codehere 0.7.0 → 0.7.1

package/dist/application/use-cases/generate-final-report.js

@@ -1,107 +1,84 @@
 /**
- * Final Report — PM-UX Layer 3 · MVP (v0.5.0-alpha.3+).
+ * Final Report — the headline deliverable. At task exit, produce a plain-English
+ * summary of what the agent did.
  *
- * At task exit, generates a 3-paragraph plain-English summary of what the
- * agent did, what was touched, and what the user should look at. Prints to
- * stdout so the dogfood-while-building loop sees the artifact immediately.
+ * Engine (locked 2026-06-03, after the real dogfood found NO report on a real
+ * conductor run): REUSE THE AGENT SESSION. The agent already narrates what it
+ * did (kind:'say' steps — e.g. "Added subtract(a,b) to utils.js:5"); we use that
+ * directly. No fresh summarizer spawn.
  *
- * Provider strategy (MVP — try free first, fall back to paid):
- *   - Tries `claude-free --bare -p "<prompt>"` first. The `claude-free`
- *     wrapper is what actually routes through the FCC proxy at :8082
- *     (verified 2026-05-02 dogfood: plain `claude --bare` does NOT route
- *     through FCC — it hits paid Claude. The May 1 memory rule was wrong.)
- *   - Falls back to `claude --bare -p "<prompt>"` if `claude-free` is not
- *     installed (paid path; will fail gracefully if no credit).
- *   - If neither binary is installed, returns null silently (no report).
+ * Why the old path was replaced: it spawned a SEPARATE provider binary chain
+ * (`claude-free` → `claude`) to summarize. `claude-free` (the FCC/NIM proxy
+ * binary) is on PATH but its proxy was down → 30s hang → null; the `claude`
+ * fallback also returned null in the conductor exit-handler. Net: a completed
+ * real task showed "⚠ Final Report unavailable" — the headline deliverable
+ * missing. Reusing the agent's own words is cheaper, has full context, and can't
+ * be taken down by an external proxy.
  *
- * Env override: set CODEHERE_REPORT_BINARY=<binary-name> to force a
- * specific provider (e.g. for testing or non-default setups).
- *
- * Iterations 5-9 (2026-05-02) refuted the "we own the supervisory layer"
- * thesis. Final Report is the keystone delivery moment per the v3 chain
- * (claim_market_position) — it's the artifact the dogfood loop produces
- * that none of the surveyed competitors (ComposioHQ, Overstory, Praktor,
- * Claude Squad, AI-Agents-Orchestrator) advertise.
+ * Fallback (locked): when the agent left no usable summary (or it looks like a
+ * provider failure), build a DETERMINISTIC report from the recorded steps +
+ * artifacts. It states ONLY verified facts, says plainly that no written summary
+ * was available, and NEVER implies success — so a completed task always shows a
+ * deliverable, and it's honest about which kind it is (see `source`).
  */
-import { spawn } from 'child_process';
-import { isMockMode } from '../../infrastructure/orchestration/mocks/resolve-agent-spawn.js';
-import { mockFinalReport } from '../../infrastructure/orchestration/mocks/mock-synthesis.js';
-const PROMPT_TEMPLATE = (i) => `You are a PM reporting back to a developer about what their AI coding agent
-just did. Write 3 short paragraphs in plain English. No headers, no bullet
-lists, no markdown — just three paragraphs separated by blank lines.
-
-CRITICAL anti-hallucination rule: ground every claim in the structured data
-below. You CANNOT see the contents of files, the output of commands, or
-anything beyond what's listed under "Steps the agent took" and "Files
-changed". If the data doesn't show specific filenames, do NOT invent any.
-If a step ran a command but its output isn't shown to you, describe what
-the step ATTEMPTED, not what it found. Saying "I don't have the output to
-report on" is correct; making up plausible-sounding details is wrong and
-the developer will catch the lie.
-
-Paragraph 1: What the agent ATTEMPTED. Verb-led. Describe steps as listed.
-             Mention specific filenames ONLY if they appear in the data
-             below. 1-3 sentences.
-Paragraph 2: What was TOUCHED. Reference ONLY the "Files changed" list
-             below. If the list is empty AND "File tracking" says git is
-             available, say "No files were changed." If "File tracking" says
-             git is NOT available, say codehere could not track file changes
-             because this folder is not a git repository — do NOT say no files
-             were changed, because the agent may well have changed files
-             codehere cannot see. 1-2 sentences.
-Paragraph 3: What the developer should LOOK AT. If steps + files data show
-             nothing risky, say so explicitly ("nothing to verify; the
-             session was read-only" or similar). 1-2 sentences.
-
-Be specific where the data lets you. Don't pad. Don't editorialize. Don't
-praise the agent. Don't fabricate file names, line counts, or content
-descriptions you cannot derive from the data below.
-
-The task was: ${i.prompt}
-The agent used: ${i.agent}
-Duration: ${i.durationMs}ms
-Status: ${i.status}
-
-Steps the agent took:
-${i.steps.length ? i.steps.map((s) => `- ${s.label} (${s.state})`).join('\n') : '(no structured steps captured)'}
-
-File tracking: ${i.artifacts?.noGitTracking ? 'git NOT available (this folder is not a git repository — file changes cannot be tracked)' : 'git available'}
-
-Files changed:
-${i.artifacts?.files?.length
-    ? i.artifacts.files
-        .map((f) => `- ${f.path} (+${f.added}/-${f.removed}${f.trust !== undefined ? `, trust: ${f.trust}` : ''})`)
-        .join('\n')
-    : '(no file artifacts captured)'}
-
-Token usage: ${i.artifacts?.usage?.inputTokens ?? 0} in / ${i.artifacts?.usage?.outputTokens ?? 0} out
-
-Now write the 3 paragraphs, grounded ONLY in the data above.`;
-const REPORT_TIMEOUT_MS = 30_000;
-/** Provider chain: try free first, then paid. Override with CODEHERE_REPORT_BINARY. */
-function selectProviderBinary() {
-    const override = process.env.CODEHERE_REPORT_BINARY;
-    if (override)
-        return [override];
-    return ['claude-free', 'claude'];
-}
+const MAX_SUMMARY_CHARS = 1600;
 /**
- * UAT-003 — patterns that indicate the wrapped agent's session terminated
- * because of a network / auth / quota failure rather than a real task.
- * When we see these in the would-be summary text, we prepend a plain-English
- * recovery hint instead of letting the raw provider error echo through.
- *
- * Pre-fix: bare `exit` in REPL → Conductor spawned claude-code → real API
- * call failed with "All connection attempts failed Request ID: req_...";
- * Final Report quoted that text verbatim. Per Core Values #4 + #6, this is
- * unacceptable — the user sees a Request ID that means nothing.
+ * UAT-003 — patterns indicating the agent's own text is actually a network /
+ * auth / quota failure, not a real summary. Such "summaries" must NOT be shown
+ * as the report; they fall through to the deterministic fallback.
  */
 const NETWORK_FAILURE_PATTERNS = /(?:all connection attempts failed|ECONNREFUSED|ENOTFOUND|fetch failed|network error|request id:\s*req_|connection timed out|getaddrinfo)/i;
 function isLikelyNetworkFailureSummary(text) {
     return NETWORK_FAILURE_PATTERNS.test(text);
 }
+/**
+ * ENGINE: the agent's own narration. kind:'say' steps are the words the agent
+ * already emitted (reasoning + wrap-up). Joined newest-context-last, they ARE
+ * the summary — no extra spawn. Returns null if the agent said nothing usable.
+ */
+function extractAgentSummary(steps) {
+    const says = steps
+        .filter((s) => s.kind === 'say' && typeof s.label === 'string' && s.label.trim().length > 0)
+        .map((s) => s.label.trim());
+    if (!says.length)
+        return null;
+    const text = says.join('\n\n').slice(0, MAX_SUMMARY_CHARS);
+    // Too short to be a real summary (e.g. a one-word ack) → let the fallback give facts.
+    return text.length >= 12 ? text : null;
+}
+/**
+ * FALLBACK: deterministic, honest. Facts only, from steps + artifacts. Says
+ * plainly that no written summary was available. Never implies success.
+ */
+function buildDeterministicReport(input) {
+    const files = input.artifacts?.files ?? [];
+    const toolSteps = input.steps.filter((s) => s.kind !== 'say');
+    const noGit = input.artifacts?.noGitTracking;
+    const agentName = input.agent === 'conductor' ? 'the agent codehere chose' : input.agent;
+    const parts = [
+        `No plain-English summary was available for this run — ${agentName} didn't leave a written summary, and codehere doesn't fabricate one. Here are the recorded facts.`,
+        `The session ran ${input.steps.length} step${input.steps.length === 1 ? '' : 's'}` +
+            (toolSteps.length
+                ? ` (${toolSteps.slice(0, 5).map((s) => s.label).join(', ')}${toolSteps.length > 5 ? ', …' : ''})`
+                : '') +
+            `.`,
+    ];
+    if (noGit) {
+        parts.push(`This folder isn't a git repository, so codehere couldn't track which files changed — check the working tree yourself.`);
+    }
+    else if (files.length) {
+        parts.push(`Files changed: ` +
+            files
+                .map((f) => `${f.path} (+${f.added}/-${f.removed}${f.trust !== undefined ? `, trust ${f.trust}` : ''})`)
+                .join('; ') +
+            `.`);
+    }
+    else {
+        parts.push(`No files were changed.`);
+    }
+    return { summary: parts.join('\n\n'), generatedAt: Date.now(), durationMs: 0, source: 'deterministic' };
+}
 function buildErrorRecoveryReport(input, durationMs) {
-    // Tailor the hint to the specific failure shape we can detect from input.
     const agentName = input.agent === 'conductor' ? 'the agent codehere chose' : input.agent;
     return {
         summary: `The ${agentName} session ended without completing the task. ` +
@@ -112,114 +89,32 @@ function buildErrorRecoveryReport(input, durationMs) {
             `codehere couldn't confirm any file changes from this attempt.`,
         generatedAt: Date.now(),
         durationMs,
+        source: 'error-recovery',
     };
 }
 /**
- * Generate a Final Report. Returns null if no provider is reachable.
- * Never throws — failure modes return null + log a debug line.
- *
- * UAT-003 — when the input.status is 'error', we skip the LLM call entirely
- * and return a deterministic recovery hint. Saves tokens on a known-failed
- * task AND gives the user a plain-English next step instead of waiting for
- * a possibly-unhelpful LLM summary.
+ * Generate a Final Report. Reuses the agent's own summary; falls back to a
+ * deterministic, honest facts report. A completed task ALWAYS gets a report
+ * (never null for non-error terminal states) — no external dependency.
  */
 export async function generateFinalReport(input) {
-    // CODEHERE_MOCK — synthesize a grounded report with zero API so the full
-    // demo flow (incl. this headline deliverable + the verify cross-check) runs
-    // under mock. Errors still get the deterministic recovery report below.
-    if (isMockMode() && input.status !== 'error') {
-        return mockFinalReport(input);
-    }
-    // Short-circuit on errored sessions — don't waste tokens summarizing nothing.
+    // No mock short-circuit: under CODEHERE_MOCK the SAME engine runs, so the
+    // narration gap is reproduced faithfully — claude/aider (emit `say`) get a
+    // rich agent-summary; codex/gemini/opencode (no `say`) get the honest
+    // deterministic report, exactly as on a real run. (A prior mock-only
+    // short-circuit synthesized a report from steps for every agent, hiding the
+    // cross-vendor gap — you couldn't dogfood "codex's report is thin" under mock.)
+    // Errored session — deterministic recovery hint, no summarization of nothing.
     if (input.status === 'error') {
         return buildErrorRecoveryReport(input, 0);
     }
-    const prompt = PROMPT_TEMPLATE(input);
-    for (const binary of selectProviderBinary()) {
-        const result = await tryProvider(binary, prompt, input.sessionId);
-        if (result) {
-            // Defense-in-depth: even on 'completed' status, if the generated
-            // summary leaks a provider network-failure string (e.g., the wrapped
-            // agent exited 0 but its assistant text was an error message), wrap
-            // the summary with a recovery preamble.
-            if (isLikelyNetworkFailureSummary(result.summary)) {
-                return {
-                    summary: `Couldn't reach the provider cleanly — the agent's session text looks like a network or auth failure.\n\n` +
-                        `What to try: check your internet, run \`codehere health\`, or rerun in a minute. ` +
-                        `If it persists, switch agents from the dropdown.\n\n` +
-                        `— Raw agent message —\n${result.summary}`,
-                    generatedAt: result.generatedAt,
-                    durationMs: result.durationMs,
-                };
-            }
-            return result;
-        }
+    // ENGINE: reuse the agent's own narration (no fresh spawn).
+    const agentSummary = extractAgentSummary(input.steps);
+    if (agentSummary && !isLikelyNetworkFailureSummary(agentSummary)) {
+        return { summary: agentSummary, generatedAt: Date.now(), durationMs: 0, source: 'agent-summary' };
     }
-    return null;
-}
-function tryProvider(binary, prompt, sessionId) {
-    const startedAt = Date.now();
-    return new Promise((resolve) => {
-        let stdout = '';
-        let stderr = '';
-        let settled = false;
-        const finish = (result) => {
-            if (settled)
-                return;
-            settled = true;
-            resolve(result);
-        };
-        // Provider args per-binary:
-        //   - `claude-free` (FCC proxy binary) needs `--bare` to skip session
-        //     setup that the proxy doesn't implement.
-        //   - Standard `claude` (the Claude Code Max CLI) MUST NOT use `--bare`
-        //     because `--bare` explicitly rejects OAuth and keychain auth — and
-        //     Claude Code Max users authenticate via OAuth. With `--bare`, the
-        //     fallback path returned empty silently, no Final Report ever
-        //     reached the UI, and the dashboard showed `✓ Final Report` on a
-        //     missing artifact. (May 21, 2026 — root cause of CRIT #1.)
-        const args = binary === 'claude-free' ? ['--bare', '-p', prompt] : ['-p', prompt];
-        const child = spawn(binary, args, {
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-        const timeout = setTimeout(() => {
-            child.kill('SIGTERM');
-            if (process.env.CODEHERE_DEBUG === '1') {
-                console.error(`[final-report] ${binary} timeout after ${REPORT_TIMEOUT_MS}ms for ${sessionId}`);
-            }
-            finish(null);
-        }, REPORT_TIMEOUT_MS);
-        child.on('error', (err) => {
-            clearTimeout(timeout);
-            // ENOENT = binary not installed. Silent fallback to next provider in chain.
-            if (process.env.CODEHERE_DEBUG === '1') {
-                console.error(`[final-report] ${binary} unavailable: ${err.message}`);
-            }
-            finish(null);
-        });
-        child.stdout?.on('data', (chunk) => {
-            stdout += chunk.toString('utf8');
-        });
-        child.stderr?.on('data', (chunk) => {
-            stderr += chunk.toString('utf8');
-        });
-        child.on('exit', (code) => {
-            clearTimeout(timeout);
-            if (code !== 0) {
-                if (process.env.CODEHERE_DEBUG === '1') {
-                    console.error(`[final-report] ${binary} exited ${code}: ${stderr.slice(0, 200)}`);
-                }
-                finish(null);
-                return;
-            }
-            const summary = stdout.trim();
-            if (!summary) {
-                finish(null);
-                return;
-            }
-            finish({ summary, generatedAt: Date.now(), durationMs: Date.now() - startedAt });
-        });
-    });
+    // FALLBACK: deterministic, honest — always a deliverable, never a fake ✓.
+    return buildDeterministicReport(input);
 }
 /**
  * Pretty-print to terminal. Used by session-manager when a spawned task exits.

package/dist/infrastructure/orchestration/aider-adapter.js

@@ -342,7 +342,10 @@ export function spawnAider(prompt, options = {}) {
             return new Promise((resolve, reject) => {
                 let stdout = '';
                 let stderr = '';
-                const followup = spawn('aider', ['--restore-chat-history', '--message', text, ...HEADLESS_FLAGS], {
+                // Route follow-ups through the mock seam too — under CODEHERE_MOCK=1 this
+                // hits the mock REPL, not real aider. (Was a real-spend leak.)
+                const sp2 = resolveAgentSpawn('aider', 'aider', ['--restore-chat-history', '--message', text, ...HEADLESS_FLAGS], text);
+                const followup = spawn(sp2.command, sp2.args, {
                     cwd,
                     env: spawnEnv,
                     stdio: ['ignore', 'pipe', 'pipe'],

package/dist/infrastructure/orchestration/claude-code-adapter.js

@@ -384,7 +384,11 @@ export function spawnClaudeCode(prompt, options = {}) {
                 }
                 let stdout = '';
                 let stderr = '';
-                const followup = spawn('claude', ['-p', text, '--resume', claudeSessionId, ...HEADLESS_FLAGS], {
+                // Route follow-ups through the mock seam too — under CODEHERE_MOCK=1 this
+                // hits the mock REPL, not the real binary. (Was a real-spend leak:
+                // appendMessage spawned `claude` directly regardless of mock mode.)
+                const sp2 = resolveAgentSpawn('claude-code', 'claude', ['-p', text, '--resume', claudeSessionId, ...HEADLESS_FLAGS], text);
+                const followup = spawn(sp2.command, sp2.args, {
                     cwd,
                     env: spawnEnv,
                     stdio: ['ignore', 'pipe', 'pipe'],

package/dist/infrastructure/orchestration/codex-adapter.js

@@ -456,15 +456,10 @@ export function spawnCodex(prompt, options = {}) {
                 let stdout = '';
                 let stderr = '';
                 // codex exec resume <SESSION_ID> -  → reads prompt from stdin
-                const followup = spawn('codex', [
-                    'exec',
-                    '--json',
-                    '--skip-git-repo-check',
-                    '--dangerously-bypass-approvals-and-sandbox',
-                    'resume',
-                    codexThreadId,
-                    '-',
-                ], {
+                // Route follow-ups through the mock seam too — under CODEHERE_MOCK=1 this
+                // hits the mock REPL, not real codex. (Was a real-spend leak.)
+                const sp2 = resolveAgentSpawn('codex', 'codex', ['exec', '--json', '--skip-git-repo-check', '--dangerously-bypass-approvals-and-sandbox', 'resume', codexThreadId, '-'], text);
+                const followup = spawn(sp2.command, sp2.args, {
                     cwd,
                     env: spawnEnv,
                     stdio: ['pipe', 'pipe', 'pipe'],

package/dist/infrastructure/orchestration/conductor-adapter.js

@@ -53,9 +53,15 @@ const ROUTING_RULES = [
         reason: 'targeted fixes favor Aider',
     },
     {
-        triggers: ['scaffold', 'generate', 'create new', 'bootstrap', 'set up'],
-        preferred: ['opencode', 'claude-code', 'codex'],
-        reason: 'greenfield generation favors OpenCode',
+        // Narrowed 2026-06-02 (root-cause fix for "randomly uses opencode"): bare
+        // 'generate'/'set up' are far too common ("generate a report", "set up the
+        // config") and were silently routing ordinary tasks to opencode. AND
+        // claude-code now leads — opencode has NO mid-stream visibility (buffered
+        // output), so it must never be the surprise default for a "watch it work"
+        // product; it stays available via the explicit agent picker.
+        triggers: ['scaffold', 'bootstrap', 'create a new project', 'greenfield', 'new project from scratch'],
+        preferred: ['claude-code', 'codex', 'opencode'],
+        reason: 'greenfield scaffolding — claude-code default (visible); opencode opt-in only',
     },
     {
         triggers: ['add tests', 'write tests', 'test coverage', 'unit test', 'integration test'],

package/dist/infrastructure/orchestration/graphify-context.js

@@ -185,24 +185,29 @@ export function loadRecentContextPack(cwd) {
  * Returns the original prompt if graphify-ts fails or is unavailable.
  *
  * Respects CODEHERE_GRAPHIFY env var:
- *   - unset or "auto" (default): compile on spawn if graph doesn't exist
- *   - "force": always compile, even if pack exists
- *   - "off": skip entirely
+ *   - unset or "auto" (default): enrich ONLY from a pre-existing graph/pack;
+ *     NEVER compile on the spawn hot path (root-cause fix 2026-06-02 for
+ *     "every task calls graphify" — `npx graphify-ts pack` was shelling out
+ *     synchronously on every spawn, slowing crucial tasks + prepending a
+ *     verbose context blob the user never asked for).
+ *   - "force": compile a fresh pack on spawn (explicit opt-in for the cost).
+ *   - "off": skip entirely.
  */
 export function enrichPromptWithPackSync(prompt, cwd, { force = false } = {}) {
     const mode = process.env.CODEHERE_GRAPHIFY ?? 'auto';
     if (mode === 'off')
         return prompt;
-    // Check for existing pack to avoid recompiling on every spawn
-    const existingPack = loadRecentContextPack(cwd);
-    const graphPath = getGraphPath(cwd);
-    const graphExists = existsSync(graphPath);
-    if (!force && existingPack && graphExists) {
-        // Reuse existing pack — just enrich the prompt with a compact reference
-        const reference = `[graphify-ts context pack: ${existingPack.nodeCount} nodes, ${existingPack.edgeCount} edges, pack=${existingPack.packId}]`;
-        return `[graphify context: ${reference} — agent should call retrieve() for full pack]\n\n${prompt}`;
-    }
-    // Compile a fresh pack
+    const forceCompile = force || mode === 'force';
+    // 'auto' must NEVER touch the user's prompt — not by compiling (npx subprocess
+    // on the hot path) AND not by prepending an existing pack's "[graphify context:
+    // …]" reference blob. That blob leaked into the visible prompt, the Final
+    // Report summary, and the conversation ("On it — [graphify context: 1017
+    // nodes…]") — user-reported 2026-06-02 with a graph present. Structural
+    // context enrichment is now 'force'-only opt-in; a normal task gets a clean prompt.
+    if (!forceCompile)
+        return prompt;
+    // Compile a fresh pack (force only)
+    // Compile a fresh pack (force only)
     const pack = compileContextPackSync(prompt, cwd, { task: 'explain', budget: 2500 });
     if (!pack) {
         return prompt;

package/dist/infrastructure/orchestration/memory-injector.js

@@ -29,7 +29,7 @@
  * AGENTS.md / session.md). Same byte-equality-based detection pattern as
  * memory-command.ts (per feedback_implementation_patterns_v05.md Pattern #1).
  */
-import { existsSync, readFileSync, realpathSync } from 'fs';
+import { existsSync, readFileSync, realpathSync, writeFileSync } from 'fs';
 import { join, dirname, resolve } from 'path';
 const DEFAULT_MAX_TOKENS = 3000;
 const DEFAULT_MAX_LESSONS = 10;
@@ -329,4 +329,49 @@ export function applyMemoryPrefix(prompt, cwd, options) {
         record: { included: r.included, tokens: r.tokens, truncated: r.truncated },
     };
 }
+/**
+ * Write-back side of the shared-room hand-off: append a finished turn's outcome
+ * to the project's `working/session.md` so the NEXT agent spawned in this
+ * project reads it via buildMemoryPrefix() — closing the loop ("agents take
+ * turns in a shared room, each building on the last").
+ *
+ * Resolves the SAME project root as the read path (findProjectRoot), so it only
+ * writes when the project is codehere-initialized — it never creates `.codehere/`
+ * in an uninitialized repo. The scratch is capped (the injector also budgets it).
+ * Best-effort: a memory-write failure must never break a run.
+ */
+export function recordTurnToWorkingMemory(cwd, entry) {
+    try {
+        const projectRoot = findProjectRoot(cwd);
+        if (projectRoot === null)
+            return; // not a codehere-initialized project
+        const dir = join(projectRoot, '.codehere', 'memory', 'working');
+        if (!existsSync(dir))
+            return;
+        const p = join(dir, 'session.md');
+        const HEADER = '# Working session log - codehere auto-records each agent turn so the next one picks up here\n';
+        const agent = (entry.agent || 'agent').replace(/\s+/g, ' ').trim().slice(0, 40);
+        const prompt = (entry.prompt || '').replace(/\s+/g, ' ').trim().slice(0, 120);
+        const summary = (entry.summary || '').replace(/\s+/g, ' ').trim().slice(0, 600);
+        const files = entry.files ? ` - ${entry.files} file${entry.files === 1 ? '' : 's'} changed` : '';
+        const block = `\n## ${agent}${prompt ? ' - ' + prompt : ''}${files}\n${summary || '(no written summary)'}\n`;
+        let cur = '';
+        try {
+            cur = existsSync(p) ? readFileSync(p, 'utf8') : '';
+        }
+        catch {
+            cur = '';
+        }
+        if (!cur.trim() || looksLikeInitSeed(cur, 'session'))
+            cur = HEADER;
+        cur += block;
+        const CAP = 8000;
+        if (cur.length > CAP)
+            cur = HEADER + cur.slice(cur.length - (CAP - HEADER.length));
+        writeFileSync(p, cur, 'utf8');
+    }
+    catch {
+        /* never break a run on a memory-write failure */
+    }
+}
 //# sourceMappingURL=memory-injector.js.map

package/dist/infrastructure/orchestration/mocks/mock-agent-repl.js

@@ -15,33 +15,30 @@
  * runs end-to-end. For replaying REAL captured runs, that's the cassette system.
  */
 import { existsSync, readFileSync, writeFileSync } from 'fs';
-import { join, isAbsolute, basename } from 'path';
+import { join } from 'path';
 function argVal(flag) {
     const i = process.argv.indexOf(flag);
     return i >= 0 && i + 1 < process.argv.length ? process.argv[i + 1] : undefined;
 }
-/** The file the mock claims to edit — derived from the prompt, used for both
- *  the emitted step AND the real on-disk edit so they stay consistent. */
-function targetFile(p) {
-    return /(\b[\w./-]+\.(ts|tsx|js|py|go|rs|md))\b/.exec(p)?.[1] || 'src/feature.ts';
-}
-/** CODEHERE_MOCK fidelity: actually apply a small, safe edit so the REAL
- *  artifacts pipeline (git diff → trust score → Final Report → verify) has a
- *  genuine change to report. The demo's "1 file changed · trust" stays honest —
- *  it is a real diff on disk, just authored by the mock, not a model. */
-function materializeEdit(file) {
+/** The single dedicated file the mock edits — claimed in the step AND written on
+ *  disk, so they stay consistent. ALWAYS a mock-only file, NEVER an existing real
+ *  source file. The prior version derived a path from the prompt and appended to
+ *  it; when the daemon's cwd was a real repo and the prompt carried injected
+ *  memory (which lists repo paths like `src/ui.ts`), it corrupted real tracked
+ *  source. gitignored so it never rides along. */
+const MOCK_EDIT_FILE = 'codehere-mock-change.md';
+/** CODEHERE_MOCK fidelity: apply a small, safe on-disk edit so the run has a
+ *  genuine change — WITHOUT touching real source. Writes only to the dedicated
+ *  MOCK_EDIT_FILE. Note: that file is gitignored, so INSIDE a git repo the
+ *  artifacts extractor (git ls-files --others --exclude-standard) won't count it
+ *  — but verify-all runs the mock in a NON-git sandbox where file counts don't
+ *  apply, and the polished demo uses seeded sessions, not live mock edits. */
+function materializeEdit() {
     try {
-        const cwd = process.cwd();
-        let target = isAbsolute(file) ? file : join(cwd, file);
-        if (!target.startsWith(cwd))
-            target = join(cwd, basename(file)); // no traversal
-        const marker = `\n// codehere(mock): change applied for "${prompt.slice(0, 60).replace(/"/g, "'")}"\n`;
-        if (existsSync(target)) {
-            writeFileSync(target, readFileSync(target, 'utf-8') + marker);
-        }
-        else if (!file.includes('/')) {
-            writeFileSync(target, marker.trimStart()); // top-level only — never mkdir
-        }
+        const target = join(process.cwd(), MOCK_EDIT_FILE);
+        const header = '# codehere mock scratch — synthetic edits under CODEHERE_MOCK (safe to delete)\n\n';
+        const marker = `codehere(mock): change applied for "${prompt.slice(0, 60).replace(/"/g, "'")}"\n`;
+        writeFileSync(target, (existsSync(target) ? readFileSync(target, 'utf-8') : header) + marker);
     }
     catch {
         /* best-effort — mock fidelity must never crash the run */
@@ -74,7 +71,7 @@ const out = (o) => process.stdout.write(JSON.stringify(o) + '\n');
 // for the execution path to produce real steps/artifacts without an API call.
 function plannedSteps(p) {
     const lc = p.toLowerCase();
-    const file = targetFile(p);
+    const file = MOCK_EDIT_FILE;
     const steps = [
         { tool: 'Read', input: { file_path: 'REPO_MAP.md' }, result: 'context loaded · 84 files indexed' },
         { tool: 'Edit', input: { file_path: file }, result: '+' + (20 + (p.length % 90)) + ' lines · change applied' },
@@ -204,7 +201,7 @@ async function main() {
         prompt = (await readStdin()) || 'task';
     // Apply the real on-disk edit before emitting the run so the artifacts
     // extractor (which diffs at exit) sees a genuine change.
-    materializeEdit(targetFile(prompt));
+    materializeEdit();
     switch (agent) {
         case 'claude-code':
         case 'claude':

package/dist/infrastructure/orchestration/session-manager.js

@@ -20,6 +20,7 @@ import { OpenCodeAdapter } from './opencode-adapter.js';
 import { GeminiAdapter } from './gemini-adapter.js';
 import { buildGenericAdapter, loadAgentsConfig } from './generic-cli-adapter.js';
 import { buildConductorAdapter } from './conductor-adapter.js';
+import { recordTurnToWorkingMemory } from './memory-injector.js';
 import { seedAgentsConfig } from './agents-config-seed.js';
 import { AUDIT_FILE } from '../hooks/claude-sdk-hook.js';
 import { appendSpawned, appendCompleted, appendFinalReport, loadRecent, } from './session-persistence.js';
@@ -308,7 +309,22 @@ export class SessionManager {
                         summary: report.summary,
                         generatedAt: report.generatedAt,
                         durationMs: report.durationMs,
+                        source: report.source,
                     });
+                    // Shared-room hand-off: record this turn's outcome to the project's
+                    // working memory so the NEXT agent spawned here reads it (closes the
+                    // loop with applyMemoryPrefix). Best-effort; only initialized projects.
+                    try {
+                        recordTurnToWorkingMemory(cwd, {
+                            agent: session.agent,
+                            prompt: session.prompt,
+                            summary: report.summary,
+                            files: session.artifacts?.files?.length,
+                        });
+                    }
+                    catch {
+                        /* memory write must never break the run */
+                    }
                     try {
                         printFinalReportToTerminal(reportInput, report);
                     }
@@ -473,6 +489,7 @@ export class SessionManager {
                                 summary: report.summary,
                                 generatedAt: report.generatedAt,
                                 durationMs: report.durationMs,
+                                source: report.source,
                             });
                             try {
                                 printFinalReportToTerminal(reportInput, report);
@@ -669,6 +686,7 @@ export class SessionManager {
                         summary: report.summary,
                         generatedAt: report.generatedAt,
                         durationMs: report.durationMs,
+                        source: report.source,
                     });
                     try {
                         printFinalReportToTerminal(reportInput, report);

package/dist/infrastructure/orchestration/session-persistence.js

@@ -151,7 +151,7 @@ export function loadSessionById(idOrPrefix) {
             steps: c.steps,
             artifacts: c.artifacts,
             ...(c.turns ? { turns: c.turns } : {}),
-            ...(fr ? { finalReport: { summary: fr.summary, generatedAt: fr.generatedAt, durationMs: fr.durationMs } } : {}),
+            ...(fr ? { finalReport: { summary: fr.summary, generatedAt: fr.generatedAt, durationMs: fr.durationMs, source: fr.source } } : {}),
             ...(failoverFrom ? { failoverFrom } : {}),
             ...(failoverTo ? { failoverTo } : {}),
             ...(failoverReason ? { failoverReason } : {}),
@@ -222,7 +222,7 @@ export function loadRecent(limit = 20) {
         steps: c.steps,
         artifacts: c.artifacts,
         ...(c.turns ? { turns: c.turns } : {}),
-        ...(fr ? { finalReport: { summary: fr.summary, generatedAt: fr.generatedAt, durationMs: fr.durationMs } } : {}),
+        ...(fr ? { finalReport: { summary: fr.summary, generatedAt: fr.generatedAt, durationMs: fr.durationMs, source: fr.source } } : {}),
         ...((c.failoverFrom ?? s.failoverFrom) ? { failoverFrom: c.failoverFrom ?? s.failoverFrom } : {}),
         ...((c.failoverTo ?? s.failoverTo) ? { failoverTo: c.failoverTo ?? s.failoverTo } : {}),
         ...((c.failoverReason ?? s.failoverReason) ? { failoverReason: c.failoverReason ?? s.failoverReason } : {}),

package/dist/infrastructure/protocols/mcp-server-impl.js

@@ -444,7 +444,9 @@ export function startMCPServer(options = {}) {
         // Health check
         if (req.method === 'GET' && req.url === '/health') {
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ status: 'ok', server: 'codehere-mcp', version: getVersion(), tools: TOOLS.length }));
+            // `mock` lets a no-spend tool (verify-all) confirm a daemon is mock BEFORE
+            // attaching — so it can refuse to drive a LIVE daemon while claiming "no spend".
+            res.end(JSON.stringify({ status: 'ok', server: 'codehere-mcp', version: getVersion(), tools: TOOLS.length, mock: process.env.CODEHERE_MOCK === '1' }));
             return;
         }
         // v2 Task-Centric PM UI (primary — served at /)

package/dist/infrastructure/protocols/ui-page-v2.js

@@ -665,11 +665,11 @@ const SHARED_STYLES = `
   /* auditor persona · audit-chain + verifier + hook-badges amplified,
      summary muted (per demo v12 line 2462: "amplify audit-lines +
      hook-badges + trust-grades") */
-  body.auditor .audit-line { background: rgba(74,144,226,0.06); border-left-color: #4a90e2; color: var(--fg-70); font-size: 11.5px; padding: 8px 14px; }
-  body.auditor .verifier-panel { box-shadow: 0 0 0 2px rgba(40,200,64,0.18); }
-  body.auditor .hook-badge { transform: scale(1.05); }
-  body.auditor .file-chip .trust { font-weight: 700; padding: 2px 7px; }
-  body.auditor .panel:has(p) { opacity: 0.7; }
+  body[data-persona="auditor"] .audit-line { background: rgba(74,144,226,0.06); border-left-color: #4a90e2; color: var(--fg-70); font-size: 11.5px; padding: 8px 14px; }
+  body[data-persona="auditor"] .verifier-panel { box-shadow: 0 0 0 2px rgba(40,200,64,0.18); }
+  body[data-persona="auditor"] .hook-badge { transform: scale(1.05); }
+  body[data-persona="auditor"] .file-chip .trust { font-weight: 700; padding: 2px 7px; }
+  body[data-persona="auditor"] .panel:has(p) { opacity: 0.7; }
 
   /* SHAPE: velocity · hide tool-call cards, summary prose, tokens, verifier · keep outcome + files */
   body.shape-velocity .tc-card,
@@ -683,6 +683,13 @@ const SHARED_STYLES = `
   body.shape-security .verifier-panel { box-shadow: 0 0 0 2px rgba(255,95,87,0.18); padding: 14px; }
   body.shape-security .hook-block-card { box-shadow: 0 0 0 2px rgba(255,95,87,0.3); }
 
+  /* Reshape shapes recompose the goal room too (slice 4): "just what shipped"
+   * / velocity hide per-turn meta; the audit/security shape amplifies the
+   * room's audit line. Reuses the existing body.shape-* + .p-eng/.audit-line. */
+  body.shape-ship-only #task-list .card-row2 .p-eng,
+  body.shape-velocity #task-list .card-row2 .p-eng { display: none !important; }
+  body.shape-security #task-list .audit-line { background: rgba(74,144,226,0.06); border-left-color: #4a90e2; font-size: 11.5px; padding: 8px 14px; }
+
   /* v0.8 S2.5 · Settings drawer · ported from demo v12 lines 178-192 + A-09
    * in the backlog. Right-side off-canvas panel · holds Context Sources +
    * future section-visibility toggles. */
@@ -936,6 +943,29 @@ const SHARED_STYLES = `
     box-shadow: 0 0 0 3px rgba(255,154,118,0.18);
   }
 
+  /* Goal-first home · each project (goal) is a group; its tasks live inside.
+   * The home is organized by what you're working toward, not by status. */
+  .goal-group { margin: 0 0 22px; }
+  .goal-head {
+    display: flex; align-items: baseline; gap: 10px;
+    padding: 0 0 8px; margin: 20px 0 10px;
+    border-bottom: 1px solid var(--border);
+  }
+  .goal-group:first-child .goal-head { margin-top: 0; }
+  .goal-title { font-size: 15px; font-weight: 600; color: var(--fg); letter-spacing: -0.01em; }
+  .goal-meta { font-family: var(--mono); font-size: 10.5px; color: var(--fg-40); margin-left: auto; }
+  .goal-head { cursor: pointer; }
+  .goal-head:hover .goal-title { color: var(--accent); }
+  .goal-head:hover .goal-meta { color: var(--fg-70); }
+
+  /* The goal room · a single goal opened to its multi-agent turns, in order. */
+  .room-head { margin: 4px 0 14px; }
+  .room-back { background: transparent; border: 0; color: var(--fg-50); font-family: var(--mono); font-size: 11px; cursor: pointer; padding: 0; margin-bottom: 12px; }
+  .room-back:hover { color: var(--fg); }
+  .room-title { font-size: 20px; font-weight: 600; color: var(--fg); letter-spacing: -0.01em; }
+  .room-sub { font-family: var(--mono); font-size: 11px; color: var(--fg-40); margin-top: 5px; }
+  .turns-label { font-family: var(--mono); font-size: 10px; letter-spacing: 0.12em; color: var(--fg-40); text-transform: uppercase; margin: 18px 0 12px; }
+
   /* Task card · glass surface · matches demo v12 .glass-card pattern.
    * Faint white-on-dark fill + 1px low-contrast border · sits on top of
    * the ambient dot-grid. Hover lifts 2px with a bigger shadow + inner
@@ -1536,7 +1566,7 @@ const SHARED_STYLES = `
 `;
 const APP_SCRIPT = `
 const _cached = {};
-let _filter = 'all', _detail = null, _offline = false;
+let _filter = 'all', _detail = null, _room = null, _offline = false, _autoOpened = false;
 const ICONS = { queued:'\\u23F3', running:'\\u25CF', paused:'\\u23F8', blocked:'\\uD83D\\uDD12', done:'\\u2713', failed:'\\u2715', crashed:'!', killed:'\\u2298' };
 const STAT_ORDER = ['running','queued','paused','blocked','done','failed','crashed','killed'];
 const FILTERS = { all: s=>true, running: s=>['running','queued','paused','blocked'].includes(s.status), done: s=>['done','completed'].includes(s.status), failed: s=>['failed','crashed','killed','error'].includes(s.status) };
@@ -1668,12 +1698,14 @@ function codeCard(path, snippet, lang) {
 }
 function allS(d) { const sp=d.spawned||d.sessions||[], pe=d.persisted||[], seen=new Set(sp.map(s=>s.sessionId)); return [...sp,...pe.filter(p=>!seen.has(p.sessionId))]; }
 function cardActions(s) {
+  // Only 'kill' is wired (POST /api/task/:id/kill). Pause/Resume/Restart had NO
+  // backend endpoint — they rendered as live buttons that silently no-op'd (R11
+  // honest-state lie, 2026-06-03). Removed until real process control lands; Kill
+  // and Cancel both map to the wired kill, so every rendered control here works.
   const m={
-    running:'<button class="card-btn pause" onclick="event.stopPropagation();a(\\'pause\\',\\''+s+'\\')">Pause</button><button class="card-btn kill" onclick="event.stopPropagation();a(\\'kill\\',\\''+s+'\\')">Kill</button>',
-    paused:'<button class="card-btn" onclick="event.stopPropagation();a(\\'resume\\',\\''+s+'\\')">Resume</button><button class="card-btn kill" onclick="event.stopPropagation();a(\\'kill\\',\\''+s+'\\')">Kill</button>',
+    running:'<button class="card-btn kill" onclick="event.stopPropagation();a(\\'kill\\',\\''+s+'\\')">Kill</button>',
+    paused:'<button class="card-btn kill" onclick="event.stopPropagation();a(\\'kill\\',\\''+s+'\\')">Kill</button>',
     queued:'<button class="card-btn kill" onclick="event.stopPropagation();a(\\'kill\\',\\''+s+'\\')">Cancel</button>',
-    crashed:'<button class="card-btn restart" onclick="event.stopPropagation();a(\\'restart\\',\\''+s+'\\')">Restart</button>',
-    failed:'<button class="card-btn restart" onclick="event.stopPropagation();a(\\'restart\\',\\''+s+'\\')">Restart</button>',
     blocked:'<button class="card-btn kill" onclick="event.stopPropagation();a(\\'kill\\',\\''+s+'\\')">Cancel</button>',
   };
   return m[mapped(s)]||'';
@@ -1691,11 +1723,55 @@ function mapped(s) { return s==='queued'?'running':s==='blocked'?'paused':aStat(
 function findS(id) { const s=allS(_cached.tasks||{}); return s.find(x=>x.sessionId===id)||null; }
 
 function render() {
-  if(_detail){ const t=findS(_detail); if(t)renderD(t); else{ _detail=null; renderL(); } }
+  if(_detail){ const t=findS(_detail); if(t)renderD(t); else{ _detail=null; if(_room)renderRoom(); else renderL(); } }
+  else if(_room) renderRoom();
   else renderL();
   upCnt(); upBud(); upSq(); upWk(); upIdx();
 }
 
+// The goal room — one goal opened to its tasks as a chronological thread of
+// agent turns. Renders into #task-list (same surface as the goals list).
+function openRoom(enc){
+  _room=decodeURIComponent(enc||''); _detail=null;
+  document.getElementById('task-list-view').style.display='';
+  document.getElementById('task-detail-view').style.display='none';
+  document.body.classList.remove('detail-open');
+  render();
+}
+function closeRoom(){ _room=null; render(); }
+function renderRoom(){
+  const c=document.getElementById('task-list');
+  const _hs=document.getElementById('host-sessions-strip'); if(_hs){ _hs.style.display='none'; }
+  const esc=s=>String(s==null?'':s).replace(/[&<>"]/g,ch=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[ch]));
+  const cwd=_room;
+  const items=allS(_cached.tasks||{}).filter(x=>!/^demo-/.test(x.sessionId||'') && (x.cwd||'')===cwd);
+  items.sort((a,b)=>(a.startedAt||0)-(b.startedAt||0)); // turns in the order they happened
+  const projects=_cached.projects||[];
+  const p=projects.find(x=>x.cwd===cwd);
+  const title=(p&&p.title)||(cwd?(cwd.split('/').filter(Boolean).pop()||'Goal'):'Goal');
+  const agents=[...new Set(items.map(x=>x.agent).filter(Boolean))];
+  let html='<div class="room-head"><button class="room-back" onclick="closeRoom()">\\u2190 all goals</button>';
+  html+='<div class="room-title">'+esc(title)+'</div>';
+  // Persona-adaptive (direction B): everyone sees the plain-English outcome;
+  // the technical path is engineer-only (.p-eng · hidden for PM/designer via
+  // the existing body[data-persona] CSS — recomposes live, no re-render).
+  const _done=items.filter(x=>x.status==='completed'||x.status==='done').length;
+  const _outcome=items.length?(_done===items.length?('\\u2713 all '+items.length+' shipped'):(_done+' of '+items.length+' shipped')):'no tasks yet';
+  html+='<div class="room-sub">'+esc(_outcome)+(agents.length?' \\u00b7 '+agents.map(esc).join(', '):'')+'<span class="p-eng"> \\u00b7 '+esc(cwd||'')+'</span></div></div>';
+  if(items.length){
+    html+='<div class="turns-label">How your agents worked this goal, in order</div>';
+    for(const t of items) html+=cardH(t);
+    // Auditor signal · subtle for everyone, amplified for the Auditor persona
+    // via body[data-persona="auditor"] .audit-line. Honest: real step count,
+    // and every step IS in the local hash-chained audit log.
+    const _stepsTotal=items.reduce((n,t)=>n+((t.steps||[]).length),0);
+    html+='<div class="audit-line allow" style="margin-top:14px">&#128274; every step in this goal is in the local audit chain \\u00b7 <b>'+_stepsTotal+' steps</b> \\u00b7 verify \\u21bb</div>';
+  } else {
+    html+='<div class="empty-state"><h2>No tasks in this goal yet.</h2></div>';
+  }
+  c.innerHTML=html;
+}
+
 // C-01 · first-run indexing banner · auto-show when session count < 3 +
 // only once per browser session (sessionStorage tracks the dismissal).
 function upIdx(){
@@ -1773,6 +1849,7 @@ function fmtGap(ms){
 
 function renderL() {
   const c=document.getElementById('task-list'), all=allS(_cached.tasks||{});
+  const esc=s=>String(s==null?'':s).replace(/[&<>"]/g,ch=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[ch]));
   const fl=all.filter(FILTERS[_filter]||FILTERS.all);
   let html='';
   // Pin demo-shape sessions (id prefix 'demo-') to the very top — they
@@ -1783,29 +1860,54 @@ function renderL() {
     html+='<div class="section-label featured">Featured</div>';
     for(const t of demo) html+=cardH(t);
   }
-  for(const g of STAT_ORDER){
-    const items=rest.filter(x=>aStat(x.status)===g||(g==='running'&&['running','queued'].includes(x.status))||(g==='failed'&&['crashed','killed','error'].includes(x.status)));
-    if(!items.length)continue;
-    const label={running:'Running',queued:'Running',paused:'Paused',blocked:'Blocked',done:'Done',failed:'Failed',crashed:'Failed',killed:'Failed'}[g]||g;
-    html+='<div class="section-label">'+label+'</div>';
+  // Goal-first home: group the rest by project (the goal/room), not by status.
+  // cwd → project title (from /api/projects); fall back to the folder name.
+  const projects=_cached.projects||[];
+  const titleFor=cwd=>{
+    if(!cwd) return 'Ungrouped';
+    const p=projects.find(x=>x.cwd===cwd);
+    if(p&&p.title) return p.title;
+    const parts=String(cwd).split('/').filter(Boolean);
+    return parts.length?parts[parts.length-1]:'Ungrouped';
+  };
+  const groups=new Map();
+  for(const t of rest){
+    const key=t.cwd||'ungrouped';
+    if(!groups.has(key)) groups.set(key,{cwd:t.cwd,items:[]});
+    groups.get(key).items.push(t);
+  }
+  const lastTs=g=>g.items.reduce((m,x)=>Math.max(m,x.startedAt||0),0);
+  const ordered=[...groups.values()].sort((a,b)=>lastTs(b)-lastTs(a));
+  let prevGroupTs=null;
+  for(const g of ordered){
+    // Time-gap separator BETWEEN goals (ordered by recency) — a big gap means
+    // these goals are from a different stretch of work ("last week").
+    const gts=lastTs(g);
+    if(prevGroupTs!==null && gts>0 && prevGroupTs>0){
+      const gg=Math.abs(prevGroupTs-gts);
+      if(gg>2*3600*1000){ html+='<div class="time-gap"><span class="line"></span><span class="label">'+fmtGap(gg)+'</span><span class="line"></span></div>'; }
+    }
+    prevGroupTs=gts;
+    g.items.sort((a,b)=>(b.startedAt||0)-(a.startedAt||0));
+    const running=g.items.filter(x=>['running','queued','paused','blocked'].includes(x.status)).length;
+    const meta=g.items.length+' task'+(g.items.length===1?'':'s')+(running?' · '+running+' running':'');
+    html+='<div class="goal-group"><div class="goal-head" onclick="openRoom(\\''+encodeURIComponent(g.cwd||'')+'\\')"><span class="goal-title">'+esc(titleFor(g.cwd))+'</span><span class="goal-meta">'+esc(meta)+' \\u00b7 open \\u2192</span></div>';
+    // Time-gap separator within a goal · a big gap between consecutive tasks
+    // in the same goal is meaningful ("picked this back up 3 days later").
     let prevTs=null;
-    for(const t of items){
-      // F-04 · time-gap separator · inject before this card when there's a
-      // > 2h gap between its startedAt and the previous card's. Skips for
-      // 'running' (still alive, no gap) and the first card (no predecessor).
-      const ts = t.startedAt || 0;
-      if(g!=='running' && prevTs!==null && ts>0 && prevTs>0){
+    for(const t of g.items){
+      const ts=t.startedAt||0;
+      if(prevTs!==null && ts>0 && prevTs>0){
         const gap=Math.abs(prevTs-ts);
-        if(gap > 2*3600*1000){
-          html+='<div class="time-gap"><span class="line"></span><span class="label">'+fmtGap(gap)+'</span><span class="line"></span></div>';
-        }
+        if(gap>2*3600*1000){ html+='<div class="time-gap"><span class="line"></span><span class="label">'+fmtGap(gap)+'</span><span class="line"></span></div>'; }
       }
       html+=cardH(t);
       prevTs=ts;
     }
+    html+='</div>';
   }
   if(!html){
-    const h={all:'No tasks yet. Type a task below to get started.',running:'No running tasks.',done:'No completed tasks.',failed:'No failed tasks.'};
+    const h={all:'No goals yet. Type a task below to start one.',running:'No running tasks.',done:'No completed tasks.',failed:'No failed tasks.'};
     html='<div class="empty-state"><h2>'+(h[_filter]||'No tasks found.')+'</h2></div>';
   }
   c.innerHTML=html;
@@ -1814,6 +1916,8 @@ function renderL() {
 function renderHostSessions(data){
   const strip=document.getElementById('host-sessions-strip');
   if(!strip)return;
+  // The observed-sessions strip belongs to the goals home, not inside a room.
+  if(_room){ strip.style.display='none'; strip.innerHTML=''; return; }
   const sessions=(data&&data.sessions)||[];
   if(!sessions.length){ strip.style.display='none'; strip.innerHTML=''; return; }
   function he(s){ return String(s).replace(/[&<>"]/g, c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])); }
@@ -1880,7 +1984,7 @@ function cardH(t) {
   const stalledHtml = t.stalledReason ? '<div class="card-stalled" title="the watchdog stopped this task because the agent went silent">'+he(t.stalledReason)+'</div>' : '';
   return '<div class="task-card '+agentClass+pinClass+'" onclick="showD(\\''+t.sessionId+'\\')">'
     +'<div class="card-row1">'+statIcon(s)+'<span class="card-title" title="'+displayPrompt(t.prompt).replace(/"/g,'&quot;').slice(0,400)+'">'+title(t.prompt)+'</span>'+tagHtml(t.tags||[])+agentChip+'</div>'
-    +'<div class="card-row2">'+metaParts.join('')+verB(t.verification)+outcomeHtml+'</div>'
+    +'<div class="card-row2"><span class="p-eng">'+metaParts.join('')+'</span>'+verB(t.verification)+outcomeHtml+'</div>'
     +stalledHtml
     +(cardActions(t.sessionId)?'<div class="card-row3">'+cardActions(t.sessionId)+'</div>':'')+'</div>';
 }
@@ -2401,6 +2505,12 @@ function renderD(t) {
   // Empty finalReport object or null/empty summary => honest "unavailable" outcome,
   // not a green check. Composer must offer a re-spawn affordance for these cases.
   const hasReportText = !!(t.finalReport && typeof t.finalReport.summary === 'string' && t.finalReport.summary.trim());
+  // §G R8 — green ✓ "Final Report" ONLY for a verified live-agent summary
+  // (source === 'agent-summary'). Every other source — deterministic fallback,
+  // error-recovery, mock synthesis — renders an honest ⚠, never a fake ✓.
+  // POSITIVE allowlist (not deny-one) so a new/unknown source can't sneak a ✓.
+  const reportSource = (t.finalReport && t.finalReport.source) || '';
+  const isVerifiedAgentReport = reportSource === 'agent-summary';
   const isTerminal = ['completed','done','killed','failed','error','crashed'].includes(t.status);
   // The headline "N files changed" number. Normally derived from the actual
   // artifact list, so claim === rendered count, always. The optional
@@ -2415,8 +2525,13 @@ function renderD(t) {
   } else {
     oHtml+=(claimedFiles?'<div class="outcome-item"><span class="check">'+ms(true)+'</span> '+claimedFiles+' file'+(claimedFiles===1?'':'s')+' changed</div>':'');
     oHtml+='<div class="outcome-item"><span class="'+(nStep>0?'check':'pending')+'">'+(nStep>0?ms(true):'\\u2022')+'</span> '+nStep+' step'+(nStep===1?'':'s')+'</div>';
-    if(hasReportText) {
+    if(hasReportText && isVerifiedAgentReport) {
       oHtml+='<div class="outcome-item"><span class="check">'+ms(true)+'</span> Final Report</div>';
+    } else if(hasReportText) {
+      const _rl = reportSource==='deterministic' ? 'No written report \\u2014 recorded facts only'
+                : reportSource==='error-recovery' ? 'Final Report \\u2014 task did not complete'
+                : 'Final Report \\u2014 unverified (not a live-agent summary)';
+      oHtml+='<div class="outcome-item"><span class="pending">\\u26A0</span> '+_rl+'</div>';
     } else if(isTerminal) {
       oHtml+='<div class="outcome-item"><span class="pending">\\u26A0</span> Final Report unavailable</div>';
     }
@@ -3190,9 +3305,25 @@ function al(m){const e=document.getElementById('toast');if(e){e.textContent=m;e.
 async function fetchAll() {
   const sk=document.getElementById('skeleton');if(sk){const p=sk.parentNode;if(p)p.removeChild(sk);}
   try {
-    const [t,r]=await Promise.all([fetch('/api/tasks').then(x=>x.json()),fetch('/api/readiness/agents').then(x=>x.json())]);
-    _cached.tasks=t;_cached.readiness=r;
+    const [t,r,pj]=await Promise.all([fetch('/api/tasks').then(x=>x.json()),fetch('/api/readiness/agents').then(x=>x.json()),fetch('/api/projects').then(x=>x.json()).catch(()=>({projects:[]}))]);
+    _cached.tasks=t;_cached.readiness=r;_cached.projects=(pj&&pj.projects)||[];
     if(t.pricing)_cached.pricing=t.pricing;
+    // Auto-open the most relevant thread on first load (running > most-recent) —
+    // landing on a bare list "did nothing" feel (Ega 2026-06-02). Once only, and
+    // only if the user hasn't already navigated; Back still returns to the list.
+    if(!_autoOpened){
+      const _all=allS(t||{});
+      if(_all.length){
+        _autoOpened=true;
+        if(_detail===null){
+          const _act=_all.filter(x=>['running','queued','paused','blocked'].includes(x.status));
+          const _pool=_act.length?_act:_all.slice();
+          _pool.sort((a,b)=>(b.startedAt||0)-(a.startedAt||0));
+          const _pick=_pool[0];
+          if(_pick&&_pick.sessionId){ showD(_pick.sessionId); }
+        }
+      }
+    }
     render();
   }catch(e){console.error('fetch error',e);}
   try {
@@ -3946,6 +4077,7 @@ export const TASK_HTML_V2 = `<!doctype html>
       <option value="pm">PM view</option>
       <option value="designer">Designer view</option>
       <option value="eng">Engineer view</option>
+      <option value="auditor">Auditor view</option>
     </select>
     <button class="density-toggle" id="density-toggle" title="Toggle compact / standard density">&#8862; Compact</button>
     <button class="reshape-btn" id="reshape-open" title="Describe the view you want · agent composes from primitives">⌘ Reshape view</button>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codehere",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "A PM for your AI coding agents. Delegate, orchestrate, and audit Claude Code, Codex, Aider, OpenCode, Gemini, and any user-configured CLI agent from one local web UI — every AI action traced, every file scored, every spawn warmed with project memory.",
   "main": "dist/index.js",
   "type": "module",
@@ -17,6 +17,7 @@
     "node": ">=20"
   },
   "scripts": {
+    "prepare": "bash ../scripts/install-hooks.sh || true",
     "prebuild": "rm -rf dist",
     "build": "tsc",
     "postbuild": "chmod +x dist/index.js",