@rubytech/create-realagent 1.0.613 → 1.0.615

package/payload/server/server.js

@@ -4165,7 +4165,9 @@ import Anthropic2 from "@anthropic-ai/sdk";
 import { spawn as spawn2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
 import { resolve as resolve6, join as join4 } from "path";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync2, unlinkSync, cpSync, rmSync } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync, cpSync, rmSync } from "fs";
+import { lookup as dnsLookup } from "dns/promises";
+import { createConnection as netConnect } from "net";
 
 // ../lib/models/src/index.ts
 var OPUS_MODEL = "claude-opus-4-7";
@@ -4465,7 +4467,7 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 import neo4j from "neo4j-driver";
 import { randomUUID } from "crypto";
 import { spawn } from "child_process";
-import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5, openSync, readSync, closeSync, statSync as statSync2 } from "fs";
 import { resolve as resolve5 } from "path";
 var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
 var driver = null;
@@ -5455,7 +5457,45 @@ Expertise: ${typeof profile.expertise === "string" ? profile.expertise : JSON.st
 var MAX_SESSION_TASKS = 20;
 var MAX_SESSION_REVIEW_ALERTS = 5;
 var MAX_SESSION_PROJECTS = 5;
-async function loadSessionContext(accountId) {
+var MAX_RECENT_TOOL_FAILURES = 3;
+var RECENT_FAILURES_TAIL_BYTES = 10 * 1024;
+function readRecentToolFailures(accountId, conversationId) {
+  try {
+    const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
+    const logDir = resolve5(platformRoot3, "..", "data/accounts", accountId, "logs");
+    const date5 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const logPath2 = resolve5(logDir, `claude-agent-stream-${date5}.log`);
+    if (!existsSync5(logPath2)) return [];
+    const st = statSync2(logPath2);
+    const size = st.size;
+    const readBytes = Math.min(size, RECENT_FAILURES_TAIL_BYTES);
+    const position = size - readBytes;
+    const fd = openSync(logPath2, "r");
+    try {
+      const buf = Buffer.alloc(readBytes);
+      readSync(fd, buf, 0, readBytes, position);
+      const text = buf.toString("utf-8");
+      const convPrefix = conversationId.slice(0, 8);
+      const lines = text.split("\n");
+      const matches = [];
+      for (let i = lines.length - 1; i >= 0 && matches.length < MAX_RECENT_TOOL_FAILURES; i--) {
+        const line = lines[i];
+        if (line.includes("[tool-failure-diag]") && line.includes(`conversationId=${convPrefix}`)) {
+          matches.push(line);
+        }
+      }
+      return matches.reverse();
+    } finally {
+      closeSync(fd);
+    }
+  } catch (err) {
+    console.error(
+      `[session-context] recent-tool-failures read failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return [];
+  }
+}
+async function loadSessionContext(accountId, conversationId) {
   const session = getSession();
   try {
     const digestResult = await session.run(
@@ -5625,9 +5665,21 @@ ${projectLines.join("\n")}`);
       sections.push(`## Active Review Alerts (${alertsResult.records.length})
 ${alertLines.join("\n")}`);
     }
+    let recentFailuresCount = 0;
+    if (conversationId) {
+      const failureLines = readRecentToolFailures(accountId, conversationId);
+      if (failureLines.length > 0) {
+        recentFailuresCount = failureLines.length;
+        const guidance = "These tool calls failed in the current conversation. Inspect the diagnostic fields before retrying the same tool against the same target \u2014 if you do retry, narrate explicitly why the diagnostic suggests a retry will now succeed. A second identical failure is evidence the path is broken, not evidence another attempt is warranted.";
+        sections.push(`## Recent Tool Failures (${failureLines.length})
+${guidance}
+
+${failureLines.map((l) => `- ${l.trim()}`).join("\n")}`);
+      }
+    }
     if (sections.length === 0) return null;
     console.error(
-      `[session-context] Loaded for ${accountId.slice(0, 8)}\u2026: digest=${digestResult.records.length > 0 ? "yes" : "no"}, tasks=${tasksResult.records.length}, projects=${projectsCount}, reviewAlerts=${alertsResult.records.length}, pendingActions=${pendingCount}`
+      `[session-context] Loaded for ${accountId.slice(0, 8)}\u2026: digest=${digestResult.records.length > 0 ? "yes" : "no"}, tasks=${tasksResult.records.length}, projects=${projectsCount}, reviewAlerts=${alertsResult.records.length}, pendingActions=${pendingCount}, recentFailures=${recentFailuresCount}`
     );
     return `<previous-context>
 ${sections.join("\n\n")}
@@ -5991,6 +6043,133 @@ var BROWSER_TOOL_PREFIXES = [
 function isBrowserTool(name) {
   return BROWSER_TOOL_PREFIXES.some((p) => name.startsWith(p));
 }
+var DIAG_HARD_CAP_MS = 5e3;
+var DIAG_DNS_TIMEOUT_MS = 2e3;
+var DIAG_TCP_TIMEOUT_MS = 3e3;
+var DIAG_HTTP_TIMEOUT_MS = 4e3;
+function quoteDiag(value) {
+  return JSON.stringify(value);
+}
+function extractUrl(toolName, input) {
+  if (input === null || typeof input !== "object") return void 0;
+  const obj = input;
+  if (toolName === "WebFetch" && typeof obj.url === "string") return obj.url;
+  if (isBrowserTool(toolName) && typeof obj.url === "string") return obj.url;
+  if (typeof obj.url === "string" && /^https?:\/\//.test(obj.url)) return obj.url;
+  return void 0;
+}
+var FULL_REDACT_ENV_VARS = /* @__PURE__ */ new Set(["HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY"]);
+function redactEnvField(name) {
+  const value = process.env[name];
+  if (!value) return `${name.toLowerCase()}=absent`;
+  if (FULL_REDACT_ENV_VARS.has(name)) {
+    return `${name.toLowerCase()}=present`;
+  }
+  const suffix = value.length > 40 ? value.slice(-40) : value;
+  return `${name.toLowerCase()}=present suffix=${quoteDiag(suffix)}`;
+}
+async function probeDns(host, family) {
+  const label = family === 4 ? "dns_a" : "dns_aaaa";
+  const start = Date.now();
+  let timer;
+  try {
+    const result = await Promise.race([
+      dnsLookup(host, { family, verbatim: true }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("timeout")), DIAG_DNS_TIMEOUT_MS);
+      })
+    ]);
+    if (timer) clearTimeout(timer);
+    const ms = Date.now() - start;
+    return `${label}=${result.address} ${label}_ms=${ms}`;
+  } catch (err) {
+    if (timer) clearTimeout(timer);
+    const ms = Date.now() - start;
+    const msg = err instanceof Error ? err.message : String(err);
+    return `${label}=err ${label}_err=${quoteDiag(msg.slice(0, 60))} ${label}_ms=${ms}`;
+  }
+}
+async function probeTcp(host, port2) {
+  const start = Date.now();
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    const sock = netConnect({ host, port: port2, family: 0 });
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      try {
+        sock.destroy();
+      } catch {
+      }
+      resolvePromise(result);
+    };
+    const timer = setTimeout(() => finish(`tcp=timeout tcp_ms=${Date.now() - start}`), DIAG_TCP_TIMEOUT_MS);
+    sock.once("connect", () => {
+      clearTimeout(timer);
+      finish(`tcp=ok tcp_ms=${Date.now() - start}`);
+    });
+    sock.once("error", (err) => {
+      clearTimeout(timer);
+      const msg = err instanceof Error ? err.message : String(err);
+      finish(`tcp=err tcp_err=${quoteDiag(msg.slice(0, 60))} tcp_ms=${Date.now() - start}`);
+    });
+  });
+}
+async function probeHttp(url2) {
+  const start = Date.now();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DIAG_HTTP_TIMEOUT_MS);
+  try {
+    const res = await fetch(url2, { method: "HEAD", redirect: "manual", signal: controller.signal });
+    clearTimeout(timer);
+    return `http_status=${res.status} http_ms=${Date.now() - start}`;
+  } catch (err) {
+    clearTimeout(timer);
+    const msg = err instanceof Error ? err.message : String(err);
+    return `http_status=err http_err=${quoteDiag(msg.slice(0, 60))} http_ms=${Date.now() - start}`;
+  }
+}
+async function runFailureDiagnostic(toolName, toolInput) {
+  const inputKeys = toolInput !== null && typeof toolInput === "object" ? Object.keys(toolInput).join(",") : "";
+  const envFields = [
+    redactEnvField("HTTPS_PROXY"),
+    redactEnvField("HTTP_PROXY"),
+    redactEnvField("NO_PROXY"),
+    redactEnvField("NODE_OPTIONS")
+  ].join(" ");
+  const url2 = extractUrl(toolName, toolInput);
+  if (!url2) {
+    return `diag_url=none input_keys=[${inputKeys}] ${envFields}`;
+  }
+  let host;
+  let port2;
+  try {
+    const parsed = new URL(url2);
+    host = parsed.hostname;
+    port2 = parsed.port ? Number(parsed.port) : parsed.protocol === "https:" ? 443 : 80;
+  } catch {
+    return `diag_url=unparseable input_keys=[${inputKeys}] ${envFields}`;
+  }
+  const probes = Promise.allSettled([
+    probeDns(host, 4),
+    probeDns(host, 6),
+    probeTcp(host, port2),
+    probeHttp(url2)
+  ]);
+  let capTimer;
+  const capped = await Promise.race([
+    probes,
+    new Promise((resolvePromise) => {
+      capTimer = setTimeout(() => resolvePromise("__diag_timeout__"), DIAG_HARD_CAP_MS);
+    })
+  ]);
+  if (capTimer) clearTimeout(capTimer);
+  if (capped === "__diag_timeout__") {
+    return `diag_host=${host} diag_port=${port2} diag_timeout=true input_keys=[${inputKeys}] ${envFields}`;
+  }
+  const fields = capped.map((r) => r.status === "fulfilled" ? r.value : `probe_err=${quoteDiag(String(r.reason).slice(0, 40))}`).join(" ");
+  return `diag_host=${host} diag_port=${port2} ${fields} input_keys=[${inputKeys}] ${envFields}`;
+}
 function agentLogStream(name, accountDir) {
   const logDir = resolve6(accountDir, "logs");
   mkdirSync4(logDir, { recursive: true });
@@ -6000,7 +6179,7 @@ function agentLogStream(name, accountDir) {
     for (const file2 of readdirSync2(logDir)) {
       if (!file2.startsWith(`${name}-`)) continue;
       const filePath = resolve6(logDir, file2);
-      if (statSync2(filePath).mtimeMs < cutoff) unlinkSync(filePath);
+      if (statSync3(filePath).mtimeMs < cutoff) unlinkSync(filePath);
     }
   } catch {
   }
@@ -6182,8 +6361,8 @@ function resolveAgentConfig(accountDir, agentName) {
   const hasKnowledge = existsSync6(knowledgePath);
   const hasSummary = existsSync6(summaryPath);
   if (hasKnowledge && hasSummary) {
-    const knowledgeMtime = statSync2(knowledgePath).mtimeMs;
-    const summaryMtime = statSync2(summaryPath).mtimeMs;
+    const knowledgeMtime = statSync3(knowledgePath).mtimeMs;
+    const summaryMtime = statSync3(summaryPath).mtimeMs;
     if (summaryMtime >= knowledgeMtime) {
       knowledge = readFileSync7(summaryPath, "utf-8");
     } else {
@@ -6862,7 +7041,7 @@ ${specialist}: ${plugins.join(", ")}`);
           for (const entry of readdirSync2(current)) {
             const full = resolve6(current, entry);
             try {
-              const stat4 = statSync2(full);
+              const stat4 = statSync3(full);
               if (stat4.isDirectory()) {
                 walk(full, `${rel}${entry}/`);
               } else if (entry.endsWith(".md")) {
@@ -6993,6 +7172,15 @@ function resolveUserAccounts(userId) {
 var sessionStore = /* @__PURE__ */ new Map();
 setSessionStoreRef(sessionStore);
 function registerSession(sessionKey, agentType, accountId, agentName, userId, userName) {
+  const existing = sessionStore.get(sessionKey);
+  if (existing) {
+    existing.agentType = agentType;
+    existing.accountId = accountId;
+    existing.agentName = agentName ?? existing.agentName;
+    existing.userId = userId ?? existing.userId;
+    existing.userName = userName ?? existing.userName;
+    return;
+  }
   sessionStore.set(sessionKey, { createdAt: Date.now(), agentType, accountId, agentName, userId, userName });
 }
 function registerResumedSession(sessionKey, accountId, agentName, conversationId, messages) {
@@ -7057,6 +7245,9 @@ function storeAgentSessionId(sessionKey, agentSessionId) {
   const session = sessionStore.get(sessionKey);
   if (session) {
     session.agentSessionId = agentSessionId;
+    console.error(`[session-store] storeAgentSessionId sessionKey=${sessionKey.slice(0, 12)}\u2026 sessionId=${agentSessionId.slice(0, 8)}\u2026`);
+  } else {
+    console.error(`[session-store] storeAgentSessionId SKIPPED \u2014 no session entry sessionKey=${sessionKey.slice(0, 12)}\u2026 sessionId=${agentSessionId.slice(0, 8)}\u2026`);
   }
 }
 function getAgentSessionId(sessionKey) {
@@ -8033,14 +8224,19 @@ async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSes
   streamLog.end();
   return { ok: capturedSummary !== void 0 && !timedOut, summary: capturedSummary };
 }
-function clearAgentSessionId(sessionKey) {
+function clearAgentSessionId(sessionKey, reason) {
   const session = sessionStore.get(sessionKey);
   if (session) {
     session.agentSessionId = void 0;
+    console.error(`[session-store] clearAgentSessionId sessionKey=${sessionKey.slice(0, 12)}\u2026 reason=${reason}`);
+  } else {
+    console.error(`[session-store] clearAgentSessionId SKIPPED \u2014 no session entry sessionKey=${sessionKey.slice(0, 12)}\u2026 reason=${reason}`);
   }
 }
-async function* parseClaudeStream(proc, streamLog, adminModel) {
+async function* parseClaudeStream(proc, streamLog, adminModel, conversationId) {
   const toolIdToName = /* @__PURE__ */ new Map();
+  const toolIdToInput = /* @__PURE__ */ new Map();
+  const convIdTag = conversationId ? ` conversationId=${conversationId.slice(0, 8)}` : "";
   let emittedDone = false;
   let buffer = "";
   const modelCtxWindow = contextWindow(adminModel);
@@ -8236,15 +8432,18 @@ async function* parseClaudeStream(proc, streamLog, adminModel) {
                   yield { type: "session_resume", conversationId: resumeConversationId };
                 }
               } else {
-                if (block.id) toolIdToName.set(block.id, block.name);
+                if (block.id) {
+                  toolIdToName.set(block.id, block.name);
+                  toolIdToInput.set(block.id, block.input ?? {});
+                }
                 const inputPreview = JSON.stringify(block.input ?? {}).slice(0, 200);
                 if (block.name === "Agent") {
                   const subType = block.input?.subagent_type ?? "general-purpose";
                   const desc = block.input?.description ?? "";
-                  streamLog.write(`[${isoTs()}] [agent-dispatch] subagent_type=${JSON.stringify(subType)} description=${JSON.stringify(desc)} input=${inputPreview}
+                  streamLog.write(`[${isoTs()}] [agent-dispatch]${convIdTag} subagent_type=${JSON.stringify(subType)} description=${JSON.stringify(desc)} input=${inputPreview}
 `);
                 } else {
-                  streamLog.write(`[${isoTs()}] [tool-use] name=${block.name} input=${inputPreview}
+                  streamLog.write(`[${isoTs()}] [tool-use]${convIdTag} name=${block.name} input=${inputPreview}
 `);
                   if (isBrowserTool(block.name)) {
                     vncLog("mcp-tool", { name: block.name, input_preview: inputPreview });
@@ -8276,10 +8475,10 @@ async function* parseClaudeStream(proc, streamLog, adminModel) {
               }
               const outputPreview = output.slice(0, 300);
               if (name === "Agent") {
-                streamLog.write(`[${isoTs()}] [agent-return] error=${!!block.is_error} output=${JSON.stringify(outputPreview)}
+                streamLog.write(`[${isoTs()}] [agent-return]${convIdTag} error=${!!block.is_error} output=${JSON.stringify(outputPreview)}
 `);
               } else {
-                streamLog.write(`[${isoTs()}] [tool-result] name=${name} error=${!!block.is_error} output=${JSON.stringify(outputPreview)}
+                streamLog.write(`[${isoTs()}] [tool-result]${convIdTag} name=${name} error=${!!block.is_error} output=${JSON.stringify(outputPreview)}
 `);
                 if (isBrowserTool(name)) {
                   vncLog("mcp-tool-result", {
@@ -8288,7 +8487,24 @@ async function* parseClaudeStream(proc, streamLog, adminModel) {
                     output_preview: outputPreview
                   });
                 }
+                if (block.is_error && block.tool_use_id) {
+                  const toolInput = toolIdToInput.get(block.tool_use_id);
+                  try {
+                    const diag = await runFailureDiagnostic(name, toolInput);
+                    if (!streamLog.destroyed) {
+                      streamLog.write(`[${isoTs()}] [tool-failure-diag]${convIdTag} name=${name} ${diag}
+`);
+                    }
+                  } catch (err) {
+                    if (!streamLog.destroyed) {
+                      const msg2 = err instanceof Error ? err.message : String(err);
+                      streamLog.write(`[${isoTs()}] [tool-failure-diag]${convIdTag} name=${name} diag_err=${JSON.stringify(msg2.slice(0, 80))}
+`);
+                    }
+                  }
+                }
               }
+              if (block.tool_use_id) toolIdToInput.delete(block.tool_use_id);
               const renderDirectiveRe = /^__RENDER__(\{.+\})$/gm;
               let renderMatch;
               while ((renderMatch = renderDirectiveRe.exec(output)) !== null) {
@@ -8758,7 +8974,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
   const toolCalls = [];
   const pendingToolCalls = /* @__PURE__ */ new Map();
   let capturedTokens;
-  for await (const event of withSubagentHeartbeat(parseClaudeStream(proc, streamLog, adminModel), streamLog)) {
+  for await (const event of withSubagentHeartbeat(parseClaudeStream(proc, streamLog, adminModel, spawnConvId), streamLog)) {
     if (event.type === "session_init") {
       currentAgentSessionId = event.sessionId;
       if (sessionKey) storeAgentSessionId(sessionKey, event.sessionId);
@@ -8826,7 +9042,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
             console.error(`[profile-reflection] Unhandled error: ${err instanceof Error ? err.message : String(err)}`);
           });
         }
-        clearAgentSessionId(sessionKey);
+        clearAgentSessionId(sessionKey, "compaction-complete");
         const convId = sessionStore.get(sessionKey)?.conversationId;
         if (convId) {
           yield { type: "status", message: "Recovering context..." };
@@ -8890,7 +9106,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     } else if (event.type === "subagent_stalled") {
       if (sessionKey) {
         storeStalledSubagent(sessionKey, { name: event.name, task: event.task, prompt: event.prompt, elapsed_ms: event.elapsed_ms, tool_uses: event.tool_uses, total_tokens: event.total_tokens, last_tool_name: event.last_tool_name });
-        clearAgentSessionId(sessionKey);
+        clearAgentSessionId(sessionKey, "subagent-stalled");
       }
       const taskPreview = (event.task || "").length > 120 ? event.task.slice(0, 120) + "\u2026" : event.task || "";
       streamLog.write(`[${isoTs()}] [stall-recovery] name=${event.name} task=${JSON.stringify(taskPreview)} \u2014 informing user and closing stream
@@ -8905,7 +9121,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
       streamLog.write(`[${isoTs()}] [main-stream-stall-recovery] elapsed=${elapsedSec}s last_event=${event.last_event_type} \u2014 killing process and closing stream
 `);
       proc.kill("SIGTERM");
-      if (sessionKey) clearAgentSessionId(sessionKey);
+      if (sessionKey) clearAgentSessionId(sessionKey, "main-stream-stalled");
       yield { type: "text", content: `The response stalled after ${elapsedSec} seconds of silence. Tap Retry to try again.` };
       yield { type: "component", name: "action-buttons", data: { buttons: [{ label: "Retry", value: "Please retry my last request." }] } };
       gotDone = true;
@@ -8915,7 +9131,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
       if (event.subtype === "error_max_turns" && event.stop_reason === "tool_use") {
         streamLog.write(`[${isoTs()}] [max-turns-interrupted] subtype=${event.subtype} stop_reason=${event.stop_reason} \u2014 entering recovery
 `);
-        if (sessionKey) clearAgentSessionId(sessionKey);
+        if (sessionKey) clearAgentSessionId(sessionKey, "max-turns-interrupted");
       } else {
         gotDone = true;
         if (!sessionWasReset) {
@@ -8951,7 +9167,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     yield event;
   }
   if (!gotDone) {
-    if (sessionKey) clearAgentSessionId(sessionKey);
+    if (sessionKey) clearAgentSessionId(sessionKey, "context-overflow-recovery");
     const hasWork = responseText.length > 0 || toolCalls.length > 0;
     if (hasWork && retryCount === 0 && sessionKey) {
       streamLog.write(`[${isoTs()}] [context-overflow-recovery] detected sessionKey=${sessionKey.slice(0, 8)}\u2026 responseTextLen=${responseText.length} toolCallCount=${toolCalls.length}
@@ -9086,7 +9302,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
   const pendingToolCalls = /* @__PURE__ */ new Map();
   const renderedComponents = [];
   let capturedTokens;
-  for await (const event of withSubagentHeartbeat(parseClaudeStream(proc, streamLog, adminModel), streamLog)) {
+  for await (const event of withSubagentHeartbeat(parseClaudeStream(proc, streamLog, adminModel, managedConvId), streamLog)) {
     if (event.type === "text") {
       responseText += event.content;
     } else if (event.type === "usage") {
@@ -9588,7 +9804,7 @@ ${EXPLANATORY_STYLE_INSTRUCTIONS}` : baseSystemPrompt;
       console.error(`[profile-reflection] Unhandled error: ${err instanceof Error ? err.message : String(err)}`);
     });
   }
-  clearAgentSessionId(sessionKey);
+  clearAgentSessionId(sessionKey, "session-compact-complete");
   return { ok: step.value.ok };
 }
 async function* invokeAgent(config2, message, sessionKey, attachments = [], userTimestamp, gatewayResult) {
@@ -9658,8 +9874,9 @@ $ACCOUNT_DIR is ${account.accountDir}
 ${profileSummary}`;
       }
     }
+    const invokeConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
     const [sessionContext, onboardingStep] = await Promise.all([
-      loadSessionContext(accountId),
+      loadSessionContext(accountId, invokeConvId),
       loadOnboardingStep(accountId)
     ]);
     if (sessionContext) {
@@ -9874,7 +10091,7 @@ ${block}`;
 import { basename as basename2 } from "path";
 
 // app/lib/review-detector/rules.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, statSync as statSync3, mkdirSync as mkdirSync5, renameSync } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, statSync as statSync4, mkdirSync as mkdirSync5, renameSync } from "fs";
 import { resolve as resolve7, dirname as dirname2 } from "path";
 var DEFAULT_SCAN_INTERVAL_MS = 5e3;
 var RATE_LIMIT_PATTERN = "rate[- ]?limit(?:ed| reached| hit)|(?:HTTP|status)[^a-z]{0,3}429|too many requests";
@@ -9898,6 +10115,7 @@ var VALID_SOURCES = /* @__PURE__ */ new Set([
   "mcp",
   "config-dir"
 ]);
+var VALID_SCOPES = /* @__PURE__ */ new Set(["global", "session"]);
 function defaultRules() {
   return [
     {
@@ -9972,6 +10190,20 @@ function defaultRules() {
       thresholdCount: 0,
       thresholdWindowMinutes: 0,
       suggestedAction: "An external-facing tool executed with auto-executed approval state. Check account.json approvalPolicy \u2014 if this tool should require review, the gating hook may have been bypassed or the policy was changed."
+    },
+    {
+      // Task 530: catches the bridgeai-style class where a single conversation
+      // sees the same tool error repeatedly and the agent silently falls back.
+      // Session-scoped so cross-conversation coincidence doesn't trigger it.
+      id: "tool-result-recurring-errors",
+      name: "Tool result errors recurring in a conversation",
+      type: "repeated-error",
+      logSource: "system",
+      pattern: "\\[tool-result\\].*error=true",
+      thresholdCount: 2,
+      thresholdWindowMinutes: 5,
+      scope: "session",
+      suggestedAction: 'The same conversation has logged multiple tool failures. Use the admin `logs-read` MCP tool with `type: "system"` (or the `logs-read.sh` script with the conversationId) to retrieve the adjacent [tool-failure-diag] lines and identify whether the cause is DNS, TCP, HTTP, or the tool\'s internal pipeline \u2014 then adapt the next attempt to match. Never retry the same tool against the same target without diagnostic-grounded reasoning.'
     }
   ];
 }
@@ -10006,7 +10238,7 @@ function loadRules(configDir2) {
 function rulesFileMtime(configDir2) {
   const path2 = rulesFilePath(configDir2);
   try {
-    return statSync3(path2).mtimeMs;
+    return statSync4(path2).mtimeMs;
   } catch {
     return null;
   }
@@ -10117,6 +10349,12 @@ function validateRule(input, label, seenIds) {
   if (typeof r.watchPath === "string") rule.watchPath = r.watchPath;
   if (typeof r.staleHours === "number") rule.staleHours = r.staleHours;
   if (typeof r.suppressedUntil === "string") rule.suppressedUntil = r.suppressedUntil;
+  if (r.scope !== void 0) {
+    if (typeof r.scope !== "string" || !VALID_SCOPES.has(r.scope)) {
+      throw new Error(`${label}: scope must be one of ${[...VALID_SCOPES].join(", ")}`);
+    }
+    rule.scope = r.scope;
+  }
   if (rule.type === "file-write-storm" || rule.type === "stale-log") {
     if (!rule.watchPath) {
       throw new Error(`${label}: ${rule.type} rules require watchPath`);
@@ -10131,7 +10369,7 @@ function validateRule(input, label, seenIds) {
 }
 
 // app/lib/review-detector/sources.ts
-import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync7, renameSync as renameSync2, mkdirSync as mkdirSync6, openSync, readSync, closeSync, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync2, mkdirSync as mkdirSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve8, join as join5, basename, dirname as dirname3 } from "path";
 function tailStatePath(configDir2) {
   return resolve8(configDir2, "review-state.json");
@@ -10202,7 +10440,7 @@ function discoverAllSources(configDir2, accountLogDir2) {
 }
 function readNewLines(filepath, prev) {
   if (!existsSync8(filepath)) return null;
-  const stat4 = statSync4(filepath);
+  const stat4 = statSync5(filepath);
   const size = stat4.size;
   const inode = stat4.ino;
   let startOffset = 0;
@@ -10227,12 +10465,12 @@ function readNewLines(filepath, prev) {
       truncated
     };
   }
-  const fd = openSync(filepath, "r");
+  const fd = openSync2(filepath, "r");
   try {
     const bufSize = Math.max(0, size - startOffset);
     const buf = Buffer.alloc(bufSize);
     if (bufSize > 0) {
-      readSync(fd, buf, 0, bufSize, startOffset);
+      readSync2(fd, buf, 0, bufSize, startOffset);
     }
     const text = buf.toString("utf-8");
     const lines = text.length > 0 ? text.split("\n") : [];
@@ -10250,7 +10488,7 @@ function readNewLines(filepath, prev) {
       truncated
     };
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
 }
 function countRecentWrites(dir, sinceMs) {
@@ -10259,7 +10497,7 @@ function countRecentWrites(dir, sinceMs) {
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (!entry.isFile()) continue;
     try {
-      const st = statSync4(join5(dir, entry.name));
+      const st = statSync5(join5(dir, entry.name));
       if (st.mtimeMs >= sinceMs) count += 1;
     } catch {
     }
@@ -10269,7 +10507,7 @@ function countRecentWrites(dir, sinceMs) {
 function fileLastWriteMs(path2) {
   if (!existsSync8(path2)) return null;
   try {
-    return statSync4(path2).mtimeMs;
+    return statSync5(path2).mtimeMs;
   } catch {
     return null;
   }
@@ -10282,7 +10520,7 @@ function sourceKey(file2) {
 }
 
 // app/lib/review-detector/writer.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync3, statSync as statSync5 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync3, statSync as statSync6 } from "fs";
 import { resolve as resolve9, dirname as dirname4 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function reviewLogPath(configDir2) {
@@ -10548,6 +10786,12 @@ import { resolve as resolve10 } from "path";
 
 // app/lib/review-detector/evaluator.ts
 var SAMPLE_MAX_CHARS = 500;
+var CONV_ID_REGEX = /conversationId=([a-f0-9]{8})/;
+function scopeKeyFor(rule, line) {
+  if (rule.scope !== "session") return "";
+  const m = CONV_ID_REGEX.exec(line);
+  return m ? m[1] : "";
+}
 var compiledRegexCache = /* @__PURE__ */ new Map();
 function compileRegex(pattern) {
   let re = compiledRegexCache.get(pattern);
@@ -10568,31 +10812,60 @@ function toSample(line) {
   return line.slice(0, SAMPLE_MAX_CHARS) + "\u2026";
 }
 function newRuleState() {
-  return { matchTimestamps: [], lastAlertAt: null, cumulativeSinceLastAlert: 0, lastSeenAt: null };
+  return {
+    matchTimestamps: [],
+    matchTimestampsByScope: /* @__PURE__ */ new Map(),
+    lastAlertAt: null,
+    cumulativeSinceLastAlert: 0,
+    lastSeenAt: null
+  };
 }
 function evaluateTextRule(rule, lines, state, nowMs) {
   if (isSuppressed(rule, nowMs)) return { match: null, state };
   if (rule.pattern.length === 0) return { match: null, state };
   const regex = compileRegex(rule.pattern);
-  let sample = null;
-  let matchCount = 0;
+  const matchesByScope = /* @__PURE__ */ new Map();
+  let firstSample = null;
   for (const line of lines) {
-    if (regex.test(line)) {
-      matchCount += 1;
-      if (!sample) sample = line;
-    }
-  }
-  if (matchCount === 0) return { match: null, state };
+    if (!regex.test(line)) continue;
+    if (!firstSample) firstSample = line;
+    const key = scopeKeyFor(rule, line);
+    const existing = matchesByScope.get(key) ?? [];
+    existing.push(line);
+    matchesByScope.set(key, existing);
+  }
+  if (matchesByScope.size === 0) return { match: null, state };
+  const windowStart = rule.thresholdWindowMinutes > 0 ? nowMs - rule.thresholdWindowMinutes * 6e4 : -Infinity;
   const updated = {
     ...state,
-    matchTimestamps: [...state.matchTimestamps]
-  };
-  for (let i = 0; i < matchCount; i++) updated.matchTimestamps.push(nowMs);
-  if (rule.thresholdWindowMinutes > 0) {
-    const windowStart = nowMs - rule.thresholdWindowMinutes * 6e4;
+    matchTimestamps: [...state.matchTimestamps],
+    matchTimestampsByScope: new Map(state.matchTimestampsByScope ?? [])
+  };
+  let firingSample = null;
+  let fires = false;
+  const isCountZero = rule.thresholdCount === 0;
+  if (rule.scope === "session") {
+    for (const [key, hits] of matchesByScope) {
+      const prior = updated.matchTimestampsByScope.get(key) ?? [];
+      const merged = [...prior, ...hits.map(() => nowMs)].filter((t) => t >= windowStart);
+      if (merged.length === 0) {
+        updated.matchTimestampsByScope.delete(key);
+      } else {
+        updated.matchTimestampsByScope.set(key, merged);
+      }
+      if (!fires && (isCountZero || merged.length >= rule.thresholdCount)) {
+        fires = true;
+        firingSample = hits[0];
+      }
+    }
+  } else {
+    for (const hits of matchesByScope.values()) {
+      for (const _ of hits) updated.matchTimestamps.push(nowMs);
+    }
     updated.matchTimestamps = updated.matchTimestamps.filter((t) => t >= windowStart);
+    fires = isCountZero || updated.matchTimestamps.length >= rule.thresholdCount;
+    if (fires) firingSample = firstSample;
   }
-  const fires = rule.thresholdCount === 0 ? true : updated.matchTimestamps.length >= rule.thresholdCount;
   if (!fires) {
     return { match: null, state: updated };
   }
@@ -10600,7 +10873,7 @@ function evaluateTextRule(rule, lines, state, nowMs) {
     ruleId: rule.id,
     ruleName: rule.name,
     matchedAt: nowMs,
-    sampleEvidence: toSample(sample ?? lines[0] ?? ""),
+    sampleEvidence: toSample(firingSample ?? firstSample ?? lines[0] ?? ""),
     suggestedAction: rule.suggestedAction
   };
   return { match: match2, state: updated };
@@ -29925,7 +30198,7 @@ async function POST16(req) {
 
 // app/api/onboarding/claude-auth/route.ts
 import { spawn as spawn3, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync12, writeSync } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync12, writeSync } from "fs";
 function checkAuthStatus() {
   try {
     execFileSync2("claude", ["auth", "status"], { encoding: "utf-8", timeout: 5e3 });
@@ -29996,7 +30269,7 @@ async function POST17(req, remoteAddress) {
   const chromiumWrapper = writeChromiumWrapper();
   const x11Env = buildX11Env(chromiumWrapper, transport);
   vncLog("claude-auth", { action: "start", transport });
-  const claudeAuthLogFd = openSync2(logPath("claude-auth"), "a");
+  const claudeAuthLogFd = openSync3(logPath("claude-auth"), "a");
   const claudeProc = spawn3("claude", ["auth", "login"], {
     env: x11Env,
     stdio: ["ignore", "pipe", "pipe"]
@@ -30005,7 +30278,7 @@ async function POST17(req, remoteAddress) {
   const onClaudeOutput = (chunk) => writeSync(claudeAuthLogFd, chunk);
   claudeProc.stdout?.on("data", onClaudeOutput);
   claudeProc.stderr?.on("data", onClaudeOutput);
-  claudeProc.once("close", () => closeSync2(claudeAuthLogFd));
+  claudeProc.once("close", () => closeSync3(claudeAuthLogFd));
   await waitForAuthPage(2e4);
   return Response.json({ started: true, transport });
 }
@@ -30573,7 +30846,7 @@ async function POST22(req) {
 }
 
 // app/api/admin/logs/route.ts
-import { existsSync as existsSync19, readdirSync as readdirSync5, readFileSync as readFileSync20, statSync as statSync6 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync5, readFileSync as readFileSync20, statSync as statSync7 } from "fs";
 import { resolve as resolve19, basename as basename5 } from "path";
 var TAIL_BYTES = 8192;
 async function GET9(request) {
@@ -30634,7 +30907,7 @@ async function GET9(request) {
     } catch {
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync6(resolve19(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve19(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
         const content = readFileSync20(resolve19(dir, name));
@@ -30894,7 +31167,7 @@ async function GET13() {
 
 // app/api/admin/version/upgrade/route.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync24, statSync as statSync7, writeFileSync as writeFileSync16, readFileSync as readFileSync24, openSync as openSync3, closeSync as closeSync3 } from "fs";
+import { existsSync as existsSync24, statSync as statSync8, writeFileSync as writeFileSync16, readFileSync as readFileSync24, openSync as openSync4, closeSync as closeSync4 } from "fs";
 import { resolve as resolve25, join as join11 } from "path";
 var PLATFORM_ROOT10 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
 var upgradePkg = "@rubytech/create-maxy";
@@ -30914,7 +31187,7 @@ var LOCK_MAX_AGE_MS = 20 * 60 * 1e3;
 function isLockFresh() {
   if (!existsSync24(LOCK_FILE)) return false;
   try {
-    const stat4 = statSync7(LOCK_FILE);
+    const stat4 = statSync8(LOCK_FILE);
     return Date.now() - stat4.mtimeMs < LOCK_MAX_AGE_MS;
   } catch {
     return false;
@@ -30943,7 +31216,7 @@ async function POST23(req) {
     console.error("[admin/version/upgrade] failed to write lock file:", err);
   }
   try {
-    const logFd = openSync3(LOG_FILE, "w");
+    const logFd = openSync4(LOG_FILE, "w");
     const child = spawn4("systemd-run", [
       "--user",
       "--scope",
@@ -30959,7 +31232,7 @@ async function POST23(req) {
       cwd: resolve25(process.cwd(), "..")
     });
     child.unref();
-    closeSync3(logFd);
+    closeSync4(logFd);
     console.log(`[admin/version/upgrade] spawned upgrade process (pid ${child.pid})`);
     return Response.json({ ok: true, started: true });
   } catch (err) {