@zq-silk/yui 2.1.0 → 2.2.0

package/dist/nativeAgent/toolManager/executor.js

@@ -0,0 +1,290 @@
+// Match the existing model/tool wire budgets; all sizes are UTF-8 JSON bytes.
+const messageBytes = 512 * 1024;
+const argumentBytes = 64 * 1024;
+const callsPerBatch = 8;
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value)
+    && Object.getPrototypeOf(value) === Object.prototype;
+const nonempty = (value) => typeof value === 'string' && value.trim().length > 0;
+const identifier = (value) => nonempty(value) && Buffer.byteLength(value, 'utf8') <= 1024;
+const bytes = (value) => Buffer.byteLength(JSON.stringify(value), 'utf8');
+function json(value, depth = 0) {
+    if (depth > 32)
+        return false;
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return true;
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return Array.from(value).every(v => json(v, depth + 1));
+    return object(value) && Object.values(value).every(v => json(v, depth + 1));
+}
+function freeze(value) {
+    if (value && typeof value === 'object') {
+        for (const child of Object.values(value))
+            freeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+function snapshot(value, limit) {
+    const copy = structuredClone(value);
+    if (!json(copy) || bytes(copy) > limit)
+        throw new Error('Invalid or oversized JSON');
+    return freeze(copy);
+}
+function failure(code, message, effect = 'none') {
+    return { ok: false, error: { code, message, effect } };
+}
+function outcome(raw, identity, beforeStart = false) {
+    try {
+        const value = snapshot(raw, messageBytes);
+        if (!object(value))
+            throw new Error();
+        let normalized;
+        if (!beforeStart && value.ok === true && typeof value.content === 'string') {
+            normalized = { ok: true, content: value.content };
+        }
+        else if (value.ok === false && object(value.error) && nonempty(value.error.code)
+            && typeof value.error.message === 'string'
+            && (value.error.effect === 'none' || (!beforeStart && value.error.effect === 'unknown'))) {
+            normalized = { ok: false, error: {
+                    code: value.error.code, message: value.error.message, effect: value.error.effect,
+                } };
+        }
+        else
+            throw new Error();
+        // Guarantee the consumer can append the paired message without truncation.
+        if (bytes({ role: 'tool', toolCallId: identity.toolCallId, name: identity.name, outcome: normalized }) > messageBytes) {
+            throw new Error();
+        }
+        return normalized;
+    }
+    catch {
+        return failure('tool_protocol', 'Invalid or oversized tool result', beforeStart ? 'none' : 'unknown');
+    }
+}
+function status(started, value) {
+    if (!started)
+        return 'not_executed';
+    if (value.ok)
+        return 'succeeded';
+    if (value.error.effect === 'unknown')
+        return 'unknown';
+    return value.error.code === 'cancelled' ? 'cancelled' : 'failed';
+}
+export function buildExecutor(options) {
+    if (!options?.environment || typeof options.environment.acquire !== 'function') {
+        throw new Error('Tool environment.acquire capability is required');
+    }
+    if (!options.permission || typeof options.permission.check !== 'function') {
+        throw new Error('Tool permission.check capability is required');
+    }
+    if (!Array.isArray(options.tools))
+        throw new Error('Tool collection is required');
+    const acquire = options.environment.acquire.bind(options.environment);
+    const check = options.permission.check.bind(options.permission);
+    const registry = new Map();
+    for (const tool of options.tools) {
+        let definition;
+        try {
+            definition = snapshot(tool.definition, messageBytes);
+            if (!identifier(definition.name) || typeof definition.description !== 'string'
+                || !object(definition.inputSchema) || typeof tool.validate !== 'function'
+                || typeof tool.execute !== 'function')
+                throw new Error();
+        }
+        catch {
+            throw new Error('Invalid tool declaration or implementation');
+        }
+        if (registry.has(definition.name))
+            throw new Error('Tool names must be unique');
+        registry.set(definition.name, {
+            definition, validate: tool.validate.bind(tool), execute: tool.execute.bind(tool),
+        });
+    }
+    const definitions = snapshot([...registry.values()].map(t => t.definition), messageBytes);
+    return Object.freeze({
+        definitions,
+        async executeBatch(request) {
+            // Admit the whole immutable batch before acquiring any resource.
+            let scope, calls;
+            try {
+                scope = snapshot(request.scope, 4096);
+                calls = snapshot(request.calls, messageBytes);
+                if (!identifier(scope.sessionId) || !identifier(scope.turnId) || !Number.isSafeInteger(scope.step)
+                    || scope.step < 1 || !Array.isArray(calls) || !calls.length || calls.length > callsPerBatch
+                    || calls.some(c => !object(c) || !identifier(c.id) || !identifier(c.name)
+                        || !json(c.arguments) || bytes(c.arguments) > argumentBytes)
+                    || new Set(calls.map(c => c.id)).size !== calls.length)
+                    throw new Error();
+            }
+            catch {
+                throw new Error('Invalid tool batch: bounded JSON, scope and unique call identities required');
+            }
+            // Missing recording/cancellation capabilities cannot silently become no-ops.
+            const signal = request.signal;
+            const beforeExecute = request.beforeExecute;
+            const afterExecute = request.afterExecute;
+            if (!signal || typeof signal.aborted !== 'boolean' || typeof signal.addEventListener !== 'function'
+                || typeof beforeExecute !== 'function' || typeof afterExecute !== 'function') {
+                throw new Error('Tool batch signal, beforeExecute and afterExecute capabilities are required');
+            }
+            const results = [];
+            let stopped = null;
+            let recordingError;
+            for (const call of calls) {
+                const identity = freeze({ ...scope, toolCallId: call.id, name: call.name });
+                let started = false;
+                let cleanup = { status: 'not_acquired' };
+                let value = failure('not_started', 'Tool was not started');
+                const cancelled = () => {
+                    if (!signal.aborted)
+                        return false;
+                    stopped ??= 'cancelled';
+                    value = failure('cancelled_before_start', 'Cancelled before tool execution');
+                    return true;
+                };
+                const attempt = async () => {
+                    if (cancelled())
+                        return;
+                    const tool = registry.get(call.name);
+                    if (!tool) {
+                        value = failure('unknown_tool', 'Unknown tool');
+                        return;
+                    }
+                    try {
+                        const invalid = tool.validate(call.arguments);
+                        if (invalid !== null) {
+                            value = outcome({ ok: false, error: invalid }, identity, true);
+                            if (!value.ok && value.error.code === 'tool_protocol')
+                                stopped = 'capability_failed';
+                            return;
+                        }
+                    }
+                    catch {
+                        value = failure('tool_validation', 'Tool validation capability failed');
+                        stopped = 'capability_failed';
+                        return;
+                    }
+                    if (cancelled())
+                        return;
+                    const invocation = freeze({ identity, call, definition: tool.definition });
+                    let lease;
+                    try {
+                        lease = await acquire(invocation, signal);
+                    }
+                    catch {
+                        value = failure('environment_failed', 'Environment acquisition failed');
+                        cleanup = { status: 'acquire_failed', error: {
+                                code: 'acquire_failed', message: 'Environment provider owns partial-resource cleanup; no lease was returned',
+                            } };
+                        stopped = 'capability_failed';
+                        return;
+                    }
+                    // A malformed lease cannot prove acquired resources were released.
+                    let release;
+                    try {
+                        if (!lease || typeof lease.release !== 'function')
+                            throw new Error();
+                        release = lease.release.bind(lease);
+                    }
+                    catch {
+                        value = failure('environment_protocol', 'Environment returned an invalid resource lease');
+                        cleanup = { status: 'failed', error: {
+                                code: 'invalid_lease', message: 'No release capability; resource effects unknown',
+                            } };
+                        stopped = 'cleanup_failed';
+                        return;
+                    }
+                    try {
+                        // Use the same environment for authorization and execution, even if
+                        // the lease implementation exposes its value through an accessor.
+                        let environment;
+                        try {
+                            environment = lease.value;
+                        }
+                        catch {
+                            value = failure('environment_failed', 'Environment value is unavailable');
+                            stopped = 'capability_failed';
+                            return;
+                        }
+                        if (cancelled())
+                            return;
+                        try {
+                            await beforeExecute(identity);
+                        }
+                        catch {
+                            value = failure('record_failed', 'Required execution-intent recording failed');
+                            stopped = 'capability_failed';
+                            return;
+                        }
+                        if (cancelled())
+                            return;
+                        // Permission is the last awaited boundary before tool invocation.
+                        let decision;
+                        try {
+                            decision = snapshot(await check(invocation, environment, signal), 4096);
+                            if (!object(decision) || !(decision.allowed === true
+                                || (decision.allowed === false && typeof decision.reason === 'string')))
+                                throw new Error();
+                        }
+                        catch {
+                            value = failure('permission_failed', 'Permission capability failed or returned an invalid decision');
+                            stopped = 'capability_failed';
+                            return;
+                        }
+                        if (cancelled())
+                            return;
+                        if (!decision.allowed) {
+                            value = failure('permission_denied', decision.reason);
+                            return;
+                        }
+                        started = true;
+                        try {
+                            value = outcome(await tool.execute(call.arguments, identity, signal, environment), identity);
+                        }
+                        catch {
+                            value = failure('tool_exception', 'Tool threw; actual effects are unknown', 'unknown');
+                        }
+                    }
+                    finally {
+                        try {
+                            await release();
+                            cleanup = { status: 'released' };
+                        }
+                        catch {
+                            cleanup = { status: 'failed', error: { code: 'release_failed', message: 'Resource release failed; inspect this invocation' } };
+                            stopped = 'cleanup_failed';
+                        }
+                    }
+                };
+                if (!stopped)
+                    await attempt();
+                else if (stopped === 'cancelled')
+                    cancelled();
+                if (!value.ok && value.error.effect === 'unknown')
+                    stopped = 'unknown_effect';
+                if (signal.aborted)
+                    stopped ??= 'cancelled';
+                const settlement = freeze({
+                    identity, started, status: status(started, value), outcome: value,
+                    cancellationRequested: signal.aborted, cleanup,
+                });
+                results.push(settlement);
+                if (!recordingError) {
+                    try {
+                        await afterExecute(settlement);
+                    }
+                    catch {
+                        recordingError = {
+                            identity, code: 'result_record_failed',
+                            message: 'Result recording failed; write effect unknown. Reconcile using in-memory receipts',
+                        };
+                        stopped ??= 'capability_failed';
+                    }
+                }
+            }
+            return freeze({ results, stopped, ...(recordingError ? { recordingError } : {}) });
+        },
+    });
+}

package/dist/nativeAgent/toolManager/index.js

@@ -0,0 +1,4 @@
+import { buildExecutor } from './executor.js';
+export function createToolExecutor(options) {
+    return buildExecutor(options);
+}

package/dist/nativeAgent/validation.js

@@ -57,10 +57,10 @@ export function response(value, usedIds) {
     }
     return snapshot(value);
 }
-export function history(value) {
+export function history(value, maxBytes = limits.historyBytes) {
     const pending = new Map();
     const used = new Set();
-    if (!Array.isArray(value) || !json(value) || size(value) > limits.historyBytes) {
+    if (!Array.isArray(value) || !json(value) || size(value) > maxBytes) {
         throw new AgentFault('invalid_history', 'History must be bounded JSON messages');
     }
     for (const m of value) {

package/dist/task/taskAuthority.js

@@ -51,6 +51,62 @@ export function assertTaskDeliveryAuthority(store, environment, taskId) {
     }
     return actor;
 }
+/** Project effects consume the current Session's captured scope, never the
+ * Role's desired configuration or the mere presence of a writable directory.
+ * Task management (including abort/inspection) remains a separate authority. */
+export function assertTaskProjectWriteAuthority(store, environment, taskId, projectId) {
+    const actor = assertTaskDeliveryAuthority(store, environment, taskId);
+    if (actor !== "leader")
+        return actor;
+    const caller = currentManagedRuntime(store, environment, taskId, LEADER_ROLE);
+    const session = store.getTaskRoleSessionSet(taskId, LEADER_ROLE)?.sessions[caller.agentId];
+    const effective = session?.effective;
+    const task = store.getTask(taskId);
+    const main = store.getTaskWorkspace(taskId);
+    const entry = main?.entries.find(entry => entry.projectId === projectId);
+    if (task?.status !== "active" || task.executionGate.state !== "enabled"
+        || !task.projectBindings.some(binding => binding.projectId === projectId)
+        || effective?.profileAccess !== "write" || !effective.writeProjectIds.includes(projectId)
+        || main?.owner.type !== "task" || main.owner.taskId !== taskId
+        || effective.workspace.root !== main.root || entry?.access !== "write"
+        || !effective.workspace.entries.some(captured => captured.projectId === projectId
+            && captured.access === "write" && captured.path === entry.path)) {
+        throw usageError("Project write requires this Task's current delivery Session with a captured writable Project in its Task-main workspace. Read the Session scope; use formal Session replacement to adopt a new boundary.");
+    }
+    return actor;
+}
+/** A managed Leader integrates into its captured Task-main, not any branch
+ * reachable through the same Git repository. The executor also verifies that
+ * this ref is physically checked out here immediately before target effects. */
+export function taskIntegrationTargetCheckout(store, environment, taskId, projectId, targetRef) {
+    if (assertTaskProjectWriteAuthority(store, environment, taskId, projectId) !== "leader") {
+        return undefined;
+    }
+    return taskIntegrationSettlementCheckout(store, environment, taskId, projectId, targetRef);
+}
+/** Confirming an already-applied CAS is Task management, not a Project write
+ * grant. Keep the current delivery identity and captured target ownership, but
+ * do not require or change its declared write scope. Never use this for CAS. */
+export function taskIntegrationSettlementCheckout(store, environment, taskId, projectId, targetRef) {
+    if (assertTaskDeliveryAuthority(store, environment, taskId) !== "leader")
+        return undefined;
+    const task = store.getTask(taskId);
+    const main = store.getTaskWorkspace(taskId);
+    const entry = main?.entries.find(entry => entry.projectId === projectId);
+    const caller = currentManagedRuntime(store, environment, taskId, LEADER_ROLE);
+    const effective = store.getTaskRoleSessionSet(taskId, LEADER_ROLE)?.sessions[caller.agentId]?.effective;
+    const captured = effective?.workspace.entries.find(entry => entry.projectId === projectId);
+    const branchRef = (ref) => ref.startsWith("refs/heads/") ? ref : `refs/heads/${ref}`;
+    if (task?.status !== "active" || !task.projectBindings.some(binding => binding.projectId === projectId)
+        || main?.owner.type !== "task" || main.owner.taskId !== taskId
+        || effective?.workspace.root !== main.root || entry?.access !== "write"
+        || captured?.path !== entry.path || entry.branch === undefined || captured.branch === undefined
+        || branchRef(entry.branch) !== branchRef(captured.branch)
+        || branchRef(targetRef) !== branchRef(captured.branch)) {
+        throw usageError("Managed Leader Integration target must be its captured Task-main branch and checkout.");
+    }
+    return entry.path;
+}
 /**
  * Authority for a live steer/interrupt of an exact current native Turn
  * (decision-3 §1/§9, message-5 gap B). The legal evidence is the native

package/dist/web/assets/client/app.js

@@ -15,7 +15,7 @@ import { entriesOf } from "/assets/js/records.js";
 
 const $ = function (selector) { return document.querySelector(selector); };
 const el = {
-  sidebar: $(".sidebar"), center: $("#center"), detail: $("#detail"),
+  sidebar: $(".sidebar"), sidebarDivider: $("#sidebar-divider"), center: $("#center"), detail: $("#detail"),
   search: $("#search"), filters: $("#status-filters"), attention: $("#attention-bar"), tasks: $("#task-list"),
   catalogNext: $("#catalog-next"), catalogReset: $("#catalog-reset"), catalogCount: $("#catalog-count"),
   catalogAttentionReset: $("#catalog-attention-reset"),
@@ -43,6 +43,9 @@ function readPreference(key, fallback) {
 function writePreference(key, value) {
   try { localStorage.setItem(key, value); } catch {}
 }
+function clearPreference(key) {
+  try { localStorage.removeItem(key); } catch {}
+}
 const dock = {
   open: readPreference("yui.dock.open", "true") !== "false",
   mode: "discussion",
@@ -52,6 +55,10 @@ const dock = {
   // Task, never restored from the desktop preference.
   sheet: false
 };
+// Task list width: null keeps the CSS default (--sidebar-w); otherwise the width
+// the user dragged to. It is a preference; the width actually applied is clamped
+// to the current window.
+const sidebar = { width: Number(readPreference("yui.sidebar.width", "")) || null, resizing: false };
 const narrow = window.matchMedia("(max-width: 900px)");
 
 const i18n = createI18n(el.locale);
@@ -510,7 +517,7 @@ function updateLayout() {
   el.dockTabSession.setAttribute("aria-selected", String(dock.mode === "session"));
   el.dockTabDiscussion.disabled = !state.selected;
   el.dockSwap.setAttribute("aria-pressed", String(dock.center));
-  setDockWidth(dock.width, false);
+  applySidebarWidth();
   syncDockButtons();
 }
 function syncDockButtons() {
@@ -598,9 +605,63 @@ el.divider.addEventListener("keydown", function (event) {
   event.preventDefault();
   setDockWidth(event.key === "Home" ? 320 : event.key === "End" ? maxDockWidth() : dock.width + delta, true);
 });
-window.addEventListener("resize", function () { setDockWidth(dock.width, false); });
 narrow.addEventListener("change", updateLayout);
 
+// --- Sidebar width ----------------------------------------------------------------
+const SIDEBAR_MIN = 240;
+const SIDEBAR_MAX = 560;
+function maxSidebarWidth() {
+  // An open dock can shrink to its minimum, so it reserves only that much.
+  const reserve = dockVisible() ? 320 + 9 : 0;
+  return Math.max(SIDEBAR_MIN, Math.min(SIDEBAR_MAX, window.innerWidth - reserve - 420));
+}
+function applySidebarWidth() {
+  const root = document.documentElement.style;
+  if (sidebar.width === null) root.removeProperty("--sidebar-w");
+  else root.setProperty("--sidebar-w", Math.max(SIDEBAR_MIN, Math.min(maxSidebarWidth(), sidebar.width)) + "px");
+  // A wider task list leaves the dock less room; the dock keeps its stored width.
+  setDockWidth(dock.width, false);
+  el.sidebarDivider.setAttribute("aria-valuemax", String(maxSidebarWidth()));
+  el.sidebarDivider.setAttribute("aria-valuenow", String(el.sidebar.offsetWidth));
+}
+function setSidebarWidth(width, persist) {
+  sidebar.width = width === null ? null : Math.max(SIDEBAR_MIN, Math.min(maxSidebarWidth(), Math.round(width)));
+  if (persist) {
+    if (sidebar.width === null) clearPreference("yui.sidebar.width");
+    else writePreference("yui.sidebar.width", String(sidebar.width));
+  }
+  applySidebarWidth();
+}
+el.sidebarDivider.addEventListener("pointerdown", function (event) {
+  if (event.button !== 0 || window.innerWidth <= 900) return;
+  sidebar.resizing = true;
+  el.sidebarDivider.setPointerCapture(event.pointerId);
+  document.body.classList.add("sidebar-resizing");
+  event.preventDefault();
+});
+el.sidebarDivider.addEventListener("pointermove", function (event) {
+  if (!sidebar.resizing) return;
+  setSidebarWidth(event.clientX - el.sidebar.getBoundingClientRect().left, false);
+});
+function finishSidebarResize() {
+  if (!sidebar.resizing) return;
+  sidebar.resizing = false;
+  document.body.classList.remove("sidebar-resizing");
+  if (sidebar.width !== null) writePreference("yui.sidebar.width", String(sidebar.width));
+}
+el.sidebarDivider.addEventListener("pointerup", finishSidebarResize);
+el.sidebarDivider.addEventListener("pointercancel", finishSidebarResize);
+el.sidebarDivider.addEventListener("dblclick", function () { setSidebarWidth(null, true); });
+el.sidebarDivider.addEventListener("keydown", function (event) {
+  const current = el.sidebar.offsetWidth;
+  const next = event.key === "ArrowRight" ? current + 16 : event.key === "ArrowLeft" ? current - 16
+    : event.key === "Home" ? SIDEBAR_MIN : event.key === "End" ? maxSidebarWidth() : null;
+  if (next === null) return;
+  event.preventDefault();
+  setSidebarWidth(next, true);
+});
+window.addEventListener("resize", applySidebarWidth);
+
 // --- Sidebar controls -------------------------------------------------------------
 let searchTimer = null;
 el.search.addEventListener("input", function () {

package/dist/web/assets/client/detail.js

@@ -129,14 +129,14 @@ function renderOverviewPanel(panel, data, t, locale, ctx) {
     panel.append(needs);
   }
 
-  const grid = h("div.card-grid");
-  grid.append(progressCard(data, t, locale, ctx));
+  // Independent column stacks, not paired rows: a long progress card must not
+  // push the next row down and leave a gap under the shorter Session card.
+  // Main column: what the Task is and where it stands. Rail: live and decided facts.
   const sessions = card({ title: t("sessions.title"), icon: "terminal", hint: t("sessions.hint") });
   sessions.body.append(h("div", { dataset: { slot: "sessions" } }));
-  grid.append(sessions);
-  grid.append(goalCard(data, t, ctx));
-  grid.append(decisionsCard(data, t, locale, ctx));
-  panel.append(grid);
+  panel.append(h("div.card-columns", null,
+    h("div.card-column", null, progressCard(data, t, locale, ctx), goalCard(data, t, ctx)),
+    h("div.card-column", null, sessions, decisionsCard(data, t, locale, ctx))));
   if (task.status === "draft") panel.append(planningCard(data, t, locale));
 }
 

package/dist/web/assets/client/i18n.js

@@ -7,6 +7,8 @@ const EN = {
     "sidebar.noMatch": "No tasks match this filter.",
     "sidebar.activeRuns": "Open execution records",
     "sidebar.workItems": "Work items",
+    "sidebar.resize": "Resize task list",
+    "sidebar.resizeHint": "Drag to resize · double-click to reset",
     "search.label": "Search tasks",
     "search.placeholder": "Search title, ID, tag…",
     "filters.label": "Filter by status",
@@ -560,6 +562,8 @@ const ZH = {
     "sidebar.noMatch": "没有符合筛选的任务。",
     "sidebar.activeRuns": "未结清的执行记录",
     "sidebar.workItems": "工作项",
+    "sidebar.resize": "调整任务列表宽度",
+    "sidebar.resizeHint": "拖拽调整宽度 · 双击恢复默认",
     "search.label": "搜索任务",
     "search.placeholder": "搜索标题、ID、标签…",
     "filters.label": "按状态筛选",

package/dist/web/assets/client/overview.js

@@ -28,7 +28,12 @@ export function renderOverview(container, state, t, locale, actions) {
     metricTile(t("metrics.completed"), counts ? counts.completed : "—", { tone: "ok" }),
     metricTile(t("metrics.total"), counts ? counts.total : "—")));
 
-  const grid = h("div.overview-grid");
+  // Two independent column stacks instead of paired rows: each card keeps its
+  // natural height, so a short card never leaves a gap beside a long one.
+  // Main column: the work path (answer, in progress, recent). Rail: catalog-wide
+  // signals and the explicit Session read.
+  const main = h("div.overview-col.overview-main");
+  const rail = h("div.overview-col.overview-rail");
   // Open questions: the catalog names the affected Tasks, never the questions.
   const inbox = card({ title: t("overview.inbox"), icon: "inbox", count: counts ? counts.openInputs : null });
   const items = state.attention || [];
@@ -41,7 +46,7 @@ export function renderOverview(container, state, t, locale, actions) {
         h("span.list-row-go", null, t("overview.answer"), icon("chevron", "icon-sm")));
     })));
   }
-  grid.append(inbox);
+  main.append(inbox);
 
   const catalog = card({ title: t("overview.catalog"), icon: "pulse", hint: t("overview.catalogHint") });
   if (state.catalogAttention) {
@@ -59,16 +64,14 @@ export function renderOverview(container, state, t, locale, actions) {
     })));
     catalog.body.append(note(t("overview.signalsHelp")));
   } else catalog.body.append(emptyState(t("loading.dashboard")));
-  grid.append(catalog);
-  page.append(grid);
+  rail.append(catalog);
 
   const active = (state.tasks || []).filter(function (task) { return task.status === "active"; });
   const recent = (state.tasks || []).filter(function (task) { return task.status !== "archived"; }).slice().sort(byNewest).slice(0, 8);
-  const lists = h("div.overview-grid");
-  lists.append(taskListCard(t("overview.activeNow"), "pulse", active, t("overview.activeEmpty"), t, locale, actions));
-  lists.append(taskListCard(t("overview.recent"), "history", recent, t("sidebar.empty"), t, locale, actions));
-  page.append(lists);
-  page.append(sessionCard(state, t, locale, actions));
+  main.append(taskListCard(t("overview.activeNow"), "pulse", active, t("overview.activeEmpty"), t, locale, actions));
+  main.append(taskListCard(t("overview.recent"), "history", recent, t("sidebar.empty"), t, locale, actions));
+  rail.append(sessionCard(state, t, locale, actions));
+  page.append(h("div.overview-layout", null, main, rail));
   page.append(h("p.page-foot", null, t("overview.pageScope")));
   container.append(page);
 }

package/dist/web/assets/client/sidebar.js

@@ -30,7 +30,24 @@ export function renderAttentionBar(container, state, t, onPick) {
 }
 
 // The tab row is created once and updated in place so its horizontal scroll
-// position survives every refresh.
+// position survives every refresh. When the sidebar is too narrow for every
+// tab, the clipped edge fades out, the wheel scrolls the row sideways and a
+// newly selected tab is scrolled into view.
+function syncTabsOverflow(row) {
+  const max = row.scrollWidth - row.clientWidth;
+  const before = row.scrollLeft > 1;
+  const after = row.scrollLeft < max - 1;
+  row.dataset.fade = before && after ? "both" : after ? "end" : before ? "start" : "none";
+}
+
+function revealTab(row, tab) {
+  const margin = 28;
+  const left = tab.offsetLeft - margin;
+  const right = tab.offsetLeft + tab.offsetWidth + margin;
+  if (left < row.scrollLeft) row.scrollLeft = Math.max(0, left);
+  else if (right > row.scrollLeft + row.clientWidth) row.scrollLeft = right - row.clientWidth;
+}
+
 export function renderFilters(container, state, t, onFilter) {
   const counts = state.counts || {};
   let row = container.querySelector(":scope > .tabs-row");
@@ -41,6 +58,13 @@ export function renderFilters(container, state, t, onFilter) {
         h("span.status-tab-label"), h("span.status-tab-count")));
     });
     container.append(row);
+    row.addEventListener("scroll", function () { syncTabsOverflow(row); }, { passive: true });
+    row.addEventListener("wheel", function (event) {
+      if (Math.abs(event.deltaY) <= Math.abs(event.deltaX) || row.scrollWidth <= row.clientWidth) return;
+      event.preventDefault();
+      row.scrollLeft += event.deltaY;
+    }, { passive: false });
+    new ResizeObserver(function () { syncTabsOverflow(row); }).observe(row);
   }
   STATUS_FILTERS.forEach(function (status) {
     const tab = row.querySelector('[data-status="' + status + '"]');
@@ -56,6 +80,11 @@ export function renderFilters(container, state, t, onFilter) {
     badge.hidden = hide;
     if (!hide) badge.textContent = String(count);
   });
+  if (row.dataset.selected !== state.filter) {
+    row.dataset.selected = state.filter;
+    revealTab(row, row.querySelector('[data-status="' + state.filter + '"]'));
+  }
+  syncTabsOverflow(row);
 }
 
 function groupOf(task) {
@@ -106,7 +135,7 @@ function taskRow(task, state, t, locale, onSelect) {
   h("span.task-body", null,
     h("span.task-line", null, h("span.task-name", null, task.title), h("time.task-time", { dateTime: task.updatedAt }, relativeTime(task.updatedAt, locale, t))),
     h("span.task-line.task-sub", null, h("code.task-id", null, task.id),
-      counts.workItems > 0 ? h("span.task-meta", { title: t("sidebar.workItems") }, icon("layers", "icon-sm"), String(counts.workItems)) : null,
+      counts.workItems > 0 ? h("span.task-count", { title: t("sidebar.workItems") }, icon("layers", "icon-sm"), String(counts.workItems)) : null,
       signals)));
   return row;
 }

package/dist/web/assets/shell.js

@@ -56,12 +56,13 @@ export const DASHBOARD_HTML = `<!doctype html>
         <button id="operator-terminal" class="foot-btn" type="button" title="Operator session · O">
           ${iconSvg("terminal")}<span data-i18n="actions.operator">Operator</span><kbd>O</kbd>
         </button>
-        <button id="global-input-open" class="foot-btn" type="button">
+        <button id="global-input-open" class="foot-btn" type="button" title="Global input" data-i18n-title="global.open">
           ${iconSvg("broadcast")}<span data-i18n="global.open">Global input</span>
         </button>
         <button id="settings-open" class="icon-btn" type="button" aria-label="Settings" data-i18n-aria-label="settings.title" title="Settings">${iconSvg("settings")}</button>
       </footer>
     </aside>
+    <div id="sidebar-divider" class="sidebar-divider" role="separator" tabindex="0" aria-orientation="vertical" aria-valuemin="240" aria-valuemax="560" aria-valuenow="264" aria-label="Resize task list" data-i18n-aria-label="sidebar.resize" title="Drag to resize · double-click to reset" data-i18n-title="sidebar.resizeHint"><span aria-hidden="true"></span></div>
     <main id="center" class="center" tabindex="-1">
       <div id="detail" class="detail"></div>
     </main>

package/dist/web/assets/styles/components.js

@@ -73,6 +73,8 @@ code.id{padding:1px 6px;border-radius:var(--r-xs);background:var(--surface-3);co
 .card-body{display:grid;gap:12px;padding:14px 16px 16px;min-width:0}
 .card-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:14px;align-items:start}
 .card-grid-1{grid-template-columns:minmax(0,1fr)}
+.card-columns{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:14px;align-items:start}
+.card-column{display:flex;flex-direction:column;gap:14px;min-width:0}
 .stack{display:grid;gap:10px;min-width:0}
 
 /* Disclosure */