@xopcai/xopc 0.0.276 → 0.0.278

package/dist/src/projects/project-skill-service.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveBundledSkillsDir } from "../config/paths.js";
-import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "../agent/skills/workspace-skills-dir.js";
-import { loadSkills, loadWorkspaceSkillInventory } from "../agent/skills/index.js";
 import { removeSkillsLockEntry } from "../agent/skills/hub-lock.js";
 import { deleteManagedSkill, installSkillFromZip, isValidSkillId } from "../agent/skills/managed-store.js";
+import { resolveWorkspaceSkillsDir, resolveWorkspaceSkillsLockPath } from "../agent/skills/workspace-skills-dir.js";
+import { loadSkills, loadWorkspaceSkillInventory } from "../agent/skills/index.js";
 import { pullSkillFromSource } from "../agent/skills/hub-pull.js";
 import { downloadFromMarketplace } from "../agent/skills/skills-marketplace.js";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";

package/dist/src/providers/auth-runtime/resolve-auth.js

@@ -1,5 +1,5 @@
-import { init_sync_provider_auth, resolveProviderApiKeyForAgentSync } from "../../auth/sync-provider-auth.js";
 import { getApiKeyFromEnv, init_env_keys } from "../env-keys.js";
+import { init_sync_provider_auth, resolveProviderApiKeyForAgentSync } from "../../auth/sync-provider-auth.js";
 import { getDefaultAuthProfileStore } from "./auth-profile-store.js";
 //#region src/providers/auth-runtime/resolve-auth.ts
 init_env_keys();

package/dist/src/providers/index.js

@@ -1,11 +1,11 @@
 import { __esmMin, __exportAll } from "../../_virtual/_rolldown/runtime.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
-import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
-import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { init_model_ref, splitProviderModelRef } from "./model-ref.js";
 import { ModelRegistry, getModelRegistry, init_model_registry, prewarmModelRegistry, resetModelRegistry } from "./model-registry.js";
+import { getModelOAuthProviderIds, init_registry } from "../auth/oauth/registry.js";
 import { CredentialResolver, hasCredentials, init_credentials } from "../auth/credentials.js";
+import { hasProviderAuthOnDiskSync, init_sync_provider_auth } from "../auth/sync-provider-auth.js";
 import { EXTENSION_PROVIDER_BASE_URL, init_constants } from "./constants.js";
 import { applyOfficialModelMetadataCorrections, getSupplementalModels, init_model_supplements } from "./model-supplements.js";
 import { getProviderRegistry, init_plugin_registry } from "./plugin-registry.js";

package/dist/src/providers/model-reference-auditor.js

@@ -1,7 +1,7 @@
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { getModelRegistry, init_model_registry } from "./model-registry.js";
-import { parseImageGenerationModelRef } from "../agent/image/generation/model-ref.js";
 import { getImageGenerationProvider } from "../agent/image/generation/provider-registry.js";
+import { parseImageGenerationModelRef } from "../agent/image/generation/model-ref.js";
 //#region src/providers/model-reference-auditor.ts
 init_model_catalog_store();
 init_model_registry();

package/dist/src/providers/model-registry.js

@@ -1,8 +1,8 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { resolveModelsJsonPath } from "../config/paths.js";
 import { init_resolve_config_value, resolveConfigValue, resolveHeaders } from "../config/resolve-config-value.js";
+import { resolveModelsJsonPath } from "../config/paths.js";
 import { getDefaultModelValues, init_models_json, validateModelsConfig } from "../config/models-json.js";
 import { getApiKeyFromEnv, init_env_keys } from "./env-keys.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";

package/dist/src/providers/register-runtime-providers.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
+import { getOAuthProviderDefinition, init_registry } from "../auth/oauth/registry.js";
 import { XOPC_CLOUD_PROVIDER_ID, init_xopc_cloud_config, resolveXopcModelRouterUrl } from "./xopc-cloud-config.js";
 //#region src/providers/register-runtime-providers.ts
 function registerRuntimeProvider(modelRuntime, source) {

package/dist/src/remote-access/exposure-manager.js

@@ -2,9 +2,9 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { isTailscaleInstalled } from "../infra/tailscale.js";
 import { resolveGatewayBindMode } from "../config/gateway-bind.js";
-import { getTunnelService } from "../tunnel/tunnel-service.js";
 import { collectExposureConflicts } from "./exposure-guards.js";
 import { getTailscaleExposureState, maybeStartTailscaleFromConfig, stopTailscaleExposure } from "../gateway/tailscale-lifecycle.js";
+import { getTunnelService } from "../tunnel/tunnel-service.js";
 import { getTunnelConsentState } from "../tunnel/consent.js";
 import { maybeAutoStartTunnelFromConfig } from "../tunnel/gateway-lifecycle.js";
 //#region src/remote-access/exposure-manager.ts

package/dist/src/session/index.js

@@ -1,12 +1,12 @@
 import { buildSessionContextForLlm, isTranscriptContextEntry, mergeLlmMessagesPreservingContextRows, transcriptRowsFromJsonArray } from "./session-context-for-llm.js";
 import { SessionStatus } from "./types.js";
 import { effectiveWorkspacePathForSession, normalizeWorkingDirectoryInput, projectWorkspacePath } from "./session-workspace.js";
-import { flattenMessageContent, messagesToClientHistory } from "./client-history.js";
-import { emitSessionTranscriptUpdate, onSessionTranscriptUpdate } from "./transcript-events.js";
 import { fallbackTitleFromMessages, generateSessionTitleFromMessages, getSessionTitleSource, isWebchatSessionKey, maybeRefineSessionTitleWithLlm, maybeSetProvisionalSessionTitle, provisionalTitleFromUserText, sanitizeGeneratedSessionTitle, sanitizeSessionTitle, shouldAutoTitleSessionKey, shouldRefineSessionTitleWithLlm } from "./session-title.js";
+import { flattenMessageContent, messagesToClientHistory } from "./client-history.js";
 import { SessionStore } from "./store.js";
 import { applySessionPatchToMetadata } from "./patch-metadata.js";
 import { SessionIndex } from "./manager.js";
+import { emitSessionTranscriptUpdate, onSessionTranscriptUpdate } from "./transcript-events.js";
 import { SessionConfigStore, resolveReasoningLevel, resolveThinkingLevel, resolveVerboseLevel } from "./config-store.js";
 import { DEFAULT_ACTIVITY_DETAIL_LEVEL, resolveConfiguredActivityDetailDefault, resolveEffectiveReasoningLevel, resolveEffectiveThinkingLevel } from "./thinking-resolve.js";
 import { DEFAULT_IDLE_MINUTES, DEFAULT_RESET_AT_HOUR, DEFAULT_RESET_MODE, evaluateSessionFreshness, resolveDailyResetAtMs, resolveSessionResetPolicy } from "./reset-policy.js";

package/dist/src/session/session-title.js

@@ -4,8 +4,8 @@ import { isCronSessionKey } from "../routing/session-key-utils.js";
 import { init_session_key, parseSessionKey } from "../routing/session-key.js";
 import { init_providers, resolveModel } from "../providers/index.js";
 import { completeWithResolvedCredentials } from "../providers/model-call.js";
-import { readAgentMessageContent } from "../agent/memory/agent-message-access.js";
 import { stripRuntimeContextFromUserMessage } from "./user-message-display.js";
+import { readAgentMessageContent } from "../agent/memory/agent-message-access.js";
 //#region src/session/session-title.ts
 init_session_key();
 init_providers();

package/dist/src/session/store.js

@@ -12,14 +12,14 @@ import { appendCompactionBoundaryIfUnchanged, appendTranscriptEntry, listCompact
 import { getSessionConfig, setSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
-import { transcriptRowsToClientHistory } from "./client-history.js";
-import { SessionCompactor } from "../agent/memory/compaction.js";
-import { resolveUserContextSessionAccess } from "../user-context/access-policy.js";
 import { readPostCompactionContext } from "../agent/reply/post-compaction-context.js";
+import { SessionCompactor } from "../agent/memory/compaction.js";
 import { resolveCompactionPolicy } from "../agent/memory/compaction-policy.js";
 import { promoteCompactionLedger } from "../agent/memory/compaction-promotion.js";
+import { resolveUserContextSessionAccess } from "../user-context/access-policy.js";
 import { SlidingWindow } from "../agent/memory/window.js";
 import { isAppendOnlyLlmTranscriptMessage } from "./transcript-stats.js";
+import { transcriptRowsToClientHistory } from "./client-history.js";
 import { backfillStructuredTurnOutcomes } from "./turn-outcome-projector.js";
 import { computeTranscriptUserRoundDeleteRange } from "./user-round-delete.js";
 //#region src/session/store.ts

package/dist/src/session/thinking-resolve.js

@@ -1,5 +1,5 @@
-import { resolveReasoningLevel, resolveThinkingLevel } from "./config-store.js";
 import { normalizeThinkLevel } from "../agent/transcript/thinking-types.js";
+import { resolveReasoningLevel, resolveThinkingLevel } from "./config-store.js";
 //#region src/session/thinking-resolve.ts
 const FALLBACK = "medium";
 /**

package/dist/src/share/share-store.js

@@ -5,8 +5,8 @@ import { requireXopcDatabase } from "../storage/sqlite/connection.js";
 import { runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
 import { init_paths } from "../config/paths.js";
 import { DurableState } from "../storage/sqlite/durable-state.js";
-import { SHARE_CONFIG_DEFAULTS } from "./share-types.js";
 import { isPathUnderWorkspace } from "../gateway/workspace-editor-path.js";
+import { SHARE_CONFIG_DEFAULTS } from "./share-types.js";
 import { logShareAudit } from "./share-audit.js";
 import { join, relative, resolve } from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -588,7 +588,11 @@ var ShareStore = class {
 		return runSqliteWriteTransaction(() => {
 			const record = this.shares.get(id);
 			if (!record) return null;
-			if (patch.extendTtlMs !== void 0) record.expiresAt = new Date(Date.now() + patch.extendTtlMs).toISOString();
+			if (patch.extendTtlMs !== void 0) {
+				if (record.revoked) throw new Error("Revoked shares cannot be renewed");
+				if (!Number.isFinite(patch.extendTtlMs) || patch.extendTtlMs < 6e4 || patch.extendTtlMs > this.config.maxTtlMs) throw new Error("Share duration is outside the configured limits");
+				record.expiresAt = new Date(Date.now() + patch.extendTtlMs).toISOString();
+			}
 			if (patch.maxViews !== void 0) record.maxViews = patch.maxViews;
 			this.shares.set(record.id, record);
 			logShareAudit("share.update", {

package/dist/src/share/share-thumbnail.js

@@ -2,9 +2,9 @@ import { resolveStateDir } from "../config/paths-state.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths } from "../config/paths.js";
+import { loadPlaywrightCoreModule } from "../browser/providers/playwright-doctor.js";
 import { getShareStore } from "./share-store.js";
 import { getSiteShareStore } from "./site-share-store.js";
-import { loadPlaywrightCoreModule } from "../browser/providers/playwright-doctor.js";
 import { join } from "node:path";
 import { mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
 //#region src/share/share-thumbnail.ts

package/dist/src/share/site-share-store.js

@@ -3,8 +3,8 @@ import { init_logger } from "../utils/logger.js";
 import { requireXopcDatabase } from "../storage/sqlite/connection.js";
 import { runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
 import { DurableState } from "../storage/sqlite/durable-state.js";
-import { SITE_SHARE_CONFIG_DEFAULTS } from "./site-share-types.js";
 import { isPathUnderWorkspace } from "../gateway/workspace-editor-path.js";
+import { SITE_SHARE_CONFIG_DEFAULTS } from "./site-share-types.js";
 import { relative, resolve } from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { lstat, readdir, realpath, stat } from "node:fs/promises";

package/dist/src/storage/sqlite/connection.js

@@ -5,7 +5,7 @@ import { ensureXopcDatabaseSchema } from "./schema.js";
 import { requireNodeSqlite } from "../../infra/node-sqlite.js";
 import { installSqliteTransientRejectionHandler } from "../../infra/unhandled-rejections.js";
 import path from "node:path";
-import fs from "node:fs";
+import fsSync from "node:fs";
 import childProcess from "node:child_process";
 //#region src/storage/sqlite/connection.ts
 init_logger();
@@ -28,7 +28,7 @@ function normalizeNonNegativeInteger(value, label) {
 function findExistingVolumePath(targetPath) {
 	let current = path.resolve(targetPath);
 	while (true) try {
-		return fs.statSync(current).isDirectory() ? current : path.dirname(current);
+		return fsSync.statSync(current).isDirectory() ? current : path.dirname(current);
 	} catch {
 		const parent = path.dirname(current);
 		if (parent === current) return null;
@@ -75,7 +75,7 @@ function parseMountCommandEntries(contents) {
 }
 function readMountEntries() {
 	try {
-		return parseProcMountInfoEntries(fs.readFileSync(PROC_MOUNTINFO_PATH, "utf8"));
+		return parseProcMountInfoEntries(fsSync.readFileSync(PROC_MOUNTINFO_PATH, "utf8"));
 	} catch {}
 	try {
 		return parseMountCommandEntries(String(childProcess.execFileSync("mount", [])));
@@ -102,7 +102,7 @@ function isNetworkMountEntryPath(targetPath) {
 	return mountEntry ? isNetworkMountType(mountEntry.fsType) : false;
 }
 function isNetworkBackedPath(targetPath) {
-	if (typeof fs.statfsSync !== "function") return isNetworkMountEntryPath(targetPath);
+	if (typeof fsSync.statfsSync !== "function") return isNetworkMountEntryPath(targetPath);
 	const checkedPath = findExistingVolumePath(targetPath);
 	if (!checkedPath) return false;
 	try {
@@ -111,7 +111,7 @@ function isNetworkBackedPath(targetPath) {
 			4283649346,
 			4266872130,
 			20859
-		].includes(fs.statfsSync(checkedPath).type >>> 0)) return true;
+		].includes(fsSync.statfsSync(checkedPath).type >>> 0)) return true;
 	} catch {
 		return isNetworkMountEntryPath(checkedPath);
 	}
@@ -156,13 +156,13 @@ let cachedDatabase = null;
 function ensureDatabasePermissions(pathname) {
 	const dir = pathname.slice(0, Math.max(pathname.lastIndexOf("/"), pathname.lastIndexOf("\\")));
 	if (dir) {
-		fs.mkdirSync(dir, { recursive: true });
-		fs.chmodSync(dir, DB_DIR_MODE);
+		fsSync.mkdirSync(dir, { recursive: true });
+		fsSync.chmodSync(dir, DB_DIR_MODE);
 	}
 	for (const suffix of DB_SIDECAR_SUFFIXES) {
 		const candidate = `${pathname}${suffix}`;
-		if (!fs.existsSync(candidate)) continue;
-		fs.chmodSync(candidate, DB_FILE_MODE);
+		if (!fsSync.existsSync(candidate)) continue;
+		fsSync.chmodSync(candidate, DB_FILE_MODE);
 	}
 }
 function openDatabaseAtPath(pathname) {

package/dist/src/tasks/execution-context.js

@@ -1,7 +1,7 @@
 import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
 import "../storage/sqlite/index.js";
-import { TaskConversationRepository } from "./task-conversation-repository.js";
 import { getExecutionEnvironmentForSession } from "../execution-environments/subject.js";
+import { TaskConversationRepository } from "./task-conversation-repository.js";
 //#region src/tasks/execution-context.ts
 const ORIGINS = new Set([
 	"chat",

package/dist/src/tasks/home-query-service.js

@@ -2,12 +2,12 @@ import { isHomeAttentionAcknowledged } from "../storage/sqlite/home-attention-re
 import { getRelationshipSettings } from "../storage/sqlite/relationship-settings-repository.js";
 import { listConnectorApprovals } from "../storage/sqlite/connector-repository.js";
 import "../storage/sqlite/index.js";
-import { TaskRepository } from "./task-repository.js";
-import { TaskReadModelProjector } from "./task-read-model-projector.js";
 import "../automations/domain/defaults.js";
 import "../automations/index.js";
-import { AttentionGovernor } from "./attention-governor.js";
 import { listGatewayAgents } from "../gateway/agents-admin.js";
+import { TaskRepository } from "./task-repository.js";
+import { TaskReadModelProjector } from "./task-read-model-projector.js";
+import { AttentionGovernor } from "./attention-governor.js";
 //#region src/tasks/home-query-service.ts
 function toHomeWorkflowRun(run) {
 	return {
@@ -63,6 +63,7 @@ function attentionDetail(kind, status, locale, timeoutSeconds) {
 }
 function decisionFromTask(model, projectName, locale) {
 	const task = model.task;
+	if (task.phase === "closed" || model.operationalState === "waiting" && model.attention.length === 0) return null;
 	const isChinese = locale?.toLowerCase().startsWith("zh") ?? task.locale === "zh";
 	if (task.phase === "review") return {
 		id: `task:${task.id}:review`,

package/dist/src/tasks/index.js

@@ -1,19 +1,19 @@
 import { enqueueTaskAttentionRequiredEvent, enqueueTaskChanged, enqueueTaskChangedEvent } from "./task-change-events.js";
 import { TaskRunRepository } from "./task-run-repository.js";
+import { TaskContextRepository } from "./task-context-repository.js";
 import { TaskRepository } from "./task-repository.js";
-import { TaskConversationConflictError, TaskConversationRepository } from "./task-conversation-repository.js";
 import { TaskReadModelProjector } from "./task-read-model-projector.js";
-import { TaskContextRepository } from "./task-context-repository.js";
 import { TaskDependencyError, TaskDependencyService } from "./task-dependency-service.js";
 import { TaskApplicationService } from "./task-application-service.js";
 import { ProjectMonitoringService, decideProactiveDisposition, isInQuietHours, nextQuietHoursEnd, proactiveDispositionReason } from "./project-monitoring-service.js";
+import { TaskConversationConflictError, TaskConversationRepository } from "./task-conversation-repository.js";
+import { assembleTaskContext, buildTaskExecutionDirective, getTaskContextManifest, getTaskExecutionBrief } from "./task-context-assembler.js";
 import { resolveExecutionContext } from "./execution-context.js";
 import { AttentionGovernor } from "./attention-governor.js";
 import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "./home-query-service.js";
 import { TaskWorkflowCoordinator } from "./task-workflow-coordinator.js";
 import { defineTaskContract } from "./task-contract-definition.js";
 import { ModelTaskContractPlanner, parseTaskContractResponse } from "./task-contract-planner.js";
-import { assembleTaskContext, buildTaskExecutionDirective, getTaskContextManifest, getTaskExecutionBrief } from "./task-context-assembler.js";
 import { TaskRunCoordinator } from "./task-run-coordinator.js";
 import { ProjectOperatingViewService, summarizeProjectOperatingView } from "./project-operating-view-service.js";
 import { TaskValueMetricsService } from "./task-value-metrics-service.js";

package/dist/src/tasks/project-operating-view-service.js

@@ -17,8 +17,9 @@ function summarizeProjectOperatingView(view) {
 			counts.needsUser += 1;
 			continue;
 		}
-		if (task.phase === "closed") counts.done += 1;
-		else if ([
+		if (task.phase === "closed") {
+			if (task.resolution === "done") counts.done += 1;
+		} else if ([
 			"queued",
 			"running",
 			"verifying"
@@ -48,7 +49,8 @@ var ProjectOperatingViewService = class {
 		const cards = projectTasks.map((task) => {
 			const model = this.#projector.project(task);
 			const latest = this.#runs.getLatestRoot(task.id);
-			const receipt = latest ? this.#runs.getReceipt(latest.id) : void 0;
+			const receipt = latest?.contractVersion === task.latestContractVersion ? this.#runs.getReceipt(latest.id) : void 0;
+			const nextCheckAt = this.#runs.listActiveWaits(task.id).filter((wait) => wait.kind !== "paused" && wait.resumeAt !== void 0).map((wait) => wait.resumeAt).sort((a, b) => a - b)[0];
 			return {
 				id: task.id,
 				title: task.title,
@@ -62,6 +64,7 @@ var ProjectOperatingViewService = class {
 				blockedBy: this.#dependencies.listBlocking(task.id),
 				allowedCommands: model.allowedCommands,
 				...receipt ? { latestVerification: receipt.verification.status } : {},
+				...nextCheckAt !== void 0 && model.allowedCommands.includes("add_wait") ? { nextCheckAt } : {},
 				updatedAt: task.updatedAt
 			};
 		});
@@ -95,7 +98,7 @@ var ProjectOperatingViewService = class {
 			digest: {
 				health: cards.length === 0 ? "empty" : attentionCount > 0 ? "attention" : "healthy",
 				summary: cards.length === 0 ? "No tasks yet" : `${cards.filter(moving).length} moving, ${attentionCount} need attention`,
-				recommendedAction: cards.find(needsUser)?.attention[0]?.summary ?? cards.find((card) => card.attention.length > 0)?.attention[0]?.summary ?? cards.find(moving)?.title ?? cards.find((card) => card.phase === "ready")?.title ?? cards.find((card) => card.phase === "backlog")?.title
+				recommendedAction: cards.find(needsUser)?.attention[0]?.summary ?? cards.find((card) => card.attention.length > 0)?.attention[0]?.summary ?? cards.find(moving)?.title ?? cards.find((card) => card.phase === "ready" && card.allowedCommands.includes("start"))?.title ?? cards.find((card) => card.phase === "backlog" && card.operationalState === "idle")?.title
 			},
 			monitoring: this.#monitoring.get(project.id)
 		};

package/dist/src/tasks/task-application-service.js

@@ -1,9 +1,10 @@
 import { getSqliteDatabase, runSqliteWriteTransaction } from "../storage/sqlite/transaction.js";
+import { TaskExecutorSelectionSchema, verifiedTaskCriteria } from "../../packages/gateway-contract/src/tasks.js";
 import { enqueueTaskAttentionRequiredEvent, enqueueTaskChangedEvent } from "./task-change-events.js";
 import { TaskRunRepository } from "./task-run-repository.js";
+import { TaskContextRepository } from "./task-context-repository.js";
 import { TaskRepository } from "./task-repository.js";
 import { TaskReadModelProjector } from "./task-read-model-projector.js";
-import { TaskContextRepository } from "./task-context-repository.js";
 import { TaskDependencyService } from "./task-dependency-service.js";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/tasks/task-application-service.ts
@@ -208,7 +209,7 @@ var TaskApplicationService = class {
 					});
 					break;
 				case "request_review":
-					result = task.phase === "active" ? this.lifecycle(task.id, task.version, "review") : {
+					result = task.phase === "active" && !this.#runs.getActiveRoot(task.id) && this.#runs.listActiveWaits(task.id).length === 0 ? this.lifecycle(task.id, task.version, "review") : {
 						ok: false,
 						reason: "invalid_transition",
 						model
@@ -225,6 +226,14 @@ var TaskApplicationService = class {
 					};
 					break;
 				case "add_wait": {
+					if (task.phase === "closed") {
+						result = {
+							ok: false,
+							reason: "invalid_transition",
+							model
+						};
+						break;
+					}
 					const activeRun = this.#runs.getActiveRoot(task.id);
 					this.#runs.createWait({
 						taskId: task.id,
@@ -252,18 +261,92 @@ var TaskApplicationService = class {
 						reason: "not_found",
 						model
 					};
-					else if (wait.condition.type === "connection") result = {
+					else if (wait.status !== "active" || task.phase === "closed" || wait.condition.type === "connection") result = {
 						ok: false,
 						reason: "invalid_transition",
 						model
 					};
 					else {
+						const response = input.command.resolution;
+						if (response?.kind === "task_approval") {
+							if (actor.kind !== "user" || wait.kind !== "approval" || typeof wait.condition.capability !== "string" || response.decision !== "approve" && response.decision !== "deny") {
+								result = {
+									ok: false,
+									reason: "invalid_transition",
+									model
+								};
+								break;
+							}
+							if (response.decision === "deny") {
+								if (!this.#runs.listActiveWaits(task.id).some((item) => item.kind === "paused")) this.#runs.createWait({
+									taskId: task.id,
+									kind: "paused",
+									reason: "Approval declined by user",
+									condition: { approvalWaitId: wait.id }
+								});
+								const active = this.#runs.getActiveRoot(task.id);
+								if (active && [
+									"queued",
+									"running",
+									"verifying"
+								].includes(active.status)) this.#runs.setStatus({
+									runId: active.id,
+									expectedVersion: active.version,
+									from: [active.status],
+									to: "waiting",
+									actor
+								});
+								result = {
+									ok: true,
+									model: this.#projector.get(task.id)
+								};
+								break;
+							}
+							this.#context.grant({
+								taskId: task.id,
+								capability: wait.condition.capability,
+								scope: {
+									waitId: wait.id,
+									contractVersion: task.latestContractVersion
+								},
+								grantedBy: actor
+							});
+						}
+						if (response?.kind === "user_answer") {
+							if (actor.kind !== "user" || wait.kind !== "user_input" || typeof response.answer !== "string" || !response.answer.trim() || response.answer.length > 12e3) {
+								result = {
+									ok: false,
+									reason: "invalid_transition",
+									model
+								};
+								break;
+							}
+							this.#context.add({
+								taskId: task.id,
+								targetKind: "source",
+								targetId: wait.id,
+								role: "input",
+								title: wait.reason,
+								pinned: true,
+								metadata: { userAnswer: response.answer.trim() },
+								createdBy: actor
+							});
+						}
 						this.#runs.resolveWait({
 							waitId: wait.id,
 							actor,
 							resolution: input.command.resolution
 						});
-						result = {
+						const executor = TaskExecutorSelectionSchema.safeParse(wait.condition.executor);
+						result = response?.kind === "task_approval" && executor.success && !this.#runs.getActiveRoot(task.id) && this.#runs.listActiveWaits(task.id).length === 0 ? this.start(task.id, task.version, executor.data, {
+							idempotencyKey: input.idempotencyKey,
+							actor,
+							correlationId: input.idempotencyKey
+						}) : {
+							ok: true,
+							model: this.#projector.get(task.id)
+						};
+						if (result.ok === false && result.reason === "blocked") result = {
 							ok: true,
 							model: this.#projector.get(task.id)
 						};
@@ -364,6 +447,20 @@ var TaskApplicationService = class {
 				model: this.#projector.get(run.taskId)
 			};
 			const task = this.#tasks.require(run.taskId);
+			if (run.parentRunId || task.phase === "closed" || this.#runs.listActiveWaits(task.id).length > 0 || run.contractVersion !== task.latestContractVersion) {
+				enqueueTaskChangedEvent(db, {
+					taskId: task.id,
+					projectId: task.projectId,
+					version: task.version,
+					changedFields: ["runs", "receipts"],
+					actor: input.actor,
+					source: input.actor ? void 0 : "runtime"
+				});
+				return {
+					ok: true,
+					model: this.#projector.project(task)
+				};
+			}
 			if (input.receipt.status !== "succeeded") {
 				const model = this.#projector.project(task);
 				enqueueTaskAttentionRequiredEvent(db, {
@@ -391,7 +488,9 @@ var TaskApplicationService = class {
 					model
 				};
 			}
-			const verified = input.receipt.verification.status === "passed";
+			const verifiedCriteria = verifiedTaskCriteria(input.receipt);
+			const criteria = task.contract?.acceptanceCriteria ?? [];
+			const verified = criteria.length > 0 && criteria.every((criterion) => verifiedCriteria.has(criterion)) && input.receipt.verification.status === "passed" && input.receipt.completionVerdict === "achieved" && input.receipt.remainingWork.length === 0 && !input.receipt.needsUser;
 			const phase = task.contract?.acceptancePolicy === "verified_auto" && verified ? "closed" : "review";
 			const updated = this.#tasks.setLifecycle({
 				taskId: task.id,
@@ -446,6 +545,11 @@ var TaskApplicationService = class {
 			reason: "invalid_transition",
 			model: this.#projector.project(task)
 		};
+		if (this.#runs.listActiveWaits(taskId).length > 0) return {
+			ok: false,
+			reason: "blocked",
+			model: this.#projector.project(task)
+		};
 		const blocking = this.#dependencies.listBlocking(taskId);
 		if (blocking.length > 0) {
 			const existingWaits = this.#runs.listActiveWaits(taskId);

package/dist/src/tasks/task-context-assembler.js

@@ -1,9 +1,10 @@
 import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
+import { verifiedTaskCriteria } from "../../packages/gateway-contract/src/tasks.js";
 import { TaskRunRepository } from "./task-run-repository.js";
 import "../storage/sqlite/index.js";
+import { TaskContextRepository } from "./task-context-repository.js";
 import { TaskRepository } from "./task-repository.js";
 import { TaskConversationRepository } from "./task-conversation-repository.js";
-import { TaskContextRepository } from "./task-context-repository.js";
 //#region src/tasks/task-context-assembler.ts
 const STANDARD = {
 	profile: "standard",
@@ -17,11 +18,13 @@ function taskIdForSession(sessionKey) {
 function getTaskExecutionBrief(taskId) {
 	if (!isXopcDatabaseOpen()) return void 0;
 	const task = new TaskRepository().get(taskId);
-	if (!task?.contract) return void 0;
+	if (!task?.contract || task.phase === "closed") return void 0;
 	const runs = new TaskRunRepository();
+	if (runs.listActiveWaits(taskId).some((wait) => wait.kind === "paused")) return void 0;
 	const latestRun = runs.getLatestRoot(taskId);
-	const latestReceipt = latestRun ? runs.getReceipt(latestRun.id) : void 0;
-	const remainingCriteria = latestReceipt?.verification.checks.length ? latestReceipt.verification.checks.filter((check) => check.status !== "passed").map((check) => check.criterion) : task.contract.acceptanceCriteria;
+	const latestReceipt = latestRun?.contractVersion === task.latestContractVersion ? runs.getReceipt(latestRun.id) : void 0;
+	const passedCriteria = verifiedTaskCriteria(latestReceipt);
+	const remainingCriteria = task.contract.acceptanceCriteria.filter((criterion) => !passedCriteria.has(criterion));
 	const critical = task.priority === "critical" || task.contract.risks.length > 0 || task.contract.approvalRequired.length > 0;
 	const allocation = critical ? {
 		profile: "critical",
@@ -121,6 +124,7 @@ function buildTaskExecutionDirective(sessionKey) {
 		`Remaining acceptance criteria: ${remainingCriteria.join("; ")}`,
 		contract.constraints.length ? `Constraints: ${contract.constraints.join("; ")}` : "",
 		contract.approvalRequired.length ? `Authority required: ${contract.approvalRequired.join("; ")}` : "",
+		...new TaskContextRepository().list(task.id).filter((edge) => typeof edge.metadata.userAnswer === "string").slice(-20).map((edge) => `User response to ${edge.title ?? "question"}: ${JSON.stringify(edge.metadata.userAnswer)}`),
 		handoffPayload ? `Handoff snapshot: ${handoffPayload}` : "",
 		"Take safe in-scope steps and produce inspectable evidence. Do not claim completion without verification.",
 		"</xopc_task_execution>"

package/dist/src/tasks/task-handoff-service.js

@@ -3,9 +3,9 @@ import { init_logger } from "../utils/logger.js";
 import { TaskRunRepository } from "./task-run-repository.js";
 import { init_agent_scope, listAgentEntries, normalizeAgentId } from "../agent/agent-scope.js";
 import { buildSessionKey, init_session_key, sanitizeSegment } from "../routing/session-key.js";
+import { TaskContextRepository } from "./task-context-repository.js";
 import { TaskRepository } from "./task-repository.js";
 import { TaskConversationRepository } from "./task-conversation-repository.js";
-import { TaskContextRepository } from "./task-context-repository.js";
 //#region src/tasks/task-handoff-service.ts
 init_agent_scope();
 init_session_key();

package/dist/src/tasks/task-read-model-projector.js

@@ -13,6 +13,7 @@ var TaskReadModelProjector = class {
 		const activeRun = this.#runs.getActiveRoot(task.id);
 		const latestRun = activeRun ?? this.#runs.getLatestRoot(task.id);
 		const waits = this.#runs.listActiveWaits(task.id);
+		const paused = waits.some((wait) => wait.kind === "paused");
 		const hasIncompleteDependency = Boolean(getSqliteDatabase().prepare(`SELECT 1 FROM task_dependencies edge
        JOIN tasks dependency ON dependency.task_id = edge.depends_on_task_id
        WHERE edge.task_id = ?
@@ -48,8 +49,8 @@ var TaskReadModelProjector = class {
 				waits,
 				hasIncompleteDependency
 			}),
-			attention,
-			allowedCommands: this.allowedCommands(task, activeRun?.status, waits.length > 0)
+			attention: task.phase === "closed" || paused ? [] : attention,
+			allowedCommands: this.allowedCommands(task, activeRun?.status, waits.length > 0, paused)
 		};
 	}
 	summary(taskId) {
@@ -65,6 +66,7 @@ var TaskReadModelProjector = class {
 	}
 	operationalState(input) {
 		if (input.task.phase === "closed") return "idle";
+		if (input.waits.some((wait) => wait.kind === "paused")) return "waiting";
 		if (input.activeRun?.status === "running") return "running";
 		if (input.activeRun?.status === "verifying") return "verifying";
 		if (input.activeRun?.status === "queued") return "queued";
@@ -74,15 +76,15 @@ var TaskReadModelProjector = class {
 		if (input.hasIncompleteDependency) return "blocked";
 		return "idle";
 	}
-	allowedCommands(task, activeRunStatus, hasWaits) {
+	allowedCommands(task, activeRunStatus, hasWaits, paused) {
 		if (task.phase === "closed") return ["reopen"];
 		const commands = ["revise_contract", "close"];
+		if (!paused) commands.push("add_wait");
 		if (!activeRunStatus && !hasWaits) commands.unshift("move");
 		if (hasWaits) commands.unshift("resolve_wait");
-		else if (activeRunStatus === "running" || activeRunStatus === "verifying") commands.unshift("add_wait");
 		if (task.phase === "backlog") commands.unshift("mark_ready");
 		if (!activeRunStatus && !hasWaits && task.phase !== "backlog") commands.unshift("start");
-		if (task.phase === "active" && !activeRunStatus) commands.push("request_review");
+		if (task.phase === "active" && !activeRunStatus && !hasWaits) commands.push("request_review");
 		return commands;
 	}
 };

package/dist/src/tasks/task-run-coordinator.js

@@ -1,6 +1,6 @@
 import { TaskRunRepository } from "./task-run-repository.js";
-import { TaskRepository } from "./task-repository.js";
 import { TaskContextRepository } from "./task-context-repository.js";
+import { TaskRepository } from "./task-repository.js";
 import { TaskApplicationService } from "./task-application-service.js";
 //#region src/tasks/task-run-coordinator.ts
 var TaskRunCoordinator = class TaskRunCoordinator {
@@ -16,7 +16,9 @@ var TaskRunCoordinator = class TaskRunCoordinator {
 		const task = tasks.get(input.context.taskId);
 		if (!task || task.phase === "closed") return void 0;
 		const runs = new TaskRunRepository();
+		if (runs.listActiveWaits(task.id).length > 0) return void 0;
 		let run = runs.get(input.runId);
+		if (run && (run.taskId !== task.id || run.parentRunId || run.sessionKey && run.sessionKey !== input.context.sessionKey)) return void 0;
 		if (!run) {
 			if (runs.getActiveRoot(task.id)) return void 0;
 			const agentId = task.delegateAgentId ?? input.context.agentId;