@frockbot/plugin-shell 0.3.9 → 0.3.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/plugin-shell",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "private": false,
   "type": "module",
   "exports": {
@@ -30,6 +30,7 @@
     "./frockbot.json": "./frockbot.json",
     "./host": "./src/host.ts",
     "./manifest": "./src/manifest.ts",
+    "./notification-id": "./src/notification-id.ts",
     "./package.json": "./package.json",
     "./run-cursor": "./src/run-cursor.ts",
     "./run-protocol": "./src/run-protocol.ts",
@@ -47,41 +48,42 @@
   },
   "dependencies": {
     "@cordisjs/plugin-webui": "0.8.2",
-    "@frockbot/agent-runtime": "0.3.9",
-    "@frockbot/application-foundation": "0.3.9",
-    "@frockbot/catalog-core": "0.3.9",
-    "@frockbot/client-core": "0.3.9",
-    "@frockbot/client-ui": "0.3.9",
-    "@frockbot/computer-core": "0.3.9",
-    "@frockbot/computer-host-protocol": "0.3.9",
-    "@frockbot/configuration-core": "0.3.9",
-    "@frockbot/connection-core": "0.3.9",
-    "@frockbot/kernel-agent-loop": "0.3.9",
-    "@frockbot/kernel-composition": "0.3.9",
-    "@frockbot/kernel-contracts": "0.3.9",
-    "@frockbot/kernel-do": "0.3.9",
-    "@frockbot/machine-protocol": "0.3.9",
-    "@frockbot/plugin-applets": "0.3.9",
-    "@frockbot/plugin-authoring": "0.3.9",
-    "@frockbot/plugin-bot-template": "0.3.9",
-    "@frockbot/plugin-computer": "0.3.9",
-    "@frockbot/plugin-flock": "0.3.9",
-    "@frockbot/plugin-image": "0.3.9",
-    "@frockbot/plugin-machine-messages": "0.3.9",
-    "@frockbot/plugin-mcp": "0.3.9",
-    "@frockbot/plugin-memory": "0.3.9",
-    "@frockbot/plugin-package-catalog": "0.3.9",
-    "@frockbot/plugin-routines": "0.3.9",
-    "@frockbot/plugin-skills": "0.3.9",
-    "@frockbot/plugin-subagents": "0.3.9",
-    "@frockbot/plugin-user-machine": "0.3.9",
-    "@frockbot/protocol": "0.3.9",
+    "@frockbot/agent-runtime": "0.3.11",
+    "@frockbot/application-foundation": "0.3.11",
+    "@frockbot/catalog-core": "0.3.11",
+    "@frockbot/client-core": "0.3.11",
+    "@frockbot/client-ui": "0.3.11",
+    "@frockbot/computer-core": "0.3.11",
+    "@frockbot/computer-host-protocol": "0.3.11",
+    "@frockbot/configuration-core": "0.3.11",
+    "@frockbot/connection-core": "0.3.11",
+    "@frockbot/kernel-agent-loop": "0.3.11",
+    "@frockbot/kernel-composition": "0.3.11",
+    "@frockbot/kernel-contracts": "0.3.11",
+    "@frockbot/kernel-do": "0.3.11",
+    "@frockbot/machine-protocol": "0.3.11",
+    "@frockbot/plugin-applets": "0.3.11",
+    "@frockbot/plugin-authoring": "0.3.11",
+    "@frockbot/plugin-bot-template": "0.3.11",
+    "@frockbot/plugin-computer": "0.3.11",
+    "@frockbot/plugin-flock": "0.3.11",
+    "@frockbot/plugin-image": "0.3.11",
+    "@frockbot/plugin-machine-messages": "0.3.11",
+    "@frockbot/plugin-mcp": "0.3.11",
+    "@frockbot/plugin-memory": "0.3.11",
+    "@frockbot/plugin-package-catalog": "0.3.11",
+    "@frockbot/plugin-routines": "0.3.11",
+    "@frockbot/plugin-skills": "0.3.11",
+    "@frockbot/plugin-subagents": "0.3.11",
+    "@frockbot/plugin-user-machine": "0.3.11",
+    "@frockbot/protocol": "0.3.11",
     "cordis": "4.0.0-rc.8",
     "vue": "3.5.41"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "latest",
-    "@frockbot/plugin-tools": "0.3.9",
+    "@frockbot/plugin-prompt": "0.3.11",
+    "@frockbot/plugin-tools": "0.3.11",
     "@types/bun": "1.3.6",
     "@types/node": "26.2.0",
     "@vitejs/plugin-vue": "6.0.8",

package/src/agent.test.ts

@@ -8,9 +8,12 @@ import {
   type ToolExecutionContext,
   type TurnTypeV1,
 } from "@frockbot/kernel-contracts";
+import { SystemPromptRegistry } from "@frockbot/plugin-prompt";
 import { ToolRegistry } from "@frockbot/plugin-tools";
 import { Context } from "cordis";
 import {
+  CONVERSATION_PROMPT_SECTION_V1,
+  CONVERSATION_PROMPT_TEXT_V1,
   shellAdmissionCeilingV1,
   shellAgentPlugin,
   PARENT_HANDOFF_CAPABILITY_V1,
@@ -31,6 +34,7 @@ interface Mounted {
 async function mount(): Promise<Mounted> {
   const root = new Context();
   await root.plugin(SessionStore);
+  await root.plugin(SystemPromptRegistry);
   await root.plugin(ToolRegistry);
   const session = root.sessions.create(SESSION_ID);
   session.appendBatch([
@@ -382,3 +386,65 @@ describe("wake_parent", () => {
     }
   });
 });
+
+// The conversational contract is a prompt section and a tool description, and
+// the two have to say the same thing: a model that read one and not the other
+// would have half the rule.
+describe("the conversation prompt section", () => {
+  test("is assembled into the system prompt the model reads", async () => {
+    const mounted = await mount();
+    try {
+      const assembled = await mounted.root.systemPrompt.assemble({
+        sessionId: SESSION_ID,
+        provider: "test",
+        model: "test-model",
+        turnType: "chat",
+      });
+
+      const section = assembled.sections.find(
+        (candidate) => candidate.id === CONVERSATION_PROMPT_SECTION_V1,
+      );
+      expect(section?.text).toBe(CONVERSATION_PROMPT_TEXT_V1);
+      expect(assembled.text).toContain(CONVERSATION_PROMPT_TEXT_V1);
+    } finally {
+      await mounted.dispose();
+    }
+  });
+
+  test("says acknowledge first, then beats, and never the steps between", () => {
+    expect(CONVERSATION_PROMPT_TEXT_V1).toContain("On it.");
+    expect(CONVERSATION_PROMPT_TEXT_V1).toContain(
+      "send only on a real beat: the result, a decision only the user can make, or a blocker",
+    );
+    expect(CONVERSATION_PROMPT_TEXT_V1).toContain(
+      "Never narrate what you are doing",
+    );
+    expect(CONVERSATION_PROMPT_TEXT_V1).toContain(
+      "Never leave a question or a request hanging",
+    );
+    // Short enough to be read as guidance rather than skimmed as a document.
+    expect(CONVERSATION_PROMPT_TEXT_V1.split("\n").length).toBeLessThanOrEqual(
+      12,
+    );
+  });
+
+  test("matches what the send tool's own description tells the model", async () => {
+    const mounted = await mount();
+    try {
+      const schema = mounted.root.tools
+        .schemas({ turnType: "chat" })
+        .find((tool) => tool.name === SEND_TO_USER_TOOL_V1);
+      const description = schema?.description ?? "";
+
+      expect(description).toContain("only way to say anything the user sees");
+      // When to call it, not only what it does.
+      expect(description).toContain("Call it once, immediately");
+      expect(description).toContain("Call it again only on a real");
+      expect(description).toContain("narrate a step or a tool");
+      expect(description).toContain("never end your Turn leaving the");
+      expect(description).toContain("keep it short");
+    } finally {
+      await mounted.dispose();
+    }
+  });
+});

package/src/agent.ts

@@ -3,6 +3,10 @@
 //
 // Two tools, and no authority of its own:
 //
+//  0. One prompt section, `conversation`: when to speak and when not to. It
+//     is contributed beside the tool so the section and the tool description
+//     cannot drift into telling the model two different things.
+//
 //  1. `send_to_user` (legacy alias `send_message`) — parity register row 57b.
 //     One tool carrying the typed payload union, admitted on chat turns only,
 //     recording each send as `send/to-user` on the durable log. Row 57c: a
@@ -127,8 +131,38 @@ function sendAcknowledgement(payload: SendToUserPayloadV1): string {
   }
 }
 
+/**
+ * The Bot's conversational contract, in the words the model reads.
+ *
+ * It lives here rather than in a prompt Package because it is the same rule
+ * the send tool's own description states: one place to write it, so the
+ * section and the tool cannot drift into telling the model two things. The
+ * Shell already owns the voice; it owns how the voice is used.
+ */
+export const CONVERSATION_PROMPT_SECTION_V1 = "conversation";
+/** Ordered after identity (0), before anything a Package contributes. */
+export const CONVERSATION_PROMPT_ORDER_V1 = 1;
+
+export const CONVERSATION_PROMPT_TEXT_V1 = [
+  "## Talking to the user",
+  "",
+  "Everything the user sees is a `send_to_user` call; nothing else reaches them.",
+  'When a request will take more than a moment, send one short line first — "On it." or "Looking into that." — then go quiet and work.',
+  "After that, send only on a real beat: the result, a decision only the user can make, or a blocker you cannot get past.",
+  "Never narrate what you are doing, what you are about to do, or which tool you are using.",
+  "Never leave a question or a request hanging: before you stop, the user must have the answer, the result, or the reason there isn't one.",
+  "When the work is finished, send the result itself, not an account of how you got it.",
+  "Keep every message short — a line or two, no preamble and no sign-off.",
+  "Don't say the same thing twice.",
+].join("\n");
+
 const SEND_TO_USER_DESCRIPTION = [
   "Speak to the user. This is the only way to say anything the user sees.",
+  "Call it once, immediately, with one short line when the request will take",
+  "more than a moment, then work in silence. Call it again only on a real",
+  "beat: the result, a decision only the user can make, or a blocker. Do not",
+  "call it to narrate a step or a tool, and never end your Turn leaving the",
+  "user's question unanswered. Each call is one message; keep it short.",
   "The payload is one of:",
   '{"type":"text","text":"…"}',
   '{"type":"attachment","url":"https://…","name":"…","mediaType":"…"}',
@@ -295,6 +329,13 @@ export const shellAgentPlugin: Plugin.Function = (ctx) => {
   const userVoice = shellAdmissionCeilingV1(USER_VOICE_CAPABILITY_V1);
   const parentHandoff = shellAdmissionCeilingV1(PARENT_HANDOFF_CAPABILITY_V1);
   const disposers = [
+    // The voice and the rules for using it are contributed together, so a
+    // Composition that admits the send tool always carries the contract.
+    ctx.systemPrompt.register({
+      id: CONVERSATION_PROMPT_SECTION_V1,
+      order: CONVERSATION_PROMPT_ORDER_V1,
+      render: () => CONVERSATION_PROMPT_TEXT_V1,
+    }),
     ctx.tools.register(
       createSendToUserTool(SEND_TO_USER_TOOL_V1, ctx.sessions),
       userVoice ? { admissionCeiling: userVoice } : undefined,
@@ -327,6 +368,6 @@ export const shellAgentPlugin: Plugin.Function = (ctx) => {
     for (const dispose of disposers.toReversed()) dispose();
   };
 };
-shellAgentPlugin.inject = ["tools", "sessions"];
+shellAgentPlugin.inject = ["tools", "sessions", "systemPrompt"];
 
 export default shellAgentPlugin;

package/src/backend-configuration.test.ts

@@ -8,6 +8,7 @@ import type {
 import type { PackageSettingDefinition } from "@frockbot/kernel-composition";
 import { createShellBotBackendContribution } from "./backend.js";
 import { createIsolateCapabilityHost } from "./backend-isolate.js";
+import { notificationIdV1 } from "./notification-id.js";
 
 class MemoryStorage {
   readonly values = new Map<string, unknown>();
@@ -600,8 +601,15 @@ describe("generic per-Turn model resolution", () => {
     });
     await expect(contribution.listNotifications()).resolves.toEqual([
       expect.objectContaining({
-        notificationId:
-          "package-connection-unavailable:run-1:bot-authored:flock-ai-ambient",
+        // Colons would fail the acknowledge decoder, so the mint replaces
+        // them and folds in a digest of the raw parts; a notification nobody
+        // can acknowledge 400s forever.
+        notificationId: notificationIdV1(
+          "package-connection-unavailable",
+          "run-1",
+          "bot-authored",
+          "flock-ai-ambient",
+        ),
         title: "Connection unavailable",
       }),
     ]);

package/src/backend-package-catalog.ts

@@ -320,7 +320,7 @@ export function createPackageCatalogHost(
           change.action === "remove"
             ? change.input.packageId
             : change.input.catalogId,
-        ...(change.action === "remove"
+        ...(change.action === "remove" || change.input.contentHash === undefined
           ? {}
           : { contentHash: change.input.contentHash }),
       }),
@@ -591,6 +591,13 @@ export function createPackageCatalogHost(
       let user: UserSettingsViewV1;
       let base: CompositionGenerationV1;
       let intent: PackageCatalogChangeIntentV1;
+      /**
+       * The entry names a compiled-in Package that is already required core in
+       * this Bot's Composition, so installing it is a User settings change and
+       * nothing else. Set on the install path and re-derived on a resumed
+       * intent, which carries no bundle hash precisely when this is true.
+       */
+      let firstParty = false;
       try {
         user = await options.user.read();
         base = await options.composition.lastKnownGood();
@@ -611,6 +618,12 @@ export function createPackageCatalogHost(
             );
           entry = resumed;
           intent = existingIntent;
+          firstParty =
+            existingIntent.action !== "remove" &&
+            !resumed.bundle &&
+            base.members.find(
+              (candidate) => candidate.packageId === resumed.packageId,
+            )?.provenance.kind === "first-party";
         } else if (action === "remove") {
           const packageId = request.change.input.packageId;
           const member = base.members.find(
@@ -673,21 +686,46 @@ export function createPackageCatalogHost(
           const resolved = await pinnedEntry(request.change.input.catalogId);
           user = resolved.user;
           entry = resolved.entry;
-          if (!entry.bundle) {
-            throw new Error(
-              `Catalog entry "${entry.catalogId}" does not carry installable code`,
-            );
-          }
-          if (entry.bundle.contentHash !== request.change.input.contentHash) {
+          // A first-party entry names reviewed compiled-in code and publishes
+          // no bundle: there is no artifact to verify and no hash to pin. The
+          // Plugins page has always installed such an entry; refusing it here
+          // is what made `package_install` by chat disagree with the UI (F4).
+          if (entry.bundle) {
+            if (entry.bundle.contentHash !== request.change.input.contentHash) {
+              throw new Error(
+                `Catalog entry "${entry.catalogId}" has content hash "${entry.bundle.contentHash}", not "${request.change.input.contentHash}"`,
+              );
+            }
+            await verifyArtifact(entry);
+          } else if (request.change.input.contentHash !== undefined) {
             throw new Error(
-              `Catalog entry "${entry.catalogId}" has content hash "${entry.bundle.contentHash}", not "${request.change.input.contentHash}"`,
+              `Catalog entry "${entry.catalogId}" does not carry a Package bundle`,
             );
           }
-          await verifyArtifact(entry);
           const member = base.members.find(
             (candidate) => candidate.packageId === entry.packageId,
           );
-          if (action === "install" && member) {
+          // Installing a first-party entry changes the *User's* settings, not
+          // the Composition: the compiled-in Package is already required core
+          // in the bootstrap generation (every one of them is), and
+          // `assertRequiredCoreSet` refuses any proposal that restates a
+          // first-party member with catalog provenance. So "already a member"
+          // is the normal state here, not a conflict — the guard below is
+          // about a *bundle-backed* entry, whose code really would be added
+          // twice.
+          firstParty =
+            !entry.bundle && member?.provenance.kind === "first-party";
+          if (firstParty) {
+            // The one integrity check left for a member nothing re-hashes at
+            // mount: the entry must name the manifest the application actually
+            // compiled in, or the Catalog has drifted from this deployment.
+            if (member!.manifestHash !== entry.manifestHash) {
+              throw new Error(
+                `Catalog entry "${entry.catalogId}" names manifest "${entry.manifestHash}", but this deployment ships "${member!.manifestHash}"`,
+              );
+            }
+          }
+          if (action === "install" && member && !firstParty) {
             throw new Error(
               `Package "${entry.packageId}" is already in this Bot's Composition`,
             );
@@ -716,7 +754,7 @@ export function createPackageCatalogHost(
             version: entry.version,
             catalogId: entry.catalogId,
             catalogGeneration: resolved.generation,
-            contentHash: entry.bundle.contentHash,
+            ...(entry.bundle ? { contentHash: entry.bundle.contentHash } : {}),
             manifestHash: entry.manifestHash,
             summary:
               request.change.input.summary ??
@@ -744,16 +782,27 @@ export function createPackageCatalogHost(
       // Intent and manifest before the User settings effect. The manifest key
       // is the existing isolate loader seam used by authored Packages.
       if (!existingIntent) {
+        const bundle = entry.bundle;
         await options.storage.put({
           [packageCatalogChangeIntentKey(request.effectId)]: intent,
-          [authorshipManifestKey(intent.manifestHash)]: {
-            schemaVersion: 1,
-            manifestHash: intent.manifestHash,
-            packageId: intent.packageId,
-            version: intent.version,
-            manifest: entry.bundle!.manifest,
-            createdAt: intent.recordedAt,
-          } satisfies AuthoredManifestRecordV1,
+          // A bundle-less entry stores no manifest document, because it adds
+          // no Composition member to mount one for: the compiled-in Package is
+          // already required core, running the manifest this deployment
+          // shipped. The entry's `manifestHash` was checked against that
+          // member's above, so a Catalog that has drifted from this deployment
+          // is refused rather than silently recorded.
+          ...(bundle
+            ? {
+                [authorshipManifestKey(intent.manifestHash)]: {
+                  schemaVersion: 1,
+                  manifestHash: intent.manifestHash,
+                  packageId: intent.packageId,
+                  version: intent.version,
+                  manifest: bundle.manifest,
+                  createdAt: intent.recordedAt,
+                } satisfies AuthoredManifestRecordV1,
+              }
+            : {}),
         });
         existingIntent = intent;
       }
@@ -776,7 +825,9 @@ export function createPackageCatalogHost(
               version: intent.version,
               catalogId: intent.catalogId,
               catalogGeneration: intent.catalogGeneration,
-              contentHash: intent.contentHash,
+              ...(intent.contentHash === undefined
+                ? {}
+                : { contentHash: intent.contentHash }),
             };
       const receipt = await options.user.execute(command);
       if (receipt.status === "rejected") {
@@ -785,6 +836,30 @@ export function createPackageCatalogHost(
 
       const parent =
         (await options.composition.read(intent.baseGenerationId)) ?? base;
+      // A first-party entry contributes no member: it is already required core
+      // in the bootstrap generation, and restating it with catalog provenance
+      // is exactly what `assertRequiredCoreSet` refuses. The install is the
+      // User settings command above, which is all the Plugins page does too,
+      // so the Composition is left on the generation it was already running.
+      if (firstParty) {
+        const outcome: PackageCatalogChangeOutcomeRecordV1 = {
+          schemaVersion: 1,
+          status: "recorded",
+          effectId: request.effectId,
+          action,
+          packageId: intent.packageId,
+          displayName: intent.displayName,
+          version: intent.version,
+          generationId: parent.generationId,
+          missingConnectionTypes: intent.missingConnectionTypes,
+          recordedAt: intent.recordedAt,
+        };
+        await options.storage.put({
+          [packageCatalogChangeOutcomeKey(request.effectId)]: outcome,
+        });
+        return recordedOutcome(outcome);
+      }
+
       const members = parent.members.filter(
         (member) => member.packageId !== intent.packageId,
       );
@@ -850,7 +925,9 @@ export function createPackageCatalogHost(
         packageId: intent.packageId,
         displayName: intent.displayName,
         ...(action === "remove" ? {} : { version: intent.version }),
-        ...(action === "remove" ? {} : { contentHash: intent.contentHash }),
+        ...(action === "remove" || intent.contentHash === undefined
+          ? {}
+          : { contentHash: intent.contentHash }),
         generationId: generation.generationId,
         missingConnectionTypes: intent.missingConnectionTypes,
         recordedAt: intent.recordedAt,

package/src/backend.ts

@@ -415,6 +415,12 @@ import {
   type ClientRunV1,
   type ClientTurnV1,
 } from "./run-protocol.js";
+import { notificationIdV1 } from "./notification-id.js";
+import {
+  type CompositionManifestSourcesV1,
+  compositionMemberManifestDocumentV1,
+  compositionMemberManifestV1,
+} from "./composition-manifest.js";
 import {
   BOT_DEBUG_DEFAULT_RUN_LIMIT_V1,
   BOT_DEBUG_EVENT_BYTES_V1,
@@ -1233,15 +1239,47 @@ export class ShellBotBackendContribution {
     return { schemaVersion: 1, skills: entries };
   }
 
-  /** The one durable manifest lookup used by mounts, commands, and UI views. */
-  private async readCompositionMemberManifest(
+  /** The two places this Bot's manifests live; see `composition-manifest.ts`. */
+  private compositionManifestSources(): CompositionManifestSourcesV1 {
+    return {
+      stored: (manifestHash) =>
+        this.ctx.storage.get<AuthoredManifestRecordV1>(
+          authorshipManifestKey(manifestHash),
+        ),
+      application: (member) => this.readApplicationMemberManifest(member),
+    };
+  }
+
+  /**
+   * The manifest a **mount** is handed: the stored document, byte-for-byte
+   * what `manifestHash` was taken over at authoring time.
+   *
+   * Decoding rebuilds the object (`decodeV5` always writes a `configuration`
+   * key, for one), so a decoded manifest does not canonicalize back to the
+   * recorded hash. Every mount re-verifies that hash
+   * (`botIsolatePackageDescriptorV1`), so the raw document is the only thing
+   * that can be handed to it.
+   */
+  private readCompositionMemberManifestDocument(
+    member: CompositionMemberV1,
+  ): Promise<unknown | undefined> {
+    return compositionMemberManifestDocumentV1(
+      member,
+      this.compositionManifestSources(),
+    );
+  }
+
+  /**
+   * The same manifest as the typed shape, for the callers that are not mounts:
+   * commands and UI views, which read fields rather than re-hash the document.
+   */
+  private readCompositionMemberManifest(
     member: CompositionMemberV1,
   ): Promise<FrockBotManifest | undefined> {
-    const stored = await this.ctx.storage.get<AuthoredManifestRecordV1>(
-      authorshipManifestKey(member.manifestHash),
+    return compositionMemberManifestV1(
+      member,
+      this.compositionManifestSources(),
     );
-    if (stored) return decodeFrockBotManifest(stored.manifest);
-    return await this.readApplicationMemberManifest(member);
   }
 
   /**
@@ -1270,6 +1308,19 @@ export class ShellBotBackendContribution {
     return declared.manifest;
   }
 
+  /** The stored manifest document a mount hashes, or a modelled failure. */
+  private async requireCompositionMemberManifestDocument(
+    member: CompositionMemberV1,
+  ): Promise<unknown> {
+    const document = await this.readCompositionMemberManifestDocument(member);
+    if (document === undefined) {
+      throw new Error(
+        `package "${member.packageId}" manifest "${member.manifestHash}" is unavailable`,
+      );
+    }
+    return document;
+  }
+
   private async requireCompositionMemberManifest(
     member: CompositionMemberV1,
   ): Promise<FrockBotManifest> {
@@ -1832,7 +1883,11 @@ export class ShellBotBackendContribution {
     fallback: CompositionGenerationV1,
   ): Promise<void> {
     await this.authority.recordNotification({
-      notificationId: `composition-failure:${failure.generationId}:${failure.attempt}`,
+      notificationId: notificationIdV1(
+        "composition-failure",
+        failure.generationId,
+        failure.attempt,
+      ),
       runId,
       createdAt: failure.at,
       title: `${settings.profile.name} kept its last working Packages`,
@@ -1883,7 +1938,8 @@ export class ShellBotBackendContribution {
         artifacts,
         this.bundledPackageArtifacts,
       ),
-      manifestFor: (member) => this.requireCompositionMemberManifest(member),
+      manifestFor: (member) =>
+        this.requireCompositionMemberManifestDocument(member),
       capabilitiesFor: (member) =>
         mintCapabilities({
           props: {
@@ -2692,7 +2748,12 @@ export class ShellBotBackendContribution {
     );
     if (!connection?.generation) {
       await this.authority.recordNotification({
-        notificationId: `package-connection-unavailable:${input.runId}:${input.packageId}:${input.request}`,
+        notificationId: notificationIdV1(
+          "package-connection-unavailable",
+          input.runId,
+          input.packageId,
+          input.request,
+        ),
         runId: input.runId,
         createdAt: new Date().toISOString(),
         title: "Connection unavailable",
@@ -2720,7 +2781,11 @@ export class ShellBotBackendContribution {
     }
     const request = decodeIsolateNotificationRequestV1(input.request);
     await this.authority.recordNotification({
-      notificationId: `package:${input.packageId}:${request.notificationId}`,
+      notificationId: notificationIdV1(
+        "package",
+        input.packageId,
+        request.notificationId,
+      ),
       runId: input.runId,
       createdAt: new Date().toISOString(),
       title: request.title,
@@ -3107,7 +3172,7 @@ export class ShellBotBackendContribution {
     await this.authority.recordNotification({
       // The same id shape the completion path uses, so one firing is one
       // intent however many times the alarm retries it.
-      notificationId: `routine-failed:${fire.fireId}`,
+      notificationId: notificationIdV1("routine-failed", fire.fireId),
       runId: fire.fireId,
       createdAt: new Date().toISOString(),
       title: `${settings.profile.name} could not run a Routine`,
@@ -3660,7 +3725,7 @@ export class ShellBotBackendContribution {
     }
     if (!settings.notifications.enabled) return;
     await this.authority.recordNotification({
-      notificationId: `task-settled:${task.taskId}`,
+      notificationId: notificationIdV1("task-settled", task.taskId),
       runId: task.taskId,
       createdAt: at,
       title: `${settings.profile.name} finished a subagent task`,
@@ -5324,9 +5389,30 @@ export class ShellBotBackendContribution {
       index.map((entry) => entry.cursor),
       await this.sidebarPreview(storedPreview, index),
       failures,
+      await this.isWorking(index[0]?.runId),
     );
   }
 
+  /**
+   * Whether the Bot's newest admitted run is still going.
+   *
+   * The sidebar draws this as an activity ring, so somebody in another
+   * conversation can see a Bot working rather than reading a quiet row as a
+   * stalled one. It is the newest run only: a Bot admits one Turn at a time,
+   * so an older run that is somehow still marked running is a reconciliation
+   * problem and not something a ring should report. A read that fails is no
+   * ring — liveness is never worth failing a sidebar poll for.
+   */
+  private async isWorking(runId: string | undefined): Promise<boolean> {
+    if (runId === undefined) return false;
+    try {
+      const run = await this.authority.readRun(runId);
+      return run?.status === "running";
+    } catch {
+      return false;
+    }
+  }
+
   /**
    * How many stored runs a read will open to recover a missing preview. The
    * newest settled chat Turn is almost always the first entry; the bound is
@@ -5464,7 +5550,7 @@ export class ShellBotBackendContribution {
       // `automation_completion_inbox` row".
       if (handoff === undefined) return undefined;
       return {
-        notificationId: `routine-wake:${result.runId}`,
+        notificationId: notificationIdV1("routine-wake", result.runId),
         runId: result.runId,
         createdAt: new Date().toISOString(),
         title: `${settings.profile.name} finished a Routine`,