@rho-workspace/rho 0.5.3 → 0.5.5

package/node_modules/@hono/node-server/dist/index.js

@@ -52,6 +52,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -212,6 +221,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -232,6 +242,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/index.mjs

@@ -13,6 +13,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -173,6 +182,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -193,6 +203,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/listener.js

@@ -44,6 +44,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -204,6 +213,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -224,6 +234,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/listener.mjs

@@ -10,6 +10,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -170,6 +179,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -190,6 +200,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/request.js

@@ -38,6 +38,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -198,6 +207,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -218,6 +228,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/request.mjs

@@ -7,6 +7,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -167,6 +176,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -187,6 +197,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/server.js

@@ -48,6 +48,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -208,6 +217,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -228,6 +238,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/server.mjs

@@ -13,6 +13,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -173,6 +182,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -193,6 +203,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/vercel.js

@@ -46,6 +46,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -206,6 +215,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -226,6 +236,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/dist/vercel.mjs

@@ -10,6 +10,15 @@ var RequestError = class extends Error {
     this.name = "RequestError";
   }
 };
+var validateRequestTarget = (target) => {
+  const backslash = target.indexOf("\\");
+  if (backslash !== -1) {
+    const query = target.indexOf("?");
+    if (query === -1 || backslash < query) {
+      throw new RequestError("Backslash in request path");
+    }
+  }
+};
 var toRequestError = (e) => {
   if (e instanceof RequestError) {
     return e;
@@ -170,6 +179,7 @@ var newRequest = (incoming, defaultHostname) => {
       throw new RequestError("Absolute URL for :path is not allowed in HTTP/2");
     }
     try {
+      validateRequestTarget(incomingUrl);
       const url2 = new URL(incomingUrl);
       req[urlKey] = url2.href;
     } catch (e) {
@@ -190,6 +200,7 @@ var newRequest = (incoming, defaultHostname) => {
   } else {
     scheme = incoming.socket && incoming.socket.encrypted ? "https" : "http";
   }
+  validateRequestTarget(incomingUrl);
   const url = new URL(`${scheme}://${host}${incomingUrl}`);
   if (url.hostname.length !== host.length && url.hostname !== host.replace(/:\d+$/, "")) {
     throw new RequestError("Invalid host header");

package/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "1.19.17",
+  "version": "1.19.18",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/node_modules/@rho-workspace/plugin-agent/README.md

@@ -343,7 +343,9 @@ results. Results survive MCP restart. One call to the service may take
 `RHO_TRANSPORT_MS` (30 s), plus the `waitMs` it asks the service to wait (at most ten
 minutes, as for a Notebook cell); the call uses `node:http`, whose wait for a reply has
 no limit of its own. A transport overrun keeps the outcome uncertain and directs
-observation of the original identity, never replacement work.
+observation of the original identity, never replacement work. A refused connection is the one
+transport failure whose outcome is known: nothing reached the service, so the call
+returns `unavailable` naming the address and saying nothing ran (`delivered: false`).
 
 The pure `./layered-contract` entry defines the four tool inputs and Agent note
 props. `./layered` provides the bounded complete-object cache and caller checks;
@@ -388,3 +390,42 @@ fetched; an explicit response excludes replies already present in that context.
 ACP retains Codex's native MCP spelling while identifying its operation, and names
 an otherwise unnamed permission from the original tool update. These observations
 do not expand native permission or grant access to arbitrary session history.
+
+## External conversations
+
+Agent 0.4.29 exports `dsh-session` for a Harness adapter to retain a read-only
+observation of a native version-4 session. `observeDshSession(projectRoot, header,
+events)` requires the real native working folder to equal the selected project.
+It preserves session, turn and tool-call identities. Repeated cuts replace the
+same record; a changed prefix or backwards cursor is refused. It never creates
+an Agent, executes a tool, changes a grant or resumes a runtime.
+
+`external-session` supplies bounded `listExternalSessions` and
+`readExternalSession` reads. The operation contracts are `agent.sessions.list`
+and `agent.sessions.read`; an embedding application supplies authorization.
+`ui-external-session` renders prompts, visible replies, operations and results,
+with input explicitly retained by the native client. Reasoning, injected context
+and system messages are excluded; credential-shaped strings are redacted.
+This is an observation of the client's reports, not an independent execution proof.
+
+A successful resource-registration reply carries its exact resource identity and
+version. The application must verify that tuple against its own project resources.
+A native deliverable without a receipt is only a reported path, with no historical
+bytes asserted. Tool return, native exit code and turn completion remain separate.
+An unfinished turn with no observation for 10 seconds has an unknown outcome.
+
+`externalSessionLimits` names the fixed local observation budgets: 64 sessions
+per project, 200 retained turns per session, 256 tools per turn, 32,768 source
+events / 32 MiB per cut, 32,768 characters per prompt/reply and earlier-reply
+collection, 8,192 characters per tool field, and 4 MiB per stored record.
+Text/tools/earlier turns beyond their budgets are omitted with counts. An
+oversized source, conflicting cut, invalid record or busy writer retains the
+previous record and reports failure. Storage is `.rho/agent/external`, contained
+in the project without symlink directories; atomic replacement leaves readers a
+complete record. A positively dead PID lock can be reclaimed; an unknown/live
+lock cannot. Reads create no directories or runtime state. These limits protect
+local storage and observation work; they do not limit the native Agent.
+
+`test/external-session.test.mjs` checks identity, prefix conflicts, omissions,
+missing outcomes, redaction, project containment, retained failure and pagination.
+The Rho application records its separate real Harness/browser acceptance.

package/node_modules/@rho-workspace/plugin-agent/dist/acp-conversation.js

@@ -195,10 +195,21 @@ export class AcpConversation {
             let model;
             this.observationOrigin = this.sessionId ? 'history' : 'initial';
             if (this.sessionId) {
-                if (!initialized.agentCapabilities?.loadSession)
+                const caps = initialized.agentCapabilities;
+                if (caps?.loadSession) {
+                    const loaded = await connection.agent.request(acp.methods.agent.session.load, { ...params, sessionId: this.sessionId });
+                    this.settings = loaded.configOptions ?? [];
+                }
+                else if (caps?.sessionCapabilities?.resume) {
+                    // ACP session/resume (e.g. dsh): restore the persisted session on a fresh process. It composes
+                    // the request's MCP connections and validates only the workspace, so the non-standard
+                    // systemPrompt is omitted; history is restored from the Agent's own persistence, not replayed.
+                    const resumed = await connection.agent.request(acp.methods.agent.session.resume, { cwd: o.cwd, mcpServers: o.mcpServers, sessionId: this.sessionId });
+                    this.settings = resumed?.configOptions ?? [];
+                }
+                else {
                     throw new Error('This Agent cannot load the original session. Nothing was resent.');
-                const loaded = await connection.agent.request(acp.methods.agent.session.load, { ...params, sessionId: this.sessionId });
-                this.settings = loaded.configOptions ?? [];
+                }
             }
             else {
                 const created = await connection.agent.request(acp.methods.agent.session.new, params);

package/node_modules/@rho-workspace/plugin-agent/dist/activity-normalize.d.ts

@@ -10,5 +10,6 @@ export interface CaptureOptions {
     maxEventBytes?: number;
 }
 export declare function canonicalActivity(value: any): string;
+export declare function activityPayload(value: any, options: CaptureOptions): any;
 export declare function normalizeClaude(records: any[], sessionId: string, project: string, options?: CaptureOptions): ObservedEvent[];
 export declare function normalizeDsh(records: any[], options?: CaptureOptions): ObservedEvent[];

package/node_modules/@rho-workspace/plugin-agent/dist/activity-normalize.js

@@ -9,7 +9,7 @@ export function canonicalActivity(value) {
 const sensitive = /(?:^|[_-])(?:authorization|cookie|password|passwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token|token)$/i;
 const hidden = /^(?:thinking|reasoning|reasoning_content|signature)$/i;
 const txt = (v) => typeof v === 'string' ? v : Array.isArray(v) ? v.filter(b => b?.type === 'text').map(b => b.text).join('\n') : '';
-function payload(value, options) {
+export function activityPayload(value, options) {
     let redacted = false, truncated = false;
     const cap = options.maxFieldBytes ?? 8192;
     const identities = new Set(['native_id', 'call_id', 'root_call_id', 'job_id', 'parent_message_id']);
@@ -76,7 +76,7 @@ function inputSummary(input) {
 function chained(items, options) {
     let prefix = hash(activityNormalizer);
     return items.map(({ kind, data }, sequence) => {
-        const safe = payload(data, options);
+        const safe = activityPayload(data, options);
         prefix = hash(prefix + canonicalActivity({ kind, data: safe }));
         return { sequence, kind, data: { ...safe, prefix_sha256: prefix } };
     });

package/node_modules/@rho-workspace/plugin-agent/dist/conversation.d.ts

@@ -123,5 +123,6 @@ export declare function visibleError(error: unknown, env?: NodeJS.ProcessEnv): s
 export { ClaudeAcpConversation, type ClaudeAcpOptions } from './claude-acp.js';
 export { writeClaudePlugin, claudePluginLimits, type ClaudePlugin, type ClaudePluginSkill, type ClaudePluginHook } from './claude-plugin.js';
 export { CodexAcpConversation, type CodexAcpOptions } from './codex-acp.js';
+export { GenericAcpConversation, type GenericAcpOptions } from './generic-acp.js';
 export { ClaudeCliConversation } from './claude-cli.js';
 export type { SessionObservation, SessionTool, ConfigOption, ConfigValue } from './session-observation.js';

package/node_modules/@rho-workspace/plugin-agent/dist/conversation.js

@@ -25,4 +25,5 @@ export function visibleError(error, env = process.env) {
 export { ClaudeAcpConversation } from './claude-acp.js';
 export { writeClaudePlugin, claudePluginLimits } from './claude-plugin.js';
 export { CodexAcpConversation } from './codex-acp.js';
+export { GenericAcpConversation } from './generic-acp.js';
 export { ClaudeCliConversation } from './claude-cli.js';

package/node_modules/@rho-workspace/plugin-agent/dist/dsh-session.d.ts

@@ -0,0 +1,6 @@
+import { type ExternalSessionRecord } from './external-session.js';
+export declare function externalProjectPath(root: string, input: unknown): string | null;
+/** Project the native committed log. System prompts, injected context and reasoning
+ * are excluded. Original session, turn and call identities survive every backfill. */
+export declare function projectDshSession(root: string, header: any, events: readonly any[], observedAt?: string): ExternalSessionRecord;
+export declare function observeDshSession(root: string, header: any, events: readonly any[]): import("./external-session.js").ExternalSessionSummary;

package/node_modules/@rho-workspace/plugin-agent/dist/dsh-session.js

@@ -0,0 +1,174 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { activityPayload, canonicalActivity } from './activity-normalize.js';
+import { externalSessionId, retainedExternalSession, saveExternalSession } from './external-session.js';
+import { externalSessionLimits as limits } from './external-session-contract.js';
+const text = (v) => typeof v === 'string' ? v : Array.isArray(v) ? v.filter(b => b?.type === 'text' && typeof b.text === 'string').map(b => b.text).join('\n') : '';
+const time = (v) => { const n = typeof v === 'number' ? v : Date.parse(v); if (!Number.isFinite(n))
+    throw new Error('Native event has no valid timestamp.'); return new Date(n).toISOString(); };
+const hash = (v) => createHash('sha256').update(canonicalActivity(v)).digest('hex');
+const safe = (value, cap = limits.maxTextChars) => (activityPayload({ text: value.replace(/\b([\w-]*(?:token|cookie|authorization)["']?\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s'";]+)/gi, '$1[redacted]') }, { content: true, maxFieldBytes: cap * 4, maxEventBytes: cap * 8 }).text ?? '').slice(0, cap).replace(/[\uD800-\uDBFF]$/, '');
+export function externalProjectPath(root, input) {
+    if (typeof input !== 'string' || input.length > 1024 || input.includes('\0'))
+        return null;
+    const relative = path.relative(root, path.resolve(root, input)).split(path.sep).join('/');
+    return relative && !relative.startsWith('../') && !path.isAbsolute(relative) && !relative.split('/').some(p => ['..', '.rho', '.git'].includes(p)) ? relative : null;
+}
+function paths(root, args, content) {
+    const candidates = [args?.path, args?.file_path, args?.filename, args?.declaration?.path];
+    // These are explicitly labelled mentions, never inferred file writes or historical snapshots.
+    for (const m of content.matchAll(/(?<![\w/.:\-])\/?(?:[\w.\-\u0080-\uFFFF]+\/)*[\w.\-\u0080-\uFFFF]+\.(?:R|r|py|md|csv|tsv|png|svg|pdf|json|txt|qmd|Rmd)\b/g))
+        candidates.push(m[0]);
+    return [...new Set(candidates.map(p => externalProjectPath(root, p)).filter((p) => !!p))].slice(0, 32);
+}
+/** Project the native committed log. System prompts, injected context and reasoning
+ * are excluded. Original session, turn and call identities survive every backfill. */
+export function projectDshSession(root, header, events, observedAt = new Date().toISOString()) {
+    root = fs.realpathSync(root);
+    if (!header || header.version !== 4 || typeof header.id !== 'string' || !/^[A-Za-z0-9._:@-]{1,128}$/.test(header.id) || typeof header.cwd !== 'string' || fs.realpathSync(header.cwd) !== root)
+        throw new Error('Harness session does not match the selected project.');
+    if (events.length > limits.maxEvents || Buffer.byteLength(JSON.stringify(events)) > limits.maxSourceBytes)
+        throw new Error('Harness observation exceeds source limits; previous observation retained.');
+    const turns = [], byTurn = new Map(), tools = new Map();
+    let current, title = '', lastAt = time(header.createdAt), omittedTurns = 0;
+    const makeTurn = (id, at) => {
+        let t = byTurn.get(id);
+        if (t)
+            return t;
+        t = { id: 'turn:' + id, at, state: 'unknown', prompt: '', reply: '', messages: [], tools: [], results: [], omittedTools: 0, omittedChars: 0 };
+        byTurn.set(id, t);
+        turns.push(t);
+        if (turns.length > limits.maxTurns) {
+            const gone = turns.shift();
+            omittedTurns++;
+            for (const [k, v] of tools)
+                if (v.turn === gone)
+                    tools.delete(k);
+            for (const [k, v] of byTurn)
+                if (v === gone)
+                    byTurn.delete(k);
+        }
+        return t;
+    };
+    const appendText = (t, field, value, replace = false) => {
+        const full = replace ? value : t[field] + (t[field] ? '\n\n' : '') + value;
+        t[field] = safe(full);
+        t.omittedChars += Math.max(0, full.length - t[field].length);
+    };
+    for (let i = 0; i < events.length; i++) {
+        const e = events[i];
+        if (e.seq !== i)
+            throw new Error('Harness source has a missing or reordered native event.');
+        const d = e.data ?? {}, at = time(e.time);
+        lastAt = at;
+        if (e.type === 'session/title' && typeof d.title === 'string')
+            title = safe(d.title, 512);
+        if (e.type === 'turn/start') {
+            current = makeTurn(d.turn, at);
+            current.state = 'running';
+        }
+        if (e.type === 'user/message' && d.source?.kind === 'user') {
+            if (!current)
+                current = makeTurn(e.seq, at);
+            appendText(current, 'prompt', text(d.content));
+        }
+        if (e.type === 'assistant/message') {
+            const t = byTurn.get(d.turn) ?? current;
+            if (!t)
+                continue;
+            const message = text(d.message?.content);
+            if (message) {
+                if (t.reply)
+                    t.messages.push({ at, text: t.reply });
+                while (t.messages.length > 200 || t.messages.reduce((n, m) => n + m.text.length, 0) > limits.maxTextChars)
+                    t.omittedChars += t.messages.shift().text.length;
+                appendText(t, 'reply', message, true);
+            }
+        }
+        if (e.type === 'tool/call') {
+            const t = byTurn.get(d.turn) ?? current;
+            if (!t || typeof d.callId !== 'string' || typeof d.name !== 'string')
+                continue;
+            if (tools.has(d.callId))
+                throw new Error('Harness call identity was reused.');
+            if (t.tools.length >= limits.maxTools) {
+                t.omittedTools++;
+                continue;
+            }
+            let args = d.arguments;
+            if (typeof args === 'string') {
+                try {
+                    args = JSON.parse(args);
+                }
+                catch { }
+            }
+            const name = d.name === 'mcp__rho__rho_call' && typeof args?.operation === 'string' ? args.operation : d.name;
+            const input = args?.input ?? args;
+            const detail = safe(typeof input?.command === 'string' ? input.command : JSON.stringify(input) ?? '', limits.maxDetailChars);
+            const tool = { id: d.callId, at, name, detail, output: '', outcome: 'requested', paths: paths(root, input, detail) };
+            t.tools.push(tool);
+            tools.set(d.callId, { turn: t, tool });
+        }
+        if (e.type === 'tool/result') {
+            const message = d.message, item = tools.get(message?.toolCallId ?? message?.source?.callId);
+            if (!item)
+                continue;
+            const output = text(message?.content);
+            item.tool.output = safe(output, limits.maxDetailChars);
+            item.tool.outcome = message?.isError ? 'failed' : 'returned';
+            item.turn.omittedChars += Math.max(0, output.length - item.tool.output.length);
+            // Only a successful Rho registration/capture reply asserts an exact resource version.
+            if (['resource.register', 'resource.capture', 'agent.activity.capture'].includes(item.tool.name) && !message?.isError) {
+                try {
+                    const response = JSON.parse(output), r = response.value?.resource ?? response.value;
+                    const relative = externalProjectPath(root, r?.path);
+                    if (response.ok === true && relative && /^[a-f0-9]{64}$/.test(r.id) && /^[a-f0-9]{64}$/.test(r.version) && typeof r.projectId === 'string' && item.turn.results.length < 64)
+                        item.turn.results.push({ path: relative, id: r.id, version: r.version, projectId: r.projectId, toolId: item.tool.id });
+                }
+                catch { /* The bounded receipt can be incomplete; never fabricate a resource. */ }
+            }
+        }
+        if (e.type === 'job/settled') {
+            const item = tools.get(d.toolCall?.rootCallId ?? d.toolCall?.callId), exit = typeof d.detail === 'string' ? /^exit code: (-?\d+)$/.exec(d.detail) : null;
+            if (item && exit)
+                item.tool.exitCode = Number(exit[1]);
+        }
+        if (e.type === 'deliverables/presented') {
+            const t = byTurn.get(d.turn) ?? current;
+            if (!t)
+                continue;
+            for (const file of d.files ?? []) {
+                const relative = externalProjectPath(root, file.path);
+                if (relative && !t.results.some(r => r.path === relative) && t.results.length < 64)
+                    t.results.push({ path: relative, toolId: d.callId ?? 'event:' + e.seq });
+            }
+        }
+        if (e.type === 'turn/end') {
+            const t = byTurn.get(d.turn);
+            if (!t)
+                continue;
+            t.state = d.reason?.kind === 'completed' ? 'completed' : d.reason?.kind === 'cancelled' ? 'stopped' : d.reason?.kind === 'error' ? 'failed' : 'unknown';
+            t.endedAt = at;
+            for (const tool of t.tools)
+                if (tool.outcome === 'requested')
+                    tool.outcome = 'unknown';
+        }
+    }
+    const summary = { id: externalSessionId('dsh', header.id), producer: 'dsh', sessionId: header.id, title: title || turns.find(t => t.prompt)?.prompt.slice(0, 160) || 'Harness conversation', lastAt, observedAt,
+        state: turns.at(-1)?.state ?? 'unknown', turns: turns.length + omittedTurns, sourceCursor: events.length, omittedTurns, inputOwner: 'external' };
+    const result = { format: 1, projectRoot: root, summary, turns, sourceDigest: hash(events) };
+    // A suffix is retained at the record budget; gaps are explicit, earlier files stay untouched.
+    while (Buffer.byteLength(JSON.stringify(result)) > limits.maxRecordBytes && result.turns.length > 1) {
+        result.turns.shift();
+        result.summary.omittedTurns++;
+    }
+    if (Buffer.byteLength(JSON.stringify(result)) > limits.maxRecordBytes)
+        throw new Error('Harness turn exceeds maxRecordBytes; previous observation retained.');
+    return result;
+}
+export function observeDshSession(root, header, events) {
+    const old = retainedExternalSession(root, 'dsh', header.id);
+    const value = projectDshSession(root, header, events);
+    return saveExternalSession(root, value, old ? hash(events.slice(0, old.summary.sourceCursor)) : undefined);
+}