@orion-agents/orion-code 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -22,6 +22,89 @@ which is **not** a pass.
 
 ## [Unreleased]
 
+## [0.3.4] — CANDIDATE
+
+> **Status: candidate.** This stabilization work is isolated on the v0.3.4 worktree. It is not
+> merged, tagged or published to npm, and exact-artifact qualification remains a separate gate.
+
+### Changed
+
+- Bind Settings writes to the active Workspace and Context revision in addition to the Settings
+  document revision, so a stale browser tab cannot apply a valid patch to another Workspace.
+- Preserve lexical symbolic-link identity while projecting a contained target as a file or
+  directory, and expose the true changed-file total separately from the bounded Review page.
+- Split exact-tgz qualification into a script-disabled identity stage and a separate lifecycle-
+  enabled consumer/native stage.
+
+### Fixed
+
+- Keep split terminal surrogate pairs intact across delayed PTY callbacks, wait for browser write
+  capacity without animation-frame spin, and drain reconnect data in replay, live-tail, exit order.
+- Reject blank Session renames without changing durable metadata, and keep active-turn state intact
+  when a busy-rejected slash command fails.
+- Isolate concurrent command transcript capture so interleaved output cannot cross Sessions or
+  leave the process-wide console bridge installed.
+- Project cold and resident Composer model, Effort and permission changes from the actor Runtime's
+  canonical Session instead of a pre-actor metadata copy.
+- Detect binary content on every file page, render contained directory symlinks as expandable and
+  label Review truncation against the true repository total.
+
+### Security
+
+- Redact URL userinfo and structured sensitive keys before browser/evidence projection; evaluate
+  file aliases plus canonical targets and block sensitive current or rename-source Git diffs before
+  starting a content process.
+- Require matching, canonical-digest-verified terminal receipts and durable receipt facts before a
+  modern tool result can project success.
+- Fail release qualification for a failed live canary or duplicated runtime run and manifest
+  evidence instead of accepting a structurally complete but non-independent matrix.
+
+## [0.3.3] — CANDIDATE
+
+> **Status: candidate.** The implementation and local qualification remain isolated on the v0.3.3
+> worktree. It is not merged, tagged, published to npm or represented as a completed release receipt.
+
+### Added
+
+- Add the bundled `orion-blocksmith` pixel-workshop style as a closed built-in appearance option,
+  composed with system/light/dark themes and reduced motion without remote assets or executable
+  theme packages.
+- Add a bounded Web Session actor registry with three running slots, four resident actors, FIFO
+  overflow admission, cancellable queued turns, idle LRU eviction and explicit per-Session runtime
+  revisions.
+- Add the v0.3.3 OpenAPI, migration guide and exact-artifact WEB33-P0-01..12 plus
+  WEB33-P0-16..24 qualification contract.
+
+### Changed
+
+- Make foreground Session selection browser-tab-local so a running, approval-waiting or queued
+  Session continues while another Session is viewed or submitted.
+- Route Session commands and Composer mutations through exact Workspace, Context, Session runtime
+  and control revisions; stale operations fail closed instead of following a global active Session.
+- Keep a single Workbench SSE connection while projecting Session-tagged runtime state into bounded
+  per-Session browser caches.
+- Package runtime JavaScript and declarations without generated source-map files, preserving local
+  build maps while keeping the published artifact within the existing unpacked-size budget.
+
+### Fixed
+
+- Remove the global pending barrier from warm same-Workspace Session selection and restore cached
+  content immediately while a guarded snapshot refreshes in the background.
+- Keep the collapsed Work Panel as a right-side full-height 48px rail across desktop and drawer
+  breakpoints without moving it below the conversation or creating horizontal page overflow.
+- Keep the only persistent Settings entry at the lower-left project rail and restore focus after a
+  successful Settings save.
+- Raise Orion Blocksmith light-theme muted text contrast to WCAG AA for small labels and empty-state
+  copy.
+
+### Security
+
+- Serialize same-Workspace mutating Tool steps through a shared arbiter while preserving independent
+  actors for non-conflicting work; stale file baselines are rejected before side effects.
+- Bind queued-turn cancellation, approvals, Goal/Plan controls and structured Context references to
+  the intended Session actor, with zero cross-Session provider, Tool, journal or file effects on
+  revision conflict.
+
 ## [0.3.2] — CANDIDATE
 
 > **Status: candidate.** Source, API and browser qualification are being frozen together. This is

package/README.md

@@ -2,16 +2,20 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.2 candidate — one Orion runtime with a resizable local Web Workbench, a Session-scoped
-> Composer Control Center and the existing TUI/terminal surfaces. Candidate source is not an npm
-> publication or Git tag.
+> v0.3.4 candidate — a compatible security, terminal-ordering and release-evidence stabilization of
+> the v0.3.3 multi-Session Web Workbench. Candidate source is not an npm publication, Git tag, or
+> merge-ready release.
 
 [中文说明](README.zh-CN.md) ·
-[v0.3.2 Workbench plan](docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md) ·
-[v0.3.2 Web API](docs/architecture/v0.3.2-web-api.yaml) ·
+[v0.3.4 stabilization plan](docs/plan/v0.3.4-stabilization-plan.md) ·
+[v0.3.4 contract](docs/architecture/v0.3.4-stabilization-contract.md) ·
+[v0.3.4 E2E plan](docs/test/v0.3.4-stabilization-e2e-plan.md) ·
+[v0.3.4 migration](docs/migration/v0.3.3-to-v0.3.4.md) ·
+[v0.3.3 plan](docs/plan/v0.3.3-plan.md) ·
+[v0.3.3 Web API](docs/architecture/v0.3.3-web-api.yaml) ·
 [mode/permission contract](docs/architecture/agent-mode-permission-contract.md) ·
-[v0.3.2 E2E plan](docs/test/v0.3.2-web-workbench-e2e-plan.md) ·
-[v0.3.2 migration](docs/migration/v0.3.1-to-v0.3.2.md) ·
+[v0.3.3 E2E plan](docs/test/v0.3.3-web-workbench-e2e-plan.md) ·
+[v0.3.3 migration](docs/migration/v0.3.2-to-v0.3.3.md) ·
 [v0.3.0 Web plan](docs/plan/v0.3.0-web-workbench-plan.md) ·
 [Settings plan](docs/plan/v0.3.0-settings-integration-plan.md) ·
 [Node compatibility](docs/plan/v0.3.0-node-runtime-compatibility-plan.md) ·
@@ -20,11 +24,32 @@ Local-first, goal-driven coding agent for the terminal and browser.
 [Settings migration](docs/migration/v0.2.2-to-v0.3.0-settings.md) ·
 [real-state gallery](docs/assets/screenshots/v0.3.0-web/README.md)
 
-## What v0.3.2 includes
-
-- **One runtime, two interactive surfaces.** `orion web` uses the same product bootstrap,
-  AgentRuntimeController, Session/Thread stores, ToolGateway, approvals, Goals, Plans, Skills and
-  MCP boundaries as the terminal product; the browser does not run a second agent loop.
+## What v0.3.4 stabilizes
+
+- **Context-bound writes.** Settings mutations now carry the active Workspace and Context revision;
+  stale tabs fail with no write or Runtime apply. Blank Session renames and busy slash commands also
+  fail without corrupting durable or active-turn state.
+- **One sensitive-data boundary.** Structured credentials, URL userinfo, canonical file targets,
+  Git diff paths, tool artifacts and concurrent command output are checked and redacted before they
+  reach browser or evidence surfaces.
+- **Deterministic Terminal transport.** Split surrogate pairs, browser write backpressure and
+  reconnect races preserve complete Unicode and the required replay, live-tail, exit and close
+  order.
+- **Honest durable/read projections.** Tool receipt and journal facts must validate as a pair;
+  symbolic links expose an effective target kind without losing lexical identity, and Review
+  distinguishes total changed files from its bounded visible page.
+- **Fail-closed release proof.** Failed live canaries, duplicate runtime evidence and lifecycle
+  scripts hidden inside a supposedly safe package-install stage are release blockers.
+
+## What v0.3.3 includes
+
+- **One execution spine, bounded Web Session actors.** Web Sessions use the same product bootstrap,
+  AgentRuntimeController, Session/Thread stores, ToolGateway, approvals, Goals, Plans, Skills and MCP
+  boundaries as the terminal product. Up to three Session turns may run concurrently with four
+  resident actors; the TUI and terminal surfaces keep their single-active-Session contract.
+- **Orion Blocksmith.** A bundled pixel-workshop style combines with system/light/dark themes without
+  remote assets, dynamic theme code or a second settings source. Classic remains available as an
+  explicit built-in style.
 - **Recoverable Web workbench.** The React workbench includes workspace/session navigation,
   transcript and tool activity, BUILD/PLAN/AUTO, follow-ups, interrupt, approvals, Goal/Plan,
   model/effort settings, Skills/MCP and diagnostics. Snapshots plus cursor replay repair refreshes
@@ -88,10 +113,10 @@ user extension boundaries.
 Node.js 22.12+, 24, and 26 are supported. Use Node 24 LTS for production or Node 26 Current for
 current development environments. Node 20 is upstream EOL and is no longer a v0.3 runtime.
 
-After the immutable `0.3.2` npm receipt exists:
+After the immutable `0.3.4` npm receipt exists:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.2
+npm install -g @orion-agents/orion-code@0.3.4
 orion --version
 orion doctor
 ```
@@ -278,10 +303,13 @@ npm run test:web-e2e -- --grep @settings
 
 Release qualification additionally builds one exact tarball and installs that unchanged hash on
 Node 22/24/26 for package identity, native SQLite, TUI, terminal, print, Web, Goal, subagent, Skill,
-MCP, Compact, and resume journeys. WEB32-P0-01..12 additionally qualify the resizable project rail,
-Composer controls, Context, durable Plan review, queue/drafts and recovery/accessibility contract.
-See the [`v0.3.2 Workbench plan`](docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md) and
-[`v0.3.2 E2E qualification plan`](docs/test/v0.3.2-web-workbench-e2e-plan.md).
+MCP, Compact, and resume journeys. WEB33-P0-01..12 qualify the built-in appearance contract, while
+WEB33-P0-16..24 qualify parallel Session actors, foreground-local switching, bounded queues, the
+right rail and the single Settings entry. See the [`v0.3.3 plan`](docs/plan/v0.3.3-plan.md) and
+[`v0.3.3 E2E qualification plan`](docs/test/v0.3.3-web-workbench-e2e-plan.md). The security and
+stabilization delta is defined by the
+[`v0.3.4 test plan`](docs/test/v0.3.4-stabilization-e2e-plan.md), which does not treat source gates
+as release evidence.
 
 ## Security
 

package/README.zh-CN.md

@@ -2,15 +2,19 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.2 候选版本：一套 Orion Runtime，同时提供可调宽本地 Web Workbench、Session 级
-> Composer Control Center 与既有 TUI/terminal。Candidate 源码不代表已创建 npm 发布或 Git tag。
+> v0.3.4 候选版本：对 v0.3.3 多 Session Web Workbench 进行兼容的安全、终端顺序与发布证据
+> 稳定化。Candidate 源码不代表已创建 npm 发布、Git tag 或达到可合并状态。
 
 [English](README.md) ·
-[v0.3.2 Workbench 方案](docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md) ·
-[v0.3.2 Web API](docs/architecture/v0.3.2-web-api.yaml) ·
+[v0.3.4 稳定化方案](docs/plan/v0.3.4-stabilization-plan.md) ·
+[v0.3.4 合同](docs/architecture/v0.3.4-stabilization-contract.md) ·
+[v0.3.4 E2E 方案](docs/test/v0.3.4-stabilization-e2e-plan.md) ·
+[v0.3.4 迁移](docs/migration/v0.3.3-to-v0.3.4.md) ·
+[v0.3.3 方案](docs/plan/v0.3.3-plan.md) ·
+[v0.3.3 Web API](docs/architecture/v0.3.3-web-api.yaml) ·
 [模式/权限合同](docs/architecture/agent-mode-permission-contract.md) ·
-[v0.3.2 E2E 方案](docs/test/v0.3.2-web-workbench-e2e-plan.md) ·
-[v0.3.2 迁移](docs/migration/v0.3.1-to-v0.3.2.md) ·
+[v0.3.3 E2E 方案](docs/test/v0.3.3-web-workbench-e2e-plan.md) ·
+[v0.3.3 迁移](docs/migration/v0.3.2-to-v0.3.3.md) ·
 [v0.3.0 Web 方案](docs/plan/v0.3.0-web-workbench-plan.md) ·
 [Settings 方案](docs/plan/v0.3.0-settings-integration-plan.md) ·
 [Node 兼容方案](docs/plan/v0.3.0-node-runtime-compatibility-plan.md) ·
@@ -19,11 +23,26 @@
 [Settings 迁移](docs/migration/v0.2.2-to-v0.3.0-settings.md) ·
 [真实状态图册](docs/assets/screenshots/v0.3.0-web/README.md)
 
-## v0.3.2 包含什么
-
-- **一个 Runtime、两个交互界面。** `orion web` 与终端产品共用 product bootstrap、
-  AgentRuntimeController、Session/Thread、ToolGateway、审批、Goal、Plan、Skills 和 MCP；浏览器不另起
-  一套 agent loop。
+## v0.3.4 稳定了什么
+
+- **Context 绑定写入。** Settings mutation 现在同时携带活动 Workspace 与 Context revision；陈旧页面
+  不会写入或应用到另一个 Runtime。空 Session 名称和 busy slash command 也会保持持久态与活动回合不变。
+- **统一敏感数据边界。** 结构化凭据、URL userinfo、canonical 文件目标、Git diff 路径、tool artifact
+  和并发命令输出在进入浏览器或证据前统一检查与脱敏。
+- **确定的 Terminal 传输。** PTY 代理对分片、浏览器写入背压与重连竞态都保持完整 Unicode，以及
+  replay、live tail、exit、close 的严格顺序。
+- **诚实的 durable/read 投影。** Tool receipt 与 journal fact 必须成对校验；symlink 在保留 lexical
+  类型的同时投影有效目标类型；Review 将仓库真实总数与有界可见页分开显示。
+- **Fail-closed 发布证据。** live canary 失败、重复 Runtime 证据，或混入“安全安装阶段”的生命周期
+  script 都会阻止发布。
+
+## v0.3.3 包含什么
+
+- **一条执行主干、有界 Web Session actors。** Web Session 与终端产品共用 product bootstrap、
+  AgentRuntimeController、Session/Thread、ToolGateway、审批、Goal、Plan、Skills 和 MCP。Web 最多允许
+  3 个 Session turn 并行、4 个 actor 常驻；TUI/terminal 继续保持单活动 Session 合同。
+- **Orion 方块工坊。** 内置像素工坊风格可与 system/light/dark 组合，不加载远程资产、动态主题代码或
+  第二份 Settings 真相；classic 继续作为显式内置风格提供。
 - **可恢复的 Web 工作台。** React 界面覆盖工作区/会话、对话与工具活动、BUILD/PLAN/AUTO、follow-up、
   interrupt、审批、Goal/Plan、模型/effort、Skills/MCP 和诊断。快照与 cursor replay 负责刷新和 SSE
   重连恢复。
@@ -76,10 +95,10 @@ MCP 仍是用户可见的扩展边界。
 支持 Node.js 22.12+、24 和 26。生产环境建议使用 Node 24 LTS，当前开发环境也支持 Node 26
 Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 
-当 npm 已存在不可变的 `0.3.2` 发布凭据后：
+当 npm 已存在不可变的 `0.3.4` 发布凭据后：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.2
+npm install -g @orion-agents/orion-code@0.3.4
 orion --version
 orion doctor
 ```
@@ -251,9 +270,10 @@ npm run test:web-e2e -- --grep @settings
 
 正式准出还会只构建一次 exact tarball，并在 Node 22/24/26 安装同一个 hash，验证 package identity、
 native SQLite、TUI、terminal、print、Web、Goal、subagent、Skill、MCP、Compact 与 resume；
-WEB32-P0-01..12 还会验证可调项目栏、Composer 控制、Context、durable Plan review、队列/草稿、恢复与
-无障碍合同。详见 [`v0.3.2 Workbench 方案`](docs/plan/v0.3.2-web-workbench-layout-and-composer-plan.md)与
-[`v0.3.2 E2E 资格计划`](docs/test/v0.3.2-web-workbench-e2e-plan.md)。
+WEB33-P0-01..12 验证内置外观合同，WEB33-P0-16..24 验证并行 Session actors、标签页本地前台切换、
+有界队列、右侧 rail 与唯一 Settings 入口。详见 [`v0.3.3 方案`](docs/plan/v0.3.3-plan.md)与
+[`v0.3.3 E2E 资格计划`](docs/test/v0.3.3-web-workbench-e2e-plan.md)。v0.3.4 的安全与稳定化增量见
+[`v0.3.4 测试计划`](docs/test/v0.3.4-stabilization-e2e-plan.md)；它不会把 source gate 当成发布凭据。
 
 ## 安全
 

package/dist/runtime/agent-runtime-controller.d.ts

@@ -132,6 +132,7 @@ export declare class AgentRuntimeController {
     reviewPlan(input: Parameters<NonNullable<import('./agent-runtime-runner').AgentRuntimeRunnerV1['reviewPlan']>>[0]): Promise<import('./plan-review').PlanReviewResolutionReceiptV1>;
     private runTurn;
     private handleRunLoopError;
+    private handleCommandError;
     private synchronizeSettingsAtLogicalBoundary;
     private emitAppend;
     private emitStatus;

package/dist/runtime/agent-runtime-controller.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgentRuntimeController = exports.FollowupQueueConflictError = void 0;
+const async_hooks_1 = require("async_hooks");
 const crypto_1 = require("crypto");
 const commands_1 = require("../commands");
 const parser_1 = require("../commands/parser");
@@ -333,21 +334,7 @@ class AgentRuntimeController {
         }
         if (parsedInput.isCommand) {
             const command = (0, commands_1.findCommand)(parsedInput.name);
-            this.activeRun = this.runCommand(command, parsedInput.args)
-                .catch(error => this.handleRunLoopError(error))
-                .finally(() => {
-                this.activeRun = null;
-            });
-            return { type: 'command_handled' };
-        }
-        if (this.turnController.hasActiveTurn()) {
-            const parsed = (0, parser_1.parseInput)(submitted);
-            if (parsed.isCommand) {
-                const command = (0, commands_1.findCommand)(parsed.name);
-                if (!command) {
-                    this.emitStatus(`Unknown command /${parsed.name}; active turn continues.`);
-                    return { type: 'command_ignored' };
-                }
+            if (this.turnController.hasActiveTurn()) {
                 if (command.busyPolicy === 'reject-busy') {
                     this.emitStatus(`/${command.name} rejected: an agent turn is active.`);
                     return { type: 'command_rejected_busy', commandId: command.id };
@@ -365,6 +352,16 @@ class AgentRuntimeController {
                 this.emitStatus(`Queued /${command.name}; it will apply after the active logical request.`);
                 return { type: 'command_queued', commandId: command.id };
             }
+            const run = this.runCommand(command, parsedInput.args)
+                .catch(error => this.handleCommandError(command, error))
+                .finally(() => {
+                if (this.activeRun === run)
+                    this.activeRun = null;
+            });
+            this.activeRun = run;
+            return { type: 'command_handled' };
+        }
+        if (this.turnController.hasActiveTurn()) {
             this.turnController.clearExitIntent();
             this.turnController.requestRevision(submitted);
             // v0.1.3 (G1): echo the incremental input to the transcript immediately,
@@ -731,6 +728,17 @@ class AgentRuntimeController {
             this.emitStatus(readyStatus);
         this.options.afterTurnLoop?.();
     }
+    handleCommandError(command, error) {
+        const message = (0, style_1.sanitizeTerminalText)((0, redaction_1.redactTraceText)(error instanceof Error ? error.message : String(error)));
+        this.emitAppend({
+            role: 'error',
+            title: `/${command.name}`,
+            content: message,
+            errorLayer: 'runtime',
+            command: commandIdentity(command, false),
+        });
+        this.emitStatus(`/${command.name} failed; the active turn state was not changed.`);
+    }
     async synchronizeSettingsAtLogicalBoundary() {
         const synchronize = this.options.runtime.synchronizeSettings;
         if (!synchronize)
@@ -1076,37 +1084,80 @@ function commandIdentity(command, success) {
     };
 }
 async function captureCommandOutput(execute) {
-    const lines = [];
-    const originalLog = console.log;
-    const originalError = console.error;
-    const originalWarn = console.warn;
-    const capture = (...values) => {
-        const line = values
-            .map(value => {
-            if (typeof value === 'string')
-                return value;
-            try {
-                return JSON.stringify(value);
-            }
-            catch {
-                return String(value);
-            }
-        })
-            .join(' ');
-        lines.push((0, style_1.sanitizeTerminalText)(line));
-    };
-    console.log = capture;
-    console.error = capture;
-    console.warn = capture;
+    const capture = { active: true, lines: [] };
+    acquireCommandConsoleBridge();
     try {
-        return { result: await execute(), output: lines.join('\n').trim() };
+        const result = await commandOutputCaptureStorage.run(capture, execute);
+        return { result, output: capture.lines.join('\n').trim() };
     }
     finally {
-        console.log = originalLog;
-        console.error = originalError;
-        console.warn = originalWarn;
+        capture.active = false;
+        releaseCommandConsoleBridge();
+    }
+}
+const commandOutputCaptureStorage = new async_hooks_1.AsyncLocalStorage();
+let commandConsoleBridgeReferences = 0;
+let commandConsoleOriginalMethods;
+const commandConsoleBridge = {
+    log: (...values) => routeCommandConsole('log', values),
+    error: (...values) => routeCommandConsole('error', values),
+    warn: (...values) => routeCommandConsole('warn', values),
+};
+function acquireCommandConsoleBridge() {
+    if (commandConsoleBridgeReferences === 0) {
+        commandConsoleOriginalMethods = {
+            log: originalConsoleMethod('log'),
+            error: originalConsoleMethod('error'),
+            warn: originalConsoleMethod('warn'),
+        };
+        console.log = commandConsoleBridge.log;
+        console.error = commandConsoleBridge.error;
+        console.warn = commandConsoleBridge.warn;
+    }
+    commandConsoleBridgeReferences += 1;
+}
+function releaseCommandConsoleBridge() {
+    commandConsoleBridgeReferences = Math.max(0, commandConsoleBridgeReferences - 1);
+    if (commandConsoleBridgeReferences !== 0 || !commandConsoleOriginalMethods)
+        return;
+    if (console.log === commandConsoleBridge.log)
+        console.log = commandConsoleOriginalMethods.log;
+    if (console.error === commandConsoleBridge.error)
+        console.error = commandConsoleOriginalMethods.error;
+    if (console.warn === commandConsoleBridge.warn)
+        console.warn = commandConsoleOriginalMethods.warn;
+}
+function originalConsoleMethod(method) {
+    const current = console[method];
+    if (current !== commandConsoleBridge[method] || !commandConsoleOriginalMethods)
+        return current;
+    return commandConsoleOriginalMethods[method];
+}
+function routeCommandConsole(method, values) {
+    const capture = commandOutputCaptureStorage.getStore();
+    if (capture?.active) {
+        capture.lines.push((0, style_1.sanitizeTerminalText)((0, redaction_1.redactTraceText)(formatConsoleValues(values))));
+        return;
+    }
+    const original = commandConsoleOriginalMethods?.[method];
+    if (original && original !== commandConsoleBridge[method]) {
+        Reflect.apply(original, console, values);
     }
 }
+function formatConsoleValues(values) {
+    return values
+        .map(value => {
+        if (typeof value === 'string')
+            return value;
+        try {
+            return JSON.stringify(value) ?? String(value);
+        }
+        catch {
+            return String(value);
+        }
+    })
+        .join(' ');
+}
 function projectFollowupQueueItem(item) {
     return Object.freeze({
         id: item.id,

package/dist/runtime/capability-receipt-journal.js

@@ -223,7 +223,7 @@ function replayAll(store) {
     const events = [];
     let cursor = 0;
     while (true) {
-        const page = store.replay(cursor);
+        const page = store.replay(cursor, undefined, 'capability_receipt_journal');
         events.push(...page.events);
         if (!page.hasMore)
             return events;

package/dist/runtime/durable-tool-receipt-reader.js

@@ -72,7 +72,7 @@ function readItemReceipt(sessionId, store, item) {
     if (!terminalSeq || terminalSeq < 2 || !toolName || !item.receipt) {
         throw new tool_receipt_validator_1.DurableToolReceiptValidationError('Terminal tool projection is missing its canonical receipt identity.');
     }
-    const pair = store.replay(terminalSeq - 2, 2).events;
+    const pair = store.replay(terminalSeq - 2, 2, 'durable_tool_receipt').events;
     const factEvent = pair.find(event => event.seq === terminalSeq - 1);
     const terminalEvent = pair.find(event => event.seq === terminalSeq);
     if (!factEvent || !terminalEvent || terminalEvent.itemId !== item.itemId) {

package/dist/runtime/legacy-thread-materializer.js

@@ -477,7 +477,7 @@ function materializeFacts(threadsDir, plan) {
     if (cursor > plan.events.length) {
         throw diverged(`Existing Thread has ${cursor} events, expected ${plan.events.length}`);
     }
-    const existing = cursor === 0 ? [] : store.replay(0, cursor).events;
+    const existing = cursor === 0 ? [] : store.replay(0, cursor, 'legacy_materializer').events;
     for (let index = 0; index < existing.length; index += 1) {
         if ((0, canonical_1.canonicalRuntimeJson)(existing[index]) !== (0, canonical_1.canonicalRuntimeJson)(plan.events[index])) {
             throw diverged(`Existing Thread diverges from import plan at seq ${index + 1}`);
@@ -490,7 +490,7 @@ function materializeFacts(threadsDir, plan) {
     return store;
 }
 function verifyMaterializedStore(store, plan) {
-    const replay = store.replay(0, Math.max(1, plan.events.length));
+    const replay = store.replay(0, Math.max(1, plan.events.length), 'legacy_materializer');
     if (replay.hasMore ||
         replay.events.length !== plan.events.length ||
         (0, canonical_1.digestRuntimeValue)(replay.events) !== plan.eventDigest) {

package/dist/runtime/orion-runtime-v1.d.ts

@@ -14,7 +14,7 @@ import { PromptRegistryV1 } from './prompts';
 import { ResourceScope, type ResourceScopeCloseReport } from './resource-scope';
 import { type RuntimeContributorSlots, type RuntimeContributors, type RuntimeServicePort, type RuntimeServices, type RuntimeServiceSlots } from './runtime-services';
 import { LazySkillRuntime, type LazySkillRuntimeOptions, type LazySkillRuntimeStatsV1 } from './skills';
-import { ExecutionService, type AuthoritySnapshotV1, type ToolBindingV1 } from './step-snapshot';
+import { ExecutionService, type AuthoritySnapshotV1, type ToolBindingV1, type WorkspaceMutationCoordinatorV1 } from './step-snapshot';
 import { ThreadCompactMaintenanceRunnerV1, ThreadCompactTransactionPersistenceV1, type ThreadCompactMaintenanceRunnerOptionsV1 } from './thread-compact-persistence';
 import { type TaskContextService, type TaskContextServiceOptions } from './task-context-service';
 import { ThreadEventStore, type ThreadEventStoreOptionsV1 } from './thread-event-store';
@@ -116,6 +116,7 @@ export interface OrionRuntimeV1Options {
     readonly mcp: Omit<LazyMcpRuntimeOptions, 'signal'>;
     readonly resolveCapabilityConfiguration: OrionCapabilityConfigurationResolverV1;
     readonly approvalHandler?: FirstPartyApprovalHandlerV1;
+    readonly workspaceMutationCoordinator?: WorkspaceMutationCoordinatorV1;
     readonly contributors?: RuntimeContributorSlots;
     readonly subagents?: OrionSubagentCompositionV1;
     readonly thread?: Omit<ThreadRuntimeOptionsV1, 'store' | 'runner' | 'maintenanceRunner' | 'projectPath' | 'requireTurnCommit'>;

package/dist/runtime/orion-runtime-v1.js

@@ -82,22 +82,24 @@ class OrionRuntimeV1 {
         const projection = graph.thread.getProjection();
         const admission = graph.thread.getAdmissionSnapshot();
         const eventCursor = graph.eventStore.getCursor();
-        const recent = graph.eventStore.replay(Math.max(0, eventCursor - 256), 256).events;
-        const latestCapabilityEvent = [...recent]
-            .reverse()
-            .find(event => event.payload.type === 'capability.receipt');
-        const latestSnapshotEvent = [...recent]
-            .reverse()
-            .find(event => event.payload.type === 'step.snapshot');
-        const latestCommitEvent = [...recent]
-            .reverse()
-            .find(event => event.payload.type === 'turn.committed');
-        const latestCompactEvent = [...recent]
-            .reverse()
-            .find(event => event.payload.type.startsWith('compact.'));
+        const legacyRecent = projection.diagnosticEvents && projection.compactEvents
+            ? []
+            : graph.eventStore.replay(Math.max(0, eventCursor - 256), 256, 'runtime_diagnostics_legacy')
+                .events;
+        const latestCapabilityEvent = projection.diagnosticEvents?.latestCapability ??
+            [...legacyRecent].reverse().find(event => event.payload.type === 'capability.receipt');
+        const latestSnapshotEvent = projection.diagnosticEvents?.latestStepSnapshot ??
+            [...legacyRecent].reverse().find(event => event.payload.type === 'step.snapshot');
+        const latestCommitProjection = Object.values(projection.turns)
+            .map(turn => turn.commit)
+            .filter((commit) => Boolean(commit))
+            .sort((left, right) => left.seq - right.seq)
+            .at(-1);
+        const latestCompactEvent = projection.compactEvents?.at(-1) ??
+            [...legacyRecent].reverse().find(event => event.payload.type.startsWith('compact.'));
         const capability = parseCapabilityDiagnostics(latestCapabilityEvent, latestSnapshotEvent);
-        const latestCommit = latestCommitEvent?.payload.type === 'turn.committed'
-            ? (0, turn_commit_1.parseTurnCommitV1)(latestCommitEvent.payload.data.receipt)
+        const latestCommit = latestCommitProjection
+            ? (0, turn_commit_1.parseTurnCommitV1)(latestCommitProjection.receipt)
             : undefined;
         const task = graph.taskContext.snapshot();
         const activeTurn = projection.activeTurnId
@@ -354,7 +356,7 @@ class OrionRuntimeV1 {
             });
             const approval = new first_party_tool_services_1.FirstPartyToolApprovalServiceV1(this.options.approvalHandler);
             const sandbox = new first_party_tool_services_1.FirstPartySandboxServiceV1();
-            const execution = new step_snapshot_1.ExecutionService();
+            const execution = new step_snapshot_1.ExecutionService(this.options.workspaceMutationCoordinator);
             const toolJournal = new thread_tool_journal_1.ThreadToolInvocationJournalV1(eventStore);
             const gateway = new tool_gateway_1.ToolGateway({
                 policy,

package/dist/runtime/orion-session-runner.d.ts

@@ -27,6 +27,7 @@ export declare class OrionSessionRunnerV1 implements AgentRuntimeRunnerV1 {
     private transition;
     private readonly backgroundDrains;
     private closed;
+    private closeFlight?;
     constructor(options: OrionSessionRunnerOptionsV1);
     runInput(input: string, options?: AgentRuntimeRunInputOptionsV1): Promise<void>;
     runRequest(request: AgentTurnRequest, options?: AgentRuntimeRunInputOptionsV1): Promise<void>;
@@ -38,6 +39,7 @@ export declare class OrionSessionRunnerV1 implements AgentRuntimeRunnerV1 {
     reviewPlan(input: Parameters<typeof resolvePlanReviewV1>[1]): Promise<ReturnType<typeof resolvePlanReviewV1>>;
     interrupt(reason?: string): void;
     close(reason?: string): Promise<void>;
+    private performClose;
     private ensureActive;
     private switchTo;
     private closeActive;

package/dist/runtime/orion-session-runner.js

@@ -99,10 +99,14 @@ class OrionSessionRunnerV1 {
     interrupt(reason = 'user interrupted') {
         this.active?.adapter.interrupt(reason);
     }
-    async close(reason = 'session runner closed') {
-        if (this.closed)
-            return;
+    close(reason = 'session runner closed') {
+        if (this.closeFlight)
+            return this.closeFlight;
         this.closed = true;
+        this.closeFlight = this.performClose(reason);
+        return this.closeFlight;
+    }
+    async performClose(reason) {
         const transitioning = this.transition;
         if (transitioning) {
             try {
@@ -161,7 +165,11 @@ class OrionSessionRunnerV1 {
             return;
         active.disposeObserver?.();
         active.adapter.close(reason);
-        await active.runtime.close(reason);
+        const report = await active.runtime.close(reason);
+        if (report.timedOut || report.leaseTimedOut || report.errors.length > 0) {
+            throw new Error(`Orion Session Runtime cleanup was incomplete (${report.errors.length} error(s), ` +
+                `timedOut=${report.timedOut}, leaseTimedOut=${report.leaseTimedOut}).`);
+        }
     }
     async drainUntilIdle(active) {
         let idle = false;

package/dist/runtime/product-bootstrap.d.ts

@@ -3,6 +3,8 @@ import { type SettingsInvalidationV1 } from '../services/settings-coordinator';
 import type { OrionRuntimeV1 } from './orion-runtime-v1';
 import type { ThreadSessionRuntimeActivationV1 } from './thread-session-view';
 import type { OrionCodeUiRuntime } from './ui-events';
+import type { WorkspaceMutationCoordinatorV1 } from './step-snapshot';
+import { WorkspaceRuntimeKernelV1 } from './workspace-runtime-kernel';
 export interface ProductUiRuntimeBootstrapOptions {
     readonly cwd: string;
     readonly uiRenderer?: UIRenderer;
@@ -11,6 +13,10 @@ export interface ProductUiRuntimeBootstrapOptions {
     readonly onActiveSessionRuntime?: (runtime: OrionRuntimeV1, sessionId: string, activation?: ThreadSessionRuntimeActivationV1) => void | (() => void);
     /** Secret-free Settings invalidations projected by the renderer-owned host. */
     readonly onSettingsInvalidated?: (event: SettingsInvalidationV1) => void;
+    /** Optional Web-hosted FIFO for side effects shared by concurrent Session actors. */
+    readonly workspaceMutationCoordinator?: WorkspaceMutationCoordinatorV1;
+    /** Workspace-owned resources reused by Web Session actors. */
+    readonly workspaceRuntimeKernel?: WorkspaceRuntimeKernelV1;
 }
 /**
  * Shared product composition root for TUI, terminal, print and Web surfaces.