@klarkxy/dsh-session-manager 0.3.2 → 0.3.3

package/lib/index.js

@@ -7,9 +7,9 @@ import { deriveEventMessage, foldSurface, isAppendSurfaceEvent } from "@deepseek
 import { BlockAssembler, ReasoningEffortId, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { lstat, mkdir, realpath } from "node:fs/promises";
 import { join } from "node:path";
-import { createModelSettingsChanges } from "@klarkxy/dsh-plugin-kit/model-settings-changes";
 import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
 import { z } from "zod";
+import { createModelSettingsChanges } from "@klarkxy/dsh-plugin-kit/model-settings-changes";
 //#region src/contracts.ts
 /** Shared names and bounds for cross-session discovery. */
 const PLUGIN_NAME = "@klarkxy/dsh-session-manager";
@@ -2157,7 +2157,7 @@ function registerHostRpc(ctx, channel, call, options = {}) {
 }
 //#endregion
 //#region src/welcome-back.ts
-const UUID$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const UUID$2 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /** Assistant-side durable activity: the moment the session last responded or worked. */
 const RESPONSE_EVENTS = /* @__PURE__ */ new Set([
 	"assistant/message",
@@ -2317,7 +2317,7 @@ function isBusyFailure(error) {
 }
 async function compactSession(services, request, signal) {
 	const sessionId = requiredSessionId(request?.sessionId);
-	if (typeof request?.requestId !== "string" || !UUID$1.test(request.requestId)) throw new PresenceError("session-manager/invalid-request", "requestId must be a UUID");
+	if (typeof request?.requestId !== "string" || !UUID$2.test(request.requestId)) throw new PresenceError("session-manager/invalid-request", "requestId must be a UUID");
 	const controller = services.sessionController;
 	const compaction = services.compaction;
 	if (controller === void 0 || compaction === void 0) throw new PresenceError("session-manager/unavailable", "this runtime cannot compact a session");
@@ -2466,11 +2466,17 @@ function presenceServices(ctx, sessionQuery) {
 	const agents = optional("agents");
 	const sessionController = optional("sessionController");
 	const compaction = optional("compaction");
+	const workspaceController = optional("workspaceController");
+	const attachments = optional("attachments");
+	const fileUploads = optional("fileUploads");
 	return {
 		sessionQuery,
 		...agents === void 0 ? {} : { agents },
 		...sessionController === void 0 ? {} : { sessionController },
-		...compaction === void 0 ? {} : { compaction }
+		...compaction === void 0 ? {} : { compaction },
+		...workspaceController === void 0 ? {} : { workspaceController },
+		...attachments === void 0 ? {} : { attachments },
+		...fileUploads === void 0 ? {} : { fileUploads }
 	};
 }
 //#endregion
@@ -2560,12 +2566,12 @@ async function writePresenceConfig(root, config, patch, store, signal) {
 }
 //#endregion
 //#region src/temporary-directory.ts
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const UUID$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 /** Allocate only beneath the active profile. Replaying a request retains its directory.
 * No user paths, session formats, free-session metadata or deletion are involved.
 */
 async function allocateTemporaryDirectory(profileDir, requestId, signal) {
-	if (typeof requestId !== "string" || !UUID.test(requestId)) throw new Error("Invalid temporary workspace request ID");
+	if (typeof requestId !== "string" || !UUID$1.test(requestId)) throw new Error("Invalid temporary workspace request ID");
 	signal.throwIfAborted();
 	let directory = await realpath(profileDir);
 	for (const part of [
@@ -2609,13 +2615,682 @@ async function runTemporaryAllocate(profileDir, payload, signal) {
 	}
 }
 //#endregion
+//#region src/edit-prepare.ts
+function unavailable(message) {
+	return new PresenceError("session-manager/unavailable", message);
+}
+function promptContent$1(event) {
+	const content = event.data.content.map((block) => {
+		if (block.type === "text") return {
+			type: "text",
+			text: block.text
+		};
+		if (block.type === "image") return {
+			type: "image",
+			attachmentId: block.attachment.attachmentId
+		};
+		if (block.type === "file") return {
+			type: "file",
+			...block.attachment
+		};
+		throw unavailable("This prompt contains an unsupported content block");
+	});
+	const text = event.data.content.map((block) => block.type === "text" ? block.text : "").join("");
+	if (text.trim() === "" && !content.some((block) => block.type !== "text")) throw unavailable("The selected prompt has no content to resend");
+	return {
+		text,
+		content
+	};
+}
+/** Resolve one exact human prompt on the active branch, with its original attachments. */
+async function prepareEdit(sessionQuery, request, signal) {
+	if (typeof request?.sessionId !== "string" || request.sessionId.trim() === "") throw new PresenceError("session-manager/invalid-request", "sessionId must be a non-empty string");
+	if (!Number.isSafeInteger(request.promptSeq) || request.promptSeq < 0) throw new PresenceError("session-manager/invalid-request", "promptSeq must be a non-negative integer");
+	const observation = await sessionQuery.observeSession(SessionId(request.sessionId), {
+		signal,
+		projectionMode: "none"
+	});
+	try {
+		if (isSubagentSession({ header: observation.header })) throw unavailable("Subagent prompts cannot be edited here");
+		const events = activeEventsOf(observation);
+		if (events === void 0) throw unavailable("The active conversation branch cannot be inspected");
+		const prompt = events.find((event) => event.type === "user/message" && event.seq === request.promptSeq && event.data.source.kind === "user");
+		if (prompt === void 0) throw unavailable("The selected prompt is unavailable");
+		const { text, content } = promptContent$1(prompt);
+		const modified = events.some((event) => event.type === "workspace/changes" && event.seq > prompt.seq);
+		return {
+			sessionId: request.sessionId,
+			promptSeq: prompt.seq,
+			text,
+			...content.some((block) => block.type !== "text") ? { content } : {},
+			modified
+		};
+	} finally {
+		observation[Symbol.dispose]();
+	}
+}
+//#endregion
+//#region src/retry-journal.ts
+const retryRecordSchema = z.object({
+	requestId: z.string().uuid(),
+	source: z.string().min(1),
+	messageId: z.string().min(1),
+	text: z.string().optional(),
+	expectedRevision: z.number().int().nonnegative(),
+	expectedInputRevision: z.string(),
+	forkSeq: z.number().int().nonnegative(),
+	title: z.string().optional(),
+	forkStarted: z.boolean(),
+	childId: z.string().min(1).optional(),
+	renamed: z.boolean().optional(),
+	prompted: z.boolean(),
+	result: z.object({
+		sessionId: z.string().min(1),
+		sourceSessionId: z.string().min(1),
+		archived: z.boolean()
+	}).strict().optional()
+}).strict().refine((row) => (!row.childId || row.forkStarted) && (!row.prompted || Boolean(row.childId)) && (!row.result || row.prompted && row.result.sessionId === row.childId && row.result.sourceSessionId === row.source));
+/** Separate from preferences: unreadable retry evidence must never become an empty ledger. */
+const retryDomain = defineDomain({
+	name: "dsh_session_manager_retries",
+	version: 1,
+	layout: "per-record",
+	tables: { requests: domainTable(retryRecordSchema) }
+});
+var RetryJournalError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+/** Owns one profile's request identities and drains active commits before releasing storage. */
+var RetryJournal = class {
+	domain;
+	records = /* @__PURE__ */ new Map();
+	running = /* @__PURE__ */ new Map();
+	runningIds = /* @__PURE__ */ new Set();
+	closing;
+	closed = false;
+	constructor(domain) {
+		this.domain = domain;
+		for (const [key, value] of domain.table("requests").entries()) {
+			const row = retryRecordSchema.parse(value);
+			if (key !== row.requestId) throw new Error("Retry record identity mismatch");
+			this.records.set(row.requestId, row);
+		}
+	}
+	get(requestId) {
+		return this.records.get(requestId);
+	}
+	async put(row) {
+		const stored = retryRecordSchema.parse(row);
+		await this.domain.table("requests").put(row.requestId, stored);
+		this.records.set(row.requestId, row);
+	}
+	run(source, requestId, action) {
+		if (this.closed) return Promise.reject(new RetryJournalError("session-manager/unavailable", "retry storage is closing"));
+		if (this.runningIds.has(requestId)) return Promise.reject(new RetryJournalError("session/retry-pending", "this retry is still running"));
+		if (this.running.has(source)) return Promise.reject(new RetryJournalError("session-manager/busy", "another retry is running"));
+		for (const row of this.records.values()) if (row.source === source && row.requestId !== requestId && row.forkStarted && !row.result) return Promise.reject(new RetryJournalError("session/retry-uncertain", "an earlier resend must be resolved first"));
+		const work = Promise.resolve().then(action).finally(() => {
+			this.running.delete(source);
+			this.runningIds.delete(requestId);
+		});
+		this.running.set(source, work);
+		this.runningIds.add(requestId);
+		return work;
+	}
+	close() {
+		this.closed = true;
+		return this.closing ??= Promise.allSettled([...this.running.values()]).then(() => this.domain.close());
+	}
+};
+//#endregion
+//#region src/edit-file.ts
+/** Reuse the host's streaming intake; only a file in the exact source prompt may be copied. */
+async function stageEditFile(query, services, request, signal) {
+	if (![request.sessionId, request.attachmentId].every((value) => typeof value === "string" && value !== "") || !Number.isSafeInteger(request.promptSeq) || request.promptSeq < 0) throw new PresenceError("session-manager/invalid-request", "Invalid attachment request");
+	const observation = await query.observeSession(SessionId(request.sessionId), {
+		signal,
+		projectionMode: "none"
+	});
+	try {
+		const part = (activeEventsOf(observation)?.find((event) => event.seq === request.promptSeq && event.type === "user/message" && event.data.source.kind === "user"))?.data.content.find((part) => part.type === "file" && part.attachment.attachmentId === request.attachmentId);
+		if (part?.type !== "file" || !services.attachments || !services.fileUploads) throw new PresenceError("session-manager/unavailable", "The selected file is unavailable");
+		return await services.fileUploads.uploadStream({
+			sessionId: request.sessionId,
+			name: part.attachment.name,
+			data: services.attachments.readFileStream(part.attachment, signal),
+			signal
+		});
+	} finally {
+		observation[Symbol.dispose]();
+	}
+}
+//#endregion
+//#region src/retry-branch.ts
+/**
+* Content digest of one prompt. Not a hash: the token only has to change when
+* the client edited between preview and commit, so the JSON of the durable
+* content is the honest cheapest representation.
+*/
+function inputRevisionOf(event) {
+	return JSON.stringify(event.data.content);
+}
+/**
+* An edit of a turn's first input must not inherit its empty turn/step shell.
+* Find the last balanced, drained prefix before that shell, including inbox
+* splices: cutting just before turn/start can resurrect the original queued
+* prompt. A later input in the same turn keeps the real work before it.
+*/
+function editForkBoundary(events, promptSeq) {
+	const pending = {
+		"next-turn": 0,
+		"next-step": 0
+	};
+	let open = false;
+	let hasContent = false;
+	let balanced;
+	let previous;
+	for (const event of events) {
+		if (event.seq >= promptSeq) break;
+		const type = event.type;
+		if (type === "agent/inbox/spliced") {
+			const splice = event.data;
+			const count = pending[splice.target];
+			const removed = splice.removedCount ?? 0;
+			if (count === void 0 || !Array.isArray(splice.inserted) || !Number.isSafeInteger(splice.start) || splice.start < 0 || splice.start > count || !Number.isSafeInteger(removed) || removed < 0 || splice.start + removed > count) return void 0;
+			pending[splice.target] += splice.inserted.length - removed;
+		}
+		if (type === "turn/start") {
+			open = true;
+			hasContent = false;
+		} else if (type === "turn/end") {
+			open = false;
+			hasContent = false;
+		} else if (type === "user/message" || type === "assistant/message" || type === "tool/call" || type === "tool/result" || type === "command/run" || type === "job/registered") hasContent = true;
+		previous = event.seq;
+		if (!open && pending["next-turn"] === 0 && pending["next-step"] === 0) balanced = event.seq;
+	}
+	if (open && !hasContent) return balanced;
+	return pending["next-turn"] === 0 && pending["next-step"] === 0 ? previous : void 0;
+}
+/**
+* Whether an already-observed prompt is still on the active surface: its seq
+* must not appear in any later event's `sourceEventSeqs`.
+*/
+function isOnActiveSurface(events, promptSeq) {
+	for (const event of events) {
+		if (event.seq <= promptSeq) continue;
+		const seqs = event.sourceEventSeqs;
+		if (Array.isArray(seqs) && seqs.includes(promptSeq)) return false;
+	}
+	return true;
+}
+/**
+* Later model-side work the user must explicitly keep (`allowModified`).
+* `command/run` and `job/*` are not in the stock SessionEventMap but a restored
+* log from a newer host can carry them, so the scan compares plain strings.
+*/
+const MODIFIED_EVIDENCE = /* @__PURE__ */ new Set([
+	"tool/call",
+	"tool/result",
+	"command/run",
+	"job/registered"
+]);
+function modificationEvidence(events, promptSeq) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const event of events) {
+		const type = event.type;
+		if (event.seq > promptSeq && MODIFIED_EVIDENCE.has(type)) seen.add(type);
+	}
+	return [...seen];
+}
+/**
+* A live job started and not yet settled blocks retry like a running turn.
+* Job events are absent from the stock event union; the scan reads `jobId`
+* defensively so a log restored from a newer host still reports live work.
+*/
+function hasLiveJobs(events) {
+	const live = /* @__PURE__ */ new Set();
+	for (const event of events) {
+		const type = event.type;
+		if (type !== "job/registered" && type !== "job/settled") continue;
+		const jobId = event.data.jobId;
+		if (typeof jobId !== "string") continue;
+		if (type === "job/registered") live.add(jobId);
+		else live.delete(jobId);
+	}
+	return live.size > 0;
+}
+//#endregion
+//#region src/retry-content.ts
+/**
+* The editor exposes joined text, while the host stores an ordered block list.
+* Apply the smallest single text replacement to that list. Unchanged text on
+* either side of an attachment stays on its own side; attachments never move.
+* Code points avoid splitting an emoji at a block boundary during replacement.
+*/
+function editedPromptBlocks(content, text) {
+	const before = content.flatMap((block) => block.type === "text" ? Array.from(block.text) : []);
+	if (text === void 0 || before.join("") === text) return content;
+	const after = Array.from(text);
+	let prefix = 0;
+	while (prefix < Math.min(before.length, after.length) && before[prefix] === after[prefix]) prefix++;
+	let suffix = 0;
+	while (suffix < Math.min(before.length, after.length) - prefix && before[before.length - suffix - 1] === after[after.length - suffix - 1]) suffix++;
+	const end = before.length - suffix;
+	const replacement = after.slice(prefix, after.length - suffix).join("");
+	let offset = 0;
+	let inserted = false;
+	const blocks = content.map((block) => {
+		if (block.type !== "text") return block;
+		const chars = Array.from(block.text);
+		const start = offset;
+		offset += chars.length;
+		const left = chars.slice(0, Math.max(0, prefix - start)).join("");
+		const right = chars.slice(Math.max(0, end - start)).join("");
+		const insertHere = !inserted && offset >= prefix;
+		if (insertHere) inserted = true;
+		return {
+			type: "text",
+			text: left + (insertHere ? replacement : "") + right
+		};
+	});
+	if (!inserted && text !== "") blocks.push({
+		type: "text",
+		text
+	});
+	return blocks;
+}
+//#endregion
+//#region src/retry-service.ts
+/**
+* Host-side edit-and-resend engine. A commit never writes to the source log:
+* it forks the retained conversation prefix, queues the
+* edited prompt on the fork, mirrors the title/sidebar position/pin, and
+* archives the source so the branch looks like the same chat.
+*
+* Why a fork and not a same-session `surfaceOp` replace: a replace bumps
+* `surface.contentGeneration`, which starts a new request series and
+* reshuffles the system/tool projections — the provider's prompt prefix
+* cache can be disrupted. Retaining the unchanged model-visible prefix gives
+* the provider the same content to reuse; actual cache hits remain provider-dependent.
+*
+* The profile's durable journal records intent before creating a fork and
+* the child identity before prompting it. Replays resume that same child.
+* The host cannot create a fork idempotently: an interrupted fork with no
+* saved child identity is therefore refused, never guessed or repeated.
+*/
+var RetryError = class extends Error {
+	code;
+	name = "RetryError";
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Retry needs a session controller that can fork and prompt; capabilities are honest about it. */
+function retryCapabilities(services) {
+	const controller = services.sessionController;
+	const available = services.retryJournal !== void 0 && controller !== void 0 && typeof controller.fork === "function" && typeof controller.prompt === "function";
+	return {
+		retry: available,
+		retryModified: available,
+		retryContent: false
+	};
+}
+function requireSessionId(value) {
+	if (typeof value !== "string" || value.trim() === "") throw new RetryError("session-manager/invalid-request", "sessionId must be a non-empty string");
+	return value;
+}
+function findPrompt(events, messageId) {
+	return events.find((event) => event.type === "user/message" && event.data.id === messageId && event.data.source.kind === "user");
+}
+async function observe(services, sessionId, signal) {
+	const observation = await services.sessionQuery.observeSession(SessionId(sessionId), {
+		signal,
+		projectionMode: "none"
+	});
+	const events = activeEventsOf(observation);
+	if (events === void 0) {
+		observation[Symbol.dispose]();
+		throw new RetryError("session-manager/unavailable", "the active conversation branch cannot be inspected");
+	}
+	return {
+		observation,
+		events
+	};
+}
+async function previewRetry(services, request, signal) {
+	const sessionId = requireSessionId(request?.sessionId);
+	if (typeof request.messageId !== "string" || request.messageId === "") throw new RetryError("session-manager/invalid-request", "messageId must be a non-empty string");
+	const { observation, events } = await observe(services, sessionId, signal);
+	try {
+		const base = {
+			sessionId,
+			messageId: request.messageId
+		};
+		if (isSubagentSession({ header: observation.header })) return {
+			...base,
+			promptSeq: -1,
+			branchRevision: 0,
+			inputRevision: "",
+			eligible: false,
+			modified: false,
+			reason: "subagent"
+		};
+		if (services.agents?.get(sessionId)?.status === "running" || hasLiveJobs(events)) return {
+			...base,
+			promptSeq: -1,
+			branchRevision: 0,
+			inputRevision: "",
+			eligible: false,
+			modified: false,
+			reason: "busy"
+		};
+		const prompt = findPrompt(events, request.messageId);
+		if (prompt === void 0 || !isOnActiveSurface(events, prompt.seq)) return {
+			...base,
+			promptSeq: -1,
+			branchRevision: 0,
+			inputRevision: "",
+			eligible: false,
+			modified: false,
+			reason: "prompt-unavailable"
+		};
+		const modified = modificationEvidence(events, prompt.seq).length > 0;
+		return {
+			...base,
+			promptSeq: prompt.seq,
+			branchRevision: events[events.length - 1]?.seq ?? 0,
+			inputRevision: inputRevisionOf(prompt),
+			eligible: !modified,
+			modified,
+			...modified ? { reason: "modified" } : {}
+		};
+	} finally {
+		observation[Symbol.dispose]();
+	}
+}
+/**
+* Latest `session/title` text at or before `throughSeq`. Title events are
+* log-only and merge-augmented, so the scan reads plain strings — the same
+* fold the title projection applies, without importing the title service.
+*/
+function foldedTitle(events, throughSeq) {
+	let title;
+	for (const event of events) {
+		if (event.seq > throughSeq) break;
+		if (event.type !== "session/title") continue;
+		const value = event.data.title;
+		if (typeof value === "string" && value.trim() !== "") title = value;
+	}
+	return title;
+}
+/**
+* The title the child still needs after the cut. A title event inside the
+* inherited prefix already lands on the fork; a title beyond that prefix
+* has to be re-applied — before the prompt, so an explicit
+* user-source title pins it ahead of any automatic generation.
+*/
+function titleToApply(events, forkSeq) {
+	const title = foldedTitle(events, Number.MAX_SAFE_INTEGER);
+	if (title === void 0 || foldedTitle(events, forkSeq) === title) return void 0;
+	return title;
+}
+/**
+* Canonical request equality: replay is valid only when every stored field of
+* the original request matches — same target, same edit text, same preview
+* tokens. `content` is rejected at validation so it never reaches this point.
+*/
+function assertSameRequest(entry, request) {
+	if (entry.source !== request.sessionId || entry.messageId !== request.messageId || entry.text !== request.text || entry.expectedRevision !== request.expectedRevision || entry.expectedInputRevision !== request.expectedInputRevision) throw new RetryError("session/retry-conflict", "the same requestId carries a different retry body");
+}
+/**
+* Re-check every preview guarantee on the live log, then record the resume
+* state a fork commit needs. The source log is never mutated, so this is the
+* only place the observed head matters: a stale check rejects before any
+* stage lands.
+*/
+async function validateCommit(services, request, sessionId, signal) {
+	const { observation, events } = await observe(services, sessionId, signal);
+	try {
+		signal.throwIfAborted();
+		if (isSubagentSession({ header: observation.header })) throw new RetryError("session/retry-blocked", "subagent sessions cannot be edited and resent");
+		if (services.agents?.get(sessionId)?.status === "running" || hasLiveJobs(events)) throw new RetryError("session-manager/busy", "the session is busy");
+		const prompt = findPrompt(events, request.messageId);
+		if (prompt === void 0) throw new RetryError("session/retry-input", "the prompt is no longer in the session");
+		if (!isOnActiveSurface(events, prompt.seq)) throw new RetryError("session/retry-revision", "the prompt is no longer on the active surface");
+		if ((events[events.length - 1]?.seq ?? -1) !== request.expectedRevision) throw new RetryError("session/retry-revision", "the session changed after the preview");
+		if (inputRevisionOf(prompt) !== request.expectedInputRevision) throw new RetryError("session/retry-input", "the prompt changed after the preview");
+		if (request.allowModified !== true) throw new RetryError("session/retry-input", "resend requires explicit confirmation");
+		if (!editedPromptBlocks(prompt.data.content, request.text).some((block) => block.type !== "text" || block.text !== "")) throw new RetryError("session/retry-input", "the resent prompt would be empty");
+		const forkSeq = editForkBoundary(events, prompt.seq);
+		if (forkSeq === void 0) throw new RetryError("session/retry-blocked", "the prompt has no drained conversation prefix to fork from");
+		return {
+			requestId: request.requestId,
+			source: sessionId,
+			messageId: request.messageId,
+			text: request.text,
+			expectedRevision: request.expectedRevision,
+			expectedInputRevision: request.expectedInputRevision,
+			forkSeq,
+			title: titleToApply(events, forkSeq),
+			forkStarted: false,
+			prompted: false
+		};
+	} finally {
+		observation[Symbol.dispose]();
+	}
+}
+/**
+* The prompt the child receives keeps the original block order. Image
+* bytes are re-read from the source log first; file
+* receipts are bound to the target agent, so original files are staged
+* against the child — never the source — after every image resolved.
+*/
+async function promptContent(services, controller, entry, signal) {
+	const { observation, events } = await observe(services, entry.source, signal);
+	let blocks;
+	try {
+		const prompt = findPrompt(events, entry.messageId);
+		if (!prompt || inputRevisionOf(prompt) !== entry.expectedInputRevision) throw new RetryError("session/retry-input", "the original prompt can no longer be read");
+		blocks = editedPromptBlocks(prompt.data.content, entry.text);
+	} finally {
+		observation[Symbol.dispose]();
+	}
+	const parts = [];
+	const files = [];
+	for (const block of blocks) if (block.type === "text") parts.push(block);
+	else if (block.type === "image") {
+		if (typeof controller.attachment !== "function") throw new RetryError("session-manager/unavailable", "this runtime cannot read the original image");
+		const image = await controller.attachment({
+			sessionId: entry.source,
+			attachmentId: block.attachment.attachmentId
+		});
+		if (typeof image?.attachment?.mediaType !== "string" || typeof image.data !== "string" || image.data === "") throw new RetryError("session/retry-failed", "the original image could not be read");
+		parts.push({
+			type: "image",
+			mediaType: image.attachment.mediaType,
+			data: image.data,
+			...typeof image.attachment.name === "string" && image.attachment.name !== "" ? { name: image.attachment.name } : {}
+		});
+	} else if (block.type === "file") {
+		files.push({
+			index: parts.length,
+			attachment: block.attachment
+		});
+		parts.push(void 0);
+	}
+	for (const file of files) {
+		if (services.fileUploads === void 0 || services.attachments === void 0) throw new RetryError("session-manager/unavailable", "this runtime cannot copy the original file");
+		const receiptId = (await services.fileUploads.uploadStream({
+			sessionId: entry.childId,
+			name: file.attachment.name,
+			data: services.attachments.readFileStream(file.attachment, signal),
+			signal
+		}))?.receiptId;
+		if (typeof receiptId !== "string" || receiptId === "") throw new RetryError("session/retry-failed", "the original file could not be staged");
+		parts[file.index] = {
+			type: "file",
+			receiptId
+		};
+	}
+	return parts;
+}
+/** The source's workspace and pin state, read from the controller's opening baseline. */
+async function workspacePlacement(workspace, sourceId, signal) {
+	if (typeof workspace.follow !== "function") return { pinned: false };
+	for await (const frame of workspace.follow(signal)) {
+		if (frame?.type !== "baseline") return { pinned: false };
+		const owner = (Array.isArray(frame.value?.items) ? frame.value.items : []).find((item) => Array.isArray(item?.sessionIds) && item.sessionIds.includes(sourceId));
+		const pinned = Array.isArray(frame.value?.pinnedSessionIds) && frame.value.pinnedSessionIds.includes(sourceId);
+		return {
+			...typeof owner?.workspaceId === "string" && owner.workspaceId !== "" ? { workspaceId: owner.workspaceId } : {},
+			pinned
+		};
+	}
+	return { pinned: false };
+}
+/**
+* Make the fork look like the same chat: the sidebar slot just before the
+* source, the source's pin, then the source archived. Every step is
+* best-effort — the conversation itself is already correct without them.
+*/
+async function finalizeCommit(services, entry, signal) {
+	const workspace = services.workspaceController;
+	let archived = false;
+	if (workspace !== void 0) {
+		let placement = { pinned: false };
+		try {
+			placement = await workspacePlacement(workspace, entry.source, signal);
+		} catch {}
+		if (placement.workspaceId !== void 0 && typeof workspace.insertSessionBefore === "function") try {
+			await workspace.insertSessionBefore({
+				workspaceId: placement.workspaceId,
+				sessionId: entry.childId,
+				beforeSessionId: entry.source
+			});
+		} catch {}
+		if (placement.pinned && typeof workspace.pinSession === "function") try {
+			await workspace.pinSession({ sessionId: entry.childId });
+		} catch {}
+		if (typeof workspace.archiveSession === "function") try {
+			await workspace.archiveSession({ sessionId: entry.source });
+			archived = true;
+		} catch {}
+	}
+	return {
+		sessionId: entry.childId,
+		sourceSessionId: entry.source,
+		archived
+	};
+}
+function requireController(services) {
+	const controller = services.sessionController;
+	if (controller === void 0 || typeof controller.fork !== "function" || typeof controller.prompt !== "function") throw new RetryError("session-manager/unavailable", "this runtime cannot fork a session");
+	return controller;
+}
+/**
+* Resume recorded stages. A failed save retains the live child identity;
+* after restart, an intent with no child fails closed because fork has no
+* request-id contract. No stage proceeds until its prerequisite is durable.
+*/
+async function runCommit(services, journal, entry, signal) {
+	try {
+		const controller = requireController(services);
+		if (entry.childId === void 0) {
+			if (entry.forkStarted) throw new RetryError("session/retry-uncertain", "the previous fork outcome is unknown; inspect the session list");
+			entry.forkStarted = true;
+			await journal.put(entry);
+			const childId = (await controller.fork({
+				sessionId: entry.source,
+				atSeq: entry.forkSeq
+			}))?.sessionId;
+			if (typeof childId !== "string" || childId === "") throw new RetryError("session/retry-failed", "the fork returned no session");
+			entry.childId = childId;
+		}
+		await journal.put(entry);
+		const forkedEntry = entry;
+		if (forkedEntry.title !== void 0 && forkedEntry.renamed !== true && typeof controller.rename === "function") {
+			await controller.rename({
+				sessionId: forkedEntry.childId,
+				title: forkedEntry.title
+			});
+			forkedEntry.renamed = true;
+			await journal.put(entry);
+		}
+		if (forkedEntry.prompted !== true) {
+			const content = await promptContent(services, controller, forkedEntry, signal);
+			await controller.prompt({
+				requestId: forkedEntry.requestId,
+				sessionId: forkedEntry.childId,
+				mode: "queue",
+				content
+			}, signal);
+			forkedEntry.prompted = true;
+			await journal.put(entry);
+		}
+		forkedEntry.result = await finalizeCommit(services, forkedEntry, signal);
+		await journal.put(entry);
+		return forkedEntry.result;
+	} catch (error) {
+		if (entry.forkStarted && !entry.childId && journal.get(entry.requestId)) throw new RetryError("session/retry-uncertain", "the previous fork outcome is unknown; inspect the session list");
+		if (entry.childId) throw new RetryError("session/retry-pending", "resend is incomplete; retry the same request");
+		throw commitFailure(error, signal);
+	}
+}
+/** Host RemoteError codes worth surfacing verbatim; anything else is a generic commit failure. */
+function commitFailure(error, signal) {
+	if (error instanceof RetryError || error instanceof RetryJournalError || error instanceof PresenceError) return error;
+	if (signal.aborted) return error;
+	if (error instanceof Error && error.name === "AbortError") return error;
+	const code = error?.code;
+	if (code === "session/not-found") return new RetryError("session-manager/not-found", "the session is not available");
+	if (code === "session/agent-busy" || code === "session/writer-held") return new RetryError("session-manager/busy", "the session is busy");
+	if (code === "session/fork-unavailable" || code === "session/migration-required") return new RetryError("session/retry-blocked", "the session cannot be forked here");
+	return new RetryError("session/retry-failed", "the retry commit failed");
+}
+async function commitRetry(services, request, signal) {
+	const sessionId = requireSessionId(request?.sessionId);
+	if (typeof request.messageId !== "string" || request.messageId === "") throw new RetryError("session-manager/invalid-request", "messageId must be a non-empty string");
+	if (!Number.isSafeInteger(request.expectedRevision) || request.expectedRevision < 0) throw new RetryError("session-manager/invalid-request", "expectedRevision must be a non-negative integer");
+	if (typeof request.expectedInputRevision !== "string") throw new RetryError("session-manager/invalid-request", "expectedInputRevision must be a string");
+	if (!UUID.test(request.requestId)) throw new RetryError("session-manager/invalid-request", "requestId must be a UUID");
+	if (request.content !== void 0) throw new RetryError("session/retry-input", "content replacement is not supported; edit the text only");
+	if (request.text !== void 0 && typeof request.text !== "string") throw new RetryError("session-manager/invalid-request", "text must be a string");
+	if (request.allowModified !== true) throw new RetryError("session/retry-input", "resend requires explicit confirmation");
+	requireController(services);
+	const journal = services.retryJournal;
+	if (!journal) throw new RetryError("session-manager/unavailable", "durable retry storage is unavailable");
+	return journal.run(sessionId, request.requestId, async () => {
+		const existing = journal.get(request.requestId);
+		if (existing !== void 0) {
+			assertSameRequest(existing, request);
+			if (existing.result !== void 0) {
+				try {
+					await journal.put(existing);
+				} catch {
+					throw new RetryError("session/retry-pending", "resend completed but its receipt could not be saved");
+				}
+				return existing.result;
+			}
+		}
+		const entry = existing ?? await validateCommit(services, request, sessionId, signal);
+		return runCommit(services, journal, entry, signal);
+	});
+}
+//#endregion
 //#region src/rpc.ts
 const PROFILE_ERROR = "Session Manager requires the active profile directory";
 function isAbort(error) {
 	return error instanceof Error && error.name === "AbortError";
 }
 function failure(error) {
-	if (error instanceof PresenceError) return {
+	if (error instanceof PresenceError || error instanceof RetryError || error instanceof RetryJournalError) return {
 		ok: false,
 		error: {
 			code: error.code,
@@ -2653,6 +3328,21 @@ function registerSessionManagerRpc(root, transport, config, models, modelStore)
 	const profileDir = profile.dir;
 	const suggestions = createSuggestionCache();
 	const lifetime = new AbortController();
+	let journal;
+	const retryJournal = async () => {
+		lifetime.signal.throwIfAborted();
+		const storage = root.get("storageDomain");
+		if (!storage) return void 0;
+		return journal ??= (async () => {
+			const domain = await storage.open(retryDomain);
+			try {
+				return new RetryJournal(domain);
+			} catch (error) {
+				await domain.close();
+				throw error;
+			}
+		})();
+	};
 	const unregister = registerHostRpc(transport, TEMP_WORKSPACE_CHANNEL, async (endpoint, payload, signal) => {
 		const merged = AbortSignal.any([signal, lifetime.signal]);
 		try {
@@ -2679,6 +3369,64 @@ function registerSessionManagerRpc(root, transport, config, models, modelStore)
 					value: await suggestContinuation(services, config, models(), suggestions, payload, merged)
 				};
 			}
+			if (endpoint === "edit.prepare") {
+				if (!payloadKeys(payload, ["sessionId", "promptSeq"])) throw new PresenceError("session-manager/invalid-request", "invalid edit request");
+				return {
+					ok: true,
+					value: await prepareEdit(sessionQuery, payload, merged)
+				};
+			}
+			if (endpoint === "edit.file") {
+				if (!payloadKeys(payload, [
+					"sessionId",
+					"promptSeq",
+					"attachmentId"
+				])) throw new PresenceError("session-manager/invalid-request", "invalid attachment request");
+				const fileServices = {
+					attachments: root.get("attachments"),
+					fileUploads: root.get("fileUploads")
+				};
+				return {
+					ok: true,
+					value: await stageEditFile(sessionQuery, fileServices, payload, merged)
+				};
+			}
+			if (endpoint === "retry.capabilities") {
+				if (!payloadKeys(payload, [])) throw new PresenceError("session-manager/invalid-request", "invalid retry capabilities request");
+				return {
+					ok: true,
+					value: retryCapabilities({
+						...services,
+						retryJournal: await retryJournal()
+					})
+				};
+			}
+			if (endpoint === "retry.preview") {
+				if (!payloadKeys(payload, ["sessionId", "messageId"])) throw new PresenceError("session-manager/invalid-request", "invalid retry preview request");
+				return {
+					ok: true,
+					value: await previewRetry(services, payload, merged)
+				};
+			}
+			if (endpoint === "retry.commit") {
+				if (!payloadKeys(payload, [
+					"sessionId",
+					"messageId",
+					"expectedRevision",
+					"expectedInputRevision",
+					"requestId",
+					"text",
+					"content",
+					"allowModified"
+				])) throw new PresenceError("session-manager/invalid-request", "invalid retry commit request");
+				return {
+					ok: true,
+					value: await commitRetry({
+						...services,
+						retryJournal: await retryJournal()
+					}, payload, merged)
+				};
+			}
 			if (endpoint === "config.read") {
 				if (!payloadKeys(payload, [])) throw new PresenceError("session-manager/invalid-request", "invalid config request");
 				return {
@@ -2698,10 +3446,11 @@ function registerSessionManagerRpc(root, transport, config, models, modelStore)
 			return failure(error);
 		}
 	}, { requirePayload: true });
-	return () => {
+	return async () => {
 		lifetime.abort();
 		suggestions.clear();
 		unregister();
+		await journal?.then((value) => value.close(), () => {});
 	};
 }
 //#endregion