@overdeck/desktop 0.45.7 → 0.45.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overdeck/desktop",
-  "version": "0.45.7",
+  "version": "0.45.8",
   "description": "Overdeck Command Deck — AI agent monitoring desktop app",
   "publishConfig": {
     "access": "public"
@@ -45,6 +45,7 @@
     "electron": "40.6.0"
   },
   "devDependencies": {
+    "@electron/notarize": "^2.5.0",
     "@overdeck/contracts": "workspace:*",
     "@types/node": "^22.0.0",
     "electron-builder": "^25.1.8",
@@ -105,7 +106,12 @@
         }
       ],
       "icon": "resources/icon.png",
-      "category": "public.app-category.developer-tools"
+      "category": "public.app-category.developer-tools",
+      "hardenedRuntime": true,
+      "gatekeeperAssess": false,
+      "entitlements": "build/entitlements.mac.plist",
+      "entitlementsInherit": "build/entitlements.mac.plist",
+      "notarize": false
     },
     "dmg": {
       "title": "Overdeck",
@@ -126,6 +132,7 @@
       "oneClick": false,
       "allowToChangeInstallationDirectory": true
     },
-    "afterPack": "scripts/afterPack.cjs"
+    "afterPack": "scripts/afterPack.cjs",
+    "afterSign": "scripts/notarize.cjs"
   }
 }

package/server/{acceptance-criteria-DYffaKI9.js → acceptance-criteria-l0DSvFFS.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { b as init_types, o as init_io, x as subItemsOf } from "./io-DtAQ_2hp.js";
+import { b as init_types, o as init_io, x as subItemsOf } from "./io-Wy8YpFeP.js";
 import "effect";
 //#region ../../lib/vbrief/acceptance-criteria.ts
 /**
@@ -30,4 +30,4 @@ var init_acceptance_criteria = __esmMin((() => {
 //#endregion
 export { init_acceptance_criteria as n, extractACFromDocument as t };
 
-//# sourceMappingURL=acceptance-criteria-DYffaKI9.js.map
+//# sourceMappingURL=acceptance-criteria-l0DSvFFS.js.map

package/server/{activity-logger-DO27GsPa.js → activity-logger-DvYvFhwZ.js}

@@ -1,3 +1,3 @@
-import { a as init_activity_logger, n as emitActivityEntrySync, r as emitActivityTtsSync } from "./activity-logger-Dm95Ua07.js";
+import { a as init_activity_logger, n as emitActivityEntrySync, r as emitActivityTtsSync } from "./activity-logger-pcbf-e30.js";
 init_activity_logger();
 export { emitActivityEntrySync, emitActivityTtsSync };

package/server/{activity-logger-Dm95Ua07.js → activity-logger-pcbf-e30.js}

@@ -56,7 +56,8 @@ function emitActivityEntrySync(options) {
 			message: options.message,
 			details: options.details,
 			issueId: options.issueId,
-			link: options.link
+			link: options.link,
+			desktop: options.desktop
 		}
 	});
 }
@@ -186,4 +187,4 @@ var init_activity_logger = __esmMin((() => {
 //#endregion
 export { init_activity_logger as a, emitDashboardLifecycleSync as i, emitActivityEntrySync as n, setActivityEventStoreProvider as o, emitActivityTtsSync as r, emitActivityDetailedSync as t };
 
-//# sourceMappingURL=activity-logger-Dm95Ua07.js.map
+//# sourceMappingURL=activity-logger-pcbf-e30.js.map

package/server/{advancing-selfheal-n8tAeFwE.js → advancing-selfheal-CMlGznKv.js}

@@ -1,13 +1,14 @@
-import { O as listSessionNames, w as killSession, x as init_tmux } from "./tmux-CBYZ5lKF.js";
-import { c as init_review_status, s as getReviewStatusSync, u as loadReviewStatuses } from "./review-status-DWAsTqfJ.js";
-import { Jn as saveAgentStateSync, Pn as getAgentStateSync, Vn as markAgentStoppedState, er as init_persistent_logger, mr as getAgentRuntimeStateSync, nr as logDeaconEventSync, t as init_agents } from "./agents-D_x5BSZM.js";
-import { l as selectNonMergedTerminalAdvancingSessions, r as isIdlePastThreshold, s as selectMergedAdvancingSessions, u as selectTerminalAdvancingSessions } from "./reap-terminal-sessions-C6rD1pDT.js";
+import { O as listSessionNames, w as killSession, x as init_tmux } from "./tmux-ePNhMIMU.js";
+import { c as init_review_status, s as getReviewStatusSync, u as loadReviewStatuses } from "./review-status-BQjqQXZG.js";
+import { Jn as saveAgentStateSync, Pn as getAgentStateSync, Vn as markAgentStoppedState, er as init_persistent_logger, nr as logDeaconEventSync, t as init_agents } from "./agents-DHvsjsuP.js";
+import { o as selectMergedAdvancingSessions, t as init_reap_terminal_sessions } from "./reap-terminal-sessions-CAmURC2h.js";
 import { Effect } from "effect";
 //#region ../../lib/cloister/advancing-selfheal.ts
 init_agents();
 init_persistent_logger();
 init_review_status();
 init_tmux();
+init_reap_terminal_sessions();
 const JOURNAL_RECONCILE_STATES = new Set([
 	"pending",
 	"reviewing",
@@ -84,33 +85,11 @@ function markAdvancingSessionStopped(session, deps = defaultDeps) {
 	return true;
 }
 /**
-* PAN-1716: Reap completed advancing-role sessions that have a recorded
-* terminal verdict but are still tmux-alive.
-*/
-async function checkTerminalAdvancingSessions() {
-	const actions = [];
-	try {
-		const toKill = selectTerminalAdvancingSessions(loadReviewStatuses(), [...await Effect.runPromise(listSessionNames())]);
-		for (const session of toKill) try {
-			await Effect.runPromise(killSession(session));
-			actions.push(`Reaped terminal advancing session ${session} (verdict recorded, session idle)`);
-			console.log(`[deacon] Reaped terminal advancing session ${session} (PAN-1716)`);
-			logDeaconEventSync(`checkTerminalAdvancingSessions: reaped ${session} — phase verdict terminal but session alive (PAN-1716)`);
-		} catch (err) {
-			console.warn(`[deacon] Failed to reap terminal session ${session}: ${err instanceof Error ? err.message : String(err)}`);
-		}
-	} catch (error) {
-		const msg = error instanceof Error ? error.message : String(error);
-		console.error("[deacon] Error reaping terminal advancing sessions:", msg);
-	}
-	return actions;
-}
-/**
 * PAN-2341: Reap advancing-role sessions for already-merged issues.
 *
-* KEEP_SPECIALIST_SESSIONS_ALIVE can intentionally leave review/test/ship panes
-* visible, but once the issue is merged those sessions have no remaining role in
-* the pipeline and still occupy the advancing ceiling. Kill the tmux session and
+* The warm-by-default lifecycle (PAN-2579) intentionally leaves review/test/ship
+* panes alive, but once the issue is MERGED those sessions have no remaining role
+* in the pipeline (close-out territory). Kill the tmux session and
 * mark the agents-table row stopped so countRunningAgents() frees the slot.
 */
 async function checkMergedAdvancingSessions() {
@@ -134,48 +113,14 @@ async function checkMergedAdvancingSessions() {
 	}
 	return actions;
 }
-/**
-* PAN-2341: Reap non-merged terminal advancing sessions after a short idle
-* window. This bypasses specialist keep-alive only after the pane has sat idle
-* long enough for operator inspection, then marks the agents row stopped so the
-* advancing ceiling frees in the same patrol.
-*/
-async function checkIdleTerminalAdvancingSessions() {
-	const actions = [];
-	try {
-		const candidates = selectNonMergedTerminalAdvancingSessions(loadReviewStatuses(), [...await Effect.runPromise(listSessionNames())]);
-		const now = Date.now();
-		for (const session of candidates) {
-			if (!isIdlePastThreshold(getAgentRuntimeStateSync(session), 6e5, now)) continue;
-			try {
-				await Effect.runPromise(killSession(session));
-			} catch (err) {
-				console.warn(`[deacon] Failed to reap idle terminal advancing session ${session}: ${err instanceof Error ? err.message : String(err)}`);
-			}
-			const markedStopped = markAdvancingSessionStopped(session);
-			actions.push(markedStopped ? `Reaped idle terminal advancing session ${session} (verdict recorded, idle >=10m, row stopped)` : `Reaped idle terminal advancing session ${session} (verdict recorded, idle >=10m)`);
-			console.log(`[deacon] Reaped idle terminal advancing session ${session} (PAN-2341)`);
-			logDeaconEventSync(`checkIdleTerminalAdvancingSessions: reaped ${session} — terminal verdict idle >=10m (PAN-2341)`);
-		}
-	} catch (error) {
-		const msg = error instanceof Error ? error.message : String(error);
-		console.error("[deacon] Error reaping idle terminal advancing sessions:", msg);
-	}
-	return actions;
-}
 const defaultBootAdvancingSelfHealDeps = {
 	reconcileInFlightJournals,
 	checkMergedAdvancingSessions,
-	checkIdleTerminalAdvancingSessions,
 	log: logDeaconEventSync
 };
 async function runBootAdvancingSelfHeal(deps = defaultBootAdvancingSelfHealDeps) {
 	const actions = [];
-	const steps = [
-		["reconcileInFlightJournals", deps.reconcileInFlightJournals],
-		["checkMergedAdvancingSessions", deps.checkMergedAdvancingSessions],
-		["checkIdleTerminalAdvancingSessions", deps.checkIdleTerminalAdvancingSessions]
-	];
+	const steps = [["reconcileInFlightJournals", deps.reconcileInFlightJournals], ["checkMergedAdvancingSessions", deps.checkMergedAdvancingSessions]];
 	for (const [name, step] of steps) try {
 		const stepActions = await step();
 		actions.push(...stepActions);
@@ -187,6 +132,6 @@ async function runBootAdvancingSelfHeal(deps = defaultBootAdvancingSelfHealDeps)
 	return actions;
 }
 //#endregion
-export { checkIdleTerminalAdvancingSessions, checkMergedAdvancingSessions, checkTerminalAdvancingSessions, reconcileInFlightJournals, runBootAdvancingSelfHeal };
+export { checkMergedAdvancingSessions, markAdvancingSessionStopped, reconcileInFlightJournals, runBootAdvancingSelfHeal };
 
-//# sourceMappingURL=advancing-selfheal-n8tAeFwE.js.map
+//# sourceMappingURL=advancing-selfheal-CMlGznKv.js.map

package/server/{agent-gc-CIFaa2vJ.js → agent-gc-BtAzj8QN.js}

@@ -1,5 +1,5 @@
-import { Mt as readIssueRecordForWorkspaceSync, Ot as init_record } from "./config-yaml-DbdN9Fuq.js";
-import { d as init_agents, m as removeAgentSync, p as listAllAgentsSync } from "./briefing-freshness-B3YxHQ-L.js";
+import { Mt as readIssueRecordForWorkspaceSync, Ot as init_record } from "./config-yaml-DPAieL_G.js";
+import { d as init_agents, m as removeAgentSync, p as listAllAgentsSync } from "./briefing-freshness-CXhZdnB8.js";
 //#region ../../lib/cloister/agent-gc.ts
 init_agents();
 init_record();
@@ -25,4 +25,4 @@ function pruneTerminalStoppedAgents() {
 //#endregion
 export { pruneTerminalStoppedAgents as n, pruneStoppedAgentsForIssue as t };
 
-//# sourceMappingURL=agent-gc-CIFaa2vJ.js.map
+//# sourceMappingURL=agent-gc-BtAzj8QN.js.map

package/server/{agent-state-service-BqVDA9b8.js → agent-state-service-5ge9xxhx.js}

@@ -1,6 +1,6 @@
-import { Br as getOverdeckHome, Vr as init_paths } from "./config-yaml-DbdN9Fuq.js";
-import { a as init_event_store, i as initEventStore } from "./event-store-DrfTJZ1_.js";
-import { l as INITIAL_READ_MODEL_STATE, t as init_src, u as applyEvent } from "./src-AXK4mjue.js";
+import { Br as getOverdeckHome, Vr as init_paths } from "./config-yaml-DPAieL_G.js";
+import { a as init_event_store, i as initEventStore } from "./event-store-DTJXZjCl.js";
+import { l as INITIAL_READ_MODEL_STATE, t as init_src, u as applyEvent } from "./src-fgbU-jJ-.js";
 import { a as setAgentRuntimeMirror, i as markAgentStateServiceInProcess, n as init_agent_runtime_mirror, t as getRuntimeSnapshot$1 } from "./agent-runtime-mirror-DrWxopNA.js";
 import { Context, Effect, Layer, SubscriptionRef } from "effect";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -101,7 +101,7 @@ const AgentStateServiceLive = Layer.effect(AgentStateService, Effect.gen(functio
 	const store = yield* Effect.promise(() => initEventStore());
 	const ref = yield* SubscriptionRef.make({});
 	const seedFromSources = Effect.gen(function* () {
-		const { reconstructCacheAuto } = yield* Effect.promise(() => import("./reconstruct-cache--H2QBooC.js"));
+		const { reconstructCacheAuto } = yield* Effect.promise(() => import("./reconstruct-cache-_tDZ2D72.js"));
 		const seeded = (yield* Effect.promise(() => reconstructCacheAuto())).agentRuntimeById;
 		if (Object.keys(seeded).length > 0) {
 			yield* SubscriptionRef.update(ref, (current) => mergeRuntimeBySequence(current, seeded));
@@ -150,4 +150,4 @@ function applyEventToRef(ref, ev) {
 //#endregion
 export { AgentStateServiceLive as n, getRuntimeSnapshot as r, AgentStateService as t };
 
-//# sourceMappingURL=agent-state-service-BqVDA9b8.js.map
+//# sourceMappingURL=agent-state-service-5ge9xxhx.js.map

package/server/{agent-state-service-CLifyinO.js → agent-state-service-C1iUF9Ft.js}

@@ -1,2 +1,2 @@
-import { n as AgentStateServiceLive, r as getRuntimeSnapshot, t as AgentStateService } from "./agent-state-service-BqVDA9b8.js";
+import { n as AgentStateServiceLive, r as getRuntimeSnapshot, t as AgentStateService } from "./agent-state-service-5ge9xxhx.js";
 export { AgentStateService, AgentStateServiceLive, getRuntimeSnapshot };

package/server/agent-state-xk_G8t90.js

@@ -0,0 +1,3 @@
+import { Dn as clearAgentTroubledSync, Fn as init_agent_state, Pn as getAgentStateSync, Tn as clearAgentPausedSync, Xn as setAgentPausedSync } from "./agents-DHvsjsuP.js";
+init_agent_state();
+export { clearAgentPausedSync, clearAgentTroubledSync, getAgentStateSync, setAgentPausedSync };

package/server/{agents-KaEsWZ8D.js → agents-BIggLvi_.js}

@@ -1,3 +1,3 @@
-import { $ as warnOnBareNumericIssueIds, $n as writeAgentStateJsonSync, $t as waitForPromptReady, An as getAgentDir, Bn as markAgentRunningState, C as restartAgent, Cn as __testInternals, Ct as deliverAgentPermissionDecision, Dn as clearAgentTroubledSync, E as resumeAgent, En as clearAgentTroubled, Et as setAgentDeliveryMethod, F as getActivity, Gt as getAgentRuntimeBaseCommand, Hn as markAgentTroubled, I as getLatestSessionId, In as isAgentPaused, It as retrieveSpawnTimeMemoryContext, J as dropLegacyAgentStatesMissingRoleAsync, Jn as saveAgentStateSync, Jt as getProviderAuthMode, K as stopAgent, Kn as resetAgentFailureCount, L as getLatestSessionIdSync, Ln as isAgentTroubled, Lt as transitionIssueToInProgress, Mn as getAgentState, Mt as assertWorkspaceStackHealthyForSpawn, Nn as getAgentStateFilePath, Nt as buildAgentLaunchConfig, On as clearYieldForResumeSync, P as appendActivity, Pn as getAgentStateSync, Q as listRunningAgentsSync, Qn as wipeAgentStateDirs, Qt as roleAgentDefinitionPath, R as getSessionId, Rn as isRole, Rt as transitionIssueToInReview, S as recoverAgent, Sn as SESSION_EXITED_BEFORE_KICKOFF, St as deliverAgentMessage, Tn as clearAgentPausedSync, Tt as deliverResumeMessageWithTranscriptConfirmation, U as spawnAgent, Un as recordAgentFailure, Ut as OHMYPI_AGENT_READY_TIMEOUT_SECONDS, Vn as markAgentStoppedState, W as spawnRun, Wn as recordAgentFailureSync, Wt as describeOhmypiSpawnFailure, X as listAgentStates, Xn as setAgentPausedSync, Yn as setAgentPaused, Yt as getRoleRuntimeBaseCommand, Z as listRunningAgents, Zn as setAgentYieldedSync, Zt as injectPiConversationMemory, _n as decideChannelsForWorkAgent, a as replayStandingAgent, b as autoRecoverAgents, bn as writeChannelsBridgeMcpConfig, cn as determineModel, cr as isQualifiedAgentId, dn as getProviderTmuxFlags, dr as waitForAgentIdle, fr as waitForReadySignal, gn as buildDefaultResumeContinueMessage, gr as saveAgentRuntimeState, i as replayCrashedStandingAgent, j as messageAgent, ln as getProviderEnvForModel, lr as normalizeAgentId, mr as getAgentRuntimeStateSync, n as compactAtTierRunBoundary, o as shouldReplayCompactAtTierRunBoundary, on as buildCavemanExports, pr as getAgentRuntimeState, q as stopAgentSync, qn as saveAgentState, r as contextWindowForModel, sn as buildSpawnEnvForModel, sr as clearReadySignal, t as init_agents, un as getProviderExportsForModel, ur as resolveAgentTargetSync, vn as decideSupervisorForWorkAgent, w as buildCompactRecoverySeed, wn as clearAgentPaused, wt as deliverInitialPromptWithRetry, x as detectCrashedAgents, xn as GOVERNOR_SLOT_PAUSE_REASON_PREFIX, yn as dismissDevChannelsDialog, z as saveSessionId } from "./agents-D_x5BSZM.js";
+import { $ as warnOnBareNumericIssueIds, $n as writeAgentStateJsonSync, $t as waitForPromptReady, An as getAgentDir, Bn as markAgentRunningState, C as restartAgent, Cn as __testInternals, Ct as deliverAgentPermissionDecision, Dn as clearAgentTroubledSync, E as resumeAgent, En as clearAgentTroubled, Et as setAgentDeliveryMethod, F as getActivity, Gt as getAgentRuntimeBaseCommand, Hn as markAgentTroubled, I as getLatestSessionId, In as isAgentPaused, It as retrieveSpawnTimeMemoryContext, J as dropLegacyAgentStatesMissingRoleAsync, Jn as saveAgentStateSync, Jt as getProviderAuthMode, K as stopAgent, Kn as resetAgentFailureCount, L as getLatestSessionIdSync, Ln as isAgentTroubled, Lt as transitionIssueToInProgress, Mn as getAgentState, Mt as assertWorkspaceStackHealthyForSpawn, Nn as getAgentStateFilePath, Nt as buildAgentLaunchConfig, On as clearYieldForResumeSync, P as appendActivity, Pn as getAgentStateSync, Q as listRunningAgentsSync, Qn as wipeAgentStateDirs, Qt as roleAgentDefinitionPath, R as getSessionId, Rn as isRole, Rt as transitionIssueToInReview, S as recoverAgent, Sn as SESSION_EXITED_BEFORE_KICKOFF, St as deliverAgentMessage, Tn as clearAgentPausedSync, Tt as deliverResumeMessageWithTranscriptConfirmation, U as spawnAgent, Un as recordAgentFailure, Ut as OHMYPI_AGENT_READY_TIMEOUT_SECONDS, Vn as markAgentStoppedState, W as spawnRun, Wn as recordAgentFailureSync, Wt as describeOhmypiSpawnFailure, X as listAgentStates, Xn as setAgentPausedSync, Yn as setAgentPaused, Yt as getRoleRuntimeBaseCommand, Z as listRunningAgents, Zn as setAgentYieldedSync, Zt as injectPiConversationMemory, _n as decideChannelsForWorkAgent, a as replayStandingAgent, b as autoRecoverAgents, bn as writeChannelsBridgeMcpConfig, cn as determineModel, cr as isQualifiedAgentId, dn as getProviderTmuxFlags, dr as waitForAgentIdle, fr as waitForReadySignal, gn as buildDefaultResumeContinueMessage, gr as saveAgentRuntimeState, i as replayCrashedStandingAgent, j as messageAgent, ln as getProviderEnvForModel, lr as normalizeAgentId, mr as getAgentRuntimeStateSync, n as compactAtTierRunBoundary, o as shouldReplayCompactAtTierRunBoundary, on as buildCavemanExports, pr as getAgentRuntimeState, q as stopAgentSync, qn as saveAgentState, r as contextWindowForModel, sn as buildSpawnEnvForModel, sr as clearReadySignal, t as init_agents, un as getProviderExportsForModel, ur as resolveAgentTargetSync, vn as decideSupervisorForWorkAgent, w as buildCompactRecoverySeed, wn as clearAgentPaused, wt as deliverInitialPromptWithRetry, x as detectCrashedAgents, xn as GOVERNOR_SLOT_PAUSE_REASON_PREFIX, yn as dismissDevChannelsDialog, z as saveSessionId } from "./agents-DHvsjsuP.js";
 init_agents();
 export { GOVERNOR_SLOT_PAUSE_REASON_PREFIX, OHMYPI_AGENT_READY_TIMEOUT_SECONDS, SESSION_EXITED_BEFORE_KICKOFF, __testInternals, appendActivity, assertWorkspaceStackHealthyForSpawn, autoRecoverAgents, buildAgentLaunchConfig, buildCavemanExports, buildCompactRecoverySeed, buildDefaultResumeContinueMessage, buildSpawnEnvForModel, clearAgentPaused, clearAgentPausedSync, clearAgentTroubled, clearAgentTroubledSync, clearReadySignal, clearYieldForResumeSync, compactAtTierRunBoundary, contextWindowForModel, decideChannelsForWorkAgent, decideSupervisorForWorkAgent, deliverAgentMessage, deliverAgentPermissionDecision, deliverInitialPromptWithRetry, deliverResumeMessageWithTranscriptConfirmation, describeOhmypiSpawnFailure, detectCrashedAgents, determineModel, dismissDevChannelsDialog, dropLegacyAgentStatesMissingRoleAsync, getActivity, getAgentDir, getAgentRuntimeBaseCommand, getAgentRuntimeState, getAgentRuntimeStateSync, getAgentState, getAgentStateFilePath, getAgentStateSync, getLatestSessionId, getLatestSessionIdSync, getProviderAuthMode, getProviderEnvForModel, getProviderExportsForModel, getProviderTmuxFlags, getRoleRuntimeBaseCommand, getSessionId, injectPiConversationMemory, isAgentPaused, isAgentTroubled, isQualifiedAgentId, isRole, listAgentStates, listRunningAgents, listRunningAgentsSync, markAgentRunningState, markAgentStoppedState, markAgentTroubled, messageAgent, normalizeAgentId, recordAgentFailure, recordAgentFailureSync, recoverAgent, replayCrashedStandingAgent, replayStandingAgent, resetAgentFailureCount, resolveAgentTargetSync, restartAgent, resumeAgent, retrieveSpawnTimeMemoryContext, roleAgentDefinitionPath, saveAgentRuntimeState, saveAgentState, saveAgentStateSync, saveSessionId, setAgentDeliveryMethod, setAgentPaused, setAgentPausedSync, setAgentYieldedSync, shouldReplayCompactAtTierRunBoundary, spawnAgent, spawnRun, stopAgent, stopAgentSync, transitionIssueToInProgress, transitionIssueToInReview, waitForAgentIdle, waitForPromptReady, waitForReadySignal, warnOnBareNumericIssueIds, wipeAgentStateDirs, writeAgentStateJsonSync, writeChannelsBridgeMcpConfig };