@pikiloom/kernel 0.3.14 → 0.3.16

package/dist/contracts/driver.d.ts

@@ -6,6 +6,9 @@ export interface AgentTurnInput {
     fork?: {
         anchor?: string | null;
     } | null;
+    rewind?: {
+        anchor?: string | null;
+    } | null;
     workdir: string;
     model?: string | null;
     effort?: string | null;
@@ -110,6 +113,7 @@ export interface AgentDriver {
         resume?: boolean;
         tui?: boolean;
         fork?: boolean;
+        rewind?: boolean;
     };
     run(input: AgentTurnInput, ctx: DriverContext): Promise<DriverResult>;
     tui?(input: TuiInput): TuiSpec;

package/dist/contracts/ports.d.ts

@@ -25,6 +25,9 @@ export interface CoreSessionRecord {
         anchor: string | null;
         mode: 'native' | 'seed';
     } | null;
+    pendingRewind?: {
+        anchor: string | null;
+    } | null;
 }
 export interface SessionStore {
     ensure(agent: string, opts: {
@@ -48,6 +51,7 @@ export interface SessionStore {
     reconcileRunning?(isAlive: (pid: number) => boolean): Promise<number>;
     appendTurn?(agent: string, sessionId: string, turn: UniversalSnapshot): Promise<void>;
     history?(agent: string, sessionId: string): Promise<UniversalSnapshot[]>;
+    truncateTurns?(agent: string, sessionId: string, throughTaskId: string | null): Promise<void>;
 }
 export interface ModelInjection {
     model?: string | null;

package/dist/contracts/surface.d.ts

@@ -23,6 +23,13 @@ export interface LoomIO {
     forkSession(input: ForkSessionInput): Promise<{
         sessionKey: string;
     }>;
+    rewindSession(input: {
+        sessionKey: string;
+        atTaskId: string;
+        anchor?: string | null;
+    }): Promise<{
+        sessionKey: string;
+    }>;
     stop(sessionKey: string): boolean;
     steer(taskId: string, prompt: string, attachments?: string[]): Promise<boolean>;
     interact(promptId: string, action: 'select' | 'text' | 'skip' | 'cancel', value?: string): boolean;

package/dist/drivers/claude.d.ts

@@ -9,6 +9,7 @@ export declare class ClaudeDriver implements AgentDriver {
         resume: boolean;
         tui: boolean;
         fork: boolean;
+        rewind: boolean;
     };
     constructor(bin?: string);
     tui(input: TuiInput): TuiSpec;
@@ -25,6 +26,8 @@ export declare class ClaudeDriver implements AgentDriver {
 }
 export declare function claudeResumeArgs(sessionId: string, fork?: {
     anchor?: string | null;
+} | null, rewind?: {
+    anchor?: string | null;
 } | null): string[];
 export declare function handleClaudeEvent(ev: any, s: any, emit: (e: DriverEvent) => void): void;
 export declare function claudeBgHoldCapMs(): number;

package/dist/drivers/claude.js

@@ -9,7 +9,7 @@ import { attachedFileNote, contextPercent, createLineBuffer, imageMimeForFile, p
 export class ClaudeDriver {
     bin;
     id = 'claude';
-    capabilities = { steer: true, interact: false, resume: true, tui: true, fork: true };
+    capabilities = { steer: true, interact: false, resume: true, tui: true, fork: true, rewind: true };
     constructor(bin = 'claude') {
         this.bin = bin;
     }
@@ -43,7 +43,7 @@ export class ClaudeDriver {
         if (input.effort)
             args.push('--effort', input.effort === 'ultra' ? 'max' : input.effort); // request extended thinking (ultra is a display-only alias for max)
         if (input.sessionId)
-            args.push(...claudeResumeArgs(input.sessionId, input.fork));
+            args.push(...claudeResumeArgs(input.sessionId, input.fork, input.rewind));
         if (input.systemPrompt)
             args.push('--append-system-prompt', input.systemPrompt);
         if (input.mcpConfigPath)
@@ -369,14 +369,19 @@ export class ClaudeDriver {
 }
 // The --resume flag family for one turn: plain resume appends to the session; a fork branches
 // a NEW session off it (--fork-session), optionally cut at an inclusive keep-boundary record
-// uuid (--resume-session-at). Pure so tests can pin the arg contract without spawning.
-export function claudeResumeArgs(sessionId, fork) {
+// uuid (--resume-session-at); a rewind cuts at that boundary WITHOUT --fork-session, so claude
+// rebranches the SAME session in place (the transcript is a parentUuid tree — the dropped tip
+// becomes a dead sibling and leaves the active path). Pure so tests pin the arg contract.
+export function claudeResumeArgs(sessionId, fork, rewind) {
     const args = ['--resume', sessionId];
     if (fork) {
         args.push('--fork-session');
         if (fork.anchor)
             args.push('--resume-session-at', fork.anchor);
     }
+    else if (rewind?.anchor) {
+        args.push('--resume-session-at', rewind.anchor);
+    }
     return args;
 }
 function claudeUsageOf(s) {

package/dist/drivers/codex.d.ts

@@ -19,8 +19,15 @@ export declare function captureCodexAgentMessage(item: any, s: CodexContentState
 export declare function captureCodexReasoning(text: string, s: CodexContentState, emit: (e: DriverEvent) => void): void;
 export declare function codexFinalText(s: CodexContentState): string;
 export declare function codexFinalReasoning(s: CodexContentState): string;
+export interface CodexLivenessOptions {
+    /** Silence after an accepted steer before the turn is healed (interrupt + replay). */
+    steerStallMs?: number;
+    /** Idle silence (no running tool, no pending HITL request) before the turn is force-closed. */
+    turnStallMs?: number;
+}
 export declare class CodexDriver implements AgentDriver {
     private readonly bin;
+    private readonly liveness;
     readonly id = "codex";
     readonly capabilities: {
         steer: boolean;
@@ -29,7 +36,7 @@ export declare class CodexDriver implements AgentDriver {
         tui: boolean;
         fork: boolean;
     };
-    constructor(bin?: string);
+    constructor(bin?: string, liveness?: CodexLivenessOptions);
     run(input: AgentTurnInput, ctx: DriverContext): Promise<DriverResult>;
     tui(input: TuiInput): TuiSpec;
     listNativeSessions(opts: {

package/dist/drivers/codex.js

@@ -234,12 +234,47 @@ export function codexFinalText(s) {
 export function codexFinalReasoning(s) {
     return s.reasoning.trim() ? s.reasoning : s.thinkParts.join('\n\n');
 }
+// ── Turn liveness (steer race + silent-stall recovery) ──────────────────────────
+// codex app-server has a turn-boundary race: a `turn/steer` that lands in the instant an
+// item completes is ACCEPTED (recorded into the rollout) but never dispatched — the agent
+// loop goes idle, no further notifications arrive, and `turn/completed` never fires, so the
+// turn hangs forever while the process sits at 0% CPU (observed on codex-cli 0.144.x;
+// same family as openai/codex#15714 / #23807). Two defenses below:
+//
+// 1. A successful steer is treated as ACCEPTED, NOT CONSUMED: it stays pending until a
+//    progress notification proves the loop picked it up. If the turn instead goes silent
+//    (or completes without consuming it), the driver heals in place — interrupt the wedged
+//    turn and restart it with the same input. The steered text is already in the thread
+//    history, so the worst false-positive cost is one duplicated user message; the turn
+//    keeps running under the same run()/task, invisible to upper layers.
+// 2. A generic silence backstop: a turn with no notifications for a long stretch while
+//    nothing is visibly in flight (no running tool call, no server->client request awaiting
+//    a human) is declared stalled and force-closed, so the session ends as a visible error
+//    instead of spinning forever.
+const CODEX_STEER_STALL_MS = 300_000; // matches codex core's own 300s stream watchdog
+const CODEX_TURN_STALL_MS = 900_000; // long: silent thinking stretches are legitimate
+// Notifications that prove the agent loop is making forward progress AFTER a steer.
+// item/completed and tokenUsage are deliberately excluded — they can be the trailing edge
+// of work that finished before the steer landed (the exact race signature). Progress that
+// arrives within CODEX_STEER_CONSUMED_MS of the steer only refreshes the pending marker's
+// clock rather than clearing it: the app-server can flush pre-acceptance stream output in
+// the same write as the steer response, so near-simultaneous events are not proof the
+// loop survived the injection. Progress beyond that window is.
+const CODEX_STEER_CONSUMED_MS = 2_000;
+const CODEX_PROGRESS_METHODS = new Set([
+    'turn/started', 'item/started', 'item/agentMessage/delta',
+    'item/reasoning/textDelta', 'item/reasoning/summaryTextDelta',
+    'item/commandExecution/outputDelta', 'item/fileChange/outputDelta',
+    'item/fileChange/patchUpdated', 'turn/plan/updated', 'rawResponseItem/completed',
+]);
 export class CodexDriver {
     bin;
+    liveness;
     id = 'codex';
     capabilities = { steer: true, interact: false, resume: true, tui: true, fork: true };
-    constructor(bin = 'codex') {
+    constructor(bin = 'codex', liveness = {}) {
         this.bin = bin;
+        this.liveness = liveness;
     }
     async run(input, ctx) {
         // BYOK provider routing arrives as `-c key=value` overrides; pass them through so the
@@ -261,6 +296,15 @@ export class CodexDriver {
         const deltaItems = new Set();
         let lastTextItemId = null;
         let steerRegistered = false;
+        // Liveness state (see the CODEX_STEER_STALL_MS block comment above).
+        const steerStallMs = this.liveness.steerStallMs ?? CODEX_STEER_STALL_MS;
+        const turnStallMs = this.liveness.turnStallMs ?? CODEX_TURN_STALL_MS;
+        let lastEventAt = Date.now();
+        let pendingSteer = null;
+        let pendingServerRequests = 0;
+        let healing = false;
+        let stalled = false;
+        let livenessTimer = null;
         if (!srv.start())
             return { ok: false, text: '', error: 'failed to start codex app-server', stopReason: 'error' };
         let settled = false;
@@ -320,23 +364,78 @@ export class CodexDriver {
                 state.sessionId = threadId;
                 ctx.emit({ type: 'session', sessionId: threadId });
             }
+            // Heal a wedged/lost steer in place: (optionally) interrupt the dead turn, then restart
+            // it with the same input. Runs under the SAME run()/turnDone, so upper layers just see
+            // the turn continue. `healing` suppresses the interrupt's own turn/completed echo.
+            const heal = async (opts) => {
+                if (settled || healing || !pendingSteer)
+                    return;
+                healing = true;
+                const replayInput = pendingSteer.input;
+                pendingSteer = null;
+                if (opts.interrupt && state.sessionId && state.turnId) {
+                    await srv.request('turn/interrupt', { threadId: state.sessionId, turnId: state.turnId }, 5_000);
+                }
+                if (settled) {
+                    healing = false;
+                    return;
+                } // raced with abort / process death
+                const resp = await srv.request('turn/start', {
+                    threadId: state.sessionId,
+                    input: replayInput,
+                    model: input.model || undefined,
+                    effort: input.effort || undefined,
+                });
+                if (settled) {
+                    healing = false;
+                    return;
+                }
+                if (resp.error) {
+                    state.status = 'error';
+                    state.error = `steer recovery failed: ${resp.error.message || 'turn/start failed'}`;
+                    healing = false;
+                    settle();
+                    return;
+                }
+                state.turnId = resp.result?.turn?.id ?? state.turnId;
+                lastEventAt = Date.now();
+                healing = false;
+            };
             // Codex emits no explicit compaction event, so track peak occupancy: a sharp
             // mid-turn drop is an auto-compaction, surfaced as a live `compaction` signal.
             let compactPeakTokens = 0;
             srv.onNotification((method, params) => {
                 if (params?.threadId && params.threadId !== state.sessionId && method !== 'turn/started')
                     return;
+                lastEventAt = Date.now();
+                if (pendingSteer && CODEX_PROGRESS_METHODS.has(method)) {
+                    const now = Date.now();
+                    if (now - pendingSteer.at >= CODEX_STEER_CONSUMED_MS)
+                        pendingSteer = null; // loop provably alive post-steer
+                    else
+                        pendingSteer.progressAt = now; // maybe pre-acceptance flush — keep watching
+                }
                 switch (method) {
                     case 'turn/started':
                         state.turnId = params?.turn?.id ?? null;
                         if (!steerRegistered && state.turnId) {
                             steerRegistered = true;
                             ctx.registerSteer(async (prompt, attachments = []) => {
-                                if (!state.sessionId || !state.turnId)
+                                if (settled || !state.sessionId || !state.turnId)
                                     return false;
-                                const r = await srv.request('turn/steer', { threadId: state.sessionId, expectedTurnId: state.turnId, input: buildTurnInput(prompt, attachments) }, 30_000);
-                                if (r.error)
+                                const steerInput = buildTurnInput(prompt, attachments);
+                                // Arm BEFORE sending — accepted, not yet consumed. Arming after the response
+                                // would race the response's own microtask against progress notifications the
+                                // server flushed in the same write, mis-arming against already-consumed steers.
+                                // Back-to-back steers accumulate so a heal replays everything swallowed.
+                                const armed = { input: [...(pendingSteer?.input ?? []), ...steerInput], at: Date.now(), progressAt: null };
+                                pendingSteer = armed;
+                                const r = await srv.request('turn/steer', { threadId: state.sessionId, expectedTurnId: state.turnId, input: steerInput }, 30_000);
+                                if (r.error) {
+                                    if (pendingSteer === armed)
+                                        pendingSteer = null; // rejected — nothing to watch
                                     return false;
+                                }
                                 state.turnId = r.result?.turnId ?? state.turnId;
                                 return true;
                             });
@@ -466,11 +565,21 @@ export class CodexDriver {
                     }
                     case 'turn/completed': {
                         const turn = params?.turn || {};
+                        applyCodexTokenUsage(state, params?.tokenUsage || turn.tokenUsage || turn.usage);
+                        ctx.emit({ type: 'usage', usage: codexUsageOf(state) });
+                        if (healing)
+                            break; // completion echo of the turn heal() just interrupted
+                        if (pendingSteer && !pendingSteer.progressAt && !ctx.signal.aborted && (turn.status ?? 'completed') === 'completed') {
+                            // The other face of the steer race: the turn finished without ever consuming
+                            // the injected input. Replay it as a fresh turn instead of settling — the
+                            // upper layers already dequeued the message on steer-ok, so settling here
+                            // would silently drop it.
+                            void heal({ interrupt: false });
+                            break;
+                        }
                         state.status = turn.status ?? 'completed';
                         if (turn.error)
                             state.error = turn.error.message || turn.error.code || 'turn error';
-                        applyCodexTokenUsage(state, params?.tokenUsage || turn.tokenUsage || turn.usage);
-                        ctx.emit({ type: 'usage', usage: codexUsageOf(state) });
                         settle();
                         break;
                     }
@@ -480,6 +589,7 @@ export class CodexDriver {
             // accept approvals by default (parity with the legacy codex driver). Never throw —
             // an unanswerable request degrades to an empty response, not a JSON-RPC error.
             srv.onRequest(async (method, params, id) => {
+                pendingServerRequests++; // a request awaiting a human legitimately silences the turn
                 try {
                     if (method === 'item/tool/requestUserInput') {
                         const interaction = codexUserInputToInteraction(params, `codex-input-${id}`);
@@ -497,6 +607,9 @@ export class CodexDriver {
                 catch {
                     return {};
                 }
+                finally {
+                    pendingServerRequests--;
+                }
             });
             const turnResp = await srv.request('turn/start', {
                 threadId: state.sessionId,
@@ -506,6 +619,35 @@ export class CodexDriver {
             });
             if (turnResp.error)
                 return { ok: false, text: state.text, error: turnResp.error.message || 'turn/start failed', stopReason: 'error', sessionId: state.sessionId };
+            // Liveness checker: heals a stalled steer, force-closes a silently dead turn. The
+            // silence clock only accumulates while nothing is visibly in flight — a running tool
+            // call or a server->client request parked on a human keeps the turn alive forever.
+            const checkEveryMs = Math.max(25, Math.min(5_000, Math.floor(Math.min(steerStallMs, turnStallMs) / 4)));
+            livenessTimer = setInterval(() => {
+                if (settled || healing)
+                    return;
+                const now = Date.now();
+                if (pendingSteer) {
+                    if (now - (pendingSteer.progressAt ?? pendingSteer.at) >= steerStallMs)
+                        void heal({ interrupt: true });
+                    return;
+                }
+                const busy = pendingServerRequests > 0 || [...toolCalls.values()].some(c => c.status === 'running');
+                if (busy) {
+                    lastEventAt = now;
+                    return;
+                }
+                if (now - lastEventAt < turnStallMs)
+                    return;
+                stalled = true;
+                state.error = state.error || `codex app-server went silent mid-turn (no events for ${Math.round(turnStallMs / 1000)}s); closing the turn`;
+                if (state.sessionId && state.turnId) {
+                    srv.request('turn/interrupt', { threadId: state.sessionId, turnId: state.turnId }, 5_000).finally(() => settle());
+                }
+                else
+                    settle();
+            }, checkEveryMs);
+            livenessTimer.unref?.();
             await turnDone;
             const usage = codexUsageOf(state);
             const ok2 = (state.status === 'completed' || state.status == null) && !state.error && !ctx.signal.aborted;
@@ -515,7 +657,7 @@ export class CodexDriver {
                 text: codexFinalText(state),
                 reasoning: finalReasoning || undefined,
                 error: state.error || (ctx.signal.aborted ? 'Interrupted by user.' : null),
-                stopReason: ctx.signal.aborted ? 'interrupted' : (state.status || 'end_turn'),
+                stopReason: ctx.signal.aborted ? 'interrupted' : stalled ? 'stalled' : (state.status || 'end_turn'),
                 sessionId: state.sessionId,
                 // Fork anchor: the turn id is the inclusive keep-boundary thread/fork's lastTurnId takes.
                 anchor: state.turnId,
@@ -523,6 +665,8 @@ export class CodexDriver {
             };
         }
         finally {
+            if (livenessTimer)
+                clearInterval(livenessTimer);
             srv.kill();
         }
     }

package/dist/ports/defaults.d.ts

@@ -32,6 +32,7 @@ export declare class FsSessionStore implements SessionStore {
     reconcileRunning(isAlive: (pid: number) => boolean): Promise<number>;
     appendTurn(agent: string, sessionId: string, turn: UniversalSnapshot): Promise<void>;
     history(agent: string, sessionId: string): Promise<UniversalSnapshot[]>;
+    truncateTurns(agent: string, sessionId: string, throughTaskId: string | null): Promise<void>;
 }
 /**
  * Is a pid currently a live process? `signal 0` probes without delivering a signal: ESRCH =>

package/dist/ports/defaults.js

@@ -145,6 +145,26 @@ export class FsSessionStore {
         }
         return out;
     }
+    // Rewrite turns.jsonl to the prefix through `throughTaskId` inclusive (in-place rewind). null
+    // clears the transcript; an unknown id keeps everything (no-op) so a stale cut can't wipe
+    // history. Atomic (temp file + rename) so a crash can't leave a half-written store.
+    async truncateTurns(agent, sessionId, throughTaskId) {
+        const all = await this.history(agent, sessionId);
+        let kept;
+        if (throughTaskId == null)
+            kept = [];
+        else {
+            const cut = all.findIndex((t) => t.taskId === throughTaskId);
+            if (cut < 0)
+                return; // unknown cut — leave the transcript untouched
+            kept = all.slice(0, cut + 1);
+        }
+        const p = this.turnsPath(agent, sessionId);
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        const tmp = `${p}.tmp-${process.pid}`;
+        fs.writeFileSync(tmp, kept.map((t) => JSON.stringify(t)).join('\n') + (kept.length ? '\n' : ''));
+        fs.renameSync(tmp, p);
+    }
 }
 /**
  * Is a pid currently a live process? `signal 0` probes without delivering a signal: ESRCH =>

package/dist/runtime/hub.d.ts

@@ -46,6 +46,13 @@ export declare class Hub implements LoomIO {
     forkSession(input: ForkSessionInput): Promise<{
         sessionKey: string;
     }>;
+    rewindSession(input: {
+        sessionKey: string;
+        atTaskId: string;
+        anchor?: string | null;
+    }): Promise<{
+        sessionKey: string;
+    }>;
     private enqueue;
     private runNow;
     private promoteNext;

package/dist/runtime/hub.js

@@ -143,6 +143,52 @@ export class Hub {
         this.deps.log?.(`[hub] forked ${input.fromSessionKey} -> ${agent}:${newId} (${mode}${anchor ? `, anchor ${anchor}` : ''}, ${kept.length}/${turns.length} turns)`);
         return { sessionKey: makeSessionKey(agent, newId) };
     }
+    // Rewind `sessionKey` IN PLACE to a turn boundary: drop the transcript after `atTaskId` (the
+    // last KEPT turn) and stamp a pendingRewind the next prompt() consumes (resume the SAME native
+    // session at the kept boundary, NO fork). The session id — managed AND native — is unchanged;
+    // only the dropped tip leaves the active path. Requires a rewind-capable driver, a store that
+    // can truncate, and a resolvable native anchor at the cut; otherwise throws so the caller can
+    // fall back (append on the same session, or a fork).
+    async rewindSession(input) {
+        const { agent, sessionId } = splitSessionKey(input.sessionKey);
+        const driver = this.deps.drivers.get(agent);
+        if (!driver)
+            throw new Error(`No driver registered for agent "${agent}"`);
+        if (!driver.capabilities?.rewind)
+            throw new Error(`agent "${agent}" has no in-place rewind`);
+        if (!this.deps.sessionStore.truncateTurns || !this.deps.sessionStore.history) {
+            throw new Error('session store cannot rewind (no truncateTurns/history)');
+        }
+        const rec = await this.deps.sessionStore.get(agent, sessionId);
+        if (!rec)
+            throw new Error(`rewind: session ${input.sessionKey} not found`);
+        const nativeId = rec.nativeSessionId || sessionId;
+        const turns = await this.deps.sessionStore.history(agent, sessionId).catch(() => []);
+        const cut = turns.findIndex((t) => t.taskId === input.atTaskId);
+        if (cut < 0)
+            throw new Error(`rewind point ${input.atTaskId} not found in ${input.sessionKey}`);
+        if (cut === turns.length - 1)
+            throw new Error(`rewind point ${input.atTaskId} is the tail — nothing to regenerate`);
+        const kept = turns.slice(0, cut + 1);
+        // Native rebranch boundary: explicit override → the kept tail's recorded anchor. No anchor =
+        // the kept turn never recorded one (e.g. a native-only import) — can't rebranch, so refuse.
+        const anchor = input.anchor ?? kept[kept.length - 1]?.anchor ?? null;
+        if (!anchor)
+            throw new Error(`rewind: no native anchor at ${input.atTaskId} in ${input.sessionKey}`);
+        // Drop the tip from the managed transcript, then stamp the rewind intent. The native store is
+        // untouched here — the next dispatch rebranches it at `anchor` via AgentTurnInput.rewind.
+        await this.deps.sessionStore.truncateTurns(agent, sessionId, input.atTaskId);
+        const last = kept[kept.length - 1];
+        rec.model = last?.model ?? rec.model ?? null;
+        rec.effort = last?.effort ?? rec.effort ?? null;
+        rec.nativeSessionId = nativeId;
+        rec.runState = 'completed';
+        rec.runDetail = null;
+        rec.pendingRewind = { anchor };
+        await this.deps.sessionStore.save(rec);
+        this.deps.log?.(`[hub] rewound ${input.sessionKey} to ${input.atTaskId} (anchor ${anchor}, kept ${kept.length}/${turns.length} turns)`);
+        return { sessionKey: input.sessionKey };
+    }
     enqueue(item) {
         const q = this.waiting.get(item.sessionKey) ?? [];
         q.push(item);
@@ -174,6 +220,9 @@ export class Hub {
         // first turn keeps the intent, so the retry forks again). Native mode resumes the PARENT's
         // native id with the fork flag; seed mode starts fresh and replays the copied transcript.
         const pendingFork = rec && !rec.nativeSessionId ? rec.pendingFork ?? null : null;
+        // A rewind keeps the SAME native id (it resumes+rebranches this session), so — unlike a fork —
+        // it is NOT gated on a missing native id. Fork and rewind never coexist on one record.
+        const pendingRewind = rec?.pendingRewind ?? null;
         const injection = await this.deps.modelResolver.resolve(agent, { model: input.model, profileId: null }).catch(() => null);
         const model = injection?.model ?? input.model ?? null;
         const effort = input.effort ?? null;
@@ -191,6 +240,7 @@ export class Hub {
         const systemPrompt = await this.composeSystemPrompt(agent, workdir, !preExisted || pendingFork?.mode === 'seed');
         let driverSessionId = rec?.nativeSessionId || (input.sessionKey ? sessionId : null);
         let driverFork = null;
+        let driverRewind = null;
         let driverPrompt = input.prompt;
         if (pendingFork) {
             if (pendingFork.mode === 'native' && pendingFork.parentNativeSessionId) {
@@ -204,11 +254,18 @@ export class Hub {
                     driverPrompt = `${seed}\n\n${input.prompt}`;
             }
         }
+        else if (pendingRewind) {
+            // In-place rewind: resume THIS session's own native id but rebranch at the kept boundary
+            // (no fork), so the dropped tip leaves the active path and the prompt regenerates from it.
+            driverSessionId = rec?.nativeSessionId || sessionId;
+            driverRewind = { anchor: pendingRewind.anchor };
+        }
         const turnInput = {
             prompt: driverPrompt,
             attachments: input.attachments,
             sessionId: driverSessionId,
             fork: driverFork,
+            rewind: driverRewind,
             workdir,
             model, effort, systemPrompt,
             env: spawn.env,
@@ -239,6 +296,20 @@ export class Hub {
                     this.deps.log?.(`[hub] pendingFork clear failed ${sessionKey}: ${e?.message || e}`);
                 }
             }
+            // A rewind materialized (the turn ran and rebranched the native session) — consume the
+            // intent so a normal follow-up prompt appends to the regenerated tip instead of rewinding.
+            if (pendingRewind && result.sessionId) {
+                try {
+                    const settled = await this.deps.sessionStore.get(agent, sessionId);
+                    if (settled?.pendingRewind) {
+                        settled.pendingRewind = null;
+                        await this.deps.sessionStore.save(settled);
+                    }
+                }
+                catch (e) {
+                    this.deps.log?.(`[hub] pendingRewind clear failed ${sessionKey}: ${e?.message || e}`);
+                }
+            }
             // Persist the completed turn's final snapshot as a transcript entry. The runner's
             // snapshot is stable once done (a follow-up prompt spawns a fresh runner+snapshot).
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikiloom/kernel",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "description": "Heterogeneous coding agents (Claude / Codex / Gemini / ACP) -> an interaction-friendly, accumulating session snapshot + control handle, over pluggable surfaces (IM, Web, tunnel, TUI). The reusable core pikiloom itself is built on.",
   "type": "module",
   "license": "MIT",