dominds 1.16.1 → 1.16.2

package/dist/server/api-routes.js

@@ -55,6 +55,7 @@ const dialog_fork_1 = require("../dialog-fork");
 const dialog_global_registry_1 = require("../dialog-global-registry");
 const log_1 = require("../log");
 const persistence_1 = require("../persistence");
+const persistence_errors_1 = require("../persistence-errors");
 const priming_1 = require("../priming");
 const work_language_1 = require("../runtime/work-language");
 const team_1 = require("../team");
@@ -90,24 +91,108 @@ function getErrorCode(error) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
-function parseDialogStatusFromUrl(urlObj) {
-    const raw = urlObj.searchParams.get('status');
-    if (raw === null)
-        return 'running';
+function parsePersistableDialogStatus(raw) {
     if (raw === 'running' || raw === 'completed' || raw === 'archived') {
         return raw;
     }
     return null;
 }
-function parseDialogStatusKind(raw) {
-    if (raw === 'running' || raw === 'completed' || raw === 'archived') {
-        return raw;
+function readOptionalPersistableDialogStatusQuery(urlObj) {
+    const raw = urlObj.searchParams.get('status');
+    if (raw === null) {
+        return { kind: 'missing' };
+    }
+    const status = parsePersistableDialogStatus(raw);
+    if (status === null) {
+        return { kind: 'invalid' };
+    }
+    return { kind: 'value', status };
+}
+function readOptionalPersistableDialogStatus(raw) {
+    if (raw === undefined) {
+        return { kind: 'missing' };
+    }
+    const status = parsePersistableDialogStatus(raw);
+    if (status === null) {
+        return { kind: 'invalid' };
+    }
+    return { kind: 'value', status };
+}
+async function loadDialogMetadataForLookup(dialogId, status, context) {
+    try {
+        return await persistence_1.DialogPersistence.loadDialogMetadata(dialogId, status);
+    }
+    catch (error) {
+        if (!(0, persistence_errors_1.findDomindsPersistenceFileError)(error)) {
+            throw error;
+        }
+        log.warn(`${context}: dialog metadata quarantined during lazy lookup`, error, {
+            dialogId: dialogId.valueOf(),
+            status,
+        });
+        return null;
+    }
+}
+async function loadRootDialogMetadataForLookup(dialogId, status, context) {
+    try {
+        return await persistence_1.DialogPersistence.loadRootDialogMetadata(dialogId, status);
+    }
+    catch (error) {
+        if (!(0, persistence_errors_1.findDomindsPersistenceFileError)(error)) {
+            throw error;
+        }
+        log.warn(`${context}: root dialog metadata quarantined during lazy lookup`, error, {
+            dialogId: dialogId.valueOf(),
+            status,
+        });
+        return null;
+    }
+}
+async function loadDialogLatestForLookup(dialogId, status, context) {
+    try {
+        return await persistence_1.DialogPersistence.loadDialogLatest(dialogId, status);
+    }
+    catch (error) {
+        if (!(0, persistence_errors_1.findDomindsPersistenceFileError)(error)) {
+            throw error;
+        }
+        log.warn(`${context}: latest.yaml quarantined during lazy lookup`, error, {
+            dialogId: dialogId.valueOf(),
+            status,
+        });
+        return null;
     }
-    return null;
 }
 async function detectWaitingForFreshBootsReasoning(dialogId, status) {
-    const pending = await persistence_1.DialogPersistence.loadPendingSubdialogs(dialogId, status);
-    return pending.some((entry) => entry.callName === 'freshBootsReasoning');
+    try {
+        // Pending-subdialogs is also lazy-loaded per dialog. A malformed queue should quarantine just
+        // that dialog and degrade this derived flag to "unknown/false" instead of taking down the
+        // surrounding list or hierarchy response.
+        const pending = await persistence_1.DialogPersistence.loadPendingSubdialogs(dialogId, status);
+        return pending.some((entry) => entry.callName === 'freshBootsReasoning');
+    }
+    catch (error) {
+        if (!(0, persistence_errors_1.findDomindsPersistenceFileError)(error)) {
+            throw error;
+        }
+        log.warn('detectWaitingForFreshBootsReasoning: pending-subdialogs quarantined during lookup', error, {
+            dialogId: dialogId.valueOf(),
+            status,
+        });
+        return false;
+    }
+}
+async function pathStillExistsForLookup(targetPath) {
+    try {
+        await promises_1.default.access(targetPath);
+        return true;
+    }
+    catch (error) {
+        if (getErrorCode(error) === 'ENOENT') {
+            return false;
+        }
+        throw error;
+    }
 }
 function buildPrimingWarningSummary(warnings) {
     if (warnings.length === 0)
@@ -219,7 +304,17 @@ async function handleSaveCurrentCoursePriming(req, res) {
     }
     const rootId = typeof dialogRaw['rootId'] === 'string' ? dialogRaw['rootId'].trim() : '';
     const selfId = typeof dialogRaw['selfId'] === 'string' ? dialogRaw['selfId'].trim() : '';
-    const status = parseDialogStatusKind(dialogRaw['status']) ?? 'running';
+    const parsedStatus = readOptionalPersistableDialogStatus(dialogRaw['status']);
+    if (parsedStatus.kind === 'invalid') {
+        const payload = {
+            success: false,
+            error: 'dialog.status must be running, completed, or archived',
+            errorCode: 'INVALID_REQUEST',
+        };
+        respondJson(res, 400, payload);
+        return true;
+    }
+    const status = parsedStatus.kind === 'missing' ? 'running' : parsedStatus.status;
     const course = typeof courseRaw === 'number' && Number.isFinite(courseRaw) ? Math.floor(courseRaw) : 0;
     const slug = typeof slugRaw === 'string' ? slugRaw.trim() : '';
     const overwrite = overwriteRaw === true;
@@ -1073,11 +1168,12 @@ async function handleApiRoute(req, res, pathname, context) {
         // Dialog list endpoint
         if (pathname === '/api/dialogs' && req.method === 'GET') {
             const urlObj = new URL(req.url ?? '', 'http://127.0.0.1');
-            const status = parseDialogStatusFromUrl(urlObj);
-            if (!status) {
+            const parsedStatus = readOptionalPersistableDialogStatusQuery(urlObj);
+            if (parsedStatus.kind === 'invalid') {
                 respondJson(res, 400, { success: false, error: 'Invalid status' });
                 return true;
             }
+            const status = parsedStatus.kind === 'missing' ? 'running' : parsedStatus.status;
             return await handleGetDialogs(res, status);
         }
         if (pathname === '/api/dialogs/run-control-counts' && req.method === 'GET') {
@@ -1137,11 +1233,12 @@ async function handleApiRoute(req, res, pathname, context) {
             const parts = pathname.split('/');
             const rootId = parts[3].replace(/%2F/g, '/');
             const urlObj = new URL(req.url ?? '', 'http://127.0.0.1');
-            const status = parseDialogStatusFromUrl(urlObj);
-            if (!status) {
+            const parsedStatus = readOptionalPersistableDialogStatusQuery(urlObj);
+            if (parsedStatus.kind === 'invalid') {
                 respondJson(res, 400, { success: false, error: 'Invalid status' });
                 return true;
             }
+            const status = parsedStatus.kind === 'missing' ? 'running' : parsedStatus.status;
             return await handleGetDialogHierarchy(res, rootId, status);
         }
         // Serve persisted dialog artifacts (binary)
@@ -1164,11 +1261,12 @@ async function handleApiRoute(req, res, pathname, context) {
                 return true;
             }
             const urlObj = new URL(req.url ?? '', 'http://127.0.0.1');
-            const status = parseDialogStatusFromUrl(urlObj);
-            if (!status) {
+            const parsedStatus = readOptionalPersistableDialogStatusQuery(urlObj);
+            if (parsedStatus.kind === 'invalid') {
                 respondJson(res, 400, { success: false, error: 'Invalid status' });
                 return true;
             }
+            const status = parsedStatus.kind === 'missing' ? 'running' : parsedStatus.status;
             return await handleGetDialogArtifact(req, res, { rootId, selfId }, status);
         }
         // Get specific dialog
@@ -1177,11 +1275,12 @@ async function handleApiRoute(req, res, pathname, context) {
             const selfId = (parts[4] || parts[3]).replace(/%2F/g, '/');
             const rootId = parts[3].replace(/%2F/g, '/');
             const urlObj = new URL(req.url ?? '', 'http://127.0.0.1');
-            const status = parseDialogStatusFromUrl(urlObj);
-            if (!status) {
+            const parsedStatus = readOptionalPersistableDialogStatusQuery(urlObj);
+            if (parsedStatus.kind === 'invalid') {
                 respondJson(res, 400, { success: false, error: 'Invalid status' });
                 return true;
             }
+            const status = parsedStatus.kind === 'missing' ? 'running' : parsedStatus.status;
             const dialog = { selfId, rootId, status };
             return await handleGetDialog(res, dialog, status);
         }
@@ -1850,25 +1949,29 @@ async function handleGetToolsRegistry(req, res) {
         const selfId = typeof selfIdRaw === 'string' ? selfIdRaw.trim() : '';
         const requestedAgentId = typeof agentIdRaw === 'string' ? agentIdRaw.trim() : '';
         const requestedTaskDocPath = typeof taskDocPathRaw === 'string' ? taskDocPathRaw.trim() : '';
+        const requestedStatusParam = readOptionalPersistableDialogStatusQuery(urlObj);
+        if (requestedStatusParam.kind === 'invalid') {
+            respondJson(res, 400, { success: false, error: 'Invalid status' });
+            return true;
+        }
         const resolveDialogMetadata = async () => {
             if (rootId === '' || selfId === '') {
                 return null;
             }
-            const requestedStatus = parseDialogStatusFromUrl(urlObj);
             const statusOrder = [
                 'running',
                 'completed',
                 'archived',
             ];
-            const candidateStatuses = requestedStatus === null
+            const candidateStatuses = requestedStatusParam.kind === 'missing'
                 ? statusOrder
                 : [
-                    requestedStatus,
-                    ...statusOrder.filter((status) => status !== requestedStatus),
+                    requestedStatusParam.status,
+                    ...statusOrder.filter((status) => status !== requestedStatusParam.status),
                 ];
             for (const status of candidateStatuses) {
                 const dialogId = new dialog_1.DialogID(selfId, rootId);
-                const metadata = await persistence_1.DialogPersistence.loadDialogMetadata(dialogId, status);
+                const metadata = await loadDialogMetadataForLookup(dialogId, status, 'resolveDialogMetadata');
                 if (metadata) {
                     return metadata;
                 }
@@ -1992,21 +2095,14 @@ async function handleGetDialogs(res, status) {
         const ids = await persistence_1.DialogPersistence.listDialogs(status);
         for (const id of ids) {
             const dialogId = new dialog_1.DialogID(id);
-            const meta = await persistence_1.DialogPersistence.loadRootDialogMetadata(dialogId, status);
+            const meta = await loadRootDialogMetadataForLookup(dialogId, status, 'handleListDialogs');
             if (!meta)
                 continue;
-            // Load latest.yaml for currentCourse and lastModified timestamp
-            const latest = await persistence_1.DialogPersistence.loadDialogLatest(dialogId, status);
+            // listDialogs() only yields candidate IDs. Metadata/latest stay lazy so one malformed dialog
+            // can quarantine itself here without taking down the whole list response.
+            const latest = await loadDialogLatestForLookup(dialogId, status, 'handleListDialogs');
             const rootPath = persistence_1.DialogPersistence.getRootDialogPath(dialogId, status);
-            const rootStillExists = await promises_1.default
-                .access(rootPath)
-                .then(() => true)
-                .catch((error) => {
-                if (getErrorCode(error) === 'ENOENT') {
-                    return false;
-                }
-                throw error;
-            });
+            const rootStillExists = await pathStillExistsForLookup(rootPath);
             if (!rootStillExists) {
                 continue;
             }
@@ -2014,6 +2110,9 @@ async function handleGetDialogs(res, status) {
             // Count subdialogs for this root dialog
             const subPath = path.join(rootPath, 'subdialogs');
             const subdialogCount = await countSubdialogs(subPath);
+            if (!(await pathStillExistsForLookup(rootPath))) {
+                continue;
+            }
             rootDialogs.push({
                 rootId: meta.id,
                 agentId: meta.agentId,
@@ -2067,12 +2166,17 @@ async function countSubdialogs(dirPath) {
                 const dialogYamlPath = path.join(fullPath, 'dialog.yaml');
                 try {
                     await promises_1.default.access(dialogYamlPath);
-                    // This directory contains dialog.yaml - it's a subdialog
+                    // This directory contains dialog.yaml - it's a subdialog.
                     count++;
                 }
-                catch {
-                    // No dialog.yaml - recurse into this directory
-                    count += await countSubdialogs(fullPath);
+                catch (error) {
+                    if (getErrorCode(error) === 'ENOENT') {
+                        // Only a missing dialog.yaml means "keep recursing". Permission/I/O failures must stay
+                        // loud so operators can distinguish inaccessible paths from ordinary non-dialog dirs.
+                        count += await countSubdialogs(fullPath);
+                        continue;
+                    }
+                    throw error;
                 }
             }
         }
@@ -2093,7 +2197,7 @@ async function countSubdialogs(dirPath) {
  */
 async function handleGetDialogHierarchy(res, rootId, status) {
     try {
-        const rootMeta = await persistence_1.DialogPersistence.loadRootDialogMetadata(new dialog_1.DialogID(rootId), status);
+        const rootMeta = await loadRootDialogMetadataForLookup(new dialog_1.DialogID(rootId), status, 'handleGetDialogHierarchy:root');
         if (!rootMeta) {
             respondJson(res, 404, {
                 success: false,
@@ -2102,17 +2206,9 @@ async function handleGetDialogHierarchy(res, rootId, status) {
             return true;
         }
         // Load latest.yaml for root dialog currentCourse and lastModified timestamp
-        const rootLatest = await persistence_1.DialogPersistence.loadDialogLatest(new dialog_1.DialogID(rootId), status);
+        const rootLatest = await loadDialogLatestForLookup(new dialog_1.DialogID(rootId), status, 'handleGetDialogHierarchy:root');
         const rootPath = persistence_1.DialogPersistence.getRootDialogPath(new dialog_1.DialogID(rootId), status);
-        const rootStillExists = await promises_1.default
-            .access(rootPath)
-            .then(() => true)
-            .catch((error) => {
-            if (getErrorCode(error) === 'ENOENT') {
-                return false;
-            }
-            throw error;
-        });
+        const rootStillExists = await pathStillExistsForLookup(rootPath);
         if (!rootStillExists) {
             respondJson(res, 404, {
                 success: false,
@@ -2131,18 +2227,29 @@ async function handleGetDialogHierarchy(res, rootId, status) {
             displayState: rootLatest?.displayState,
             waitingForFreshBootsReasoning: await detectWaitingForFreshBootsReasoning(new dialog_1.DialogID(rootId), status),
         };
+        if (!(await pathStillExistsForLookup(rootPath))) {
+            respondJson(res, 404, {
+                success: false,
+                error: `Root dialog ${rootId} was quarantined as malformed`,
+            });
+            return true;
+        }
         let subdialogs = [];
         const dialogIds = await persistence_1.DialogPersistence.listAllDialogIds(status);
         for (const dialogId of dialogIds) {
             if (dialogId.rootId !== rootId || dialogId.selfId === rootId) {
                 continue;
             }
-            const meta = await persistence_1.DialogPersistence.loadDialogMetadata(dialogId, status);
+            const meta = await loadDialogMetadataForLookup(dialogId, status, 'handleGetDialogHierarchy:subdialog');
             if (!meta) {
                 continue;
             }
-            const subLatest = await persistence_1.DialogPersistence.loadDialogLatest(dialogId, status);
+            const subLatest = await loadDialogLatestForLookup(dialogId, status, 'handleGetDialogHierarchy:subdialog');
             const waitingForFreshBootsReasoning = await detectWaitingForFreshBootsReasoning(dialogId, status);
+            const subdialogPath = persistence_1.DialogPersistence.getSubdialogPath(dialogId, status);
+            if (!(await pathStillExistsForLookup(subdialogPath))) {
+                continue;
+            }
             const derivedSupdialogId = meta.assignmentFromSup?.callerDialogId &&
                 meta.assignmentFromSup.callerDialogId.trim() !== ''
                 ? meta.assignmentFromSup.callerDialogId
@@ -2292,7 +2399,16 @@ async function handleForkDialog(req, res, context, rootIdRaw) {
         const rootId = rootIdRaw.trim();
         const course = typeof courseRaw === 'number' && Number.isFinite(courseRaw) ? Math.floor(courseRaw) : 0;
         const genseq = typeof genseqRaw === 'number' && Number.isFinite(genseqRaw) ? Math.floor(genseqRaw) : 0;
-        const status = parseDialogStatusKind(statusRaw) ?? 'running';
+        const parsedStatus = readOptionalPersistableDialogStatus(statusRaw);
+        if (parsedStatus.kind === 'invalid') {
+            const payload = {
+                success: false,
+                error: 'status must be running, completed, or archived',
+            };
+            respondJson(res, 400, payload);
+            return true;
+        }
+        const status = parsedStatus.kind === 'missing' ? 'running' : parsedStatus.status;
         if (rootId === '') {
             const payload = { success: false, error: 'rootId is required' };
             respondJson(res, 400, payload);
@@ -2380,7 +2496,7 @@ async function handleMoveDialogs(req, res, context) {
                 respondJson(res, 400, { success: false, error: 'rootId must be a non-empty string' });
                 return true;
             }
-            const meta = await persistence_1.DialogPersistence.loadRootDialogMetadata(new dialog_1.DialogID(rootId), fromStatus);
+            const meta = await loadRootDialogMetadataForLookup(new dialog_1.DialogID(rootId), fromStatus, 'handleMoveDialogs:root');
             if (!meta) {
                 respondJson(res, 404, {
                     success: false,
@@ -2417,7 +2533,7 @@ async function handleMoveDialogs(req, res, context) {
         for (const id of ids) {
             if (typeof id !== 'string' || id.trim() === '')
                 continue;
-            const meta = await persistence_1.DialogPersistence.loadRootDialogMetadata(new dialog_1.DialogID(id), fromStatus);
+            const meta = await loadRootDialogMetadataForLookup(new dialog_1.DialogID(id), fromStatus, 'handleMoveDialogs:task-scan');
             if (!meta)
                 continue;
             if (meta.taskDocPath !== taskDocPath)
@@ -2551,7 +2667,7 @@ async function handleDeleteDialog(res, dialog, context) {
  */
 async function handleGetDialog(res, dialog, status) {
     try {
-        const metadata = await persistence_1.DialogPersistence.loadDialogMetadata(new dialog_1.DialogID(dialog.selfId, dialog.rootId), status);
+        const metadata = await loadDialogMetadataForLookup(new dialog_1.DialogID(dialog.selfId, dialog.rootId), status, 'handleGetDialog');
         if (!metadata) {
             respondJson(res, 404, { success: false, error: `Dialog not found in ${status}` });
             return true;
@@ -2598,7 +2714,7 @@ async function handleResolveDialogStatus(req, res) {
         const dialogId = new dialog_1.DialogID(selfId, rootId);
         const candidates = ['running', 'completed', 'archived'];
         for (const status of candidates) {
-            const metadata = await persistence_1.DialogPersistence.loadDialogMetadata(dialogId, status);
+            const metadata = await loadDialogMetadataForLookup(dialogId, status, 'handleResolveDialogStatus');
             if (!metadata)
                 continue;
             respondJson(res, 200, {

package/dist/server/websocket-handler.js

@@ -25,6 +25,7 @@ const kernel_driver_1 = require("../llm/kernel-driver");
 const runtime_2 = require("../llm/kernel-driver/runtime");
 const log_1 = require("../log");
 const persistence_1 = require("../persistence");
+const persistence_errors_1 = require("../persistence-errors");
 const priming_1 = require("../priming");
 const problems_1 = require("../problems");
 const reply_special_1 = require("../recovery/reply-special");
@@ -51,12 +52,22 @@ function normalizeDiligencePushMax(value) {
         return 0;
     return Math.floor(value);
 }
-function parseDialogStatusKind(raw) {
+function parsePersistableDialogStatus(raw) {
     if (raw !== 'running' && raw !== 'completed' && raw !== 'archived') {
         return null;
     }
     return raw;
 }
+function readOptionalPersistableDialogStatus(raw) {
+    if (raw === undefined) {
+        return { kind: 'missing' };
+    }
+    const status = parsePersistableDialogStatus(raw);
+    if (status === null) {
+        return { kind: 'invalid' };
+    }
+    return { kind: 'value', status };
+}
 function formatDeclaredDeadSubdialogNotice(language, dialogId, callName) {
     if (language === 'zh') {
         switch (callName) {
@@ -318,7 +329,15 @@ async function handleDeclareSubdialogDead(ws, packet) {
         return;
     }
     const dialogIdObj = new dialog_1.DialogID(dialog.selfId, dialog.rootId);
-    const requestedStatus = parseDialogStatusKind(dialog.status) ?? 'running';
+    const requestedStatusInput = readOptionalPersistableDialogStatus(dialog.status);
+    if (requestedStatusInput.kind === 'invalid') {
+        ws.send(JSON.stringify({
+            type: 'error',
+            message: 'declare_subdialog_dead requires status running, completed, or archived',
+        }));
+        return;
+    }
+    const requestedStatus = requestedStatusInput.kind === 'missing' ? 'running' : requestedStatusInput.status;
     if (requestedStatus !== 'running') {
         ws.send(JSON.stringify({
             type: 'error',
@@ -405,7 +424,15 @@ async function handleSetDiligencePush(ws, packet) {
         }
         // Diligence Push is root-dialog state. Even if a subdialog is displayed, always mutate the root.
         const dialogIdObj = new dialog_1.DialogID(rootId);
-        const requestedStatus = parseDialogStatusKind(dialog.status) ?? 'running';
+        const requestedStatusInput = readOptionalPersistableDialogStatus(dialog.status);
+        if (requestedStatusInput.kind === 'invalid') {
+            ws.send(JSON.stringify({
+                type: 'error',
+                message: 'set_diligence_push requires status running, completed, or archived',
+            }));
+            return;
+        }
+        const requestedStatus = requestedStatusInput.kind === 'missing' ? 'running' : requestedStatusInput.status;
         const rootMeta = await persistence_1.DialogPersistence.loadDialogMetadata(dialogIdObj, requestedStatus);
         if (!rootMeta) {
             ws.send(JSON.stringify({
@@ -523,7 +550,15 @@ async function handleRefillDiligencePushBudget(ws, packet) {
         return;
     }
     const rootDialogId = new dialog_1.DialogID(rootId);
-    const requestedStatus = parseDialogStatusKind(dialog.status) ?? 'running';
+    const requestedStatusInput = readOptionalPersistableDialogStatus(dialog.status);
+    if (requestedStatusInput.kind === 'invalid') {
+        ws.send(JSON.stringify({
+            type: 'error',
+            message: 'refill_diligence_push_budget requires status running, completed, or archived',
+        }));
+        return;
+    }
+    const requestedStatus = requestedStatusInput.kind === 'missing' ? 'running' : requestedStatusInput.status;
     const rootMeta = await persistence_1.DialogPersistence.loadDialogMetadata(rootDialogId, requestedStatus);
     if (!rootMeta) {
         ws.send(JSON.stringify({
@@ -742,7 +777,15 @@ async function handleDisplayDialog(ws, packet) {
             cleanupWsClient(ws);
         }
         const dialogIdObj = new dialog_1.DialogID(dialogId, rootDialogId);
-        const requestedStatus = parseDialogStatusKind(dialogIdent.status) ?? 'running';
+        const requestedStatusInput = readOptionalPersistableDialogStatus(dialogIdent.status);
+        if (requestedStatusInput.kind === 'invalid') {
+            ws.send(JSON.stringify({
+                type: 'error',
+                message: 'display_dialog requires status running, completed, or archived',
+            }));
+            return;
+        }
+        const requestedStatus = requestedStatusInput.kind === 'missing' ? 'running' : requestedStatusInput.status;
         const dialogState = await persistence_1.DialogPersistence.restoreDialog(dialogIdObj, requestedStatus);
         const metadata = await persistence_1.DialogPersistence.loadDialogMetadata(dialogIdObj, requestedStatus);
         if (!dialogState || !metadata) {
@@ -957,7 +1000,15 @@ async function handleDisplayCourse(ws, packet) {
         }
         const dialogId = new dialog_1.DialogID(dialogIdStr, rootDialogIdStr);
         try {
-            const requestedStatus = parseDialogStatusKind(dialog.status) ?? 'running';
+            const requestedStatusInput = readOptionalPersistableDialogStatus(dialog.status);
+            if (requestedStatusInput.kind === 'invalid') {
+                ws.send(JSON.stringify({
+                    type: 'error',
+                    message: 'display_course requires status running, completed, or archived',
+                }));
+                return;
+            }
+            const requestedStatus = requestedStatusInput.kind === 'missing' ? 'running' : requestedStatusInput.status;
             const metadata = await persistence_1.DialogPersistence.loadDialogMetadata(dialogId, requestedStatus);
             if (!metadata) {
                 log.warn('Metadata not found for display_course', undefined, {
@@ -1190,22 +1241,34 @@ async function handleResumeAll(ws, packet) {
     }
     const dialogIds = await persistence_1.DialogPersistence.listAllDialogIds('running');
     for (const id of dialogIds) {
-        const latest = await persistence_1.DialogPersistence.loadDialogLatest(id, 'running');
-        if (!(0, dialog_display_state_1.isDialogLatestResumable)(latest))
-            continue;
-        void (async () => {
-            try {
-                const dlg = await restoreDialogForDrive(id, 'running');
-                await (0, kernel_driver_1.driveDialogStream)(dlg, undefined, true, {
-                    allowResumeFromInterrupted: true,
-                    source: 'ws_resume_all',
-                    reason: 'resume_all',
-                });
-            }
-            catch (err) {
-                log.warn('resume_all: failed to resume dialog', err, { dialogId: id.valueOf() });
+        try {
+            // listAllDialogIds() only gives candidate IDs. A malformed dialog can still quarantine itself
+            // during lazy latest lookup here without preventing resume-all for the rest.
+            const latest = await persistence_1.DialogPersistence.loadDialogLatest(id, 'running');
+            if (!(0, dialog_display_state_1.isDialogLatestResumable)(latest))
+                continue;
+            void (async () => {
+                try {
+                    const dlg = await restoreDialogForDrive(id, 'running');
+                    await (0, kernel_driver_1.driveDialogStream)(dlg, undefined, true, {
+                        allowResumeFromInterrupted: true,
+                        source: 'ws_resume_all',
+                        reason: 'resume_all',
+                    });
+                }
+                catch (err) {
+                    log.warn('resume_all: failed to resume dialog', err, { dialogId: id.valueOf() });
+                }
+            })();
+        }
+        catch (error) {
+            if (!(0, persistence_errors_1.findDomindsPersistenceFileError)(error)) {
+                throw error;
             }
-        })();
+            log.warn('resume_all: skipping malformed dialog during latest lookup', error, {
+                dialogId: id.valueOf(),
+            });
+        }
     }
     emitRunControlRefresh('resume_all');
 }
@@ -1390,6 +1453,44 @@ function setupWebSocketServer(httpServer, clients, auth, serverWorkLanguage, mod
     broadcastDialogsIndexMessage = (msg) => {
         broadcastToClients(msg);
     };
+    (0, persistence_1.setPrepareDialogQuarantineHook)(async ({ rootDialogId, status }) => {
+        if (status !== 'running') {
+            return;
+        }
+        (0, dialog_display_state_1.markRootDialogQuarantining)(rootDialogId);
+        await (0, dialog_display_state_1.forceStopActiveRunsForRootDialog)(rootDialogId);
+    });
+    (0, persistence_1.setFinalizeDialogQuarantineHook)(({ rootDialogId, status, quarantined }) => {
+        if (status !== 'running') {
+            return;
+        }
+        if (quarantined) {
+            (0, dialog_display_state_1.clearRootDialogQuarantiningIfIdle)(rootDialogId);
+            return;
+        }
+        (0, dialog_display_state_1.clearRootDialogQuarantining)(rootDialogId);
+    });
+    (0, persistence_1.setDialogsQuarantinedBroadcaster)((msg) => {
+        broadcastToClients(msg);
+        if (msg.fromStatus !== 'running') {
+            return;
+        }
+        void (0, dialog_display_state_1.getRunControlCountsSnapshot)()
+            .then((counts) => {
+            broadcastToClients({
+                type: 'run_control_counts_evt',
+                proceeding: counts.proceeding,
+                resumable: counts.resumable,
+                timestamp: (0, time_1.formatUnifiedTimestamp)(new Date()),
+            });
+        })
+            .catch((error) => {
+            log.warn('Failed to broadcast run-control counts after dialog quarantine', error, {
+                rootId: msg.rootId,
+                dialogId: msg.dialogId,
+            });
+        });
+    });
     // Broadcast global run-control refresh hints so all clients converge from persisted dialog index.
     broadcastRunControlRefreshMessage = (msg) => {
         broadcastToClients(msg);
@@ -1418,6 +1519,9 @@ function setupWebSocketServer(httpServer, clients, auth, serverWorkLanguage, mod
         (0, team_config_updates_1.stopTeamConfigWatcher)();
         (0, team_config_updates_1.clearTeamConfigBroadcaster)();
         (0, dominds_self_update_1.setDomindsSelfUpdateBroadcaster)(null);
+        (0, persistence_1.setFinalizeDialogQuarantineHook)(null);
+        (0, persistence_1.setPrepareDialogQuarantineHook)(null);
+        (0, persistence_1.setDialogsQuarantinedBroadcaster)(null);
         void wss.close();
     });
     wss.on('connection', (ws, req) => {

package/dist/tools/team_mgmt.js

@@ -5333,7 +5333,7 @@ async function renderTeamMgmtGuideContent(language, topicsRaw = []) {
                         '`model_param_options` 可选：用于记录该 provider 支持的 `.minds/team.yaml model_params` 选项（文档用途）。',
                         '`apiQuirks` 可选：写在 `providers.<providerKey>.apiQuirks`，类型是 `string|string[]`。它是 provider 级 transport / 网关兼容开关，用来描述“这个供应商/网关的 API 有非标准行为”，不是 `.minds/team.yaml` 的成员参数，也不是 `model_params`。',
                         '使用原则：只有在你确认某个上游网关确实偏离了标准协议，而且 Dominds 已为这个偏差实现了命名 quirk 时才配置；不要把它当作随意调参入口。当前实现里，未知 quirk 值通常不会报错，但也不会带来任何效果。',
-                        '当前已知示例：OpenAI Responses 包装层支持 `apiQuirks: xcode.best`（或数组里包含它）。它一方面会把供应商额外发出的 `keepalive` 流事件识别为 heartbeat，而不是当作异常事件处理；另一方面也会对该网关特有的“同一对话上下文连续返回 empty response”做 provider-specific failure handling：先做少量临时重试，连续达到阈值后直接放弃，并明确提示应新开对话而不是继续调大普通重试参数。最小示例：\n```yaml\nproviders:\n  my_gateway:\n    apiType: openai\n    baseUrl: https://example.invalid/v1\n    apiKeyEnvVar: MY_GATEWAY_API_KEY\n    apiQuirks: xcode.best\n    models:\n      my_model: { name: \"upstream-model-id\" }\n```',
+                        '当前已知示例：OpenAI Responses 包装层支持 `apiQuirks: xcode.best`（或数组里包含它）。它一方面会把供应商额外发出的 `keepalive` 流事件识别为 heartbeat，而不是当作异常事件处理；另一方面也会对该网关特有的失败模式做 provider-specific failure handling，包括“同一对话上下文连续返回 empty response”时先做少量临时重试、连续达到阈值后停止自动重试，并明确提示直接继续大概率仍无真实进展，更建议结合真实情况灵活尝试多种新的指令；这类 provider/API retry 状态在同一次 driver 自动续跑链里会继续沿用，不因中途换 course 而自动清零；若当前对话启用了鞭策，driver 也会优先判断是否能按鞭策逻辑直接续跑一次，而不是先落入 stopped，并且一旦 driver 接受这次自动恢复资格，就会立刻记作已消费；以及把网关返回的 HTML 版 502 Bad Gateway 错误页归类为 conservative 策略重试。最小示例：\n```yaml\nproviders:\n  my_gateway:\n    apiType: openai\n    baseUrl: https://example.invalid/v1\n    apiKeyEnvVar: MY_GATEWAY_API_KEY\n    apiQuirks: xcode.best\n    models:\n      my_model: { name: \"upstream-model-id\" }\n```',
                         '边界提醒：`apiQuirks` 只影响实现里显式消费它的 provider/generator。就当前实现看，至少 OpenAI Responses 路径会读取它；不要假设所有 `apiType` 都支持或需要它。若配置后行为仍异常，应继续检查上游网关文档、抓流事件类型，并结合 `team_mgmt_check_provider(...)` / 运行日志排查。',
                     ])
                 : fmtHeader('.minds/llm.yaml') +
@@ -5347,7 +5347,7 @@ async function renderTeamMgmtGuideContent(language, topicsRaw = []) {
                         'Optional: `model_param_options` documents `.minds/team.yaml model_params` knobs (documentation only).',
                         '`apiQuirks` is optional under `providers.<providerKey>.apiQuirks`, with type `string|string[]`. It is a provider-level transport / gateway compatibility switch for non-standard upstream API behavior. It is not a `.minds/team.yaml` member field and not part of `model_params`.',
                         'Use it only when you have confirmed that an upstream gateway deviates from the expected protocol and Dominds has an explicitly named quirk for that deviation. Do not treat it as a generic tuning field. In the current implementation, unknown quirk values are usually ignored rather than rejected, so a typo may silently do nothing.',
-                        'Known current example: the OpenAI Responses wrapper supports `apiQuirks: xcode.best` (or an array containing it). It not only treats vendor-emitted `keepalive` stream events as heartbeat events instead of unexpected protocol noise, but also applies provider-specific failure handling for repeated empty responses in the same dialog context: a few temporary retries first, then an explicit give-up that tells the user to start a new dialog rather than merely increasing generic retry knobs. Minimal example:\n```yaml\nproviders:\n  my_gateway:\n    apiType: openai\n    baseUrl: https://example.invalid/v1\n    apiKeyEnvVar: MY_GATEWAY_API_KEY\n    apiQuirks: xcode.best\n    models:\n      my_model: { name: \"upstream-model-id\" }\n```',
+                        'Known current example: the OpenAI Responses wrapper supports `apiQuirks: xcode.best` (or an array containing it). It not only treats vendor-emitted `keepalive` stream events as heartbeat events instead of unexpected protocol noise, but also applies provider-specific failure handling for gateway-specific failures, including repeated empty responses in the same dialog context (a few temporary retries first, then an explicit stop of automatic retries with a warning that simply continuing is still unlikely to make real progress and that the better next step is to try different fresh instructions based on the real situation; this provider/API retry state intentionally continues across course changes within the same driver auto-continue chain; if Diligence Push is enabled for the dialog, the driver will first see whether it can continue once through that path before falling into stopped, and that recovery budget is considered consumed as soon as the driver accepts that path) and gateway-returned HTML 502 Bad Gateway pages classified into conservative retry. Minimal example:\n```yaml\nproviders:\n  my_gateway:\n    apiType: openai\n    baseUrl: https://example.invalid/v1\n    apiKeyEnvVar: MY_GATEWAY_API_KEY\n    apiQuirks: xcode.best\n    models:\n      my_model: { name: \"upstream-model-id\" }\n```',
                         'Boundary reminder: `apiQuirks` only affects providers/generators that explicitly read it in code. In the current implementation, at least the OpenAI Responses path consumes it; do not assume every `apiType` supports or needs it. If behavior is still wrong after setting it, continue with upstream gateway docs, raw stream event inspection, and `team_mgmt_check_provider(...)` / runtime logs.',
                     ]);
         }