@abelxiaoxing/cadence 2.0.13 → 2.0.15

package/docs/service-management.md

@@ -20,9 +20,12 @@ cadence stop --workspace /absolute/project
 Defaults are loopback `127.0.0.1:17423`, normal Pi agent configuration, and detached service lifetime.
 An explicit port0 selects and persists a positive port once; restart uses the selected configuration, not a fallback endpoint.
 Missing/corrupt existing setup is preserved, not filled in or reset.
-A workspace that contains the private state home (the home directory and its ancestors, such as `C:\Users\<you>` with `%LOCALAPPDATA%` or `~` with `~/.local/state`) would expose private history and locks to change observation, so every command there uses `~/cadence` (`%USERPROFILE%\cadence`) instead of refusing.
-Only `start` creates it; `status` reports `absent` without creating it, an explicit `--workspace` adds one informational line, and JSON output names the effective `workspace` only when it differs.
-`/cadence` started in such a directory attaches to the same owner, and real project directories are never redirected.
+Commands without `--workspace` address the unified workbench, which has no execution cwd and never creates `~/cadence`.
+Use `cadence workbench start|status|diagnose|stop|token-link|token-rotate` to name that target explicitly.
+Its start accepts `--foreground`, `--state-home`, `--agent-dir`, `--server-config` and a private `--config` containing an `HttpPolicy` object (the schema used below for project HTTP policy).
+The configuration's port/token come from the `.env`; a selected HTTP policy is retained across orderly restarts.
+A project root containing the private state home is refused, with no alternate directory creation; native `/cadence` also requires a real project selection.
+Existing `~/cadence` content is never removed, relocated or automatically adopted.
 A directory inside `cadence-assistant-v1` is never an engineering workspace, even for root or `project open --create`.
 Apart from the background service below, there is no supervisor installation, provider login or credential migration.
 
@@ -43,7 +46,16 @@ The JSON result reports the canonical workspace, actual task cwd and endpoint; t
 Keep that link private.
 Open Pi in the same project and use `/cadence` for the native client; explicit `cadence stop --workspace <path>` stops only that project.
 Opening another project never changes the cwd or cancels work in the former one.
-Each project has its own browser entry and owner; this is not a same-page cross-project browser router.
+The default workbench routes all associated projects through one origin, including a configured HTTPS proxy.
+Its project picker browses directory names readonly; only **Open this project** starts or reuses an owner, without admitting a task or model call.
+Project navigation remounts only the browser client; the original owner's work continues.
+Browser proxy traffic keeps browser authority and the owner's own attachments, CSRF/build checks, grants and history proofs; native management routes and local-capability headers are not forwarded.
+The gateway also refuses the legacy project-level Open command, so every opening is associated through the workbench instead of returning an independent backend token link.
+The gateway's token, backend cookies and native capabilities are never returned in project DTOs or stored in browser localStorage.
+Token rotation retires and detaches its exact browser attachments without cancelling admitted work.
+The private account state stores bounded project references and opening receipts, not copied worktrees, Pi profiles or imported transcripts.
+Private coordination/Pi credential directories and foreign-owned project selections are refused.
+Direct project entry links remain available as a compatibility route; that route alone still uses separate loopback project entries.
 Git subdirectories and aliases resolve to the same checkout, while overlapping parent/child owners still refuse.
 An unknown, quarantined or inaccessible selection is never treated as a new project or recovered by choosing another state home.
 
@@ -72,12 +84,18 @@ Linux also accepts `--name <name>` on every server command to select `cadence-<n
 Names must start with a letter or digit and contain only letters, digits, `_` and `-` (at most48characters).
 
 `install` also creates the research template `~/.pi/agent/cadence/.env` when it is missing, never overwriting it, whatever the service result, and adds its [port and token](#port-and-token) lines when they are missing.
-`install` works from any package location and runs `start --foreground --workspace <workspace> --server-config <file>` (Linux, macOS) or the same without `--foreground` (Windows) from that copy with the installing Node, without `--port`.
-The workspace is `~/cadence` (created if missing), an existing absolute `--workspace`, or on later installs the one the definition already runs; a workspace containing the service's state home lands on `~/cadence` with a note.
+`install` without `--workspace` runs `workbench start --foreground --server-config <file>` (Linux, macOS), or without `--foreground` on Windows.
+The service process may use its package directory as a technical launch cwd; it is never an agent workspace and no project scan or model runtime is initialized there.
+An explicit `--workspace` retains single-project service compatibility and must name an existing suitable directory.
+A reinstall without `--workspace` explicitly selects the unified entry after orderly Stop of the old generated definition; it neither deletes the former workspace nor imports its data.
+A plain `restart` retains the definition's existing target, including an older explicit project service, rather than silently migrating it.
 The `.env` [port and token](#port-and-token) select the endpoint (17423 by default) and the token; an occupied endpoint fails instead of falling back.
 Install and restart print the private entry link once the owner answers; the JSON result on stdout never carries the token.
 `restart` rewrites an existing definition with the current Node and package paths, keeping its workspace and the user's disable choices, and starts it; run it after an npm upgrade, a Node change or a `models.json` edit.
-`stop` stops the owner orderly and keeps the registration for the next boot or login.
+`stop` joins the workbench's accepted openings and associated exact-epoch project owners, then closes the entry; unrelated project owners stay independent.
+If one associated owner refuses or has a changed epoch, Stop still reaches the other known owners serially, while the workbench remains fenced rather than reporting a successful Stop.
+Project-specific `stop --workspace <path>` remains scoped to that owner.
+The generated registration stays for the next boot or login.
 `uninstall` stops it orderly and deletes only what Cadence generated; workspace, state home, history, linger and Pi sources stay.
 Because npm runs no uninstall script, uninstall the service before `npm uninstall -g`; a left-behind definition fails to start once its CLI path disappears.
 A definition Cadence did not generate is left unchanged (`foreign`), and `status` reports `absent` when none is registered.
@@ -85,7 +103,8 @@ A definition Cadence did not generate is left unchanged (`foreign`), and `status
 Pi's installer omits peers, so the standalone owner and workers load the Pi SDK (`pi-coding-agent`, `pi-ai`) from exact 0.84.3 optional dependencies.
 Package files may be hard links into the package manager's store (Bun's default install); Cadence binds their exact content, not their link count.
 Missing or unusable Pi sources refuse before an owner registers; a new owner without the SDK quarantines.
-`install` therefore writes no service definition while the SDK is unresolvable (for example, optional dependencies omitted), and registers without starting while Pi's `auth.json` is missing (`waiting-for-pi-login`); log in to Pi, then run `cadence server restart`.
+The no-project workbench starts without either an SDK runtime or Pi authentication; missing sources are reported only when a project is explicitly opened.
+For an explicit single-project definition, the older guards remain: no SDK means no definition, and missing `auth.json` means registered but waiting for Pi login.
 
 While no service is registered, Pi's session-start card shows a separate warning naming `cadence server install` for an installed package copy (`node <copy>/src/service-cli.mjs server install` for Pi's managed copy, which puts no bin on `PATH`); a checkout loaded with `pi -e` stays quiet.
 It is a warning rather than part of the info card because Pi's TUI replaces one info status with the next.
@@ -175,7 +194,7 @@ Only where polkit requires authorization for `set-self-linger` (older systemd de
 `--no-linger` or `CADENCE_LINGER=0` skips linger; `restart` never changes it, so `loginctl disable-linger` is kept.
 The unit bakes the installer's PATH (minus npm lifecycle entries), LANG/LC_ALL, an absolute XDG_STATE_HOME and a custom PI_CODING_AGENT_DIR, so shell management sees the same state home and Pi sources.
 Proxy variables are not baked; add a validated pair with `systemctl --user edit cadence`.
-It carries `ConditionPathExists=` for the CLI, `auth.json` and both SDK packages.
+It carries `ConditionPathExists=` for the CLI; explicit single-project definitions also require `auth.json` and both SDK packages, while the project-less workbench does not.
 
 `restart` stops an active unit with its loaded definition, rewrites the file and starts it, without enabling a disabled unit; a masked unit is never enabled or started.
 `ExecStop` is the authenticated orderly Stop, so admitted work is stopped, not detached; `stop` and `uninstall` (`disable --now`) use it too.
@@ -191,7 +210,7 @@ To keep the service off while Cadence stays installed, use `systemctl --user dis
 
 `install` writes `~/Library/LaunchAgents/com.abelxiaoxing.cadence.plist` with `RunAtLoad`, runs `launchctl enable` (undoing a `launchctl disable`) and loads it into `gui/<uid>` with `launchctl bootstrap`, which starts it; launchd loads it again at every login.
 It bakes the same PATH, LANG/LC_ALL, XDG_STATE_HOME and PI_CODING_AGENT_DIR as the Linux unit and logs to `~/Library/Logs/cadence.log`.
-Without `auth.json` the agent is written but not loaded.
+For an explicit single-project service, missing `auth.json` leaves the agent written but not loaded; the project-less workbench can start without Pi login.
 Because launchd stops a job only by signaling it, `restart`, `stop`, `uninstall` and a reinstall first stop the owner through the authenticated orderly Stop, and change nothing when that Stop is `unconfirmed`, `quarantined` or `unavailable`.
 Only then does Cadence unload (`bootout`) or replace the agent; `stop` leaves it loaded, and the finished job starts again at the next login.
 There is no `KeepAlive`: launchd has no start limit, and a restart never clears fences, so a failed owner stays down until `cadence server restart`.
@@ -201,10 +220,10 @@ At logout or shutdown launchd signals the job, which is not orderly Stop and can
 ### Windows login Run entry
 
 `install` writes `%LOCALAPPDATA%\cadence-server\cadence.vbs`, beside rather than inside the private state home, and the per-user value `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Cadence`, which runs it with `wscript.exe` at login; no administrator rights are needed.
-The launcher is UTF-16 with a byte-order mark, so non-ASCII paths work, and runs `start --workspace` with window style 0, so no console window appears; the detached owner keeps running after the launcher exits.
+The launcher is UTF-16 with a byte-order mark, so non-ASCII paths work, and runs `workbench start` (or `start --workspace` for an explicit project) with window style 0, so no console window appears; the detached owner keeps running after the launcher exits.
 It bakes only a custom PI_CODING_AGENT_DIR, because the login environment already carries PATH and `%LOCALAPPDATA%`.
 `install` also removes Task Manager's `StartupApproved` switch for the entry (undoing a disable there); `restart` keeps both the entry and that switch, and `status` reports a disabled entry.
-Without `auth.json` the entry is registered but nothing starts.
+For an explicit single-project service, missing `auth.json` leaves the entry registered but starts nothing; the project-less workbench can start without Pi login.
 Nothing supervises the detached owner, so a failed owner is not restarted, and every `restart`, `stop`, `uninstall` and reinstall first runs the authenticated orderly Stop and changes nothing unless it is confirmed; Cadence never kills a process.
 A `Cadence` Run value without Cadence's launcher is `foreign` and left unchanged; registry values are only tested for presence, because `reg.exe` prints them in the console code page.
 At sign-out or shutdown Windows ends the owner without orderly Stop, which can leave recovery fences; run `cadence server stop` first while work is running.
@@ -239,7 +258,7 @@ At sign-out or shutdown Windows ends the owner without orderly Stop, which can l
   Ctrl-C, SIGTERM, machine crash or terminal destruction is **not** the authenticated orderly Stop route and can leave recovery fences.
   A recovered `stopped` registration means acknowledged fence release, not retroactive native closure certification.
 
-`diagnose` reports fixed pending/recording facts and `proxyAuth: direct|validated-proxy`.
+`diagnose` reports fixed pending/recording facts and `proxyAuth: direct|validated-proxy` when the owner is reachable; a blocked global registry instead reports its fixed lock reason and local recovery hint.
 No normal status/diagnosis prints access secrets, provider credentials or outbound proxy URLs.
 Keep the explicitly revealed token link private.
 Browser entry redirects to a token-free URL and uses an HttpOnly cookie; that does not retract a link already copied into history, a clipboard or external logs.
@@ -281,8 +300,46 @@ cadence recover inspect --workspace /absolute/project
 cadence recover resolve --workspace /absolute/project
 ```
 
-Inspection is readonly.
-It displays the epoch, exact coordination/history digests, owner PID/host observation and independent process/credential/storage uncertainty.
+Inspection is readonly and handles the global registry lock before project-owner recovery.
+
+### Residual global registry lock
+
+`status` and `diagnose` report `reason: "registry-locked"` and the lock holder observation (`live`, `absent`, `ambiguous` or `unreadable`).
+Project Open reports `registry-locked` instead of an opaque `unavailable`; the folder picker explains the local recovery command.
+This lock is shared by every project in the selected state home, so trying a different project does not bypass it.
+Use the same account and `--state-home` as the owner; omit that flag only when it uses the default state home:
+
+```sh
+cadence recover inspect --workspace /absolute/project --state-home /absolute/state-home
+cadence recover resolve --workspace /absolute/project --state-home /absolute/state-home
+```
+
+With a registry lock present, inspection reports `scope: "global-registry"`, the exact lock-incarnation digest, holder PID/host, reservation count and any previous resolver's liveness.
+A project with no selected owner can be used to address this global operation; it still must be an existing suitable directory.
+Resolve requires the same four fresh local-terminal acknowledgments described below, with the displayed lock-incarnation digest instead of a service epoch.
+The holder must be on this host and its PID probe must specifically report absence; age, a remote host, permission denial or a reused live PID never authorizes release.
+
+Recovery validates the registry and checks that unreserved project selections have no remaining owner/checkout fences.
+A normally stopped project whose working directory was later removed is checked through its retained private metadata; recovery neither requires nor reconstructs that directory.
+An interrupted reservation remains reserved even when its project initialization is incomplete: unrelated projects can reopen, but that project's uncertain resources are not repaired.
+An older release interrupted after removing a reservation but before releasing its project locks is unsafe and remains blocked, as do corrupt/partial registry bytes, linked files and changed resources.
+Inspection reports `blocked-preserve-state` when it cannot establish those conditions; preserve that state for manual diagnosis rather than deleting locks.
+
+Before releasing only `registry.lock`, the resolver exclusively creates, flushes and closes a private receipt under `service-registry-v1/recovery-v1/<lock-incarnation>/<attempt>.json`, retaining the original lock bytes and acknowledged digest.
+It then rechecks the lock incarnation, registry, unreserved project selections, receipt and terminal authority.
+Concurrent resolvers cannot release a successor lock.
+If a resolver dies after the receipt but before release, a new inspection and fresh terminal confirmation may append the next attempt after that resolver's same-host PID is absent; neither receipt nor lock is silently reclaimed.
+Torn or unsafe receipts remain preserved and refused.
+Inspection is bounded to 1024 namespace entries and 128 attempts for one lock incarnation; it never evicts evidence to make space.
+
+All project reservations, owner locks, checkout locks, capabilities, history and unknown outcomes remain unchanged.
+No Open/Start is replayed, no process is signaled, and no service is installed or started by recovery.
+After success, explicitly open the desired project again.
+If its own owner is still fenced, run `recover inspect` again and follow project-owner recovery separately; restoring global registry access does not certify or release that owner's work.
+
+### Project-owner recovery
+
+With no registry lock present, inspection displays the epoch, exact coordination/history digests, owner PID/host observation and independent process/credential/storage uncertainty.
 Those digests identify preserved resources, not successful work or credential validity.
 A journal with no unmatched intent does not prove every escaped descendant or external credential writer stopped.
 

package/licenses/pi-web-ui-reuse.md

@@ -1,12 +1,14 @@
 # pi-web-ui presentation reuse
 
 Cadence adapts source from [xing-shuyin/pi-web-ui](https://github.com/xing-shuyin/pi-web-ui), revision `e8bab487af208bc9a1ab60a821652323f598127f`.
+The ordinary-conversation composer, folder picker, file browser and agent-dock presentation additionally reference revision `944f556463d6693a3f0cfe375c22680090e85bbe`, with separate file hashes recorded in the source inventory.
 Copyright (c) 2026 xing-shuyin.
 The full existing [MIT license](pi-web-ui-MIT.txt) is retained unchanged.
 This adaptation is not endorsed by the upstream author.
 
 Adapted families include the three-pane workspace and drawers, nested navigation and plan editing, lazy transcript/tool cards, Markdown/stream/code/math/copy, readonly preview and diff, search/deep links, reconciliation, and the standalone run-trace client.
 Cadence replaces upstream execution, arbitrary messaging, history repair, mutation, plugin and credential-storage boundaries with its finite typed shared service client.
+Ordinary chat has its own Cadence service implementation; the upstream subagent/goal/delegate runtimes, prompt composer, PTY and plugin system are not included.
 Timeline geometry is explicitly ordinal; recorded worker-local clocks and native check duration remain independently labeled, never aligned into inferred overlap.
 The source-level file/hash/modification inventory is `provenance/webui-reuse.json`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abelxiaoxing/cadence",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "description": "Shared Pi task workspace: native terminal and WebUI, persistent service, checks and human review.",
   "license": "MIT",
   "type": "module",
@@ -60,7 +60,10 @@
     "README.md",
     "LICENSE",
     "THIRD_PARTY_NOTICES.md",
-    "licenses"
+    "licenses",
+    "src/conversation-context.mjs",
+    "src/conversation-resources.mjs",
+    "src/service/contracts/workbench.ts"
   ],
   "pi": {
     "extensions": [

package/src/conversation-context.mjs

@@ -0,0 +1,147 @@
+/** Private ordinary-chat context. No Pi session import, hidden thinking or provider envelopes. */
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+import {
+  canonicalJson,
+  closed,
+  integer,
+  list,
+  oneOf,
+  parseWireJson,
+  text,
+} from "./worker-public.mjs";
+import { DetailSanitizer, sanitizeText } from "./worker-redaction.mjs";
+
+export const CONTEXT_BYTES = 2 * 1024 * 1024;
+const clean = (s, secrets, max = CONTEXT_BYTES) =>
+  sanitizeText(text(s, max), secrets);
+function argumentsData(value, secrets) {
+  const sanitizer = new DetailSanitizer("canonical-json", secrets);
+  const source =
+    sanitizer.write(canonicalJson(value, 64 * 1024)) + sanitizer.end();
+  if (sanitizer.limited) throw new Error("Unsupported context arguments");
+  return parseWireJson(source, 64 * 1024);
+}
+/** Deliberately retain text and tool exchanges, not just last assistant prose. */
+export function conversationMessages(messages, secrets = []) {
+  return list(messages, 4096, (message) => {
+    if (!message || typeof message !== "object")
+      throw new Error("Invalid context");
+    const role = oneOf(message.role, ["user", "assistant", "toolResult"]);
+    const timestamp = integer(message.timestamp, 0);
+    const content =
+      typeof message.content === "string"
+        ? [{ type: "text", text: clean(message.content, secrets) }]
+        : list(message.content, 256, (block) => {
+            if (block.type === "text")
+              return { type: "text", text: clean(block.text, secrets) };
+            if (role === "assistant" && block.type === "toolCall")
+              return {
+                type: "toolCall",
+                id: clean(block.id, secrets, 512),
+                name: clean(block.name, secrets, 128),
+                arguments: argumentsData(block.arguments, secrets),
+              };
+            // Images, hidden thinking and opaque provider signatures never become retained context.
+            return null;
+          }).filter(Boolean);
+    if (role === "user") return { role, timestamp, content };
+    if (role === "toolResult")
+      return {
+        role,
+        timestamp,
+        content,
+        toolCallId: clean(message.toolCallId, secrets, 512),
+        toolName: clean(message.toolName, secrets, 128),
+        isError: message.isError === true,
+      };
+    const usage = closed(message.usage, [
+      "input",
+      "output",
+      "cacheRead",
+      "cacheWrite",
+      "totalTokens",
+      "cost",
+    ]);
+    const cost = closed(usage.cost, [
+      "input",
+      "output",
+      "cacheRead",
+      "cacheWrite",
+      "total",
+    ]);
+    for (const value of [
+      ...Object.values(usage).filter((v) => typeof v !== "object"),
+      ...Object.values(cost),
+    ])
+      if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+        throw new Error("Invalid usage");
+    return {
+      role,
+      timestamp,
+      content,
+      api: clean(message.api, secrets, 128),
+      provider: clean(message.provider, secrets, 128),
+      model: clean(message.model, secrets, 256),
+      usage,
+      stopReason: oneOf(message.stopReason, [
+        "stop",
+        "length",
+        "toolUse",
+        "error",
+        "aborted",
+      ]),
+    };
+  });
+}
+export function readConversationContext(path) {
+  if (path === null) return [];
+  const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const st = fstatSync(fd);
+    if (
+      !st.isFile() ||
+      st.nlink !== 1 ||
+      st.size > CONTEXT_BYTES ||
+      (process.platform !== "win32" &&
+        (st.mode & 0o077 || st.uid !== process.getuid()))
+    )
+      throw new Error("Invalid context file");
+    const buffer = Buffer.alloc(st.size + 1);
+    let size = 0;
+    while (size < buffer.length) {
+      const n = readSync(fd, buffer, size, buffer.length - size, null);
+      if (!n) break;
+      size += n;
+    }
+    const after = fstatSync(fd);
+    if (
+      size !== st.size ||
+      after.size !== st.size ||
+      after.mtimeMs !== st.mtimeMs
+    )
+      throw new Error("Changed context file");
+    const o = closed(
+      parseWireJson(
+        new TextDecoder("utf-8", { fatal: true }).decode(
+          buffer.subarray(0, size),
+        ),
+        CONTEXT_BYTES,
+      ),
+      ["schema", "messages"],
+    );
+    if (o.schema !== "cadence-conversation-context/1")
+      throw new Error("Invalid context format");
+    return conversationMessages(o.messages);
+  } finally {
+    closeSync(fd);
+  }
+}
+export function encodeConversationContext(messages, secrets) {
+  return canonicalJson(
+    {
+      schema: "cadence-conversation-context/1",
+      messages: conversationMessages(messages, secrets),
+    },
+    CONTEXT_BYTES,
+  );
+}

package/src/conversation-resources.mjs

@@ -0,0 +1,47 @@
+/** Ordinary Pi context only: no extension/plugin executor, persona or prompt composer. */
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import {
+  loadProjectContextFiles,
+  loadSkills,
+} from "@earendil-works/pi-coding-agent";
+
+function optional(path) {
+  try {
+    if (!statSync(path).isFile() || statSync(path).size > 64 * 1024)
+      throw new Error("Resource too large");
+    return readFileSync(path, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return undefined;
+    throw error;
+  }
+}
+export function conversationResources(base, cwd, agentDir) {
+  const project = join(cwd, ".pi");
+  const system =
+    optional(join(project, "SYSTEM.md")) ??
+    optional(join(agentDir, "SYSTEM.md"));
+  const append = [
+    optional(join(agentDir, "APPEND_SYSTEM.md")),
+    optional(join(project, "APPEND_SYSTEM.md")),
+  ].filter((v) => v !== undefined);
+  const agentsFiles = loadProjectContextFiles({ cwd, agentDir });
+  const skills = loadSkills({
+    cwd,
+    agentDir,
+    skillPaths: [],
+    includeDefaults: true,
+  });
+  if (
+    Buffer.byteLength(JSON.stringify({ system, append, agentsFiles, skills })) >
+    256 * 1024
+  )
+    throw new Error("Resources too large");
+  return {
+    ...base,
+    getSystemPrompt: () => system,
+    getAppendSystemPrompt: () => append,
+    getAgentsFiles: () => ({ agentsFiles }),
+    getSkills: () => skills,
+  };
+}

package/src/native-build.ts

@@ -2,5 +2,5 @@
 export const nativeBuild = {
   kind: "native",
   contractHash:
-    "e9b1ea4bb8d1c275a0cb0cf70947f9ac58e5de0cc438d551dc96809f3e82dd7c",
+    "944f3b53bd5b7f1d3f30868e0947d900e356ae9a2bcfb9f591edd988b3d5eb3a",
 } as const;

package/src/native-client.ts

@@ -192,8 +192,8 @@ export class NativeConnection {
     // Failed detach keeps its exact transport/slot. Explicit re-entry may retry
     // detach, but never forget it and allocate a replacement on uncertainty.
     await this.detach();
-    // Pi started in the home directory attaches to the ~/cadence landing owner,
-    // the same one the management client starts there. Observation only.
+    // Native clients require an explicit project; never create or redirect to
+    // a default workspace. Observation only.
     const access = new ServiceCoordination(
       effectiveWorkspace(cwd).workspace,
     ).localAccess();

package/src/operator-cli.mjs

@@ -288,13 +288,10 @@ function stateHomeInside(root, stateHome = defaultStateHome()) {
 function privateWorkspace(requested, stateHome = defaultStateHome()) {
   return contains(join(canonicalAmbientRoot(stateHome), "cadence-assistant-v1"), canonicalAmbientRoot(requested));
 }
-var LANDING_WORKSPACE = "cadence";
-function effectiveWorkspace(requested, stateHome, home = homedir()) {
-  if (privateWorkspace(requested, stateHome))
-    throw new Error("Private state cannot be a workspace");
-  if (!stateHomeInside(resolveWorkspace(requested).root, stateHome))
-    return { workspace: requested, redirected: false };
-  return { workspace: join(home, LANDING_WORKSPACE), redirected: true };
+function effectiveWorkspace(requested, stateHome, _home) {
+  if (privateWorkspace(requested, stateHome) || stateHomeInside(resolveWorkspace(requested).root, stateHome))
+    throw new Error("Choose a project outside Cadence private state; no default workspace was created");
+  return { workspace: requested, redirected: false };
 }
 
 class TaskStore {

package/src/sdk-worker.mjs

@@ -1,4 +1,6 @@
-// Ordinary SDK child, not Pi CLI startup. No discovery, credential files or fallback executor.
+// Isolated SDK child, not Pi CLI startup. Task discovery stays disabled;
+// ordinary conversations explicitly load only context/skills, never extensions.
+import { writeFileSync } from "node:fs";
 import {
   createProvider,
   InMemoryCredentialStore,
@@ -12,6 +14,11 @@ import {
   SessionManager,
   SettingsManager,
 } from "@earendil-works/pi-coding-agent";
+import {
+  encodeConversationContext,
+  readConversationContext,
+} from "./conversation-context.mjs";
+import { conversationResources } from "./conversation-resources.mjs";
 import { CaptureEmitter, SdkCapture } from "./worker-capture.mjs";
 import {
   closed,
@@ -185,13 +192,27 @@ try {
     if (inputBytes > 128 * 1024) refuse("parse", "input-bound");
     chunks.push(chunk);
   }
+  const parsed = parseWireJson(
+    new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)),
+    LIMITS.workerRequestBytes,
+  );
   const envelope = closed(
-    parseWireJson(
-      new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)),
-      LIMITS.workerRequestBytes,
-    ),
-    ["request", "cwd", "model", "auth"],
+    parsed,
+    Object.hasOwn(parsed ?? {}, "conversation")
+      ? ["request", "cwd", "model", "auth", "conversation"]
+      : ["request", "cwd", "model", "auth"],
   );
+  const conversation =
+    envelope.conversation === undefined
+      ? null
+      : closed(envelope.conversation, ["previous", "agentDir"]);
+  if (
+    conversation &&
+    ((conversation.previous !== null &&
+      typeof conversation.previous !== "string") ||
+      typeof conversation.agentDir !== "string")
+  )
+    refuse("parse", "invalid-conversation");
   const publicRequest = decodeWorkerPublicRequest(envelope.request);
   const request = {
     ...envelope,
@@ -329,6 +350,10 @@ try {
   process.stdout.on("error", stdoutFailureListener);
   stage = "session";
   const requestedThinkingLevel = thinkingLevel ?? "off";
+  const manager = SessionManager.inMemory(cwd);
+  if (conversation)
+    for (const message of readConversationContext(conversation.previous))
+      manager.appendMessage(message);
   const created = await createAgentSession({
     cwd,
     agentDir: cwd,
@@ -351,8 +376,10 @@ try {
             ),
           ]
         : [],
-    resourceLoader,
-    sessionManager: SessionManager.inMemory(cwd),
+    resourceLoader: conversation
+      ? conversationResources(resourceLoader, cwd, conversation.agentDir)
+      : resourceLoader,
+    sessionManager: manager,
     settingsManager: SettingsManager.inMemory({
       compaction: { enabled: false },
       retry: { enabled: false },
@@ -483,6 +510,12 @@ try {
   stage = "assistant-final";
   if (failure || terminalStopReason !== "stop" || ingress.frames !== 0)
     refuse("assistant-final", "terminal-incomplete");
+  // Anonymous pipe only. The owner applies its access-secret sanitizer before
+  // any checkpoint reaches disk; worker output cannot contain owner credentials.
+  if (conversation) {
+    stage = "conversation-context";
+    writeFileSync(3, encodeConversationContext(session.messages, secrets));
+  }
   await capture.final();
   await emitter.drain();
 } catch {