@sagentlab/navarch-runtime 0.1.90 → 0.1.92

package/README.md

@@ -460,6 +460,9 @@ unchanged across the deployment.
 | `NAVARCH_QODER_EXTRA_ARGS` | — | Comma list of extra CLI args appended after the unattended defaults (`--setting-sources`, `--permission-mode auto`, `--output-format json`). An explicit `--output-format`, `--permission-mode`, `--settings`, `--model`, or `--reasoning-effort` here replaces the per-session default. Qoder selects its own account models; pin one via `--model` here or `connect --model` to override. |
 | `NAVARCH_MCP_CONFIG_PATH` | — | Path to the platform MCP config passed as `--mcp-config`. |
 | `NAVARCH_WORKTREE_GUARD` | on | Host-mode sessions get an adapter-native per-session worktree boundary guard (see below). Set `off` to disable it for every runtime on the machine — required to run OpenCode on the host. |
+| `NAVARCH_NAVI_CONVERSATIONS` | on | Serve read-only Navi repository conversations on this machine. Only the `claude-code` adapter on the host sandbox with the worktree guard on is supported; `navarch-runtime doctor` prints the `navi_chat:` state and reason. Set `off` to stop polling for conversations. |
+| `NAVARCH_CONVERSATION_POLL_MS` | `5000` | Idle poll interval for queued conversation turns (1000–30000). |
+| `NAVARCH_CONVERSATION_TURN_TIMEOUT_MS` | `540000` | Time limit for one conversation turn's agent process (at most nine minutes). |
 | `NAVARCH_GUARD_EXTRA_ROOTS` | — | `path.delimiter`-separated (`:` on POSIX) extra directories the worktree guard allows beyond the session worktree, shared bare repo, and temp dirs. |
 
 ## Worktree boundary guard (host mode)

package/dist/adapters/claude-conversation.cjs

@@ -0,0 +1,269 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeConversationRunner = exports.ClaudeStreamParser = exports.CLAUDE_CONVERSATION_TOOLS = void 0;
+exports.claudeConversationArgs = claudeConversationArgs;
+exports.runClaudeConversationTurn = runClaudeConversationTurn;
+const node_child_process_1 = require("node:child_process");
+const node_perf_hooks_1 = require("node:perf_hooks");
+const kill_agent_cjs_1 = require("../kill-agent.cjs");
+/**
+ * Read-only tools a Navi repository question may use. Anything not listed
+ * (Bash, Edit, Write, WebFetch, Task, MCP tools) is absent from the model's
+ * tool list, so a question cannot itself authorize a code change, PR,
+ * deployment, or new task. Machine-wide NAVARCH_CLAUDE_EXTRA_ARGS are
+ * deliberately not applied here: they could add --dangerously-skip-permissions
+ * or --allowedTools and widen this boundary.
+ */
+exports.CLAUDE_CONVERSATION_TOOLS = "Read,Grep,Glob";
+const STDERR_TAIL_BYTES = 8 * 1024;
+/**
+ * Incremental parser for `claude -p --output-format stream-json --verbose
+ * --include-partial-messages`. Chunks may split a record anywhere. Text is
+ * emitted from `text_delta` records the moment they are parsed. A complete
+ * `assistant` message is used only for a message that streamed no deltas
+ * (a CLI without partial-message support), so text is never emitted twice.
+ */
+class ClaudeStreamParser {
+    emit;
+    onRecord;
+    buffer = "";
+    currentMessageId = null;
+    streamedMessages = new Set();
+    emittedText = false;
+    separatorPending = false;
+    result = null;
+    /** `onRecord` fires for each complete record before any event it produces is emitted. */
+    constructor(emit, onRecord = () => undefined) {
+        this.emit = emit;
+        this.onRecord = onRecord;
+    }
+    /** Returns the number of complete records parsed from this chunk. */
+    push(chunk) {
+        this.buffer += chunk;
+        let records = 0;
+        for (;;) {
+            const newline = this.buffer.indexOf("\n");
+            if (newline < 0)
+                break;
+            const line = this.buffer.slice(0, newline).trim();
+            this.buffer = this.buffer.slice(newline + 1);
+            if (!line)
+                continue;
+            records += 1;
+            this.onRecord();
+            this.record(line);
+        }
+        return records;
+    }
+    /** Parses a final record that lacks a trailing newline. */
+    flush() {
+        const line = this.buffer.trim();
+        this.buffer = "";
+        if (line) {
+            this.onRecord();
+            this.record(line);
+        }
+    }
+    /** Used when the agent finished without any streamed text. */
+    get hasEmittedText() {
+        return this.emittedText;
+    }
+    text(text) {
+        if (!text)
+            return;
+        this.emit({ type: "text", text: this.separatorPending ? `\n\n${text}` : text });
+        this.separatorPending = false;
+        this.emittedText = true;
+    }
+    record(line) {
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            return;
+        }
+        if (!parsed || typeof parsed !== "object")
+            return;
+        const record = parsed;
+        switch (record.type) {
+            case "stream_event":
+                this.streamEvent(record.event, record.parent_tool_use_id);
+                break;
+            case "assistant":
+                this.assistant(record);
+                break;
+            case "user":
+                this.toolResults(record);
+                break;
+            case "result":
+                this.result = {
+                    isError: record.is_error === true || (typeof record.subtype === "string" && record.subtype !== "success"),
+                    text: typeof record.result === "string" ? record.result : null,
+                };
+                if (this.result.isError)
+                    this.emit({ type: "failure", reason: String(record.subtype ?? "error") });
+                break;
+        }
+    }
+    streamEvent(event, parentToolUseId) {
+        // Sub-agent output is not part of the user's answer.
+        if (!event || typeof event !== "object" || parentToolUseId)
+            return;
+        const e = event;
+        const message = asRec(e.message);
+        const delta = asRec(e.delta);
+        if (e.type === "message_start") {
+            this.currentMessageId = typeof message?.id === "string" ? message.id : null;
+        }
+        else if (e.type === "content_block_start") {
+            const block = asRec(e.content_block);
+            if (block?.type === "tool_use" && typeof block.name === "string") {
+                this.emit({ type: "tool_status", tool: block.name, phase: "started" });
+            }
+            else if (block?.type === "text" && this.emittedText) {
+                this.separatorPending = true;
+            }
+        }
+        else if (e.type === "content_block_delta" && delta?.type === "text_delta" && typeof delta.text === "string") {
+            if (this.currentMessageId)
+                this.streamedMessages.add(this.currentMessageId);
+            this.text(delta.text);
+        }
+    }
+    assistant(record) {
+        const message = asRec(record.message);
+        if (record.parent_tool_use_id || !message || !Array.isArray(message.content))
+            return;
+        if (typeof message.id === "string" && this.streamedMessages.has(message.id))
+            return;
+        for (const item of message.content) {
+            const block = asRec(item);
+            if (block?.type === "text" && typeof block.text === "string") {
+                if (this.emittedText)
+                    this.separatorPending = true;
+                this.text(block.text);
+            }
+            else if (block?.type === "tool_use" && typeof block.name === "string" && !(typeof message.id === "string" && this.streamedMessages.has(message.id))) {
+                this.emit({ type: "tool_status", tool: block.name, phase: "started" });
+            }
+        }
+    }
+    toolResults(record) {
+        const content = asRec(record.message)?.content;
+        if (!Array.isArray(content))
+            return;
+        for (const item of content) {
+            const block = asRec(item);
+            if (block?.type === "tool_result" && block.is_error === true) {
+                this.emit({ type: "tool_status", tool: "tool", phase: "failed" });
+            }
+        }
+    }
+}
+exports.ClaudeStreamParser = ClaudeStreamParser;
+function asRec(value) {
+    return value && typeof value === "object" ? value : null;
+}
+/** Fixed, read-only argument list for one conversation turn. */
+function claudeConversationArgs(options) {
+    const args = [
+        "-p",
+        "--output-format", "stream-json",
+        "--verbose",
+        "--include-partial-messages",
+        // The server holds the bounded history. A local Claude transcript would
+        // be a second, unbounded private copy of the conversation.
+        "--no-session-persistence",
+        // No operator hooks, project settings or MCP servers (including the
+        // lease-scoped Navarch task tools) in a conversation.
+        "--setting-sources", "",
+        "--strict-mcp-config",
+        "--tools", exports.CLAUDE_CONVERSATION_TOOLS,
+        "--permission-mode", "default",
+    ];
+    if (options.settingsPath)
+        args.push("--settings", options.settingsPath);
+    if (options.model)
+        args.push("--model", options.model);
+    return args;
+}
+async function runClaudeConversationTurn(options) {
+    const idle = (aborted) => ({
+        exitCode: null, timedOut: false, aborted, succeeded: false, firstEventMs: null, firstTextMs: null, stderr: "",
+    });
+    if (options.signal.aborted)
+        return idle(true);
+    const startedAt = node_perf_hooks_1.performance.now();
+    let firstEventMs = null;
+    let firstTextMs = null;
+    let timedOut = false;
+    let aborted = false;
+    let closed = false;
+    let stderr = "";
+    const deliver = (event) => {
+        // After stop, timeout or exit, late output must not reach the caller.
+        if (closed || aborted || timedOut)
+            return;
+        if (event.type === "text" && firstTextMs === null)
+            firstTextMs = node_perf_hooks_1.performance.now() - startedAt;
+        options.onEvent(event);
+    };
+    const parser = new ClaudeStreamParser(deliver, () => {
+        if (firstEventMs === null)
+            firstEventMs = node_perf_hooks_1.performance.now() - startedAt;
+    });
+    return new Promise((resolve) => {
+        const child = (0, node_child_process_1.spawn)(options.bin, claudeConversationArgs(options), {
+            detached: process.platform !== "win32",
+            cwd: options.cwd,
+            env: options.env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        child.stdin?.on("error", () => undefined);
+        child.stdin?.end(options.prompt);
+        options.onProcessStarted?.(child.pid);
+        const timer = options.timeoutMs > 0 ? setTimeout(() => {
+            timedOut = true;
+            (0, kill_agent_cjs_1.killAgent)(child);
+        }, options.timeoutMs) : undefined;
+        const onAbort = () => {
+            aborted = true;
+            (0, kill_agent_cjs_1.killAgent)(child);
+        };
+        options.signal.addEventListener("abort", onAbort, { once: true });
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            parser.push(chunk);
+        });
+        child.stderr.setEncoding("utf8");
+        child.stderr.on("data", (chunk) => {
+            stderr = (stderr + chunk).slice(-STDERR_TAIL_BYTES);
+        });
+        const finish = (exitCode) => {
+            if (closed)
+                return;
+            parser.flush();
+            // An answer delivered only in the final result record (no stream deltas).
+            if (!parser.hasEmittedText && parser.result && !parser.result.isError && parser.result.text) {
+                deliver({ type: "text", text: parser.result.text });
+            }
+            closed = true;
+            clearTimeout(timer);
+            options.signal.removeEventListener("abort", onAbort);
+            resolve({
+                exitCode, timedOut, aborted,
+                succeeded: exitCode === 0 && !aborted && !timedOut && !!parser.result && !parser.result.isError,
+                firstEventMs, firstTextMs, stderr,
+            });
+        };
+        child.on("error", (err) => {
+            stderr = (stderr + `\n${String(err)}`).slice(-STDERR_TAIL_BYTES);
+            finish(null);
+        });
+        child.on("close", (code) => finish(code));
+        if (options.signal.aborted)
+            onAbort();
+    });
+}
+exports.claudeConversationRunner = { run: runClaudeConversationTurn };

package/dist/adapters/claude.cjs

@@ -5,6 +5,7 @@ exports.runClaudeCodeAdapter = runClaudeCodeAdapter;
 const node_child_process_1 = require("node:child_process");
 const exit_conditions_cjs_1 = require("../exit-conditions.cjs");
 const kill_agent_cjs_1 = require("../kill-agent.cjs");
+const claude_conversation_cjs_1 = require("./claude-conversation.cjs");
 const adapter_capacity_cjs_1 = require("../adapter-capacity.cjs");
 const DEFAULT_CLAUDE_MODEL = "claude-opus-5-5";
 const FALLBACK_CLAUDE_MODEL = "claude-opus-5-5";
@@ -281,4 +282,5 @@ function shellQuote(value) {
 exports.claudeCodeAdapter = {
     agentType: "claude-code",
     run: runClaudeCodeAdapter,
+    conversation: claude_conversation_cjs_1.claudeConversationRunner,
 };

package/dist/api.cjs

@@ -158,6 +158,20 @@ class NavarchApiClient {
             throw new Error("issueSecrets: empty response from control plane.");
         return result;
     }
+    /** Navi runtime v1: advertises conversation support for 90 s and returns queued turns for this machine. */
+    async pollConversations(machineId) {
+        const result = await this.request("POST", `/api/machines/${encodeURIComponent(machineId)}/conversations`, { protocol: 1 });
+        if (!result)
+            throw new Error("pollConversations: empty response from control plane.");
+        return result;
+    }
+    /** Navi runtime v1 claim / renew / append for one turn. */
+    async conversationCommand(machineId, conversationId, command) {
+        const result = await this.request("POST", `/api/machines/${encodeURIComponent(machineId)}/conversations/${encodeURIComponent(conversationId)}`, command);
+        if (!result)
+            throw new Error("conversationCommand: empty response from control plane.");
+        return result;
+    }
     /** Create a signed upload target for this lease's redacted transcript. */
     async getTranscriptUploadUrl(leaseId) {
         const result = await this.request("POST", `/api/dispatch/${encodeURIComponent(leaseId)}/transcript-upload-url`, {});

package/dist/claim-loop.cjs

@@ -6,6 +6,7 @@ const api_cjs_1 = require("./api.cjs");
 const logger_cjs_1 = require("./logger.cjs");
 const log = (0, logger_cjs_1.createLogger)("claim");
 const MAX_CLAIM_BACKOFF_MS = 60_000;
+const pendingClaimSlot = "pending-claim-request";
 /**
  * Polls dispatch/claim on an interval, gated by available capacity
  * (implementation-plan.md WP-07 "Claim loop: poll dispatch, receive context
@@ -69,13 +70,24 @@ class ClaimLoop {
             // the dispatcher records it on the lease and excludes it from review
             // tasks of PRs this session authors.
             const sessionId = (0, node_crypto_1.randomUUID)();
-            const claimed = await this.api.claim({
-                available_capacity: this.capacity.available(),
-                capabilities: this.config.capabilities,
-                agent_type: this.config.agentType,
-                runtimes: this.config.runtimes,
-                session_id: sessionId,
-            });
+            // Hold the slot for the duration of the claim request. Navi conversation
+            // turns also take slots; without this reservation one could take the last
+            // slot while the control plane is granting a lease, stranding that lease.
+            const availableCapacity = this.capacity.available();
+            this.capacity.acquire(pendingClaimSlot);
+            let claimed;
+            try {
+                claimed = await this.api.claim({
+                    available_capacity: availableCapacity,
+                    capabilities: this.config.capabilities,
+                    agent_type: this.config.agentType,
+                    runtimes: this.config.runtimes,
+                    session_id: sessionId,
+                });
+            }
+            finally {
+                this.capacity.release(pendingClaimSlot);
+            }
             if (this.consecutiveFailures > 0) {
                 log.info(`claim polling recovered after ${this.consecutiveFailures} failed attempt(s)`);
             }

package/dist/cli.cjs

@@ -12,6 +12,8 @@ const api_cjs_1 = require("./api.cjs");
 const capacity_cjs_1 = require("./capacity.cjs");
 const heartbeat_loop_cjs_1 = require("./heartbeat-loop.cjs");
 const claim_loop_cjs_1 = require("./claim-loop.cjs");
+const loop_cjs_1 = require("./conversation/loop.cjs");
+const capability_cjs_1 = require("./conversation/capability.cjs");
 const session_cjs_1 = require("./session.cjs");
 const sandbox_cjs_1 = require("./sandbox.cjs");
 const logger_cjs_1 = require("./logger.cjs");
@@ -267,6 +269,13 @@ async function startCommand(flags) {
         return (0, session_cjs_1.runSession)({ api, config, shutdownSignal: runtimeShutdown.signal }, claimed, sessionId)
             .finally(() => activeSessionIds.delete(sessionId));
     });
+    const conversationLoop = new loop_cjs_1.ConversationLoop({
+        api,
+        machineId: identity.machine_id,
+        config,
+        capacity,
+        shutdownSignal: runtimeShutdown.signal,
+    });
     const bootId = (0, node_crypto_1.randomUUID)();
     const updateCoordinatorRef = {};
     let readySent = false;
@@ -282,6 +291,7 @@ async function startCommand(flags) {
         }
     }, (status) => {
         claimLoop.stop();
+        conversationLoop.stop();
         worktreeJanitor.stop();
         log.error(status === 410
             ? `agent ${identity.name} has been removed from the fleet; it can no longer claim tasks.`
@@ -298,12 +308,14 @@ async function startCommand(flags) {
     updateCoordinatorRef.current = new update_coordinator_cjs_1.RuntimeUpdateCoordinator({
         config,
         claimLoop,
+        conversationLoop,
         capacity,
         heartbeat,
     });
     heartbeat.start();
     worktreeJanitor.start();
     claimLoop.start();
+    conversationLoop.start();
     log.info(`navarch-runtime started: machine=${identity.name} agent=${config.agentType} max_sessions=${config.maxSessions} api_base=${identity.api_base}`);
     let shuttingDown = false;
     const shutdown = () => {
@@ -316,6 +328,7 @@ async function startCommand(flags) {
             log.info("shutting down: draining active sessions...");
             heartbeat.setUpdateState("draining");
             await claimLoop.drain();
+            await conversationLoop.drain();
             await capacity.waitForIdle();
             worktreeJanitor.stop();
             heartbeat.stop();
@@ -391,6 +404,8 @@ async function doctorCommand(flags) {
     console.log(`sandbox_mode:    ${config.sandboxMode}`);
     console.log(`worktree_guard:  ${config.worktreeGuard ? "on" : "off"}`);
     console.log(`runtimes:        ${config.runtimes?.join(", ") ?? config.agentType}`);
+    const conversation = (0, capability_cjs_1.conversationCapability)(config);
+    console.log(`navi_chat:       ${conversation.state.toUpperCase()}${conversation.state === "unsupported" ? ` — ${conversation.reason}` : ` (${config.agentType}, read-only)`}`);
     console.log(`docker:          ${dockerOk ? "available" : "NOT AVAILABLE (docker-backed sessions will fail)"}`);
     const browserProbe = await (0, browser_probe_cjs_1.probeBrowserCapability)(config);
     console.log(`browser:         ${browserProbe.status.toUpperCase()}${browserProbe.reason ? ` — ${browserProbe.reason}` : ""}`);

package/dist/config.cjs

@@ -178,6 +178,11 @@ function loadRuntimeConfig(env = process.env) {
         // by default; operators who would rather share nothing can opt out.
         reportUsageLimits: !["off", "false", "0"].includes(env.NAVARCH_USAGE_LIMITS ?? ""),
         browserProbe: !["off", "false", "0"].includes(env.NAVARCH_BROWSER_PROBE ?? ""),
+        naviConversations: !["off", "false", "0"].includes(env.NAVARCH_NAVI_CONVERSATIONS ?? ""),
+        // The server stops waiting for a capability advertisement after 90 s and
+        // asks for a poll at least every 30 s; the floor only bounds control-plane load.
+        conversationPollIntervalMs: Math.min(30_000, Math.max(1_000, envInt(env, "NAVARCH_CONVERSATION_POLL_MS", 5_000))),
+        conversationTurnTimeoutMs: Math.min(9 * 60_000, envInt(env, "NAVARCH_CONVERSATION_TURN_TIMEOUT_MS", 9 * 60_000)),
         codexHome: defaultCodexHome(env),
         claudeConfigPath: defaultClaudeConfigPath(env),
     };

package/dist/conversation/capability.cjs

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.conversationCapability = conversationCapability;
+exports.conversationSupportMatrix = conversationSupportMatrix;
+const index_cjs_1 = require("../adapters/index.cjs");
+/**
+ * Whether this runtime can execute a Navi conversation turn, with the reason
+ * when it cannot. The runtime polls (and so advertises conversation support
+ * to the control plane) only when this returns `supported`.
+ *
+ * A conversation always runs on the machine's configured primary adapter
+ * (`agentType`). An unsupported primary adapter is reported, never replaced
+ * by another installed agent: the user selected this runtime for the agent it
+ * runs.
+ */
+function conversationCapability(config) {
+    if (!config.naviConversations) {
+        return { state: "unsupported", reason: "Disabled by NAVARCH_NAVI_CONVERSATIONS=off." };
+    }
+    const adapter = (0, index_cjs_1.selectAdapter)(config.agentType);
+    if (!adapter.conversation) {
+        return {
+            state: "unsupported",
+            reason: `The ${config.agentType} adapter has no streamed read-only conversation path.`,
+        };
+    }
+    if (config.sandboxMode !== "host") {
+        return {
+            state: "unsupported",
+            reason: "Conversations run on the host; NAVARCH_SANDBOX_MODE=docker is not supported yet.",
+        };
+    }
+    if (!config.worktreeGuard) {
+        return {
+            state: "unsupported",
+            reason: "Conversations need the worktree read boundary; NAVARCH_WORKTREE_GUARD is off.",
+        };
+    }
+    return { state: "supported" };
+}
+/** Per-adapter support table for docs and diagnostics (host sandbox, guard on, feature enabled). */
+function conversationSupportMatrix() {
+    const agents = ["claude-code", "codex", "gemini", "opencode", "acp", "qoder", "pi-local", "pi"];
+    return agents.map((agentType) => ({
+        agentType,
+        capability: conversationCapability({
+            agentType,
+            sandboxMode: "host",
+            worktreeGuard: true,
+            naviConversations: true,
+        }),
+    }));
+}

package/dist/conversation/journal.cjs

@@ -0,0 +1,153 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConversationJournal = void 0;
+exports.assertUuid = assertUuid;
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const UUID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+function assertUuid(value, label) {
+    if (!UUID.test(value))
+        throw new Error(`${label} is not a UUID.`);
+    return value.toLowerCase();
+}
+/** File-backed journal under `<workspaceRoot>/conversations/journal`. One file per turn. */
+class ConversationJournal {
+    now;
+    root;
+    constructor(workspaceRoot, now = Date.now) {
+        this.now = now;
+        this.root = node_path_1.default.join(workspaceRoot, "conversations", "journal");
+    }
+    file(conversationId, turnId) {
+        return node_path_1.default.join(this.root, assertUuid(conversationId, "conversation id"), `${assertUuid(turnId, "turn id")}.json`);
+    }
+    async read(conversationId, turnId) {
+        const file = this.file(conversationId, turnId);
+        let raw;
+        try {
+            raw = await node_fs_1.promises.readFile(file, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed?.v === 1 && parsed.turnId === turnId.toLowerCase() && typeof parsed.token === "string")
+                return parsed;
+        }
+        catch {
+            // fall through
+        }
+        // An unreadable record means we cannot prove the turn never ran. Treat it
+        // as executed: the server's lease expiry settles it.
+        return {
+            v: 1, conversationId: conversationId.toLowerCase(), turnId: turnId.toLowerCase(), token: "",
+            state: "done", outcome: "corrupt", acked: 0, createdAt: this.now(), updatedAt: this.now(),
+        };
+    }
+    /** Creates the record with `token` if absent. The caller must pass a fresh random UUID. */
+    async open(conversationId, turnId, token) {
+        const existing = await this.read(conversationId, turnId);
+        if (existing)
+            return { journal: existing, created: false };
+        const journal = {
+            v: 1,
+            conversationId: assertUuid(conversationId, "conversation id"),
+            turnId: assertUuid(turnId, "turn id"),
+            token: assertUuid(token, "claim token"),
+            state: "claiming",
+            acked: 0,
+            createdAt: this.now(),
+            updatedAt: this.now(),
+        };
+        await this.write(journal);
+        return { journal, created: true };
+    }
+    /** Atomic replace so a crash never leaves a half-written record. */
+    async write(journal) {
+        journal.updatedAt = this.now();
+        const file = this.file(journal.conversationId, journal.turnId);
+        await node_fs_1.promises.mkdir(node_path_1.default.dirname(file), { recursive: true, mode: 0o700 });
+        const temp = `${file}.${process.pid}.tmp`;
+        await node_fs_1.promises.writeFile(temp, `${JSON.stringify(journal)}\n`, { mode: 0o600 });
+        await node_fs_1.promises.rename(temp, file);
+    }
+    /** Marks the turn terminal and drops retained text. */
+    async finish(journal, outcome) {
+        journal.state = "done";
+        journal.outcome = outcome;
+        delete journal.pending;
+        await this.write(journal);
+    }
+    /** Records that were left in a non-terminal state, for crash recovery. */
+    async unfinished() {
+        const found = [];
+        let conversations;
+        try {
+            conversations = await node_fs_1.promises.readdir(this.root);
+        }
+        catch {
+            return found;
+        }
+        for (const conversationId of conversations) {
+            if (!UUID.test(conversationId))
+                continue;
+            let files;
+            try {
+                files = await node_fs_1.promises.readdir(node_path_1.default.join(this.root, conversationId));
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (!file.endsWith(".json"))
+                    continue;
+                const journal = await this.read(conversationId, file.slice(0, -".json".length)).catch(() => null);
+                if (journal && journal.state !== "done")
+                    found.push(journal);
+            }
+        }
+        return found;
+    }
+    /**
+     * Removes journals and conversation checkouts older than `maxAgeMs`. The
+     * server keeps idempotency records for 24 hours, so callers pass longer.
+     */
+    async prune(maxAgeMs, workspaceRoot) {
+        const cutoff = this.now() - maxAgeMs;
+        const conversationsRoot = node_path_1.default.join(workspaceRoot, "conversations");
+        let ids;
+        try {
+            ids = await node_fs_1.promises.readdir(this.root);
+        }
+        catch {
+            return;
+        }
+        for (const conversationId of ids) {
+            if (!UUID.test(conversationId))
+                continue;
+            const dir = node_path_1.default.join(this.root, conversationId);
+            let newest = 0;
+            let unfinished = false;
+            for (const file of await node_fs_1.promises.readdir(dir).catch(() => [])) {
+                const journal = await this.read(conversationId, file.replace(/\.json$/, "")).catch(() => null);
+                if (!journal)
+                    continue;
+                newest = Math.max(newest, journal.updatedAt);
+                if (journal.state !== "done")
+                    unfinished = true;
+            }
+            if (unfinished || newest > cutoff)
+                continue;
+            await node_fs_1.promises.rm(dir, { recursive: true, force: true }).catch(() => undefined);
+            await node_fs_1.promises.rm(node_path_1.default.join(conversationsRoot, conversationId.toLowerCase()), { recursive: true, force: true })
+                .catch(() => undefined);
+        }
+    }
+}
+exports.ConversationJournal = ConversationJournal;