@piagent/platform 1.8.0 → 1.9.0

package/packages/piagent-webui/server/loopback-server.ts

@@ -13,6 +13,9 @@ const MAX_BOOTSTRAP_BODY_BYTES = 4_096;
 const MAX_CONTROL_BODY_BYTES = 70_000;
 const MAX_ATTACHMENT_BODY_BYTES = 11_250_000;
 const REQUESTS_PER_MINUTE = 120;
+// An authenticated browser session refreshes its lists on every live event;
+// several busy conversations exceed 120 reads a minute in normal use.
+const SESSION_REQUESTS_PER_MINUTE = 600;
 const BOOTSTRAP_FAILURES_PER_MINUTE = 8;
 const CONTROLS_PER_MINUTE = 60;
 const MAX_JSON_RESPONSE_BYTES = 16 * 1024 * 1024;
@@ -69,6 +72,10 @@ export async function startLoopbackServer(options: {
   readProviderAuthJob?: (jobRef: string) => unknown | Promise<unknown>;
   executeProviderAuth?: (command: unknown) => unknown | Promise<unknown>;
   executeProjectImport?: () => unknown | Promise<unknown>;
+  readCompanyStatus?: () => unknown | Promise<unknown>;
+  executeCompanyConnect?: () => unknown | Promise<unknown>;
+  // Reads of a company session, answered by the company Gateway; null: local.
+  relaySessionRead?: (sessionRef: string, path: string) => Promise<{ status: number; value: unknown } | null>;
   gatewayProtocol?: GatewayProtocolHandler;
   readModel?: WebUiReadModelProvider;
   executeControl?: (command: unknown) => unknown | Promise<unknown>;
@@ -113,7 +120,7 @@ export async function startLoopbackServer(options: {
     if (now - rate.windowStart >= 60_000) Object.assign(rate, { windowStart: now, requests: 0, bootstrapFailures: 0 });
     rate.requests += 1; rates.set(rateKey, rate);
     while (rates.size > 128) rates.delete(rates.keys().next().value as string);
-    if (rate.requests > REQUESTS_PER_MINUTE) return errorResponse(response, 429, "rate-limit");
+    if (rate.requests > (browserSession ? SESSION_REQUESTS_PER_MINUTE : REQUESTS_PER_MINUTE)) return errorResponse(response, 429, "rate-limit");
     let url: URL;
     try { url = new URL(request.url ?? "/", origin); }
     catch { return errorResponse(response, 400, "invalid-url"); }
@@ -176,6 +183,33 @@ export async function startLoopbackServer(options: {
       }
     }
 
+    // A gateway without company sessions (the company WebUI itself, or a
+    // dashboard with no relay) answers null: no company section, no failed load.
+    if (request.method === "GET" && url.pathname === "/api/v1/managed") {
+      if (!auth.authenticate(request)) return errorResponse(response, 401, "authentication-required");
+      if (url.search) return errorResponse(response, 400, "invalid-managed-query");
+      if (!options.readCompanyStatus) return jsonResponse(response, 200, null);
+      try { return jsonResponse(response, 200, await options.readCompanyStatus()); }
+      catch { return errorResponse(response, 503, "managed-status-unavailable"); }
+    }
+
+    // Starts (or reconnects to) the company Gateway; macOS may ask for Keychain access.
+    if (request.method === "POST" && url.pathname === "/api/v1/managed/connect" && options.executeCompanyConnect) {
+      if (requestOrigin !== origin) return errorResponse(response, 403, "origin-required");
+      const mutationSession = auth.authorizeMutation(request);
+      if (!mutationSession) return errorResponse(response, 403, "mutation-authority-rejected");
+      if (!consumeControl(mutationSession.id, now)) return errorResponse(response, 429, "control-rate-limit");
+      if (!String(request.headers["content-type"] ?? "").toLowerCase().startsWith("application/json")) return errorResponse(response, 415, "content-type");
+      let command: Record<string, unknown>;
+      try { command = JSON.parse((await requestBody(request, MAX_BOOTSTRAP_BODY_BYTES)).toString("utf8")); }
+      catch (error) { return errorResponse(response, (error as Error).message === "body-limit" ? 413 : 400, "invalid-managed-connect"); }
+      if (!command || typeof command !== "object" || Array.isArray(command) || Object.keys(command).length !== 1 || command.action !== "managed.connect") {
+        return errorResponse(response, 400, "invalid-managed-connect");
+      }
+      try { return jsonResponse(response, 200, await options.executeCompanyConnect()); }
+      catch { return errorResponse(response, 503, "managed-connect-failed"); }
+    }
+
     if (request.method === "POST" && url.pathname === "/api/v1/provider-auth" && options.executeProviderAuth) {
       if (requestOrigin !== origin) return errorResponse(response, 403, "origin-required");
       const mutationSession = auth.authorizeMutation(request);
@@ -353,6 +387,8 @@ export async function startLoopbackServer(options: {
         return errorResponse(response, 400, "invalid-session-inspection-ref");
       }
       try {
+        const relayed = await options.relaySessionRead?.(sessionRef, inspectionPath + url.search);
+        if (relayed) return jsonResponse(response, relayed.status, relayed.value);
         if (inspectionPath === "/connections") {
           if (url.search || !options.readSessionConnections) return errorResponse(response, 404, "inspection-route-not-found");
           const value = await options.readSessionConnections(sessionRef);

package/packages/piagent-webui/server/message-stop-reason.ts

@@ -0,0 +1,11 @@
+// Some providers end a turn the member stopped with `stopReason: "error"` and
+// the AbortError text instead of `stopReason: "aborted"`. That is a stop, not a
+// model failure: showing "the model returned an error" for it tells the member
+// to resend or change model after they pressed Stop themselves.
+const ABORT_ERROR = /\b(?:this operation|the operation|request) was aborted\b|\bAbortError\b|^aborted$/i;
+
+export function effectiveStopReason(message: any): string {
+  const stopReason = String(message?.stopReason ?? "");
+  if (stopReason === "error" && ABORT_ERROR.test(String(message?.errorMessage ?? "").trim())) return "aborted";
+  return stopReason;
+}

package/packages/piagent-webui/server/tool-call-summary.ts

@@ -0,0 +1,185 @@
+import os from "node:os";
+import path from "node:path";
+
+import { redactSensitiveText } from "../../piagent-core/extensions/redaction-core.js";
+
+// What a coding-agent timeline shows for one tool call: the kind of action,
+// its target (project-relative path, command, query or URL), an edit's diff
+// and a bounded result preview. Every string is ANSI-stripped and redacted;
+// raw arguments and results never leave the server.
+export type ToolKind = "read" | "write" | "edit" | "command" | "search" | "list" | "web-search" | "web-fetch"
+  | "subagent" | "network" | "git" | "plan" | "other";
+export type ToolSummary = { kind: ToolKind; target: string | null; detail: string | null };
+export type ToolChange = { added: number; removed: number; preview: string; truncated: boolean };
+export type ToolResult = { text: string; truncated: boolean; isError: boolean };
+export type TurnUsage = { inputTokens: number; outputTokens: number; cacheReadTokens: number; cacheWriteTokens: number; totalTokens: number };
+
+const ANSI = /\u001b(?:\[[0-?]*[ -/]*[@-~]|[@-_])/g;
+const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g;
+const TARGET_CHARS = 400, DETAIL_CHARS = 400, PREVIEW_LINES = 80, PREVIEW_CHARS = 6_000, RESULT_LINES = 60, RESULT_CHARS = 4_000;
+
+function clean(value: unknown, max: number): string | null {
+  if (typeof value !== "string" || !value.trim()) return null;
+  const text = redactedWhole(value);
+  return text.length > max ? `${text.slice(0, max - 1)}…` : text;
+}
+// Redaction needs the whole text: a private key is recognised only while its
+// lines are together, so file contents and edit texts are redacted before they
+// are split into preview rows.
+function redactedWhole(value: unknown): string {
+  return redactSensitiveText(String(value ?? "").replace(ANSI, "").replace(CONTROL, " ")).text;
+}
+function record(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
+}
+function pick(args: Record<string, unknown>, keys: readonly string[]): unknown {
+  for (const key of keys) if (args[key] !== undefined && args[key] !== null && args[key] !== "") return args[key];
+  return undefined;
+}
+// Paths inside the project are shown relative to it; anything else only by
+// its file name, so folders outside the project never reach the browser.
+export function displayPath(value: unknown, cwd?: string): string | null {
+  if (typeof value !== "string" || !value.trim()) return null;
+  const raw = value.trim();
+  if (!path.isAbsolute(raw)) return raw.split(/[\\/]/).includes("..") ? clean(path.basename(raw), TARGET_CHARS) : clean(raw, TARGET_CHARS);
+  const relative = cwd ? path.relative(cwd, raw) : "";
+  return cwd && !relative.startsWith("..") && !path.isAbsolute(relative) ? clean(relative || ".", TARGET_CHARS) : clean(path.basename(raw), TARGET_CHARS);
+}
+// A command as run in the project: the project folder reads "." and the home
+// folder "~".
+function displayCommand(value: unknown, cwd?: string): string | null {
+  if (typeof value !== "string") return null;
+  let shown = value;
+  if (cwd && cwd.length > 1) shown = shown.split(cwd).join(".");
+  const home = os.homedir();
+  if (home.length > 1) shown = shown.split(home).join("~");
+  return clean(shown, TARGET_CHARS);
+}
+// A multi-line command (a heredoc, a script) reads by its first line; the
+// whole command, bounded, opens in the step's body.
+function commandParts(value: unknown, cwd?: string): { target: string | null; script: string | null } {
+  const full = displayCommand(value, cwd), rows = full ? full.split("\n").filter((row) => row.trim()) : [];
+  return rows.length > 1 ? { target: `${rows[0].trim().slice(0, TARGET_CHARS - 2)} …`, script: full } : { target: full, script: null };
+}
+const lines = (text: string) => text === "" ? [] : text.replace(/\r\n/g, "\n").split("\n");
+
+function bounded(rows: string[], removed: number, added: number): ToolChange {
+  let preview = "", count = 0, truncated = false;
+  for (const row of rows) {
+    const safe = (clean(row, 400) ?? row.slice(0, 1)).replace(/\n/g, " ");
+    if (count >= PREVIEW_LINES || preview.length + safe.length + 1 > PREVIEW_CHARS) { truncated = true; break; }
+    preview += (count ? "\n" : "") + safe; count += 1;
+  }
+  return { added, removed, preview, truncated };
+}
+// Old and new text of each edit, trimmed to the changed lines plus two lines
+// of context: enough to read the change without reproducing the file.
+function editChange(edits: Array<{ oldText?: unknown; newText?: unknown }>): ToolChange {
+  const rows: string[] = []; let added = 0, removed = 0;
+  for (const edit of edits.slice(0, 20)) {
+    const before = lines(redactedWhole(edit.oldText)), after = lines(redactedWhole(edit.newText));
+    let head = 0; while (head < before.length && head < after.length && before[head] === after[head]) head += 1;
+    let tail = 0; while (tail < before.length - head && tail < after.length - head && before[before.length - 1 - tail] === after[after.length - 1 - tail]) tail += 1;
+    const gone = before.slice(head, before.length - tail), come = after.slice(head, after.length - tail);
+    removed += gone.length; added += come.length;
+    if (rows.length) rows.push("@@");
+    for (const row of before.slice(Math.max(0, head - 2), head)) rows.push(` ${row}`);
+    for (const row of gone) rows.push(`-${row}`);
+    for (const row of come) rows.push(`+${row}`);
+    for (const row of before.slice(before.length - tail, Math.min(before.length, before.length - tail + 2))) rows.push(` ${row}`);
+  }
+  return bounded(rows, removed, added);
+}
+
+// A patch in the apply_patch format: the files it touches (from its
+// "*** Add/Update/Delete File:" headers) and its +/- body lines, redacted as a
+// whole like an edit. "write" when it only adds files.
+function patchChange(value: unknown, cwd?: string): { summary: ToolSummary; change: ToolChange } {
+  const text = redactedWhole(value), rows: string[] = [], files: string[] = []; let added = 0, removed = 0, onlyAdds = true;
+  for (const row of lines(text)) {
+    const header = row.match(/^\*\*\* (Add|Update|Delete) File: (.+)$/);
+    if (header) { files.push(header[2].trim()); if (header[1] !== "Add") onlyAdds = false; if (rows.length) rows.push("@@"); continue; }
+    if (/^\*\*\* (Begin|End) Patch$|^\*\*\* Move to: /.test(row)) continue;
+    if (row.startsWith("@@")) { if (rows.length && rows.at(-1) !== "@@") rows.push("@@"); continue; }
+    if (row.startsWith("+")) added += 1; else if (row.startsWith("-")) removed += 1;
+    rows.push(row);
+  }
+  const first = displayPath(files[0], cwd), more = files.length - 1;
+  return { summary: { kind: files.length && onlyAdds ? "write" : "edit", target: first && more > 0 ? `${first} +${more}` : first, detail: null },
+    change: bounded(rows, removed, added) };
+}
+
+const ALIASES: Record<string, string> = { read_file: "read", view: "read", cat: "read", write_file: "write", create_file: "write",
+  edit_file: "edit", str_replace: "edit", str_replace_editor: "edit", shell: "bash", exec: "bash", run: "bash", terminal: "bash", run_experiment: "bash",
+  glob: "find", search: "grep", search_files: "grep", list: "ls", list_files: "ls", list_dir: "ls" };
+
+export function summarizeToolCall(name: unknown, input: unknown, cwd?: string): { summary: ToolSummary; change?: ToolChange } {
+  const raw = String(name ?? "").toLowerCase(), tool = ALIASES[raw] ?? raw, args = record(input);
+  const file = pick(args, ["path", "file_path", "filePath", "file"]);
+  switch (tool) {
+    case "read": {
+      const offset = Number(args.offset), limit = Number(args.limit);
+      const detail = Number.isInteger(offset) && offset > 0 ? `${offset}${Number.isInteger(limit) && limit > 0 ? `–${offset + limit - 1}` : "+"}` : null;
+      return { summary: { kind: "read", target: displayPath(file, cwd), detail } };
+    }
+    case "write": {
+      const content = lines(redactedWhole(args.content));
+      return { summary: { kind: "write", target: displayPath(file, cwd), detail: null },
+        change: bounded(content.map((row) => `+${row}`), 0, content.length) };
+    }
+    case "edit": {
+      const edits = Array.isArray(args.edits) ? args.edits as Array<{ oldText?: unknown; newText?: unknown }>
+        : [{ oldText: args.oldText ?? args.old_string, newText: args.newText ?? args.new_string }];
+      return { summary: { kind: "edit", target: displayPath(file, cwd), detail: null }, change: editChange(edits) };
+    }
+    case "apply_patch": return patchChange(pick(args, ["patch", "input"]), cwd);
+    case "bash": {
+      const command = commandParts(args.command, cwd);
+      return { summary: { kind: "command", target: command.target, detail: command.script } };
+    }
+    case "run_with_network":
+      return { summary: { kind: "network", target: commandParts(args.command, cwd).target, detail: clean(args.reason, DETAIL_CHARS) } };
+    case "grep": case "find": {
+      const where = [displayPath(args.path, cwd), clean(args.glob, 120)].filter(Boolean).join(" · ");
+      return { summary: { kind: "search", target: clean(args.pattern, TARGET_CHARS), detail: where || null } };
+    }
+    case "ls": return { summary: { kind: "list", target: displayPath(file ?? ".", cwd), detail: null } };
+    case "web_search": return { summary: { kind: "web-search", target: clean(args.query, TARGET_CHARS), detail: null } };
+    case "web_fetch": return { summary: { kind: "web-fetch", target: clean(args.url, TARGET_CHARS), detail: null } };
+    case "delegate": case "subagent":
+      return { summary: { kind: "subagent", target: clean(pick(args, ["role", "agent", "name"]), 40), detail: clean(args.task, 200) } };
+    case "fetch_origin": return { summary: { kind: "git", target: clean(pick(args, ["remote", "branch", "ref"]) ?? "origin", 120), detail: null } };
+    case "update_plan": {
+      // The checklist's progress, and the step being worked on.
+      const steps = Array.isArray(args.plan) ? (args.plan as Array<{ step?: unknown; status?: unknown }>) : [];
+      const done = steps.filter((p) => p?.status === "completed").length, current = steps.find((p) => p?.status === "in_progress");
+      return { summary: { kind: "plan", target: `${done}/${steps.length}`, detail: clean(current?.step, 200) } };
+    }
+    default: {
+      const first = Object.values(args).find((value) => typeof value === "string" && value.trim()) as string | undefined;
+      const target = first && /[\\/]/.test(first) ? displayPath(first, cwd) : clean(first, 200);
+      return { summary: { kind: "other", target, detail: null } };
+    }
+  }
+}
+
+export function toolResultPreview(message: any): ToolResult {
+  const text = typeof message?.content === "string" ? message.content : Array.isArray(message?.content)
+    ? message.content.filter((part: any) => part?.type === "text" && typeof part.text === "string").map((part: any) => part.text).join("\n") : "";
+  const all = lines(clean(text, 1_000_000) ?? ""), kept = all.slice(0, RESULT_LINES).join("\n");
+  return { text: kept.slice(0, RESULT_CHARS), truncated: all.length > RESULT_LINES || kept.length > RESULT_CHARS, isError: Boolean(message?.isError) };
+}
+
+export function turnUsage(message: any): TurnUsage | null {
+  const usage = record(message?.usage);
+  const count = (value: unknown) => Number.isFinite(Number(value)) && Number(value) > 0 ? Math.min(10_000_000_000, Math.round(Number(value))) : 0;
+  const value = { inputTokens: count(usage.input), outputTokens: count(usage.output), cacheReadTokens: count(usage.cacheRead),
+    cacheWriteTokens: count(usage.cacheWrite), totalTokens: count(usage.totalTokens) };
+  if (!value.totalTokens) value.totalTokens = Math.min(10_000_000_000, value.inputTokens + value.outputTokens + value.cacheReadTokens + value.cacheWriteTokens);
+  return value.totalTokens ? value : null;
+}
+
+export function modelLabel(message: any): string | null {
+  const model = typeof message?.model === "string" ? message.model.replace(/[^A-Za-z0-9._:@/-]/g, "").slice(0, 120) : "";
+  return model || null;
+}

package/packages/piagent-webui/server/transcript-projection.ts

@@ -5,9 +5,13 @@ import { looksLikeCompletionClaim } from "../../piagent-core/runtime/session/com
 import { isLightweightNonAuthorizingChangeLanguage } from "../../piagent-core/runtime/workflows/change-clarification.ts";
 import { workflowCommandPattern } from "../../piagent-core/runtime/workflows/webui-workflow.ts";
 import { hasVisibleText } from "../shared/text-visibility.ts";
+import { effectiveStopReason } from "./message-stop-reason.ts";
 import { WEBUI_MESSAGE_CORRELATION_ENTRY_TYPE, webUiMessageCorrelationEntry,
   type WebUiMessageCorrelation } from "../shared/message-correlation.ts";
 import { terminalDeliveryPairs, type TerminalDeliveryPair, type TerminalDeliveryReceipt } from "./terminal-delivery-receipt.ts";
+import { parseFailure } from "../../piagent-core/runtime/managed-failure.mjs";
+import { modelLabel, summarizeToolCall, toolResultPreview, turnUsage, type ToolChange, type ToolResult, type ToolSummary,
+  type TurnUsage } from "./tool-call-summary.ts";
 
 const MAX_ENTRIES = 50_000;
 const MAX_ITEMS = 200;
@@ -28,7 +32,11 @@ type TranscriptAttachment = { displayName: string; kind: "file" | "image" | "doc
 type TranscriptItem = { messageRef: string; parentMessageRef: string | null; role: "user" | "assistant" | "tool-result" | "custom"; recordedAt: string;
   agentOperationId: string | null; messageRequestId?: string; turnIndex: number | null; content: TranscriptContent;
   attachments?: TranscriptAttachment[];
-  toolCalls: Array<{ toolCallRef: string; toolName: string; state: "requested" | "completed" | "failed" | "unknown" }> };
+  toolCalls: Array<{ toolCallRef: string; toolName: string; state: "requested" | "completed" | "failed" | "unknown";
+    summary?: ToolSummary; change?: ToolChange; result?: ToolResult }>; usage?: TurnUsage; model?: string; process?: HarnessProcess };
+type HarnessFinding = { severity: "blocking" | "major" | "minor"; file: string; line: number | null; issue: string };
+type HarnessProcess = { phase: "plan" | "verify" | "review" | "final"; outcome?: string; loop?: number; maxLoops?: number; verified?: boolean; reviewed?: boolean;
+  blockingOpen?: number; planOpen?: number; planSkipped?: true; verifyPolicy?: string; reviewPolicy?: string; reviewUnavailable?: string; findings?: HarnessFinding[] };
 export type TranscriptDocument = { schemaVersion: 1; version: "piagent-webui-transcript-v1"; generatedAt: string; identity: TranscriptIdentity;
   revision: TranscriptRevision; eventCursor: string; state: "ready" | "unavailable"; items: TranscriptItem[];
   page: { beforeCursor: string | null; nextBeforeCursor: string | null; hasOlder: boolean; limit: number; truncated: boolean }; reasonCode: string | null };
@@ -44,6 +52,8 @@ export type TranscriptProjectionInput = {
   taskOutcome?: string | null;
   terminalDeliveryReceipt?: TerminalDeliveryReceipt;
   terminalDeliveryEntries?: unknown[];
+  // The session's project folder: tool paths are shown relative to it.
+  cwd?: string;
 };
 
 function hash(value: string): string { return createHash("sha256").update(value).digest("hex"); }
@@ -88,8 +98,18 @@ function userMessageProjection(message: any): { text: string; attachments: Trans
   // text the operator typed; the remaining recognized blocks become cards.
   return { text: attachments.length ? String(textParts[0]?.text ?? "") : messageText(message), attachments: attachments.slice(0, 4) };
 }
+// A company request fails with Studio's (or Agent Watch's) own code: who
+// failed, which kind of failure, and Studio's request id. Text is never shown.
+export type CompanyFailure = { role: "main" | "research" | "review"; reasonCode: string; code: string; requestRef: string | null; local: boolean };
+export function companyFailure(text: unknown): CompanyFailure | null {
+  const parsed = parseFailure(text);
+  if (!parsed || !/^[A-Za-z0-9][A-Za-z0-9_:.-]{0,79}$/.test(parsed.code)) return null;
+  return { role: parsed.role as CompanyFailure["role"], reasonCode: `company-${parsed.kind}`, code: parsed.code, requestRef: parsed.requestId, local: parsed.local };
+}
+const COMPANY = "agent_watch_managed";
 function assistantFailureReason(message: any): string | null {
   if (message?.role !== "assistant" || message?.stopReason !== "error") return null;
+  if (message.provider === COMPANY) return companyFailure(message.errorMessage)?.reasonCode ?? "company-failed";
   const detail = String(message?.errorMessage ?? "").toLowerCase();
   if (/(?:authentication|auth|token|credential).{0,48}expired|expired.{0,48}(?:authentication|auth|token|credential)/.test(detail)) {
     return "provider-auth-expired";
@@ -103,7 +123,7 @@ function assistantFailureReason(message: any): string | null {
 }
 function assistantUnavailableReason(message: any, text: string, projectedToolCalls: TranscriptItem["toolCalls"]): string | null {
   if (message?.role !== "assistant") return null;
-  const stopReason = String(message?.stopReason ?? "");
+  const stopReason = effectiveStopReason(message);
   if (stopReason === "error") return assistantFailureReason(message) ?? "provider-response-failed";
   if (stopReason === "aborted") return "assistant-message-aborted";
   if (stopReason === "length") return "assistant-output-incomplete";
@@ -141,6 +161,31 @@ function toolCalls(message: any, sessionRef: string, role: TranscriptItem["role"
     return { toolCallRef: opaque("tool", [sessionRef, item.id ?? index]), toolName: safeToolName(item.name), state: item.state };
   });
 }
+// The harness's process notes ("agent-watch-process"): what it asked of the
+// agent before a code-changing turn ended, and how that turn ended.
+const PROCESS_OUTCOMES = ["no_change", "interrupted", "blocking_open", "unverified", "review_unavailable", "unreviewed", "clean"];
+const POLICY_MODES = ["off", "suggest", "require"];
+function harnessProcess(details: any): HarnessProcess | null {
+  if (!["plan", "verify", "review", "final"].includes(details?.phase)) return null;
+  const loop = (n: unknown): n is number => Number.isInteger(n) && (n as number) >= 0 && (n as number) <= 3;
+  const out: HarnessProcess = { phase: details.phase };
+  if (PROCESS_OUTCOMES.includes(details.outcome)) out.outcome = details.outcome;
+  if (loop(details.loop)) out.loop = details.loop;
+  if (loop(details.maxLoops)) out.maxLoops = details.maxLoops;
+  if (typeof details.verified === "boolean") out.verified = details.verified;
+  if (typeof details.reviewed === "boolean") out.reviewed = details.reviewed;
+  if (Number.isInteger(details.blockingOpen) && details.blockingOpen >= 0) out.blockingOpen = Math.min(details.blockingOpen, 1000);
+  if (Number.isInteger(details.planOpen) && details.planOpen >= 1 && details.planOpen <= 30) out.planOpen = details.planOpen;
+  if (details.planSkipped === true) out.planSkipped = true;
+  if (POLICY_MODES.includes(details.policy?.verify)) out.verifyPolicy = details.policy.verify;
+  if (POLICY_MODES.includes(details.policy?.review)) out.reviewPolicy = details.policy.review;
+  if (["too_large", "not_git", "limit", "failed"].includes(details.reviewUnavailable)) out.reviewUnavailable = details.reviewUnavailable;
+  if (Array.isArray(details.findings)) out.findings = details.findings
+    .filter((f: any) => ["blocking", "major", "minor"].includes(f?.severity) && typeof f.issue === "string" && f.issue.trim()).slice(0, 10)
+    .map((f: any) => ({ severity: f.severity, file: safeText(String(f.file ?? "")).full.slice(0, 300), line: Number.isSafeInteger(f.line) && f.line > 0 ? f.line : null,
+      issue: safeText(f.issue).full.slice(0, 500) }));
+  return out;
+}
 function role(message: any): TranscriptItem["role"] | null {
   return message?.role === "user" ? "user" : message?.role === "assistant" ? "assistant" : message?.role === "toolResult" ? "tool-result" : null;
 }
@@ -198,6 +243,13 @@ function correlatedTranscriptItems(entries: unknown[], identity: TranscriptIdent
       pending = webUiMessageCorrelationEntry(entry);
       continue;
     }
+    if (entry?.type === "custom_message" && entry.customType === "agent-watch-process") {
+      const process = harnessProcess(entry.details);
+      const projected = process && item({ ...entry, type: "message", message: { role: "custom", content: entry.content } }, identity, true);
+      if (projected) values.push({ entry, item: { ...projected, process, ...(turn ? { agentOperationId: turn.operationRef, messageRequestId: turn.messageRequestId } : {}) },
+        cursor: opaque("transcript", [identity.sessionRef, entry.id]) });
+      continue;
+    }
     if (role(entry?.message) === "user") { turn = pending; pending = null; }
     const projected = item(entry, identity);
     if (!projected) continue;
@@ -291,6 +343,37 @@ function boundedTurnPage(
   return { selected, start, compacted: false };
 }
 
+// The agent timeline: each tool call of a shown answer carries its summary,
+// an edit's diff and its result preview; answers carry usage and model.
+function timelineItems(selected: ProjectedTranscriptItem[], all: ProjectedTranscriptItem[], cwd?: string): TranscriptItem[] {
+  const results = new Map<string, any>();
+  for (const value of all) if (value.item.role === "tool-result" && value.item.toolCalls[0]) results.set(value.item.toolCalls[0].toolCallRef, value.entry?.message);
+  return selected.map((value) => {
+    if (value.item.role !== "assistant") return value.item;
+    const message = value.entry?.message;
+    const blocks = Array.isArray(message?.content) ? message.content.filter((part: any) => part?.type === "toolCall") : [];
+    const toolCalls = value.item.toolCalls.map((call, index) => {
+      const block = blocks[index], result = results.get(call.toolCallRef);
+      if (!block) return call;
+      const { summary, change } = summarizeToolCall(block.name, block.arguments, cwd);
+      // A helper's answer can carry its delegated prompt and artifacts: only
+      // its outcome is shown, never its text.
+      const shown = result && summary.kind !== "subagent" ? { result: toolResultPreview(result) } : {};
+      // A failed helper or company search says why (its code), not what it wrote.
+      const failed = result?.isError && message?.provider === COMPANY && ["subagent", "web-search"].includes(summary.kind)
+        ? companyFailure(toolResultPreview(result).text) : null;
+      return { ...call, summary, ...(change ? { change } : {}), ...shown, ...(failed ? { failure: failed } : {}),
+        ...(result ? { state: result.isError ? "failed" as const : "completed" as const } : {}) };
+    });
+    // A company turn is answered by a harness role; which model sits behind it
+    // is the harness's business and stays out of the browser.
+    const company = message?.provider === COMPANY;
+    const usage = turnUsage(message), model = company ? null : modelLabel(message);
+    const failure = company && effectiveStopReason(message) === "error" ? companyFailure(message.errorMessage) : null;
+    return { ...value.item, toolCalls, ...(usage ? { usage } : {}), ...(model ? { model } : {}), ...(failure ? { failure } : {}) };
+  });
+}
+
 function unavailable(input: TranscriptProjectionInput, reasonCode: string, limit: number): TranscriptDocument {
   return { schemaVersion: 1, version: "piagent-webui-transcript-v1", generatedAt: input.generatedAt ?? new Date().toISOString(),
     identity: structuredClone(input.identity), revision: structuredClone(input.revision), eventCursor: input.eventCursor,
@@ -314,7 +397,7 @@ export function projectTranscript(input: TranscriptProjectionInput): TranscriptD
     if (cursorIndex < 0) return unavailable(input, "transcript-cursor-gap", limit);
     end = cursorIndex;
   }
-  const page = boundedTurnPage(projected, end, limit), selected = page.selected.map((value) => value.item), hasOlder = page.start > 0;
+  const page = boundedTurnPage(projected, end, limit), selected = timelineItems(page.selected, projected, input.cwd), hasOlder = page.start > 0;
   return { schemaVersion: 1, version: "piagent-webui-transcript-v1", generatedAt: input.generatedAt ?? new Date().toISOString(),
     identity: structuredClone(input.identity), revision: structuredClone(input.revision), eventCursor: input.eventCursor,
     state: "ready", items: selected, page: { beforeCursor: input.beforeCursor ?? null, nextBeforeCursor: hasOlder ? cursors[page.start] : null,

package/packs/engineering-base/pack.json

@@ -45,6 +45,10 @@
         {
           "id": "piagent-ops",
           "path": "packages/piagent-core/skills/piagent-ops/SKILL.md"
+        },
+        {
+          "id": "test-audit",
+          "path": "packages/piagent-core/skills/test-audit/SKILL.md"
         }
       ],
       "subagents": [

package/schemas/piagent-webui/runtime-command-v1.schema.json

@@ -9,9 +9,8 @@
   "$defs": {
     "action": {
       "enum": [
-        "runtime.status", "runtime.inspector", "runtime.commands", "runtime.fast-status", "runtime.fast-on", "runtime.fast-off", "orchestration.status",
+        "runtime.status", "runtime.inspector", "runtime.fast-status", "runtime.fast-on", "runtime.fast-off", "orchestration.status",
         "usage.live", "usage.history", "usage.logs", "usage.efficiency", "usage.preflight",
-        "onboarding.status", "onboarding.profile", "onboarding.tech",
         "profile.status", "profile.options", "profile.tech-options", "profile.apply", "profile.auto",
         "context.status", "context.rebuild", "context.search", "context.pack", "context.impact", "context.efficiency", "context.preflight", "context.compact",
         "memory.status",

package/schemas/piagent-webui/session-catalog-v1.schema.json

@@ -91,6 +91,14 @@
         "unread": { "type": "boolean" },
         "composerAvailable": { "type": "boolean" },
         "needsAttention": { "type": "boolean" },
+        "managedHelpers": { "type": "object", "additionalProperties": false, "required": ["active", "maximum"], "properties": {"active": {"type": ["integer", "null"], "minimum": 0, "maximum": 2}, "maximum": {"const": 2}} },
+        "managedThinkingLevels": {"type": "array", "uniqueItems": true, "maxItems": 7, "items": {"enum": ["off","minimal","low","medium","high","xhigh","max"]}},
+        "managedPlan": { "type": "object", "additionalProperties": false, "required": ["steps"], "properties": {
+          "steps": { "type": "array", "minItems": 1, "maxItems": 30, "items": { "type": "object", "additionalProperties": false, "required": ["step", "status"], "properties": {
+            "step": { "type": "string", "minLength": 1, "maxLength": 200 }, "status": { "enum": ["pending", "in_progress", "completed"] } } } } } },
+        "managedProcess": { "type": "object", "additionalProperties": false, "required": ["outcome", "verified", "reviewed", "blockingOpen"], "properties": {
+          "outcome": { "enum": ["no_change", "interrupted", "blocking_open", "unverified", "review_unavailable", "unreviewed", "clean"] },
+          "verified": { "type": "boolean" }, "reviewed": { "type": "boolean" }, "blockingOpen": { "type": "integer", "minimum": 0, "maximum": 1000 }, "planSkipped": { "const": true } } },
         "modelLabel": { "$ref": "common-v1.schema.json#/$defs/nullableDisplayText" },
         "thinkingLevel": { "enum": ["off", "minimal", "low", "medium", "high", "xhigh", "max", "unknown"] },
         "contextUsage": { "$ref": "#/$defs/contextUsage" },

package/schemas/piagent-webui/transcript-v1.schema.json

@@ -152,6 +152,52 @@
         }
       ]
     },
+    "harnessProcess": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["phase"],
+      "properties": {
+        "phase": { "enum": ["plan", "verify", "review", "final"] },
+        "outcome": { "enum": ["no_change", "interrupted", "blocking_open", "unverified", "review_unavailable", "unreviewed", "clean"] },
+        "loop": { "type": "integer", "minimum": 0, "maximum": 3 },
+        "maxLoops": { "type": "integer", "minimum": 0, "maximum": 3 },
+        "verified": { "type": "boolean" },
+        "reviewed": { "type": "boolean" },
+        "blockingOpen": { "type": "integer", "minimum": 0, "maximum": 1000 },
+        "planOpen": { "type": "integer", "minimum": 1, "maximum": 30 },
+        "planSkipped": { "const": true },
+        "verifyPolicy": { "enum": ["off", "suggest", "require"] },
+        "reviewPolicy": { "enum": ["off", "suggest", "require"] },
+        "reviewUnavailable": { "enum": ["too_large", "not_git", "limit", "failed"] },
+        "findings": {
+          "type": "array",
+          "maxItems": 10,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["severity", "file", "line", "issue"],
+            "properties": {
+              "severity": { "enum": ["blocking", "major", "minor"] },
+              "file": { "type": "string", "maxLength": 300 },
+              "line": { "type": ["integer", "null"], "minimum": 1 },
+              "issue": { "type": "string", "maxLength": 500 }
+            }
+          }
+        }
+      }
+    },
+    "companyFailure": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["role", "reasonCode", "code", "requestRef", "local"],
+      "properties": {
+        "role": { "enum": ["main", "research", "review"] },
+        "reasonCode": { "$ref": "common-v1.schema.json#/$defs/reasonCode" },
+        "code": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_:.-]{0,79}$" },
+        "requestRef": { "anyOf": [{ "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" }, { "type": "null" }] },
+        "local": { "type": "boolean" }
+      }
+    },
     "toolCall": {
       "type": "object",
       "additionalProperties": false,
@@ -164,7 +210,39 @@
           "maxLength": 80,
           "pattern": "^[A-Za-z0-9][A-Za-z0-9._:@~-]{0,79}$"
         },
-        "state": { "enum": ["requested", "completed", "failed", "unknown"] }
+        "state": { "enum": ["requested", "completed", "failed", "unknown"] },
+        "summary": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "target", "detail"],
+          "properties": {
+            "kind": { "enum": ["read", "write", "edit", "command", "search", "list", "web-search", "web-fetch", "subagent", "network", "git", "plan", "other"] },
+            "target": { "anyOf": [{ "type": "string", "maxLength": 400 }, { "type": "null" }] },
+            "detail": { "anyOf": [{ "type": "string", "maxLength": 400 }, { "type": "null" }] }
+          }
+        },
+        "change": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["added", "removed", "preview", "truncated"],
+          "properties": {
+            "added": { "type": "integer", "minimum": 0, "maximum": 1000000 },
+            "removed": { "type": "integer", "minimum": 0, "maximum": 1000000 },
+            "preview": { "type": "string", "maxLength": 6000 },
+            "truncated": { "type": "boolean" }
+          }
+        },
+        "result": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["text", "truncated", "isError"],
+          "properties": {
+            "text": { "type": "string", "maxLength": 4000 },
+            "truncated": { "type": "boolean" },
+            "isError": { "type": "boolean" }
+          }
+        },
+        "failure": { "$ref": "#/$defs/companyFailure" }
       }
     },
     "transcriptItem": {
@@ -195,6 +273,21 @@
           "uniqueItems": true,
           "items": { "$ref": "#/$defs/attachmentSummary" }
         },
+        "usage": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens", "totalTokens"],
+          "properties": {
+            "inputTokens": { "type": "integer", "minimum": 0, "maximum": 10000000000 },
+            "outputTokens": { "type": "integer", "minimum": 0, "maximum": 10000000000 },
+            "cacheReadTokens": { "type": "integer", "minimum": 0, "maximum": 10000000000 },
+            "cacheWriteTokens": { "type": "integer", "minimum": 0, "maximum": 10000000000 },
+            "totalTokens": { "type": "integer", "minimum": 0, "maximum": 10000000000 }
+          }
+        },
+        "model": { "type": "string", "minLength": 1, "maxLength": 120, "pattern": "^[A-Za-z0-9._:@/-]{1,120}$" },
+        "failure": { "$ref": "#/$defs/companyFailure" },
+        "process": { "$ref": "#/$defs/harnessProcess" },
         "toolCalls": {
           "type": "array",
           "maxItems": 64,