns structured output with `project_path`, `created[]`, `updated[]`, `skipped[]` arrays (one per artifact), and `artifacts[]` carrying each file's `name` and machine-stable `status` tag. The legacy `message` field preserves backward compatibility.
-
-**Why structured fields matter:** Claws can detect per-artifact state (`created` vs `updated` vs `skipped`) without substring-matching human prose. Use the `created[]`, `updated[]`, and `skipped[]` arrays for conditional follow-up logic (e.g., only commit if files were actually created, not just updated).
-
 ### Interactive REPL
 
 ```bash
@@ -100,85 +71,6 @@ cd rust
 ./target/debug/claw --output-format json prompt "status"
 ```
 
-### Inspect worker state
-
-The `claw state` command reads `.claw/worker-state.json`, which is written by the interactive REPL or a one-shot prompt when a worker executes a task. This file contains the worker ID, session reference, model, and permission mode.
-
-Prerequisite: You must run `claw` (interactive REPL) or `claw prompt <text>` at least once in the repository to produce the worker state file.
-
-```bash
-cd rust
-./target/debug/claw state
-```
-
-JSON mode:
-```bash
-./target/debug/claw state --output-format json
-```
-
-If you run `claw state` before any worker has executed, you will see a helpful error:
-```
-error: no worker state file found at .claw/worker-state.json
-  Hint: worker state is written by the interactive REPL or a non-interactive prompt.
-  Run:   claw               # start the REPL (writes state on first turn)
-  Or:    claw prompt <text> # run one non-interactive turn
-  Then rerun: claw state [--output-format json]
-```
-
-## Advanced slash commands (Interactive REPL only)
-
-These commands are available inside the interactive REPL (`claw` with no args). They extend the assistant with workspace analysis, planning, and navigation features.
-
-### `/ultraplan` — Deep planning with multi-step reasoning
-
-**Purpose:** Break down a complex task into steps using extended reasoning.
-
-```bash
-# Start the REPL
-claw
-
-# Inside the REPL
-/ultraplan refactor the auth module to use async/await
-/ultraplan design a caching layer for database queries
-/ultraplan analyze this module for performance bottlenecks
-```
-
-Output: A structured plan with numbered steps, reasoning for each step, and expected outcomes. Use this when you want the assistant to think through a problem in detail before coding.
-
-### `/teleport` — Jump to a file or symbol
-
-**Purpose:** Quickly navigate to a file, function, class, or struct by name.
-
-```bash
-# Jump to a symbol
-/teleport UserService
-/teleport authenticate_user
-/teleport RequestHandler
-
-# Jump to a file
-/teleport src/auth.rs
-/teleport crates/runtime/lib.rs
-/teleport ./ARCHITECTURE.md
-```
-
-Output: The file content, with the requested symbol highlighted or the file fully loaded. Useful for exploring the codebase without manually navigating directories. If multiple matches exist, the assistant shows the top candidates.
-
-### `/bughunter` — Scan for likely bugs and issues
-
-**Purpose:** Analyze code for common pitfalls, anti-patterns, and potential bugs.
-
-```bash
-# Scan the entire workspace
-/bughunter
-
-# Scan a specific directory or file
-/bughunter src/handlers
-/bughunter rust/crates/runtime
-/bughunter src/auth.rs
-```
-
-Output: A list of suspicious patterns with explanations (e.g., "unchecked unwrap()", "potential race condition", "missing error handling"). Each finding includes the file, line number, and suggested fix. Use this as a first pass before a full code review.
-
 ## Model and permission controls
 
 ```bash
@@ -213,7 +105,8 @@ export ANTHROPIC_API_KEY="sk-ant-..."
 
 ```bash
 cd rust
-export ANTHROPIC_AUTH_TOKEN="anthropic-oauth-or-proxy-bearer-token"
+./target/debug/claw login
+./target/debug/claw logout
 ```
 
 ### Which env var goes where
@@ -223,7 +116,7 @@ export ANTHROPIC_AUTH_TOKEN="anthropic-oauth-or-proxy-bearer-token"
 | Credential shape | Env var | HTTP header | Typical source |
 |---|---|---|---|
 | `sk-ant-*` API key | `ANTHROPIC_API_KEY` | `x-api-key: sk-ant-...` | [console.anthropic.com](https://console.anthropic.com) |
-| OAuth access token (opaque) | `ANTHROPIC_AUTH_TOKEN` | `Authorization: Bearer ...` | an Anthropic-compatible proxy or OAuth flow that mints bearer tokens |
+| OAuth access token (opaque) | `ANTHROPIC_AUTH_TOKEN` | `Authorization: Bearer ...` | `claw login` or an Anthropic-compatible proxy that mints Bearer tokens |
 | OpenRouter key (`sk-or-v1-*`) | `OPENAI_API_KEY` + `OPENAI_BASE_URL=https://openrouter.ai/api/v1` | `Authorization: Bearer ...` | [openrouter.ai/keys](https://openrouter.ai/keys) |
 
 **Why this matters:** if you paste an `sk-ant-*` key into `ANTHROPIC_AUTH_TOKEN`, Anthropic's API will return `401 Invalid bearer token` because `sk-ant-*` keys are rejected over the Bearer header. The fix is a one-line env var swap — move the key to `ANTHROPIC_API_KEY`. Recent `claw` builds detect this exact shape (401 + `sk-ant-*` in the Bearer slot) and append a hint to the error message pointing at the fix.
@@ -232,7 +125,7 @@ export ANTHROPIC_AUTH_TOKEN="anthropic-oauth-or-proxy-bearer-token"
 
 ## Local Models
 
-`claw` can talk to local servers and provider gateways through either Anthropic-compatible or OpenAI-compatible endpoints. Use `ANTHROPIC_BASE_URL` with `ANTHROPIC_AUTH_TOKEN` for Anthropic-compatible services, or `OPENAI_BASE_URL` with `OPENAI_API_KEY` for OpenAI-compatible services.
+`claw` can talk to local servers and provider gateways through either Anthropic-compatible or OpenAI-compatible endpoints. Use `ANTHROPIC_BASE_URL` with `ANTHROPIC_AUTH_TOKEN` for Anthropic-compatible services, or `OPENAI_BASE_URL` with `OPENAI_API_KEY` for OpenAI-compatible services. OAuth is Anthropic-only, so when `OPENAI_BASE_URL` is set you should use API-key style auth instead of `claw login`.
 
 ### Anthropic-compatible endpoint
 
@@ -299,7 +192,7 @@ Reasoning variants (`qwen-qwq-*`, `qwq-*`, `*-thinking`) automatically strip `te
 
 | Provider | Protocol | Auth env var(s) | Base URL env var | Default base URL |
 |---|---|---|---|---|
-| **Anthropic** (direct) | Anthropic Messages API | `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` | `ANTHROPIC_BASE_URL` | `https://api.anthropic.com` |
+| **Anthropic** (direct) | Anthropic Messages API | `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` or OAuth (`claw login`) | `ANTHROPIC_BASE_URL` | `https://api.anthropic.com` |
 | **xAI** | OpenAI-compatible | `XAI_API_KEY` | `XAI_BASE_URL` | `https://api.x.ai/v1` |
 | **OpenAI-compatible** | OpenAI Chat Completions | `OPENAI_API_KEY` | `OPENAI_BASE_URL` | `https://api.openai.com/v1` |
 | **DashScope** (Alibaba) | OpenAI-compatible | `DASHSCOPE_API_KEY` | `DASHSCOPE_BASE_URL` | `https://dashscope.aliyuncs.com/compatible-mode/v1` |

docs/MODEL_COMPATIBILITY.md

@@ -1,236 +0,0 @@
-# Model Compatibility Guide
-
-This document describes model-specific handling in the OpenAI-compatible provider. When adding new models or providers, review this guide to ensure proper compatibility.
-
-## Table of Contents
-
-- [Overview](#overview)
-- [Model-Specific Handling](#model-specific-handling)
-  - [Kimi Models (is_error Exclusion)](#kimi-models-is_error-exclusion)
-  - [Reasoning Models (Tuning Parameter Stripping)](#reasoning-models-tuning-parameter-stripping)
-  - [GPT-5 (max_completion_tokens)](#gpt-5-max_completion_tokens)
-  - [Qwen Models (DashScope Routing)](#qwen-models-dashscope-routing)
-- [Implementation Details](#implementation-details)
-- [Adding New Models](#adding-new-models)
-- [Testing](#testing)
-
-## Overview
-
-The `openai_compat.rs` provider translates Claude Code's internal message format to OpenAI-compatible chat completion requests. Different models have varying requirements for:
-
-- Tool result message fields (`is_error`)
-- Sampling parameters (temperature, top_p, etc.)
-- Token limit fields (`max_tokens` vs `max_completion_tokens`)
-- Base URL routing
-
-## Model-Specific Handling
-
-### Kimi Models (is_error Exclusion)
-
-**Affected models:** `kimi-k2.5`, `kimi-k1.5`, `kimi-moonshot`, and any model with `kimi` in the name (case-insensitive)
-
-**Behavior:** The `is_error` field is **excluded** from tool result messages.
-
-**Rationale:** Kimi models (via Moonshot AI and DashScope) reject the `is_error` field with a 400 Bad Request error:
-```json
-{
-  "error": {
-    "type": "invalid_request_error",
-    "message": "Unknown field: is_error"
-  }
-}
-```
-
-**Detection:**
-```rust
-fn model_rejects_is_error_field(model: &str) -> bool {
-    let lowered = model.to_ascii_lowercase();
-    let canonical = lowered.rsplit('/').next().unwrap_or(lowered.as_str());
-    canonical.starts_with("kimi-")
-}
-```
-
-**Testing:** See `model_rejects_is_error_field_detects_kimi_models` and related tests in `openai_compat.rs`.
-
----
-
-### Reasoning Models (Tuning Parameter Stripping)
-
-**Affected models:**
-- OpenAI: `o1`, `o1-*`, `o3`, `o3-*`, `o4`, `o4-*`
-- xAI: `grok-3-mini`
-- Alibaba DashScope: `qwen-qwq-*`, `qwq-*`, `qwen3-*-thinking`
-
-**Behavior:** The following tuning parameters are **stripped** from requests:
-- `temperature`
-- `top_p`
-- `frequency_penalty`
-- `presence_penalty`
-
-**Rationale:** Reasoning/chain-of-thought models use fixed sampling strategies and reject these parameters with 400 errors.
-
-**Exception:** `reasoning_effort` is included for compatible models when explicitly set.
-
-**Detection:**
-```rust
-fn is_reasoning_model(model: &str) -> bool {
-    let canonical = model.to_ascii_lowercase()
-        .rsplit('/')
-        .next()
-        .unwrap_or(model);
-    canonical.starts_with("o1")
-        || canonical.starts_with("o3")
-        || canonical.starts_with("o4")
-        || canonical == "grok-3-mini"
-        || canonical.starts_with("qwen-qwq")
-        || canonical.starts_with("qwq")
-        || (canonical.starts_with("qwen3") && canonical.contains("-thinking"))
-}
-```
-
-**Testing:** See `reasoning_model_strips_tuning_params`, `grok_3_mini_is_reasoning_model`, and `qwen_reasoning_variants_are_detected` tests.
-
----
-
-### GPT-5 (max_completion_tokens)
-
-**Affected models:** All models starting with `gpt-5`
-
-**Behavior:** Uses `max_completion_tokens` instead of `max_tokens` in the request payload.
-
-**Rationale:** GPT-5 models require the `max_completion_tokens` field. Legacy `max_tokens` causes request validation failures:
-```json
-{
-  "error": {
-    "message": "Unknown field: max_tokens"
-  }
-}
-```
-
-**Implementation:**
-```rust
-let max_tokens_key = if wire_model.starts_with("gpt-5") {
-    "max_completion_tokens"
-} else {
-    "max_tokens"
-};
-```
-
-**Testing:** See `gpt5_uses_max_completion_tokens_not_max_tokens` and `non_gpt5_uses_max_tokens` tests.
-
----
-
-### Qwen Models (DashScope Routing)
-
-**Affected models:** All models with `qwen` prefix
-
-**Behavior:** Routed to DashScope (`https://dashscope.aliyuncs.com/compatible-mode/v1`) rather than default providers.
-
-**Rationale:** Qwen models are hosted by Alibaba Cloud's DashScope service, not OpenAI or Anthropic.
-
-**Configuration:**
-```rust
-pub const DEFAULT_DASHSCOPE_BASE_URL: &str = "https://dashscope.aliyuncs.com/compatible-mode/v1";
-```
-
-**Authentication:** Uses `DASHSCOPE_API_KEY` environment variable.
-
-**Note:** Some Qwen models are also reasoning models (see [Reasoning Models](#reasoning-models-tuning-parameter-stripping) above) and receive both treatments.
-
-## Implementation Details
-
-### File Location
-All model-specific logic is in:
-```
-rust/crates/api/src/providers/openai_compat.rs
-```
-
-### Key Functions
-
-| Function | Purpose |
-|----------|---------|
-| `model_rejects_is_error_field()` | Detects models that don't support `is_error` in tool results |
-| `is_reasoning_model()` | Detects reasoning models that need tuning param stripping |
-| `translate_message()` | Converts internal messages to OpenAI format (applies `is_error` logic) |
-| `build_chat_completion_request()` | Constructs full request payload (applies all model-specific logic) |
-
-### Provider Prefix Handling
-
-All model detection functions strip provider prefixes (e.g., `dashscope/kimi-k2.5` → `kimi-k2.5`) before matching:
-
-```rust
-let canonical = model.to_ascii_lowercase()
-    .rsplit('/')
-    .next()
-    .unwrap_or(model);
-```
-
-This ensures consistent detection regardless of whether models are referenced with or without provider prefixes.
-
-## Adding New Models
-
-When adding support for new models:
-
-1. **Check if the model is a reasoning model**
-   - Does it reject temperature/top_p parameters?
-   - Add to `is_reasoning_model()` detection
-
-2. **Check tool result compatibility**
-   - Does it reject the `is_error` field?
-   - Add to `model_rejects_is_error_field()` detection
-
-3. **Check token limit field**
-   - Does it require `max_completion_tokens` instead of `max_tokens`?
-   - Update the `max_tokens_key` logic
-
-4. **Add tests**
-   - Unit test for detection function
-   - Integration test in `build_chat_completion_request`
-
-5. **Update this documentation**
-   - Add the model to the affected lists
-   - Document any special behavior
-
-## Testing
-
-### Running Model-Specific Tests
-
-```bash
-# All OpenAI compatibility tests
-cargo test --package api providers::openai_compat
-
-# Specific test categories
-cargo test --package api model_rejects_is_error_field
-cargo test --package api reasoning_model
-cargo test --package api gpt5
-cargo test --package api qwen
-```
-
-### Test Files
-
-- Unit tests: `rust/crates/api/src/providers/openai_compat.rs` (in `mod tests`)
-- Integration tests: `rust/crates/api/tests/openai_compat_integration.rs`
-
-### Verifying Model Detection
-
-To verify a model is detected correctly without making API calls:
-
-```rust
-#[test]
-fn my_new_model_is_detected() {
-    // is_error handling
-    assert!(model_rejects_is_error_field("my-model"));
-    
-    // Reasoning model detection
-    assert!(is_reasoning_model("my-model"));
-    
-    // Provider prefix handling
-    assert!(model_rejects_is_error_field("provider/my-model"));
-}
-```
-
----
-
-*Last updated: 2026-04-16*
-
-For questions or updates, see the implementation in `rust/crates/api/src/providers/openai_compat.rs`.

prd.json

@@ -1,356 +0,0 @@
-{
-  "version": "1.0",
-  "description": "Clawable Coding Harness - Clear roadmap stories and commit each",
-  "stories": [
-    {
-      "id": "US-001",
-      "title": "Phase 1.6 - startup-no-evidence evidence bundle + classifier",
-      "description": "When startup times out, emit typed worker.startup_no_evidence event with evidence bundle including last known worker lifecycle state, pane command, prompt-send timestamp, prompt-acceptance state, trust-prompt detection result, and transport/MCP health summary. Classifier should down-rank into specific failure classes.",
-      "acceptanceCriteria": [
-        "worker.startup_no_evidence event emitted on startup timeout with evidence bundle",
-        "Evidence bundle includes: last lifecycle state, pane command, prompt-send timestamp, prompt-acceptance state, trust-prompt detection, transport/MCP health",
-        "Classifier attempts to categorize into: trust_required, prompt_misdelivery, prompt_acceptance_timeout, transport_dead, worker_crashed, or unknown",
-        "Tests verify evidence bundle structure and classifier behavior"
-      ],
-      "passes": true,
-      "priority": "P0"
-    },
-    {
-      "id": "US-002",
-      "title": "Phase 2 - Canonical lane event schema (4.x series)",
-      "description": "Define typed events for lane lifecycle: lane.started, lane.ready, lane.prompt_misdelivery, lane.blocked, lane.red, lane.green, lane.commit.created, lane.pr.opened, lane.merge.ready, lane.finished, lane.failed, branch.stale_against_main. Also implement event ordering, reconciliation, provenance, deduplication, and projection contracts.",
-      "acceptanceCriteria": [
-        "LaneEvent enum with all required variants defined",
-        "Event ordering with monotonic sequence metadata attached",
-        "Event provenance labels (live_lane, test, healthcheck, replay, transport)",
-        "Session identity completeness at creation (title, workspace, purpose)",
-        "Duplicate terminal-event suppression with fingerprinting",
-        "Lane ownership/scope binding in events",
-        "Nudge acknowledgment with dedupe contract",
-        "clawhip consumes typed lane events instead of pane scraping"
-      ],
-      "passes": true,
-      "priority": "P0"
-    },
-    {
-      "id": "US-003",
-      "title": "Phase 3 - Stale-branch detection before broad verification",
-      "description": "Before broad test runs, compare current branch to main and detect if known fixes are missing. Emit branch.stale_against_main event and suggest/auto-run rebase/merge-forward.",
-      "acceptanceCriteria": [
-        "Branch freshness comparison against main implemented",
-        "branch.stale_against_main event emitted when behind",
-        "Auto-rebase/merge-forward policy integration",
-        "Avoid misclassifying stale-branch failures as new regressions"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-004",
-      "title": "Phase 3 - Recovery recipes with ledger",
-      "description": "Encode automatic recoveries for common failures (trust prompt, prompt misdelivery, stale branch, compile red, MCP startup). Expose recovery attempt ledger with recipe id, attempt count, state, timestamps, failure summary.",
-      "acceptanceCriteria": [
-        "Recovery recipes defined for: trust_prompt_unresolved, prompt_delivered_to_shell, stale_branch, compile_red_after_refactor, MCP_handshake_failure, partial_plugin_startup",
-        "Recovery attempt ledger with: recipe id, attempt count, state, timestamps, failure summary, escalation reason",
-        "One automatic recovery attempt before escalation",
-        "Ledger emitted as structured event data"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-005",
-      "title": "Phase 4 - Typed task packet format",
-      "description": "Define structured task packet with fields: objective, scope, repo/worktree, branch policy, acceptance tests, commit policy, reporting contract, escalation policy.",
-      "acceptanceCriteria": [
-        "TaskPacket struct with all required fields",
-        "TaskScope resolution (workspace/module/single-file/custom)",
-        "Validation and serialization support",
-        "Integration into tools/src/lib.rs"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-006",
-      "title": "Phase 4 - Policy engine for autonomous coding",
-      "description": "Encode automation rules: if green + scoped diff + review passed -> merge to dev; if stale branch -> merge-forward before broad tests; if startup blocked -> recover once, then escalate; if lane completed -> emit closeout and cleanup session.",
-      "acceptanceCriteria": [
-        "Policy rules engine implemented",
-        "Rules: green + scoped diff + review -> merge",
-        "Rules: stale branch -> merge-forward before tests",
-        "Rules: startup blocked -> recover once, then escalate",
-        "Rules: lane completed -> closeout and cleanup"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-007",
-      "title": "Phase 5 - Plugin/MCP lifecycle maturity",
-      "description": "First-class plugin/MCP lifecycle contract: config validation, startup healthcheck, discovery result, degraded-mode behavior, shutdown/cleanup. Close gaps in end-to-end lifecycle.",
-      "acceptanceCriteria": [
-        "Plugin/MCP config validation contract",
-        "Startup healthcheck with structured results",
-        "Discovery result reporting",
-        "Degraded-mode behavior documented and implemented",
-        "Shutdown/cleanup contract",
-        "Partial startup and per-server failures reported structurally"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-008",
-      "title": "Fix kimi-k2.5 model API compatibility",
-      "description": "The kimi-k2.5 model (and other kimi models) reject API requests containing the is_error field in tool result messages. The OpenAI-compatible provider currently always includes is_error for all models. Need to make this field conditional based on model support.",
-      "acceptanceCriteria": [
-        "translate_message function accepts model parameter",
-        "is_error field excluded for kimi models (kimi-k2.5, kimi-k1.5, etc.)",
-        "is_error field included for models that support it (openai, grok, xai, etc.)",
-        "build_chat_completion_request passes model to translate_message",
-        "Tests verify is_error presence/absence based on model",
-        "cargo test passes",
-        "cargo clippy passes",
-        "cargo fmt passes"
-      ],
-      "passes": true,
-      "priority": "P0"
-    },
-    {
-      "id": "US-009",
-      "title": "Add unit tests for kimi model compatibility fix",
-      "description": "During dogfooding we discovered the existing test coverage for model-specific is_error handling is insufficient. Need to add dedicated tests for model_rejects_is_error_field function and translate_message behavior with different models.",
-      "acceptanceCriteria": [
-        "Test model_rejects_is_error_field identifies kimi-k2.5, kimi-k1.5, dashscope/kimi-k2.5",
-        "Test translate_message includes is_error for gpt-4, grok-3, claude models",
-        "Test translate_message excludes is_error for kimi models",
-        "Test build_chat_completion_request produces correct payload for kimi vs non-kimi",
-        "All new tests pass",
-        "cargo test --package api passes"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-010",
-      "title": "Add model compatibility documentation",
-      "description": "Document which models require special handling (is_error exclusion, reasoning model tuning param stripping, etc.) in a MODEL_COMPATIBILITY.md file for operators and contributors.",
-      "acceptanceCriteria": [
-        "MODEL_COMPATIBILITY.md created in docs/ or repo root",
-        "Document kimi models is_error exclusion",
-        "Document reasoning models (o1, o3, grok-3-mini) tuning param stripping",
-        "Document gpt-5 max_completion_tokens requirement",
-        "Document qwen model routing through dashscope",
-        "Cross-reference with existing code comments"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-011",
-      "title": "Performance optimization: reduce API request serialization overhead",
-      "description": "The translate_message function creates intermediate JSON Value objects that could be optimized. Profile and optimize the hot path for API request building, especially for conversations with many tool results.",
-      "acceptanceCriteria": [
-        "Profile current request building with criterion or similar",
-        "Identify bottlenecks in translate_message and build_chat_completion_request",
-        "Implement optimizations (Vec pre-allocation, reduced cloning, etc.)",
-        "Benchmark before/after showing improvement",
-        "No functional changes or API breakage"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-012",
-      "title": "Trust prompt resolver with allowlist auto-trust",
-      "description": "Add allowlisted auto-trust behavior for known repos/worktrees. Trust prompts currently block TUI startup and require manual intervention. Implement automatic trust resolution for pre-approved repositories.",
-      "acceptanceCriteria": [
-        "TrustAllowlist config structure with repo patterns",
-        "Auto-trust behavior for allowlisted repos/worktrees",
-        "trust_required event emitted when trust prompt detected",
-        "trust_resolved event emitted when trust is granted",
-        "Non-allowlisted repos remain gated (manual trust required)",
-        "Integration with worker boot lifecycle",
-        "Tests for allowlist matching and event emission"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-013",
-      "title": "Phase 2 - Session event ordering + terminal-state reconciliation",
-      "description": "When the same session emits contradictory lifecycle events (idle, error, completed, transport/server-down) in close succession, expose deterministic final truth. Attach monotonic sequence/causal ordering metadata, classify terminal vs advisory events, reconcile duplicate/out-of-order terminal events into one canonical lane outcome.",
-      "acceptanceCriteria": [
-        "Monotonic sequence / causal ordering metadata attached to session lifecycle events",
-        "Terminal vs advisory event classification implemented",
-        "Reconcile duplicate or out-of-order terminal events into one canonical outcome",
-        "Distinguish 'session terminal state unknown because transport died' from real 'completed'",
-        "Tests verify reconciliation behavior with out-of-order event bursts"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-014",
-      "title": "Phase 2 - Event provenance / environment labeling",
-      "description": "Every emitted event should declare its source (live_lane, test, healthcheck, replay, transport) so claws do not mistake test noise for production truth. Include environment/channel label, emitter identity, and confidence/trust level.",
-      "acceptanceCriteria": [
-        "EventProvenance enum with live_lane, test, healthcheck, replay, transport variants",
-        "Environment/channel label attached to all events",
-        "Emitter identity field on events",
-        "Confidence/trust level field for downstream automation",
-        "Tests verify provenance labeling and filtering"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-015",
-      "title": "Phase 2 - Session identity completeness at creation time",
-      "description": "A newly created session should emit stable title, workspace/worktree path, and lane/session purpose at creation time. If any field is not yet known, emit explicit typed placeholder reason rather than bare unknown string.",
-      "acceptanceCriteria": [
-        "Session creation emits stable title, workspace/worktree path, purpose immediately",
-        "Explicit typed placeholder when fields unknown (not bare 'unknown' strings)",
-        "Later-enriched metadata reconciles onto same session identity without ambiguity",
-        "Tests verify session identity completeness and placeholder handling"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-016",
-      "title": "Phase 2 - Duplicate terminal-event suppression",
-      "description": "When the same session emits repeated completed/failed/terminal notifications, collapse duplicates before they trigger repeated downstream reactions. Attach canonical terminal-event fingerprint per lane/session outcome.",
-      "acceptanceCriteria": [
-        "Canonical terminal-event fingerprint attached per lane/session outcome",
-        "Suppress/coalesce repeated terminal notifications within reconciliation window",
-        "Preserve raw event history for audit while exposing one actionable outcome downstream",
-        "Surface when later duplicate materially differs from original terminal payload",
-        "Tests verify deduplication and material difference detection"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-017",
-      "title": "Phase 2 - Lane ownership / scope binding",
-      "description": "Each session and lane event should declare who owns it and what workflow scope it belongs to. Attach owner/assignee identity, workflow scope (claw-code-dogfood, external-git-maintenance, infra-health, manual-operator), and mark whether watcher is expected to act, observe only, or ignore.",
-      "acceptanceCriteria": [
-        "Owner/assignee identity attached to sessions and lane events",
-        "Workflow scope field (claw-code-dogfood, external-git-maintenance, etc.)",
-        "Watcher action expectation field (act, observe-only, ignore)",
-        "Preserve scope through session restarts, resumes, and late terminal events",
-        "Tests verify ownership and scope binding"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-018",
-      "title": "Phase 2 - Nudge acknowledgment / dedupe contract",
-      "description": "Periodic clawhip nudges should carry nudge id/cycle id and delivery timestamp. Expose whether claw has already acknowledged or responded for that cycle. Distinguish new nudge, retry nudge, and stale duplicate.",
-      "acceptanceCriteria": [
-        "Nudge id / cycle id and delivery timestamp attached",
-        "Acknowledgment state exposed (already acknowledged or not)",
-        "Distinguish new nudge vs retry nudge vs stale duplicate",
-        "Allow downstream summaries to bind reported pinpoint back to triggering nudge id",
-        "Tests verify nudge deduplication and acknowledgment tracking"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-019",
-      "title": "Phase 2 - Stable roadmap-id assignment for newly filed pinpoints",
-      "description": "When a claw records a new pinpoint/follow-up, assign or expose a stable tracking id immediately. Expose that id in structured event/report payload and preserve across edits, reorderings, and summary compression.",
-      "acceptanceCriteria": [
-        "Canonical roadmap id assigned at filing time",
-        "Roadmap id exposed in structured event/report payload",
-        "Same id preserved across edits, reorderings, summary compression",
-        "Distinguish 'new roadmap filing' from 'update to existing roadmap item'",
-        "Tests verify stable id assignment and update detection"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-020",
-      "title": "Phase 2 - Roadmap item lifecycle state contract",
-      "description": "Each roadmap pinpoint should carry machine-readable lifecycle state (filed, acknowledged, in_progress, blocked, done, superseded). Attach last state-change timestamp and preserve lineage when one pinpoint supersedes or merges into another.",
-      "acceptanceCriteria": [
-        "Lifecycle state enum with filed, acknowledged, in_progress, blocked, done, superseded",
-        "Last state-change timestamp attached",
-        "New report can declare first filing, status update, or closure",
-        "Preserve lineage when one pinpoint supersedes or merges into another",
-        "Tests verify lifecycle state transitions"
-      ],
-      "passes": true,
-      "priority": "P2"
-    },
-    {
-      "id": "US-021",
-      "title": "Request body size pre-flight check for OpenAI-compatible provider",
-      "description": "Implement pre-flight request body size estimation to prevent 400 Bad Request errors from API gateways with size limits. Based on dogfood findings with kimi-k2.5 testing, DashScope API has a 6MB request body limit that was exceeded by large system prompts.",
-      "acceptanceCriteria": [
-        "Pre-flight size estimation before sending requests to OpenAI-compatible providers",
-        "Clear error message when request exceeds provider-specific size limit",
-        "Configuration for different provider limits (6MB DashScope, 100MB OpenAI, etc.)",
-        "Unit tests for size estimation and limit checking",
-        "Integration with existing error handling for actionable user messages"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-022",
-      "title": "Enhanced error context for API failures",
-      "description": "Add structured error context to API failures including request ID tracking across retries, provider-specific error code mapping, and suggested user actions based on error type (e.g., 'Reduce prompt size' for 413, 'Check API key' for 401).",
-      "acceptanceCriteria": [
-        "Request ID tracking across retries with full context in error messages",
-        "Provider-specific error code mapping with actionable suggestions",
-        "Suggested user actions for common error types (401, 403, 413, 429, 500, 502-504)",
-        "Unit tests for error context extraction",
-        "All existing tests pass and clippy is clean"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-023",
-      "title": "Add automatic routing for kimi models to DashScope",
-      "description": "Based on dogfood findings with kimi-k2.5 testing, users must manually prefix with dashscope/kimi-k2.5 instead of just using kimi-k2.5. Add automatic routing for kimi/ and kimi- prefixed models to DashScope (similar to qwen models), and add a 'kimi' alias to the model registry.",
-      "acceptanceCriteria": [
-        "kimi/ and kimi- prefix routing to DashScope in metadata_for_model()",
-        "'kimi' alias in MODEL_REGISTRY that resolves to 'kimi-k2.5'",
-        "resolve_model_alias() handles the kimi alias correctly",
-        "Unit tests for kimi routing (similar to qwen routing tests)",
-        "All tests pass and clippy is clean"
-      ],
-      "passes": true,
-      "priority": "P1"
-    },
-    {
-      "id": "US-024",
-      "title": "Add token limit metadata for kimi models",
-      "description": "The model_token_limit() function has no entries for kimi-k2.5 or kimi-k1.5, causing preflight context window validation to skip these models. Add token limit metadata to enable preflight checks and accurate max token defaults. Per Moonshot AI documentation, kimi-k2.5 supports 256K context window and 16K max output tokens.",
-      "acceptanceCriteria": [
-        "model_token_limit('kimi-k2.5') returns Some(ModelTokenLimit { max_output_tokens: 16384, context_window_tokens: 256000 })",
-        "model_token_limit('kimi-k1.5') returns appropriate limits",
-        "model_token_limit('kimi') follows alias chain (kimi → kimi-k2.5) and returns k2.5 limits",
-        "preflight_message_request() validates context window for kimi models (via generic preflight, no provider-specific code needed)",
-        "Unit tests verify limits and preflight behavior for kimi models",
-        "All tests pass and clippy is clean"
-      ],
-      "passes": true,
-      "priority": "P1"
-    }
-  ],
-  "metadata": {
-    "lastUpdated": "2026-04-17",
-    "completedStories": ["US-001", "US-002", "US-003", "US-004", "US-005", "US-006", "US-007", "US-008", "US-009", "US-010", "US-011", "US-012", "US-013", "US-014", "US-015", "US-016", "US-017", "US-018", "US-019", "US-020", "US-021", "US-022", "US-023", "US-024"],
-    "inProgressStories": [],
-    "totalStories": 24,
-    "status": "completed"
-  }
-}

progress.txt

@@ -1,378 +0,0 @@
-Ralph Iteration Summary - claw-code Roadmap Implementation
-===========================================================
-
-Iteration 1: 2026-04-16
-------------------------
-
-US-001 COMPLETED (Phase 1.6 - startup-no-evidence evidence bundle + classifier)
-- Files: rust/crates/runtime/src/worker_boot.rs
-- Added StartupFailureClassification enum with 6 variants
-- Added StartupEvidenceBundle with 8 fields
-- Implemented classify_startup_failure() logic
-- Added observe_startup_timeout() method to Worker
-- Tests: 6 new tests verifying classification logic
-
-US-002 COMPLETED (Phase 2 - Canonical lane event schema)
-- Files: rust/crates/runtime/src/lane_events.rs
-- Added EventProvenance enum with 5 labels
-- Added SessionIdentity, LaneOwnership structs
-- Added LaneEventMetadata with sequence/ordering
-- Added LaneEventBuilder for construction
-- Implemented is_terminal_event(), dedupe_terminal_events()
-- Tests: 10 new tests for events and deduplication
-
-US-005 COMPLETED (Phase 4 - Typed task packet format)
-- Files:
-  - rust/crates/runtime/src/task_packet.rs
-  - rust/crates/runtime/src/task_registry.rs
-  - rust/crates/tools/src/lib.rs
-- Added TaskScope enum (Workspace, Module, SingleFile, Custom)
-- Updated TaskPacket with scope_path and worktree fields
-- Added validate_scope_requirements() validation logic
-- Fixed all test compilation errors in dependent modules
-- Tests: Updated existing tests to use new types
-
-PRE-EXISTING IMPLEMENTATIONS (verified working):
-------------------------------------------------
-
-US-003 COMPLETE (Phase 3 - Stale-branch detection)
-- Files: rust/crates/runtime/src/stale_branch.rs
-- BranchFreshness enum (Fresh, Stale, Diverged)
-- StaleBranchPolicy (AutoRebase, AutoMergeForward, WarnOnly, Block)
-- StaleBranchEvent with structured events
-- check_freshness() with git integration
-- apply_policy() with policy resolution
-- Tests: 12 unit tests + 5 integration tests passing
-
-US-004 COMPLETE (Phase 3 - Recovery recipes with ledger)
-- Files: rust/crates/runtime/src/recovery_recipes.rs
-- FailureScenario enum with 7 scenarios
-- RecoveryStep enum with actionable steps
-- RecoveryRecipe with step sequences
-- RecoveryLedger for attempt tracking
-- RecoveryEvent for structured emission
-- attempt_recovery() with escalation logic
-- Tests: 15 unit tests + 1 integration test passing
-
-US-006 COMPLETE (Phase 4 - Policy engine for autonomous coding)
-- Files: rust/crates/runtime/src/policy_engine.rs
-- PolicyRule with condition/action/priority
-- PolicyCondition (And, Or, GreenAt, StaleBranch, etc.)
-- PolicyAction (MergeToDev, RecoverOnce, Escalate, etc.)
-- LaneContext for evaluation context
-- evaluate() for rule matching
-- Tests: 18 unit tests + 6 integration tests passing
-
-US-007 COMPLETE (Phase 5 - Plugin/MCP lifecycle maturity)
-- Files: rust/crates/runtime/src/plugin_lifecycle.rs
-- ServerStatus enum (Healthy, Degraded, Failed)
-- ServerHealth with capabilities tracking
-- PluginState with full lifecycle states
-- PluginLifecycle event tracking
-- PluginHealthcheck structured results
-- DiscoveryResult for capability discovery
-- DegradedMode behavior
-- Tests: 11 unit tests passing
-
-
-Iteration 2026-04-27 - ROADMAP #200 COMPLETED
-------------------------------------------------
-- Selected next actionable backlog item because no active task was in progress.
-- ROADMAP #200: Interactive MCP/tool permission prompts are invisible blockers.
-- Files: rust/crates/runtime/src/worker_boot.rs, rust/crates/runtime/src/recovery_recipes.rs, ROADMAP.md, progress.txt.
-- Added tool_permission_required worker status and event classification for interactive MCP/tool permission gates.
-- Added structured ToolPermissionPrompt payload with server/tool identity and prompt preview.
-- Startup evidence now records tool_permission_prompt_detected and classifies timeout evidence as tool_permission_required.
-- Readiness snapshots now mark tool-permission-gated workers as blocked, not ready/idle.
-- Tests: targeted tool_permission regressions, full runtime test/clippy/fmt pending in Ralph verification loop.
-
-VERIFICATION STATUS:
-------------------
-- cargo build --workspace: PASSED
-- cargo test --workspace: PASSED (476+ unit tests, 12 integration tests)
-- cargo clippy --workspace: PASSED
-
-All 7 stories from prd.json now have passes: true
-
-Iteration 2: 2026-04-16
-------------------------
-
-US-009 COMPLETED (Add unit tests for kimi model compatibility fix)
-- Files: rust/crates/api/src/providers/openai_compat.rs
-- Added 4 comprehensive unit tests:
-  1. model_rejects_is_error_field_detects_kimi_models - verifies detection of kimi-k2.5, kimi-k1.5, dashscope/kimi-k2.5, case insensitivity
-  2. translate_message_includes_is_error_for_non_kimi_models - verifies gpt-4o, grok-3, claude include is_error
-  3. translate_message_excludes_is_error_for_kimi_models - verifies kimi models exclude is_error (prevents 400 Bad Request)
-  4. build_chat_completion_request_kimi_vs_non_kimi_tool_results - full integration test for request building
-- Tests: 4 new tests, 119 unit tests total in api crate (+4), all passing
-- Integration tests: 29 passing (no regressions)
-
-US-010 COMPLETED (Add model compatibility documentation)
-- Files: docs/MODEL_COMPATIBILITY.md
-- Created comprehensive documentation covering:
-  1. Kimi Models (is_error Exclusion) - documents the 400 Bad Request issue and solution
-  2. Reasoning Models (Tuning Parameter Stripping) - covers o1, o3, o4, grok-3-mini, qwen-qwq, qwen3-thinking
-  3. GPT-5 (max_completion_tokens) - documents max_tokens vs max_completion_tokens requirement
-  4. Qwen Models (DashScope Routing) - explains routing and authentication
-- Added implementation details section with key functions
-- Added "Adding New Models" guide for future contributors
-- Added testing section with example commands
-- Cross-referenced with existing code comments in openai_compat.rs
-- cargo clippy passes
-
-Iteration 3: 2026-04-16
-------------------------
-
-US-012 COMPLETED (Trust prompt resolver with allowlist auto-trust)
-- Files: rust/crates/runtime/src/trust_resolver.rs
-- Enhanced TrustConfig with pattern matching and serde support:
-  - TrustAllowlistEntry struct with pattern, worktree_pattern, description
-  - TrustResolution enum (AutoAllowlisted, ManualApproval)
-  - Enhanced TrustEvent variants with serde tags and metadata
-  - Glob pattern matching with * and ? wildcards
-  - Support for path prefix matching and worktree patterns
-- Updated TrustResolver with new resolve() signature:
-  - Added worktree parameter for worktree pattern matching
-  - Proper event emission with TrustResolution
-  - Manual approval detection from screen text
-- Added helper functions:
-  - extract_repo_name() - extracts repo name from path
-  - detect_manual_approval() - detects manual trust from screen text
-  - glob_matches() - recursive backtracking glob matcher
-- Tests: 25 new tests for pattern matching, serialization, and resolver behavior
-- All 483 runtime tests pass
-- cargo clippy passes with no warnings
-
-US-011 COMPLETED (Performance optimization: reduce API request serialization overhead)
-- Files:
-  - rust/crates/api/Cargo.toml (added criterion dev-dependency and bench config)
-  - rust/crates/api/benches/request_building.rs (new benchmark suite)
-  - rust/crates/api/src/providers/openai_compat.rs (optimizations)
-  - rust/crates/api/src/lib.rs (public exports for benchmarks)
-- Optimizations implemented:
-  1. flatten_tool_result_content: Pre-allocate String capacity and avoid intermediate Vec
-     - Before: collected to Vec<String> then joined
-     - After: single String with pre-calculated capacity, push directly
-  2. Made key functions public for benchmarking: translate_message, build_chat_completion_request,
-     flatten_tool_result_content, is_reasoning_model, model_rejects_is_error_field
-- Benchmark results:
-  - flatten_tool_result_content/single_text: ~17ns
-  - flatten_tool_result_content/multi_text (10 blocks): ~46ns
-  - flatten_tool_result_content/large_content (50 blocks): ~11.7µs
-  - translate_message/text_only: ~200ns
-  - translate_message/tool_result: ~348ns
-  - build_chat_completion_request/10 messages: ~16.4µs
-  - build_chat_completion_request/100 messages: ~209µs
-  - is_reasoning_model detection: ~26-42ns depending on model
-- All tests pass (119 unit tests + 29 integration tests)
-- cargo clippy passes
-
-VERIFICATION STATUS (Iteration 3):
-----------------------------------
-- cargo build --workspace: PASSED
-- cargo test --workspace: PASSED (891+ tests)
-- cargo clippy --workspace --all-targets -- -D warnings: PASSED
-- cargo fmt -- --check: PASSED
-
-All 12 stories from prd.json now have passes: true
-- US-001 through US-007: Pre-existing implementations
-- US-008: kimi-k2.5 model API compatibility fix
-- US-009: Unit tests for kimi model compatibility
-- US-010: Model compatibility documentation
-- US-011: Performance optimization with criterion benchmarks
-- US-012: Trust prompt resolver with allowlist auto-trust
-
-Iteration 4: 2026-04-16
-------------------------
-
-US-013 COMPLETED (Phase 2 - Session event ordering + terminal-state reconciliation)
-- Files: rust/crates/runtime/src/lane_events.rs
-- Added EventTerminality enum (Terminal, Advisory, Uncertainty)
-- Added classify_event_terminality() function for event classification
-- Added reconcile_terminal_events() function for deterministic event ordering:
-  - Sorts events by monotonic sequence number
-  - Deduplicates terminal events by fingerprint
-  - Detects transport death uncertainty (terminal + transport death)
-  - Handles out-of-order event bursts
-- Added events_materially_differ() for detecting meaningful differences
-- Added 8 comprehensive tests for reconciliation logic:
-  - reconcile_terminal_events_sorts_by_monotonic_sequence
-  - reconcile_terminal_events_deduplicates_same_fingerprint
-  - reconcile_terminal_events_detects_transport_death_uncertainty
-  - reconcile_terminal_events_handles_completed_idle_error_completed_noise
-  - reconcile_terminal_events_returns_none_for_empty_input
-  - reconcile_terminal_events_preserves_advisory_events
-  - events_materially_differ_detects_real_differences
-  - classify_event_terminality_correctly_classifies
-- Fixed test compilation issues with LaneEventBuilder API
-
-VERIFICATION STATUS (Iteration 4):
-----------------------------------
-- cargo build --workspace: PASSED
-- cargo test --workspace: PASSED (891+ tests)
-- cargo clippy --workspace --all-targets -- -D warnings: PASSED
-- cargo fmt -- --check: PASSED
-
-US-013 marked passes: true in prd.json
-
-US-014 COMPLETED (Phase 2 - Event provenance / environment labeling)
-- Files: rust/crates/runtime/src/lane_events.rs
-- Added ConfidenceLevel enum (High, Medium, Low, Unknown)
-- Added fields to LaneEventMetadata:
-  - environment_label: Option<String> - environment/channel (production, staging, dev)
-  - emitter_identity: Option<String> - emitter (clawd, plugin-name, operator-id)
-  - confidence_level: Option<ConfidenceLevel> - trust level for automation
-- Added builder methods: with_environment(), with_emitter(), with_confidence()
-- Added filtering functions:
-  - filter_by_provenance() - select events by source
-  - filter_by_environment() - select events by environment label
-  - filter_by_confidence() - select events above confidence threshold
-  - is_test_event() - check if synthetic source (test, healthcheck, replay)
-  - is_live_lane_event() - check if production event
-- Added 7 comprehensive tests for US-014:
-  - confidence_level_round_trips_through_serialization
-  - filter_by_provenance_selects_only_matching_events
-  - filter_by_environment_selects_only_matching_environment
-  - filter_by_confidence_selects_events_above_threshold
-  - is_test_event_detects_synthetic_sources
-  - is_live_lane_event_detects_production_events
-  - lane_event_metadata_includes_us014_fields
-
-US-016 COMPLETED (Phase 2 - Duplicate terminal-event suppression)
-- Files: rust/crates/runtime/src/lane_events.rs
-- Event fingerprinting already implemented via compute_event_fingerprint()
-- Fingerprint attached via LaneEventMetadata.event_fingerprint
-- Deduplication via dedupe_terminal_events() - returns first occurrence of each fingerprint
-- Raw event history preserved separately from deduplicated actionable events
-- Material difference detection via events_materially_differ():
-  - Different event type (Finished vs Failed) is material
-  - Different status is material
-  - Different failure class is material
-  - Different data payload is material
-- Reconcile function surfaces latest terminal event when materially different
-- Added 5 comprehensive tests for US-016:
-  - canonical_terminal_event_fingerprint_attached_to_metadata
-  - dedupe_terminal_events_suppresses_repeated_fingerprints
-  - dedupe_preserves_raw_event_history_separately
-  - events_materially_differ_detects_payload_differences
-  - reconcile_terminal_events_surfaces_latest_when_different
-
-US-017 COMPLETED (Phase 2 - Lane ownership / scope binding)
-- Files: rust/crates/runtime/src/lane_events.rs
-- LaneOwnership struct already existed with:
-  - owner: String - owner/assignee identity
-  - workflow_scope: String - workflow scope (claw-code-dogfood, etc.)
-  - watcher_action: WatcherAction - Act, Observe, Ignore
-- Ownership preserved through lifecycle via with_ownership() builder method
-- All lifecycle events (Started -> Ready -> Finished) preserve ownership
-- Added 3 comprehensive tests for US-017:
-  - lane_ownership_attached_to_metadata
-  - lane_ownership_preserved_through_lifecycle_events
-  - lane_ownership_watcher_action_variants
-
-US-015 COMPLETED (Phase 2 - Session identity completeness at creation time)
-- Files: rust/crates/runtime/src/lane_events.rs
-- SessionIdentity struct already existed with:
-  - title: String - stable title for the session
-  - workspace: String - workspace/worktree path
-  - purpose: String - lane/session purpose
-  - placeholder_reason: Option<String> - reason for placeholder values
-- Added reconcile_enriched() method for updating session identity:
-  - Updates title/workspace/purpose with newly available data
-  - Clears placeholder_reason when real values are provided
-  - Preserves existing values for fields not being updated
-  - Allows incremental enrichment without ambiguity
-- Added 2 comprehensive tests:
-  - session_identity_reconcile_enriched_updates_fields
-  - session_identity_reconcile_preserves_placeholder_if_no_new_data
-
-US-018 COMPLETED (Phase 2 - Nudge acknowledgment / dedupe contract)
-- Files: rust/crates/runtime/src/lane_events.rs
-- Added NudgeTracking struct:
-  - nudge_id: String - unique nudge identifier
-  - delivered_at: String - timestamp of delivery
-  - acknowledged: bool - whether acknowledged
-  - acknowledged_at: Option<String> - when acknowledged
-  - is_retry: bool - whether this is a retry
-  - original_nudge_id: Option<String> - original ID if retry
-- Added NudgeClassification enum (New, Retry, StaleDuplicate)
-- Added classify_nudge() function for deduplication logic
-- Added 6 comprehensive tests for US-018
-
-US-019 COMPLETED (Phase 2 - Stable roadmap-id assignment)
-- Files: rust/crates/runtime/src/lane_events.rs
-- Added RoadmapId struct:
-  - id: String - canonical unique identifier
-  - filed_at: String - timestamp when filed
-  - is_new_filing: bool - new vs update
-  - supersedes: Option<String> - lineage for supersedes
-- Added builder methods: new_filing(), update(), supersedes()
-- Added 3 comprehensive tests for US-019
-
-US-020 COMPLETED (Phase 2 - Roadmap item lifecycle state contract)
-- Files: rust/crates/runtime/src/lane_events.rs
-- Added RoadmapLifecycleState enum (Filed, Acknowledged, InProgress, Blocked, Done, Superseded)
-- Added RoadmapLifecycle struct:
-  - state: RoadmapLifecycleState - current state
-  - state_changed_at: String - last transition timestamp
-  - filed_at: String - original filing timestamp
-  - lineage: Vec<String> - supersession chain
-- Added methods: new_filed(), transition(), superseded_by(), is_terminal(), is_active()
-- Added 5 comprehensive tests for US-020
-
-VERIFICATION STATUS (Iteration 7):
-----------------------------------
-- cargo build --workspace: PASSED
-- cargo test --workspace: PASSED (891+ tests)
-- cargo clippy --workspace --all-targets -- -D warnings: PASSED
-- cargo fmt -- --check: PASSED
-
-US-013 through US-015 and US-018 through US-020 now marked passes: true
-
-FINAL VERIFICATION (All 20 Stories Complete):
-------------------------------------------------
-- cargo build --workspace: PASSED
-- cargo test --workspace: PASSED (119+ API tests, 39 runtime tests, 12 integration tests)
-- cargo clippy --workspace --all-targets -- -D warnings: PASSED
-- cargo fmt -- --check: PASSED
-
-ALL 20 STORIES FROM PRD COMPLETE:
-- US-001 through US-012: Pre-existing implementations (verified working)
-- US-013: Session event ordering + terminal-state reconciliation
-- US-014: Event provenance / environment labeling
-- US-015: Session identity completeness at creation time
-- US-016: Duplicate terminal-event suppression
-- US-017: Lane ownership / scope binding
-- US-018: Nudge acknowledgment / dedupe contract
-- US-019: Stable roadmap-id assignment
-- US-020: Roadmap item lifecycle state contract
-
-Iteration 8: 2026-04-16
-------------------------
-
-US-021 COMPLETED (Request body size pre-flight check - from dogfood findings)
-- Files:
-  - rust/crates/api/src/error.rs (new error variant)
-  - rust/crates/api/src/providers/openai_compat.rs
-- Added RequestBodySizeExceeded error variant with actionable message
-- Added max_request_body_bytes to OpenAiCompatConfig:
-  - DashScope: 6MB (6_291_456 bytes) - from dogfood with kimi-k2.5
-  - OpenAI: 100MB (104_857_600 bytes)
-  - xAI: 50MB (52_428_800 bytes)
-- Added estimate_request_body_size() for pre-flight checks
-- Added check_request_body_size() for validation
-- Pre-flight check integrated in send_raw_request()
-- Tests: 5 new tests for size estimation and limit checking
-
-PROJECT STATUS: COMPLETE (21/21 stories)
-
-Iteration 2026-04-29 - ROADMAP #96 COMPLETED
-------------------------------------------------
-- Pulled origin/main: already up to date.
-- Selected ROADMAP #96 as a small repo-local Immediate Backlog item: the `claw --help` Resume-safe command summary leaked slash-command stubs despite the main Interactive command listing filtering them.
-- Files: rust/crates/rusty-claude-cli/src/main.rs, ROADMAP.md, progress.txt.
-- Changed help rendering to filter `resume_supported_slash_commands()` through `STUB_COMMANDS` before building the Resume-safe one-liner.
-- Added `stub_commands_absent_from_resume_safe_help` regression coverage so future stub additions cannot leak into the Resume-safe summary.
-- Targeted verification: `cargo test -p rusty-claude-cli stub_commands_absent_from_resume_safe_help -- --nocapture` passed; `cargo test -p rusty-claude-cli parses_direct_cli_actions -- --nocapture` passed.
-- Format/check verification: `cargo fmt --all --check`, `git diff --check`, and `cargo check -p rusty-claude-cli` passed.
-- Broader clippy note: `cargo clippy -p rusty-claude-cli --all-targets -- -D warnings` is blocked by pre-existing `clippy::unnecessary_wraps` failures in `rust/crates/commands/src/lib.rs` (`render_mcp_report_for`, `render_mcp_report_json_for`), outside this diff.

rust/.claw.json

@@ -1,5 +0,0 @@
-{
-  "permissions": {
-    "defaultMode": "dontAsk"
-  }
-}

rust/.claw/sessions/session-1775386832313-0.jsonl

@@ -1 +1,2 @@
-{"created_at_ms":1775777421902,"session_id":"session-1775777421902-1","type":"session_meta","updated_at_ms":1775777421902,"version":1}
+{"created_at_ms":1775386832313,"session_id":"session-1775386832313-0","type":"session_meta","updated_at_ms":1775386832313,"version":1}
+{"message":{"blocks":[{"text":"status --help","type":"text"}],"role":"user"},"type":"message"}

rust/.gitignore

@@ -1,7 +1,3 @@
 target/
 .omx/
 .clawd-agents/
-# Claw Code local artifacts
-.claw/settings.local.json
-.claw/sessions/
-.clawhip/

rust/CLAUDE.md

@@ -1,16 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claw Code (clawcode.dev) when working with code in this repository.
-
-## Detected stack
-- Languages: Rust.
-- Frameworks: none detected from the supported starter markers.
-
-## Verification
-- From the repository root, run Rust formatting with `scripts/fmt.sh` (or `scripts/fmt.sh --check` for CI-style checks). From this `rust/` directory, the equivalent command is `../scripts/fmt.sh`. Root-level `cargo fmt --manifest-path rust/Cargo.toml` is not the supported formatting command.
-- From this `rust/` directory, run Rust verification with `cargo clippy --workspace --all-targets -- -D warnings` and `cargo test --workspace`.
-
-## Working agreement
-- Prefer small, reviewable changes and keep generated bootstrap files aligned with actual repo workflows.
-- Keep shared defaults in `.claw.json`; reserve `.claw/settings.local.json` for machine-local overrides.
-- Do not overwrite existing `CLAUDE.md` content automatically; update it intentionally when repo workflows change.

rust/Cargo.lock

@@ -17,23 +17,10 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "anes"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
 [[package]]
 name = "api"
 version = "0.1.0"
 dependencies = [
- "criterion",
  "reqwest",
  "runtime",
  "serde",
@@ -48,12 +35,6 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
-[[package]]
-name = "autocfg"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -96,12 +77,6 @@ version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
-[[package]]
-name = "cast"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
-
 [[package]]
 name = "cc"
 version = "1.2.58"
@@ -124,58 +99,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "ciborium"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
-dependencies = [
- "ciborium-io",
- "ciborium-ll",
- "serde",
-]
-
-[[package]]
-name = "ciborium-io"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
-
-[[package]]
-name = "ciborium-ll"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
-dependencies = [
- "ciborium-io",
- "half",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
-dependencies = [
- "clap_builder",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
-dependencies = [
- "anstyle",
- "clap_lex",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -221,67 +144,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "criterion"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f"
-dependencies = [
- "anes",
- "cast",
- "ciborium",
- "clap",
- "criterion-plot",
- "is-terminal",
- "itertools",
- "num-traits",
- "once_cell",
- "oorandom",
- "plotters",
- "rayon",
- "regex",
- "serde",
- "serde_derive",
- "serde_json",
- "tinytemplate",
- "walkdir",
-]
-
-[[package]]
-name = "criterion-plot"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
-dependencies = [
- "cast",
- "itertools",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
-
 [[package]]
 name = "crossterm"
 version = "0.28.1"
@@ -307,12 +169,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -353,12 +209,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "either"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
-
 [[package]]
 name = "endian-type"
 version = "0.1.2"
@@ -395,7 +245,7 @@ checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
 dependencies = [
  "cfg-if",
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -530,29 +380,12 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
-[[package]]
-name = "half"
-version = "2.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
-dependencies = [
- "cfg-if",
- "crunchy",
- "zerocopy",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
-[[package]]
-name = "hermit-abi"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
-
 [[package]]
 name = "home"
 version = "0.5.12"
@@ -789,26 +622,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "is-terminal"
-version = "0.4.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "itertools"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -942,15 +755,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
 
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -979,12 +783,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "oorandom"
-version = "11.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
-
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -1039,34 +837,6 @@ dependencies = [
  "time",
 ]
 
-[[package]]
-name = "plotters"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
-dependencies = [
- "num-traits",
- "plotters-backend",
- "plotters-svg",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "plotters-backend"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a"
-
-[[package]]
-name = "plotters-svg"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670"
-dependencies = [
- "plotters-backend",
-]
-
 [[package]]
 name = "plugins"
 version = "0.1.0"
@@ -1245,26 +1015,6 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
-[[package]]
-name = "rayon"
-version = "1.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -1388,7 +1138,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1772,16 +1522,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "tinytemplate"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
-dependencies = [
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "tinyvec"
 version = "1.11.0"

rust/README.md

@@ -34,10 +34,10 @@ export ANTHROPIC_API_KEY="sk-ant-..."
 export ANTHROPIC_BASE_URL="https://your-proxy.com"
 ```
 
-Or provide an OAuth bearer token directly:
+Or authenticate via OAuth and let the CLI persist credentials locally:
 
 ```bash
-export ANTHROPIC_AUTH_TOKEN="anthropic-oauth-or-proxy-bearer-token"
+cargo run -p rusty-claude-cli -- login
 ```
 
 ## Mock parity harness
@@ -80,7 +80,7 @@ Primary artifacts:
 | Feature | Status |
 |---------|--------|
 | Anthropic / OpenAI-compatible provider flows + streaming | ✅ |
-| Direct bearer-token auth via `ANTHROPIC_AUTH_TOKEN` | ✅ |
+| OAuth login/logout | ✅ |
 | Interactive REPL (rustyline) | ✅ |
 | Tool system (bash, read, write, edit, grep, glob) | ✅ |
 | Web tools (search, fetch) | ✅ |
@@ -135,18 +135,17 @@ Top-level commands:
   version
   status
   sandbox
-  acp [serve]
   dump-manifests
   bootstrap-plan
   agents
   mcp
   skills
   system-prompt
+  login
+  logout
   init
 ```
 
-`claw acp` is a local discoverability surface for editor-first users: it reports the current ACP/Zed status without starting the runtime. As of April 16, 2026, claw-code does **not** ship an ACP/Zed daemon entrypoint yet, and `claw acp serve` is only a status alias until the real protocol surface lands.
-
 The command surface is moving quickly. For the canonical live help text, run:
 
 ```bash
@@ -160,8 +159,8 @@ Tab completion expands slash commands, model aliases, permission modes, and rece
 The REPL now exposes a much broader surface than the original minimal shell:
 
 - session / visibility: `/help`, `/status`, `/sandbox`, `/cost`, `/resume`, `/session`, `/version`, `/usage`, `/stats`
-- workspace / git: `/compact`, `/clear`, `/config`, `/memory`, `/init`, `/diff`, `/commit`, `/pr`, `/issue`, `/export`, `/hooks`, `/files`, `/release-notes`
-- discovery / debugging: `/mcp`, `/agents`, `/skills`, `/doctor`, `/tasks`, `/context`, `/desktop`
+- workspace / git: `/compact`, `/clear`, `/config`, `/memory`, `/init`, `/diff`, `/commit`, `/pr`, `/issue`, `/export`, `/hooks`, `/files`, `/branch`, `/release-notes`, `/add-dir`
+- discovery / debugging: `/mcp`, `/agents`, `/skills`, `/doctor`, `/tasks`, `/context`, `/desktop`, `/ide`
 - automation / analysis: `/review`, `/advisor`, `/insights`, `/security-review`, `/subagent`, `/team`, `/telemetry`, `/providers`, `/cron`, and more
 - plugin management: `/plugin` (with aliases `/plugins`, `/marketplace`)
 
@@ -195,7 +194,7 @@ rust/
 
 ### Crate Responsibilities
 
-- **api** — provider clients, SSE streaming, request/response types, auth (`ANTHROPIC_API_KEY` + bearer-token support), request-size/context-window preflight
+- **api** — provider clients, SSE streaming, request/response types, auth (API key + OAuth bearer), request-size/context-window preflight
 - **commands** — slash command definitions, parsing, help text generation, JSON/text command rendering
 - **compat-harness** — extracts tool/prompt manifests from upstream TS source
 - **mock-anthropic-service** — deterministic `/v1/messages` mock for CLI parity tests and local harness runs

rust/crates/api/Cargo.toml

@@ -13,12 +13,5 @@ serde_json.workspace = true
 telemetry = { path = "../telemetry" }
 tokio = { version = "1", features = ["io-util", "macros", "net", "rt-multi-thread", "time"] }
 
-[dev-dependencies]
-criterion = { version = "0.5", features = ["html_reports"] }
-
 [lints]
 workspace = true
-
-[[bench]]
-name = "request_building"
-harness = false

rust/crates/api/benches/request_building.rs

@@ -1,329 +0,0 @@
-// Benchmarks for API request building performance
-// Benchmarks are exempt from strict linting as they are test/performance code
-#![allow(
-    clippy::cognitive_complexity,
-    clippy::doc_markdown,
-    clippy::explicit_iter_loop,
-    clippy::format_in_format_args,
-    clippy::missing_docs_in_private_items,
-    clippy::must_use_candidate,
-    clippy::needless_pass_by_value,
-    clippy::clone_on_copy,
-    clippy::too_many_lines,
-    clippy::uninlined_format_args
-)]
-
-use api::{
-    build_chat_completion_request, flatten_tool_result_content, is_reasoning_model,
-    translate_message, InputContentBlock, InputMessage, MessageRequest, OpenAiCompatConfig,
-    ToolResultContentBlock,
-};
-use criterion::{black_box, criterion_group, criterion_main, BenchmarkId, Criterion};
-use serde_json::json;
-
-/// Create a sample message request with various content types
-fn create_sample_request(message_count: usize) -> MessageRequest {
-    let mut messages = Vec::with_capacity(message_count);
-
-    for i in 0..message_count {
-        match i % 4 {
-            0 => messages.push(InputMessage::user_text(format!("Message {}", i))),
-            1 => messages.push(InputMessage {
-                role: "assistant".to_string(),
-                content: vec![
-                    InputContentBlock::Text {
-                        text: format!("Assistant response {}", i),
-                    },
-                    InputContentBlock::ToolUse {
-                        id: format!("call_{}", i),
-                        name: "read_file".to_string(),
-                        input: json!({"path": format!("/tmp/file{}", i)}),
-                    },
-                ],
-            }),
-            2 => messages.push(InputMessage {
-                role: "user".to_string(),
-                content: vec![InputContentBlock::ToolResult {
-                    tool_use_id: format!("call_{}", i - 1),
-                    content: vec![ToolResultContentBlock::Text {
-                        text: format!("Tool result content {}", i),
-                    }],
-                    is_error: false,
-                }],
-            }),
-            _ => messages.push(InputMessage {
-                role: "assistant".to_string(),
-                content: vec![InputContentBlock::ToolUse {
-                    id: format!("call_{}", i),
-                    name: "write_file".to_string(),
-                    input: json!({"path": format!("/tmp/out{}", i), "content": "data"}),
-                }],
-            }),
-        }
-    }
-
-    MessageRequest {
-        model: "gpt-4o".to_string(),
-        max_tokens: 1024,
-        messages,
-        stream: false,
-        system: Some("You are a helpful assistant.".to_string()),
-        temperature: Some(0.7),
-        top_p: None,
-        tools: None,
-        tool_choice: None,
-        frequency_penalty: None,
-        presence_penalty: None,
-        stop: None,
-        reasoning_effort: None,
-    }
-}
-
-/// Benchmark translate_message with various message types
-fn bench_translate_message(c: &mut Criterion) {
-    let mut group = c.benchmark_group("translate_message");
-
-    // Text-only message
-    let text_message = InputMessage::user_text("Simple text message".to_string());
-    group.bench_with_input(
-        BenchmarkId::new("text_only", "single"),
-        &text_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("gpt-4o")));
-        },
-    );
-
-    // Assistant message with tool calls
-    let assistant_message = InputMessage {
-        role: "assistant".to_string(),
-        content: vec![
-            InputContentBlock::Text {
-                text: "I'll help you with that.".to_string(),
-            },
-            InputContentBlock::ToolUse {
-                id: "call_1".to_string(),
-                name: "read_file".to_string(),
-                input: json!({"path": "/tmp/test"}),
-            },
-            InputContentBlock::ToolUse {
-                id: "call_2".to_string(),
-                name: "write_file".to_string(),
-                input: json!({"path": "/tmp/out", "content": "data"}),
-            },
-        ],
-    };
-    group.bench_with_input(
-        BenchmarkId::new("assistant_with_tools", "2_tools"),
-        &assistant_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("gpt-4o")));
-        },
-    );
-
-    // Tool result message
-    let tool_result_message = InputMessage {
-        role: "user".to_string(),
-        content: vec![InputContentBlock::ToolResult {
-            tool_use_id: "call_1".to_string(),
-            content: vec![ToolResultContentBlock::Text {
-                text: "File contents here".to_string(),
-            }],
-            is_error: false,
-        }],
-    };
-    group.bench_with_input(
-        BenchmarkId::new("tool_result", "single"),
-        &tool_result_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("gpt-4o")));
-        },
-    );
-
-    // Tool result for kimi model (is_error excluded)
-    group.bench_with_input(
-        BenchmarkId::new("tool_result_kimi", "kimi-k2.5"),
-        &tool_result_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("kimi-k2.5")));
-        },
-    );
-
-    // Large content message
-    let large_content = "x".repeat(10000);
-    let large_message = InputMessage::user_text(large_content);
-    group.bench_with_input(
-        BenchmarkId::new("large_text", "10kb"),
-        &large_message,
-        |b, msg| {
-            b.iter(|| translate_message(black_box(msg), black_box("gpt-4o")));
-        },
-    );
-
-    group.finish();
-}
-
-/// Benchmark build_chat_completion_request with various message counts
-fn bench_build_request(c: &mut Criterion) {
-    let mut group = c.benchmark_group("build_chat_completion_request");
-    let config = OpenAiCompatConfig::openai();
-
-    for message_count in [10, 50, 100].iter() {
-        let request = create_sample_request(*message_count);
-        group.bench_with_input(
-            BenchmarkId::new("message_count", message_count),
-            &request,
-            |b, req| {
-                b.iter(|| build_chat_completion_request(black_box(req), config.clone()));
-            },
-        );
-    }
-
-    // Benchmark with reasoning model (tuning params stripped)
-    let mut reasoning_request = create_sample_request(50);
-    reasoning_request.model = "o1-mini".to_string();
-    group.bench_with_input(
-        BenchmarkId::new("reasoning_model", "o1-mini"),
-        &reasoning_request,
-        |b, req| {
-            b.iter(|| build_chat_completion_request(black_box(req), config.clone()));
-        },
-    );
-
-    // Benchmark with gpt-5 (max_completion_tokens)
-    let mut gpt5_request = create_sample_request(50);
-    gpt5_request.model = "gpt-5".to_string();
-    group.bench_with_input(
-        BenchmarkId::new("gpt5", "gpt-5"),
-        &gpt5_request,
-        |b, req| {
-            b.iter(|| build_chat_completion_request(black_box(req), config.clone()));
-        },
-    );
-
-    group.finish();
-}
-
-/// Benchmark flatten_tool_result_content
-fn bench_flatten_tool_result(c: &mut Criterion) {
-    let mut group = c.benchmark_group("flatten_tool_result_content");
-
-    // Single text block
-    let single_text = vec![ToolResultContentBlock::Text {
-        text: "Simple result".to_string(),
-    }];
-    group.bench_with_input(
-        BenchmarkId::new("single_text", "1_block"),
-        &single_text,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    // Multiple text blocks
-    let multi_text: Vec<ToolResultContentBlock> = (0..10)
-        .map(|i| ToolResultContentBlock::Text {
-            text: format!("Line {}: some content here\n", i),
-        })
-        .collect();
-    group.bench_with_input(
-        BenchmarkId::new("multi_text", "10_blocks"),
-        &multi_text,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    // JSON content blocks
-    let json_content: Vec<ToolResultContentBlock> = (0..5)
-        .map(|i| ToolResultContentBlock::Json {
-            value: json!({"index": i, "data": "test content", "nested": {"key": "value"}}),
-        })
-        .collect();
-    group.bench_with_input(
-        BenchmarkId::new("json_content", "5_blocks"),
-        &json_content,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    // Mixed content
-    let mixed_content = vec![
-        ToolResultContentBlock::Text {
-            text: "Here's the result:".to_string(),
-        },
-        ToolResultContentBlock::Json {
-            value: json!({"status": "success", "count": 42}),
-        },
-        ToolResultContentBlock::Text {
-            text: "Processing complete.".to_string(),
-        },
-    ];
-    group.bench_with_input(
-        BenchmarkId::new("mixed_content", "text+json"),
-        &mixed_content,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    // Large content - simulating typical tool output
-    let large_content: Vec<ToolResultContentBlock> = (0..50)
-        .map(|i| {
-            if i % 3 == 0 {
-                ToolResultContentBlock::Json {
-                    value: json!({"line": i, "content": "x".repeat(100)}),
-                }
-            } else {
-                ToolResultContentBlock::Text {
-                    text: format!("Line {}: {}", i, "some output content here"),
-                }
-            }
-        })
-        .collect();
-    group.bench_with_input(
-        BenchmarkId::new("large_content", "50_blocks"),
-        &large_content,
-        |b, content| {
-            b.iter(|| flatten_tool_result_content(black_box(content)));
-        },
-    );
-
-    group.finish();
-}
-
-/// Benchmark is_reasoning_model detection
-fn bench_is_reasoning_model(c: &mut Criterion) {
-    let mut group = c.benchmark_group("is_reasoning_model");
-
-    let models = vec![
-        ("gpt-4o", false),
-        ("o1-mini", true),
-        ("o3", true),
-        ("grok-3", false),
-        ("grok-3-mini", true),
-        ("qwen/qwen-qwq-32b", true),
-        ("qwen/qwen-plus", false),
-    ];
-
-    for (model, expected) in models {
-        group.bench_with_input(
-            BenchmarkId::new(model, if expected { "reasoning" } else { "normal" }),
-            model,
-            |b, m| {
-                b.iter(|| is_reasoning_model(black_box(m)));
-            },
-        );
-    }
-
-    group.finish();
-}
-
-criterion_group!(
-    benches,
-    bench_translate_message,
-    bench_build_request,
-    bench_flatten_tool_result,
-    bench_is_reasoning_model
-);
-criterion_main!(benches);

rust/crates/api/src/client.rs

@@ -232,7 +232,10 @@ mod tests {
                     openai_client.base_url()
                 );
             }
-            other => panic!("Expected ProviderClient::OpenAi for qwen-plus, got: {other:?}"),
+            other => panic!(
+                "Expected ProviderClient::OpenAi for qwen-plus, got: {:?}",
+                other
+            ),
         }
     }
 }

rust/crates/api/src/error.rs

@@ -24,7 +24,7 @@ pub enum ApiError {
         env_vars: &'static [&'static str],
         /// Optional, runtime-computed hint appended to the error Display
         /// output. Populated when the provider resolver can infer what the
-        /// user probably intended (e.g. an `OpenAI` key is set but Anthropic
+        /// user probably intended (e.g. an OpenAI key is set but Anthropic
         /// was selected because no Anthropic credentials exist).
         hint: Option<String>,
     },
@@ -53,8 +53,6 @@ pub enum ApiError {
         request_id: Option<String>,
         body: String,
         retryable: bool,
-        /// Suggested user action based on error type (e.g., "Reduce prompt size" for 413)
-        suggested_action: Option<String>,
     },
     RetriesExhausted {
         attempts: u32,
@@ -65,11 +63,6 @@ pub enum ApiError {
         attempt: u32,
         base_delay: Duration,
     },
-    RequestBodySizeExceeded {
-        estimated_bytes: usize,
-        max_bytes: usize,
-        provider: &'static str,
-    },
 }
 
 impl ApiError {
@@ -136,8 +129,7 @@ impl ApiError {
             | Self::Io(_)
             | Self::Json { .. }
             | Self::InvalidSseFrame(_)
-            | Self::BackoffOverflow { .. }
-            | Self::RequestBodySizeExceeded { .. } => false,
+            | Self::BackoffOverflow { .. } => false,
         }
     }
 
@@ -155,8 +147,7 @@ impl ApiError {
             | Self::Io(_)
             | Self::Json { .. }
             | Self::InvalidSseFrame(_)
-            | Self::BackoffOverflow { .. }
-            | Self::RequestBodySizeExceeded { .. } => None,
+            | Self::BackoffOverflow { .. } => None,
         }
     }
 
@@ -181,7 +172,6 @@ impl ApiError {
                 "provider_transport"
             }
             Self::InvalidApiKeyEnv(_) | Self::Io(_) | Self::Json { .. } => "runtime_io",
-            Self::RequestBodySizeExceeded { .. } => "request_size",
         }
     }
 
@@ -204,8 +194,7 @@ impl ApiError {
             | Self::Io(_)
             | Self::Json { .. }
             | Self::InvalidSseFrame(_)
-            | Self::BackoffOverflow { .. }
-            | Self::RequestBodySizeExceeded { .. } => false,
+            | Self::BackoffOverflow { .. } => false,
         }
     }
 
@@ -234,14 +223,12 @@ impl ApiError {
             | Self::Io(_)
             | Self::Json { .. }
             | Self::InvalidSseFrame(_)
-            | Self::BackoffOverflow { .. }
-            | Self::RequestBodySizeExceeded { .. } => false,
+            | Self::BackoffOverflow { .. } => false,
         }
     }
 }
 
 impl Display for ApiError {
-    #[allow(clippy::too_many_lines)]
     fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
         match self {
             Self::MissingCredentials {
@@ -337,14 +324,6 @@ impl Display for ApiError {
                 f,
                 "retry backoff overflowed on attempt {attempt} with base delay {base_delay:?}"
             ),
-            Self::RequestBodySizeExceeded {
-                estimated_bytes,
-                max_bytes,
-                provider,
-            } => write!(
-                f,
-                "request body size ({estimated_bytes} bytes) exceeds {provider} limit ({max_bytes} bytes); reduce prompt length or context before retrying"
-            ),
         }
     }
 }
@@ -490,7 +469,6 @@ mod tests {
             request_id: Some("req_jobdori_123".to_string()),
             body: String::new(),
             retryable: true,
-            suggested_action: None,
         };
 
         assert!(error.is_generic_fatal_wrapper());
@@ -513,7 +491,6 @@ mod tests {
                 request_id: Some("req_nested_456".to_string()),
                 body: String::new(),
                 retryable: true,
-                suggested_action: None,
             }),
         };
 
@@ -534,7 +511,6 @@ mod tests {
             request_id: Some("req_ctx_123".to_string()),
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         assert!(error.is_context_window_failure());

rust/crates/api/src/http_client.rs

@@ -88,12 +88,12 @@ pub fn build_http_client_with(config: &ProxyConfig) -> Result<reqwest::Client, A
         .as_deref()
         .and_then(reqwest::NoProxy::from_string);
 
-    let (http_proxy_url, https_url) = match config.proxy_url.as_deref() {
+    let (http_proxy_url, https_proxy_url) = match config.proxy_url.as_deref() {
         Some(unified) => (Some(unified), Some(unified)),
         None => (config.http_proxy.as_deref(), config.https_proxy.as_deref()),
     };
 
-    if let Some(url) = https_url {
+    if let Some(url) = https_proxy_url {
         let mut proxy = reqwest::Proxy::https(url)?;
         if let Some(filter) = no_proxy.clone() {
             proxy = proxy.no_proxy(Some(filter));

rust/crates/api/src/lib.rs

@@ -19,10 +19,7 @@ pub use prompt_cache::{
     PromptCacheStats,
 };
 pub use providers::anthropic::{AnthropicClient, AnthropicClient as ApiClient, AuthSource};
-pub use providers::openai_compat::{
-    build_chat_completion_request, flatten_tool_result_content, is_reasoning_model,
-    model_rejects_is_error_field, translate_message, OpenAiCompatClient, OpenAiCompatConfig,
-};
+pub use providers::openai_compat::{OpenAiCompatClient, OpenAiCompatConfig};
 pub use providers::{
     detect_provider_kind, max_tokens_for_model, max_tokens_for_model_with_override,
     resolve_model_alias, ProviderKind,

rust/crates/api/src/providers/anthropic.rs

@@ -502,8 +502,9 @@ impl AnthropicClient {
         // Best-effort refinement using the Anthropic count_tokens endpoint.
         // On any failure (network, parse, auth), fall back to the local
         // byte-estimate result which already passed above.
-        let Ok(counted_input_tokens) = self.count_tokens(request).await else {
-            return Ok(());
+        let counted_input_tokens = match self.count_tokens(request).await {
+            Ok(count) => count,
+            Err(_) => return Ok(()),
         };
         let estimated_total_tokens = counted_input_tokens.saturating_add(request.max_tokens);
         if estimated_total_tokens > limit.context_window_tokens {
@@ -630,7 +631,21 @@ impl AuthSource {
         if let Some(bearer_token) = read_env_non_empty("ANTHROPIC_AUTH_TOKEN")? {
             return Ok(Self::BearerToken(bearer_token));
         }
-        Err(anthropic_missing_credentials())
+        match load_saved_oauth_token() {
+            Ok(Some(token_set)) if oauth_token_is_expired(&token_set) => {
+                if token_set.refresh_token.is_some() {
+                    Err(ApiError::Auth(
+                        "saved OAuth token is expired; load runtime OAuth config to refresh it"
+                            .to_string(),
+                    ))
+                } else {
+                    Err(ApiError::ExpiredOAuthToken)
+                }
+            }
+            Ok(Some(token_set)) => Ok(Self::BearerToken(token_set.access_token)),
+            Ok(None) => Err(anthropic_missing_credentials()),
+            Err(error) => Err(error),
+        }
     }
 }
 
@@ -650,14 +665,14 @@ pub fn resolve_saved_oauth_token(config: &OAuthConfig) -> Result<Option<OAuthTok
 
 pub fn has_auth_from_env_or_saved() -> Result<bool, ApiError> {
     Ok(read_env_non_empty("ANTHROPIC_API_KEY")?.is_some()
-        || read_env_non_empty("ANTHROPIC_AUTH_TOKEN")?.is_some())
+        || read_env_non_empty("ANTHROPIC_AUTH_TOKEN")?.is_some()
+        || load_saved_oauth_token()?.is_some())
 }
 
 pub fn resolve_startup_auth_source<F>(load_oauth_config: F) -> Result<AuthSource, ApiError>
 where
     F: FnOnce() -> Result<Option<OAuthConfig>, ApiError>,
 {
-    let _ = load_oauth_config;
     if let Some(api_key) = read_env_non_empty("ANTHROPIC_API_KEY")? {
         return match read_env_non_empty("ANTHROPIC_AUTH_TOKEN")? {
             Some(bearer_token) => Ok(AuthSource::ApiKeyAndBearer {
@@ -670,7 +685,25 @@ where
     if let Some(bearer_token) = read_env_non_empty("ANTHROPIC_AUTH_TOKEN")? {
         return Ok(AuthSource::BearerToken(bearer_token));
     }
-    Err(anthropic_missing_credentials())
+
+    let Some(token_set) = load_saved_oauth_token()? else {
+        return Err(anthropic_missing_credentials());
+    };
+    if !oauth_token_is_expired(&token_set) {
+        return Ok(AuthSource::BearerToken(token_set.access_token));
+    }
+    if token_set.refresh_token.is_none() {
+        return Err(ApiError::ExpiredOAuthToken);
+    }
+
+    let Some(config) = load_oauth_config()? else {
+        return Err(ApiError::Auth(
+            "saved OAuth token is expired; runtime OAuth config is missing".to_string(),
+        ));
+    };
+    Ok(AuthSource::from(resolve_saved_oauth_token_set(
+        &config, token_set,
+    )?))
 }
 
 fn resolve_saved_oauth_token_set(
@@ -885,7 +918,6 @@ async fn expect_success(response: reqwest::Response) -> Result<reqwest::Response
         request_id,
         body,
         retryable,
-        suggested_action: None,
     })
 }
 
@@ -910,7 +942,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
         request_id,
         body,
         retryable,
-        suggested_action,
     } = error
     else {
         return error;
@@ -923,7 +954,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
             request_id,
             body,
             retryable,
-            suggested_action,
         };
     }
     let Some(bearer_token) = auth.bearer_token() else {
@@ -934,7 +964,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
             request_id,
             body,
             retryable,
-            suggested_action,
         };
     };
     if !bearer_token.starts_with("sk-ant-") {
@@ -945,7 +974,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
             request_id,
             body,
             retryable,
-            suggested_action,
         };
     }
     // Only append the hint when the AuthSource is pure BearerToken. If both
@@ -960,7 +988,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
             request_id,
             body,
             retryable,
-            suggested_action,
         };
     }
     let enriched_message = match message {
@@ -974,7 +1001,6 @@ fn enrich_bearer_auth_error(error: ApiError, auth: &AuthSource) -> ApiError {
         request_id,
         body,
         retryable,
-        suggested_action,
     }
 }
 
@@ -990,7 +1016,7 @@ fn strip_unsupported_beta_body_fields(body: &mut Value) {
         object.remove("presence_penalty");
         // Anthropic uses "stop_sequences" not "stop". Convert if present.
         if let Some(stop_val) = object.remove("stop") {
-            if stop_val.as_array().is_some_and(|a| !a.is_empty()) {
+            if stop_val.as_array().map_or(false, |a| !a.is_empty()) {
                 object.insert("stop_sequences".to_string(), stop_val);
             }
         }
@@ -1154,7 +1180,7 @@ mod tests {
     }
 
     #[test]
-    fn auth_source_from_env_or_saved_ignores_saved_oauth_when_env_absent() {
+    fn auth_source_from_saved_oauth_when_env_absent() {
         let _guard = env_lock();
         let config_home = temp_config_home();
         std::env::set_var("CLAW_CONFIG_HOME", &config_home);
@@ -1168,8 +1194,8 @@ mod tests {
         })
         .expect("save oauth credentials");
 
-        let error = AuthSource::from_env_or_saved().expect_err("saved oauth should be ignored");
-        assert!(error.to_string().contains("ANTHROPIC_API_KEY"));
+        let auth = AuthSource::from_env_or_saved().expect("saved auth");
+        assert_eq!(auth.bearer_token(), Some("saved-access-token"));
 
         clear_oauth_credentials().expect("clear credentials");
         std::env::remove_var("CLAW_CONFIG_HOME");
@@ -1225,7 +1251,7 @@ mod tests {
     }
 
     #[test]
-    fn resolve_startup_auth_source_ignores_saved_oauth_without_loading_config() {
+    fn resolve_startup_auth_source_uses_saved_oauth_without_loading_config() {
         let _guard = env_lock();
         let config_home = temp_config_home();
         std::env::set_var("CLAW_CONFIG_HOME", &config_home);
@@ -1239,9 +1265,41 @@ mod tests {
         })
         .expect("save oauth credentials");
 
-        let error = resolve_startup_auth_source(|| panic!("config should not be loaded"))
-            .expect_err("saved oauth should be ignored");
-        assert!(error.to_string().contains("ANTHROPIC_API_KEY"));
+        let auth = resolve_startup_auth_source(|| panic!("config should not be loaded"))
+            .expect("startup auth");
+        assert_eq!(auth.bearer_token(), Some("saved-access-token"));
+
+        clear_oauth_credentials().expect("clear credentials");
+        std::env::remove_var("CLAW_CONFIG_HOME");
+        cleanup_temp_config_home(&config_home);
+    }
+
+    #[test]
+    fn resolve_startup_auth_source_errors_when_refreshable_token_lacks_config() {
+        let _guard = env_lock();
+        let config_home = temp_config_home();
+        std::env::set_var("CLAW_CONFIG_HOME", &config_home);
+        std::env::remove_var("ANTHROPIC_AUTH_TOKEN");
+        std::env::remove_var("ANTHROPIC_API_KEY");
+        save_oauth_credentials(&runtime::OAuthTokenSet {
+            access_token: "expired-access-token".to_string(),
+            refresh_token: Some("refresh-token".to_string()),
+            expires_at: Some(1),
+            scopes: vec!["scope:a".to_string()],
+        })
+        .expect("save expired oauth credentials");
+
+        let error =
+            resolve_startup_auth_source(|| Ok(None)).expect_err("missing config should error");
+        assert!(
+            matches!(error, crate::error::ApiError::Auth(message) if message.contains("runtime OAuth config is missing"))
+        );
+
+        let stored = runtime::load_oauth_credentials()
+            .expect("load stored credentials")
+            .expect("stored token set");
+        assert_eq!(stored.access_token, "expired-access-token");
+        assert_eq!(stored.refresh_token.as_deref(), Some("refresh-token"));
 
         clear_oauth_credentials().expect("clear credentials");
         std::env::remove_var("CLAW_CONFIG_HOME");
@@ -1562,7 +1620,6 @@ mod tests {
             request_id: Some("req_varleg_001".to_string()),
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         // when
@@ -1603,7 +1660,6 @@ mod tests {
             request_id: None,
             body: String::new(),
             retryable: true,
-            suggested_action: None,
         };
 
         // when
@@ -1632,7 +1688,6 @@ mod tests {
             request_id: None,
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         // when
@@ -1660,7 +1715,6 @@ mod tests {
             request_id: None,
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         // when
@@ -1685,7 +1739,6 @@ mod tests {
             request_id: None,
             body: String::new(),
             retryable: false,
-            suggested_action: None,
         };
 
         // when

rust/crates/api/src/providers/mod.rs

@@ -122,15 +122,6 @@ const MODEL_REGISTRY: &[(&str, ProviderMetadata)] = &[
             default_base_url: openai_compat::DEFAULT_XAI_BASE_URL,
         },
     ),
-    (
-        "kimi",
-        ProviderMetadata {
-            provider: ProviderKind::OpenAi,
-            auth_env: "DASHSCOPE_API_KEY",
-            base_url_env: "DASHSCOPE_BASE_URL",
-            default_base_url: openai_compat::DEFAULT_DASHSCOPE_BASE_URL,
-        },
-    ),
 ];
 
 #[must_use]
@@ -153,10 +144,7 @@ pub fn resolve_model_alias(model: &str) -> String {
                     "grok-2" => "grok-2",
                     _ => trimmed,
                 },
-                ProviderKind::OpenAi => match *alias {
-                    "kimi" => "kimi-k2.5",
-                    _ => trimmed,
-                },
+                ProviderKind::OpenAi => trimmed,
             })
         })
         .map_or_else(|| trimmed.to_string(), ToOwned::to_owned)
@@ -206,16 +194,6 @@ pub fn metadata_for_model(model: &str) -> Option<ProviderMetadata> {
             default_base_url: openai_compat::DEFAULT_DASHSCOPE_BASE_URL,
         });
     }
-    // Kimi models (kimi-k2.5, kimi-k1.5, etc.) via DashScope compatible-mode.
-    // Routes kimi/* and kimi-* model names to DashScope endpoint.
-    if canonical.starts_with("kimi/") || canonical.starts_with("kimi-") {
-        return Some(ProviderMetadata {
-            provider: ProviderKind::OpenAi,
-            auth_env: "DASHSCOPE_API_KEY",
-            base_url_env: "DASHSCOPE_BASE_URL",
-            default_base_url: openai_compat::DEFAULT_DASHSCOPE_BASE_URL,
-        });
-    }
     None
 }
 
@@ -224,15 +202,6 @@ pub fn detect_provider_kind(model: &str) -> ProviderKind {
     if let Some(metadata) = metadata_for_model(model) {
         return metadata.provider;
     }
-    // When OPENAI_BASE_URL is set, the user explicitly configured an
-    // OpenAI-compatible endpoint. Prefer it over the Anthropic fallback
-    // even when the model name has no recognized prefix — this is the
-    // common case for local providers (Ollama, LM Studio, vLLM, etc.)
-    // where model names like "qwen2.5-coder:7b" don't match any prefix.
-    if std::env::var_os("OPENAI_BASE_URL").is_some() && openai_compat::has_api_key("OPENAI_API_KEY")
-    {
-        return ProviderKind::OpenAi;
-    }
     if anthropic::has_auth_from_env_or_saved().unwrap_or(false) {
         return ProviderKind::Anthropic;
     }
@@ -242,11 +211,6 @@ pub fn detect_provider_kind(model: &str) -> ProviderKind {
     if openai_compat::has_api_key("XAI_API_KEY") {
         return ProviderKind::Xai;
     }
-    // Last resort: if OPENAI_BASE_URL is set without OPENAI_API_KEY (some
-    // local providers like Ollama don't require auth), still route there.
-    if std::env::var_os("OPENAI_BASE_URL").is_some() {
-        return ProviderKind::OpenAi;
-    }
     ProviderKind::Anthropic
 }
 
@@ -289,12 +253,6 @@ pub fn model_token_limit(model: &str) -> Option<ModelTokenLimit> {
             max_output_tokens: 64_000,
             context_window_tokens: 131_072,
         }),
-        // Kimi models via DashScope (Moonshot AI)
-        // Source: https://platform.moonshot.cn/docs/intro
-        "kimi-k2.5" | "kimi-k1.5" => Some(ModelTokenLimit {
-            max_output_tokens: 16_384,
-            context_window_tokens: 256_000,
-        }),
         _ => None,
     }
 }
@@ -536,10 +494,9 @@ mod tests {
         // ANTHROPIC_API_KEY was set because metadata_for_model returned None
         // and detect_provider_kind fell through to auth-sniffer order.
         // The model prefix must win over env-var presence.
-        let kind = super::metadata_for_model("openai/gpt-4.1-mini").map_or_else(
-            || detect_provider_kind("openai/gpt-4.1-mini"),
-            |m| m.provider,
-        );
+        let kind = super::metadata_for_model("openai/gpt-4.1-mini")
+            .map(|m| m.provider)
+            .unwrap_or_else(|| detect_provider_kind("openai/gpt-4.1-mini"));
         assert_eq!(
             kind,
             ProviderKind::OpenAi,
@@ -548,7 +505,8 @@ mod tests {
 
         // Also cover bare gpt- prefix
         let kind2 = super::metadata_for_model("gpt-4o")
-            .map_or_else(|| detect_provider_kind("gpt-4o"), |m| m.provider);
+            .map(|m| m.provider)
+            .unwrap_or_else(|| detect_provider_kind("gpt-4o"));
         assert_eq!(kind2, ProviderKind::OpenAi);
     }
 
@@ -582,34 +540,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn kimi_prefix_routes_to_dashscope() {
-        // Kimi models via DashScope (kimi-k2.5, kimi-k1.5, etc.)
-        let meta = super::metadata_for_model("kimi-k2.5")
-            .expect("kimi-k2.5 must resolve to DashScope metadata");
-        assert_eq!(meta.auth_env, "DASHSCOPE_API_KEY");
-        assert_eq!(meta.base_url_env, "DASHSCOPE_BASE_URL");
-        assert!(meta.default_base_url.contains("dashscope.aliyuncs.com"));
-        assert_eq!(meta.provider, ProviderKind::OpenAi);
-
-        // With provider prefix
-        let meta2 = super::metadata_for_model("kimi/kimi-k2.5")
-            .expect("kimi/kimi-k2.5 must resolve to DashScope metadata");
-        assert_eq!(meta2.auth_env, "DASHSCOPE_API_KEY");
-        assert_eq!(meta2.provider, ProviderKind::OpenAi);
-
-        // Different kimi variants
-        let meta3 = super::metadata_for_model("kimi-k1.5")
-            .expect("kimi-k1.5 must resolve to DashScope metadata");
-        assert_eq!(meta3.auth_env, "DASHSCOPE_API_KEY");
-    }
-
-    #[test]
-    fn kimi_alias_resolves_to_kimi_k2_5() {
-        assert_eq!(super::resolve_model_alias("kimi"), "kimi-k2.5");
-        assert_eq!(super::resolve_model_alias("KIMI"), "kimi-k2.5"); // case insensitive
-    }
-
     #[test]
     fn keeps_existing_max_token_heuristic() {
         assert_eq!(max_tokens_for_model("opus"), 32_000);
@@ -750,71 +680,6 @@ mod tests {
             .expect("models without context metadata should skip the guarded preflight");
     }
 
-    #[test]
-    fn returns_context_window_metadata_for_kimi_models() {
-        // kimi-k2.5
-        let k25_limit =
-            model_token_limit("kimi-k2.5").expect("kimi-k2.5 should have token limit metadata");
-        assert_eq!(k25_limit.max_output_tokens, 16_384);
-        assert_eq!(k25_limit.context_window_tokens, 256_000);
-
-        // kimi-k1.5
-        let k15_limit =
-            model_token_limit("kimi-k1.5").expect("kimi-k1.5 should have token limit metadata");
-        assert_eq!(k15_limit.max_output_tokens, 16_384);
-        assert_eq!(k15_limit.context_window_tokens, 256_000);
-    }
-
-    #[test]
-    fn kimi_alias_resolves_to_kimi_k25_token_limits() {
-        // The "kimi" alias resolves to "kimi-k2.5" via resolve_model_alias()
-        let alias_limit =
-            model_token_limit("kimi").expect("kimi alias should resolve to kimi-k2.5 limits");
-        let direct_limit = model_token_limit("kimi-k2.5").expect("kimi-k2.5 should have limits");
-        assert_eq!(
-            alias_limit.max_output_tokens,
-            direct_limit.max_output_tokens
-        );
-        assert_eq!(
-            alias_limit.context_window_tokens,
-            direct_limit.context_window_tokens
-        );
-    }
-
-    #[test]
-    fn preflight_blocks_oversized_requests_for_kimi_models() {
-        let request = MessageRequest {
-            model: "kimi-k2.5".to_string(),
-            max_tokens: 16_384,
-            messages: vec![InputMessage {
-                role: "user".to_string(),
-                content: vec![InputContentBlock::Text {
-                    text: "x".repeat(1_000_000), // Large input to exceed context window
-                }],
-            }],
-            system: Some("Keep the answer short.".to_string()),
-            tools: None,
-            tool_choice: None,
-            stream: true,
-            ..Default::default()
-        };
-
-        let error = preflight_message_request(&request)
-            .expect_err("oversized request should be rejected for kimi models");
-
-        match error {
-            ApiError::ContextWindowExceeded {
-                model,
-                context_window_tokens,
-                ..
-            } => {
-                assert_eq!(model, "kimi-k2.5");
-                assert_eq!(context_window_tokens, 256_000);
-            }
-            other => panic!("expected context-window preflight failure, got {other:?}"),
-        }
-    }
-
     #[test]
     fn parse_dotenv_extracts_keys_handles_comments_quotes_and_export_prefix() {
         // given
@@ -1116,31 +981,4 @@ NO_EQUALS_LINE
             "empty env var should not trigger the hint sniffer, got {hint:?}"
         );
     }
-
-    #[test]
-    fn openai_base_url_overrides_anthropic_fallback_for_unknown_model() {
-        // given — user has OPENAI_BASE_URL + OPENAI_API_KEY but no Anthropic
-        // creds, and a model name with no recognized prefix.
-        let _lock = env_lock();
-        let _base_url = EnvVarGuard::set("OPENAI_BASE_URL", Some("http://127.0.0.1:11434/v1"));
-        let _api_key = EnvVarGuard::set("OPENAI_API_KEY", Some("dummy"));
-        let _anthropic_key = EnvVarGuard::set("ANTHROPIC_API_KEY", None);
-        let _anthropic_token = EnvVarGuard::set("ANTHROPIC_AUTH_TOKEN", None);
-
-        // when
-        let provider = detect_provider_kind("qwen2.5-coder:7b");
-
-        // then — should route to OpenAI, not Anthropic
-        assert_eq!(
-            provider,
-            ProviderKind::OpenAi,
-            "OPENAI_BASE_URL should win over Anthropic fallback for unknown models"
-        );
-    }
-
-    // NOTE: a "OPENAI_BASE_URL without OPENAI_API_KEY" test is omitted
-    // because workspace-parallel test binaries can race on process env
-    // (env_lock only protects within a single binary). The detection logic
-    // is covered: OPENAI_BASE_URL alone routes to OpenAi as a last-resort
-    // fallback in detect_provider_kind().
 }

rust/crates/api/src/types.rs

@@ -26,11 +26,6 @@ pub struct MessageRequest {
     pub presence_penalty: Option<f64>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub stop: Option<Vec<String>>,
-    /// Reasoning effort level for OpenAI-compatible reasoning models (e.g. `o4-mini`).
-    /// Accepted values: `"low"`, `"medium"`, `"high"`. Omitted when `None`.
-    /// Silently ignored by backends that do not support it.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub reasoning_effort: Option<String>,
 }
 
 impl MessageRequest {

rust/crates/commands/src/lib.rs

@@ -4,7 +4,7 @@ use std::fmt;
 use std::fs;
 use std::path::{Path, PathBuf};
 
-use plugins::{PluginError, PluginLoadFailure, PluginManager, PluginSummary};
+use plugins::{PluginError, PluginManager, PluginSummary};
 use runtime::{
     compact_session, CompactionConfig, ConfigLoader, ConfigSource, McpOAuthConfig, McpServerConfig,
     ScopedMcpServerConfig, Session,
@@ -257,6 +257,20 @@ const SLASH_COMMAND_SPECS: &[SlashCommandSpec] = &[
         argument_hint: None,
         resume_supported: true,
     },
+    SlashCommandSpec {
+        name: "login",
+        aliases: &[],
+        summary: "Log in to the service",
+        argument_hint: None,
+        resume_supported: false,
+    },
+    SlashCommandSpec {
+        name: "logout",
+        aliases: &[],
+        summary: "Log out of the current session",
+        argument_hint: None,
+        resume_supported: false,
+    },
     SlashCommandSpec {
         name: "plan",
         aliases: &[],
@@ -1207,83 +1221,6 @@ impl SlashCommand {
     pub fn parse(input: &str) -> Result<Option<Self>, SlashCommandParseError> {
         validate_slash_command_input(input)
     }
-
-    /// Returns the canonical slash-command name (e.g. `"/branch"`) for use in
-    /// error messages and logging. Derived from the spec table so it always
-    /// matches what the user would have typed.
-    #[must_use]
-    pub fn slash_name(&self) -> &'static str {
-        match self {
-            Self::Help => "/help",
-            Self::Clear { .. } => "/clear",
-            Self::Compact { .. } => "/compact",
-            Self::Cost => "/cost",
-            Self::Doctor => "/doctor",
-            Self::Config { .. } => "/config",
-            Self::Memory { .. } => "/memory",
-            Self::History { .. } => "/history",
-            Self::Diff => "/diff",
-            Self::Status => "/status",
-            Self::Stats => "/stats",
-            Self::Version => "/version",
-            Self::Commit { .. } => "/commit",
-            Self::Pr { .. } => "/pr",
-            Self::Issue { .. } => "/issue",
-            Self::Init => "/init",
-            Self::Bughunter { .. } => "/bughunter",
-            Self::Ultraplan { .. } => "/ultraplan",
-            Self::Teleport { .. } => "/teleport",
-            Self::DebugToolCall { .. } => "/debug-tool-call",
-            Self::Resume { .. } => "/resume",
-            Self::Model { .. } => "/model",
-            Self::Permissions { .. } => "/permissions",
-            Self::Session { .. } => "/session",
-            Self::Plugins { .. } => "/plugins",
-            Self::Login => "/login",
-            Self::Logout => "/logout",
-            Self::Vim => "/vim",
-            Self::Upgrade => "/upgrade",
-            Self::Share => "/share",
-            Self::Feedback => "/feedback",
-            Self::Files => "/files",
-            Self::Fast => "/fast",
-            Self::Exit => "/exit",
-            Self::Summary => "/summary",
-            Self::Desktop => "/desktop",
-            Self::Brief => "/brief",
-            Self::Advisor => "/advisor",
-            Self::Stickers => "/stickers",
-            Self::Insights => "/insights",
-            Self::Thinkback => "/thinkback",
-            Self::ReleaseNotes => "/release-notes",
-            Self::SecurityReview => "/security-review",
-            Self::Keybindings => "/keybindings",
-            Self::PrivacySettings => "/privacy-settings",
-            Self::Plan { .. } => "/plan",
-            Self::Review { .. } => "/review",
-            Self::Tasks { .. } => "/tasks",
-            Self::Theme { .. } => "/theme",
-            Self::Voice { .. } => "/voice",
-            Self::Usage { .. } => "/usage",
-            Self::Rename { .. } => "/rename",
-            Self::Copy { .. } => "/copy",
-            Self::Hooks { .. } => "/hooks",
-            Self::Context { .. } => "/context",
-            Self::Color { .. } => "/color",
-            Self::Effort { .. } => "/effort",
-            Self::Branch { .. } => "/branch",
-            Self::Rewind { .. } => "/rewind",
-            Self::Ide { .. } => "/ide",
-            Self::Tag { .. } => "/tag",
-            Self::OutputStyle { .. } => "/output-style",
-            Self::AddDir { .. } => "/add-dir",
-            Self::Sandbox => "/sandbox",
-            Self::Mcp { .. } => "/mcp",
-            Self::Export { .. } => "/export",
-            #[allow(unreachable_patterns)]
-            _ => "/unknown",
-        }
-    }
 }
 
 #[allow(clippy::too_many_lines)]
@@ -1383,16 +1320,17 @@ pub fn validate_slash_command_input(
         "skills" | "skill" => SlashCommand::Skills {
             args: parse_skills_args(remainder.as_deref())?,
         },
-        "doctor" | "providers" => {
+        "doctor" => {
             validate_no_args(command, &args)?;
             SlashCommand::Doctor
         }
-        "login" | "logout" => {
-            return Err(command_error(
-                "This auth flow was removed. Set ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN instead.",
-                command,
-                "",
-            ));
+        "login" => {
+            validate_no_args(command, &args)?;
+            SlashCommand::Login
+        }
+        "logout" => {
+            validate_no_args(command, &args)?;
+            SlashCommand::Logout
         }
         "vim" => {
             validate_no_args(command, &args)?;
@@ -1402,7 +1340,7 @@ pub fn validate_slash_command_input(
             validate_no_args(command, &args)?;
             SlashCommand::Upgrade
         }
-        "stats" | "tokens" | "cache" => {
+        "stats" => {
             validate_no_args(command, &args)?;
             SlashCommand::Stats
         }
@@ -1877,12 +1815,20 @@ pub fn resume_supported_slash_commands() -> Vec<&'static SlashCommandSpec> {
 
 fn slash_command_category(name: &str) -> &'static str {
     match name {
-        "help" | "status" | "cost" | "resume" | "session" | "version" | "usage" | "stats"
-        | "rename" | "clear" | "compact" | "history" | "tokens" | "cache" | "exit" | "summary"
-        | "tag" | "thinkback" | "copy" | "share" | "feedback" | "rewind" | "pin" | "unpin"
-        | "bookmarks" | "context" | "files" | "focus" | "unfocus" | "retry" | "stop" | "undo" => {
-            "Session"
-        }
+        "help" | "status" | "cost" | "resume" | "session" | "version" | "login" | "logout"
+        | "usage" | "stats" | "rename" | "clear" | "compact" | "history" | "tokens" | "cache"
+        | "exit" | "summary" | "tag" | "thinkback" | "copy" | "share" | "feedback" | "rewind"
+        | "pin" | "unpin" | "bookmarks" | "context" | "files" | "focus" | "unfocus" | "retry"
+        | "stop" | "undo" => "Session",
+        "diff" | "commit" | "pr" | "issue" | "branch" | "blame" | "log" | "git" | "stash"
+        | "init" | "export" | "plan" | "review" | "security-review" | "bughunter" | "ultraplan"
+        | "teleport" | "refactor" | "fix" | "autofix" | "explain" | "docs" | "perf" | "search"
+        | "references" | "definition" | "hover" | "symbols" | "map" | "web" | "image"
+        | "screenshot" | "paste" | "listen" | "speak" | "test" | "lint" | "build" | "run"
+        | "format" | "parallel" | "multi" | "macro" | "alias" | "templates" | "migrate"
+        | "benchmark" | "cron" | "agent" | "subagent" | "agents" | "skills" | "team" | "plugin"
+        | "mcp" | "hooks" | "tasks" | "advisor" | "insights" | "release-notes" | "chat"
+        | "approve" | "deny" | "allowed-tools" | "add-dir" => "Tools",
         "model" | "permissions" | "config" | "memory" | "theme" | "vim" | "voice" | "color"
         | "effort" | "fast" | "brief" | "output-style" | "keybindings" | "privacy-settings"
         | "stickers" | "language" | "profile" | "max-tokens" | "temperature" | "system-prompt"
@@ -1992,42 +1938,6 @@ pub fn suggest_slash_commands(input: &str, limit: usize) -> Vec<String> {
 }
 
 #[must_use]
-/// Render the slash-command help section, optionally excluding stub commands
-/// (commands that are registered in the spec list but not yet implemented).
-/// Pass an empty slice to include all commands.
-pub fn render_slash_command_help_filtered(exclude: &[&str]) -> String {
-    let mut lines = vec![
-        "Slash commands".to_string(),
-        "  Start here        /status, /diff, /agents, /skills, /commit".to_string(),
-        "  [resume]          also works with --resume SESSION.jsonl".to_string(),
-        String::new(),
-    ];
-
-    let categories = ["Session", "Tools", "Config", "Debug"];
-
-    for category in categories {
-        lines.push(category.to_string());
-        for spec in slash_command_specs()
-            .iter()
-            .filter(|spec| slash_command_category(spec.name) == category)
-            .filter(|spec| !exclude.contains(&spec.name))
-        {
-            lines.push(format_slash_command_help_line(spec));
-        }
-        lines.push(String::new());
-    }
-
-    lines
-        .into_iter()
-        .rev()
-        .skip_while(String::is_empty)
-        .collect::<Vec<_>>()
-        .into_iter()
-        .rev()
-        .collect::<Vec<_>>()
-        .join("\n")
-}
-
 pub fn render_slash_command_help() -> String {
     let mut lines = vec![
         "Slash commands".to_string(),
@@ -2186,15 +2096,10 @@ pub fn handle_plugins_slash_command(
     manager: &mut PluginManager,
 ) -> Result<PluginsCommandResult, PluginError> {
     match action {
-        None | Some("list") => {
-            let report = manager.installed_plugin_registry_report()?;
-            let plugins = report.summaries();
-            let failures = report.failures();
-            Ok(PluginsCommandResult {
-                message: render_plugins_report_with_failures(&plugins, failures),
-                reload_runtime: false,
-            })
-        }
+        None | Some("list") => Ok(PluginsCommandResult {
+            message: render_plugins_report(&manager.list_installed_plugins()?),
+            reload_runtime: false,
+        }),
         Some("install") => {
             let Some(target) = target else {
                 return Ok(PluginsCommandResult {
@@ -2453,8 +2358,7 @@ pub fn resolve_skill_invocation(
                         .map(|s| s.name.clone())
                         .collect();
                     if !names.is_empty() {
-                        message.push_str("\n  Available skills: ");
-                        message.push_str(&names.join(", "));
+                        message.push_str(&format!("\n  Available skills: {}", names.join(", ")));
                     }
                 }
                 message.push_str("\n  Usage: /skills [list|install <path>|help|<skill> [args]]");
@@ -2554,22 +2458,11 @@ fn render_mcp_report_for(
 
     match normalize_optional_args(args) {
         None | Some("list") => {
-            // #144: degrade gracefully on config parse failure (same contract
-            // as #143 for `status`). Text mode prepends a "Config load error"
-            // block before the MCP list; the list falls back to empty.
-            match loader.load() {
-                Ok(runtime_config) => Ok(render_mcp_summary_report(
-                    cwd,
-                    runtime_config.mcp().servers(),
-                )),
-                Err(err) => {
-                    let empty = std::collections::BTreeMap::new();
-                    Ok(format!(
-                        "Config load error\n  Status           fail\n  Summary          runtime config failed to load; reporting partial MCP view\n  Details          {err}\n  Hint             `claw doctor` classifies config parse errors; fix the listed field and rerun\n\n{}",
-                        render_mcp_summary_report(cwd, &empty)
-                    ))
-                }
-            }
+            let runtime_config = loader.load()?;
+            Ok(render_mcp_summary_report(
+                cwd,
+                runtime_config.mcp().servers(),
+            ))
         }
         Some(args) if is_help_arg(args) => Ok(render_mcp_usage(None)),
         Some("show") => Ok(render_mcp_usage(Some("show"))),
@@ -2582,19 +2475,12 @@ fn render_mcp_report_for(
             if parts.next().is_some() {
                 return Ok(render_mcp_usage(Some(args)));
             }
-            // #144: same degradation for `mcp show`; if config won't parse,
-            // the specific server lookup can't succeed, so report the parse
-            // error with context.
-            match loader.load() {
-                Ok(runtime_config) => Ok(render_mcp_server_report(
-                    cwd,
-                    server_name,
-                    runtime_config.mcp().get(server_name),
-                )),
-                Err(err) => Ok(format!(
-                    "Config load error\n  Status           fail\n  Summary          runtime config failed to load; cannot resolve `{server_name}`\n  Details          {err}\n  Hint             `claw doctor` classifies config parse errors; fix the listed field and rerun"
-                )),
-            }
+            let runtime_config = loader.load()?;
+            Ok(render_mcp_server_report(
+                cwd,
+                server_name,
+                runtime_config.mcp().get(server_name),
+            ))
         }
         Some(args) => Ok(render_mcp_usage(Some(args))),
     }
@@ -2617,33 +2503,11 @@ fn render_mcp_report_json_for(
 
     match normalize_optional_args(args) {
         None | Some("list") => {
-            // #144: match #143's degraded envelope contract. On config parse
-            // failure, emit top-level `status: "degraded"` with
-            // `config_load_error`, empty servers[], and exit 0. On clean
-            // runs, the existing serializer adds `status: "ok"` below.
-            match loader.load() {
-                Ok(runtime_config) => {
-                    let mut value =
-                        render_mcp_summary_report_json(cwd, runtime_config.mcp().servers());
-                    if let Some(map) = value.as_object_mut() {
-                        map.insert("status".to_string(), Value::String("ok".to_string()));
-                        map.insert("config_load_error".to_string(), Value::Null);
-                    }
-                    Ok(value)
-                }
-                Err(err) => {
-                    let empty = std::collections::BTreeMap::new();
-                    let mut value = render_mcp_summary_report_json(cwd, &empty);
-                    if let Some(map) = value.as_object_mut() {
-                        map.insert("status".to_string(), Value::String("degraded".to_string()));
-                        map.insert(
-                            "config_load_error".to_string(),
-                            Value::String(err.to_string()),
-                        );
-                    }
-                    Ok(value)
-                }
-            }
+            let runtime_config = loader.load()?;
+            Ok(render_mcp_summary_report_json(
+                cwd,
+                runtime_config.mcp().servers(),
+            ))
         }
         Some(args) if is_help_arg(args) => Ok(render_mcp_usage_json(None)),
         Some("show") => Ok(render_mcp_usage_json(Some("show"))),
@@ -2656,29 +2520,12 @@ fn render_mcp_report_json_for(
             if parts.next().is_some() {
                 return Ok(render_mcp_usage_json(Some(args)));
             }
-            // #144: same degradation pattern for show action.
-            match loader.load() {
-                Ok(runtime_config) => {
-                    let mut value = render_mcp_server_report_json(
-                        cwd,
-                        server_name,
-                        runtime_config.mcp().get(server_name),
-                    );
-                    if let Some(map) = value.as_object_mut() {
-                        map.insert("status".to_string(), Value::String("ok".to_string()));
-                        map.insert("config_load_error".to_string(), Value::Null);
-                    }
-                    Ok(value)
-                }
-                Err(err) => Ok(serde_json::json!({
-                    "kind": "mcp",
-                    "action": "show",
-                    "server": server_name,
-                    "status": "degraded",
-                    "config_load_error": err.to_string(),
-                    "working_directory": cwd.display().to_string(),
-                })),
-            }
+            let runtime_config = loader.load()?;
+            Ok(render_mcp_server_report_json(
+                cwd,
+                server_name,
+                runtime_config.mcp().get(server_name),
+            ))
         }
         Some(args) => Ok(render_mcp_usage_json(Some(args))),
     }
@@ -2706,48 +2553,6 @@ pub fn render_plugins_report(plugins: &[PluginSummary]) -> String {
     lines.join("\n")
 }
 
-#[must_use]
-pub fn render_plugins_report_with_failures(
-    plugins: &[PluginSummary],
-    failures: &[PluginLoadFailure],
-) -> String {
-    let mut lines = vec!["Plugins".to_string()];
-
-    // Show successfully loaded plugins
-    if plugins.is_empty() {
-        lines.push("  No plugins installed.".to_string());
-    } else {
-        for plugin in plugins {
-            let enabled = if plugin.enabled {
-                "enabled"
-            } else {
-                "disabled"
-            };
-            lines.push(format!(
-                "  {name:<20} v{version:<10} {enabled}",
-                name = plugin.metadata.name,
-                version = plugin.metadata.version,
-            ));
-        }
-    }
-
-    // Show warnings for broken plugins
-    if !failures.is_empty() {
-        lines.push(String::new());
-        lines.push("Warnings:".to_string());
-        for failure in failures {
-            lines.push(format!(
-                "  ⚠️  Failed to load {} plugin from `{}`",
-                failure.kind,
-                failure.plugin_root.display()
-            ));
-            lines.push(format!("      Error: {}", failure.error()));
-        }
-    }
-
-    lines.join("\n")
-}
-
 fn render_plugin_install_report(plugin_id: &str, plugin: Option<&PluginSummary>) -> String {
     let name = plugin.map_or(plugin_id, |plugin| plugin.metadata.name.as_str());
     let version = plugin.map_or("unknown", |plugin| plugin.metadata.version.as_str());
@@ -4178,15 +3983,12 @@ mod tests {
         handle_plugins_slash_command, handle_skills_slash_command_json, handle_slash_command,
         load_agents_from_roots, load_skills_from_roots, render_agents_report,
         render_agents_report_json, render_mcp_report_json_for, render_plugins_report,
-        render_plugins_report_with_failures, render_skills_report, render_slash_command_help,
-        render_slash_command_help_detail, resolve_skill_path, resume_supported_slash_commands,
-        slash_command_specs, suggest_slash_commands, validate_slash_command_input,
-        DefinitionSource, SkillOrigin, SkillRoot, SkillSlashDispatch, SlashCommand,
-    };
-    use plugins::{
-        PluginError, PluginKind, PluginLoadFailure, PluginManager, PluginManagerConfig,
-        PluginMetadata, PluginSummary,
+        render_skills_report, render_slash_command_help, render_slash_command_help_detail,
+        resolve_skill_path, resume_supported_slash_commands, slash_command_specs,
+        suggest_slash_commands, validate_slash_command_input, DefinitionSource, SkillOrigin,
+        SkillRoot, SkillSlashDispatch, SlashCommand,
     };
+    use plugins::{PluginKind, PluginManager, PluginManagerConfig, PluginMetadata, PluginSummary};
     use runtime::{
         CompactionConfig, ConfigLoader, ContentBlock, ConversationMessage, MessageRole, Session,
     };
@@ -4209,24 +4011,6 @@ mod tests {
         LOCK.get_or_init(|| Mutex::new(()))
     }
 
-    fn env_guard() -> std::sync::MutexGuard<'static, ()> {
-        env_lock()
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-    }
-
-    #[test]
-    fn env_guard_recovers_after_poisoning() {
-        let poisoned = std::thread::spawn(|| {
-            let _guard = env_guard();
-            panic!("poison env lock");
-        })
-        .join();
-        assert!(poisoned.is_err(), "poisoning thread should panic");
-
-        let _guard = env_guard();
-    }
-
     fn restore_env_var(key: &str, original: Option<OsString>) {
         match original {
             Some(value) => std::env::set_var(key, value),
@@ -4653,14 +4437,6 @@ mod tests {
         assert!(action_error.contains("  Usage            /mcp [list|show <server>|help]"));
     }
 
-    #[test]
-    fn removed_login_and_logout_commands_report_env_auth_guidance() {
-        let login_error = parse_error_message("/login");
-        assert!(login_error.contains("ANTHROPIC_API_KEY"));
-        let logout_error = parse_error_message("/logout");
-        assert!(logout_error.contains("ANTHROPIC_AUTH_TOKEN"));
-    }
-
     #[test]
     fn renders_help_from_shared_specs() {
         let help = render_slash_command_help();
@@ -4702,9 +4478,7 @@ mod tests {
         assert!(help.contains("/agents [list|help]"));
         assert!(help.contains("/skills [list|install <path>|help|<skill> [args]]"));
         assert!(help.contains("aliases: /skill"));
-        assert!(!help.contains("/login"));
-        assert!(!help.contains("/logout"));
-        assert_eq!(slash_command_specs().len(), 139);
+        assert_eq!(slash_command_specs().len(), 141);
         assert!(resume_supported_slash_commands().len() >= 39);
     }
 
@@ -4835,14 +4609,7 @@ mod tests {
         )
         .expect("slash command should be handled");
 
-        // With the tool-use/tool-result boundary guard the compaction may
-        // preserve one extra message, so 1 or 2 messages may be removed.
-        assert!(
-            result.message.contains("Compacted 1 messages")
-                || result.message.contains("Compacted 2 messages"),
-            "unexpected compaction message: {}",
-            result.message
-        );
+        assert!(result.message.contains("Compacted 2 messages"));
         assert_eq!(result.session.messages[0].role, MessageRole::System);
     }
 
@@ -4962,36 +4729,6 @@ mod tests {
         assert!(rendered.contains("disabled"));
     }
 
-    #[test]
-    fn renders_plugins_report_with_broken_plugin_warnings() {
-        let rendered = render_plugins_report_with_failures(
-            &[PluginSummary {
-                metadata: PluginMetadata {
-                    id: "demo@external".to_string(),
-                    name: "demo".to_string(),
-                    version: "1.2.3".to_string(),
-                    description: "demo plugin".to_string(),
-                    kind: PluginKind::External,
-                    source: "demo".to_string(),
-                    default_enabled: false,
-                    root: None,
-                },
-                enabled: true,
-            }],
-            &[PluginLoadFailure::new(
-                PathBuf::from("/tmp/broken-plugin"),
-                PluginKind::External,
-                "broken".to_string(),
-                PluginError::InvalidManifest("hook path `hooks/pre.sh` does not exist".to_string()),
-            )],
-        );
-
-        assert!(rendered.contains("Warnings:"));
-        assert!(rendered.contains("Failed to load external plugin"));
-        assert!(rendered.contains("/tmp/broken-plugin"));
-        assert!(rendered.contains("does not exist"));
-    }
-
     #[test]
     fn lists_agents_from_project_and_user_roots() {
         let workspace = temp_dir("agents-workspace");
@@ -5289,7 +5026,7 @@ mod tests {
 
     #[test]
     fn discovers_omc_skills_from_project_and_user_compatibility_roots() {
-        let _guard = env_guard();
+        let _guard = env_lock().lock().expect("env lock");
         let workspace = temp_dir("skills-omc-workspace");
         let user_home = temp_dir("skills-omc-home");
         let claude_config_dir = temp_dir("skills-omc-claude-config");
@@ -5536,82 +5273,6 @@ mod tests {
         let _ = fs::remove_dir_all(config_home);
     }
 
-    #[test]
-    fn mcp_degrades_gracefully_on_malformed_mcp_config_144() {
-        // #144: mirror of #143's partial-success contract for `claw mcp`.
-        // Previously `mcp` hard-failed on any config parse error, hiding
-        // well-formed servers and forcing claws to fall back to `doctor`.
-        // Now `mcp` emits a degraded envelope instead: exit 0, status:
-        // "degraded", config_load_error populated, servers[] empty.
-        let _guard = env_guard();
-        let workspace = temp_dir("mcp-degrades-144");
-        let config_home = temp_dir("mcp-degrades-144-cfg");
-        fs::create_dir_all(workspace.join(".claw")).expect("create workspace .claw dir");
-        fs::create_dir_all(&config_home).expect("create config home");
-        // One valid server + one malformed entry missing `command`.
-        fs::write(
-            workspace.join(".claw.json"),
-            r#"{
-  "mcpServers": {
-    "everything": {"command": "npx", "args": ["-y", "@modelcontextprotocol/server-everything"]},
-    "missing-command": {"args": ["arg-only-no-command"]}
-  }
-}
-"#,
-        )
-        .expect("write malformed .claw.json");
-
-        let loader = ConfigLoader::new(&workspace, &config_home);
-        // list action: must return Ok (not Err) with degraded envelope.
-        let list = render_mcp_report_json_for(&loader, &workspace, None)
-            .expect("mcp list should not hard-fail on config parse errors (#144)");
-        assert_eq!(list["kind"], "mcp");
-        assert_eq!(list["action"], "list");
-        assert_eq!(
-            list["status"].as_str(),
-            Some("degraded"),
-            "top-level status should be 'degraded': {list}"
-        );
-        let err = list["config_load_error"]
-            .as_str()
-            .expect("config_load_error must be a string on degraded runs");
-        assert!(
-            err.contains("mcpServers.missing-command"),
-            "config_load_error should name the malformed field path: {err}"
-        );
-        assert_eq!(list["configured_servers"], 0);
-        assert!(list["servers"].as_array().unwrap().is_empty());
-
-        // show action: should also degrade (not hard-fail).
-        let show = render_mcp_report_json_for(&loader, &workspace, Some("show everything"))
-            .expect("mcp show should not hard-fail on config parse errors (#144)");
-        assert_eq!(show["kind"], "mcp");
-        assert_eq!(show["action"], "show");
-        assert_eq!(
-            show["status"].as_str(),
-            Some("degraded"),
-            "show action should also report status: 'degraded': {show}"
-        );
-        assert!(show["config_load_error"].is_string());
-
-        // Clean path: status: "ok", config_load_error: null.
-        let clean_ws = temp_dir("mcp-degrades-144-clean");
-        fs::create_dir_all(&clean_ws).expect("clean ws");
-        let clean_loader = ConfigLoader::new(&clean_ws, &config_home);
-        let clean_list = render_mcp_report_json_for(&clean_loader, &clean_ws, None)
-            .expect("clean mcp list should succeed");
-        assert_eq!(
-            clean_list["status"].as_str(),
-            Some("ok"),
-            "clean run should report status: 'ok'"
-        );
-        assert!(clean_list["config_load_error"].is_null());
-
-        let _ = fs::remove_dir_all(workspace);
-        let _ = fs::remove_dir_all(config_home);
-        let _ = fs::remove_dir_all(clean_ws);
-    }
-
     #[test]
     fn parses_quoted_skill_frontmatter_values() {
         let contents = "---\nname: \"hud\"\ndescription: 'Quoted description'\n---\n";

rust/crates/compat-harness/src/lib.rs

@@ -18,12 +18,6 @@ impl UpstreamPaths {
         }
     }
 
-    /// Returns the repository root path.
-    #[must_use]
-    pub fn repo_root(&self) -> &Path {
-        &self.repo_root
-    }
-
     #[must_use]
     pub fn from_workspace_dir(workspace_dir: impl AsRef<Path>) -> Self {
         let workspace_dir = workspace_dir

rust/crates/plugins/src/hooks.rs

@@ -561,4 +561,43 @@ mod tests {
             );
         }
     }
+
+    #[test]
+    fn output_with_stdin_tolerates_broken_pipe_when_child_closes_stdin_early() {
+        // given: a hook that immediately closes stdin without consuming the
+        // JSON payload. Use an oversized payload so the parent keeps writing
+        // long enough for Linux to surface EPIPE on the old implementation.
+        let root = temp_dir("stdin-close");
+        let script = root.join("close-stdin.sh");
+        fs::create_dir_all(&root).expect("temp hook dir");
+        fs::write(
+            &script,
+            "#!/bin/sh\nexec 0<&-\nprintf 'stdin closed early\\n'\nsleep 0.05\n",
+        )
+        .expect("write stdin-closing hook");
+        make_executable(&script);
+
+        let mut child = super::shell_command(script.to_str().expect("utf8 path"));
+        child.stdin(std::process::Stdio::piped());
+        child.stdout(std::process::Stdio::piped());
+        child.stderr(std::process::Stdio::piped());
+        let large_input = vec![b'x'; 2 * 1024 * 1024];
+
+        // when
+        let output = child
+            .output_with_stdin(&large_input)
+            .expect("broken pipe should be tolerated");
+
+        // then
+        assert!(
+            output.status.success(),
+            "child should still exit cleanly: {output:?}"
+        );
+        assert_eq!(
+            String::from_utf8_lossy(&output.stdout).trim(),
+            "stdin closed early"
+        );
+
+        let _ = fs::remove_dir_all(root);
+    }
 }

rust/crates/plugins/src/lib.rs

@@ -1,13 +1,10 @@
 mod hooks;
-#[cfg(test)]
-pub mod test_isolation;
 
 use std::collections::{BTreeMap, BTreeSet};
 use std::fmt::{Display, Formatter};
 use std::fs;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
-use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use serde::{Deserialize, Serialize};
@@ -2163,13 +2160,7 @@ fn materialize_source(
     match source {
         PluginInstallSource::LocalPath { path } => Ok(path.clone()),
         PluginInstallSource::GitUrl { url } => {
-            static MATERIALIZE_COUNTER: AtomicU64 = AtomicU64::new(0);
-            let unique = MATERIALIZE_COUNTER.fetch_add(1, Ordering::Relaxed);
-            let nanos = SystemTime::now()
-                .duration_since(UNIX_EPOCH)
-                .unwrap()
-                .as_nanos();
-            let destination = temp_root.join(format!("plugin-{nanos}-{unique}"));
+            let destination = temp_root.join(format!("plugin-{}", unix_time_ms()));
             let output = Command::new("git")
                 .arg("clone")
                 .arg("--depth")
@@ -2282,24 +2273,10 @@ fn ensure_object<'a>(root: &'a mut Map<String, Value>, key: &str) -> &'a mut Map
         .expect("object should exist")
 }
 
-/// Environment variable lock for test isolation.
-/// Guards against concurrent modification of `CLAW_CONFIG_HOME`.
-#[cfg(test)]
-fn env_lock() -> &'static std::sync::Mutex<()> {
-    static ENV_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
-    &ENV_LOCK
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    fn env_guard() -> std::sync::MutexGuard<'static, ()> {
-        env_lock()
-            .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner)
-    }
-
     fn temp_dir(label: &str) -> PathBuf {
         let nanos = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
@@ -2308,18 +2285,6 @@ mod tests {
         std::env::temp_dir().join(format!("plugins-{label}-{nanos}"))
     }
 
-    #[test]
-    fn env_guard_recovers_after_poisoning() {
-        let poisoned = std::thread::spawn(|| {
-            let _guard = env_guard();
-            panic!("poison env lock");
-        })
-        .join();
-        assert!(poisoned.is_err(), "poisoning thread should panic");
-
-        let _guard = env_guard();
-    }
-
     fn write_file(path: &Path, contents: &str) {
         if let Some(parent) = path.parent() {
             fs::create_dir_all(parent).expect("parent dir");
@@ -2503,7 +2468,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_validates_required_fields() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-required");
         write_file(
             root.join(MANIFEST_FILE_NAME).as_path(),
@@ -2518,7 +2482,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_reads_root_manifest_and_validates_entries() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-root");
         write_loader_plugin(&root);
 
@@ -2548,7 +2511,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_supports_packaged_manifest_path() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-packaged");
         write_external_plugin(&root, "packaged-demo", "1.0.0");
 
@@ -2562,7 +2524,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_defaults_optional_fields() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-defaults");
         write_file(
             root.join(MANIFEST_FILE_NAME).as_path(),
@@ -2584,7 +2545,6 @@ mod tests {
 
     #[test]
     fn load_plugin_from_directory_rejects_duplicate_permissions_and_commands() {
-        let _guard = env_guard();
         let root = temp_dir("manifest-duplicates");
         write_file(
             root.join("commands").join("sync.sh").as_path(),
@@ -2880,7 +2840,6 @@ mod tests {
 
     #[test]
     fn discovers_builtin_and_bundled_plugins() {
-        let _guard = env_guard();
         let manager = PluginManager::new(PluginManagerConfig::new(temp_dir("discover")));
         let plugins = manager.list_plugins().expect("plugins should list");
         assert!(plugins
@@ -2893,7 +2852,6 @@ mod tests {
 
     #[test]
     fn installs_enables_updates_and_uninstalls_external_plugins() {
-        let _guard = env_guard();
         let config_home = temp_dir("home");
         let source_root = temp_dir("source");
         write_external_plugin(&source_root, "demo", "1.0.0");
@@ -2942,7 +2900,6 @@ mod tests {
 
     #[test]
     fn auto_installs_bundled_plugins_into_the_registry() {
-        let _guard = env_guard();
         let config_home = temp_dir("bundled-home");
         let bundled_root = temp_dir("bundled-root");
         write_bundled_plugin(&bundled_root.join("starter"), "starter", "0.1.0", false);
@@ -2974,7 +2931,6 @@ mod tests {
 
     #[test]
     fn default_bundled_root_loads_repo_bundles_as_installed_plugins() {
-        let _guard = env_guard();
         let config_home = temp_dir("default-bundled-home");
         let manager = PluginManager::new(PluginManagerConfig::new(&config_home));
 
@@ -2993,7 +2949,6 @@ mod tests {
 
     #[test]
     fn bundled_sync_prunes_removed_bundled_registry_entries() {
-        let _guard = env_guard();
         let config_home = temp_dir("bundled-prune-home");
         let bundled_root = temp_dir("bundled-prune-root");
         let stale_install_path = config_home
@@ -3057,7 +3012,6 @@ mod tests {
 
     #[test]
     fn installed_plugin_discovery_keeps_registry_entries_outside_install_root() {
-        let _guard = env_guard();
         let config_home = temp_dir("registry-fallback-home");
         let bundled_root = temp_dir("registry-fallback-bundled");
         let install_root = config_home.join("plugins").join("installed");
@@ -3112,7 +3066,6 @@ mod tests {
 
     #[test]
     fn installed_plugin_discovery_prunes_stale_registry_entries() {
-        let _guard = env_guard();
         let config_home = temp_dir("registry-prune-home");
         let bundled_root = temp_dir("registry-prune-bundled");
         let install_root = config_home.join("plugins").join("installed");
@@ -3158,7 +3111,6 @@ mod tests {
 
     #[test]
     fn persists_bundled_plugin_enable_state_across_reloads() {
-        let _guard = env_guard();
         let config_home = temp_dir("bundled-state-home");
         let bundled_root = temp_dir("bundled-state-root");
         write_bundled_plugin(&bundled_root.join("starter"), "starter", "0.1.0", false);
@@ -3192,7 +3144,6 @@ mod tests {
 
     #[test]
     fn persists_bundled_plugin_disable_state_across_reloads() {
-        let _guard = env_guard();
         let config_home = temp_dir("bundled-disabled-home");
         let bundled_root = temp_dir("bundled-disabled-root");
         write_bundled_plugin(&bundled_root.join("starter"), "starter", "0.1.0", true);
@@ -3226,7 +3177,6 @@ mod tests {
 
     #[test]
     fn validates_plugin_source_before_install() {
-        let _guard = env_guard();
         let config_home = temp_dir("validate-home");
         let source_root = temp_dir("validate-source");
         write_external_plugin(&source_root, "validator", "1.0.0");
@@ -3241,7 +3191,6 @@ mod tests {
 
     #[test]
     fn plugin_registry_tracks_enabled_state_and_lookup() {
-        let _guard = env_guard();
         let config_home = temp_dir("registry-home");
         let source_root = temp_dir("registry-source");
         write_external_plugin(&source_root, "registry-demo", "1.0.0");
@@ -3269,7 +3218,6 @@ mod tests {
 
     #[test]
     fn plugin_registry_report_collects_load_failures_without_dropping_valid_plugins() {
-        let _guard = env_guard();
         // given
         let config_home = temp_dir("report-home");
         let external_root = temp_dir("report-external");
@@ -3314,7 +3262,6 @@ mod tests {
 
     #[test]
     fn installed_plugin_registry_report_collects_load_failures_from_install_root() {
-        let _guard = env_guard();
         // given
         let config_home = temp_dir("installed-report-home");
         let bundled_root = temp_dir("installed-report-bundled");
@@ -3345,7 +3292,6 @@ mod tests {
 
     #[test]
     fn rejects_plugin_sources_with_missing_hook_paths() {
-        let _guard = env_guard();
         // given
         let config_home = temp_dir("broken-home");
         let source_root = temp_dir("broken-source");
@@ -3373,7 +3319,6 @@ mod tests {
 
     #[test]
     fn rejects_plugin_sources_with_missing_failure_hook_paths() {
-        let _guard = env_guard();
         // given
         let config_home = temp_dir("broken-failure-home");
         let source_root = temp_dir("broken-failure-source");
@@ -3401,7 +3346,6 @@ mod tests {
 
     #[test]
     fn plugin_registry_runs_initialize_and_shutdown_for_enabled_plugins() {
-        let _guard = env_guard();
         let config_home = temp_dir("lifecycle-home");
         let source_root = temp_dir("lifecycle-source");
         let _ = write_lifecycle_plugin(&source_root, "lifecycle-demo", "1.0.0");
@@ -3425,7 +3369,6 @@ mod tests {
 
     #[test]
     fn aggregates_and_executes_plugin_tools() {
-        let _guard = env_guard();
         let config_home = temp_dir("tool-home");
         let source_root = temp_dir("tool-source");
         write_tool_plugin(&source_root, "tool-demo", "1.0.0");
@@ -3454,7 +3397,6 @@ mod tests {
 
     #[test]
     fn list_installed_plugins_scans_install_root_without_registry_entries() {
-        let _guard = env_guard();
         let config_home = temp_dir("installed-scan-home");
         let bundled_root = temp_dir("installed-scan-bundled");
         let install_root = config_home.join("plugins").join("installed");
@@ -3486,7 +3428,6 @@ mod tests {
 
     #[test]
     fn list_installed_plugins_scans_packaged_manifests_in_install_root() {
-        let _guard = env_guard();
         let config_home = temp_dir("installed-packaged-scan-home");
         let bundled_root = temp_dir("installed-packaged-scan-bundled");
         let install_root = config_home.join("plugins").join("installed");
@@ -3515,143 +3456,4 @@ mod tests {
         let _ = fs::remove_dir_all(config_home);
         let _ = fs::remove_dir_all(bundled_root);
     }
-
-    /// Regression test for ROADMAP #41: verify that `CLAW_CONFIG_HOME` isolation prevents
-    /// host `~/.claw/plugins/` from bleeding into test runs.
-    #[test]
-    fn claw_config_home_isolation_prevents_host_plugin_leakage() {
-        let _guard = env_guard();
-
-        // Create a temp directory to act as our isolated CLAW_CONFIG_HOME
-        let config_home = temp_dir("isolated-home");
-        let bundled_root = temp_dir("isolated-bundled");
-
-        // Set CLAW_CONFIG_HOME to our temp directory
-        std::env::set_var("CLAW_CONFIG_HOME", &config_home);
-
-        // Create a test fixture plugin in the isolated config home
-        let install_root = config_home.join("plugins").join("installed");
-        let fixture_plugin_root = install_root.join("isolated-test-plugin");
-        write_file(
-            fixture_plugin_root.join(MANIFEST_RELATIVE_PATH).as_path(),
-            r#"{
-  "name": "isolated-test-plugin",
-  "version": "1.0.0",
-  "description": "Test fixture plugin in isolated config home"
-}"#,
-        );
-
-        // Create PluginManager with isolated bundled_root - it should use the temp config_home, not host ~/.claw/
-        let mut config = PluginManagerConfig::new(&config_home);
-        config.bundled_root = Some(bundled_root.clone());
-        let manager = PluginManager::new(config);
-
-        // List installed plugins - should only see the test fixture, not host plugins
-        let installed = manager
-            .list_installed_plugins()
-            .expect("installed plugins should list");
-
-        // Verify we only see the test fixture plugin
-        assert_eq!(
-            installed.len(),
-            1,
-            "should only see the test fixture plugin, not host ~/.claw/plugins/"
-        );
-        assert_eq!(
-            installed[0].metadata.id, "isolated-test-plugin@external",
-            "should see the test fixture plugin"
-        );
-
-        // Cleanup
-        std::env::remove_var("CLAW_CONFIG_HOME");
-        let _ = fs::remove_dir_all(config_home);
-        let _ = fs::remove_dir_all(bundled_root);
-    }
-
-    #[test]
-    fn plugin_lifecycle_handles_parallel_execution() {
-        use std::sync::atomic::{AtomicUsize, Ordering as AtomicOrdering};
-        use std::sync::Arc;
-        use std::thread;
-
-        let _guard = env_guard();
-
-        // Shared base directory for all threads
-        let base_dir = temp_dir("parallel-base");
-
-        // Track successful installations and any errors
-        let success_count = Arc::new(AtomicUsize::new(0));
-        let error_count = Arc::new(AtomicUsize::new(0));
-
-        // Spawn multiple threads to install plugins simultaneously
-        let mut handles = Vec::new();
-        for thread_id in 0..5 {
-            let base_dir = base_dir.clone();
-            let success_count = Arc::clone(&success_count);
-            let error_count = Arc::clone(&error_count);
-
-            let handle = thread::spawn(move || {
-                // Create unique directories for this thread
-                let config_home = base_dir.join(format!("config-{thread_id}"));
-                let source_root = base_dir.join(format!("source-{thread_id}"));
-
-                // Write lifecycle plugin for this thread
-                let _log_path =
-                    write_lifecycle_plugin(&source_root, &format!("parallel-{thread_id}"), "1.0.0");
-
-                // Create PluginManager and install
-                let mut manager = PluginManager::new(PluginManagerConfig::new(&config_home));
-                let install_result = manager.install(source_root.to_str().expect("utf8 path"));
-
-                match install_result {
-                    Ok(install) => {
-                        let log_path = install.install_path.join("lifecycle.log");
-
-                        // Initialize and shutdown the registry to trigger lifecycle hooks
-                        let registry = manager.plugin_registry();
-                        match registry {
-                            Ok(registry) => {
-                                if registry.initialize().is_ok() && registry.shutdown().is_ok() {
-                                    // Verify lifecycle.log exists and has expected content
-                                    if let Ok(log) = fs::read_to_string(&log_path) {
-                                        if log == "init\nshutdown\n" {
-                                            success_count.fetch_add(1, AtomicOrdering::Relaxed);
-                                        }
-                                    }
-                                }
-                            }
-                            Err(_) => {
-                                error_count.fetch_add(1, AtomicOrdering::Relaxed);
-                            }
-                        }
-                    }
-                    Err(_) => {
-                        error_count.fetch_add(1, AtomicOrdering::Relaxed);
-                    }
-                }
-            });
-            handles.push(handle);
-        }
-
-        // Wait for all threads to complete
-        for handle in handles {
-            handle.join().expect("thread should complete");
-        }
-
-        // Verify all threads succeeded without collisions
-        let successes = success_count.load(AtomicOrdering::Relaxed);
-        let errors = error_count.load(AtomicOrdering::Relaxed);
-
-        assert_eq!(
-            successes, 5,
-            "all 5 parallel plugin installations should succeed"
-        );
-        assert_eq!(
-            errors, 0,
-            "no errors should occur during parallel execution"
-        );
-
-        // Cleanup
-        let _ = fs::remove_dir_all(base_dir);
-    }
 }

rust/crates/plugins/src/test_isolation.rs

@@ -1,73 +0,0 @@
-// Test isolation utilities for plugin tests
-// ROADMAP #41: Stop ambient plugin state from skewing CLI regression checks
-
-use std::env;
-use std::path::PathBuf;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::sync::Mutex;
-
-static TEST_COUNTER: AtomicU64 = AtomicU64::new(0);
-static ENV_LOCK: Mutex<()> = Mutex::new(());
-
-/// Lock for test environment isolation
-pub struct EnvLock {
-    _guard: std::sync::MutexGuard<'static, ()>,
-    temp_home: PathBuf,
-}
-
-impl EnvLock {
-    /// Acquire environment lock for test isolation
-    pub fn lock() -> Self {
-        let guard = ENV_LOCK.lock().unwrap();
-        let count = TEST_COUNTER.fetch_add(1, Ordering::SeqCst);
-        let temp_home = std::env::temp_dir().join(format!("plugin-test-{count}"));
-
-        // Set up isolated environment
-        std::fs::create_dir_all(&temp_home).ok();
-        std::fs::create_dir_all(temp_home.join(".claude/plugins/installed")).ok();
-        std::fs::create_dir_all(temp_home.join(".config")).ok();
-
-        // Redirect HOME and XDG_CONFIG_HOME to temp directory
-        env::set_var("HOME", &temp_home);
-        env::set_var("XDG_CONFIG_HOME", temp_home.join(".config"));
-        env::set_var("XDG_DATA_HOME", temp_home.join(".local/share"));
-
-        EnvLock {
-            _guard: guard,
-            temp_home,
-        }
-    }
-
-    /// Get the temporary home directory for this test
-    #[must_use]
-    pub fn temp_home(&self) -> &PathBuf {
-        &self.temp_home
-    }
-}
-
-impl Drop for EnvLock {
-    fn drop(&mut self) {
-        // Cleanup temp directory
-        std::fs::remove_dir_all(&self.temp_home).ok();
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_env_lock_creates_isolated_home() {
-        let lock = EnvLock::lock();
-        let home = env::var("HOME").unwrap();
-        assert!(home.contains("plugin-test-"));
-        assert_eq!(home, lock.temp_home().to_str().unwrap());
-    }
-
-    #[test]
-    fn test_env_lock_creates_plugin_directories() {
-        let lock = EnvLock::lock();
-        let plugins_dir = lock.temp_home().join(".claude/plugins/installed");
-        assert!(plugins_dir.exists());
-    }
-}

rust/crates/runtime/src/bash.rs

@@ -8,7 +8,6 @@ use tokio::process::Command as TokioCommand;
 use tokio::runtime::Builder;
 use tokio::time::timeout;
 
-use crate::lane_events::{LaneEvent, ShipMergeMethod, ShipProvenance};
 use crate::sandbox::{
     build_linux_sandbox_command, resolve_sandbox_status_for_request, FilesystemIsolationMode,
     SandboxConfig, SandboxStatus,
@@ -103,76 +102,11 @@ pub fn execute_bash(input: BashCommandInput) -> io::Result<BashCommandOutput> {
     runtime.block_on(execute_bash_async(input, sandbox_status, cwd))
 }
 
-/// Detect git push to main and emit ship provenance event
-fn detect_and_emit_ship_prepared(command: &str) {
-    let trimmed = command.trim();
-    // Simple detection: git push with main/master
-    if trimmed.contains("git push") && (trimmed.contains("main") || trimmed.contains("master")) {
-        // Emit ship.prepared event
-        let now = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap_or_default()
-            .as_millis();
-        let provenance = ShipProvenance {
-            source_branch: get_current_branch().unwrap_or_else(|| "unknown".to_string()),
-            base_commit: get_head_commit().unwrap_or_default(),
-            commit_count: 0, // Would need to calculate from range
-            commit_range: "unknown..HEAD".to_string(),
-            merge_method: ShipMergeMethod::DirectPush,
-            actor: get_git_actor().unwrap_or_else(|| "unknown".to_string()),
-            pr_number: None,
-        };
-        let _event = LaneEvent::ship_prepared(format!("{now}"), &provenance);
-        // Log to stderr as interim routing before event stream integration
-        eprintln!(
-            "[ship.prepared] branch={} -> main, commits={}, actor={}",
-            provenance.source_branch, provenance.commit_count, provenance.actor
-        );
-    }
-}
-
-fn get_current_branch() -> Option<String> {
-    let output = Command::new("git")
-        .args(["branch", "--show-current"])
-        .output()
-        .ok()?;
-    if output.status.success() {
-        Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
-    } else {
-        None
-    }
-}
-
-fn get_head_commit() -> Option<String> {
-    let output = Command::new("git")
-        .args(["rev-parse", "--short", "HEAD"])
-        .output()
-        .ok()?;
-    if output.status.success() {
-        Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
-    } else {
-        None
-    }
-}
-
-fn get_git_actor() -> Option<String> {
-    let name = Command::new("git")
-        .args(["config", "user.name"])
-        .output()
-        .ok()
-        .filter(|o| o.status.success())
-        .map(|o| String::from_utf8_lossy(&o.stdout).trim().to_string())?;
-    Some(name)
-}
-
 async fn execute_bash_async(
     input: BashCommandInput,
     sandbox_status: SandboxStatus,
     cwd: std::path::PathBuf,
 ) -> io::Result<BashCommandOutput> {
-    // Detect and emit ship provenance for git push operations
-    detect_and_emit_ship_prepared(&input.command);
-
     let mut command = prepare_tokio_command(&input.command, &cwd, &sandbox_status, true);
 
     let output_result = if let Some(timeout_ms) = input.timeout {

rust/crates/runtime/src/compact.rs

@@ -108,54 +108,10 @@ pub fn compact_session(session: &Session, config: CompactionConfig) -> Compactio
         .first()
         .and_then(extract_existing_compacted_summary);
     let compacted_prefix_len = usize::from(existing_summary.is_some());
-    let raw_keep_from = session
+    let keep_from = session
         .messages
         .len()
         .saturating_sub(config.preserve_recent_messages);
-    // Ensure we do not split a tool-use / tool-result pair at the compaction
-    // boundary. If the first preserved message is a user message whose first
-    // block is a ToolResult, the assistant message with the matching ToolUse
-    // was slated for removal — that produces an orphaned tool role message on
-    // the OpenAI-compat path (400: tool message must follow assistant with
-    // tool_calls). Walk the boundary back until we start at a safe point.
-    let keep_from = {
-        let mut k = raw_keep_from;
-        // If the first preserved message is a tool-result turn, ensure its
-        // paired assistant tool-use turn is preserved too. Without this fix,
-        // the OpenAI-compat adapter sends an orphaned 'tool' role message
-        // with no preceding assistant 'tool_calls', which providers reject
-        // with a 400. We walk back only if the immediately preceding message
-        // is NOT an assistant message that contains a ToolUse block (i.e. the
-        // pair is actually broken at the boundary).
-        loop {
-            if k == 0 || k <= compacted_prefix_len {
-                break;
-            }
-            let first_preserved = &session.messages[k];
-            let starts_with_tool_result = first_preserved
-                .blocks
-                .first()
-                .is_some_and(|b| matches!(b, ContentBlock::ToolResult { .. }));
-            if !starts_with_tool_result {
-                break;
-            }
-            // Check the message just before the current boundary.
-            let preceding = &session.messages[k - 1];
-            let preceding_has_tool_use = preceding
-                .blocks
-                .iter()
-                .any(|b| matches!(b, ContentBlock::ToolUse { .. }));
-            if preceding_has_tool_use {
-                // Pair is intact — walk back one more to include the assistant turn.
-                k = k.saturating_sub(1);
-                break;
-            }
-            // Preceding message has no ToolUse but we have a ToolResult —
-            // this is already an orphaned pair; walk back to try to fix it.
-            k = k.saturating_sub(1);
-        }
-        k
-    };
     let removed = &session.messages[compacted_prefix_len..keep_from];
     let preserved = session.messages[keep_from..].to_vec();
     let summary =
@@ -554,7 +510,7 @@ fn extract_summary_timeline(summary: &str) -> Vec<String> {
 #[cfg(test)]
 mod tests {
     use super::{
-        collect_key_files, compact_session, format_compact_summary,
+        collect_key_files, compact_session, estimate_session_tokens, format_compact_summary,
         get_compact_continuation_message, infer_pending_work, should_compact, CompactionConfig,
     };
     use crate::session::{ContentBlock, ConversationMessage, MessageRole, Session};
@@ -603,14 +559,7 @@ mod tests {
             },
         );
 
-        // With the tool-use/tool-result boundary fix, the compaction preserves
-        // one extra message to avoid an orphaned tool result at the boundary.
-        // messages[1] (assistant) must be kept along with messages[2] (tool result).
-        assert!(
-            result.removed_message_count <= 2,
-            "expected at most 2 removed, got {}",
-            result.removed_message_count
-        );
+        assert_eq!(result.removed_message_count, 2);
         assert_eq!(
             result.compacted_session.messages[0].role,
             MessageRole::System
@@ -628,13 +577,8 @@ mod tests {
                 max_estimated_tokens: 1,
             }
         ));
-        // Note: with the tool-use/tool-result boundary guard the compacted session
-        // may preserve one extra message at the boundary, so token reduction is
-        // not guaranteed for small sessions. The invariant that matters is that
-        // the removed_message_count is non-zero (something was compacted).
         assert!(
-            result.removed_message_count > 0,
-            "compaction must remove at least one message"
+            estimate_session_tokens(&result.compacted_session) < estimate_session_tokens(&session)
         );
     }
 
@@ -738,79 +682,6 @@ mod tests {
         assert!(files.contains(&"rust/crates/rusty-claude-cli/src/main.rs".to_string()));
     }
 
-    /// Regression: compaction must not split an assistant(ToolUse) /
-    /// user(ToolResult) pair at the boundary. An orphaned tool-result message
-    /// without the preceding assistant `tool_calls` causes a 400 on the
-    /// OpenAI-compat path (gaebal-gajae repro 2026-04-09).
-    #[test]
-    fn compaction_does_not_split_tool_use_tool_result_pair() {
-        use crate::session::{ContentBlock, Session};
-
-        let tool_id = "call_abc";
-        let mut session = Session::default();
-        // Turn 1: user prompt
-        session
-            .push_message(ConversationMessage::user_text("Search for files"))
-            .unwrap();
-        // Turn 2: assistant calls a tool
-        session
-            .push_message(ConversationMessage::assistant(vec![
-                ContentBlock::ToolUse {
-                    id: tool_id.to_string(),
-                    name: "search".to_string(),
-                    input: "{\"q\":\"*.rs\"}".to_string(),
-                },
-            ]))
-            .unwrap();
-        // Turn 3: tool result
-        session
-            .push_message(ConversationMessage::tool_result(
-                tool_id,
-                "search",
-                "found 5 files",
-                false,
-            ))
-            .unwrap();
-        // Turn 4: assistant final response
-        session
-            .push_message(ConversationMessage::assistant(vec![ContentBlock::Text {
-                text: "Done.".to_string(),
-            }]))
-            .unwrap();
-
-        // Compact preserving only 1 recent message — without the fix this
-        // would cut the boundary so that the tool result (turn 3) is first,
-        // without its preceding assistant tool_calls (turn 2).
-        let config = CompactionConfig {
-            preserve_recent_messages: 1,
-            ..CompactionConfig::default()
-        };
-        let result = compact_session(&session, config);
-        // After compaction, no two consecutive messages should have the pattern
-        // tool_result immediately following a non-assistant message (i.e. an
-        // orphaned tool result without a preceding assistant ToolUse).
-        let messages = &result.compacted_session.messages;
-        for i in 1..messages.len() {
-            let curr_is_tool_result = messages[i]
-                .blocks
-                .first()
-                .is_some_and(|b| matches!(b, ContentBlock::ToolResult { .. }));
-            if curr_is_tool_result {
-                let prev_has_tool_use = messages[i - 1]
-                    .blocks
-                    .iter()
-                    .any(|b| matches!(b, ContentBlock::ToolUse { .. }));
-                assert!(
-                    prev_has_tool_use,
-                    "message[{}] is a ToolResult but message[{}] has no ToolUse: {:?}",
-                    i,
-                    i - 1,
-                    &messages[i - 1].blocks
-                );
-            }
-        }
-    }
-
     #[test]
     fn infers_pending_work_from_recent_messages() {
         let pending = infer_pending_work(&[

rust/crates/runtime/src/config.rs

@@ -1254,21 +1254,11 @@ mod tests {
     use std::time::{SystemTime, UNIX_EPOCH};
 
     fn temp_dir() -> std::path::PathBuf {
-        // #149: previously used `runtime-config-{nanos}` which collided
-        // under parallel `cargo test --workspace` when multiple tests
-        // started within the same nanosecond bucket on fast machines.
-        // Add process id + a monotonically-incrementing atomic counter
-        // so every callsite gets a provably-unique directory regardless
-        // of clock resolution or scheduling.
-        use std::sync::atomic::{AtomicU64, Ordering};
-        static COUNTER: AtomicU64 = AtomicU64::new(0);
         let nanos = SystemTime::now()
             .duration_since(UNIX_EPOCH)
             .expect("time should be after epoch")
             .as_nanos();
-        let pid = std::process::id();
-        let seq = COUNTER.fetch_add(1, Ordering::Relaxed);
-        std::env::temp_dir().join(format!("runtime-config-{pid}-{nanos}-{seq}"))
+        std::env::temp_dir().join(format!("runtime-config-{nanos}"))
     }
 
     #[test]

rust/crates/runtime/src/conversation.rs

@@ -292,24 +292,6 @@ where
         }
     }
 
-    /// Run a session health probe to verify the runtime is functional after compaction.
-    /// Returns Ok(()) if healthy, Err if the session appears broken.
-    fn run_session_health_probe(&mut self) -> Result<(), String> {
-        // Check if we have basic session integrity
-        if self.session.messages.is_empty() && self.session.compaction.is_some() {
-            // Freshly compacted with no messages - this is normal
-            return Ok(());
-        }
-
-        // Verify tool executor is responsive with a non-destructive probe
-        // Using glob_search with a pattern that won't match anything
-        let probe_input = r#"{"pattern": "*.health-check-probe-"}"#;
-        match self.tool_executor.execute("glob_search", probe_input) {
-            Ok(_) => Ok(()),
-            Err(e) => Err(format!("Tool executor probe failed: {e}")),
-        }
-    }
-
     #[allow(clippy::too_many_lines)]
     pub fn run_turn(
         &mut self,
@@ -317,18 +299,6 @@ where
         mut prompter: Option<&mut dyn PermissionPrompter>,
     ) -> Result<TurnSummary, RuntimeError> {
         let user_input = user_input.into();
-
-        // ROADMAP #38: Session-health canary - probe if context was compacted
-        if self.session.compaction.is_some() {
-            if let Err(error) = self.run_session_health_probe() {
-                return Err(RuntimeError::new(format!(
-                    "Session health probe failed after compaction: {error}. \
-                     The session may be in an inconsistent state. \
-                     Consider starting a fresh session with /session new."
-                )));
-            }
-        }
-
         self.record_turn_started(&user_input);
         self.session
             .push_user_text(user_input)
@@ -534,10 +504,6 @@ where
         &self.session
     }
 
-    pub fn api_client_mut(&mut self) -> &mut C {
-        &mut self.api_client
-    }
-
     pub fn session_mut(&mut self) -> &mut Session {
         &mut self.session
     }
@@ -1611,88 +1577,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn compaction_health_probe_blocks_turn_when_tool_executor_is_broken() {
-        struct SimpleApi;
-        impl ApiClient for SimpleApi {
-            fn stream(
-                &mut self,
-                _request: ApiRequest,
-            ) -> Result<Vec<AssistantEvent>, RuntimeError> {
-                panic!("API should not run when health probe fails");
-            }
-        }
-
-        let mut session = Session::new();
-        session.record_compaction("summarized earlier work", 4);
-        session
-            .push_user_text("previous message")
-            .expect("message should append");
-
-        let tool_executor = StaticToolExecutor::new().register("glob_search", |_input| {
-            Err(ToolError::new("transport unavailable"))
-        });
-        let mut runtime = ConversationRuntime::new(
-            session,
-            SimpleApi,
-            tool_executor,
-            PermissionPolicy::new(PermissionMode::DangerFullAccess),
-            vec!["system".to_string()],
-        );
-
-        let error = runtime
-            .run_turn("trigger", None)
-            .expect_err("health probe failure should abort the turn");
-        assert!(
-            error
-                .to_string()
-                .contains("Session health probe failed after compaction"),
-            "unexpected error: {error}"
-        );
-        assert!(
-            error.to_string().contains("transport unavailable"),
-            "expected underlying probe error: {error}"
-        );
-    }
-
-    #[test]
-    fn compaction_health_probe_skips_empty_compacted_session() {
-        struct SimpleApi;
-        impl ApiClient for SimpleApi {
-            fn stream(
-                &mut self,
-                _request: ApiRequest,
-            ) -> Result<Vec<AssistantEvent>, RuntimeError> {
-                Ok(vec![
-                    AssistantEvent::TextDelta("done".to_string()),
-                    AssistantEvent::MessageStop,
-                ])
-            }
-        }
-
-        let mut session = Session::new();
-        session.record_compaction("fresh summary", 2);
-
-        let tool_executor = StaticToolExecutor::new().register("glob_search", |_input| {
-            Err(ToolError::new(
-                "glob_search should not run for an empty compacted session",
-            ))
-        });
-        let mut runtime = ConversationRuntime::new(
-            session,
-            SimpleApi,
-            tool_executor,
-            PermissionPolicy::new(PermissionMode::DangerFullAccess),
-            vec!["system".to_string()],
-        );
-
-        let summary = runtime
-            .run_turn("trigger", None)
-            .expect("empty compacted session should not fail health probe");
-        assert_eq!(summary.auto_compaction, None);
-        assert_eq!(runtime.session().messages.len(), 2);
-    }
-
     #[test]
     fn build_assistant_message_requires_message_stop_event() {
         // given

rust/crates/runtime/src/file_ops.rs

@@ -308,20 +308,12 @@ pub fn glob_search(pattern: &str, path: Option<&str>) -> io::Result<GlobSearchOu
         base_dir.join(pattern).to_string_lossy().into_owned()
     };
 
-    // The `glob` crate does not support brace expansion ({a,b,c}).
-    // Expand braces into multiple patterns so patterns like
-    // `Assets/**/*.{cs,uxml,uss}` work correctly.
-    let expanded = expand_braces(&search_pattern);
-
-    let mut seen = std::collections::HashSet::new();
     let mut matches = Vec::new();
-    for pat in &expanded {
-        let entries = glob::glob(pat)
-            .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error.to_string()))?;
-        for entry in entries.flatten() {
-            if entry.is_file() && seen.insert(entry.clone()) {
-                matches.push(entry);
-            }
+    let entries = glob::glob(&search_pattern)
+        .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error.to_string()))?;
+    for entry in entries.flatten() {
+        if entry.is_file() {
+            matches.push(entry);
         }
     }
 
@@ -627,35 +619,13 @@ pub fn is_symlink_escape(path: &Path, workspace_root: &Path) -> io::Result<bool>
     Ok(!resolved.starts_with(&canonical_root))
 }
 
-/// Expand shell-style brace groups in a glob pattern.
-///
-/// Handles one level of braces: `foo.{a,b,c}` → `["foo.a", "foo.b", "foo.c"]`.
-/// Nested braces are not expanded (uncommon in practice).
-/// Patterns without braces pass through unchanged.
-fn expand_braces(pattern: &str) -> Vec<String> {
-    let Some(open) = pattern.find('{') else {
-        return vec![pattern.to_owned()];
-    };
-    let Some(close) = pattern[open..].find('}').map(|i| open + i) else {
-        // Unmatched brace — treat as literal.
-        return vec![pattern.to_owned()];
-    };
-    let prefix = &pattern[..open];
-    let suffix = &pattern[close + 1..];
-    let alternatives = &pattern[open + 1..close];
-    alternatives
-        .split(',')
-        .flat_map(|alt| expand_braces(&format!("{prefix}{alt}{suffix}")))
-        .collect()
-}
-
 #[cfg(test)]
 mod tests {
     use std::time::{SystemTime, UNIX_EPOCH};
 
     use super::{
-        edit_file, expand_braces, glob_search, grep_search, is_symlink_escape, read_file,
-        read_file_in_workspace, write_file, GrepSearchInput, MAX_WRITE_SIZE,
+        edit_file, glob_search, grep_search, is_symlink_escape, read_file, read_file_in_workspace,
+        write_file, GrepSearchInput, MAX_WRITE_SIZE,
     };
 
     fn temp_path(name: &str) -> std::path::PathBuf {
@@ -789,51 +759,4 @@ mod tests {
         .expect("grep should succeed");
         assert!(grep_output.content.unwrap_or_default().contains("hello"));
     }
-
-    #[test]
-    fn expand_braces_no_braces() {
-        assert_eq!(expand_braces("*.rs"), vec!["*.rs"]);
-    }
-
-    #[test]
-    fn expand_braces_single_group() {
-        let mut result = expand_braces("Assets/**/*.{cs,uxml,uss}");
-        result.sort();
-        assert_eq!(
-            result,
-            vec!["Assets/**/*.cs", "Assets/**/*.uss", "Assets/**/*.uxml",]
-        );
-    }
-
-    #[test]
-    fn expand_braces_nested() {
-        let mut result = expand_braces("src/{a,b}.{rs,toml}");
-        result.sort();
-        assert_eq!(
-            result,
-            vec!["src/a.rs", "src/a.toml", "src/b.rs", "src/b.toml"]
-        );
-    }
-
-    #[test]
-    fn expand_braces_unmatched() {
-        assert_eq!(expand_braces("foo.{bar"), vec!["foo.{bar"]);
-    }
-
-    #[test]
-    fn glob_search_with_braces_finds_files() {
-        let dir = temp_path("glob-braces");
-        std::fs::create_dir_all(&dir).unwrap();
-        std::fs::write(dir.join("a.rs"), "fn main() {}").unwrap();
-        std::fs::write(dir.join("b.toml"), "[package]").unwrap();
-        std::fs::write(dir.join("c.txt"), "hello").unwrap();
-
-        let result =
-            glob_search("*.{rs,toml}", Some(dir.to_str().unwrap())).expect("glob should succeed");
-        assert_eq!(
-            result.num_files, 2,
-            "should match .rs and .toml but not .txt"
-        );
-        let _ = std::fs::remove_dir_all(&dir);
-    }
 }

rust/crates/runtime/src/hooks.rs

@@ -1,5 +1,4 @@
 use std::ffi::OsStr;
-use std::fmt::Write as FmtWrite;
 use std::io::Write;
 use std::process::{Command, Stdio};
 use std::sync::{
@@ -14,8 +13,6 @@ use serde_json::{json, Value};
 use crate::config::{RuntimeFeatureConfig, RuntimeHookConfig};
 use crate::permissions::PermissionOverride;
 
-const HOOK_PREVIEW_CHAR_LIMIT: usize = 160;
-
 pub type HookPermissionDecision = PermissionOverride;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -440,7 +437,7 @@ impl HookRunner {
             Ok(CommandExecution::Finished(output)) => {
                 let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
                 let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-                let parsed = parse_hook_output(event, tool_name, command, &stdout, &stderr);
+                let parsed = parse_hook_output(&stdout);
                 let primary_message = parsed.primary_message().map(ToOwned::to_owned);
                 match output.status.code() {
                     Some(0) => {
@@ -535,54 +532,16 @@ fn merge_parsed_hook_output(target: &mut HookRunResult, parsed: ParsedHookOutput
     }
 }
 
-fn parse_hook_output(
-    event: HookEvent,
-    tool_name: &str,
-    command: &str,
-    stdout: &str,
-    stderr: &str,
-) -> ParsedHookOutput {
+fn parse_hook_output(stdout: &str) -> ParsedHookOutput {
     if stdout.is_empty() {
         return ParsedHookOutput::default();
     }
 
-    let root = match serde_json::from_str::<Value>(stdout) {
-        Ok(Value::Object(root)) => root,
-        Ok(value) => {
-            return ParsedHookOutput {
-                messages: vec![format_invalid_hook_output(
-                    event,
-                    tool_name,
-                    command,
-                    &format!(
-                        "expected top-level JSON object, got {}",
-                        json_type_name(&value)
-                    ),
-                    stdout,
-                    stderr,
-                )],
-                ..ParsedHookOutput::default()
-            };
-        }
-        Err(error) if looks_like_json_attempt(stdout) => {
-            return ParsedHookOutput {
-                messages: vec![format_invalid_hook_output(
-                    event,
-                    tool_name,
-                    command,
-                    &error.to_string(),
-                    stdout,
-                    stderr,
-                )],
-                ..ParsedHookOutput::default()
-            };
-        }
-        Err(_) => {
-            return ParsedHookOutput {
-                messages: vec![stdout.to_string()],
-                ..ParsedHookOutput::default()
-            };
-        }
+    let Ok(Value::Object(root)) = serde_json::from_str::<Value>(stdout) else {
+        return ParsedHookOutput {
+            messages: vec![stdout.to_string()],
+            ..ParsedHookOutput::default()
+        };
     };
 
     let mut parsed = ParsedHookOutput::default();
@@ -660,69 +619,6 @@ fn parse_tool_input(tool_input: &str) -> Value {
     serde_json::from_str(tool_input).unwrap_or_else(|_| json!({ "raw": tool_input }))
 }
 
-fn format_invalid_hook_output(
-    event: HookEvent,
-    tool_name: &str,
-    command: &str,
-    detail: &str,
-    stdout: &str,
-    stderr: &str,
-) -> String {
-    let stdout_preview = bounded_hook_preview(stdout).unwrap_or_else(|| "<empty>".to_string());
-    let stderr_preview = bounded_hook_preview(stderr).unwrap_or_else(|| "<empty>".to_string());
-    let command_preview = bounded_hook_preview(command).unwrap_or_else(|| "<empty>".to_string());
-
-    format!(
-        "hook_invalid_json: phase={} tool={} command={} detail={} stdout_preview={} stderr_preview={}",
-        event.as_str(),
-        tool_name,
-        command_preview,
-        detail,
-        stdout_preview,
-        stderr_preview
-    )
-}
-
-fn bounded_hook_preview(value: &str) -> Option<String> {
-    let trimmed = value.trim();
-    if trimmed.is_empty() {
-        return None;
-    }
-
-    let mut preview = String::new();
-    for (count, ch) in trimmed.chars().enumerate() {
-        if count == HOOK_PREVIEW_CHAR_LIMIT {
-            preview.push('…');
-            break;
-        }
-        match ch {
-            '\n' => preview.push_str("\\n"),
-            '\r' => preview.push_str("\\r"),
-            '\t' => preview.push_str("\\t"),
-            control if control.is_control() => {
-                let _ = write!(&mut preview, "\\u{{{:x}}}", control as u32);
-            }
-            _ => preview.push(ch),
-        }
-    }
-    Some(preview)
-}
-
-fn json_type_name(value: &Value) -> &'static str {
-    match value {
-        Value::Null => "null",
-        Value::Bool(_) => "boolean",
-        Value::Number(_) => "number",
-        Value::String(_) => "string",
-        Value::Array(_) => "array",
-        Value::Object(_) => "object",
-    }
-}
-
-fn looks_like_json_attempt(value: &str) -> bool {
-    matches!(value.trim_start().chars().next(), Some('{' | '['))
-}
-
 fn format_hook_failure(command: &str, code: i32, stdout: Option<&str>, stderr: &str) -> String {
     let mut message = format!("Hook `{command}` exited with status {code}");
     if let Some(stdout) = stdout.filter(|stdout| !stdout.is_empty()) {
@@ -1039,31 +935,6 @@ mod tests {
         assert!(!result.messages().iter().any(|message| message == "later"));
     }
 
-    #[test]
-    fn malformed_nonempty_hook_output_reports_explicit_diagnostic_with_previews() {
-        let runner = HookRunner::new(RuntimeHookConfig::new(
-            vec![shell_snippet(
-                "printf '{not-json\nsecond line'; printf 'stderr warning' >&2; exit 1",
-            )],
-            Vec::new(),
-            Vec::new(),
-        ));
-
-        let result = runner.run_pre_tool_use("Edit", r#"{"file":"src/lib.rs"}"#);
-
-        assert!(result.is_failed());
-        let rendered = result.messages().join("\n");
-        assert!(rendered.contains("hook_invalid_json:"));
-        assert!(rendered.contains("phase=PreToolUse"));
-        assert!(rendered.contains("tool=Edit"));
-        assert!(rendered.contains("command=printf '{not-json"));
-        assert!(rendered.contains("printf 'stderr warning' >&2; exit 1"));
-        assert!(rendered.contains("detail=key must be a string"));
-        assert!(rendered.contains("stdout_preview={not-json"));
-        assert!(rendered.contains("second line stderr_preview=stderr warning"));
-        assert!(rendered.contains("stderr_preview=stderr warning"));
-    }
-
     #[test]
     fn abort_signal_cancels_long_running_hook_and_reports_progress() {
         let runner = HookRunner::new(RuntimeHookConfig::new(

rust/crates/runtime/src/lib.rs

@@ -83,11 +83,8 @@ pub use hooks::{
     HookAbortSignal, HookEvent, HookProgressEvent, HookProgressReporter, HookRunResult, HookRunner,
 };
 pub use lane_events::{
-    compute_event_fingerprint, dedupe_superseded_commit_events, dedupe_terminal_events,
-    is_terminal_event, BlockedSubphase, EventProvenance, LaneCommitProvenance, LaneEvent,
-    LaneEventBlocker, LaneEventBuilder, LaneEventMetadata, LaneEventName, LaneEventStatus,
-    LaneFailureClass, LaneOwnership, SessionIdentity, ShipMergeMethod, ShipProvenance,
-    WatcherAction,
+    dedupe_superseded_commit_events, LaneCommitProvenance, LaneEvent, LaneEventBlocker,
+    LaneEventName, LaneEventStatus, LaneFailureClass,
 };
 pub use mcp::{
     mcp_server_signature, mcp_tool_name, mcp_tool_prefix, normalize_name_for_mcp,

rust/crates/runtime/src/oauth.rs

@@ -335,14 +335,7 @@ fn credentials_home_dir() -> io::Result<PathBuf> {
         return Ok(PathBuf::from(path));
     }
     let home = std::env::var_os("HOME")
-        .or_else(|| std::env::var_os("USERPROFILE"))
-        .ok_or_else(|| {
-            io::Error::new(
-                io::ErrorKind::NotFound,
-                "HOME is not set (on Windows, set USERPROFILE or HOME, \
-                 or use CLAW_CONFIG_HOME to point directly at the config directory)",
-            )
-        })?;
+        .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "HOME is not set"))?;
     Ok(PathBuf::from(home).join(".claw"))
 }
 

rust/crates/runtime/src/permission_enforcer.rs

@@ -65,40 +65,6 @@ impl PermissionEnforcer {
         matches!(self.check(tool_name, input), EnforcementResult::Allowed)
     }
 
-    /// Check permission with an explicitly provided required mode.
-    /// Used when the required mode is determined dynamically (e.g., bash command classification).
-    pub fn check_with_required_mode(
-        &self,
-        tool_name: &str,
-        input: &str,
-        required_mode: PermissionMode,
-    ) -> EnforcementResult {
-        // When the active mode is Prompt, defer to the caller's interactive
-        // prompt flow rather than hard-denying.
-        if self.policy.active_mode() == PermissionMode::Prompt {
-            return EnforcementResult::Allowed;
-        }
-
-        let active_mode = self.policy.active_mode();
-
-        // Check if active mode meets the dynamically determined required mode
-        if active_mode >= required_mode {
-            return EnforcementResult::Allowed;
-        }
-
-        // Permission denied - active mode is insufficient
-        EnforcementResult::Denied {
-            tool: tool_name.to_owned(),
-            active_mode: active_mode.as_str().to_owned(),
-            required_mode: required_mode.as_str().to_owned(),
-            reason: format!(
-                "'{tool_name}' with input '{input}' requires '{}' permission, but current mode is '{}'",
-                required_mode.as_str(),
-                active_mode.as_str()
-            ),
-        }
-    }
-
     #[must_use]
     pub fn active_mode(&self) -> PermissionMode {
         self.policy.active_mode()

rust/crates/runtime/src/recovery_recipes.rs

@@ -45,14 +45,10 @@ impl FailureScenario {
     #[must_use]
     pub fn from_worker_failure_kind(kind: WorkerFailureKind) -> Self {
         match kind {
-            WorkerFailureKind::TrustGate | WorkerFailureKind::ToolPermissionGate => {
-                Self::TrustPromptUnresolved
-            }
+            WorkerFailureKind::TrustGate => Self::TrustPromptUnresolved,
             WorkerFailureKind::PromptDelivery => Self::PromptMisdelivery,
             WorkerFailureKind::Protocol => Self::McpHandshakeFailure,
-            WorkerFailureKind::Provider | WorkerFailureKind::StartupNoEvidence => {
-                Self::ProviderFailure
-            }
+            WorkerFailureKind::Provider => Self::ProviderFailure,
         }
     }
 }

rust/crates/runtime/src/session.rs

@@ -13,7 +13,6 @@ const SESSION_VERSION: u32 = 1;
 const ROTATE_AFTER_BYTES: u64 = 256 * 1024;
 const MAX_ROTATED_FILES: usize = 3;
 static SESSION_ID_COUNTER: AtomicU64 = AtomicU64::new(0);
-static LAST_TIMESTAMP_MS: AtomicU64 = AtomicU64::new(0);
 
 /// Speaker role associated with a persisted conversation message.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -97,11 +96,6 @@ pub struct Session {
     pub fork: Option<SessionFork>,
     pub workspace_root: Option<PathBuf>,
     pub prompt_history: Vec<SessionPromptEntry>,
-    /// The model used in this session, persisted so resumed sessions can
-    /// report which model was originally used.
-    /// Timestamp of last successful health check (ROADMAP #38)
-    pub last_health_check_ms: Option<u64>,
-    pub model: Option<String>,
     persistence: Option<SessionPersistence>,
 }
 
@@ -116,7 +110,6 @@ impl PartialEq for Session {
             && self.fork == other.fork
             && self.workspace_root == other.workspace_root
             && self.prompt_history == other.prompt_history
-            && self.last_health_check_ms == other.last_health_check_ms
     }
 }
 
@@ -168,8 +161,6 @@ impl Session {
             fork: None,
             workspace_root: None,
             prompt_history: Vec::new(),
-            last_health_check_ms: None,
-            model: None,
             persistence: None,
         }
     }
@@ -272,8 +263,6 @@ impl Session {
             }),
             workspace_root: self.workspace_root.clone(),
             prompt_history: self.prompt_history.clone(),
-            last_health_check_ms: self.last_health_check_ms,
-            model: self.model.clone(),
             persistence: None,
         }
     }
@@ -382,10 +371,6 @@ impl Session {
                     .collect()
             })
             .unwrap_or_default();
-        let model = object
-            .get("model")
-            .and_then(JsonValue::as_str)
-            .map(String::from);
         Ok(Self {
             version,
             session_id,
@@ -396,8 +381,6 @@ impl Session {
             fork,
             workspace_root,
             prompt_history,
-            last_health_check_ms: None,
-            model,
             persistence: None,
         })
     }
@@ -411,7 +394,6 @@ impl Session {
         let mut compaction = None;
         let mut fork = None;
         let mut workspace_root = None;
-        let mut model = None;
         let mut prompt_history = Vec::new();
 
         for (line_number, raw_line) in contents.lines().enumerate() {
@@ -451,10 +433,6 @@ impl Session {
                         .get("workspace_root")
                         .and_then(JsonValue::as_str)
                         .map(PathBuf::from);
-                    model = object
-                        .get("model")
-                        .and_then(JsonValue::as_str)
-                        .map(String::from);
                 }
                 "message" => {
                     let message_value = object.get("message").ok_or_else(|| {
@@ -497,8 +475,6 @@ impl Session {
             fork,
             workspace_root,
             prompt_history,
-            last_health_check_ms: None,
-            model,
             persistence: None,
         })
     }
@@ -604,9 +580,6 @@ impl Session {
                 JsonValue::String(workspace_root_to_string(workspace_root)?),
             );
         }
-        if let Some(model) = &self.model {
-            object.insert("model".to_string(), JsonValue::String(model.clone()));
-        }
         Ok(JsonValue::Object(object))
     }
 
@@ -1031,27 +1004,10 @@ fn normalize_optional_string(value: Option<String>) -> Option<String> {
 }
 
 fn current_time_millis() -> u64 {
-    let wall_clock = SystemTime::now()
+    SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .map(|duration| u64::try_from(duration.as_millis()).unwrap_or(u64::MAX))
-        .unwrap_or_default();
-
-    let mut candidate = wall_clock;
-    loop {
-        let previous = LAST_TIMESTAMP_MS.load(Ordering::Relaxed);
-        if candidate <= previous {
-            candidate = previous.saturating_add(1);
-        }
-        match LAST_TIMESTAMP_MS.compare_exchange(
-            previous,
-            candidate,
-            Ordering::SeqCst,
-            Ordering::SeqCst,
-        ) {
-            Ok(_) => return candidate,
-            Err(actual) => candidate = actual.saturating_add(1),
-        }
-    }
+        .unwrap_or_default()
 }
 
 fn generate_session_id() -> String {
@@ -1143,8 +1099,8 @@ fn cleanup_rotated_logs(path: &Path) -> Result<(), SessionError> {
 #[cfg(test)]
 mod tests {
     use super::{
-        cleanup_rotated_logs, current_time_millis, rotate_session_file_if_needed, ContentBlock,
-        ConversationMessage, MessageRole, Session, SessionFork,
+        cleanup_rotated_logs, rotate_session_file_if_needed, ContentBlock, ConversationMessage,
+        MessageRole, Session, SessionFork,
     };
     use crate::json::JsonValue;
     use crate::usage::TokenUsage;
@@ -1152,16 +1108,6 @@ mod tests {
     use std::path::{Path, PathBuf};
     use std::time::{SystemTime, UNIX_EPOCH};
 
-    #[test]
-    fn session_timestamps_are_monotonic_under_tight_loops() {
-        let first = current_time_millis();
-        let second = current_time_millis();
-        let third = current_time_millis();
-
-        assert!(first < second);
-        assert!(second < third);
-    }
-
     #[test]
     fn persists_and_restores_session_jsonl() {
         let mut session = Session::new();
@@ -1495,8 +1441,12 @@ mod tests {
 /// Called by external consumers (e.g. clawhip) to enumerate sessions for a CWD.
 #[allow(dead_code)]
 pub fn workspace_sessions_dir(cwd: &std::path::Path) -> Result<std::path::PathBuf, SessionError> {
-    let store = crate::session_control::SessionStore::from_cwd(cwd)
-        .map_err(|e| SessionError::Io(std::io::Error::other(e.to_string())))?;
+    let store = crate::session_control::SessionStore::from_cwd(cwd).map_err(|e| {
+        SessionError::Io(std::io::Error::new(
+            std::io::ErrorKind::Other,
+            e.to_string(),
+        ))
+    })?;
     Ok(store.sessions_dir().to_path_buf())
 }
 
@@ -1513,7 +1463,8 @@ mod workspace_sessions_dir_tests {
         let result = workspace_sessions_dir(&tmp);
         assert!(
             result.is_ok(),
-            "workspace_sessions_dir should succeed for a valid CWD, got: {result:?}"
+            "workspace_sessions_dir should succeed for a valid CWD, got: {:?}",
+            result
         );
         let dir = result.unwrap();
         // The returned path should be non-empty and end with a hash component

rust/crates/runtime/src/session_control.rs

@@ -31,19 +31,14 @@ impl SessionStore {
     /// The on-disk layout becomes `<cwd>/.claw/sessions/<workspace_hash>/`.
     pub fn from_cwd(cwd: impl AsRef<Path>) -> Result<Self, SessionControlError> {
         let cwd = cwd.as_ref();
-        // #151: canonicalize so equivalent paths (symlinks, relative vs
-        // absolute, /tmp vs /private/tmp on macOS) produce the same
-        // workspace_fingerprint. Falls back to the raw path if canonicalize
-        // fails (e.g. the directory doesn't exist yet).
-        let canonical_cwd = fs::canonicalize(cwd).unwrap_or_else(|_| cwd.to_path_buf());
-        let sessions_root = canonical_cwd
+        let sessions_root = cwd
             .join(".claw")
             .join("sessions")
-            .join(workspace_fingerprint(&canonical_cwd));
+            .join(workspace_fingerprint(cwd));
         fs::create_dir_all(&sessions_root)?;
         Ok(Self {
             sessions_root,
-            workspace_root: canonical_cwd,
+            workspace_root: cwd.to_path_buf(),
         })
     }
 
@@ -56,18 +51,14 @@ impl SessionStore {
         workspace_root: impl AsRef<Path>,
     ) -> Result<Self, SessionControlError> {
         let workspace_root = workspace_root.as_ref();
-        // #151: canonicalize workspace_root for consistent fingerprinting
-        // across equivalent path representations.
-        let canonical_workspace =
-            fs::canonicalize(workspace_root).unwrap_or_else(|_| workspace_root.to_path_buf());
         let sessions_root = data_dir
             .as_ref()
             .join("sessions")
-            .join(workspace_fingerprint(&canonical_workspace));
+            .join(workspace_fingerprint(workspace_root));
         fs::create_dir_all(&sessions_root)?;
         Ok(Self {
             sessions_root,
-            workspace_root: canonical_workspace,
+            workspace_root: workspace_root.to_path_buf(),
         })
     }
 
@@ -83,7 +74,6 @@ impl SessionStore {
         &self.workspace_root
     }
 
-    #[must_use]
     pub fn create_handle(&self, session_id: &str) -> SessionHandle {
         let id = session_id.to_string();
         let path = self
@@ -112,7 +102,7 @@ impl SessionStore {
             candidate
         } else if looks_like_path {
             return Err(SessionControlError::Format(
-                format_missing_session_reference(reference, &self.sessions_root),
+                format_missing_session_reference(reference),
             ));
         } else {
             self.resolve_managed_path(reference)?
@@ -131,115 +121,17 @@ impl SessionStore {
                 return Ok(path);
             }
         }
-        if let Some(legacy_root) = self.legacy_sessions_root() {
-            for extension in [PRIMARY_SESSION_EXTENSION, LEGACY_SESSION_EXTENSION] {
-                let path = legacy_root.join(format!("{session_id}.{extension}"));
-                if !path.exists() {
-                    continue;
-                }
-                let session = Session::load_from_path(&path)?;
-                self.validate_loaded_session(&path, &session)?;
-                return Ok(path);
-            }
-        }
         Err(SessionControlError::Format(
-            format_missing_session_reference(session_id, &self.sessions_root),
+            format_missing_session_reference(session_id),
         ))
     }
 
     pub fn list_sessions(&self) -> Result<Vec<ManagedSessionSummary>, SessionControlError> {
         let mut sessions = Vec::new();
-        self.collect_sessions_from_dir(&self.sessions_root, &mut sessions)?;
-        if let Some(legacy_root) = self.legacy_sessions_root() {
-            self.collect_sessions_from_dir(&legacy_root, &mut sessions)?;
-        }
-        sort_managed_sessions(&mut sessions);
-        Ok(sessions)
-    }
-
-    pub fn latest_session(&self) -> Result<ManagedSessionSummary, SessionControlError> {
-        self.list_sessions()?.into_iter().next().ok_or_else(|| {
-            SessionControlError::Format(format_no_managed_sessions(&self.sessions_root))
-        })
-    }
-
-    pub fn load_session(
-        &self,
-        reference: &str,
-    ) -> Result<LoadedManagedSession, SessionControlError> {
-        let handle = self.resolve_reference(reference)?;
-        let session = Session::load_from_path(&handle.path)?;
-        self.validate_loaded_session(&handle.path, &session)?;
-        Ok(LoadedManagedSession {
-            handle: SessionHandle {
-                id: session.session_id.clone(),
-                path: handle.path,
-            },
-            session,
-        })
-    }
-
-    pub fn fork_session(
-        &self,
-        session: &Session,
-        branch_name: Option<String>,
-    ) -> Result<ForkedManagedSession, SessionControlError> {
-        let parent_session_id = session.session_id.clone();
-        let forked = session
-            .fork(branch_name)
-            .with_workspace_root(self.workspace_root.clone());
-        let handle = self.create_handle(&forked.session_id);
-        let branch_name = forked
-            .fork
-            .as_ref()
-            .and_then(|fork| fork.branch_name.clone());
-        let forked = forked.with_persistence_path(handle.path.clone());
-        forked.save_to_path(&handle.path)?;
-        Ok(ForkedManagedSession {
-            parent_session_id,
-            handle,
-            session: forked,
-            branch_name,
-        })
-    }
-
-    fn legacy_sessions_root(&self) -> Option<PathBuf> {
-        self.sessions_root
-            .parent()
-            .filter(|parent| parent.file_name().is_some_and(|name| name == "sessions"))
-            .map(Path::to_path_buf)
-    }
-
-    fn validate_loaded_session(
-        &self,
-        session_path: &Path,
-        session: &Session,
-    ) -> Result<(), SessionControlError> {
-        let Some(actual) = session.workspace_root() else {
-            if path_is_within_workspace(session_path, &self.workspace_root) {
-                return Ok(());
-            }
-            return Err(SessionControlError::Format(
-                format_legacy_session_missing_workspace_root(session_path, &self.workspace_root),
-            ));
-        };
-        if workspace_roots_match(actual, &self.workspace_root) {
-            return Ok(());
-        }
-        Err(SessionControlError::WorkspaceMismatch {
-            expected: self.workspace_root.clone(),
-            actual: actual.to_path_buf(),
-        })
-    }
-
-    fn collect_sessions_from_dir(
-        &self,
-        directory: &Path,
-        sessions: &mut Vec<ManagedSessionSummary>,
-    ) -> Result<(), SessionControlError> {
-        let entries = match fs::read_dir(directory) {
+        let read_result = fs::read_dir(&self.sessions_root);
+        let entries = match read_result {
             Ok(entries) => entries,
-            Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ok(()),
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ok(sessions),
             Err(err) => return Err(err.into()),
         };
         for entry in entries {
@@ -255,44 +147,94 @@ impl SessionStore {
                 .and_then(|time| time.duration_since(UNIX_EPOCH).ok())
                 .map(|duration| duration.as_millis())
                 .unwrap_or_default();
-            let summary = match Session::load_from_path(&path) {
-                Ok(session) => {
-                    if self.validate_loaded_session(&path, &session).is_err() {
-                        continue;
-                    }
-                    ManagedSessionSummary {
-                        id: session.session_id,
-                        path,
-                        updated_at_ms: session.updated_at_ms,
-                        modified_epoch_millis,
-                        message_count: session.messages.len(),
-                        parent_session_id: session
+            let (id, message_count, parent_session_id, branch_name) =
+                match Session::load_from_path(&path) {
+                    Ok(session) => {
+                        let parent_session_id = session
                             .fork
                             .as_ref()
-                            .map(|fork| fork.parent_session_id.clone()),
-                        branch_name: session
+                            .map(|fork| fork.parent_session_id.clone());
+                        let branch_name = session
                             .fork
                             .as_ref()
-                            .and_then(|fork| fork.branch_name.clone()),
+                            .and_then(|fork| fork.branch_name.clone());
+                        (
+                            session.session_id,
+                            session.messages.len(),
+                            parent_session_id,
+                            branch_name,
+                        )
                     }
-                }
-                Err(_) => ManagedSessionSummary {
-                    id: path
-                        .file_stem()
-                        .and_then(|value| value.to_str())
-                        .unwrap_or("unknown")
-                        .to_string(),
-                    path,
-                    updated_at_ms: 0,
-                    modified_epoch_millis,
-                    message_count: 0,
-                    parent_session_id: None,
-                    branch_name: None,
-                },
-            };
-            sessions.push(summary);
+                    Err(_) => (
+                        path.file_stem()
+                            .and_then(|value| value.to_str())
+                            .unwrap_or("unknown")
+                            .to_string(),
+                        0,
+                        None,
+                        None,
+                    ),
+                };
+            sessions.push(ManagedSessionSummary {
+                id,
+                path,
+                modified_epoch_millis,
+                message_count,
+                parent_session_id,
+                branch_name,
+            });
         }
-        Ok(())
+        sessions.sort_by(|left, right| {
+            right
+                .modified_epoch_millis
+                .cmp(&left.modified_epoch_millis)
+                .then_with(|| right.id.cmp(&left.id))
+        });
+        Ok(sessions)
+    }
+
+    pub fn latest_session(&self) -> Result<ManagedSessionSummary, SessionControlError> {
+        self.list_sessions()?
+            .into_iter()
+            .next()
+            .ok_or_else(|| SessionControlError::Format(format_no_managed_sessions()))
+    }
+
+    pub fn load_session(
+        &self,
+        reference: &str,
+    ) -> Result<LoadedManagedSession, SessionControlError> {
+        let handle = self.resolve_reference(reference)?;
+        let session = Session::load_from_path(&handle.path)?;
+        Ok(LoadedManagedSession {
+            handle: SessionHandle {
+                id: session.session_id.clone(),
+                path: handle.path,
+            },
+            session,
+        })
+    }
+
+    pub fn fork_session(
+        &self,
+        session: &Session,
+        branch_name: Option<String>,
+    ) -> Result<ForkedManagedSession, SessionControlError> {
+        let parent_session_id = session.session_id.clone();
+        let forked = session.fork(branch_name);
+        let handle = self.create_handle(&forked.session_id);
+        let branch_name = forked
+            .fork
+            .as_ref()
+            .and_then(|fork| fork.branch_name.clone());
+        let forked = forked.with_persistence_path(handle.path.clone());
+        forked.save_to_path(&handle.path)?;
+        Ok(ForkedManagedSession {
+            parent_session_id,
+            handle,
+            session: forked,
+            branch_name,
+        })
     }
 }
 
@@ -327,23 +269,12 @@ pub struct SessionHandle {
 pub struct ManagedSessionSummary {
     pub id: String,
     pub path: PathBuf,
-    pub updated_at_ms: u64,
     pub modified_epoch_millis: u128,
     pub message_count: usize,
     pub parent_session_id: Option<String>,
     pub branch_name: Option<String>,
 }
 
-fn sort_managed_sessions(sessions: &mut [ManagedSessionSummary]) {
-    sessions.sort_by(|left, right| {
-        right
-            .updated_at_ms
-            .cmp(&left.updated_at_ms)
-            .then_with(|| right.modified_epoch_millis.cmp(&left.modified_epoch_millis))
-            .then_with(|| right.id.cmp(&left.id))
-    });
-}
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LoadedManagedSession {
     pub handle: SessionHandle,
@@ -363,7 +294,6 @@ pub enum SessionControlError {
     Io(std::io::Error),
     Session(SessionError),
     Format(String),
-    WorkspaceMismatch { expected: PathBuf, actual: PathBuf },
 }
 
 impl Display for SessionControlError {
@@ -372,12 +302,6 @@ impl Display for SessionControlError {
             Self::Io(error) => write!(f, "{error}"),
             Self::Session(error) => write!(f, "{error}"),
             Self::Format(error) => write!(f, "{error}"),
-            Self::WorkspaceMismatch { expected, actual } => write!(
-                f,
-                "session workspace mismatch: expected {}, found {}",
-                expected.display(),
-                actual.display()
-            ),
         }
     }
 }
@@ -403,8 +327,9 @@ pub fn sessions_dir() -> Result<PathBuf, SessionControlError> {
 pub fn managed_sessions_dir_for(
     base_dir: impl AsRef<Path>,
 ) -> Result<PathBuf, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    Ok(store.sessions_dir().to_path_buf())
+    let path = base_dir.as_ref().join(".claw").join("sessions");
+    fs::create_dir_all(&path)?;
+    Ok(path)
 }
 
 pub fn create_managed_session_handle(
@@ -417,8 +342,10 @@ pub fn create_managed_session_handle_for(
     base_dir: impl AsRef<Path>,
     session_id: &str,
 ) -> Result<SessionHandle, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    Ok(store.create_handle(session_id))
+    let id = session_id.to_string();
+    let path =
+        managed_sessions_dir_for(base_dir)?.join(format!("{id}.{PRIMARY_SESSION_EXTENSION}"));
+    Ok(SessionHandle { id, path })
 }
 
 pub fn resolve_session_reference(reference: &str) -> Result<SessionHandle, SessionControlError> {
@@ -429,8 +356,36 @@ pub fn resolve_session_reference_for(
     base_dir: impl AsRef<Path>,
     reference: &str,
 ) -> Result<SessionHandle, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.resolve_reference(reference)
+    let base_dir = base_dir.as_ref();
+    if is_session_reference_alias(reference) {
+        let latest = latest_managed_session_for(base_dir)?;
+        return Ok(SessionHandle {
+            id: latest.id,
+            path: latest.path,
+        });
+    }
+
+    let direct = PathBuf::from(reference);
+    let candidate = if direct.is_absolute() {
+        direct.clone()
+    } else {
+        base_dir.join(&direct)
+    };
+    let looks_like_path = direct.extension().is_some() || direct.components().count() > 1;
+    let path = if candidate.exists() {
+        candidate
+    } else if looks_like_path {
+        return Err(SessionControlError::Format(
+            format_missing_session_reference(reference),
+        ));
+    } else {
+        resolve_managed_session_path_for(base_dir, reference)?
+    };
+
+    Ok(SessionHandle {
+        id: session_id_from_path(&path).unwrap_or_else(|| reference.to_string()),
+        path,
+    })
 }
 
 pub fn resolve_managed_session_path(session_id: &str) -> Result<PathBuf, SessionControlError> {
@@ -441,8 +396,16 @@ pub fn resolve_managed_session_path_for(
     base_dir: impl AsRef<Path>,
     session_id: &str,
 ) -> Result<PathBuf, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.resolve_managed_path(session_id)
+    let directory = managed_sessions_dir_for(base_dir)?;
+    for extension in [PRIMARY_SESSION_EXTENSION, LEGACY_SESSION_EXTENSION] {
+        let path = directory.join(format!("{session_id}.{extension}"));
+        if path.exists() {
+            return Ok(path);
+        }
+    }
+    Err(SessionControlError::Format(
+        format_missing_session_reference(session_id),
+    ))
 }
 
 #[must_use]
@@ -461,8 +424,64 @@ pub fn list_managed_sessions() -> Result<Vec<ManagedSessionSummary>, SessionCont
 pub fn list_managed_sessions_for(
     base_dir: impl AsRef<Path>,
 ) -> Result<Vec<ManagedSessionSummary>, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.list_sessions()
+    let mut sessions = Vec::new();
+    for entry in fs::read_dir(managed_sessions_dir_for(base_dir)?)? {
+        let entry = entry?;
+        let path = entry.path();
+        if !is_managed_session_file(&path) {
+            continue;
+        }
+        let metadata = entry.metadata()?;
+        let modified_epoch_millis = metadata
+            .modified()
+            .ok()
+            .and_then(|time| time.duration_since(UNIX_EPOCH).ok())
+            .map(|duration| duration.as_millis())
+            .unwrap_or_default();
+        let (id, message_count, parent_session_id, branch_name) =
+            match Session::load_from_path(&path) {
+                Ok(session) => {
+                    let parent_session_id = session
+                        .fork
+                        .as_ref()
+                        .map(|fork| fork.parent_session_id.clone());
+                    let branch_name = session
+                        .fork
+                        .as_ref()
+                        .and_then(|fork| fork.branch_name.clone());
+                    (
+                        session.session_id,
+                        session.messages.len(),
+                        parent_session_id,
+                        branch_name,
+                    )
+                }
+                Err(_) => (
+                    path.file_stem()
+                        .and_then(|value| value.to_str())
+                        .unwrap_or("unknown")
+                        .to_string(),
+                    0,
+                    None,
+                    None,
+                ),
+            };
+        sessions.push(ManagedSessionSummary {
+            id,
+            path,
+            modified_epoch_millis,
+            message_count,
+            parent_session_id,
+            branch_name,
+        });
+    }
+    sessions.sort_by(|left, right| {
+        right
+            .modified_epoch_millis
+            .cmp(&left.modified_epoch_millis)
+            .then_with(|| right.id.cmp(&left.id))
+    });
+    Ok(sessions)
 }
 
 pub fn latest_managed_session() -> Result<ManagedSessionSummary, SessionControlError> {
@@ -472,8 +491,10 @@ pub fn latest_managed_session() -> Result<ManagedSessionSummary, SessionControlE
 pub fn latest_managed_session_for(
     base_dir: impl AsRef<Path>,
 ) -> Result<ManagedSessionSummary, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.latest_session()
+    list_managed_sessions_for(base_dir)?
+        .into_iter()
+        .next()
+        .ok_or_else(|| SessionControlError::Format(format_no_managed_sessions()))
 }
 
 pub fn load_managed_session(reference: &str) -> Result<LoadedManagedSession, SessionControlError> {
@@ -484,8 +505,15 @@ pub fn load_managed_session_for(
     base_dir: impl AsRef<Path>,
     reference: &str,
 ) -> Result<LoadedManagedSession, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.load_session(reference)
+    let handle = resolve_session_reference_for(base_dir, reference)?;
+    let session = Session::load_from_path(&handle.path)?;
+    Ok(LoadedManagedSession {
+        handle: SessionHandle {
+            id: session.session_id.clone(),
+            path: handle.path,
+        },
+        session,
+    })
 }
 
 pub fn fork_managed_session(
@@ -500,8 +528,21 @@ pub fn fork_managed_session_for(
     session: &Session,
     branch_name: Option<String>,
 ) -> Result<ForkedManagedSession, SessionControlError> {
-    let store = SessionStore::from_cwd(base_dir)?;
-    store.fork_session(session, branch_name)
+    let parent_session_id = session.session_id.clone();
+    let forked = session.fork(branch_name);
+    let handle = create_managed_session_handle_for(base_dir, &forked.session_id)?;
+    let branch_name = forked
+        .fork
+        .as_ref()
+        .and_then(|fork| fork.branch_name.clone());
+    let forked = forked.with_persistence_path(handle.path.clone());
+    forked.save_to_path(&handle.path)?;
+    Ok(ForkedManagedSession {
+        parent_session_id,
+        handle,
+        session: forked,
+        branch_name,
+    })
 }
 
 #[must_use]
@@ -521,58 +562,24 @@ fn session_id_from_path(path: &Path) -> Option<String> {
         .map(ToOwned::to_owned)
 }
 
-fn format_missing_session_reference(reference: &str, sessions_root: &Path) -> String {
-    // #80: show the actual workspace-fingerprint directory instead of lying about .claw/sessions/
-    let fingerprint_dir = sessions_root
-        .file_name()
-        .and_then(|f| f.to_str())
-        .unwrap_or("<unknown>");
+fn format_missing_session_reference(reference: &str) -> String {
     format!(
-        "session not found: {reference}\nHint: managed sessions live in .claw/sessions/{fingerprint_dir}/ (workspace-specific partition).\nTry `{LATEST_SESSION_REFERENCE}` for the most recent session or `/session list` in the REPL."
+        "session not found: {reference}\nHint: managed sessions live in .claw/sessions/. Try `{LATEST_SESSION_REFERENCE}` for the most recent session or `/session list` in the REPL."
     )
 }
 
-fn format_no_managed_sessions(sessions_root: &Path) -> String {
-    // #80: show the actual workspace-fingerprint directory instead of lying about .claw/sessions/
-    let fingerprint_dir = sessions_root
-        .file_name()
-        .and_then(|f| f.to_str())
-        .unwrap_or("<unknown>");
+fn format_no_managed_sessions() -> String {
     format!(
-        "no managed sessions found in .claw/sessions/{fingerprint_dir}/\nStart `claw` to create a session, then rerun with `--resume {LATEST_SESSION_REFERENCE}`.\nNote: claw partitions sessions per workspace fingerprint; sessions from other CWDs are invisible."
+        "no managed sessions found in .claw/sessions/\nStart `claw` to create a session, then rerun with `--resume {LATEST_SESSION_REFERENCE}`."
     )
 }
 
-fn format_legacy_session_missing_workspace_root(
-    session_path: &Path,
-    workspace_root: &Path,
-) -> String {
-    format!(
-        "legacy session is missing workspace binding: {}\nOpen it from its original workspace or re-save it from {}.",
-        session_path.display(),
-        workspace_root.display()
-    )
-}
-
-fn workspace_roots_match(left: &Path, right: &Path) -> bool {
-    canonicalize_for_compare(left) == canonicalize_for_compare(right)
-}
-
-fn canonicalize_for_compare(path: &Path) -> PathBuf {
-    fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf())
-}
-
-fn path_is_within_workspace(path: &Path, workspace_root: &Path) -> bool {
-    canonicalize_for_compare(path).starts_with(canonicalize_for_compare(workspace_root))
-}
-
 #[cfg(test)]
 mod tests {
     use super::{
         create_managed_session_handle_for, fork_managed_session_for, is_session_reference_alias,
         list_managed_sessions_for, load_managed_session_for, resolve_session_reference_for,
-        workspace_fingerprint, ManagedSessionSummary, SessionControlError, SessionStore,
-        LATEST_SESSION_REFERENCE,
+        workspace_fingerprint, ManagedSessionSummary, SessionStore, LATEST_SESSION_REFERENCE,
     };
     use crate::session::Session;
     use std::fs;
@@ -588,7 +595,7 @@ mod tests {
     }
 
     fn persist_session(root: &Path, text: &str) -> Session {
-        let mut session = Session::new().with_workspace_root(root.to_path_buf());
+        let mut session = Session::new();
         session
             .push_user_text(text)
             .expect("session message should save");
@@ -624,35 +631,6 @@ mod tests {
             .expect("session summary should exist")
     }
 
-    #[test]
-    fn latest_session_prefers_semantic_updated_at_over_file_mtime() {
-        let mut sessions = vec![
-            ManagedSessionSummary {
-                id: "older-file-newer-session".to_string(),
-                path: PathBuf::from("/tmp/older"),
-                updated_at_ms: 200,
-                modified_epoch_millis: 100,
-                message_count: 2,
-                parent_session_id: None,
-                branch_name: None,
-            },
-            ManagedSessionSummary {
-                id: "newer-file-older-session".to_string(),
-                path: PathBuf::from("/tmp/newer"),
-                updated_at_ms: 100,
-                modified_epoch_millis: 200,
-                message_count: 1,
-                parent_session_id: None,
-                branch_name: None,
-            },
-        ];
-
-        crate::session_control::sort_managed_sessions(&mut sessions);
-
-        assert_eq!(sessions[0].id, "older-file-newer-session");
-        assert_eq!(sessions[1].id, "newer-file-older-session");
-    }
-
     #[test]
     fn creates_and_lists_managed_sessions() {
         // given
@@ -730,7 +708,7 @@ mod tests {
     // ------------------------------------------------------------------
 
     fn persist_session_via_store(store: &SessionStore, text: &str) -> Session {
-        let mut session = Session::new().with_workspace_root(store.workspace_root().to_path_buf());
+        let mut session = Session::new();
         session
             .push_user_text(text)
             .expect("session message should save");
@@ -762,40 +740,6 @@ mod tests {
         assert_eq!(fp_a1.len(), 16, "fingerprint must be a 16-char hex string");
     }
 
-    /// #151 regression: equivalent paths (e.g. `/tmp/foo` vs `/private/tmp/foo`
-    /// on macOS where `/tmp` is a symlink to `/private/tmp`) must resolve to
-    /// the same session store. Previously they diverged because
-    /// `workspace_fingerprint()` hashed the raw path string. Now
-    /// `SessionStore::from_cwd()` canonicalizes first.
-    #[test]
-    fn session_store_from_cwd_canonicalizes_equivalent_paths() {
-        let base = temp_dir();
-        let real_dir = base.join("real-workspace");
-        fs::create_dir_all(&real_dir).expect("real workspace should exist");
-
-        // Build two stores via different but equivalent path representations:
-        // the raw path and the canonicalized path.
-        let raw_path = real_dir.clone();
-        let canonical_path = fs::canonicalize(&real_dir).expect("canonicalize ok");
-
-        let store_from_raw =
-            SessionStore::from_cwd(&raw_path).expect("store from raw should build");
-        let store_from_canonical =
-            SessionStore::from_cwd(&canonical_path).expect("store from canonical should build");
-
-        assert_eq!(
-            store_from_raw.sessions_dir(),
-            store_from_canonical.sessions_dir(),
-            "equivalent paths must produce the same sessions dir (raw={} canonical={})",
-            raw_path.display(),
-            canonical_path.display()
-        );
-
-        if base.exists() {
-            fs::remove_dir_all(base).expect("cleanup ok");
-        }
-    }
-
     #[test]
     fn session_store_from_cwd_isolates_sessions_by_workspace() {
         // given
@@ -876,104 +820,6 @@ mod tests {
         fs::remove_dir_all(base).expect("temp dir should clean up");
     }
 
-    #[test]
-    fn session_store_rejects_legacy_session_from_other_workspace() {
-        // given
-        let base = temp_dir();
-        let workspace_a = base.join("repo-alpha");
-        let workspace_b = base.join("repo-beta");
-        fs::create_dir_all(&workspace_a).expect("workspace a should exist");
-        fs::create_dir_all(&workspace_b).expect("workspace b should exist");
-        // #151: canonicalize so test expectations match the store's canonical
-        // workspace_root. Without this, the test builds sessions with a raw
-        // path but the store resolves to the canonical form.
-        let workspace_a = fs::canonicalize(&workspace_a).unwrap_or(workspace_a);
-        let workspace_b = fs::canonicalize(&workspace_b).unwrap_or(workspace_b);
-
-        let store_b = SessionStore::from_cwd(&workspace_b).expect("store b should build");
-        let legacy_root = workspace_b.join(".claw").join("sessions");
-        fs::create_dir_all(&legacy_root).expect("legacy root should exist");
-        let legacy_path = legacy_root.join("legacy-cross.jsonl");
-        let session = Session::new()
-            .with_workspace_root(workspace_a.clone())
-            .with_persistence_path(legacy_path.clone());
-        session
-            .save_to_path(&legacy_path)
-            .expect("legacy session should persist");
-
-        // when
-        let err = store_b
-            .load_session("legacy-cross")
-            .expect_err("workspace mismatch should be rejected");
-
-        // then
-        match err {
-            SessionControlError::WorkspaceMismatch { expected, actual } => {
-                assert_eq!(expected, workspace_b);
-                assert_eq!(actual, workspace_a);
-            }
-            other => panic!("expected workspace mismatch, got {other:?}"),
-        }
-        fs::remove_dir_all(base).expect("temp dir should clean up");
-    }
-
-    #[test]
-    fn session_store_loads_safe_legacy_session_from_same_workspace() {
-        // given
-        let base = temp_dir();
-        fs::create_dir_all(&base).expect("base dir should exist");
-        // #151: canonicalize for path-representation consistency with store.
-        let base = fs::canonicalize(&base).unwrap_or(base);
-        let store = SessionStore::from_cwd(&base).expect("store should build");
-        let legacy_root = base.join(".claw").join("sessions");
-        let legacy_path = legacy_root.join("legacy-safe.jsonl");
-        fs::create_dir_all(&legacy_root).expect("legacy root should exist");
-        let session = Session::new()
-            .with_workspace_root(base.clone())
-            .with_persistence_path(legacy_path.clone());
-        session
-            .save_to_path(&legacy_path)
-            .expect("legacy session should persist");
-
-        // when
-        let loaded = store
-            .load_session("legacy-safe")
-            .expect("same-workspace legacy session should load");
-
-        // then
-        assert_eq!(loaded.handle.id, session.session_id);
-        assert_eq!(loaded.handle.path, legacy_path);
-        assert_eq!(loaded.session.workspace_root(), Some(base.as_path()));
-        fs::remove_dir_all(base).expect("temp dir should clean up");
-    }
-
-    #[test]
-    fn session_store_loads_unbound_legacy_session_from_same_workspace() {
-        // given
-        let base = temp_dir();
-        fs::create_dir_all(&base).expect("base dir should exist");
-        // #151: canonicalize for path-representation consistency with store.
-        let base = fs::canonicalize(&base).unwrap_or(base);
-        let store = SessionStore::from_cwd(&base).expect("store should build");
-        let legacy_root = base.join(".claw").join("sessions");
-        let legacy_path = legacy_root.join("legacy-unbound.json");
-        fs::create_dir_all(&legacy_root).expect("legacy root should exist");
-        let session = Session::new().with_persistence_path(legacy_path.clone());
-        session
-            .save_to_path(&legacy_path)
-            .expect("legacy session should persist");
-
-        // when
-        let loaded = store
-            .load_session("legacy-unbound")
-            .expect("same-workspace legacy session without workspace binding should load");
-
-        // then
-        assert_eq!(loaded.handle.path, legacy_path);
-        assert_eq!(loaded.session.workspace_root(), None);
-        fs::remove_dir_all(base).expect("temp dir should clean up");
-    }
-
     #[test]
     fn session_store_latest_and_resolve_reference() {
         // given

rust/crates/runtime/src/task_packet.rs

@@ -1,42 +1,11 @@
 use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
 
-/// Task scope resolution for defining the granularity of work.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum TaskScope {
-    /// Work across the entire workspace
-    Workspace,
-    /// Work within a specific module/crate
-    Module,
-    /// Work on a single file
-    SingleFile,
-    /// Custom scope defined by the user
-    Custom,
-}
-
-impl std::fmt::Display for TaskScope {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Workspace => write!(f, "workspace"),
-            Self::Module => write!(f, "module"),
-            Self::SingleFile => write!(f, "single-file"),
-            Self::Custom => write!(f, "custom"),
-        }
-    }
-}
-
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct TaskPacket {
     pub objective: String,
-    pub scope: TaskScope,
-    /// Optional scope path when scope is `Module`, `SingleFile`, or `Custom`
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub scope_path: Option<String>,
+    pub scope: String,
     pub repo: String,
-    /// Worktree path for the task
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub worktree: Option<String>,
     pub branch_policy: String,
     pub acceptance_tests: Vec<String>,
     pub commit_policy: String,
@@ -88,6 +57,7 @@ pub fn validate_packet(packet: TaskPacket) -> Result<ValidatedPacket, TaskPacket
     let mut errors = Vec::new();
 
     validate_required("objective", &packet.objective, &mut errors);
+    validate_required("scope", &packet.scope, &mut errors);
     validate_required("repo", &packet.repo, &mut errors);
     validate_required("branch_policy", &packet.branch_policy, &mut errors);
     validate_required("commit_policy", &packet.commit_policy, &mut errors);
@@ -98,9 +68,6 @@ pub fn validate_packet(packet: TaskPacket) -> Result<ValidatedPacket, TaskPacket
     );
     validate_required("escalation_policy", &packet.escalation_policy, &mut errors);
 
-    // Validate scope-specific requirements
-    validate_scope_requirements(&packet, &mut errors);
-
     for (index, test) in packet.acceptance_tests.iter().enumerate() {
         if test.trim().is_empty() {
             errors.push(format!(
@@ -116,26 +83,6 @@ pub fn validate_packet(packet: TaskPacket) -> Result<ValidatedPacket, TaskPacket
     }
 }
 
-fn validate_scope_requirements(packet: &TaskPacket, errors: &mut Vec<String>) {
-    // Scope path is required for Module, SingleFile, and Custom scopes
-    let needs_scope_path = matches!(
-        packet.scope,
-        TaskScope::Module | TaskScope::SingleFile | TaskScope::Custom
-    );
-
-    if needs_scope_path
-        && packet
-            .scope_path
-            .as_ref()
-            .is_none_or(|p| p.trim().is_empty())
-    {
-        errors.push(format!(
-            "scope_path is required for scope '{}'",
-            packet.scope
-        ));
-    }
-}
-
 fn validate_required(field: &str, value: &str, errors: &mut Vec<String>) {
     if value.trim().is_empty() {
         errors.push(format!("{field} must not be empty"));
@@ -149,10 +96,8 @@ mod tests {
     fn sample_packet() -> TaskPacket {
         TaskPacket {
             objective: "Implement typed task packet format".to_string(),
-            scope: TaskScope::Module,
-            scope_path: Some("runtime/task system".to_string()),
+            scope: "runtime/task system".to_string(),
             repo: "claw-code-parity".to_string(),
-            worktree: Some("/tmp/wt-1".to_string()),
             branch_policy: "origin/main only".to_string(),
             acceptance_tests: vec![
                 "cargo build --workspace".to_string(),
@@ -174,12 +119,9 @@ mod tests {
 
     #[test]
     fn invalid_packet_accumulates_errors() {
-        use super::TaskScope;
         let packet = TaskPacket {
             objective: " ".to_string(),
-            scope: TaskScope::Workspace,
-            scope_path: None,
-            worktree: None,
+            scope: String::new(),
             repo: String::new(),
             branch_policy: "\t".to_string(),
             acceptance_tests: vec!["ok".to_string(), " ".to_string()],
@@ -194,6 +136,9 @@ mod tests {
         assert!(error
             .errors()
             .contains(&"objective must not be empty".to_string()));
+        assert!(error
+            .errors()
+            .contains(&"scope must not be empty".to_string()));
         assert!(error
             .errors()
             .contains(&"repo must not be empty".to_string()));

rust/crates/runtime/src/task_registry.rs

@@ -85,12 +85,11 @@ impl TaskRegistry {
         packet: TaskPacket,
     ) -> Result<Task, TaskPacketValidationError> {
         let packet = validate_packet(packet)?.into_inner();
-        // Use scope_path as description if available, otherwise use scope as string
-        let description = packet
-            .scope_path
-            .clone()
-            .or_else(|| Some(packet.scope.to_string()));
-        Ok(self.create_task(packet.objective.clone(), description, Some(packet)))
+        Ok(self.create_task(
+            packet.objective.clone(),
+            Some(packet.scope.clone()),
+            Some(packet),
+        ))
     }
 
     fn create_task(
@@ -250,13 +249,10 @@ mod tests {
 
     #[test]
     fn creates_task_from_packet() {
-        use crate::task_packet::TaskScope;
         let registry = TaskRegistry::new();
         let packet = TaskPacket {
             objective: "Ship task packet support".to_string(),
-            scope: TaskScope::Module,
-            scope_path: Some("runtime/task system".to_string()),
-            worktree: Some("/tmp/wt-task".to_string()),
+            scope: "runtime/task system".to_string(),
             repo: "claw-code-parity".to_string(),
             branch_policy: "origin/main only".to_string(),
             acceptance_tests: vec!["cargo test --workspace".to_string()],

rust/crates/runtime/src/trust_resolver.rs

@@ -1,7 +1,5 @@
 use std::path::{Path, PathBuf};
 
-use serde::{Deserialize, Serialize};
-
 const TRUST_PROMPT_CUES: &[&str] = &[
     "do you trust the files in this folder",
     "trust the files in this folder",
@@ -10,121 +8,24 @@ const TRUST_PROMPT_CUES: &[&str] = &[
     "yes, proceed",
 ];
 
-/// Resolution method for trust decisions.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum TrustPolicy {
-    /// Automatically trust this path (allowlisted)
     AutoTrust,
-    /// Require manual approval
     RequireApproval,
-    /// Deny trust for this path
     Deny,
 }
 
-/// Events emitted during trust resolution lifecycle.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(tag = "type", rename_all = "snake_case")]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub enum TrustEvent {
-    /// Trust prompt was detected and is required
-    TrustRequired {
-        /// Current working directory where trust is needed
-        cwd: String,
-        /// Optional repo identifier
-        #[serde(skip_serializing_if = "Option::is_none")]
-        repo: Option<String>,
-        /// Optional worktree path
-        #[serde(skip_serializing_if = "Option::is_none")]
-        worktree: Option<String>,
-    },
-    /// Trust was resolved (granted)
-    TrustResolved {
-        /// Current working directory
-        cwd: String,
-        /// The policy that was applied
-        policy: TrustPolicy,
-        /// How the trust was resolved
-        resolution: TrustResolution,
-    },
-    /// Trust was denied
-    TrustDenied {
-        /// Current working directory
-        cwd: String,
-        /// Reason for denial
-        reason: String,
-    },
+    TrustRequired { cwd: String },
+    TrustResolved { cwd: String, policy: TrustPolicy },
+    TrustDenied { cwd: String, reason: String },
 }
 
-/// How trust was resolved.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum TrustResolution {
-    /// Automatically granted due to allowlist
-    AutoAllowlisted,
-    /// Manually approved by user
-    ManualApproval,
-}
-
-/// Entry in the trust allowlist with pattern matching support.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct TrustAllowlistEntry {
-    /// Repository path or glob pattern to match
-    pub pattern: String,
-    /// Optional worktree subpath pattern
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub worktree_pattern: Option<String>,
-    /// Human-readable description of why this is allowlisted
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub description: Option<String>,
-}
-
-impl TrustAllowlistEntry {
-    #[must_use]
-    pub fn new(pattern: impl Into<String>) -> Self {
-        Self {
-            pattern: pattern.into(),
-            worktree_pattern: None,
-            description: None,
-        }
-    }
-
-    #[must_use]
-    pub fn with_worktree_pattern(mut self, pattern: impl Into<String>) -> Self {
-        self.worktree_pattern = Some(pattern.into());
-        self
-    }
-
-    #[must_use]
-    pub fn with_description(mut self, desc: impl Into<String>) -> Self {
-        self.description = Some(desc.into());
-        self
-    }
-}
-
-/// Configuration for trust resolution with allowlist/denylist support.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default)]
 pub struct TrustConfig {
-    /// Allowlisted paths with pattern matching
-    pub allowlisted: Vec<TrustAllowlistEntry>,
-    /// Denied paths (exact or prefix matches)
-    pub denied: Vec<PathBuf>,
-    /// Whether to emit events for trust decisions
-    #[serde(default = "default_emit_events")]
-    pub emit_events: bool,
-}
-
-fn default_emit_events() -> bool {
-    true
-}
-
-impl Default for TrustConfig {
-    fn default() -> Self {
-        Self {
-            allowlisted: Vec::new(),
-            denied: Vec::new(),
-            emit_events: true,
-        }
-    }
+    allowlisted: Vec<PathBuf>,
+    denied: Vec<PathBuf>,
 }
 
 impl TrustConfig {
@@ -134,14 +35,8 @@ impl TrustConfig {
     }
 
     #[must_use]
-    pub fn with_allowlisted(mut self, path: impl Into<String>) -> Self {
-        self.allowlisted.push(TrustAllowlistEntry::new(path));
-        self
-    }
-
-    #[must_use]
-    pub fn with_allowlisted_entry(mut self, entry: TrustAllowlistEntry) -> Self {
-        self.allowlisted.push(entry);
+    pub fn with_allowlisted(mut self, path: impl Into<PathBuf>) -> Self {
+        self.allowlisted.push(path.into());
         self
     }
 
@@ -150,147 +45,6 @@ impl TrustConfig {
         self.denied.push(path.into());
         self
     }
-
-    /// Check if a path matches an allowlisted entry using glob patterns.
-    #[must_use]
-    pub fn is_allowlisted(
-        &self,
-        cwd: &str,
-        worktree: Option<&str>,
-    ) -> Option<&TrustAllowlistEntry> {
-        self.allowlisted.iter().find(|entry| {
-            let path_matches = Self::pattern_matches(&entry.pattern, cwd);
-            if !path_matches {
-                return false;
-            }
-
-            match (&entry.worktree_pattern, worktree) {
-                (Some(wt_pattern), Some(wt)) => Self::pattern_matches(wt_pattern, wt),
-                (Some(_), None) => false,
-                (None, _) => true,
-            }
-        })
-    }
-
-    /// Match a pattern against a path string.
-    /// Supports exact matching and glob patterns (* and ?).
-    fn pattern_matches(pattern: &str, path: &str) -> bool {
-        let pattern = pattern.trim();
-        let path = path.trim();
-
-        // Exact match
-        if pattern == path {
-            return true;
-        }
-
-        // Normalize paths for comparison
-        let pattern_normalized = pattern.replace("//", "/");
-        let path_normalized = path.replace("//", "/");
-
-        // Check if pattern is a path prefix (e.g., "/tmp/worktrees" matches "/tmp/worktrees/repo-a")
-        // This handles the common case of directory containment
-        if !pattern_normalized.contains('*') && !pattern_normalized.contains('?') {
-            // Prefix match: pattern is a directory that contains path
-            if path_normalized.starts_with(&pattern_normalized) {
-                let rest = &path_normalized[pattern_normalized.len()..];
-                // Must be exact match or continue with /
-                return rest.is_empty() || rest.starts_with('/');
-            }
-        }
-
-        // Check if pattern ends with wildcard (prefix match)
-        if pattern_normalized.ends_with("/*") {
-            let prefix = pattern_normalized.trim_end_matches("/*");
-            if let Some(rest) = path_normalized.strip_prefix(prefix) {
-                // Must either be exact match or continue with /
-                return rest.is_empty() || rest.starts_with('/');
-            }
-        } else if pattern_normalized.ends_with('*') && !pattern_normalized.contains("/*/") {
-            // Simple trailing * (not a path component wildcard)
-            let prefix = pattern_normalized.trim_end_matches('*');
-            if let Some(rest) = path_normalized.strip_prefix(prefix) {
-                return rest.is_empty() || !rest.starts_with('/');
-            }
-        }
-
-        // Check if pattern is a path component match (bounded by /)
-        if path_normalized
-            .split('/')
-            .any(|component| component == pattern_normalized)
-        {
-            return true;
-        }
-
-        // Check if pattern appears as a substring within a path component
-        // (e.g., "repo" matches "/tmp/worktrees/repo-a")
-        if path_normalized
-            .split('/')
-            .any(|component| component.contains(&pattern_normalized))
-        {
-            return true;
-        }
-
-        // Glob matching for patterns with ? or * in the middle
-        if pattern.contains('?') || pattern.contains("/*/") || pattern.starts_with("*/") {
-            return Self::glob_matches(&pattern_normalized, &path_normalized);
-        }
-
-        false
-    }
-
-    /// Simple glob pattern matching (? matches single char, * matches any sequence).
-    /// Handles patterns like /tmp/*/repo-* where * matches path components.
-    fn glob_matches(pattern: &str, path: &str) -> bool {
-        // Use recursive backtracking for proper glob matching
-        Self::glob_match_recursive(pattern, path, 0, 0)
-    }
-
-    fn glob_match_recursive(pattern: &str, path: &str, p_idx: usize, s_idx: usize) -> bool {
-        let p_chars: Vec<char> = pattern.chars().collect();
-        let s_chars: Vec<char> = path.chars().collect();
-
-        let mut p = p_idx;
-        let mut s = s_idx;
-
-        while p < p_chars.len() {
-            match p_chars[p] {
-                '*' => {
-                    // Try all possible matches for *
-                    p += 1;
-                    if p >= p_chars.len() {
-                        // * at end matches everything remaining
-                        return true;
-                    }
-                    // Try matching 0 or more characters
-                    for skip in 0..=(s_chars.len() - s) {
-                        if Self::glob_match_recursive(pattern, path, p, s + skip) {
-                            return true;
-                        }
-                    }
-                    return false;
-                }
-                '?' => {
-                    // ? matches exactly one character
-                    if s >= s_chars.len() {
-                        return false;
-                    }
-                    p += 1;
-                    s += 1;
-                }
-                c => {
-                    // Exact character match
-                    if s >= s_chars.len() || s_chars[s] != c {
-                        return false;
-                    }
-                    p += 1;
-                    s += 1;
-                }
-            }
-        }
-
-        // Pattern exhausted - path must also be exhausted
-        s >= s_chars.len()
-    }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -332,19 +86,15 @@ impl TrustResolver {
     }
 
     #[must_use]
-    pub fn resolve(&self, cwd: &str, worktree: Option<&str>, screen_text: &str) -> TrustDecision {
+    pub fn resolve(&self, cwd: &str, screen_text: &str) -> TrustDecision {
         if !detect_trust_prompt(screen_text) {
             return TrustDecision::NotRequired;
         }
 
-        let repo = extract_repo_name(cwd);
         let mut events = vec![TrustEvent::TrustRequired {
             cwd: cwd.to_owned(),
-            repo: repo.clone(),
-            worktree: worktree.map(String::from),
         }];
 
-        // Check denylist first
         if let Some(matched_root) = self
             .config
             .denied
@@ -362,12 +112,15 @@ impl TrustResolver {
             };
         }
 
-        // Check allowlist with pattern matching
-        if self.config.is_allowlisted(cwd, worktree).is_some() {
+        if self
+            .config
+            .allowlisted
+            .iter()
+            .any(|root| path_matches(cwd, root))
+        {
             events.push(TrustEvent::TrustResolved {
                 cwd: cwd.to_owned(),
                 policy: TrustPolicy::AutoTrust,
-                resolution: TrustResolution::AutoAllowlisted,
             });
             return TrustDecision::Required {
                 policy: TrustPolicy::AutoTrust,
@@ -375,19 +128,6 @@ impl TrustResolver {
             };
         }
 
-        // Check for manual trust resolution via screen text analysis
-        if detect_manual_approval(screen_text) {
-            events.push(TrustEvent::TrustResolved {
-                cwd: cwd.to_owned(),
-                policy: TrustPolicy::RequireApproval,
-                resolution: TrustResolution::ManualApproval,
-            });
-            return TrustDecision::Required {
-                policy: TrustPolicy::RequireApproval,
-                events,
-            };
-        }
-
         TrustDecision::Required {
             policy: TrustPolicy::RequireApproval,
             events,
@@ -395,20 +135,17 @@ impl TrustResolver {
     }
 
     #[must_use]
-    pub fn trusts(&self, cwd: &str, worktree: Option<&str>) -> bool {
-        // Check denylist first
-        let denied = self
+    pub fn trusts(&self, cwd: &str) -> bool {
+        !self
             .config
             .denied
             .iter()
-            .any(|root| path_matches(cwd, root));
-
-        if denied {
-            return false;
-        }
-
-        // Check allowlist using pattern matching
-        self.config.is_allowlisted(cwd, worktree).is_some()
+            .any(|root| path_matches(cwd, root))
+            && self
+                .config
+                .allowlisted
+                .iter()
+                .any(|root| path_matches(cwd, root))
     }
 }
 
@@ -435,240 +172,11 @@ fn normalize_path(path: &Path) -> PathBuf {
     std::fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf())
 }
 
-/// Extract repository name from a path for event context.
-fn extract_repo_name(cwd: &str) -> Option<String> {
-    let path = Path::new(cwd);
-    // Try to find a .git directory to identify repo root
-    let mut current = Some(path);
-    while let Some(p) = current {
-        if p.join(".git").is_dir() {
-            return p.file_name().map(|n| n.to_string_lossy().to_string());
-        }
-        current = p.parent();
-    }
-    // Fallback: use the last component of the path
-    path.file_name().map(|n| n.to_string_lossy().to_string())
-}
-
-/// Detect if the screen text indicates manual approval was granted.
-fn detect_manual_approval(screen_text: &str) -> bool {
-    let lowered = screen_text.to_ascii_lowercase();
-    // Look for indicators that user manually approved
-    MANUAL_APPROVAL_CUES.iter().any(|cue| lowered.contains(cue))
-}
-
-const MANUAL_APPROVAL_CUES: &[&str] = &[
-    "yes, i trust",
-    "i trust this",
-    "trusted manually",
-    "approval granted",
-];
-
-#[cfg(test)]
-mod path_matching_tests {
-    use super::*;
-
-    #[test]
-    fn glob_pattern_star_matches_any_sequence() {
-        assert!(TrustConfig::pattern_matches("/tmp/*", "/tmp/foo"));
-        assert!(TrustConfig::pattern_matches("/tmp/*", "/tmp/bar/baz"));
-        assert!(!TrustConfig::pattern_matches("/tmp/*", "/other/tmp/foo"));
-    }
-
-    #[test]
-    fn glob_pattern_question_matches_single_char() {
-        assert!(TrustConfig::pattern_matches("/tmp/test?", "/tmp/test1"));
-        assert!(TrustConfig::pattern_matches("/tmp/test?", "/tmp/testA"));
-        assert!(!TrustConfig::pattern_matches("/tmp/test?", "/tmp/test12"));
-        assert!(!TrustConfig::pattern_matches("/tmp/test?", "/tmp/test"));
-    }
-
-    #[test]
-    fn pattern_matches_exact() {
-        assert!(TrustConfig::pattern_matches(
-            "/tmp/worktrees",
-            "/tmp/worktrees"
-        ));
-        assert!(!TrustConfig::pattern_matches(
-            "/tmp/worktrees",
-            "/tmp/worktrees-other"
-        ));
-    }
-
-    #[test]
-    fn pattern_matches_prefix_with_wildcard() {
-        assert!(TrustConfig::pattern_matches(
-            "/tmp/worktrees/*",
-            "/tmp/worktrees/repo-a"
-        ));
-        assert!(TrustConfig::pattern_matches(
-            "/tmp/worktrees/*",
-            "/tmp/worktrees/repo-a/subdir"
-        ));
-        assert!(!TrustConfig::pattern_matches(
-            "/tmp/worktrees/*",
-            "/tmp/other/repo"
-        ));
-    }
-
-    #[test]
-    fn pattern_matches_contains() {
-        // Pattern contained within path
-        assert!(TrustConfig::pattern_matches(
-            "worktrees",
-            "/tmp/worktrees/repo-a"
-        ));
-        assert!(TrustConfig::pattern_matches(
-            "repo",
-            "/tmp/worktrees/repo-a"
-        ));
-    }
-
-    #[test]
-    fn allowlist_entry_with_worktree_pattern() {
-        let config = TrustConfig::new().with_allowlisted_entry(
-            TrustAllowlistEntry::new("/tmp/worktrees/*")
-                .with_worktree_pattern("*/.git")
-                .with_description("Git worktrees"),
-        );
-
-        // Should match when both patterns match
-        assert!(config
-            .is_allowlisted("/tmp/worktrees/repo-a", Some("/tmp/worktrees/repo-a/.git"))
-            .is_some());
-
-        // Should not match when worktree pattern doesn't match
-        assert!(config
-            .is_allowlisted("/tmp/worktrees/repo-a", Some("/other/path"))
-            .is_none());
-
-        // Should not match when a worktree pattern is required but no worktree is supplied
-        assert!(config
-            .is_allowlisted("/tmp/worktrees/repo-a", None)
-            .is_none());
-
-        // Should match when no worktree pattern required and path matches
-        let config_no_worktree = TrustConfig::new().with_allowlisted("/tmp/worktrees/*");
-        assert!(config_no_worktree
-            .is_allowlisted("/tmp/worktrees/repo-a", None)
-            .is_some());
-    }
-
-    #[test]
-    fn allowlist_entry_returns_matched_entry() {
-        let entry = TrustAllowlistEntry::new("/tmp/worktrees/*").with_description("Test worktrees");
-        let config = TrustConfig::new().with_allowlisted_entry(entry.clone());
-
-        let matched = config.is_allowlisted("/tmp/worktrees/repo-a", None);
-        assert!(matched.is_some());
-        assert_eq!(
-            matched.unwrap().description,
-            Some("Test worktrees".to_string())
-        );
-    }
-
-    #[test]
-    fn complex_glob_patterns() {
-        // Multiple wildcards
-        assert!(TrustConfig::pattern_matches(
-            "/tmp/*/repo-*",
-            "/tmp/worktrees/repo-123"
-        ));
-        assert!(TrustConfig::pattern_matches(
-            "/tmp/*/repo-*",
-            "/tmp/other/repo-abc"
-        ));
-        assert!(!TrustConfig::pattern_matches(
-            "/tmp/*/repo-*",
-            "/tmp/worktrees/other"
-        ));
-
-        // Mixed ? and *
-        assert!(TrustConfig::pattern_matches(
-            "/tmp/test?/*.txt",
-            "/tmp/test1/file.txt"
-        ));
-        assert!(TrustConfig::pattern_matches(
-            "/tmp/test?/*.txt",
-            "/tmp/testA/subdir/file.txt"
-        ));
-    }
-
-    #[test]
-    fn serde_serialization_roundtrip() {
-        let config = TrustConfig::new()
-            .with_allowlisted_entry(
-                TrustAllowlistEntry::new("/tmp/worktrees/*")
-                    .with_worktree_pattern("*/.git")
-                    .with_description("Git worktrees"),
-            )
-            .with_denied("/tmp/malicious");
-
-        let json = serde_json::to_string(&config).expect("serialization failed");
-        let deserialized: TrustConfig =
-            serde_json::from_str(&json).expect("deserialization failed");
-
-        assert_eq!(config.allowlisted.len(), deserialized.allowlisted.len());
-        assert_eq!(config.denied.len(), deserialized.denied.len());
-        assert_eq!(config.emit_events, deserialized.emit_events);
-    }
-
-    #[test]
-    fn trust_event_serialization() {
-        let event = TrustEvent::TrustRequired {
-            cwd: "/tmp/test".to_string(),
-            repo: Some("test-repo".to_string()),
-            worktree: Some("/tmp/test/.git".to_string()),
-        };
-
-        let json = serde_json::to_string(&event).expect("serialization failed");
-        assert!(json.contains("trust_required"));
-        assert!(json.contains("/tmp/test"));
-        assert!(json.contains("test-repo"));
-
-        let deserialized: TrustEvent = serde_json::from_str(&json).expect("deserialization failed");
-        match deserialized {
-            TrustEvent::TrustRequired {
-                cwd,
-                repo,
-                worktree,
-            } => {
-                assert_eq!(cwd, "/tmp/test");
-                assert_eq!(repo, Some("test-repo".to_string()));
-                assert_eq!(worktree, Some("/tmp/test/.git".to_string()));
-            }
-            _ => panic!("wrong event type"),
-        }
-    }
-
-    #[test]
-    fn trust_event_resolved_serialization() {
-        let event = TrustEvent::TrustResolved {
-            cwd: "/tmp/test".to_string(),
-            policy: TrustPolicy::AutoTrust,
-            resolution: TrustResolution::AutoAllowlisted,
-        };
-
-        let json = serde_json::to_string(&event).expect("serialization failed");
-        assert!(json.contains("trust_resolved"));
-        assert!(json.contains("auto_allowlisted"));
-
-        let deserialized: TrustEvent = serde_json::from_str(&json).expect("deserialization failed");
-        match deserialized {
-            TrustEvent::TrustResolved { resolution, .. } => {
-                assert_eq!(resolution, TrustResolution::AutoAllowlisted);
-            }
-            _ => panic!("wrong event type"),
-        }
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::{
-        detect_manual_approval, detect_trust_prompt, path_matches_trusted_root,
-        TrustAllowlistEntry, TrustConfig, TrustDecision, TrustEvent, TrustPolicy, TrustResolution,
-        TrustResolver,
+        detect_trust_prompt, path_matches_trusted_root, TrustConfig, TrustDecision, TrustEvent,
+        TrustPolicy, TrustResolver,
     };
 
     #[test]
@@ -689,7 +197,7 @@ mod tests {
         let resolver = TrustResolver::new(TrustConfig::new().with_allowlisted("/tmp/worktrees"));
 
         // when
-        let decision = resolver.resolve("/tmp/worktrees/repo-a", None, "Ready for your input\n>");
+        let decision = resolver.resolve("/tmp/worktrees/repo-a", "Ready for your input\n>");
 
         // then
         assert_eq!(decision, TrustDecision::NotRequired);
@@ -705,23 +213,23 @@ mod tests {
         // when
         let decision = resolver.resolve(
             "/tmp/worktrees/repo-a",
-            None,
             "Do you trust the files in this folder?\n1. Yes, proceed\n2. No",
         );
 
         // then
         assert_eq!(decision.policy(), Some(TrustPolicy::AutoTrust));
-        let events = decision.events();
-        assert_eq!(events.len(), 2);
-        assert!(matches!(events[0], TrustEvent::TrustRequired { .. }));
-        assert!(matches!(
-            events[1],
-            TrustEvent::TrustResolved {
-                policy: TrustPolicy::AutoTrust,
-                resolution: TrustResolution::AutoAllowlisted,
-                ..
-            }
-        ));
+        assert_eq!(
+            decision.events(),
+            &[
+                TrustEvent::TrustRequired {
+                    cwd: "/tmp/worktrees/repo-a".to_string(),
+                },
+                TrustEvent::TrustResolved {
+                    cwd: "/tmp/worktrees/repo-a".to_string(),
+                    policy: TrustPolicy::AutoTrust,
+                },
+            ]
+        );
     }
 
     #[test]
@@ -732,7 +240,6 @@ mod tests {
         // when
         let decision = resolver.resolve(
             "/tmp/other/repo-b",
-            None,
             "Do you trust the files in this folder?\n1. Yes, proceed\n2. No",
         );
 
@@ -742,8 +249,6 @@ mod tests {
             decision.events(),
             &[TrustEvent::TrustRequired {
                 cwd: "/tmp/other/repo-b".to_string(),
-                repo: Some("repo-b".to_string()),
-                worktree: None,
             }]
         );
     }
@@ -760,7 +265,6 @@ mod tests {
         // when
         let decision = resolver.resolve(
             "/tmp/worktrees/repo-c",
-            None,
             "Do you trust the files in this folder?\n1. Yes, proceed\n2. No",
         );
 
@@ -771,8 +275,6 @@ mod tests {
             &[
                 TrustEvent::TrustRequired {
                     cwd: "/tmp/worktrees/repo-c".to_string(),
-                    repo: Some("repo-c".to_string()),
-                    worktree: None,
                 },
                 TrustEvent::TrustDenied {
                     cwd: "/tmp/worktrees/repo-c".to_string(),
@@ -782,66 +284,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn auto_trusts_with_glob_pattern_allowlist() {
-        // given
-        let resolver = TrustResolver::new(TrustConfig::new().with_allowlisted("/tmp/worktrees/*"));
-
-        // when - any repo under /tmp/worktrees should auto-trust
-        let decision = resolver.resolve(
-            "/tmp/worktrees/repo-a",
-            None,
-            "Do you trust the files in this folder?\n1. Yes, proceed\n2. No",
-        );
-
-        // then
-        assert_eq!(decision.policy(), Some(TrustPolicy::AutoTrust));
-    }
-
-    #[test]
-    fn resolve_with_worktree_pattern_matching() {
-        // given
-        let config = TrustConfig::new().with_allowlisted_entry(
-            TrustAllowlistEntry::new("/tmp/worktrees/*").with_worktree_pattern("*/.git"),
-        );
-        let resolver = TrustResolver::new(config);
-
-        // when - with worktree that matches the pattern
-        let decision = resolver.resolve(
-            "/tmp/worktrees/repo-a",
-            Some("/tmp/worktrees/repo-a/.git"),
-            "Do you trust the files in this folder?\n1. Yes, proceed\n2. No",
-        );
-
-        // then - should auto-trust because both patterns match
-        assert_eq!(decision.policy(), Some(TrustPolicy::AutoTrust));
-    }
-
-    #[test]
-    fn manual_approval_detected_from_screen_text() {
-        // given
-        let resolver = TrustResolver::new(TrustConfig::new());
-
-        // when - screen text indicates manual approval
-        let decision = resolver.resolve(
-            "/tmp/some/repo",
-            None,
-            "Do you trust the files in this folder?\nUser selected: Yes, I trust this folder",
-        );
-
-        // then - should detect manual approval
-        assert_eq!(decision.policy(), Some(TrustPolicy::RequireApproval));
-        let events = decision.events();
-        assert!(events.len() >= 2);
-        assert!(matches!(
-            events[events.len() - 1],
-            TrustEvent::TrustResolved {
-                resolution: TrustResolution::ManualApproval,
-                ..
-            }
-        ));
-    }
-
     #[test]
     fn sibling_prefix_does_not_match_trusted_root() {
         // given
@@ -854,70 +296,4 @@ mod tests {
         // then
         assert!(!matched);
     }
-
-    #[test]
-    fn detects_manual_approval_cues() {
-        assert!(detect_manual_approval(
-            "User selected: Yes, I trust this folder"
-        ));
-        assert!(detect_manual_approval(
-            "I trust this repository and its contents"
-        ));
-        assert!(detect_manual_approval("Approval granted by user"));
-        assert!(!detect_manual_approval(
-            "Do you trust the files in this folder?"
-        ));
-        assert!(!detect_manual_approval("Some unrelated text"));
-    }
-
-    #[test]
-    fn trust_config_default_emit_events() {
-        let config = TrustConfig::default();
-        assert!(config.emit_events);
-    }
-
-    #[test]
-    fn trust_resolver_trusts_method() {
-        let resolver = TrustResolver::new(
-            TrustConfig::new()
-                .with_allowlisted("/tmp/worktrees/*")
-                .with_denied("/tmp/worktrees/bad-repo"),
-        );
-
-        // Should trust allowlisted paths
-        assert!(resolver.trusts("/tmp/worktrees/good-repo", None));
-
-        // Should not trust denied paths
-        assert!(!resolver.trusts("/tmp/worktrees/bad-repo", None));
-
-        // Should not trust unknown paths
-        assert!(!resolver.trusts("/tmp/other/repo", None));
-    }
-
-    #[test]
-    fn trust_policy_serde_roundtrip() {
-        for policy in [
-            TrustPolicy::AutoTrust,
-            TrustPolicy::RequireApproval,
-            TrustPolicy::Deny,
-        ] {
-            let json = serde_json::to_string(&policy).expect("serialization failed");
-            let deserialized: TrustPolicy =
-                serde_json::from_str(&json).expect("deserialization failed");
-            assert_eq!(policy, deserialized);
-        }
-    }
-
-    #[test]
-    fn trust_resolution_serde_roundtrip() {
-        for resolution in [
-            TrustResolution::AutoAllowlisted,
-            TrustResolution::ManualApproval,
-        ] {
-            let json = serde_json::to_string(&resolution).expect("serialization failed");
-            let deserialized: TrustResolution =
-                serde_json::from_str(&json).expect("deserialization failed");
-            assert_eq!(resolution, deserialized);
-        }
-    }
 }

rust/crates/runtime/tests/integration_tests.rs

@@ -304,7 +304,7 @@ fn worker_provider_failure_flows_through_recovery_to_policy() {
         .observe(&worker.worker_id, "Ready for your input\n>")
         .expect("ready observe should succeed");
     registry
-        .send_prompt(&worker.worker_id, Some("Run analysis"), None)
+        .send_prompt(&worker.worker_id, Some("Run analysis"))
         .expect("prompt send should succeed");
 
     // Session completes with provider failure (finish="unknown", tokens=0)

rust/crates/rusty-claude-cli/build.rs

@@ -14,13 +14,14 @@ fn main() {
                 None
             }
         })
-        .map_or_else(|| "unknown".to_string(), |s| s.trim().to_string());
+        .map(|s| s.trim().to_string())
+        .unwrap_or_else(|| "unknown".to_string());
 
-    println!("cargo:rustc-env=GIT_SHA={git_sha}");
+    println!("cargo:rustc-env=GIT_SHA={}", git_sha);
 
     // TARGET is always set by Cargo during build
     let target = env::var("TARGET").unwrap_or_else(|_| "unknown".to_string());
-    println!("cargo:rustc-env=TARGET={target}");
+    println!("cargo:rustc-env=TARGET={}", target);
 
     // Build date from SOURCE_DATE_EPOCH (reproducible builds) or current UTC date.
     // Intentionally ignoring time component to keep output deterministic within a day.
@@ -47,7 +48,8 @@ fn main() {
                         None
                     }
                 })
-                .map_or_else(|| "unknown".to_string(), |s| s.trim().to_string())
+                .map(|s| s.trim().to_string())
+                .unwrap_or_else(|| "unknown".to_string())
         });
     println!("cargo:rustc-env=BUILD_DATE={build_date}");
 

rust/crates/rusty-claude-cli/src/init.rs

@@ -9,7 +9,7 @@ const STARTER_CLAW_JSON: &str = concat!(
     "}\n",
 );
 const GITIGNORE_COMMENT: &str = "# Claw Code local artifacts";
-const GITIGNORE_ENTRIES: [&str; 3] = [".claw/settings.local.json", ".claw/sessions/", ".clawhip/"];
+const GITIGNORE_ENTRIES: [&str; 2] = [".claw/settings.local.json", ".claw/sessions/"];
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum InitStatus {
@@ -27,18 +27,6 @@ impl InitStatus {
             Self::Skipped => "skipped (already exists)",
         }
     }
-
-    /// Machine-stable identifier for structured output (#142).
-    /// Unlike `label()`, this never changes wording: claws can switch on
-    /// these values without brittle substring matching.
-    #[must_use]
-    pub(crate) fn json_tag(self) -> &'static str {
-        match self {
-            Self::Created => "created",
-            Self::Updated => "updated",
-            Self::Skipped => "skipped",
-        }
-    }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -70,36 +58,6 @@ impl InitReport {
         lines.push("  Next step        Review and tailor the generated guidance".to_string());
         lines.join("\n")
     }
-
-    /// Summary constant that claws can embed in JSON output without having
-    /// to read it out of the human-formatted `message` string (#142).
-    pub(crate) const NEXT_STEP: &'static str = "Review and tailor the generated guidance";
-
-    /// Artifact names that ended in the given status. Used to build the
-    /// structured `created[]`/`updated[]`/`skipped[]` arrays for #142.
-    #[must_use]
-    pub(crate) fn artifacts_with_status(&self, status: InitStatus) -> Vec<String> {
-        self.artifacts
-            .iter()
-            .filter(|artifact| artifact.status == status)
-            .map(|artifact| artifact.name.to_string())
-            .collect()
-    }
-
-    /// Structured artifact list for JSON output (#142). Each entry carries
-    /// `name` and machine-stable `status` tag.
-    #[must_use]
-    pub(crate) fn artifact_json_entries(&self) -> Vec<serde_json::Value> {
-        self.artifacts
-            .iter()
-            .map(|artifact| {
-                serde_json::json!({
-                    "name": artifact.name,
-                    "status": artifact.status.json_tag(),
-                })
-            })
-            .collect()
-    }
 }
 
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
@@ -375,7 +333,7 @@ fn framework_notes(detection: &RepoDetection) -> Vec<String> {
 
 #[cfg(test)]
 mod tests {
-    use super::{initialize_repo, render_init_claude_md, InitStatus};
+    use super::{initialize_repo, render_init_claude_md};
     use std::fs;
     use std::path::Path;
     use std::time::{SystemTime, UNIX_EPOCH};
@@ -417,7 +375,6 @@ mod tests {
         let gitignore = fs::read_to_string(root.join(".gitignore")).expect("read gitignore");
         assert!(gitignore.contains(".claw/settings.local.json"));
         assert!(gitignore.contains(".claw/sessions/"));
-        assert!(gitignore.contains(".clawhip/"));
         let claude_md = fs::read_to_string(root.join("CLAUDE.md")).expect("read claude md");
         assert!(claude_md.contains("Languages: Rust."));
         assert!(claude_md.contains("cargo clippy --workspace --all-targets -- -D warnings"));
@@ -450,64 +407,6 @@ mod tests {
         let gitignore = fs::read_to_string(root.join(".gitignore")).expect("read gitignore");
         assert_eq!(gitignore.matches(".claw/settings.local.json").count(), 1);
         assert_eq!(gitignore.matches(".claw/sessions/").count(), 1);
-        assert_eq!(gitignore.matches(".clawhip/").count(), 1);
-
-        fs::remove_dir_all(root).expect("cleanup temp dir");
-    }
-
-    #[test]
-    fn artifacts_with_status_partitions_fresh_and_idempotent_runs() {
-        // #142: the structured JSON output needs to be able to partition
-        // artifacts into created/updated/skipped without substring matching
-        // the human-formatted `message` string.
-        let root = temp_dir();
-        fs::create_dir_all(&root).expect("create root");
-
-        let fresh = initialize_repo(&root).expect("fresh init should succeed");
-        let created_names = fresh.artifacts_with_status(InitStatus::Created);
-        assert_eq!(
-            created_names,
-            vec![
-                ".claw/".to_string(),
-                ".claw.json".to_string(),
-                ".gitignore".to_string(),
-                "CLAUDE.md".to_string(),
-            ],
-            "fresh init should place all four artifacts in created[]"
-        );
-        assert!(
-            fresh.artifacts_with_status(InitStatus::Skipped).is_empty(),
-            "fresh init should have no skipped artifacts"
-        );
-
-        let second = initialize_repo(&root).expect("second init should succeed");
-        let skipped_names = second.artifacts_with_status(InitStatus::Skipped);
-        assert_eq!(
-            skipped_names,
-            vec![
-                ".claw/".to_string(),
-                ".claw.json".to_string(),
-                ".gitignore".to_string(),
-                "CLAUDE.md".to_string(),
-            ],
-            "idempotent init should place all four artifacts in skipped[]"
-        );
-        assert!(
-            second.artifacts_with_status(InitStatus::Created).is_empty(),
-            "idempotent init should have no created artifacts"
-        );
-
-        // artifact_json_entries() uses the machine-stable `json_tag()` which
-        // never changes wording (unlike `label()` which says "skipped (already exists)").
-        let entries = second.artifact_json_entries();
-        assert_eq!(entries.len(), 4);
-        for entry in &entries {
-            let status = entry.get("status").and_then(|v| v.as_str()).unwrap();
-            assert_eq!(
-                status, "skipped",
-                "machine status tag should be the bare word 'skipped', not label()'s 'skipped (already exists)'"
-            );
-        }
 
         fs::remove_dir_all(root).expect("cleanup temp dir");
     }

rust/crates/rusty-claude-cli/src/render.rs

@@ -639,16 +639,10 @@ fn apply_code_block_background(line: &str) -> String {
 /// fence markers of equal or greater length are wrapped with a longer fence.
 ///
 /// LLMs frequently emit triple-backtick code blocks that contain triple-backtick
-/// examples.  `CommonMark` (and pulldown-cmark) treats the inner marker as the
+/// examples.  CommonMark (and pulldown-cmark) treats the inner marker as the
 /// closing fence, breaking the render.  This function detects the situation and
 /// upgrades the outer fence to use enough backticks (or tildes) that the inner
 /// markers become ordinary content.
-#[allow(
-    clippy::too_many_lines,
-    clippy::items_after_statements,
-    clippy::manual_repeat_n,
-    clippy::manual_str_repeat
-)]
 fn normalize_nested_fences(markdown: &str) -> String {
     // A fence line is either "labeled" (has an info string ⇒ always an opener)
     // or "bare" (no info string ⇒ could be opener or closer).

rust/crates/rusty-claude-cli/tests/cli_flags_and_config_defaults.rs

@@ -266,7 +266,7 @@ fn command_in(cwd: &Path) -> Command {
 
 fn write_session(root: &Path, label: &str) -> PathBuf {
     let session_path = root.join(format!("{label}.jsonl"));
-    let mut session = Session::new().with_workspace_root(root.to_path_buf());
+    let mut session = Session::new();
     session
         .push_user_text(format!("session fixture for {label}"))
         .expect("session write should succeed");

rust/crates/rusty-claude-cli/tests/compact_output.rs

@@ -5,7 +5,6 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use mock_anthropic_service::{MockAnthropicService, SCENARIO_PREFIX};
-use serde_json::Value;
 
 static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
 
@@ -126,63 +125,6 @@ fn compact_flag_streaming_text_only_emits_final_message_text() {
     fs::remove_dir_all(&workspace).expect("workspace cleanup should succeed");
 }
 
-#[test]
-fn compact_flag_with_json_output_emits_structured_json() {
-    let runtime = tokio::runtime::Runtime::new().expect("tokio runtime should build");
-    let server = runtime
-        .block_on(MockAnthropicService::spawn())
-        .expect("mock service should start");
-    let base_url = server.base_url();
-
-    let workspace = unique_temp_dir("compact-json");
-    let config_home = workspace.join("config-home");
-    let home = workspace.join("home");
-    fs::create_dir_all(&workspace).expect("workspace should exist");
-    fs::create_dir_all(&config_home).expect("config home should exist");
-    fs::create_dir_all(&home).expect("home should exist");
-
-    let prompt = format!("{SCENARIO_PREFIX}streaming_text");
-    let output = run_claw(
-        &workspace,
-        &config_home,
-        &home,
-        &base_url,
-        &[
-            "--model",
-            "sonnet",
-            "--permission-mode",
-            "read-only",
-            "--output-format",
-            "json",
-            "--compact",
-            &prompt,
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "compact json run should succeed
-stdout:
-{}
-
-stderr:
-{}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr),
-    );
-    let stdout = String::from_utf8(output.stdout).expect("stdout should be utf8");
-    let parsed: Value = serde_json::from_str(&stdout).expect("compact json stdout should parse");
-    assert_eq!(
-        parsed["message"],
-        "Mock streaming says hello from the parity harness."
-    );
-    assert_eq!(parsed["compact"], true);
-    assert_eq!(parsed["model"], "claude-sonnet-4-6");
-    assert!(parsed["usage"].is_object());
-
-    fs::remove_dir_all(&workspace).expect("workspace cleanup should succeed");
-}
-
 fn run_claw(
     cwd: &std::path::Path,
     config_home: &std::path::Path,

rust/crates/rusty-claude-cli/tests/output_format_contract.rs

@@ -4,7 +4,6 @@ use std::process::{Command, Output};
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use runtime::Session;
 use serde_json::Value;
 
 static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
@@ -46,24 +45,6 @@ fn status_and_sandbox_emit_json_when_requested() {
     assert!(sandbox["filesystem_mode"].as_str().is_some());
 }
 
-#[test]
-fn acp_guidance_emits_json_when_requested() {
-    let root = unique_temp_dir("acp-json");
-    fs::create_dir_all(&root).expect("temp dir should exist");
-
-    let acp = assert_json_command(&root, &["--output-format", "json", "acp"]);
-    assert_eq!(acp["kind"], "acp");
-    assert_eq!(acp["status"], "discoverability_only");
-    assert_eq!(acp["supported"], false);
-    assert_eq!(acp["serve_alias_only"], true);
-    assert_eq!(acp["discoverability_tracking"], "ROADMAP #64a");
-    assert_eq!(acp["tracking"], "ROADMAP #76");
-    assert!(acp["message"]
-        .as_str()
-        .expect("acp message")
-        .contains("discoverability alias"));
-}
-
 #[test]
 fn inventory_commands_emit_structured_json_when_requested() {
     let root = unique_temp_dir("inventory-json");
@@ -192,15 +173,13 @@ fn dump_manifests_and_init_emit_json_when_requested() {
     fs::create_dir_all(&root).expect("temp dir should exist");
 
     let upstream = write_upstream_fixture(&root);
-    let manifests = assert_json_command(
+    let manifests = assert_json_command_with_env(
         &root,
-        &[
-            "--output-format",
-            "json",
-            "dump-manifests",
-            "--manifests-dir",
+        &["--output-format", "json", "dump-manifests"],
+        &[(
+            "CLAUDE_CODE_UPSTREAM",
             upstream.to_str().expect("utf8 upstream"),
-        ],
+        )],
     );
     assert_eq!(manifests["kind"], "dump-manifests");
     assert_eq!(manifests["commands"], 1);
@@ -227,7 +206,7 @@ fn doctor_and_resume_status_emit_json_when_requested() {
     assert!(summary["failures"].as_u64().is_some());
 
     let checks = doctor["checks"].as_array().expect("doctor checks");
-    assert_eq!(checks.len(), 6);
+    assert_eq!(checks.len(), 5);
     let check_names = checks
         .iter()
         .map(|check| {
@@ -239,27 +218,7 @@ fn doctor_and_resume_status_emit_json_when_requested() {
         .collect::<Vec<_>>();
     assert_eq!(
         check_names,
-        vec![
-            "auth",
-            "config",
-            "install source",
-            "workspace",
-            "sandbox",
-            "system"
-        ]
-    );
-
-    let install_source = checks
-        .iter()
-        .find(|check| check["name"] == "install source")
-        .expect("install source check");
-    assert_eq!(
-        install_source["official_repo"],
-        "https://github.com/ultraworkers/claw-code"
-    );
-    assert_eq!(
-        install_source["deprecated_install"],
-        "cargo install claw-code"
+        vec!["auth", "config", "workspace", "sandbox", "system"]
     );
 
     let workspace = checks
@@ -277,7 +236,12 @@ fn doctor_and_resume_status_emit_json_when_requested() {
     assert!(sandbox["enabled"].is_boolean());
     assert!(sandbox["fallback_reason"].is_null() || sandbox["fallback_reason"].is_string());
 
-    let session_path = write_session_fixture(&root, "resume-json", Some("hello"));
+    let session_path = root.join("session.jsonl");
+    fs::write(
+        &session_path,
+        "{\"type\":\"session_meta\",\"version\":3,\"session_id\":\"resume-json\",\"created_at_ms\":0,\"updated_at_ms\":0}\n{\"type\":\"message\",\"message\":{\"role\":\"user\",\"blocks\":[{\"type\":\"text\",\"text\":\"hello\"}]}}\n",
+    )
+    .expect("session should write");
     let resumed = assert_json_command(
         &root,
         &[
@@ -289,8 +253,7 @@ fn doctor_and_resume_status_emit_json_when_requested() {
         ],
     );
     assert_eq!(resumed["kind"], "status");
-    // model is null in resume mode (not known without --model flag)
-    assert!(resumed["model"].is_null());
+    assert_eq!(resumed["model"], "restored-session");
     assert_eq!(resumed["usage"]["messages"], 1);
     assert!(resumed["workspace"]["cwd"].as_str().is_some());
     assert!(resumed["sandbox"]["filesystem_mode"].as_str().is_some());
@@ -304,7 +267,12 @@ fn resumed_inventory_commands_emit_structured_json_when_requested() {
     fs::create_dir_all(&config_home).expect("config home should exist");
     fs::create_dir_all(&home).expect("home should exist");
 
-    let session_path = write_session_fixture(&root, "resume-inventory-json", Some("inventory"));
+    let session_path = root.join("session.jsonl");
+    fs::write(
+        &session_path,
+        "{\"type\":\"session_meta\",\"version\":3,\"session_id\":\"resume-inventory-json\",\"created_at_ms\":0,\"updated_at_ms\":0}\n{\"type\":\"message\",\"message\":{\"role\":\"user\",\"blocks\":[{\"type\":\"text\",\"text\":\"inventory\"}]}}\n",
+    )
+    .expect("session should write");
 
     let mcp = assert_json_command_with_env(
         &root,
@@ -355,7 +323,12 @@ fn resumed_version_and_init_emit_structured_json_when_requested() {
     let root = unique_temp_dir("resume-version-init-json");
     fs::create_dir_all(&root).expect("temp dir should exist");
 
-    let session_path = write_session_fixture(&root, "resume-version-init-json", None);
+    let session_path = root.join("session.jsonl");
+    fs::write(
+        &session_path,
+        "{\"type\":\"session_meta\",\"version\":3,\"session_id\":\"resume-version-init-json\",\"created_at_ms\":0,\"updated_at_ms\":0}\n",
+    )
+    .expect("session should write");
 
     let version = assert_json_command(
         &root,
@@ -431,24 +404,6 @@ fn write_upstream_fixture(root: &Path) -> PathBuf {
     upstream
 }
 
-fn write_session_fixture(root: &Path, session_id: &str, user_text: Option<&str>) -> PathBuf {
-    let session_path = root.join("session.jsonl");
-    let mut session = Session::new()
-        .with_workspace_root(root.to_path_buf())
-        .with_persistence_path(session_path.clone());
-    session.session_id = session_id.to_string();
-    if let Some(text) = user_text {
-        session
-            .push_user_text(text)
-            .expect("session fixture message should persist");
-    } else {
-        session
-            .save_to_path(&session_path)
-            .expect("session fixture should persist");
-    }
-    session_path
-}
-
 fn write_agent(root: &Path, name: &str, description: &str, model: &str, reasoning: &str) {
     fs::create_dir_all(root).expect("agent root should exist");
     fs::write(

rust/crates/rusty-claude-cli/tests/resume_slash_commands.rs

@@ -20,7 +20,7 @@ fn resumed_binary_accepts_slash_commands_with_arguments() {
     let session_path = temp_dir.join("session.jsonl");
     let export_path = temp_dir.join("notes.txt");
 
-    let mut session = workspace_session(&temp_dir);
+    let mut session = Session::new();
     session
         .push_user_text("ship the slash command harness")
         .expect("session write should succeed");
@@ -122,7 +122,7 @@ fn resumed_config_command_loads_settings_files_end_to_end() {
     fs::create_dir_all(&config_home).expect("config home should exist");
 
     let session_path = project_dir.join("session.jsonl");
-    workspace_session(&project_dir)
+    Session::new()
         .with_persistence_path(&session_path)
         .save_to_path(&session_path)
         .expect("session should persist");
@@ -180,13 +180,13 @@ fn resume_latest_restores_the_most_recent_managed_session() {
     // given
     let temp_dir = unique_temp_dir("resume-latest");
     let project_dir = temp_dir.join("project");
-    fs::create_dir_all(&project_dir).expect("project dir should exist");
-    let project_dir = fs::canonicalize(&project_dir).unwrap_or(project_dir);
-    let store = runtime::SessionStore::from_cwd(&project_dir).expect("session store should build");
-    let older_path = store.create_handle("session-older").path;
-    let newer_path = store.create_handle("session-newer").path;
+    let sessions_dir = project_dir.join(".claw").join("sessions");
+    fs::create_dir_all(&sessions_dir).expect("sessions dir should exist");
 
-    let mut older = workspace_session(&project_dir).with_persistence_path(&older_path);
+    let older_path = sessions_dir.join("session-older.jsonl");
+    let newer_path = sessions_dir.join("session-newer.jsonl");
+
+    let mut older = Session::new().with_persistence_path(&older_path);
     older
         .push_user_text("older session")
         .expect("older session write should succeed");
@@ -194,7 +194,7 @@ fn resume_latest_restores_the_most_recent_managed_session() {
         .save_to_path(&older_path)
         .expect("older session should persist");
 
-    let mut newer = workspace_session(&project_dir).with_persistence_path(&newer_path);
+    let mut newer = Session::new().with_persistence_path(&newer_path);
     newer
         .push_user_text("newer session")
         .expect("newer session write should succeed");
@@ -229,7 +229,7 @@ fn resumed_status_command_emits_structured_json_when_requested() {
     fs::create_dir_all(&temp_dir).expect("temp dir should exist");
     let session_path = temp_dir.join("session.jsonl");
 
-    let mut session = workspace_session(&temp_dir);
+    let mut session = Session::new();
     session
         .push_user_text("resume status json fixture")
         .expect("session write should succeed");
@@ -261,8 +261,7 @@ fn resumed_status_command_emits_structured_json_when_requested() {
     let parsed: Value =
         serde_json::from_str(stdout.trim()).expect("resume status output should be json");
     assert_eq!(parsed["kind"], "status");
-    // model is null in resume mode (not known without --model flag)
-    assert!(parsed["model"].is_null());
+    assert_eq!(parsed["model"], "restored-session");
     assert_eq!(parsed["permission_mode"], "danger-full-access");
     assert_eq!(parsed["usage"]["messages"], 1);
     assert!(parsed["usage"]["turns"].is_number());
@@ -276,47 +275,6 @@ fn resumed_status_command_emits_structured_json_when_requested() {
     assert!(parsed["sandbox"]["filesystem_mode"].as_str().is_some());
 }
 
-#[test]
-fn resumed_status_surfaces_persisted_model() {
-    // given — create a session with model already set
-    let temp_dir = unique_temp_dir("resume-status-model");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-
-    let mut session = workspace_session(&temp_dir);
-    session.model = Some("claude-sonnet-4-6".to_string());
-    session
-        .push_user_text("model persistence fixture")
-        .expect("write ok");
-    session.save_to_path(&session_path).expect("persist ok");
-
-    // when
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/status",
-        ],
-    );
-
-    // then
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "status");
-    assert_eq!(
-        parsed["model"], "claude-sonnet-4-6",
-        "model should round-trip through session metadata"
-    );
-}
-
 #[test]
 fn resumed_sandbox_command_emits_structured_json_when_requested() {
     // given
@@ -324,7 +282,7 @@ fn resumed_sandbox_command_emits_structured_json_when_requested() {
     fs::create_dir_all(&temp_dir).expect("temp dir should exist");
     let session_path = temp_dir.join("session.jsonl");
 
-    workspace_session(&temp_dir)
+    Session::new()
         .save_to_path(&session_path)
         .expect("session should persist");
 
@@ -360,183 +318,10 @@ fn resumed_sandbox_command_emits_structured_json_when_requested() {
     assert!(parsed["markers"].is_array());
 }
 
-#[test]
-fn resumed_version_command_emits_structured_json() {
-    let temp_dir = unique_temp_dir("resume-version-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    workspace_session(&temp_dir)
-        .save_to_path(&session_path)
-        .expect("session should persist");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/version",
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "version");
-    assert!(parsed["version"].as_str().is_some());
-    assert!(parsed["git_sha"].as_str().is_some());
-    assert!(parsed["target"].as_str().is_some());
-}
-
-#[test]
-fn resumed_export_command_emits_structured_json() {
-    let temp_dir = unique_temp_dir("resume-export-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    let mut session = workspace_session(&temp_dir);
-    session
-        .push_user_text("export json fixture")
-        .expect("write ok");
-    session.save_to_path(&session_path).expect("persist ok");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/export",
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "export");
-    assert!(parsed["file"].as_str().is_some());
-    assert_eq!(parsed["message_count"], 1);
-}
-
-#[test]
-fn resumed_help_command_emits_structured_json() {
-    let temp_dir = unique_temp_dir("resume-help-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    workspace_session(&temp_dir)
-        .save_to_path(&session_path)
-        .expect("persist ok");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/help",
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "help");
-    assert!(parsed["text"].as_str().is_some());
-    let text = parsed["text"].as_str().unwrap();
-    assert!(text.contains("/status"), "help text should list /status");
-}
-
-#[test]
-fn resumed_no_command_emits_restored_json() {
-    let temp_dir = unique_temp_dir("resume-no-cmd-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    let mut session = workspace_session(&temp_dir);
-    session
-        .push_user_text("restored json fixture")
-        .expect("write ok");
-    session.save_to_path(&session_path).expect("persist ok");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-        ],
-    );
-
-    assert!(
-        output.status.success(),
-        "stderr:\n{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8");
-    let parsed: Value = serde_json::from_str(stdout.trim()).expect("should be json");
-    assert_eq!(parsed["kind"], "restored");
-    assert!(parsed["session_id"].as_str().is_some());
-    assert!(parsed["path"].as_str().is_some());
-    assert_eq!(parsed["message_count"], 1);
-}
-
-#[test]
-fn resumed_stub_command_emits_not_implemented_json() {
-    let temp_dir = unique_temp_dir("resume-stub-json");
-    fs::create_dir_all(&temp_dir).expect("temp dir should exist");
-    let session_path = temp_dir.join("session.jsonl");
-    workspace_session(&temp_dir)
-        .save_to_path(&session_path)
-        .expect("persist ok");
-
-    let output = run_claw(
-        &temp_dir,
-        &[
-            "--output-format",
-            "json",
-            "--resume",
-            session_path.to_str().expect("utf8 path"),
-            "/allowed-tools",
-        ],
-    );
-
-    // Stub commands exit with code 2
-    assert!(!output.status.success());
-    let stderr = String::from_utf8(output.stderr).expect("utf8");
-    let parsed: Value = serde_json::from_str(stderr.trim()).expect("should be json");
-    assert_eq!(parsed["type"], "error");
-    assert!(
-        parsed["error"]
-            .as_str()
-            .unwrap()
-            .contains("not yet implemented"),
-        "error should say not yet implemented: {:?}",
-        parsed["error"]
-    );
-}
-
 fn run_claw(current_dir: &Path, args: &[&str]) -> Output {
     run_claw_with_env(current_dir, args, &[])
 }
 
-fn workspace_session(root: &Path) -> Session {
-    Session::new().with_workspace_root(root.to_path_buf())
-}
-
 fn run_claw_with_env(current_dir: &Path, args: &[&str], envs: &[(&str, &str)]) -> Output {
     let mut command = Command::new(env!("CARGO_BIN_EXE_claw"));
     command.current_dir(current_dir).args(args);

scripts/fmt.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-cd "$REPO_ROOT/rust"
-exec cargo fmt "$@"