@sanqianx/claude-ai-workbench 0.13.2 → 0.13.3

package/src/backend/lib/native-task-transcript.js

@@ -1,393 +1,393 @@
-'use strict';
-
-// Native task transcript collector - the read side of native task history.
-// When a bound subagent reaches a real terminal signal (a SubagentStop hook
-// trace, a terminal SDK task status, or the main reply ending while an agent
-// task is already terminal), the collector performs ONE public SDK read
-// (getSubagentMessages) for that agent, normalizes the snapshot through the
-// redaction boundary (native-task-messages + the trace module's credential
-// masking), and publishes it as claude/native-task-transcript facts through
-// the SAME durable publish gate as every other native fact. It has no
-// authority of its own: the agent identity comes exclusively from the
-// registry's trusted bindings, the read uses only the installed SDK's public
-// entry point with the query's real cwd and the process's inherited config
-// root, and dedup keys/cursors are consumed only after the gate proves the
-// fact durable. Every scheduled read freezes its notification-time Service
-// owner and query context: a later query or a whole Service transfer can
-// never redirect, republish or un-drop it. No polling, no private transcript
-// parsing, no worker, no process.env mutation, no parent abort on read
-// failure.
-
-const { normalizeTaskMessages } = require('./native-task-messages');
-const { createSecretRedactor } = require('./native-task-trace');
-const { NATIVE_TASK_HISTORY_READER_LIMITS } = require('./native-task-history-reader');
-
-const SDK_PAGE_LIMIT = 1000;
-const MAX_READ_PAGES = 20;
-const CHUNK_BYTES = 256 * 1024;
-const CHUNK_ENVELOPE_HEADROOM = 2048;
-const MAX_RETRIES = 2;
-const RETRY_DELAYS_MS = [250, 1000];
-const TERMINAL_STATUSES = new Set(['completed', 'failed', 'stopped']);
-// A built chunk must stay servable by the history reader: the reader refuses
-// (HTTP 413 ROW_TOO_LARGE) any single row above its page byte cap, so a fact
-// that big could never page back. The headroom covers the journal row
-// envelope (sequence stamping and framing) wrapped around the event.
-const READ_ROW_HEADROOM = 4096;
-const MAX_SERVABLE_EVENT_BYTES = Math.max(0, NATIVE_TASK_HISTORY_READER_LIMITS.maxPageBytes - READ_ROW_HEADROOM);
-
-// Fixed, content-free reason codes for the explicit read-state facts. The
-// marker events carry no SDK error text and no paths.
-const READ_REASONS = {
-  apiAbsent: 'NATIVE_TASK_TRANSCRIPT_API_ABSENT',
-  configRootMismatch: 'NATIVE_TASK_TRANSCRIPT_CONFIG_ROOT_MISMATCH',
-  cwdMismatch: 'NATIVE_TASK_TRANSCRIPT_CWD_MISMATCH',
-  readFailed: 'NATIVE_TASK_TRANSCRIPT_READ_FAILED',
-  redactFailed: 'NATIVE_TASK_TRANSCRIPT_REDACT_FAILED',
-  normalizeRefused: 'NATIVE_TASK_TRANSCRIPT_NORMALIZE_REFUSED',
-  entryOversize: 'NATIVE_TASK_TRANSCRIPT_ENTRY_OVERSIZE',
-};
-
-function byteLength(value) { return Buffer.byteLength(JSON.stringify(value)); }
-
-// Precise Service ownership identity: the runtime epoch and the committer
-// closure the read was initiated under. "Some binding currently exists" is
-// not an owner - only the exact same epoch AND the exact same committer
-// reference (or the very same identity object) counts. A null on either
-// side never matches a live binding on the other.
-function sameOwner(captured, current) {
-  if (captured === current) return true;
-  if (!captured || !current) return false;
-  return typeof captured.committer === 'function' && typeof current.committer === 'function'
-    && captured.epoch === current.epoch && captured.committer === current.committer;
-}
-
-function createNativeTaskTranscriptCollector({ isLive, getRuntime, isBound, emit, sdkImport, redactSource, queryContext, ownerIdentity } = {}) {
-  if (typeof isLive !== 'function' || typeof getRuntime !== 'function' || typeof isBound !== 'function'
-    || typeof emit !== 'function' || typeof sdkImport !== 'function' || typeof redactSource !== 'function'
-    || typeof queryContext !== 'function') {
-    throw new Error('createNativeTaskTranscriptCollector requires live/runtime/binding/emit/sdk/redaction/context accessors');
-  }
-  if (ownerIdentity !== undefined && typeof ownerIdentity !== 'function') {
-    throw new Error('createNativeTaskTranscriptCollector requires the owner identity accessor to be a function when provided');
-  }
-  // Per-task publish state. The dedup sets are consumed ONLY after the gate
-  // accepted a chunk: a refused fact never marks content as published.
-  const tasks = new Map();
-  function taskState(taskKey) {
-    let entry = tasks.get(taskKey);
-    if (!entry) {
-      entry = { publishedUuids: new Set(), publishedStepIds: new Set(), publishedModelIds: new Set(), markerReasons: new Set(), emptyPublished: false, inFlight: false, rerun: null, retries: 0 };
-      tasks.set(taskKey, entry);
-    }
-    return entry;
-  }
-
-  // Trusted lookup: only bindings the registry itself established.
-  function bindingFor(sdkSessionId, taskId) {
-    const runtime = getRuntime();
-    if (!runtime || typeof runtime.agentTranscriptBindings !== 'function') return null;
-    try {
-      const bindings = runtime.agentTranscriptBindings();
-      return bindings.find(binding => binding.sdkSessionId === sdkSessionId && binding.taskId === taskId) || null;
-    } catch {
-      return null;
-    }
-  }
-  function terminalBindings(sdkSessionId) {
-    const runtime = getRuntime();
-    if (!runtime || typeof runtime.agentTranscriptBindings !== 'function') return [];
-    try {
-      return runtime.agentTranscriptBindings().filter(binding => (!sdkSessionId || binding.sdkSessionId === sdkSessionId)
-        && TERMINAL_STATUSES.has(String(binding.status || '')));
-    } catch {
-      return [];
-    }
-  }
-
-  // Everything a scheduled read needs is frozen at NOTIFICATION time: the
-  // precise Service owner, the query context and the redaction source of the
-  // transport that produced the trigger. A later query (or a whole Service
-  // transfer) can never rewrite what an already-scheduled read uses; a
-  // collector that cannot even read one of these captures nothing instead of
-  // guessing.
-  function captureFrame(capture) {
-    const frame = { capture, owner: null, context: null, secrets: null, secretsFailed: false };
-    try { frame.owner = typeof ownerIdentity === 'function' ? ownerIdentity() : null; } catch { frame.owner = null; }
-    try { frame.context = queryContext(); } catch { frame.context = null; }
-    try { frame.secrets = redactSource(); } catch { frame.secrets = null; frame.secretsFailed = true; }
-    return frame;
-  }
-  function currentOwner() {
-    try { return typeof ownerIdentity === 'function' ? ownerIdentity() : null; } catch { return null; }
-  }
-  function ownerValid(frame) { return sameOwner(frame.owner, currentOwner()); }
-  // The redactor reads only the frame-frozen secrets; a source that failed
-  // at capture time keeps failing here so the normalizer fails closed.
-  function frameRedactor(frame) {
-    return createSecretRedactor(() => {
-      if (frame.secretsFailed) throw new Error('redaction source unavailable at capture');
-      return frame.secrets;
-    });
-  }
-
-  function schedule(sdkSessionId, taskId, capture) {
-    if (!isLive()) return;
-    const binding = bindingFor(sdkSessionId, taskId);
-    if (!binding) return;
-    const frame = captureFrame(capture);
-    const taskKey = JSON.stringify([sdkSessionId, taskId]);
-    const entry = taskState(taskKey);
-    if (entry.inFlight) { entry.rerun = frame; return; }
-    entry.inFlight = true;
-    void run(taskKey, binding, frame).catch(() => {
-      const current = tasks.get(taskKey);
-      if (current) { current.inFlight = false; current.rerun = null; }
-    });
-  }
-
-  async function run(taskKey, initialBinding, frame) {
-    const entry = tasks.get(taskKey);
-    try {
-      await attempt(taskKey, initialBinding, frame);
-    } finally {
-      const rerunFrame = entry.rerun;
-      entry.rerun = null;
-      if (rerunFrame && isLive()) {
-        // The queued rerun keeps the notification-time frame it was
-        // requested under: after an ownership transfer it is a stale request
-        // and stops before any read or publish, while a same-owner repeat
-        // re-reads normally.
-        const binding = bindingFor(initialBinding.sdkSessionId, initialBinding.taskId);
-        if (binding) {
-          void run(taskKey, binding, rerunFrame).catch(() => {
-            const current = tasks.get(taskKey);
-            if (current) { current.inFlight = false; current.rerun = null; }
-          });
-          return;
-        }
-      }
-      entry.inFlight = false;
-    }
-  }
-
-  // A full snapshot read: bounded explicit pages off the public API until a
-  // short page (complete) or the read budget (honestly incomplete). The
-  // query context is the frame-frozen one, never the current holder.
-  async function readSnapshot(binding, frame) {
-    const sdk = await sdkImport();
-    if (!sdk || typeof sdk.getSubagentMessages !== 'function') return { status: 'unavailable', reason: READ_REASONS.apiAbsent };
-    const context = frame.context;
-    if (!context || typeof context.cwd !== 'string' || context.cwd === '') return { status: 'unavailable', reason: READ_REASONS.cwdMismatch };
-    if ((process.env.CLAUDE_CONFIG_DIR || null) !== (context.configRoot || null)) {
-      return { status: 'unavailable', reason: READ_REASONS.configRootMismatch };
-    }
-    const live = bindingFor(binding.sdkSessionId, binding.taskId);
-    if (!live) return { status: 'stale' };
-    const messages = [];
-    let complete = false;
-    try {
-      for (let page = 0; page < MAX_READ_PAGES; page += 1) {
-        const slice = await sdk.getSubagentMessages(binding.sdkSessionId, binding.taskId, {
-          dir: context.cwd, limit: SDK_PAGE_LIMIT, offset: messages.length,
-        });
-        if (!Array.isArray(slice)) throw new Error('non-array page');
-        messages.push(...slice);
-        if (slice.length < SDK_PAGE_LIMIT) { complete = true; break; }
-      }
-    } catch {
-      return { status: 'retry' };
-    }
-    return { status: 'ok', messages, complete, cwd: context.cwd };
-  }
-
-  function markerEvent(binding, scope, capture, readStatus, reason) {
-    return {
-      type: 'claude/native-task-transcript',
-      source: 'sdk-public-read',
-      scope: { storeScope: scope.storeScope, contextId: scope.contextId, parentSessionId: scope.parentSessionId },
-      sdkSessionId: binding.sdkSessionId,
-      taskId: binding.taskId,
-      taskRef: binding.taskRef ? { ...binding.taskRef } : null,
-      ownerRunId: binding.ownerRunId || null,
-      capture,
-      read: { status: readStatus, reason, at: new Date().toISOString() },
-      entries: [],
-      toolSteps: [],
-      usage: { records: [], summary: null },
-      diagnostics: [],
-      chunk: { index: 0, count: 0, complete: false },
-    };
-  }
-
-  async function attempt(taskKey, binding, frame) {
-    const entry = tasks.get(taskKey);
-    // Every read, retry and rerun starts by re-proving the precise Service
-    // owner it was initiated under; a transferred or unbound owner stops
-    // here without publishing and without consuming anything.
-    if (!ownerValid(frame)) return;
-    let read;
-    try {
-      read = await readSnapshot(binding, frame);
-    } catch {
-      read = { status: 'retry' };
-    }
-    if (read.status === 'stale') return;
-    if (read.status === 'retry') {
-      if (entry.retries < MAX_RETRIES && isLive() && ownerValid(frame)) {
-        entry.retries += 1;
-        await new Promise(resolve => setTimeout(resolve, RETRY_DELAYS_MS[Math.min(entry.retries - 1, RETRY_DELAYS_MS.length - 1)]));
-        if (!isLive() || !ownerValid(frame)) { entry.retries = 0; return; }
-        return attempt(taskKey, binding, frame);
-      }
-      entry.retries = 0;
-      await publishMarker(taskKey, binding, frame, 'failed', READ_REASONS.readFailed);
-      return;
-    }
-    entry.retries = 0;
-    if (read.status === 'unavailable') {
-      await publishMarker(taskKey, binding, frame, 'unavailable', read.reason);
-      return;
-    }
-    let normalized;
-    try {
-      normalized = normalizeTaskMessages(read.messages, { redact: frameRedactor(frame) });
-    } catch (error) {
-      const reason = error && (error.code === 'NATIVE_TASK_MESSAGES_REDACT_REQUIRED' || error.code === 'NATIVE_TASK_MESSAGES_REDACT_FAILED')
-        ? READ_REASONS.redactFailed
-        : READ_REASONS.normalizeRefused;
-      await publishMarker(taskKey, binding, frame, 'failed', reason);
-      return;
-    }
-    await publishChunks(taskKey, binding, frame, normalized, read.complete);
-  }
-
-  async function publishMarker(taskKey, binding, frame, readStatus, reason) {
-    const entry = tasks.get(taskKey);
-    if (entry.markerReasons.has(reason)) return;
-    const runtime = getRuntime();
-    const scope = runtime && typeof runtime.scope === 'function' ? runtime.scope() : null;
-    if (!scope || !isLive() || !isBound() || !ownerValid(frame)) return;
-    const event = markerEvent(binding, scope, frame.capture, readStatus, reason);
-    if (emit(event) === true) entry.markerReasons.add(reason);
-  }
-
-  // Delta chunks: entries never published before, grouped under the byte
-  // budget, with the steps/usage records whose first contributing entry sits
-  // in the group. Cursor sets are consumed only after the gate accepted the
-  // chunk; a refusal stops the whole publish with nothing consumed.
-  async function publishChunks(taskKey, binding, frame, normalized, snapshotComplete) {
-    const entry = tasks.get(taskKey);
-    const runtime = getRuntime();
-    const scope = runtime && typeof runtime.scope === 'function' ? runtime.scope() : null;
-    if (!scope || !isLive() || !isBound() || !ownerValid(frame)) return;
-    const deltaEntries = normalized.entries.filter(item => !entry.publishedUuids.has(item.uuid));
-    if (deltaEntries.length === 0) {
-      // An empty first read is an honest fact: the SDK published no messages
-      // for this agent yet the binding is real and terminal. Published once
-      // and only before any content ever landed; later still-empty reads add
-      // nothing.
-      if (entry.publishedUuids.size > 0 || entry.emptyPublished) return;
-      const event = baseEvent(binding, scope, frame.capture, normalized, snapshotComplete);
-      event.chunk = { index: 0, count: 1, complete: snapshotComplete };
-      if (emit(event) === true) entry.emptyPublished = true;
-      return;
-    }
-    const groups = [];
-    let current = [];
-    let currentBytes = CHUNK_ENVELOPE_HEADROOM;
-    for (const item of deltaEntries) {
-      const size = byteLength(item);
-      if (current.length > 0 && currentBytes + size > CHUNK_BYTES) {
-        groups.push(current);
-        current = [];
-        currentBytes = CHUNK_ENVELOPE_HEADROOM;
-      }
-      current.push(item);
-      currentBytes += size;
-    }
-    if (current.length > 0) groups.push(current);
-    const groupUuids = groups.map(group => new Set(group.map(item => item.uuid)));
-    let chunkIndex = 0;
-    for (const group of groups) {
-      if (!isLive() || !isBound() || !ownerValid(frame)) return;
-      const uuids = groupUuids[chunkIndex];
-      const steps = normalized.toolSteps.filter(step => !entry.publishedStepIds.has(step.toolUseId)
-        && stepBelongsToGroup(step, uuids));
-      const records = normalized.usageRecords.filter(record => !entry.publishedModelIds.has(record.modelMessageId || 'noid:' + record.entryUuids[0])
-        && record.entryUuids.some(uuid => uuids.has(uuid)));
-      const event = baseEvent(binding, scope, frame.capture, normalized, snapshotComplete);
-      event.entries = group;
-      event.toolSteps = steps;
-      event.usage = { records, summary: chunkIndex === groups.length - 1 && snapshotComplete ? normalized.usageSummary : null };
-      event.diagnostics = chunkIndex === groups.length - 1 ? normalized.diagnostics : [];
-      event.chunk = { index: chunkIndex, count: groups.length, complete: chunkIndex === groups.length - 1 && snapshotComplete };
-      // A chunk the history reader could never serve - its page byte cap
-      // refuses a row this large, so the fact could never page back - must
-      // not land as a fake success: one explicit unavailable marker is the
-      // honest outcome, no cursor is consumed and publishing stops.
-      if (byteLength(event) > MAX_SERVABLE_EVENT_BYTES) {
-        await publishMarker(taskKey, binding, frame, 'unavailable', READ_REASONS.entryOversize);
-        return;
-      }
-      if (emit(event) !== true) return;
-      for (const item of group) entry.publishedUuids.add(item.uuid);
-      for (const step of steps) entry.publishedStepIds.add(step.toolUseId);
-      for (const record of records) entry.publishedModelIds.add(record.modelMessageId || 'noid:' + record.entryUuids[0]);
-      chunkIndex += 1;
-    }
-  }
-
-  function stepBelongsToGroup(step, uuids) {
-    if (step.useEntryUuids.some(uuid => uuids.has(uuid))) return true;
-    return step.resultEntryUuid !== null && uuids.has(step.resultEntryUuid);
-  }
-
-  function baseEvent(binding, scope, capture, normalized, snapshotComplete) {
-    return {
-      type: 'claude/native-task-transcript',
-      source: 'sdk-public-read',
-      scope: { storeScope: scope.storeScope, contextId: scope.contextId, parentSessionId: scope.parentSessionId },
-      sdkSessionId: binding.sdkSessionId,
-      taskId: binding.taskId,
-      taskRef: binding.taskRef ? { ...binding.taskRef } : null,
-      ownerRunId: binding.ownerRunId || null,
-      capture,
-      read: { status: 'ok', at: new Date().toISOString() },
-      entries: [],
-      toolSteps: [],
-      usage: { records: [], summary: null },
-      diagnostics: [],
-      stats: snapshotComplete ? normalized.stats : null,
-      chunk: { index: 0, count: 0, complete: false },
-    };
-  }
-
-  return {
-    // Real-event triggers. All of them resolve the target through the
-    // registry's trusted bindings; an unknown or unbound identity schedules
-    // nothing.
-    notifyTrace(trace) {
-      if (!trace || typeof trace !== 'object' || trace.type !== 'claude/native-trace') return;
-      if (trace.source !== 'sdk-hook' || trace.hookEvent !== 'SubagentStop') return;
-      const sdkSessionId = typeof trace.sdkSessionId === 'string' ? trace.sdkSessionId : null;
-      const agentId = typeof trace.nativeAgentId === 'string' ? trace.nativeAgentId : null;
-      if (sdkSessionId && agentId) schedule(sdkSessionId, agentId, 'subagent-stop');
-    },
-    notifySdkMessage(message) {
-      // Only a real SDK task event (the stream that just moved a registry
-      // task to a terminal status) is a trigger; prose and other system
-      // traffic schedule nothing.
-      if (!message || typeof message !== 'object' || message.type !== 'system') return;
-      if (typeof message.subtype !== 'string' || !message.subtype.startsWith('task_')) return;
-      const sdkSessionId = typeof message.session_id === 'string' && message.session_id !== '' ? message.session_id : null;
-      if (!sdkSessionId) return;
-      for (const binding of terminalBindings(sdkSessionId)) schedule(binding.sdkSessionId, binding.taskId, 'sdk-terminal');
-    },
-    sweep(capture) {
-      for (const binding of terminalBindings(null)) schedule(binding.sdkSessionId, binding.taskId, capture || 'turn-end-sweep');
-    },
-  };
-}
-
-module.exports = { createNativeTaskTranscriptCollector };
+'use strict';
+
+// Native task transcript collector - the read side of native task history.
+// When a bound subagent reaches a real terminal signal (a SubagentStop hook
+// trace, a terminal SDK task status, or the main reply ending while an agent
+// task is already terminal), the collector performs ONE public SDK read
+// (getSubagentMessages) for that agent, normalizes the snapshot through the
+// redaction boundary (native-task-messages + the trace module's credential
+// masking), and publishes it as claude/native-task-transcript facts through
+// the SAME durable publish gate as every other native fact. It has no
+// authority of its own: the agent identity comes exclusively from the
+// registry's trusted bindings, the read uses only the installed SDK's public
+// entry point with the query's real cwd and the process's inherited config
+// root, and dedup keys/cursors are consumed only after the gate proves the
+// fact durable. Every scheduled read freezes its notification-time Service
+// owner and query context: a later query or a whole Service transfer can
+// never redirect, republish or un-drop it. No polling, no private transcript
+// parsing, no worker, no process.env mutation, no parent abort on read
+// failure.
+
+const { normalizeTaskMessages } = require('./native-task-messages');
+const { createSecretRedactor } = require('./native-task-trace');
+const { NATIVE_TASK_HISTORY_READER_LIMITS } = require('./native-task-history-reader');
+
+const SDK_PAGE_LIMIT = 1000;
+const MAX_READ_PAGES = 20;
+const CHUNK_BYTES = 256 * 1024;
+const CHUNK_ENVELOPE_HEADROOM = 2048;
+const MAX_RETRIES = 2;
+const RETRY_DELAYS_MS = [250, 1000];
+const TERMINAL_STATUSES = new Set(['completed', 'failed', 'stopped']);
+// A built chunk must stay servable by the history reader: the reader refuses
+// (HTTP 413 ROW_TOO_LARGE) any single row above its page byte cap, so a fact
+// that big could never page back. The headroom covers the journal row
+// envelope (sequence stamping and framing) wrapped around the event.
+const READ_ROW_HEADROOM = 4096;
+const MAX_SERVABLE_EVENT_BYTES = Math.max(0, NATIVE_TASK_HISTORY_READER_LIMITS.maxPageBytes - READ_ROW_HEADROOM);
+
+// Fixed, content-free reason codes for the explicit read-state facts. The
+// marker events carry no SDK error text and no paths.
+const READ_REASONS = {
+  apiAbsent: 'NATIVE_TASK_TRANSCRIPT_API_ABSENT',
+  configRootMismatch: 'NATIVE_TASK_TRANSCRIPT_CONFIG_ROOT_MISMATCH',
+  cwdMismatch: 'NATIVE_TASK_TRANSCRIPT_CWD_MISMATCH',
+  readFailed: 'NATIVE_TASK_TRANSCRIPT_READ_FAILED',
+  redactFailed: 'NATIVE_TASK_TRANSCRIPT_REDACT_FAILED',
+  normalizeRefused: 'NATIVE_TASK_TRANSCRIPT_NORMALIZE_REFUSED',
+  entryOversize: 'NATIVE_TASK_TRANSCRIPT_ENTRY_OVERSIZE',
+};
+
+function byteLength(value) { return Buffer.byteLength(JSON.stringify(value)); }
+
+// Precise Service ownership identity: the runtime epoch and the committer
+// closure the read was initiated under. "Some binding currently exists" is
+// not an owner - only the exact same epoch AND the exact same committer
+// reference (or the very same identity object) counts. A null on either
+// side never matches a live binding on the other.
+function sameOwner(captured, current) {
+  if (captured === current) return true;
+  if (!captured || !current) return false;
+  return typeof captured.committer === 'function' && typeof current.committer === 'function'
+    && captured.epoch === current.epoch && captured.committer === current.committer;
+}
+
+function createNativeTaskTranscriptCollector({ isLive, getRuntime, isBound, emit, sdkImport, redactSource, queryContext, ownerIdentity } = {}) {
+  if (typeof isLive !== 'function' || typeof getRuntime !== 'function' || typeof isBound !== 'function'
+    || typeof emit !== 'function' || typeof sdkImport !== 'function' || typeof redactSource !== 'function'
+    || typeof queryContext !== 'function') {
+    throw new Error('createNativeTaskTranscriptCollector requires live/runtime/binding/emit/sdk/redaction/context accessors');
+  }
+  if (ownerIdentity !== undefined && typeof ownerIdentity !== 'function') {
+    throw new Error('createNativeTaskTranscriptCollector requires the owner identity accessor to be a function when provided');
+  }
+  // Per-task publish state. The dedup sets are consumed ONLY after the gate
+  // accepted a chunk: a refused fact never marks content as published.
+  const tasks = new Map();
+  function taskState(taskKey) {
+    let entry = tasks.get(taskKey);
+    if (!entry) {
+      entry = { publishedUuids: new Set(), publishedStepIds: new Set(), publishedModelIds: new Set(), markerReasons: new Set(), emptyPublished: false, inFlight: false, rerun: null, retries: 0 };
+      tasks.set(taskKey, entry);
+    }
+    return entry;
+  }
+
+  // Trusted lookup: only bindings the registry itself established.
+  function bindingFor(sdkSessionId, taskId) {
+    const runtime = getRuntime();
+    if (!runtime || typeof runtime.agentTranscriptBindings !== 'function') return null;
+    try {
+      const bindings = runtime.agentTranscriptBindings();
+      return bindings.find(binding => binding.sdkSessionId === sdkSessionId && binding.taskId === taskId) || null;
+    } catch {
+      return null;
+    }
+  }
+  function terminalBindings(sdkSessionId) {
+    const runtime = getRuntime();
+    if (!runtime || typeof runtime.agentTranscriptBindings !== 'function') return [];
+    try {
+      return runtime.agentTranscriptBindings().filter(binding => (!sdkSessionId || binding.sdkSessionId === sdkSessionId)
+        && TERMINAL_STATUSES.has(String(binding.status || '')));
+    } catch {
+      return [];
+    }
+  }
+
+  // Everything a scheduled read needs is frozen at NOTIFICATION time: the
+  // precise Service owner, the query context and the redaction source of the
+  // transport that produced the trigger. A later query (or a whole Service
+  // transfer) can never rewrite what an already-scheduled read uses; a
+  // collector that cannot even read one of these captures nothing instead of
+  // guessing.
+  function captureFrame(capture) {
+    const frame = { capture, owner: null, context: null, secrets: null, secretsFailed: false };
+    try { frame.owner = typeof ownerIdentity === 'function' ? ownerIdentity() : null; } catch { frame.owner = null; }
+    try { frame.context = queryContext(); } catch { frame.context = null; }
+    try { frame.secrets = redactSource(); } catch { frame.secrets = null; frame.secretsFailed = true; }
+    return frame;
+  }
+  function currentOwner() {
+    try { return typeof ownerIdentity === 'function' ? ownerIdentity() : null; } catch { return null; }
+  }
+  function ownerValid(frame) { return sameOwner(frame.owner, currentOwner()); }
+  // The redactor reads only the frame-frozen secrets; a source that failed
+  // at capture time keeps failing here so the normalizer fails closed.
+  function frameRedactor(frame) {
+    return createSecretRedactor(() => {
+      if (frame.secretsFailed) throw new Error('redaction source unavailable at capture');
+      return frame.secrets;
+    });
+  }
+
+  function schedule(sdkSessionId, taskId, capture) {
+    if (!isLive()) return;
+    const binding = bindingFor(sdkSessionId, taskId);
+    if (!binding) return;
+    const frame = captureFrame(capture);
+    const taskKey = JSON.stringify([sdkSessionId, taskId]);
+    const entry = taskState(taskKey);
+    if (entry.inFlight) { entry.rerun = frame; return; }
+    entry.inFlight = true;
+    void run(taskKey, binding, frame).catch(() => {
+      const current = tasks.get(taskKey);
+      if (current) { current.inFlight = false; current.rerun = null; }
+    });
+  }
+
+  async function run(taskKey, initialBinding, frame) {
+    const entry = tasks.get(taskKey);
+    try {
+      await attempt(taskKey, initialBinding, frame);
+    } finally {
+      const rerunFrame = entry.rerun;
+      entry.rerun = null;
+      if (rerunFrame && isLive()) {
+        // The queued rerun keeps the notification-time frame it was
+        // requested under: after an ownership transfer it is a stale request
+        // and stops before any read or publish, while a same-owner repeat
+        // re-reads normally.
+        const binding = bindingFor(initialBinding.sdkSessionId, initialBinding.taskId);
+        if (binding) {
+          void run(taskKey, binding, rerunFrame).catch(() => {
+            const current = tasks.get(taskKey);
+            if (current) { current.inFlight = false; current.rerun = null; }
+          });
+          return;
+        }
+      }
+      entry.inFlight = false;
+    }
+  }
+
+  // A full snapshot read: bounded explicit pages off the public API until a
+  // short page (complete) or the read budget (honestly incomplete). The
+  // query context is the frame-frozen one, never the current holder.
+  async function readSnapshot(binding, frame) {
+    const sdk = await sdkImport();
+    if (!sdk || typeof sdk.getSubagentMessages !== 'function') return { status: 'unavailable', reason: READ_REASONS.apiAbsent };
+    const context = frame.context;
+    if (!context || typeof context.cwd !== 'string' || context.cwd === '') return { status: 'unavailable', reason: READ_REASONS.cwdMismatch };
+    if ((process.env.CLAUDE_CONFIG_DIR || null) !== (context.configRoot || null)) {
+      return { status: 'unavailable', reason: READ_REASONS.configRootMismatch };
+    }
+    const live = bindingFor(binding.sdkSessionId, binding.taskId);
+    if (!live) return { status: 'stale' };
+    const messages = [];
+    let complete = false;
+    try {
+      for (let page = 0; page < MAX_READ_PAGES; page += 1) {
+        const slice = await sdk.getSubagentMessages(binding.sdkSessionId, binding.taskId, {
+          dir: context.cwd, limit: SDK_PAGE_LIMIT, offset: messages.length,
+        });
+        if (!Array.isArray(slice)) throw new Error('non-array page');
+        messages.push(...slice);
+        if (slice.length < SDK_PAGE_LIMIT) { complete = true; break; }
+      }
+    } catch {
+      return { status: 'retry' };
+    }
+    return { status: 'ok', messages, complete, cwd: context.cwd };
+  }
+
+  function markerEvent(binding, scope, capture, readStatus, reason) {
+    return {
+      type: 'claude/native-task-transcript',
+      source: 'sdk-public-read',
+      scope: { storeScope: scope.storeScope, contextId: scope.contextId, parentSessionId: scope.parentSessionId },
+      sdkSessionId: binding.sdkSessionId,
+      taskId: binding.taskId,
+      taskRef: binding.taskRef ? { ...binding.taskRef } : null,
+      ownerRunId: binding.ownerRunId || null,
+      capture,
+      read: { status: readStatus, reason, at: new Date().toISOString() },
+      entries: [],
+      toolSteps: [],
+      usage: { records: [], summary: null },
+      diagnostics: [],
+      chunk: { index: 0, count: 0, complete: false },
+    };
+  }
+
+  async function attempt(taskKey, binding, frame) {
+    const entry = tasks.get(taskKey);
+    // Every read, retry and rerun starts by re-proving the precise Service
+    // owner it was initiated under; a transferred or unbound owner stops
+    // here without publishing and without consuming anything.
+    if (!ownerValid(frame)) return;
+    let read;
+    try {
+      read = await readSnapshot(binding, frame);
+    } catch {
+      read = { status: 'retry' };
+    }
+    if (read.status === 'stale') return;
+    if (read.status === 'retry') {
+      if (entry.retries < MAX_RETRIES && isLive() && ownerValid(frame)) {
+        entry.retries += 1;
+        await new Promise(resolve => setTimeout(resolve, RETRY_DELAYS_MS[Math.min(entry.retries - 1, RETRY_DELAYS_MS.length - 1)]));
+        if (!isLive() || !ownerValid(frame)) { entry.retries = 0; return; }
+        return attempt(taskKey, binding, frame);
+      }
+      entry.retries = 0;
+      await publishMarker(taskKey, binding, frame, 'failed', READ_REASONS.readFailed);
+      return;
+    }
+    entry.retries = 0;
+    if (read.status === 'unavailable') {
+      await publishMarker(taskKey, binding, frame, 'unavailable', read.reason);
+      return;
+    }
+    let normalized;
+    try {
+      normalized = normalizeTaskMessages(read.messages, { redact: frameRedactor(frame) });
+    } catch (error) {
+      const reason = error && (error.code === 'NATIVE_TASK_MESSAGES_REDACT_REQUIRED' || error.code === 'NATIVE_TASK_MESSAGES_REDACT_FAILED')
+        ? READ_REASONS.redactFailed
+        : READ_REASONS.normalizeRefused;
+      await publishMarker(taskKey, binding, frame, 'failed', reason);
+      return;
+    }
+    await publishChunks(taskKey, binding, frame, normalized, read.complete);
+  }
+
+  async function publishMarker(taskKey, binding, frame, readStatus, reason) {
+    const entry = tasks.get(taskKey);
+    if (entry.markerReasons.has(reason)) return;
+    const runtime = getRuntime();
+    const scope = runtime && typeof runtime.scope === 'function' ? runtime.scope() : null;
+    if (!scope || !isLive() || !isBound() || !ownerValid(frame)) return;
+    const event = markerEvent(binding, scope, frame.capture, readStatus, reason);
+    if (emit(event) === true) entry.markerReasons.add(reason);
+  }
+
+  // Delta chunks: entries never published before, grouped under the byte
+  // budget, with the steps/usage records whose first contributing entry sits
+  // in the group. Cursor sets are consumed only after the gate accepted the
+  // chunk; a refusal stops the whole publish with nothing consumed.
+  async function publishChunks(taskKey, binding, frame, normalized, snapshotComplete) {
+    const entry = tasks.get(taskKey);
+    const runtime = getRuntime();
+    const scope = runtime && typeof runtime.scope === 'function' ? runtime.scope() : null;
+    if (!scope || !isLive() || !isBound() || !ownerValid(frame)) return;
+    const deltaEntries = normalized.entries.filter(item => !entry.publishedUuids.has(item.uuid));
+    if (deltaEntries.length === 0) {
+      // An empty first read is an honest fact: the SDK published no messages
+      // for this agent yet the binding is real and terminal. Published once
+      // and only before any content ever landed; later still-empty reads add
+      // nothing.
+      if (entry.publishedUuids.size > 0 || entry.emptyPublished) return;
+      const event = baseEvent(binding, scope, frame.capture, normalized, snapshotComplete);
+      event.chunk = { index: 0, count: 1, complete: snapshotComplete };
+      if (emit(event) === true) entry.emptyPublished = true;
+      return;
+    }
+    const groups = [];
+    let current = [];
+    let currentBytes = CHUNK_ENVELOPE_HEADROOM;
+    for (const item of deltaEntries) {
+      const size = byteLength(item);
+      if (current.length > 0 && currentBytes + size > CHUNK_BYTES) {
+        groups.push(current);
+        current = [];
+        currentBytes = CHUNK_ENVELOPE_HEADROOM;
+      }
+      current.push(item);
+      currentBytes += size;
+    }
+    if (current.length > 0) groups.push(current);
+    const groupUuids = groups.map(group => new Set(group.map(item => item.uuid)));
+    let chunkIndex = 0;
+    for (const group of groups) {
+      if (!isLive() || !isBound() || !ownerValid(frame)) return;
+      const uuids = groupUuids[chunkIndex];
+      const steps = normalized.toolSteps.filter(step => !entry.publishedStepIds.has(step.toolUseId)
+        && stepBelongsToGroup(step, uuids));
+      const records = normalized.usageRecords.filter(record => !entry.publishedModelIds.has(record.modelMessageId || 'noid:' + record.entryUuids[0])
+        && record.entryUuids.some(uuid => uuids.has(uuid)));
+      const event = baseEvent(binding, scope, frame.capture, normalized, snapshotComplete);
+      event.entries = group;
+      event.toolSteps = steps;
+      event.usage = { records, summary: chunkIndex === groups.length - 1 && snapshotComplete ? normalized.usageSummary : null };
+      event.diagnostics = chunkIndex === groups.length - 1 ? normalized.diagnostics : [];
+      event.chunk = { index: chunkIndex, count: groups.length, complete: chunkIndex === groups.length - 1 && snapshotComplete };
+      // A chunk the history reader could never serve - its page byte cap
+      // refuses a row this large, so the fact could never page back - must
+      // not land as a fake success: one explicit unavailable marker is the
+      // honest outcome, no cursor is consumed and publishing stops.
+      if (byteLength(event) > MAX_SERVABLE_EVENT_BYTES) {
+        await publishMarker(taskKey, binding, frame, 'unavailable', READ_REASONS.entryOversize);
+        return;
+      }
+      if (emit(event) !== true) return;
+      for (const item of group) entry.publishedUuids.add(item.uuid);
+      for (const step of steps) entry.publishedStepIds.add(step.toolUseId);
+      for (const record of records) entry.publishedModelIds.add(record.modelMessageId || 'noid:' + record.entryUuids[0]);
+      chunkIndex += 1;
+    }
+  }
+
+  function stepBelongsToGroup(step, uuids) {
+    if (step.useEntryUuids.some(uuid => uuids.has(uuid))) return true;
+    return step.resultEntryUuid !== null && uuids.has(step.resultEntryUuid);
+  }
+
+  function baseEvent(binding, scope, capture, normalized, snapshotComplete) {
+    return {
+      type: 'claude/native-task-transcript',
+      source: 'sdk-public-read',
+      scope: { storeScope: scope.storeScope, contextId: scope.contextId, parentSessionId: scope.parentSessionId },
+      sdkSessionId: binding.sdkSessionId,
+      taskId: binding.taskId,
+      taskRef: binding.taskRef ? { ...binding.taskRef } : null,
+      ownerRunId: binding.ownerRunId || null,
+      capture,
+      read: { status: 'ok', at: new Date().toISOString() },
+      entries: [],
+      toolSteps: [],
+      usage: { records: [], summary: null },
+      diagnostics: [],
+      stats: snapshotComplete ? normalized.stats : null,
+      chunk: { index: 0, count: 0, complete: false },
+    };
+  }
+
+  return {
+    // Real-event triggers. All of them resolve the target through the
+    // registry's trusted bindings; an unknown or unbound identity schedules
+    // nothing.
+    notifyTrace(trace) {
+      if (!trace || typeof trace !== 'object' || trace.type !== 'claude/native-trace') return;
+      if (trace.source !== 'sdk-hook' || trace.hookEvent !== 'SubagentStop') return;
+      const sdkSessionId = typeof trace.sdkSessionId === 'string' ? trace.sdkSessionId : null;
+      const agentId = typeof trace.nativeAgentId === 'string' ? trace.nativeAgentId : null;
+      if (sdkSessionId && agentId) schedule(sdkSessionId, agentId, 'subagent-stop');
+    },
+    notifySdkMessage(message) {
+      // Only a real SDK task event (the stream that just moved a registry
+      // task to a terminal status) is a trigger; prose and other system
+      // traffic schedule nothing.
+      if (!message || typeof message !== 'object' || message.type !== 'system') return;
+      if (typeof message.subtype !== 'string' || !message.subtype.startsWith('task_')) return;
+      const sdkSessionId = typeof message.session_id === 'string' && message.session_id !== '' ? message.session_id : null;
+      if (!sdkSessionId) return;
+      for (const binding of terminalBindings(sdkSessionId)) schedule(binding.sdkSessionId, binding.taskId, 'sdk-terminal');
+    },
+    sweep(capture) {
+      for (const binding of terminalBindings(null)) schedule(binding.sdkSessionId, binding.taskId, capture || 'turn-end-sweep');
+    },
+  };
+}
+
+module.exports = { createNativeTaskTranscriptCollector };