@zq-silk/yui 2.8.1 → 2.10.0

package/README.md

@@ -30,7 +30,7 @@ not from terminal windows you juggle or details you have to remember.
 - **Bring your own Agent** — Codex CLI, Claude Code CLI and ACP peers run behind
   one boundary and stay replaceable without losing the Task.
 - **Local-first and private** — everything runs on your machine for one trusted
-  user; Web is loopback-only, with read-only views and authenticated user controls.
+  user; Web defaults to loopback, with explicitly enabled authenticated LAN access.
 - **Isolated by default** — repository work happens in managed Git worktrees;
   the stable checkout stays read-only.
 
@@ -181,6 +181,8 @@ For a visual overview, run `yui web` in another terminal. The local Web view
 shows the same tasks and pending questions and lets you send messages, answer
 questions and explicitly queue, steer or interrupt Task input. These authenticated
 Task controls use the same operations as the CLI; Web is not a separate task system.
+For explicit trusted-LAN binding, password protection, access URLs and Operator
+start/status/stop, see [Controlled Web access](docs/web-access.md). HTTP is not encrypted.
 The task list remains at the left, task details occupy the primary reading area,
 and recorded Task messages live in a secondary discussion pane. You can resize,
 swap or hide that pane; on narrow screens it opens over the detail. Native Sessions
@@ -311,7 +313,7 @@ the Controller are what touch the store:
      it moves work and records facts — it never judges an answer
 
   Agents work in Projects: read-only checkout + isolated worktrees.
-  Web (yui web): loopback views + authenticated user controls.
+  Web (yui web): local by default + explicitly authenticated LAN access.
 ```
 
 ### Layered design
@@ -321,7 +323,7 @@ never a fixed workflow:
 
 ```text
   Experience   —  how you interact
-    CLI (Operator) · Web (loopback, authenticated) · native Agent sessions
+    CLI (Operator) · Web (local / authenticated LAN) · native Agent sessions
     collect input · show facts · confirm actions · invoke capabilities
         ▼
   Intelligence —  who decides

package/dist/cli/commandCatalog.js

@@ -275,7 +275,7 @@ const taskChildren = [
     {
         name: "project", discovery: { surface: "managed", audiences: ["operator", "leader"] },
         summary: "Manage Projects bound to a Task.",
-        sections: [{ id: "manage", title: "Commands", entries: ["list", "add"] }],
+        sections: [{ id: "manage", title: "Commands", entries: ["list", "add", "delivery"] }],
         children: [
             {
                 name: "list", discovery: { surface: "public", audiences: ["public", "operator", "leader"] },
@@ -287,6 +287,13 @@ const taskChildren = [
                 summary: "Add a Project to a Task.",
                 usage: "yui task project add <task> <project> [--base <ref>] [--directory <name>]",
                 options: ["--base", "--directory"]
+            },
+            {
+                name: "delivery", discovery: { surface: "public", audiences: ["public", "operator", "leader"] },
+                summary: "Record a sourced Task Project delivery requirement; never grants cleanup or execution authority.",
+                usage: "yui task project delivery <task> <project-id> --requirement <required|excluded> --reason <text> --source-message <message-id> --purpose <exact-quote> --if-current <event-id|none>",
+                options: ["--requirement", "--reason", "--source-message", "--purpose", "--if-current"],
+                optionValues: { "--requirement": ["required", "excluded"] }
             }
         ]
     },
@@ -314,8 +321,8 @@ const taskChildren = [
                 name: "request", discovery: { surface: "public", audiences: ["public", "operator", "leader"] },
                 summary: "Record an Activation request. Every active Task gets a managed main workspace. empty adds no execution environment; scratch adopts a separate scratch environment; local requires a registered Resource and grant, not a Project ID.",
                 usage: "yui task activation request <task> --request-id <id> "
-                    + "--environment <empty|scratch|local:<resource>:<read|write>>",
-                options: ["--request-id", "--environment"],
+                    + "--environment <empty|scratch|local:<resource>:<read|write>> [--source-message <id> | --source-text <exact-input>]",
+                options: ["--request-id", "--environment", "--source-message", "--source-text"],
                 examples: [
                     "yui task activation request <task> --request-id start-1 --environment empty",
                     "yui task activation request <task> --request-id start-1 --environment scratch"
@@ -643,8 +650,8 @@ const taskChildren = [
             {
                 name: "upsert", discovery: { surface: "managed", audiences: ["operator", "leader"] },
                 summary: "Create or immutably update an external PR/MR and its publication state.",
-                usage: "yui task publication upsert <task> --project <project> --provider <github|gitlab> --repository <owner/name> --kind <pull-request|merge-request> --id <external-id> [--url <url>] [--title <text>] [--source-branch <branch>] [--target-branch <branch>] [--local-commit <sha>] [--head-commit <sha>] [--remote-commit <sha>] [--state <open|merged|closed>] [--reported|--verified] [--evidence <text>] [--merged-at <iso-timestamp>]",
-                options: ["--project", "--provider", "--repository", "--kind", "--id", "--url", "--title", "--source-branch", "--target-branch", "--local-commit", "--head-commit", "--remote-commit", "--state", "--reported", "--verified", "--evidence", "--merged-at"]
+                usage: "yui task publication upsert <task> --project <project> --provider <github|gitlab> --repository <owner/name> --kind <pull-request|merge-request> --id <external-id> [--url <url>] [--title <text>] [--source-branch <branch>] [--target-branch <branch>] [--local-commit <sha>] [--head-commit <sha>] [--remote-commit <sha>] [--state <open|merged|closed>] [--reported] [--evidence <text>] [--merged-at <iso-timestamp>]",
+                options: ["--project", "--provider", "--repository", "--kind", "--id", "--url", "--title", "--source-branch", "--target-branch", "--local-commit", "--head-commit", "--remote-commit", "--state", "--reported", "--evidence", "--merged-at"]
             },
             {
                 name: "diff", discovery: { surface: "managed", audiences: ["operator", "leader"] },
@@ -660,8 +667,9 @@ const taskChildren = [
             },
             {
                 name: "verify", discovery: { surface: "managed", audiences: ["operator", "leader"] },
-                summary: "Observe the current PR/MR head and merge through its provider; record verification separately from Task coverage.",
-                usage: "yui task publication verify (<task>/<publication-id> | <task> <publication-id>)"
+                summary: "Record exact authorized tool evidence, or query the optional gh/glab adapter; verification is separate from Task coverage.",
+                usage: "yui task publication verify (<task>/<publication-id> | <task> <publication-id>) [--observation <json>]",
+                options: ["--observation"]
             },
             {
                 name: "list", discovery: { surface: "public", audiences: ["public", "operator", "leader"] },
@@ -738,7 +746,7 @@ const taskChildren = [
                     },
                     {
                         name: "new", discovery: { surface: "managed", audiences: ["operator", "leader"] },
-                        summary: "Request replacement even for active or ended Sessions; stop exact execution and preserve Task context, results and workspaces.",
+                        summary: "Stop exact execution, then initialize a successor without replaying retained inbox obligations; preserve claims, context and workspaces.",
                         usage: "yui task role session new <task> <role> --reason <text>",
                         options: ["--reason"]
                     }
@@ -1016,15 +1024,15 @@ const taskChildren = [
     },
     {
         name: "brief", discovery: { surface: "managed", audiences: ["operator", "leader"] },
-        summary: "Manage the Task Brief, the authoritative summary of current task state.",
+        summary: "Manage the Leader-maintained Task summary; live lifecycle and authority remain separate facts.",
         sections: [{ id: "manage", title: "Commands", entries: ["show", "update"] }],
         children: [
             { name: "show", discovery: { surface: "managed", audiences: ["operator", "leader"] }, summary: "Show the Task Brief.", usage: "yui task brief show <task> [--cursor <cursor>]", options: ["--cursor"] },
             {
                 name: "update", discovery: { surface: "managed", audiences: ["operator", "leader"] },
                 summary: "Create or update the Task Brief.",
-                usage: "yui task brief update <task> [--objective <text>] [--boundary <text> ...] [--approach <text>] [--focus <text>] [--leader-summary <text>]",
-                options: ["--objective", "--boundary", "--approach", "--focus", "--leader-summary"]
+                usage: "yui task brief update <task> --if-current <writeGuard> [--objective <text>] [--boundary <text> ...] [--approach <text>] [--focus <text>] [--leader-summary <text>]",
+                options: ["--if-current", "--objective", "--boundary", "--approach", "--focus", "--leader-summary"]
             }
         ]
     },
@@ -1136,7 +1144,7 @@ export const ROOT_COMMAND = buildNode({
             ] },
         { id: "workflow", title: "Workflow", entries: ["agent", "operator", "role", "inbox", "project", "task"] },
         { id: "configuration", title: "Configuration", entries: ["config"] },
-        { id: "operations", title: "Operations", entries: ["web", "controller", "session", "execution", "capability", "job", "jobs", "telemetry", "release"] },
+        { id: "operations", title: "Operations", entries: ["web", "controller", "session", "execution", "capability", "job", "schedule", "jobs", "telemetry", "release"] },
         { id: "resources", title: "Resources", entries: ["resources"] },
         { id: "internal", title: "Internal", entries: ["internal"] }
     ],
@@ -1163,11 +1171,12 @@ export const ROOT_COMMAND = buildNode({
         {
             name: "inbox",
             summary: "Read and explicitly handle the current managed Agent's own inbox.",
-            sections: [{ id: "commands", title: "Commands", entries: ["list", "show", "claim", "ack"] }],
+            sections: [{ id: "commands", title: "Commands", entries: ["list", "show", "claim", "ack", "retire"] }],
             children: [
                 { name: "list", discovery: { surface: "managed", audiences: ["operator", "global", "leader", "assignment"] },
                     summary: "Discover unhandled own-address entries, including accepted delivery, with current identity and separate handling receipts.",
-                    usage: "yui inbox list [--limit <1..100>] [--cursor <cursor>]", options: ["--limit", "--cursor"] },
+                    usage: "yui inbox list [--view current|history|all] [--limit <1..100>] [--cursor <cursor>]",
+                    options: ["--view", "--limit", "--cursor"], optionValues: { "--view": ["current", "history", "all"] } },
                 { name: "show", discovery: { surface: "managed", audiences: ["operator", "global", "leader", "assignment"] },
                     summary: "Read an exact original or fixed notification window without acknowledgement.",
                     usage: "yui inbox show <entry> [--cursor <cursor>]", options: ["--cursor"] },
@@ -1175,8 +1184,12 @@ export const ROOT_COMMAND = buildNode({
                     summary: "Reserve 1..16 exact entries for handling in this turn; never starts a model turn.",
                     usage: "yui inbox claim <entry> [<entry> ...] --request-id <id>", options: ["--request-id"] },
                 { name: "ack", discovery: { surface: "managed", audiences: ["operator", "global", "leader", "assignment"] },
-                    summary: "Confirm handling of claimed entries with an auditable disposition, not Provider acceptance.",
+                    summary: "Record handling, including a rightful successor's disposition of an unchanged prior claim; never proves native acceptance or authorizes replay.",
                     usage: "yui inbox ack <entry> [<entry> ...] --request-id <id> --reason <disposition>",
+                    options: ["--request-id", "--reason"] },
+                { name: "retire", discovery: { surface: "managed", audiences: ["operator", "global"] },
+                    summary: "Explicitly retire obsolete proven-unsubmitted Global input, preserving its original target and evidence.",
+                    usage: "yui inbox retire <entry> [<entry> ...] --request-id <id> --reason <disposition>",
                     options: ["--request-id", "--reason"] }
             ]
         },
@@ -1191,8 +1204,8 @@ export const ROOT_COMMAND = buildNode({
                     children: [
                         {
                             name: "list", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Discover Global Messages without consuming input.",
-                            usage: "yui role message list <role> [--pending|--diagnostics|--diagnostic <key>] [--limit <1..100>] [--cursor <cursor>]",
-                            options: ["--pending", "--diagnostics", "--diagnostic", "--limit", "--cursor"]
+                            usage: "yui role message list <role> [--current|--pending|--diagnostics|--diagnostic <key>] [--limit <1..100>] [--cursor <cursor>]",
+                            options: ["--current", "--pending", "--diagnostics", "--diagnostic", "--limit", "--cursor"]
                         },
                         {
                             name: "show", discovery: { surface: "public", audiences: ["public", "operator"] }, summary: "Read one exact Global Message; follow contentPage.nextCursor for long content.",
@@ -1242,8 +1255,8 @@ export const ROOT_COMMAND = buildNode({
         {
             name: "web", discovery: { surface: "public", audiences: ["public", "operator"] },
             summary: "Serve the control room using the running Controller's capability Host.",
-            usage: "yui web [--host <loopback>] [--port <port>] | --status | --stop",
-            options: ["--host", "--port", "--status", "--stop"]
+            usage: "yui web [--host <IP|localhost>] [--port <port>] [--auth-file <absolute-path>] [--detach] | --status | --stop",
+            options: ["--host", "--port", "--auth-file", "--detach", "--status", "--stop"]
         },
         {
             name: "controller", discovery: { surface: "public", audiences: ["public", "operator"] },
@@ -1641,15 +1654,37 @@ export const ROOT_COMMAND = buildNode({
         },
         {
             name: "job", discovery: { surface: "managed", audiences: ["operator", "leader", "assignment"] },
-            summary: "Start, inspect, cancel, or acknowledge a Controller-managed DurableJob.",
-            sections: [{ id: "manage", title: "Commands", entries: ["start", "get", "cancel", "acknowledge"] }],
+            summary: "Manage stable Job definitions and exact execution Runs (not scheduler wakes).",
+            sections: [{ id: "manage", title: "Commands", entries: ["define", "update", "list", "show", "run", "runs", "run-get", "logs", "run-cancel", "run-acknowledge", "start", "get", "cancel", "acknowledge"] }],
             children: [
+                ...["define", "update", "list", "show", "run", "runs", "run-get", "logs", "run-cancel", "run-acknowledge"].map(name => ({
+                    name, discovery: { surface: "managed", audiences: ["operator", "leader", "assignment"] },
+                    summary: `${name} a stable Job or exact Run.`,
+                    usage: `yui job ${name} (--task <id>|--global)${name === "list" ? "" : " --job <id>"}`
+                        + (name === "define" || name === "update" ? " --title <text> --input <configuration-json>" : "")
+                        + (name === "update" ? " --revision <current>" : "")
+                        + (name === "run" ? " --request-id <key> [--retry-of <run-id>]" : "")
+                        + (["run-get", "logs", "run-cancel", "run-acknowledge"].includes(name) ? " --run <run-id>" : "")
+                })),
                 { name: "start", discovery: { surface: "managed", audiences: ["operator", "leader", "assignment"] }, summary: "Start a DurableJob under an explicit request identity.", usage: "yui job start --request-id <id> --task <id> --project <project> --head <sha> --workspace <dir> --step <name>=<command> [--step ...] [--owner task|work-item:<id>|integration-attempt:<id>] [--env <k=v>...]" },
                 { name: "get", discovery: { surface: "managed", audiences: ["operator", "leader", "assignment"] }, summary: "Show a DurableJob record and its terminal result.", usage: "yui job get --task <id> --job <job-id>" },
                 { name: "cancel", discovery: { surface: "managed", audiences: ["operator", "leader", "assignment"] }, summary: "Request cancellation of a running or queued DurableJob.", usage: "yui job cancel --task <id> --job <job-id>" },
                 { name: "acknowledge", discovery: { surface: "managed", audiences: ["operator", "leader", "assignment"] }, summary: "Acknowledge an unknown-needs-attention DurableJob so Task lifecycle gates can proceed.", usage: "yui job acknowledge --task <id> --job <job-id>" }
             ]
         },
+        {
+            name: "schedule", discovery: { surface: "managed", audiences: ["operator", "leader", "assignment"] },
+            summary: "Manage persistent time plans referencing scoped Jobs.",
+            sections: [{ id: "manage", title: "Commands", entries: ["create", "list", "show", "update", "enable", "disable"] }],
+            children: ["create", "list", "show", "update", "enable", "disable"].map(name => ({
+                name, discovery: { surface: "managed", audiences: ["operator", "leader", "assignment"] },
+                summary: `${name} a Schedule; disabling never cancels an admitted Run.`,
+                usage: `yui schedule ${name} (--global|--task <id>)${name === "list" ? "" : " --schedule <id>"}`
+                    + (name === "create" ? " --job <id> --rule <json>" : "")
+                    + (name === "update" ? " --rule <json> [--job <id>]" : "")
+                    + (["update", "enable", "disable"].includes(name) ? " --revision <observed>" : "")
+            }))
+        },
         {
             name: "jobs", discovery: { surface: "public", audiences: ["public", "operator"] },
             summary: "Inspect scheduler wake and recovery records.",

package/dist/cli/helpRenderer.js

@@ -25,7 +25,9 @@ function describeOption(option) {
         "--agent": "Select an Agent.",
         "--base": "Set the base Git reference.",
         "--input": "Set dispatch input.",
-        "--host": "Set the loopback listen address.",
+        "--host": "Set the listen IP (default 127.0.0.1); non-loopback requires --auth-file.",
+        "--auth-file": "Owner-only file with a unique 32–128 character password; browser username is yui. HTTP is not encrypted.",
+        "--detach": "Return after Controller starts Web; use --status / --stop. Operator and --json starts always return.",
         "--port": "Set the local listen port.",
         "--json": "Emit machine-readable JSON.",
         "--project": "Select a Project.",

package/dist/cli/interactionPolicy.js

@@ -185,7 +185,7 @@ export const INTERACTION_POLICIES = Object.freeze([
                 actionTarget: true,
                 statuses: ["draft"]
             }],
-        trailingOptions: { "--request-id": "value", "--environment": "value" }
+        trailingOptions: { "--request-id": "value", "--environment": "value", "--source-message": "value", "--source-text": "value" }
     },
     {
         commandPath: ["task", "activation", "cancel"],
@@ -615,7 +615,7 @@ export const INTERACTION_POLICIES = Object.freeze([
     ].map(([group, command]) => {
         const trailingOptions = {};
         if (group === "brief" && command === "update") {
-            Object.assign(trailingOptions, { "--objective": "value", "--boundary": "value", "--approach": "value", "--focus": "value", "--leader-summary": "value" });
+            Object.assign(trailingOptions, { "--if-current": "value", "--objective": "value", "--boundary": "value", "--approach": "value", "--focus": "value", "--leader-summary": "value" });
         }
         else if (group === "decision" && command === "record") {
             Object.assign(trailingOptions, { "--title": "value", "--rationale": "value" });

package/dist/commands/durableJobCommands.js

@@ -1,5 +1,6 @@
 import { usageError } from "../errors/cliError.js";
 import { ensureFileTaskController } from "../controller/clientRuntime.js";
+import { callFileTaskController } from "../controller/clientRuntime.js";
 import { acknowledgeDurableJob, cancelDurableJob, getDurableJob, startDurableJob } from "../controller/jobClient.js";
 import { resolveJobCaller, taskLocalActor } from "../task/taskAuthority.js";
 /**
@@ -14,6 +15,9 @@ export const JOB_OWNER_USAGE = "task|work-item:<id>|integration-attempt:<id>";
  */
 export async function runDurableJobCommand(args, options) {
     const [command, ...rest] = args;
+    if (command !== undefined && ["define", "update", "list", "show", "run", "runs", "run-get", "run-cancel", "run-acknowledge", "logs"].includes(command)) {
+        return definitionCommand(command, rest, options);
+    }
     if (command === "start")
         return startJob(rest, options);
     if (command === "get")
@@ -31,6 +35,52 @@ export async function runDurableJobCommand(args, options) {
         + "yui job cancel --task <id> --job <job-id>\n"
         + "yui job acknowledge --task <id> --job <job-id>");
 }
+async function definitionCommand(command, args, options) {
+    const flags = new Map();
+    for (let i = 0; i < args.length; i++) {
+        const flag = args[i];
+        if (!["--global", "--task", "--job", "--title", "--input", "--revision", "--request-id", "--retry-of", "--run"].includes(flag)
+            || flags.has(flag))
+            throw usageError(`Unknown or repeated Job flag: ${flag}.`);
+        if (flag === "--global") {
+            flags.set(flag, "true");
+            continue;
+        }
+        const value = args[++i];
+        if (value === undefined || value.startsWith("--"))
+            throw usageError(`Missing value: ${flag}.`);
+        flags.set(flag, value);
+    }
+    if (flags.has("--global") === flags.has("--task"))
+        throw usageError("Choose exactly one of --task <id> or --global.");
+    const taskId = flags.get("--task");
+    const caller = resolveJobCaller(options.environment, taskId ?? "");
+    const scope = taskId === undefined ? { kind: "global" } : { kind: "task", taskId };
+    let configuration;
+    if (flags.has("--input")) {
+        try {
+            configuration = JSON.parse(flags.get("--input"));
+        }
+        catch {
+            throw usageError("--input must be a JSON Job configuration.");
+        }
+    }
+    const requestId = flags.get("--request-id");
+    if (command === "run" && !requestId)
+        throw usageError("job run requires --request-id.");
+    const params = {
+        op: command, scope, caller,
+        ...(flags.has("--job") ? { id: flags.get("--job") } : {}),
+        ...(flags.has("--title") ? { title: flags.get("--title") } : {}),
+        ...(configuration === undefined ? {} : { configuration }),
+        ...(flags.has("--revision") ? { expectedRevision: Number(flags.get("--revision")) } : {}),
+        ...(flags.has("--run") ? { runId: flags.get("--run") } : {}),
+        ...(flags.has("--retry-of") ? { retryOf: flags.get("--retry-of") } : {}),
+        ...(command === "run" ? { trigger: { source: flags.has("--retry-of") ? "retry" : "manual", key: requestId } } : {})
+    };
+    const result = await callFileTaskController(options.home, "job.definition", params, { environment: options.environment });
+    return `${JSON.stringify(result, null, 2)}\n`;
+}
 async function startJob(args, options) {
     const parsed = parseStartArgs(args);
     await ensureFileTaskController(options.home, { environment: options.environment });

package/dist/commands/globalRoleCommands.js

@@ -6,6 +6,7 @@ import { controlProviderRetry, providerRetryProjection, providerRetrySummary, re
 import { pendingGlobalInboxMessages, inboxHandlingState, globalInboxDeliveryState } from "../message/inboxReceipt.js";
 import { settleGlobalRetryInput } from "../message/globalProviderRetry.js";
 import { globalInputBacklog } from "../message/globalInputBacklog.js";
+import { inboxEntryCategory } from "../message/inboxTurn.js";
 import { checkCurrentSkills, SKILL_REUSE_RULE } from "../context/currentSkills.js";
 import { runtimeDiagnosticGroups, runtimeDiagnosticEvidence } from "../controller/globalRuntimeAttention.js";
 import { roleSkillIds } from "../context/roleSessionContext.js";
@@ -131,10 +132,16 @@ function roleContext(args, store, options) {
     // through distinct receipts; a context read does neither.
     const messages = store.listGlobalRoleMessages(name);
     const queued = messages.filter((message) => message.delivery === undefined
-        && message.inbox?.ack === undefined
+        && message.inbox === undefined
         && message.notDelivered === undefined
         && (message.interruptThen !== undefined || message.inputControl?.action === "queue"));
-    const pending = recordPage(pendingGlobalInboxMessages(messages).map(globalMessageSummary), `global:${name}/messages/pending`, { limit: 8 });
+    const unhandled = pendingGlobalInboxMessages(messages);
+    const current = currentGlobalInboxMessages(messages, name, sessions);
+    const pending = recordPage(current.map(globalMessageSummary), `global:${name}/messages/current`, { limit: 8 }, {
+        historyCount: unhandled.length - current.length,
+        historyRead: "yui inbox list --view history --json",
+        note: "Historical absence of handling evidence is not new work or permission to replay effects."
+    });
     const observedAt = new Date();
     const { oldestAgeMs, messages: _backlogMessages, ...backlog } = globalInputBacklog(queued, sessions, observedAt, {
         attention: name === "operator" ? store.getWorkMailbox({ kind: "operator" }) : null,
@@ -175,9 +182,9 @@ function roleContext(args, store, options) {
         pending,
         backlog,
         reads: {
-            ownInbox: "yui inbox list --json",
+            ownInbox: "yui inbox list --view current --json",
             messages: `role message list ${name}`,
-            pending: `role message list ${name} --pending`,
+            pending: `role message list ${name} --current`,
             detail: `role message show ${name} <message-id>`,
             diagnostics: `role message list ${name} --diagnostics`,
             retry: `session retry ${name} show`
@@ -213,6 +220,16 @@ function roleContext(args, store, options) {
             ""
         ].join("\n") };
 }
+function currentGlobalInboxMessages(messages, name, sessions) {
+    const actor = { scope: "global", roleName: name, agentId: sessions?.activeAgentId ?? "",
+        nativeSessionId: sessions?.sessions[sessions.activeAgentId]?.nativeSessionId ?? "" };
+    const binding = sessions?.providerBinding;
+    const turn = binding?.conversations.find(c => c.epoch === binding.currentConversationEpoch)?.conversationId === actor.nativeSessionId
+        ? binding?.run : undefined;
+    const category = (message) => inboxEntryCategory(message, actor, turn);
+    return pendingGlobalInboxMessages(messages).filter(message => category(message) !== "history")
+        .sort((a, b) => Number(category(b) === "current") - Number(category(a) === "current"));
+}
 function globalMessageSummary(message) {
     return {
         id: message.id, createdAt: message.createdAt, kind: message.kind,
@@ -626,17 +643,18 @@ function globalRoleMessage(args, store, options) {
         }
         requireRole(name, store);
         const pending = tail.includes("--pending");
+        const current = tail.includes("--current");
         const diagnostics = tail.includes("--diagnostics");
-        const parsed = readOptions(tail.filter(arg => arg !== "--pending" && arg !== "--diagnostics"), action === "list"
+        const parsed = readOptions(tail.filter(arg => arg !== "--pending" && arg !== "--current" && arg !== "--diagnostics"), action === "list"
             ? ["--cursor", "--limit", "--diagnostic"] : ["--cursor"]);
         const diagnostic = parsed.values.get("--diagnostic");
-        if (Number(pending) + Number(diagnostics) + Number(diagnostic !== undefined) > 1
+        if (Number(pending) + Number(current) + Number(diagnostics) + Number(diagnostic !== undefined) > 1
             || action === "show" && diagnostics)
             throw usageError("Choose one Message discovery view.");
         const messages = store.listGlobalRoleMessages(name);
         let data;
         if (action === "show") {
-            if (parsed.positionals.length !== 1 || pending)
+            if (parsed.positionals.length !== 1 || pending || current)
                 throw usageError("Role message show <role> <message-id> [--cursor <cursor>].");
             const message = messages.find(m => m.id === parsed.positionals[0]);
             if (message === undefined)
@@ -654,8 +672,9 @@ function globalRoleMessage(args, store, options) {
                 return { kind: "output", output: `${JSON.stringify(data)}\n`, data };
             }
             const selected = diagnostic !== undefined ? runtimeDiagnosticEvidence(messages, diagnostic)
-                : pending ? pendingGlobalInboxMessages(messages) : [...messages].reverse();
-            data = recordPage(selected.map(globalMessageSummary), `global:${name}/messages/${diagnostic === undefined ? pending ? "pending" : "all" : `diagnostic/${diagnostic}`}`, parsed);
+                : current ? currentGlobalInboxMessages(messages, name, store.getGlobalRoleSessionSet(name))
+                    : pending ? pendingGlobalInboxMessages(messages) : [...messages].reverse();
+            data = recordPage(selected.map(globalMessageSummary), `global:${name}/messages/${diagnostic === undefined ? current ? "current" : pending ? "pending" : "all" : `diagnostic/${diagnostic}`}`, parsed);
         }
         return { kind: "output", output: `${JSON.stringify(data, null, 2)}\n`, data };
     }
@@ -711,6 +730,8 @@ function messageGlobalInput(name, input, store, options) {
     }
     store.updateGlobalRoleMessage({ ...persisted.message, control: {
             requestId, receiptId: `steer:${name}/${persisted.message.id}`,
+            target: { agentId: resolution.target.agentId, nativeSessionId: resolution.target.nativeSessionId,
+                attemptId: resolution.target.attemptId },
             outcome: "pending", observedAt: now.toISOString()
         } });
     return {