diff --git a/apps/cli/src/headless.ts b/apps/cli/src/headless.ts
index c24213b..a13c056 100644
--- a/apps/cli/src/headless.ts
+++ b/apps/cli/src/headless.ts
@@ -441,6 +441,7 @@ function formatEventText(out: Writable, e: AgentEvent): void {
       return;
     case 'usage':
     case 'thinking_delta':
+    case 'model_step_complete':
     case 'turn_complete':
       return;
   }
diff --git a/apps/cli/src/repl.ts b/apps/cli/src/repl.ts
index 150854d..f6192fa 100644
--- a/apps/cli/src/repl.ts
+++ b/apps/cli/src/repl.ts
@@ -762,6 +762,7 @@ function formatEvent(out: Writable, e: AgentEvent): void {
       else out.write(`    ✓ ${truncate(e.result.content, 200)}\n`);
       return;
     case 'usage':
+    case 'model_step_complete':
       return;
     case 'error':
       out.write(`\n  ✕ ${e.error}\n`);
diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
index d25f9f5..ce392f9 100644
--- a/apps/desktop/src-tauri/Cargo.lock
+++ b/apps/desktop/src-tauri/Cargo.lock
@@ -675,6 +675,7 @@ name = "deepcode_desktop"
 version = "0.1.6"
 dependencies = [
  "dirs 5.0.1",
+ "libc",
  "serde",
  "serde_json",
  "sha2",
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index 703e41d..7a0e4f0 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -27,6 +27,7 @@ sha2 = "0.10"
 thiserror = "1"
 tokio = { version = "1", features = ["fs", "rt-multi-thread", "macros", "sync", "time", "process"] }
 dirs = "5"
+libc = "0.2"
 
 [profile.release]
 panic = "abort"
diff --git a/apps/desktop/src-tauri/src/commands.rs b/apps/desktop/src-tauri/src/commands.rs
index a839406..97da891 100644
--- a/apps/desktop/src-tauri/src/commands.rs
+++ b/apps/desktop/src-tauri/src/commands.rs
@@ -189,14 +189,26 @@ pub fn session_read(id: String) -> Result<Vec<serde_json::Value>, String> {
         Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(vec![]),
         Err(e) => return Err(format!("read {}: {}", path.display(), e)),
     };
+    parse_session_messages(&text)
+}
+
+fn parse_session_messages(text: &str) -> Result<Vec<serde_json::Value>, String> {
+    let lines: Vec<&str> = text.split('\n').collect();
+    let last_content = lines.iter().rposition(|line| !line.trim().is_empty());
     let mut out = Vec::new();
-    for line in text.lines() {
+    for (index, line) in lines.iter().enumerate() {
         let line = line.trim();
         if line.is_empty() {
             continue;
         }
-        let Ok(v) = serde_json::from_str::<serde_json::Value>(line) else {
-            continue; // tolerate a partial trailing line
+        let v = match serde_json::from_str::<serde_json::Value>(line) {
+            Ok(value) => value,
+            Err(_) if Some(index) == last_content && !text.ends_with('\n') => {
+                continue; // recover an interrupted final append only
+            }
+            Err(error) => {
+                return Err(format!("corrupt session at line {}: {}", index + 1, error));
+            }
         };
         // Desktop sessions tag messages with type:"message"; CLI/headless sessions
         // write bare {role, content} lines with no type. Accept both, skip meta.
@@ -206,6 +218,12 @@ pub fn session_read(id: String) -> Result<Vec<serde_json::Value>, String> {
             Some("user") | Some("assistant")
         );
         if t == Some("message") || (t.is_none() && is_role_msg) {
+            if !v.get("content").is_some_and(|content| content.is_array()) {
+                return Err(format!(
+                    "corrupt session at line {}: message content must be an array",
+                    index + 1
+                ));
+            }
             out.push(v);
         }
     }
@@ -773,6 +791,29 @@ mod contract_tests {
         assert!(name.is_none() && desc.is_none());
     }
 
+    #[test]
+    fn session_parser_accepts_both_legacy_formats_and_truncated_tail() {
+        let text = concat!(
+            "{\"type\":\"session_meta\",\"id\":\"x\"}\n",
+            "{\"type\":\"message\",\"role\":\"user\",\"content\":[]}\n",
+            "{\"role\":\"assistant\",\"content\":[]}\n",
+            "{\"role\":\"assistant\""
+        );
+        let messages = parse_session_messages(text).unwrap();
+        assert_eq!(messages.len(), 2);
+    }
+
+    #[test]
+    fn session_parser_rejects_middle_corruption() {
+        let text = concat!(
+            "{\"role\":\"user\",\"content\":[]}\n",
+            "{not-json}\n",
+            "{\"role\":\"assistant\",\"content\":[]}\n"
+        );
+        let error = parse_session_messages(text).unwrap_err();
+        assert!(error.contains("line 2"), "got {error}");
+    }
+
     #[test]
     fn skill_info_serializes_camel_case() {
         let v = serde_json::to_value(SkillInfo {
diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs
index 866d119..ed42f40 100644
--- a/apps/desktop/src-tauri/src/lib.rs
+++ b/apps/desktop/src-tauri/src/lib.rs
@@ -24,7 +24,9 @@ use commands::{
 };
 use snapshots::session_snapshots;
 use tauri::Manager;
-use tools::{tool_bash, tool_edit, tool_glob, tool_grep, tool_read, tool_write};
+use tools::{
+    tool_bash, tool_bash_cancel, tool_edit, tool_glob, tool_grep, tool_read, tool_write, BashState,
+};
 use voice::{voice_cancel, voice_start, voice_status, voice_stop, VoiceState};
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
@@ -37,6 +39,7 @@ pub fn run() {
         .plugin(tauri_plugin_updater::Builder::new().build())
         .plugin(tauri_plugin_process::init())
         .manage(VoiceState::default())
+        .manage(BashState::default())
         .invoke_handler(tauri::generate_handler![
             get_app_info,
             read_credentials,
@@ -62,6 +65,7 @@ pub fn run() {
             tool_write,
             tool_edit,
             tool_bash,
+            tool_bash_cancel,
             tool_glob,
             tool_grep,
             session_snapshots,
diff --git a/apps/desktop/src-tauri/src/tools.rs b/apps/desktop/src-tauri/src/tools.rs
index 3f43c07..f2eee17 100644
--- a/apps/desktop/src-tauri/src/tools.rs
+++ b/apps/desktop/src-tauri/src/tools.rs
@@ -5,10 +5,12 @@
 
 use crate::snapshots;
 use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
 use std::path::Path;
 use std::process::Stdio;
 use tokio::io::AsyncReadExt;
 use tokio::process::Command;
+use tokio::sync::{oneshot, Mutex};
 
 // ──────────────────────────────────────────────────────────────────────────
 // Snapshot capture
@@ -240,10 +242,42 @@ pub struct BashOk {
     pub stderr: String,
     pub exit_code: i32,
     pub timed_out: bool,
+    pub cancelled: bool,
 }
 
+#[derive(Default)]
+pub struct BashState {
+    // `Some(sender)` is running; `None` records an abort that raced ahead of
+    // command registration so the process never escapes cancellation.
+    active: Mutex<HashMap<String, Option<oneshot::Sender<()>>>>,
+}
+
+#[cfg(unix)]
+fn kill_process_group(pid: u32) {
+    // The shell is placed in its own process group below, so a negative PID
+    // terminates the shell and every descendant it spawned.
+    unsafe {
+        libc::kill(-(pid as i32), libc::SIGKILL);
+    }
+}
+
+#[cfg(not(unix))]
+fn kill_process_group(_pid: u32) {}
+
 #[tauri::command]
-pub async fn tool_bash(input: BashInput) -> Result<BashOk, String> {
+pub async fn tool_bash(
+    input: BashInput,
+    command_id: String,
+    state: tauri::State<'_, BashState>,
+) -> Result<BashOk, String> {
+    run_bash(input, command_id, &state).await
+}
+
+async fn run_bash(
+    input: BashInput,
+    command_id: String,
+    state: &BashState,
+) -> Result<BashOk, String> {
     let timeout = std::time::Duration::from_millis(input.timeout_ms.unwrap_or(120_000));
     let mut cmd = Command::new("/bin/sh");
     cmd.arg("-c").arg(&input.command);
@@ -251,8 +285,24 @@ pub async fn tool_bash(input: BashInput) -> Result<BashOk, String> {
         cmd.current_dir(cwd);
     }
     cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
+    #[cfg(unix)]
+    {
+        use std::os::unix::process::CommandExt;
+        cmd.as_std_mut().process_group(0);
+    }
 
     let mut child = cmd.spawn().map_err(|e| format!("spawn: {e}"))?;
+    let pid = child.id().ok_or("spawned process has no pid")?;
+    let (cancel_tx, mut cancel_rx) = oneshot::channel();
+    {
+        let mut active = state.active.lock().await;
+        if matches!(active.get(&command_id), Some(None)) {
+            active.remove(&command_id);
+            drop(cancel_tx);
+        } else {
+            active.insert(command_id.clone(), Some(cancel_tx));
+        }
+    }
     let mut stdout_pipe = child.stdout.take().ok_or("no stdout pipe")?;
     let mut stderr_pipe = child.stderr.take().ok_or("no stderr pipe")?;
 
@@ -268,31 +318,77 @@ pub async fn tool_bash(input: BashInput) -> Result<BashOk, String> {
         s
     });
 
-    let mut timed_out = false;
-    let exit_status = match tokio::time::timeout(timeout, child.wait()).await {
-        Ok(s) => s.map_err(|e| format!("wait: {e}"))?,
-        Err(_) => {
-            timed_out = true;
+    enum Finish {
+        Exited(std::io::Result<std::process::ExitStatus>),
+        TimedOut,
+        Cancelled,
+    }
+    let finish = tokio::select! {
+        status = child.wait() => Finish::Exited(status),
+        _ = tokio::time::sleep(timeout) => Finish::TimedOut,
+        _ = &mut cancel_rx => Finish::Cancelled,
+    };
+    state.active.lock().await.remove(&command_id);
+
+    let (exit_code, timed_out, cancelled) = match finish {
+        Finish::Exited(status) => (
+            status
+                .map_err(|e| format!("wait: {e}"))?
+                .code()
+                .unwrap_or(-1),
+            false,
+            false,
+        ),
+        Finish::TimedOut => {
+            kill_process_group(pid);
+            let _ = child.start_kill();
+            let _ = child.wait().await;
+            (124, true, false)
+        }
+        Finish::Cancelled => {
+            kill_process_group(pid);
             let _ = child.start_kill();
             let _ = child.wait().await;
-            return Ok(BashOk {
-                stdout: String::new(),
-                stderr: format!("timeout after {}ms", timeout.as_millis()),
-                exit_code: 124,
-                timed_out,
-            });
+            (130, false, true)
         }
     };
     let stdout = stdout_task.await.unwrap_or_default();
-    let stderr = stderr_task.await.unwrap_or_default();
+    let mut stderr = stderr_task.await.unwrap_or_default();
+    if timed_out {
+        stderr.push_str(&format!("\ntimeout after {}ms", timeout.as_millis()));
+    }
+    if cancelled {
+        stderr.push_str("\naborted by user");
+    }
     Ok(BashOk {
         stdout,
         stderr,
-        exit_code: exit_status.code().unwrap_or(-1),
+        exit_code,
         timed_out,
+        cancelled,
     })
 }
 
+#[tauri::command]
+pub async fn tool_bash_cancel(
+    command_id: String,
+    state: tauri::State<'_, BashState>,
+) -> Result<bool, String> {
+    Ok(cancel_bash(command_id, &state).await)
+}
+
+async fn cancel_bash(command_id: String, state: &BashState) -> bool {
+    let mut active = state.active.lock().await;
+    match active.remove(&command_id) {
+        Some(Some(cancel)) => cancel.send(()).is_ok(),
+        Some(None) => true,
+        None => {
+            active.insert(command_id, None);
+            true
+        }
+    }
+}
+
 // ──────────────────────────────────────────────────────────────────────────
 // Glob (filesystem pattern match)
 // ──────────────────────────────────────────────────────────────────────────
@@ -454,17 +550,59 @@ mod casing_tests {
             stderr: String::new(),
             exit_code: 0,
             timed_out: false,
+            cancelled: false,
         })
         .unwrap();
         let k = keys(&v);
         // The exit-code badge bug: renderer compares r.exitCode !== 0.
         assert!(k.contains(&"exitCode".to_string()), "got {k:?}");
         assert!(k.contains(&"timedOut".to_string()), "got {k:?}");
+        assert!(k.contains(&"cancelled".to_string()), "got {k:?}");
         assert!(
             !k.contains(&"exit_code".to_string()),
             "snake_case leaked: {k:?}"
         );
     }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn bash_cancel_kills_descendants() {
+        use std::sync::Arc;
+
+        let root = std::env::temp_dir().join(format!(
+            "dc-rust-bash-cancel-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        std::fs::create_dir_all(&root).unwrap();
+        let marker = root.join("orphan-marker.txt");
+        let command = format!("(sleep 0.4; echo orphan > '{}') & wait", marker.display());
+        let state = Arc::new(BashState::default());
+        let run_state = state.clone();
+        let task = tokio::spawn(async move {
+            run_bash(
+                BashInput {
+                    command,
+                    cwd: Some(root.to_string_lossy().to_string()),
+                    timeout_ms: Some(5_000),
+                },
+                "cancel-test".to_string(),
+                &run_state,
+            )
+            .await
+        });
+
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        assert!(cancel_bash("cancel-test".to_string(), &state).await);
+        let result = task.await.unwrap().unwrap();
+        assert!(result.cancelled);
+        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+        assert!(!marker.exists(), "descendant survived cancellation");
+        let _ = std::fs::remove_dir_all(marker.parent().unwrap());
+    }
 }
 
 // ── snapshot capture path ───────────────────────────────────────────────
diff --git a/apps/desktop/src/lib/mac-agent.ts b/apps/desktop/src/lib/mac-agent.ts
index a0c6cda..034e286 100644
--- a/apps/desktop/src/lib/mac-agent.ts
+++ b/apps/desktop/src/lib/mac-agent.ts
@@ -203,7 +203,7 @@ export async function startAgentTurn(args: StartTurnArgs): Promise<StartTurnResu
         temperature: effortParams.temperature,
         cwd: args.cwd ?? '/',
         signal: abort.signal,
-        mode: args.mode,
+        mode: args.mode ?? 'default',
         // Disable system reminders in the renderer — they require node:fs
         // (reads todos.json + stats files). The Mac UI surfaces those
         // contextually elsewhere.
diff --git a/apps/desktop/src/lib/mac-tools.ts b/apps/desktop/src/lib/mac-tools.ts
index 033b1bb..7c69f23 100644
--- a/apps/desktop/src/lib/mac-tools.ts
+++ b/apps/desktop/src/lib/mac-tools.ts
@@ -13,6 +13,8 @@ import { invoke } from '@tauri-apps/api/core';
 import type { ToolHandler, ToolResult } from '@deepcode/core/dist/types.js';
 import { getActiveSessionId } from './mac-session.js';
 
+let bashCommandSeq = 0;
+
 /**
  * Tolerant key pick — accepts either snake_case or camelCase. DeepSeek
  * occasionally normalizes JSON Schema keys to camelCase regardless of
@@ -218,24 +220,44 @@ export const MacBashTool: ToolHandler = {
       required: ['command'],
     },
   },
-  async execute(input: Record<string, unknown>): Promise<ToolResult> {
+  async execute(input: Record<string, unknown>, ctx): Promise<ToolResult> {
     try {
       const command = pickStr(input, 'command', 'cmd');
       if (!command) {
         return { content: 'Error: missing command', isError: true };
       }
-      const r = (await invoke('tool_bash', {
-        input: {
-          command,
-          cwd: pickStr(input, 'cwd', 'working_dir'),
-          timeout_ms: pickNum(input, 'timeout_ms', 'timeoutMs', 'timeout'),
-        },
-      })) as { stdout: string; stderr: string; exitCode: number; timedOut: boolean };
+      if (ctx.signal?.aborted) {
+        return { content: 'aborted by user', isError: true };
+      }
+      const commandId = `bash-${Date.now().toString(36)}-${bashCommandSeq++}`;
+      const onAbort = (): void => {
+        void invoke('tool_bash_cancel', { commandId });
+      };
+      ctx.signal?.addEventListener('abort', onAbort, { once: true });
+      let r: {
+        stdout: string;
+        stderr: string;
+        exitCode: number;
+        timedOut: boolean;
+        cancelled: boolean;
+      };
+      try {
+        r = (await invoke('tool_bash', {
+          commandId,
+          input: {
+            command,
+            cwd: pickStr(input, 'cwd', 'working_dir'),
+            timeout_ms: pickNum(input, 'timeout_ms', 'timeoutMs', 'timeout'),
+          },
+        })) as typeof r;
+      } finally {
+        ctx.signal?.removeEventListener('abort', onAbort);
+      }
       const combined = (r.stdout || '') + (r.stderr ? `\n[stderr]\n${r.stderr}` : '');
       return {
         content: combined || `(no output, exit ${r.exitCode})`,
-        data: { exitCode: r.exitCode, timedOut: r.timedOut },
-        isError: r.exitCode !== 0,
+        data: { exitCode: r.exitCode, timedOut: r.timedOut, cancelled: r.cancelled },
+        isError: r.exitCode !== 0 || r.cancelled,
       };
     } catch (err) {
       return { content: `Error: ${(err as Error).message ?? String(err)}`, isError: true };
diff --git a/apps/lsp/src/handler.test.ts b/apps/lsp/src/handler.test.ts
index 6c2b404..d365019 100644
--- a/apps/lsp/src/handler.test.ts
+++ b/apps/lsp/src/handler.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { handleMessage, type LspMessage } from './handler.js';
+import { __test, handleMessage, type LspMessage } from './handler.js';
 
 describe('handleMessage — initialize', () => {
   it('returns capabilities + serverInfo + supported commands', async () => {
@@ -102,6 +102,26 @@ describe('handleMessage — executeCommand', () => {
     expect((out[0]!.result as { aborted: boolean }).aborted).toBe(false);
   });
 
+  it('deepcode.abort aborts the active turn controller', async () => {
+    const controller = new AbortController();
+    __test.state.activeTurns.set('active-turn', controller);
+    const out: LspMessage[] = [];
+
+    await handleMessage(
+      {
+        jsonrpc: '2.0',
+        id: 41,
+        method: 'workspace/executeCommand',
+        params: { command: 'deepcode.abort', arguments: [{ turnId: 'active-turn' }] },
+      },
+      (m) => out.push(m),
+    );
+
+    expect((out[0]!.result as { aborted: boolean }).aborted).toBe(true);
+    expect(controller.signal.aborted).toBe(true);
+    __test.state.activeTurns.delete('active-turn');
+  });
+
   it('errors on unknown command', async () => {
     const out: LspMessage[] = [];
     await handleMessage(
diff --git a/apps/lsp/src/handler.ts b/apps/lsp/src/handler.ts
index 94dee15..1651cb4 100644
--- a/apps/lsp/src/handler.ts
+++ b/apps/lsp/src/handler.ts
@@ -16,13 +16,13 @@ interface ServerState {
   initialized: boolean;
   /** Workspace root URI from initialize. */
   rootUri?: string;
-  /** In-flight turn IDs so /abort can cancel them. */
-  activeTurns: Set<string>;
+  /** In-flight turn controllers so /abort cancels provider and tools. */
+  activeTurns: Map<string, AbortController>;
 }
 
 const state: ServerState = {
   initialized: false,
-  activeTurns: new Set(),
+  activeTurns: new Map(),
 };
 
 const SERVER_INFO = {
@@ -116,7 +116,8 @@ async function handleRunAgent(
 ): Promise<{ turnId: string }> {
   if (!args.prompt) throw new Error('prompt is required');
   const turnId = `lsp-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
-  state.activeTurns.add(turnId);
+  const abortController = new AbortController();
+  state.activeTurns.set(turnId, abortController);
 
   // Stream events back via JSON-RPC notifications.
   // Wired to the real agent loop — same code that drives the CLI / Mac client.
@@ -133,7 +134,7 @@ async function handleRunAgent(
       const [
         { runAgent },
         { DeepSeekProvider },
-        { ToolRegistry, BUILTIN_TOOLS },
+        { ToolRegistry, BUILTIN_TOOLS, SAFE_READONLY_TOOLS },
         { resolveCredentials, CredentialsStore },
       ] = await Promise.all([
         import('@deepcode/core').then((m) => ({ runAgent: m.runAgent })),
@@ -141,6 +142,7 @@ async function handleRunAgent(
         import('@deepcode/core').then((m) => ({
           ToolRegistry: m.ToolRegistry,
           BUILTIN_TOOLS: m.BUILTIN_TOOLS,
+          SAFE_READONLY_TOOLS: m.SAFE_READONLY_TOOLS,
         })),
         import('@deepcode/core').then((m) => ({
           resolveCredentials: m.resolveCredentials,
@@ -168,6 +170,9 @@ async function handleRunAgent(
         userMessage: args.prompt!,
         model: args.model ?? 'deepseek-chat',
         cwd: state.rootUri ? new URL(state.rootUri).pathname : process.cwd(),
+        signal: abortController.signal,
+        mode: 'default',
+        permissions: { allow: [...SAFE_READONLY_TOOLS] },
         onEvent: (e) => {
           send({
             jsonrpc: '2.0',
@@ -207,8 +212,10 @@ async function handleRunAgent(
 
 function handleAbort(args: { turnId?: string }): { aborted: boolean } {
   if (!args.turnId) throw new Error('turnId is required');
-  const had = state.activeTurns.delete(args.turnId);
-  return { aborted: had };
+  const controller = state.activeTurns.get(args.turnId);
+  if (!controller) return { aborted: false };
+  controller.abort();
+  return { aborted: true };
 }
 
 async function handleListSkills(): Promise<{ skills: unknown[] }> {
diff --git a/apps/vscode/src/extension.ts b/apps/vscode/src/extension.ts
index 9fc5f16..3ccd089 100644
--- a/apps/vscode/src/extension.ts
+++ b/apps/vscode/src/extension.ts
@@ -96,6 +96,8 @@ async function runAgent(
       userMessage,
       model: 'deepseek-chat',
       cwd,
+      mode: 'default',
+      permissions: { allow: [...core.SAFE_READONLY_TOOLS] },
       onEvent: (e) => {
         if (e.type === 'text_delta') out.append(e.text);
         else if (e.type === 'tool_use') out.appendLine(`\n[${e.name}] ${formatInput(e.input)}`);
@@ -162,6 +164,8 @@ class ChatViewProvider implements vscode.WebviewViewProvider {
         userMessage: msg.text,
         model: 'deepseek-chat',
         cwd: this.vscodeMod.workspace.workspaceFolders?.[0]?.uri.fsPath ?? process.cwd(),
+        mode: 'default',
+        permissions: { allow: [...core.SAFE_READONLY_TOOLS] },
         onEvent: (e) => {
           if (e.type === 'text_delta') {
             buffer += e.text;
diff --git a/packages/core/src/agent.test.ts b/packages/core/src/agent.test.ts
index bca01a4..6e24040 100644
--- a/packages/core/src/agent.test.ts
+++ b/packages/core/src/agent.test.ts
@@ -3,7 +3,7 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { runAgent } from './agent.js';
+import { runAgent as runAgentCore, type RunAgentOptions } from './agent.js';
 import { HookDispatcher } from './hooks/index.js';
 import { SessionManager } from './sessions/index.js';
 import { ToolRegistry } from './tools/registry.js';
@@ -16,6 +16,13 @@ import type {
 } from './types.js';
 import type { Provider, ProviderResult, ProviderRunOpts } from './providers/types.js';
 
+type TestRunAgentOptions = Omit<RunAgentOptions, 'mode'> & { mode?: RunAgentOptions['mode'] };
+
+/** Most loop tests predate policy dispatch and focus on orchestration behavior. */
+function runAgent(opts: TestRunAgentOptions) {
+  return runAgentCore({ mode: 'bypassPermissions', ...opts });
+}
+
 /**
  * MockProvider — pulls scripted responses from a queue, allowing fully deterministic
  * agent loop tests with no real API calls.
@@ -119,6 +126,12 @@ describe('runAgent', () => {
     expect(toolEvents).toHaveLength(1);
     const resultEvents = events.filter((e) => e.type === 'tool_result');
     expect(resultEvents).toHaveLength(1);
+    const steps = events.filter((e) => e.type === 'model_step_complete');
+    expect(steps).toHaveLength(2);
+    expect(steps.map((event) => event.step)).toEqual([1, 2]);
+    const completed = events.filter((e) => e.type === 'turn_complete');
+    expect(completed).toHaveLength(1);
+    expect(completed[0]).toMatchObject({ stopReason: 'end_turn' });
   });
 
   it('handles unknown tool gracefully', async () => {
@@ -190,6 +203,104 @@ describe('runAgent', () => {
     expect(result.turnsUsed).toBe(0);
   });
 
+  it('classifies a provider AbortError as an aborted run', async () => {
+    const ac = new AbortController();
+    let markEntered!: () => void;
+    const entered = new Promise<void>((resolve) => {
+      markEntered = resolve;
+    });
+    const provider: Provider = {
+      name: 'abortable',
+      runTurn: async () => {
+        markEntered();
+        await new Promise<void>((_resolve, reject) => {
+          ac.signal.addEventListener(
+            'abort',
+            () => reject(Object.assign(new Error('cancelled'), { name: 'AbortError' })),
+            { once: true },
+          );
+        });
+        throw new Error('unreachable');
+      },
+    };
+    const pending = runAgent({
+      provider,
+      tools: new ToolRegistry(),
+      systemPrompt: '',
+      userMessage: 'go',
+      model: 'deepseek-chat',
+      cwd,
+      signal: ac.signal,
+    });
+    await entered;
+    ac.abort();
+    await expect(pending).resolves.toMatchObject({ stopReason: 'aborted', turnsUsed: 1 });
+  });
+
+  it('fails safe for a legacy caller that omits mode and permissions', async () => {
+    const provider = new MockProvider([
+      toolUse('writing', {
+        type: 'tool_use',
+        id: 'write-1',
+        name: 'Write',
+        input: { file_path: 'blocked.txt', content: 'must not exist' },
+      }),
+      endTurn('done'),
+    ]);
+
+    const result = await runAgentCore({
+      provider,
+      tools: new ToolRegistry(),
+      systemPrompt: '',
+      userMessage: 'write a file',
+      model: 'deepseek-chat',
+      cwd,
+    } as RunAgentOptions);
+
+    expect(result.stopReason).toBe('end_turn');
+    await expect(fs.access(join(cwd, 'blocked.txt'))).rejects.toThrow();
+    const toolResult = result.history
+      .flatMap((message) => message.content)
+      .find((block) => block.type === 'tool_result');
+    expect(toolResult).toMatchObject({ is_error: true });
+  });
+
+  it('aborts while an approval prompt is pending', async () => {
+    const ac = new AbortController();
+    let approvalStarted!: () => void;
+    const started = new Promise<void>((resolve) => {
+      approvalStarted = resolve;
+    });
+    const provider = new MockProvider([
+      toolUse('writing', {
+        type: 'tool_use',
+        id: 'write-pending',
+        name: 'Write',
+        input: { file_path: 'pending.txt', content: 'must not exist' },
+      }),
+    ]);
+
+    const pending = runAgentCore({
+      provider,
+      tools: new ToolRegistry(),
+      systemPrompt: '',
+      userMessage: 'write a file',
+      model: 'deepseek-chat',
+      cwd,
+      signal: ac.signal,
+      mode: 'default',
+      approval: async () => {
+        approvalStarted();
+        return new Promise<boolean>(() => {});
+      },
+    });
+    await started;
+    ac.abort();
+
+    await expect(pending).resolves.toMatchObject({ stopReason: 'aborted', turnsUsed: 1 });
+    await expect(fs.access(join(cwd, 'pending.txt'))).rejects.toThrow();
+  });
+
   it('persists messages and captures snapshots when session is provided', async () => {
     await fs.writeFile(join(cwd, 'edit-me.txt'), 'before');
     const sessionMgr = new SessionManager({ root: sessionsRoot });
diff --git a/packages/core/src/agent.ts b/packages/core/src/agent.ts
index 9d81cc6..4f972ed 100644
--- a/packages/core/src/agent.ts
+++ b/packages/core/src/agent.ts
@@ -8,6 +8,7 @@ import { TaskManager, type TaskRunner } from './tasks/manager.js';
 import type { HookDispatcher } from './hooks/index.js';
 import type { Mode } from './types.js';
 import type { Provider } from './providers/types.js';
+import { resolveRuntimePolicy } from './runtime/index.js';
 // NOTE: reminders + sessions are lazy-loaded inside the loop so a browser
 // build (Tauri renderer) that doesn't use them avoids pulling node:fs at
 // module-load time. See `loadRemindersIfEnabled` and `appendSessionIfSet`.
@@ -60,9 +61,8 @@ export interface RunAgentOptions {
   session?: { manager: SessionManager; id: string };
   /** Optional: snapshot files before/after Edit/Write tool calls. */
   enableSnapshots?: boolean;
-  /** M3: dispatch gates (mode + permissions + hooks). When set, every tool call
-   *  goes through the gate. When unset, all tool calls are allowed (M1 behavior). */
-  mode?: Mode;
+  /** Required dispatch mode. Every tool call goes through the central gate. */
+  mode: Mode;
   permissions?: PermissionRules;
   hooks?: HookDispatcher;
   approval?: ApprovalCallback;
@@ -141,6 +141,35 @@ export interface RunAgentResult {
 
 const DEFAULT_MAX_TURNS = 16;
 
+async function waitForApproval(
+  approval: ApprovalCallback,
+  toolName: string,
+  toolInput: Record<string, unknown>,
+  verdict: DispatchVerdict,
+  signal?: AbortSignal,
+): Promise<ApprovalDecision> {
+  if (!signal) return approval(toolName, toolInput, verdict);
+  if (signal.aborted) return false;
+
+  return new Promise<ApprovalDecision>((resolve, reject) => {
+    let settled = false;
+    const finish = (decision: ApprovalDecision): void => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener('abort', onAbort);
+      resolve(decision);
+    };
+    const onAbort = (): void => finish(false);
+    signal.addEventListener('abort', onAbort, { once: true });
+    Promise.resolve(approval(toolName, toolInput, verdict)).then(finish, (error: unknown) => {
+      if (settled) return;
+      settled = true;
+      signal.removeEventListener('abort', onAbort);
+      reject(error);
+    });
+  });
+}
+
 /**
  * Tools with no side effects whose results don't depend on each other — safe to
  * execute concurrently within a single turn. Everything else (Edit/Write/Bash/
@@ -155,6 +184,7 @@ const READ_ONLY_TOOLS = new Set(['Read', 'Grep', 'Glob', 'WebFetch', 'WebSearch'
  */
 export async function runAgent(opts: RunAgentOptions): Promise<RunAgentResult> {
   const maxTurns = opts.maxTurns ?? DEFAULT_MAX_TURNS;
+  const runtimePolicy = resolveRuntimePolicy(opts);
   let history: StoredMessage[] = [...(opts.history ?? [])];
   let snapshotSeq = (await opts.session?.manager.snapshots(opts.session.id))?.length ?? 0;
 
@@ -291,8 +321,8 @@ export async function runAgent(opts: RunAgentOptions): Promise<RunAgentResult> {
         // A background task passes its own signal so TaskStop can cancel just
         // that task; foreground sub-agents inherit the main run's signal.
         signal: signal ?? opts.signal,
-        mode: opts.mode,
-        permissions: opts.permissions,
+        mode: runtimePolicy.mode,
+        permissions: runtimePolicy.permissions,
         hooks: opts.hooks,
         sandboxConfig: opts.sandboxConfig,
         autoMode: opts.autoMode,
@@ -420,15 +450,16 @@ export async function runAgent(opts: RunAgentOptions): Promise<RunAgentResult> {
     }
   };
 
+  const finish = async (stopReason: RunAgentResult['stopReason']): Promise<RunAgentResult> => {
+    await fireStop(stopReason);
+    const message = [...history].reverse().find((candidate) => candidate.role === 'assistant');
+    opts.onEvent?.({ type: 'turn_complete', stopReason, message });
+    return { history, turnsUsed, usage: totalUsage, stopReason, modeSignal };
+  };
+
   for (let turn = 0; turn < maxTurns; turn++) {
     if (opts.signal?.aborted) {
-      return {
-        history,
-        turnsUsed,
-        usage: totalUsage,
-        stopReason: 'aborted',
-        modeSignal,
-      };
+      return finish('aborted');
     }
 
     turnsUsed++;
@@ -450,9 +481,12 @@ export async function runAgent(opts: RunAgentOptions): Promise<RunAgentResult> {
         },
       });
     } catch (err) {
+      if (opts.signal?.aborted || (err as { name?: string }).name === 'AbortError') {
+        return finish('aborted');
+      }
       const message = (err as Error).message ?? 'unknown';
       opts.onEvent?.({ type: 'error', error: message });
-      return { history, turnsUsed, usage: totalUsage, stopReason: 'error', modeSignal };
+      return finish('error');
     }
 
     totalUsage.inputTokens += result.usage.inputTokens;
@@ -475,7 +509,7 @@ export async function runAgent(opts: RunAgentOptions): Promise<RunAgentResult> {
     history.push(assistantMsg);
     if (opts.session) await opts.session.manager.append(opts.session.id, assistantMsg);
 
-    opts.onEvent?.({ type: 'turn_complete', message: assistantMsg });
+    opts.onEvent?.({ type: 'model_step_complete', step: turnsUsed, message: assistantMsg });
 
     // Emit any tool_use events
     for (const block of result.content) {
@@ -491,8 +525,7 @@ export async function runAgent(opts: RunAgentOptions): Promise<RunAgentResult> {
 
     // If no tool calls, we're done
     if (result.stopReason !== 'tool_use') {
-      await fireStop('end_turn');
-      return { history, turnsUsed, usage: totalUsage, stopReason: 'end_turn', modeSignal };
+      return finish('end_turn');
     }
 
     // Execute tool calls and append a single user-role message with tool_result
@@ -522,42 +555,49 @@ export async function runAgent(opts: RunAgentOptions): Promise<RunAgentResult> {
         continue;
       }
 
-      // M3: dispatch gate (mode + permissions + PreToolUse hook)
-      if (opts.mode) {
-        const verdict = await dispatchToolCall({
-          tool: toolUse.name,
-          input: toolUse.input,
-          mode: opts.mode,
-          rules: opts.permissions,
-          hooks: opts.hooks,
-          cwd: opts.cwd,
-          autoMode: opts.autoMode,
-          autoModeProvider: opts.provider,
-        });
-        let allowed = verdict.decision === 'allow';
-        if (verdict.decision === 'ask' && opts.approval) {
-          const decision = await opts.approval(toolUse.name, toolUse.input, verdict);
-          // 'always' = host has (or will) persist a matcher; treat as allow-this-call.
-          allowed = decision === true || decision === 'always';
-        }
-        if (!allowed) {
-          resultsById.set(toolUse.id, {
-            type: 'tool_result',
-            tool_use_id: toolUse.id,
-            content: `Tool call blocked: ${verdict.reason}`,
-            is_error: true,
-          });
-          opts.onEvent?.({
-            type: 'tool_result',
-            id: toolUse.id,
-            result: {
-              content: verdict.reason,
-              isError: true,
-              data: { dispatchSource: verdict.source, decision: verdict.decision },
-            },
-          });
-          continue;
+      // Every call goes through the central mode + permissions + hook gate.
+      const verdict = await dispatchToolCall({
+        tool: toolUse.name,
+        input: toolUse.input,
+        mode: runtimePolicy.mode,
+        rules: runtimePolicy.permissions,
+        hooks: opts.hooks,
+        cwd: opts.cwd,
+        autoMode: opts.autoMode,
+        autoModeProvider: opts.provider,
+      });
+      let allowed = verdict.decision === 'allow';
+      if (verdict.decision === 'ask' && opts.approval) {
+        const decision = await waitForApproval(
+          opts.approval,
+          toolUse.name,
+          toolUse.input,
+          verdict,
+          opts.signal,
+        );
+        if (opts.signal?.aborted) {
+          return finish('aborted');
         }
+        // 'always' = host has (or will) persist a matcher; treat as allow-this-call.
+        allowed = decision === true || decision === 'always';
+      }
+      if (!allowed) {
+        resultsById.set(toolUse.id, {
+          type: 'tool_result',
+          tool_use_id: toolUse.id,
+          content: `Tool call blocked: ${verdict.reason}`,
+          is_error: true,
+        });
+        opts.onEvent?.({
+          type: 'tool_result',
+          id: toolUse.id,
+          result: {
+            content: verdict.reason,
+            isError: true,
+            data: { dispatchSource: verdict.source, decision: verdict.decision },
+          },
+        });
+        continue;
       }
 
       ready.push({ toolUse, handler });
@@ -718,8 +758,7 @@ export async function runAgent(opts: RunAgentOptions): Promise<RunAgentResult> {
     }
   }
 
-  await fireStop('max_turns');
-  return { history, turnsUsed, usage: totalUsage, stopReason: 'max_turns', modeSignal };
+  return finish('max_turns');
 }
 
 export const AGENT_MODULE_VERSION = '0.1.0';
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index a685970..f0028e7 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -58,6 +58,8 @@ export {
   SessionManager,
   defaultSessionsDir,
   newSessionId,
+  readSessionRecords,
+  SessionCorruptionError,
   captureSnapshot,
   captureGitCheckpoint,
   listSnapshots,
@@ -65,6 +67,9 @@ export {
   type SessionMeta,
   type SessionFiles,
   type SessionManagerOpts,
+  type SessionDiagnostic,
+  type SessionFormat,
+  type SessionReadResult,
   type Snapshot,
 } from './sessions/index.js';
 
@@ -172,6 +177,14 @@ export {
 // Agent loop's approval callback type (M3b)
 export type { ApprovalCallback, ApprovalDecision } from './agent.js';
 
+// Runtime safety policy shared by non-interactive hosts.
+export {
+  SAFE_DEFAULT_PERMISSIONS,
+  SAFE_READONLY_TOOLS,
+  resolveRuntimePolicy,
+  type RuntimePolicyInput,
+} from './runtime/index.js';
+
 // Skills (M4 — SKILL.md frontmatter loading + system-prompt builder; M5 — Skill tool)
 export {
   loadSkills,
diff --git a/packages/core/src/ipc/protocol.ts b/packages/core/src/ipc/protocol.ts
index c7adf47..a7630f7 100644
--- a/packages/core/src/ipc/protocol.ts
+++ b/packages/core/src/ipc/protocol.ts
@@ -4,7 +4,7 @@
 // Goals:
 //   1. Type-safe channel names + payload shapes (no string-typed `ipc.invoke`).
 //   2. Stream agent events (text_delta / tool_use / tool_result / usage /
-//      turn_complete / error) one-way from main → renderer.
+//      model_step_complete / turn_complete / error) one-way from main → renderer.
 //   3. Same shape works for the future web SDK if we host the agent loop
 //      out-of-process (just swap the transport).
 //
diff --git a/packages/core/src/runtime/index.ts b/packages/core/src/runtime/index.ts
new file mode 100644
index 0000000..2fc289a
--- /dev/null
+++ b/packages/core/src/runtime/index.ts
@@ -0,0 +1,6 @@
+export {
+  SAFE_DEFAULT_PERMISSIONS,
+  SAFE_READONLY_TOOLS,
+  resolveRuntimePolicy,
+  type RuntimePolicyInput,
+} from './policy.js';
diff --git a/packages/core/src/runtime/policy.ts b/packages/core/src/runtime/policy.ts
new file mode 100644
index 0000000..7ce3403
--- /dev/null
+++ b/packages/core/src/runtime/policy.ts
@@ -0,0 +1,43 @@
+import type { PermissionRules } from '../config/types.js';
+import type { Mode } from '../types.js';
+
+/**
+ * Tools that a host without an approval UI may safely expose by default.
+ * Unknown, write-capable, and extension-provided tools intentionally do not
+ * appear here, so they resolve to `ask` and are blocked when no approval
+ * callback is installed.
+ */
+export const SAFE_READONLY_TOOLS = Object.freeze([
+  'Read',
+  'Grep',
+  'Glob',
+  'WebFetch',
+  'WebSearch',
+  'AskUserQuestion',
+  'ExitPlanMode',
+  'ToolSearch',
+] as const);
+
+export const SAFE_DEFAULT_PERMISSIONS: Readonly<PermissionRules> = Object.freeze({
+  allow: [...SAFE_READONLY_TOOLS],
+});
+
+export interface RuntimePolicyInput {
+  mode?: Mode;
+  permissions?: PermissionRules;
+}
+
+/**
+ * Runtime fallback for untyped/legacy callers. Typed callers must still pass
+ * `mode`, but JavaScript and stale integrations fail safe instead of silently
+ * bypassing the dispatcher.
+ */
+export function resolveRuntimePolicy(input: RuntimePolicyInput): {
+  mode: Mode;
+  permissions: PermissionRules;
+} {
+  return {
+    mode: input.mode ?? 'default',
+    permissions: input.permissions ?? { allow: [...SAFE_READONLY_TOOLS] },
+  };
+}
diff --git a/packages/core/src/sessions/index.ts b/packages/core/src/sessions/index.ts
index bd70931..db140c4 100644
--- a/packages/core/src/sessions/index.ts
+++ b/packages/core/src/sessions/index.ts
@@ -7,8 +7,13 @@ export type { SessionManagerOpts } from './manager.js';
 export {
   defaultSessionsDir,
   newSessionId,
+  readSessionRecords,
+  SessionCorruptionError,
   type SessionMeta,
   type SessionFiles,
+  type SessionDiagnostic,
+  type SessionFormat,
+  type SessionReadResult,
 } from './storage.js';
 export {
   captureSnapshot,
diff --git a/packages/core/src/sessions/storage.test.ts b/packages/core/src/sessions/storage.test.ts
index a903716..f02d0bb 100644
--- a/packages/core/src/sessions/storage.test.ts
+++ b/packages/core/src/sessions/storage.test.ts
@@ -1,4 +1,4 @@
-import { mkdtemp, rm } from 'node:fs/promises';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
@@ -8,6 +8,8 @@ import {
   newSessionId,
   readMessages,
   readMeta,
+  readSessionRecords,
+  SessionCorruptionError,
   sessionFiles,
   writeMeta,
 } from './storage.js';
@@ -67,6 +69,72 @@ describe('session storage', () => {
     expect(await readMessages(root, 'nope')).toEqual([]);
   });
 
+  it('reads desktop header + typed message JSONL without changing its bytes', async () => {
+    const id = 'desktop-old';
+    const path = sessionFiles(root, id).jsonlPath;
+    const original = [
+      JSON.stringify({
+        type: 'session_meta',
+        id,
+        cwd: '/desktop',
+        created_at: 1_767_225_600,
+        title: 'Legacy desktop',
+      }),
+      JSON.stringify({
+        type: 'message',
+        role: 'user',
+        content: [{ type: 'text', text: 'hello from desktop' }],
+        timestamp: '2026-01-01T00:00:01.000Z',
+      }),
+      '',
+    ].join('\n');
+    await writeFile(path, original, 'utf8');
+
+    const parsed = await readSessionRecords(root, id);
+    expect(parsed.format).toBe('desktop-v0');
+    expect(parsed.meta).toMatchObject({ id, cwd: '/desktop', title: 'Legacy desktop' });
+    expect(parsed.messages).toHaveLength(1);
+    expect(await readFile(path, 'utf8')).toBe(original);
+    await expect(readMeta(root, id)).resolves.toMatchObject({ id, cwd: '/desktop' });
+  });
+
+  it('tolerates only an incomplete final JSONL record', async () => {
+    const id = 'truncated-tail';
+    await writeFile(
+      sessionFiles(root, id).jsonlPath,
+      `${JSON.stringify({ role: 'user', content: [{ type: 'text', text: 'complete' }] })}\n{"role":"assistant"`,
+      'utf8',
+    );
+
+    const parsed = await readSessionRecords(root, id);
+    expect(parsed.messages).toHaveLength(1);
+    expect(parsed.diagnostics).toEqual([
+      expect.objectContaining({ line: 2, code: 'truncated_tail', fatal: false }),
+    ]);
+    await expect(readMessages(root, id)).resolves.toHaveLength(1);
+  });
+
+  it('reports middle corruption instead of silently dropping history', async () => {
+    const id = 'middle-corrupt';
+    await writeFile(
+      sessionFiles(root, id).jsonlPath,
+      [
+        JSON.stringify({ role: 'user', content: [{ type: 'text', text: 'before' }] }),
+        '{not-json}',
+        JSON.stringify({ role: 'assistant', content: [{ type: 'text', text: 'after' }] }),
+        '',
+      ].join('\n'),
+      'utf8',
+    );
+
+    const parsed = await readSessionRecords(root, id);
+    expect(parsed.messages).toHaveLength(2);
+    expect(parsed.diagnostics).toEqual([
+      expect.objectContaining({ line: 2, code: 'invalid_json', fatal: true }),
+    ]);
+    await expect(readMessages(root, id)).rejects.toBeInstanceOf(SessionCorruptionError);
+  });
+
   it('listSessions sorts newest first', async () => {
     await writeMeta(root, {
       id: 'a',
@@ -84,6 +152,22 @@ describe('session storage', () => {
     expect(list.map((s) => s.id)).toEqual(['b', 'a']);
   });
 
+  it('listSessions includes desktop-only JSONL sessions', async () => {
+    await writeFile(
+      sessionFiles(root, 'desktop-list').jsonlPath,
+      `${JSON.stringify({
+        type: 'session_meta',
+        id: 'desktop-list',
+        cwd: '/desktop',
+        created_at: 1_767_225_600,
+      })}\n`,
+      'utf8',
+    );
+    await expect(listSessions(root)).resolves.toEqual([
+      expect.objectContaining({ id: 'desktop-list', cwd: '/desktop' }),
+    ]);
+  });
+
   it('sessionFiles returns sensible paths', () => {
     const f = sessionFiles('/root', 'abc');
     expect(f.metaPath).toBe('/root/abc.meta.json');
diff --git a/packages/core/src/sessions/storage.ts b/packages/core/src/sessions/storage.ts
index 6e1faf1..18330fc 100644
--- a/packages/core/src/sessions/storage.ts
+++ b/packages/core/src/sessions/storage.ts
@@ -2,12 +2,42 @@
 // Each line is one StoredMessage envelope.
 // Spec: docs/DEVELOPMENT_PLAN.md §3.5
 
-import { promises as fs, createReadStream } from 'node:fs';
+import { promises as fs } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { createInterface } from 'node:readline';
 import type { StoredMessage } from '../types.js';
 
+export type SessionFormat = 'core-v0' | 'desktop-v0' | 'empty';
+
+export interface SessionDiagnostic {
+  line: number;
+  code: 'truncated_tail' | 'invalid_json' | 'invalid_message';
+  message: string;
+  fatal: boolean;
+}
+
+export interface SessionReadResult {
+  format: SessionFormat;
+  meta: SessionMeta | null;
+  messages: StoredMessage[];
+  diagnostics: SessionDiagnostic[];
+}
+
+export class SessionCorruptionError extends Error {
+  constructor(
+    readonly sessionId: string,
+    readonly diagnostics: SessionDiagnostic[],
+  ) {
+    super(
+      `Session ${sessionId} is corrupted at ${diagnostics
+        .filter((d) => d.fatal)
+        .map((d) => `line ${d.line}: ${d.message}`)
+        .join('; ')}`,
+    );
+    this.name = 'SessionCorruptionError';
+  }
+}
+
 export interface SessionMeta {
   id: string;
   cwd: string;
@@ -47,7 +77,9 @@ export async function readMeta(root: string, sessionId: string): Promise<Session
     const raw = await fs.readFile(files.metaPath, 'utf8');
     return JSON.parse(raw) as SessionMeta;
   } catch (err) {
-    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
+      return (await readSessionRecords(root, sessionId)).meta;
+    }
     throw err;
   }
 }
@@ -63,23 +95,141 @@ export async function appendMessage(
 }
 
 export async function readMessages(root: string, sessionId: string): Promise<StoredMessage[]> {
+  const result = await readSessionRecords(root, sessionId);
+  const fatal = result.diagnostics.filter((diagnostic) => diagnostic.fatal);
+  if (fatal.length > 0) throw new SessionCorruptionError(sessionId, fatal);
+  return result.messages;
+}
+
+function isStoredMessage(value: unknown): value is StoredMessage {
+  if (!value || typeof value !== 'object') return false;
+  const record = value as Record<string, unknown>;
+  return (record.role === 'user' || record.role === 'assistant') && Array.isArray(record.content);
+}
+
+function desktopMeta(value: Record<string, unknown>, updatedAt: string): SessionMeta | null {
+  if (value.type !== 'session_meta' || typeof value.id !== 'string') return null;
+  const createdAt =
+    typeof value.created_at === 'number'
+      ? new Date(value.created_at * 1000).toISOString()
+      : typeof value.created_at === 'string'
+        ? value.created_at
+        : updatedAt;
+  return {
+    id: value.id,
+    cwd: typeof value.cwd === 'string' ? value.cwd : '',
+    createdAt,
+    updatedAt,
+    model: typeof value.model === 'string' ? value.model : undefined,
+    title: typeof value.title === 'string' ? value.title : undefined,
+  };
+}
+
+/** Parse both historical JSONL layouts without modifying either one. */
+export async function readSessionRecords(
+  root: string,
+  sessionId: string,
+): Promise<SessionReadResult> {
   const files = sessionFiles(root, sessionId);
+  let raw: string;
+  let updatedAt: string;
   try {
-    await fs.access(files.jsonlPath);
-  } catch {
-    return [];
+    const [text, stat] = await Promise.all([
+      fs.readFile(files.jsonlPath, 'utf8'),
+      fs.stat(files.jsonlPath),
+    ]);
+    raw = text;
+    updatedAt = stat.mtime.toISOString();
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return { format: 'empty', meta: null, messages: [], diagnostics: [] };
+    }
+    throw error;
   }
-  const out: StoredMessage[] = [];
-  const rl = createInterface({ input: createReadStream(files.jsonlPath, { encoding: 'utf8' }) });
-  for await (const line of rl) {
+
+  const lines = raw.split('\n');
+  let lastContentIndex = -1;
+  for (let index = lines.length - 1; index >= 0; index--) {
+    if (lines[index]!.trim().length > 0) {
+      lastContentIndex = index;
+      break;
+    }
+  }
+  const messages: StoredMessage[] = [];
+  const diagnostics: SessionDiagnostic[] = [];
+  let meta: SessionMeta | null = null;
+  let format: SessionFormat = 'empty';
+
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index]!;
     if (!line.trim()) continue;
+    let value: unknown;
     try {
-      out.push(JSON.parse(line) as StoredMessage);
-    } catch {
-      // skip malformed lines (forward-compat)
+      value = JSON.parse(line);
+    } catch (error) {
+      const isTruncatedTail = index === lastContentIndex && !raw.endsWith('\n');
+      diagnostics.push({
+        line: index + 1,
+        code: isTruncatedTail ? 'truncated_tail' : 'invalid_json',
+        message: isTruncatedTail
+          ? 'ignored an incomplete final JSONL record'
+          : `invalid JSON: ${(error as Error).message}`,
+        fatal: !isTruncatedTail,
+      });
+      continue;
+    }
+    if (!value || typeof value !== 'object') {
+      diagnostics.push({
+        line: index + 1,
+        code: 'invalid_message',
+        message: 'record must be a JSON object',
+        fatal: true,
+      });
+      continue;
     }
+
+    const record = value as Record<string, unknown>;
+    if (record.type === 'session_meta') {
+      format = 'desktop-v0';
+      meta ??= desktopMeta(record, updatedAt);
+      continue;
+    }
+    if (record.type === 'message') {
+      format = 'desktop-v0';
+      if (isStoredMessage(record)) {
+        messages.push({
+          role: record.role,
+          content: record.content,
+          timestamp: typeof record.timestamp === 'string' ? record.timestamp : undefined,
+        });
+      } else {
+        diagnostics.push({
+          line: index + 1,
+          code: 'invalid_message',
+          message: 'message record has an invalid role or content array',
+          fatal: true,
+        });
+      }
+      continue;
+    }
+    if (record.type === undefined) {
+      format = 'core-v0';
+      if (isStoredMessage(record)) messages.push(record);
+      else {
+        diagnostics.push({
+          line: index + 1,
+          code: 'invalid_message',
+          message: 'bare record has an invalid role or content array',
+          fatal: true,
+        });
+      }
+      continue;
+    }
+    // Unknown typed records are reserved for forward-compatible lifecycle
+    // items. They are not messages and are intentionally ignored.
   }
-  return out;
+
+  return { format, meta, messages, diagnostics };
 }
 
 export async function listSessions(root: string): Promise<SessionMeta[]> {
@@ -89,12 +239,15 @@ export async function listSessions(root: string): Promise<SessionMeta[]> {
     return [];
   }
   const entries = await fs.readdir(root);
-  const metaFiles = entries.filter((f) => f.endsWith('.meta.json'));
+  const ids = new Set<string>();
+  for (const entry of entries) {
+    if (entry.endsWith('.meta.json')) ids.add(entry.slice(0, -'.meta.json'.length));
+    else if (entry.endsWith('.jsonl')) ids.add(entry.slice(0, -'.jsonl'.length));
+  }
   const metas = await Promise.all(
-    metaFiles.map(async (f) => {
+    [...ids].map(async (id) => {
       try {
-        const raw = await fs.readFile(join(root, f), 'utf8');
-        return JSON.parse(raw) as SessionMeta;
+        return await readMeta(root, id);
       } catch {
         return null;
       }
diff --git a/packages/core/src/tools/bash.test.ts b/packages/core/src/tools/bash.test.ts
index b52ae08..71b33bc 100644
--- a/packages/core/src/tools/bash.test.ts
+++ b/packages/core/src/tools/bash.test.ts
@@ -1,5 +1,5 @@
 import type { ChildProcess } from 'node:child_process';
-import { mkdtemp, rm } from 'node:fs/promises';
+import { access, mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Readable } from 'node:stream';
@@ -48,6 +48,23 @@ describe('BashTool', () => {
     expect(r.content).toMatch(/killed by timeout/i);
   }, 5000);
 
+  it('aborts the foreground process tree', async () => {
+    if (process.platform === 'win32') return;
+    const marker = join(tmp, 'orphan-marker.txt');
+    const ac = new AbortController();
+    const pending = BashTool.execute(
+      { command: `(sleep 0.4; echo orphan > "${marker}") & wait`, timeout: 5_000 },
+      { cwd: tmp, signal: ac.signal },
+    );
+    setTimeout(() => ac.abort(), 50);
+
+    const result = await pending;
+    expect(result.isError).toBe(true);
+    expect(result.content).toMatch(/aborted by user/i);
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    await expect(access(marker)).rejects.toThrow();
+  }, 5000);
+
   it('run_in_background returns immediately with a log path that fills in', async () => {
     const r = await BashTool.execute(
       { command: 'echo bg-output-here', run_in_background: true },
diff --git a/packages/core/src/tools/bash.ts b/packages/core/src/tools/bash.ts
index 36d3313..3b8c5dd 100644
--- a/packages/core/src/tools/bash.ts
+++ b/packages/core/src/tools/bash.ts
@@ -6,7 +6,7 @@
 //   that can't be set up (e.g. can't bind the DNS proxy on :53), fail CLOSED to
 //   deny-all-net rather than running unrestricted.
 
-import { spawn } from 'node:child_process';
+import { spawn, type ChildProcess } from 'node:child_process';
 import { promises as fs } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
@@ -39,6 +39,7 @@ type SandboxCtx = ToolContext & {
 
 const DEFAULT_TIMEOUT_MS = 120_000; // 2 minutes
 const MAX_OUTPUT_BYTES = 30_000;
+type TerminationReason = 'timeout' | 'aborted';
 
 // Monotonic suffix so two background spawns in the same millisecond from the
 // same pid don't collide on a log filename.
@@ -54,7 +55,7 @@ function capStream(s: string, label: string): string {
 function summarize(
   stdout: string,
   stderr: string,
-  killed: boolean,
+  terminationReason: TerminationReason | undefined,
   code: number | null,
   timeoutMs: number,
   note?: string,
@@ -63,15 +64,39 @@ function summarize(
   if (note) parts.push(note);
   if (stdout) parts.push(`<stdout>\n${stdout}\n</stdout>`);
   if (stderr) parts.push(`<stderr>\n${stderr}\n</stderr>`);
-  if (killed) parts.push(`[killed by timeout after ${timeoutMs}ms]`);
+  if (terminationReason === 'timeout') parts.push(`[killed by timeout after ${timeoutMs}ms]`);
+  if (terminationReason === 'aborted') parts.push('[aborted by user]');
   parts.push(`exit: ${code ?? 'unknown'}`);
   return {
     content: parts.join('\n'),
-    data: { exitCode: code, killed, stdoutBytes: stdout.length, stderrBytes: stderr.length },
-    isError: killed || (code !== null && code !== 0),
+    data: {
+      exitCode: code,
+      killed: terminationReason !== undefined,
+      terminationReason,
+      stdoutBytes: stdout.length,
+      stderrBytes: stderr.length,
+    },
+    isError: terminationReason !== undefined || (code !== null && code !== 0),
   };
 }
 
+/** Kill the whole foreground process group on POSIX, not just its shell. */
+function killProcessTree(child: ChildProcess, signal: NodeJS.Signals): void {
+  if (process.platform !== 'win32' && child.pid !== undefined) {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {
+      // The group may already have exited; fall back to the direct child.
+    }
+  }
+  try {
+    child.kill(signal);
+  } catch {
+    // Process already exited.
+  }
+}
+
 /**
  * Foreground run under the slirp4netns selective-network sandbox. Rejects with
  * NetworkSandboxUnavailable if setup fails (caller falls back to deny-all-net).
@@ -87,7 +112,7 @@ async function runForegroundNet(
   return new Promise<ToolResult>((resolve) => {
     let stdout = '';
     let stderr = '';
-    let killed = false;
+    let terminationReason: TerminationReason | undefined;
     let settled = false;
     const finish = (r: ToolResult): void => {
       if (!settled) {
@@ -96,11 +121,11 @@ async function runForegroundNet(
       }
     };
     const timer = setTimeout(() => {
-      killed = true;
+      terminationReason = 'timeout';
       void handle.close();
     }, timeoutMs);
     const onAbort = (): void => {
-      killed = true;
+      terminationReason = 'aborted';
       void handle.close();
     };
     ctx.signal?.addEventListener('abort', onAbort, { once: true });
@@ -114,7 +139,7 @@ async function runForegroundNet(
       .then((code) => {
         clearTimeout(timer);
         ctx.signal?.removeEventListener('abort', onAbort);
-        finish(summarize(stdout, stderr, killed, code, timeoutMs));
+        finish(summarize(stdout, stderr, terminationReason, code, timeoutMs));
       })
       .catch((err: unknown) => {
         clearTimeout(timer);
@@ -153,6 +178,13 @@ export const BashTool: ToolHandler = {
     if (!input?.command || typeof input.command !== 'string') {
       return { content: 'Error: command is required (string).', isError: true };
     }
+    if (ctx.signal?.aborted) {
+      return {
+        content: '[aborted by user]',
+        isError: true,
+        data: { terminationReason: 'aborted' },
+      };
+    }
     const timeoutMs = Math.max(1_000, input.timeout ?? DEFAULT_TIMEOUT_MS);
 
     // M3.5: wrap under platform sandbox if configured. ctx.sandboxConfig is
@@ -239,20 +271,33 @@ export const BashTool: ToolHandler = {
     return new Promise((resolvePromise) => {
       const child = spawn(wrapped.command, wrapped.args, {
         cwd: ctx.cwd,
-        signal: ctx.signal,
+        detached: process.platform !== 'win32',
       });
       let stdout = '';
       let stderr = '';
-      let killed = false;
-      const timer = setTimeout(() => {
-        killed = true;
-        // SIGKILL + destroy pipes — on Ubuntu CI, dash leaves orphaned children
-        // whose inherited stdout/stderr fds keep `close` from firing on the
-        // parent. Destroying the pipes forces close.
-        child.kill('SIGKILL');
+      let terminationReason: TerminationReason | undefined;
+      let settled = false;
+      const finish = (result: ToolResult): void => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        ctx.signal?.removeEventListener('abort', onAbort);
+        resolvePromise(result);
+      };
+      const terminate = (reason: TerminationReason): void => {
+        if (terminationReason) return;
+        terminationReason = reason;
+        killProcessTree(child, 'SIGKILL');
+        // Descendants can inherit these descriptors; destroying them also
+        // prevents an orphan from keeping the Promise open indefinitely.
         child.stdout?.destroy();
         child.stderr?.destroy();
+      };
+      const timer = setTimeout(() => {
+        terminate('timeout');
       }, timeoutMs);
+      const onAbort = (): void => terminate('aborted');
+      ctx.signal?.addEventListener('abort', onAbort, { once: true });
 
       child.stdout.on('data', (chunk: Buffer) => {
         stdout = capStream(stdout + chunk.toString('utf8'), 'stdout');
@@ -262,16 +307,14 @@ export const BashTool: ToolHandler = {
       });
 
       child.on('error', (err) => {
-        clearTimeout(timer);
-        resolvePromise({
+        finish({
           content: `Error spawning command: ${err.message}`,
           isError: true,
         });
       });
 
       child.on('close', (code) => {
-        clearTimeout(timer);
-        resolvePromise(summarize(stdout, stderr, killed, code, timeoutMs, failNote));
+        finish(summarize(stdout, stderr, terminationReason, code, timeoutMs, failNote));
       });
     });
   },
diff --git a/packages/core/src/types.ts b/packages/core/src/types.ts
index f49507d..5e9fbb7 100644
--- a/packages/core/src/types.ts
+++ b/packages/core/src/types.ts
@@ -181,7 +181,14 @@ export type AgentEvent =
   | { type: 'thinking_delta'; text: string }
   | { type: 'tool_use'; id: string; name: string; input: Record<string, unknown> }
   | { type: 'tool_result'; id: string; result: ToolResult }
-  | { type: 'turn_complete'; message: StoredMessage }
+  /** One provider round-trip completed; a user turn may contain many steps. */
+  | { type: 'model_step_complete'; step: number; message: StoredMessage }
+  /** The whole user turn reached one terminal state. Emitted exactly once. */
+  | {
+      type: 'turn_complete';
+      stopReason: 'end_turn' | 'max_turns' | 'aborted' | 'error';
+      message?: StoredMessage;
+    }
   | {
       type: 'usage';
       inputTokens: number;
diff --git a/packages/core/src/worktree/index.test.ts b/packages/core/src/worktree/index.test.ts
index c20edbf..f47e52f 100644
--- a/packages/core/src/worktree/index.test.ts
+++ b/packages/core/src/worktree/index.test.ts
@@ -73,6 +73,22 @@ describe('createWorktree / removeWorktree', () => {
     expect(await fs.readFile(join(h.path, 'a.txt'), 'utf8')).toBe('A');
     await removeWorktree(h);
     await expect(fs.access(h.path)).rejects.toThrow();
+    const branch = spawnSync('git', ['-C', src, 'rev-parse', '--verify', h.branch], {
+      encoding: 'utf8',
+      env: cleanGitEnv(),
+    });
+    expect(branch.status).toBe(0);
+  });
+
+  it('refuses to remove a dirty worktree', async () => {
+    const h = await createWorktree({ source: src, parentDir: parent });
+    const changed = join(h.path, 'a.txt');
+    await fs.writeFile(changed, 'unsaved work');
+
+    await expect(removeWorktree(h)).rejects.toThrow(/worktree remove/);
+    expect(await fs.readFile(changed, 'utf8')).toBe('unsaved work');
+
+    runOrFail('git', ['worktree', 'remove', '--force', h.path], src);
   });
 
   it('honors baseRef from config', async () => {
diff --git a/packages/core/src/worktree/index.ts b/packages/core/src/worktree/index.ts
index ba24fec..ab1483f 100644
--- a/packages/core/src/worktree/index.ts
+++ b/packages/core/src/worktree/index.ts
@@ -20,6 +20,8 @@ export interface WorktreeHandle {
   branch: string;
   /** Source repo path. */
   source: string;
+  /** Untracked symlinks created by DeepCode and safe to unlink on removal. */
+  managedSymlinks?: string[];
 }
 
 export interface CreateWorktreeOpts {
@@ -57,6 +59,7 @@ export async function createWorktree(opts: CreateWorktreeOpts): Promise<Worktree
   }
 
   // Symlinks: e.g. node_modules → source/node_modules
+  const managedSymlinks: string[] = [];
   for (const dir of opts.config?.symlinkDirectories ?? []) {
     const src = join(source, dir);
     const dst = join(path, dir);
@@ -71,14 +74,16 @@ export async function createWorktree(opts: CreateWorktreeOpts): Promise<Worktree
       /* ignore */
     }
     await fs.symlink(src, dst, 'dir');
+    managedSymlinks.push(dst);
   }
 
-  return { path, branch, source };
+  return { path, branch, source, managedSymlinks };
 }
 
 /**
- * Remove a worktree (git worktree remove + delete the branch).
+ * Remove a clean worktree while retaining its branch for recovery or review.
  * Idempotent: silently no-ops if path is already gone.
+ * Dirty or untracked worktrees are rejected by Git and left intact.
  */
 export async function removeWorktree(handle: WorktreeHandle): Promise<void> {
   try {
@@ -86,12 +91,17 @@ export async function removeWorktree(handle: WorktreeHandle): Promise<void> {
   } catch {
     return;
   }
-  runGit(handle.source, ['worktree', 'remove', '--force', handle.path]);
-  // Delete the branch (best-effort)
-  spawnSync('git', ['-C', handle.source, 'branch', '-D', handle.branch], {
-    stdio: 'pipe',
-    env: gitSpawnEnv(),
-  });
+  // These are the only untracked paths DeepCode itself creates. Remove them
+  // only if they are still symlinks; a user-replaced directory/file is data and
+  // must make the subsequent clean-worktree check fail.
+  for (const path of handle.managedSymlinks ?? []) {
+    try {
+      if ((await fs.lstat(path)).isSymbolicLink()) await fs.unlink(path);
+    } catch {
+      // Missing or unreadable managed link: let Git perform the final check.
+    }
+  }
+  runGit(handle.source, ['worktree', 'remove', handle.path]);
 }
 
 function runGit(cwd: string, args: string[]): void {