@huynle/hub 0.7.4 → 0.8.1

package/src/spoke/spoke.ts

@@ -33,19 +33,23 @@ import {
   type TurnResult,
 } from "../protocol"
 import { extractReply } from "../reply"
+import { busyError, NOT_A_USER_MESSAGE, REVERT_BUSY, revertPreview, revertSummary, userContent, userIndex, visibleMessages } from "./fork-revert"
 import { TurnTracker } from "../turns"
 import { TimelineCache, boundedTimelinePart, newestPage, timelineFile, timelineItems } from "./timeline"
 import { SpokeConnection, type Backoff, type ConnectionState } from "./client"
 import { PROMPT_SOURCE, VOICE_AGENT } from "./conversation"
-import { DeliveryLedger, deliverMetadata, deliverText, harnessMessageID, InboxOrigins, planDelivery } from "./deliver"
+import { DeliveryLedger, deferredWhileBusy, deliverMetadata, deliverText, harnessMessageID, InboxOrigins, planDelivery, QUIET_WHILE_BUSY } from "./deliver"
 import { pollEnrollment, startEnrollment } from "./enroll"
 import { HerdrWatcher, openInHerdr, type HerdrRunner } from "./herdr"
 import type { LocalHubResult } from "./localhub"
 import { launchDirectoryProblem } from "./node-roots"
 import { PresenceBook } from "./presence"
+import { OpenCodeProfiles } from "./profile-apply"
 import { SessionTokenStore } from "./session-tokens"
+import { SessionContexts } from "./session-context"
+import { CONCIERGE_AGENT } from "../../packages/protocol/src/concierge.ts"
 import { changeStats, contextUsage, filePatch, mcpServers } from "./summary"
-import { browserSessions, isExposed, isReported, SessionTracker, shouldForward, type EventLike, type SessionDetails } from "./tracker"
+import { browserSessions, eventSessionID, isExposed, isReported, SessionTracker, shouldForward, type EventLike, type SessionDetails } from "./tracker"
 import { renderTaskBoard, TaskBoard } from "./taskboard"
 import { watchConfig, type ConfigWatcher } from "./watch"
 
@@ -138,18 +142,36 @@ export interface SpokeHost {
    */
   activity?(directories: readonly string[]): Promise<{ readonly active: readonly string[]; readonly jobs: ReadonlyArray<JobInfo & { readonly sessionID: string }> }>
   /**
-   * Recent root sessions from the local service with their workspace (service processes only): those in
-   * the history window (`days`, at most `max`), plus `include` (always listed: open, running, ...).
+   * Recent root sessions with their workspace: those in the history window (`days`, at most `max`), plus `include`
+   * (always listed: open, running, ...). The background service lists every session; a foreground `opencode serve`
+   * only those of the locations it loaded. Absent (a TUI's own server, which this process cannot reach): the
+   * process reports only the sessions it sees active.
    */
-  listRecent?(options?: { days: number; max: number; include: readonly string[] }): Promise<Array<{ id: string } & SessionDetails>>
+  /** `signal` aborts when the spoke abandons the listing because it timed out (listingTimeoutMs): stop asking the server. */
+  listRecent?(options?: { days: number; max: number; include: readonly string[]; signal?: AbortSignal }): Promise<Array<{ id: string } & SessionDetails>>
   /** Creates a session in a directory (service processes only). */
   createSession?(input: { directory: string; title?: string }): Promise<{ id: string }>
   /** MCP servers and their status for a directory (raw OpenCode McpServer list). */
   mcpList?(directory: string): Promise<ReadonlyArray<unknown>>
-  /** Working-tree changes of a directory (raw OpenCode FileDiffInfo list). */
-  vcsDiff?(directory: string): Promise<ReadonlyArray<unknown>>
+  /** Working-tree changes of a directory (raw OpenCode FileDiffInfo list); undefined when nothing can read that directory. */
+  vcsDiff?(directory: string): Promise<ReadonlyArray<unknown> | undefined>
   /** Current branch of a directory. */
   vcsBranch?(directory: string): Promise<string | undefined>
+  /** (HWA-16) A location's local skill and command names (they win over a hub profile's); absent: none applied. */
+  localNames?(directory: string): Promise<{ skills: readonly string[]; commands: readonly string[] }>
+  /** (HWA-16) The plugin registered the hub_profile tool (profile skills and commands need it). */
+  readonly profileTool?: boolean
+  /**
+   * Forks a session before one of its messages (OpenCode's session.fork over the own server; the plugin API has
+   * none). Absent: this process cannot reach its server, so it does not announce "fork".
+   */
+  forkSession?(input: { sessionID: string; before: string }): Promise<{ id: string; title?: string; location?: { directory?: string } }>
+  /** Stages a revert from a message (session.revert.stage); with `files`, restores the files changed since. */
+  revertStage?(input: { sessionID: string; messageID: string; files: boolean }): Promise<unknown>
+  /** Undoes a staged revert (session.revert.clear). */
+  revertClear?(sessionID: string): Promise<unknown>
+  /** Makes a staged revert permanent (session.revert.commit). Absent with the two above: no "revert". */
+  revertCommit?(sessionID: string): Promise<unknown>
 }
 
 /** A form reply for OpenCode: an answer, or a cancel. */
@@ -164,6 +186,10 @@ const RELAY_TIMEOUT_MS = 15_000
 const ANSWER_IN_TERMINAL = "This OpenCode process cannot answer questions from the hub; answer it in the terminal"
 
 export interface SpokeOptions {
+  /** (CON-04) Where Concierge session locks persist (the plugin's state dir); memory only without it. */
+  readonly conciergeLockFile?: string
+  /** Other Concierge lock files read, never written (the other default state dir places; FX-08, fail closed). */
+  readonly conciergeLockReadFiles?: readonly string[]
   readonly configFile: string
   readonly machineName: string
   readonly kind: ProcessKind
@@ -176,6 +202,8 @@ export interface SpokeOptions {
   readonly seedIntervalMs?: number
   /** Delay before re-listing the service's sessions after a session event (default 2 s). */
   readonly seedDebounceMs?: number
+  /** Longest one session listing may take before it is abandoned and later listings run (default 60 s). */
+  readonly listingTimeoutMs?: number
   readonly pollMs?: number
   readonly backoff?: Backoff
   /**
@@ -270,12 +298,16 @@ const FALLBACK_AGENT = "build"
 const LOCAL_HUB_MAX_RETRY_MS = 15 * 60_000
 const ENROLL_RETRY_MS = 500
 const NOT_SHARED = "This session is not shared with voice"
+const CANNOT_FORK = "This OpenCode process cannot fork sessions (its server cannot be reached)"
+const CANNOT_REVERT = "This OpenCode process cannot revert sessions (its server cannot be reached)"
+/** OpenCode's revert events (session.revert.staged, .cleared, .committed). */
+const REVERT_EVENTS = new Set(["session.revert.staged", "session.revert.cleared", "session.revert.committed"])
 const CANNOT_AUTO_NAME = "This OpenCode process cannot auto-name sessions (its server cannot be reached); use /rename in its terminal"
 export const AUTO_NAME_WAIT_MS = 20_000
 /** Longest session title the hub sets (OpenCode's own titles are shorter). */
 export const MAX_TITLE_CHARS = 200
 const UNKNOWN_SESSION = "Unknown session"
-/** Events after which the service re-lists its sessions (other processes' sessions appear, change, go). */
+/** Events after which a listing process re-lists its sessions (other processes' sessions appear, change, go). */
 const LISTING_EVENTS = new Set(["session.created", "session.renamed", "session.deleted"])
 
 const errorText = (cause: unknown) => (cause instanceof Error ? cause.message : String(cause))
@@ -292,6 +324,10 @@ export class Spoke {
   private connection?: SpokeConnection
   private connectionKey = ""
   private readonly tracker = new SessionTracker()
+  /** Hub profiles applied to sessions (./profile-apply): session-scoped layers in memory, read by the context hook. */
+  readonly profiles: OpenCodeProfiles
+  /** (CON-04) Hub session contexts (sessionContext op): per-turn parts, denied tools and lockAgent, read by the context hook. */
+  readonly contexts: SessionContexts
   /** Session tokens from the hub (sessionTokens op), for the sessions' shells (P1-T6). Never logged. */
   private readonly tokens = new SessionTokenStore()
   /**
@@ -327,7 +363,18 @@ export class Spoke {
   private conversationChain: Promise<unknown> = Promise.resolve()
   private readonly abort = new AbortController()
   private snapshotTimer?: ReturnType<typeof setTimeout>
+  /** Sessions the last snapshot sent listed (the hub keeps status only for sessions it was told about). */
+  private announced = new Set<string>()
+  /** Sessions whose run failed before any snapshot listed them: the failure goes out again once one does. */
+  private unheardFailures = new Set<string>()
   private seedTimer?: ReturnType<typeof setTimeout>
+  /** A listing runs; `relist`: another was asked for meanwhile (runs once it ends, never alongside). */
+  private listing = false
+  private relist = false
+  /** Bumped per listing: a listing applies its result only while it is still the latest (a timed-out one never does). */
+  private listingGeneration = 0
+  /** A listing timed out and was logged; reset by the next listing that completes. */
+  private listingHung = false
   private intervals: Array<ReturnType<typeof setInterval>> = []
   private enrollment?: { state: EnrollmentState; abort: AbortController }
   private started = false
@@ -366,6 +413,16 @@ export class Spoke {
   ) {
     this.config = options.launch ? launchVoiceConfig(options.launch, options.machineName) : readConfig(options.configFile, options.machineName)
     this.hub = { pending: false, nextAt: 0, cooldown: options.localHubRetryMs ?? 30_000 }
+    this.contexts = new SessionContexts({
+      ...(options.conciergeLockFile ? { lockFile: options.conciergeLockFile } : {}),
+      ...(options.conciergeLockReadFiles?.length ? { readLockFiles: options.conciergeLockReadFiles } : {}),
+    })
+    const localNames = host.localNames?.bind(host)
+    this.profiles = new OpenCodeProfiles({
+      isBusy: (id) => this.running.has(id) || this.tracker.isBusy(id),
+      ...(localNames ? { localNames: (id: string) => localNames(this.directoryOf(id)) } : {}),
+      tool: () => host.profileTool === true,
+    })
   }
 
   start(): void {
@@ -374,9 +431,9 @@ export class Spoke {
     if (!this.options.launch) this.watch()
     void this.listen()
     this.apply(this.config)
-    this.every(this.options.snapshotIntervalMs ?? 30_000, () => this.sendSnapshot())
+    this.every(this.options.snapshotIntervalMs ?? 30_000, () => (void this.refreshLockedAgents(), this.sendSnapshot()))
     this.every(this.options.presenceCheckMs ?? 5000, () => this.checkOpen())
-    if (this.options.kind === "service" && this.host.listRecent) {
+    if (this.host.listRecent) {
       void this.seed()
       this.every(this.options.seedIntervalMs ?? 60_000, () => void this.seed())
     }
@@ -502,7 +559,7 @@ export class Spoke {
     if (key === this.openKey) return
     this.openKey = key
     const unknown = [...open.keys()].filter((id) => !this.tracker.has(id))
-    if (unknown.length && this.options.kind === "service" && this.host.listRecent) this.scheduleSeed()
+    if (unknown.length && this.host.listRecent) this.scheduleSeed()
     else if (unknown.length) {
       for (const id of unknown) this.tracker.ensure(id, Date.now())
       void this.fetchInfo()
@@ -825,7 +882,13 @@ export class Spoke {
         opencodeVersion: this.host.opencodeVersion,
         pluginVersion: this.options.pluginVersion,
         // Hub messages and prompts need OpenCode's synthetic messages.
-        features: SPOKE_FEATURES.filter((f) => (f !== "deliver" && f !== "hubPrompt") || this.host.synthetic !== undefined),
+        // Fork and revert need OpenCode's own server (the plugin API has neither).
+        features: SPOKE_FEATURES.filter(
+          (f) =>
+            ((f !== "deliver" && f !== "hubPrompt") || this.host.synthetic !== undefined) &&
+            (f !== "fork" || this.host.forkSession !== undefined) &&
+            (f !== "revert" || this.canRevert()),
+        ),
         harness: HARNESS_OPENCODE,
         harnessVersion: this.host.opencodeVersion,
         evidence: "native",
@@ -905,6 +968,13 @@ export class Spoke {
   private async conversationOn(sessionID: string): Promise<ResultFor["conversation"]> {
     const entry = this.conversations.get(sessionID)
     const session = await this.host.getSession(sessionID)
+    // (CON-04) lockAgent: conversation mode is recorded, but the session keeps its agent and model (the Concierge
+    // never escapes its restricted agent, and the context hook adds no orchestrator parts).
+    // A session on the concierge agent is locked too (a spoke that restarted before the hub re-sent the context).
+    if (this.contexts.locked(sessionID) || session.agent === CONCIERGE_AGENT) {
+      this.conversations.set(sessionID, {})
+      return { agent: session.agent ?? (await this.defaultAgent()) }
+    }
     this.rememberModel(sessionID, session.model)
     const current = session.agent
     const models = await this.voiceModelOn(sessionID, session, entry)
@@ -1023,9 +1093,10 @@ export class Spoke {
         return this.modelPrefsResult(req.sessionID)
       }
       case "timeline": {
-        // A first page reads OpenCode (it shows the newest state); following pages reuse those rows briefly.
+        // A first page reads OpenCode (it shows the newest state); following pages reuse those rows briefly. A
+        // staged revert hides its message and everything after it (OpenCode keeps them until it is committed).
         const first = req.cursor === undefined && req.before === undefined
-        const items = await this.timelines.get(req.sessionID, async () => timelineItems(req.sessionID, await this.host.context(req.sessionID)), first)
+        const items = await this.timelines.get(req.sessionID, async () => timelineItems(req.sessionID, await this.shownMessages(req.sessionID)), first)
         if (req.before !== undefined || req.order === "desc") return newestPage(items, req.limit ?? 50, req.before) satisfies ResultFor["timeline"]
         const offset = req.cursor === undefined ? 0 : Number(req.cursor)
         if (!Number.isInteger(offset) || offset < 0) throw new Error("Invalid timeline cursor")
@@ -1069,6 +1140,134 @@ export class Spoke {
         return this.setConversation(req.sessionID, req.on)
       case "deliver":
         return this.deliver(req)
+      case "sessionContext": {
+        // Only a session this process reports (a context needs a real session).
+        if (!this.tracker.has(req.sessionID)) throw new Error(UNKNOWN_SESSION)
+        const result = this.contexts.handle(req)
+        // The hub sees the new revision (and the session's agent) in the next sessions frame.
+        void this.refreshLockedAgents().finally(() => this.scheduleSnapshot())
+        return result
+      }
+      case "profileApply":
+        // Only a session this process reports (mode "always" exposes any ID; a profile needs a real session).
+        if (!this.tracker.has(req.sessionID)) throw new Error(UNKNOWN_SESSION)
+        return this.profiles.handle(req)
+      case "fork":
+        return this.fork(req.sessionID, req.messageID)
+      case "revertPreview": {
+        const messages = await this.host.context(req.sessionID)
+        const index = userIndex(messages, req.messageID)
+        if (index < 0) throw new Error(NOT_A_USER_MESSAGE)
+        return revertPreview(messages, index) satisfies ResultFor["revertPreview"]
+      }
+      case "revert":
+        return this.revert(req.sessionID, req.messageID, req.files)
+      case "revertRestore":
+        if (!this.canRevert()) throw new Error(CANNOT_REVERT)
+        await this.host.revertClear!(req.sessionID)
+        return this.revertDone(req.sessionID)
+      case "revertCommit":
+        if (!this.canRevert()) throw new Error(CANNOT_REVERT)
+        await this.host.revertCommit!(req.sessionID)
+        return this.revertDone(req.sessionID)
+    }
+  }
+
+  private canRevert(): boolean {
+    return this.host.revertStage !== undefined && this.host.revertClear !== undefined && this.host.revertCommit !== undefined
+  }
+
+  /**
+   * Forks the session before one of its user messages (feature "fork") and reports the new session at once (the
+   * snapshot goes out before the reply). The result carries the message's text and attachments for the composer.
+   */
+  private async fork(sessionID: string, messageID: string): Promise<ResultFor["fork"]> {
+    const fork = this.host.forkSession?.bind(this.host)
+    if (!fork) throw new Error(CANNOT_FORK)
+    const messages = await this.host.context(sessionID)
+    const index = userIndex(messages, messageID)
+    if (index < 0) throw new Error(NOT_A_USER_MESSAGE)
+    const session = await fork({ sessionID, before: messageID })
+    if (typeof session?.id !== "string" || !session.id) throw new Error("OpenCode did not report the forked session")
+    const title = typeof session.title === "string" ? session.title : ""
+    const directory = typeof session.location?.directory === "string" && session.location.directory ? session.location.directory : (this.tracker.directoryOf(sessionID) ?? this.host.directory)
+    const now = Date.now()
+    const source = this.tracker.snapshot(now).find((s) => s.id === sessionID)
+    this.tracker.observe({ type: "session.created", data: { sessionID: session.id, title, location: { directory } } }, now)
+    this.tracker.setInfo(session.id, {
+      title,
+      directory,
+      updated: now,
+      ...(source?.project ? { project: source.project } : {}),
+      ...(source?.projectName ? { projectName: source.projectName } : {}),
+    })
+    if (this.config.mode === "session") this.setSession(session.id, true)
+    this.sendSnapshot()
+    return { sessionID: session.id, ...(title ? { title } : {}), ...userContent(messages[index]) }
+  }
+
+  /**
+   * Stages a revert from one of the session's user messages (feature "revert"), with the files restored when
+   * `files`, and reports it at once. Refused while the session runs (OpenCode refuses it too).
+   */
+  private async revert(sessionID: string, messageID: string, files: boolean): Promise<ResultFor["revert"]> {
+    if (!this.canRevert()) throw new Error(CANNOT_REVERT)
+    const messages = await this.host.context(sessionID)
+    const index = userIndex(messages, messageID)
+    if (index < 0) throw new Error(NOT_A_USER_MESSAGE)
+    if (this.running.has(sessionID) || this.tracker.isBusy(sessionID)) throw new Error(REVERT_BUSY)
+    let staged: unknown
+    try {
+      staged = await this.host.revertStage!({ sessionID, messageID, files })
+    } catch (cause) {
+      if (busyError(cause)) throw new Error(REVERT_BUSY)
+      throw cause
+    }
+    const revert = revertSummary(staged, messages) ?? revertSummary({ messageID }, messages)!
+    this.timelines.invalidate(sessionID)
+    // Sent at once even when OpenCode's staged event already set it (its snapshot may still be debounced).
+    this.tracker.setRevert(sessionID, revert)
+    this.sendSnapshot()
+    return { revert, ...userContent(messages[index]) }
+  }
+
+  /** After a restore or commit: no revert is staged; reported at once. */
+  private revertDone(sessionID: string): Record<string, never> {
+    this.timelines.invalidate(sessionID)
+    this.tracker.setRevert(sessionID, undefined)
+    this.sendSnapshot()
+    return {}
+  }
+
+  /**
+   * The session's messages a timeline shows: all of them, or with a staged revert those before its message. The
+   * revert is read from OpenCode's session (so one staged before this process saw it counts) and reported.
+   */
+  private async shownMessages(sessionID: string): Promise<readonly unknown[]> {
+    const [messages, session] = await Promise.all([
+      this.host.context(sessionID),
+      this.canRevert() ? this.host.getSession(sessionID).catch(() => undefined) : Promise.resolve(undefined),
+    ])
+    if (!this.canRevert()) return messages
+    const raw = session ? (session as { revert?: unknown }).revert : undefined
+    const revert = session ? revertSummary(raw, messages) : this.tracker.revertOf(sessionID)
+    if (session && this.tracker.setRevert(sessionID, revert)) this.scheduleSnapshot()
+    return visibleMessages(messages, revert?.messageID)
+  }
+
+  /** A revert staged, restored or committed anywhere (this hub, the terminal, another client): reported. */
+  private async observeRevert(event: EventLike, sessionID: string): Promise<void> {
+    if (!this.tracker.has(sessionID)) return
+    if (event.type !== "session.revert.staged") {
+      if (this.tracker.setRevert(sessionID, undefined)) this.scheduleSnapshot()
+      return
+    }
+    try {
+      const raw = (event.data as Record<string, unknown>).revert
+      const revert = revertSummary(raw, await this.host.context(sessionID))
+      if (this.tracker.setRevert(sessionID, revert)) this.scheduleSnapshot()
+    } catch (cause) {
+      console.error("[hub] could not read a staged revert", cause)
     }
   }
 
@@ -1081,11 +1280,11 @@ export class Spoke {
     if (!synthetic) throw new Error("This OpenCode process cannot take hub messages")
     return this.deliveries.run(req.messageID, req.wake, async () => {
       const subagent = (this.tracker.parentOf(req.sessionID) ?? (await this.host.getSession(req.sessionID).catch(() => undefined))?.parentID) !== undefined
-      const plan = planDelivery(req, {
-        busy: this.running.has(req.sessionID) || this.tracker.isBusy(req.sessionID),
-        formOpen: this.tracker.formOpenIn(req.sessionID),
-        subagent,
-      })
+      const busy = this.running.has(req.sessionID) || this.tracker.isBusy(req.sessionID)
+      // A routine quiet message into a running turn would still cost a model call: refused, the hub keeps it
+      // pending and sends it again after the turn (the turn's end sends a sessions frame). Nothing is admitted.
+      if (busy && deferredWhileBusy(req, subagent)) throw new Error(QUIET_WHILE_BUSY)
+      const plan = planDelivery(req, { busy, formOpen: this.tracker.formOpenIn(req.sessionID), subagent })
       const id = harnessMessageID(req.messageID)
       // Marked before sending: OpenCode may report it delivered before the call returns.
       this.origins.hub(id)
@@ -1488,6 +1687,7 @@ export class Spoke {
       if (event.type === "session.deleted" && typeof sessionID === "string") {
         this.tokens.delete(sessionID)
         this.actTokens.delete(sessionID)
+        this.profiles.forget(sessionID)
       }
       if (event.type === "form.replied" || event.type === "form.cancelled") {
         const formID = (event.data as Record<string, unknown> | undefined)?.id
@@ -1502,7 +1702,9 @@ export class Spoke {
         if (typeof title === "string") for (const waiter of this.renameWaiters.get(sessionID) ?? []) waiter(title)
       }
       if (this.tracker.observe(event, Date.now())) this.scheduleSnapshot()
-      if (this.options.kind === "service" && this.host.listRecent && LISTING_EVENTS.has(event.type) && !(event.data as any)?.parentID) {
+      if (REVERT_EVENTS.has(event.type) && typeof sessionID === "string") void this.observeRevert(event, sessionID)
+      if (typeof sessionID === "string") this.profiles.settle(sessionID) // a turn boundary makes a staged profile effective
+      if (this.host.listRecent && LISTING_EVENTS.has(event.type) && !(event.data as any)?.parentID) {
         this.scheduleSeed()
       }
       void this.fetchInfo()
@@ -1510,7 +1712,11 @@ export class Spoke {
         // Activity events go out compact: tool inputs become a short summary, outputs are dropped; job exits
         // get their session from the job.
         const compact = this.withOrigin(compactActivity({ type: event.type, data: (event.data ?? {}) as Record<string, unknown> }, (id) => this.tracker.jobSession(id)))
-        if (compact && shouldForward(this.config, this.tracker, compact)) this.connection.send({ t: "event", event: compact })
+        if (compact && shouldForward(this.config, this.tracker, compact)) {
+          this.announce(compact)
+          this.connection.send({ t: "event", event: compact })
+          if (compact.type === "session.execution.failed" && typeof sessionID === "string" && !this.announced.has(sessionID)) this.unheardFailures.add(sessionID)
+        }
       }
     } catch (cause) {
       console.error("[hub] event handling failed", cause)
@@ -1599,13 +1805,52 @@ export class Spoke {
   }
 
   private async seed(): Promise<void> {
+    if (this.listing) {
+      this.relist = true
+      return
+    }
+    this.listing = true
+    try {
+      do {
+        this.relist = false
+        await this.listOnce()
+      } while (this.relist && this.started)
+    } finally {
+      this.listing = false
+    }
+  }
+
+  /**
+   * One listing, bounded by listingTimeoutMs: a server that accepts and never answers must not stop later listings
+   * (seed() runs one at a time). A timed-out listing is abandoned (logged once until a listing completes again);
+   * if it settles later its result is dropped, so it never overwrites a newer listing.
+   */
+  private async listOnce(): Promise<void> {
+    const generation = ++this.listingGeneration
+    const limit = this.options.listingTimeoutMs ?? LISTING_TIMEOUT_MS
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const timedOut = Symbol("timeout")
+    const cancel = new AbortController()
     try {
       const keep = this.keep()
       const { days, max } = this.config.list
-      const sessions = (await this.host.listRecent?.({ days, max, include: [...keep] })) ?? []
+      const listed = Promise.resolve(this.host.listRecent?.({ days, max, include: [...keep], signal: cancel.signal }))
+      listed.catch(() => {}) // an abandoned listing that fails later is not an unhandled rejection
+      const result = await Promise.race([listed, new Promise<typeof timedOut>((resolve) => (timer = setTimeout(() => resolve(timedOut), limit)))])
+      if (result === timedOut) {
+        cancel.abort(new Error(`listing timed out after ${limit} ms`))
+        if (!this.listingHung) console.error(`[hub] listing recent sessions timed out after ${limit} ms; listing again later`)
+        this.listingHung = true
+        return
+      }
+      this.listingHung = false
+      if (generation !== this.listingGeneration) return
+      const sessions = result ?? []
       if (this.tracker.applyListing(sessions, Date.now(), keep)) this.scheduleSnapshot()
     } catch (cause) {
       console.error("[hub] could not list recent sessions", errorText(cause))
+    } finally {
+      clearTimeout(timer)
     }
   }
 
@@ -1625,9 +1870,68 @@ export class Spoke {
     }, this.options.snapshotDebounceMs ?? 500)
   }
 
+  /**
+   * (CON-04) The agent a locked (Concierge) session runs on, as the context hook or OpenCode reports it: a change
+   * goes to the hub in the next sessions frame (the hub suspends a Concierge on another agent).
+   */
+  noteAgent(sessionID: string, agent: string | undefined): void {
+    if (this.contexts.seenAgent(sessionID, agent)) this.scheduleSnapshot()
+  }
+
+  /** Reads the current agent of every locked session this process reports (OpenCode's session record). */
+  private async refreshLockedAgents(): Promise<void> {
+    for (const sessionID of this.contexts.lockedSessions()) {
+      if (!this.tracker.has(sessionID)) continue
+      try {
+        this.noteAgent(sessionID, (await this.host.getSession(sessionID)).agent)
+      } catch {
+        // Gone or unreachable: the next refresh tries again.
+      }
+    }
+  }
+
   private sendSnapshot(): void {
+    if (this.snapshotTimer) clearTimeout(this.snapshotTimer)
+    this.snapshotTimer = undefined
     const tui = this.presenceBook.open(Date.now())
-    this.connection?.send({ t: "sessions", sessions: browserSessions(this.config, this.tracker, Date.now(), { terminal: (id) => this.terminal(id, tui) }) })
+    const sessions = browserSessions(this.config, this.tracker, Date.now(), { terminal: (id) => this.terminal(id, tui) }).map((s) => ({ ...s, ...this.contexts.report(s.id) }))
+    this.connection?.send({ t: "sessions", sessions })
+    this.announced = new Set(sessions.map((s) => s.id))
+    this.resendUnheardFailures()
+  }
+
+  /**
+   * A run that failed while its session's details were still being fetched went out before any snapshot listed the
+   * session, so the hub dropped it: once a snapshot lists the session, its failure goes out again (unless a run
+   * started since).
+   */
+  private resendUnheardFailures(): void {
+    for (const id of [...this.unheardFailures]) {
+      const error = this.tracker.errorOf(id)
+      if (!error || !this.tracker.has(id)) {
+        this.unheardFailures.delete(id)
+        continue
+      }
+      if (!this.announced.has(id) || this.connection?.state !== "connected") continue
+      this.unheardFailures.delete(id)
+      const event = { type: "session.execution.failed", data: { sessionID: id, error } }
+      if (shouldForward(this.config, this.tracker, event)) this.connection.send({ t: "event", event })
+    }
+  }
+
+  /**
+   * Sends the snapshot now when an event is about a session the hub was not told about yet: the hub drops a run's
+   * events (a failure, a permission) for sessions it does not know, and a run can fail within milliseconds of
+   * session.created (a model that does not exist), well before the debounced snapshot. Creating, renaming or
+   * deleting a session alone waits for the debounce (a burst of subagents sends one snapshot).
+   */
+  private announce(event: { type: string; data: Record<string, unknown> }): void {
+    if (event.type === "session.created" || event.type === "session.renamed" || event.type === "session.deleted") return
+    const sessionID = eventSessionID(event)
+    if (!sessionID || this.announced.has(sessionID) || !this.tracker.hasInfo(sessionID)) return
+    this.sendSnapshot()
+    // Once per session even when the snapshot's limits leave it out.
+    this.announced.add(sessionID)
   }
 
   private every(ms: number, run: () => void): void {
@@ -1637,6 +1941,9 @@ export class Spoke {
   }
 }
 
+/** Longest a session listing may take (SpokeOptions.listingTimeoutMs). */
+const LISTING_TIMEOUT_MS = 60_000
+
 /** Directories whose shells are listed when seeding. */
 const SEED_DIRECTORIES = 20
 

package/src/spoke/timeline.ts

@@ -1,4 +1,4 @@
-import { DELIVER_ID_MAX, MESSAGE_KINDS, PROMPT_IMAGE_MIMES, type MessageKind, type PromptImage, type TimelineMessageItem } from "../protocol"
+import { DELIVER_ID_MAX, MESSAGE_KINDS, PROMPT_IMAGE_MIMES, summarizeToolInput, type MessageKind, type PromptImage, type TimelineMessageItem } from "../protocol"
 import { PROMPT_SOURCE } from "./conversation"
 
 /** An attachment of a user message: its position in the message's files (for timelineFile), type and name. */
@@ -32,6 +32,8 @@ export interface TimelineItem {
   readonly callID?: string
   /** Subagent (subagent/task) tool rows: the child session it runs in. */
   readonly childSessionID?: string
+  /** (CON-09b) Tool rows: a short summary of the input (summarizeToolInput). */
+  readonly summary?: string
   /** Subagent tool rows: the task's short description. */
   readonly title?: string
   /** Assistant text rows: which text part of the message this is (0, 1, …), as in live text deltas. */
@@ -100,10 +102,13 @@ export function timelineItems(sessionID: string, messages: readonly unknown[]):
         const status = part.state?.status
         const name = String(part.name ?? "tool")
         const spawn = SUBAGENT_TOOLS.has(name) ? subagentOf(part.state) : {}
+        // (CON-09b) The same short summary live activity shows (the command, the path, the hub verb).
+        const summary = summarizeToolInput(part.state?.input)
         out.push({
           ...base,
           kind: "tool",
           name,
+          ...(summary ? { summary } : {}),
           state: status === "error" ? "failed" : status === "completed" ? "done" : "running",
           ...(typeof part.id === "string" && part.id ? { callID: part.id } : {}),
           ...spawn,

package/src/spoke/tracker.ts

@@ -1,7 +1,7 @@
 // Sessions this OpenCode process knows about, built from the events it sees, plus which of them
 // are exposed to the central server (by mode). Pure: time is passed in.
 import type { Mode } from "../config"
-import { compactActivity, compactRunError, FORWARDED_EVENTS, type CompactRunError, type CompactSessionStatus, type JobInfo, type SessionInfo, type TerminalInfo } from "../protocol"
+import { compactActivity, compactRunError, FORWARDED_EVENTS, type CompactRunError, type CompactSessionStatus, type JobInfo, type SessionInfo, type SessionRevertInfo, type TerminalInfo } from "../protocol"
 
 /** A session is "owned" by this process while it viewed or ran it within this window. */
 export const OWNED_WINDOW_MS = 30 * 60 * 1000
@@ -35,6 +35,8 @@ interface Entry {
   projectName?: string
   /** Came from the service's listing of recent sessions (dropped when it leaves the listing). */
   listed?: boolean
+  /** A staged revert (feature "revert"). */
+  revert?: SessionRevertInfo
 }
 
 const ACTIVITY = new Set([
@@ -183,6 +185,20 @@ export class SessionTracker {
     return changed
   }
 
+  /** The session's staged revert, if any. */
+  revertOf(id: string): SessionRevertInfo | undefined {
+    return this.entries.get(id)?.revert
+  }
+
+  /** Sets (or, undefined, clears) a known session's staged revert. Returns true when it changed. */
+  setRevert(id: string, revert: SessionRevertInfo | undefined): boolean {
+    const entry = this.entries.get(id)
+    if (!entry || JSON.stringify(entry.revert ?? null) === JSON.stringify(revert ?? null)) return false
+    if (revert) entry.revert = revert
+    else delete entry.revert
+    return true
+  }
+
   /** Fills in details fetched for a session that was first seen through an activity event. */
   setInfo(id: string, details: SessionDetails): boolean {
     const entry = this.entries.get(id)
@@ -331,6 +347,11 @@ export class SessionTracker {
       .sort((a, b) => this.lineage(b).length - this.lineage(a).length)
   }
 
+  /** The session is known with its details, so a snapshot lists it. */
+  hasInfo(id: string): boolean {
+    return this.entries.get(id)?.info === true
+  }
+
   needsInfo(): string[] {
     return [...this.entries.values()].filter((e) => !e.info).map((e) => e.id)
   }
@@ -383,6 +404,7 @@ export class SessionTracker {
         owned: e.lastActivity !== undefined && now - e.lastActivity <= OWNED_WINDOW_MS,
         ...(e.project ? { project: e.project } : {}),
         ...(e.projectName ? { projectName: e.projectName } : {}),
+        ...(e.revert ? { revert: e.revert } : {}),
       }))
   }