blun-king-cli 9.1.589 → 9.1.595

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # BLUN King Changelog
 
+## 9.1.594
+
+- Preserve private Telegram replies while group messages wait, and retain slash-command routing.
+- Honor long Retry-After delays and restore remaining cooldowns after resuming a session.
+- Continue one settled tool step after rejected narration without publishing that narration or weakening final-answer review.
+- Restore bounded write-continuation recovery, shell timeouts, task controls and session recovery.
+- Keep input, quota rows, activity, task expansion and source-labelled tool output visible during streaming and history navigation.
+- Require complete console regression evidence before packaging and verify matching public update metadata.
+
+## 9.1.593
+
+- Keep the input and both status rows visible after delayed startup messages, without clearing terminal scrollback.
+
+## 9.1.592
+
+- Preserve explicit startup permissions and remember deliberate permission selections for new sessions.
+- Prevent overlapping session selections from closing the session being resumed.
+- Restore rotating activity words, cumulative usage, step number and local date/time alongside live timing and token estimates.
+- Allow protected-source reads redirected to literal null sinks without removing protected-write checks.
+- Include the bounded startup and reload corrections prepared in 9.1.591.
+
+## 9.1.591
+
+- Finish the managed model refresh before opening a session, with a bounded catalog request.
+- Reopen continued sessions through one reload so an overdue loop cannot race a second reload.
+- Preserve additional workspace directories through the reload path.
+- Keep the existing input, footer, quota rows, loop countdown and compaction display unchanged.
+
+## 9.1.590
+
+- Retain complete bounded instructions without the extra 8 KiB AgentSpine rejection.
+- Keep routine AgentSpine preparation out of the visible transcript while retaining source and receipt checks.
+- Preserve the active King profile when unrelated host settings are inherited.
+- Restore the loop countdown and replace the previous recurring loop when scheduling a new one.
+- Retain the approved compaction display and queued reload behavior.
+
 ## 9.1.589
 
 - Bundle reviewed AgentSpine and Translate Native sources with verified update manifests.

package/README.md

@@ -60,3 +60,15 @@ Sie stehen unter `blun` und `king` identisch zur Verfügung.
 denselben abgesicherten Updater. Er bleibt im installierten Stable- oder
 Next-Kanal, verhindert Rückstufungen und übergibt npm ausschließlich eine zuvor
 aufgelöste exakte Paketversion.
+
+## Absturzdiagnose unter Windows
+
+Startfehler und unbehandelte Ausnahmen werden im begrenzten, bereinigten Protokoll `BLUN_HOME/diagnostics/runtime-exits.jsonl` erfasst. Die Diagnose startet keinen neuen Prozess und ändert beim Start keine Windows-Registrywerte.
+
+Ausführliche Node-Berichte sind optional. Nur `BLUN_NODE_CRASH_REPORTS=1` aktiviert sie für den gestarteten Prozess. Die Berichte liegen unter `BLUN_HOME/diagnostics/crash-dumps`. Umgebungsvariablen und Netzwerkinformationen werden ausgeschlossen; Programmargumente, Dateipfade und weitere sensible Prozessdaten können trotzdem enthalten sein. Berichte vor einer Weitergabe prüfen.
+
+Drei gemeinsam reservierte Plätze begrenzen die Anzahl dieser Node-Berichte, nicht deren Dateigröße. Ein ordentlich beendeter Prozess gibt seine Reservierung frei; ein späterer Prozess kann den Bericht dieses Platzes ersetzen. Aktive oder unklar verwaiste Reservierungen werden nicht automatisch entfernt. Sind alle Plätze belegt oder liegen alte Berichte mit Zufallskennung vor, bleiben neue Detailberichte aus, bis der Betreiber diese Dateien ausdrücklich geprüft und bereinigt hat. Der normale Start und das kleine Fehlerprotokoll bleiben davon unabhängig. Sitzungen und fremde Dateien werden nicht entfernt.
+
+Native Windows-Dumps sind davon getrennt. Der mitgelieferte Helfer `bin/windows-node-crash-dump.cjs` bietet `--query-wer` für eine reine Abfrage. Eine Änderung erfordert ausdrücklich `--configure-wer --confirm-system-wide`, ein gesetztes `BLUN_HOME` und ausreichende Windows-Rechte. Sie betrifft alle Prozesse namens `node.exe`, nicht nur BLUN: drei Minidumps im angegebenen Diagnoseordner. Bei einem Teilfehler nennt die JSON-Ausgabe die bereits gesetzten Werte. Der normale Start ruft diesen Befehl niemals auf.
+
+Node-Berichte erfassen unterstützte Node-Fehler; sie sind kein Beleg dafür, dass jeder native Windows-Abbruch erfasst wird. Die Funktion lässt den ursprünglichen Fehler und den vorgesehenen Prozessabbruch bestehen.

package/agent-spine-plugin/CHANGELOG.md

@@ -58,6 +58,7 @@ All notable changes to AgentSpine will be documented here. The project follows [
 
 ### Fixed
 
+- King keeps complete instructions within the existing source-reader resource bounds, resolves its isolated profile first, and accounts for JSON escaping without adding an instruction-size gate. Routine hooks, lifecycle receipts and process advisories use quiet `additionalContext`; actual denials and exact source/receipt checks remain unchanged. Synthetic fresh/upgrade probes cover large and combined sources, escaping and byte preservation. Package allowance grows by 4 KiB unpacked for the helper and install checks; packed and file-count limits stay fixed. Live King/macOS acceptance remains separate.
 - The portal/thread lifecycle probe that starts a fresh process now runs outside the shared Windows I/O pool. Its existing assertions and process deadlines are unchanged.
 - The hermetic runner isolates the real host-origin source-attestation probe from concurrent Windows filesystem pressure, preserving its existing fail-closed result and timing boundaries without increasing a timeout.
 - Reuse host-verified, assignment-bound briefing observations in MCP delivery preparation without a second content fetch; keep missing proof advisory and document provider-specific history limits.

package/agent-spine-plugin/docs/host-integration.md

@@ -10,7 +10,7 @@ Provider evidence is not interchangeable. Each adapter separately binds its life
 |---|---|---|---|
 | Project instructions | `CLAUDE.md` hierarchy | `AGENTS.md` hierarchy | `AGENTS.md` through the isolated BLUN profile |
 | Hook package | Native `hooks/hooks.json` | Explicit `hooks/codex.json` | Manifest lifecycle hooks |
-| Verified hook briefing → delivery knowledge | Native `additionalContext` handoff receipt | Native `additionalContext` handoff receipt | Native bounded `message` handoff receipt; live acceptance open |
+| Verified hook briefing → delivery knowledge | Native `additionalContext` handoff receipt | Native `additionalContext` handoff receipt | Bounded model-only `additionalContext` handoff receipt; live acceptance open |
 | Historical transcript enrollment | Bounded registered Claude source | Bounded Codex `sessions` source with verified headers | Protected King agent-wire mapping; live mapping open |
 | Cross-provider evidence handoff | Explicit opt-in; Claude provenance retained | Explicit opt-in; Codex provenance retained | Same contract; live launcher unverified |
 | Native permissions/trust | Host-owned | Host-owned | Host-owned; enforcement of returned block decisions remains externally unverified |
@@ -19,6 +19,20 @@ Provider evidence is not interchangeable. Each adapter separately binds its life
 
 Adapter acceptance uses bounded synthetic A/B sessions and covers restart, source mutation, foreign scope, private exclusion and service failure. Cross-provider recall still needs local opt-in plus `includePriorProviders: true` with `includePriorSessions: true`. Report repository, installed-host and model observations separately.
 
+King preparation, lifecycle receipts and process advisories do not emit visible
+`message` prompts. Required instructions remain byte-exact; `UserPromptSubmit`
+uses model-only `additionalContext`. Other events also return that quiet field;
+whether the host consumes it is a separate lifecycle contract. Actual deny/block
+decisions retain their original error schema.
+King uses the existing source-reader safety bounds of 4 MiB per document and
+8 MiB for the source set, not Codex's 32 KiB instruction cap. When both King
+environment bindings are present, `BLUN_HOME` owns the profile even if an unrelated
+`CODEX_HOME` is inherited. These are resource limits, not recommended file sizes.
+Codex/King internal hook envelopes account for the serialized verified briefing,
+including JSON escaping. King's emitted runtime context remains at most 1200
+bytes; its native instruction loader separately supplies full instructions.
+Claude's existing instruction and context limits remain unchanged.
+
 ## Claude Code
 
 | Component | Path | Purpose |

package/agent-spine-plugin/docs/preflight-recall.md

@@ -6,7 +6,7 @@ The receipt binds agent and optional persona, user, tenant, host, instruction ho
 
 ## Host instructions
 
-Claude Code uses its resolved user and project `CLAUDE.md` hierarchy. Codex uses the corresponding `AGENTS.override.md`/`AGENTS.md` hierarchy. A generic host must explicitly bind `instruction_host` to `claude` or `codex`; AgentSpine does not guess. The mandatory preflight section contains the complete bytes of every active instruction document. Its standard hard budget is 8 KiB. Claude instructions may use one explicit aggregate overflow up to 16 KiB; the mode, used bytes, overflow and hard limit are bound into the signed exact-turn receipt and revalidated before consumption. Codex and generic instruction hosts remain capped at 8 KiB. An unreadable, replaced, deleted, oversized, out-of-scope, or symlinked mandatory file blocks immediately with a visible bounded diagnostic instead of degrading to a descriptor or waiting silently.
+Claude Code uses its resolved user and project `CLAUDE.md` hierarchy. Codex uses the corresponding `AGENTS.override.md`/`AGENTS.md` hierarchy. A generic host must explicitly bind `instruction_host` to `claude` or `codex`; AgentSpine does not guess. The mandatory preflight section contains the complete bytes of every active instruction document. The standard budget is 8 KiB, with aggregate overflow up to 16 KiB for Claude or 32 KiB for Codex. King uses its own profile and the existing source-reader resource limits: 4 MiB per source and 8 MiB total, not a recommended instruction size (see [host integration](host-integration.md)). The mode, used bytes, overflow and hard limit are bound into the signed exact-turn receipt and revalidated before consumption. An unreadable, replaced, deleted, resource-oversized, out-of-scope, or symlinked mandatory file blocks immediately with a visible bounded diagnostic instead of degrading to a descriptor or waiting silently.
 
 Claude Code's `InstructionsLoaded` lifecycle event is registered as an additional observability signal, while `UserPromptSubmit` remains the blocking and injection boundary. Codex uses its own manifest-selected hook set without that unsupported Claude-only event. The preflight does not rely on the model remembering to read a file or call a tool.
 

package/agent-spine-plugin/scripts/check-install-hook.js

@@ -101,6 +101,7 @@ export async function invokeInstalledHook(pluginRoot, projectRoot, stateRoot, ho
           decision: protocol.decision || null,
           reason: protocol.reason || null,
           message: protocol.hookSpecificOutput?.message || null,
+          additionalContext: protocol.hookSpecificOutput?.additionalContext || null,
           ...protocolShape(protocol)
         });
       } catch (error) {
@@ -122,7 +123,7 @@ export async function invokeInstalledBlunPostWriteDigest(pluginRoot, projectRoot
   };
   const prompted = await invokeInstalledHook(pluginRoot, projectRoot, stateRoot, "blun", shared,
     { requireBriefing: false });
-  const requirementId = prompted.message?.match(
+  const requirementId = prompted.additionalContext?.match(
     /Requirement: (premortem-requirement:[a-f0-9]{64}:[a-f0-9]{64})/
   )?.[1];
   if (!requirementId) throw new Error("installed BLUN prompt did not expose its premortem requirement");
@@ -163,12 +164,12 @@ export async function invokeInstalledBlunPostWriteDigest(pluginRoot, projectRoot
   const post = await invokeInstalledHook(pluginRoot, projectRoot, stateRoot, "blun", {
     ...shared, ...tool, hook_event_name: "PostToolUse", success: true, tool_response: { ok: true }
   }, { requireBriefing: false });
-  const digest = post.message?.match(/Premortem latest write sha256 ([a-f0-9]{64})/)?.[1];
+  const digest = post.additionalContext?.match(/Premortem latest write sha256 ([a-f0-9]{64})/)?.[1];
   if (!digest || !exactKeys(post.protocolKeys, ["hookSpecificOutput"])
-    || !exactKeys(post.hookSpecificKeys, ["hookEventName", "message"])) {
-    throw new Error("installed BLUN PostToolUse did not return its latest-write digest through message");
+    || !exactKeys(post.hookSpecificKeys, ["additionalContext", "hookEventName"])) {
+    throw new Error("installed BLUN PostToolUse did not return its latest-write digest through model context");
   }
-  return { contextField: "message", latestWriteDigest: digest };
+  return { contextField: "additionalContext", latestWriteDigest: digest };
 }
 
 function exactKeys(value, expected) {

package/agent-spine-plugin/scripts/check-install-king.js

@@ -0,0 +1,37 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { invokeInstalledHook } from "./check-install-hook.js";
+
+export async function invokeInstalledKingInstructions(pluginRoot, workspace) {
+  const results = [];
+  for (const [name, projectBytes, userBytes, fill] of [
+    ["large", 44000, 0, "x"], ["combined", 25000, 19000, "x"], ["escaped", 32768, 0, '"']
+  ]) {
+    const root = join(workspace, name, "project"), home = join(workspace, name, "home");
+    await mkdir(join(root, ".git"), { recursive: true });
+    await mkdir(home, { recursive: true });
+    const sources = new Map();
+    for (const [path, bytes] of [[join(root, "AGENTS.md"), projectBytes], [join(home, "AGENTS.md"), userBytes]]) {
+      if (!bytes) continue;
+      const header = "# Synthetic installed King instructions\n\n";
+      const content = Buffer.from(header + fill.repeat(bytes - Buffer.byteLength(header)));
+      await writeFile(path, content); sources.set(path, content);
+    }
+    const output = await invokeInstalledHook(pluginRoot, root, join(workspace, name, "state"), "blun", {
+      hook_event_name: "UserPromptSubmit", host: "codex", cwd: root,
+      session_id: `session:king-${name}`, event_id: `turn:king-${name}`,
+      prompt: "Inspect the complete synthetic instructions."
+    }, { requireBriefing: false, extraEnv: { BLUN_HOME: home, CODEX_HOME: home } });
+    const bytes = Buffer.byteLength(output.additionalContext || "");
+    if (output.decision || output.message || !bytes || bytes > 1200
+      || JSON.stringify(output.hookSpecificKeys) !== JSON.stringify(["additionalContext", "hookEventName"])) {
+      throw new Error(`installed King ${name} must accept full instructions through quiet bounded context: ${output.reason}`);
+    }
+    for (const [path, original] of sources) {
+      if (!(await readFile(path)).equals(original)) throw new Error("installed King changed source instructions");
+    }
+    results.push({ name, instructionBytes: projectBytes + userBytes, contextBytes: bytes,
+      contextField: "additionalContext", sourcePreserved: true });
+  }
+  return results;
+}

package/agent-spine-plugin/scripts/check-install.js

@@ -12,6 +12,7 @@ import {
   invokeInstalledBlockingProtocols, invokeInstalledBlunPostWriteDigest, invokeInstalledHook
 } from "./check-install-hook.js";
 import { invokeInstalledSelfstarter as runInstalledSelfstarter } from "./check-install-selfstarter.js";
+import { invokeInstalledKingInstructions } from "./check-install-king.js";
 
 function hash(value) {
   return createHash("sha256").update(value).digest("hex");
@@ -364,13 +365,15 @@ export async function checkInstall(root = process.cwd()) {
     await mkdir(userProject, { recursive: true });
     await writeFile(source, "# Existing soul\n\nNever modify me.\n", "utf8");
     await writeFile(join(userProject, "CLAUDE.md"), "# Installed Claude rules\n\nLoad this before every answer.\n", "utf8");
-    await writeFile(join(userProject, "AGENTS.md"), "# Installed Codex rules\n\nLoad this before every answer.\n", "utf8");
+    const largeCodexRules = `# Installed Codex rules\n\n${"x".repeat(17_590 - 25)}`;
+    await writeFile(join(userProject, "AGENTS.md"), largeCodexRules, "utf8");
     const protectedInstallSources = [source, join(userProject, "CLAUDE.md"), join(userProject, "AGENTS.md")];
     const sourceHashes = new Map(await Promise.all(protectedInstallSources.map(async (path) => [path, hash(await readFile(path))])));
 
     const fresh = join(workspace, "fresh", "agent-spine");
     await copyBundle(root, fresh);
     const freshResult = await checkHosts(fresh);
+    const freshKing = await invokeInstalledKingInstructions(fresh, join(workspace, "king-fresh"));
     const aliasRoot = join(workspace, "fresh-alias");
     await symlink(join(workspace, "fresh"), aliasRoot, process.platform === "win32" ? "junction" : "dir");
     const aliasResult = await checkHosts(join(aliasRoot, "agent-spine"));
@@ -410,6 +413,7 @@ export async function checkInstall(root = process.cwd()) {
     await removeTree(installed);
     await rename(staging, installed);
     const upgraded = await checkHosts(installed);
+    const upgradedKing = await invokeInstalledKingInstructions(installed, join(workspace, "king-upgrade"));
     const upgradeState = join(workspace, "state-upgrade");
     const upgradedHook = await invokeInstalledHook(installed, userProject, upgradeState, "codex");
     const upgradedBlockingProtocols = await invokeInstalledBlockingProtocols(
@@ -439,6 +443,7 @@ export async function checkInstall(root = process.cwd()) {
       automaticBriefing: { fresh: freshHook, upgrade: upgradedHook },
       blockingProtocols: { fresh: freshBlockingProtocols, upgrade: upgradedBlockingProtocols },
       blunPostWriteDigest: { fresh: freshBlunPost, upgrade: upgradedBlunPost },
+      kingInstructions: { fresh: freshKing, upgrade: upgradedKing },
       automaticAttention: { fresh: freshAttention, upgrade: upgradedAttention },
       automaticSelfstarter: { fresh: freshSelfstarter, upgrade: upgradedSelfstarter },
       automaticChannelWake: { fresh: freshChannelWake, upgrade: upgradedChannelWake },

package/agent-spine-plugin/scripts/release-check.js

@@ -8,7 +8,8 @@ const SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?
 // Includes the bounded user-feedback candidate path; this is not semantic acceptance.
 // Measured code growth before documentation: 1874 packed / 7830 unpacked bytes.
 const MAX_PACKED_BYTES = 544 * 1024;
-const MAX_UNPACKED_BYTES = 2430 * 1024;
+// King instruction/handoff fix and copied-install probes add about 4 KiB unpacked.
+const MAX_UNPACKED_BYTES = 2434 * 1024;
 const REQUIRED_PACKAGE_FILES = [
   "blun.plugin.json", ".claude-plugin/plugin.json", ".codex-plugin/plugin.json", ".mcp.json",
   "CHANGELOG.md", "LICENSE", "README.md", "bin/agentspine.js", "bin/agentspine-mcp.js",
@@ -78,7 +79,7 @@ function validatePackageReport(report, version) {
   assert(typeof item.integrity === "string" && item.integrity.startsWith("sha512-"), "npm pack did not report SHA-512 integrity");
   assert(Number.isInteger(item.entryCount) && item.entryCount > 0 && item.entryCount <= 500, "npm package file count is outside the release limit");
   assert(Number.isInteger(item.size) && item.size > 0 && item.size <= MAX_PACKED_BYTES, "npm package exceeds the 544 KiB packed release limit");
-  assert(Number.isInteger(item.unpackedSize) && item.unpackedSize > 0 && item.unpackedSize <= MAX_UNPACKED_BYTES, "npm package exceeds the 2430 KiB unpacked release limit");
+  assert(Number.isInteger(item.unpackedSize) && item.unpackedSize > 0 && item.unpackedSize <= MAX_UNPACKED_BYTES, "npm package exceeds the 2434 KiB unpacked release limit");
   const paths = (item.files || []).map((file) => file.path);
   assert(paths.length === new Set(paths).size, "npm package contains duplicate paths");
   for (const path of REQUIRED_PACKAGE_FILES) assert(paths.includes(path), `npm package is missing required file: ${path}`);

package/agent-spine-plugin/src/cli-agent.js

@@ -2,7 +2,7 @@ import { checkDelegation, createTask, deleteTask, grantDelegation, loadDelegatio
 import { cancelJob, deleteJob, grantExecution, loadExecutionPolicy, registerJob, revokeExecution, selfstarterContext } from "./lib/selfstarter.js";
 import { channelRuntimeContext, grantChannelBinding, loadChannelPolicy, revokeChannelBinding } from "./lib/channel-runtime.js";
 import { personaContext, syncPersonaRosterFromEnvironment } from "./lib/persona-runtime.js";
-import { assignGoal, gatewayContext, resolveGoalKnowledgeGap, setGatewayControl } from "./lib/gateway-runtime.js";
+import { assignGoal, gatewayContext, resolveGoalKnowledgeGap, reviewLegacyGatewayHold, setGatewayControl } from "./lib/gateway-runtime.js";
 import {
   currentHostTranscriptReceipt, enrollPrivateSessionTimeline, LOCAL_TIMELINE_ENROLLMENT_CONFIRMATION,
   LOCAL_TIMELINE_ENROLLMENT_RECOVERY_CONFIRMATION, resetPrivateSessionTimelineEnrollment
@@ -35,6 +35,7 @@ export const agentCommands = new Set([
   "goal-assign",
   "goal-clarify",
   "gateway-control",
+  "gateway-review-legacy-hold",
   "gateway-status",
   "timeline-receipt",
   "timeline-enroll",
@@ -293,4 +294,22 @@ export async function runAgentCommand({ command, flags, positional, json }) {
   if (command === "gateway-status") {
     return output(await gatewayContext({ root: positional[0] || process.cwd(), agentId: flags.agent || null }), json);
   }
+
+  if (command === "gateway-review-legacy-hold") {
+    const required = ["root", "goal", "owner", "project", "worker", "claimed-at", "attempt", "review-note"];
+    const allowed = new Set([...required, "group", "host-stopped", "effects-reviewed", "confirm-local-review", "json"]);
+    if (positional.length !== 1 || Object.keys(flags).some((name) => !allowed.has(name))) {
+      throw new Error("legacy hold review accepts one queue ID and only its documented exact review flags");
+    }
+    if (required.some((name) => typeof flags[name] !== "string" || !flags[name])) {
+      throw new Error("legacy hold review requires explicit root, goal, owner, project, worker, claimed-at, attempt and review-note");
+    }
+    return output(await reviewLegacyGatewayHold({
+      root: flags.root, queueId: positional[0], goalId: flags.goal, ownerSubjectId: flags.owner,
+      projectId: flags.project, groupId: flags.group ?? null, workerId: flags.worker,
+      claimedAt: flags["claimed-at"], attempt: Number(flags.attempt), reviewNote: flags["review-note"],
+      hostStopped: booleanFlag(flags["host-stopped"]), effectsReviewed: booleanFlag(flags["effects-reviewed"]),
+      confirmation: booleanFlag(flags["confirm-local-review"]) ? "local-owner-confirmed" : null
+    }), json);
+  }
 }

package/agent-spine-plugin/src/cli.js

@@ -115,6 +115,7 @@ Usage:
   agentspine goal-clarify <goal-id> --gap id --answer text [--source owner-input|objective-observation] [--source-digest sha256] --confirm-local-goal
   agentspine gateway-control [root] [--enabled true|false] [--kill-switch true|false] --confirm-local-gateway
   agentspine gateway-status [root] [--agent id]
+  agentspine gateway-review-legacy-hold <queue-id> --root path --goal id --owner id --project id [--group id] --worker id --claimed-at ISO --attempt n --review-note text --host-stopped --effects-reviewed --confirm-local-review
   agentspine share-keygen <signer-id> [--public-out signer.json] [--rotate] [--confirm-local-share]
   agentspine share-signers [root]
   agentspine share-trust <signer.json> [--root path] [--confirm-local-share]

package/agent-spine-plugin/src/index.js

@@ -48,7 +48,7 @@ export {
 export {
   EXECUTION_ATTEMPT_SCHEMA, GATEWAY_EVENT_SCHEMA, GATEWAY_POLICY_SCHEMA, GATEWAY_RUNTIME_SCHEMA,
   GOAL_PLAN_SCHEMA,
-  assignGoal, claimGatewayWork, completeGatewayRun, deliverPrepared, failGatewayRun, markGatewayHostStarted,
+  assignGoal, claimGatewayWork, completeGatewayRun, deliverPrepared, failGatewayRun, markGatewayHostStarted, reviewLegacyGatewayHold,
   enqueueGatewayWake, executionAttemptForStep, gatewayContext, gatewayRuntimeFindings,
   inspectGatewayRuntime, loadGatewayRuntime, reconcileGateway, resolveGoalKnowledgeGap, setGatewayControl
 } from "./lib/gateway-runtime.js";

package/agent-spine-plugin/src/lib/delivery-command-actions.js

@@ -298,7 +298,7 @@ function segmentWrites(segment) {
   if (executable === "dd") return tokens.slice(1).some((token) => /^of=/.test(token.value));
   if (new Set(["bash", "sh", "zsh", "pwsh", "powershell"]).has(executable)
     && new Set(["-c", "-command"]).has(tokens[1]?.value.toLowerCase()) && tokens[2]) {
-    return commandWriteActions(tokens[2].value).length > 0;
+    return commandWriteActions(tokens[2].value, 0, executable === "pwsh" || executable === "powershell").length > 0;
   }
   if (executable === "eval" && tokens[1]) {
     return commandWriteActions(tokens.slice(1).map((token) => token.value).join(" ")).length > 0;
@@ -378,7 +378,7 @@ function structuredComparisonIndexes(command) {
   return indexes;
 }
 
-function redirectionActions(command) {
+function redirectionActions(command, powershell = false) {
   const actions = [];
   const comparisons = structuredComparisonIndexes(command);
   let quote = null;
@@ -405,26 +405,32 @@ function redirectionActions(command) {
     if (next === ">") index += 1;
     let target = index + 1;
     while (/\s/.test(command[target] || "")) target += 1;
+    const tail = shellSegments(command.slice(target))[0]?.text || "";
+    const sink = shellTokens(tail)[0];
+    const nullDevice = ((!powershell || process.platform !== "win32") && sink?.value === "/dev/null")
+      || (process.platform === "win32" && /^nul$/i.test(sink?.value || ""));
+    const nullVariable = powershell && sink?.plain && /^\$null$/i.test(sink.value);
+    if (nullDevice || nullVariable) continue;
     if (!["&", "="].includes(command[target])) actions.push({ kind: "write", family: null, index });
   }
   return actions;
 }
 
-function commandWriteActions(command, depth = 0) {
+function commandWriteActions(command, depth = 0, powershell = false) {
   const heredocs = maskHeredocBodies(command);
   const analyzable = heredocs.command;
   const actions = shellSegments(analyzable).filter(segmentWrites)
     .map((segment) => ({ kind: "write", family: null, index: segment.index }));
-  actions.push(...redirectionActions(analyzable));
+  actions.push(...redirectionActions(analyzable, powershell));
   if (depth < MAX_SUBSTITUTION_DEPTH) {
     for (const heredoc of heredocs.bodies) {
       const executable = shellExecutableName(executableTokens(heredoc.opener)[0]?.value);
       if (!SHELL_STDIN_EXECUTORS.has(executable)) continue;
-      actions.push(...commandWriteActions(heredoc.text, depth + 1)
+      actions.push(...commandWriteActions(heredoc.text, depth + 1, false)
         .map((action) => ({ ...action, index: heredoc.index + action.index })));
     }
     for (const substitution of shellSubstitutions(analyzable, depth)) {
-      actions.push(...commandWriteActions(substitution.text, depth + 1)
+      actions.push(...commandWriteActions(substitution.text, depth + 1, powershell)
         .map((action) => ({ ...action, index: substitution.index + action.index })));
     }
   }
@@ -446,7 +452,10 @@ export function deliveryToolActions(input) {
   if (!SHELL_TOOLS.test(toolName)) return [];
   const command = commandFromInput(input);
   if (command.length > MAX_COMMAND_CHARS) return [];
-  const actions = commandWriteActions(command);
+  const toolInput = input?.tool_input ?? input?.tool_args;
+  const powershell = /(^|__)(powershell|pwsh)(_|$)/i.test(toolName)
+    || /(?:^|[\\/])(?:powershell|pwsh)(?:\.exe)?$/i.test(toolInput?.shell || "");
+  const actions = commandWriteActions(command, 0, powershell);
   const test = trailingTestAction(command);
   if (test) actions.push(test);
   return actions.sort((left, right) => left.index - right.index || left.kind.localeCompare(right.kind));

package/agent-spine-plugin/src/lib/gateway-control.js

@@ -2,6 +2,7 @@ import { attentionFindings, loadAttention } from "./attention.js";
 import { channelRuntimeFindings, loadChannelPolicy, loadChannelRuntime } from "./channel-runtime.js";
 import { loadGraph } from "./graph.js";
 import { expireGatewayLane } from "./gateway-host-lifecycle.js";
+import { heldExecution } from "./gateway-host-fencing.js";
 import * as goalPremortem from "./gateway-premortem.js";
 import { resolveKnowledgeGapCandidate, sameKnowledgeGapResolution } from "./knowledge-evidence.js";
 import { loadPersonaRuntime, personaRuntimeFindings } from "./persona-runtime.js";
@@ -33,6 +34,71 @@ export async function setGatewayControl({ root = process.cwd(), enabled, killSwi
   });
 }
 
+export async function reviewLegacyGatewayHold({ root = process.cwd(), queueId, goalId, ownerSubjectId,
+  projectId, groupId = null, workerId, claimedAt, attempt, hostStopped, effectsReviewed, reviewNote,
+  confirmation, now = new Date() }) {
+  if (confirmation !== CONFIRMATION || hostStopped !== true || effectsReviewed !== true) {
+    throw new Error("legacy hold review requires explicit local owner confirmation of host stop and reviewed effects");
+  }
+  queueId = exactId(queueId, "queueId"); goalId = exactId(goalId, "goalId");
+  ownerSubjectId = exactId(ownerSubjectId, "ownerSubjectId"); workerId = exactId(workerId, "workerId");
+  projectId = exactId(projectId, "projectId"); groupId = exactId(groupId, "groupId", true);
+  if (typeof claimedAt !== "string" || timestamp(claimedAt) !== claimedAt
+    || !Number.isInteger(attempt) || attempt < 1 || attempt > 20) {
+    throw new Error("legacy hold review requires the exact claim timestamp and integer attempt");
+  }
+  if (typeof reviewNote !== "string" || reviewNote.length > 500) throw new Error("legacy review note must contain 1-500 characters");
+  reviewNote = safeText(reviewNote, "reviewNote", 500);
+  const current = timestamp(now);
+  const paths = await pathsFor(root);
+  return withLock(paths, async () => {
+    const policy = await readJson(paths.gatewayPolicyPath, paths.catalog.root, normalizePolicy, emptyPolicy);
+    const runtime = await readJson(paths.gatewayRuntimePath, paths.catalog.root, normalizeRuntime, emptyRuntime);
+    const item = runtime.queue.find((entry) => entry.queueId === queueId);
+    const goal = policy.goals.find((entry) => entry.goalId === goalId);
+    const step = goal?.plan?.steps.find((entry) => entry.stepId === item?.goalStepId);
+    if (!item || !goal || item.goalId !== goalId || goal.ownerSubjectId !== ownerSubjectId
+      || item.projectId !== projectId || goal.projectId !== projectId
+      || item.groupId !== groupId || goal.groupId !== groupId
+      || (item.goalStepId && !step) || item.agentId !== planStepAgentId(goal, step)) {
+      throw new Error("legacy hold review requires the exact goal owner and queue scope");
+    }
+    const hold = item.executionHold;
+    if (!hold || hold.workerId !== workerId || hold.claimedAt !== claimedAt || hold.attempt !== attempt) {
+      throw new Error("legacy hold review requires the exact held generation");
+    }
+    if (hold.hostSessionId !== null || runtime.history.some((entry) => entry.kind === "queue"
+      && entry.objectId === queueId && entry.value.attempts === attempt
+      && entry.value.executionHold?.hostSessionId)) {
+      throw new Error("a known host session requires exact-session quiescence, not legacy owner review");
+    }
+    if (item.lease !== null || !["blocked", "cancelled"].includes(item.status)) {
+      throw new Error("legacy owner review requires an unleased blocked or cancelled queue item");
+    }
+    const details = { goalId, ownerSubjectId, projectId, groupId, workerId, claimedAt, attempt,
+      hostStopped: true, effectsReviewed: true, reviewNote, reviewBasis: "local-owner-attestation" };
+    if (hold.status === "settled") {
+      const receipt = runtime.receipts.find((entry) => entry.kind === "legacy-host-owner-reviewed"
+        && entry.objectId === queueId && entry.details.workerId === workerId
+        && entry.details.claimedAt === claimedAt && entry.details.attempt === attempt);
+      if (!receipt || JSON.stringify(receipt.details) !== JSON.stringify(details)) {
+        throw new Error("legacy hold already has a different settlement or owner review");
+      }
+      return { item: structuredClone(item), receipt: structuredClone(receipt), duplicate: true };
+    }
+    if (current < item.updatedAt || current < claimedAt || (hold.hostStartedAt && current < hold.hostStartedAt)) {
+      throw new Error("legacy review timestamp precedes the held generation");
+    }
+    // This attestation is not native quiescence, goal completion, or authority to resume work.
+    preserve(runtime, "queue", item, "legacy-host-owner-reviewed", current);
+    hold.status = "settled"; hold.settledAt = current;
+    item.updatedAt = current; runtime.revision += 1;
+    const receipt = appendReceipt(runtime, "legacy-host-owner-reviewed", queueId, current, details);
+    await writeJson(paths.gatewayRuntimePath, runtime);
+    return { item: structuredClone(item), receipt: structuredClone(receipt), duplicate: false };
+  });
+}
+
 export async function assignGoal({ root = process.cwd(), goalId, agentId, ownerSubjectId, projectId, groupId = null,
   priority = 70, successCriterion, nextSafeStep = null, steps = null, deadline = null, confirmation, now = new Date() }) {
   if (confirmation !== CONFIRMATION) throw new Error("goal assignment requires explicit local owner confirmation");
@@ -76,6 +142,9 @@ export async function assignGoal({ root = process.cwd(), goalId, agentId, ownerS
     if (previous?.plan && previous.plan.definitionsDigest !== goal.plan?.definitionsDigest) {
       throw new Error("goal plan definitions are immutable; assign a new goal ID");
     }
+    if (previous && runtime.queue.some((item) => item.goalId === goalId && heldExecution(item))) {
+      return { goal: structuredClone(previous), gatewayPolicyPath: paths.gatewayPolicyPath, duplicate: true, held: true };
+    }
     if (previous?.plan && previous.status === "blocked") {
       const blockedStep = currentPlanStep(previous);
       if (!blockedStep || blockedStep.status !== "blocked") throw new Error("blocked goal plan has no bound blocked step");
@@ -299,4 +368,3 @@ export async function reconcileGateway({ root = process.cwd(), now = new Date()
     return { policy, runtime, recovered: true };
   });
 }
-

package/agent-spine-plugin/src/lib/gateway-host-fencing.js

@@ -0,0 +1,92 @@
+import { ID_RE, safeCheckpoint, sha256 } from "./gateway-common.js";
+
+const SCHEMA = "agentspine.host-execution-hold/v1";
+const validTime = (value) => typeof value === "string" && Number.isFinite(new Date(value).getTime());
+
+export function heldExecution(item) {
+  return item?.executionHold?.status === "held" ? item.executionHold : null;
+}
+
+export function newExecutionHold(item, resources = null) {
+  return { schema: SCHEMA, status: "held", workerId: item.lease.workerId,
+    claimedAt: item.lease.claimedAt, attempt: item.attempts,
+    hostSessionId: null, hostStartedAt: item.lease.hostStartedAt ?? null,
+    resources, settledAt: null, checkpointDigest: null, authority: "execution-state-only" };
+}
+
+export function validExecutionHold(item) {
+  const hold = item.executionHold;
+  if (hold === undefined) return true;
+  return hold && hold.schema === SCHEMA && ["held", "settled"].includes(hold.status)
+    && ID_RE.test(hold.workerId || "") && validTime(hold.claimedAt)
+    && Number.isInteger(hold.attempt) && hold.attempt > 0 && hold.attempt === item.attempts
+    && (hold.hostSessionId === null || ID_RE.test(hold.hostSessionId || ""))
+    && (hold.hostStartedAt === null || validTime(hold.hostStartedAt))
+    && (hold.resources === null || (Array.isArray(hold.resources) && hold.resources.length <= 16
+      && new Set(hold.resources).size === hold.resources.length && hold.resources.every((resource) => ID_RE.test(resource || ""))))
+    && (hold.status === "held" ? hold.settledAt === null && hold.checkpointDigest === null
+      : validTime(hold.settledAt) && (hold.checkpointDigest === null || /^[a-f0-9]{64}$/.test(hold.checkpointDigest)))
+    && (!item.lease || (hold.status === "held" && hold.workerId === item.lease.workerId
+      && hold.claimedAt === item.lease.claimedAt))
+    && hold.authority === "execution-state-only";
+}
+
+// Old ambiguous records have no resource snapshot. Conservatively retain the whole scope.
+export function retainLegacyExecutionHolds(runtime) {
+  for (const item of runtime.queue) {
+    if (item.executionHold !== undefined) continue;
+    let original = item.lease ? item : null;
+    if (!original && ["blocked", "cancelled"].includes(item.status)) {
+      original = runtime.history.findLast((entry) => entry.kind === "queue"
+        && entry.objectId === item.queueId && entry.value.attempts === item.attempts
+        && entry.value.lease && entry.value.lease.executionMode !== "read-only")?.value;
+    }
+    if (original?.lease && original.lease.executionMode !== "read-only") {
+      item.executionHold = newExecutionHold(original);
+    }
+  }
+}
+
+export function executionBlocks(heldItem, candidate, resources) {
+  const hold = heldExecution(heldItem);
+  if (!hold || heldItem.queueId === candidate.queueId) return false;
+  if (heldItem.agentId === candidate.agentId) return true;
+  return heldItem.projectId === candidate.projectId && heldItem.groupId === candidate.groupId
+    && (hold.resources === null || resources.some((resource) => hold.resources.includes(resource)));
+}
+
+export function exactHeldGeneration(item, { workerId, claimedAt, attempt }) {
+  const hold = heldExecution(item);
+  return Boolean(hold && hold.workerId === workerId && hold.claimedAt === claimedAt && hold.attempt === attempt);
+}
+
+export function requireHostQuiescence(item, receipt, result, current) {
+  const hold = heldExecution(item);
+  if (!hold?.hostSessionId) return null;
+  const checkedAt = receipt?.checkedAt;
+  const age = new Date(current).getTime() - checkedAt;
+  if (!receipt || receipt.sessionId !== hold.hostSessionId || receipt.admissionClosed !== true
+    || receipt.status !== "quiescent" || !Array.isArray(receipt.remaining) || receipt.remaining.length !== 0
+    || !Number.isFinite(checkedAt) || age < 0 || age > 30000
+    || checkedAt < new Date(hold.hostStartedAt).getTime()) {
+    throw new Error("host settlement requires fresh exact-session quiescence with no remaining work");
+  }
+  if (item.goalId && (result?.checkpoint === undefined || result.checkpoint === null)) {
+    throw new Error("host settlement requires a non-null goal checkpoint");
+  }
+  return { sessionId: hold.hostSessionId, checkedAt,
+    checkpointDigest: item.goalId ? sha256(JSON.stringify(safeCheckpoint(result.checkpoint))) : null };
+}
+
+export function settleHostExecution(runtime, item, proof, current, appendReceipt) {
+  const hold = heldExecution(item);
+  if (!hold) return null;
+  hold.status = "settled";
+  hold.settledAt = current;
+  hold.checkpointDigest = proof?.checkpointDigest ?? null;
+  return appendReceipt(runtime, "host-execution-settled", item.queueId, current, {
+    workerId: hold.workerId, claimedAt: hold.claimedAt, attempt: hold.attempt,
+    sessionId: hold.hostSessionId, checkedAt: proof?.checkedAt ?? null,
+    checkpointDigest: hold.checkpointDigest, legacy: hold.hostSessionId === null
+  });
+}

package/agent-spine-plugin/src/lib/gateway-host-lifecycle.js

@@ -1,3 +1,5 @@
+import { exactHeldGeneration, heldExecution } from "./gateway-host-fencing.js";
+
 export const AMBIGUOUS_HOST_OUTCOME =
   "Host execution may have produced an effect before restart; manual owner review is required.";
 
@@ -45,7 +47,13 @@ export function exactGatewayLeaseGeneration(claimedAt, attempt, action) {
   return new Date(claimedAt).toISOString();
 }
 
-export function requireExactGatewayLease(runtime, item, { workerId, claimedAt, attempt, current, action }) {
+export function requireExactGatewayLease(runtime, item, { workerId, claimedAt, attempt, current, action, allowHeld = false }) {
+  if (allowHeld && heldExecution(item)?.hostSessionId
+    && exactHeldGeneration(item, { workerId, claimedAt, attempt })) {
+    const lane = runtime.lanes.find((entry) => entry.queueId === item.queueId && entry.workerId === workerId
+      && entry.claimedAt === claimedAt && ["leased", "expired"].includes(entry.status));
+    if (lane) return lane;
+  }
   if (!item || item.status !== "leased" || item.attempts !== attempt
     || item.lease?.workerId !== workerId || item.lease.claimedAt !== claimedAt
     || new Date(item.lease.expiresAt) <= new Date(current)) {

package/agent-spine-plugin/src/lib/gateway-prepared-host.js

@@ -0,0 +1,28 @@
+import { markGatewayHostStarted } from "./gateway-runs.js";
+
+export async function executePreparedHost({ root, item, hostFactory, env, clock }) {
+  const host = await hostFactory(item, { env });
+  if (!host || typeof host.sessionId !== "string" || typeof host.run !== "function"
+    || typeof host.quiesce !== "function") throw new Error("prepared host requires an exact session, run and quiesce");
+  try {
+    await markGatewayHostStarted({ root, queueId: item.queueId, workerId: item.lease.workerId,
+      claimedAt: item.lease.claimedAt, attempt: item.attempts, hostSessionId: host.sessionId, now: clock() });
+  } catch (error) {
+    await host.quiesce().catch(() => {});
+    throw error;
+  }
+  let result;
+  try { result = await host.run(); }
+  catch {
+    result = { text: "Host step failed; the last known checkpoint is retained.", blocked: true,
+      blocker: "Host step failed; inspect the saved session before continuing.",
+      checkpoint: item.goal?.checkpoint ?? { hostStepFailed: true, sessionId: host.sessionId } };
+  }
+  // This is a host-returned observation, separate from model-controlled result JSON.
+  const quiescence = await host.quiesce();
+  if (quiescence?.sessionId !== host.sessionId || quiescence.status !== "quiescent"
+    || quiescence.admissionClosed !== true || !Array.isArray(quiescence.remaining) || quiescence.remaining.length) {
+    throw new Error("Host execution termination remains unconfirmed");
+  }
+  return { result, quiescence };
+}