@prismshadow/penguin-server 0.2.15 → 0.2.17

package/dist/plugin/index.d.ts

@@ -1,10 +1,10 @@
-import { SpawnConfiner, OmniMessage, ThinkingLevelName, ToolCallPayload, ApprovalDecision, ProjectConfig, ModelRef, PluginTables, ListEndpointModelsOptions, ModelRequestContext, ProxyEnvPolicy, ControlEnvContext, AgentAssembly, ApproveFn, StopReason, CompactAvailability, SessionTitleResult, BackgroundCommandInfo, ToolDetachResult, BackgroundSubagentInfo, SubagentMessageOptions, SubagentMessageOutcome } from '@prismshadow/penguin-core';
+import { SpawnConfiner, AmspRecord, ThinkingLevelName, ToolCallPayload, ApprovalDecision, ProjectConfig, ModelRef, PluginTables, ListEndpointModelsOptions, ModelRequestContext, ProxyEnvPolicy, ControlEnvContext, AgentAssembly, ApproveFn, StopReason, CompactAvailability, SessionTitleResult, BackgroundCommandInfo, ToolDetachResult, BackgroundSubagentInfo, SubagentMessageOptions, SubagentMessageOutcome } from '@prismshadow/penguin-core';
 import { SandboxProviderSource, SandboxSettings, SandboxDimension, SandboxLimit } from '@prismshadow/penguin-core/plugin';
 import { Slot, Opaque } from '@prismshadow/penguin-core/kernel';
 import { ApprovalMode, ModelRefDto, ChatDefaultsDto, CommandPolicyDto, ModelVisionDetectRequest, ModelVisionDetectResponse, ModelTestRequest, ModelTestResponse, ModelProtocolDetectRequest, ModelProtocolDetectResponse, EndpointModelListRequest, EndpointModelListResponse, ModelsResponse, ModelsUpdateRequest, ProviderConnectionUpdate, PresetSyncMode, PresetSyncResponse, ServerEvent, MessagingChannel, UnavailableSandboxBackend, SessionSandboxPreset, SessionSandbox, SessionInfo, SessionCategory, SessionCategoryCounts, ModelScopeAuthFlowStatusResponse, SessionStatus, PendingSteeringInfo, SessionBackgroundTasks, PendingFollowUpInfo, AgentConfigDto, AgentConfigUpdateRequest, AgentKernelUpdateResponse, VaultResponse, VaultUpdateRequest, PluginUpdateRef, MessagingRuntimeStatus, PluginConfiguration, ContributionsResponse, RendererRef } from '../api/types.js';
 export { PluginConfigField } from '../api/types.js';
 import { ThinkingLevelName as ThinkingLevelName$1 } from '@prismshadow/penguin-core/interfaces';
-import { SessionSource } from '@prismshadow/penguin-core/omnimessage';
+import { SessionSource } from '@prismshadow/amsp';
 import { Hono } from 'hono';
 import '@prismshadow/penguin-hmr';
 
@@ -23,8 +23,10 @@ interface UserRow {
 
 /**
  * "desktop" and "setup" may set a password without the old one (theirs is random and was never
- * shown); desktop-only routes open to "desktop" alone. "token" is the local API token's Bearer
- * header — per request, never a stored row. Anything else reads as "password".
+ * shown); desktop-only routes open to "desktop" alone. "token" is the local API token's
+ * authority, whether presented as a Bearer header or exchanged for a Remote cookie.
+ * Exchanging the credential must not grant the person's privileges. Anything else reads as
+ * "password".
  */
 type SessionVia = "password" | "desktop" | "setup" | "token";
 
@@ -195,6 +197,12 @@ interface CreateTerminalSessionOptions {
     cwd: string;
     /** Owning user id — a shell is the most privileged thing this server hands out. */
     ownerUserId: string;
+    /**
+     * The conversation (PenguinHarness Session) this shell was opened for — not this object's own
+     * id. A label the Web App files the shell under, so each conversation lists only its own; null
+     * for a shell no conversation asked for (the API, the CLI, the standalone /terminal page).
+     */
+    sessionId?: string | null;
     /**
      * Stable per-user display number (tmux-style), assigned by the manager at creation. It
      * travels with the terminal for its whole life — UI numbering must never depend on list
@@ -254,6 +262,8 @@ interface TerminalSessionInfo {
     name: string;
     cwd: string;
     ownerUserId: string;
+    /** The conversation the shell belongs to, or null (see CreateTerminalSessionOptions.sessionId). */
+    sessionId: string | null;
     title: string | null;
     cols: number;
     rows: number;
@@ -272,6 +282,8 @@ declare class TerminalSession {
     readonly ownerUserId: string;
     readonly createdAt: Date;
     private name;
+    /** The conversation this shell belongs to; changes only when that conversation's id does. */
+    private owningSession;
     private readonly terminal;
     private readonly ptyProcess;
     private readonly inputMode;
@@ -291,6 +303,8 @@ declare class TerminalSession {
     get exit(): TerminalExitInfo | null;
     info(): TerminalSessionInfo;
     rename(name: string): void;
+    /** Files the shell under another conversation — the same one, once its id has self-healed. */
+    setSession(sessionId: string | null): void;
     write(data: string): void;
     /**
      * Applies a size request under the claim/update ownership rule, resizing both the pty and
@@ -322,6 +336,8 @@ declare class TerminalSession {
 interface CreateTerminalRequest {
     cwd: string;
     ownerUserId: string;
+    /** The conversation the shell is opened for; absent or null for none. */
+    sessionId?: string | null;
     name?: string;
     cols?: number;
     rows?: number;
@@ -370,8 +386,8 @@ interface RecallableFile {
 
 /** The open streaming fragments of running sessions, as their holder uses them — what {@link LiveTailTracker} implements. */
 interface LiveTail {
-    observe(sessionId: string, msg: OmniMessage): void;
-    fragments(sessionId: string): OmniMessage[];
+    observe(sessionId: string, msg: AmspRecord): void;
+    fragments(sessionId: string): AmspRecord[];
     clear(sessionId: string): void;
 }
 
@@ -475,7 +491,7 @@ interface SessionRow {
      * the CLI, or adopted from a Trace a legacy CLI-direct run left behind), "org" (opened by
      * the organization runtime — a desk or a ticket session — or spawned as a sub-session of
      * one, which inherits the stamp at registration), "api" (created by an Agent API run — the
-     * only rows the API may continue); NULL = legacy row from before the column existed,
+     * only rows the API may continue), "workbench" (created by the Workbench host); NULL = legacy row from before the column existed,
      * treated as web. Free text in SQLite, so a new value needs no migration.
      * Provenance that outlives its organization: development mode's list is the one reader
      * that filters on it (through the list's `excludeOrg`), and it hides "org" rows whether or
@@ -484,7 +500,7 @@ interface SessionRow {
      * (runtime/session-sources.ts); `client` is a separate, DB-only axis that meta never
      * records.
      */
-    client?: "web" | "cli" | "org" | "api" | null;
+    client?: "web" | "cli" | "org" | "api" | "workbench" | null;
     /** Cache: a Trace record exists (set at task start / adoption / subagent registration; backfilled by list hydration). */
     hasTrace?: boolean;
     /**
@@ -525,14 +541,14 @@ interface SessionRow {
  */
 
 interface PendingApproval {
-    toolCall: OmniMessage<ToolCallPayload>;
+    toolCall: AmspRecord<ToolCallPayload>;
     origin?: string[];
 }
 /** A Session runtime's pending approvals, as its holder uses them — what {@link ApprovalRegistry} implements. */
 interface Approvals {
     readonly size: number;
     list(): PendingApproval[];
-    wait(toolCall: OmniMessage<ToolCallPayload>): Promise<ApprovalDecision>;
+    wait(toolCall: AmspRecord<ToolCallPayload>): Promise<ApprovalDecision>;
     decide(toolCallId: string, decision: ApprovalDecision): boolean;
     denyAll(): void;
     denyMain(): void;
@@ -541,7 +557,7 @@ interface Approvals {
 /** A numbered channel event; `id` is `<epoch>-<seq>`, `data` is serialized single-line JSON. */
 interface ChannelEvent {
     id: string;
-    /** SSE event name; omitted (OmniMessage) means no `event:` line. */
+    /** SSE event name; omitted (a record) means no `event:` line. */
     event?: string;
     data: string;
 }
@@ -766,6 +782,13 @@ interface TitleNotifier {
  * written before the source was required, which records none.
  */
 type RecordedSource = SessionSource | null;
+/**
+ * Who is reading a list, as far as the listing rule cares: a server that adopted this one as a
+ * machine at `adoptedAt` (read from {@link ADOPTED_AT_HEADER}), or anyone else (`{}`).
+ */
+interface ListingView {
+    adoptedAt?: string;
+}
 
 /** One indexed Trace shard. */
 interface TraceFileRow {
@@ -832,7 +855,7 @@ declare abstract class TraceIndex {
         fileIndex: number;
         date: string;
         sizeBytes: number;
-        records: OmniMessage[];
+        records: AmspRecord[];
     }): void;
     abstract removeSession(projectId: string, agentId: string, sessionId: string): void;
     abstract removeAgent(projectId: string, agentId: string): void;
@@ -866,7 +889,7 @@ interface PlatformModelCatalog {
     models: PlatformCatalogModel[];
 }
 /**
- * Catalog merge result. `updated` counts route migrations; existing metadata is preserved.
+ * Catalog merge result. `updated` counts changes to existing prices, promotions or routes.
  */
 interface PlatformModelApplyResult {
     added: number;
@@ -894,6 +917,8 @@ type UtilityCompletion = {
 /** ProjectConfigStore: the mechanism ProjectConfigService implements. */
 declare abstract class ProjectConfigStore {
     abstract readRaw(projectId: string): Promise<RawTable>;
+    /** Reads every Project's config once, so what the read path's one-time migrations write back (core's and the server's) is on disk before any Session opens one. */
+    abstract migrateStoredConfigs(): Promise<void>;
     abstract loadConfig(projectId: string): Promise<ProjectConfig>;
     abstract writeRaw(projectId: string, data: RawTable): Promise<void>;
     abstract writeInitialConfig(projectId: string, name: string): Promise<void>;
@@ -941,9 +966,8 @@ declare abstract class ProjectConfigStore {
     abstract getModelApiKey(projectId: string, provider: string, modelId: string): Promise<string | undefined>;
     /**
      * The key a group's account balance is read with: the group key (never a row's own), or
-     * else the environment key a Session on one of the group's rows would use on its effective
-     * endpoint, when that variable's official endpoint is the balance endpoint's own host.
-     * Server-side only.
+     * else the vendor's environment key where MMSP's vendor client reads it for the group's base
+     * URL (none, or the vendor's own default endpoint). Server-side only.
      */
     abstract getGroupBalanceKey(projectId: string, provider: string): Promise<string | undefined>;
     abstract setModelApiKeyResolver(resolver: (context: ModelRequestContext) => Promise<string | undefined>): void;
@@ -1079,8 +1103,8 @@ declare class SessionService {
     /**
      * The approval mode a Session created without one starts with. An organization's Session
      * keeps `allow-all`: its runtime names the mode it wants, and nobody is there to answer an
-     * ask a preset might bring. The other unattended creators — a scheduled run, a workflow —
-     * pass `allow-all` themselves (scheduler.ts, workflows/service.ts).
+     * ask a preset might bring. The other unattended creators — a scheduled run, a workbench —
+     * pass `allow-all` themselves (scheduler.ts, workbenches/service.ts).
      */
     private startApproval;
     /** A Session's policy: its snapshot, or — for a row from before snapshots — the settings. */
@@ -1101,9 +1125,11 @@ declare class SessionService {
      * Session the user never kept reads archived, and a subagent with a stray mark does not.
      *
      * `orgIds` is the list flow's one-query organization map (see listSessions); without it the
-     * organization is a point lookup, which is what the single-Session paths want.
+     * organization is a point lookup, which is what the single-Session paths want. `view` is who
+     * is reading (sourceSeenBy): a server that adopted this one sees its earlier Sessions as CLI
+     * tasks, in `source` and `archived` alike.
      */
-    toInfo(row: SessionRow, hasTrace: boolean, orgIds?: ReadonlyMap<string, string>): Promise<SessionInfo>;
+    toInfo(row: SessionRow, hasTrace: boolean, orgIds?: ReadonlyMap<string, string>, view?: ListingView): Promise<SessionInfo>;
     /**
      * A Session's source, with session_meta as the single source of truth: the in-process
      * registry answers first (populated at creation / subagent registration / forks / adoption /
@@ -1113,9 +1139,11 @@ declare class SessionService {
      * no source is read with the row's client (readRecordedSource). A Session with no Trace yet
      * is NOT cached — its meta appears with the first run — and reads as its row says
      * (unrunSource): the organization runtime's as `company`, the Agent API's as `api`, any other
-     * as unknown.
+     * as unknown. What the reader sees of it (sourceSeenBy) is applied last and never cached.
      */
     private sourceOf;
+    /** The source as recorded (see sourceOf), whoever reads it. */
+    private recordedSourceOf;
     /** Whether this Session already has a Trace record (a Task has been run): answered by the index (reconciled first). */
     hasTrace(row: SessionRow): Promise<boolean>;
     /**
@@ -1130,7 +1158,7 @@ declare class SessionService {
      * through the trace index once (hasTrace reconciles the Agent), so a subagent Session is
      * known for one even before any list has walked it.
      */
-    listingOf(row: SessionRow): Promise<SessionCategory | null>;
+    listingOf(row: SessionRow, view?: ListingView): Promise<SessionCategory | null>;
     /**
      * List, sorted by createdAt descending — or, with `order: "activity"`, by lastActiveAt
      * descending (ties by sessionId, see {@link compareActivityDesc}). Every row is served
@@ -1187,6 +1215,9 @@ declare class SessionService {
      * stays `user`, and a row the organization caches name before the reconcile pass stamps it
      * reads as `user`. Without the flag every row is served, whichever client created it, but
      * for that rule.
+     *
+     * `view` is who reads the list (sourceSeenBy): every row is classified and served as that
+     * reader sees it.
      */
     listSessions(projectId: string, agentId: string, opts?: {
         paging?: SessionListPaging;
@@ -1195,6 +1226,7 @@ declare class SessionService {
         workspaceGroup?: string;
         withCounts?: boolean;
         excludeOrg?: boolean;
+        view?: ListingView;
     }): Promise<{
         sessions: SessionInfo[];
         counts?: SessionCategoryCounts;
@@ -1208,9 +1240,9 @@ declare class SessionService {
      * and `excludeOrg`, classified the same way — with the source each was classified by and
      * whether it has a Trace. It builds no SessionInfo: the page makes one (toInfo) only for the
      * rows a response carries, so a request costs a classification per archived row, not a full
-     * row view per archived row.
+     * row view per archived row. `view` is who reads it, as for listSessions.
      */
-    archivedRows(projectId: string, agentId: string): Promise<ArchivedRow[]>;
+    archivedRows(projectId: string, agentId: string, view?: ListingView): Promise<ArchivedRow[]>;
     /**
      * The rows a list walk starts from: the Agent's index rows, an organization's left out when
      * `excludeOrg` asks (see listSessions), with the Project's organization map; and when any row
@@ -1247,6 +1279,7 @@ declare class SessionService {
         /** The provider group for `modelId`; always paired with modelId, never inferred. */
         provider?: string;
         workspace?: string;
+        thinkingLevel?: ThinkingLevelName;
         approvalMode?: ApprovalMode;
         /** The composer's sandbox picks; omitted halves take the server's settings. */
         sandbox?: Partial<SessionSandbox>;
@@ -1266,7 +1299,7 @@ declare class SessionService {
          * are the only callers that pass them, so no request can claim either provenance for
          * itself ("api" is what lets the Agent API continue a Session).
          */
-        client?: "web" | "cli" | "org" | "api";
+        client?: "web" | "cli" | "org" | "api" | "workbench";
     }): Promise<SessionInfo>;
     /** A new Session's snapshot: the settings, with the creator's picks (checked) on top. */
     private snapshotSandbox;
@@ -1379,7 +1412,7 @@ declare class ModelScopeAuthService {
     private sweep;
     private evictOldest;
 }
-declare const ModelScopeAuth_base: (abstract new () => Pick<ModelScopeAuthService, "status" | "start" | "retryApply" | "cancel" | "ensureFresh">) & (<C>(target: C, context: ClassDecoratorContext) => C);
+declare const ModelScopeAuth_base: (abstract new () => Pick<ModelScopeAuthService, "status" | "start" | "cancel" | "retryApply" | "ensureFresh">) & (<C>(target: C, context: ClassDecoratorContext) => C);
 /** The per-App ModelScope key authorization capability consumed by Project model routes. */
 declare abstract class ModelScopeAuth extends ModelScopeAuth_base {
 }
@@ -1392,10 +1425,10 @@ type RunOpts = {
 };
 interface RuntimeSession {
     readonly sessionId: string;
-    run(newMessages: OmniMessage[], opts: RunOpts): AsyncGenerator<OmniMessage>;
+    run(newMessages: AmspRecord[], opts: RunOpts): AsyncGenerator<AmspRecord>;
     compact(opts: {
         signal: AbortSignal;
-    }): AsyncGenerator<OmniMessage>;
+    }): AsyncGenerator<AmspRecord>;
     /**
      * The running context's model (core `Session.provider` / `Session.modelId`, getters over
      * the context's session_meta): the row's pair at creation, moved by each in-session switch
@@ -1416,7 +1449,7 @@ interface RuntimeSession {
         provider: string;
         modelId: string;
         signal: AbortSignal;
-    }): AsyncGenerator<OmniMessage, StopReason>;
+    }): AsyncGenerator<AmspRecord, StopReason>;
     /**
      * The Session's thinking level (core `Session.thinkingLevel`, plain state): soft-limited —
      * an assignment applies from the Session's very next LLM request. Optional: test fakes may
@@ -1426,23 +1459,30 @@ interface RuntimeSession {
     /** Whether compaction is possible and why; when not ok, compact() yields no messages (see core ContextEngine.compactability). */
     compactability(): CompactAvailability;
     /** Queues a mid-run steering input (core `Session.steer`); false when no Task is running. */
-    steer(input: OmniMessage[]): boolean;
+    steer(input: AmspRecord[]): boolean;
     /**
      * Withdraws a steering input queued via `steer` before core delivers it (core
      * `Session.unsteer`, matched by input-list identity); false when it is no longer queued —
      * already delivered, or the run exited. Optional: test fakes may omit it, in which case
      * every recall reports "already delivered".
      */
-    unsteer?(input: OmniMessage[]): boolean;
+    unsteer?(input: AmspRecord[]): boolean;
     /** Skips the in-progress reconnect backoff, firing the next retry immediately (core `Session.skipReconnectWait`); false when no wait is in progress. */
     skipReconnectWait(): boolean;
     /**
      * Whether a run with empty input would send anything (core `Session.hasPendingInput`): the
-     * failed turn's input held as carry-over — in process, or rebuilt from the Trace after a
-     * restart — or a compaction summary waiting for the next run. Optional: test fakes may omit
-     * it, reading as nothing held.
+     * input of a turn that failed or was stopped, held as carry-over — in process, or rebuilt
+     * from the Trace after a restart — or a compaction summary waiting for the next run.
+     * Optional: test fakes may omit it, reading as nothing held.
      */
     hasPendingInput?(): boolean;
+    /**
+     * Whether the next Task opens a new Trace file (core `Session.contextOpenPending`): a
+     * compaction left the next context's file to its first write, so that Task streams the new
+     * `session_meta` behind its `task_begin`, and the input echo waits for it (see InputEcho).
+     * Optional: test fakes may omit it, reading as no.
+     */
+    contextOpenPending?(): boolean;
     /**
      * Runs the named package's `user_prompt` hook (core `Session.runUserPromptHook` — hooks
      * run in core and nowhere else); null = the package is not installed or names no such
@@ -1474,13 +1514,13 @@ interface RuntimeSession {
      */
     onBackgroundNotice?(listener: () => void): void;
     /** Takes the queued background completion notices as task input (core `Session.takeBackgroundNotices`). Optional, like onBackgroundNotice. */
-    takeBackgroundNotices?(): OmniMessage[];
+    takeBackgroundNotices?(): AmspRecord[];
     /** Whether completion notices are still queued (core `Session.hasPendingBackgroundNotices`); pins the entry against idle eviction. Optional, like onBackgroundNotice. */
     hasPendingBackgroundNotices?(): boolean;
     /** Refreshes the listen-port probes behind the process list's `serviceUrl` (core `Session.probeBackgroundCommandServices`). Optional: test fakes may omit it. */
     probeBackgroundCommandServices?(): Promise<void>;
     /** Subscribes live-forwarded background-subagent messages (core `Session.onBackgroundMessage`); the manager publishes them to the session channel. Optional: test fakes may omit it. */
-    onBackgroundMessage?(listener: (msg: OmniMessage) => void): void;
+    onBackgroundMessage?(listener: (msg: AmspRecord) => void): void;
     /** Background command processes owned by the Session's environment (core `Session.listBackgroundCommands`). Optional: test fakes may omit it. */
     listBackgroundCommands?(): BackgroundCommandInfo[];
     /** Kills one background command process (core `Session.killBackgroundCommand`); false when the id is unknown. Optional, like listBackgroundCommands. */
@@ -1492,7 +1532,7 @@ interface RuntimeSession {
     /** All live subagent child sessions of the Session's environment (core `Session.listBackgroundSubagents`). Optional, like listBackgroundCommands. */
     listBackgroundSubagents?(): BackgroundSubagentInfo[];
     /** Host message to one child session — steering mid-run, a follow-up run when idle, a revival when released (core `Session.sendToBackgroundSubagent`). Optional. */
-    sendToBackgroundSubagent?(childSessionId: string, messages: OmniMessage[], opts?: SubagentMessageOptions): Promise<SubagentMessageOutcome>;
+    sendToBackgroundSubagent?(childSessionId: string, messages: AmspRecord[], opts?: SubagentMessageOptions): Promise<SubagentMessageOutcome>;
     /** Subscribes the host's session-lifetime fallback approval sink for child sessions (core `Session.setSubagentApprovalFallback`). Optional. */
     setSubagentApprovalFallback?(approve: ApproveFn): void;
     /** Aborts one child session's current run, keeping the session (core `Session.abortBackgroundSubagentRun`); false when unknown or idle. Optional. */
@@ -1510,13 +1550,13 @@ interface RuntimeSession {
 interface SessionLoader {
     /**
      * Load a runtime Session from an index row: recover (with a Trace) or self-heal
-     * rebuild (no Trace, session_id will change). Throws HttpError(409) for unrecoverable
+     * rebuild (no Trace, under the row's session_id). Throws HttpError(409) for unrecoverable
      * cases such as a missing Workspace.
      */
     load(row: SessionRow): Promise<RuntimeSession>;
 }
 interface UsageRecorderLike {
-    record(ctx: UsageContext, msg: OmniMessage): Promise<void>;
+    record(ctx: UsageContext, msg: AmspRecord): Promise<void>;
 }
 interface SessionManagerDeps {
     /** The in-memory state this manager works on (see agent-state.ts). Optional: a manager built without one — unit tests — gets an empty state of its own. */
@@ -1527,6 +1567,12 @@ interface SessionManagerDeps {
     /** Session-origin registry (session_meta is the single source of truth; subagent registration records the forwarded meta's source here). */
     sources: SessionOrigins;
     recorder: UsageRecorderLike;
+    /**
+     * The data root, for what is read off an Agent's state on disk before a Session is loaded
+     * (startGoal's goal-plugin check). Optional: a manager built without one — unit tests on a
+     * fake loader — skips those reads, and the loaded Session's own answer decides.
+     */
+    root?: string;
     /** Automatic Session title generation (optional: not injected in tests or when disabled). */
     titles?: TitleNotifier;
     /** Error persistence (optional: without it, only logs — same as before this was wired up). */
@@ -1573,7 +1619,7 @@ interface RecallStore {
 interface QueuedFollowUp {
     /** Recall handle (PendingFollowUpInfo.id), assigned at queue time. */
     id: string;
-    input: OmniMessage[];
+    input: AmspRecord[];
     /**
      * Original content for recall, and the content `task_state` shows on the queued line.
      * Always present: a caller that knows more than the input carries (the HTTP route, which
@@ -1586,7 +1632,7 @@ interface QueuedFollowUp {
 /** One undelivered steering entry: the display info broadcast on task_state, plus what a recall needs — the exact input list core queued (its unsteer handle) and the original content. */
 interface PendingSteeringEntry {
     info: PendingSteeringInfo;
-    input: OmniMessage[];
+    input: AmspRecord[];
     recall: RecallStore;
 }
 /** Active-table entry: a loaded runtime Session plus its running state. */
@@ -1628,7 +1674,7 @@ interface RuntimeEntry {
      * the input publish, so the live channel cannot backfill it either. GET /messages
      * appends the ones the Trace has not caught up to yet (exact-envelope dedup).
      */
-    pendingInputs: OmniMessage[];
+    pendingInputs: AmspRecord[];
     /**
      * The running Task's streamed bootstrap records (mcp_connect begin/end,
      * tool_list_ready), held until the run ends. Their Trace writes are deferred by the
@@ -1637,7 +1683,7 @@ interface RuntimeEntry {
      * otherwise show nothing at all (a silent blank while a slow server times out).
      * GET /messages appends whichever of them the Trace has not caught up to.
      */
-    pendingBootstrap: OmniMessage[];
+    pendingBootstrap: AmspRecord[];
     /**
      * Steering messages queued on core but not yet delivered to the model — a display mirror
      * of core's steering queue (same FIFO order), so the composer's "steering queued" hint and
@@ -1733,7 +1779,7 @@ declare class SessionManager {
      * the resume fallback names the child's owning Agent from its own session row, which must
      * belong to the parent's project.
      */
-    sendToSubagent(sessionId: string, childSessionId: string, messages: OmniMessage[]): Promise<SubagentMessageOutcome>;
+    sendToSubagent(sessionId: string, childSessionId: string, messages: AmspRecord[]): Promise<SubagentMessageOutcome>;
     /**
      * Sets a Session's thinking level on its loaded runtime (core `Session.thinkingLevel`,
      * plain state): the row's value is what the loader applies at load, so this only needs to
@@ -1749,12 +1795,12 @@ declare class SessionManager {
     /** Queued follow-up tasks awaiting auto-start, as their display/recall info (id + content summary). */
     pendingFollowUpsOf(sessionId: string): PendingFollowUpInfo[];
     /**
-     * Live tail of a running session: one synthetic `partial_* start` OmniMessage per open
+     * Live tail of a running session: one synthetic `partial_* start` AmspRecord per open
      * streaming fragment, carrying the full accumulated content so far (see live-tail.ts).
      * Empty when idle or when nothing is streaming. GET /messages attaches this (with a
      * channel cursor) so a client joining mid-stream can render the in-progress message.
      */
-    liveFragments(sessionId: string): OmniMessage[];
+    liveFragments(sessionId: string): AmspRecord[];
     /**
      * The running Task's input messages as published at launch; empty when idle. The engine
      * writes these exact envelopes to the Trace only after the first run's bootstrap (MCP
@@ -1762,9 +1808,9 @@ declare class SessionManager {
      * not caught up to yet — without this, a client rebuilding history during the connect
      * (the draft flow subscribes only after the input publish) loses the user's own message.
      */
-    pendingInputs(sessionId: string): OmniMessage[];
+    pendingInputs(sessionId: string): AmspRecord[];
     /** The running Task's streamed bootstrap records (see RuntimeEntry.pendingBootstrap); empty when idle. */
-    pendingBootstrap(sessionId: string): OmniMessage[];
+    pendingBootstrap(sessionId: string): AmspRecord[];
     /** Number of Sessions for this Agent that are currently running / compacting. */
     activeCountForAgent(projectId: string, agentId: string): number;
     /** Add a newly created Session to the active table (status idle), avoiding a redundant load on the next Task. */
@@ -1852,7 +1898,7 @@ declare class SessionManager {
      * caller's store is read off the input, so a queued follow-up is recallable and shows
      * its content whichever path queued it.
      */
-    startTask(sessionId: string, input: OmniMessage[], opts?: {
+    startTask(sessionId: string, input: AmspRecord[], opts?: {
         queueIfBusy?: boolean;
         recall?: RecallStore;
     }): Promise<{
@@ -1860,13 +1906,14 @@ declare class SessionManager {
         queued: boolean;
     }>;
     /**
-     * Retry a failed run (`POST /retry`): a Task started with EMPTY input, so core sends the
-     * input of the turn that failed — held as carry-over since the run ended `fatal` or gave
-     * up reconnecting — and nothing else. No user message is published or recorded, and with no
+     * Retry a failed or stopped run (`POST /retry`): a Task started with EMPTY input, so core
+     * sends the input of the turn that did not finish — held as carry-over since the run ended
+     * `fatal`, gave up reconnecting or was stopped by the user, with whatever the model had
+     * already written — and nothing else. No user message is published or recorded, and with no
      * Prompt there is no user_prompt consult. Gated like startTask (busy is the same 409) but
      * never queued, and refused with 409 `nothing_to_retry` when nothing is held — the user's
-     * next message already resent that input, or no run failed — since the run would end at
-     * once and the client would watch a Task start and stop with nothing sent. Not a person's
+     * next message already resent that input, or no run was cut short — since the run would end
+     * at once and the client would watch a Task start and stop with nothing sent. Not a person's
      * input for company mode's hop accounting: the turn it resends was counted, or not, when
      * it was first sent.
      */
@@ -1881,13 +1928,15 @@ declare class SessionManager {
      * `user_prompt` hook (hooks run in core and nowhere else — `Session.runUserPromptHook`)
      * writes the Session's goal file and answers the round-1 protocol message; it runs under
      * the session lock AFTER the idle check, since it overwrites the goal file a running goal
-     * is reading. Not installed (null) is the route's 409; an empty answer a 500. Round inputs
+     * is reading. An Agent without the goal plugin's hook package is refused with the route's
+     * 409 before the Session is even loaded (goal-plugin.ts); a loaded Session whose hook
+     * answers null is the same 409, and an empty answer a 500. Round inputs
      * are yielded by core and published like any streamed message; progress additionally goes
      * out as goal_* server events (the run state itself is the goal file the plugin maintains).
      */
     startGoal(sessionId: string, args: {
         /** The user's own message(s) exactly as submitted — text and images, no wrapping. */
-        messages: OmniMessage[];
+        messages: AmspRecord[];
         /** The user's own objective text (leading marker blocks stripped): what the plugin records, the goal_started event and the title material. */
         objective: string;
         budget: number;
@@ -1897,7 +1946,7 @@ declare class SessionManager {
     /**
      * Taps a goal run's stream for `drive`: round boundaries become goal_round events —
      * round 1 from the seeded input (core never yields a run's initial input, so it is
-     * counted here, where startGoal published it), later rounds from the stop-hook continues
+     * counted here, from what startGoal echoes), later rounds from the stop-hook continues
      * core yields, each announced by the hook's `continue` event; a harness-stamped input
      * nothing announced is another package's user_prompt context riding behind the
      * objective, not a round — and the goal hook's `stop` event becomes the
@@ -1910,9 +1959,9 @@ declare class SessionManager {
     /** Closes a goal as aborted for the UI (stream cut off / infrastructure failure). */
     private finishAborted;
     /**
-     * Shared task launch (fresh tasks, auto-started follow-ups and retries): flips to running,
-     * publishes the input, and drives the run. Caller holds the session lock and has verified
-     * idle. A retry's input is empty: nothing is published or held, and drive gets no title
+     * Shared task launch (fresh tasks, auto-started follow-ups and retries): flips to running
+     * and drives the run, which echoes the input. Caller holds the session lock and has verified
+     * idle. A retry's input is empty: nothing is echoed or held, and drive gets no title
      * material — the turn it resends already offered its text when it was first sent.
      */
     private launchTask;
@@ -1992,7 +2041,7 @@ declare class SessionManager {
      * keeps the composer's "steering queued" hint, content included, alive across reloads —
      * and the content itself is what a recall (recallSteering) hands back to the composer.
      */
-    steer(sessionId: string, input: OmniMessage[], recall: RecallStore): void;
+    steer(sessionId: string, input: AmspRecord[], recall: RecallStore): void;
     /**
      * Recall an undelivered steering message (#287): withdraw it from core's queue and the
      * display mirror, re-broadcast state, and hand back its original content for the composer
@@ -2148,12 +2197,10 @@ declare class SessionManager {
      * a Task arriving mid-load waits for this load instead of starting a second one.
      *
      * A Session that is gone or being deleted, alone or with its Agent, resolves quietly: there is
-     * nothing to warm and the caller has nothing to do about it. So does one with no Trace yet,
-     * because loading it is a self-heal REBUILD under a new session id — that would move the
-     * Session out from under the binding that asked, and earlier than any Task would. The row's
-     * `hasTrace` is a cache, so a row that has not caught up only misses the warm-up. Any other
-     * load failure rejects; the first Task meets the same failure and reports it where a person
-     * will see it.
+     * nothing to warm and the caller has nothing to do about it. One that never ran is rebuilt
+     * under its own id (see createCoreSessionLoader), so the binding that asked keeps its Session.
+     * Any other load failure rejects; the first Task meets the same failure and reports it where a
+     * person will see it.
      */
     preload(sessionId: string): Promise<void>;
     private assertOpen;
@@ -2164,7 +2211,9 @@ declare class SessionManager {
     private assertIdle;
     private generationOf;
     private refreshProviderCredentialIfNeeded;
-    /** get-or-resume-or-heal: use directly on an active-table hit; otherwise load via the loader, updating the index's primary key on self-heal. */
+    /** get-or-resume-or-heal: use directly on an active-table hit; otherwise load via the loader, updating the index's primary key when it answers another id. */
+    /** startGoal's check before the load (goal-plugin.ts); an unknown id is left to ensureEntry's 404. */
+    private assertGoalPluginInstalled;
     private ensureEntry;
     /**
      * Auto-start of queued background completion notices: called when core signals an
@@ -2178,7 +2227,8 @@ declare class SessionManager {
      * Drive the output stream in the background: publish each message + persist usage +
      * persist LLM/tool errors; on completion (including errors) resets to idle and pushes
      * the status. `titleSource` is passed only for Task runs (compaction doesn't generate
-     * a title): its user text drives automatic title generation at run start.
+     * a title): its user text drives automatic title generation at run start, and its `echo`
+     * is the run's input, published right behind the run's first `task_begin` (see InputEcho).
      */
     private drive;
     /**
@@ -2353,8 +2403,10 @@ interface AgentListItem {
     kernelOutdated: boolean;
     /** Number of vault keys. */
     vaultKeyCount: number;
-    /** Number of scheduled tasks (count of .toml files under schedule/, including invalid ones). */
+    /** Number of scheduled tasks (count of .toml files directly under schedule/, including invalid ones; archived files under schedule/expired/ are not counted). */
     scheduleCount: number;
+    /** Workbench folders with a manifest, including ones with a load error. */
+    workbenchCount: number;
     /** Number of installed Skills (count of skills/<name>/ directories that contain a SKILL.md). */
     skillCount: number;
     /** Number of installed hook packages (hooks/<name>/ directories with a hooks.json). */
@@ -2372,6 +2424,8 @@ declare class AgentService implements AgentLifecycle {
     private readonly snapshots;
     /** Union of DB index ∪ directory scan; unmanaged directory Agents are backfilled into the DB. */
     listAgents(projectId: string): Promise<AgentListItem[]>;
+    /** Count installed folders without compiling or walking their UI/runtime assets. */
+    private workbenchCount;
     /**
      * Every id `createAgent` refuses as taken, as names only: the index rows and every entry under
      * `agents/`. Unlike `listAgents`, this includes a folder with no `system_config.yaml`, and it
@@ -2380,7 +2434,7 @@ declare class AgentService implements AgentLifecycle {
     takenAgentIds(projectId: string): Promise<string[]>;
     /** Number of vault keys (falls back to 0 on read failure). */
     private vaultKeyCount;
-    /** Number of scheduled tasks: count of .toml files under schedule/ (0 if the directory doesn't exist). */
+    /** Number of scheduled tasks: count of .toml files directly under schedule/ (0 if the directory doesn't exist). The expired/ subdirectory of archived files is not a .toml name, so it is never counted. */
     private scheduleCount;
     /**
      * One pass over `skills/` and one over `hooks/`, answering the card's questions: how many
@@ -2836,7 +2890,7 @@ type AppEnv = {
 /** Minimal dependency on SessionManager (eases test doubles; mirrors ScheduleTaskRunner). */
 interface MessagingTaskRunnerShape {
     statusOf(sessionId: string): string;
-    startTask(sessionId: string, input: OmniMessage[], 
+    startTask(sessionId: string, input: AmspRecord[], 
     /**
      * `recall` is what a queued follow-up hands back when the user withdraws it in the Web
      * App. It is optional because the manager derives one from the input for every caller
@@ -3314,19 +3368,28 @@ interface PluginConfigSlots {
     groups: Slot<SettingsGroupDecl>;
 }
 
-/** The assembled business surface: one request in, one response (or a decline) out. */
+/**
+ * The assembled business surface: one request in, one response (or a decline) out.
+ *
+ * `fetchAs` is the same surface entered as a user already established by other means — the
+ * API socket (socket/serve.ts), whose handshake the runtime authenticated and whose owner it
+ * checked before the platform ever saw the socket. Those requests carry no cookie, so the
+ * gate in front of the routes is not the cookie one but "this user": the routes themselves,
+ * their authorization and their errors are identical.
+ */
 declare abstract class Http {
     abstract fetch(request: Opaque<"Request", Request>): Promise<Opaque<"Response", Response>>;
+    abstract fetchAs(userId: string, request: Opaque<"Request", Request>): Promise<Opaque<"Response", Response>>;
 }
 interface HttpSlots {
     /**
-     * A route group. `auth: "user"` mounts it behind the cookie gate, `"none"` in front of
-     * it; `order` is the mount position (a stable number, since Hono matches in order). The
-     * code half is the group's Hono app.
+     * A route group. `auth: "user"` accepts a cookie or the local API token; `"token"` accepts
+     * only the local API token, without renewing cookies; `"none"` is public. `order` is the
+     * mount position (a stable number, since Hono matches in order). The code half is the Hono app.
      */
     routes: Slot<{
         prefix: string;
-        auth: "user" | "none";
+        auth: "user" | "token" | "none";
         order: number;
     }, Opaque<"Hono", Hono<AppEnv>>>;
 }
@@ -3364,7 +3427,7 @@ interface WebShellSlots {
         renderer: RendererRef;
     };
     /**
-     * A tab beside a Session's chat. A workflow contributes here too, from its own tree, where
+     * A tab beside a Session's chat. A workbench contributes here too, from its own tree, where
      * the host publishes this slot under this module's name and scopes the tab to its Agent.
      */
     sessionTabs: {