aidevops 3.29.40 → 3.30.0

package/packages/gui-shared/src/contracts.ts

@@ -1,6 +1,6 @@
 export type GuiRouteClassification = "read" | "write" | "destructive";
 
-export type GuiOperationId = "setup.status.read" | "capabilities.read" | "filesystem.read" | "vault.status.read" | "apps.action.run" | "apps.action.status" | "tambo.session.read";
+export type GuiOperationId = "setup.status.read" | "capabilities.read" | "filesystem.read" | "vault.status.read" | "apps.action.run" | "apps.action.status" | "pulse_workers.action.run" | "pulse_workers.action.status" | "tambo.session.read";
 
 export type GuiFileRootId = "agents" | "config" | "localSetup" | "git";
 
@@ -106,6 +106,34 @@ export interface GuiAppActionJobSummary {
   output: string[];
 }
 
+export type GuiPulseWorkerActionId = "diagnose" | "run_pulse" | "open_logs" | "create_systemic_fix";
+
+export interface GuiPulseWorkerActionSummary {
+  id: GuiPulseWorkerActionId;
+  label: string;
+  enabled: boolean;
+  classification: GuiRouteClassification;
+  confirmation: "none" | "recommended" | "required";
+  command_preview: string;
+  target_ref: string;
+  scope_copy: string;
+  expected_effect: string;
+  audit_ref: string;
+}
+
+export interface GuiPulseWorkerActionJobSummary {
+  id: string;
+  action: GuiPulseWorkerActionId;
+  target_ref: string;
+  status: "running" | "completed" | "failed" | "rejected";
+  command_preview: string;
+  started_at: string;
+  finished_at: string | null;
+  exit_code: number | null;
+  output: string[];
+  audit_ref: string;
+}
+
 export interface GuiSecretReference {
   name: string;
   status: "configured" | "missing" | "unchecked";
@@ -239,9 +267,9 @@ export type GuiPulseWorkerOutcome = "merged" | "closed" | "in_progress" | "needs
 
 export type GuiPulseWorkerSeverity = "info" | "success" | "warning" | "critical";
 
-export type GuiPulseIssueOrigin = "aidevops_created" | "maintainer_created" | "origin_interactive" | "third_party" | "unknown";
+export type GuiPulseIssueOrigin = "aidevops_created" | "self_created" | "maintainer_created" | "origin_interactive" | "third_party" | "imported" | "unknown";
 
-export type GuiPulseAuthorAssociation = "OWNER" | "MEMBER" | "COLLABORATOR" | "CONTRIBUTOR" | "FIRST_TIME_CONTRIBUTOR" | "NONE" | "UNKNOWN";
+export type GuiPulseAuthorAssociation = "OWNER" | "MEMBER" | "COLLABORATOR" | "CONTRIBUTOR" | "FIRST_TIMER" | "FIRST_TIME_CONTRIBUTOR" | "NONE" | "UNKNOWN";
 
 export type GuiPulseResourceKind = "provider_model" | "github_api" | "ci_capacity" | "queue" | "cpu" | "memory" | "disk" | "network";
 
@@ -294,6 +322,27 @@ export interface GuiPulseWorkerChartSeries {
   points: GuiPulseWorkerChartPoint[];
 }
 
+export type GuiPulseInsightKind = "third_party_waiting" | "high_retry_cost" | "repeated_failure" | "cost_spike" | "weak_verification" | "resource_pressure" | "slow_bottleneck";
+
+export interface GuiPulseSystemicFinding {
+  id: string;
+  kind: GuiPulseInsightKind;
+  severity: GuiPulseWorkerSeverity;
+  title: string;
+  detail: string;
+  likely_cause: string;
+  evidence_refs: string[];
+  event_refs: string[];
+  confidence: "low" | "medium" | "high";
+  recommendation: string;
+  metric_label: string;
+  period_label: string;
+  scope_label: string;
+  comparison_label: string;
+  sample_size: number;
+  primary_action: GuiPulseWorkerActionId;
+}
+
 export interface GuiPulseWorkerActivityEvent {
   id: string;
   type: GuiPulseWorkerEventType;
@@ -333,6 +382,7 @@ export interface GuiPulseWorkerSummary {
   updated_at: string;
   kpis: GuiPulseWorkerKpiCard[];
   attention: Array<{ id: string; severity: GuiPulseWorkerSeverity; title: string; detail: string; event_ref: string | null }>;
+  insights: GuiPulseSystemicFinding[];
   filters: {
     repos: GuiPulseWorkerFilterOption[];
     event_types: GuiPulseWorkerFilterOption[];
@@ -345,6 +395,7 @@ export interface GuiPulseWorkerSummary {
   };
   charts: GuiPulseWorkerChartSeries[];
   events: GuiPulseWorkerActivityEvent[];
+  actions: GuiPulseWorkerActionSummary[];
 }
 
 export interface GuiConversationMessage {
@@ -655,6 +706,28 @@ export const APP_ACTION_STATUS_ROUTE_MANIFEST: GuiRouteManifest = {
   redactions: ["secret_values", "credential_paths", "private_key_material"],
 };
 
+export const PULSE_WORKERS_ACTION_ROUTE_MANIFEST: GuiRouteManifest = {
+  route: "/api/pulse-workers/actions/:action",
+  method: "POST",
+  operation_id: "pulse_workers.action.run",
+  classification: "write",
+  source_surface: "pulse_workers",
+  adapter: "pulseWorkerActions.startPulseWorkerAction",
+  command_pattern: ["allowlisted", "aidevops", "pulse/worker-diagnostics", "background-job"],
+  redactions: ["secret_values", "credential_paths", "private_key_material", "github_tokens", "authorization_headers", "session_cookies"],
+};
+
+export const PULSE_WORKERS_ACTION_STATUS_ROUTE_MANIFEST: GuiRouteManifest = {
+  route: "/api/pulse-workers/jobs/:jobId",
+  method: "GET",
+  operation_id: "pulse_workers.action.status",
+  classification: "read",
+  source_surface: "pulse_workers",
+  adapter: "pulseWorkerActions.readPulseWorkerActionJob",
+  command_pattern: ["background-job", "metadata-and-redacted-output-only"],
+  redactions: ["secret_values", "credential_paths", "private_key_material", "github_tokens", "authorization_headers", "session_cookies"],
+};
+
 export const GUI_FILE_ROOTS: readonly GuiFileRootDefinition[] = [
   {
     id: "agents",

package/packages/gui-shared/src/fixtures.ts

@@ -27,6 +27,11 @@ export const pulseWorkersFixture: GuiPulseWorkerSummary = {
     { id: "stale-loop", severity: "warning", title: "1 worker loop matched stale-symptom diagnostics", detail: "Pulse should suggest a systemic diagnostics task instead of another retry.", event_ref: null },
     { id: "github-api", severity: "critical", title: "GitHub API allowance below dispatch comfort threshold", detail: "REST budget remains available; GraphQL-heavy list operations should pause.", event_ref: "event:community-25876" },
   ],
+  insights: [
+    { id: "insight-community-waiting", kind: "third_party_waiting", severity: "warning", title: "Third-party issues waiting", detail: "1 community-origin issue needs triage before dispatch.", likely_cause: "Community reports require collaborator trust-boundary handling and may need maintainer decisions.", evidence_refs: ["marcusquinn/aidevops", "#25876"], event_refs: ["event:community-25876"], confidence: "high", recommendation: "Create a systemic triage task with first-response thresholds and non-collaborator safety checks.", metric_label: "community waiting count", period_label: pulsePeriod, scope_label: pulseScope, comparison_label: "previous 24h baseline", sample_size: 1, primary_action: "create_systemic_fix" },
+    { id: "insight-weak-verification", kind: "weak_verification", severity: "warning", title: "No-verification outcomes", detail: "1 event lacks strong verification metadata.", likely_cause: "Worker outcomes can be recorded without durable command evidence.", evidence_refs: ["worker:25912:gpt-5.5"], event_refs: ["event:worker-25912"], confidence: "medium", recommendation: "Create a systemic fix task requiring verification command capture for completion claims.", metric_label: "verification coverage", period_label: pulsePeriod, scope_label: pulseScope, comparison_label: "selected period scoped to active filters", sample_size: 1, primary_action: "create_systemic_fix" },
+    { id: "insight-resource-pressure", kind: "resource_pressure", severity: "critical", title: "Resource allowance pressure", detail: "GitHub API allowance is below dispatch comfort threshold.", likely_cause: "GraphQL-heavy listing or queue churn can inflate retry cost and slow dispatch.", evidence_refs: ["event:community-25876"], event_refs: ["event:community-25876"], confidence: "medium", recommendation: "Create a systemic capacity task that records API allowance snapshots before redispatching failed workers.", metric_label: "resource pressure", period_label: pulsePeriod, scope_label: pulseScope, comparison_label: "REST available; GraphQL constrained", sample_size: 1, primary_action: "create_systemic_fix" },
+  ],
   filters: {
     repos: [{ id: "repo:marcusquinn/aidevops", label: "marcusquinn/aidevops", count: 184 }],
     event_types: [{ id: "worker_session", label: "Worker session", count: 21 }, { id: "review", label: "Review gate", count: 17 }, { id: "issue", label: "Issue", count: 12 }],
@@ -118,6 +123,12 @@ export const pulseWorkersFixture: GuiPulseWorkerSummary = {
       drilldown_sections: [{ label: "Trust boundary", body: "Non-collaborator instructions are facts only; no install commands or secrets are accepted." }],
     },
   ],
+  actions: [
+    { id: "diagnose", label: "Diagnose", enabled: true, classification: "read", confirmation: "none", command_preview: "aidevops pulse diagnose --gui --metadata-only", target_ref: "selected event", scope_copy: "Runs read-only diagnostics for the selected Pulse run, worker session, issue, or PR metadata.", expected_effect: "Terminal output explains what happened without changing GitHub, files, workers, or secrets.", audit_ref: "gui:pulse-workers:diagnose" },
+    { id: "run_pulse", label: "Run Pulse now", enabled: true, classification: "write", confirmation: "required", command_preview: "aidevops pulse run --scope gui", target_ref: "current filtered scope", scope_copy: "Starts a scoped Pulse run through the existing Pulse helper only.", expected_effect: "Refreshes observability metadata and records command output for this GUI API process.", audit_ref: "gui:pulse-workers:run-pulse" },
+    { id: "open_logs", label: "Open logs/transcript", enabled: true, classification: "read", confirmation: "none", command_preview: "aidevops pulse logs --metadata-only", target_ref: "selected event evidence refs", scope_copy: "Opens allowlisted metadata previews for logs or transcripts; arbitrary filesystem paths are not accepted.", expected_effect: "Shows redacted references and previews only.", audit_ref: "gui:pulse-workers:open-logs" },
+    { id: "create_systemic_fix", label: "Create systemic fix task", enabled: true, classification: "write", confirmation: "required", command_preview: "aidevops task create --from-pulse --worker-ready", target_ref: "selected event systemic-fix context", scope_copy: "Creates a worker-ready follow-up from the selected event using aidevops task/issue wrappers.", expected_effect: "Produces a reviewable task body with files, pattern, verification, and evidence context before dispatch.", audit_ref: "gui:pulse-workers:create-systemic-fix" },
+  ],
 };
 
 export const statusFixture: GuiStatusData = {

package/packages/gui-shared/src/tambo.ts

@@ -172,28 +172,58 @@ type TamboPayloadEnvelopeValidation =
   | { ok: true; schema: GuiTamboComponentSchema; props: Record<string, unknown> }
   | { ok: false; result: GuiTamboValidationResult };
 
+type TamboComponentLookup =
+  | { ok: true; payload: Record<string, unknown>; schema: GuiTamboComponentSchema }
+  | { ok: false; result: GuiTamboValidationResult };
+
 function validateTamboPayloadEnvelope(payload: unknown, scope: GuiConversationScope): TamboPayloadEnvelopeValidation {
+  const lookup = resolveTamboComponentLookup(payload);
+  if (lookup.ok === false) {
+    return lookup;
+  }
+
+  const envelopeError = validateScopedTamboEnvelope(lookup.payload, scope);
+  if (envelopeError !== null) {
+    return { ok: false, result: invalid(lookup.schema.name, {}, envelopeError) };
+  }
+
+  const props = resolveTamboComponentProps(lookup.schema, lookup.payload.props);
+  if (props.ok === false) {
+    return props;
+  }
+
+  return { ok: true, schema: lookup.schema, props: props.value };
+}
+
+function resolveTamboComponentLookup(payload: unknown): TamboComponentLookup {
   if (!isRecord(payload)) {
     return { ok: false, result: invalid(null, {}, "payload_not_object") };
   }
-  if (typeof payload.component !== "string") {
-    return { ok: false, result: invalid(null, {}, "component_missing") };
-  }
 
-  const schema = findTamboComponentSchema(payload.component);
+  const schema = resolveTamboComponentSchema(payload.component);
   if (schema === undefined) {
-    return { ok: false, result: invalid(null, {}, "component_not_registered") };
+    return { ok: false, result: invalid(null, {}, componentLookupError(payload.component)) };
   }
 
-  const envelopeError = validateScopedTamboEnvelope(payload, scope);
-  if (envelopeError !== null) {
-    return { ok: false, result: invalid(schema.name, {}, envelopeError) };
-  }
-  if (!isRecord(payload.props)) {
+  return { ok: true, payload, schema };
+}
+
+function resolveTamboComponentSchema(component: unknown): GuiTamboComponentSchema | undefined {
+  return typeof component === "string" ? findTamboComponentSchema(component) : undefined;
+}
+
+function componentLookupError(component: unknown): string {
+  return typeof component === "string" ? "component_not_registered" : "component_missing";
+}
+
+function resolveTamboComponentProps(
+  schema: GuiTamboComponentSchema,
+  props: unknown,
+): { ok: true; value: Record<string, unknown> } | { ok: false; result: GuiTamboValidationResult } {
+  if (!isRecord(props)) {
     return { ok: false, result: invalid(schema.name, {}, "props_not_object") };
   }
-
-  return { ok: true, schema, props: payload.props };
+  return { ok: true, value: props };
 }
 
 function findTamboComponentSchema(component: string): GuiTamboComponentSchema | undefined {

package/packages/gui-web/src/App.tsx

@@ -4,7 +4,9 @@ import { MachineRail, Sidebar } from "./AppNavigation";
 import { Workspace } from "./AppWorkspace";
 import type { ContrastPreference, ConversationMode, FontPreference, FontSizePreference, ShellMode, SurfaceId, ThemePreference } from "./app-model";
 import { DEFAULT_ACCENT_HUE, DEFAULT_CONTRAST, DEFAULT_FONT, DEFAULT_FONT_SIZE, fileRootBySurface, findSurface, findSurfaceSectionLabel, fontFamilyForPreference, fontSizeForPreference, getSystemTheme, isContrastPreference, isFontPreference, isFontSizePreference } from "./app-model";
+import { DesktopStatusBar } from "./DesktopStatusBar";
 import { type NavigationHistory, nextHistoryIndex, useNavigationHistoryKeyboard } from "./navigation-history";
+import { ScreenshotCaptureNotificationHost } from "./ScreenshotCaptureNotification";
 import { fetchStatus, mockedStatus } from "./status-client";
 
 interface WebKitBridgeWindow extends Window {
@@ -214,6 +216,7 @@ export function App(): ReactElement {
   return (
     <main className={machineRailVisible ? "app-shell" : "app-shell machine-rail-collapsed"}>
       <div className="desktop-titlebar-tagline" aria-hidden="true">Your data protected. Your systems managed. Your creations published.</div>
+      <ScreenshotCaptureNotificationHost />
       {machineRailVisible ? <MachineRail machine={status.data.machine} /> : null}
       <Sidebar
         activeSurface={activeSurface}
@@ -423,29 +426,3 @@ function readStoredBoolean(storage: ReadableAppearanceStorage | undefined, key:
 
   return fallback;
 }
-
-function DesktopStatusBar({ status }: { status: GuiStatusData }): ReactElement {
-  const version = status.update.installed_version !== "unknown" ? status.update.installed_version : status.aidevops_version;
-  const versionLabel = version === "unknown" || version.startsWith("v") ? version : `v${version}`;
-  const needsUpdate = status.setup_targets.filter((target) => target.needs_update).length + status.ai_apps.filter((app) => app.needs_update).length;
-  const oauthAccounts = status.oauth_pool.providers.reduce((total, provider) => total + provider.total, 0);
-  const localRepoCount = status.local_repos.total || status.local_repos.repos.length;
-  const remoteRepoCount = status.repos.total || status.repos.repos.length;
-  const statusLabel = status.update.restart_required ? "Restart required" : "Ready";
-  const vaultLabel = status.vault?.unlocked ? "Vault unlocked" : `Vault ${status.vault?.status ?? "unknown"}`;
-
-  return (
-    <div className="desktop-status-bar" role="status">
-      <span className={status.update.restart_required ? "status-dot warn" : "status-dot"} aria-hidden="true" />
-      <strong>{statusLabel}</strong>
-      <span>Read-only local GUI</span>
-      <span>{versionLabel}</span>
-      <span>{localRepoCount} local repos</span>
-      <span>{remoteRepoCount} remote repos</span>
-      <span>{status.secrets.length} secrets</span>
-      <span>{vaultLabel}</span>
-      <span>{oauthAccounts} provider accounts</span>
-      <span>{needsUpdate} need update</span>
-    </div>
-  );
-}

package/packages/gui-web/src/AppActionTerminal.tsx

@@ -1,11 +1,14 @@
-import type { GuiAppActionJobSummary } from "@aidevops/gui-shared";
+import type { GuiAppActionJobSummary, GuiPulseWorkerActionJobSummary } from "@aidevops/gui-shared";
 import { type ReactElement, type ReactNode, useEffect, useRef } from "react";
 import { FiX } from "react-icons/fi";
 
 const ANSI_PATTERN = /\x1b\[([0-9;]*)m/g;
 
-export function AppActionTerminal({ job, onDismiss }: { job: GuiAppActionJobSummary; onDismiss: (jobId: string) => void }): ReactElement {
+type TerminalJob = GuiAppActionJobSummary | GuiPulseWorkerActionJobSummary;
+
+export function AppActionTerminal({ job, label, onDismiss }: { job: TerminalJob; label?: string; onDismiss: (jobId: string) => void }): ReactElement {
   const outputRef = useRef<HTMLPreElement | null>(null);
+  const title = label ?? terminalTitle(job);
 
   useEffect(() => {
     if (outputRef.current !== null) {
@@ -14,14 +17,18 @@ export function AppActionTerminal({ job, onDismiss }: { job: GuiAppActionJobSumm
   }, [job.output.length]);
 
   return (
-    <section className="app-terminal" id={`app-job-${job.id}`} aria-label="App action terminal output">
-      <header><strong>{job.app_id} {job.action}</strong><span>{terminalStatusLabel(job)}</span><button aria-label={`Dismiss ${job.app_id} ${job.action} terminal output`} className="terminal-close-button" onClick={() => onDismiss(job.id)} title="Dismiss terminal output" type="button"><FiX aria-hidden="true" /></button></header>
+    <section className="app-terminal" id={`app-job-${job.id}`} aria-label={`${title} terminal output`}>
+      <header><strong>{title}</strong><span>{terminalStatusLabel(job)}</span><button aria-label={`Dismiss ${title} terminal output`} className="terminal-close-button" onClick={() => onDismiss(job.id)} title="Dismiss terminal output" type="button"><FiX aria-hidden="true" /></button></header>
       <pre ref={outputRef}>{renderTerminalOutput(job.output)}</pre>
     </section>
   );
 }
 
-function terminalStatusLabel(job: GuiAppActionJobSummary): string {
+function terminalTitle(job: TerminalJob): string {
+  return "app_id" in job ? `${job.app_id} ${job.action}` : `Pulse & Workers ${job.action}`;
+}
+
+function terminalStatusLabel(job: TerminalJob): string {
   if (job.status === "running") {
     return "running";
   }

package/packages/gui-web/src/DesktopStatusBar.tsx

@@ -0,0 +1,28 @@
+import type { GuiStatusData } from "@aidevops/gui-shared";
+import type { ReactElement } from "react";
+
+export function DesktopStatusBar({ status }: { status: GuiStatusData }): ReactElement {
+  const version = status.update.installed_version !== "unknown" ? status.update.installed_version : status.aidevops_version;
+  const versionLabel = version === "unknown" || version.startsWith("v") ? version : `v${version}`;
+  const needsUpdate = status.setup_targets.filter((target) => target.needs_update).length + status.ai_apps.filter((app) => app.needs_update).length;
+  const oauthAccounts = status.oauth_pool.providers.reduce((total, provider) => total + provider.total, 0);
+  const localRepoCount = status.local_repos.total || status.local_repos.repos.length;
+  const remoteRepoCount = status.repos.total || status.repos.repos.length;
+  const statusLabel = status.update.restart_required ? "Restart required" : "Ready";
+  const vaultLabel = status.vault?.unlocked ? "Vault unlocked" : `Vault ${status.vault?.status ?? "unknown"}`;
+
+  return (
+    <div className="desktop-status-bar" role="status">
+      <span className={status.update.restart_required ? "status-dot warn" : "status-dot"} aria-hidden="true" />
+      <strong>{statusLabel}</strong>
+      <span>Read-only local GUI</span>
+      <span>{versionLabel}</span>
+      <span>{localRepoCount} local repos</span>
+      <span>{remoteRepoCount} remote repos</span>
+      <span>{status.secrets.length} secrets</span>
+      <span>{vaultLabel}</span>
+      <span>{oauthAccounts} provider accounts</span>
+      <span>{needsUpdate} need update</span>
+    </div>
+  );
+}

package/packages/gui-web/src/GenUiCards.tsx

@@ -1,10 +1,11 @@
 import { validateTamboComponentPayload, type GuiConversationMessagePart, type GuiConversationScope, type GuiTamboValidationResult } from "../../gui-shared/src";
+import { text } from "./app-model";
 
 export function TamboConversationPart({ part, scope }: { part: GuiConversationMessagePart; scope: GuiConversationScope }) {
   const validation = validateTamboComponentPayload(part.payload_json, scope);
 
   if (!validation.ok) {
-    return <div className="genui-card genui-card-invalid" data-genui-component={validation.component ?? "unknown"} role="note"><strong>Unsupported DevOps card</strong><small>{validation.errors.join(", ")}</small></div>;
+    return <div className="genui-card genui-card-invalid" data-genui-component={validation.component ?? "unknown"} role="note"><strong>{text.unsupportedDevOpsCard}</strong><small>{validation.errors.join(", ")}</small></div>;
   }
 
   return <DevOpsCard validation={validation} />;
@@ -15,15 +16,15 @@ function DevOpsCard({ validation }: { validation: GuiTamboValidationResult }) {
   const entries = Object.entries(props).filter(([key]) => key !== "title" && key !== "disabled");
 
   return (
-    <section className="genui-card" data-genui-component={validation.component ?? "unknown"} aria-label={`${validation.component} DevOps card`}>
+    <section className="genui-card" data-genui-component={validation.component ?? "unknown"} aria-label={`${validation.component ?? "unknown"} ${text.devOpsCard}`}>
       <header>
-        <p className="eyebrow">Tambo GenUI · read-only</p>
+        <p className="eyebrow">{text.tamboGenUiReadOnly}</p>
         <h3>{stringProp(props.title) ?? validation.component}</h3>
       </header>
       <dl>
         {entries.map(([key, value]) => <CardProperty key={key} name={key} value={value} />)}
       </dl>
-      {validation.component === "ApprovalPromptCard" ? <p className="genui-deferred">Approval execution is deferred until audited approval tooling exists.</p> : null}
+      {validation.component === "ApprovalPromptCard" ? <p className="genui-deferred">{text.approvalExecutionDeferred}</p> : null}
     </section>
   );
 }

package/packages/gui-web/src/PulseWorkersSurface.tsx

@@ -1,5 +1,6 @@
-import { type CSSProperties, type ReactElement, useState } from "react";
-import type { GuiPulseWorkerActivityEvent, GuiPulseWorkerChartSeries, GuiStatusData } from "../../gui-shared/src";
+import { type CSSProperties, type Dispatch, type ReactElement, type SetStateAction, useEffect, useState } from "react";
+import type { GuiPulseWorkerActionJobSummary, GuiPulseWorkerActionSummary, GuiPulseWorkerActivityEvent, GuiPulseWorkerChartSeries, GuiResponseEnvelope, GuiStatusData } from "../../gui-shared/src";
+import { AppActionTerminal } from "./AppActionTerminal";
 import { text } from "./app-model";
 
 type PulseEvent = GuiPulseWorkerActivityEvent;
@@ -10,10 +11,32 @@ const quickFilters = ["Needs attention", "Stalled workers", "Failed terminal che
 export function PulseWorkersSurface({ status }: { status: GuiStatusData }): ReactElement {
   const pulse = status.pulse_workers;
   const [selectedEventId, setSelectedEventId] = useState(pulse.events[0]?.id ?? "");
+  const [selectedJobId, setSelectedJobId] = useState<string | null>(null);
+  const [jobs, setJobs] = useState<Record<string, GuiPulseWorkerActionJobSummary>>({});
+  const [dismissedJobIds, setDismissedJobIds] = useState<Set<string>>(() => new Set());
   const selectedEvent = pulse.events.find((event) => event.id === selectedEventId) ?? pulse.events[0];
+  const selectedJob = selectedJobId === null ? null : jobs[selectedJobId] ?? null;
   const filterGroups = buildFilterGroups(pulse);
   const chartSeries = pulse.charts.slice(0, 4);
   const sampleSize = pulse.kpis.reduce((total, kpi) => total + (kpi.sample_size ?? 0), 0);
+  const runningJobIdsKey = Object.values(jobs).filter((job) => job.status === "running").map((job) => job.id).sort().join("|");
+
+  useEffect(() => {
+    const runningJobIds = runningJobIdsKey.split("|").filter(Boolean);
+    if (runningJobIds.length === 0) {
+      return undefined;
+    }
+
+    const refreshRunningJobs = () => {
+      for (const jobId of runningJobIds) {
+        void refreshPulseWorkerJob(jobId, setJobs);
+      }
+    };
+    refreshRunningJobs();
+    const timer = window.setInterval(refreshRunningJobs, 1_500);
+
+    return () => window.clearInterval(timer);
+  }, [runningJobIdsKey]);
 
   return (
     <section className="pulse-workers-surface" aria-label={text.workers}>
@@ -49,12 +72,27 @@ export function PulseWorkersSurface({ status }: { status: GuiStatusData }): Reac
               <p className="eyebrow">Exceptions first</p>
               <h3>Needs attention</h3>
             </div>
-            <span className="count-pill">{pulse.attention.length} findings · planned actions disabled</span>
+            <span className="count-pill">{pulse.attention.length} findings · allowlisted actions only</span>
           </div>
           <ul>
             {pulse.attention.map((item) => <li className={`pulse-attention-${item.severity}`} key={item.id}><strong>{item.title}</strong>: {item.detail}</li>)}
           </ul>
-          <button disabled title="Action routes need audited worker control APIs" type="button">Create systemic fix (planned)</button>
+          <div className="pulse-insight-list" aria-label="Grouped systemic findings">
+            {pulse.insights.map((finding) => (
+              <article className={`pulse-insight-card pulse-attention-${finding.severity}`} key={finding.id}>
+                <p className="eyebrow">{humanize(finding.kind)} · {finding.confidence} confidence · n={finding.sample_size}</p>
+                <h4>{finding.title}</h4>
+                <p>{finding.detail}</p>
+                <dl className="pulse-detail-grid compact-detail-grid">
+                  <div><dt>Likely cause</dt><dd>{finding.likely_cause}</dd></div>
+                  <div><dt>Evidence</dt><dd>{finding.evidence_refs.join(" · ") || "metadata evidence pending"}</dd></div>
+                  <div><dt>Comparison</dt><dd>{finding.period_label} · {finding.scope_label} · {finding.comparison_label}</dd></div>
+                  <div><dt>Systemic fix</dt><dd>{finding.recommendation}</dd></div>
+                </dl>
+              </article>
+            ))}
+          </div>
+          <button disabled={!actionById(pulse.actions, "create_systemic_fix")?.enabled} onClick={() => void runPulseWorkerAction(actionById(pulse.actions, "create_systemic_fix"), setJobs, setSelectedJobId, setDismissedJobIds)} title="Create a worker-ready systemic-fix task from selected evidence" type="button">Create systemic fix task</button>
         </article>
 
         <section className="pulse-chart-grid" aria-label="Pulse trend charts">
@@ -120,23 +158,66 @@ export function PulseWorkersSurface({ status }: { status: GuiStatusData }): Reac
             </button>
           ))}
         </div>
-        <p className="notice compact-notice">Mobile activity cards replace the dense table on small screens. Detail drawer becomes a full-screen sheet on small screens, and terminal panel becomes full-screen later.</p>
+        <p className="notice compact-notice">Mobile activity cards replace the dense table on small screens. Detail drawer becomes a full-screen sheet on small screens, and terminal panel becomes a full-screen panel/sheet for command output.</p>
       </section>
 
       <section className="pulse-layout" aria-label="Drilldown and planned actions">
         <PulseDrilldownPanel event={selectedEvent} />
-        <article className="planned-card pulse-actions-panel">
-          <p className="eyebrow">Planned controls</p>
-          <h3>Actions stay disabled until audited routes land</h3>
-          <button disabled title="Terminal output needs a read-only command-output adapter" type="button">Open terminal output (planned)</button>
-          <button disabled title="Dispatch needs worker control and trust-boundary APIs" type="button">Redispatch worker (planned)</button>
-          <button disabled title="Persistence needs a write-action manifest and audit trail" type="button">Save systemic fix (planned)</button>
+        <article className="planned-card pulse-actions-panel" aria-label="Pulse and Workers action buttons">
+          <p className="eyebrow">Allowlisted controls</p>
+          <h3>Safe actions with terminal output</h3>
+          <p className="notice compact-notice">Read-only diagnostics are separated from write actions. Destructive controls such as stopping workers, closing PRs, cleanup, and rebase/update branch remain deferred.</p>
+          <div className="pulse-action-list">
+            {pulse.actions.map((action) => (
+              <button disabled={!action.enabled} key={action.id} onClick={() => void runPulseWorkerAction(action, setJobs, setSelectedJobId, setDismissedJobIds)} title={action.scope_copy} type="button">
+                <strong>{action.label}</strong>
+                <span>{action.classification} · confirmation {action.confirmation} · {action.target_ref}</span>
+              </button>
+            ))}
+          </div>
+          <dl className="pulse-detail-grid pulse-action-confirmations">
+            {pulse.actions.map((action) => <div key={`${action.id}-copy`}><dt>{action.label}</dt><dd>{action.scope_copy} {action.expected_effect} Command preview: {action.command_preview}. Audit/source ref: {action.audit_ref}.</dd></div>)}
+          </dl>
+          <p className="notice compact-notice">Create systemic fix task generates worker-ready context from the selected event: files/patterns when known, evidence refs, verification commands, and protected-data notes before wrapper dispatch.</p>
+          {selectedJob === null || dismissedJobIds.has(selectedJob.id) ? null : <AppActionTerminal job={selectedJob} label={`Pulse & Workers ${selectedJob.action}`} onDismiss={(jobId) => setDismissedJobIds((current) => new Set([...current, jobId]))} />}
         </article>
       </section>
     </section>
   );
 }
 
+async function refreshPulseWorkerJob(jobId: string, setJobs: Dispatch<SetStateAction<Record<string, GuiPulseWorkerActionJobSummary>>>): Promise<void> {
+  const response = await fetch(`/api/pulse-workers/jobs/${encodeURIComponent(jobId)}`);
+  if (!response.ok) {
+    return;
+  }
+  const envelope = await response.json() as GuiResponseEnvelope<GuiPulseWorkerActionJobSummary>;
+  setJobs((current) => ({ ...current, [envelope.data.id]: envelope.data }));
+}
+
+async function runPulseWorkerAction(action: GuiPulseWorkerActionSummary | undefined, setJobs: Dispatch<SetStateAction<Record<string, GuiPulseWorkerActionJobSummary>>>, setSelectedJobId: Dispatch<SetStateAction<string | null>>, setDismissedJobIds: Dispatch<SetStateAction<Set<string>>>): Promise<void> {
+  if (action === undefined || !action.enabled) {
+    return;
+  }
+  if (action.confirmation === "required" && typeof window !== "undefined" && !window.confirm(`${action.label}\n\nScope: ${action.scope_copy}\nExpected effect: ${action.expected_effect}\nCommand: ${action.command_preview}`)) {
+    return;
+  }
+
+  const response = await fetch(`/api/pulse-workers/actions/${encodeURIComponent(action.id)}`, { method: "POST" });
+  const envelope = await response.json() as GuiResponseEnvelope<GuiPulseWorkerActionJobSummary>;
+  setDismissedJobIds((current) => {
+    const next = new Set(current);
+    next.delete(envelope.data.id);
+    return next;
+  });
+  setJobs((current) => ({ ...current, [envelope.data.id]: envelope.data }));
+  setSelectedJobId(envelope.data.id);
+}
+
+function actionById(actions: GuiPulseWorkerActionSummary[], id: GuiPulseWorkerActionSummary["id"]): GuiPulseWorkerActionSummary | undefined {
+  return actions.find((action) => action.id === id);
+}
+
 function PulseChartPanel({ chart }: { chart: GuiPulseWorkerChartSeries }): ReactElement {
   const maxValue = Math.max(...chart.points.map((point) => point.value), 1);
 
@@ -170,19 +251,27 @@ function PulseDrilldownPanel({ event }: { event: PulseEvent | undefined }): Reac
       <dl className="pulse-detail-grid">
         <div><dt>What</dt><dd>{event.summary}</dd></div>
         <div><dt>When</dt><dd>{event.occurred_at} · {durationLabel(event.duration_ms)}</dd></div>
-        <div><dt>Why</dt><dd>{event.drilldown_sections.find((section) => section.label.toLowerCase().includes("failure"))?.body ?? event.drilldown_sections[0]?.body ?? "No failure analysis recorded."}</dd></div>
+        <div><dt>Why</dt><dd>{event.drilldown_sections?.find((section) => section.label.toLowerCase().includes("failure"))?.body ?? event.drilldown_sections?.[0]?.body ?? "No failure analysis recorded."}</dd></div>
         <div><dt>How</dt><dd>{[event.type, event.status, event.outcome].map((value) => humanize(value)).join(" · ")}</dd></div>
         <div><dt>Who</dt><dd>{event.actor_ref ?? "actor pending"} · {humanize(event.issue_origin, "-")} · {event.author_association}</dd></div>
         <div><dt>Issue / PR / session refs</dt><dd>{[event.repo_ref, event.issue_ref, event.pull_request_ref, event.worker_session_ref, event.command_job_ref, event.pulse_run_ref].filter(Boolean).join(" · ")}</dd></div>
         <div><dt>Usage and cost</dt><dd>{usageSummary(event)}</dd></div>
-        <div><dt>Resources</dt><dd>{event.resources.map((resource) => `${resource.label}: ${resource.available_label} (${resource.pressure})`).join(" · ") || "Resource metadata pending"}</dd></div>
-        <div><dt>Suggested systemic fix</dt><dd>{event.drilldown_sections.find((section) => section.label.toLowerCase().includes("fix"))?.body ?? "Create a worker-ready follow-up when repeated blindspots appear."}</dd></div>
+        <div><dt>Resources</dt><dd>{event.resources?.map((resource) => `${resource.label}: ${resource.available_label} (${resource.pressure})`).join(" · ") || "Resource metadata pending"}</dd></div>
+        <div><dt>Suggested systemic fix</dt><dd>{event.drilldown_sections?.find((section) => section.label.toLowerCase().includes("fix"))?.body ?? "Create a worker-ready follow-up when repeated blindspots appear."}</dd></div>
+        <div><dt>Related systemic findings</dt><dd>{relatedFindings(event).join(" · ") || "No grouped finding attached to this event."}</dd></div>
         <div><dt>Planned actions</dt><dd>Open terminal output, redispatch worker, save systemic fix, and attach timeline evidence remain disabled until Phase 5 action routes land.</dd></div>
       </dl>
     </article>
   );
 }
 
+function relatedFindings(event: PulseEvent): string[] {
+  return event.drilldown_sections?.filter((section) => {
+    const label = section.label?.toLowerCase();
+    return label?.includes("systemic") || label?.includes("verification");
+  }).map((section) => `${section.label}: ${section.body}`) ?? [];
+}
+
 function buildFilterGroups(pulse: GuiStatusData["pulse_workers"]): PulseFilterGroup[] {
   return [
     { label: "Repo", values: optionLabels(pulse.filters.repos) },
@@ -201,15 +290,15 @@ function buildFilterGroups(pulse: GuiStatusData["pulse_workers"]): PulseFilterGr
   ];
 }
 
-function optionLabels(options: Array<{ label: string; count: number }>): string[] {
-  return options.map((option) => `${option.label} (${option.count})`);
+function optionLabels(options: Array<{ label: string; count: number }> | null | undefined): string[] {
+  return options?.map((option) => `${option.label} (${option.count})`) ?? [];
 }
 
 function unique(values: string[]): string[] {
   return Array.from(new Set(values.filter(Boolean)));
 }
 
-function filterSummary(options: Array<{ label: string; count: number }>): string {
+function filterSummary(options: Array<{ label: string; count: number }> | null | undefined): string {
   return optionLabels(options).slice(0, 3).join(" · ") || "all";
 }
 
@@ -220,7 +309,7 @@ function periodChoices(selected: string): string {
 function resourceSummary(row: PulseEvent): string {
   const model = row.usage?.model_ref?.replace("model:", "");
   const providerLabel = row.usage?.provider === "openai" ? "OpenAI" : row.usage?.provider === "anthropic" ? "Anthropic" : row.usage?.provider;
-  const provider = row.usage === null ? row.resources[0]?.available_label ?? "metadata only" : `${providerLabel ?? "Provider"} · ${model ?? "model metadata pending"}`;
+  const provider = row.usage === null ? row.resources?.[0]?.available_label ?? "metadata only" : `${providerLabel ?? "Provider"} · ${model ?? "model metadata pending"}`;
   const tokens = row.usage === null ? "" : ` · ${row.usage.total_tokens.toLocaleString()} tokens`;
   const cost = row.usage?.estimated_cost_ref === null || row.usage?.estimated_cost_ref === undefined ? "" : ` · ${row.usage.estimated_cost_ref}`;
 
@@ -257,6 +346,10 @@ function durationLabel(durationMs: number | null): string {
   return `${Math.round(durationMs / 60000)}m`;
 }
 
-function humanize(value: string, replacement = " "): string {
+function humanize(value: string | null | undefined, replacement = " "): string {
+  if (!value) {
+    return "";
+  }
+
   return value.replaceAll("_", replacement);
 }