@kybernesis/buzz 0.13.0 → 0.15.0

package/README.md

@@ -95,6 +95,34 @@ share link as the person who asked (`POST /eve/v1/kyb/artifacts/:id/share`, `@ky
 app and opens it beside the conversation; everywhere else the link is in the text. The person
 can withdraw the link from the agent. `BUZZ_CARDS=off` stops card messages.
 
+## Questions and approvals
+
+When the agent needs a yes or an answer, the bridge posts the question as a reply to the message
+that asked: an approval as the email, event or message it would send (recipients, subject and
+the whole body, not "Approve tool call"), any other question as its sentence, then the options by
+number. The person who asked answers by replying with a number, an option or their own words. Since 0.14 the
+question also travels hidden (`<!-- kyb:ask v1 {...} -->`), and the plugin draws it as Studio
+does, with Send it, Edit and Don't send on an email, the amount and Approve in Link on a
+purchase, and the fields of a form. A press posts the person's answer as a reply to the
+question: a short line, with the answer hidden after it (`<!-- kyb:answer v1 {...} -->`). The
+bridge accepts a hidden answer only as a direct reply to a prompt it posted, only for a request
+still open, and only with that request's own options. Replies inside a thread count, whichever
+`e` tag names the prompt. A vault request never takes a secret in the channel.
+
+Since 0.15 a question is for the person whose message raised it. Anyone else who presses an
+answer, or names the agent while it waits, is told whose answer it needs; a remark in the
+question's thread is left alone. The question carries who asked, so the plugin shows everyone
+else the email with "Waiting on" and no buttons. `BUZZ_ANSWERS=anyone` keeps the older rule.
+When a question ends (answered, declined, sent back with changes, or no longer waited on because
+its work stopped) the bridge edits its own prompt to say how and by whom, with the question
+hidden as `<!-- kyb:settled v1 {...} -->` instead. Only a message's author can edit it, so every
+client, with the plugin or without, shows the same outcome and nobody is offered the buttons
+again. The edit names nobody, so it notifies nobody.
+
+If the work an answer restarts fails (a model refusing the continuation, say), the bridge says so
+in the channel with the stream's own error, rather than leaving the person who answered with
+silence. A declined call is the person's choice and is not reported as a failure.
+
 ## Configuration
 
 | Variable | Meaning |
@@ -105,7 +133,8 @@ can withdraw the link from the agent. `BUZZ_CARDS=off` stops card messages.
 | `BUZZ_SESSIONS_FILE` | Channel-to-session continuity store (default beside the key file; an existing legacy `.buzz-sessions.json` is reused) |
 | `BUZZ_AGENT_SILENCE_TIMEOUT_MS` | Maximum silence before the agent acknowledges a request: unread drain, send and create acknowledgement (default `300000`, five minutes). This is where a genuine stall shows: no run is ever created. |
 | `BUZZ_AGENT_WORK_TIMEOUT_MS` | Ceiling on silence once the response stream is open (default `3600000`, sixty minutes). The stream is quiet while the agent works, a long tool call or a delegated subagent produces nothing until it returns, so this is a ceiling on work, not a stall detector. |
-| `BUZZ_CARDS` | `off` stops posting cards after replies (default on) |
+| `BUZZ_CARDS` | `off` stops posting cards after replies and hidden questions in prompts (default on) |
+| `BUZZ_ANSWERS` | Who may answer a question in a shared channel: `asker` (default), only the person whose message raised it, or `anyone` the agent knows there |
 | `BUZZ_PROFILE_SYNC_MS` | How often the profile is re-checked against the name and picture its owner set and its `.agent` name (default `900000`, fifteen minutes; `0` turns it off) |
 | `AGENTID_MIRROR_SUFFIX` | Where names serve their public documents (default `.agentid.dev`); for staging only |
 | `KYBERNESIS_ISSUER` | The control plane |

package/dist/bridge.d.ts

@@ -26,9 +26,20 @@ export type BuzzBridgeOptions = {
     /**
      * Post the cards a turn's tools handed back, each as its own message after
      * the reply: the card's text, with the card hidden in a comment for clients
-     * that draw it. Default true; false posts the reply alone, as before 0.13.
+     * that draw it. Questions carry themselves the same way (0.14), so the
+     * plugin can draw an approval as its email and answer it with a press.
+     * Default true; false posts the reply and questions as words alone.
      */
     cards?: boolean;
+    /**
+     * Who may answer a question the agent asks in a shared channel. `asker`
+     * (the default): only the person whose message raised it; anyone else is
+     * told so, and the plugin shows them the question without buttons.
+     * `anyone`: anyone the agent knows in the channel, as before 0.15.
+     * Either way, once a question ends the bridge edits it to say how, for
+     * everyone who can see it.
+     */
+    answers?: "asker" | "anyone";
     onLog?: (message: string) => void;
 };
 export declare function buzzBridge(options: BuzzBridgeOptions): {

package/dist/bridge.js

@@ -1,11 +1,11 @@
-import { cardMessage, cardText } from "@kybernesis/cards";
+import { cardMessage, cardText, readHiddenAnswers } from "@kybernesis/cards";
 import { channelIdentity } from "@kybernesis/enterprise";
 import { fetchMedia, parseMedia } from "./media.js";
 import { speakerCredentials } from "./credentials.js";
 import { surfaceWriter } from "./surface.js";
 import { SessionStore } from "./sessions.js";
 import { agentSilenceReply, answerTurn, composeMessage, DEFAULT_AGENT_SILENCE_TIMEOUT_MS, DEFAULT_AGENT_WORK_TIMEOUT_MS, describeSilentTurn, rejectedTurnReply, silentTurnReply, validateAgentSilenceTimeoutMs, } from "./turn.js";
-import { followPendingConversation, followerRetryDelayMs, formatInputRequests, invalidInputReply, needsPendingFollower, resolveInputReply, respondToPendingConversation, resumeStalledReply, } from "./hitl.js";
+import { applySettlements, followPendingConversation, followerRetryDelayMs, formatInputRequests, invalidInputReply, isAsker, needsPendingFollower, notTheAskerReply, settlementsFor, settleRemaining, resolveCarriedAnswers, resolveInputReply, respondToPendingConversation, resumeFailedReply, resumeStalledReply, STALE_ANSWER_REPLY, } from "./hitl.js";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { Client } from "eve/client";
@@ -35,6 +35,8 @@ export function buzzBridge(options) {
     const log = options.onLog ?? ((message) => console.log(new Date().toISOString().slice(11, 19), message));
     const agentWorkTimeoutMs = validateAgentSilenceTimeoutMs(options.agentWorkTimeoutMs ?? DEFAULT_AGENT_WORK_TIMEOUT_MS);
     const agentSilenceTimeoutMs = validateAgentSilenceTimeoutMs(options.agentSilenceTimeoutMs ?? DEFAULT_AGENT_SILENCE_TIMEOUT_MS);
+    const askerOnly = options.answers !== "anyone";
+    const carry = options.cards !== false;
     /**
      * An artifact card, with a link everyone in the channel can open.
      *
@@ -262,6 +264,49 @@ export function buzzBridge(options) {
         followers.get(conversation)?.abort();
         followers.delete(conversation);
     }
+    /**
+     * Edit each posted question whose requests just ended, so everyone who can
+     * see it reads how it ended and nobody is offered its buttons again.
+     *
+     * @remarks
+     * The plugin used to keep a pressed question's outcome only on the device
+     * that pressed it. In a shared channel everyone else, and the same person on
+     * another device, still saw Send it on an email that had gone. The prompt is
+     * the agent's own message and only its author may edit it, so the edit is
+     * the one record every client draws. Runs inside the conversation's queue.
+     */
+    function settlePrompts(relay, community, channel, settlements) {
+        const current = sessions.get(community, channel);
+        if (!current?.prompts?.length || settlements.size === 0)
+            return;
+        const { edits, open } = applySettlements(current.prompts, settlements, { carry, askerOnly });
+        for (const { eventId, content } of edits) {
+            if (relay.edit(channel, eventId, content))
+                log(`marked a question in ${channel.slice(0, 8)} as ${[...new Set(settlements.values())].map((s) => s.outcome).join(", ")}`);
+            else
+                log(`could not mark a question in ${channel.slice(0, 8)} as ended: not connected`);
+        }
+        const { prompts: _prompts, ...rest } = current;
+        sessions.set(community, channel, open.length ? { ...rest, prompts: open } : rest);
+    }
+    /** Every question still open in this conversation ends the same way: answered elsewhere, or no longer waited on. */
+    function settleOpenPrompts(relay, community, channel, outcome) {
+        const current = sessions.get(community, channel);
+        if (!current?.prompts?.length)
+            return;
+        settlePrompts(relay, community, channel, settleRemaining(current.prompts, { outcome, at: Date.now() }));
+    }
+    /** Remember a posted question, so it can be edited when it ends. */
+    function rememberPrompt(community, channel, prompt) {
+        const current = sessions.get(community, channel);
+        if (!current)
+            return;
+        sessions.set(community, channel, {
+            ...current,
+            promptEventIds: [...(current.promptEventIds ?? []), prompt.eventId],
+            prompts: [...(current.prompts ?? []), prompt],
+        });
+    }
     function startFollower(community, channel) {
         if (stopped)
             return;
@@ -286,28 +331,32 @@ export function buzzBridge(options) {
                 if (followers.get(conversation) !== controller)
                     return;
                 const current = sessions.get(community, channel);
+                // The follower began from a copy; who asked and what was posted are the store's.
+                const { prompts: _stale, asker: _staleAsker, ...fresh } = state;
+                const kept = {
+                    ...(current?.asker ? { asker: current.asker } : {}),
+                    ...(current?.prompts?.length ? { prompts: current.prompts } : {}),
+                };
                 if (state.pendingInputRequests?.length) {
-                    sessions.set(community, channel, { ...state, promptEventIds: current?.promptEventIds });
+                    sessions.set(community, channel, { ...fresh, ...kept, promptEventIds: current?.promptEventIds });
                     return;
                 }
                 if (current?.promptEventIds?.length)
                     relay.unwatchReplies(current.promptEventIds);
-                sessions.set(community, channel, state);
+                sessions.set(community, channel, { ...fresh, ...kept });
+                // Nothing is waiting on a person any more. A question the bridge did not see answered
+                // was answered elsewhere if the turn resumed, and is no longer waited on if it ended.
+                settleOpenPrompts(relay, community, channel, state.resumeInFlight ? "answered" : "withdrawn");
             }),
             onInputRequested: (requests) => serialize(community, channel, async () => {
                 if (followers.get(conversation) !== controller)
                     return;
-                const promptId = relay.reply(channel, formatInputRequests(requests));
+                const asker = sessions.get(community, channel)?.asker;
+                const promptId = relay.reply(channel, formatInputRequests(requests, { carry, asker, askerOnly }));
                 if (!promptId)
                     throw new Error("Buzz relay is not connected");
                 relay.watchReplies([promptId]);
-                const current = sessions.get(community, channel);
-                if (current) {
-                    sessions.set(community, channel, {
-                        ...current,
-                        promptEventIds: [...(current.promptEventIds ?? []), promptId],
-                    });
-                }
+                rememberPrompt(community, channel, { eventId: promptId, requests, ...(asker ? { asker } : {}) });
                 log(`posted another input request in ${channel.slice(0, 8)}`);
             }),
             onMessage: (message, cards) => serialize(community, channel, async () => {
@@ -319,6 +368,16 @@ export function buzzBridge(options) {
                     log(`posted resumed reply in ${channel.slice(0, 8)} (${message.length} chars)`);
                 await postCards(relay, channel, cards, stored.speakerPublicKey);
             }),
+            onFailed: (failures) => serialize(community, channel, async () => {
+                if (followers.get(conversation) !== controller)
+                    return;
+                const current = sessions.get(community, channel);
+                if (current?.promptEventIds?.length)
+                    relay.unwatchReplies(current.promptEventIds);
+                if (!relay.reply(channel, resumeFailedReply(failures)))
+                    throw new Error("Buzz relay is not connected");
+                log(`resumed turn failed in ${channel.slice(0, 8)} (${describeSilentTurn(failures)}); told the room`);
+            }),
             onLog: log,
         }, controller.signal).catch((error) => {
             if (!controller.signal.aborted) {
@@ -354,7 +413,8 @@ export function buzzBridge(options) {
                         return;
                     if (current.promptEventIds?.length)
                         relay.unwatchReplies(current.promptEventIds);
-                    const { pendingInputRequests: _p, resumeInFlight: _r, promptEventIds: _e, ...cleared } = current;
+                    settleOpenPrompts(relay, community, channel, "answered");
+                    const { pendingInputRequests: _p, resumeInFlight: _r, promptEventIds: _e, prompts: _q, ...cleared } = sessions.get(community, channel) ?? current;
                     sessions.set(community, channel, cleared);
                     relay.reply(channel, resumeStalledReply(agentWorkTimeoutMs));
                     log(`gave up on the resumed turn in ${channel.slice(0, 8)}: no progress past index ${retry.index}`);
@@ -378,9 +438,13 @@ export function buzzBridge(options) {
         const addressed = event.tags.some((t) => t[0] === "p" && t[1] === key.publicKey);
         // A reply to a prompt this agent posted is an answer even when it names nobody: people answer
         // a question by replying to it, not by mentioning the asker. Only while that prompt is open.
-        const repliedTo = event.tags.find((t) => t[0] === "e")?.[1];
+        // Any `e` tag counts: a reply inside a thread names the thread's root first and the prompt
+        // after it (NIP-10 `root` and `reply` markers), so the first tag is often not the prompt.
+        const referenced = event.tags.filter((t) => t[0] === "e" && typeof t[1] === "string").map((t) => t[1]);
+        // The message this one answers directly: the `reply` marker, else the last `e` tag.
+        const parent = event.tags.find((t) => t[0] === "e" && t[3] === "reply")?.[1] ?? referenced.at(-1);
         const open = channel ? sessions.get(from, channel) : undefined;
-        const answersPrompt = Boolean(repliedTo && open?.pendingInputRequests?.length && open.promptEventIds?.includes(repliedTo));
+        const answersPrompt = Boolean(open?.pendingInputRequests?.length && referenced.some((id) => open.promptEventIds?.includes(id)));
         // In a one-to-one DM every message is to the agent, mention or not, as with Buzz's own
         // agents. Not one written by another agent (it carries its owner's `auth` attestation):
         // two agents in a DM would otherwise answer each other forever.
@@ -414,9 +478,35 @@ export function buzzBridge(options) {
             await serialize(from, channel, async () => {
                 const pending = sessions.get(from, channel);
                 if (pending?.pendingInputRequests?.length) {
-                    // "@Ava approve" is an approve. The mention is how the message reached us, not the answer.
-                    const answer = addressed ? text.replace(/^@\S+\s*/, "") : text;
-                    const responses = resolveInputReply(answer, pending.pendingInputRequests);
+                    let responses;
+                    const carried = readHiddenAnswers(text);
+                    if (askerOnly && pending.asker && !isAsker(pending.asker, event.pubkey, speaker.user.id)) {
+                        // Someone else's question. A remark in its thread is people talking, not an answer:
+                        // only a press, or a message that names the agent, is told whose answer it waits for.
+                        if (carried.length || addressed)
+                            relay.reply(channel, notTheAskerReply(pending.asker), event);
+                        log(`ignored an answer in ${channel.slice(0, 8)} from ${speaker.user.email}: the question is for someone else`);
+                        return;
+                    }
+                    if (carried.length) {
+                        // A press in the plugin. It counts only as a direct reply to a prompt this bridge
+                        // posted, so a message quoting someone else's question cannot answer this one.
+                        if (!parent || !pending.promptEventIds?.includes(parent)) {
+                            log(`ignored a pressed answer in ${channel.slice(0, 8)} that does not reply to an open prompt`);
+                            return;
+                        }
+                        const resolved = resolveCarriedAnswers(carried, pending.pendingInputRequests);
+                        if (!resolved.responses) {
+                            relay.reply(channel, resolved.stale ? STALE_ANSWER_REPLY : invalidInputReply(pending.pendingInputRequests), event);
+                            return;
+                        }
+                        responses = resolved.responses;
+                    }
+                    else {
+                        // "@Ava approve" is an approve. The mention is how the message reached us, not the answer.
+                        const answer = addressed ? text.replace(/^@\S+\s*/, "") : text;
+                        responses = resolveInputReply(answer, pending.pendingInputRequests);
+                    }
                     if (!responses) {
                         relay.reply(channel, invalidInputReply(pending.pendingInputRequests), event);
                         return;
@@ -432,8 +522,9 @@ export function buzzBridge(options) {
                     const session = clientFor(event.pubkey).sessions.attach(pending.id, {
                         streamIndex: pending.streamIndex,
                     });
-                    await respondToPendingConversation(session, responses, from, channel);
+                    await respondToPendingConversation(session, responses);
                     log(`submitted ${responses.length} input response(s) in ${channel.slice(0, 8)}`);
+                    const settlements = settlementsFor(responses, pending.pendingInputRequests, speaker.user.displayName?.trim() || undefined);
                     /**
                      * The answer is in, so this conversation is no longer waiting on a
                      * person. It is waiting on the agent, and that is a thing the bridge
@@ -447,11 +538,15 @@ export function buzzBridge(options) {
                      * a human, so while that flag was set the room could only be told
                      * nothing.
                      */
+                    // A press answers one question; any others stay open until they are answered too.
                     const answered = sessions.get(from, channel);
                     if (answered?.pendingInputRequests?.length) {
+                        const done = new Set(responses.map((response) => response.requestId));
+                        const remaining = answered.pendingInputRequests.filter((request) => !done.has(request.requestId));
                         const { pendingInputRequests: _resolved, ...rest } = answered;
-                        sessions.set(from, channel, { ...rest, resumeInFlight: true });
+                        sessions.set(from, channel, remaining.length ? { ...rest, pendingInputRequests: remaining } : { ...rest, resumeInFlight: true });
                     }
+                    settlePrompts(relay, from, channel, settlements);
                     return;
                 }
                 if (pending?.resumeInFlight) {
@@ -468,18 +563,19 @@ export function buzzBridge(options) {
                 const message = await composeMessage(text, attachments, (ref) => fetchMedia(key, ref), log);
                 const result = await answerTurn(clientFor(event.pubkey), sessions, channel, message, from, log, agentSilenceTimeoutMs, agentWorkTimeoutMs);
                 if (result.status === "waiting" && result.inputRequests.length > 0) {
+                    const name = speaker.user.displayName?.trim();
+                    const asker = { key: event.pubkey, ...(speaker.user.id ? { userId: speaker.user.id } : {}), ...(name ? { name } : {}) };
                     sessions.set(from, channel, {
                         id: result.sessionId,
                         streamIndex: result.streamIndex,
                         pendingInputRequests: result.inputRequests,
                         speakerPublicKey: event.pubkey,
+                        asker,
                     });
-                    const promptId = relay.reply(channel, formatInputRequests(result.inputRequests), event);
+                    const promptId = relay.reply(channel, formatInputRequests(result.inputRequests, { carry, asker, askerOnly }), event);
                     if (promptId) {
                         relay.watchReplies([promptId]);
-                        const current = sessions.get(from, channel);
-                        if (current)
-                            sessions.set(from, channel, { ...current, promptEventIds: [promptId] });
+                        rememberPrompt(from, channel, { eventId: promptId, requests: result.inputRequests, asker });
                     }
                     log(`posted ${result.inputRequests.length} input request(s) in ${channel.slice(0, 8)}`);
                     startFollower(from, channel);

package/dist/cli.js

@@ -231,6 +231,7 @@ function run() {
             ? { agentWorkTimeoutMs: Number(process.env.BUZZ_AGENT_WORK_TIMEOUT_MS) }
             : {}),
         ...(process.env.BUZZ_CARDS === "off" ? { cards: false } : {}),
+        ...(process.env.BUZZ_ANSWERS === "anyone" ? { answers: "anyone" } : {}),
         ...(process.env.BUZZ_AGENT_SILENCE_TIMEOUT_MS
             ? { agentSilenceTimeoutMs: Number(process.env.BUZZ_AGENT_SILENCE_TIMEOUT_MS) }
             : {}),
@@ -424,6 +425,7 @@ else {
     BUZZ_AGENT_SILENCE_TIMEOUT_MS   maximum silence before a turn is acknowledged (default 300000ms)
     BUZZ_AGENT_WORK_TIMEOUT_MS      ceiling on a turn once acknowledged (default 3600000ms)
     BUZZ_CARDS=off                  post replies without the cards tools handed back
+    BUZZ_ANSWERS=anyone             let anyone in a channel answer a question (default: only who asked)
     BUZZ_PROFILE_SYNC_MS           how often the profile is re-checked against the name and
                                    picture its owner set (default 900000ms, fifteen
                                    minutes; 0 turns it off)

package/dist/hitl.d.ts

@@ -1,19 +1,87 @@
 import { type ClientSession, type InputRequest, type InputResponse } from "eve/client";
-import { type Card } from "@kybernesis/cards";
-import type { StoredSession } from "./sessions.js";
+import { type AskAnswer, type AskSettled, type Card } from "@kybernesis/cards";
+import type { StoredAsker, StoredPrompt, StoredSession } from "./sessions.js";
+import { type TurnFailure } from "./turn.js";
+/** How a question is posted: who it is for, and which of its requests have ended. */
+export interface PromptOptions {
+    /** Carry each question hidden after the words, for the plugin. */
+    carry?: boolean;
+    /** The person whose message raised it. */
+    asker?: StoredAsker;
+    /** Only the asker may answer it. */
+    askerOnly?: boolean;
+    /** Requests that have ended, by request id: shown as how they ended, with nothing to answer. */
+    settled?: Readonly<Record<string, AskSettled>>;
+}
+/**
+ * Render pending Eve input in a Buzz channel.
+ *
+ * Everyone reads the words: a question's sentence (a `[kyb:…]` marker line is
+ * dropped), an approval as the email or event it would send, then the options
+ * by number. With `carry`, each question also travels hidden after the words
+ * (`<!-- kyb:ask v1 … -->`), so the Kybernesis plugin can draw it the way
+ * Studio does and answer it with a press. Only a posted prompt carries them:
+ * a press is accepted only as a reply to a prompt the bridge is watching.
+ *
+ * The same text, with `settled`, is what the prompt is edited to once a
+ * question ends: how it ended and who ended it, then what it asked, and the
+ * question hidden as `kyb:settled` so no client offers to answer it again.
+ */
+export declare function formatInputRequests(requests: readonly InputRequest[], options?: PromptOptions): string;
+/** What someone other than the asker hears when they try to answer. */
+export declare function notTheAskerReply(asker: StoredAsker): string;
+/** Whether `pubkey`, resolved to `userId`, is the person a question is for. */
+export declare function isAsker(asker: StoredAsker, pubkey: string, userId?: string): boolean;
+/** How each response settles its request, said by `by`. */
+export declare function settlementsFor(responses: readonly InputResponse[], requests: readonly InputRequest[], by?: string, at?: number): Map<string, AskSettled>;
+/**
+ * Prompts with `settlements` applied: each one that changed, with the text it
+ * is edited to, and the prompts still waiting on something afterwards.
+ */
+export declare function applySettlements(prompts: readonly StoredPrompt[], settlements: ReadonlyMap<string, AskSettled>, options: {
+    carry?: boolean;
+    askerOnly?: boolean;
+}): {
+    edits: {
+        eventId: string;
+        content: string;
+    }[];
+    open: StoredPrompt[];
+};
+/** Every request in `prompts` that has not ended yet, settled the same way. */
+export declare function settleRemaining(prompts: readonly StoredPrompt[], settled: AskSettled): Map<string, AskSettled>;
 /**
- * Render pending Eve input in a text-only Buzz channel.
+ * Answers a client pressed, checked against what is actually open.
  *
- * A Kybernesis tool may put a `[kyb:…] {json}` marker on a question's first
- * line for apps that draw it as a card. Buzz shows only the sentence after it.
+ * Each answer must name an open request. An option must be one of that
+ * request's own; words alone answer only a question that takes words. eve's
+ * strict schema checks the result before it is sent. `stale` is true when no
+ * answer named an open request, which is what a second press on a question
+ * someone already answered looks like.
  */
-export declare function formatInputRequests(requests: readonly InputRequest[]): string;
+export declare function resolveCarriedAnswers(answers: readonly AskAnswer[], requests: readonly InputRequest[]): {
+    responses: readonly InputResponse[];
+    stale: false;
+} | {
+    responses: null;
+    stale: boolean;
+};
+/** What a press on a question nobody is waiting on any more gets. */
+export declare const STALE_ANSWER_REPLY = "That question was already answered, so nothing changed.";
 /** Resolve a Buzz text reply using Eve's certified matching semantics. */
 export declare function resolveInputReply(text: string, requests: readonly InputRequest[]): readonly InputResponse[] | null;
 /** Actionable response for text that cannot satisfy every pending request. */
 export declare function invalidInputReply(requests: readonly InputRequest[]): string;
-/** Submit a matched reply without consuming its response stream. */
-export declare function respondToPendingConversation(session: Pick<ClientSession, "respond">, responses: readonly InputResponse[], community: string, channel: string): Promise<void>;
+/**
+ * Submit a matched reply without consuming its response stream.
+ *
+ * No `clientContext`: the turn already carries the channel from when it
+ * started, and eve 0.81 treats context on a respond as new turn input. It then
+ * runs one more model step after the agent's reply, with the agent's message
+ * last, which models that refuse prefill reject. The turn fails and the whole
+ * conversation ends, on an approve, a decline or an answer alike.
+ */
+export declare function respondToPendingConversation(session: Pick<ClientSession, "respond">, responses: readonly InputResponse[]): Promise<void>;
 /**
  * How long a follower waits between reattaching when it saw no progress.
  *
@@ -34,6 +102,16 @@ export declare function followerRetryDelayMs(cycles: number, capMs?: number): nu
  * Say the answer arrived, say the work did not, and say the channel is usable.
  */
 export declare function resumeStalledReply(stallMs: number): string;
+/**
+ * What the room is told when the turn an answer resumed failed.
+ *
+ * @remarks
+ * Found live: a declined approval resumed the turn, the model refused the
+ * continuation, and the run ended. The follower saw the stream end and said
+ * nothing, so the person who pressed Decline got silence. They answered; the
+ * failure is the one thing they must hear about, in the stream's own words.
+ */
+export declare function resumeFailedReply(failures: readonly TurnFailure[]): string;
 /** A session needs its follower while asking or while resumed output is unpublished. */
 export declare function needsPendingFollower(session: Pick<StoredSession, "pendingInputRequests" | "resumeInFlight">): boolean;
 export interface PendingFollowerCallbacks {
@@ -42,6 +120,8 @@ export interface PendingFollowerCallbacks {
     onInputRequested(requests: readonly InputRequest[]): void | Promise<void>;
     /** The resumed turn's words, and the cards its tools handed back. */
     onMessage(message: string, cards: readonly Card[]): void | Promise<void>;
+    /** The resumed turn failed: what the stream said, for the room. */
+    onFailed?(failures: readonly TurnFailure[]): void | Promise<void>;
     onLog?: (message: string) => void;
 }
 type MutableStoredSession = Omit<StoredSession, "updated">;

package/dist/hitl.js

@@ -1,32 +1,169 @@
-import { resolveTextToResponses, } from "eve/client";
-import { cardsOf, newStepState, promptText, readStep } from "@kybernesis/cards";
+import { parseInputResponses, resolveTextToResponses, } from "eve/client";
+import { askFrom, askText, cardsOf, hiddenAsk, hiddenSettled, newStepState, readStep, settledLine, settleWith, } from "@kybernesis/cards";
+import { failureFromEvent, silentTurnReply } from "./turn.js";
 /**
- * Render pending Eve input in a text-only Buzz channel.
+ * Render pending Eve input in a Buzz channel.
  *
- * A Kybernesis tool may put a `[kyb:…] {json}` marker on a question's first
- * line for apps that draw it as a card. Buzz shows only the sentence after it.
+ * Everyone reads the words: a question's sentence (a `[kyb:…]` marker line is
+ * dropped), an approval as the email or event it would send, then the options
+ * by number. With `carry`, each question also travels hidden after the words
+ * (`<!-- kyb:ask v1 … -->`), so the Kybernesis plugin can draw it the way
+ * Studio does and answer it with a press. Only a posted prompt carries them:
+ * a press is accepted only as a reply to a prompt the bridge is watching.
+ *
+ * The same text, with `settled`, is what the prompt is edited to once a
+ * question ends: how it ended and who ended it, then what it asked, and the
+ * question hidden as `kyb:settled` so no client offers to answer it again.
  */
-export function formatInputRequests(requests) {
-    return requests.map((request, requestIndex) => {
-        const prompt = promptText(request.prompt);
-        const lines = [
-            requests.length > 1 ? `Question ${requestIndex + 1}: ${prompt}` : prompt,
-        ];
+export function formatInputRequests(requests, options = {}) {
+    const person = options.asker ? { key: options.asker.key, ...(options.asker.name ? { name: options.asker.name } : {}) } : undefined;
+    const only = Boolean(options.askerOnly && person);
+    const asks = requests.map((request) => ({
+        ...askFrom(request),
+        ...(person ? { asker: person } : {}),
+        ...(only ? { askerOnly: true } : {}),
+    }));
+    const settledOf = (ask) => options.settled?.[ask.requestId];
+    const text = asks.map((ask, requestIndex) => {
+        const request = requests[requestIndex];
+        const prompt = askText(ask);
+        const numbered = (line) => (requests.length > 1 ? `Question ${requestIndex + 1}: ${line}` : line);
+        const settled = settledOf(ask);
+        if (settled)
+            return [numbered(settledLine({ ...ask, settled })), "", prompt].join("\n");
+        const lines = [numbered(prompt)];
         if (request.options?.length) {
             lines.push("", ...request.options.map((option, optionIndex) => {
                 const description = option.description ? ` — ${option.description}` : "";
                 return `${optionIndex + 1}. ${option.label} [${option.id}]${description}`;
             }));
         }
+        const who = only && person?.name ? `${person.name}, reply` : "Reply";
         if (request.allowFreeform === true || !request.options?.length) {
-            lines.push("", "Reply to this message with an option number, option ID, exact label, or your own answer.");
+            lines.push("", `${who} to this message with an option number, option ID, exact label, or your own answer.`);
         }
         else {
-            lines.push("", "Reply to this message with an option number, option ID, or exact label.");
+            lines.push("", `${who} to this message with an option number, option ID, or exact label.`);
         }
         return lines.join("\n");
     }).join("\n\n");
+    if (!options.carry)
+        return text;
+    const hidden = asks
+        .map((ask) => {
+        const settled = settledOf(ask);
+        return settled ? hiddenSettled({ ...ask, settled }) : hiddenAsk(ask);
+    })
+        .filter((h) => h !== null);
+    return hidden.length ? `${text}\n\n${hidden.join("\n")}` : text;
+}
+/** What someone other than the asker hears when they try to answer. */
+export function notTheAskerReply(asker) {
+    return `Only ${asker.name ?? "the person who asked"} can answer this one. I can take something new once it's answered.`;
+}
+/** Whether `pubkey`, resolved to `userId`, is the person a question is for. */
+export function isAsker(asker, pubkey, userId) {
+    return asker.key === pubkey || Boolean(asker.userId && userId && asker.userId === userId);
+}
+/** How each response settles its request, said by `by`. */
+export function settlementsFor(responses, requests, by, at = Date.now()) {
+    const open = new Map(requests.map((request) => [request.requestId, request]));
+    const out = new Map();
+    for (const response of responses) {
+        const request = open.get(response.requestId);
+        if (!request)
+            continue;
+        const answer = {
+            ...(response.optionId !== undefined ? { optionId: response.optionId } : {}),
+            ...(response.text !== undefined ? { text: response.text } : {}),
+        };
+        out.set(response.requestId, settleWith(askFrom(request), answer, by, at));
+    }
+    return out;
+}
+/**
+ * Prompts with `settlements` applied: each one that changed, with the text it
+ * is edited to, and the prompts still waiting on something afterwards.
+ */
+export function applySettlements(prompts, settlements, options) {
+    const edits = [];
+    const open = [];
+    for (const prompt of prompts) {
+        const fresh = prompt.requests.filter((request) => settlements.has(request.requestId) && !prompt.settled?.[request.requestId]);
+        let next = prompt;
+        if (fresh.length) {
+            const settled = { ...prompt.settled };
+            for (const request of fresh)
+                settled[request.requestId] = settlements.get(request.requestId);
+            next = { ...prompt, settled };
+            edits.push({
+                eventId: prompt.eventId,
+                content: formatInputRequests(prompt.requests, { carry: options.carry, asker: prompt.asker, askerOnly: options.askerOnly, settled }),
+            });
+        }
+        if (next.requests.some((request) => !next.settled?.[request.requestId]))
+            open.push(next);
+    }
+    return { edits, open };
+}
+/** Every request in `prompts` that has not ended yet, settled the same way. */
+export function settleRemaining(prompts, settled) {
+    const out = new Map();
+    for (const prompt of prompts) {
+        for (const request of prompt.requests) {
+            if (!prompt.settled?.[request.requestId])
+                out.set(request.requestId, settled);
+        }
+    }
+    return out;
+}
+/**
+ * Answers a client pressed, checked against what is actually open.
+ *
+ * Each answer must name an open request. An option must be one of that
+ * request's own; words alone answer only a question that takes words. eve's
+ * strict schema checks the result before it is sent. `stale` is true when no
+ * answer named an open request, which is what a second press on a question
+ * someone already answered looks like.
+ */
+export function resolveCarriedAnswers(answers, requests) {
+    const open = new Map(requests.map((request) => [request.requestId, request]));
+    const picked = new Map();
+    let named = false;
+    for (const answer of answers) {
+        const request = open.get(answer.requestId);
+        if (!request)
+            continue;
+        named = true;
+        if (picked.has(request.requestId))
+            continue;
+        const ids = request.options?.map((option) => option.id) ?? [];
+        if (answer.optionId !== undefined) {
+            if (ids.length > 0 && !ids.includes(answer.optionId))
+                return { responses: null, stale: false };
+            picked.set(request.requestId, {
+                requestId: request.requestId,
+                optionId: answer.optionId,
+                ...(answer.text?.trim() ? { text: answer.text.trim() } : {}),
+            });
+            continue;
+        }
+        const words = answer.text?.trim();
+        if (!words || (ids.length > 0 && request.allowFreeform !== true))
+            return { responses: null, stale: false };
+        picked.set(request.requestId, { requestId: request.requestId, text: words });
+    }
+    if (picked.size === 0)
+        return { responses: null, stale: !named };
+    try {
+        return { responses: parseInputResponses([...picked.values()]), stale: false };
+    }
+    catch {
+        return { responses: null, stale: false };
+    }
 }
+/** What a press on a question nobody is waiting on any more gets. */
+export const STALE_ANSWER_REPLY = "That question was already answered, so nothing changed.";
 /** Resolve a Buzz text reply using Eve's certified matching semantics. */
 export function resolveInputReply(text, requests) {
     if (!text.trim())
@@ -38,10 +175,17 @@ export function resolveInputReply(text, requests) {
 export function invalidInputReply(requests) {
     return `I still need a valid answer before I can continue.\n\n${formatInputRequests(requests)}`;
 }
-/** Submit a matched reply without consuming its response stream. */
-export async function respondToPendingConversation(session, responses, community, channel) {
+/**
+ * Submit a matched reply without consuming its response stream.
+ *
+ * No `clientContext`: the turn already carries the channel from when it
+ * started, and eve 0.81 treats context on a respond as new turn input. It then
+ * runs one more model step after the agent's reply, with the agent's message
+ * last, which models that refuse prefill reject. The turn fails and the whole
+ * conversation ends, on an approve, a decline or an answer alike.
+ */
+export async function respondToPendingConversation(session, responses) {
     await session.respond(responses, {
-        clientContext: { buzzCommunity: community, buzzChannel: channel },
         streamReconnectPolicy: { reconnect: false },
     });
 }
@@ -73,6 +217,19 @@ export function resumeStalledReply(stallMs) {
         `${minutes === 1 ? "" : "s"} without producing anything, so I have stopped waiting on it. ` +
         `Nothing was posted and no work landed from it. This channel is clear — ask me again and I will start fresh.`);
 }
+/**
+ * What the room is told when the turn an answer resumed failed.
+ *
+ * @remarks
+ * Found live: a declined approval resumed the turn, the model refused the
+ * continuation, and the run ended. The follower saw the stream end and said
+ * nothing, so the person who pressed Decline got silence. They answered; the
+ * failure is the one thing they must hear about, in the stream's own words.
+ */
+export function resumeFailedReply(failures) {
+    const said = silentTurnReply(failures);
+    return `Your answer reached me, but the work it restarted stopped. ${said}`;
+}
 /** A session needs its follower while asking or while resumed output is unpublished. */
 export function needsPendingFollower(session) {
     return Boolean(session.pendingInputRequests?.length || session.resumeInFlight);
@@ -106,6 +263,16 @@ export async function followPendingConversation(session, initial, callbacks, sig
     let streamIndex = initial.streamIndex;
     let completedMessage = "";
     let steps = newStepState();
+    /** Failures since the last answer. A declined call is the person's choice, not one. */
+    let failures = [];
+    /** Tell the room, then stop supervising: a failed run will not come back. */
+    const failThenClear = async () => {
+        // Only an answered question resumed this work; a run failing while it waits on a person stays quiet as before.
+        if (state.resumeInFlight)
+            await callbacks.onFailed?.(failures);
+        state = withoutSupervision(state);
+        await persist();
+    };
     const persist = async () => {
         state = { ...state, streamIndex };
         await callbacks.onState(state);
@@ -133,10 +300,15 @@ export async function followPendingConversation(session, initial, callbacks, sig
         // the follower is still open.
         streamIndex += 1;
         readStep(steps, streamEvent.type, streamEvent.data);
+        const declined = streamEvent.type === "action.result" && streamEvent.data.status === "rejected";
+        const failure = declined ? null : failureFromEvent(streamEvent);
+        if (failure)
+            failures.push(failure);
         switch (streamEvent.type) {
             case "input.requested":
                 completedMessage = "";
                 steps = newStepState();
+                failures = [];
                 state = withPending(state, streamEvent.data.requests);
                 // Keep the durable cursor before the prompt until Buzz accepts it for
                 // relay delivery; a reconnect can then replay and render the request.
@@ -169,9 +341,11 @@ export async function followPendingConversation(session, initial, callbacks, sig
                 }
                 await persist();
                 break;
-            case "turn.cancelled":
             case "turn.failed":
             case "session.failed":
+                await failThenClear();
+                return;
+            case "turn.cancelled":
             case "session.completed":
                 state = withoutSupervision(state);
                 await persist();
@@ -183,5 +357,16 @@ export async function followPendingConversation(session, initial, callbacks, sig
                 break;
         }
     }
+    /**
+     * The stream closed without a boundary. Usually a dropped connection, and
+     * the caller reattaches. But after an answer, a model failure followed by
+     * the end of the stream is the run ending: reattaching finds nothing new,
+     * and the room would be told only after the work ceiling, an hour later.
+     */
+    if (state.resumeInFlight && failures.some((f) => f.kind === "model")) {
+        callbacks.onLog?.("resumed turn failed and its stream ended; telling the room");
+        await failThenClear();
+        return;
+    }
     callbacks.onLog?.("pending Eve stream ended before a resumable boundary");
 }

package/dist/relay.d.ts

@@ -15,6 +15,8 @@ import type { AgentKey } from "./keys.js";
 export declare const KIND_MESSAGE = 9;
 /** NIP-25 reaction. */
 export declare const KIND_REACTION = 7;
+/** A replacement edit of a message, by its author only (the relay enforces it). */
+export declare const KIND_EDIT = 40003;
 /** NIP-42 relay authentication. */
 export declare const KIND_AUTH = 22242;
 /** NIP-98 HTTP authentication. */
@@ -37,6 +39,9 @@ export declare const TYPING_INTERVAL_MS = 3000;
 export declare const PRESENCE_INTERVAL_MS = 60000;
 /** Enough overlap for same-second redelivery without retaining every event forever. */
 export declare const MAX_SEEN_EVENT_IDS = 10000;
+/** At most this many messages wait for a reconnect, and none older than this goes out late. */
+export declare const MAX_OUTBOX = 100;
+export declare const OUTBOX_MAX_AGE_MS: number;
 /** How often to re-read which direct conversations this agent is in. */
 export declare const DIRECT_REFRESH_MS = 30000;
 export type NostrEvent = {
@@ -69,6 +74,14 @@ export declare class BuzzRelay {
     private refusal;
     /** Answered already, so a redelivery in two overlapping polls is not answered twice. */
     private readonly seen;
+    /**
+     * Messages and reactions signed while the connection was down or not yet signed in.
+     *
+     * The relay drops in and out every few minutes. A question posted in one of those gaps
+     * used to vanish: the person never saw it, and their next message was taken as a wrong
+     * answer to it. They go out, in order, as soon as the connection is signed in again.
+     */
+    private readonly outbox;
     private cursor;
     /** Prompts this agent posted; replies to them are polled for even when they carry no mention. */
     private readonly replyWatch;
@@ -134,12 +147,16 @@ export declare class BuzzRelay {
     private discoveryDone;
     /** Take the DMs just found; read back any that are new, from when they could last have been missed. */
     private adopt;
-    /** Publish one event; returns its id when it left this process, null when the socket was down. */
+    /**
+     * Publish one event; returns its id when it left this process or waits in the outbox, null
+     * when it was dropped. Presence and typing are dropped while offline: late, they are wrong.
+     */
     publish(event: {
         kind: number;
         tags: string[][];
         content: string;
     }): string | null;
+    private flushOutbox;
     setPresence(status: PresenceStatus): void;
     private keepPresent;
     /** Say "typing" in a channel until the returned function is called. */
@@ -148,6 +165,13 @@ export declare class BuzzRelay {
     reply(channel: string, text: string, replyTo?: NostrEvent, options?: {
         mention?: boolean;
     }): string | null;
+    /**
+     * Replace the words of a message this agent posted. Every client shows the
+     * latest edit by the author, and only the author's edits count, so nobody
+     * else can make a message of the agent's say something else. No mention
+     * tag: an edit is not news, so nobody is notified again.
+     */
+    edit(channel: string, eventId: string, text: string): string | null;
     /** Sign one HTTP request as this agent (NIP-98), binding the signature to the body. */
     private httpAuth;
     private submit;

package/dist/relay.js

@@ -16,6 +16,8 @@ import { finalizeEvent } from "nostr-tools/pure";
 export const KIND_MESSAGE = 9;
 /** NIP-25 reaction. */
 export const KIND_REACTION = 7;
+/** A replacement edit of a message, by its author only (the relay enforces it). */
+export const KIND_EDIT = 40003;
 /** NIP-42 relay authentication. */
 export const KIND_AUTH = 22242;
 /** NIP-98 HTTP authentication. */
@@ -38,6 +40,9 @@ export const TYPING_INTERVAL_MS = 3_000;
 export const PRESENCE_INTERVAL_MS = 60_000;
 /** Enough overlap for same-second redelivery without retaining every event forever. */
 export const MAX_SEEN_EVENT_IDS = 10_000;
+/** At most this many messages wait for a reconnect, and none older than this goes out late. */
+export const MAX_OUTBOX = 100;
+export const OUTBOX_MAX_AGE_MS = 15 * 60_000;
 /** How often to re-read which direct conversations this agent is in. */
 export const DIRECT_REFRESH_MS = 30_000;
 /** Ids per `#d`/`#h` filter, and filters per request: the relay caps a request at ten. */
@@ -68,6 +73,14 @@ export class BuzzRelay {
     refusal = null;
     /** Answered already, so a redelivery in two overlapping polls is not answered twice. */
     seen = new Set();
+    /**
+     * Messages and reactions signed while the connection was down or not yet signed in.
+     *
+     * The relay drops in and out every few minutes. A question posted in one of those gaps
+     * used to vanish: the person never saw it, and their next message was taken as a wrong
+     * answer to it. They go out, in order, as soon as the connection is signed in again.
+     */
+    outbox = [];
     cursor = now();
     /** Prompts this agent posted; replies to them are polled for even when they carry no mention. */
     replyWatch = new Set();
@@ -229,6 +242,7 @@ export class BuzzRelay {
             this.backoff = 5_000;
             this.refusal = null;
             this.log(`authenticated as ${this.key.publicKey.slice(0, 12)}…`);
+            this.flushOutbox();
             this.keepPresent();
             this.discoverDirect();
             this.poll();
@@ -404,10 +418,38 @@ export class BuzzRelay {
             this.send(["REQ", `m${Date.now()}c`, ...filters]);
         }
     }
-    /** Publish one event; returns its id when it left this process, null when the socket was down. */
+    /**
+     * Publish one event; returns its id when it left this process or waits in the outbox, null
+     * when it was dropped. Presence and typing are dropped while offline: late, they are wrong.
+     */
     publish(event) {
         const signed = finalizeEvent({ created_at: now(), ...event }, this.key.secretKey);
-        return this.send(["EVENT", signed]) ? signed.id : null;
+        if (this.authenticated && this.send(["EVENT", signed]))
+            return signed.id;
+        // Held only between connections of a running relay; one never started or closed sends nothing.
+        if (this.closed || !this.socket || ![KIND_MESSAGE, KIND_REACTION, KIND_EDIT].includes(event.kind))
+            return null;
+        if (this.outbox.length >= MAX_OUTBOX)
+            this.outbox.shift();
+        this.outbox.push({ event: signed, at: Date.now() });
+        return signed.id;
+    }
+    flushOutbox() {
+        const cutoff = Date.now() - OUTBOX_MAX_AGE_MS;
+        const stale = this.outbox.filter(({ at }) => at < cutoff).length;
+        if (stale)
+            this.log(`dropped ${stale} message(s) held too long while disconnected`);
+        const due = this.outbox.splice(0).filter(({ at }) => at >= cutoff);
+        let sent = 0;
+        for (const held of due) {
+            if (!this.send(["EVENT", held.event]))
+                break;
+            sent += 1;
+        }
+        // The connection dropped again mid-flush: the rest wait for the next sign-in, in order.
+        this.outbox.unshift(...due.slice(sent));
+        if (sent)
+            this.log(`sent ${sent} message(s) held while disconnected`);
     }
     setPresence(status) {
         this.publish({ kind: KIND_PRESENCE, tags: [], content: status });
@@ -435,6 +477,15 @@ export class BuzzRelay {
         }
         return this.publish({ kind: KIND_MESSAGE, tags, content: text });
     }
+    /**
+     * Replace the words of a message this agent posted. Every client shows the
+     * latest edit by the author, and only the author's edits count, so nobody
+     * else can make a message of the agent's say something else. No mention
+     * tag: an edit is not news, so nobody is notified again.
+     */
+    edit(channel, eventId, text) {
+        return this.publish({ kind: KIND_EDIT, tags: [["h", channel], ["e", eventId]], content: text });
+    }
     /** Sign one HTTP request as this agent (NIP-98), binding the signature to the body. */
     httpAuth(url, body) {
         const auth = finalizeEvent({

package/dist/sessions.d.ts

@@ -1,4 +1,20 @@
+import type { AskSettled } from "@kybernesis/cards";
 import type { InputRequest } from "eve/client";
+/** The person whose message raised a question: their chat key, account and name. */
+export interface StoredAsker {
+    key: string;
+    /** Their control-plane account, so another device of theirs counts as them. */
+    userId?: string;
+    name?: string;
+}
+/** A question the bridge posted, kept until every request in it has settled, so it can be rewritten. */
+export interface StoredPrompt {
+    eventId: string;
+    requests: readonly InputRequest[];
+    asker?: StoredAsker;
+    /** Requests that have ended, by request id. */
+    settled?: Readonly<Record<string, AskSettled>>;
+}
 /** One conversation: which eve session it is, and how far the bridge has read. */
 export interface StoredSession {
     id: string;
@@ -14,6 +30,10 @@ export interface StoredSession {
      * counts as an answer whether or not it mentions this agent.
      */
     promptEventIds?: readonly string[];
+    /** Who the open questions are for. Absent on conversations from before 0.15: anyone may answer those. */
+    asker?: StoredAsker;
+    /** The posted questions not yet fully settled, so the bridge can rewrite each one when it ends. */
+    prompts?: readonly StoredPrompt[];
     /** When it was last used, so a store that runs for years does not grow forever. */
     updated: number;
 }

package/dist/turn.d.ts

@@ -98,9 +98,10 @@ export declare const DEFAULT_UNREAD_DRAIN_TIMEOUT_MS = 20000;
 export declare function answerTurn(client: Client, sessions: SessionStore, channel: string, message: TurnMessage, community: string, log?: (message: string) => void, agentSilenceTimeoutMs?: number, agentWorkTimeoutMs?: number, unreadDrainTimeoutMs?: number): Promise<TurnOutcome>;
 /** What the room is told when eve refuses the turn itself. */
 /**
- * The two answers from eve that mean the stored session cannot carry another
- * turn: an unknown session id (404), and a session that ended (409 with
- * `session_not_active`, "The session is no longer active."). A session ends
+ * The answers from eve that mean the stored session cannot carry another
+ * turn: an unknown session id (404), a session that ended (409 with
+ * `session_not_active`, "The session is no longer active."), and one whose
+ * history expired (410 `session_expired`). A session ends
  * when one of its turns fails hard, for instance a model call that 404s at
  * the gateway; the channel must then start a fresh one.
  *

package/dist/turn.js

@@ -430,9 +430,10 @@ export async function answerTurn(client, sessions, channel, message, community,
 }
 /** What the room is told when eve refuses the turn itself. */
 /**
- * The two answers from eve that mean the stored session cannot carry another
- * turn: an unknown session id (404), and a session that ended (409 with
- * `session_not_active`, "The session is no longer active."). A session ends
+ * The answers from eve that mean the stored session cannot carry another
+ * turn: an unknown session id (404), a session that ended (409 with
+ * `session_not_active`, "The session is no longer active."), and one whose
+ * history expired (410 `session_expired`). A session ends
  * when one of its turns fails hard, for instance a model call that 404s at
  * the gateway; the channel must then start a fresh one.
  *
@@ -446,7 +447,10 @@ export async function answerTurn(client, sessions, channel, message, community,
 export function isSessionGone(error) {
     if (!(error instanceof ClientError))
         return false;
-    if (error.status === 404)
+    // 410 session_expired, "Session history is no longer available.": a run that
+    // ended (a failed turn ends the session) can no longer be read. Seen on
+    // 2026-10-24 when the next message in a channel failed instead of starting over.
+    if (error.status === 404 || error.status === 410)
         return true;
     return (error.status === 409 &&
         (error.code === "session_not_active" || /no longer active/i.test(String(error.message ?? ""))));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/buzz",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Put an eve agent in a Buzz workspace as a member: per-speaker verified identity resolved through the control plane, self-service identity linking, presence, typing and seen signals.",
   "license": "Apache-2.0",
   "type": "module",
@@ -44,7 +44,7 @@
     "test": "node --test \"test/**/*.test.mjs\""
   },
   "dependencies": {
-    "@kybernesis/cards": "^0.4.0",
+    "@kybernesis/cards": "^0.6.0",
     "@kybernesis/enterprise": "^0.10.0",
     "nostr-tools": "^2.10.0",
     "zod": "^4"