pub verification_uri_complete: String,

    pub expires_in: i64,

    pub interval: u64,

    /// The scopes this authorization was opened for, as the server settled

    /// them.

    ///

    /// The server's answer, not the request: `--scope` asks, and the

    /// deployment decides — an unknown scope is refused outright, and asking

    /// for nothing takes the server's own default set. Carried here and

    /// reported so `--scope` has a visible effect. Without it the flag reached

    /// the wire and nothing a reader could see ever changed, which is

    /// indistinguishable from the flag not being read at all.

    #[serde(default)]

    pub scope: Option<String>,

}

/// One poll of the token endpoint.

    #[arg(long, help = "Target harness lane (e.g. ox-alpha, gemini, devin, claude, codex)")]

    pub lane: Option<String>,

    /// Pick the model a turn runs on by its catalog id.

    ///

    /// `--lane` deals in tiers; this deals in ids, settled against `GET

    /// /api/v1/models` before a thread is opened, so an id this deployment

    /// does not serve is refused by name rather than quietly replaced with the

    /// default. `ollama:<model>` names a model on this machine.

    #[arg(

        long,

        help = "Model id to answer on, or ollama:<model> for one on this machine"

    )]

    pub model: Option<String>,

    /// Answer from an Ollama server on this machine.

    ///

    /// The same lane `--lane local` selects. Nothing in the conversation

    /// leaves the machine and nothing is metered.

    #[arg(long, help = "Answer from a model running on this machine through Ollama")]

    pub local: bool,

    /// Answer from the built-in stand-in instead of reaching a model.

    ///

    /// A deliberate mode, not a failure path. The live path fails loudly when

    /// it cannot reach a model — this is the only way to get the stand-in, and

    /// it opens no thread, spends nothing, and says on every reply that it is

    /// not a model.

    #[arg(long, help = "Answer from the built-in stand-in instead of reaching a model")]

    pub offline: bool,

    /// The effort recorded on the thread as its admitted execution shape.

    #[arg(

        long,

        value_parser = ["minimal", "low", "medium", "high", "max"],

        help = "Reasoning effort recorded on the thread as its admitted execution shape"

    )]

    pub reasoning: Option<String>,

    /// Continue a thread of the account's instead of opening a new one.

    ///

    /// Bare `--resume` shows a picker over this repository's recent threads;

    /// `--resume <id>` names one; `--resume --last` continues the most recent

    /// without asking.

    ///

    /// The id is the flag's own value rather than the positional argument.

    /// `openagents coder` reads the positional as the id under `--resume`,

    /// which costs it the ability to resume and say something in the same

    /// breath; here `oa coder --resume <id> "what did we conclude?"` is both.

    #[arg(

        long,

        num_args = 0..=1,

        default_missing_value = "",

        value_name = "ID",

        help = "Continue a thread instead of opening one. Bare: a picker over this repository's threads"

    )]

    pub resume: Option<String>,

    #[arg(long, help = "With --resume, continue the most recent thread without asking")]

    pub last: bool,

    #[arg(

        long,

        help = "With --resume, list every thread on the account rather than this repository's"

    )]

    pub all: bool,

    #[arg(long, help = "Run in non-interactive headless mode")]

    pub headless: bool,

    pub dev_port: u16,

}

/// The lane name `oa coder` runs on when nothing names another.

const DEFAULT_LANE: &str = "ox-alpha";

impl CoderArgs {

    /// The lane this invocation asked for, as a name [`crate::runtime::Lane`]

    /// understands.

    ///

    /// Three flags reach the same setting — `--lane` names a tier, `--model`

    /// names a catalog id, `--local` names this machine — so two of them

    /// naming different things is a refusal rather than a silent precedence

    /// order. A reader who wrote both meant one of them and cannot tell which

    /// one won.

    pub fn lane_name(&self) -> Result<String, String> {

        let mut asked: Vec<(&str, String)> = Vec::new();

        if let Some(lane) = self.lane.as_deref().map(str::trim).filter(|s| !s.is_empty()) {

            asked.push(("--lane", lane.to_string()));

        }

        if let Some(model) = self.model.as_deref().map(str::trim).filter(|s| !s.is_empty()) {

            asked.push(("--model", model.to_string()));

        }

        if self.local {

            asked.push(("--local", "local".to_string()));

        }

        match asked.len() {

            0 => Ok(DEFAULT_LANE.to_string()),

            1 => Ok(asked.remove(0).1),

            _ => {

                let resolved: Vec<crate::runtime::Lane> = asked

                    .iter()

                    .map(|(_, value)| crate::runtime::Lane::from_str(value))

                    .collect();

                // `--local --model ollama:x` is one intent written twice, and

                // is the one combination that is not a contradiction: `--local`

                // names the lane and the other names the model on it, so the

                // more specific one is what was meant. Bare `--local` alone

                // means "whatever is installed", which contradicts nothing.

                if resolved.iter().all(crate::runtime::Lane::is_local) {

                    let named: Vec<&str> = resolved

                        .iter()

                        .filter_map(|lane| match lane {

                            crate::runtime::Lane::Local(model) if !model.is_empty() => {

                                Some(model.as_str())

                            }

                            _ => None,

                        })

                        .collect();

                    match named.as_slice() {

                        [] => return Ok("local".to_string()),

                        [only] => return Ok(format!("ollama:{only}")),

                        _ if named.windows(2).all(|pair| pair[0] == pair[1]) => {

                            return Ok(format!("ollama:{}", named[0]))

                        }

                        _ => {}

                    }

                }

                // Two names for one hosted lane is agreement, not a conflict:

                // `--lane pro` and `--model gpt-5.6-luna` are the same thing

                // said twice.

                if resolved.windows(2).all(|pair| pair[0] == pair[1]) {

                    return Ok(asked.remove(0).1);

                }

                let names: Vec<String> = asked

                    .iter()

                    .map(|(flag, value)| format!("{flag} {value}"))

                    .collect();

                Err(format!(

                    "{} name different lanes. Give one of them.",

                    names.join(" and ")

                ))

            }

        }

    }

    /// Whether any of `--lane`, `--model` or `--local` was written.

    ///

    /// A resumed thread already holds the model its grant pins, so naming one

    /// on the same command line is a flag with nothing to do.

    pub fn named_a_lane(&self) -> bool {

        self.lane.is_some() || self.model.is_some() || self.local

    }

}

// ---------------------------------------------------------------------------

// coder: the offline stand-in

// ---------------------------------------------------------------------------

/// What `--offline` answers with.

///

/// A deliberate mode. This text is reachable only when someone asks for it:

/// the live path fails loudly when it cannot reach a model, and there is no

/// branch that falls back here. The reply names itself as a stand-in on every

/// turn, because a reply that reads like a model's and is not one is the

/// failure this whole flag exists to keep visible.

pub fn standin_reply(prompt: &str) -> String {

    let asked = prompt.trim();

    format!(

        "[stand-in] No model answered this. `--offline` asked for the built-in \

         stand-in, so nothing was sent anywhere, no thread was opened, and \

         nothing was spent.\n\n\

         You asked: {asked}\n\n\

         What works without a model: the composer, the transcript, `--plain`, \

         `--export`, and the tool registry. Drop `--offline` to reach a model, \

         or use `--local` for one on this machine."

    )

}

/// The label a stand-in session reports where a model id would go.

pub const STANDIN_MODEL: &str = "stand-in (no model attached)";

// ---------------------------------------------------------------------------

// delegate

// ---------------------------------------------------------------------------

            } else {

                api_base.clone()

            };

            // Flags that name the same setting differently are refused before

            // anything runs. Every one of these is a combination where one

            // flag would have to be ignored, and a flag that is ignored is a

            // flag that lied.

            if let Err(reason) = coder.lane_name() {

                fail(&reason);

            }

            let resuming = coder.resume.is_some();

            if coder.offline && resuming {

                fail("--resume reads the thread from the server; it cannot combine with --offline");

            }

            if coder.offline && coder.named_a_lane() {

                fail(

                    "--offline answers from the built-in stand-in and reaches no model, \

                     so it cannot combine with --lane, --model or --local",

                );

            }

            if coder.offline && coder.reasoning.is_some() {

                fail(

                    "--offline opens no thread, and --reasoning is recorded on a thread. \

                     Drop one of them.",

                );

            }

            if (coder.last || coder.all) && !resuming {

                fail("--last and --all say which thread to continue, so they need --resume");

            }

            if resuming && coder.named_a_lane() {

                fail(

                    "a resumed thread answers on the model its own grant pins, \

                     so --resume cannot combine with --lane, --model or --local",

                );

            }

            if resuming && coder.reasoning.is_some() {

                fail(

                    "a resumed thread already carries the effort it was opened with, \

                     so --resume cannot combine with --reasoning",

                );

            }

            if coder.delegate {

                crate::delegate::run_delegation(

                    crate::delegate::DelegationRequest::from_coder(coder),

                    token,

                )

                .await?;

            } else if coder.headless {

                run_headless_coder(coder, &session_base, token).await?;

            } else if coder.offline {

                run_offline_coder(coder);

            } else {

                crate::interactive::run_tui(coder, session_base, token).await?;

                // What a thread is recorded against, and what `--resume`

                // filters the picker to. A directory that is not an OpenAgents

                // checkout has none, which is not an error: the thread is

                // simply not attributable to a repository.

                let repository = crate::repo::infer_repository(&endpoint.origin, None).ok();

                // `--resume` is settled before anything draws: the picker

                // prints to the normal screen, and a refusal has to be

                // readable rather than painted over by the full-screen

                // session and wiped on exit.

                let resumed = if let Some(named) = coder.resume.as_deref() {

                    let interactive =

                        !coder.plain && !cli.json && std::io::IsTerminal::is_terminal(&std::io::stdin());

                    let request = crate::resume::ResumeRequest {

                        thread_id: Some(named).filter(|id| !id.is_empty()),

                        last: coder.last,

                        all: coder.all,

                        repository: repository.clone(),

                        interactive,

                    };

                    match crate::resume::resolve(&session_base, token.as_deref(), request).await {

                        Ok(Some(resumption)) => Some(resumption),

                        // An empty answer at the picker cancels, and cancelling

                        // is not a failure.

                        Ok(None) => return Ok(()),

                        Err(reason) => fail(&reason),

                    }

                } else {

                    None

                };

                if coder.headless {

                    run_headless_coder(coder, &session_base, token, repository, resumed).await?;

                } else {

                    crate::interactive::run_tui(coder, session_base, token, repository, resumed)

                        .await?;

                }

            }

        }

        Commands::Delegate(args) => {

            verification_uri_complete: pending.verification_uri_complete.clone(),

            expires_in: remaining,

            interval: pending.interval,

            // The pending record predates the scope field and holds no scope.

            // The authorization the server already opened decides it, and this

            // path only waits for that one to be approved.

            scope: None,

        };

        let token = or_fail(devices.wait(&authorization).await);

        or_fail(store.store(&token));

                "verification_url": authorization.verification_uri_complete,

                "user_code": authorization.user_code,

                "expires_in": authorization.expires_in,

                "scope": authorization.scope,

                "resume_command": resume_command,

            }));

        } else {

            println!("OpenAgents authorization is ready.");

            println!("Open this URL: {}", authorization.verification_uri_complete);

            println!("Authorization code: {}", authorization.user_code);

            // What the approval page will ask the reader to grant. The server

            // settles this: `--scope` asks and the deployment decides.

            if let Some(scope) = authorization.scope.as_deref().filter(|s| !s.is_empty()) {

                println!("Scope requested: {scope}");

            }

            println!("After you approve the request, run: {resume_command}");

        }

        return;

        authorization.verification_uri_complete

    );

    eprintln!("OpenAgents authorization code: {}", authorization.user_code);

    if let Some(scope) = authorization.scope.as_deref().filter(|s| !s.is_empty()) {

        eprintln!("Scope requested: {scope}");

    }

    if !crate::auth::open_browser(&authorization.verification_uri_complete) {

        eprintln!("The browser did not open. Open the authorization URL above.");

    }

    }

}

// ---------------------------------------------------------------------------

// coder: the offline stand-in

// ---------------------------------------------------------------------------

/// `oa coder --offline`.

///

/// One turn, line-oriented, from [`standin_reply`]. It opens no socket at all,

/// so it answers with the network down — which is the whole point, and the

/// only reason the stand-in exists.

///

/// This is a mode someone asked for, not a fallback someone landed in. The

/// live path in [`crate::runtime`] fails loudly when it cannot reach a model

/// and there is no branch from there to here. The inversion this replaces was

/// the reverse: a rejected request answered with the sentence `Completed

/// autonomous reasoning turn (offline fallback).` and exit 0, with no flag

/// that could ask for it.

fn run_offline_coder(coder: CoderArgs) {

    let Some(prompt) = coder.prompt.as_deref().map(str::trim).filter(|p| !p.is_empty()) else {

        fail(

            "--offline answers one prompt from the built-in stand-in. Give it one: \

             `oa coder --offline \"<prompt>\"`",

        );

    };

    let answer = standin_reply(prompt);

    println!("{answer}");

    println!("\nModel: {STANDIN_MODEL}");

    if let Some(path) = coder.export.as_deref() {

        let transcript = crate::interactive::transcript_of(prompt, &answer);

        if let Err(error) = std::fs::write(path, &transcript) {

            fail(&format!(

                "could not write the transcript to {path}: {error}"

            ));

        }

        println!("Transcript written to {path}");

    }

}

// ---------------------------------------------------------------------------

// coder: headless

// ---------------------------------------------------------------------------

    coder: CoderArgs,

    api_base: &str,

    token: Option<String>,

    repository: Option<String>,

    resumed: Option<crate::resume::Resumption>,

) -> Result<(), Box<dyn std::error::Error>> {

    let prompt = coder

        .prompt

        .clone()

        .unwrap_or_else(|| "Analyze workspace and run tests".to_string());

    println!("Executing coder prompt headlessly: {}", prompt);

    let lane_name = coder.lane.clone().unwrap_or_else(|| "ox-alpha".to_string());

    let lane_name = coder.lane_name().unwrap_or_else(|reason| fail(&reason));

    // A headless session may start children. They run on the same lane and the

    // same credential, and they do not get the tool themselves.

    let tools = crate::tools::HarnessToolRegistry::with_delegation(

        token,

        tools,

    );

    runtime.reasoning = coder.reasoning.clone();

    runtime.repository = repository;

    if let Some(resumption) = &resumed {

        if let Err(reason) = crate::resume::apply(&mut runtime, resumption).await {

            fail(&reason);

        }

        println!(

            "{}",

            crate::resume::resumed_line(

                resumption,

                runtime.last_model.as_deref().unwrap_or("an unnamed model")

            )

        );

    }

    let result = runtime

        .execute_turn(&prompt, |chunk| {

            print!("{}", chunk);

            isolation: None,

            keep_workspaces: false,

            lane: None,

            model: None,

            local: false,

            offline: false,

            reasoning: None,

            resume: None,

            last: false,

            all: false,

            headless: false,

            export: None,

            plain: false,

    args: CoderArgs,

    api_base: String,

    token: Option<String>,

    repository: Option<String>,

    resumed: Option<crate::resume::Resumption>,

) -> Result<(), Box<dyn std::error::Error>> {

    let lane_name = args.lane.clone().unwrap_or_else(|| "ox-alpha".to_string());

    let lane_name = args.lane_name()?;

    let lane = Lane::from_str(&lane_name);

    // `--plain` asks for the line-oriented path even on a terminal. Without a

    // terminal there is no full-screen session to run either way.

    if args.plain || !is_terminal() {

        return run_without_a_terminal(args, api_base, token, lane).await;

        return run_without_a_terminal(args, api_base, token, repository, lane, resumed).await;

    }

    let tools = session_tools(&lane_name, &token);

    let session = CoderRuntimeSession::new(lane.clone(), Some(api_base), token, tools);

    let mut session = CoderRuntimeSession::new(lane.clone(), Some(api_base), token, tools);

    session.reasoning = args.reasoning.clone();

    session.repository = repository;

    // A resumed thread is adopted before the screen is entered, so its refusal

    // is readable rather than painted over and wiped on exit.

    if let Some(resumption) = &resumed {

        crate::resume::apply(&mut session, resumption).await?;

        println!(

            "{}",

            crate::resume::resumed_line(

                resumption,

                session.last_model.as_deref().unwrap_or("an unnamed model")

            )

        );

    }

    let (control_tx, control_rx) = unbounded_channel::<Control>();

    let (event_tx, mut event_rx) = unbounded_channel::<TurnEvent>();

    args: CoderArgs,

    api_base: String,

    token: Option<String>,

    repository: Option<String>,

    lane: Lane,

    resumed: Option<crate::resume::Resumption>,

) -> Result<(), Box<dyn std::error::Error>> {

    let lane_name = args.lane.clone().unwrap_or_else(|| "ox-alpha".to_string());

    let lane_name = args.lane_name()?;

    let Some(prompt) = args.prompt.clone() else {

        eprintln!(

            "`oa coder` needs a terminal for an interactive session. \

    let tools = session_tools(&lane_name, &token);

    let mut session = CoderRuntimeSession::new(lane, Some(api_base), token, tools);

    session.reasoning = args.reasoning.clone();

    session.repository = repository;

    if let Some(resumption) = &resumed {

        crate::resume::apply(&mut session, resumption).await?;

        println!(

            "{}",

            crate::resume::resumed_line(

                resumption,

                session.last_model.as_deref().unwrap_or("an unnamed model")

            )

        );

    }

    // The reply is printed as it streams. `execute_turn` also returns the last

    // step's text, which is the same text — so it is printed only when nothing

    // streamed, which is how the offline paths still say something.

pub mod plugins;

pub mod provider;

pub mod repo;

pub mod resume;

pub mod runtime;

pub mod signals;

pub mod tools;

//! `oa coder --resume`: back into a thread the account already holds.

//!

//! The shape is the one `openagents coder` settled on and this CLI copies so

//! the two agree: bare `--resume` shows a picker over this repository's recent

//! threads, `--resume <id>` names one directly (the positional argument is the

//! id, not a prompt), `--resume --last` continues the most recent without

//! asking, and `--all` drops the repository filter.

//!

//! Three server reads and one write:

//!

//! - `GET /api/v1/threads?limit=50` is the picker's list.

//! - `GET /api/v1/threads/{id}` is `--resume <id>`.

//! - `GET /api/v1/threads/{id}/events?limit=50&after=<id>` is the transcript,

//!   paged because the listing caps at fifty and a working session passes

//!   fifty events inside an hour.

//! - `POST /api/v1/threads/{id}/grants` re-mints the thread's authority, which

//!   is what makes this a continuation rather than a new thread that has read

//!   an old one. The server's own fence: it revokes every active grant on the

//!   thread and bumps its generation, so a resumed session cannot race a

//!   zombie of its former self.

//!

//! ## The replay is read-only

//!

//! [`replay_wire`] rebuilds the messages the live turn loop would have

//! accumulated and nothing else. Nothing here posts an event: the server

//! already holds these, and writing them back would double the record.

//! Reasoning is deliberately absent, because the live loop never puts a

//! thought on the wire.

//!

//! ## What a Rust-opened thread replays to

//!

//! [`crate::runtime`] records `thread.opened` and no turn events, so a thread

//! this CLI opened replays to an empty conversation while one `openagents

//! coder` opened replays to its transcript. That is the record, not a parse

//! failure, and the caller says how many messages came back rather than

//! implying a transcript that is not there.

use crate::runtime::ChatMessage;

use serde::Deserialize;

use std::time::Duration;

/// The server's listing cap. Pages are read at exactly this size.

const PAGE_LIMIT: usize = 50;

/// One thread as `GET /api/v1/threads` reports it.

#[derive(Debug, Clone, PartialEq, Eq)]

pub struct ThreadSummary {

    pub id: String,

    pub status: String,

    pub objective: String,

    pub event_count: u64,

    pub started_at: Option<String>,

    /// The thread's own `repository` field when the server reports one, else

    /// parsed back out of the objective sentence this CLI composes.

    pub repository: Option<String>,

}

impl ThreadSummary {

    fn from_view(value: &serde_json::Value) -> Option<Self> {

        let id = value.get("id")?.as_str()?.to_string();

        let objective = value

            .get("objective")

            .and_then(|v| v.as_str())

            .unwrap_or_default()

            .to_string();

        let repository = value

            .get("repository")

            .and_then(|v| v.as_str())

            .filter(|s| !s.is_empty())

            .map(str::to_string)

            .or_else(|| repository_of(&objective));

        Some(Self {

            id,

            status: value

                .get("status")

                .and_then(|v| v.as_str())

                .unwrap_or("unknown")

                .to_string(),

            objective,

            event_count: value

                .get("event_count")

                .and_then(|v| v.as_u64())

                .unwrap_or(0),

            started_at: value

                .get("started_at")

                .and_then(|v| v.as_str())

                .map(str::to_string),

            repository,

        })

    }

    /// One line in the picker.

    pub fn line(&self) -> String {

        let when = self.started_at.as_deref().unwrap_or("—");

        let where_ = self.repository.as_deref().unwrap_or("no repository");

        format!(

            "{}  {}  {}  {} events  {}",

            &self.id[..self.id.len().min(8)],

            self.status,

            when,

            self.event_count,

            where_

        )

    }

}

/// The repository a thread's objective names, when this CLI named it.

///

/// Deterministic parsing of a bounded field this same program wrote — the

/// session opener composes `openagents coder in <repo> on <branch>` — not a

/// guess at free text. Anything else parses to nothing and is simply a thread

/// without a repository.

pub fn repository_of(objective: &str) -> Option<String> {

    let rest = objective.strip_prefix("openagents coder in ")?;

    let (repository, _branch) = rest.rsplit_once(" on ")?;

    if repository.is_empty() {

        return None;

    }

    Some(repository.to_string())

}

/// The threads the picker offers, newest first as the server ordered them.

///

/// Filtered to the named repository unless `all`, because a reader resuming

/// work is almost always resuming it where they are standing. Terminal threads

/// stay in the list: this CLI revokes its thread on a clean exit, so an

/// open-only list would usually be empty, and picking a terminal one gets the

/// refusal that teaches why rather than a listing that hides it.

pub fn resumable_threads(

    threads: &[ThreadSummary],

    repository: Option<&str>,

    all: bool,

) -> Vec<ThreadSummary> {

    if all {

        return threads.to_vec();

    }

    let Some(repository) = repository else {

        return Vec::new();

    };

    threads

        .iter()

        .filter(|t| t.repository.as_deref() == Some(repository))

        .cloned()

        .collect()

}

/// Refuse a thread that cannot be continued.

///

/// A terminal thread holds no authority and its transcript is closed — the

/// server refuses both a re-mint and a new event — so resuming one could only

/// ever show history. The refusal names the status, because `cancelled` after

/// a clean exit and `failed` after an error call for different next steps.

pub fn assert_resumable(thread: &ThreadSummary) -> Result<(), String> {

    if thread.status == "open" {

        return Ok(());

    }

    Err(format!(

        "thread {} is {}: its transcript is closed and it holds no authority to re-grant. \

         Start a new session with `oa coder` instead.",

        thread.id, thread.status

    ))

}

/// One event as `GET /api/v1/threads/{id}/events` reports it.

#[derive(Debug, Clone, Deserialize)]

pub struct ThreadEvent {

    /// The cursor: a client continues from the last id it read.

    pub id: i64,

    pub event_type: String,

    #[serde(default)]

    pub payload: serde_json::Value,

}

/// The model-facing transcript, rebuilt in the shape the live loop feeds it.

///

/// `turn.user` is a user message as sent. `tool.ran` becomes the standard chat

/// exchange: an assistant message carrying the call in `tool_calls` with the

/// arguments as the raw JSON string the record kept, then a `tool` message

/// named by `tool_call_id`. `turn.assistant` is the turn's whole answer, and

/// an empty one is dropped — a turn that only ran tools is recorded with no

/// answer, and a blank assistant message on the wire is a message the provider

/// has to be asked to ignore. `turn.reasoning` is absent on purpose.

///

/// Event types outside this vocabulary are skipped rather than refused: the

/// transcript is append-only and a future writer may know words this reader

/// does not.

pub fn replay_wire(events: &[ThreadEvent]) -> Vec<ChatMessage> {

    let mut messages = Vec::new();

    for event in events {

        let payload = &event.payload;

        match event.event_type.as_str() {

            "turn.user" => messages.push(ChatMessage {

                role: "user".to_string(),

                content: Some(text(payload, "text")),

                tool_calls: None,

                tool_call_id: None,

            }),

            "tool.ran" => {

                let call_id = text(payload, "call_id");

                let name = {

                    let named = text(payload, "tool");

                    if named.is_empty() {

                        "tool".to_string()

                    } else {

                        named

                    }

                };

                let outcome = payload

                    .get("output")

                    .and_then(|v| v.as_str())

                    .or_else(|| payload.get("error").and_then(|v| v.as_str()))

                    .unwrap_or("")

                    .to_string();

                messages.push(ChatMessage {

                    role: "assistant".to_string(),

                    content: None,

                    tool_calls: Some(vec![serde_json::json!({

                        "id": call_id,

                        "type": "function",

                        "function": {

                            "name": name,

                            "arguments": text(payload, "arguments"),

                        }

                    })]),

                    tool_call_id: None,

                });

                messages.push(ChatMessage {

                    role: "tool".to_string(),

                    content: Some(outcome),

                    tool_calls: None,

                    tool_call_id: Some(call_id),

                });

            }

            "turn.assistant" => {

                let said = text(payload, "text");

                if said.trim().is_empty() {

                    continue;

                }

                messages.push(ChatMessage {

                    role: "assistant".to_string(),

                    content: Some(said),

                    tool_calls: None,

                    tool_call_id: None,

                });

            }

            _ => {}

        }

    }

    messages

}

fn text(payload: &serde_json::Value, key: &str) -> String {

    payload

        .get(key)

        .and_then(|v| v.as_str())

        .unwrap_or("")

        .to_string()

}

// ---------------------------------------------------------------------------

// the server reads

// ---------------------------------------------------------------------------

/// The reads `--resume` makes, against one origin with one account token.

pub struct ResumeApi {

    api_base: String,

    token: String,

    http: reqwest::Client,

}

impl ResumeApi {

    pub fn new(api_base: &str, token: &str) -> Self {

        Self {

            api_base: api_base.trim_end_matches('/').to_string(),

            token: token.to_string(),

            http: reqwest::Client::builder()

                .timeout(Duration::from_secs(30))

                .build()

                .unwrap_or_default(),

        }

    }

    async fn get(&self, url: &str, what: &str) -> Result<serde_json::Value, String> {

        let response = self

            .http

            .get(url)

            .bearer_auth(&self.token)

            .send()

            .await

            .map_err(|error| format!("{what}: {url} could not be reached: {error}"))?;

        let status = response.status();

        let body = response.text().await.unwrap_or_default();

        if !status.is_success() {

            return Err(format!("{what}: {url} refused the read: {status} {body}"));

        }

        serde_json::from_str(&body).map_err(|error| {

            format!("{what}: {url} answered with something that is not JSON: {error}")

        })

    }

    /// The account's threads, newest first, as the server reports them.

    pub async fn list_threads(&self) -> Result<Vec<ThreadSummary>, String> {

        let url = format!("{}/threads?limit={PAGE_LIMIT}", self.api_base);

        let body = self

            .get(&url, "the account's threads could not be listed")

            .await?;

        Ok(body

            .get("threads")

            .and_then(|v| v.as_array())

            .map(|list| list.iter().filter_map(ThreadSummary::from_view).collect())

            .unwrap_or_default())

    }

    /// One thread by id, for `--resume <id>`.

    pub async fn fetch_thread(&self, thread_id: &str) -> Result<ThreadSummary, String> {

        let url = format!("{}/threads/{thread_id}", self.api_base);

        let body = self

            .get(&url, &format!("thread {thread_id} could not be read"))

            .await?;

        let view = body.get("thread").unwrap_or(&body);

        ThreadSummary::from_view(view).ok_or_else(|| {

            format!("{url} answered without a thread id, so there is nothing to resume")

        })

    }

    /// The whole transcript, oldest first, through the cursor.

    ///

    /// Pages of [`PAGE_LIMIT`], each continuing from the last event id read,

    /// until a page comes back short. The cap is the server's; a session's

    /// history is exactly the thing that outgrows it.

    pub async fn fetch_all_events(&self, thread_id: &str) -> Result<Vec<ThreadEvent>, String> {

        let mut collected: Vec<ThreadEvent> = Vec::new();

        let mut after: Option<i64> = None;

        loop {

            let cursor = match after {

                Some(id) => format!("&after={id}"),

                None => String::new(),

            };

            let url = format!(

                "{}/threads/{thread_id}/events?limit={PAGE_LIMIT}{cursor}",

                self.api_base

            );

            let body = self

                .get(

                    &url,

                    &format!("the transcript of thread {thread_id} could not be read"),

                )

                .await?;

            let page: Vec<ThreadEvent> = body

                .get("events")

                .and_then(|v| v.as_array())

                .map(|list| {

                    list.iter()

                        .filter_map(|raw| serde_json::from_value(raw.clone()).ok())

                        .collect()

                })

                .unwrap_or_default();

            let short = page.len() < PAGE_LIMIT;

            let last = page.last().map(|e| e.id);

            collected.extend(page);

            match last {

                Some(id) if !short => after = Some(id),

                _ => return Ok(collected),

            }

        }

    }

}

// ---------------------------------------------------------------------------

// the picker

// ---------------------------------------------------------------------------

/// Ask which thread to continue, over the terminal.

///

/// Returns `Ok(None)` when the reader cancels with an empty line, which is not

/// a failure. The caller checks for a terminal before calling this: the

/// non-interactive forms are `--resume <id>` and `--resume --last`.

pub fn pick_thread(candidates: &[ThreadSummary]) -> Result<Option<ThreadSummary>, String> {

    use std::io::Write;

    println!("Threads you can continue:");

    for (index, thread) in candidates.iter().enumerate() {

        println!("  {:>2}. {}", index + 1, thread.line());

    }

    print!(

        "Continue which? (1-{}, or Enter to cancel) ",

        candidates.len()

    );

    let _ = std::io::stdout().flush();

    let mut answer = String::new();

    std::io::stdin()

        .read_line(&mut answer)

        .map_err(|error| format!("the picker could not read your answer: {error}"))?;

    let answer = answer.trim();

    if answer.is_empty() {

        return Ok(None);

    }

    let chosen: usize = answer

        .parse()

        .map_err(|_| format!("{answer:?} is not one of the numbers listed"))?;

    candidates

        .get(chosen.wrapping_sub(1))

        .cloned()

        .map(Some)

        .ok_or_else(|| format!("{chosen} is not one of the {} listed", candidates.len()))

}

// ---------------------------------------------------------------------------

// resolving `--resume` into a thread and a transcript

// ---------------------------------------------------------------------------

/// The thread a resumed session continues, and the transcript it continues it

/// with.

#[derive(Debug, Clone)]

pub struct Resumption {

    pub thread: ThreadSummary,

    /// The wire transcript rebuilt from the thread's recorded events. Empty

    /// where the thread recorded no turns, which is what a thread this CLI

    /// opened looks like today.

    pub messages: Vec<ChatMessage>,

    /// How many events were read, so the caller can say what came back rather

    /// than implying a transcript that is not there.

    pub events_read: usize,

}

/// How `--resume` was written on the command line.

pub struct ResumeRequest<'a> {

    /// The positional argument, which `--resume` reads as a thread id.

    pub thread_id: Option<&'a str>,

    /// `--last`.

    pub last: bool,

    /// `--all`.

    pub all: bool,

    /// The repository the picker filters to, when this checkout names one.

    pub repository: Option<String>,

    /// Whether a picker can be shown. `false` on a pipe, under `--plain`, and

    /// under `--json`.

    pub interactive: bool,

}

/// Pick the thread, read its transcript, and re-mint its authority.

///

/// `Ok(None)` means the reader cancelled the picker, which ends the command

/// without being a failure. Everything else is either a resumption or a

/// refusal naming what could not be reached.

pub async fn resolve(

    api_base: &str,

    token: Option<&str>,

    request: ResumeRequest<'_>,

) -> Result<Option<Resumption>, String> {

    let Some(token) = token else {

        return Err(

            "resuming reads the account's threads, and this API has no stored token. \

             Run `oa auth login` first."

                .to_string(),

        );

    };

    let api = ResumeApi::new(api_base, token);

    let thread = match request.thread_id {

        Some(id) => api.fetch_thread(id).await?,

        None => {

            let candidates = resumable_threads(

                &api.list_threads().await?,

                request.repository.as_deref(),

                request.all,

            );

            if candidates.is_empty() {

                return Err(if request.all {

                    "this account holds no threads to resume".to_string()

                } else {

                    match request.repository.as_deref() {

                        Some(repository) => format!(

                            "no threads were opened from {repository}. \

                             Use --all to list every thread on the account."

                        ),

                        None => "this directory is not a checkout of a repository the API knows, \

                                 so there is nothing to filter on. Use --all to list every thread \

                                 on the account, or --resume <id>."