agent-tempo 1.7.0 → 2.0.0-beta.2

package/dashboard/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-tempo-dashboard",
   "private": true,
-  "version": "1.7.0",
+  "version": "2.0.0-beta.2",
   "type": "module",
   "description": "Web dashboard for agent-tempo. Bundled into the npm package; served by the daemon at /dashboard/*.",
   "scripts": {

package/dist/activities/hard-terminate.d.ts

@@ -12,9 +12,9 @@ export interface HardTerminateInput {
     playerName: string;
     /** Adapter type — controls PID-file lookup and expected process-name verification. */
     agent: AgentType;
-    /** Session's workDir — used to locate the copilot bridge PID file (`<workDir>/logs/<playerName>.pid`). */
+    /** Session's workDir — carried on the activity input as a session attribute. */
     workDir: string;
-    /** Optional explicit logDir override; falls back to `<workDir>/logs`. */
+    /** Optional explicit logDir override for the central bridge log path. */
     logDir?: string;
 }
 export interface HardTerminateResult {

package/dist/activities/hard-terminate.js

@@ -29,7 +29,6 @@ exports.hardTerminateAttachment = hardTerminateAttachment;
  */
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
-const path_1 = require("path");
 const config_1 = require("../config");
 const constants_1 = require("../constants");
 const log = (...args) => console.error('[agent-tempo:hard-terminate]', ...args);
@@ -38,19 +37,14 @@ const log = (...args) => console.error('[agent-tempo:hard-terminate]', ...args);
  * what happened so callers can record it in workflow history without blocking state flips.
  */
 async function hardTerminateAttachment(input) {
-    const { ensemble, playerName, agent, workDir, logDir } = input;
+    const { ensemble, playerName, agent, logDir } = input;
     const notes = [];
     const killedPids = [];
     log(`hardTerminate start — ensemble=${ensemble} player=${playerName} agent=${agent}`);
     // ── Copilot bridge: PID file is authoritative ──
     if (agent === 'copilot') {
-        // #690 — pid lives at the CENTRAL ~/.agent-tempo/logs/<ensemble>/ path now.
-        // Transitional (one version, v1.6.2) READ-ONLY fallback to the legacy per-cwd
-        // <workDir>/logs so we can still find+kill an orphan from a pre-upgrade spawn.
-        // TODO(v1.7): drop the legacy fallback.
-        const centralPid = (0, config_1.bridgeLogPaths)(ensemble, playerName, logDir).pidPath;
-        const legacyPid = (0, path_1.join)(logDir || (0, path_1.join)(workDir, 'logs'), `${playerName}.pid`);
-        const pidPath = (0, fs_1.existsSync)(centralPid) ? centralPid : legacyPid;
+        // #690 — pid lives at the CENTRAL ~/.agent-tempo/logs/<ensemble>/ path.
+        const pidPath = (0, config_1.bridgeLogPaths)(ensemble, playerName, logDir).pidPath;
         if ((0, fs_1.existsSync)(pidPath)) {
             try {
                 const pidStr = (0, fs_1.readFileSync)(pidPath, 'utf8').trim();

package/dist/activities/maestro.d.ts

@@ -86,19 +86,14 @@ export interface MaestroActivityOptions {
 /** Activity interface — used by proxyActivities in the Maestro workflow. */
 export interface MaestroActivities {
     /**
-     * Legacy V1 refresh — the `costProfile: 'local'` path AND the replay
-     * path for every maestro started before #748.
-     * TODO(next major, #748): remove once the minimum deployment age
-     * exceeds the longest-lived pre-#748 maestro history (they replay V1);
-     * remove together with the V1 branch in workflows/maestro.ts.
-     */
-    refreshEnsembleState(ensemble: string): Promise<MaestroPlayerInfo[]>;
-    /**
-     * T0.1 (#748) — additive V2: called only by maestros started with
-     * `costProfile: 'cloud'` in their input. SA/memo-based ensemble-scoped
-     * scan + in-process observer presence for workflow-side cadence
-     * stretching. V1 stays for in-flight pre-#748 maestros (replay safety)
-     * and the local profile.
+     * Ensemble-scoped player scan. Returns the player rows plus `observersPresent`
+     * (SSE subscriber presence) for workflow-side cadence stretching on the cloud
+     * profile. Honors the daemon's cost profile internally: cloud → SA/memo
+     * ensemble-scoped scan, local → the legacy visibility scan.
+     *
+     * 2.0 (#788): the only refresh activity — the former V1 `refreshEnsembleState`
+     * was removed; both profiles call this (the A2 cutover means no pre-#748
+     * maestro survives to need the V1 replay path).
      */
     refreshEnsembleStateV2(input: {
         ensemble: string;

package/dist/activities/maestro.js

@@ -30,6 +30,9 @@ function createMaestroActivities(client, opts = {}) {
         // tempo bucket can diff across refreshes.
         activityCount: s.activityCount,
         lastActivityAt: s.lastActivityAt,
+        // #886 slice 2 — carry the degraded flag through to the wire so the
+        // dashboard/board can render an uncertain row instead of dropping it.
+        ...(s.degraded ? { degraded: true } : {}),
     });
     // #753 — attribute every Temporal call made by these activities (however
     // deep, e.g. scanEnsembleSessions → queryHandleWithTimeout) to the maestro.
@@ -55,16 +58,6 @@ function createMaestroActivities(client, opts = {}) {
         }
     };
     return (0, action_counters_1.tagActionSource)(maestroSource, {
-        async refreshEnsembleState(ensemble) {
-            try {
-                const sessions = await (0, resolve_1.scanEnsembleSessions)(client, ensemble);
-                return sessions.map(toPlayerInfo(ensemble));
-            }
-            catch (err) {
-                log('refreshEnsembleState failed:', err);
-                throw activity_1.ApplicationFailure.nonRetryable(`Failed to scan ensemble: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        },
         async refreshEnsembleStateV2(input) {
             try {
                 // Honor the DAEMON's configured profile for the scan strategy: a

package/dist/activities/outbox.js

@@ -292,6 +292,18 @@ function createOutboxActivities(client, config, ingestTokens, doorbells) {
                         // session workflow and dispatch path can resolve the adapter descriptor
                         // from the registry without falling back to the legacy agentType field.
                         adapterId: adapters_1.registry.resolveFromAgentType(agent),
+                        // #704 — resolve the adapter descriptor's dialog-blocking property at
+                        // spawn time and thread it onto durable metadata so the session workflow
+                        // can ARM/DISARM the booting watchdog structurally (no agentType
+                        // hardcode). Headless adapters omit it ⇒ falsy ⇒ ARMED; interactive
+                        // `claude-code` sets it true ⇒ disarmed until #890.
+                        canBlockOnDialog: adapters_1.registry.get(adapters_1.registry.resolveFromAgentType(agent))?.canBlockOnDialog === true,
+                        // #704 — optional env override for the booting deadline (workflows
+                        // can't read env). Only set when a valid positive integer is provided.
+                        ...(() => {
+                            const ms = Number(process.env[config_2.ENV.BOOTING_DEADLINE_MS]);
+                            return Number.isFinite(ms) && ms > 0 ? { bootingDeadlineMs: ms } : {};
+                        })(),
                         sessionId,
                         // #131 / #449 Phase C — persist the claude-api / opencode model
                         // on durable metadata so restart can recover the original choice
@@ -764,8 +776,9 @@ function createOutboxActivities(client, config, ingestTokens, doorbells) {
         /**
          * D14 `deliverReset` — set a `pendingReset` flag on the target via
          * `setPendingResetSignal` (a signal, like deliverCue — NOT a direct
-         * subprocess call). The Pi extension polls `pendingResetQuery`, performs the
-         * clean-wipe (`newSession`), then clears it via `ackResetSignal(resetId)`.
+         * subprocess call). The Pi extension reads the pending reset off the
+         * combined `pendingIntake` query, performs the clean-wipe (`newSession`),
+         * then clears it via `ackResetSignal(resetId)`.
          */
         async deliverReset(input) {
             const { ensemble, targetPlayerId, resetId, fresh, reason, requestedBy } = input;
@@ -892,6 +905,7 @@ function createOutboxActivities(client, config, ingestTokens, doorbells) {
                             adapterId,
                             adapterClass,
                             leaseMs: validation_1.DEFAULT_RESTART_LEASE_MS,
+                            protocolVersion: constants_1.PROTOCOL_VERSION, // #786 — 2.0 wire handshake
                         }],
                 });
                 // Step 5 — context seed (saved state and/or transcript replay).

package/dist/activities/resolve.d.ts

@@ -87,6 +87,17 @@ export interface EnsembleSessionInfo {
      * session. Undefined when the session predates W2 or the query failed.
      */
     lastActivityAt?: string;
+    /**
+     * #886 slice 2 — `true` when this row was produced from a DEGRADED scan:
+     * the visibility list returned the workflow, but extracting its observation
+     * fields threw, so the rich metadata (part/workDir/hostname/…) is a
+     * best-effort blank rather than authoritative. The row's IDENTITY
+     * (`workflowId` + best-effort `playerId`) is preserved so the player stays
+     * in the roster marked uncertain — instead of being silently dropped, which
+     * reads as "player absent" and causes roster flapping (contra #777). Absent
+     * / `false` on every healthy row.
+     */
+    degraded?: boolean;
 }
 /**
  * T0.1 (#748) — cloud-profile ensemble scan. Observation path ONLY (see the
@@ -96,13 +107,13 @@ export interface EnsembleSessionInfo {
  *   - The visibility query is **ensemble-scoped** via the `AgentTempoEnsemble`
  *     filter SA — no more cluster-wide list + per-session `getMetadata`
  *     pre-filtering (the unfiltered scan was the dominant idle-burn driver).
- *   - For v1.8+ runs (memo-complete: `AgentTempoWorkDir` present), the entire
- *     player row is read from the list result (SAs + memo) — **zero**
- *     per-player queries except the BPM `getActivityState` query, which is
- *     intentionally kept per the architect's ruling (deriving BPM from phase
- *     transitions would change the metric's meaning).
- *   - Pre-v1.8 runs (no observation memo) fall back to the legacy per-player
- *     `getMetadata` + `getPart` queries — cost shrinks as old runs cycle out.
+ *   - The entire player row is read from the list result (SAs + memo) —
+ *     **zero** per-player queries except the BPM `getActivityState` query,
+ *     which is intentionally kept per the architect's ruling (deriving BPM
+ *     from phase transitions would change the metric's meaning). Every 2.0
+ *     session seeds the observation memo at workflow start (T0.5 #747 /
+ *     #757), so `AgentTempoWorkDir` is always present; the pre-v1.8 memo-
+ *     absent per-player `getMetadata`/`getPart` fallback was removed in #874.
  *
  * Staleness: SA/memo reads are eventually consistent (tens of seconds worst
  * case under backlog) — acceptable for the observation path per the design

package/dist/activities/resolve.js

@@ -160,13 +160,13 @@ async function resolveByDerivedId(client, ensemble, playerName) {
  *   - The visibility query is **ensemble-scoped** via the `AgentTempoEnsemble`
  *     filter SA — no more cluster-wide list + per-session `getMetadata`
  *     pre-filtering (the unfiltered scan was the dominant idle-burn driver).
- *   - For v1.8+ runs (memo-complete: `AgentTempoWorkDir` present), the entire
- *     player row is read from the list result (SAs + memo) — **zero**
- *     per-player queries except the BPM `getActivityState` query, which is
- *     intentionally kept per the architect's ruling (deriving BPM from phase
- *     transitions would change the metric's meaning).
- *   - Pre-v1.8 runs (no observation memo) fall back to the legacy per-player
- *     `getMetadata` + `getPart` queries — cost shrinks as old runs cycle out.
+ *   - The entire player row is read from the list result (SAs + memo) —
+ *     **zero** per-player queries except the BPM `getActivityState` query,
+ *     which is intentionally kept per the architect's ruling (deriving BPM
+ *     from phase transitions would change the metric's meaning). Every 2.0
+ *     session seeds the observation memo at workflow start (T0.5 #747 /
+ *     #757), so `AgentTempoWorkDir` is always present; the pre-v1.8 memo-
+ *     absent per-player `getMetadata`/`getPart` fallback was removed in #874.
  *
  * Staleness: SA/memo reads are eventually consistent (tens of seconds worst
  * case under backlog) — acceptable for the observation path per the design
@@ -179,52 +179,64 @@ async function scanEnsembleSessionsCloud(client, ensemble, log = () => { }) {
     try {
         for await (const workflow of (0, visibility_deadline_1.iterateWithDeadline)(client.workflow.list({ query }), visibility_deadline_1.VISIBILITY_DEADLINES_MS.scanEnsembleSessions, 'scanEnsembleSessionsCloud')) {
             try {
-                const handle = client.workflow.getHandle(workflow.workflowId);
                 const phase = (0, search_attributes_1.getAttachmentPhase)(workflow);
                 const playerId = (0, search_attributes_1.getSearchAttrString)(workflow, 'AgentTempoPlayerId') ?? workflow.workflowId;
                 const hostname = (0, search_attributes_1.getSearchAttrString)(workflow, 'AgentTempoHostname') ?? '';
-                // v1.8-memo-observation-fields runs carry workDir on the memo — use
-                // its presence as the "memo-complete row" discriminator.
-                const workDir = (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.workDir);
-                let row;
-                if (workDir !== undefined) {
-                    row = {
-                        playerId,
-                        part: (0, search_attributes_1.getPart)(workflow) ?? '',
-                        hostname,
-                        workDir,
-                        gitRoot: (0, search_attributes_1.getWorkflowMetaString)(workflow, search_attributes_1.MEMO_KEYS.gitRoot),
-                        gitBranch: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.gitBranch),
-                        isConductor: (0, search_attributes_1.getIsConductor)(workflow)
-                            ?? (workflow.workflowId?.endsWith('-conductor') ?? false),
-                        agentType: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.agentType) || 'claude',
-                        playerType: (0, search_attributes_1.getPlayerType)(workflow),
-                    };
-                }
-                else {
-                    // Legacy run (pre-v1.8 memo) — per-player query fallback, bounded
-                    // (#433). Same two queries the legacy scan used.
-                    const metadata = await (0, query_timeout_1.queryHandleWithTimeout)(handle, 'getMetadata');
-                    const part = await (0, query_timeout_1.queryHandleWithTimeout)(handle, 'getPart');
-                    row = {
-                        playerId: metadata.playerId,
-                        part,
-                        hostname: metadata.hostname,
-                        workDir: metadata.workDir,
-                        gitRoot: metadata.gitRoot,
-                        gitBranch: metadata.gitBranch,
-                        isConductor: metadata.isConductor,
-                        agentType: metadata.agentType || 'claude',
-                        playerType: metadata.playerType,
-                    };
-                }
+                // Every 2.0 session seeds the observation memo at workflow start
+                // (T0.5 #747 / #757), so the entire player row is read straight from
+                // the visibility list result — SAs + memo, zero per-player queries
+                // (the parallel BPM `getActivityState` query below aside). The
+                // pre-v1.8 memo-absent `getMetadata`/`getPart` fallback was removed
+                // in #874 (dead under the 2.0 clean cutover).
+                const row = {
+                    playerId,
+                    part: (0, search_attributes_1.getPart)(workflow) ?? '',
+                    hostname,
+                    workDir: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.workDir) ?? '',
+                    gitRoot: (0, search_attributes_1.getWorkflowMetaString)(workflow, search_attributes_1.MEMO_KEYS.gitRoot),
+                    gitBranch: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.gitBranch),
+                    isConductor: (0, search_attributes_1.getIsConductor)(workflow)
+                        ?? (workflow.workflowId?.endsWith('-conductor') ?? false),
+                    agentType: (0, search_attributes_1.getMemoString)(workflow, search_attributes_1.MEMO_KEYS.agentType) || 'claude',
+                    playerType: (0, search_attributes_1.getPlayerType)(workflow),
+                };
                 // BPM fields filled in below — kept out of the enumeration loop so
                 // per-player query latency can't eat the visibility deadline.
                 sessions.push({ workflowId: workflow.workflowId, ...row, phase });
             }
-            catch {
-                // Workflow may have just completed, or a legacy-fallback query timed
-                // out (#433) — skip this row; the next tick fills it in.
+            catch (rowErr) {
+                // #886 slice 2 — observation extraction threw for this workflow. The
+                // OLD behaviour silently dropped the row, which makes a transient
+                // failure read as "player absent" → roster flapping (contra #777). The
+                // workflow IS in the visibility list, so the player exists; emit a
+                // DEGRADED row that preserves identity (workflowId + best-effort
+                // playerId) and flags `degraded: true`, instead of dropping it.
+                //
+                // playerId is salvaged in its own guard so a throwing getter can't
+                // escape to the outer (visibility-timeout-only) catch and fail the
+                // whole scan; it falls back to the workflowId. Identity preservation
+                // is the point — a row keyed on the real playerId avoids the
+                // remove+add churn that dropping (or re-keying on workflowId) causes.
+                let salvagedPlayerId = workflow.workflowId;
+                try {
+                    salvagedPlayerId =
+                        (0, search_attributes_1.getSearchAttrString)(workflow, 'AgentTempoPlayerId') ?? workflow.workflowId;
+                }
+                catch {
+                    /* keep workflowId */
+                }
+                sessions.push({
+                    workflowId: workflow.workflowId,
+                    playerId: salvagedPlayerId,
+                    part: '',
+                    hostname: '',
+                    workDir: '',
+                    isConductor: workflow.workflowId.endsWith('-conductor'),
+                    agentType: 'claude',
+                    degraded: true,
+                });
+                log(`scanEnsembleSessionsCloud: degraded row for ${workflow.workflowId} ` +
+                    `(observation extraction failed: ${rowErr instanceof Error ? rowErr.message : String(rowErr)})`);
             }
         }
     }

package/dist/adapters/base.js

@@ -6,6 +6,7 @@ exports.installProcessLifecycleTelemetry = installProcessLifecycleTelemetry;
 exports._resetProcessLifecycleTelemetryForTest = _resetProcessLifecycleTelemetryForTest;
 exports._liveAdaptersForTest = _liveAdaptersForTest;
 const signals_1 = require("../workflows/signals");
+const constants_1 = require("../constants");
 const terminal_error_1 = require("./terminal-error");
 const action_counters_1 = require("../utils/action-counters");
 const log = (...args) => console.error('[agent-tempo:adapter]', ...args);
@@ -389,6 +390,7 @@ class BaseAttachment {
                     adapterId: this.descriptor.adapterId,
                     adapterClass: this.descriptor.adapterClass,
                     leaseMs: 3 * this.descriptor.heartbeatMs,
+                    protocolVersion: constants_1.PROTOCOL_VERSION, // #786 — 2.0 wire handshake
                     ...(expectedAttachmentId ? { expectedAttachmentId } : {}),
                 }],
         });
@@ -1147,6 +1149,7 @@ class BaseAttachment {
                                 adapterId: this.descriptor.adapterId,
                                 adapterClass: this.descriptor.adapterClass,
                                 leaseMs: 3 * this.descriptor.heartbeatMs,
+                                protocolVersion: constants_1.PROTOCOL_VERSION, // #786 — 2.0 wire handshake
                             }],
                     });
                     // Success — rebuild pinned handle from the NEW runId and hand it to the subclass.

package/dist/adapters/claude-code/adapter.js

@@ -22,6 +22,13 @@ exports.claudeCodeDescriptor = {
     // Interactive class — 60s cadence per design §4.3. The base class drives the
     // heartbeat loop at this interval when the V2 lifecycle path is active.
     heartbeatMs: 60_000,
+    // #704 — the interactive spawn passes `--dangerously-load-development-channels`,
+    // which shows a BLOCKING dev-channels dialog that requires a human click and
+    // can park the session pre-attach. So the booting attach-timeout watchdog must
+    // NOT arm for this adapter (an operator-away false-kill is worse than the hang).
+    // The 6 headless adapters omit this (⇒ falsy ⇒ armed). Flip to remove once #890
+    // dissolves the dialog. See docs/design/704-is-demo-companion-brief.md §2.
+    canBlockOnDialog: true,
 };
 // #749: one family of backoff curves across the codebase — this poller's
 // error backoff shares the SDK idle-backoff constants (values unchanged:

package/dist/cli/command-center-command.js

@@ -55,6 +55,7 @@ const config_1 = require("../config");
 const spawn_1 = require("../spawn");
 const probe_1 = require("../pi/probe");
 const install_1 = require("../pi/install");
+const constants_1 = require("../constants");
 const out = __importStar(require("./output"));
 /**
  * Public entry point — invoked by the CLI dispatcher. Launches the board in a
@@ -95,6 +96,14 @@ async function commandCenterCommand(args) {
             process.exit(1);
         }
     }
+    // #791 — surface the three access tiers up front so the subscription-friendly
+    // posture is discoverable: the board + operator controls need NO auth on a
+    // local daemon; only the LLM planner needs a Claude subscription (`/login`,
+    // zero API key) or an API key. Wording is the single source of truth in
+    // constants.ts (mirrored into docs/cli.md, drift-guarded).
+    out.log(out.dim('  Access tiers (the board works with no auth — only the LLM planner needs a key/login):'));
+    for (const line of (0, constants_1.commandCenterAccessTierLines)())
+        out.log(out.dim(line));
     // Admin (T3) token — mission-control's operator write/gate surface reads it.
     // #54: a LOCAL (loopback) daemon grants full trust tokenless, so a tokenless
     // board is fully functional locally; only a REMOTE / 0.0.0.0 daemon requires the
@@ -105,8 +114,13 @@ async function commandCenterCommand(args) {
         out.log(out.dim(`  ${config_1.ENV.HTTP_ADMIN_TOKEN} not set — fine for a local (loopback) daemon (full trust). ` +
             'Set it only if this board drives a remote / 0.0.0.0 daemon.'));
     }
+    // #791 — NOT a warning: a missing API key is an expected, fully-supported
+    // state. The board + operator controls work regardless; point at the `/login`
+    // zero-API-key planner path (Claude Pro/Max OAuth) rather than implying a
+    // degraded fallback.
     if (!process.env.ANTHROPIC_API_KEY) {
-        out.warn('ANTHROPIC_API_KEY is not set — the Pi command-center will fall back to Pi\'s own auth/default model.');
+        out.log(out.dim('  ANTHROPIC_API_KEY not set — the board + operator controls still work. ' +
+            'Run /login inside the board to enable the LLM planner on your Claude subscription (zero API key).'));
     }
     const temporalEnvVars = {
         [config_1.ENV.TEMPORAL_ADDRESS]: config.temporalAddress,

package/dist/cli/commands.d.ts

@@ -50,6 +50,14 @@ interface UpOpts extends CliOverrides {
      * can't exist there anyway (gate 3 in recruit pre-flight).
      */
     scenario?: string;
+    /**
+     * #786 — `up --from-upgrade`. Recreate protocol-2 workflows from the
+     * `upgrade-snapshot-v1.json` left by `upgrade-to-2`, instead of starting a
+     * fresh ensemble. Recreates the roster (structural essentials only),
+     * surfaces undelivered cues for review, and archives the snapshot on
+     * success. Ignores `--lineup` / conductor-spawn flags.
+     */
+    fromUpgrade?: boolean;
 }
 /**
  * #832 — the operator-facing "ensemble ready" lines for `up` / `conduct`.

package/dist/cli/commands.js

@@ -1060,6 +1060,71 @@ function formatEnsembleReadyLines(ensemble, lineupName, playerCount) {
         `Connect: agent-tempo command-center ${ensemble}`,
     ];
 }
+/**
+ * #786 — `up --from-upgrade` orchestration. Opens a Temporal client, recreates
+ * protocol-2 workflows from `upgrade-snapshot-v1.json`, prints the outcome
+ * (incl. undelivered cues surfaced for review — NEVER redelivered), and
+ * archives the snapshot on success. Separated from `up()` so the I/O is in one
+ * place; the recreation logic itself lives (testably) in
+ * `src/upgrade/from-upgrade.ts`.
+ */
+async function runFromUpgradeFlow(config) {
+    const { runFromUpgrade } = await Promise.resolve().then(() => __importStar(require('../upgrade/from-upgrade')));
+    const { SnapshotValidationError } = await Promise.resolve().then(() => __importStar(require('../upgrade/snapshot-v1')));
+    out.heading('agent-tempo up --from-upgrade');
+    const connection = await (0, connection_1.createTemporalConnection)(config);
+    const client = new client_1.Client({ connection, namespace: config.temporalNamespace });
+    try {
+        const result = await runFromUpgrade(client, {
+            home: config_1.AGENT_TEMPO_HOME,
+            taskQueue: config.taskQueue,
+            temporalAddress: config.temporalAddress,
+            temporalNamespace: config.temporalNamespace,
+            log: (...args) => out.dim('  ' + args.map(String).join(' ')),
+        });
+        if (!result.snapshotFound) {
+            out.warn(`No upgrade snapshot found in ${config_1.AGENT_TEMPO_HOME}.`);
+            out.log(`  Run \`agent-tempo upgrade-to-2\` on the 1.x install first.`);
+            return;
+        }
+        out.success(`Recreated ${result.workflowsCreated} protocol-2 workflow(s) across ` +
+            `${result.ensemblesRecreated} ensemble(s).`);
+        if (result.undeliveredCues.length > 0) {
+            out.log('');
+            out.warn(`${result.undeliveredCues.length} undelivered cue(s) — review (NOT redelivered):`);
+            for (const c of result.undeliveredCues) {
+                const preview = c.text.length > 120 ? c.text.slice(0, 117) + '…' : c.text;
+                out.log(`  [${c.ensemble}] ${c.from} → ${c.playerId} (${c.timestamp}): ${preview}`);
+            }
+        }
+        if (result.failures.length > 0) {
+            out.log('');
+            out.error(`${result.failures.length} workflow(s) failed to recreate — snapshot left in place for retry:`);
+            for (const f of result.failures)
+                out.log(`  ${f.workflowId}: ${f.error}`);
+            process.exitCode = 1;
+            return;
+        }
+        if (result.archived) {
+            out.dim(`  Snapshot archived → ${result.archivePath}`);
+        }
+        out.log('');
+        out.log('  Continuity seeding (state slots / schedules / sessionId / model) is a');
+        out.log('  tracked #786 fast-follow — recreated sessions are structural skeletons.');
+    }
+    catch (err) {
+        // A malformed snapshot is a LOUD failure (never a silent skip).
+        if (err instanceof SnapshotValidationError) {
+            out.error(`Upgrade snapshot is corrupt — refusing to proceed: ${err.message}`);
+            process.exitCode = 1;
+            return;
+        }
+        throw err;
+    }
+    finally {
+        await connection.close().catch(() => { });
+    }
+}
 async function up(opts) {
     const config = (0, config_1.getConfig)(opts);
     // #689 — best-effort sweep of stale 0600 secret env files (residual from a shell
@@ -1111,6 +1176,16 @@ async function up(opts) {
         out.log(`  ${out.dim('You can start it manually: agent-tempo daemon start')}`);
         process.exit(1);
     }
+    // #786 — `up --from-upgrade`: recreate protocol-2 workflows from the snapshot
+    // left by `upgrade-to-2`, then stop. Runs AFTER ensureInfra (Temporal + daemon
+    // up, so the recreated workflows have live workers AND the daemon's boot guard
+    // has already verified a clean cutover) but instead of the lineup/conductor
+    // spawn flow. Continuity seeding (#334 state / schedules / sessionId / model)
+    // is a tracked #786 fast-follow — this MVP recreates structural skeletons only.
+    if (opts.fromUpgrade) {
+        await runFromUpgradeFlow(config);
+        return;
+    }
     // Step 4: Register MCP server if needed
     if ((0, mcp_1.isMcpConfigured)(process.cwd())) {
         out.check('MCP configured', true);
@@ -1907,12 +1982,8 @@ async function down(opts) {
  * Returns a formatted string like " (pid 12345)" or "" if no PID file found.
  */
 function getBridgePidInfo(ensemble, name) {
-    // #690 — pid lives at the CENTRAL ~/.agent-tempo/logs/<ensemble>/ path; transitional
-    // READ-ONLY fallback to the legacy per-cwd ./logs for a pre-upgrade bridge.
-    // TODO(v1.7): drop the legacy fallback.
-    const centralPid = (0, config_1.bridgeLogPaths)(ensemble, name).pidPath;
-    const legacyPid = (0, path_1.join)(process.cwd(), 'logs', `${name}.pid`);
-    const pidPath = (0, fs_1.existsSync)(centralPid) ? centralPid : legacyPid;
+    // #690 — pid lives at the CENTRAL ~/.agent-tempo/logs/<ensemble>/ path.
+    const pidPath = (0, config_1.bridgeLogPaths)(ensemble, name).pidPath;
     if (!(0, fs_1.existsSync)(pidPath))
         return '';
     try {
@@ -1946,13 +2017,10 @@ function getBridgePidInfo(ensemble, name) {
  * — do NOT reuse this global scan-all from a scoped op: it would kill OTHER live
  * ensembles' bridges. The param is intentionally NOT added now (no caller needs it
  * = speculative; backlogged per the architect's deviation ruling).
- *
- * Plus a transitional READ of the legacy per-cwd `./logs` for a pre-upgrade
- * bridge. TODO(v1.7): drop the legacy `./logs` dir.
  */
 function killBridgeProcesses() {
     const centralRoot = (0, config_1.bridgeLogsRoot)();
-    const dirs = [(0, path_1.join)(process.cwd(), 'logs')]; // legacy (transitional)
+    const dirs = [];
     try {
         for (const ent of (0, fs_1.readdirSync)(centralRoot, { withFileTypes: true })) {
             if (ent.isDirectory())
@@ -1960,7 +2028,7 @@ function killBridgeProcesses() {
         }
     }
     catch {
-        // no central logs root yet — nothing central to scan
+        // no central logs root yet — nothing to scan
     }
     for (const logsDir of dirs) {
         if (!(0, fs_1.existsSync)(logsDir))

package/dist/cli/daemon-command.js

@@ -371,28 +371,20 @@ async function daemonInstall() {
 async function daemonUninstall() {
     const platform = process.platform;
     if (platform === 'linux') {
-        // Backward-compat: clean up either the new (`agent-tempo.service`) or
-        // legacy (`agent-tempo.service`) unit so v0.x installs migrate cleanly.
         const dirSystemd = (0, path_1.join)((0, os_1.homedir)(), '.config', 'systemd', 'user');
-        const dstNew = (0, path_1.join)(dirSystemd, 'agent-tempo.service');
-        const dstLegacy = (0, path_1.join)(dirSystemd, 'agent-tempo.service');
-        for (const svc of ['agent-tempo', 'agent-tempo']) {
-            try {
-                (0, child_process_1.execFileSync)('systemctl', ['--user', 'disable', '--now', svc], { stdio: 'ignore' });
-            }
-            catch { /* may not be running */ }
+        const dst = (0, path_1.join)(dirSystemd, 'agent-tempo.service');
+        try {
+            (0, child_process_1.execFileSync)('systemctl', ['--user', 'disable', '--now', 'agent-tempo'], { stdio: 'ignore' });
         }
-        let removed = false;
+        catch { /* may not be running */ }
         try {
-            for (const dst of [dstNew, dstLegacy]) {
-                if ((0, fs_1.existsSync)(dst)) {
-                    (0, fs_1.unlinkSync)(dst);
-                    out.success(`Removed ${dst}`);
-                    removed = true;
-                }
+            if ((0, fs_1.existsSync)(dst)) {
+                (0, fs_1.unlinkSync)(dst);
+                out.success(`Removed ${dst}`);
             }
-            if (!removed)
+            else {
                 out.log('No systemd unit file found.');
+            }
         }
         catch (err) {
             out.error(`Failed to remove systemd unit: ${err?.message ?? err}`);
@@ -401,24 +393,18 @@ async function daemonUninstall() {
         return;
     }
     if (platform === 'darwin') {
-        // Backward-compat: clean up either the new (`com.agent.tempo.plist`) or
-        // legacy (`com.claude.tempo.plist`) plist so v0.x installs migrate cleanly.
-        const dstNew = (0, path_1.join)((0, os_1.homedir)(), 'Library', 'LaunchAgents', 'com.agent.tempo.plist');
-        const dstLegacy = (0, path_1.join)((0, os_1.homedir)(), 'Library', 'LaunchAgents', 'com.claude.tempo.plist');
-        let removed = false;
-        for (const dst of [dstNew, dstLegacy]) {
-            try {
-                (0, child_process_1.execFileSync)('launchctl', ['unload', dst], { stdio: 'ignore' });
-            }
-            catch { /* may not be loaded */ }
-            if ((0, fs_1.existsSync)(dst)) {
-                (0, fs_1.unlinkSync)(dst);
-                out.success(`Removed ${dst}`);
-                removed = true;
-            }
+        const dst = (0, path_1.join)((0, os_1.homedir)(), 'Library', 'LaunchAgents', 'com.agent.tempo.plist');
+        try {
+            (0, child_process_1.execFileSync)('launchctl', ['unload', dst], { stdio: 'ignore' });
         }
-        if (!removed)
+        catch { /* may not be loaded */ }
+        if ((0, fs_1.existsSync)(dst)) {
+            (0, fs_1.unlinkSync)(dst);
+            out.success(`Removed ${dst}`);
+        }
+        else {
             out.log('No launchd plist found.');
+        }
         return;
     }
     if (platform === 'win32') {