@openrig/cli 0.4.4 → 0.4.6

package/daemon/dist/domain/terminal/terminal-views-store.js

@@ -0,0 +1,146 @@
+// OPR.0.4.6.02 C2 — the terminal-views store.
+//
+// SAVED views persist to `terminal-views.yaml` at the OPENRIG_HOME root
+// (VM-isolatable via OPENRIG_HOME). They are write-once/read-at-launch: the
+// daemon reads them at launch and the operator's saved layouts survive
+// restarts. Each saved member carries a STRUCTURED `host` field (a host id,
+// never a `member@rig@host` string — MH BR-1).
+//
+// DERIVED views (per-rig / per-mission / per-slice) are computed LIVE from the
+// live seat inventory + the review agents band and are NEVER written to disk
+// (A3). That invariant is structural, not conventional: this module exposes
+// `deriveViewMembers` (a pure mapper) and a `save()` that only ever accepts a
+// `SavedView` — there is no code path that persists a derived view.
+//
+// Writes are atomic (tmp + rename on the same filesystem) and byte-stable:
+// serialization uses a fixed field order and OMITS absent optionals (never
+// null), so a read→save round-trip of the same logical content is idempotent.
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { getDefaultOpenRigPath } from "../../openrig-compat.js";
+const EMPTY_FILE = { version: 1, views: [] };
+/** Build a member object in fixed key order, omitting absent optionals (never null). */
+function normalizeMember(m) {
+    const out = { seat: m.seat };
+    if (m.label != null && m.label !== "")
+        out.label = m.label;
+    if (m.host != null && m.host !== "")
+        out.host = m.host;
+    if (m.tmuxSession != null && m.tmuxSession !== "")
+        out.tmuxSession = m.tmuxSession;
+    if (m.readOnly === true)
+        out.readOnly = true;
+    return out;
+}
+function normalizeView(v) {
+    return { id: v.id, name: v.name, members: v.members.map(normalizeMember) };
+}
+/** Canonical byte-stable serialization of the whole file (fixed order, omit-when-absent). */
+function serialize(file) {
+    const normalized = {
+        version: 1,
+        views: file.views.map(normalizeView),
+    };
+    return stringifyYaml(normalized);
+}
+export class TerminalViewsStore {
+    path;
+    constructor(path = getDefaultOpenRigPath("terminal-views.yaml")) {
+        this.path = path;
+    }
+    /** The resolved on-disk path (useful for tests / diagnostics). */
+    getPath() {
+        return this.path;
+    }
+    /**
+     * Read-at-launch. An absent file yields the empty set. A malformed file
+     * throws (honest — never a silent reset that would discard operator layouts).
+     */
+    read() {
+        if (!existsSync(this.path))
+            return { version: 1, views: [] };
+        const raw = readFileSync(this.path, "utf-8");
+        const parsed = parseYaml(raw);
+        if (parsed == null)
+            return { version: 1, views: [] };
+        if (typeof parsed !== "object") {
+            throw new Error(`terminal views file at ${this.path} must be a YAML object with a 'views' array`);
+        }
+        const obj = parsed;
+        const views = obj["views"];
+        if (!Array.isArray(views)) {
+            throw new Error(`terminal views file at ${this.path}: 'views' must be an array`);
+        }
+        return { version: 1, views: views };
+    }
+    list() {
+        return this.read().views;
+    }
+    get(id) {
+        return this.read().views.find((v) => v.id === id) ?? null;
+    }
+    /**
+     * Persist a SAVED view (upsert by id). Atomic (tmp + rename) and byte-stable.
+     * Returns the resulting file. Only accepts `SavedView` — a derived view can
+     * never reach disk through this path (A3).
+     */
+    save(view) {
+        const current = this.read();
+        const idx = current.views.findIndex((v) => v.id === view.id);
+        const next = [...current.views];
+        if (idx >= 0)
+            next[idx] = view;
+        else
+            next.push(view);
+        const file = { version: 1, views: next };
+        this.writeAtomic(file);
+        return { version: 1, views: file.views.map(normalizeView) };
+    }
+    /** Remove a saved view by id (idempotent). Atomic. */
+    remove(id) {
+        const current = this.read();
+        const file = {
+            version: 1,
+            views: current.views.filter((v) => v.id !== id),
+        };
+        this.writeAtomic(file);
+        return { version: 1, views: file.views.map(normalizeView) };
+    }
+    writeAtomic(file) {
+        const tmp = `${this.path}.tmp`;
+        writeFileSync(tmp, serialize(file), "utf-8");
+        renameSync(tmp, this.path);
+    }
+}
+/**
+ * Map a live seat inventory into composer-ready members. PURE and IN-MEMORY —
+ * the result is handed straight to `composeView`; it is NEVER written to the
+ * saved-views file. Non-tmux / session-less rows are dropped from the derived
+ * set (a derived view only tiles attachable seats; saved views name absents).
+ */
+export function deriveViewMembers(rows, opts = {}) {
+    const members = [];
+    for (const row of rows) {
+        if (row.attachmentType !== "tmux")
+            continue;
+        const seat = row.canonicalSessionName;
+        if (!seat)
+            continue;
+        const tmuxSession = row.tmuxSession ?? row.canonicalSessionName;
+        const agent = row.logicalId ?? seat;
+        const label = opts.labelSuffix ? `${agent} · ${opts.labelSuffix}` : agent;
+        members.push({
+            seat,
+            label,
+            tmuxSession,
+            host: opts.host ?? null,
+            readOnly: opts.readOnly === true,
+            // Derived views are live: presence in the inventory IS the liveness
+            // signal for the derived set; a stricter has-session probe layers on at
+            // compose time for local members if the caller supplies one.
+            alive: true,
+        });
+    }
+    return members;
+}
+//# sourceMappingURL=terminal-views-store.js.map

package/daemon/dist/domain/terminal/terminal-views-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-views-store.js","sourceRoot":"","sources":["../../../src/domain/terminal/terminal-views-store.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,uEAAuE;AACvE,4EAA4E;AAC5E,+CAA+C;AAC/C,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,oEAAoE;AACpE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAE9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AA4BhE,MAAM,UAAU,GAAsB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAEhE,wFAAwF;AACxF,SAAS,eAAe,CAAC,CAAkB;IACzC,MAAM,GAAG,GAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE;QAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE;QAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACvD,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE;QAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IACnF,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;QAAE,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,CAAY;IACjC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,IAAuB;IACxC,MAAM,UAAU,GAAsB;QACpC,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;KACrC,CAAC;IACF,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,OAAe,qBAAqB,CAAC,qBAAqB,CAAC;QAA3D,SAAI,GAAJ,IAAI,CAAuD;IAAG,CAAC;IAE5F,kEAAkE;IAClE,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAY,CAAC;QACzC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,6CAA6C,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAoB,EAAE,CAAC;IACrD,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,IAAe;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAgB,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,GAAG,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,IAAI,GAAsB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,sDAAsD;IACtD,MAAM,CAAC,EAAU;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAsB;YAC9B,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAChD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,WAAW,CAAC,IAAuB;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;CACF;AA8BD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAmB,EACnB,OAAsB,EAAE;IAExB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,oBAAoB,CAAC;QAChE,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC;YACX,IAAI;YACJ,KAAK;YACL,WAAW;YACX,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI;YAChC,oEAAoE;YACpE,wEAAwE;YACxE,6DAA6D;YAC7D,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/daemon/dist/domain/terminal/view-composer.d.ts

@@ -0,0 +1,42 @@
+import type { HostEntry } from "../hosts/hosts-registry-reader.js";
+import type { ComposedPane, ComposedView } from "./terminal-provider.js";
+/**
+ * Panes per grid page (3×3). Overflow spills to the next provider tab/page.
+ * A module constant in v1 — a future per-rig `terminal.tiles_per_page` config
+ * key is a natural extension, but no config key ships in this slice (the plan
+ * keeps the C1 config surface to the single `terminal.status_bar` key).
+ */
+export declare const PANES_PER_PAGE = 9;
+/**
+ * One resolved member of a view, ready to compose. `alive` and `readOnly` are
+ * decided upstream (liveness probe + cross-rig/saved-read-only policy); the
+ * composer only routes on them. `host` is a structured host id or null (local).
+ */
+export interface ViewMemberInput {
+    /** Canonical session name of the seat. */
+    seat: string;
+    /** Pane label — `<agent> · <slice>` (AC-7). */
+    label: string;
+    /** The tmux session to attach to (may be null if the seat has no tmux binding). */
+    tmuxSession: string | null;
+    /** Structured host id when remote; null for a local seat. */
+    host: string | null;
+    /** View-only / cross-rig membership → read-only (`-r`) attach. */
+    readOnly: boolean;
+    /** Local liveness (has-session). Ignored for remote members (reachability is an ssh concern). */
+    alive: boolean;
+}
+/** The composer's only side-channel: read-only host resolution from the registry. */
+export interface ComposeContext {
+    /** Resolve a host id to its registry entry, or null if the id is unknown. */
+    resolveHost(id: string): HostEntry | null;
+}
+/** Chunk panes into fixed-size grid pages (one provider tab per page). */
+export declare function chunkPanes(panes: ComposedPane[], perPage?: number): ComposedPane[][];
+/**
+ * Compose a resolved member list into a provider-neutral view. Pure: same
+ * inputs → byte-identical output. Member order is preserved into `opened`
+ * (and therefore into page assignment), so paging is deterministic.
+ */
+export declare function composeView(id: string, members: ViewMemberInput[], ctx: ComposeContext): ComposedView;
+//# sourceMappingURL=view-composer.d.ts.map

package/daemon/dist/domain/terminal/view-composer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-composer.d.ts","sourceRoot":"","sources":["../../../src/domain/terminal/view-composer.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAEV,YAAY,EACZ,YAAY,EAEb,MAAM,wBAAwB,CAAC;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,kEAAkE;IAClE,QAAQ,EAAE,OAAO,CAAC;IAClB,iGAAiG;IACjG,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;CAC3C;AAYD,0EAA0E;AAC1E,wBAAgB,UAAU,CACxB,KAAK,EAAE,YAAY,EAAE,EACrB,OAAO,GAAE,MAAuB,GAC/B,YAAY,EAAE,EAAE,CAOlB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,eAAe,EAAE,EAC1B,GAAG,EAAE,cAAc,GAClB,YAAY,CA2Fd"}

package/daemon/dist/domain/terminal/view-composer.js

@@ -0,0 +1,137 @@
+// OPR.0.4.6.02 C2 — the PURE view composer.
+//
+// Turns a resolved list of view members into a provider-neutral `ComposedView`
+// (`{ opened, absent, degraded, pages }`, BR-6 honest-partial). All of the
+// partition rules live here, in one testable pure function, so no provider
+// re-implements them:
+//
+//   local live       → `tmux attach -t <session>`
+//   view-only / cross-rig (read-only)
+//                    → `tmux attach -r -t <session>`
+//   ssh host         → `ssh <dest> tmux attach [-r] -t <session>`
+//   http host        → NO pane; honest-degrade { seat, host, reason }
+//   dead / no session → absent[] (named, never silently dropped)
+//
+// The composer takes members that already carry a STRUCTURED `host` field (a
+// host id, never a `member@rig@host` string — MH BR-1). Host classification
+// (ssh vs http vs unknown) is resolved through the operator's read-only hosts
+// registry via the injected `resolveHost`.
+/**
+ * Panes per grid page (3×3). Overflow spills to the next provider tab/page.
+ * A module constant in v1 — a future per-rig `terminal.tiles_per_page` config
+ * key is a natural extension, but no config key ships in this slice (the plan
+ * keeps the C1 config surface to the single `terminal.status_bar` key).
+ */
+export const PANES_PER_PAGE = 9;
+/** POSIX single-quote a string so session names / targets are shell-inert in the composed command. */
+function shellQuote(s) {
+    return "'" + s.replace(/'/g, "'\"'\"'") + "'";
+}
+/** The remote ssh destination — `user@target` when a user is declared, else `target`. */
+function sshDest(host) {
+    return host.user ? `${host.user}@${host.target}` : host.target;
+}
+/** Chunk panes into fixed-size grid pages (one provider tab per page). */
+export function chunkPanes(panes, perPage = PANES_PER_PAGE) {
+    if (perPage < 1)
+        throw new Error(`chunkPanes: perPage must be >= 1 (got ${perPage})`);
+    const pages = [];
+    for (let i = 0; i < panes.length; i += perPage) {
+        pages.push(panes.slice(i, i + perPage));
+    }
+    return pages;
+}
+/**
+ * Compose a resolved member list into a provider-neutral view. Pure: same
+ * inputs → byte-identical output. Member order is preserved into `opened`
+ * (and therefore into page assignment), so paging is deterministic.
+ */
+export function composeView(id, members, ctx) {
+    const opened = [];
+    const absent = [];
+    const degraded = [];
+    for (const m of members) {
+        const attachFlag = m.readOnly ? "-r " : "";
+        if (m.host !== null) {
+            // Remote member: classify by the registry entry's transport.
+            const host = ctx.resolveHost(m.host);
+            if (!host) {
+                // Unknown host id is a config gap, not a live seat — degrade named,
+                // never a silent omission.
+                degraded.push({
+                    seat: m.seat,
+                    host: m.host,
+                    reason: `host ${m.host} is not in the hosts registry`,
+                });
+                continue;
+            }
+            if (host.transport === "http") {
+                // http hosts speak daemon REST, not interactive ssh panes — the tile
+                // surface needs ssh. Honest-degrade, R1(a).
+                degraded.push({
+                    seat: m.seat,
+                    host: m.host,
+                    reason: `host ${m.host} is http-registered; tiles need ssh`,
+                });
+                continue;
+            }
+            // ssh host: a seat with no recorded tmux session cannot be attached.
+            if (!m.tmuxSession) {
+                absent.push({
+                    seat: m.seat,
+                    host: m.host,
+                    reason: "no tmux session recorded for this seat",
+                });
+                continue;
+            }
+            // Guard G1: the host registry is STRUCTURED data, but the pane command is a
+            // shell string — so the ssh destination must be shell-inert AND not
+            // option-shaped. A registry `user`/`target` with whitespace or shell
+            // metacharacters would otherwise split into extra shell words; a leading
+            // `-` would be parsed BY ssh as an option (option injection). We shell-quote
+            // the destination so it stays exactly ONE argument, and honest-degrade (named,
+            // never run) a destination that begins with `-`.
+            const dest = sshDest(host);
+            if (dest.startsWith("-")) {
+                degraded.push({
+                    seat: m.seat,
+                    host: m.host,
+                    reason: `host ${m.host} ssh destination '${dest}' is option-shaped (leading '-'); refusing to compose an ssh tile`,
+                });
+                continue;
+            }
+            opened.push({
+                seat: m.seat,
+                label: m.label,
+                paneCommand: `ssh ${shellQuote(dest)} tmux attach ${attachFlag}-t ${shellQuote(m.tmuxSession)}`,
+                readOnly: m.readOnly,
+            });
+            continue;
+        }
+        // Local member.
+        if (!m.tmuxSession) {
+            absent.push({
+                seat: m.seat,
+                host: null,
+                reason: "no tmux session recorded for this seat",
+            });
+            continue;
+        }
+        if (!m.alive) {
+            absent.push({
+                seat: m.seat,
+                host: null,
+                reason: `tmux session ${m.tmuxSession} is not alive`,
+            });
+            continue;
+        }
+        opened.push({
+            seat: m.seat,
+            label: m.label,
+            paneCommand: `tmux attach ${attachFlag}-t ${shellQuote(m.tmuxSession)}`,
+            readOnly: m.readOnly,
+        });
+    }
+    return { id, opened, absent, degraded, pages: chunkPanes(opened) };
+}
+//# sourceMappingURL=view-composer.js.map

package/daemon/dist/domain/terminal/view-composer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-composer.js","sourceRoot":"","sources":["../../../src/domain/terminal/view-composer.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,sBAAsB;AACtB,EAAE;AACF,kDAAkD;AAClD,sCAAsC;AACtC,qDAAqD;AACrD,kEAAkE;AAClE,sEAAsE;AACtE,iEAAiE;AACjE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,2CAA2C;AAU3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AA4BhC,sGAAsG;AACtG,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC;AAChD,CAAC;AAED,yFAAyF;AACzF,SAAS,OAAO,CAAC,IAA8C;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACjE,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CACxB,KAAqB,EACrB,UAAkB,cAAc;IAEhC,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,GAAG,CAAC,CAAC;IACtF,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,EAAU,EACV,OAA0B,EAC1B,GAAmB;IAEnB,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAE3C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACpB,6DAA6D;YAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,oEAAoE;gBACpE,2BAA2B;gBAC3B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,+BAA+B;iBACtD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC9B,qEAAqE;gBACrE,4CAA4C;gBAC5C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,qCAAqC;iBAC5D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,qEAAqE;YACrE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,MAAM,EAAE,wCAAwC;iBACjD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,4EAA4E;YAC5E,oEAAoE;YACpE,qEAAqE;YACrE,yEAAyE;YACzE,6EAA6E;YAC7E,+EAA+E;YAC/E,iDAAiD;YACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,qBAAqB,IAAI,mEAAmE;iBACnH,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,OAAO,UAAU,CAAC,IAAI,CAAC,gBAAgB,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;gBAC/F,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,gBAAgB;QAChB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,wCAAwC;aACjD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,gBAAgB,CAAC,CAAC,WAAW,eAAe;aACrD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,eAAe,UAAU,MAAM,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE;YACvE,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AACrE,CAAC"}

package/daemon/dist/domain/tmux-option-defaults.d.ts

@@ -0,0 +1,89 @@
+import type { TmuxAdapter } from "../adapters/tmux.js";
+export interface TmuxOptionDefaultsDeps {
+    tmuxAdapter: TmuxAdapter;
+    /**
+     * OPR.0.4.6.02 S1 — reads the daemon's tmux option defaults at APPLY time.
+     * Resolved fresh per call (from the SettingsStore in startup) so an
+     * operator's `terminal.status_bar` flip applies to FUTURE launches only.
+     * Defaults to `statusBar: false` (bar hidden) when omitted.
+     */
+    readTmuxOptionDefaults?: () => {
+        statusBar: boolean;
+    };
+    /**
+     * OPR.0.4.6.02 S1 — platform selector for the server-scope `copy-command`
+     * table. Defaults to `process.platform`; injectable for the scope tests.
+     */
+    platform?: NodeJS.Platform;
+    /**
+     * OPR.0.4.6.02 S1 — cheap `command -v <bin>` probe for the linux
+     * copy-command fallback chain. Defaults to a real shell probe; injectable
+     * for deterministic tests.
+     */
+    hasCommand?: (bin: string) => boolean;
+}
+/**
+ * OPR.0.4.6.02 S1 — applies the daemon's tmux option defaults to a
+ * FRESHLY-CREATED session. Shared by `NodeLauncher` (the launch path) and
+ * `SuccessorSessionLauncher` (the fresh seat-handover successor path) so
+ * every fresh operator/agent seat gets consistent mouse/status/clipboard
+ * defaults (orch C1 scope ruling: fold fresh successors in via ONE helper).
+ *
+ * Scope discipline (guard b2): SESSION-scope options (`mouse`, `status`) are
+ * applied ONLY to the just-created session name passed in — never a
+ * pre-existing/discovered session — so the never-retro-flip rail (BR-1)
+ * holds and a `terminal.status_bar` flip affects future launches only.
+ * SERVER-scope options (`set-clipboard`, `copy-command`) are asserted ONCE
+ * per daemon lifetime via the shared memo on this single instance; a daemon
+ * RESTART re-asserts (a fresh applier). Callers MUST only invoke this after
+ * a successful `createSession` on a freshly-created session.
+ */
+export declare class TmuxOptionDefaultsApplier {
+    private tmuxAdapter;
+    private readTmuxOptionDefaults;
+    private platform;
+    private hasCommand;
+    private serverDefaultsAsserted;
+    constructor(deps: TmuxOptionDefaultsDeps);
+    /**
+     * Apply the option defaults to a JUST-CREATED session. `mouse` is always
+     * on; the inner status bar follows the `terminal.status_bar` config key
+     * (default off), read at apply time so a flip applies to FUTURE launches
+     * only (this touches only `sessionName`). Then assert the server-scope
+     * defaults once per daemon lifetime.
+     *
+     * Returns the list of non-fatal warnings (empty when all sets succeed) so
+     * the caller can fold them into its own launch-warning channel. NEVER
+     * throws for an option-set failure — a seat without mouse-scroll is
+     * degraded, not dead (and a handover successor must not be handover-fatal
+     * over a cosmetic option).
+     */
+    applyToFreshSession(sessionName: string): Promise<string[]>;
+    /**
+     * Assert the SERVER-scope tmux defaults (`set-clipboard on` + the
+     * per-platform `copy-command`) on the daemon's OWN tmux server, ONCE per
+     * daemon lifetime. Written only through `setServerOption` (`set-option
+     * -s`) — never a `-t` session target (guard b2 scope contract).
+     *
+     * Per-process memoization means a daemon RESTART re-asserts these (a fresh
+     * applier instance): an operator's manual `copy-command` / `set-clipboard`
+     * override does NOT survive a daemon restart — the named off-switch
+     * follow-up is the customization path. Re-running is harmless (idempotent
+     * set of the same values); the memo is an optimization, not a correctness
+     * gate.
+     */
+    private ensureServerDefaults;
+}
+/**
+ * OPR.0.4.6.02 S1 — the per-platform tmux `copy-command` table (arch rail
+ * b). Ref: the tmux "Clipboard" wiki — `copy-command` is the shell command
+ * tmux pipes a copy-mode selection into to reach the system clipboard.
+ *  - darwin → `pbcopy`
+ *  - linux  → `wl-copy` if present, else `xclip -selection clipboard -i`,
+ *             else UNSET (null) — fall back to `set-clipboard on` OSC 52.
+ *  - other  → UNSET (null).
+ * Pure: platform + a `command -v` probe in, the command string (or null)
+ * out. One table, no side effects — the applier decides whether to write.
+ */
+export declare function resolveCopyCommand(platform: NodeJS.Platform, hasCommand: (bin: string) => boolean): string | null;
+//# sourceMappingURL=tmux-option-defaults.d.ts.map

package/daemon/dist/domain/tmux-option-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmux-option-defaults.d.ts","sourceRoot":"","sources":["../../src/domain/tmux-option-defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,sBAAsB,CAA+B;IAC7D,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,sBAAsB,CAAS;gBAE3B,IAAI,EAAE,sBAAsB;IAOxC;;;;;;;;;;;;OAYG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAuBjE;;;;;;;;;;;;OAYG;YACW,oBAAoB;CAmBnC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GACnC,MAAM,GAAG,IAAI,CAQf"}

package/daemon/dist/domain/tmux-option-defaults.js

@@ -0,0 +1,132 @@
+import { spawnSync } from "node:child_process";
+/**
+ * OPR.0.4.6.02 S1 — applies the daemon's tmux option defaults to a
+ * FRESHLY-CREATED session. Shared by `NodeLauncher` (the launch path) and
+ * `SuccessorSessionLauncher` (the fresh seat-handover successor path) so
+ * every fresh operator/agent seat gets consistent mouse/status/clipboard
+ * defaults (orch C1 scope ruling: fold fresh successors in via ONE helper).
+ *
+ * Scope discipline (guard b2): SESSION-scope options (`mouse`, `status`) are
+ * applied ONLY to the just-created session name passed in — never a
+ * pre-existing/discovered session — so the never-retro-flip rail (BR-1)
+ * holds and a `terminal.status_bar` flip affects future launches only.
+ * SERVER-scope options (`set-clipboard`, `copy-command`) are asserted ONCE
+ * per daemon lifetime via the shared memo on this single instance; a daemon
+ * RESTART re-asserts (a fresh applier). Callers MUST only invoke this after
+ * a successful `createSession` on a freshly-created session.
+ */
+export class TmuxOptionDefaultsApplier {
+    tmuxAdapter;
+    readTmuxOptionDefaults;
+    platform;
+    hasCommand;
+    serverDefaultsAsserted = false;
+    constructor(deps) {
+        this.tmuxAdapter = deps.tmuxAdapter;
+        this.readTmuxOptionDefaults = deps.readTmuxOptionDefaults ?? (() => ({ statusBar: false }));
+        this.platform = deps.platform ?? process.platform;
+        this.hasCommand = deps.hasCommand ?? defaultHasCommand;
+    }
+    /**
+     * Apply the option defaults to a JUST-CREATED session. `mouse` is always
+     * on; the inner status bar follows the `terminal.status_bar` config key
+     * (default off), read at apply time so a flip applies to FUTURE launches
+     * only (this touches only `sessionName`). Then assert the server-scope
+     * defaults once per daemon lifetime.
+     *
+     * Returns the list of non-fatal warnings (empty when all sets succeed) so
+     * the caller can fold them into its own launch-warning channel. NEVER
+     * throws for an option-set failure — a seat without mouse-scroll is
+     * degraded, not dead (and a handover successor must not be handover-fatal
+     * over a cosmetic option).
+     */
+    async applyToFreshSession(sessionName) {
+        const warnings = [];
+        const mouse = await this.tmuxAdapter.setSessionOption(sessionName, "mouse", "on");
+        if (!mouse.ok) {
+            warnings.push(`tmux "mouse" option not set for ${sessionName}: ${mouse.message}`);
+        }
+        let statusBar = false;
+        try {
+            statusBar = this.readTmuxOptionDefaults().statusBar === true;
+        }
+        catch {
+            statusBar = false;
+        }
+        const status = await this.tmuxAdapter.setSessionOption(sessionName, "status", statusBar ? "on" : "off");
+        if (!status.ok) {
+            warnings.push(`tmux "status" option not set for ${sessionName}: ${status.message}`);
+        }
+        await this.ensureServerDefaults(warnings);
+        return warnings;
+    }
+    /**
+     * Assert the SERVER-scope tmux defaults (`set-clipboard on` + the
+     * per-platform `copy-command`) on the daemon's OWN tmux server, ONCE per
+     * daemon lifetime. Written only through `setServerOption` (`set-option
+     * -s`) — never a `-t` session target (guard b2 scope contract).
+     *
+     * Per-process memoization means a daemon RESTART re-asserts these (a fresh
+     * applier instance): an operator's manual `copy-command` / `set-clipboard`
+     * override does NOT survive a daemon restart — the named off-switch
+     * follow-up is the customization path. Re-running is harmless (idempotent
+     * set of the same values); the memo is an optimization, not a correctness
+     * gate.
+     */
+    async ensureServerDefaults(warnings) {
+        if (this.serverDefaultsAsserted)
+            return;
+        // Set first so concurrent applies don't double-assert; either way the
+        // sets are idempotent.
+        this.serverDefaultsAsserted = true;
+        const clip = await this.tmuxAdapter.setServerOption("set-clipboard", "on");
+        if (!clip.ok) {
+            warnings.push(`tmux "set-clipboard" server option not set: ${clip.message}`);
+        }
+        const copyCommand = resolveCopyCommand(this.platform, this.hasCommand);
+        if (copyCommand !== null) {
+            const cc = await this.tmuxAdapter.setServerOption("copy-command", copyCommand);
+            if (!cc.ok) {
+                warnings.push(`tmux "copy-command" server option not set: ${cc.message}`);
+            }
+        }
+    }
+}
+/**
+ * OPR.0.4.6.02 S1 — the per-platform tmux `copy-command` table (arch rail
+ * b). Ref: the tmux "Clipboard" wiki — `copy-command` is the shell command
+ * tmux pipes a copy-mode selection into to reach the system clipboard.
+ *  - darwin → `pbcopy`
+ *  - linux  → `wl-copy` if present, else `xclip -selection clipboard -i`,
+ *             else UNSET (null) — fall back to `set-clipboard on` OSC 52.
+ *  - other  → UNSET (null).
+ * Pure: platform + a `command -v` probe in, the command string (or null)
+ * out. One table, no side effects — the applier decides whether to write.
+ */
+export function resolveCopyCommand(platform, hasCommand) {
+    if (platform === "darwin")
+        return "pbcopy";
+    if (platform === "linux") {
+        if (hasCommand("wl-copy"))
+            return "wl-copy";
+        if (hasCommand("xclip"))
+            return "xclip -selection clipboard -i";
+        return null;
+    }
+    return null;
+}
+/**
+ * OPR.0.4.6.02 S1 — default `command -v <bin>` probe (POSIX shell builtin).
+ * Returns true when the binary resolves on PATH. Cheap + best-effort; any
+ * failure (spawn error, non-shell env) reads as absent.
+ */
+function defaultHasCommand(bin) {
+    try {
+        const r = spawnSync(`command -v ${bin}`, { shell: true, stdio: "ignore" });
+        return r.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=tmux-option-defaults.js.map

package/daemon/dist/domain/tmux-option-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmux-option-defaults.js","sourceRoot":"","sources":["../../src/domain/tmux-option-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAyB/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,yBAAyB;IAC5B,WAAW,CAAc;IACzB,sBAAsB,CAA+B;IACrD,QAAQ,CAAkB;IAC1B,UAAU,CAA2B;IACrC,sBAAsB,GAAG,KAAK,CAAC;IAEvC,YAAY,IAA4B;QACtC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,mBAAmB,CAAC,WAAmB;QAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,mCAAmC,WAAW,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,oCAAoC,WAAW,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,oBAAoB,CAAC,QAAkB;QACnD,IAAI,IAAI,CAAC,sBAAsB;YAAE,OAAO;QACxC,sEAAsE;QACtE,uBAAuB;QACvB,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAEnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,+CAA+C,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC/E,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC,8CAA8C,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,UAAoC;IAEpC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,+BAA+B,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,cAAc,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/daemon/dist/domain/types.d.ts

@@ -188,7 +188,7 @@ export type RigEvent = {
     sessionName: string;
     runtime: string;
     sessionId: string;
-    provenance: "hook" | "scrape";
+    provenance: "hook" | "scrape" | "rpc";
 } | {
     type: "session.resume_token_set";
     rigId: string;
@@ -571,10 +571,22 @@ export type RigEvent = {
     instanceId: string;
     workflowName: string;
     reason: string;
+} | {
+    type: "workflow.resumed";
+    instanceId: string;
+    workflowName: string;
+    stepId: string;
+    resumedBy: string;
+    decision: string | null;
+    resumeCount: number;
 } | {
     type: "workflow.routing_table_changed";
     rigName: string;
     cause: string;
+    instanceId?: string;
+    stepId?: string | null;
+    from?: string;
+    to?: string;
 } | {
     type: "workflow_spec.removed";
     sourcePath: string;
@@ -801,6 +813,12 @@ export interface NodeInventoryEntry {
     logicalId: string;
     podId: string | null;
     podNamespace?: string | null;
+    /**
+     * OPR.0.4.6.FAC1: the seat's declared role (`nodes.role`, written by
+     * the pod-member path). The workflow binding layer's role→seat
+     * candidate filter reads exactly this. null = role-less.
+     */
+    role: string | null;
     canonicalSessionName: string | null;
     attachmentType?: "tmux" | "external_cli" | null;
     nodeKind: "agent" | "infrastructure";
@@ -1191,6 +1209,14 @@ export interface RigSpecPodMember {
     runtime: string;
     codexConfigProfile?: string;
     model?: string;
+    /**
+     * OPR.0.4.6.FAC1: optional seat-side role declaration (writes the
+     * existing `nodes.role` column via createMemberNode → addNode). The
+     * workflow binding layer resolves workflow roles to seats by this
+     * dimension. Opt-in: a role-less member is never role-resolved and
+     * stays reachable only via explicit preferred_targets.
+     */
+    role?: string;
     cwd: string;
     restorePolicy?: string;
     startup?: StartupBlock;
@@ -1417,6 +1443,13 @@ export interface ExpansionPodFragment {
         codexConfigProfile?: string;
         restorePolicy?: string;
         label?: string;
+        /**
+         * OPR.0.4.6.FAC1: optional seat-side role; threaded through
+         * buildExpansionSpecObject → the pod-member schema → nodes.role
+         * (a provided role is never silently dropped — the sibling-layer
+         * rule).
+         */
+        role?: string;
         /** Optional session source declaration; threaded through to launch. */
         sessionSource?: SessionSourceSpec;
         /**