@huynle/hub 0.8.0 → 0.8.2

package/src/spoke/spoke.ts

@@ -33,12 +33,12 @@ import {
   type TurnResult,
 } from "../protocol"
 import { extractReply } from "../reply"
-import { busyError, NOT_A_USER_MESSAGE, REVERT_BUSY, revertPreview, revertSummary, userContent, userIndex, visibleMessages } from "./fork-revert"
+import { copiesHubIdentity, forkIdentityNote, notAUserMessage, opError, REVERT_BUSY, REVERT_END_BUSY, revertPreview, revertSummary, userContent, userIndex, visibleMessages, withStagedAt } from "./fork-revert"
 import { TurnTracker } from "../turns"
 import { TimelineCache, boundedTimelinePart, newestPage, timelineFile, timelineItems } from "./timeline"
-import { SpokeConnection, type Backoff, type ConnectionState } from "./client"
+import { CodedError, SpokeConnection, type Backoff, type ConnectionState } from "./client"
 import { PROMPT_SOURCE, VOICE_AGENT } from "./conversation"
-import { DeliveryLedger, deferredWhileBusy, deliverMetadata, deliverText, harnessMessageID, InboxOrigins, planDelivery, QUIET_WHILE_BUSY } from "./deliver"
+import { DeliveryLedger, deferredWhileBusy, deliverMetadata, deliverText, harnessMessageID, InboxOrigins, planDelivery, QUIET_WHILE_BUSY, REVERT_STAGED } from "./deliver"
 import { pollEnrollment, startEnrollment } from "./enroll"
 import { HerdrWatcher, openInHerdr, type HerdrRunner } from "./herdr"
 import type { LocalHubResult } from "./localhub"
@@ -147,17 +147,21 @@ export interface SpokeHost {
    * only those of the locations it loaded. Absent (a TUI's own server, which this process cannot reach): the
    * process reports only the sessions it sees active.
    */
-  listRecent?(options?: { days: number; max: number; include: readonly string[] }): Promise<Array<{ id: string } & SessionDetails>>
+  /** `signal` aborts when the spoke abandons the listing because it timed out (listingTimeoutMs): stop asking the server. */
+  listRecent?(options?: { days: number; max: number; include: readonly string[]; signal?: AbortSignal }): Promise<Array<{ id: string } & SessionDetails>>
   /** Creates a session in a directory (service processes only). */
   createSession?(input: { directory: string; title?: string }): Promise<{ id: string }>
   /** MCP servers and their status for a directory (raw OpenCode McpServer list). */
   mcpList?(directory: string): Promise<ReadonlyArray<unknown>>
-  /** Working-tree changes of a directory (raw OpenCode FileDiffInfo list). */
-  vcsDiff?(directory: string): Promise<ReadonlyArray<unknown>>
+  /** Working-tree changes of a directory (raw OpenCode FileDiffInfo list); undefined when nothing can read that directory. */
+  vcsDiff?(directory: string): Promise<ReadonlyArray<unknown> | undefined>
   /** Current branch of a directory. */
   vcsBranch?(directory: string): Promise<string | undefined>
-  /** (HWA-16) A location's local skill and command names (they win over a hub profile's); absent: none applied. */
-  localNames?(directory: string): Promise<{ skills: readonly string[]; commands: readonly string[] }>
+  /**
+   * (HWA-16) A location's local skill and command names (they win over a hub profile's), read in that folder;
+   * undefined: unknown (the profile's skills and commands are not offered). Absent: none applied.
+   */
+  localNames?(directory: string): Promise<{ skills: readonly string[]; commands: readonly string[] } | undefined>
   /** (HWA-16) The plugin registered the hub_profile tool (profile skills and commands need it). */
   readonly profileTool?: boolean
   /**
@@ -187,6 +191,8 @@ const ANSWER_IN_TERMINAL = "This OpenCode process cannot answer questions from t
 export interface SpokeOptions {
   /** (CON-04) Where Concierge session locks persist (the plugin's state dir); memory only without it. */
   readonly conciergeLockFile?: string
+  /** Other Concierge lock files read, never written (the other default state dir places; FX-08, fail closed). */
+  readonly conciergeLockReadFiles?: readonly string[]
   readonly configFile: string
   readonly machineName: string
   readonly kind: ProcessKind
@@ -195,6 +201,8 @@ export interface SpokeOptions {
   readonly pluginVersion: string
   readonly turnTimeoutMs?: number
   readonly snapshotDebounceMs?: number
+  /** How long a fork waits for its hub identity note to go in (default FORK_NOTE_TIMEOUT_MS). */
+  readonly forkNoteTimeoutMs?: number
   readonly snapshotIntervalMs?: number
   readonly seedIntervalMs?: number
   /** Delay before re-listing the service's sessions after a session event (default 2 s). */
@@ -295,6 +303,8 @@ const FALLBACK_AGENT = "build"
 const LOCAL_HUB_MAX_RETRY_MS = 15 * 60_000
 const ENROLL_RETRY_MS = 500
 const NOT_SHARED = "This session is not shared with voice"
+/** How long a fork waits for its hub identity note (a synthetic message) before it answers without it. */
+export const FORK_NOTE_TIMEOUT_MS = 5_000
 const CANNOT_FORK = "This OpenCode process cannot fork sessions (its server cannot be reached)"
 const CANNOT_REVERT = "This OpenCode process cannot revert sessions (its server cannot be reached)"
 /** OpenCode's revert events (session.revert.staged, .cleared, .committed). */
@@ -337,6 +347,8 @@ export class Spoke {
   private readonly turns = new TurnTracker()
   /** Timeline rows of sessions being paged through (30 s, dropped on any event of the session). */
   private readonly timelines = new TimelineCache()
+  /** Per session: a counter of revert events (a staged event's late read must not undo a later one). */
+  private readonly revertSeq = new Map<string, number>()
   private readonly voiceTurns = new Map<string, number>()
   private readonly running = new Set<string>()
   /** Hub messages applied (by messageID), so a retry is not admitted again. */
@@ -410,7 +422,10 @@ export class Spoke {
   ) {
     this.config = options.launch ? launchVoiceConfig(options.launch, options.machineName) : readConfig(options.configFile, options.machineName)
     this.hub = { pending: false, nextAt: 0, cooldown: options.localHubRetryMs ?? 30_000 }
-    this.contexts = new SessionContexts(options.conciergeLockFile ? { lockFile: options.conciergeLockFile } : {})
+    this.contexts = new SessionContexts({
+      ...(options.conciergeLockFile ? { lockFile: options.conciergeLockFile } : {}),
+      ...(options.conciergeLockReadFiles?.length ? { readLockFiles: options.conciergeLockReadFiles } : {}),
+    })
     const localNames = host.localNames?.bind(host)
     this.profiles = new OpenCodeProfiles({
       isBusy: (id) => this.running.has(id) || this.tracker.isBusy(id),
@@ -1052,7 +1067,8 @@ export class Spoke {
       case "form":
         return this.form("cancel" in req ? { sessionID: req.sessionID, formID: req.formID, cancel: true } : { sessionID: req.sessionID, formID: req.formID, answer: req.answer })
       case "context":
-        return { messages: contextMessages(await this.host.context(req.sessionID)) }
+        // A staged revert's hidden messages are not part of the conversation any more.
+        return { messages: contextMessages(await this.shownMessages(req.sessionID)) }
       case "models": {
         const raw = await this.host.listModels?.() ?? []
         return {
@@ -1146,27 +1162,45 @@ export class Spoke {
         // Only a session this process reports (mode "always" exposes any ID; a profile needs a real session).
         if (!this.tracker.has(req.sessionID)) throw new Error(UNKNOWN_SESSION)
         return this.profiles.handle(req)
+      // Fork and revert: OpenCode's busy and not-found failures answer coded refusals (Res.code).
       case "fork":
-        return this.fork(req.sessionID, req.messageID)
-      case "revertPreview": {
-        const messages = await this.host.context(req.sessionID)
-        const index = userIndex(messages, req.messageID)
-        if (index < 0) throw new Error(NOT_A_USER_MESSAGE)
-        return revertPreview(messages, index) satisfies ResultFor["revertPreview"]
-      }
+        return this.fork(req.sessionID, req.messageID).catch((cause) => {
+          throw opError(cause, REVERT_BUSY)
+        })
+      case "revertPreview":
+        return this.revertPreview(req.sessionID, req.messageID).catch((cause) => {
+          throw opError(cause, REVERT_BUSY)
+        })
       case "revert":
-        return this.revert(req.sessionID, req.messageID, req.files)
+        return this.revert(req.sessionID, req.messageID, req.files).catch((cause) => {
+          throw opError(cause, REVERT_BUSY)
+        })
       case "revertRestore":
-        if (!this.canRevert()) throw new Error(CANNOT_REVERT)
-        await this.host.revertClear!(req.sessionID)
-        return this.revertDone(req.sessionID)
       case "revertCommit":
-        if (!this.canRevert()) throw new Error(CANNOT_REVERT)
-        await this.host.revertCommit!(req.sessionID)
-        return this.revertDone(req.sessionID)
+        return this.revertEnd(req.sessionID, req.op).catch((cause) => {
+          throw opError(cause, REVERT_END_BUSY)
+        })
     }
   }
 
+  private async revertPreview(sessionID: string, messageID: string): Promise<ResultFor["revertPreview"]> {
+    const messages = await this.host.context(sessionID)
+    const index = userIndex(messages, messageID)
+    if (index < 0) throw notAUserMessage()
+    return revertPreview(messages, index)
+  }
+
+  /** Restores (revert.clear) or commits a staged revert; refused while the session runs (OpenCode refuses it too). */
+  private async revertEnd(sessionID: string, op: "revertRestore" | "revertCommit"): Promise<Record<string, never>> {
+    if (!this.canRevert()) throw new Error(CANNOT_REVERT)
+    if (op === "revertRestore") await this.host.revertClear!(sessionID)
+    else {
+      await this.host.revertCommit!(sessionID)
+      this.recordCommit(sessionID)
+    }
+    return this.revertDone(sessionID)
+  }
+
   private canRevert(): boolean {
     return this.host.revertStage !== undefined && this.host.revertClear !== undefined && this.host.revertCommit !== undefined
   }
@@ -1180,7 +1214,7 @@ export class Spoke {
     if (!fork) throw new Error(CANNOT_FORK)
     const messages = await this.host.context(sessionID)
     const index = userIndex(messages, messageID)
-    if (index < 0) throw new Error(NOT_A_USER_MESSAGE)
+    if (index < 0) throw notAUserMessage()
     const session = await fork({ sessionID, before: messageID })
     if (typeof session?.id !== "string" || !session.id) throw new Error("OpenCode did not report the forked session")
     const title = typeof session.title === "string" ? session.title : ""
@@ -1197,9 +1231,34 @@ export class Spoke {
     })
     if (this.config.mode === "session") this.setSession(session.id, true)
     this.sendSnapshot()
+    if (copiesHubIdentity(messages, index)) await this.forkNote(session.id, forkIdentityNote(sessionID, source?.title))
     return { sessionID: session.id, ...(title ? { title } : {}), ...userContent(messages[index]) }
   }
 
+  /**
+   * OpenCode's fork copies the source's hub primer (its hub name and roles), and has no way to drop a message: the
+   * fork gets a hub note (admitted without a turn, like a primer) that the identity is not its own. Best effort.
+   */
+  private async forkNote(forkID: string, text: string): Promise<void> {
+    const synthetic = this.host.synthetic?.bind(this.host)
+    if (!synthetic) return
+    const id = harnessMessageID(`fork-note:${forkID}`)
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const ms = this.options.forkNoteTimeoutMs ?? FORK_NOTE_TIMEOUT_MS
+    try {
+      this.origins.hub(id)
+      // Never holds the fork's answer for long: a note that is slow to go in is given up (logged).
+      await Promise.race([
+        synthetic({ sessionID: forkID, id, text, metadata: { source: PROMPT_SOURCE, messageID: id, kind: "primer", from: "hub", to: forkID }, delivery: "steer", resume: false }),
+        new Promise((_, reject) => (timer = setTimeout(() => reject(new Error(`no answer in ${ms} ms`)), ms))),
+      ])
+    } catch (cause) {
+      console.error("[hub] could not tell a fork that its hub identity is not its own", cause)
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+
   /**
    * Stages a revert from one of the session's user messages (feature "revert"), with the files restored when
    * `files`, and reports it at once. Refused while the session runs (OpenCode refuses it too).
@@ -1208,16 +1267,10 @@ export class Spoke {
     if (!this.canRevert()) throw new Error(CANNOT_REVERT)
     const messages = await this.host.context(sessionID)
     const index = userIndex(messages, messageID)
-    if (index < 0) throw new Error(NOT_A_USER_MESSAGE)
-    if (this.running.has(sessionID) || this.tracker.isBusy(sessionID)) throw new Error(REVERT_BUSY)
-    let staged: unknown
-    try {
-      staged = await this.host.revertStage!({ sessionID, messageID, files })
-    } catch (cause) {
-      if (busyError(cause)) throw new Error(REVERT_BUSY)
-      throw cause
-    }
-    const revert = revertSummary(staged, messages) ?? revertSummary({ messageID }, messages)!
+    if (index < 0) throw notAUserMessage()
+    if (this.running.has(sessionID) || this.tracker.isBusy(sessionID)) throw new CodedError(REVERT_BUSY, "busy")
+    const staged = await this.host.revertStage!({ sessionID, messageID, files })
+    const revert = withStagedAt(revertSummary(staged, messages) ?? revertSummary({ messageID }, messages)!, this.tracker.revertOf(sessionID), Date.now())
     this.timelines.invalidate(sessionID)
     // Sent at once even when OpenCode's staged event already set it (its snapshot may still be debounced).
     this.tracker.setRevert(sessionID, revert)
@@ -1244,21 +1297,52 @@ export class Spoke {
     ])
     if (!this.canRevert()) return messages
     const raw = session ? (session as { revert?: unknown }).revert : undefined
-    const revert = session ? revertSummary(raw, messages) : this.tracker.revertOf(sessionID)
+    const known = this.tracker.revertOf(sessionID)
+    const read = session ? revertSummary(raw, messages) : known
+    const revert = session && read ? withStagedAt(read, known, Date.now()) : read
     if (session && this.tracker.setRevert(sessionID, revert)) this.scheduleSnapshot()
     return visibleMessages(messages, revert?.messageID)
   }
 
-  /** A revert staged, restored or committed anywhere (this hub, the terminal, another client): reported. */
+  /**
+   * Records a commit of the session's revert (op or OpenCode's committed event) as its removed window
+   * (SessionInfo.revertCommitted). Without a known staged revert: the event of a commit already recorded changes
+   * nothing; otherwise a window without a start (the console still reloads on it). Returns true when it changed.
+   */
+  private recordCommit(sessionID: string, to?: string): boolean {
+    const staged = this.tracker.revertOf(sessionID)
+    const messageID = staged?.messageID ?? to
+    if (!messageID) return false
+    if (!staged && this.tracker.committedOf(sessionID)?.messageID === messageID) return false
+    const now = Date.now()
+    return this.tracker.setCommitted(sessionID, { messageID, ...(staged?.at === undefined ? {} : { from: staged.at }), until: staged?.stagedAt ?? now, at: now })
+  }
+
+  /**
+   * A revert staged, restored or committed anywhere (this hub, the terminal, another client): reported. A staged
+   * event reads the history; a later event that arrives meanwhile (a prompt committing it at once) wins, and the
+   * late read only fills in the commit's window start.
+   */
   private async observeRevert(event: EventLike, sessionID: string): Promise<void> {
     if (!this.tracker.has(sessionID)) return
+    const seq = (this.revertSeq.get(sessionID) ?? 0) + 1
+    this.revertSeq.set(sessionID, seq)
     if (event.type !== "session.revert.staged") {
-      if (this.tracker.setRevert(sessionID, undefined)) this.scheduleSnapshot()
+      const data = event.data as Record<string, unknown>
+      const committed = event.type === "session.revert.committed" && this.recordCommit(sessionID, typeof data.to === "string" && data.to ? data.to : undefined)
+      if (committed) this.timelines.invalidate(sessionID)
+      if (this.tracker.setRevert(sessionID, undefined) || committed) this.scheduleSnapshot()
       return
     }
     try {
       const raw = (event.data as Record<string, unknown>).revert
-      const revert = revertSummary(raw, await this.host.context(sessionID))
+      const read = revertSummary(raw, await this.host.context(sessionID))
+      if (this.revertSeq.get(sessionID) !== seq) {
+        const commit = this.tracker.committedOf(sessionID)
+        if (commit && commit.from === undefined && read?.at !== undefined && read.messageID === commit.messageID && this.tracker.setCommitted(sessionID, { ...commit, from: read.at })) this.scheduleSnapshot()
+        return
+      }
+      const revert = read && withStagedAt(read, this.tracker.revertOf(sessionID), Date.now())
       if (this.tracker.setRevert(sessionID, revert)) this.scheduleSnapshot()
     } catch (cause) {
       console.error("[hub] could not read a staged revert", cause)
@@ -1273,6 +1357,8 @@ export class Spoke {
     const synthetic = this.host.synthetic?.bind(this.host)
     if (!synthetic) throw new Error("This OpenCode process cannot take hub messages")
     return this.deliveries.run(req.messageID, req.wake, async () => {
+      // Defence in depth: the hub holds deliveries while it sees the revert; this process may know it first.
+      if (this.tracker.revertOf(req.sessionID)) throw new Error(REVERT_STAGED)
       const subagent = (this.tracker.parentOf(req.sessionID) ?? (await this.host.getSession(req.sessionID).catch(() => undefined))?.parentID) !== undefined
       const busy = this.running.has(req.sessionID) || this.tracker.isBusy(req.sessionID)
       // A routine quiet message into a running turn would still cost a model call: refused, the hub keeps it
@@ -1448,7 +1534,7 @@ export class Spoke {
     }
     const host = this.host
     const [messages, models, mcp, diffs, branch] = await Promise.all([
-      optional(() => host.context(sessionID)),
+      optional(() => this.shownMessages(sessionID)),
       optional(host.listModels && (() => host.listModels!())),
       optional(host.mcpList && (() => host.mcpList!(directory))),
       optional(host.vcsDiff && (() => host.vcsDiff!(directory))),
@@ -1824,13 +1910,15 @@ export class Spoke {
     const limit = this.options.listingTimeoutMs ?? LISTING_TIMEOUT_MS
     let timer: ReturnType<typeof setTimeout> | undefined
     const timedOut = Symbol("timeout")
+    const cancel = new AbortController()
     try {
       const keep = this.keep()
       const { days, max } = this.config.list
-      const listed = Promise.resolve(this.host.listRecent?.({ days, max, include: [...keep] }))
+      const listed = Promise.resolve(this.host.listRecent?.({ days, max, include: [...keep], signal: cancel.signal }))
       listed.catch(() => {}) // an abandoned listing that fails later is not an unhandled rejection
       const result = await Promise.race([listed, new Promise<typeof timedOut>((resolve) => (timer = setTimeout(() => resolve(timedOut), limit)))])
       if (result === timedOut) {
+        cancel.abort(new Error(`listing timed out after ${limit} ms`))
         if (!this.listingHung) console.error(`[hub] listing recent sessions timed out after ${limit} ms; listing again later`)
         this.listingHung = true
         return

package/src/spoke/timeline.ts

@@ -1,4 +1,4 @@
-import { DELIVER_ID_MAX, MESSAGE_KINDS, PROMPT_IMAGE_MIMES, summarizeToolInput, type MessageKind, type PromptImage, type TimelineMessageItem } from "../protocol"
+import { DELIVER_ID_MAX, MESSAGE_KINDS, PROMPT_IMAGE_MIMES, redactEmbeddedMedia, summarizeToolInput, type MessageKind, type PromptImage, type TimelineMessageItem } from "../protocol"
 import { PROMPT_SOURCE } from "./conversation"
 
 /** An attachment of a user message: its position in the message's files (for timelineFile), type and name. */
@@ -45,6 +45,11 @@ export interface TimelineItem {
   /** Error and retry rows: the error's type (bounded) and HTTP status (100–599). */
   readonly errorType?: string
   readonly errorStatus?: number
+  /**
+   * (R-04) Error rows: a permission was denied and that stopped the turn (OpenCode fails the declined tool call with
+   * "The user declined this tool call" and the step with "Step interrupted"). Whoever denied it is the hub's audit's.
+   */
+  readonly declined?: true
   /** Retry rows: the attempt number and when the next attempt starts (epoch ms). */
   readonly attempt?: number
   readonly next?: number
@@ -56,6 +61,14 @@ const SUBAGENT_TOOLS = new Set(["subagent", "task"])
 const TITLE_MAX = 160
 const ERROR_TEXT_MAX = 1000
 const ERROR_TYPE_MAX = 64
+/**
+ * OpenCode's error on a tool call the user (or an agent answering for them) denied, and on the step it then ends
+ * (2.2.3, SessionStep: failTool(call, {type: "aborted", message: DECLINED_TOOL}), failAssistant({type: "aborted",
+ * message: "Step interrupted"})). Both types are matched, so a tool that throws the same text (tool.execution) cannot
+ * mark its turn denied.
+ */
+const DECLINED_TOOL = "The user declined this tool call"
+const ABORTED = "aborted"
 
 const record = (value: unknown): Record<string, any> => value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, any> : {}
 
@@ -149,7 +162,7 @@ function errorFields(raw: unknown, fallback: string): { text: string; errorType?
  */
 function statusRow(sessionID: string, message: Record<string, any>, at: number | undefined, pos: number): TimelineItem | undefined {
   const base = { messageID: message.id as string, sessionID, ...(at === undefined ? {} : { at }), pos }
-  if (message.error != null) return { key: `${message.id}:error`, kind: "error", ...errorFields(message.error, "failed"), ...base }
+  if (message.error != null) return { key: `${message.id}:error`, kind: "error", ...errorFields(message.error, "failed"), ...(declinedTool(message) ? { declined: true as const } : {}), ...base }
   if (message.retry == null || message.time?.completed != null) return undefined
   const retry = record(message.retry)
   const next = millis(retry.at)
@@ -163,6 +176,16 @@ function statusRow(sessionID: string, message: Record<string, any>, at: number |
   }
 }
 
+/** (R-04) Whether the message's step was aborted because one of its tool calls' permission was denied. */
+function declinedTool(message: Record<string, any>): boolean {
+  if (!Array.isArray(message.content) || record(message.error).type !== ABORTED) return false
+  return message.content.some((part: any) => {
+    if (part?.type !== "tool" || part.state?.status !== "error") return false
+    const error = record(part.state.error)
+    return error.type === ABORTED && error.message === DECLINED_TOOL
+  })
+}
+
 /** A message the hub delivered (synthetic, with deliverMetadata): a "message" row; other synthetic messages: none. */
 function hubMessageRow(sessionID: string, message: Record<string, any>, at: number | undefined, pos: number): TimelineMessageItem | undefined {
   const meta = record(message.metadata)
@@ -325,8 +348,12 @@ export function timelinePart(messages: readonly unknown[], messageID: string, pa
 }
 
 const DETAIL_MAX_BYTES = 750_000
+/**
+ * A tool call's detail for the console: embedded images (tool screenshots as data: URLs or base64 parts) become
+ * small placeholders, so they never count against the limit nor travel to the console; huge text still fails.
+ */
 export function boundedTimelinePart(messages: readonly unknown[], messageID: string, partID: string): unknown {
-  const detail = timelinePart(messages, messageID, partID)
+  const detail = redactEmbeddedMedia(timelinePart(messages, messageID, partID))
   if (JSON.stringify(detail).length > DETAIL_MAX_BYTES) throw new Error("Timeline part is too large to display")
   return detail
 }

package/src/spoke/tracker.ts

@@ -1,7 +1,7 @@
 // Sessions this OpenCode process knows about, built from the events it sees, plus which of them
 // are exposed to the central server (by mode). Pure: time is passed in.
 import type { Mode } from "../config"
-import { compactActivity, compactRunError, FORWARDED_EVENTS, type CompactRunError, type CompactSessionStatus, type JobInfo, type SessionInfo, type SessionRevertInfo, type TerminalInfo } from "../protocol"
+import { compactActivity, compactRunError, FORWARDED_EVENTS, type CompactRunError, type CompactSessionStatus, type JobInfo, type SessionInfo, type RevertCommitted, type SessionRevertInfo, type TerminalInfo } from "../protocol"
 
 /** A session is "owned" by this process while it viewed or ran it within this window. */
 export const OWNED_WINDOW_MS = 30 * 60 * 1000
@@ -37,6 +37,8 @@ interface Entry {
   listed?: boolean
   /** A staged revert (feature "revert"). */
   revert?: SessionRevertInfo
+  /** The latest committed revert's removed window (feature "revert"). */
+  committed?: RevertCommitted
 }
 
 const ACTIVITY = new Set([
@@ -199,6 +201,19 @@ export class SessionTracker {
     return true
   }
 
+  /** The session's latest committed revert window, if any. */
+  committedOf(id: string): RevertCommitted | undefined {
+    return this.entries.get(id)?.committed
+  }
+
+  /** Sets a known session's latest committed revert window. Returns true when it changed. */
+  setCommitted(id: string, committed: RevertCommitted): boolean {
+    const entry = this.entries.get(id)
+    if (!entry || JSON.stringify(entry.committed ?? null) === JSON.stringify(committed)) return false
+    entry.committed = committed
+    return true
+  }
+
   /** Fills in details fetched for a session that was first seen through an activity event. */
   setInfo(id: string, details: SessionDetails): boolean {
     const entry = this.entries.get(id)
@@ -405,6 +420,7 @@ export class SessionTracker {
         ...(e.project ? { project: e.project } : {}),
         ...(e.projectName ? { projectName: e.projectName } : {}),
         ...(e.revert ? { revert: e.revert } : {}),
+        ...(e.committed ? { revertCommitted: e.committed } : {}),
       }))
   }
 

package/src/status.ts

@@ -23,7 +23,8 @@ export interface Blocker {
 export interface BlockerRecommendation {
   /** Who recommends it, as the hub names the agent. */
   readonly by: string
-  readonly recommends: "approve"
+  /** (R-03) Absent: the escalation recommends nothing (a Concierge that only tried); the blocker just links the Decision. */
+  readonly recommends?: "approve"
   readonly why?: string
   /** The Decision the user answers it in. */
   readonly decisionID?: string

package/web/dist/assets/ArtifactPage-R0ZTpHca.js

@@ -0,0 +1 @@
+import{At as e,Et as t,ft as n,i as r,r as i,yt as a}from"./ui-Dh1-78Cl.js";import{L as o,R as s,z as c}from"./index-g4V9mfSr.js";import{t as l}from"./ArtifactWorkbench-sP2mZccC.js";var u=a(`<div class="feature-page av-page">`),d=a(`<a class="icon-btn av-back"href=/artifacts aria-label="All artifacts"title="All artifacts">`);function f(a){return(()=>{var f=u();return n(f,e(l,{get id(){return a.id},layout:`page`,get lead(){return[e(t,{get when(){return o()},get children(){return e(r,{icon:`menu`,label:`Open sidebar`,onClick:s})}}),(()=>{var t=d();return n(t,e(i,{name:`back`})),t})()]},get actions(){return e(r,{class:`av-wide`,icon:`split`,label:`Open in pane`,onClick:()=>c(a.id)})}})),f})()}export{f as default};

package/web/dist/assets/ArtifactPane-C9KrBna8.js

@@ -0,0 +1 @@
+import{At as e,Pt as t,ft as n,ht as r,r as i,yt as a}from"./ui-Dh1-78Cl.js";import{t as o}from"./ArtifactWorkbench-sP2mZccC.js";var s=a(`<a class=icon-btn aria-label="Full page"title="Open the artifact's full page">`);function c(a){return e(o,{get id(){return a.artifactID},layout:`pane`,onArtifact:e=>a.onTitle?.(e.title||`Untitled`),get actions(){return(()=>{var o=s();return n(o,e(i,{name:`expand`})),t(()=>r(o,`href`,`/artifacts/${encodeURIComponent(a.artifactID)}`)),o})()},get trailing(){return a.paneTools}})}export{c as ArtifactPane};