@ddtcorex/dsh-maestro-supervisor 0.7.2 → 0.7.4

package/lib/plugin.js

@@ -14,6 +14,9 @@ import { readIntent, consumeIntent } from './intents.js';
 import { makeSkillProvider } from './skill-provider.js';
 import { registerRestartTool } from './restart-tool.js';
 import { makePreExecuteGuard } from './self-kill-guard.js';
+import { runSessionHealthCheck } from './session-health.js';
+import { warnCoreToolLoss, recordResumedSession, recordResumeProbe, registerResumeToolHealthService, } from './resume-tools.js';
+export * from './resume-tools.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 export const inject = ['sessions', 'agents', 'connection', 'tools', 'skills'];
 function parseDuration(s) {
@@ -79,6 +82,43 @@ function getAutoResumeEnabled(config) {
     catch { }
     return true;
 }
+/**
+ * C2 — resolve the mitigation policy with exactly the same precedence chain as
+ * getAutoResumeEnabled: (1) the Cordis-supplied plugin config (cordis.patch.yml
+ * `config:` block / whatever apply() receives — highest precedence), (2) env
+ * DSH_SUPERVISOR_RESUME_CORE_TOOL_POLICY, (3) ~/.dsh/.supervisor/config.json,
+ * (4) ~/.dsh/maestro/settings.json (domains.supervisor.resumeCoreToolPolicy),
+ * (5) 'warn'. Any other value falls through to the default 'warn'.
+ */
+function getResumeCoreToolPolicy(config) {
+    if (config?.resumeCoreToolPolicy === 'warn' || config?.resumeCoreToolPolicy === 'park') {
+        return config.resumeCoreToolPolicy;
+    }
+    const env = process.env.DSH_SUPERVISOR_RESUME_CORE_TOOL_POLICY;
+    if (env) {
+        const v = env.trim().toLowerCase();
+        if (v === 'warn' || v === 'park')
+            return v;
+    }
+    try {
+        const cfgPath = path.join(os.homedir(), '.dsh/.supervisor/config.json');
+        if (fs.existsSync(cfgPath)) {
+            const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
+            const raw = cfg.resumeCoreToolPolicy;
+            if (raw === 'warn' || raw === 'park')
+                return raw;
+        }
+        const maestroPath = path.join(os.homedir(), '.dsh/maestro/settings.json');
+        if (fs.existsSync(maestroPath)) {
+            const j = JSON.parse(fs.readFileSync(maestroPath, 'utf-8'));
+            const raw = j?.domains?.supervisor?.resumeCoreToolPolicy ?? j?.supervisor?.resumeCoreToolPolicy;
+            if (raw === 'warn' || raw === 'park')
+                return raw;
+        }
+    }
+    catch { }
+    return 'warn';
+}
 function getResumeWithinMs(config) {
     // Same precedence rule as getAutoResumeEnabled: explicit config wins first.
     if (config?.autoResumeWithin !== undefined) {
@@ -134,6 +174,41 @@ function getResumeWithinMs(config) {
     catch { }
     return 5 * 60 * 1000;
 }
+/**
+ * Core tools that must be visible on a resumed session. Part C targets the
+ * post-restart bash loss (`Error: unknown tool "bash"`); extend this list to
+ * widen the probe (e.g. 'cordis_inspect_query').
+ */
+export const CRITICAL_TOOLS = ['bash'];
+/** Default: the resumed agent's tool scope is its top-level session id. */
+export const defaultResolveToolScope = (_ctx, sessionId) => sessionId;
+/**
+ * Snapshot one session's visible tool view for the journal: which CRITICAL_TOOLS
+ * are missing from the SCOPED registry (not the global view) and how many tools
+ * are visible. When the tools service is absent or lacks `get`, the probe is
+ * skipped and reports no missing tools. The log line is the Part D trigger —
+ * `bash=false` at resume marks the loss the moment it happens.
+ * @param tools - the harness ToolRegistry service, or undefined when unavailable.
+ * @param scope - the session's tool scope (defaults to the top-level session id).
+ * @param logger - optional ctx logger; the probe writes its line when present.
+ */
+export function probeToolView(tools, scope, logger) {
+    const probe = { missing: [], visible: 0 };
+    try {
+        const get = tools?.get;
+        if (typeof get !== 'function')
+            return probe;
+        probe.missing = [...CRITICAL_TOOLS].filter((name) => get(name, scope) === undefined);
+        const schemas = tools?.schemas?.(scope);
+        probe.visible = Array.isArray(schemas) ? schemas.length : 0;
+    }
+    catch { }
+    try {
+        logger?.info?.(`[supervisor] resumed ${scope}: bash=${!probe.missing.includes('bash')} visibleTools=${probe.visible} missing=${probe.missing.join(',') || 'none'}`);
+    }
+    catch { }
+    return probe;
+}
 export async function runAutoResume(ctx, opts = {}) {
     try {
         const doFind = opts.findInterrupted ?? defaultFindInterrupted;
@@ -163,7 +238,7 @@ export async function runAutoResume(ctx, opts = {}) {
             return;
         }
         ctx.logger?.info?.(`[supervisor] auto-resume: ${merged.length}/${scanned} interrupted within ${withinMs}ms: ${merged.slice(0, 3).join(', ')}`);
-        await doResume(ctx, merged);
+        await doResume(ctx, merged, { ...(opts?.config !== undefined ? { config: opts.config } : {}) });
     }
     catch (e) {
         try {
@@ -175,6 +250,9 @@ export async function runAutoResume(ctx, opts = {}) {
 export async function resumeInterrupted(ctx, ids, deps = {}) {
     const doReadIntent = deps.readIntent ?? readIntent;
     const doConsumeIntent = deps.consumeIntent ?? consumeIntent;
+    const doProbe = deps.probeToolView ?? probeToolView;
+    const doResolveToolScope = deps.resolveToolScope ?? defaultResolveToolScope;
+    const coreToolPolicy = getResumeCoreToolPolicy(deps.config);
     const resumed = [];
     for (const id of ids) {
         try {
@@ -276,6 +354,28 @@ export async function resumeInterrupted(ctx, ids, deps = {}) {
             catch { }
             resumed.push(id);
             ctx.logger?.info?.(`[supervisor] auto-resume: sent recovery continue for ${id}`);
+            // C1 observability probe — snapshot the resumed session's SCOPED tool
+            // view at the success point so a post-resume bash loss surfaces in the
+            // journal the moment it happens (Part D reads this line). Defensive:
+            // absent ctx.tools just skips the probe, never fails the resume.
+            // C2 mitigation — when the probe reports a CORE tool lost from the
+            // resumed session's SCOPED view, notify the operator + inject the tool-
+            // inventory System message (park policy additionally parks the id for a
+            // manual reopen). Both record the session as "currently resumed" and
+            // the probe as the freshest observation for maestro_resume_tool_health.
+            try {
+                const probeTools = ctx.get?.('tools') ?? ctx.tools;
+                const probe = doProbe(probeTools, doResolveToolScope(ctx, sessionId), ctx.logger);
+                recordResumedSession(sessionId);
+                if (probe.missing.length) {
+                    await warnCoreToolLoss(ctx, sessionId, doResolveToolScope(ctx, sessionId), probe, coreToolPolicy, {
+                        notify: deps.notify,
+                        injectSessionMessage: deps.injectSessionMessage,
+                    });
+                }
+                recordResumeProbe(probe);
+            }
+            catch { }
         }
         catch (e) {
             ctx.logger?.warn?.(`[supervisor] auto-resume failed ${id}: ${e?.message ?? String(e)}`);
@@ -301,9 +401,122 @@ export function createResumeRpcHandler(ctx, opts = {}) {
         if (!ids.length) {
             return { ok: false, error: { code: 'bad-request', message: 'resume requires at least one session id' } };
         }
-        return { ok: true, value: { resumed: await resume(ctx, ids) } };
+        // Forward the resume-relevant surface (config so resumeCoreToolPolicy
+        // resolves, plus the C2 injectable seams). Optional keys keep the deps
+        // object minimal — absent opts only yields `{}`.
+        const resumeDeps = {
+            ...(opts.config !== undefined ? { config: opts.config } : {}),
+            ...(opts.notify !== undefined ? { notify: opts.notify } : {}),
+            ...(opts.injectSessionMessage !== undefined ? { injectSessionMessage: opts.injectSessionMessage } : {}),
+        };
+        return { ok: true, value: { resumed: await resume(ctx, ids, resumeDeps) } };
+    };
+}
+/**
+ * Session-log root resolution shared with the safe-restart pre-flight script
+ * (skills/dsh-safe-restart/scripts/restart-dsh-web.sh): SESSIONS_ROOT wins,
+ * else DSH_HOME/sessions, else ~/.dsh/sessions. Kept in lockstep with the
+ * shell derivation so the RPC/tool and the pre-flight always scan the same
+ * store.
+ */
+function defaultSessionsRoot() {
+    if (typeof process.env.SESSIONS_ROOT === 'string' && process.env.SESSIONS_ROOT)
+        return process.env.SESSIONS_ROOT;
+    return path.join(process.env.DSH_HOME || path.join(os.homedir(), '.dsh'), 'sessions');
+}
+/** Extract a non-empty payload.root, else the resolved default session root. */
+function resolveHealthRoot(payload, config) {
+    const root = payload?.root;
+    if (typeof root === 'string' && root)
+        return root;
+    return config?.sessionLogRoot ?? defaultSessionsRoot();
+}
+/**
+ * Loopback RPC handler for /dsh-maestro-supervisor-session-health. Runs the
+ * A1 session-log health check over the resolved root with repair on and
+ * quarantine off (mirrors the safe-restart pre-flight — single-frame logs get
+ * re-encoded, corrupt logs stay in place and are only counted). Same
+ * `{ ok, value | error }` envelope shape as the resume handler.
+ */
+export function createSessionHealthRpcHandler(ctx, deps = {}) {
+    const run = deps.run ?? runSessionHealthCheck;
+    const config = deps.config ?? ctx.config;
+    return async (_endpoint, payload, _signal) => {
+        try {
+            return { ok: true, value: await run(resolveHealthRoot(payload, config), { repair: true, quarantine: false }) };
+        }
+        catch (e) {
+            return { ok: false, error: { code: 'session-health-failed', message: e?.message ?? String(e) } };
+        }
     };
 }
+/** dsh.tools definition for the maestro_session_health host tool. */
+function makeSessionHealthToolDef(config) {
+    return {
+        name: 'maestro_session_health',
+        description: 'Scan session logs under the operator DSH home sessions dir and report unhealthy shapes (single-frame whole logs, corrupt first frames). ' +
+            'Single-frame logs are re-encoded into the canonical multi-frame form (with a backup); corrupt logs are only counted unless quarantine is enabled. ' +
+            'Safe to run before or after a dsh web restart.',
+        parameters: {
+            type: 'object',
+            properties: {
+                root: { type: 'string', description: 'Session-log root to scan; defaults to the configured/operator DSH home sessions dir' },
+                repair: { type: 'boolean', description: 'Re-encode single-frame whole logs into canonical multi-frame form (default true)' },
+                quarantine: { type: 'boolean', description: 'Move corrupt-first-frame logs aside instead of leaving them in place (default false)' },
+            },
+            additionalProperties: false,
+        },
+        output: {
+            schema: { type: 'object', additionalProperties: true, properties: { ok: { type: 'boolean' }, counts: { type: 'object' } } },
+            render: (_args, value) => [{ type: 'text', text: `fixed=${value?.counts?.fixed ?? 0} quarantined=${value?.counts?.quarantined ?? 0} remaining=${value?.counts?.remaining ?? 0}` }],
+        },
+        execute: async (args) => {
+            const counts = await runSessionHealthCheck(resolveHealthRoot(args, config), {
+                repair: args?.repair !== false,
+                quarantine: args?.quarantine === true,
+            });
+            return { ok: true, counts };
+        },
+    };
+}
+/**
+ * Register the session-health RPC handle (loopback authority) and the
+ * maestro_session_health host tool. Fail-safe like the other registrations:
+ * any registration error is logged, never thrown, and the returned disposer
+ * unregisters everything that did succeed.
+ */
+export function registerSessionHealthService(ctx, config = {}) {
+    const disposers = [];
+    try {
+        const conn = ctx.connection ?? ctx.get?.('connection');
+        if (conn?.rpc?.handle) {
+            disposers.push(conn.rpc.handle('/dsh-maestro-supervisor-session-health', createSessionHealthRpcHandler(ctx, { config }), { authority: 'loopback' }));
+        }
+    }
+    catch (e) {
+        try {
+            ctx.logger?.warn?.(`[supervisor] session-health RPC registration failed: ${e?.message ?? String(e)}`);
+        }
+        catch { }
+    }
+    try {
+        if (typeof ctx.tools?.register === 'function') {
+            disposers.push(ctx.tools.register(makeSessionHealthToolDef(config)));
+        }
+    }
+    catch (e) {
+        try {
+            ctx.logger?.warn?.(`[supervisor] session-health tool registration failed: ${e?.message ?? String(e)}`);
+        }
+        catch { }
+    }
+    return () => { for (const d of disposers) {
+        try {
+            d();
+        }
+        catch { }
+    } };
+}
 /** Resolve the package-root skills/ dir regardless of module layout. The built
  * host lib is flat (lib/plugin.js → ../skills), but under vitest the same
  * module loads from src/host/ (→ ../../skills). Walking to the nearest
@@ -438,6 +651,24 @@ export function apply(ctx, config = {}) {
             }
             catch { }
         }
+        try {
+            ctx.effect(() => registerSessionHealthService(ctx, config), 'supervisor:session-health');
+        }
+        catch (e) {
+            try {
+                ctx.logger?.warn?.(`[supervisor] session-health effect failed: ${e?.message ?? String(e)}`);
+            }
+            catch { }
+        }
+        try {
+            ctx.effect(() => registerResumeToolHealthService(ctx), 'supervisor:resume-tool-health');
+        }
+        catch (e) {
+            try {
+                ctx.logger?.warn?.(`[supervisor] resume-tool-health effect failed: ${e?.message ?? String(e)}`);
+            }
+            catch { }
+        }
         ctx.effect(() => {
             let disposed = false;
             let timer = null;

package/lib/resume-tools.d.ts

@@ -0,0 +1,101 @@
+/**
+ * C2 — deterministic plugin-layer mitigation for resumed sessions that lose
+ * core tools after a dsh web restart (`Error: unknown tool "bash"`).
+ *
+ * The supervisor cannot edit the harness tool layer (hard workspace rule) and
+ * the exact layer-rebuild root cause is only observable on the live system
+ * (Part D). So when the post-resume probe (C1) reports a core tool missing
+ * from the resumed session's SCOPED view, this module runs a host-side
+ * mitigation:
+ *
+ *   1. a short notifier line so the operator sees the loss immediately;
+ *   2. a "System:"-prefixed inventory user-message injected into the session
+ *      (same createUserMessage/followup pattern as the resume-intent message),
+ *      so the model stops calling the lost tool and uses what remains;
+ *   3. optionally (resumeCoreToolPolicy: 'park') records the session id in a
+ *      module-level parked set exposed through the `maestro_resume_tool_health`
+ *      host tool + loopback RPC, marking it for manual reopen.
+ *
+ * The module-level state (`parkedCoreToolLossIds`, `lastResumeProbe`,
+ * `resumedSessions`) is per-`dsh web`-process: a host restart clears it, which
+ * is exactly right — these are per-boot facts.
+ */
+import { type ToolViewProbe, type ToolViewProbeFn, type ToolScopeResolver, type ToolsLike, type ResumeCoreToolPolicy } from './plugin.js';
+/** Reset the per-process mitigation state — tests + fresh boot reuse. */
+export declare function resetResumeToolHealthState(): void;
+/** Record a session the auto-resume confirmed as resumed (on-demand probe target). */
+export declare function recordResumedSession(sessionId: string): void;
+/** Record the last REAL post-resume tool-view observation ({ missing, visible }). */
+export declare function recordResumeProbe(probe: ToolViewProbe): void;
+/**
+ * Operator-facing notify line. The park variant appends the manual-reopen
+ * marker so the operator knows the session was NOT auto-continued for tools.
+ */
+export declare function buildCoreToolLossNotifyLine(sessionId: string, missing: string[], policy: ResumeCoreToolPolicy): string;
+/**
+ * The SYSTEM message injected into the resumed session. Tells the model the
+ * CURRENT inventory (scoped `schemas()` — the tools the session can actually
+ * call) so it stops issuing the lost tool instead of looping on unknown-tool
+ * errors. Names joined with ', '.
+ */
+export declare function buildToolInventoryMessage(missing: string[], available: string[]): string;
+export interface WarnCoreToolLossDeps {
+    /** Loose notifier — default wires to the package notifier (swallows errors). */
+    notify?: (line: string) => Promise<void>;
+    /** Push a message into the resumed session — default follows the createUserMessage / followup pattern. */
+    injectSessionMessage?: (sessionId: string, content: string) => unknown;
+    /** Tool registry whose SCOPED schemas() yields the available-tool inventory. Defaults to ctx.tools. */
+    tools?: ToolsLike;
+}
+/**
+ * C2 mitigation entry: called by the resume flow when the post-resume probe
+ * found a core tool missing. Notifies, injects the inventory message, and —
+ * under 'park' policy — records the session id. Only fires on an actual
+ * CRITICAL_TOOLS loss; a non-core missing name (e.g. cordis_inspect_query)
+ * is a no-op. All seams are injectable for tests; every step is defensive.
+ */
+export declare function warnCoreToolLoss(ctx: any, sessionId: string, scope: string, probe: ToolViewProbe, policy: ResumeCoreToolPolicy, opts?: WarnCoreToolLossDeps): Promise<void>;
+export interface ResumeToolHealthSnapshot {
+    lastResumeProbe: ToolViewProbe | null;
+    parked: string[];
+}
+/**
+ * Build the RPC value. When the tool registry is reachable AND at least one
+ * current resumed session still lives, re-probes each session's SCOPED view
+ * on demand and records the aggregate as the freshest `lastResumeProbe`;
+ * otherwise returns the stored last observation unchanged ('tool registry
+ * unreachable -> lastResumeProbe' contract). Session ids whose agent is gone
+ * are skipped (they are no longer "current resumed sessions").
+ */
+export declare function snapshotResumeToolHealth(ctx: any, deps?: {
+    probeToolView?: ToolViewProbeFn;
+    resolveToolScope?: ToolScopeResolver;
+}): ResumeToolHealthSnapshot;
+/**
+ * Loopback RPC handler for /dsh-maestro-supervisor-resume-tool-health.
+ * Same `{ ok, value | error }` envelope shape as the other supervisor RPCs.
+ */
+export declare function createResumeToolHealthRpcHandler(ctx: any, deps?: {
+    probeToolView?: ToolViewProbeFn;
+    resolveToolScope?: ToolScopeResolver;
+}): (_endpoint: string, _payload: unknown, _signal: AbortSignal) => Promise<{
+    ok: boolean;
+    value: ResumeToolHealthSnapshot;
+    error?: undefined;
+} | {
+    ok: boolean;
+    error: {
+        code: string;
+        message: any;
+    };
+    value?: undefined;
+}>;
+/** dsh.tools definition for the maestro_resume_tool_health host tool. */
+export declare function makeResumeToolHealthToolDef(ctx: any): any;
+/**
+ * Register the resume-tool-health RPC handle (loopback authority) and the
+ * maestro_resume_tool_health host tool. Fail-safe like the other
+ * registrations: any registration error is logged, never thrown, and the
+ * returned disposer unregisters everything that did succeed.
+ */
+export declare function registerResumeToolHealthService(ctx: any): () => void;

package/lib/resume-tools.js

@@ -0,0 +1,248 @@
+/**
+ * C2 — deterministic plugin-layer mitigation for resumed sessions that lose
+ * core tools after a dsh web restart (`Error: unknown tool "bash"`).
+ *
+ * The supervisor cannot edit the harness tool layer (hard workspace rule) and
+ * the exact layer-rebuild root cause is only observable on the live system
+ * (Part D). So when the post-resume probe (C1) reports a core tool missing
+ * from the resumed session's SCOPED view, this module runs a host-side
+ * mitigation:
+ *
+ *   1. a short notifier line so the operator sees the loss immediately;
+ *   2. a "System:"-prefixed inventory user-message injected into the session
+ *      (same createUserMessage/followup pattern as the resume-intent message),
+ *      so the model stops calling the lost tool and uses what remains;
+ *   3. optionally (resumeCoreToolPolicy: 'park') records the session id in a
+ *      module-level parked set exposed through the `maestro_resume_tool_health`
+ *      host tool + loopback RPC, marking it for manual reopen.
+ *
+ * The module-level state (`parkedCoreToolLossIds`, `lastResumeProbe`,
+ * `resumedSessions`) is per-`dsh web`-process: a host restart clears it, which
+ * is exactly right — these are per-boot facts.
+ */
+import { notify } from './notifier.js';
+import { probeToolView, defaultResolveToolScope, CRITICAL_TOOLS, } from './plugin.js';
+// --- module-level mitigation state ---------------------------------------------
+let lastResumeProbe = null;
+const parkedCoreToolLossIds = new Set();
+const resumedSessions = new Set();
+/** Reset the per-process mitigation state — tests + fresh boot reuse. */
+export function resetResumeToolHealthState() {
+    lastResumeProbe = null;
+    parkedCoreToolLossIds.clear();
+    resumedSessions.clear();
+}
+/** Record a session the auto-resume confirmed as resumed (on-demand probe target). */
+export function recordResumedSession(sessionId) {
+    resumedSessions.add(sessionId);
+}
+/** Record the last REAL post-resume tool-view observation ({ missing, visible }). */
+export function recordResumeProbe(probe) {
+    lastResumeProbe = probe;
+}
+// --- message builders -----------------------------------------------------------
+/**
+ * Operator-facing notify line. The park variant appends the manual-reopen
+ * marker so the operator knows the session was NOT auto-continued for tools.
+ */
+export function buildCoreToolLossNotifyLine(sessionId, missing, policy) {
+    const base = `[supervisor] resumed ${sessionId}: core tool lost [${missing.join(',')}] — tool view incomplete; reopen session if it persists`;
+    return policy === 'park' ? `${base} (manual reopen required)` : base;
+}
+/**
+ * The SYSTEM message injected into the resumed session. Tells the model the
+ * CURRENT inventory (scoped `schemas()` — the tools the session can actually
+ * call) so it stops issuing the lost tool instead of looping on unknown-tool
+ * errors. Names joined with ', '.
+ */
+export function buildToolInventoryMessage(missing, available) {
+    const names = missing.join(', ');
+    const verb = missing.length === 1 ? 'tool is' : 'tools are';
+    return `System: the ${names} ${verb} unavailable in this session's restored tool view. Available tools: ${available.join(', ')}. Do not call ${names}; use the available tools.`;
+}
+/** Scoped schemas() = exactly what the session can still call; never the global view. */
+function resolveAvailableToolNames(tools, scope) {
+    try {
+        const schemas = typeof tools?.schemas === 'function' ? tools.schemas : undefined;
+        if (!schemas)
+            return [];
+        const list = schemas(scope);
+        if (!Array.isArray(list))
+            return [];
+        return list.map((t) => (t && typeof t.name === 'string' ? t.name : '')).filter((n) => n.length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Default session-message injection: mirrors the resume-intent push in
+ * plugin.ts `resumeInterrupted` — `createUserMessage` (dynamic import so the
+ * plugin loads without the LLM package ever installed) + `agent.followup`.
+ * Never throws; a missing agent just no-ops.
+ */
+function makeDefaultSessionMessageInjector(ctx) {
+    return async (sessionId, content) => {
+        try {
+            const agents = ctx.get?.('agents') ?? ctx.agents;
+            const agent = typeof agents?.get === 'function' ? agents.get(sessionId) : undefined;
+            if (typeof agent?.followup !== 'function')
+                return;
+            const { createUserMessage } = await import('@deepseek-ai/dsh-llm').catch(() => ({
+                createUserMessage: (input) => ({ ...input, role: 'user', id: crypto.randomUUID() }),
+            }));
+            agent.followup(createUserMessage({
+                content: [{ type: 'text', text: content }],
+                source: { kind: 'user' },
+            }));
+        }
+        catch { }
+    };
+}
+/**
+ * C2 mitigation entry: called by the resume flow when the post-resume probe
+ * found a core tool missing. Notifies, injects the inventory message, and —
+ * under 'park' policy — records the session id. Only fires on an actual
+ * CRITICAL_TOOLS loss; a non-core missing name (e.g. cordis_inspect_query)
+ * is a no-op. All seams are injectable for tests; every step is defensive.
+ */
+export async function warnCoreToolLoss(ctx, sessionId, scope, probe, policy, opts = {}) {
+    const lostCore = probe.missing.filter((n) => CRITICAL_TOOLS.includes(n));
+    if (!lostCore.length)
+        return;
+    const doNotify = opts.notify ?? ((line) => notify(line));
+    try {
+        await doNotify(buildCoreToolLossNotifyLine(sessionId, lostCore, policy));
+    }
+    catch { }
+    try {
+        const tools = opts.tools ?? (ctx.get?.('tools') ?? ctx.tools);
+        const doInject = opts.injectSessionMessage ?? makeDefaultSessionMessageInjector(ctx);
+        await doInject(sessionId, buildToolInventoryMessage(lostCore, resolveAvailableToolNames(tools, scope)));
+    }
+    catch { }
+    if (policy === 'park')
+        parkedCoreToolLossIds.add(sessionId);
+}
+function mergeResumeProbes(base, next) {
+    if (!base)
+        return next;
+    return {
+        missing: Array.from(new Set([...base.missing, ...next.missing])),
+        visible: base.visible + next.visible,
+    };
+}
+/**
+ * Build the RPC value. When the tool registry is reachable AND at least one
+ * current resumed session still lives, re-probes each session's SCOPED view
+ * on demand and records the aggregate as the freshest `lastResumeProbe`;
+ * otherwise returns the stored last observation unchanged ('tool registry
+ * unreachable -> lastResumeProbe' contract). Session ids whose agent is gone
+ * are skipped (they are no longer "current resumed sessions").
+ */
+export function snapshotResumeToolHealth(ctx, deps = {}) {
+    const doProbe = deps.probeToolView ?? probeToolView;
+    const doResolve = deps.resolveToolScope ?? defaultResolveToolScope;
+    const tools = ctx.get?.('tools') ?? ctx.tools;
+    let reachable = false;
+    let aggregated = null;
+    for (const id of resumedSessions) {
+        try {
+            const agents = ctx.get?.('agents') ?? ctx.agents;
+            if (typeof agents?.get === 'function' && agents.get(id) === undefined)
+                continue;
+            aggregated = mergeResumeProbes(aggregated, doProbe(tools, doResolve(ctx, id)));
+            reachable = true;
+        }
+        catch { }
+    }
+    if (reachable && aggregated)
+        lastResumeProbe = aggregated;
+    return { lastResumeProbe, parked: [...parkedCoreToolLossIds] };
+}
+/**
+ * Loopback RPC handler for /dsh-maestro-supervisor-resume-tool-health.
+ * Same `{ ok, value | error }` envelope shape as the other supervisor RPCs.
+ */
+export function createResumeToolHealthRpcHandler(ctx, deps = {}) {
+    return async (_endpoint, _payload, _signal) => {
+        try {
+            return { ok: true, value: snapshotResumeToolHealth(ctx, deps) };
+        }
+        catch (e) {
+            return { ok: false, error: { code: 'resume-tool-health-failed', message: e?.message ?? String(e) } };
+        }
+    };
+}
+/** dsh.tools definition for the maestro_resume_tool_health host tool. */
+export function makeResumeToolHealthToolDef(ctx) {
+    return {
+        name: 'maestro_resume_tool_health',
+        description: 'Report the tool-view health of sessions auto-resumed after a dsh web restart. ' +
+            'Returns the last post-resume probe (missing core tools, visible count) plus the sessions ' +
+            'parked for manual reopen under resumeCoreToolPolicy: park. The probe is refreshed on demand ' +
+            'against the currently resumed sessions when the tool registry is reachable.',
+        parameters: { type: 'object', properties: {}, additionalProperties: false },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: true,
+                properties: {
+                    lastResumeProbe: {
+                        type: 'object',
+                        properties: {
+                            missing: { type: 'array', items: { type: 'string' } },
+                            visible: { type: 'number' },
+                        },
+                    },
+                    parked: { type: 'array', items: { type: 'string' } },
+                },
+            },
+            render: (_args, value) => {
+                const probe = value?.lastResumeProbe;
+                const missing = Array.isArray(probe?.missing) && probe.missing.length ? probe.missing.join(',') : 'none';
+                const visible = typeof probe?.visible === 'number' ? probe.visible : 'n/a';
+                return [{ type: 'text', text: `missing=${missing} visible=${visible} parked=${Array.isArray(value?.parked) ? value.parked.length : 0}` }];
+            },
+        },
+        execute: async () => snapshotResumeToolHealth(ctx),
+    };
+}
+/**
+ * Register the resume-tool-health RPC handle (loopback authority) and the
+ * maestro_resume_tool_health host tool. Fail-safe like the other
+ * registrations: any registration error is logged, never thrown, and the
+ * returned disposer unregisters everything that did succeed.
+ */
+export function registerResumeToolHealthService(ctx) {
+    const disposers = [];
+    try {
+        const conn = ctx.connection ?? ctx.get?.('connection');
+        if (conn?.rpc?.handle) {
+            disposers.push(conn.rpc.handle('/dsh-maestro-supervisor-resume-tool-health', createResumeToolHealthRpcHandler(ctx), { authority: 'loopback' }));
+        }
+    }
+    catch (e) {
+        try {
+            ctx.logger?.warn?.(`[supervisor] resume-tool-health RPC registration failed: ${e?.message ?? String(e)}`);
+        }
+        catch { }
+    }
+    try {
+        if (typeof ctx.tools?.register === 'function') {
+            disposers.push(ctx.tools.register(makeResumeToolHealthToolDef(ctx)));
+        }
+    }
+    catch (e) {
+        try {
+            ctx.logger?.warn?.(`[supervisor] resume-tool-health tool registration failed: ${e?.message ?? String(e)}`);
+        }
+        catch { }
+    }
+    return () => { for (const d of disposers) {
+        try {
+            d();
+        }
+        catch { }
+    } };
+}