@cydm/happy-elves 0.1.0-beta.489 → 0.1.0-beta.490

package/apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-cli",
-  "version": "0.1.0-beta.489",
+  "version": "0.1.0-beta.490",
   "private": true,
   "type": "module"
 }

package/apps/daemon/dist/relay/prompt-admission-store.js

@@ -177,10 +177,14 @@ export async function waitForInboundPromptStart(requestId, timeoutMs) {
 }
 export function retryablePreStartPromptError(code) {
     // Internal queue/schedule admission can reset deterministic pre-start
-    // failures because no runtime turn was durably materialized.
+    // failures because no runtime turn was durably materialized.  A queue gate
+    // reports CREW_SESSION_BUSY before the provider is touched; retaining that
+    // terminal response under the stable queue prompt request id would make the
+    // same FIFO head replay its own old rejection forever.
     // Controller packet replay is narrower and only resets explicit
     // SESSION_BUSY admission races in the inbound dispatcher.
     return code === "SESSION_BUSY" ||
+        code === "CREW_SESSION_BUSY" ||
         code === "TURN_START_FAILED" ||
         code === "PROMPT_ADMISSION_TIMEOUT" ||
         code === "CREW_SESSION_STATUS_UNAVAILABLE" ||

package/apps/daemon/dist/session/native-history-refresh.js

@@ -76,14 +76,17 @@ async function refreshNativeHistory(session, config, requestId, strict, orchestr
                 // explicit adoption status because they were created before the
                 // native-history state machine existed.  Complete that migration on
                 // the normal load/read path, preserving the existing HE thread id.
-                if (metadata.headlessNativeAdoptionStatus !== "complete" && Array.isArray(metadata.nativeHistoryTurnIds)) {
+                const needsManagedOwnershipRepair = metadata.nativeHandoff === "manual-sequential" && metadata.nativeHistoryChangedExternally !== true;
+                if (needsManagedOwnershipRepair || (metadata.headlessNativeAdoptionStatus !== "complete" && Array.isArray(metadata.nativeHistoryTurnIds))) {
                     await entry.client.adoptThread({
                         threadId: session.runtimeBinding.threadId,
                         providerSessionId,
                         cwd: session.cwd,
                         provider: entry.provider,
                         nativeIdentity: expectedNativeIdentity,
+                        sessionContext: { role: "crew" },
                         manualHandoff: true,
+                        managedHandoff: true,
                     });
                 }
             }

package/apps/daemon/dist/session/prompt.js

@@ -1003,8 +1003,12 @@ function promptFailureCode(phase, error) {
         return "PROMPT_DECRYPT_FAILED";
     if (phase === "decrypt-memory-options" && isCryptoOperationFailure(error))
         return "MEMORY_OPTIONS_DECRYPT_FAILED";
-    if (phase === "start-turn" || phase === "attach-turn" || phase === "persist-runtime-start")
+    if (phase === "start-turn" || phase === "attach-turn" || phase === "persist-runtime-start") {
+        const code = structuredPromptErrorCode(error);
+        if (code && knownPromptStartErrorCode(code))
+            return code;
         return "TURN_START_FAILED";
+    }
     if (phase === "stream-turn" || phase === "await-turn-result")
         return "TURN_RUNTIME_FAILED";
     if (phase === "refresh-runtime-metadata")
@@ -1013,6 +1017,20 @@ function promptFailureCode(phase, error) {
         return "SESSION_EVENT_EMIT_FAILED";
     return "PROMPT_EXECUTION_FAILED";
 }
+function structuredPromptErrorCode(error) {
+    if (!error || typeof error !== "object" || !("code" in error))
+        return undefined;
+    const code = error.code;
+    return typeof code === "string" && code.trim() ? code : undefined;
+}
+function knownPromptStartErrorCode(code) {
+    return code === "NATIVE_HANDOFF_RECONFIRM_REQUIRED" ||
+        code === "NATIVE_HISTORY_CONFLICT" ||
+        code === "CAPABILITY_UNSUPPORTED" ||
+        code === "SESSION_BUSY" ||
+        code === "RUNTIME_UNAVAILABLE" ||
+        code === "REQUEST_TIMEOUT";
+}
 function promptFailureMessage(code, error) {
     if (code === "PROMPT_DECRYPT_FAILED") {
         return "Failed to decrypt the prompt for this daemon. Re-pair the daemon with the correct account secret.";

package/apps/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves-daemon",
-  "version": "0.1.0-beta.489",
+  "version": "0.1.0-beta.490",
   "private": true,
   "type": "module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cydm/happy-elves",
-  "version": "0.1.0-beta.489",
+  "version": "0.1.0-beta.490",
   "description": "Remote controller for local coding agents with hosted or self-hosted relay support.",
   "type": "module",
   "bin": {

package/packages/headless-runtime/dist/claude-provider.js

@@ -190,7 +190,7 @@ class ClaudeHeadlessRuntimeProvider {
         if (takeoverState === "active") {
             throw new HeadlessRuntimeCoreError("INVALID_REQUEST", `Claude native session ${providerSessionId} is active or awaiting approval; safe takeover is not supported.`);
         }
-        if (takeoverState === "unknown" && input.manualHandoff !== true) {
+        if (takeoverState === "unknown" && input.manualHandoff !== true && input.managedHandoff !== true) {
             throw new HeadlessRuntimeCoreError("CAPABILITY_UNSUPPORTED", `Claude native session ${providerSessionId} has no verifiable idle/takeover state in the configured SDK.`);
         }
         if (input.manualHandoff === true && input.manualHandoffProof?.updatedAt !== undefined && typeof info.lastModified === "number" && info.lastModified > input.manualHandoffProof.updatedAt) {
@@ -200,7 +200,7 @@ class ClaudeHeadlessRuntimeProvider {
         const history = claudeNativeHistory(providerSessionId, info, messages);
         this.sessionsByThread.set(input.thread.id, providerSessionId);
         this.startedThreads.add(input.thread.id);
-        return { providerSessionId, history, ...(input.manualHandoff ? { providerMetadata: { nativeHandoff: "manual-sequential" } } : {}) };
+        return { providerSessionId, history, ...(input.manualHandoff && input.managedHandoff !== true ? { providerMetadata: { nativeHandoff: "manual-sequential" } } : {}) };
     }
     async readNativeHistory(input) {
         if (this.transport !== "sdk" || !input.thread.providerSessionId) {

package/packages/headless-runtime/dist/codex-provider.js

@@ -227,7 +227,7 @@ class CodexHeadlessRuntimeProvider {
             if (takeoverState === "active") {
                 throw new HeadlessRuntimeCoreError("INVALID_REQUEST", `Codex native session ${input.thread.providerSessionId} is active or awaiting approval; safe takeover is not supported.`);
             }
-            if (takeoverState === "unknown" && input.manualHandoff !== true) {
+            if (takeoverState === "unknown" && input.manualHandoff !== true && input.managedHandoff !== true) {
                 throw new HeadlessRuntimeCoreError("CAPABILITY_UNSUPPORTED", `Codex native session ${input.thread.providerSessionId} has no verifiable idle/takeover state in the configured app-server.`);
             }
             const nativeUpdatedAt = epochMs(nativeThread.updatedAt ?? nativeThread.updated_at ?? nativeThread.recencyAt ?? nativeThread.recency_at);
@@ -259,7 +259,7 @@ class CodexHeadlessRuntimeProvider {
         const binding = codexProviderThreadBinding(input.thread.providerSessionId, input.thread.providerMetadata, input.thread.model, input.thread.thinkingLevel, codexClientProfileForThread(input.thread));
         return {
             ...binding,
-            ...(input.manualHandoff ? { providerMetadata: { ...binding.providerMetadata, nativeHandoff: "manual-sequential" } } : {}),
+            ...(input.manualHandoff && input.managedHandoff !== true ? { providerMetadata: { ...binding.providerMetadata, nativeHandoff: "manual-sequential" } } : {}),
             history: nativeHistory,
         };
     }

package/packages/headless-runtime/dist/core.d.ts

@@ -19,6 +19,7 @@ export type HeadlessRuntimeProvider = {
     startThread?(input: HeadlessRuntimeProviderThreadInput): Promise<HeadlessRuntimeProviderThreadBinding | void>;
     adoptThread?(input: HeadlessRuntimeProviderThreadInput & {
         manualHandoff?: boolean;
+        managedHandoff?: boolean;
         manualHandoffProof?: AdoptThreadParams["manualHandoffProof"];
     }): Promise<HeadlessRuntimeProviderThreadBinding | void>;
     validateNativeHandoff?(input: {

package/packages/headless-runtime/dist/core.js

@@ -155,6 +155,12 @@ export class HeadlessRuntimeCore {
         if (!this.provider.adoptThread) {
             throw new HeadlessRuntimeCoreError("CAPABILITY_UNSUPPORTED", `Provider ${this.provider.id} does not support native session adoption.`);
         }
+        if (params.managedHandoff === true) {
+            const existing = this.projection.getThread(params.threadId);
+            if (!existing || existing.sessionContext?.role !== "crew") {
+                throw new HeadlessRuntimeCoreError("INVALID_REQUEST", "Managed native adoption is restricted to an existing persisted Crew-owned Headless thread.");
+            }
+        }
         const key = nativeAdoptionOperationKey(params.threadId, params.providerSessionId);
         const activeForThread = this.activeNativeAdoptionsByThread.get(params.threadId);
         if (activeForThread)
@@ -200,6 +206,29 @@ export class HeadlessRuntimeCore {
                 return await this.adoptLegacyLoadedThread(existing, params, key);
             }
             assertNativeAdoptionIdentity(existing, params, this.provider.id);
+            const existingMetadata = recordFrom(existing.providerMetadata);
+            // A legacy orchestration Crew was already HE-owned before the native
+            // history migration ran. R5 could materialize that thread through the
+            // provider's manual takeover path, which left the external-handoff
+            // fence on an otherwise HE-owned Crew. Allow the daemon to durably
+            // reclassify that one managed binding without weakening native-session
+            // fencing for ordinary source:"native" threads.
+            if (params.managedHandoff === true &&
+                existingMetadata.nativeHandoff === "manual-sequential" &&
+                existingMetadata.nativeHistoryChangedExternally !== true) {
+                if (existing.sessionContext?.role !== "crew" || normalizedSessionContext(params.sessionContext)?.role !== "crew") {
+                    throw new HeadlessRuntimeCoreError("INVALID_REQUEST", "Managed native adoption is restricted to an existing Crew-owned Headless thread.");
+                }
+                const nextMetadata = { ...existingMetadata };
+                delete nextMetadata.nativeHandoff;
+                delete nextMetadata.nativeHandoffProof;
+                const managedThread = { ...existing, providerMetadata: nextMetadata, updatedAt: this.now() };
+                await this.appendEvent("thread/nativeHandoffManaged", {
+                    threadId: managedThread.id,
+                    thread: managedThread,
+                });
+                return { thread: this.requireThread(managedThread.id) };
+            }
             const adoptionStatus = nativeAdoptionStatus(existing.providerMetadata);
             if (adoptionStatus === "unknown" || adoptionStatus === "reserved" || adoptionStatus === "importing") {
                 throw new HeadlessRuntimeCoreError("REQUEST_TIMEOUT", `Native session adoption for ${params.providerSessionId} is incomplete and requires reconciliation before retry.`);
@@ -278,6 +307,7 @@ export class HeadlessRuntimeCore {
                 thread,
                 params: params,
                 manualHandoff: params.manualHandoff === true,
+                ...(params.managedHandoff ? { managedHandoff: true } : {}),
                 ...(params.manualHandoffProof ? { manualHandoffProof: params.manualHandoffProof } : {}),
             });
         }
@@ -357,6 +387,7 @@ export class HeadlessRuntimeCore {
                 thread: identityReady,
                 params: params,
                 manualHandoff: true,
+                ...(params.managedHandoff ? { managedHandoff: true } : {}),
                 ...(params.manualHandoffProof ? { manualHandoffProof: params.manualHandoffProof } : {}),
             });
         }
@@ -2902,6 +2933,9 @@ function assertNativeAdoptionParamsMatch(left, right, providerId) {
     if (leftProvider !== rightProvider || left.model !== right.model || left.thinkingLevel !== right.thinkingLevel) {
         throw new HeadlessRuntimeCoreError("INVALID_REQUEST", "Native session adoption is already in flight with different provider parameters.");
     }
+    if (left.managedHandoff !== right.managedHandoff) {
+        throw new HeadlessRuntimeCoreError("INVALID_REQUEST", "Native session adoption is already in flight with a different ownership mode.");
+    }
     const leftRole = normalizedSessionContext(left.sessionContext)?.role;
     const rightRole = normalizedSessionContext(right.sessionContext)?.role;
     if (leftRole !== rightRole) {

package/packages/headless-runtime/dist/index.js

@@ -185,6 +185,7 @@ async function dispatch(core, request) {
                 ...(typeof params.nativeIdentity === "string" && params.nativeIdentity.trim() ? { nativeIdentity: params.nativeIdentity.trim() } : {}),
                 ...(isSessionContext(params.sessionContext) || params.sessionContext === null ? { sessionContext: params.sessionContext } : {}),
                 ...(params.manualHandoff === true ? { manualHandoff: true } : {}),
+                ...(params.managedHandoff === true ? { managedHandoff: true } : {}),
                 ...(isManualHandoffProof(params.manualHandoffProof) ? { manualHandoffProof: params.manualHandoffProof } : {}),
             });
         case "thread/native-sync":

package/packages/runtime/dist/headless.d.ts

@@ -263,6 +263,13 @@ export type AdoptThreadParams = {
     sessionContext?: ThreadSessionContext | null;
     /** One-time user confirmation that the independent native client was stopped. */
     manualHandoff?: boolean;
+    /**
+     * The native session was created and is owned by Headless/Happy Elves. This
+     * still uses the provider's takeover path for legacy recovery, but must not
+     * turn the thread into an externally-owned manual handoff that requires a
+     * user proof before every subsequent HE turn.
+     */
+    managedHandoff?: boolean;
     /** Scope and history version observed by the user before confirming handoff. */
     manualHandoffProof?: {
         identity: string;