@paigy/harness 0.3.0 → 0.3.1

package/dist/main.js

@@ -11100,7 +11100,7 @@ var NotifyRequestSchema = external_exports.object({
   if (r.ask !== void 0) {
     for (const f of ["context", "select", "points"]) {
       if (r[f] !== void 0)
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [f], message: `the simplified \`ask\` form takes no ${f} \u2014 the broker derives it (use \`needs\` for multi-part asks)` });
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [f], message: `the simplified \`ask\` form takes no ${f} \u2014 the broker derives the answer shape from your prose. Drop ${f} and say it in \`ask\` instead ("should I\u2026" for approve/deny, "which of these\u2026" for a pick), passing \`options\` when you're offering concrete alternatives.` });
     }
     return;
   }
@@ -11373,7 +11373,13 @@ var NotifyPlanUnitSchema = external_exports.object({
   proposal: external_exports.object({
     select: SelectShapeSchema,
     options: external_exports.array(external_exports.object({ label: external_exports.string().min(1) })).optional()
-  }).optional()
+  }).optional(),
+  /** What the broker READ this unit as wanting from the human (#952 layer 2): a `decision`
+   *  between alternatives, an `approval` the agent is blocked on, or `knowledge` it just
+   *  needs to know. Reported so the agent can correct a misread the same way it ratifies a
+   *  shape — the read RAISES (a decision always asks) and never silences a question the
+   *  agent declared (#731, #923). */
+  wants: external_exports.enum(["decision", "approval", "knowledge"]).optional()
 });
 var NotifyPlanSchema = external_exports.object({
   units: external_exports.array(NotifyPlanUnitSchema),
@@ -11620,6 +11626,15 @@ var HistoryItemSchema = external_exports.object({
   /** When you answered the agent's notification (agent→user only). */
   humanAckedAt: external_exports.string().nullable()
 });
+var ACTIVITY_LINES = 2;
+var ACTIVITY_LINE_MAX = 80;
+var AgentActivitySchema = external_exports.object({
+  /** Oldest first, so the newest line is last — the one that replaces in place. */
+  lines: external_exports.array(external_exports.string().max(ACTIVITY_LINE_MAX)).max(ACTIVITY_LINES),
+  /** When the harness observed this tail. Its own timestamp, not the heartbeat's: a beat
+   *  that carries an UNCHANGED tail must not make a stalled agent look like it just moved. */
+  at: external_exports.string().datetime()
+});
 var ConnectionSummarySchema = external_exports.object({
   /** The connection = the agent's token id (used to address a request). */
   id: external_exports.string(),
@@ -11653,6 +11668,11 @@ var ConnectionSummarySchema = external_exports.object({
     harnesses: external_exports.array(external_exports.object({ name: external_exports.string(), label: external_exports.string(), status: external_exports.string() })).optional(),
     workspaces: external_exports.array(external_exports.string()).optional()
   }).optional(),
+  /** The tail of this agent's working log, when a harness is driving it — the agent page's
+   *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
+   *  used straight from a terminal emits no work events; the page says so rather than
+   *  drawing an empty box). */
+  activity: AgentActivitySchema.optional(),
   /** True = a provider-managed agent running in the provider's cloud (e.g. Anthropic CMA);
    *  false = a local MCP connection running on the user's computer (Claude Code/Codex/…). */
   managed: external_exports.boolean()
@@ -12475,10 +12495,14 @@ async function claimSessions(opts = {}) {
   return (await res.json()).sessions;
 }
 async function heartbeat(runtime, opts = {}) {
+  const body = {
+    ...runtime !== void 0 ? { runtime } : {},
+    ...opts.activity !== void 0 ? { activity: opts.activity } : {}
+  };
   const res = ensureAuthed(await reach(`${BACKEND_URL}/api/presence`, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
-    ...runtime !== void 0 ? { body: JSON.stringify({ runtime }) } : {}
+    ...Object.keys(body).length > 0 ? { body: JSON.stringify(body) } : {}
   }));
   if (!res.ok) throw new Error(`heartbeat failed: ${res.status}`);
 }
@@ -12632,499 +12656,202 @@ function resolveWakeDir(pinned, deps) {
   return listWorkspaces(deps)[0];
 }
 
-// src/harness/session.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { resolve as resolve2, delimiter as delimiter2 } from "path";
-
-// src/harness/acp.ts
-var none = { events: [], writes: [] };
-function optionFor(options, decision) {
-  const want = decision.allow ? "allow_once" : "reject_once";
-  return options.find((o) => o.kind === want)?.optionId ?? null;
-}
-function createAcpDriver(opts) {
-  return new AcpDriver(opts.cwd, opts.mode, opts.mcp ?? []);
-}
-var AcpDriver = class {
-  constructor(cwd, mode, mcp = []) {
-    this.cwd = cwd;
-    this.mode = mode;
-    this.mcp = mcp;
+// ../../packages/schema/dist/index.js
+var ContextSchema2 = external_exports.object({
+  title: external_exports.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
+  description: external_exports.array(external_exports.string().min(1)).describe(
+    "Semantic chunks of detail (each a standalone, non-empty piece). The user can select chunks to ask you to expand. MAY BE EMPTY: a claim whose whole content is its heading \u2014 a single sentence \u2014 has no body, and saying so beats repeating the heading underneath itself. That repeat is what `min(1)` used to force, at 2x the storage, with every reader subtracting it back out at render time."
+  )
+});
+var ParticipantSchema2 = external_exports.object({
+  kind: external_exports.enum(["human", "agent"]),
+  id: external_exports.string()
+});
+var TransformSchema2 = external_exports.enum([
+  "structure",
+  // shape intent into an answer contract; pick channel/urgency — broker `ask`, `select` shapes, `points`
+  "request_more",
+  // clarify / follow-ups / uncovered points; escalate inbox→call — {kind:'clarify'}, escalate, blocking
+  "redirect",
+  // seed / hand off a thread to a new recipient — handoff, "new session from this"
+  "break_down",
+  // one bundle → many sub-asks — checklist fan-out, `points`
+  "coalesce",
+  // many bundles → one — morning triage (#347), threading-supersede, digest
+  "organize",
+  // group related bundles onto one thread — threading (`parentId`), parent/clarify links
+  "summarize"
+  // reduce volume, keep decision value — 30-turn cap, spoken briefing
+]);
+var OptionSchema2 = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string(),
+  // .describe() flows into the MCP contact JSON schema (zodToJsonSchema), so
+  // the constraints below are what an agent reads when deciding to use these.
+  html: external_exports.string().max(16384).describe(
+    "Optional sandboxed HTML/CSS preview for a visual 'pick one' (shown in the option card). Untrusted-sandboxed: NO JavaScript, NO external network or images \u2014 inline CSS and data: URIs only; <=16KB. Use for layout/CSS mockups, tables, diffs. For a hosted image use `image` instead."
+  ).optional(),
+  image: external_exports.string().url().describe(
+    "Optional image URL rendered as the option's preview (plain image, not sandboxed). For agent-generated HTML/CSS mockups, use `html` instead."
+  ).optional()
+});
+var VisualSchema2 = external_exports.object({
+  url: external_exports.string().url(),
+  label: external_exports.string().optional()
+});
+var NotifyLevelSchema2 = external_exports.enum(["inbox", "push", "banner", "call"]);
+var SelectShapeSchema2 = external_exports.enum(["one", "many", "rank", "confirm", "text"]);
+var ReceiptEventSchema2 = external_exports.enum([
+  "delivered",
+  // the bundle reached the recipient at some level
+  "seen",
+  // the recipient opened it
+  "answered",
+  // the recipient replied
+  "escalated",
+  // re-reached at a higher level (re-ring / promote)
+  "coalesced",
+  // merged into another live claim
+  "expired",
+  // deadline passed unanswered
+  "woke",
+  // the agent was woken for an owed obligation (callback)
+  "gave_up"
+  // the budget was spent — stopped re-engaging
+]);
+var AttentionSchema2 = external_exports.object({
+  urgency: NotifyLevelSchema2,
+  /** The required answer shape, or null for a plain notify that asks nothing back. */
+  select: SelectShapeSchema2.nullable(),
+  /** Coverage contract (#396) — points the answer must address; null = none declared. */
+  points: external_exports.array(external_exports.string()).nullable(),
+  /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
+  blocking: external_exports.boolean(),
+  /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
+   *  slice wires it; optional so today's rows/callers project cleanly. */
+  deadline: external_exports.string().datetime().nullable().optional()
+});
+var NotifyRequestSchema2 = external_exports.object({
+  /** Plaintext message content. Present on the plaintext path (today's shape);
+   *  ABSENT on the E2EE path, where the sealed `envelope` below carries it. The
+   *  superRefine at the bottom enforces exactly one of the two. */
+  context: ContextSchema2.optional(),
+  options: external_exports.array(OptionSchema2.omit({ id: true })).min(1).optional().describe(
+    "The choices, in order \u2014 required when select is 'one'/'many'/'rank', omitted otherwise. Ids are assigned automatically by position ('1', '2', \u2026); the user's answer references them as optionId(s)."
+  ),
+  points: external_exports.array(external_exports.string().min(1)).optional().describe(
+    "The distinct things you need answered, each a short phrase \u2014 on a call the broker keeps the conversation going until each is addressed, and the reply reports which were covered, so a half-answer is never silently returned as final. Omit for single-part asks."
+  ),
+  visuals: external_exports.array(VisualSchema2).optional().describe(
+    "Images attached to the message itself \u2014 context for the whole question (a screenshot, a chart). For a preview on one selectable choice, use that option's `html`/`image` instead."
+  ),
+  /** Git repo the agent is working in ("owner/name"). Local MCP fills this from the checkout — omit unless overriding. */
+  repo: external_exports.string().optional(),
+  /** Git branch the agent is on. Local MCP fills this from the checkout — omit unless overriding. */
+  branch: external_exports.string().optional(),
+  /** Continue an existing conversation — the id of any notification in it (its root
+   *  is the conversation's identity). Omitted = start a new conversation. Renamed
+   *  from `parentId` (2026-08-03): one linkage system, the parent; the API edge
+   *  still accepts the old name from older clients. */
+  parentId: external_exports.string().uuid().optional(),
+  urgency: NotifyLevelSchema2.default("inbox").describe(
+    "The level you're requesting \u2014 the user's account permissions + session mode can lower it. 'inbox' (default) = sits silently in the inbox for the user to get to. 'push' = a quiet passive push (lands in Notification Center, no sound) \u2014 a gentle heads-up. 'banner' = a time-sensitive banner/lock-screen push with sound (a 'paige') they tap to open \u2014 use when you need them soon-ish but it's not worth ringing them. 'call' = rings the user's phone now (a CallKit voice call) \u2014 use only when you genuinely need them in the moment (blocked and waiting, time-sensitive). context.title is what they see on the banner/ring, so make it specific."
+  ),
+  /** The request this one CLARIFIES — spawning a clarification keeps that parent
+   *  visible and marks it needs_input. Renamed from the old `parentId` (2026-08-03)
+   *  when `parentId` became the conversation handle: `parentId` says WHERE, this
+   *  says HOW. */
+  clarifies: external_exports.string().optional(),
+  /** E2EE (text lane): when the pairing is E2EE, the sealed replacements for the
+   *  plaintext content fields, keyed by field name. FINALIZED wire shape (was
+   *  provisional in the storage PR): a per-field map `{ context?, options?,
+   *  visuals? }` of opaque Envelopes — one seal per present content field, so a
+   *  message with no options/visuals seals only `context`. It COEXISTS with the
+   *  plaintext fields by mutual exclusion: the superRefine below requires that
+   *  when `envelope` is present the plaintext `context`/`options`/`visuals` are
+   *  ABSENT (and vice-versa), so a row is either fully plaintext or fully sealed —
+   *  never a readable half. The server persists this OPAQUELY into
+   *  notifications.envelope and relays it blindly; it never decrypts. Absent =
+   *  today's plaintext path (context/options/visuals carry the cleartext).
+   *  z.lazy because EnvelopeSchema is declared further down (E2EE section). */
+  envelope: external_exports.object({
+    context: external_exports.lazy(() => EnvelopeSchema2).optional(),
+    options: external_exports.lazy(() => EnvelopeSchema2).optional(),
+    visuals: external_exports.lazy(() => EnvelopeSchema2).optional()
+  }).optional(),
+  select: SelectShapeSchema2.optional().describe(
+    "How the user answers \u2014 required on the fully-shaped form, pick the shape that fits the question: 'one' = pick one option, 'many' = pick several, 'rank' = pick & order (each needs `options`); 'confirm' = yes/no or approve/deny; 'text' = free-form reply only (status updates, open questions). 'confirm' and 'text' take no options. Omit only when sending the simplified `ask` form \u2014 the broker picks the shape."
+  ),
+  /** The simplified form (#395): instead of shaping the notification yourself
+   *  (context/select/options/urgency), state what you need to learn and why it
+   *  matters now — the broker derives the optimal shape and channel. Mutually
+   *  exclusive with `context` (and never sent alongside `envelope`: E2EE pairings
+   *  derive agent-side before sealing, so the server only ever shapes plaintext). */
+  // 10k, not a sentence budget. What the human hears is bounded by the BROKER — it splits
+  // the ask into topics and gives each one at most three sentences and one question
+  // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
+  // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
+  // come from the broker splitting and summarizing." The cap that remains is a size guard.
+  ask: external_exports.string().min(1).max(1e4).optional().describe(
+    'SIMPLIFIED FORM \u2014 state in plain prose what you need to learn from the user and why it matters now (e.g. "I need to know whether to deploy the auth fix \u2014 tests are green, staging verified"). Write as much as the situation needs (up to 10k characters) \u2014 Paigy breaks it into topics and reads it back a few sentences at a time; do NOT pre-summarize it into one line. Paigy derives the title, answer shape, options, and delivery channel for you. Mutually exclusive with context/select/options \u2014 send one form or the other.'
+  ),
+  needs: external_exports.array(external_exports.string().min(1)).optional().describe(
+    "With `ask` only: the distinct things you need answered when the ask is multi-part \u2014 becomes the coverage contract (`points`), so a half-answer is never silently final."
+  ),
+  urgencyHint: external_exports.enum(["whenever", "soon", "now"]).optional().describe(
+    "With `ask` only: how urgently you need the answer \u2014 'whenever' (inbox), 'soon' (worth a heads-up), 'now' (you're blocked this minute). A hint, not a command: the user's settings still have the final word."
+  ),
+  /** #575: the ONE self-report that replaces urgencyHint + blocking — what happens
+   *  to the agent's work while it waits. Normalized server-side into those two
+   *  fields (normalizeWaiting) so everything downstream is untouched; explicit
+   *  urgencyHint/blocking win when both are sent. */
+  waiting: external_exports.enum(["none", "soft", "hard"]).optional().describe(
+    "With `ask`: what happens to your work while you wait. 'none' = you're just informing the user. 'soft' = you'd like an answer but can keep working. 'hard' = you are stopped until they answer (reaches them urgently and escalates to a real phone call if unanswered). Replaces urgencyHint + blocking \u2014 send this one field."
+  ),
+  /** Δ9b (#895): HOLD this claim so the sender can correct the plan before anyone is
+   *  interrupted. Opt-in per claim, because the fail-open is a minute-granularity cron —
+   *  holding by default would charge every quiet claim that minute before any agent could
+   *  correct anything. Ignored for `waiting: 'hard'`: a blocking ask rings on what we have,
+   *  and the enrichment can still land mid-call (#781 re-plans the unspoken tail). */
+  confirm: external_exports.boolean().optional().describe(
+    "Hold this one so you can correct the plan before the user is interrupted. The response comes back with `held: true` and the plan; POST the confirm route to release it (with options/visuals/urgency corrections, or nothing at all). If you never do, it is announced anyway a couple of minutes later. Ignored when waiting is 'hard'."
+  ),
+  /** #575: a RELAY of the user's explicitly stated preference, never the agent's
+   *  choice. Outranks waiting in both directions: 'call' rings even for a
+   *  waiting:'none' "call me when it's done"; 'message' never rings even for
+   *  waiting:'hard'. */
+  channel: external_exports.enum(["call", "message"]).optional().describe(
+    "Only if the user explicitly said how to reach them \u2014 'call me' \u2192 'call', 'just message/text me' \u2192 'message'. Omit otherwise; Paigy picks."
+  ),
+  confirmStyle: external_exports.enum(["yesno", "approve"]).default("yesno").describe(
+    "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
+  ),
+  blocking: external_exports.boolean().default(false).describe(
+    "Set true when real downstream work is stuck behind this specific decision \u2014 you can't make meaningful progress until it's answered. This is the real signal for how urgently the user should be reached; it's what the premier use case (an agent that stays unblocked instead of going idle) depends on. Independent of `urgency`: a `banner`-level question can still be `blocking` (something IS stuck, just not time-critical enough to ring for immediately) \u2014 if it goes unanswered a while, Paigy escalates it to a real call using this flag rather than guessing from how many other things happen to be pending. Leave false for anything you could work around, defer, or where other useful work exists meanwhile."
+  )
+}).superRefine((r, ctx) => {
+  const sealed = !!r.envelope;
+  if (sealed) {
+    if (!r.envelope?.context)
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["envelope", "context"], message: "sealed request must include envelope.context" });
+    for (const f of ["context", "options", "visuals"]) {
+      if (r[f] !== void 0)
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [f], message: `E2EE request must not carry plaintext ${f} \u2014 it's sealed in envelope.${f}` });
+    }
+    if (r.points !== void 0)
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["points"], message: "E2EE request must not carry plaintext points" });
+    if (r.ask !== void 0)
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["ask"], message: "E2EE request must not carry a plaintext ask \u2014 derive the shape agent-side and seal it" });
+    if (r.needs !== void 0)
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["needs"], message: "E2EE request must not carry plaintext needs" });
+    return;
   }
-  cwd;
-  mode;
-  mcp;
-  nextId = 1;
-  initId;
-  sessionNewId;
-  promptId;
-  sessionId;
-  queued = [];
-  /** Options of each unanswered permission request, keyed by its JSON-RPC id. */
-  pending = /* @__PURE__ */ new Map();
-  /** Where the REPORT starts in `text` — everything before the LAST tool call is working
-   *  narration ("Now the API endpoints." → runs a tool), and it used to ship: the chunks
-   *  concatenate with no separator, so the owner's phone got "…find the repo.Now I have
-   *  the full picture. Writing the migration.Now…" as the opening paragraph of a finished
-   *  task (live, 2026-08-11 — "looks like a working log"). The narration's audience is the
-   *  terminal and host.log; what the agent composed AFTER its last tool call is the part
-   *  addressed to a human, and that is what leaves the machine. */
-  reportFrom = 0;
-  /** The turn being streamed: text accumulates, tools append, both flush on stopReason. */
-  text = "";
-  tools = [];
-  /** The opening frame. Everything after is driven by responses in `handleLine`. */
-  open() {
-    this.initId = this.nextId++;
-    return [
-      frame({
-        id: this.initId,
-        method: "initialize",
-        params: {
-          protocolVersion: 2,
-          // We are not an editor: no file services offered, the agent uses its own.
-          clientCapabilities: { fs: { readTextFile: false, writeTextFile: false } },
-          clientInfo: { name: "paigy-desktop", version: "0.0.0" }
-        }
-      })
-    ];
-  }
-  /** Queue a prompt; it goes out when the session exists and no turn is running. */
-  send(text) {
-    this.queued.push(text);
-    return this.flush();
-  }
-  /** Answer a PermissionEvent (ask mode). The id is the request's JSON-RPC id as a string. */
-  respond(id, decision) {
-    const request = this.pending.get(id);
-    if (!request) return [];
-    this.pending.delete(id);
-    const optionId = optionFor(request.options, decision);
-    return [
-      optionId ? frame({ id: request.id, result: { outcome: { outcome: "selected", optionId } } }) : frame({ id: request.id, result: { outcome: { outcome: "cancelled" } } })
-    ];
-  }
-  /** Cancel anything still blocked — called on stop so the process can exit cleanly. */
-  close() {
-    const writes = [...this.pending.values()].map(
-      (r) => frame({ id: r.id, result: { outcome: { outcome: "cancelled" } } })
-    );
-    this.pending.clear();
-    return writes;
-  }
-  handleLine(line) {
-    const trimmed = line.trim();
-    if (!trimmed) return none;
-    let msg;
-    try {
-      msg = JSON.parse(trimmed);
-    } catch {
-      return none;
-    }
-    if (msg.method !== void 0) {
-      return msg.id !== void 0 ? this.handleRequest(msg) : this.handleNotification(msg);
-    }
-    if (msg.id !== void 0) return this.handleResponse(msg);
-    return none;
-  }
-  // ── responses to our requests ──
-  handleResponse(msg) {
-    if (msg.id === this.initId) {
-      this.initId = void 0;
-      if (msg.error) {
-        return { events: [{ kind: "error", message: `initialize failed: ${msg.error.message}` }], writes: [] };
-      }
-      this.sessionNewId = this.nextId++;
-      return {
-        events: [],
-        writes: [frame({ id: this.sessionNewId, method: "session/new", params: { cwd: this.cwd, mcpServers: this.mcp } })]
-      };
-    }
-    if (msg.id === this.sessionNewId) {
-      this.sessionNewId = void 0;
-      const sessionId = msg.result?.sessionId;
-      if (!sessionId) {
-        return {
-          events: [{ kind: "error", message: `session/new failed: ${msg.error?.message ?? "no sessionId"}` }],
-          writes: []
-        };
-      }
-      this.sessionId = sessionId;
-      const value = this.mode === "bypass" ? "bypassPermissions" : "default";
-      const writes = [
-        frame({
-          id: this.nextId++,
-          method: "session/set_config_option",
-          params: { sessionId, configId: "mode", value }
-        }),
-        frame({ id: this.nextId++, method: "session/set_mode", params: { sessionId, modeId: value } })
-      ];
-      writes.push(...this.flush());
-      return { events: [], writes };
-    }
-    if (msg.id === this.promptId) {
-      this.promptId = void 0;
-      const events = [];
-      const report = this.text.slice(this.reportFrom).trim() || this.text.trim();
-      if (report || this.tools.length) {
-        events.push({
-          kind: "turn",
-          role: "agent",
-          text: report,
-          ...this.tools.length ? { tools: [...this.tools] } : {}
-        });
-      }
-      const result = report;
-      const failed = msg.error !== void 0 || msg.result?.stopReason === "refusal";
-      this.text = "";
-      this.tools = [];
-      this.reportFrom = 0;
-      const writes = this.flush();
-      if (!writes.length) {
-        events.push({
-          kind: "idle",
-          ...result ? { result } : {},
-          ...failed ? { failed: true } : {}
-        });
-      }
-      return { events, writes };
-    }
-    return none;
-  }
-  // ── the agent talking to us ──
-  handleNotification(msg) {
-    if (msg.method !== "session/update") return none;
-    const update = msg.params?.update;
-    switch (update?.sessionUpdate) {
-      case "agent_message_chunk":
-        this.text += update.content?.text ?? "";
-        return none;
-      case "tool_call": {
-        const title = update.title?.trim() || update.kind || "tool";
-        this.tools.push(title);
-        const note = this.text.slice(this.reportFrom).trim();
-        this.reportFrom = this.text.length;
-        return { events: [{ kind: "work", tool: title, ...note ? { note } : {} }], writes: [] };
-      }
-      default:
-        return none;
-    }
-  }
-  handleRequest(msg) {
-    if (msg.method !== "session/request_permission") {
-      return {
-        events: [],
-        writes: [frame({ id: msg.id, error: { code: -32601, message: `Method not found: ${msg.method}` } })]
-      };
-    }
-    const id = msg.id;
-    const options = msg.params?.options ?? [];
-    const title = msg.params?.toolCall?.title?.trim() || "a tool call";
-    const tool = msg.params?.toolCall?.kind ?? "tool";
-    if (this.mode === "bypass") {
-      const optionId = optionFor(options, { allow: true }) ?? optionFor(options, { allow: false });
-      return {
-        // The decision still goes through Paigy — as history, not a question. Bypass
-        // means "don't stall the agent", never "don't tell the user".
-        events: [{ kind: "turn", role: "agent", text: `auto-approved: ${title}`, tools: [tool] }],
-        writes: [
-          optionId ? frame({ id, result: { outcome: { outcome: "selected", optionId } } }) : frame({ id, result: { outcome: { outcome: "cancelled" } } })
-        ]
-      };
-    }
-    this.pending.set(String(id), { id, options });
-    return {
-      events: [{ kind: "permission", id: String(id), tool, summary: title }],
-      writes: []
-    };
-  }
-  /** Send the queued prompts as one turn, if the agent can take one right now. */
-  flush() {
-    if (!this.sessionId || this.promptId !== void 0 || !this.queued.length) return [];
-    const blocks = this.queued.map((text) => ({ type: "text", text }));
-    this.queued = [];
-    this.promptId = this.nextId++;
-    return [
-      frame({
-        id: this.promptId,
-        method: "session/prompt",
-        params: { sessionId: this.sessionId, prompt: blocks }
-      })
-    ];
-  }
-};
-var frame = (body) => JSON.stringify({ jsonrpc: "2.0", ...body });
-
-// src/harness/session.ts
-var ADAPTER_BIN = {
-  claude: "claude-agent-acp",
-  codex: "codex-acp",
-  agy: "agy"
-};
-function splitLines(buffer, chunk) {
-  const combined = buffer + chunk;
-  const parts = combined.split("\n");
-  const rest = parts.pop() ?? "";
-  return { lines: parts.filter((l) => l.trim()), rest };
-}
-function startSession(opts) {
-  const cwd = resolve2(opts.cwd.replace(/^~(?=$|\/)/, homedir4()));
-  if (!existsSync4(cwd)) {
-    queueMicrotask(() => opts.onEvent({ kind: "error", message: `workspace does not exist: ${cwd}` }));
-  }
-  const child = (opts.spawnFn ?? spawn)(opts.bin ?? ADAPTER_BIN[opts.harness], [], {
-    cwd,
-    // The adapter shells out to its vendor CLI (`claude`, `codex`), and a GUI- or
-    // launchd-launched process's PATH won't have it — probe dirs plus the RUNNING
-    // node's own bin dir (nvm installs the adapters next to node; launchd's bare
-    // PATH knows neither — live catch 2026-08-04: the first slot-wake ENOENT'd).
-    env: {
-      ...process.env,
-      PATH: [process.env.PATH, ...probeDirs()].filter(Boolean).join(delimiter2),
-      ...opts.token ? { PAIGY_TOKEN: opts.token } : {}
-    },
-    stdio: ["pipe", "pipe", "pipe"]
-  });
-  const write = (frames) => {
-    for (const f of frames) child.stdin?.write(`${f}
-`);
-  };
-  child.stderr?.on("data", (chunk) => {
-    const text = String(chunk).trim();
-    if (text) opts.onEvent({ kind: "error", message: text });
-  });
-  child.on("exit", (code) => {
-    opts.onEvent({ kind: "idle", failed: code !== 0, ...code ? { result: `exited ${code}` } : {} });
-    opts.onExit?.();
-  });
-  child.on("error", (e) => {
-    opts.onEvent({ kind: "error", message: e.message });
-    opts.onExit?.();
-  });
-  const driver = createAcpDriver({ cwd, mode: opts.mode, ...opts.mcp ? { mcp: opts.mcp } : {} });
-  let buffer = "";
-  child.stdout?.on("data", (chunk) => {
-    const { lines, rest } = splitLines(buffer, String(chunk));
-    buffer = rest;
-    for (const line of lines) {
-      const { events, writes } = driver.handleLine(line);
-      write(writes);
-      for (const event of events) opts.onEvent(event);
-    }
-  });
-  write(driver.open());
-  return {
-    send(text) {
-      write(driver.send(text));
-    },
-    respond(id, decision) {
-      write(driver.respond(id, decision));
-    },
-    stop() {
-      write(driver.close());
-      child.kill();
-    }
-  };
-}
-
-// ../../packages/schema/dist/index.js
-var ContextSchema2 = external_exports.object({
-  title: external_exports.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
-  description: external_exports.array(external_exports.string().min(1)).describe(
-    "Semantic chunks of detail (each a standalone, non-empty piece). The user can select chunks to ask you to expand. MAY BE EMPTY: a claim whose whole content is its heading \u2014 a single sentence \u2014 has no body, and saying so beats repeating the heading underneath itself. That repeat is what `min(1)` used to force, at 2x the storage, with every reader subtracting it back out at render time."
-  )
-});
-var ParticipantSchema2 = external_exports.object({
-  kind: external_exports.enum(["human", "agent"]),
-  id: external_exports.string()
-});
-var TransformSchema2 = external_exports.enum([
-  "structure",
-  // shape intent into an answer contract; pick channel/urgency — broker `ask`, `select` shapes, `points`
-  "request_more",
-  // clarify / follow-ups / uncovered points; escalate inbox→call — {kind:'clarify'}, escalate, blocking
-  "redirect",
-  // seed / hand off a thread to a new recipient — handoff, "new session from this"
-  "break_down",
-  // one bundle → many sub-asks — checklist fan-out, `points`
-  "coalesce",
-  // many bundles → one — morning triage (#347), threading-supersede, digest
-  "organize",
-  // group related bundles onto one thread — threading (`parentId`), parent/clarify links
-  "summarize"
-  // reduce volume, keep decision value — 30-turn cap, spoken briefing
-]);
-var OptionSchema2 = external_exports.object({
-  id: external_exports.string(),
-  label: external_exports.string(),
-  // .describe() flows into the MCP contact JSON schema (zodToJsonSchema), so
-  // the constraints below are what an agent reads when deciding to use these.
-  html: external_exports.string().max(16384).describe(
-    "Optional sandboxed HTML/CSS preview for a visual 'pick one' (shown in the option card). Untrusted-sandboxed: NO JavaScript, NO external network or images \u2014 inline CSS and data: URIs only; <=16KB. Use for layout/CSS mockups, tables, diffs. For a hosted image use `image` instead."
-  ).optional(),
-  image: external_exports.string().url().describe(
-    "Optional image URL rendered as the option's preview (plain image, not sandboxed). For agent-generated HTML/CSS mockups, use `html` instead."
-  ).optional()
-});
-var VisualSchema2 = external_exports.object({
-  url: external_exports.string().url(),
-  label: external_exports.string().optional()
-});
-var NotifyLevelSchema2 = external_exports.enum(["inbox", "push", "banner", "call"]);
-var SelectShapeSchema2 = external_exports.enum(["one", "many", "rank", "confirm", "text"]);
-var ReceiptEventSchema2 = external_exports.enum([
-  "delivered",
-  // the bundle reached the recipient at some level
-  "seen",
-  // the recipient opened it
-  "answered",
-  // the recipient replied
-  "escalated",
-  // re-reached at a higher level (re-ring / promote)
-  "coalesced",
-  // merged into another live claim
-  "expired",
-  // deadline passed unanswered
-  "woke",
-  // the agent was woken for an owed obligation (callback)
-  "gave_up"
-  // the budget was spent — stopped re-engaging
-]);
-var AttentionSchema2 = external_exports.object({
-  urgency: NotifyLevelSchema2,
-  /** The required answer shape, or null for a plain notify that asks nothing back. */
-  select: SelectShapeSchema2.nullable(),
-  /** Coverage contract (#396) — points the answer must address; null = none declared. */
-  points: external_exports.array(external_exports.string()).nullable(),
-  /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
-  blocking: external_exports.boolean(),
-  /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
-   *  slice wires it; optional so today's rows/callers project cleanly. */
-  deadline: external_exports.string().datetime().nullable().optional()
-});
-var NotifyRequestSchema2 = external_exports.object({
-  /** Plaintext message content. Present on the plaintext path (today's shape);
-   *  ABSENT on the E2EE path, where the sealed `envelope` below carries it. The
-   *  superRefine at the bottom enforces exactly one of the two. */
-  context: ContextSchema2.optional(),
-  options: external_exports.array(OptionSchema2.omit({ id: true })).min(1).optional().describe(
-    "The choices, in order \u2014 required when select is 'one'/'many'/'rank', omitted otherwise. Ids are assigned automatically by position ('1', '2', \u2026); the user's answer references them as optionId(s)."
-  ),
-  points: external_exports.array(external_exports.string().min(1)).optional().describe(
-    "The distinct things you need answered, each a short phrase \u2014 on a call the broker keeps the conversation going until each is addressed, and the reply reports which were covered, so a half-answer is never silently returned as final. Omit for single-part asks."
-  ),
-  visuals: external_exports.array(VisualSchema2).optional().describe(
-    "Images attached to the message itself \u2014 context for the whole question (a screenshot, a chart). For a preview on one selectable choice, use that option's `html`/`image` instead."
-  ),
-  /** Git repo the agent is working in ("owner/name"). Local MCP fills this from the checkout — omit unless overriding. */
-  repo: external_exports.string().optional(),
-  /** Git branch the agent is on. Local MCP fills this from the checkout — omit unless overriding. */
-  branch: external_exports.string().optional(),
-  /** Continue an existing conversation — the id of any notification in it (its root
-   *  is the conversation's identity). Omitted = start a new conversation. Renamed
-   *  from `parentId` (2026-08-03): one linkage system, the parent; the API edge
-   *  still accepts the old name from older clients. */
-  parentId: external_exports.string().uuid().optional(),
-  urgency: NotifyLevelSchema2.default("inbox").describe(
-    "The level you're requesting \u2014 the user's account permissions + session mode can lower it. 'inbox' (default) = sits silently in the inbox for the user to get to. 'push' = a quiet passive push (lands in Notification Center, no sound) \u2014 a gentle heads-up. 'banner' = a time-sensitive banner/lock-screen push with sound (a 'paige') they tap to open \u2014 use when you need them soon-ish but it's not worth ringing them. 'call' = rings the user's phone now (a CallKit voice call) \u2014 use only when you genuinely need them in the moment (blocked and waiting, time-sensitive). context.title is what they see on the banner/ring, so make it specific."
-  ),
-  /** The request this one CLARIFIES — spawning a clarification keeps that parent
-   *  visible and marks it needs_input. Renamed from the old `parentId` (2026-08-03)
-   *  when `parentId` became the conversation handle: `parentId` says WHERE, this
-   *  says HOW. */
-  clarifies: external_exports.string().optional(),
-  /** E2EE (text lane): when the pairing is E2EE, the sealed replacements for the
-   *  plaintext content fields, keyed by field name. FINALIZED wire shape (was
-   *  provisional in the storage PR): a per-field map `{ context?, options?,
-   *  visuals? }` of opaque Envelopes — one seal per present content field, so a
-   *  message with no options/visuals seals only `context`. It COEXISTS with the
-   *  plaintext fields by mutual exclusion: the superRefine below requires that
-   *  when `envelope` is present the plaintext `context`/`options`/`visuals` are
-   *  ABSENT (and vice-versa), so a row is either fully plaintext or fully sealed —
-   *  never a readable half. The server persists this OPAQUELY into
-   *  notifications.envelope and relays it blindly; it never decrypts. Absent =
-   *  today's plaintext path (context/options/visuals carry the cleartext).
-   *  z.lazy because EnvelopeSchema is declared further down (E2EE section). */
-  envelope: external_exports.object({
-    context: external_exports.lazy(() => EnvelopeSchema2).optional(),
-    options: external_exports.lazy(() => EnvelopeSchema2).optional(),
-    visuals: external_exports.lazy(() => EnvelopeSchema2).optional()
-  }).optional(),
-  select: SelectShapeSchema2.optional().describe(
-    "How the user answers \u2014 required on the fully-shaped form, pick the shape that fits the question: 'one' = pick one option, 'many' = pick several, 'rank' = pick & order (each needs `options`); 'confirm' = yes/no or approve/deny; 'text' = free-form reply only (status updates, open questions). 'confirm' and 'text' take no options. Omit only when sending the simplified `ask` form \u2014 the broker picks the shape."
-  ),
-  /** The simplified form (#395): instead of shaping the notification yourself
-   *  (context/select/options/urgency), state what you need to learn and why it
-   *  matters now — the broker derives the optimal shape and channel. Mutually
-   *  exclusive with `context` (and never sent alongside `envelope`: E2EE pairings
-   *  derive agent-side before sealing, so the server only ever shapes plaintext). */
-  // 10k, not a sentence budget. What the human hears is bounded by the BROKER — it splits
-  // the ask into topics and gives each one at most three sentences and one question
-  // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
-  // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
-  // come from the broker splitting and summarizing." The cap that remains is a size guard.
-  ask: external_exports.string().min(1).max(1e4).optional().describe(
-    'SIMPLIFIED FORM \u2014 state in plain prose what you need to learn from the user and why it matters now (e.g. "I need to know whether to deploy the auth fix \u2014 tests are green, staging verified"). Write as much as the situation needs (up to 10k characters) \u2014 Paigy breaks it into topics and reads it back a few sentences at a time; do NOT pre-summarize it into one line. Paigy derives the title, answer shape, options, and delivery channel for you. Mutually exclusive with context/select/options \u2014 send one form or the other.'
-  ),
-  needs: external_exports.array(external_exports.string().min(1)).optional().describe(
-    "With `ask` only: the distinct things you need answered when the ask is multi-part \u2014 becomes the coverage contract (`points`), so a half-answer is never silently final."
-  ),
-  urgencyHint: external_exports.enum(["whenever", "soon", "now"]).optional().describe(
-    "With `ask` only: how urgently you need the answer \u2014 'whenever' (inbox), 'soon' (worth a heads-up), 'now' (you're blocked this minute). A hint, not a command: the user's settings still have the final word."
-  ),
-  /** #575: the ONE self-report that replaces urgencyHint + blocking — what happens
-   *  to the agent's work while it waits. Normalized server-side into those two
-   *  fields (normalizeWaiting) so everything downstream is untouched; explicit
-   *  urgencyHint/blocking win when both are sent. */
-  waiting: external_exports.enum(["none", "soft", "hard"]).optional().describe(
-    "With `ask`: what happens to your work while you wait. 'none' = you're just informing the user. 'soft' = you'd like an answer but can keep working. 'hard' = you are stopped until they answer (reaches them urgently and escalates to a real phone call if unanswered). Replaces urgencyHint + blocking \u2014 send this one field."
-  ),
-  /** Δ9b (#895): HOLD this claim so the sender can correct the plan before anyone is
-   *  interrupted. Opt-in per claim, because the fail-open is a minute-granularity cron —
-   *  holding by default would charge every quiet claim that minute before any agent could
-   *  correct anything. Ignored for `waiting: 'hard'`: a blocking ask rings on what we have,
-   *  and the enrichment can still land mid-call (#781 re-plans the unspoken tail). */
-  confirm: external_exports.boolean().optional().describe(
-    "Hold this one so you can correct the plan before the user is interrupted. The response comes back with `held: true` and the plan; POST the confirm route to release it (with options/visuals/urgency corrections, or nothing at all). If you never do, it is announced anyway a couple of minutes later. Ignored when waiting is 'hard'."
-  ),
-  /** #575: a RELAY of the user's explicitly stated preference, never the agent's
-   *  choice. Outranks waiting in both directions: 'call' rings even for a
-   *  waiting:'none' "call me when it's done"; 'message' never rings even for
-   *  waiting:'hard'. */
-  channel: external_exports.enum(["call", "message"]).optional().describe(
-    "Only if the user explicitly said how to reach them \u2014 'call me' \u2192 'call', 'just message/text me' \u2192 'message'. Omit otherwise; Paigy picks."
-  ),
-  confirmStyle: external_exports.enum(["yesno", "approve"]).default("yesno").describe(
-    "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
-  ),
-  blocking: external_exports.boolean().default(false).describe(
-    "Set true when real downstream work is stuck behind this specific decision \u2014 you can't make meaningful progress until it's answered. This is the real signal for how urgently the user should be reached; it's what the premier use case (an agent that stays unblocked instead of going idle) depends on. Independent of `urgency`: a `banner`-level question can still be `blocking` (something IS stuck, just not time-critical enough to ring for immediately) \u2014 if it goes unanswered a while, Paigy escalates it to a real call using this flag rather than guessing from how many other things happen to be pending. Leave false for anything you could work around, defer, or where other useful work exists meanwhile."
-  )
-}).superRefine((r, ctx) => {
-  const sealed = !!r.envelope;
-  if (sealed) {
-    if (!r.envelope?.context)
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["envelope", "context"], message: "sealed request must include envelope.context" });
-    for (const f of ["context", "options", "visuals"]) {
-      if (r[f] !== void 0)
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [f], message: `E2EE request must not carry plaintext ${f} \u2014 it's sealed in envelope.${f}` });
-    }
-    if (r.points !== void 0)
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["points"], message: "E2EE request must not carry plaintext points" });
-    if (r.ask !== void 0)
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["ask"], message: "E2EE request must not carry a plaintext ask \u2014 derive the shape agent-side and seal it" });
-    if (r.needs !== void 0)
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["needs"], message: "E2EE request must not carry plaintext needs" });
-    return;
-  }
-  if (r.ask !== void 0) {
-    for (const f of ["context", "select", "points"]) {
-      if (r[f] !== void 0)
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [f], message: `the simplified \`ask\` form takes no ${f} \u2014 the broker derives it (use \`needs\` for multi-part asks)` });
-    }
-    return;
+  if (r.ask !== void 0) {
+    for (const f of ["context", "select", "points"]) {
+      if (r[f] !== void 0)
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [f], message: `the simplified \`ask\` form takes no ${f} \u2014 the broker derives the answer shape from your prose. Drop ${f} and say it in \`ask\` instead ("should I\u2026" for approve/deny, "which of these\u2026" for a pick), passing \`options\` when you're offering concrete alternatives.` });
+    }
+    return;
   }
   if (r.needs !== void 0 || r.urgencyHint !== void 0)
     ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["needs"], message: "needs/urgencyHint belong to the simplified `ask` form \u2014 with a shaped request use points/urgency" });
@@ -13357,7 +13084,13 @@ var NotifyPlanUnitSchema2 = external_exports.object({
   proposal: external_exports.object({
     select: SelectShapeSchema2,
     options: external_exports.array(external_exports.object({ label: external_exports.string().min(1) })).optional()
-  }).optional()
+  }).optional(),
+  /** What the broker READ this unit as wanting from the human (#952 layer 2): a `decision`
+   *  between alternatives, an `approval` the agent is blocked on, or `knowledge` it just
+   *  needs to know. Reported so the agent can correct a misread the same way it ratifies a
+   *  shape — the read RAISES (a decision always asks) and never silences a question the
+   *  agent declared (#731, #923). */
+  wants: external_exports.enum(["decision", "approval", "knowledge"]).optional()
 });
 var NotifyPlanSchema2 = external_exports.object({
   units: external_exports.array(NotifyPlanUnitSchema2),
@@ -13604,6 +13337,15 @@ var HistoryItemSchema2 = external_exports.object({
   /** When you answered the agent's notification (agent→user only). */
   humanAckedAt: external_exports.string().nullable()
 });
+var ACTIVITY_LINES2 = 2;
+var ACTIVITY_LINE_MAX2 = 80;
+var AgentActivitySchema2 = external_exports.object({
+  /** Oldest first, so the newest line is last — the one that replaces in place. */
+  lines: external_exports.array(external_exports.string().max(ACTIVITY_LINE_MAX2)).max(ACTIVITY_LINES2),
+  /** When the harness observed this tail. Its own timestamp, not the heartbeat's: a beat
+   *  that carries an UNCHANGED tail must not make a stalled agent look like it just moved. */
+  at: external_exports.string().datetime()
+});
 var ConnectionSummarySchema2 = external_exports.object({
   /** The connection = the agent's token id (used to address a request). */
   id: external_exports.string(),
@@ -13637,6 +13379,11 @@ var ConnectionSummarySchema2 = external_exports.object({
     harnesses: external_exports.array(external_exports.object({ name: external_exports.string(), label: external_exports.string(), status: external_exports.string() })).optional(),
     workspaces: external_exports.array(external_exports.string()).optional()
   }).optional(),
+  /** The tail of this agent's working log, when a harness is driving it — the agent page's
+   *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
+   *  used straight from a terminal emits no work events; the page says so rather than
+   *  drawing an empty box). */
+  activity: AgentActivitySchema2.optional(),
   /** True = a provider-managed agent running in the provider's cloud (e.g. Anthropic CMA);
    *  false = a local MCP connection running on the user's computer (Claude Code/Codex/…). */
   managed: external_exports.boolean()
@@ -13940,6 +13687,323 @@ var FeedbackOutcomeSchema2 = external_exports.object({
   childIds: external_exports.array(external_exports.string()).optional()
 });
 
+// src/paigy/activity.ts
+function shortenPaths(s) {
+  return s.replace(/(?<![\w.@+-])(?:\/[\w.@+-]+){3,}/g, (p) => {
+    const parts = p.split("/").filter(Boolean);
+    return `\u2026/${parts.slice(-2).join("/")}`;
+  });
+}
+function workLine(event) {
+  const note = (event.note ?? "").split("\n").find((l) => l.trim()) ?? "";
+  const line = shortenPaths([event.tool.trim(), note.trim()].filter(Boolean).join(" \u2014 ").replace(/\s+/g, " "));
+  return line.length > ACTIVITY_LINE_MAX2 ? `${line.slice(0, ACTIVITY_LINE_MAX2 - 1)}\u2026` : line;
+}
+function pushWork(lines, line) {
+  if (!line || lines[lines.length - 1] === line) return [...lines];
+  return [...lines, line].slice(-ACTIVITY_LINES2);
+}
+function sameTail(a, b) {
+  return a.length === b.length && a.every((l, i) => l === b[i]);
+}
+
+// src/harness/session.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { resolve as resolve2, delimiter as delimiter2 } from "path";
+
+// src/harness/acp.ts
+var none = { events: [], writes: [] };
+function optionFor(options, decision) {
+  const want = decision.allow ? "allow_once" : "reject_once";
+  return options.find((o) => o.kind === want)?.optionId ?? null;
+}
+function createAcpDriver(opts) {
+  return new AcpDriver(opts.cwd, opts.mode, opts.mcp ?? []);
+}
+var AcpDriver = class {
+  constructor(cwd, mode, mcp = []) {
+    this.cwd = cwd;
+    this.mode = mode;
+    this.mcp = mcp;
+  }
+  cwd;
+  mode;
+  mcp;
+  nextId = 1;
+  initId;
+  sessionNewId;
+  promptId;
+  sessionId;
+  queued = [];
+  /** Options of each unanswered permission request, keyed by its JSON-RPC id. */
+  pending = /* @__PURE__ */ new Map();
+  /** Where the REPORT starts in `text` — everything before the LAST tool call is working
+   *  narration ("Now the API endpoints." → runs a tool), and it used to ship: the chunks
+   *  concatenate with no separator, so the owner's phone got "…find the repo.Now I have
+   *  the full picture. Writing the migration.Now…" as the opening paragraph of a finished
+   *  task (live, 2026-08-11 — "looks like a working log"). The narration's audience is the
+   *  terminal and host.log; what the agent composed AFTER its last tool call is the part
+   *  addressed to a human, and that is what leaves the machine. */
+  reportFrom = 0;
+  /** The turn being streamed: text accumulates, tools append, both flush on stopReason. */
+  text = "";
+  tools = [];
+  /** The opening frame. Everything after is driven by responses in `handleLine`. */
+  open() {
+    this.initId = this.nextId++;
+    return [
+      frame({
+        id: this.initId,
+        method: "initialize",
+        params: {
+          protocolVersion: 2,
+          // We are not an editor: no file services offered, the agent uses its own.
+          clientCapabilities: { fs: { readTextFile: false, writeTextFile: false } },
+          clientInfo: { name: "paigy-desktop", version: "0.0.0" }
+        }
+      })
+    ];
+  }
+  /** Queue a prompt; it goes out when the session exists and no turn is running. */
+  send(text) {
+    this.queued.push(text);
+    return this.flush();
+  }
+  /** Answer a PermissionEvent (ask mode). The id is the request's JSON-RPC id as a string. */
+  respond(id, decision) {
+    const request = this.pending.get(id);
+    if (!request) return [];
+    this.pending.delete(id);
+    const optionId = optionFor(request.options, decision);
+    return [
+      optionId ? frame({ id: request.id, result: { outcome: { outcome: "selected", optionId } } }) : frame({ id: request.id, result: { outcome: { outcome: "cancelled" } } })
+    ];
+  }
+  /** Cancel anything still blocked — called on stop so the process can exit cleanly. */
+  close() {
+    const writes = [...this.pending.values()].map(
+      (r) => frame({ id: r.id, result: { outcome: { outcome: "cancelled" } } })
+    );
+    this.pending.clear();
+    return writes;
+  }
+  handleLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed) return none;
+    let msg;
+    try {
+      msg = JSON.parse(trimmed);
+    } catch {
+      return none;
+    }
+    if (msg.method !== void 0) {
+      return msg.id !== void 0 ? this.handleRequest(msg) : this.handleNotification(msg);
+    }
+    if (msg.id !== void 0) return this.handleResponse(msg);
+    return none;
+  }
+  // ── responses to our requests ──
+  handleResponse(msg) {
+    if (msg.id === this.initId) {
+      this.initId = void 0;
+      if (msg.error) {
+        return { events: [{ kind: "error", message: `initialize failed: ${msg.error.message}` }], writes: [] };
+      }
+      this.sessionNewId = this.nextId++;
+      return {
+        events: [],
+        writes: [frame({ id: this.sessionNewId, method: "session/new", params: { cwd: this.cwd, mcpServers: this.mcp } })]
+      };
+    }
+    if (msg.id === this.sessionNewId) {
+      this.sessionNewId = void 0;
+      const sessionId = msg.result?.sessionId;
+      if (!sessionId) {
+        return {
+          events: [{ kind: "error", message: `session/new failed: ${msg.error?.message ?? "no sessionId"}` }],
+          writes: []
+        };
+      }
+      this.sessionId = sessionId;
+      const value = this.mode === "bypass" ? "bypassPermissions" : "default";
+      const writes = [
+        frame({
+          id: this.nextId++,
+          method: "session/set_config_option",
+          params: { sessionId, configId: "mode", value }
+        }),
+        frame({ id: this.nextId++, method: "session/set_mode", params: { sessionId, modeId: value } })
+      ];
+      writes.push(...this.flush());
+      return { events: [], writes };
+    }
+    if (msg.id === this.promptId) {
+      this.promptId = void 0;
+      const events = [];
+      const report = this.text.slice(this.reportFrom).trim() || this.text.trim();
+      if (report || this.tools.length) {
+        events.push({
+          kind: "turn",
+          role: "agent",
+          text: report,
+          ...this.tools.length ? { tools: [...this.tools] } : {}
+        });
+      }
+      const result = report;
+      const failed = msg.error !== void 0 || msg.result?.stopReason === "refusal";
+      this.text = "";
+      this.tools = [];
+      this.reportFrom = 0;
+      const writes = this.flush();
+      if (!writes.length) {
+        events.push({
+          kind: "idle",
+          ...result ? { result } : {},
+          ...failed ? { failed: true } : {}
+        });
+      }
+      return { events, writes };
+    }
+    return none;
+  }
+  // ── the agent talking to us ──
+  handleNotification(msg) {
+    if (msg.method !== "session/update") return none;
+    const update = msg.params?.update;
+    switch (update?.sessionUpdate) {
+      case "agent_message_chunk":
+        this.text += update.content?.text ?? "";
+        return none;
+      case "tool_call": {
+        const title = update.title?.trim() || update.kind || "tool";
+        this.tools.push(title);
+        const note = this.text.slice(this.reportFrom).trim();
+        this.reportFrom = this.text.length;
+        return { events: [{ kind: "work", tool: title, ...note ? { note } : {} }], writes: [] };
+      }
+      default:
+        return none;
+    }
+  }
+  handleRequest(msg) {
+    if (msg.method !== "session/request_permission") {
+      return {
+        events: [],
+        writes: [frame({ id: msg.id, error: { code: -32601, message: `Method not found: ${msg.method}` } })]
+      };
+    }
+    const id = msg.id;
+    const options = msg.params?.options ?? [];
+    const title = msg.params?.toolCall?.title?.trim() || "a tool call";
+    const tool = msg.params?.toolCall?.kind ?? "tool";
+    if (this.mode === "bypass") {
+      const optionId = optionFor(options, { allow: true }) ?? optionFor(options, { allow: false });
+      return {
+        // The decision still goes through Paigy — as history, not a question. Bypass
+        // means "don't stall the agent", never "don't tell the user".
+        events: [{ kind: "turn", role: "agent", text: `auto-approved: ${title}`, tools: [tool] }],
+        writes: [
+          optionId ? frame({ id, result: { outcome: { outcome: "selected", optionId } } }) : frame({ id, result: { outcome: { outcome: "cancelled" } } })
+        ]
+      };
+    }
+    this.pending.set(String(id), { id, options });
+    return {
+      events: [{ kind: "permission", id: String(id), tool, summary: title }],
+      writes: []
+    };
+  }
+  /** Send the queued prompts as one turn, if the agent can take one right now. */
+  flush() {
+    if (!this.sessionId || this.promptId !== void 0 || !this.queued.length) return [];
+    const blocks = this.queued.map((text) => ({ type: "text", text }));
+    this.queued = [];
+    this.promptId = this.nextId++;
+    return [
+      frame({
+        id: this.promptId,
+        method: "session/prompt",
+        params: { sessionId: this.sessionId, prompt: blocks }
+      })
+    ];
+  }
+};
+var frame = (body) => JSON.stringify({ jsonrpc: "2.0", ...body });
+
+// src/harness/session.ts
+var ADAPTER_BIN = {
+  claude: "claude-agent-acp",
+  codex: "codex-acp",
+  agy: "agy"
+};
+function splitLines(buffer, chunk) {
+  const combined = buffer + chunk;
+  const parts = combined.split("\n");
+  const rest = parts.pop() ?? "";
+  return { lines: parts.filter((l) => l.trim()), rest };
+}
+function startSession(opts) {
+  const cwd = resolve2(opts.cwd.replace(/^~(?=$|\/)/, homedir4()));
+  if (!existsSync4(cwd)) {
+    queueMicrotask(() => opts.onEvent({ kind: "error", message: `workspace does not exist: ${cwd}` }));
+  }
+  const child = (opts.spawnFn ?? spawn)(opts.bin ?? ADAPTER_BIN[opts.harness], [], {
+    cwd,
+    // The adapter shells out to its vendor CLI (`claude`, `codex`), and a GUI- or
+    // launchd-launched process's PATH won't have it — probe dirs plus the RUNNING
+    // node's own bin dir (nvm installs the adapters next to node; launchd's bare
+    // PATH knows neither — live catch 2026-08-04: the first slot-wake ENOENT'd).
+    env: {
+      ...process.env,
+      PATH: [process.env.PATH, ...probeDirs()].filter(Boolean).join(delimiter2),
+      ...opts.token ? { PAIGY_TOKEN: opts.token } : {}
+    },
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const write = (frames) => {
+    for (const f of frames) child.stdin?.write(`${f}
+`);
+  };
+  child.stderr?.on("data", (chunk) => {
+    const text = String(chunk).trim();
+    if (text) opts.onEvent({ kind: "error", message: text });
+  });
+  child.on("exit", (code) => {
+    opts.onEvent({ kind: "idle", failed: code !== 0, ...code ? { result: `exited ${code}` } : {} });
+    opts.onExit?.();
+  });
+  child.on("error", (e) => {
+    opts.onEvent({ kind: "error", message: e.message });
+    opts.onExit?.();
+  });
+  const driver = createAcpDriver({ cwd, mode: opts.mode, ...opts.mcp ? { mcp: opts.mcp } : {} });
+  let buffer = "";
+  child.stdout?.on("data", (chunk) => {
+    const { lines, rest } = splitLines(buffer, String(chunk));
+    buffer = rest;
+    for (const line of lines) {
+      const { events, writes } = driver.handleLine(line);
+      write(writes);
+      for (const event of events) opts.onEvent(event);
+    }
+  });
+  write(driver.open());
+  return {
+    send(text) {
+      write(driver.send(text));
+    },
+    respond(id, decision) {
+      write(driver.respond(id, decision));
+    },
+    stop() {
+      write(driver.close());
+      child.kill();
+    }
+  };
+}
+
 // src/paigy/conversation.ts
 function endsWithQuestion(text) {
   if (!text) return false;
@@ -14205,6 +14269,7 @@ var clip = (s) => (s.length > 120 ? `${s.slice(0, 117)}\u2026` : s) || "(no text
 // src/run.ts
 function runHarness(opts) {
   let running = true;
+  let tail = [];
   const state = { ...opts.exclusive ? { exclusive: true } : {} };
   let session = null;
   const asMe = { token: opts.token };
@@ -14234,6 +14299,7 @@ function runHarness(opts) {
     }
     if (event.kind === "work") {
       opts.log(`\u2699 ${event.tool}${event.note ? ` \u2014 ${event.note.split("\n")[0] ?? ""}` : ""}`);
+      tail = pushWork(tail, workLine(event));
       return;
     }
     const { parentId } = await mirror(event, state, deps);
@@ -14241,6 +14307,7 @@ function runHarness(opts) {
     if (event.kind === "turn") opts.log(`${event.role}: ${event.text.split("\n")[0] ?? ""}`);
     if (event.kind === "idle") {
       state.resting = true;
+      tail = [];
       if (endsWithQuestion(event.result)) {
         const local = await opts.localAsk?.question?.(event.result ?? "") ?? null;
         if (local?.trim() && session && running) {
@@ -14278,8 +14345,10 @@ function runHarness(opts) {
       session?.send(text);
     },
     working: () => running && state.resting !== true,
+    tail: () => [...tail],
     stop() {
       running = false;
+      tail = [];
       cancelAsks(state);
       session?.stop();
       session = null;
@@ -14397,6 +14466,27 @@ function startHost(opts) {
       opts.log(`\u25B6 woke ${label} (${harness}) \u2014 work was waiting in ${workspace}`);
     }
   }
+  const ACTIVITY_MS = 2e3;
+  const published = /* @__PURE__ */ new Map();
+  const streamActivity = () => {
+    const publishTail = (token, lines) => {
+      void heartbeat(void 0, { token, activity: { lines, at: (/* @__PURE__ */ new Date()).toISOString() } }).catch(() => {
+      });
+    };
+    for (const [key, r] of runs) {
+      if (!r.token) continue;
+      const lines = r.run.tail();
+      const was = published.get(key);
+      if (was && sameTail(was.lines, lines)) continue;
+      published.set(key, { token: r.token, lines });
+      publishTail(r.token, lines);
+    }
+    for (const [key, was] of published) {
+      if (runs.has(key)) continue;
+      published.delete(key);
+      if (was.lines.length > 0) publishTail(was.token, []);
+    }
+  };
   const publish = () => {
     try {
       writeFileSync3(HOST_FILE, JSON.stringify({ pid: process.pid, at: Date.now(), roster: api.roster() }));
@@ -14410,6 +14500,7 @@ function startHost(opts) {
     void sweepSlots();
     publish();
   }, 5e3);
+  const activityTick = setInterval(streamActivity, ACTIVITY_MS);
   const stopSessions = () => {
     for (const { run, label } of runs.values()) {
       run.stop();
@@ -14447,6 +14538,8 @@ function startHost(opts) {
       clearInterval(pulse);
       clearInterval(spawnPoll);
       stopSessions();
+      streamActivity();
+      clearInterval(activityTick);
       try {
         writeFileSync3(HOST_FILE, JSON.stringify({ pid: process.pid, at: 0, roster: [] }));
       } catch {