codehere 1.0.1 → 1.0.2

package/dist/infrastructure/orchestration/session-manager.js

@@ -1,1590 +0,0 @@
-/**
- * In-memory registry of active task sessions + audit-log derived observation.
- *
- * Two kinds of session surfaced to the UI:
- *   1. spawned   — started via codehere.spawn; we own the subprocess, can kill.
- *   2. observed  — derived from the audit log. Claude Code sessions running
- *                  in the user's terminals, IDE, or elsewhere on this machine.
- *                  codehere didn't start them and can't kill them, but shows
- *                  them so the dashboard reflects reality from first load.
- *
- * Durable state lives in the audit log (F0). On daemon restart, spawned
- * sessions are gone but observed ones remain (they're re-derived from the log).
- */
-import { existsSync, readFileSync, realpathSync } from 'fs';
-import { execFileSync } from 'child_process';
-import { EventEmitter } from 'node:events';
-import { ClaudeCodeAdapter } from './claude-code-adapter.js';
-import { CodexAdapter } from './codex-adapter.js';
-import { AiderAdapter } from './aider-adapter.js';
-import { OpenCodeAdapter } from './opencode-adapter.js';
-import { GeminiAdapter } from './gemini-adapter.js';
-import { buildGenericAdapter, loadAgentsConfig } from './generic-cli-adapter.js';
-import { buildConductorAdapter } from './conductor-adapter.js';
-import { recordTurnToWorkingMemory } from './memory-injector.js';
-import { seedAgentsConfig } from './agents-config-seed.js';
-import { applyTestObservation } from '../../domain/task.js';
-import { AUDIT_FILE } from '../hooks/claude-sdk-hook.js';
-import { signAuditTip } from '../hooks/audit-tip-signature.js';
-import { resumeClaudeMessage } from './claude-code-adapter.js';
-import { appendSpawned, appendCompleted, appendFinalReport, appendAuditRecon, loadRecent, loadSessionById, } from './session-persistence.js';
-import { generateFinalReport, printFinalReportToTerminal } from '../../application/use-cases/generate-final-report.js';
-import { generateAcceptanceCriteria, gradeAcceptanceCriteria, isTrivialRequest, } from '../../application/use-cases/generate-acceptance-criteria.js';
-import { mirrorSpawnedToThread, mirrorCompletedToThread, mirrorFinalReportToThread, } from '../storage/project-thread-mirror.js';
-import { scanPromptBeforeSpawn } from '../hooks/pre-prompt-scan.js';
-import { generateNarration } from '../../application/use-cases/generate-narration.js';
-import { randomUUID } from 'crypto';
-import { classifyFailoverEligibility } from './failover-classifier.js';
-import { resolveFailoverTarget, toAvailability } from './failover-policy.js';
-import { loadFailoverConfig } from './failover-config.js';
-import { loadBudget, isOverBudget } from '../cost/budget-config.js';
-import { computeSpendToday, estimateCostUsd } from '../cost/spend-aggregator.js';
-import { planAutoReview } from '../../application/use-cases/plan-auto-review.js';
-import { rerunTests, detectTestCommand } from '../../application/use-cases/rerun-tests.js';
-import { reconcileAudit } from '../../application/use-cases/reconcile-audit.js';
-import { collectAuditEntriesForSession } from '../../application/use-cases/thread-export.js';
-import { enrichPromptWithPackSync, compileSessionPackSync, persistContextPack } from './graphify-context.js';
-import { buildFailoverHandoff, enrichPromptWithHandoff, enrichPromptWithThreadHandoff } from './context-handoff.js';
-import { readMergedProjectThread, listProjects } from '../storage/project-thread-reader.js';
-import { mirrorFailoverToThread } from '../storage/project-thread-mirror.js';
-// ── Agent registry ─────────────────────────────────────────────────────────────
-// All backends codehere can spawn. Order here drives the default UI dropdown
-// order. Built-in adapters first; user-config-driven ones appended from
-// ~/.codehere/agents.yaml (generic-cli-adapter). isInstalled() gates visibility
-// so an adapter registering for an un-installed CLI is harmless.
-const BUILTIN_REGISTRY = [
-    ClaudeCodeAdapter,
-    CodexAdapter,
-    AiderAdapter,
-    OpenCodeAdapter,
-    GeminiAdapter,
-];
-// Seed the default agents.yaml if this user has never configured one, so Gemini
-// / Cursor / Pi / Antigravity / Goose appear in the registry pre-wired. They
-// stay hidden in the UI until isInstalled() flips to true. Idempotent.
-seedAgentsConfig();
-const REGISTRY = [
-    ...BUILTIN_REGISTRY,
-    // User-configurable adapters — "plug any CLI" escape hatch, seeded with
-    // popular CLI agents above. Users can add/edit/remove entries freely.
-    ...loadAgentsConfig().map(buildGenericAdapter),
-];
-// F6 Conductor — the meta-agent. Registered LAST so it sees the full registry
-// at lookup time. The lookup function is closed over `REGISTRY` so it always
-// returns the current populated array (including any future user adapters).
-// Conductor is appended to the same array so UIs that iterate REGISTRY see it.
-REGISTRY.push(buildConductorAdapter(() => REGISTRY));
-/**
- * The stall watchdog window, per agent. Most adapters STREAM events as they
- * work (claude/codex/gemini/aider), so 180s of silence is a real hang. OpenCode
- * in `--format json` is SILENT BY DESIGN — it buffers all stdout until the run
- * completes (verified: `opencode run --format json` emits 0 bytes until done),
- * so it never resets the stall clock mid-run. On a slow local model that easily
- * exceeds 180s, the watchdog killed a working opencode mid-edit (real-mode
- * dogfood 2026-06-13). Silent-buffering adapters get a longer leash; a truly
- * hung opencode is still caught, just later. CODEHERE_STALL_TIMEOUT_MS overrides
- * the default for every agent.
- */
-const SILENT_BUFFERING_AGENTS = new Set(['opencode']);
-export function stallWindowFor(agent) {
-    const override = process.env.CODEHERE_STALL_TIMEOUT_MS;
-    if (override !== undefined && override !== '')
-        return Number(override);
-    return SILENT_BUFFERING_AGENTS.has(agent) ? 600_000 : 180_000;
-}
-export function availableAgents() {
-    return REGISTRY.map((a) => ({
-        id: a.id,
-        label: a.label,
-        installed: a.isInstalled(),
-        ...(a.description ? { description: a.description } : {}),
-    }));
-}
-/** Per-agent readiness across the full registry. Powers the setup-aware UI. */
-export function readinessForAllAgents() {
-    return REGISTRY.map((a) => {
-        const base = a.checkReadiness
-            ? a.checkReadiness()
-            : a.isInstalled()
-                ? { id: a.id, label: a.label, state: 'ready', installed: true }
-                : { id: a.id, label: a.label, state: 'needs_install', installed: false };
-        // v0.6 S5 — mirror the adapter's "when to use me" description into the
-        // readiness payload so the dashboard dropdown can surface it as a
-        // plain-English hover tooltip without a separate API call.
-        return a.description ? { ...base, description: a.description } : base;
-    });
-}
-export function getAdapter(id) {
-    return REGISTRY.find((a) => a.id === id);
-}
-export function allAdapters() {
-    return REGISTRY;
-}
-export function agentProcessPatterns() {
-    return REGISTRY.map((a) => ({
-        regex: a.processPattern,
-        agent: a.id,
-        label: a.label,
-    }));
-}
-const DEFAULT_OBSERVED_WINDOW_MS = 10 * 60 * 1000; // 10 minutes
-function parseEtime(s) {
-    // ps etime formats: "MM:SS", "HH:MM:SS", "D-HH:MM:SS"
-    let rest = s;
-    let days = 0;
-    if (rest.includes('-')) {
-        const [d, r] = rest.split('-');
-        days = parseInt(d, 10) || 0;
-        rest = r;
-    }
-    const parts = rest.split(':').map((p) => parseInt(p, 10) || 0);
-    if (parts.length === 2)
-        return parts[0] * 60 + parts[1];
-    if (parts.length === 3)
-        return days * 86400 + parts[0] * 3600 + parts[1] * 60 + parts[2];
-    return 0;
-}
-export class SessionManager {
-    /** Max completed sessions kept in memory. Older sessions are evicted to
-     *  prevent unbounded memory growth in the internal tracking maps. The data
-     *  survives on disk via sessions.jsonl + thread.jsonl. */
-    static MAX_COMPLETED_SESSIONS = 100;
-    /** Live-progress push. The /api/events/sessions SSE stream watches
-     *  sessions.jsonl for changes, but that file is only written on spawn +
-     *  completion — so during a run the browser got NO updates and the room
-     *  sat at "0 steps" until the agent finished, then jumped straight to the
-     *  outcome (user-#1, 2026-06-07). Steps DO update in memory; this emitter
-     *  lets the SSE layer push a "change" the instant they do, so the room
-     *  actually watches the agent work. */
-    liveChanges = new EventEmitter();
-    sessions = new Map();
-    /** Spawn order FIFO — used to evict oldest completed sessions when the cap
-     *  is reached. Pushed on spawn, referenced by evictOldCompleted(). */
-    spawnOrder = [];
-    /** Read-only sessions replayed from ~/.codehere/sessions.jsonl on daemon start.
-     *  These subprocesses are long-dead; we surface them so the user doesn't lose
-     *  their Final reports across restarts. */
-    persistedCache = loadRecent(20);
-    /**
-     * R13 / M3 — THE typed per-session state record, replacing the ~17
-     * `*BySession` maps one field at a time (each map deleted in the commit its
-     * field moves here — move-not-add). One id, one record, one lifecycle:
-     * created on first write, dropped whole at eviction. When the migration
-     * completes this becomes the single source for everything the manager
-     * tracks about a session beyond the adapter's live TaskSession handle,
-     * and `CompletedSession` (the completeness invariant: tests + files +
-     * audit + report, or an explicit honest reason for each absence) types the
-     * terminal state.
-     */
-    records = new Map();
-    /** The session's state record, created on first write. Reads that must not
-     *  create should use `this.records.get(id)?.field`. */
-    rec(id) {
-        let r = this.records.get(id);
-        if (!r) {
-            r = {};
-            this.records.set(id, r);
-        }
-        return r;
-    }
-    /** v0.6 M3 · PM Narrator. Mid-task plain-English summaries cached per
-     *  session so the API can serve the latest narration without re-running
-     *  the LLM call on every frontend poll. Latest-only — older narrations
-     *  are overwritten when a new one fires. Per claim_user_persona HIGH:
-     *  non-technical users read narration, not tool calls. */
-    narrationTimers = new Map();
-    narrationStepsAtLastFire = new Map();
-    /** Stall watchdog (dogfood 2026-05-27 #1): a spawned agent can hang with no
-     *  output and sit "running" forever (opencode did exactly this). We track the
-     *  timestamp of the last event from each session and, if a running session
-     *  goes silent past the stall window, kill it and record an honest reason so
-     *  the UI shows "stopped — no response", never a fake "running" or a normal row. */
-    stallTimers = new Map();
-    /** Stores active failover offers keyed by sessionId+target. API layer
-     *  reads these via getFailoverOffers() for the /api/failover-offers endpoint. */
-    failoverOffers;
-    /**
-     * Resolve the turn a continuation hands off from, into the prior agent +
-     * prompt + Final Report summary. Reads the durable project thread (so it
-     * survives a daemon restart and unifies clones) via the same merged reader
-     * the room renders from — agent and human see one truth. Best-effort: any
-     * failure (no project record yet, parent not found) returns null, and the
-     * spawn proceeds without a preamble rather than breaking.
-     */
-    lookupThreadHandoffParent(parentSessionId, cwd) {
-        try {
-            const proj = listProjects().find((p) => (p.localPaths || []).includes(cwd) || p.cwd === cwd);
-            if (!proj)
-                return null;
-            const thread = readMergedProjectThread(proj.slug);
-            const parent = thread?.tasks.find((t) => t.sessionId === parentSessionId);
-            if (!parent)
-                return null;
-            return {
-                agent: String(parent.agent || 'an agent'),
-                prompt: parent.prompt,
-                summary: parent.finalReport?.summary || undefined,
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    spawn(prompt, agentId = 'claude-code', options) {
-        const adapter = getAdapter(agentId);
-        if (!adapter) {
-            throw new Error(`Unknown agent: ${agentId}. Registered: ${REGISTRY.map((a) => a.id).join(', ')}`);
-        }
-        // Canonicalize the cwd ONCE at the spawn boundary so every downstream
-        // consumer (pre-scan, adapter, persistence, thread mirror, room grouping)
-        // sees one spelling. Browser dogfood 2026-06-10 caught the live break:
-        // /tmp/x and /private/tmp/x (macOS /tmp is a symlink) rendered as TWO
-        // separate goals/rooms for the SAME repo — splitting the shared-context
-        // story the room exists to tell. Best-effort: a non-existent cwd passes
-        // through unchanged (the adapter will surface that failure honestly).
-        if (options?.cwd) {
-            try {
-                options = { ...options, cwd: realpathSync(options.cwd) };
-            }
-            catch {
-                /* keep the caller's path */
-            }
-        }
-        // CODEHERE_MOCK spawns a synthetic agent (mock REPL), so the real CLI need
-        // not be installed — bypass the readiness gate. Makes the mock harness truly
-        // zero-dependency (dogfood/dev without any agent CLI installed).
-        const mockMode = process.env.CODEHERE_MOCK === '1' || process.env.CODEHERE_MOCK === 'true';
-        if (!mockMode && !adapter.isInstalled()) {
-            throw new Error(`Agent ${adapter.label} (${adapter.id}) is not installed on this machine`);
-        }
-        // Fail-fast on an unusable agent. An explicit pick that's installed-but-not-
-        // signed-in used to spawn and HANG at "running" forever (gemini: no auth → no
-        // output → the watchdog only fires after minutes). Reject it in milliseconds
-        // with the real reason instead. Skipped for the conductor (it resolves a
-        // specialist internally) and in mock mode. Honesty-at-the-surface: a task that
-        // can't start must say why, not sit spinning.
-        // Skipped under VITEST: scenario/cassette tests replay recorded vendor
-        // streams through a MOCKED child_process, so no real binary spawns and the
-        // auth gate would only reject a replay that can't hang. This is a runtime
-        // UX protection, not domain logic.
-        if (!mockMode && !process.env.VITEST && agentId !== 'conductor' && adapter.checkReadiness) {
-            const r = adapter.checkReadiness();
-            if (r.state !== 'ready') {
-                const why = r.authHint?.detail || r.installHint?.command || `${adapter.label} is not ready (${r.state})`;
-                throw new Error(`${adapter.label} can't run yet — ${why}`);
-            }
-        }
-        // Cross-vendor pre-prompt scan (task #110, slice 1). Closes the gap
-        // the FAQ now claims as "v0.5.x → v0.6 track": every adapter — not
-        // just claude-code — gets a safety scan on the user's prompt before
-        // spawn. Catches API-key paste, prompt-injection patterns, etc.
-        // Always writes one audit entry (synthetic toolName 'pre_prompt');
-        // refuses spawn ONLY when getHookMode() === 'block' AND the prompt
-        // has critical/high findings. Other modes (advisory/log-only/off)
-        // log + proceed.
-        const preScanSessionId = randomUUID();
-        const scan = scanPromptBeforeSpawn({
-            sessionId: preScanSessionId,
-            agent: agentId,
-            prompt,
-            cwd: options?.cwd,
-        });
-        if (!scan.allowed) {
-            throw new Error(scan.blockReason || 'pre-prompt scan blocked the spawn');
-        }
-        // P1 — graphify-ts structural memory: enrich prompt with compact context
-        // pack so the agent starts with a verified knowledge graph of the workspace.
-        // Respects CODEHERE_GRAPHIFY env var (auto|force|off, default=auto).
-        // Synchronous call — degrades to original prompt if graphify fails.
-        const cwd = options?.cwd ?? process.cwd();
-        let enrichedPrompt = enrichPromptWithPackSync(prompt, cwd);
-        // Phase 3 — cross-agent thread hand-off. When this spawn CONTINUES a turn
-        // (parentSessionId, set by the room composer), inject what the prior agent
-        // was asked + what it did, so a DIFFERENT agent picks up the work instead of
-        // restarting blind. The injected summary is the SAME one the room shows, so
-        // agent + human read one truth. The displayed prompt stays clean (the mirror
-        // records `prompt`, not this enriched one — same split graphify already uses).
-        if (options?.parentSessionId) {
-            const parent = this.lookupThreadHandoffParent(options.parentSessionId, cwd);
-            if (parent)
-                enrichedPrompt = enrichPromptWithThreadHandoff(enrichedPrompt, parent);
-        }
-        const session = adapter.spawn(enrichedPrompt, options);
-        this.sessions.set(session.sessionId, session);
-        this.spawnOrder.push(session.sessionId);
-        // Persistence: write the spawned record immediately so a daemon crash still
-        // leaves an audit trail of what was attempted. Subscribe to exit so we can
-        // capture the final status + steps + artifacts when the session settles.
-        this.rec(session.sessionId).cwd = cwd;
-        this.rec(session.sessionId).displayPrompt = prompt; // clean user ask (not the enriched input)
-        if (options?.batchId)
-            this.rec(session.sessionId).batchId = options.batchId;
-        // REQUEST_METHOD §2 — for a non-trivial request, derive the acceptance
-        // contract (async, non-blocking like the title agent) and store it on the
-        // record; the room shows "Done means …" once it lands. Trivial asks skip it
-        // (the scaling principle — no ceremony tax, no per-request LLM call).
-        if (!isTrivialRequest(prompt)) {
-            const _sid = session.sessionId;
-            generateAcceptanceCriteria(prompt, cwd || '')
-                .then((criteria) => {
-                if (criteria.length && this.records.has(_sid))
-                    this.rec(_sid).acceptanceCriteria = criteria;
-            })
-                .catch(() => { });
-        }
-        appendSpawned({
-            id: session.sessionId,
-            agent: session.agent,
-            prompt,
-            cwd,
-            startedAt: session.startedAt,
-            ...(options?.batchId ? { batchId: options.batchId } : {}),
-            ...(options?.parentSessionId ? { parentSessionId: options.parentSessionId } : {}),
-            ...(options?.isReview ? { isReview: true } : {}),
-        });
-        // v0.6.0 M1+M7 — forward-mirror to per-project thread.jsonl alongside
-        // sessions.jsonl. Best-effort; mirror failures don't break the spawn path.
-        mirrorSpawnedToThread({
-            sessionId: session.sessionId,
-            agent: session.agent,
-            prompt,
-            cwd,
-            startedAt: session.startedAt,
-            ...(options?.batchId ? { batchId: options.batchId } : {}),
-            ...(options?.parentSessionId ? { parentSessionId: options.parentSessionId } : {}),
-        });
-        this.rec(session.sessionId).lastActivityAt = Date.now();
-        const unsubscribe = session.subscribe((event) => {
-            // Any event = the agent is alive. Reset the stall clock. (watchdog)
-            this.rec(session.sessionId).lastActivityAt = Date.now();
-            // Capture which specialist the Conductor routed to, so the UI can name
-            // the agent that actually ran (not just "Auto").
-            if (event.type === 'codehere:conductor-routing') {
-                const d = event.data?.delegatedTo;
-                if (d)
-                    this.rec(session.sessionId).delegatedTo = d;
-            }
-            // Push a live-progress tick so an open room/detail refetches mid-run
-            // instead of waiting for the completion disk-write. Steps stream into
-            // memory; this is how the browser hears about them in real time.
-            if (event.type === 'codehere:steps' ||
-                event.type === 'codehere:artifacts' ||
-                event.type === 'codehere:conductor-routing' ||
-                event.type === 'exit') {
-                // conductor-routing included so "routed to <agent>" surfaces during the
-                // spin-up gap instead of the user staring at "starting…" with nothing.
-                this.liveChanges.emit('change');
-            }
-            // ── Failover check — intercept rate-limit / quota errors before exit ──
-            // Adapters emit 'codehere:error' (structured: { code, message, recovery })
-            // or 'error' (spawn-level: { message }). Both need classification.
-            if (event.type === 'error' || event.type === 'codehere:error') {
-                const err = event.data;
-                // Remember the specific error text so the Final Report can name it
-                // (the report reads session.steps, which don't carry this event).
-                if (err?.message) {
-                    this.rec(session.sessionId).errorText = [err.message, err.recovery].filter(Boolean).join(' ');
-                }
-                if (err?.code && err?.message) {
-                    const signal = classifyFailoverEligibility(session.agent, err.code, err.message);
-                    if (signal) {
-                        const newSession = this.handleFailover(session, signal);
-                        if (newSession)
-                            return; // auto-spawned — keep listening on new session
-                    }
-                }
-            }
-            if (event.type !== 'exit')
-                return;
-            // Tier 1.1 · OBSERVE the tests instead of trusting the agent's scrape.
-            // Fire-and-forget (never block the daemon): re-run the repo's own test
-            // command on the real on-disk state and replace the scraped count with the
-            // ground-truth result. The live verdict (mcp-server recomputes verifyClaim
-            // from session.artifacts each poll) refreshes automatically once it lands,
-            // so a "tests pass" claim that fails on re-run flips the ✓ to broken.
-            void this.observeTests(session, cwd);
-            // Tier 1.2 · reconcile the audit's declared file-writes against the real
-            // git-diff effect (read-only; never mutates the hash-chained audit).
-            // Deferred a tick so the synchronous exit path + any final mirror writes
-            // settle before we read the audit file.
-            void Promise.resolve().then(() => this.reconcileSessionAudit(session));
-            // Tier 2.1 · auto cross-vendor adversarial review (flag-gated, default
-            // OFF). When enabled, a DIFFERENT vendor independently reviews this work
-            // in refute-mode so the cross-vendor proof becomes automatic, not a manual
-            // two-task workflow. Deferred a tick so artifacts/status have settled.
-            void Promise.resolve().then(() => this.maybeAutoReview(session, cwd));
-            const data = event.data;
-            const completedAt = Date.now();
-            // Surface completedAt to API consumers reading the still-in-memory
-            // session (Bug 2 sister-fix, May 2). Without this, /api/tasks shows
-            // status=completed but no completedAt → NaN duration in the UI.
-            this.rec(session.sessionId).completedAt = completedAt;
-            appendCompleted({
-                id: session.sessionId,
-                nativeSessionId: session.nativeSessionId,
-                delegateSessionId: session.delegateSessionId,
-                status: session.status,
-                durationMs: Number(data?.durationMs ?? completedAt - session.startedAt),
-                completedAt,
-                steps: session.steps ? [...session.steps] : undefined,
-                artifacts: session.artifacts,
-                stalledReason: this.records.get(session.sessionId)?.stalled?.reason,
-                delegatedTo: this.records.get(session.sessionId)?.delegatedTo,
-            });
-            // v0.6.0 M1+M7 — forward-mirror completion to project thread.
-            mirrorCompletedToThread({
-                sessionId: session.sessionId,
-                cwd,
-                status: session.status,
-                durationMs: Number(data?.durationMs ?? completedAt - session.startedAt),
-                completedAt,
-                steps: session.steps ? [...session.steps] : undefined,
-                artifacts: session.artifacts,
-            });
-            // PM-UX Layer 3 · Final Report MVP. Fire-and-forget; the report appears
-            // in the terminal a few seconds after exit. Failure modes return null
-            // silently (claude CLI not installed, timeout, non-zero exit). No SSE,
-            // no UI integration in this MVP — terminal output only so the dogfood
-            // loop sees the artifact immediately. See `generate-final-report.ts`.
-            const reportInput = {
-                sessionId: session.sessionId,
-                prompt: session.prompt,
-                agent: session.agent,
-                status: session.status,
-                durationMs: completedAt - session.startedAt,
-                steps: session.steps ? [...session.steps] : [],
-                artifacts: session.artifacts,
-                errorText: this.records.get(session.sessionId)?.errorText,
-                delegatedTo: this.records.get(session.sessionId)?.delegatedTo,
-            };
-            generateFinalReport(reportInput)
-                .then((report) => {
-                if (report) {
-                    // Cache for web UI consumption via /api/tasks (iter 12 — non-technical
-                    // users live in the web UI, not the terminal).
-                    this.rec(session.sessionId).finalReport = report;
-                    // REQUEST_METHOD stage 5 — grade the contract against the result.
-                    // The assessment answers MET/UNMET per criterion; never marks met
-                    // without evidence (no fake green). Runs only if a contract exists.
-                    const _ac = this.rec(session.sessionId).acceptanceCriteria;
-                    if (_ac && _ac.length) {
-                        const _sid2 = session.sessionId;
-                        const _files = (session.artifacts?.files || [])
-                            .map((f) => typeof f === 'string'
-                            ? f
-                            : (f?.path ?? f?.file))
-                            .filter((x) => !!x);
-                        const _ok = session.status === 'completed' || session.status === 'done';
-                        gradeAcceptanceCriteria(_ac, {
-                            prompt: this.rec(_sid2).displayPrompt || '',
-                            reportSummary: report.summary,
-                            files: _files,
-                            verdictGreen: _ok, // gate met-grading on TASK success, never report-gen success (no fake green on a failed run)
-                        })
-                            .then((graded) => {
-                            if (this.records.has(_sid2))
-                                this.rec(_sid2).acceptanceCriteria = graded;
-                        })
-                            .catch(() => { });
-                    }
-                    // v0.6.x — persist to disk so the report survives daemon restart.
-                    // Pre-fix: founder's Mac restart 2026-05-03 left a session card
-                    // showing "Generating report…" forever because reports lived only
-                    // in this in-memory Map. Append-only finalReport record paired
-                    // with the existing spawned/completed records by sessionId.
-                    appendFinalReport({
-                        id: session.sessionId,
-                        summary: report.summary,
-                        generatedAt: report.generatedAt,
-                        durationMs: report.durationMs,
-                        source: report.source,
-                    });
-                    // Persist the summary to the project thread too (Step C) — the report
-                    // is async, so the earlier mirrorCompletedToThread ran without it. This
-                    // is what a cross-agent hand-off reads, and what the conversation view
-                    // shows after a daemon restart. Best-effort; never breaks the run.
-                    mirrorFinalReportToThread({
-                        sessionId: session.sessionId,
-                        cwd,
-                        summary: report.summary,
-                        source: report.source,
-                    });
-                    // Shared-room hand-off: record this turn's outcome to the project's
-                    // working memory so the NEXT agent spawned here reads it (closes the
-                    // loop with applyMemoryPrefix). Best-effort; only initialized projects.
-                    try {
-                        recordTurnToWorkingMemory(cwd, {
-                            agent: session.agent,
-                            prompt: session.prompt,
-                            summary: report.summary,
-                            files: session.artifacts?.files?.length,
-                        });
-                    }
-                    catch {
-                        /* memory write must never break the run */
-                    }
-                    try {
-                        printFinalReportToTerminal(reportInput, report);
-                    }
-                    catch {
-                        // Don't let a print failure crash the daemon.
-                    }
-                }
-            })
-                .catch(() => {
-                // generateFinalReport rejected — record it so the UI can show
-                // "Report unavailable" instead of "Generating report…" forever.
-                this.rec(session.sessionId).failedReport = true;
-            });
-            // P1 — persist context pack at session exit for cross-session handoff (P2).
-            // Fire-and-forget: graphify-ts may not be installed, graph may be empty,
-            // or pack compilation may fail. All degrade silently.
-            void Promise.resolve().then(() => {
-                try {
-                    const stepsStr = session.steps
-                        ?.map((s) => `${s.label}: ${s.output || s.state}`)
-                        .filter(Boolean)
-                        .join('\n') ?? '';
-                    const pack = compileSessionPackSync(cwd, {
-                        prompt: session.prompt,
-                        artifacts: JSON.stringify(session.artifacts, null, 2),
-                        steps: stepsStr,
-                        agent: session.agent,
-                    });
-                    if (pack)
-                        persistContextPack(pack, cwd);
-                }
-                catch {
-                    // Silent degradation — context pack is enrichment, not the primary path.
-                }
-            });
-            // v0.6 M3 — clean up the narration timer for this session.
-            const t = this.narrationTimers.get(session.sessionId);
-            if (t) {
-                clearInterval(t);
-                this.narrationTimers.delete(session.sessionId);
-            }
-            // Watchdog: session settled on its own — stop watching it.
-            this.clearStallTimer(session.sessionId);
-            this.evictOldCompleted();
-            unsubscribe();
-        });
-        // v0.6 M3 — PM Narrator. Mid-task plain-English summaries fired
-        // every 30s while the session is running. Heuristic: only fire if
-        // the step count grew by ≥3 since the last narration (otherwise
-        // we'd narrate the same state with new words). Fire-and-forget;
-        // failures (no claude binary, timeout, malformed output) silently
-        // skip — narration is enrichment, not the primary surface.
-        this.startNarrationTimer(session);
-        this.startStallWatchdog(session);
-        return session;
-    }
-    /** v0.6.x failover — emit a failover offer when an adapter hits a
-     *  rate-limit / quota error. The offer is surfaced via the API layer
-     *  (Slice E) and optionally auto-spawned (Slice D). Returns the new
-     *  session if auto-spawn was triggered, undefined otherwise. */
-    handleFailover(session, signal) {
-        const config = loadFailoverConfig();
-        const tried = this.records.get(session.sessionId)?.failoverTried ?? new Set();
-        tried.add(signal.fromAgent);
-        this.rec(session.sessionId).failoverTried = tried;
-        // Cost-bounded fail-over (refuter 2026-06-08). A stall/error fail-over spawns
-        // a REAL replacement agent — so it must respect the daily budget the same way
-        // conductor routing does, or the "multi-agent layer that doesn't waste money"
-        // thesis breaks (a hung agent could otherwise cascade paid spawns across the
-        // whole chain). When over budget, only FREE agents (estimateCostUsd === 0) are
-        // eligible; no free agent ready → no target → honest kill, never an
-        // over-budget paid spawn.
-        // NOTE (fail-open boundedness): estimateCostUsd returns 0 for an id absent
-        // from the cost table, so an UNKNOWN paid adapter could read as free here.
-        // That path is unreachable today — the failover chain is validated against
-        // KNOWN_AGENT_IDS (validateFailoverChain), and all five are priced. If you
-        // add a paid adapter, add its cost-table row in the SAME change.
-        const budgetCfg = loadBudget();
-        const budgetBounded = budgetCfg.dailyUsd !== null && isOverBudget(computeSpendToday().totalUsd, budgetCfg);
-        const adapters = allAdapters();
-        const available = toAvailability(adapters, (a) => {
-            if (a.id === signal.fromAgent || !a.isInstalled())
-                return false;
-            if (budgetBounded && estimateCostUsd(a.id, { inputTokens: 1, outputTokens: 1 }) !== 0)
-                return false;
-            return true;
-        });
-        const target = resolveFailoverTarget({
-            failedAgent: signal.fromAgent,
-            alreadyTried: Array.from(tried),
-            available,
-            preferredChain: config?.chain,
-        });
-        if (!target)
-            return undefined;
-        const targetAdapter = getAdapter(target);
-        if (!targetAdapter || !targetAdapter.isInstalled())
-            return undefined;
-        // Auto-failover: spawn on the next agent in the chain
-        const autoFailover = config?.autoFailover ?? true;
-        if (autoFailover) {
-            // Spawn replacement session on the next agent, preserving prompt + cwd
-            const cwd = this.records.get(session.sessionId)?.cwd ?? process.cwd();
-            // P2 — build handoff context for continuity across agent swap
-            const handoff = buildFailoverHandoff(cwd, {
-                failedAgent: session.agent,
-                failedPrompt: session.prompt,
-            });
-            // Enrich prompt with handoff if available (P2)
-            const promptWithHandoff = handoff
-                ? enrichPromptWithHandoff(session.prompt, {
-                    packId: handoff.packId,
-                    agent: session.agent,
-                    prompt: session.prompt,
-                    status: 'failed',
-                    timestamp: handoff.timestamp,
-                    nodeCount: handoff.nodeCount,
-                    edgeCount: handoff.edgeCount,
-                    task: handoff.task,
-                    payloadPreview: handoff.payloadPreview,
-                })
-                : session.prompt;
-            try {
-                const newSession = targetAdapter.spawn(promptWithHandoff, {
-                    cwd,
-                    env: process.env,
-                    preferSubscription: true,
-                });
-                // Track this new session in the same way
-                this.sessions.set(newSession.sessionId, newSession);
-                this.spawnOrder.push(newSession.sessionId);
-                this.rec(newSession.sessionId).cwd = cwd;
-                // The failover continues the SAME user task, so display the SAME clean ask —
-                // not the hand-off-enriched prompt the adapter stores as session.prompt (the
-                // "[Continuing a thread …]" leak on the failover path).
-                this.rec(newSession.sessionId).displayPrompt = this.getDisplayPrompt(session.sessionId) ?? session.prompt;
-                this.rec(newSession.sessionId).lastActivityAt = Date.now();
-                // Subscribe BEFORE persistence so exit events are never lost if the
-                // adapter exits synchronously (command not found, instant crash, etc).
-                const unsubscribe = newSession.subscribe((event) => {
-                    this.rec(newSession.sessionId).lastActivityAt = Date.now();
-                    if (event.type !== 'exit')
-                        return;
-                    this.clearStallTimer(newSession.sessionId);
-                    const data = event.data;
-                    const completedAt = Date.now();
-                    this.rec(newSession.sessionId).completedAt = completedAt;
-                    appendCompleted({
-                        id: newSession.sessionId,
-                        nativeSessionId: newSession.nativeSessionId,
-                        delegateSessionId: newSession.delegateSessionId,
-                        status: newSession.status,
-                        durationMs: Number(data?.durationMs ?? completedAt - newSession.startedAt),
-                        completedAt,
-                        steps: newSession.steps ? [...newSession.steps] : undefined,
-                        artifacts: newSession.artifacts,
-                        stalledReason: this.records.get(newSession.sessionId)?.stalled?.reason,
-                    });
-                    mirrorCompletedToThread({
-                        sessionId: newSession.sessionId,
-                        cwd,
-                        status: newSession.status,
-                        durationMs: Number(data?.durationMs ?? completedAt - newSession.startedAt),
-                        completedAt,
-                        steps: newSession.steps ? [...newSession.steps] : undefined,
-                        artifacts: newSession.artifacts,
-                    });
-                    const reportInput = {
-                        sessionId: newSession.sessionId,
-                        prompt: newSession.prompt,
-                        agent: newSession.agent,
-                        status: newSession.status,
-                        durationMs: completedAt - newSession.startedAt,
-                        steps: newSession.steps ? [...newSession.steps] : [],
-                        artifacts: newSession.artifacts,
-                        errorText: this.records.get(newSession.sessionId)?.errorText,
-                        delegatedTo: this.records.get(newSession.sessionId)?.delegatedTo,
-                    };
-                    generateFinalReport(reportInput)
-                        .then((report) => {
-                        if (report) {
-                            this.rec(newSession.sessionId).finalReport = report;
-                            appendFinalReport({
-                                id: newSession.sessionId,
-                                summary: report.summary,
-                                generatedAt: report.generatedAt,
-                                durationMs: report.durationMs,
-                                source: report.source,
-                            });
-                            mirrorFinalReportToThread({
-                                sessionId: newSession.sessionId,
-                                cwd,
-                                summary: report.summary,
-                                source: report.source,
-                            });
-                            try {
-                                printFinalReportToTerminal(reportInput, report);
-                            }
-                            catch {
-                                /* defensive */
-                            }
-                        }
-                    })
-                        .catch(() => {
-                        /* defensive */
-                    });
-                    // P1 — persist context pack at failover-replacement session exit.
-                    void Promise.resolve().then(() => {
-                        try {
-                            const stepsStr = newSession.steps
-                                ?.map((s) => `${s.label}: ${s.output || s.state}`)
-                                .filter(Boolean)
-                                .join('\n') ?? '';
-                            const pack = compileSessionPackSync(cwd, {
-                                prompt: newSession.prompt,
-                                artifacts: JSON.stringify(newSession.artifacts, null, 2),
-                                steps: stepsStr,
-                                agent: newSession.agent,
-                            });
-                            if (pack)
-                                persistContextPack(pack, cwd);
-                        }
-                        catch {
-                            // Silent degradation — context pack is enrichment, not primary path.
-                        }
-                    });
-                    const t = this.narrationTimers.get(newSession.sessionId);
-                    if (t) {
-                        clearInterval(t);
-                        this.narrationTimers.delete(newSession.sessionId);
-                    }
-                    this.evictOldCompleted();
-                    unsubscribe();
-                });
-                // Persistence + threading — safe after subscribe because the exit
-                // handler is already registered. These can run even if the session
-                // already exited (spawned record still useful, exit handler handles
-                // the completion).
-                appendSpawned({
-                    id: newSession.sessionId,
-                    agent: newSession.agent,
-                    prompt: promptWithHandoff,
-                    cwd,
-                    startedAt: newSession.startedAt,
-                });
-                mirrorSpawnedToThread({
-                    sessionId: newSession.sessionId,
-                    agent: newSession.agent,
-                    prompt: promptWithHandoff,
-                    cwd,
-                    startedAt: newSession.startedAt,
-                });
-                mirrorFailoverToThread({
-                    sessionId: newSession.sessionId,
-                    fromAgent: signal.fromAgent,
-                    toAgent: target,
-                    reason: signal.errorCode,
-                    cwd,
-                });
-                this.rec(session.sessionId).continuedAs = newSession.sessionId;
-                this.rec(newSession.sessionId).continuedFrom = session.sessionId;
-                // Record the recovery lineage on the replacement so the dashboard can
-                // surface "recovered from <fromAgent>" — the resilience must be VISIBLE,
-                // not buried in a killed row (the S3 dogfood gap, 2026-06-08).
-                this.rec(newSession.sessionId).recoveredFrom = {
-                    agent: signal.fromAgent,
-                    reason: signal.errorCode,
-                };
-                // Thread the already-tried set FORWARD onto the replacement session.
-                // Without this, a multi-hop cascade (A hangs → B hangs → …) loses its
-                // history: B's failover reads a fresh empty set and re-picks A (first
-                // ready in the chain), looping A↔B and never reaching C. Seeding the
-                // replacement with the accumulated `tried` set (already includes the
-                // just-failed agent) makes the chain walk strictly forward and exhaust
-                // honestly. (Caught by stall-failover-stress.test.ts, 2026-06-08.)
-                this.rec(newSession.sessionId).failoverTried = new Set(tried);
-                this.startNarrationTimer(newSession);
-                this.startStallWatchdog(newSession);
-                return newSession;
-            }
-            catch {
-                // Spawn failed — fall through to offer-only mode
-                return undefined;
-            }
-        }
-        // Offer-only mode: signal the API layer to present a failover banner
-        // (Slice E handles the actual UI surfacing)
-        this.emitFailoverOffer({ session, signal, target });
-        this.rec(session.sessionId).failoverReason = signal.errorCode;
-        return undefined;
-    }
-    /** Emitted when a failover offer is generated. The API layer listens
-     *  to this to surface the banner in the web UI. */
-    emitFailoverOffer(offer) {
-        if (!this.failoverOffers) {
-            this.failoverOffers = new Map();
-        }
-        const key = `${offer.session.sessionId}-${offer.target}`;
-        this.failoverOffers.set(key, { offer, createdAt: Date.now() });
-        // Auto-expire offers after 60 seconds to keep the map bounded
-        setTimeout(() => {
-            this.failoverOffers?.delete(key);
-        }, 60_000);
-    }
-    /** Get all active failover offers for the API layer. */
-    getFailoverOffers() {
-        if (!this.failoverOffers)
-            return [];
-        const offers = [];
-        for (const [, { offer, createdAt }] of this.failoverOffers) {
-            offers.push({
-                sessionId: offer.session.sessionId,
-                signal: offer.signal,
-                target: offer.target,
-                expiresAt: createdAt + 60_000,
-            });
-        }
-        return offers;
-    }
-    /** v0.6.x P0 — user-initiated failover accept. Spawns a replacement
-     *  session on the target agent, preserving the original prompt + cwd.
-     *  P2 — injects handoff context for cross-agent continuity.
-     *  Returns the new session or undefined if the target is unavailable. */
-    acceptFailover(sessionId, targetAgent) {
-        const session = this.sessions.get(sessionId);
-        if (!session)
-            return undefined;
-        const targetAdapter = getAdapter(targetAgent);
-        if (!targetAdapter || !targetAdapter.isInstalled())
-            return undefined;
-        const cwd = this.records.get(sessionId)?.cwd ?? process.cwd();
-        // P2 — build handoff context for continuity across agent swap
-        const handoff = buildFailoverHandoff(cwd, {
-            failedAgent: session.agent,
-            failedPrompt: session.prompt,
-        });
-        const promptWithHandoff = handoff
-            ? enrichPromptWithHandoff(session.prompt, {
-                packId: handoff.packId,
-                agent: session.agent,
-                prompt: session.prompt,
-                status: 'failed',
-                timestamp: handoff.timestamp,
-                nodeCount: handoff.nodeCount,
-                edgeCount: handoff.edgeCount,
-                task: handoff.task,
-                payloadPreview: handoff.payloadPreview,
-            })
-            : session.prompt;
-        const newSession = targetAdapter.spawn(promptWithHandoff, {
-            cwd,
-            env: process.env,
-            preferSubscription: true,
-        });
-        // Track the new session
-        this.sessions.set(newSession.sessionId, newSession);
-        this.spawnOrder.push(newSession.sessionId);
-        this.rec(newSession.sessionId).cwd = cwd;
-        // Failover continues the SAME ask — display the clean prompt, not the enriched input.
-        this.rec(newSession.sessionId).displayPrompt = this.getDisplayPrompt(session.sessionId) ?? session.prompt;
-        this.rec(newSession.sessionId).lastActivityAt = Date.now();
-        // Subscribe BEFORE persistence so exit events are never lost if the
-        // adapter exits synchronously.
-        const unsubscribe = newSession.subscribe((event) => {
-            this.rec(newSession.sessionId).lastActivityAt = Date.now();
-            if (event.type !== 'exit')
-                return;
-            this.clearStallTimer(newSession.sessionId);
-            const data = event.data;
-            const completedAt = Date.now();
-            this.rec(newSession.sessionId).completedAt = completedAt;
-            appendCompleted({
-                id: newSession.sessionId,
-                nativeSessionId: newSession.nativeSessionId,
-                delegateSessionId: newSession.delegateSessionId,
-                status: newSession.status,
-                durationMs: Number(data?.durationMs ?? completedAt - newSession.startedAt),
-                completedAt,
-                steps: newSession.steps ? [...newSession.steps] : undefined,
-                artifacts: newSession.artifacts,
-                stalledReason: this.records.get(newSession.sessionId)?.stalled?.reason,
-            });
-            mirrorCompletedToThread({
-                sessionId: newSession.sessionId,
-                cwd,
-                status: newSession.status,
-                durationMs: Number(data?.durationMs ?? completedAt - newSession.startedAt),
-                completedAt,
-                steps: newSession.steps ? [...newSession.steps] : undefined,
-                artifacts: newSession.artifacts,
-            });
-            const reportInput = {
-                sessionId: newSession.sessionId,
-                prompt: newSession.prompt,
-                agent: newSession.agent,
-                status: newSession.status,
-                durationMs: completedAt - newSession.startedAt,
-                steps: newSession.steps ? [...newSession.steps] : [],
-                artifacts: newSession.artifacts,
-                errorText: this.records.get(newSession.sessionId)?.errorText,
-                delegatedTo: this.records.get(newSession.sessionId)?.delegatedTo,
-            };
-            generateFinalReport(reportInput)
-                .then((report) => {
-                if (report) {
-                    this.rec(newSession.sessionId).finalReport = report;
-                    appendFinalReport({
-                        id: newSession.sessionId,
-                        summary: report.summary,
-                        generatedAt: report.generatedAt,
-                        durationMs: report.durationMs,
-                        source: report.source,
-                    });
-                    try {
-                        printFinalReportToTerminal(reportInput, report);
-                    }
-                    catch {
-                        /* defensive */
-                    }
-                }
-            })
-                .catch(() => {
-                /* defensive */
-            });
-            // P1 — persist context pack at accept-failover replacement session exit.
-            void Promise.resolve().then(() => {
-                try {
-                    const stepsStr = newSession.steps
-                        ?.map((s) => `${s.label}: ${s.output || s.state}`)
-                        .filter(Boolean)
-                        .join('\n') ?? '';
-                    const pack = compileSessionPackSync(cwd, {
-                        prompt: newSession.prompt,
-                        artifacts: JSON.stringify(newSession.artifacts, null, 2),
-                        steps: stepsStr,
-                        agent: newSession.agent,
-                    });
-                    if (pack)
-                        persistContextPack(pack, cwd);
-                }
-                catch {
-                    // Silent degradation — context pack is enrichment, not primary path.
-                }
-            });
-            const t = this.narrationTimers.get(newSession.sessionId);
-            if (t) {
-                clearInterval(t);
-                this.narrationTimers.delete(newSession.sessionId);
-            }
-            this.evictOldCompleted();
-            unsubscribe();
-        });
-        // Persistence + threading — safe after subscribe because the exit
-        // handler is already registered.
-        this.rec(sessionId).continuedAs = newSession.sessionId;
-        this.rec(newSession.sessionId).continuedFrom = sessionId;
-        appendSpawned({
-            id: newSession.sessionId,
-            agent: newSession.agent,
-            prompt: promptWithHandoff,
-            cwd,
-            startedAt: newSession.startedAt,
-        });
-        mirrorSpawnedToThread({
-            sessionId: newSession.sessionId,
-            agent: newSession.agent,
-            prompt: promptWithHandoff,
-            cwd,
-            startedAt: newSession.startedAt,
-        });
-        mirrorFailoverToThread({
-            sessionId: newSession.sessionId,
-            fromAgent: session.agent,
-            toAgent: targetAgent,
-            reason: this.records.get(session.sessionId)?.failoverReason ?? 'error',
-            cwd,
-        });
-        this.startNarrationTimer(newSession);
-        this.startStallWatchdog(newSession);
-        return newSession;
-    }
-    /** v0.6 M3 — periodic narration loop per session. */
-    startNarrationTimer(session) {
-        if (process.env.CODEHERE_DISABLE_NARRATOR === '1')
-            return;
-        this.narrationStepsAtLastFire.set(session.sessionId, 0);
-        const intervalMs = Number(process.env.CODEHERE_NARRATOR_INTERVAL_MS ?? 30_000);
-        const minStepDelta = Number(process.env.CODEHERE_NARRATOR_MIN_STEPS ?? 3);
-        const timer = setInterval(() => {
-            // Skip if session has settled.
-            if (session.status !== 'running')
-                return;
-            const steps = session.steps ?? [];
-            const lastFireSteps = this.narrationStepsAtLastFire.get(session.sessionId) ?? 0;
-            if (steps.length - lastFireSteps < minStepDelta)
-                return;
-            // Mark BEFORE the async call to prevent double-firing if the LLM
-            // is slow.
-            this.narrationStepsAtLastFire.set(session.sessionId, steps.length);
-            const elapsedMs = Date.now() - session.startedAt;
-            void generateNarration({
-                sessionId: session.sessionId,
-                prompt: session.prompt,
-                agent: session.agent,
-                elapsedMs,
-                steps: [...steps],
-            })
-                .then((out) => {
-                if (out)
-                    this.rec(session.sessionId).narration = out;
-            })
-                .catch(() => {
-                /* defensive — generateNarration never throws */
-            });
-        }, intervalMs);
-        this.narrationTimers.set(session.sessionId, timer);
-    }
-    /** Tier 1.1 · re-run the project's tests on the real on-disk state and replace
-     *  the agent's SCRAPED test count with the observed ground truth, so the verdict
-     *  checks reality, not the agent's narration. Async + best-effort: skips mock
-     *  runs (no real suite), sessions that made no test claim, and any re-run that
-     *  can't run; mutates the in-memory session so the live verdict refreshes. */
-    async observeTests(session, cwd) {
-        const mockMode = process.env.CODEHERE_MOCK === '1' || process.env.CODEHERE_MOCK === 'true';
-        if (mockMode)
-            return;
-        if (session.status !== 'completed')
-            return;
-        const claimed = session.artifacts?.tests;
-        // R5 — re-run when the task is TEST-RELEVANT, not only when the agent happened
-        // to print a parseable count. The old `if (!claimed) return` was the root cause
-        // of "tests came back null on a real run": real test work whose stdout had no
-        // scrapeable count was never re-verified. We now re-run when there's a claim,
-        // OR the task changed test files, OR a step mentions tests — closing that gap
-        // without running the whole suite after every trivial (non-test) task.
-        // Test-file shapes across ecosystems: tests|spec|__tests__ dirs · *.test.* /
-        // *.spec.* / *_test.* suffixes (JS, Go) · pytest's canonical test_*.py PREFIX
-        // (devil's-advocate audit 2026-06-09: the suffix-only pattern missed exactly
-        // the ecosystem R4 added).
-        const touchedTestFiles = (session.artifacts?.files ?? []).some((f) => /(^|\/)(tests?|spec|__tests__)\//i.test(f.path) ||
-            /\.(test|spec)\.\w+$|_test\.\w+$/i.test(f.path) ||
-            /(^|\/)test_[^/]+\.py$/i.test(f.path));
-        // Tool-action steps only ('say'/'think' carry the agent's full prose, where a
-        // stray "no tests needed" would over-fire a whole suite run). \btest misses
-        // pytest/vitest/jest (no word boundary mid-word) — name the runners.
-        const stepsMentionTests = (session.steps ?? []).some((s) => s.kind !== 'say' && s.kind !== 'think' && /\btests?\b|pytest|vitest|jest/i.test(s.label));
-        // The verifier's whole premise is "don't trust the agent's narration." So
-        // also re-run when the agent CHANGED FILES and the repo has a runnable suite
-        // — even if the agent never mentioned tests. That's exactly the case a
-        // verifier must catch: an agent silently breaks the suite and says nothing
-        // (2026-06-14 — a real run implemented code, broke its tests, and codehere
-        // stayed blind because no trigger fired). Bounded: a detectable command must
-        // exist; the re-run is timeout-bound and opt-out via CODEHERE_RERUN_TESTS=0.
-        const changedFilesWithSuite = (session.artifacts?.files ?? []).length > 0 && detectTestCommand(cwd) !== null;
-        if (!claimed && !touchedTestFiles && !stepsMentionTests && !changedFilesWithSuite)
-            return;
-        if (this.records.get(session.sessionId)?.rerunStarted)
-            return;
-        this.rec(session.sessionId).rerunStarted = true;
-        try {
-            const result = await rerunTests(cwd);
-            if (!session.artifacts)
-                return;
-            // R13/M3 — applyTestObservation (domain/task.ts) is THE one owned writer
-            // of the post-exit tests artifact: the exit-code-authoritative merge, the
-            // claim-preservation rule, and (new) the explicit couldn't-observe reason
-            // landing in testsUnobserved instead of a silent blank (the R5 leftover —
-            // this test-RELEVANT session deserved a verdict input or an honest why).
-            applyTestObservation(session.artifacts, result);
-            // Re-persist so the OBSERVED verdict (or the honest couldn't-observe
-            // reason) survives a daemon restart. The exit handler already wrote a
-            // completed record from the SCRAPED artifact (before this async re-run
-            // landed); loadRecent dedups completed records by id newest-first, so
-            // this later write wins — without it, a caught failure would silently
-            // revert to the agent's "pass" scrape on restart.
-            const completedAt = this.records.get(session.sessionId)?.completedAt ?? Date.now();
-            appendCompleted({
-                id: session.sessionId,
-                nativeSessionId: session.nativeSessionId,
-                delegateSessionId: session.delegateSessionId,
-                status: session.status,
-                durationMs: completedAt - session.startedAt,
-                completedAt,
-                steps: session.steps ? [...session.steps] : undefined,
-                artifacts: session.artifacts,
-                stalledReason: this.records.get(session.sessionId)?.stalled?.reason,
-                delegatedTo: this.records.get(session.sessionId)?.delegatedTo,
-            });
-        }
-        catch {
-            /* re-run is enrichment; never let it break completion */
-        }
-    }
-    /** Tier 1.2 · reconcile the audit's declared file-writes against the real
-     *  git-diff effect, once at completion. Read-only over the append-only audit;
-     *  best-effort (never breaks completion). The verdict is surfaced so the audit
-     *  isn't just "what the agent claimed" but "what codehere could confirm". */
-    reconcileSessionAudit(session) {
-        try {
-            // 1.3 join · include the delegate's runtime sid so a conductor-routed
-            // task's real writes are reconciled (else Auto tasks read 'no-writes').
-            const entries = collectAuditEntriesForSession(session.sessionId, undefined, session.delegateSessionId ? [session.delegateSessionId] : []);
-            const recon = reconcileAudit(entries, session.artifacts);
-            this.rec(session.sessionId).auditRecon = recon;
-            // 2.2 · persist the OBSERVED signal so it survives a daemon restart (the
-            // composite grade reads it back via PersistedSession.auditRecon).
-            appendAuditRecon(session.sessionId, recon);
-        }
-        catch {
-            /* reconciliation is enrichment; never let it break completion */
-        }
-        // R2 · sign the live chain tip now that this session's audit entries have
-        // landed — so a later on-disk edit/truncation is detectable by anyone
-        // verifying with the public key (best-effort; never blocks completion).
-        signAuditTip(AUDIT_FILE);
-    }
-    /**
-     * Tier 2.1 · auto cross-vendor adversarial review. On a successful completion,
-     * spawn a DIFFERENT vendor in refute-mode to independently review this work,
-     * so the cross-vendor proof fires automatically instead of waiting for a human
-     * to run a second task. Flag-gated (CODEHERE_AUTO_REVIEW=1, default OFF) — it
-     * spawns a real agent and costs money, so it never surprises a user.
-     *
-     * Safety: the loop guard (planAutoReview returns null for a reviewer's own
-     * completion via rec.isAutoReview) + a one-shot guard (autoReviewStarted) +
-     * the cost-bounded eligibility gate. Best-effort; never breaks completion.
-     */
-    maybeAutoReview(session, cwd) {
-        if (process.env.CODEHERE_AUTO_REVIEW !== '1')
-            return; // opt-in only
-        try {
-            const rec = this.records.get(session.sessionId);
-            if (rec?.autoReviewStarted)
-                return; // one-shot — exit can fire twice
-            // Only review work that actually succeeded; failures have nothing proven to refute.
-            if (session.status !== 'completed')
-                return;
-            // Claim the one-shot NOW — before computing the plan or spawning — so a
-            // second exit event (the path can fire twice) can't race past the guard
-            // above and spawn a duplicate reviewer. Marking an ineligible writer
-            // (plan === null below) is fine: eligibility is deterministic, so there's
-            // nothing to retry.
-            this.rec(session.sessionId).autoReviewStarted = true;
-            const writerFiles = (session.artifacts?.files ?? []).map((f) => f.path);
-            const installedAgents = REGISTRY.filter((a) => a.id !== 'conductor' && a.isInstalled()).map((a) => a.id);
-            const budgetCfg = loadBudget();
-            const budgetRemainingUsd = budgetCfg.dailyUsd === null
-                ? Number.POSITIVE_INFINITY
-                : Math.max(0, budgetCfg.dailyUsd - computeSpendToday().totalUsd);
-            const plan = planAutoReview({
-                writerAgent: session.agent,
-                writerFiles,
-                cwd,
-                installedAgents,
-                budgetRemainingUsd,
-                isAutoReviewSession: rec?.isAutoReview === true,
-            });
-            if (!plan)
-                return;
-            // Spawn the reviewer in the SAME cwd (so buildCrossVendorVerdict pairs it
-            // with this writer) and TAG it so its own completion can't recurse.
-            const reviewer = this.spawn(plan.prompt, plan.reviewerVendor, {
-                cwd: plan.cwd,
-                parentSessionId: session.sessionId,
-                isReview: true, // persisted → cross-vendor pairing observes the link, never infers it
-            });
-            this.rec(reviewer.sessionId).isAutoReview = true;
-        }
-        catch {
-            /* auto-review is enrichment; never let it break the completion path */
-        }
-    }
-    /** Tier 1.2 · the audit↔disk reconciliation verdict for a session, or undefined
-     *  if not computed (still running / not reconciled). */
-    getAuditRecon(sessionId) {
-        return this.records.get(sessionId)?.auditRecon;
-    }
-    /** Stall watchdog (dogfood 2026-05-27 #1). Polls a running session; if no
-     *  event has arrived within the stall window, kills it and records an honest
-     *  reason. Cross-agent — opencode hung, but any adapter can. Timings are
-     *  env-overridable so the mock harness + tests can drive it fast. Disable
-     *  entirely with CODEHERE_DISABLE_WATCHDOG=1. */
-    startStallWatchdog(session) {
-        if (process.env.CODEHERE_DISABLE_WATCHDOG === '1')
-            return;
-        const stallMs = stallWindowFor(session.agent);
-        const pollMs = Number(process.env.CODEHERE_STALL_POLL_MS ?? 15_000);
-        if (!(stallMs > 0) || !(pollMs > 0))
-            return;
-        const timer = setInterval(() => {
-            if (session.status !== 'running') {
-                this.clearStallTimer(session.sessionId);
-                return;
-            }
-            const last = this.records.get(session.sessionId)?.lastActivityAt ?? session.startedAt;
-            const silentMs = Date.now() - last;
-            if (silentMs < stallMs)
-                return;
-            const reason = `Stopped after no response for ${Math.round(silentMs / 1000)}s — the agent hung without finishing.`;
-            this.clearStallTimer(session.sessionId);
-            // Stall → FAIL OVER (Ega 2026-06-08). A full-stall-window silence is NOT a
-            // transient timeout (the error classifier rightly skips those) — the agent
-            // is genuinely stuck. Hand the task to the next vendor WITH context handoff
-            // (handleFailover → buildFailoverHandoff) so a hung free agent (e.g. gemini
-            // on the free tier) RECOVERS instead of dead-ending. Falls back to the
-            // honest kill + stalledReason when no failover target is available.
-            let recovered;
-            try {
-                recovered = this.handleFailover(session, { fromAgent: session.agent, errorCode: 'stall', reason });
-            }
-            catch {
-                recovered = undefined;
-            }
-            this.rec(session.sessionId).stalled = {
-                reason: recovered ? `${reason} Handed off to ${recovered.agent}.` : reason,
-                stalledAt: Date.now(),
-            };
-            try {
-                session.kill();
-            }
-            catch {
-                // kill is best-effort; the recorded stall reason + 'killed' status is
-                // what the UI reads, so a kill that throws still surfaces honestly.
-            }
-        }, pollMs);
-        this.stallTimers.set(session.sessionId, timer);
-    }
-    clearStallTimer(sessionId) {
-        const t = this.stallTimers.get(sessionId);
-        if (t) {
-            clearInterval(t);
-            this.stallTimers.delete(sessionId);
-        }
-    }
-    /** Watchdog verdict for a session — the honest "why it stopped" reason when
-     *  the stall watchdog killed it, or undefined if it settled on its own.
-     *  The API layer surfaces this so the dashboard never shows a hung task as a
-     *  normal row. */
-    getStallReason(sessionId) {
-        return this.records.get(sessionId)?.stalled?.reason;
-    }
-    /** The clean user prompt for display — strips the graphify/hand-off enrichment
-     *  that lives on session.prompt (the agent's input). Undefined for sessions
-     *  not spawned this process-lifetime (their persisted prompt is already clean). */
-    getDisplayPrompt(sessionId) {
-        return this.records.get(sessionId)?.displayPrompt;
-    }
-    /** v0.6 M3 — latest narration for a session, or undefined. */
-    getNarration(sessionId) {
-        return this.records.get(sessionId)?.narration;
-    }
-    /** Persisted (read-only) sessions from prior daemon runs. Cached at boot. */
-    listPersisted() {
-        return this.persistedCache;
-    }
-    /** S3 · mirror a just-written 'resolved' record into the boot cache, so the
-     *  acknowledged badge survives a page reload WITHOUT a daemon restart. The
-     *  acceptance walk caught the gap: appendResolved hit disk, but /api/tasks
-     *  serves this cache — the UI wiped its own ack on the next poll. */
-    markPersistedResolved(sessionId, resolvedAt) {
-        const rec = this.persistedCache.find((p) => p.sessionId === sessionId);
-        if (rec)
-            rec.resolvedAt = resolvedAt;
-    }
-    /** S13 refuter · mirror a zombie-record bookkeeping kill into the boot
-     *  cache (same reload-vs-restart gap as markPersistedResolved). */
-    markPersistedKilled(sessionId) {
-        const rec = this.persistedCache.find((p) => p.sessionId === sessionId);
-        if (rec) {
-            rec.status = 'killed';
-            rec.completedAt = Date.now();
-        }
-    }
-    /** Completion timestamp for an in-memory session, if it has exited.
-     *  Returns undefined if the session is still running OR was never spawned
-     *  through this manager. Bug 2 sister-fix (May 2): TaskSession itself has
-     *  no completedAt field; this method lets the API layer compute durations. */
-    getCompletedAt(sessionId) {
-        return this.records.get(sessionId)?.completedAt;
-    }
-    /** v0.6.x Slack-shape spike — return cwd for an in-memory session. */
-    getCwd(sessionId) {
-        return this.records.get(sessionId)?.cwd;
-    }
-    /** The specialist the Conductor routed this session to, if it was an Auto/
-     *  conductor task — so the UI can name the agent that actually ran. */
-    getDelegatedTo(sessionId) {
-        return this.records.get(sessionId)?.delegatedTo;
-    }
-    /** It-4 V1-MULTITASK — batchId for an in-memory session, if it was spawned as
-     *  part of a batch (@all fanout / multi-task project). Lets /api/tasks expose
-     *  batchId on LIVE sessions so the room rollup row derives before any restart. */
-    getBatchId(sessionId) {
-        return this.records.get(sessionId)?.batchId;
-    }
-    /** Session threading — which session did this one continue from (after failover)? */
-    getContinuedFrom(sessionId) {
-        return this.records.get(sessionId)?.continuedFrom;
-    }
-    /** Session threading — which session did this one continue as (after failover)? */
-    getContinuedAs(sessionId) {
-        return this.records.get(sessionId)?.continuedAs;
-    }
-    /** Recovery lineage — if this session is a failover REPLACEMENT, which agent it
-     *  took over from + why. Drives the dashboard "recovered from <vendor>" badge.
-     *  undefined for a normal (non-recovered) session. */
-    getRecoveredFrom(sessionId) {
-        return this.records.get(sessionId)?.recoveredFrom;
-    }
-    /** PM-UX Layer 3 · prose Final Report for an in-memory exited session.
-     *  Returns undefined while generation is in flight OR if the provider chain
-     *  failed (no claude-free, no claude, no credit, etc). The web UI reads this
-     *  through the /api/tasks serializer to render the prose summary inline. */
-    getFinalReport(sessionId) {
-        return this.records.get(sessionId)?.finalReport;
-    }
-    /** REQUEST_METHOD §2 — the acceptance contract for a session, served through
-     *  /api/tasks so the room can render "Done means …". */
-    getAcceptanceCriteria(sessionId) {
-        return this.records.get(sessionId)?.acceptanceCriteria;
-    }
-    /** Returns true if Final Report generation explicitly failed for this session.
-     *  Lets the API distinguish "not yet" from "never coming". */
-    hasFailedReport(sessionId) {
-        return this.records.get(sessionId)?.failedReport === true;
-    }
-    get(sessionId) {
-        return this.sessions.get(sessionId);
-    }
-    /**
-     * Reconstruct an APPENDABLE handle for a completed session no longer in memory
-     * (e.g. after a daemon restart), from its persisted record. claude keeps its
-     * own session store, so `claude --resume <nativeSessionId>` in the original cwd
-     * continues the goal with full context — no live session object needed. Only
-     * claude-code today (it has a stable native resume token); undefined otherwise.
-     * This is what makes `codehere reply <id>` survive a daemon restart.
-     */
-    reconstructAppendable(sessionId) {
-        const rec = loadSessionById(sessionId);
-        if (!rec || rec.agent !== 'claude-code' || !rec.nativeSessionId || !rec.cwd)
-            return undefined;
-        const native = rec.nativeSessionId;
-        const cwd = rec.cwd;
-        return {
-            sessionId: rec.sessionId,
-            startedAt: rec.startedAt,
-            prompt: rec.prompt,
-            agent: rec.agent,
-            status: rec.status,
-            cwd,
-            canAppendMessage: true,
-            subscribe: () => () => { },
-            kill: () => { },
-            appendMessage: (text) => resumeClaudeMessage(native, cwd, text),
-        };
-    }
-    /** Evict the oldest completed sessions when the in-memory cap is reached.
-     *  Prevents unbounded memory growth in the internal tracking maps. The
-     *  data survives on disk via sessions.jsonl + thread.jsonl. */
-    evictOldCompleted() {
-        const completed = [];
-        for (const id of this.spawnOrder) {
-            const at = this.records.get(id)?.completedAt;
-            if (at !== undefined)
-                completed.push({ id, completedAt: at });
-        }
-        if (completed.length <= SessionManager.MAX_COMPLETED_SESSIONS)
-            return;
-        const toEvict = completed.slice(0, completed.length - SessionManager.MAX_COMPLETED_SESSIONS);
-        const evictSet = new Set(toEvict.map((e) => e.id));
-        // MED #10 (atomic audit) · spawnOrder was never trimmed — it grew for the
-        // daemon's life and the eviction scan degraded with it.
-        this.spawnOrder = this.spawnOrder.filter((id) => !evictSet.has(id));
-        for (const id of evictSet) {
-            const t = this.narrationTimers.get(id);
-            if (t) {
-                clearInterval(t);
-                this.narrationTimers.delete(id);
-            }
-            this.clearStallTimer(id);
-            this.sessions.delete(id);
-            this.records.delete(id);
-        }
-    }
-    list() {
-        return Array.from(this.sessions.values());
-    }
-    kill(sessionId) {
-        const session = this.sessions.get(sessionId);
-        if (!session)
-            return false;
-        session.kill();
-        return true;
-    }
-    /** Graceful shutdown: kill all running sessions and clear all timers. */
-    shutdown() {
-        for (const [, timer] of this.narrationTimers) {
-            clearInterval(timer);
-        }
-        this.narrationTimers.clear();
-        for (const [, timer] of this.stallTimers) {
-            clearInterval(timer);
-        }
-        this.stallTimers.clear();
-        for (const session of this.sessions.values()) {
-            if (session.status === 'running')
-                session.kill();
-        }
-    }
-    /**
-     * Active Claude Code sessions on this machine, derived from the audit log.
-     * A session is "active" if any tool call from it was recorded within the
-     * last `maxAgeMs` milliseconds. Returns most-recent first.
-     *
-     * Note: codehere-spawned sessions may also appear here because they produce
-     * audit entries just like any other Claude Code session. The UI distinguishes
-     * by provenance.
-     */
-    listObserved(maxAgeMs = DEFAULT_OBSERVED_WINDOW_MS) {
-        if (!existsSync(AUDIT_FILE))
-            return [];
-        const now = Date.now();
-        const cutoff = now - maxAgeMs;
-        const byId = new Map();
-        let content;
-        try {
-            content = readFileSync(AUDIT_FILE, 'utf-8');
-        }
-        catch {
-            return [];
-        }
-        const lines = content.split('\n');
-        // Walk backwards — most recent lines first — and stop early when we
-        // pass the window. Audit log appends chronologically.
-        for (let i = lines.length - 1; i >= 0; i--) {
-            const line = lines[i].trim();
-            if (!line)
-                continue;
-            let entry;
-            try {
-                entry = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            if (!entry.sessionId)
-                continue;
-            const ts = typeof entry.timestamp === 'number'
-                ? entry.timestamp
-                : entry.timestamp
-                    ? Date.parse(String(entry.timestamp))
-                    : 0;
-            if (!ts)
-                continue;
-            if (ts < cutoff)
-                break; // past the window; older entries can't qualify
-            const existing = byId.get(entry.sessionId);
-            if (existing) {
-                existing.eventCount += 1;
-                if (ts < existing.firstEventAt)
-                    existing.firstEventAt = ts;
-            }
-            else {
-                byId.set(entry.sessionId, {
-                    sessionId: entry.sessionId,
-                    firstEventAt: ts,
-                    lastEventAt: ts,
-                    eventCount: 1,
-                    recentTool: entry.toolName,
-                    provenance: 'observed',
-                });
-            }
-        }
-        return Array.from(byId.values()).sort((a, b) => b.lastEventAt - a.lastEventAt);
-    }
-    /**
-     * Agent processes running on this machine right now.
-     * Enumerates via `ps`, filters to known agent executables, returns most
-     * recently started first. This is the primary F1d surface — it reflects
-     * "what AI agents are alive on your machine" independent of whether
-     * they've produced audit events yet.
-     */
-    listActiveAgents() {
-        let out;
-        try {
-            out = execFileSync('ps', ['-A', '-o', 'pid,tty,etime,args'], {
-                encoding: 'utf-8',
-                timeout: 2000,
-            });
-        }
-        catch {
-            return [];
-        }
-        const agents = [];
-        const lines = out.trim().split('\n').slice(1); // drop header
-        for (const line of lines) {
-            const m = line.trim().match(/^(\d+)\s+(\S+)\s+(\S+)\s+(.+)$/);
-            if (!m)
-                continue;
-            const [, pidStr, tty, etime, args] = m;
-            // Skip ourselves — the codehere daemon would otherwise show up repeatedly
-            if (/\bcodehere\b|\bch\s+start\b/.test(args))
-                continue;
-            // Skip the audit tailer from other codehere commands
-            if (/scan-tool|codehere-audit/.test(args))
-                continue;
-            let matched = null;
-            for (const p of agentProcessPatterns()) {
-                if (p.regex.test(args)) {
-                    matched = { agent: p.agent, label: p.label };
-                    break;
-                }
-            }
-            if (!matched)
-                continue;
-            const uptimeSeconds = parseEtime(etime);
-            const startedAt = Date.now() - uptimeSeconds * 1000;
-            agents.push({
-                pid: parseInt(pidStr, 10),
-                tty,
-                agent: matched.agent,
-                label: matched.label,
-                args: args.length > 200 ? args.slice(0, 200) + '…' : args,
-                startedAt,
-                uptimeSeconds,
-                provenance: 'detected',
-            });
-        }
-        return agents.sort((a, b) => b.startedAt - a.startedAt);
-    }
-    /** Subscribe to live-progress ticks (steps/say/exit). Returns an unsubscribe
-     *  fn. The SSE endpoint uses this to push 'change' mid-run, not just when
-     *  sessions.jsonl grows on disk. Listener cap is lifted because each
-     *  connected browser tab adds one. */
-    onLiveChange(cb) {
-        this.liveChanges.setMaxListeners(0);
-        this.liveChanges.on('change', cb);
-        return () => this.liveChanges.off('change', cb);
-    }
-    static _instance;
-    static getInstance() {
-        return (this._instance ??= new SessionManager());
-    }
-    /** @internal Resets the singleton for test isolation. */
-    static __testOnlyReset() {
-        this._instance = undefined;
-    }
-}
-// ── Test seam ─────────────────────────────────────────────────────────────────
-// Avoids refactoring the module-level REGISTRY const to DI. Usage:
-//   import { __testOnlyRegisterAdapter, SessionManager } from '...';
-//   __testOnlyRegisterAdapter(mockAdapter);
-//   SessionManager.__testOnlyReset();
-//   const sm = SessionManager.getInstance();
-/** @internal Exported for testing only — allows mock adapter injection. */
-export function __testOnlyRegisterAdapter(adapter) {
-    REGISTRY.push(adapter);
-}
-/** @internal Resets REGISTRY to BUILTIN_REGISTRY for test isolation.
- *  Call before __testOnlyRegisterAdapter to avoid adapter accumulation. */
-export function __testOnlyResetRegistry() {
-    REGISTRY.length = 0;
-    REGISTRY.push(...BUILTIN_REGISTRY);
-}
-//# sourceMappingURL=session-manager.js.map