silas 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f804f46eccb34c27515be306e2697345f3be7e0ad3479aeafb05f3ca9e5e54b
-  data.tar.gz: 63a99caaeebb60133423d0d73669eff7074232262743764ec0d9d7d38f7b2012
+  metadata.gz: 187a0730a1a84463f6207060d446c6960946513c0884d708fc0d16c011493a26
+  data.tar.gz: ed9a09b617c7dde80deaf6fe2c460e254cc96487b43eac52f56c6aa7dedecbaa
 SHA512:
-  metadata.gz: bb45b5ca774d80cdd2c584851114204eb123dd714a94264a851699ea24955fa8eefba4b1897e1924a91a484f64c9746bc625e007652fdc8a71e096425e7a9882
-  data.tar.gz: 707d7857de1f2fba1e4e9327e9c32f71e7282c4dd2cfe739cb6aea98904cc805634f0ce70fd4353c5d580ea9f521d79e9581621d8f9b321216e9e00c058ba3b8
+  metadata.gz: a38278a7020a9282b1ff9aaac7b18da60bd017a001bcc421c6e316d0033b1a4b468cd86c0d4bcdcd869940f7d9c4b953318e84dd626087bef4fee1ee8ea8b87c
+  data.tar.gz: 6f42e1a81bf935ebdbb39c678e46662ab85b9f45bd8293c0e83f4467e7db922e2102087ab62ea7eb8e8b1b3b1d323eba1a5772e997028b3e5838882bda9cfeb3

data/CHANGELOG.md

@@ -1,6 +1,66 @@
 # Changelog
 
-## 0.2.0 (unreleased)
+## 0.3.0
+
+- **`bin/rails silas:doctor`** — every known first-run failure mode as one
+  command: provider key, queue adapter (async = red), model resolution with
+  prices, migrations, tool validation, the rescuer recurring entry, the cable
+  adapter for live streaming (async cable can't carry worker deltas), and
+  whether the deny-by-default inbox/API auth has been wired. Exits non-zero
+  on failures, so it slots into CI.
+- **Hard-removed the 0.2 `:agent_sdk` config shims** — `config.auth` and
+  `config.agent_sdk_*` now raise `NoMethodError` (they were warning no-ops
+  for the 0.2 cycle). `config.engine = :agent_sdk` still raises the
+  explanatory `BootGuardError`. Workflows now use `actions/checkout@v5`
+  (Node 20 deprecation).
+- **Inbox at scale + the promised top-up card.** Budget-parked turns now
+  render a **"Budget reached — raise & resume"** card (the UI the 0.1.5
+  changelog promised): one field, one click, `raise_budget!`, completed work
+  replays from rows. The session list pages by keyset (`?before=<id>`, 50 per
+  page — the old hard `limit(100)` made session 101 unreachable forever), and
+  the index renders in **2 queries** instead of ~4 per card.
+- **Cost accounting prices itself from RubyLLM's model registry** (1,100+
+  models, refreshed upstream from models.dev) instead of a five-entry
+  hand-maintained map. Steps stamp the **provider** RubyLLM resolves at
+  persist time, and lookups use the two-arg `find(model, provider)` — 85/1081
+  registry ids exist under multiple providers at different prices, so the
+  bare lookup could silently price the wrong one. `config.model_prices` is
+  now an **override map** (default `{}`) for fine-tunes, custom deployments,
+  and models newer than the installed registry; unknown models stay
+  `unpriced`, never a lying $0.00. Dropped the write-only
+  `silas_turns.cost_microcents` column (declared since 0.1.0, never
+  populated). Default model is now `claude-sonnet-4-5` — in every supported
+  registry, unlike `claude-sonnet-5` (absent from ruby_llm 1.16's shipped
+  registry, which would have broken first runs), and never the priciest
+  model. New migration: `bin/rails silas:install:migrations db:migrate`.
+- **Structured final answers.** Declare a JSON schema under `final_answer:` in
+  agent.yml and the turn's answer comes back as a parsed Hash —
+  `Turn#answer_data` (alongside `answer_text` for prose agents), in the API
+  (`answer_data` on turns, `structured` on steps), the inbox trace, the REPL,
+  and a new `assert_answer_data` eval assertion. Implemented on RubyLLM's
+  `with_schema` (each provider's native structured-output dialect). The schema
+  is model-visible state: it folds into the definitions digest **only when
+  present** — schema-less agents keep a byte-identical digest, so turns parked
+  across the upgrade never trip `NondeterminismError` (pinned by spec); a
+  mid-turn schema change fails loudly by design. Structured answers replay
+  into later turns' history as their JSON text (deterministic).
+
+- **A public HTTP + SSE session API** at `/silas/api/v1` — sessions
+  (create/show, `?trace=1` for the full transcript), turns (create — **409**
+  while one is active — and cancel), and approvals (list / approve / decline,
+  the exact same `approve!`/`decline!` as every other surface, stamped with
+  `config.api_actor`). Deny-by-default via `config.api_auth`, the inbox's
+  contract. `GET .../sessions/:id/stream` is server-sent events at row
+  granularity (turn / completed-step / invocation changes) with
+  `Last-Event-ID` resume — at-least-once, epoch-ms watermark ids, `?poll=1`
+  for a curl-friendly backlog-and-close, self-closing after
+  `api_stream_max_duration` with a `timeout` reconnect event. The AR
+  connection is released between polls; per-token streaming remains the
+  Turbo/browser feature (deltas live in the worker process; the gem takes no
+  cross-process bus dependency). `Session` gains `parent_session` /
+  `child_sessions` associations, and session JSON carries the lineage.
+
+## 0.2.0
 
 - **Token streaming, end to end.** The engine seam's `&on_event` block — dead
   code since 0.1.0 — is live: the `:ruby_llm` engine streams the model

data/README.md

@@ -33,6 +33,7 @@ app/agent/
 bundle add silas
 bin/rails generate silas:install
 bin/rails db:migrate
+bin/rails silas:doctor   # key · queue adapter · model · migrations · tools · rescuer · cable · auth
 ```
 
 ```ruby
@@ -209,6 +210,49 @@ zero risk to the durability contract. Custom sinks subscribe to the
 text: }`, where `text` is the accumulated string so far — filter by ids;
 notifications are process-global).
 
+## Structured answers
+
+Give the turn's final answer a schema in agent.yml and read it back as a Hash:
+
+```yaml
+final_answer:
+  type: object
+  properties:
+    verdict: { type: string }
+    amount_pence: { type: integer }
+  required: [verdict]
+```
+
+`Turn#answer_data` returns the parsed payload (`answer_text` stays for prose
+agents); the HTTP API carries it as `answer_data`, evals get
+`assert_answer_data(key: :verdict, value: "approve")`. Rendered through
+RubyLLM's `with_schema`, so each provider's native structured-output mode is
+used. The schema is model-visible state — changing it mid-turn fails the turn
+loudly rather than resuming into a different contract.
+
+## The HTTP API
+
+Everything the operator surface can do, over JSON — mounted with the engine at
+`/silas/api/v1`, **deny-by-default** like the inbox (wire `config.api_auth`;
+`config.api_actor` names the identity recorded on approvals):
+
+```sh
+curl -X POST .../silas/api/v1/sessions -d "input=Refund order 42, £12.50"
+curl .../silas/api/v1/sessions/1?trace=1                # turns + steps + tool calls
+curl .../silas/api/v1/sessions/1/approvals              # what's parked
+curl -X POST .../silas/api/v1/approvals/7/approve       # the same approve! as the inbox
+curl -X POST .../silas/api/v1/sessions/1/turns -d "input=Now email them"   # 409 if busy
+curl -X POST .../silas/api/v1/turns/9/cancel
+curl -N .../silas/api/v1/sessions/1/stream              # server-sent events
+```
+
+The stream is SSE at **row granularity** — turn / completed-step / invocation
+changes, at-least-once with `Last-Event-ID` resume (ids are epoch-ms
+watermarks; `?poll=1` returns the backlog and closes, curl-friendly; streams
+close themselves after `api_stream_max_duration` and clients reconnect).
+Per-token streaming is deliberately the browser/Turbo feature — deltas live in
+the worker process, and the gem requires no cross-process bus.
+
 ## The inbox
 
 Mount the engine (the generator does this) and a live inbox appears at

data/app/controllers/concerns/silas/api/serialization.rb

@@ -0,0 +1,63 @@
+module Silas
+  module Api
+    # Minimal, dependency-free JSON shapes. Deliberately explicit allowlists —
+    # never as_json a whole row (instruction snapshots and internal columns
+    # don't belong on the wire).
+    module Serialization
+      def session_json(session, include_turns: true, trace: false)
+        base = {
+          id: session.id, agent_name: session.agent_name,
+          channel: session.channel, status: session.status,
+          parent_session_id: session.parent_session_id,
+          child_session_ids: session.child_sessions.ids,
+          cost: Silas::Inbox::Cost.for_session(session),
+          created_at: session.created_at, updated_at: session.updated_at
+        }
+        return base unless include_turns
+
+        base.merge(turns: session.turns.map { |t| turn_json(t, trace: trace) })
+      end
+
+      def turn_json(turn, trace: false)
+        base = {
+          id: turn.id, session_id: turn.session_id, index: turn.index,
+          status: turn.status, input: turn.input,
+          failure_reason: turn.failure_reason,
+          answer_text: (turn.answer_text if turn.completed?),
+          answer_data: (turn.answer_data if turn.completed?),
+          created_at: turn.created_at, updated_at: turn.updated_at
+        }
+        return base unless trace
+
+        base.merge(steps: turn.steps.map do |step|
+          step_json(step).merge(invocations: step.tool_invocations.map { |i| invocation_json(i) })
+        end)
+      end
+
+      def step_json(step)
+        {
+          id: step.id, turn_id: step.turn_id, index: step.index,
+          status: step.status, terminal: step.terminal,
+          model: step.model, provider: step.provider,
+          text: Array(step.response_blocks).select { |b| b["type"] == "text" }
+                                           .map { |b| b["text"] }.join.presence,
+          structured: Array(step.response_blocks).reverse
+                                                 .find { |b| b["type"] == "structured" }&.dig("data"),
+          updated_at: step.updated_at
+        }
+      end
+
+      def invocation_json(invocation)
+        {
+          id: invocation.id, turn_id: invocation.turn_id,
+          tool_name: invocation.tool_name, status: invocation.status,
+          approval_state: invocation.approval_state,
+          arguments: invocation.arguments, result: invocation.result,
+          error: invocation.error, approved_by: invocation.approved_by,
+          decline_reason: invocation.decline_reason,
+          updated_at: invocation.updated_at
+        }
+      end
+    end
+  end
+end

data/app/controllers/silas/api/base_controller.rb

@@ -0,0 +1,24 @@
+module Silas
+  module Api
+    # JSON API base: ActionController::API (no CSRF, no layouts, no cookies),
+    # deny-by-default auth with the inbox's contract — the host lambda DENIES
+    # by rendering (or head-ing) and PASSES by not rendering.
+    class BaseController < ActionController::API
+      before_action :authenticate!
+
+      rescue_from ActiveRecord::RecordNotFound do
+        render json: { error: "not found" }, status: :not_found
+      end
+
+      private
+
+      def authenticate!
+        Silas.config.api_auth.call(self)
+      end
+
+      def current_actor
+        Silas.config.api_actor.call(self)
+      end
+    end
+  end
+end

data/app/controllers/silas/api/v1/approvals_controller.rb

@@ -0,0 +1,35 @@
+module Silas
+  module Api
+    module V1
+      # The headline feature over HTTP: list what's parked, approve or decline
+      # it — the exact same approve!/decline! as the inbox, Slack, and email.
+      class ApprovalsController < Silas::Api::BaseController
+        include Silas::Api::Serialization
+
+        # GET /silas/api/v1/sessions/:session_id/approvals
+        def index
+          session = Silas::Session.find(params[:session_id])
+          render json: { approvals: session.pending_approvals.order(:id).map { |i| invocation_json(i) } }
+        end
+
+        # POST /silas/api/v1/approvals/:id/approve
+        def approve
+          invocation = Silas::ToolInvocation.find(params[:id])
+          invocation.approve!(by: current_actor)
+          render json: invocation_json(invocation.reload)
+        rescue Silas::Error => e
+          render json: { error: e.message }, status: :conflict
+        end
+
+        # POST /silas/api/v1/approvals/:id/decline  { reason: (optional) }
+        def decline
+          invocation = Silas::ToolInvocation.find(params[:id])
+          invocation.decline!(reason: params[:reason].presence || "declined via api", by: current_actor)
+          render json: invocation_json(invocation.reload)
+        rescue Silas::Error => e
+          render json: { error: e.message }, status: :conflict
+        end
+      end
+    end
+  end
+end

data/app/controllers/silas/api/v1/sessions_controller.rb

@@ -0,0 +1,39 @@
+module Silas
+  module Api
+    module V1
+      class SessionsController < Silas::Api::BaseController
+        include Silas::Api::Serialization
+
+        # POST /silas/api/v1/sessions  { input:, agent: (optional), metadata: (optional) }
+        # channel stays nil ("direct") — API consumers read state via GET/stream;
+        # a non-nil channel would enqueue pointless outbound delivery jobs.
+        def create
+          input = params[:input].to_s.strip
+          return render json: { error: "input is required" }, status: :unprocessable_entity if input.empty?
+
+          handle = params[:agent].present? ? Silas.agent(params[:agent]) : Silas.agent
+          session = handle.start(input: input, metadata: metadata_param)
+          render json: session_json(session.reload), status: :created
+        rescue Silas::TurnInProgressError => e
+          render json: { error: e.message }, status: :conflict
+        rescue Silas::Error => e
+          render json: { error: e.message }, status: :unprocessable_entity
+        end
+
+        # GET /silas/api/v1/sessions/:id         — session + turns
+        # GET /silas/api/v1/sessions/:id?trace=1 — plus steps + invocations
+        def show
+          session = Silas::Session.includes(turns: { steps: :tool_invocations }).find(params[:id])
+          render json: session_json(session, trace: params[:trace].present?)
+        end
+
+        private
+
+        def metadata_param
+          raw = params[:metadata]
+          raw.respond_to?(:to_unsafe_h) ? raw.to_unsafe_h : (raw.presence || {})
+        end
+      end
+    end
+  end
+end

data/app/controllers/silas/api/v1/streams_controller.rb

@@ -0,0 +1,117 @@
+require "json"
+
+module Silas
+  module Api
+    module V1
+      # Server-sent events at ROW granularity: turn / completed-step /
+      # invocation changes polled from the durable rows — the same source of
+      # truth as everything else. Deliberately NOT per-token: deltas are
+      # emitted in the worker process and the gem requires no cross-process
+      # bus; per-token streaming is the Turbo/browser feature.
+      #
+      # Delivery is at-least-once with Last-Event-ID resume: event ids are
+      # epoch-millisecond watermarks, each poll re-reads a 1ms overlap, and
+      # clients dedup by (event type, id, status). `?poll=1` emits the backlog
+      # since Last-Event-ID and closes — curl-able, and how the request specs
+      # exercise the cursor without holding a live stream.
+      #
+      # Live actions run on their own thread and hold a Puma thread for the
+      # stream's lifetime — inherent to SSE. The AR connection is NOT held:
+      # each poll checks one out and returns it before sleeping, and the
+      # stream closes itself after api_stream_max_duration (clients reconnect
+      # with Last-Event-ID).
+      class StreamsController < Silas::Api::BaseController
+        include ActionController::Live
+        include Silas::Api::Serialization
+
+        HEARTBEAT_EVERY = 15 # seconds; comment-frames keep proxies alive
+
+        def show
+          session_id = with_connection { Silas::Session.find(params[:id]).id }
+
+          response.headers["Content-Type"] = "text/event-stream"
+          response.headers["Cache-Control"] = "no-cache"
+          response.headers["X-Accel-Buffering"] = "no" # nginx: never buffer SSE
+          # Whatever the router/auth checked out must not stay pinned for the
+          # stream's lifetime.
+          ActiveRecord::Base.connection_handler.clear_active_connections!
+
+          watermark = initial_watermark
+          deadline = clock + Silas.config.api_stream_max_duration
+          last_beat = clock
+
+          loop do
+            events = with_connection { collect_changes(session_id, watermark) }
+            events.each do |type, at, payload|
+              write_event(type, payload, watermark_ms(at))
+              watermark = at if at > watermark
+            end
+
+            break if params[:poll].present? # backlog served; close
+
+            if clock >= deadline
+              write_event("timeout", { reconnect: true }, watermark_ms(watermark))
+              break
+            end
+
+            if clock - last_beat >= HEARTBEAT_EVERY
+              response.stream.write(": hb\n\n")
+              last_beat = clock
+            end
+
+            sleep Silas.config.api_stream_poll_interval
+          end
+        rescue IOError, ActionController::Live::ClientDisconnected
+          # client went away — the normal end of an SSE stream
+        ensure
+          response.stream.close rescue nil
+        end
+
+        private
+
+        # Everything with updated_at at-or-after the watermark (1ms overlap —
+        # at-least-once beats a gap). Steps only when completed: their text is
+        # the payload, and incomplete steps have none.
+        def collect_changes(session_id, watermark)
+          overlap = watermark - 0.001
+          events = []
+
+          Silas::Turn.where(session_id: session_id).where(updated_at: overlap..)
+                     .order(:updated_at, :id).each do |turn|
+            events << [ "turn", turn.updated_at, turn_json(turn) ]
+          end
+          Silas::Step.joins(:turn).where(silas_turns: { session_id: session_id })
+                     .where(status: "completed").where(updated_at: overlap..)
+                     .order(:updated_at, :id).each do |step|
+            events << [ "step", step.updated_at, step_json(step) ]
+          end
+          Silas::ToolInvocation.joins(:turn).where(silas_turns: { session_id: session_id })
+                               .where(updated_at: overlap..)
+                               .order(:updated_at, :id).each do |invocation|
+            events << [ "invocation", invocation.updated_at, invocation_json(invocation) ]
+          end
+
+          events.sort_by { |(_type, at, _payload)| at }
+        end
+
+        def write_event(type, payload, id_ms)
+          response.stream.write("id: #{id_ms}\nevent: #{type}\ndata: #{JSON.generate(payload)}\n\n")
+        end
+
+        # Last-Event-ID (header or param) in epoch ms; absent -> "from now"
+        # (GET /sessions/:id carries current state; the stream carries what
+        # changes next). Last-Event-ID: 0 replays the whole session.
+        def initial_watermark
+          raw = request.headers["Last-Event-ID"].presence || params[:last_event_id].presence
+          raw ? Time.zone.at(raw.to_i / 1000.0) : Time.zone.now
+        end
+
+        def watermark_ms(time) = (time.to_f * 1000).round
+
+        def with_connection(&) = ActiveRecord::Base.connection_pool.with_connection(&)
+
+        def clock = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+  end
+end

data/app/controllers/silas/api/v1/turns_controller.rb

@@ -0,0 +1,32 @@
+module Silas
+  module Api
+    module V1
+      class TurnsController < Silas::Api::BaseController
+        include Silas::Api::Serialization
+
+        # POST /silas/api/v1/sessions/:session_id/turns  { input: }
+        # 409 when a turn is already active — an API must surface it, not
+        # swallow it the way the webhook channels do.
+        def create
+          session = Silas::Session.find(params[:session_id])
+          input = params[:input].to_s.strip
+          return render json: { error: "input is required" }, status: :unprocessable_entity if input.empty?
+
+          turn = session.continue(input: input)
+          render json: turn_json(turn), status: :created
+        rescue Silas::TurnInProgressError => e
+          render json: { error: e.message }, status: :conflict
+        end
+
+        # POST /silas/api/v1/turns/:id/cancel
+        # Running turns are flagged (honored at the next step boundary);
+        # queued/parked turns cancel immediately — cancel: reflects which.
+        def cancel
+          turn = Silas::Turn.find(params[:id])
+          outcome = turn.cancel!(reason: "canceled via api by #{current_actor}")
+          render json: turn_json(turn.reload).merge(cancel: outcome)
+        end
+      end
+    end
+  end
+end

data/app/controllers/silas/inbox/sessions_controller.rb

@@ -3,18 +3,31 @@ module Silas
     class SessionsController < BaseController
       before_action :authenticate_write!, only: :create
 
+      PER_PAGE = 50
+
       def index
-        @sessions = Silas::Session.order(created_at: :desc).limit(100)
-        @sessions = @sessions.where(agent_name: params[:agent]) if params[:agent].present?
+        # Keyset pagination on id (?before=<id> pages older), newest first.
+        scope = Silas::Session.order(id: :desc)
+        scope = scope.where(agent_name: params[:agent]) if params[:agent].present?
         if params[:pending].present? # the "N awaiting approval" badge drills into this
           # Subquery, not joins+distinct: DISTINCT over silas_sessions.* trips
           # on the json metadata column (PG json has no equality operator).
-          @sessions = @sessions.where(
+          scope = scope.where(
             id: Silas::Turn.joins(:tool_invocations)
                            .where(silas_tool_invocations: { approval_state: "required" })
                            .select(:session_id)
           )
         end
+        scope = scope.where(id: ...params[:before].to_i) if params[:before].present?
+
+        # One query for the rows + turns, one for the pending counts — the
+        # per-row active_turn/turns.last/counts pattern was ~4 queries a card.
+        @sessions = scope.limit(PER_PAGE).includes(:turns).to_a
+        @next_before = @sessions.last&.id if @sessions.size == PER_PAGE
+        @pending_counts = Silas::ToolInvocation.joins(:turn)
+                                               .where(approval_state: "required",
+                                                      silas_turns: { session_id: @sessions.map(&:id) })
+                                               .group("silas_turns.session_id").count
         @agent_names = Silas::Session.distinct.pluck(:agent_name).sort
         @pending_total = Silas::ToolInvocation.where(approval_state: "required").count
       end

data/app/controllers/silas/inbox/turns_controller.rb

@@ -27,6 +27,25 @@ module Silas
         notice = outcome == :cancel_requested ? "Cancel requested — honored at the next step boundary." : "Turn canceled."
         redirect_to inbox_session_path(turn.session_id), notice: notice
       end
+
+      # Top up a budget-parked turn and resume it — the CHANGELOG promised
+      # this card in 0.1.5; completed steps replay from rows, same as approvals.
+      def raise_budget
+        turn = Silas::Turn.find(params[:id])
+        unless turn.budget_parked?
+          return redirect_to inbox_session_path(turn.session_id),
+                             alert: "Turn ##{turn.index} is not budget-parked."
+        end
+
+        reason = turn.failure_reason.to_s
+        value = params[:value].to_s
+        numeric = reason == "max_cost" ? value.to_f : value.to_i
+
+        turn.raise_budget!(**{ reason.to_sym => numeric })
+        redirect_to inbox_session_path(turn.session_id), notice: "#{reason} raised — resuming."
+      rescue Silas::Error, ArgumentError => e
+        redirect_to inbox_session_path(turn.session_id), alert: e.message
+      end
     end
   end
 end

data/app/helpers/silas/inbox/trace_helper.rb

@@ -18,6 +18,11 @@ module Silas
         Array(step.response_blocks).select { |b| b["type"] == "text" }.map { |b| b["text"] }.join.presence
       end
 
+      # The final_answer payload, when the agent declared a schema.
+      def step_structured(step)
+        Array(step.response_blocks).reverse.find { |b| b["type"] == "structured" }&.dig("data")
+      end
+
       def pretty_args(hash)
         JSON.pretty_generate(hash || {})
       end

data/app/models/silas/session.rb

@@ -5,6 +5,12 @@ module Silas
     has_many :turns, -> { order(:index) }, class_name: "Silas::Turn", foreign_key: :session_id,
              inverse_of: :session, dependent: :destroy
 
+    # Delegations and handoffs stamp parent_session_id; without associations
+    # they surfaced as unexplained orphans.
+    belongs_to :parent_session, class_name: "Silas::Session", optional: true
+    has_many :child_sessions, class_name: "Silas::Session",
+             foreign_key: :parent_session_id, inverse_of: :parent_session
+
     validates :status, inclusion: { in: STATUSES }
     validates :agent_name, presence: true
 

data/app/models/silas/turn.rb

@@ -84,6 +84,15 @@ module Silas
       Array(step.response_blocks).select { |b| b["type"] == "text" }.map { |b| b["text"] }.join
     end
 
+    # The structured payload when the agent declares a final_answer schema in
+    # agent.yml (nil otherwise) — the parsed Hash, not a string to re-parse.
+    def answer_data
+      step = steps.where(status: "completed").order(:index).last
+      return nil unless step
+
+      Array(step.response_blocks).reverse.find { |b| b["type"] == "structured" }&.dig("data")
+    end
+
     # Outbound: when a channel-bound turn reaches an answer, deliver it off-loop.
     after_update_commit :notify_channel_answer, if: :should_notify_answer?
 

data/app/views/layouts/silas/inbox.html.erb

@@ -92,6 +92,12 @@
     .agent-filter .chip { font-size: 12px; padding: 3px 10px; border: 1px solid #d9dce1;
       border-radius: 999px; text-decoration: none; color: inherit; }
     .agent-filter .chip-on { background: #16181d; color: #fff; border-color: #16181d; }
+    .pager { text-align: center; margin: 16px 0; }
+    .pager .chip { font-size: 13px; padding: 6px 14px; border: 1px solid var(--line);
+      border-radius: 999px; text-decoration: none; color: inherit; }
+    .topup-form { display: flex; gap: 8px; margin-top: 8px; }
+    .topup-input { flex: 1; border: 1px solid var(--line); border-radius: 8px; padding: 8px 10px;
+      font: inherit; background: var(--panel); color: var(--ink); }
   </style>
 </head>
 <body>

data/app/views/silas/inbox/sessions/index.html.erb

@@ -37,15 +37,23 @@
     <%= link_to inbox_session_path(session), class: "card session-row" do %>
       <div class="row-top">
         <span class="name"><%= session.agent_name %></span>
-        <% if (turn = session.active_turn || session.turns.last) %><%= status_pill(turn.status) %><% end %>
-        <% pending = session.pending_approvals.count %>
+        <%# Loaded association — no per-row queries. %>
+        <% if (turn = session.turns.detect(&:active?) || session.turns.last) %><%= status_pill(turn.status) %><% end %>
+        <% pending = @pending_counts.fetch(session.id, 0) %>
         <% if pending.positive? %><span class="badge"><%= pending %> to approve</span><% end %>
       </div>
       <div class="muted">
-        <%= pluralize(session.turns.count, "turn") %> ·
+        <%= pluralize(session.turns.size, "turn") %> ·
         <%= session.channel.presence || "direct" %> ·
         <%= relative_time(session.updated_at) %>
       </div>
     <% end %>
   <% end %>
+  <% if @next_before %>
+    <div class="pager">
+      <%= link_to "Older sessions →",
+            inbox_sessions_path(before: @next_before, agent: params[:agent].presence, pending: params[:pending].presence),
+            class: "chip" %>
+    </div>
+  <% end %>
 <% end %>

data/app/views/silas/inbox/steps/_step.html.erb

@@ -7,6 +7,9 @@
   <% else %>
     <div class="step-text step-live" id="silas-step-<%= step.id %>-text"></div>
   <% end %>
+  <% if (data = step_structured(step)) %>
+    <pre class="args"><%= pretty_args(data) %></pre>
+  <% end %>
   <div id="silas-step-<%= step.id %>-tools">
     <%= render partial: "silas/inbox/invocations/invocation", collection: step.tool_invocations, as: :invocation %>
   </div>

data/app/views/silas/inbox/turns/_header.html.erb

@@ -9,6 +9,17 @@
     <span class="muted">cancel requested…</span>
   <% end %>
 </div>
-<% if turn.failure_reason.present? %>
+<% if turn.budget_parked? %>
+  <div class="approval">
+    <h3>Budget reached — <%= turn.failure_reason %></h3>
+    <div class="muted">Parked at zero compute. Raise the limit and the turn resumes
+      by replaying completed work from rows — no re-calls, no re-effects.</div>
+    <%= form_with url: raise_budget_inbox_turn_path(turn), method: :post, class: "topup-form" do %>
+      <input name="value" type="number" step="any" min="0" required class="topup-input"
+             placeholder="<%= turn.failure_reason == "max_cost" ? "new limit in dollars, e.g. 2.50" : "new limit, e.g. 200000" %>">
+      <button class="btn approve">Raise &amp; resume</button>
+    <% end %>
+  </div>
+<% elsif turn.failure_reason.present? %>
   <div class="muted">failed: <%= turn.failure_reason %></div>
 <% end %>