agent-tempo 1.7.0 → 2.0.0-beta.2

package/dist/http/event-types.d.ts

@@ -47,6 +47,29 @@ export interface HealthV1 {
      * semantics. Optional so legacy clients ignoring the field don't break.
      */
     memory?: MemoryUsageV1;
+    /**
+     * #886 slice 1 — daemon-side nondeterminism alarm state. Present when the
+     * daemon installed the alarm (always, in 2.0+); a non-zero `count` means a
+     * nondeterminism / determinism-violation flap was observed since boot (e.g.
+     * a 2.0 worker replaying a 1.x history, or a code/bundle skew). Lets external
+     * monitors and the dashboard poll the alarm without scraping `daemon.log`.
+     * Optional so pre-#886 clients (and non-daemon health responders) ignore it.
+     */
+    nondeterminism?: NondeterminismAlarmV1;
+}
+/** #886 — `/v1/health` shape of the nondeterminism alarm snapshot. */
+export interface NondeterminismAlarmV1 {
+    /** Total nondeterminism records seen since daemon boot (0 = healthy). */
+    count: number;
+    /** ISO timestamp of the first hit; absent when `count === 0`. */
+    firstSeenAt?: string;
+    /** ISO timestamp of the most recent hit; absent when `count === 0`. */
+    lastSeenAt?: string;
+    /** Most-recent samples (capped, newest last) — `{ at, detail }`. */
+    recent: Array<{
+        at: string;
+        detail: string;
+    }>;
 }
 /** Snapshot of `process.memoryUsage()` at request time. All values in bytes. */
 export interface MemoryUsageV1 {
@@ -208,6 +231,16 @@ export interface PlayerSummaryV1 {
     contextTokens?: number;
     /** 3c Tier-1 coarse — context usage as a percentage of the model window. Additive. */
     contextPercent?: number;
+    /**
+     * #886 slice 2 — `true` when the daemon's observation scan could only produce
+     * a DEGRADED row for this player: the session workflow was listed but its
+     * metadata extraction failed, so the non-identity fields (part/workDir/phase/…)
+     * are best-effort blanks. Lets the dashboard/board render an "uncertain" badge
+     * instead of dropping the player, which would read as a departure and cause
+     * roster flapping (contra #777). Additive + optional per the §6 stability rule;
+     * absent on every healthy row.
+     */
+    degraded?: boolean;
 }
 /**
  * The eventId token used in the `id:` line of the SSE frame and as the
@@ -242,10 +275,11 @@ export type EventIdToken = string;
  *   - `'stale'` — matches a host with `freshness === 'stale'`
  *   - `'missing'` — `preferredHost` is null OR no matching host record
  *
- * `migrateCommand` is the TUI slash-command the operator pastes into their
- * own session on the migrate target. `--yes-steal=` (NOT
- * `--confirm-steal-from-host`) is the actual flag accepted by
- * `src/tui/commands.ts:handleMigrate`. When `preferredHost` is null the
+ * `migrateCommand` is the `/migrate` slash-command the operator pastes into
+ * their own session on the migrate target (the command-center board; the Ink
+ * TUI that originally handled it was removed in #789). `--yes-steal=` (NOT
+ * `--confirm-steal-from-host`) is the actual flag the `/migrate` handler
+ * accepts. When `preferredHost` is null the
  * command targets the local host and includes the steal guard pre-filled
  * with the last-known host (or a literal `'(unknown)'` when even that is
  * missing — the operator must edit it before submit).

package/dist/http/orphans.d.ts

@@ -30,9 +30,9 @@ import type { TempoClient } from '../client/interface';
 import type { HostInfo } from '../types';
 import type { OrphanCandidate } from '../reconcile/orphans';
 /**
- * Render the TUI `/migrate` slash command the operator pastes into their
- * own session to recover an orphan. Wording mirrors
- * `src/tui/commands.ts:handleMigrate` exactly:
+ * Render the `/migrate` slash command the operator pastes into their own
+ * session to recover an orphan (the command-center board; the Ink TUI that
+ * originally handled it was removed in #789). Wording:
  *   - positional `<playerId> <host>`
  *   - flag form `--yes-steal=<currentHost>` (NOT `--confirm-steal-from-host`)
  *

package/dist/http/orphans.js

@@ -6,9 +6,9 @@ exports.buildOrphansResponse = buildOrphansResponse;
 exports.handleOrphans = handleOrphans;
 const responses_1 = require("./responses");
 /**
- * Render the TUI `/migrate` slash command the operator pastes into their
- * own session to recover an orphan. Wording mirrors
- * `src/tui/commands.ts:handleMigrate` exactly:
+ * Render the `/migrate` slash command the operator pastes into their own
+ * session to recover an orphan (the command-center board; the Ink TUI that
+ * originally handled it was removed in #789). Wording:
  *   - positional `<playerId> <host>`
  *   - flag form `--yes-steal=<currentHost>` (NOT `--confirm-steal-from-host`)
  *

package/dist/http/server.d.ts

@@ -61,11 +61,6 @@ export interface HttpServerOptions {
      * don't fight production daemons running on the same machine.
      */
     portFilePath?: string;
-    /**
-     * @deprecated 3e — back-compat alias for {@link readToken}. A single injected
-     * bearer is treated as the READ token (T1). Prefer `readToken`/`adminToken`.
-     */
-    httpToken?: string;
     /** 3e — inject the read-tier (T1) token directly (tests). Overrides config/env. */
     readToken?: string;
     /** 3e — inject the admin (T1+T2+T3) token directly (tests). Overrides env. */

package/dist/http/server.js

@@ -72,6 +72,10 @@ const action_counters_1 = require("../utils/action-counters");
 const snapshot_1 = require("./snapshot");
 const orphans_1 = require("./orphans");
 const sse_handler_1 = require("./sse-handler");
+// #886 slice 1 — surface the daemon nondeterminism alarm on /v1/health. The
+// alarm core is Temporal-VALUE-free, so this import doesn't pull the worker
+// runtime into the HTTP layer.
+const nondeterminism_alarm_1 = require("../observability/nondeterminism-alarm");
 const log = (...args) => console.error(`[agent-tempo:http ${new Date().toISOString()}]`, ...args);
 /** Default bind addr per SSE-PROTOCOL.md §1. */
 exports.DEFAULT_BIND_ADDR = '127.0.0.1';
@@ -103,42 +107,22 @@ async function startHttpServer(opts) {
     // generation now so the daemon doesn't crash mid-request when the first
     // bearer-required call shows up.
     const bindIsLoopback = (0, auth_1.isLoopbackBindAddr)(bindAddr);
-    // 3e RBAC token resolution. Back-compat: a single `httpToken` option (or a
-    // legacy config.json `httpToken`) is adopted as the READ token (T1); the ADMIN
-    // token is env-var-only. Explicit `readToken`/`adminToken` options override
-    // (used by tests). loopback bind ⇒ no bearer required ⇒ tokens may be null.
-    let readToken;
-    let legacyMigrated = false;
-    if (opts.readToken !== undefined) {
-        readToken = opts.readToken;
-    }
-    else if (opts.httpToken !== undefined) {
-        // Back-compat: a single injected bearer is treated as the READ token (T1).
-        readToken = opts.httpToken;
-    }
-    else {
-        const loaded = (0, auth_1.loadReadToken)({ bearerRequired: !bindIsLoopback });
-        readToken = loaded.token;
-        legacyMigrated = loaded.legacy;
-    }
+    // 3e RBAC token resolution. The READ token (T1) comes from the explicit
+    // `readToken` option (tests) or env/config/auto-gen; the ADMIN token is
+    // env-var-only. loopback bind ⇒ no bearer required ⇒ tokens may be null.
+    const readToken = opts.readToken !== undefined
+        ? opts.readToken
+        : (0, auth_1.loadReadToken)({ bearerRequired: !bindIsLoopback });
     const adminToken = opts.adminToken ?? (0, auth_1.loadAdminToken)();
     if (!bindIsLoopback && !readToken) {
         throw new Error('Bearer token required for non-loopback bind but none configured. ' +
             'Set AGENT_TEMPO_HTTP_READ_TOKEN (or readToken in ~/.agent-tempo/config.json), ' +
             'or unset AGENT_TEMPO_HTTP_BIND.');
     }
-    // 3e MD-E — one-time startup warnings (non-blocking).
+    // 3e MD-E — one-time startup warning (non-blocking).
     //
-    // (1) Legacy migration: a pre-3e single `httpToken` was adopted as the READ
-    //     token (T1) and no admin token is configured, so writes / inner-tail
-    //     (all Tier ≥ 2) will 503 until an admin token is set.
-    if (legacyMigrated && adminToken === null) {
-        log('NOTICE: adopted legacy config.json `httpToken` as the read-tier token. ' +
-            'Writes and the inner-tail are admin-only and will return ' +
-            '503 until you set AGENT_TEMPO_HTTP_ADMIN_TOKEN (env-var only).');
-    }
-    // (2) Plaintext-bearer exposure: binding to a non-loopback address serves the
-    //     bearer token over cleartext HTTP. Suppressible, never blocking.
+    // Plaintext-bearer exposure: binding to a non-loopback address serves the
+    // bearer token over cleartext HTTP. Suppressible, never blocking.
     if (!bindIsLoopback && process.env[config_1.ENV.TLS_ACKNOWLEDGED] !== '1') {
         log(`WARNING: binding to non-loopback ${bindAddr} serves the bearer token over ` +
             'plaintext HTTP. Terminate TLS at a reverse proxy, or tunnel via SSH/Tailscale. ' +
@@ -433,6 +417,37 @@ async function handle(req, res, ctx) {
         }
         return (0, coat_check_1.handleCoatCheckGet)(res, ctx.client, ensemble, ticket);
     }
+    // #742 — per-player attachment-info read (`/attachment-info` board command).
+    // 2-segment GET; MUST be matched BEFORE the generic writeMatch below, which
+    // would otherwise 404 `attachment-info` as an unknown write action. The
+    // player is a `?playerId=` query param (the path stays ensemble-scoped).
+    const attachmentInfoMatch = pathname.match(/^\/v1\/ensembles\/([^/]+)\/attachment-info$/);
+    if (attachmentInfoMatch) {
+        const ensemble = decodeURIComponent(attachmentInfoMatch[1]);
+        if (!gateTier(1))
+            return; // L3 — read (Tier 1).
+        if (method !== 'GET') {
+            return (0, responses_1.errorResponse)(res, 405, { error: 'method-not-allowed' }, { Allow: 'GET, OPTIONS' });
+        }
+        const playerId = url.searchParams.get('playerId');
+        if (!playerId)
+            return (0, responses_1.errorResponse)(res, 400, { error: 'missing-field', field: 'playerId' });
+        return handleAttachmentInfo(res, ctx, ensemble, playerId);
+    }
+    // #742 — active-schedule listing (`/schedule list` board command). 2-segment
+    // GET; same ordering rationale as attachment-info (precede writeMatch). The
+    // schedule WRITE path is the `unschedule` write action below + the MCP
+    // `schedule` tool for create (no thin-shim create method on the client).
+    const schedulesMatch = pathname.match(/^\/v1\/ensembles\/([^/]+)\/schedules$/);
+    if (schedulesMatch) {
+        const ensemble = decodeURIComponent(schedulesMatch[1]);
+        if (!gateTier(1))
+            return; // L3 — read (Tier 1).
+        if (method !== 'GET') {
+            return (0, responses_1.errorResponse)(res, 405, { error: 'method-not-allowed' }, { Allow: 'GET, OPTIONS' });
+        }
+        return handleSchedules(res, ctx, ensemble);
+    }
     // Write surface (PR-7a of #340) — POST `/v1/ensembles/:ensemble/<action>`
     // Match BEFORE the GET-only method gate; everything else (POST to a
     // read endpoint, GET to a write endpoint) flows into the 405 fallback
@@ -695,6 +710,12 @@ function handleHealth(res, ctx) {
             external: mem.external,
             arrayBuffers: mem.arrayBuffers,
         },
+        // #886 slice 1 — nondeterminism alarm snapshot (present when the daemon
+        // installed the alarm; `count > 0` signals an observed flap since boot).
+        ...(() => {
+            const snap = (0, nondeterminism_alarm_1.getGlobalNondeterminismAlarm)()?.snapshot();
+            return snap ? { nondeterminism: snap } : {};
+        })(),
     };
     // Best-effort ensemble count — soft-fail to 0 rather than 500ing on a
     // healthcheck. `/v1/health` MUST stay reachable even when Temporal is
@@ -718,6 +739,35 @@ async function handleHosts(res, ctx) {
     const hosts = await ctx.client.listHosts();
     (0, responses_1.jsonResponse)(res, 200, hosts);
 }
+/**
+ * #742 — a player's V2 attachment-lifecycle snapshot. Thin shim over
+ * `client.attachmentInfo`; the command-center `/attachment-info` board command
+ * renders the payload via the shared `formatAttachmentInfoForDisplay`. A 404 is
+ * surfaced when the player's session can't be resolved (it throws "No session
+ * found …", mirroring the recall not-found contract).
+ */
+async function handleAttachmentInfo(res, ctx, ensemble, playerId) {
+    try {
+        const info = await ctx.client.attachmentInfo(ensemble, playerId);
+        (0, responses_1.jsonResponse)(res, 200, info);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (/no session found|not found/i.test(message)) {
+            return (0, responses_1.errorResponse)(res, 404, { error: 'session-not-found', ensemble, playerId, detail: message });
+        }
+        throw err;
+    }
+}
+/**
+ * #742 — active-schedule listing. Thin shim over `client.getSchedules` (which
+ * already degrades to `[]` when no scheduler is running). The command-center
+ * `/schedule [list]` board command renders the entries.
+ */
+async function handleSchedules(res, ctx, ensemble) {
+    const schedules = await ctx.client.getSchedules(ensemble);
+    (0, responses_1.jsonResponse)(res, 200, schedules);
+}
 /**
  * #753 — daemon-process per-source Temporal action counters. Pure in-memory
  * read (zero Temporal calls); adapter and Pi processes self-report via their

package/dist/http/snapshot.js

@@ -108,6 +108,9 @@ function toPlayerSummaryV1(p, wireMeta = null) {
         ...(wireMeta?.coarse?.currentTool !== undefined ? { currentTool: wireMeta.coarse.currentTool } : {}),
         ...(wireMeta?.coarse?.contextTokens !== undefined ? { contextTokens: wireMeta.coarse.contextTokens } : {}),
         ...(wireMeta?.coarse?.contextPercent !== undefined ? { contextPercent: wireMeta.coarse.contextPercent } : {}),
+        // #886 slice 2 — carry the degraded/uncertain flag onto the wire so the
+        // dashboard/board can badge the player instead of dropping it (anti-flap).
+        ...(p.degraded ? { degraded: true } : {}),
     };
 }
 /**

package/dist/http/writes.d.ts

@@ -42,7 +42,7 @@ export { WRITE_BODY_MAX };
  *   mutations. Bodies are uniform `{ playerId, reason? }` (plus per-action
  *   extras); the ensemble lives in the URL.
  */
-export declare const WRITE_ACTIONS: readonly ["cue", "pause", "play", "release", "recruit", "restart", "reset", "destroy", "detach", "recall", "shutdown"];
+export declare const WRITE_ACTIONS: readonly ["cue", "pause", "play", "release", "recruit", "restart", "reset", "destroy", "detach", "recall", "unschedule", "shutdown"];
 export type WriteAction = (typeof WRITE_ACTIONS)[number];
 /** Type guard — narrows an arbitrary string to a known `WriteAction`. */
 export declare function isWriteAction(s: string): s is WriteAction;

package/dist/http/writes.js

@@ -31,6 +31,7 @@ exports.WRITE_ACTIONS = [
     'destroy',
     'detach',
     'recall',
+    'unschedule',
     'shutdown',
 ];
 /** Type guard — narrows an arbitrary string to a known `WriteAction`. */
@@ -69,6 +70,7 @@ async function handleWriteRoute(req, res, client, ensemble, action) {
             case 'destroy': return await handleDestroy(res, client, ensemble, body);
             case 'detach': return await handleDetach(res, client, ensemble, body);
             case 'recall': return await handleRecall(res, client, ensemble, body);
+            case 'unschedule': return await handleUnschedule(res, client, ensemble, body);
             case 'shutdown': return await handleShutdown(res, client, ensemble, body);
         }
     }
@@ -242,12 +244,33 @@ async function handleRecall(res, client, ensemble, body) {
     // The dashboard's `RecallResult` consumer expects a count, not the raw
     // arrays — projecting `received` + `sent` lengths here keeps the wire
     // payload tight and avoids leaking inbox + sent-history shape into the
-    // browser-side type. Callers wanting the full timeline use the MCP
-    // `recall` tool / TempoClient method directly.
+    // browser-side type. Callers wanting the full timeline pass `{ full: true }`
+    // (the command-center `/recall` board command, #742) or use the MCP `recall`
+    // tool / TempoClient method directly.
     const result = await client.recall(ensemble, playerId);
+    if (body.full === true) {
+        // Full timeline — the operator board feeds this through the shared
+        // `buildTimeline`/`formatRecall` helpers, same as the MCP tool. Kept behind
+        // an opt-in flag so the count-only default stays the dashboard's shape.
+        return (0, responses_1.jsonResponse)(res, 200, { ok: true, ensemble, playerId, received: result.received, sent: result.sent });
+    }
     const messages = result.received.length + result.sent.length;
     (0, responses_1.jsonResponse)(res, 200, { ok: true, ensemble, playerId, messages });
 }
+/**
+ * Cancel a named schedule (#742 — the command-center `/unschedule` &
+ * `/schedule delete`). Thin shim over `client.cancelSchedule`. Body is
+ * `{ name }` (the schedule key), distinct from the per-player `{ playerId }`
+ * shape — schedules are ensemble-scoped, keyed by name. 200 (the cancel IS
+ * the operation, not a queued effect).
+ */
+async function handleUnschedule(res, client, ensemble, body) {
+    const name = (0, body_1.stringField)(body, 'name');
+    if (!name)
+        return (0, responses_1.errorResponse)(res, 400, { error: 'missing-field', field: 'name' });
+    await client.cancelSchedule(ensemble, name);
+    (0, responses_1.jsonResponse)(res, 200, { ok: true, ensemble, name });
+}
 /**
  * Ensemble teardown (#700 P1) — the HTTP verb the command-center `/ensemble-down`
  * needs (the CLI `down` + the `shutdown` MCP tool cover this, but neither was

package/dist/observability/nondeterminism-alarm.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Nondeterminism alarm (#886 slice 1).
+ *
+ * The #801 incident produced **57 workflow-task failures in 3 minutes with
+ * ZERO operator signal** — a nondeterminism flap (a 2.0 worker replaying a
+ * 1.x-recorded history, or a code/bundle skew) surfaces only as Temporal's
+ * own `WARN`-level Core log line, buried in `daemon.log` among normal chatter.
+ * Nothing NAMED the flap, counted it, or raised its severity.
+ *
+ * This module gives the daemon a tiny, process-global counter that:
+ *   1. Intercepts Temporal Runtime log records (via {@link wrapLoggerWithAlarm},
+ *      installed in the daemon's `Runtime.install({ logger })`).
+ *   2. Classifies nondeterminism / determinism-violation records
+ *      ({@link isNondeterminismLog}) — wording-tolerant, like the SA-preflight
+ *      marker set, so a Core/SDK phrasing change can't silently disarm it.
+ *   3. PROMOTES each hit to a prominent, greppable `[agent-tempo:ALARM]` line
+ *      with a running count — so a flap is named the instant it starts.
+ *   4. Keeps a small rolling snapshot ({@link NondeterminismAlarm.snapshot})
+ *      surfaced on `GET /v1/health` so external monitors / the dashboard can
+ *      poll the alarm state without scraping logs.
+ *
+ * **Temporal-VALUE-free by design:** this module imports only the `Logger`
+ * TYPE from `@temporalio/common` (erased at compile). The worker `Runtime` /
+ * `DefaultLogger` VALUES are imported by the daemon, which wraps a real logger
+ * with {@link wrapLoggerWithAlarm} and installs it. That keeps the HTTP layer
+ * (`/v1/health`) able to read {@link getGlobalNondeterminismAlarm} without
+ * pulling `@temporalio/worker` into the HTTP module graph.
+ *
+ * NOTE: daemon-side observability code — NOT workflow code — so `Date`/clocks
+ * are fine here; `now` is injected purely for deterministic unit tests.
+ */
+import type { Logger, LogMetadata } from '@temporalio/common';
+/**
+ * Substrings (matched case-insensitively against the log message) that mark a
+ * nondeterminism / determinism-violation record. A SET rather than one phrase
+ * because the exact wording varies across Core (Rust) and SDK (JS) sources and
+ * versions — `DeterminismViolationError` surfaces "Replay failed with a
+ * nondeterminism error", Core forwards a `WARN` referencing nondeterminism, and
+ * Temporal surfaces the incident class under the `TMPRL1100` code. Matching a
+ * set keeps the alarm armed across phrasing drift (same rationale as
+ * `UNREGISTERED_SA_MARKERS` in `sa-preflight.ts`).
+ */
+export declare const NONDETERMINISM_MARKERS: readonly string[];
+/** A single recorded nondeterminism hit (most-recent-N kept by the alarm). */
+export interface NondeterminismSample {
+    /** ISO timestamp of the hit. */
+    at: string;
+    /** Best-effort detail: workflow type / id from log meta + a message snippet. */
+    detail: string;
+}
+/** Pollable alarm state — embedded in `GET /v1/health` (`HealthV1.nondeterminism`). */
+export interface NondeterminismAlarmSnapshot {
+    /** Total nondeterminism records seen since daemon boot. */
+    count: number;
+    /** ISO timestamp of the first hit, or `undefined` when count === 0. */
+    firstSeenAt?: string;
+    /** ISO timestamp of the most recent hit, or `undefined` when count === 0. */
+    lastSeenAt?: string;
+    /** Most-recent samples (capped), newest last. */
+    recent: NondeterminismSample[];
+}
+export interface NondeterminismAlarmOpts {
+    /** Injectable clock (epoch ms) — defaults to `Date.now`. Test seam only. */
+    now?: () => number;
+    /**
+     * Promotion sink — invoked on EVERY hit with the running count + sample, so
+     * the daemon can emit the prominent `[agent-tempo:ALARM]` line. Defaults to a
+     * no-op; the daemon passes a `console.error`-backed promoter. Kept injectable
+     * so unit tests can assert promotion without capturing stderr.
+     */
+    onHit?: (count: number, sample: NondeterminismSample) => void;
+}
+/**
+ * Process-global nondeterminism counter. One per daemon. Records hits, promotes
+ * each, and exposes a rolling snapshot.
+ */
+export declare class NondeterminismAlarm {
+    private _count;
+    private _firstSeenAt?;
+    private _lastSeenAt?;
+    private readonly _recent;
+    private readonly now;
+    private readonly onHit;
+    constructor(opts?: NondeterminismAlarmOpts);
+    /** Record one nondeterminism hit from a log record. */
+    record(message: string, meta?: LogMetadata): void;
+    /** Current count (total hits since boot). */
+    get count(): number;
+    /** Immutable snapshot for `/v1/health`. */
+    snapshot(): NondeterminismAlarmSnapshot;
+}
+/**
+ * True when a log record (its message) signals a nondeterminism / determinism
+ * violation. Case-insensitive substring match over {@link NONDETERMINISM_MARKERS}.
+ */
+export declare function isNondeterminismLog(message: string, _meta?: LogMetadata): boolean;
+/**
+ * Wrap a base {@link Logger} so every record still flows to `base`, but any
+ * `WARN`/`ERROR` record matching {@link isNondeterminismLog} also feeds the
+ * alarm. Transparent: trace/debug/info pass straight through; warn/error/log are
+ * classified first, then forwarded unchanged.
+ *
+ * Only `WARN`/`ERROR` are inspected — a nondeterminism failure is always logged
+ * at one of those levels, and ignoring lower levels avoids a hot classifier on
+ * the (high-volume) debug/trace path.
+ */
+export declare function wrapLoggerWithAlarm(base: Logger, alarm: NondeterminismAlarm): Logger;
+/** Set the process-global alarm (daemon boot only). */
+export declare function setGlobalNondeterminismAlarm(alarm: NondeterminismAlarm): void;
+/** Read the process-global alarm, or `undefined` if not installed (e.g. tests, non-daemon). */
+export declare function getGlobalNondeterminismAlarm(): NondeterminismAlarm | undefined;
+/** Test seam — reset the singleton between unit tests. */
+export declare function __resetGlobalNondeterminismAlarmForTests(): void;

package/dist/observability/nondeterminism-alarm.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NondeterminismAlarm = exports.NONDETERMINISM_MARKERS = void 0;
+exports.isNondeterminismLog = isNondeterminismLog;
+exports.wrapLoggerWithAlarm = wrapLoggerWithAlarm;
+exports.setGlobalNondeterminismAlarm = setGlobalNondeterminismAlarm;
+exports.getGlobalNondeterminismAlarm = getGlobalNondeterminismAlarm;
+exports.__resetGlobalNondeterminismAlarmForTests = __resetGlobalNondeterminismAlarmForTests;
+/**
+ * Substrings (matched case-insensitively against the log message) that mark a
+ * nondeterminism / determinism-violation record. A SET rather than one phrase
+ * because the exact wording varies across Core (Rust) and SDK (JS) sources and
+ * versions — `DeterminismViolationError` surfaces "Replay failed with a
+ * nondeterminism error", Core forwards a `WARN` referencing nondeterminism, and
+ * Temporal surfaces the incident class under the `TMPRL1100` code. Matching a
+ * set keeps the alarm armed across phrasing drift (same rationale as
+ * `UNREGISTERED_SA_MARKERS` in `sa-preflight.ts`).
+ */
+exports.NONDETERMINISM_MARKERS = Object.freeze([
+    'nondetermin',
+    'non-determin',
+    'determinismviolation',
+    'tmprl1100',
+]);
+/** Max recent samples retained for the `/v1/health` snapshot. */
+const RECENT_CAP = 10;
+/** Max message characters kept per sample (logs can be long stack-y blobs). */
+const DETAIL_SNIPPET_MAX = 200;
+/**
+ * Process-global nondeterminism counter. One per daemon. Records hits, promotes
+ * each, and exposes a rolling snapshot.
+ */
+class NondeterminismAlarm {
+    _count = 0;
+    _firstSeenAt;
+    _lastSeenAt;
+    _recent = [];
+    now;
+    onHit;
+    constructor(opts = {}) {
+        this.now = opts.now ?? (() => Date.now());
+        this.onHit = opts.onHit ?? (() => { });
+    }
+    /** Record one nondeterminism hit from a log record. */
+    record(message, meta) {
+        const at = new Date(this.now()).toISOString();
+        this._count += 1;
+        if (this._firstSeenAt === undefined)
+            this._firstSeenAt = at;
+        this._lastSeenAt = at;
+        const sample = { at, detail: buildDetail(message, meta) };
+        this._recent.push(sample);
+        if (this._recent.length > RECENT_CAP)
+            this._recent.shift();
+        // Promote — fire the prominent, greppable alarm line (the whole point: the
+        // #801 flap produced zero operator signal). Never let a throwing sink eat
+        // the count.
+        try {
+            this.onHit(this._count, sample);
+        }
+        catch {
+            /* a broken promoter must not disarm the counter */
+        }
+    }
+    /** Current count (total hits since boot). */
+    get count() {
+        return this._count;
+    }
+    /** Immutable snapshot for `/v1/health`. */
+    snapshot() {
+        return {
+            count: this._count,
+            ...(this._firstSeenAt !== undefined ? { firstSeenAt: this._firstSeenAt } : {}),
+            ...(this._lastSeenAt !== undefined ? { lastSeenAt: this._lastSeenAt } : {}),
+            recent: this._recent.slice(),
+        };
+    }
+}
+exports.NondeterminismAlarm = NondeterminismAlarm;
+/** Build the best-effort sample detail from log meta + a message snippet. */
+function buildDetail(message, meta) {
+    const bits = [];
+    const wfType = meta?.['workflowType'];
+    const wfId = meta?.['workflowId'];
+    const runId = meta?.['runId'];
+    if (typeof wfType === 'string')
+        bits.push(`workflowType=${wfType}`);
+    if (typeof wfId === 'string')
+        bits.push(`workflowId=${wfId}`);
+    if (typeof runId === 'string')
+        bits.push(`runId=${runId}`);
+    const snippet = (message ?? '').slice(0, DETAIL_SNIPPET_MAX);
+    bits.push(snippet);
+    return bits.join(' · ');
+}
+/**
+ * True when a log record (its message) signals a nondeterminism / determinism
+ * violation. Case-insensitive substring match over {@link NONDETERMINISM_MARKERS}.
+ */
+function isNondeterminismLog(message, _meta) {
+    if (!message)
+        return false;
+    const m = message.toLowerCase();
+    return exports.NONDETERMINISM_MARKERS.some((marker) => m.includes(marker));
+}
+/**
+ * Wrap a base {@link Logger} so every record still flows to `base`, but any
+ * `WARN`/`ERROR` record matching {@link isNondeterminismLog} also feeds the
+ * alarm. Transparent: trace/debug/info pass straight through; warn/error/log are
+ * classified first, then forwarded unchanged.
+ *
+ * Only `WARN`/`ERROR` are inspected — a nondeterminism failure is always logged
+ * at one of those levels, and ignoring lower levels avoids a hot classifier on
+ * the (high-volume) debug/trace path.
+ */
+function wrapLoggerWithAlarm(base, alarm) {
+    const consider = (level, message, meta) => {
+        if ((level === 'WARN' || level === 'ERROR') && isNondeterminismLog(message, meta)) {
+            alarm.record(message, meta);
+        }
+    };
+    return {
+        log(level, message, meta) {
+            consider(level, message, meta);
+            base.log(level, message, meta);
+        },
+        trace(message, meta) {
+            base.trace(message, meta);
+        },
+        debug(message, meta) {
+            base.debug(message, meta);
+        },
+        info(message, meta) {
+            base.info(message, meta);
+        },
+        warn(message, meta) {
+            consider('WARN', message, meta);
+            base.warn(message, meta);
+        },
+        error(message, meta) {
+            consider('ERROR', message, meta);
+            base.error(message, meta);
+        },
+    };
+}
+// ── Process singleton ───────────────────────────────────────────────────────
+// The daemon installs ONE alarm at boot; `/v1/health` reads it without
+// threading a reference through the HTTP server constructor (and without
+// importing `@temporalio/worker` into the HTTP layer).
+let globalAlarm;
+/** Set the process-global alarm (daemon boot only). */
+function setGlobalNondeterminismAlarm(alarm) {
+    globalAlarm = alarm;
+}
+/** Read the process-global alarm, or `undefined` if not installed (e.g. tests, non-daemon). */
+function getGlobalNondeterminismAlarm() {
+    return globalAlarm;
+}
+/** Test seam — reset the singleton between unit tests. */
+function __resetGlobalNondeterminismAlarmForTests() {
+    globalAlarm = undefined;
+}

package/dist/palette/index.d.ts

@@ -1,14 +1,13 @@
 /**
  * Pure palette-input classification + filtering helpers.
  *
- * Shared between the TUI (`src/tui/commands.ts`) and the dashboard
- * (`dashboard/src/components/chat/`) so the two surfaces' chat-input
- * autocomplete machinery stays in lockstep — same prefix detection,
- * same filtering semantics, same quote-aware tokenizer.
+ * Used by the dashboard (`dashboard/src/components/chat/`) chat-input
+ * autocomplete machinery — prefix detection, filtering semantics, and the
+ * quote-aware tokenizer.
  *
- * Extracted from `src/tui/commands.ts` in #471/#472 (dashboard chat-input
- * TUI parity bundle). The TUI re-exports every symbol from here so existing
- * callers see no behaviour change. The dashboard imports directly from
+ * Originally extracted from the former `src/tui/commands.ts` in #471/#472
+ * (dashboard ↔ TUI parity bundle); the Ink TUI was deleted in #789, so the
+ * dashboard is now the sole consumer. The dashboard imports directly from
  * `agent-tempo/palette` (Vite alias `agent-tempo` → `../src`).
  *
  * **No imports allowed.** Keep this module dependency-free so it

package/dist/palette/index.js

@@ -2,14 +2,13 @@
 /**
  * Pure palette-input classification + filtering helpers.
  *
- * Shared between the TUI (`src/tui/commands.ts`) and the dashboard
- * (`dashboard/src/components/chat/`) so the two surfaces' chat-input
- * autocomplete machinery stays in lockstep — same prefix detection,
- * same filtering semantics, same quote-aware tokenizer.
+ * Used by the dashboard (`dashboard/src/components/chat/`) chat-input
+ * autocomplete machinery — prefix detection, filtering semantics, and the
+ * quote-aware tokenizer.
  *
- * Extracted from `src/tui/commands.ts` in #471/#472 (dashboard chat-input
- * TUI parity bundle). The TUI re-exports every symbol from here so existing
- * callers see no behaviour change. The dashboard imports directly from
+ * Originally extracted from the former `src/tui/commands.ts` in #471/#472
+ * (dashboard ↔ TUI parity bundle); the Ink TUI was deleted in #789, so the
+ * dashboard is now the sole consumer. The dashboard imports directly from
  * `agent-tempo/palette` (Vite alias `agent-tempo` → `../src`).
  *
  * **No imports allowed.** Keep this module dependency-free so it