@milpa/comal 0.1.6 → 0.2.0

package/src/scope-ceiling.mjs

@@ -0,0 +1,56 @@
+import {digest,immutable} from './operations.mjs';
+export const SCOPE_MECHANISM='comal-house-scope-v1';
+export const scopeFailure=(message,code='HOUSE_SCOPE_UNAVAILABLE')=>Object.assign(new Error(message),{code});
+const id=value=>typeof value==='string'&&/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/.test(value);
+export function guardIdentity(name,binding,token){
+ if(!id(name))throw scopeFailure('The guard needs a bounded host identity.','HOUSE_SCOPE_INVALID');
+ if(binding===undefined)return immutable({id:name,instance_token:token});
+ if(!id(binding?.revision)||binding.configuration_digest!=null&&!/^[a-f0-9]{64}$/.test(binding.configuration_digest))throw scopeFailure('The host guard implementation/configuration identity is invalid.','HOUSE_SCOPE_INVALID');
+ return immutable({id:name,revision:binding.revision,configuration_digest:binding.configuration_digest??null});
+}
+export function mechanismIdentity(name,binding){
+ if(!id(name)||!id(binding?.revision)||typeof binding.check!=='function'||!Array.isArray(binding.operations)||binding.operations.some(name=>name!=='*'&&!id(name))||binding.configuration_digest!=null&&!/^[a-f0-9]{64}$/.test(binding.configuration_digest))throw scopeFailure('The host mechanism identity is invalid.','HOUSE_SCOPE_INVALID');
+ return immutable({id:name,revision:binding.revision,operations:[...binding.operations],configuration_digest:binding.configuration_digest??null});
+}
+export function scopeCeiling(body){return immutable({...body,digest:digest(body)});}
+export function validateScopeCeiling(value,parent){
+ if(!value||typeof value!=='object')throw scopeFailure('The original scope ceiling is missing.','HOUSE_SCOPE_INVALID');
+ const{digest:stamp,...body}=value;
+ try{
+  if(body.schema!=='comal-scope-ceiling/1'||digest(body)!==stamp||!body.parent||typeof body.parent.house!=='string'||typeof body.parent.session_id!=='string'||digest(body.parent)!==digest(parent)||!Array.isArray(body.laws)||body.laws.length>64||!Array.isArray(body.guards)||body.guards.length>128||Buffer.byteLength(JSON.stringify(value))>1024*1024||Object.keys(body).some(key=>!['schema','parent','laws','guards'].includes(key)))throw Error();
+  for(const source of body.laws){
+   if(!source||typeof source.house!=='string'||typeof source.session_id!=='string'||typeof source.activation_id!=='string'||!/^[a-f0-9]{64}$/.test(source.mechanism_stamp||'')||!Array.isArray(source.mechanisms))throw Error();
+   const{plan_hash,...core}=source.plan||{};if(core.schema!=='comal-governance/v1'||digest(core)!==plan_hash||!Array.isArray(core.gates)||!Array.isArray(core.decisions))throw Error();
+   for(const entry of source.mechanisms){const identity=entry?.identity;if(!id(entry?.gate_id)||!id(identity?.id)||!id(identity?.revision)||!Array.isArray(identity.operations)||identity.operations.some(op=>op!=='*'&&!id(op)))throw Error();}
+  }
+  for(const guard of body.guards)if(!id(guard?.id)||!(id(guard.revision)&&guard.instance_token===undefined||guard.revision===undefined&&/^[a-f0-9-]{36}$/.test(guard.instance_token||'')))throw Error();
+ }catch{throw scopeFailure('The original scope ceiling or parent binding does not verify.','HOUSE_SCOPE_INVALID');}
+ return immutable(structuredClone(value));
+}
+
+// Local semantic audit of a recorded scope; never re-runs a guard or mechanism.
+export function auditScopeAuthority(rows,{cwd,id:sessionId}={}){
+ const violations=[],starts=new Map(),fault=(row,reason)=>violations.push({invocation_id:row.invocation_id,operation:row.operation,reason}),births=rows.filter(row=>row.type==='house_scope_bound');let birth,revoked=false,activeLaw;
+ for(const row of rows){
+  if(row.type==='house_scope_bound'){
+   if(birth)fault(row,'scope_birth_duplicated');
+   try{validateScopeCeiling(row.ceiling,{house:row.parent_house,session_id:row.parent_session_id});if(row.source!=='scope_host'||row.mechanism!==SCOPE_MECHANISM||row.ceiling_digest!==row.ceiling.digest||row.house!==cwd||row.session_id!==sessionId||!row.actor?.id||!['agent','subagent','human'].includes(row.actor.kind)||!/^[a-f0-9-]{36}$/.test(row.scope_id||''))throw Error();birth=row;}catch{fault(row,'scope_birth_invalid');}
+  }
+  if(row.type==='house_scope_revoked'){
+   if(row.source!=='scope_host'||row.mechanism!==SCOPE_MECHANISM||row.house!==cwd||row.session_id!==sessionId||birth&&row.scope_id!==birth.scope_id)fault(row,'scope_revocation_invalid');else revoked=true;
+  }
+  if(!birth)continue;
+  if(['house_proposal','house_started','house_receipt'].includes(row.type)&&digest(row.actor??null)!==digest(birth.actor))fault(row,'scope_actor_binding_mismatch');
+  if(row.type==='house_started')starts.set(row.invocation_id,{revoked,missingLaw:birth.ceiling.laws.length&&(!activeLaw||row.governance_plan_hash!==activeLaw.plan.plan_hash||row.mechanism_stamp!==activeLaw.mechanism_stamp||row.governance_activation_id!==activeLaw.activation_id)});
+  if(row.type==='house_receipt'&&['returned','failed'].includes(row.status)){const start=starts.get(row.invocation_id);if(start?.revoked)fault(row,'scope_dispatch_after_revocation');if(start?.missingLaw)fault(row,'scope_dispatch_without_original_law');}
+  if(row.type==='governance_activated')activeLaw=row.inherited_from?row:null;
+  if(row.type==='governance_activated'&&row.inherited_from){
+   try{if(!Array.isArray(row.inherited_from))throw Error();for(const source of birth.ceiling.laws){
+    const ref={house:source.house,session_id:source.session_id,plan_hash:source.plan.plan_hash,mechanism_stamp:source.mechanism_stamp,activation_id:source.activation_id},index=row.inherited_from.findIndex(value=>digest(value)===digest(ref));
+    if(index<0){fault(row,'scope_original_law_omitted');continue;}const prefix='scope'+index+':',scope=name=>prefix+(prefix.length+name.length>128?digest(name):name);
+    for(const gate of source.plan.gates){const actual=row.plan?.gates?.find(value=>value.id===scope(gate.id));if(!actual||actual.tier!==gate.tier||digest(actual.operations)!==digest(gate.operations)||actual.decision_id!==scope(gate.decision_id))fault(row,'scope_original_gate_changed');}
+   }}catch{fault(row,'scope_original_law_invalid');}
+  }
+ }
+ return{scope:'recorded_scope_identity_and_revocation',births:births.length,revoked,consistent:!violations.length,violations,executable_attestation:false};
+}

package/src/scoped-policy.mjs

@@ -0,0 +1,39 @@
+import {PermissionPolicy,BYPASS_PERMISSION_MODE,PERMISSION_MODES} from './permissions.mjs';
+import {digest,immutable} from './operations.mjs';
+
+const fail=message=>Object.assign(new Error(message),{code:'SCOPED_POLICY_INVALID'});
+const modes=new Set([...PERMISSION_MODES,BYPASS_PERMISSION_MODE]);
+export function capturePolicyCeiling(parent,intentions=parent.context?.intentions||[]){
+ return immutable({mode:parent.mode,allowed:[...parent.allowed],denied:[...parent.denied],intention_digest:digest(intentions)});
+}
+// Restoring a saved ceiling never restores startup bypass or grants from a child
+// prompt. Actual source root and local recorder belong to the scoped runtime.
+export function scopedPolicy({parent,ceiling=capturePolicyCeiling(parent),cwd,intentions=parent.context?.intentions||[],actions=[],readOnly=false,onDecision=()=>{}}){
+ if(!parent?.authorize||typeof cwd!=='string'||!modes.has(ceiling?.mode)||!['allowed','denied'].every(key=>Array.isArray(ceiling[key])&&ceiling[key].every(name=>typeof name==='string'))||ceiling.intention_digest&&ceiling.intention_digest!==digest(intentions))throw fail('The original policy ceiling or trusted human context does not verify.');
+ const original=immutable(structuredClone(ceiling)),trusted=immutable(structuredClone(intentions)),initialActions=immutable(structuredClone(actions));
+ const mode=()=>{
+  if(readOnly)return 'plan';const current=parent.mode,prior=original.mode;if(!modes.has(current))throw fail('The current parent mode is unavailable.');
+  if(prior===BYPASS_PERMISSION_MODE)return current===BYPASS_PERMISSION_MODE&&!parent.dangerouslySkipPermissions?'default':current;
+  if(current===BYPASS_PERMISSION_MODE)return prior;
+  return prior==='plan'||current==='plan'?'plan':prior==='default'||current==='default'?'default':prior==='auto'||current==='auto'?'auto':'acceptEdits';
+ };
+ const initial=mode(),policy=new PermissionPolicy({mode:initial,dangerouslySkipPermissions:initial===BYPASS_PERMISSION_MODE,allowed:original.allowed,denied:original.denied,cwd,onDecision});
+ Object.defineProperties(policy,{
+  mode:{get:mode},allowed:{get:()=>new Set(original.allowed.filter(name=>parent.allowed.has(name)))},denied:{get:()=>new Set([...original.denied,...parent.denied])},
+  classifier:{get:()=>parent.classifier},confirm:{get:()=>parent.confirm},rules:{get:()=>parent.rules},contractOf:{get:()=>parent.contractOf},ceiling:{value:original},
+ });
+ policy.setContext=context=>PermissionPolicy.prototype.setContext.call(policy,{intentions:structuredClone(trusted),actions:[...initialActions,...(context?.actions||[])].slice(-20)});
+ policy.setContext({actions:[]});return policy;
+}
+
+// A chain must retain each trusted human context as well as intersecting rule
+// sets/modes. Merely nesting scopedPolicy objects selects the newest context
+// for the classifier; a later broader request could then replace the old one.
+export function scopedPolicyStack({parent,bindings,cwd,onDecision=()=>{}}){
+ if(!Array.isArray(bindings)||!bindings.length)throw fail('A policy stack requires original native bindings.');
+ const scope=(parent,b)=>scopedPolicy({parent,ceiling:b.authority,cwd,intentions:b.inherited.intentions,actions:b.inherited.actions,onDecision});
+ const combined=bindings.reduce(scope,parent),unique=[...new Map(bindings.map(b=>[digest({authority:b.authority,inherited:b.inherited}),b])).values()],checks=unique.map(b=>scope(combined,b));
+ const setContext=combined.setContext.bind(combined);combined.setContext=context=>{setContext(context);for(const policy of checks)policy.setContext(context);};
+ combined.authorize=async(name,input,options)=>{let result;for(const policy of checks){result=await policy.authorize(name,input,options);if(!result.allowed)return result;}return result;};
+ return combined;
+}

package/src/secret-login.mjs

@@ -0,0 +1,68 @@
+import { t, registerMessages } from './i18n/index.mjs';
+import { authProviderDefinition, acceptsSecretLogin } from './provider-auth.mjs';
+
+registerMessages({
+  'API key for {provider}': 'Llave de API de {provider}',
+  'Subscription key for {provider}': 'Llave de suscripción de {provider}',
+  'Hidden field: nothing you type is shown, saved in history or sent to the model. Comal stores it only in its private credential store ({directory}). Esc cancels.': 'Campo oculto: lo que escribas no se muestra, no entra al historial ni se envía al modelo. Comal la guarda sólo en su almacén privado de credenciales ({directory}). Esc cancela.',
+  'Type or paste the key.': 'Escribe o pega la llave.',
+  'Login cancelled. No key was stored.': 'Login cancelado. No se guardó ninguna llave.',
+  'Use /login PROVIDER [--key | --api-key-env VARIABLE]. Never paste keys into the composer.': 'Usa /login PROVEEDOR [--key | --api-key-env VARIABLE]. Nunca pegues llaves en el compositor.',
+  '{provider} only supports browser sign-in.': '{provider} sólo admite inicio de sesión en el navegador.',
+  'The hidden key field needs the interactive terminal; use --api-key-env VARIABLE here.': 'El campo oculto de la llave necesita la terminal interactiva; aquí usa --api-key-env VARIABLE.',
+});
+
+const VARIABLE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+/** Argumentos de /login después del proveedor. Sólo nombres, nunca valores. */
+export function parseLoginArguments(parts) {
+  if (!parts.length) return {};
+  if (parts.length === 1 && parts[0] === '--key') return { hidden: true };
+  if (parts.length === 2 && parts[0] === '--api-key-env' && VARIABLE.test(parts[1])) return { apiKeyEnv: parts[1] };
+  throw new Error(t('Use /login PROVIDER [--key | --api-key-env VARIABLE]. Never paste keys into the composer.'));
+}
+
+/**
+ * Quita las cabeceras de credencial que el adaptador ya puso con su copia de la
+ * llave. credentialFetch añade la vigente; si no, fetch une ambas en
+ * "Bearer X, Bearer X" y servidores estrictos (Ollama Cloud) responden 401.
+ */
+export function withoutCredentialHeaders(headers) {
+  const entries = headers instanceof Headers ? [...headers.entries()] : Array.isArray(headers) ? headers : Object.entries(headers || {});
+  return Object.fromEntries(entries.filter(([name]) => !['authorization', 'x-api-key'].includes(String(name).toLowerCase())));
+}
+
+const cancelled = () => Object.assign(new Error(t('Login cancelled. No key was stored.')), { name: 'AbortError', code: 'ABORT_ERR' });
+
+/** Pide la llave en el campo oculto de la TUI. Devuelve null si el humano cancela. */
+export async function promptSecret({ ui, provider, directory, signal }) {
+  const p = authProviderDefinition(provider);
+  const value = await ui.setupInput({
+    title: t(p.subscription ? 'Subscription key for {provider}' : 'API key for {provider}', { provider: p.label }),
+    description: t('Hidden field: nothing you type is shown, saved in history or sent to the model. Comal stores it only in its private credential store ({directory}). Esc cancels.', { directory: directory || '~/.config/comal/auth' }),
+    secret: true, signal,
+    // El campo oculto nunca muestra el mensaje del validador; sólo un aviso genérico.
+    validate: text => text.trim() ? true : t('Type or paste the key.'),
+  });
+  return typeof value === 'string' ? value.trim() : null;
+}
+
+/**
+ * Login de proveedor con tres entradas posibles para la llave:
+ * --api-key-env VAR (variable de entorno), la variable por omisión del proveedor
+ * si existe, o el campo oculto de la TUI (siempre con --key). La llave sólo pasa
+ * de la TUI al almacén de credenciales: no vuelve en el resultado, no entra en
+ * entradas de operaciones del libro y nunca se copia a process.env.
+ */
+export async function loginProvider({ authManager, ui, provider, apiKeyEnv, hidden = false, signal, onEvent, env = authManager.env || process.env }) {
+  const p = authProviderDefinition(provider);
+  if (hidden && !acceptsSecretLogin(p.id)) throw new Error(t('{provider} only supports browser sign-in.', { provider: p.label }));
+  const secretCapable = acceptsSecretLogin(p.id) && p.method !== 'device_code';
+  const useEnvironment = apiKeyEnv || !hidden && (!secretCapable || !ui || (p.apiKeyEnv && env[p.apiKeyEnv]));
+  if (useEnvironment) return authManager.login(p.id, { apiKeyEnv, signal, onEvent });
+  if (!ui) throw new Error(t('The hidden key field needs the interactive terminal; use --api-key-env VARIABLE here.'));
+  let secret = await promptSecret({ ui, provider: p.id, directory: authManager.directory, signal });
+  if (!secret) throw cancelled();
+  try { return await authManager.login(p.id, { secret, signal }); }
+  finally { secret = null; }
+}

package/src/session-bus.mjs

@@ -1,5 +1,6 @@
 import net from 'node:net';
 import { peerMessagePurpose, peerMessageHeader } from './peer-message-context.mjs';
+import { admitNotice, noticeCounts, noticeMailbox, noticeMessage, NOTICE_LIMITS } from './plugin-notices.mjs';
 import path from 'node:path';
 import os from 'node:os';
 import { constants } from 'node:fs';
@@ -23,7 +24,7 @@ function authority(value = {}, cwd) {
   const normalize = input => {
     if (!input || typeof input !== 'object' || Array.isArray(input)) return invalid();
     const mode = input.mode === undefined ? 'plan' : input.mode;
-    if (!['default', 'acceptEdits', 'plan', 'auto'].includes(mode)) return invalid();
+    if (!['default', 'acceptEdits', 'plan', 'auto', 'bypassPermissions'].includes(mode)) return invalid();
     const list = key => {
       const items = input[key] === undefined ? [] : input[key];
       if (!Array.isArray(items) || items.length > 128 || items.some(item => typeof item !== 'string' || !item.length || item.length > 200)) return invalid();
@@ -311,18 +312,49 @@ export class SessionBus {
     return result;
   }
   async pending() {
-    if (!this.availability.available) return { count: 0, held: 0, total: 0, ...this.availability };
+    // Los avisos de plugins no dependen del transporte entre sesiones: viven en el libro.
+    let notices = null;
+    const sessionId = this.getSessionId();
+    if (UUID.test(sessionId || '')) { const counts = noticeCounts((await this.store.load(sessionId)).rows, this.inbound); if (counts.total) notices = counts; }
+    const extra = notices ? { notices } : {}, urgent = notices?.urgent || 0;
+    if (!this.availability.available) return { count: urgent, held: notices?.held || 0, total: notices?.total || 0, ...extra, ...this.availability };
     const id = this.getSessionId(); this._paths(id); const state = mailbox((await this.store.load(id)).rows);
     const held = state.live.filter(item => item.held && !state.released.has(item.message_id)).length;
-    return { count: this.inbound==='accept' ? state.live.length - held : 0, held, total: state.live.length };
+    return { count: (this.inbound==='accept' ? state.live.length - held : 0) + urgent, held: held + (notices?.held || 0), total: state.live.length + (notices?.total || 0), ...extra };
+  }
+  /** Encola un aviso de plugin ya normalizado (plugin-notices.mjs). Nunca es intención humana. */
+  async notify(normalized) {
+    const id = this.getSessionId();
+    if (!UUID.test(id || '')) return { status: 'no_session' };
+    const result = await this.store.workTransaction(id, async () => {
+      const admitted = admitNotice((await this.store.load(id)).rows, normalized, { inbound: this.inbound });
+      if (admitted.notice) await this.store.append(id, { type: 'plugin_notice_received', source: 'plugin_host', notice: admitted.notice, grants_permission: false });
+      return admitted;
+    });
+    if (result.status === 'accepted' && result.notice.urgent) this._signal();
+    this._event({ type: 'plugin_notice_admitted', plugin: normalized.plugin, ref: normalized.ref, status: result.status });
+    return { status: result.status, ...(result.notice_id ? { notice_id: result.notice_id } : {}) };
+  }
+  async _drainNotices(id) {
+    if (this.inbound !== 'accept') return [];
+    const state = noticeMailbox((await this.store.load(id)).rows), result = [];
+    // Urgentes primero; el resto espera al siguiente turno si excede el tope por entrega.
+    for (const notice of [...state.ready].sort((a, b) => Number(b.urgent) - Number(a.urgent)).slice(0, NOTICE_LIMITS.perDrain)) {
+      const message = noticeMessage(notice);
+      const row = await this.store.append(id, { type: 'message', source: 'plugin_notice', notice_id: notice.notice_id, notice, message });
+      result.push({ kind: 'plugin_notice', id: notice.notice_id, notice, message, row });
+    }
+    return result;
   }
   async drain() {
-    if (!this.availability.available) return [];
+    const sessionId = this.getSessionId();
+    const notices = UUID.test(sessionId || '') && this.inbound === 'accept' ? await this.store.workTransaction(sessionId, () => this._drainNotices(sessionId)) : [];
+    if (!this.availability.available) return notices;
     const id = this.getSessionId(); this._paths(id);
-    if (this.inbound !== 'accept') return [];
+    if (this.inbound !== 'accept') return notices;
     return this.store.workTransaction(id, async () => {
-      if(this.inbound!=='accept')return [];
-      const session = await this.store.load(id), state = mailbox(session.rows), result = [];
+      if(this.inbound!=='accept')return notices;
+      const session = await this.store.load(id), state = mailbox(session.rows), result = [...notices];
       for (const peer of state.live) {
         if (peer.held && !state.released.has(peer.message_id)) continue;
         const purpose = peerMessagePurpose(peer), header = peerMessageHeader(peer);
@@ -339,6 +371,8 @@ export class SessionBus {
     const count = await this.store.workTransaction(sessionId, async () => {
       const state = mailbox((await this.store.load(sessionId)).rows); let released = 0;
       for (const peer of state.live) if (peer.held && !state.released.has(peer.message_id) && (id === 'all' || id === peer.message_id)) { await this.store.append(sessionId, { type: 'peer_message_released', message_id: peer.message_id }); released++; }
+      const notices = noticeMailbox((await this.store.load(sessionId)).rows);
+      for (const notice of notices.live) if (notice.held && !notices.released.has(notice.notice_id) && (id === 'all' || id === notice.notice_id)) { await this.store.append(sessionId, { type: 'plugin_notice_released', notice_id: notice.notice_id }); released++; }
       return released;
     });
     if (count && this.inbound === 'accept') this._signal(); return { released: count };

package/src/session-projections-candidate.mjs

@@ -0,0 +1,119 @@
+// Prospective host-only reader. Not imported by SessionStore, CLI or a workflow.
+// A projection is data, not execution/audit/permission authority.
+import {readFile} from 'node:fs/promises';
+import {performance} from 'node:perf_hooks';
+
+const jsonBytes=value=>Buffer.byteLength(JSON.stringify(value));
+const validHash=value=>typeof value==='string'&&/^[a-f0-9]{64}$/.test(value);
+const defaultState=()=>({stage:'new',status:'ready'});
+// Preserve the original SessionStore fold operations and their JS exceptions.
+// Only its private accumulated fold is reused; callers never receive it. A
+// string messages.slice() can succeed, then messages.push() can fail, or reset
+// can restore an array. No new schema is imposed on these records.
+function foldCompatibility(rows,header,prior){
+  let messages=prior?(Array.isArray(prior.messages)?prior.messages.slice():prior.messages):[];
+  const historyMessages=prior?prior.historyMessages.slice():[];
+  let metadata=prior?prior.metadata:header,goal=prior?.goal,queue=prior?.queue,draft=prior?prior.draft:'',draftAttachments=prior?prior.draftAttachments:[],compaction=prior?.compaction,projection=prior?.projection;
+  for (const row of rows) {
+    if (row.type === 'reset') { messages = []; historyMessages.length = 0; compaction = undefined; projection = undefined; }
+    if (row.type === 'compaction') { messages = row.messages.slice(); compaction = row; }
+    if (row.type === 'context_projection') { messages = row.messages.slice(); projection = row; compaction = row; }
+    if (row.type === 'context_rebase') { messages = row.messages.slice(); projection = undefined; compaction = undefined; }
+    if (row.type === 'message') { messages.push(row.message); historyMessages.push(row.message); }
+    if (row.type === 'model') metadata = { ...metadata, model: row.model };
+    if (row.type === 'provider') metadata = { ...metadata, provider: row.provider, model: row.model, ...(row.profile !== undefined ? {provider_profile:row.profile} : {}),...(row.connection ? {provider_connection:row.connection} : {}) };
+    if (row.type === 'goal') goal = row.goal;
+    if (row.type === 'queue') queue = row.snapshot;
+    if (row.type === 'draft') { draft = row.text; draftAttachments = row.attachments || []; }
+    if (row.type === 'name') metadata = { ...metadata, name: row.name };
+    if (row.type === 'parent') metadata = { ...metadata, parent_session_id: row.parent_session_id, subagent_type: row.subagent_type, name: row.description };
+  }
+  return{messages,historyMessages,metadata,goal,queue,draft,draftAttachments,compaction,projection};
+}
+export function createSessionProjectionReader({store,JournalCache,auditJournal,assertClassifierChannels,maxCachedBytes=16*1024*1024,maxIndexBytes=1024*1024,maxTasks=8,maxReceipts=64}={}) {
+  if(!store||typeof store.load!=='function'||typeof store.file!=='function'||!(store.writers instanceof Map)||typeof store.cwd!=='string'||typeof JournalCache!=='function'||typeof auditJournal!=='function'||typeof assertClassifierChannels!=='function')throw new TypeError('Explicit original host store and journal implementations required.');
+  for(const [name,value,limit] of [['maxCachedBytes',maxCachedBytes,64*1024*1024],['maxIndexBytes',maxIndexBytes,8*1024*1024],['maxTasks',maxTasks,64],['maxReceipts',maxReceipts,256]])if(!Number.isSafeInteger(value)||value<0||value>limit)throw new TypeError('Invalid bounded projection option: '+name);
+  let entry=null,journal=new JournalCache({maxBytes:maxCachedBytes}),pending=Promise.resolve();
+  const stats={reads:0,identical:0,extensions:0,full:0,fallbacks:0,failures:0,retained_buffer_bytes:0,retained_index_json_bytes:0,max_cached_buffer_bytes:2*maxCachedBytes,max_index_json_bytes:maxIndexBytes,max_tasks:maxTasks,max_receipts:maxReceipts,last:null};
+  // Native trim() admits blank lines at EOF, but appending after them makes
+  // them internal parser errors. Such bytes can cache equality, never a prefix.
+  const reusablePrefix=(bytes,records)=>{if(bytes.at(-1)!==10)return false;let n=0;for(let p=bytes.indexOf(10);p>=0;p=bytes.indexOf(10,p+1))n++;return n===records;};
+  const clear=()=>{entry=null;journal=new JournalCache({maxBytes:maxCachedBytes});stats.retained_buffer_bytes=0;stats.retained_index_json_bytes=0;};
+  const index=()=>({header:null,accepted:null,tasks:new Map(),receipts:new Map()});
+  const put=(map,key,value,cap)=>{if(map.has(key))map.delete(key);map.set(key,value);while(map.size>cap)map.delete(map.keys().next().value);};
+  function fold(view,rows,offset=0){
+    for(let i=0;i<rows.length;i++){
+      const row=rows[i],n=offset+i;if(!row)continue;
+      if(n===0)view.header=row;
+      if(row.type==='chrome_task_accepted'&&row.source==='workflow_host')view.accepted=row;
+      if(row.type==='chrome_task_checkpoint')put(view.tasks,row.task_digest,{row,n},maxTasks);
+      if(['house_proposal','house_started','house_receipt'].includes(row.type)&&typeof row.invocation_id==='string'){
+        const tuple=view.receipts.get(row.invocation_id)||{};
+        // A bounded recent index. Missing/evicted ancestors never become proof;
+        // explicit receipt queries fall back to the original complete reader.
+        tuple[row.type]={row,n};put(view.receipts,row.invocation_id,tuple,maxReceipts);
+      }
+    }
+    return view;
+  }
+  const size=(view,compatibility)=>jsonBytes({header:view.header,accepted:view.accepted,tasks:[...view.tasks],receipts:[...view.receipts],compatibility});
+  function identity(header,id){if(header?.type!=='session'||header.id!==id||header.cwd!==store.cwd)throw new Error('La sesión pertenece a otro directorio o es inválida.');}
+  async function fallback(id,query){
+    stats.fallbacks++;clear();const book=await store.load(id);
+    const view={header:book.rows[0],accepted:book.rows.findLast(row=>row.type==='chrome_task_accepted'&&row.source==='workflow_host'),tasks:new Map(),receipts:new Map()};
+    if(query.kind==='page'){const n=book.rows.findLastIndex(row=>row.type==='chrome_task_checkpoint'&&row.task_digest===query.taskDigest);if(n>=0)view.tasks.set(query.taskDigest,{row:book.rows[n],n});}
+    else for(let i=0;i<book.rows.length;i++){const row=book.rows[i];if(row.invocation_id===query.invocationId&&['house_proposal','house_started','house_receipt'].includes(row.type)){const tuple=view.receipts.get(query.invocationId)||{};tuple[row.type]={row,n:i};view.receipts.set(query.invocationId,tuple);}}
+    return result(view,book.journalAudit,query);
+  }
+  function result(view,audit,query){
+    const base={session:{id:view.header.id,cwd:view.header.cwd},journalAudit:audit};
+    if(query.kind==='page')return structuredClone({...base,accepted:view.accepted??null,checkpoint:view.tasks.get(query.taskDigest)?.row??null,state:view.tasks.get(query.taskDigest)?.row.state||defaultState()});
+    const tuple=view.receipts.get(query.invocationId)||{};
+    return structuredClone({...base,proposal:tuple.house_proposal?.row??null,started:tuple.house_started?.row??null,receipt:tuple.house_receipt?.row??null,indices:{proposal:tuple.house_proposal?.n??null,started:tuple.house_started?.n??null,receipt:tuple.house_receipt?.n??null}});
+  }
+  async function read(id,query){
+    const began=performance.now();stats.reads++;
+    try{
+      while(store.writers.has(id))await store.writers.get(id).catch(()=>{});
+      const bytes=await readFile(store.file(id));
+      if(!maxCachedBytes||!maxIndexBytes||bytes.length>maxCachedBytes)return await fallback(id,query);
+      let audit=journal.get(id,bytes),view,records,mode,compatibility;
+      if(entry?.id===id&&bytes.equals(entry.bytes)&&audit){view=entry.view;records=entry.records;compatibility=entry.compatibility;mode='identical';stats.identical++;}
+      else if(entry?.id===id&&entry.audit.verified&&entry.prefixSafe&&bytes.length>entry.bytes.length&&bytes.subarray(0,entry.bytes.length).equals(entry.bytes)&&bytes.subarray(entry.bytes.length).toString('utf8').trimEnd()){
+        // Do not trimStart: a blank line inserted after the verified prefix is
+        // invalid in the original full parser and must remain invalid here.
+        const suffix=bytes.subarray(entry.bytes.length).toString('utf8').trimEnd().split('\n').map(row=>JSON.parse(row));
+        const absolute=new Array(entry.records).concat(suffix);identity(entry.view.header,id);assertClassifierChannels(absolute);
+        compatibility=foldCompatibility(suffix,entry.view.header,entry.compatibility);
+        audit=journal.extend(id,bytes,absolute);
+        if(!audit)return await fallback(id,query);
+        view=fold({header:entry.view.header,accepted:entry.view.accepted,tasks:new Map(entry.view.tasks),receipts:new Map([...entry.view.receipts].map(([k,v])=>[k,{...v}]))},suffix,entry.records);
+        records=absolute.length;mode='verified-prefix';stats.extensions++;
+      } else {
+        const rows=bytes.toString('utf8').trim().split('\n').map(row=>JSON.parse(row));identity(rows[0],id);assertClassifierChannels(rows);
+        compatibility=foldCompatibility(rows.slice(1),rows[0]);
+        audit=audit||auditJournal(rows);view=fold(index(),rows);records=rows.length;mode='full';stats.full++;
+      }
+      identity(view.header,id);
+      const indexBytes=size(view,compatibility);
+      if(indexBytes>maxIndexBytes)return await fallback(id,query);
+      if(mode!=='identical')journal.set(id,bytes,audit);
+      if(audit.consistent){if(mode!=='identical')entry={id,bytes:Buffer.from(bytes),view,records,compatibility,prefixSafe:reusablePrefix(bytes,records),audit:structuredClone(audit)};stats.retained_buffer_bytes=2*bytes.length;stats.retained_index_json_bytes=indexBytes;}
+      else clear();
+      // A missing recent receipt or task may have been evicted; never credit
+      // absence from a bounded index as absence from the original book.
+      if(query.kind==='receipt'&&!view.receipts.get(query.invocationId)?.house_proposal||query.kind==='page'&&!view.tasks.has(query.taskDigest)&&view.tasks.size>=maxTasks)return await fallback(id,query);
+      stats.last={mode,bytes:bytes.length,records,index_json_bytes:indexBytes,elapsed_ms:performance.now()-began};
+      return result(view,audit,query);
+    }catch(error){stats.failures++;clear();throw error;}
+    finally{stats.last={...stats.last,elapsed_ms:performance.now()-began};}
+  }
+  // Serialize private cache updates; no journal writer, actor or permission is
+  // substituted, and original writer-drain semantics remain per read.
+  const serial=(id,query)=>{const next=pending.then(()=>read(id,query));pending=next.catch(()=>{});return next;};
+  return Object.freeze({
+    readPageState(id,taskDigest){if(!validHash(taskDigest))return Promise.reject(new TypeError('Exact accepted task digest required.'));return serial(id,{kind:'page',taskDigest});},
+    readReceipt(id,invocationId){if(typeof invocationId!=='string'||!/^[a-f0-9-]{36}$/.test(invocationId))return Promise.reject(new TypeError('Exact original invocation id required.'));return serial(id,{kind:'receipt',invocationId});},
+    status(){return structuredClone(stats);},clear(){return pending.then(()=>clear());},
+  });
+}

package/src/session-projections.mjs

@@ -0,0 +1,119 @@
+// Narrow host-only reader. A normal page workflow uses it only after explicit host opt-in.
+// A projection is data, not execution/audit/permission authority.
+import {readFile} from 'node:fs/promises';
+import {performance} from 'node:perf_hooks';
+
+const jsonBytes=value=>Buffer.byteLength(JSON.stringify(value));
+const validHash=value=>typeof value==='string'&&/^[a-f0-9]{64}$/.test(value);
+const defaultState=()=>({stage:'new',status:'ready'});
+// Preserve the original SessionStore fold operations and their JS exceptions.
+// Only its private accumulated fold is reused; callers never receive it. A
+// string messages.slice() can succeed, then messages.push() can fail, or reset
+// can restore an array. No new schema is imposed on these records.
+function foldCompatibility(rows,header,prior){
+  let messages=prior?(Array.isArray(prior.messages)?prior.messages.slice():prior.messages):[];
+  const historyMessages=prior?prior.historyMessages.slice():[];
+  let metadata=prior?prior.metadata:header,goal=prior?.goal,queue=prior?.queue,draft=prior?prior.draft:'',draftAttachments=prior?prior.draftAttachments:[],compaction=prior?.compaction,projection=prior?.projection;
+  for (const row of rows) {
+    if (row.type === 'reset') { messages = []; historyMessages.length = 0; compaction = undefined; projection = undefined; }
+    if (row.type === 'compaction') { messages = row.messages.slice(); compaction = row; }
+    if (row.type === 'context_projection') { messages = row.messages.slice(); projection = row; compaction = row; }
+    if (row.type === 'context_rebase') { messages = row.messages.slice(); projection = undefined; compaction = undefined; }
+    if (row.type === 'message') { messages.push(row.message); historyMessages.push(row.message); }
+    if (row.type === 'model') metadata = { ...metadata, model: row.model };
+    if (row.type === 'provider') metadata = { ...metadata, provider: row.provider, model: row.model, ...(row.profile !== undefined ? {provider_profile:row.profile} : {}),...(row.connection ? {provider_connection:row.connection} : {}) };
+    if (row.type === 'goal') goal = row.goal;
+    if (row.type === 'queue') queue = row.snapshot;
+    if (row.type === 'draft') { draft = row.text; draftAttachments = row.attachments || []; }
+    if (row.type === 'name') metadata = { ...metadata, name: row.name };
+    if (row.type === 'parent') metadata = { ...metadata, parent_session_id: row.parent_session_id, subagent_type: row.subagent_type, name: row.description };
+  }
+  return{messages,historyMessages,metadata,goal,queue,draft,draftAttachments,compaction,projection};
+}
+export function createSessionProjectionReader({store,JournalCache,auditJournal,assertClassifierChannels,maxCachedBytes=16*1024*1024,maxIndexBytes=1024*1024,maxTasks=8,maxReceipts=64}={}) {
+  if(!store||typeof store.load!=='function'||typeof store.file!=='function'||!(store.writers instanceof Map)||typeof store.cwd!=='string'||typeof JournalCache!=='function'||typeof auditJournal!=='function'||typeof assertClassifierChannels!=='function')throw new TypeError('Explicit original host store and journal implementations required.');
+  for(const [name,value,limit] of [['maxCachedBytes',maxCachedBytes,64*1024*1024],['maxIndexBytes',maxIndexBytes,8*1024*1024],['maxTasks',maxTasks,64],['maxReceipts',maxReceipts,256]])if(!Number.isSafeInteger(value)||value<0||value>limit)throw new TypeError('Invalid bounded projection option: '+name);
+  let entry=null,journal=new JournalCache({maxBytes:maxCachedBytes}),pending=Promise.resolve();
+  const stats={reads:0,identical:0,extensions:0,full:0,fallbacks:0,failures:0,retained_buffer_bytes:0,retained_index_json_bytes:0,max_cached_buffer_bytes:2*maxCachedBytes,max_index_json_bytes:maxIndexBytes,max_tasks:maxTasks,max_receipts:maxReceipts,last:null};
+  // Native trim() admits blank lines at EOF, but appending after them makes
+  // them internal parser errors. Such bytes can cache equality, never a prefix.
+  const reusablePrefix=(bytes,records)=>{if(bytes.at(-1)!==10)return false;let n=0;for(let p=bytes.indexOf(10);p>=0;p=bytes.indexOf(10,p+1))n++;return n===records;};
+  const clear=()=>{entry=null;journal=new JournalCache({maxBytes:maxCachedBytes});stats.retained_buffer_bytes=0;stats.retained_index_json_bytes=0;};
+  const index=()=>({header:null,accepted:null,tasks:new Map(),receipts:new Map()});
+  const put=(map,key,value,cap)=>{if(map.has(key))map.delete(key);map.set(key,value);while(map.size>cap)map.delete(map.keys().next().value);};
+  function fold(view,rows,offset=0){
+    for(let i=0;i<rows.length;i++){
+      const row=rows[i],n=offset+i;if(!row)continue;
+      if(n===0)view.header=row;
+      if(row.type==='chrome_task_accepted'&&row.source==='workflow_host')view.accepted=row;
+      if(row.type==='chrome_task_checkpoint')put(view.tasks,row.task_digest,{row,n},maxTasks);
+      if(['house_proposal','house_started','house_receipt'].includes(row.type)&&typeof row.invocation_id==='string'){
+        const tuple=view.receipts.get(row.invocation_id)||{};
+        // A bounded recent index. Missing/evicted ancestors never become proof;
+        // explicit receipt queries fall back to the original complete reader.
+        tuple[row.type]={row,n};put(view.receipts,row.invocation_id,tuple,maxReceipts);
+      }
+    }
+    return view;
+  }
+  const size=(view,compatibility)=>jsonBytes({header:view.header,accepted:view.accepted,tasks:[...view.tasks],receipts:[...view.receipts],compatibility});
+  function identity(header,id){if(header?.type!=='session'||header.id!==id||header.cwd!==store.cwd)throw new Error('La sesión pertenece a otro directorio o es inválida.');}
+  async function fallback(id,query){
+    stats.fallbacks++;clear();const book=await store.load(id);
+    const view={header:book.rows[0],accepted:book.rows.findLast(row=>row.type==='chrome_task_accepted'&&row.source==='workflow_host'),tasks:new Map(),receipts:new Map()};
+    if(query.kind==='page'){const n=book.rows.findLastIndex(row=>row.type==='chrome_task_checkpoint'&&row.task_digest===query.taskDigest);if(n>=0)view.tasks.set(query.taskDigest,{row:book.rows[n],n});}
+    else for(let i=0;i<book.rows.length;i++){const row=book.rows[i];if(row.invocation_id===query.invocationId&&['house_proposal','house_started','house_receipt'].includes(row.type)){const tuple=view.receipts.get(query.invocationId)||{};tuple[row.type]={row,n:i};view.receipts.set(query.invocationId,tuple);}}
+    return result(view,book.journalAudit,query);
+  }
+  function result(view,audit,query){
+    const base={session:{id:view.header.id,cwd:view.header.cwd},journalAudit:audit};
+    if(query.kind==='page')return structuredClone({...base,accepted:view.accepted??null,checkpoint:view.tasks.get(query.taskDigest)?.row??null,state:view.tasks.get(query.taskDigest)?.row.state||defaultState()});
+    const tuple=view.receipts.get(query.invocationId)||{};
+    return structuredClone({...base,proposal:tuple.house_proposal?.row??null,started:tuple.house_started?.row??null,receipt:tuple.house_receipt?.row??null,indices:{proposal:tuple.house_proposal?.n??null,started:tuple.house_started?.n??null,receipt:tuple.house_receipt?.n??null}});
+  }
+  async function read(id,query){
+    const began=performance.now();stats.reads++;
+    try{
+      while(store.writers.has(id))await store.writers.get(id).catch(()=>{});
+      const bytes=await readFile(store.file(id));
+      if(!maxCachedBytes||!maxIndexBytes||bytes.length>maxCachedBytes)return await fallback(id,query);
+      let audit=journal.get(id,bytes),view,records,mode,compatibility;
+      if(entry?.id===id&&bytes.equals(entry.bytes)&&audit){view=entry.view;records=entry.records;compatibility=entry.compatibility;mode='identical';stats.identical++;}
+      else if(entry?.id===id&&entry.audit.verified&&entry.prefixSafe&&bytes.length>entry.bytes.length&&bytes.subarray(0,entry.bytes.length).equals(entry.bytes)&&bytes.subarray(entry.bytes.length).toString('utf8').trimEnd()){
+        // Do not trimStart: a blank line inserted after the verified prefix is
+        // invalid in the original full parser and must remain invalid here.
+        const suffix=bytes.subarray(entry.bytes.length).toString('utf8').trimEnd().split('\n').map(row=>JSON.parse(row));
+        const absolute=new Array(entry.records).concat(suffix);identity(entry.view.header,id);assertClassifierChannels(absolute);
+        compatibility=foldCompatibility(suffix,entry.view.header,entry.compatibility);
+        audit=journal.extend(id,bytes,absolute);
+        if(!audit)return await fallback(id,query);
+        view=fold({header:entry.view.header,accepted:entry.view.accepted,tasks:new Map(entry.view.tasks),receipts:new Map([...entry.view.receipts].map(([k,v])=>[k,{...v}]))},suffix,entry.records);
+        records=absolute.length;mode='verified-prefix';stats.extensions++;
+      } else {
+        const rows=bytes.toString('utf8').trim().split('\n').map(row=>JSON.parse(row));identity(rows[0],id);assertClassifierChannels(rows);
+        compatibility=foldCompatibility(rows.slice(1),rows[0]);
+        audit=audit||auditJournal(rows);view=fold(index(),rows);records=rows.length;mode='full';stats.full++;
+      }
+      identity(view.header,id);
+      const indexBytes=size(view,compatibility);
+      if(indexBytes>maxIndexBytes)return await fallback(id,query);
+      if(mode!=='identical')journal.set(id,bytes,audit);
+      if(audit.consistent){if(mode!=='identical')entry={id,bytes:Buffer.from(bytes),view,records,compatibility,prefixSafe:reusablePrefix(bytes,records),audit:structuredClone(audit)};stats.retained_buffer_bytes=2*bytes.length;stats.retained_index_json_bytes=indexBytes;}
+      else clear();
+      // A missing recent receipt or task may have been evicted; never credit
+      // absence from a bounded index as absence from the original book.
+      if(query.kind==='receipt'&&!view.receipts.get(query.invocationId)?.house_proposal||query.kind==='page'&&!view.tasks.has(query.taskDigest)&&view.tasks.size>=maxTasks)return await fallback(id,query);
+      stats.last={mode,bytes:bytes.length,records,index_json_bytes:indexBytes,elapsed_ms:performance.now()-began};
+      return result(view,audit,query);
+    }catch(error){stats.failures++;clear();throw error;}
+    finally{stats.last={...stats.last,elapsed_ms:performance.now()-began};}
+  }
+  // Serialize private cache updates; no journal writer, actor or permission is
+  // substituted, and original writer-drain semantics remain per read.
+  const serial=(id,query)=>{const next=pending.then(()=>read(id,query));pending=next.catch(()=>{});return next;};
+  return Object.freeze({
+    readPageState(id,taskDigest){if(!validHash(taskDigest))return Promise.reject(new TypeError('Exact accepted task digest required.'));return serial(id,{kind:'page',taskDigest});},
+    readReceipt(id,invocationId){if(typeof invocationId!=='string'||!/^[a-f0-9-]{36}$/.test(invocationId))return Promise.reject(new TypeError('Exact original invocation id required.'));return serial(id,{kind:'receipt',invocationId});},
+    status(){return structuredClone(stats);},clear(){return pending.then(()=>clear());},
+  });
+}

package/src/session-read-cache.mjs

@@ -1,20 +1,40 @@
 // Cache computation, never authority or file state. Every lookup is preceded by
 // a new complete file read and requires exact bytes, not stat/mtime metadata.
+import {sealRecord} from './audit.mjs';
+
 export class SessionJournalCache {
   #entry;
-  constructor({maxBytes=8*1024*1024}={}) {
+  constructor({maxBytes=16*1024*1024}={}) {
     if(!Number.isSafeInteger(maxBytes)||maxBytes<0||maxBytes>64*1024*1024)throw new Error('journalCacheBytes debe ser un entero entre 0 y 64 MiB.');
-    this.maxBytes=maxBytes;this.stats={hits:0,misses:0,oversized:0,invalid:0};
+    this.maxBytes=maxBytes;this.stats={hits:0,misses:0,prefix_hits:0,prefix_records:0,suffix_records:0,oversized:0,invalid:0};
   }
   get(id,bytes) {
     if(this.#entry?.id===id && this.#entry.bytes.equals(bytes)){this.stats.hits++;return structuredClone(this.#entry.audit);}
     this.stats.misses++;return null;
   }
+  // Called only after the complete fresh file has been parsed and admitted.
+  // Match ALL old bytes through a complete line boundary. Recompute every new
+  // seal at its absolute original sequence; never trust a suffix's claimed tip.
+  extend(id,bytes,rows) {
+    const prior=this.#entry;
+    if(!prior||prior.id!==id||!prior.audit.verified||prior.bytes.at(-1)!==10||bytes.length<=prior.bytes.length||rows.length<=prior.audit.records||!bytes.subarray(0,prior.bytes.length).equals(prior.bytes))return null;
+    let previous=prior.audit.tip_sha256,sealed=prior.audit.sealed_records,legacy=prior.audit.legacy_records;const violations=[];
+    for(let i=prior.audit.records;i<rows.length;i++){
+      const {audit,...body}=rows[i],expected=sealRecord(body,i,previous).audit;
+      if(audit){
+        sealed++;
+        if(audit.version!==1||audit.sequence!==i||audit.previous_sha256!==previous||audit.sha256!==expected.sha256)violations.push({row:i,reason:'journal_hash_chain_mismatch'});
+      }else{legacy++;if(sealed)violations.push({row:i,reason:'unsealed_record_after_sealed_suffix'});}
+      previous=expected.sha256;
+    }
+    this.stats.prefix_hits++;this.stats.prefix_records+=prior.audit.records;this.stats.suffix_records+=rows.length-prior.audit.records;
+    return {scope:'local_journal_consistency',verified:rows.length>0&&!legacy&&!violations.length,consistent:!violations.length,records:rows.length,sealed_records:sealed,legacy_records:legacy,tip_sha256:previous,integrity:'local_hash_chain_not_signed',violations};
+  }
   set(id,bytes,audit) {
     if(!this.maxBytes || bytes.length>this.maxBytes){this.#entry=undefined;this.stats.oversized++;return;}
     if(!audit.consistent){this.#entry=undefined;this.stats.invalid++;return;}
     // No mutable buffer/audit handed to a caller can poison a future hit.
     this.#entry={id,bytes:Buffer.from(bytes),audit:structuredClone(audit)};
   }
-  status(){return {...this.stats,max_bytes:this.maxBytes,retained_bytes:this.#entry?.bytes.length ||0,entries:this.#entry?1:0,proof:'complete_file_bytes_equal'};}
+  status(){return {...this.stats,max_bytes:this.maxBytes,retained_bytes:this.#entry?.bytes.length ||0,entries:this.#entry?1:0,proof:'complete_file_bytes_equal',prefix_proof:'complete_prior_bytes_equal_and_absolute_suffix_seals_replayed'};}
 }