@provos/ironcurtain 0.10.0 → 0.12.0

package/dist/web-ui/dispatch/session-dispatch.js

@@ -0,0 +1,219 @@
+/**
+ * Session-related JSON-RPC method dispatch.
+ *
+ * Handles all `sessions.*` methods: list, get, create, end, send,
+ * budget, history, diagnostics.
+ */
+import { z } from 'zod';
+import { validateParams, toSessionDto, toBudgetDto, labelSchema } from './types.js';
+import { RpcError, SessionNotFoundError, MethodNotFoundError, } from '../web-ui-types.js';
+import { tokenStreamDispatch } from './token-stream-dispatch.js';
+import { WebSessionTransport } from '../web-session-transport.js';
+import { loadConfig } from '../../config/index.js';
+import { createStandaloneSession } from '../../session/index.js';
+import { shouldAutoSaveMemory } from '../../memory/auto-save.js';
+import { BudgetExhaustedError } from '../../types/errors.js';
+import { getTokenStreamBus } from '../../docker/token-stream-bus.js';
+import * as logger from '../../logger.js';
+// ---------------------------------------------------------------------------
+// Param validation schemas
+// ---------------------------------------------------------------------------
+const sessionCreateSchema = z.object({
+    persona: z.string().min(1).optional(),
+    /**
+     * Per-session trajectory-capture override. Wins over the
+     * daemon-process default set via `--capture-traces`. When undefined,
+     * the daemon-process default (or `false`) is used. See
+     * docs/designs/mitm-token-trajectory-capture.md §10.
+     */
+    captureTraces: z.boolean().optional(),
+});
+const sessionSendSchema = z.object({ label: z.number().int().positive(), text: z.string().min(1) });
+// ---------------------------------------------------------------------------
+// Session dispatch
+// ---------------------------------------------------------------------------
+export async function sessionDispatch(ctx, method, params, client) {
+    // Delegate token stream methods to dedicated dispatch module
+    if (method.startsWith('sessions.subscribe') || method.startsWith('sessions.unsubscribe')) {
+        if (!client) {
+            throw new RpcError('INTERNAL_ERROR', 'Token stream methods require a WebSocket client');
+        }
+        return tokenStreamDispatch(ctx, method, params, client);
+    }
+    switch (method) {
+        case 'sessions.list':
+            return listSessions(ctx);
+        case 'sessions.get': {
+            const { label } = validateParams(labelSchema, params);
+            return getSession(ctx, label);
+        }
+        case 'sessions.create': {
+            const { persona, captureTraces } = validateParams(sessionCreateSchema, params);
+            return createWebSession(ctx, persona, captureTraces);
+        }
+        case 'sessions.end': {
+            const { label } = validateParams(labelSchema, params);
+            const endManaged = ctx.sessionManager.get(label);
+            const endSessionId = endManaged?.session.getInfo().id;
+            await ctx.sessionManager.end(label);
+            if (endSessionId)
+                getTokenStreamBus().endSession(endSessionId);
+            cleanupSessionQueue(ctx, label);
+            ctx.eventBus.emit('session.ended', { label, reason: 'user_ended' });
+            return;
+        }
+        case 'sessions.send': {
+            const { label, text } = validateParams(sessionSendSchema, params);
+            return sendToSession(ctx, label, text);
+        }
+        case 'sessions.budget': {
+            const { label } = validateParams(labelSchema, params);
+            const managed = ctx.sessionManager.get(label);
+            if (!managed)
+                throw new SessionNotFoundError(label);
+            return toBudgetDto(managed);
+        }
+        case 'sessions.history': {
+            const { label } = validateParams(labelSchema, params);
+            const managed = ctx.sessionManager.get(label);
+            if (!managed)
+                throw new SessionNotFoundError(label);
+            return managed.session.getHistory();
+        }
+        case 'sessions.diagnostics': {
+            const { label } = validateParams(labelSchema, params);
+            const managed = ctx.sessionManager.get(label);
+            if (!managed)
+                throw new SessionNotFoundError(label);
+            return managed.session.getDiagnosticLog();
+        }
+        default:
+            throw new MethodNotFoundError(method);
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Clean up session queue entry when session ends. */
+function cleanupSessionQueue(ctx, label) {
+    ctx.sessionQueues.delete(label);
+}
+function listSessions(ctx) {
+    return ctx.sessionManager.all().map((m) => toSessionDto(m));
+}
+function getSession(ctx, label) {
+    const managed = ctx.sessionManager.get(label);
+    if (!managed)
+        throw new SessionNotFoundError(label);
+    return {
+        ...toSessionDto(managed),
+        history: managed.session.getHistory(),
+        diagnosticLog: managed.session.getDiagnosticLog(),
+    };
+}
+async function createWebSession(ctx, persona, captureTracesOverride) {
+    const webCount = ctx.sessionManager.byKind('web').length;
+    if (webCount >= ctx.maxConcurrentWebSessions) {
+        throw new RpcError('RATE_LIMITED', `Web session limit reached (max ${ctx.maxConcurrentWebSessions})`);
+    }
+    const config = loadConfig();
+    const transport = new WebSessionTransport({
+        eventBus: ctx.eventBus,
+        sessionManager: ctx.sessionManager,
+        autoSaveMemory: shouldAutoSaveMemory(config, { persona }),
+        dockerMode: ctx.mode.kind === 'docker',
+    });
+    // Capture precedence: JSON-RPC field > daemon CLI flag > userConfig.
+    // The session factory then resolves vs `userConfig.capture?.enabled`
+    // as the final fallback (§10).
+    const effectiveCapture = captureTracesOverride !== undefined
+        ? captureTracesOverride
+        : (ctx.captureTracesDefault ?? false)
+            ? true
+            : undefined;
+    const session = await createStandaloneSession({
+        config,
+        mode: ctx.mode,
+        persona,
+        ...(effectiveCapture !== undefined ? { captureTracesOverride: effectiveCapture } : {}),
+        onEscalation: transport.createEscalationHandler(),
+        onEscalationExpired: transport.createEscalationExpiredHandler(),
+        onEscalationResolved: transport.createEscalationResolvedHandler(),
+        onDiagnostic: transport.createDiagnosticHandler(),
+    });
+    const label = ctx.sessionManager.register(session, transport, { kind: 'web', persona });
+    transport.sessionLabel = label;
+    const runPromise = transport.run(session);
+    const managed = ctx.sessionManager.get(label);
+    if (managed) {
+        managed.runPromise = runPromise;
+    }
+    const sessionId = session.getInfo().id;
+    runPromise
+        .then(() => {
+        const m = ctx.sessionManager.get(label);
+        if (m) {
+            ctx.sessionManager.end(label).catch((err) => {
+                logger.error(`[WebUI] Failed to clean up session #${label}: ${String(err)}`);
+            });
+        }
+        getTokenStreamBus().endSession(sessionId);
+    })
+        .catch((err) => {
+        logger.error(`[WebUI] Transport #${label} error: ${String(err)}`);
+    })
+        .finally(() => {
+        cleanupSessionQueue(ctx, label);
+    });
+    if (managed) {
+        ctx.eventBus.emit('session.created', toSessionDto(managed));
+    }
+    return { label };
+}
+function sendToSession(ctx, label, text) {
+    const managed = ctx.sessionManager.get(label);
+    if (!managed)
+        throw new SessionNotFoundError(label);
+    if (managed.source.kind !== 'web') {
+        throw new RpcError('INVALID_PARAMS', `Session #${label} is not a web session`);
+    }
+    const transport = managed.transport;
+    const prev = ctx.sessionQueues.get(label) ?? Promise.resolve();
+    const current = prev.then(async () => {
+        const turnNumber = managed.session.getInfo().turnCount + 1;
+        ctx.eventBus.emit('session.thinking', { label, turnNumber });
+        // Emit session status update so the frontend shows 'processing'
+        const freshManaged = ctx.sessionManager.get(label);
+        if (freshManaged) {
+            ctx.eventBus.emit('session.updated', toSessionDto(freshManaged));
+        }
+        try {
+            const response = await transport.forwardMessage(text);
+            ctx.eventBus.emit('session.output', { label, text: response, turnNumber });
+            ctx.eventBus.emit('session.budget_update', { label, budget: toBudgetDto(managed) });
+            // Emit updated session so frontend picks up status change (e.g. back to 'ready')
+            const updatedManaged = ctx.sessionManager.get(label);
+            if (updatedManaged) {
+                ctx.eventBus.emit('session.updated', toSessionDto(updatedManaged));
+            }
+        }
+        catch (err) {
+            if (err instanceof BudgetExhaustedError) {
+                const budgetSessionId = managed.session.getInfo().id;
+                ctx.eventBus.emit('session.ended', { label, reason: `Budget exhausted: ${err.message}` });
+                await ctx.sessionManager.end(label);
+                getTokenStreamBus().endSession(budgetSessionId);
+                cleanupSessionQueue(ctx, label);
+            }
+            else {
+                const message = err instanceof Error ? err.message : String(err);
+                ctx.eventBus.emit('session.output', { label, text: `Error: ${message}`, turnNumber });
+            }
+        }
+    });
+    ctx.sessionQueues.set(label, current.catch((err) => {
+        logger.error(`[WebUI] Session #${label} queue error: ${err instanceof Error ? err.message : String(err)}`);
+    }));
+    return { accepted: true };
+}
+//# sourceMappingURL=session-dispatch.js.map

package/dist/web-ui/dispatch/session-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-dispatch.js","sourceRoot":"","sources":["../../../src/web-ui/dispatch/session-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAwB,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1G,OAAO,EAGL,QAAQ,EACR,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAC;AAE1C,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;OAKG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEpG,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,MAAc,EACd,MAA+B,EAC/B,MAAoB;IAEpB,6DAA6D;IAC7D,IAAI,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe;YAClB,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAC/E,OAAO,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,YAAY;gBAAE,iBAAiB,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC/D,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAClE,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACpD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACtC,CAAC;QACD,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC5C,CAAC;QACD;YACE,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,sDAAsD;AACtD,SAAS,mBAAmB,CAAC,GAAoB,EAAE,KAAa;IAC9D,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB;IACxC,OAAO,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,KAAa;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO;QACL,GAAG,YAAY,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE;QACrC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE;KAClD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,GAAoB,EACpB,OAAgB,EAChB,qBAA+B;IAE/B,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACzD,IAAI,QAAQ,IAAI,GAAG,CAAC,wBAAwB,EAAE,CAAC;QAC7C,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,kCAAkC,GAAG,CAAC,wBAAwB,GAAG,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC;QACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,cAAc,EAAE,oBAAoB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC;QACzD,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ;KACvC,CAAC,CAAC;IAEH,qEAAqE;IACrE,qEAAqE;IACrE,+BAA+B;IAC/B,MAAM,gBAAgB,GACpB,qBAAqB,KAAK,SAAS;QACjC,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,IAAI,KAAK,CAAC;YACnC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,SAAS,CAAC;IAElB,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;QAC5C,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO;QACP,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,YAAY,EAAE,SAAS,CAAC,uBAAuB,EAAE;QACjD,mBAAmB,EAAE,SAAS,CAAC,8BAA8B,EAAE;QAC/D,oBAAoB,EAAE,SAAS,CAAC,+BAA+B,EAAE;QACjE,YAAY,EAAE,SAAS,CAAC,uBAAuB,EAAE;KAClD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACxF,SAAS,CAAC,YAAY,GAAG,KAAK,CAAC;IAE/B,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACvC,UAAU;SACP,IAAI,CAAC,GAAG,EAAE;QACT,MAAM,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACnD,MAAM,CAAC,KAAK,CAAC,uCAAuC,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,iBAAiB,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,MAAM,CAAC,KAAK,CAAC,sBAAsB,KAAK,WAAW,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEL,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,GAAoB,EAAE,KAAa,EAAE,IAAY;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,YAAY,KAAK,uBAAuB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAgC,CAAC;IAE3D,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7D,gEAAgE;QAChE,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACtD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3E,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACpF,iFAAiF;YACjF,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,cAAc,EAAE,CAAC;gBACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1F,MAAM,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACpC,iBAAiB,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBAChD,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,aAAa,CAAC,GAAG,CACnB,KAAK,EACL,OAAO,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QAC7B,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/web-ui/dispatch/token-stream-dispatch.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Token stream subscription JSON-RPC dispatch.
+ *
+ * Handles the four token stream methods:
+ *   - sessions.subscribeTokenStream     (per-session)
+ *   - sessions.unsubscribeTokenStream   (per-session)
+ *   - sessions.subscribeAllTokenStreams  (global)
+ *   - sessions.unsubscribeAllTokenStreams (global)
+ *
+ * Per-session methods resolve label to SessionId via sessionManager.
+ * Global methods use bus.subscribeAll via the bridge.
+ */
+import type { WebSocket as WsWebSocket } from 'ws';
+import { type DispatchContext } from './types.js';
+export declare function tokenStreamDispatch(ctx: DispatchContext, method: string, params: Record<string, unknown>, client: WsWebSocket): unknown;

package/dist/web-ui/dispatch/token-stream-dispatch.js

@@ -0,0 +1,55 @@
+/**
+ * Token stream subscription JSON-RPC dispatch.
+ *
+ * Handles the four token stream methods:
+ *   - sessions.subscribeTokenStream     (per-session)
+ *   - sessions.unsubscribeTokenStream   (per-session)
+ *   - sessions.subscribeAllTokenStreams  (global)
+ *   - sessions.unsubscribeAllTokenStreams (global)
+ *
+ * Per-session methods resolve label to SessionId via sessionManager.
+ * Global methods use bus.subscribeAll via the bridge.
+ */
+import { validateParams, labelSchema } from './types.js';
+import { SessionNotFoundError, MethodNotFoundError, RpcError } from '../web-ui-types.js';
+// ---------------------------------------------------------------------------
+// Dispatch
+// ---------------------------------------------------------------------------
+export function tokenStreamDispatch(ctx, method, params, client) {
+    const bridge = ctx.tokenStreamBridge;
+    if (!bridge) {
+        throw new RpcError('INTERNAL_ERROR', 'Token stream bridge not available');
+    }
+    switch (method) {
+        case 'sessions.subscribeTokenStream': {
+            const { label } = validateParams(labelSchema, params);
+            const managed = ctx.sessionManager.get(label);
+            if (!managed)
+                throw new SessionNotFoundError(label);
+            const sessionId = managed.session.getInfo().id;
+            bridge.addClient(client, label, sessionId);
+            return { subscribed: true };
+        }
+        case 'sessions.unsubscribeTokenStream': {
+            const { label } = validateParams(labelSchema, params);
+            bridge.removeClient(client, label);
+            return { unsubscribed: true };
+        }
+        case 'sessions.subscribeAllTokenStreams': {
+            bridge.addGlobalClient(client);
+            // Register all existing sessions so global events can resolve labels
+            for (const managed of ctx.sessionManager.all()) {
+                const sessionId = managed.session.getInfo().id;
+                bridge.registerSession(managed.label, sessionId);
+            }
+            return { subscribed: true };
+        }
+        case 'sessions.unsubscribeAllTokenStreams': {
+            bridge.removeGlobalClient(client);
+            return { unsubscribed: true };
+        }
+        default:
+            throw new MethodNotFoundError(method);
+    }
+}
+//# sourceMappingURL=token-stream-dispatch.js.map

package/dist/web-ui/dispatch/token-stream-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-stream-dispatch.js","sourceRoot":"","sources":["../../../src/web-ui/dispatch/token-stream-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAwB,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEzF,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,MAAc,EACd,MAA+B,EAC/B,MAAmB;IAEnB,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,+BAA+B,CAAC,CAAC,CAAC;YACrC,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YAC3C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9B,CAAC;QAED,KAAK,iCAAiC,CAAC,CAAC,CAAC;YACvC,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;QAED,KAAK,mCAAmC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC/B,qEAAqE;YACrE,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC9B,CAAC;QAED,KAAK,qCAAqC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;QAED;YACE,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/web-ui/dispatch/types.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Shared types and utilities for dispatch sub-modules.
+ *
+ * The DispatchContext and validation helpers are used by all
+ * domain-specific dispatch modules (session, job, escalation, etc.).
+ */
+import { z } from 'zod';
+import type { SessionManager, ManagedSession } from '../../session/session-manager.js';
+import type { ControlRequestHandler } from '../../daemon/control-socket.js';
+import type { SessionMode } from '../../session/types.js';
+import type { TokenStreamBridge } from '../token-stream-bridge.js';
+import type { WebEventBus } from '../web-event-bus.js';
+import { type SessionDto, type BudgetSummaryDto, type DaemonStatusDto } from '../web-ui-types.js';
+export declare const labelSchema: z.ZodObject<{
+    label: z.ZodNumber;
+}, z.core.$strip>;
+export interface DispatchContext {
+    readonly handler: ControlRequestHandler;
+    readonly sessionManager: SessionManager;
+    readonly mode: SessionMode;
+    readonly eventBus: WebEventBus;
+    readonly maxConcurrentWebSessions: number;
+    /** @internal Sequencing queues per session -- managed by dispatch module. */
+    readonly sessionQueues: Map<number, Promise<void>>;
+    /** Bridge for per-client token stream subscriptions. */
+    tokenStreamBridge?: TokenStreamBridge;
+    /**
+     * Daemon-process capture-traces default. Used by `sessions.create`
+     * when the JSON-RPC payload does not include `captureTraces`. See
+     * docs/designs/mitm-token-trajectory-capture.md §10.
+     */
+    readonly captureTracesDefault?: boolean;
+    /**
+     * Policy-mutation authz gate. When false (the DEFAULT), the policy-mutation
+     * surface does not exist: every persona-mutation method
+     * (`compileStream` / `create` / `editConstitution` / `setMemory` / `delete` /
+     * `setBroadPolicyOptIn`) returns `POLICY_MUTATION_FORBIDDEN`. Read methods
+     * (`list` / `get` / `getCompile` / `listCompiles`) stay ungated.
+     *
+     * Wired (Phase 1c) via the 4-hop `--allow-policy-mutation` daemon flag,
+     * mirroring `captureTracesDefault`:
+     *   daemon-command.ts (CommandSpec option + parseArgs + read + pass)
+     *   -> IronCurtainDaemonOptions.allowPolicyMutation
+     *   -> WebUiServerOptions.allowPolicyMutation
+     *   -> dispatchCtx.allowPolicyMutation (web-ui-server.ts).
+     * Surfaced to the UI via `DaemonStatusDto.allowPolicyMutation` so the UI
+     * hides mutation controls. Off by default, CLI-only, not config-persisted.
+     */
+    readonly allowPolicyMutation?: boolean;
+}
+export declare function validateParams<T>(schema: z.ZodType<T>, params: Record<string, unknown>): T;
+export declare function toSessionDto(managed: ManagedSession): SessionDto;
+export declare function toBudgetDto(managed: ManagedSession): BudgetSummaryDto;
+export declare function buildStatusDto(ctx: DispatchContext): DaemonStatusDto;

package/dist/web-ui/dispatch/types.js

@@ -0,0 +1,72 @@
+/**
+ * Shared types and utilities for dispatch sub-modules.
+ *
+ * The DispatchContext and validation helpers are used by all
+ * domain-specific dispatch modules (session, job, escalation, etc.).
+ */
+import { z } from 'zod';
+import { InvalidParamsError } from '../web-ui-types.js';
+// ---------------------------------------------------------------------------
+// Shared param schemas
+// ---------------------------------------------------------------------------
+export const labelSchema = z.object({ label: z.number().int().positive() });
+// ---------------------------------------------------------------------------
+// Param validation
+// ---------------------------------------------------------------------------
+export function validateParams(schema, params) {
+    const result = schema.safeParse(params);
+    if (!result.success) {
+        throw new InvalidParamsError(result.error.message);
+    }
+    return result.data;
+}
+// ---------------------------------------------------------------------------
+// DTO builders
+// ---------------------------------------------------------------------------
+export function toSessionDto(managed) {
+    const info = managed.session.getInfo();
+    const persona = managed.source.kind === 'web' ? managed.source.persona : undefined;
+    return {
+        label: managed.label,
+        source: managed.source,
+        status: info.status,
+        turnCount: info.turnCount,
+        createdAt: info.createdAt,
+        hasPendingEscalation: managed.pendingEscalation !== null,
+        messageInFlight: managed.messageInFlight,
+        budget: toBudgetDto(managed),
+        ...(persona ? { persona } : {}),
+    };
+}
+export function toBudgetDto(managed) {
+    const status = managed.session.getBudgetStatus();
+    return {
+        totalTokens: status.totalTokens,
+        stepCount: status.stepCount,
+        elapsedSeconds: status.elapsedSeconds,
+        estimatedCostUsd: status.estimatedCostUsd,
+        tokenTrackingAvailable: status.tokenTrackingAvailable,
+        limits: {
+            maxTotalTokens: status.limits.maxTotalTokens,
+            maxSteps: status.limits.maxSteps,
+            maxSessionSeconds: status.limits.maxSessionSeconds,
+            maxEstimatedCostUsd: status.limits.maxEstimatedCostUsd,
+        },
+    };
+}
+export function buildStatusDto(ctx) {
+    const status = ctx.handler.getStatus();
+    return {
+        uptimeSeconds: status.uptimeSeconds,
+        jobs: status.jobs,
+        signalConnected: status.signalConnected,
+        webUiListening: true,
+        activeSessions: ctx.sessionManager.size,
+        nextFireTime: status.nextFireTime?.toISOString() ?? null,
+        // Phase 1c: surface the policy-mutation kill switch so the UI can hide
+        // mutation controls. Defaults to false (off) when the daemon was not
+        // launched with `--allow-policy-mutation`.
+        allowPolicyMutation: ctx.allowPolicyMutation ?? false,
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/web-ui/dispatch/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/web-ui/dispatch/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EAAgE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEtH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAyC5E,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,UAAU,cAAc,CAAI,MAAoB,EAAE,MAA+B;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,oBAAoB,EAAE,OAAO,CAAC,iBAAiB,KAAK,IAAI;QACxD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;QAC5B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAuB;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;IACjD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,MAAM,EAAE;YACN,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc;YAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;YAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB;YAClD,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB;SACvD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAoB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IACvC,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,cAAc,EAAE,IAAI;QACpB,cAAc,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,IAAI;QACxD,uEAAuE;QACvE,qEAAqE;QACrE,2CAA2C;QAC3C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,IAAI,KAAK;KACtD,CAAC;AACJ,CAAC"}

package/dist/web-ui/dispatch/workflow-dispatch.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Workflow-related JSON-RPC method dispatch.
+ *
+ * Handles all `workflows.*` methods: list, get, start, resume,
+ * abort, resolveGate, inspect, fileTree, fileContent, artifacts.
+ */
+import { type DispatchContext } from './types.js';
+import { type WorkflowDetailDto, type PastRunDto, type MessageLogResponseDto, type LatestVerdictDto, type LiveWorkflowPhase, type PastRunPhase } from '../web-ui-types.js';
+import type { PastRunLoadSuccess, WorkflowManager } from '../../workflow/workflow-manager.js';
+import { type WorkflowId, type WorkflowCheckpoint, type WorkflowDefinition } from '../../workflow/types.js';
+import { type MessageLogEntry } from '../../workflow/message-log.js';
+import { type WorkflowRunSummary } from '../../workflow/workflow-discovery.js';
+export interface WorkflowDispatchContext extends DispatchContext {
+    workflowManager?: WorkflowManager;
+}
+export declare function workflowDispatch(ctx: WorkflowDispatchContext, method: string, params: Record<string, unknown>): Promise<unknown>;
+/**
+ * Synthesizes a phase value for a checkpoint loaded from disk.
+ *
+ * Requires a defined `WorkflowCheckpoint`. For checkpoint-less past-run rows
+ * (i.e. directories where `checkpoint.json` is absent — e.g. runs completed
+ * before B3b persisted `finalStatus`), callers must use
+ * `synthesizePhaseFromMessageLog` instead.
+ *
+ * Resolution order:
+ * - If `isLive` is true, returns `'running'`.
+ * - Post-B3b checkpoints carry a canonical `finalStatus.phase`. When present
+ *   and valid (matches a `PastRunPhase` value), return it directly —
+ *   this short-circuits the legacy state-name heuristic.
+ * - Legacy pre-B3b checkpoints fall through to the state-name heuristic:
+ *   - Terminal state in the definition: infer `'aborted'` from the
+ *     conventional name pattern (`'aborted'` or contains `'abort'`);
+ *     otherwise `'completed'`. Matches `handleWorkflowComplete` in the
+ *     orchestrator.
+ *   - Human-gate state: `'waiting_human'`.
+ *   - Otherwise: `'interrupted'` (mid-run state with no live instance —
+ *     typical of a daemon crash).
+ */
+export declare function computePastRunPhase(checkpoint: WorkflowCheckpoint, definition: WorkflowDefinition, isLive: boolean): LiveWorkflowPhase | PastRunPhase;
+/**
+ * Synthesize a `PastRunPhase` for a checkpoint-less directory from its message log.
+ * `entries` must be chronological (oldest-first), matching `MessageLog.readAll()`.
+ *
+ * Per D6: the destination state of the last `state_transition` lives in the
+ * `event` field (orchestrator.handleTransition writes it there). For non-terminal,
+ * non-gate destinations, post-transition `quota_exhausted` → 'aborted',
+ * `transient_failure` → 'aborted', `error` → 'failed', none → 'interrupted'.
+ */
+export declare function synthesizePhaseFromMessageLog(entries: readonly MessageLogEntry[], definition: WorkflowDefinition): PastRunPhase;
+/**
+ * `TransitionRecord` doesn't carry a structured verdict; the frontend populates
+ * `latestVerdict` from live `workflow.agent_completed` events. Past-run callers
+ * receive `undefined` until checkpoints capture verdict/confidence first-class.
+ */
+export declare function extractLatestVerdictFromTransitions(): LatestVerdictDto | undefined;
+/** Assembles a `WorkflowDetailDto` from on-disk past-run objects (checkpoint or message-log fallback). */
+export declare function buildDetailFromPastRun(id: WorkflowId, load: PastRunLoadSuccess, summary: WorkflowRunSummary): WorkflowDetailDto;
+/** Map file extensions to language identifiers for syntax highlighting. */
+export declare function inferLanguage(filePath: string): string;
+/**
+ * Resolves a relative path within a workspace and validates containment.
+ * Prevents path traversal attacks.
+ */
+export declare function resolveAndContain(workspacePath: string, relPath: string): string;
+/** Assembles a `PastRunDto` from on-disk past-run objects (checkpoint or message-log fallback). */
+export declare function buildPastRunDto(id: WorkflowId, load: PastRunLoadSuccess, summary: WorkflowRunSummary): PastRunDto;
+/**
+ * Reads a page of {@link MessageLogEntry} records for a workflow with cursor
+ * pagination (per design decision D5).
+ *
+ * Existence semantics: the workflow must be either currently active in the
+ * orchestrator or recoverable from disk via {@link WorkflowManager.loadPastRun}.
+ * Workflows write their checkpoint+definition immediately on `start()`, so
+ * `loadPastRun` succeeds for live workflows too — this single check covers
+ * both the live and past-run cases. Throws `WORKFLOW_NOT_FOUND` when neither
+ * source has the id and `WORKFLOW_CORRUPTED` when the checkpoint or definition
+ * file is present but unparseable.
+ *
+ * Note: `MessageLog.readAll()` silently skips malformed JSONL lines (it's
+ * append-only and tolerant of truncated writes from crashes), so we cannot
+ * surface log-file corruption distinctly here. The corruption error class
+ * therefore reflects only checkpoint/definition issues, not log issues.
+ *
+ * Pagination shape: `entries` is filtered to `ts < before` when `before` is
+ * set, sorted descending by `ts` (newest first), then sliced to `limit`.
+ * `hasMore` is true iff `entries.length === limit` AND at least one entry
+ * with `ts < entries[entries.length - 1].ts` exists in the original log.
+ *
+ * Cost: v1 re-reads and re-parses the whole log on every page request. This
+ * is acceptable given typical message-log sizes (hundreds of entries); a
+ * future `MessageLog.readRange(opts)` API can stream from disk in reverse
+ * order if logs grow pathologically large. The `MessageLogResponseDto` shape
+ * is stable across that change.
+ */
+export declare function readMessageLogPage(manager: WorkflowManager, workflowId: WorkflowId, opts: {
+    before?: string;
+    limit: number;
+}): MessageLogResponseDto;
+/**
+ * Extracts a human-readable state name from an XState machine state snapshot.
+ * The machineState can be a string (simple state) or a nested object (compound state).
+ */
+export declare function extractLastState(machineState: unknown): string;