flowviant 0.125.6 → 0.125.9

package/README.md

@@ -3,8 +3,8 @@
 Run your own coding CLIs as build agents for [Flowviant](https://flowviant.com) — [Claude Code](https://claude.com/claude-code), Codex or Antigravity, on your own credentials. This daemon holds your sessions, keeps a worktree per tab, and ships branches on your word. The daemon does not send your Claude, Codex or GitHub logins to Flowviant; it shells out to CLIs you signed in yourself.
 
 ```sh
-curl -fsSL https://api.flowviant.com/install.sh | sh
-flowviant   # approve the code in Flowviant → connected
+curl -fsSL https://api.flowviant.com/install.sh | sh && ~/.flowviant/bin/flowviant
+# approve the code in Flowviant → connected; new terminals just run `flowviant`
 ```
 
 Login keeps going straight into the daemon — there is no second command to run.
@@ -31,11 +31,10 @@ On the machine that runs the daemon:
 Download the standalone binary, then start it in your checkout:
 
 ```sh
-curl -fsSL https://api.flowviant.com/install.sh | sh
-flowviant
+curl -fsSL https://api.flowviant.com/install.sh | sh && ~/.flowviant/bin/flowviant
 ```
 
-It shows a short code. Open your project's **Workbench** in Flowviant and enter the code where it offers to connect a machine. The credential is stored at `~/.flowviant/credentials.json`, and from then on `flowviant` just runs. The installer prints a PATH hint if needed; `FLOWVIANT_INSTALL_DIR` changes its destination. It verifies SHA-256 and never uses sudo.
+The full path is for this first run only: the installer adds its folder to your shell's startup file, which new terminals read. It shows a short code. Open your project's **Workbench** in Flowviant and enter the code where it offers to connect a machine. The credential is stored at `~/.flowviant/credentials.json`, and from then on `flowviant` just runs. The installer prints a PATH hint if needed; `FLOWVIANT_INSTALL_DIR` changes its destination. It verifies SHA-256 and never uses sudo.
 
 Run `flowviant login` from another checkout and choose the same project in the
 browser to add its repository to that board. Project settings → General lists
@@ -68,7 +67,7 @@ The binary and global npm installs update when idle. The binary fetches the rele
 | `flowviant login` | Connect this repo to a project (approve the link it prints) |
 | `flowviant stop` | Stop every flowviant daemon on this computer |
 | `flowviant status` | Each project connected here: repo, running/serving, live agents |
-| `flowviant logs [-f]` | This repo's daemon log (`-f` follows it) |
+| `flowviant logs [-f] [-n <lines>] [--turn <id>] [--project <name|id>]` | Replay or follow retained local diagnostics; optionally select one turn |
 | `flowviant open` | Open this project's board in the browser |
 | `flowviant projects` | Every stored login and the repo it serves |
 | `flowviant machines` | Every computer serving your projects; a menu on a terminal |
@@ -77,6 +76,85 @@ The binary and global npm installs update when idle. The binary fetches the rele
 | `flowviant clean` | Delete kept agent worktrees |
 | `flowviant uninstall` | Remove every copy (`--purge` for logins too) |
 
+## Native activity feed
+
+`flowviant` (or `flowviant start`) defaults to an append-only chronological
+feed. Each work record carries its observation time, readable work name and
+stable `@` turn label; observed native children keep their parent turn and a
+child label. Long names and routine labels are shortened to fit ordinary
+terminals; errors and questions keep their actual words and line breaks.
+
+Starts, failures, interruptions, plan proposals and validated agent deliveries
+appear immediately. A delivery says **Delivered for review**; only the merge
+lane's measured landing says **Merged on the base branch**. Questions retain
+their text and the existing app destination. Answer them in Flowviant.
+Connection failures and recovery, serving changes and stopping remain visible.
+
+Routine narration and tool activity are summarized as **Latest activity**
+every ten seconds while fresh activity arrives, and flushed before immediate
+observations or at close. A quiet interval prints nothing. A latest observation
+is not proof that a command is still running. At most 256 pending turn/child
+labels are held, each limited to 120 characters; reaching that bound flushes
+them in observation order. This is a feed, not a live dashboard; `flowviant
+status` remains the on-demand snapshot.
+
+Use `flowviant --detail` or `flowviant start --detail` to print each runtime
+activity as it arrives. This selects the existing detailed activity stream;
+fuller supplied narration and tool data are available through logs below.
+The choice survives inline login, PATH adoption and self-update relaunches.
+It is inherited for that launch, not saved as a project preference. A service
+can set `FLOWVIANT_OUTPUT=detail`; `--detail` also works on `flowviant login`.
+Both presentations capture the same diagnostic detail before rendering.
+Legacy idle snapshots stay in retained diagnostics in compact mode.
+Environment-token launches attach the project journal when the roster first
+identifies the project, before starting its CLI work. If
+retention is unavailable or a write fails, the live record stays detailed.
+
+## Local diagnostic detail
+
+`flowviant logs` shows the last 80 retained lines for this repo's project,
+including daemon diagnostics and native CLI detail. Use `-n 300` for more lines,
+`-f` or `--follow` for new lines across rotation and daemon restarts, and
+`--project <name|id>` for another connected project. To isolate concurrent work,
+copy the `@` turn label from the compact feed (or the full `turn` id from detail):
+
+```sh
+flowviant logs --turn @<label> -n 300
+flowviant logs --turn <turn-id> --follow --project <name-or-id>
+```
+
+The filter accepts an exact full turn id or the deterministic twelve-hex `@`
+SHA-256 label of that id. It includes observed native children and excludes
+unattributed daemon diagnostics. With no filter those diagnostics remain
+visible. Replay includes the current log and its one predecessor, oldest first.
+Each project retains **two files of at most 2 MiB each**, under
+`~/.flowviant/daemon-<project-hash>.log` and `.log.1`, with mode `0600`.
+Retention is by bytes, not a guaranteed duration; older detail expires as work
+continues. New log directories use mode `0700`.
+
+Native entries retain observed timestamps, readable work names, full work/turn
+ids and available native-child ids, with supplied narration, answers, tool
+calls/results and CLI stderr/errors. This is **local diagnostic detail, not a
+complete vendor transcript**: it contains no unavailable reasoning or raw
+vendor event archive, and only tool information the adapters expose. Each
+encoded native record is capped at **64 KiB**, after redaction; a clipped entry
+carries `[truncated: local detail record exceeded 64 KiB]`. Oversized legacy
+console entries carry `[truncated]`. Tail limits, detected rotation/write gaps,
+unreadable records and missing selected-turn detail are explicit. A missing
+turn may have expired or predate this capture; it does not mean the turn did
+not run.
+
+Capture is independent of app trace uploads and foreground presentation. Local
+storage and replay use the daemon's existing learned-secret and credential-shape
+scrubber, with its documented exemptions; supplied per-turn MCP/login values
+are masked too. Known multiline secret fragments and streamed PEM bodies are
+masked before storage. Terminal controls are removed at storage and replay.
+Unknown secrets outside those sources/shapes remain outside that guarantee.
+If storage fails, work continues, the daemon reports that detail could not be
+retained, and a successful later write marks the gap. Foreground presentation
+never changes retained detail; desktop `--json-events` still reserves stdout for
+machine events and writes human output to stderr.
+
 ## Uninstall
 
 `flowviant uninstall` stops local daemons and removes installed copies. It keeps logins and local state in `~/.flowviant`, so reinstalling resumes them. Use `flowviant uninstall --purge` to disconnect this box from stored projects and delete that local data too. Add `--yes` to skip confirmation.

package/bin/cli.mjs

@@ -115,6 +115,11 @@ if (process.argv[2] === '__hook') {
 // is that the login ended; wait for stdout to drain before exiting.
 const flushStdout = () => new Promise((resolve) => process.stdout.write('', resolve));
 
+// Preserve an explicit foreground choice across login, PATH and update
+// relaunches, including paths that build fresh argv. No setting is saved.
+const { outputMode, configureActivityOutput } = await import('./lib/activityFeed.mjs');
+process.env.FLOWVIANT_OUTPUT = outputMode(process.argv.slice(2), process.env);
+
 // `flowviant start` is the spelled-out form of a bare `flowviant`; everything
 // below reads the start path from argv, so the word is simply dropped.
 if (process.argv[2] === 'start' && !process.argv.slice(3).some((arg) => arg === '--help' || arg === '-h')) process.argv.splice(2, 1);
@@ -229,7 +234,7 @@ async function statusCommand() {
 async function logsCommand() {
   const { runLogs } = await import('./lib/views.mjs');
   await runLogs(process.argv);
-  process.exit(0);
+  process.exit(process.exitCode || 0);
 }
 
 // `flowviant open` — this repo's board, in the browser.
@@ -484,4 +489,5 @@ const { installDaemonLogging } = await import('./lib/daemonLogging.mjs');
 const { daemonLogPath } = await import('./lib/daemonState.mjs');
 const logProjectId = CREDENTIAL?.entry?.projectId;
 installDaemonLogging(logProjectId ? daemonLogPath(logProjectId) : null, { jsonEvents: process.argv.includes('--json-events') });
+configureActivityOutput(process.env.FLOWVIANT_OUTPUT);
 await runFleetDaemon({ afterLock });

package/bin/lib/activityFeed.mjs

@@ -0,0 +1,69 @@
+/** Local foreground presentation. Retention happens before this sink. Unknown
+ * or failed retention always falls back to the complete detailed live record.
+ * A timer consumes fresh observations; it never infers liveness from silence.
+ */
+import { createHash } from 'node:crypto';
+import { c, stamp } from './ui.mjs';
+import { printableLine, printableText } from './printable.mjs';
+
+export const turnToken = id => '@' + createHash('sha256').update(id).digest('hex').slice(0, 12);
+export const matchesTurn = (id, selection) => selection === id || selection === turnToken(id);
+export const outputMode = (argv, env) => argv.includes('--detail') || env.FLOWVIANT_OUTPUT === 'detail' ? 'detail' : 'compact';
+const routine = new Set(['think', 'say', 'bash', 'glob', 'list', 'plan', 'read', 'search', 'tool', 'write']);
+
+export function formatActivityRecord(record) {
+  const name = printableLine(printableText(record.name), 24);
+  const child = record.agentId ? ` child=${turnToken(record.agentId)}` : '';
+  const prefix = `${stamp(record.observedAt)} ${c.cyan(`[${printableLine(record.kind, 16)} ${name} ${turnToken(record.turnId)}${child}]`)} `;
+  const body = printableText(record.text).replace(/\n$/, '');
+  return body.split('\n').map(line => prefix + line).join('\n') + '\n';
+}
+
+export function createActivityFeed({ intervalMs = 10_000, maxPending = 256,
+  schedule = setTimeout, cancel = clearTimeout } = {}) {
+  const pending = new Map();
+  let timer = null;
+  const flush = () => {
+    if (timer !== null) { cancel(timer); timer = null; }
+    const rows = [...pending.values()];
+    pending.clear();
+    for (const { record, write } of rows) {
+      // Only the label is coalesced. Full text was already retained, including
+      // tools/results. Observation time belongs to the latest supplied event.
+      const latest = { ...record, text: `Latest activity: ${printableLine(record.text, 120)}` };
+      write(formatActivityRecord(latest), latest.source, latest, true);
+    }
+  };
+  return {
+    present(record, detail, retained, write) {
+      if (retained === true && record.source === 'activity' && routine.has(record.activityKind)) {
+        const key = JSON.stringify([record.turnId, record.agentId]);
+        pending.delete(key); // Map order is the order of the latest observations.
+        pending.set(key, { record: { ...record, text: printableLine(record.text, 120) }, write });
+        if (pending.size >= maxPending) flush();
+        else if (timer === null) { timer = schedule(flush, intervalMs); timer.unref?.(); }
+        return;
+      }
+      // A question/error/outcome is immediate, after older pending activity.
+      flush();
+      write(retained === true ? formatActivityRecord(record) : detail, record.source, record, retained);
+    },
+    flush,
+    close(turnId) {
+      if ([...pending.values()].some(row => row.record.turnId === turnId)) flush();
+    },
+  };
+}
+
+let feed = null;
+export const compactOutput = () => feed !== null;
+export function configureActivityOutput(mode) {
+  feed?.flush();
+  feed = mode === 'compact' ? createActivityFeed() : null;
+}
+export const flushActivityOutput = () => feed?.flush();
+export const closeActivityTurn = turnId => feed?.close(turnId);
+export function presentTurnRecord(record, detail, retained, write) {
+  if (feed) feed.present(record, detail, retained, write);
+  else write(detail, record.source, record, retained);
+}

package/bin/lib/agentMergeReports.mjs

@@ -0,0 +1,46 @@
+/** Persist an outcome before sending it. Uncertain acknowledgement retries the
+ * receipt, never the Git operation; the original lease instance survives restart. */
+import { join } from 'node:path';
+import { createReportJournal } from './reportJournal.mjs';
+import { fleetRequest } from './fleetPost.mjs';
+import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
+import { FLEET_URL, DAEMON_INSTANCE } from './config.mjs';
+
+export function createMergeReports({ baseDir, delivered = async () => {} }) {
+  const journal = createReportJournal(join(baseDir, 'agent-merge-reports'));
+  const pending = new Map(journal.load().work.filter(([id, held]) =>
+    held?.body?.agentId === id && typeof held.body.ok === 'boolean' && typeof held.body.instance === 'string'));
+  const sending = new Set();
+  const retryAt = new Map();
+  const save = () => journal.save(pending, new Map());
+  const send = async (id) => {
+    if (sending.has(id) || (retryAt.get(id) ?? 0) > Date.now()) return false;
+    const held = pending.get(id);
+    if (!held) return true;
+    sending.add(id);
+    try {
+      const r = await fleetRequest(fleetEndpoint('agent-merge-done', FLEET_URL), { body: held.body });
+      // A parsed receipt includes already-settled/lost-holder results. Auth,
+      // HTML, malformed JSON and deploy skew retain the exact body.
+      if (r.ok && r.json?.success === true && typeof r.json?.data?.settled === 'boolean') {
+        pending.delete(id);
+        retryAt.delete(id);
+        save();
+        await delivered(held, r.json.data.settled);
+        return true;
+      }
+      retryAt.set(id, Date.now() + (r.retryAfterMs ?? (isConsideredRefusal(r.status) ? 60_000 : 1000)));
+      return false;
+    } finally { sending.delete(id); }
+  };
+  return {
+    pending,
+    async report(body, meta = {}) {
+      const id = String(body.agentId);
+      pending.set(id, { body: { ...body, instance: DAEMON_INSTANCE }, ...meta });
+      save();
+      return send(id);
+    },
+    async flush() { for (const id of [...pending.keys()]) await send(id); },
+  };
+}

package/bin/lib/agentMergeResolution.mjs

@@ -0,0 +1,44 @@
+/** Evidence belongs to the failed attempt, so an answer after committing can
+ * verify the same repair without inventing another commit. */
+import { readFileSync, writeFileSync, rmSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { git } from './git.mjs';
+
+const marker = (wt) => resolve(wt, git(['rev-parse', '--git-path', 'flowviant-merge-resolution'], wt));
+const sha = (value) => typeof value === 'string' && /^[a-f0-9]{40,64}$/.test(value);
+
+export function gitReportedConflict(error, wt) {
+  if (/^CONFLICT \(/m.test(`${error?.stdout ?? ''}\n${error?.stderr ?? ''}`)) return true;
+  try {
+    return Boolean(git(['diff', '--name-only', '--diff-filter=U'], wt) || git(['rev-parse', '--verify', 'MERGE_HEAD'], wt));
+  } catch { return false; }
+}
+
+export function clearMergeFailure(wt) {
+  try { rmSync(marker(wt), { force: true }); } catch { /* no marker */ }
+}
+
+export function recordMergeFailure(wt, base, conflict) {
+  try {
+    writeFileSync(marker(wt), JSON.stringify({ before: git(['rev-parse', 'HEAD'], wt), base: git(['rev-parse', base], wt), conflict }));
+  } catch { clearMergeFailure(wt); }
+}
+
+export function measuredMergeResolution(wt, before, base) {
+  let start;
+  try { start = JSON.parse(readFileSync(marker(wt), 'utf8')); }
+  catch (error) {
+    if (error?.code !== 'ENOENT') return false;
+    start = { before, base: (() => { try { return git(['rev-parse', base], wt); } catch { return null; } })(), conflict: true };
+  }
+  if (!sha(start?.before) || !sha(start?.base) || typeof start.conflict !== 'boolean') return false;
+  try {
+    const tip = git(['rev-parse', 'HEAD'], wt);
+    if (start.conflict && tip === start.before) return false;
+    if (git(['status', '--porcelain', '--untracked-files=no'], wt)) return false;
+    if (gitReportedConflict(null, wt)) return false;
+    git(['merge-base', '--is-ancestor', start.before, tip], wt);
+    git(['merge-base', '--is-ancestor', start.base, tip], wt);
+    return true;
+  } catch { return false; }
+}

package/bin/lib/agentPlan.mjs

@@ -48,8 +48,12 @@ function extract(raw) {
 
 export function parseProposal(text, scrub = envScrub) {
   const raw = String(text ?? '');
-  const parsed = extract(raw);
-  if (!parsed) return null;
+  const found = extract(raw);
+  if (!found) return null;
+  // A model says "none" with null as often as with []: both are an absent key,
+  // never a malformed list that throws the whole plan away.
+  const parsed = { ...found };
+  for (const key of ['dependencies', 'collisions', 'evidence', 'repos']) if (parsed[key] === null) delete parsed[key];
 
   const agents = [];
   for (const [i, g] of parsed.agents.slice(0, MAX_AGENTS).entries()) {

package/bin/lib/claudeInput.mjs

@@ -12,7 +12,27 @@
  * for that wave arrives just then (both measured). Only agents hold it: a
  * background shell (a dev server) may never end, and the CLI's own wind-down
  * waits on those. A CLI that never lists tasks closes at its first result. */
-export function createClaudeInput(child, { onTaken = () => {} } = {}) {
+/**
+ * THE CLI'S OWN CONTEXT MEASURE (2026-10-19). `get_context_usage` with
+ * `detail: 'summary'` answers from the last response's usage and local
+ * estimates — no model call and no token-count request (measured offline on
+ * 2.1.303). It names the window, the tokens in it and the native auto-compact
+ * threshold, so `compactAt` is the CLI's, never a guess; an auto-compact that
+ * is off has none (null). A CLI that answers an error, or never answers,
+ * reports nothing: unknown draws nothing (ContextReadout.tsx).
+ */
+export function contextFromUsage(r) {
+  const used = r?.totalTokens;
+  const window = r?.maxTokens;
+  if (!Number.isSafeInteger(used) || used < 0 || !Number.isSafeInteger(window) || window <= 0) return null;
+  const threshold = r.isAutoCompactEnabled === true && Number.isFinite(r.autoCompactThreshold) && r.autoCompactThreshold > 0
+    ? Math.min(1, r.autoCompactThreshold / window)
+    : null;
+  return { usedTokens: used, windowTokens: window, compactAt: threshold, compacting: false };
+}
+const CONTEXT_EVERY_MS = 3_000;
+
+export function createClaudeInput(child, { onTaken = () => {}, onContext = null } = {}) {
   const sent = new Set();
   const pending = new Set();
   let draining = false; // a result found no live agent: admit nothing, close once pending is read
@@ -22,6 +42,31 @@ export function createClaudeInput(child, { onTaken = () => {} } = {}) {
   let agents = 0; // live background agents, as the parent stream last listed them
   child.stdin.on('error', () => { broken = true; }); // EPIPE leaves the message queued
   const end = () => { if (!ended) { ended = true; child.stdin.end(); } };
+  // The context readout's asks: one in flight, at most one per window, and
+  // one more owed when something moved while it was out — at once when what
+  // moved was a compaction ('now'), else on the window ('later').
+  let ctxSeq = 0;
+  let ctxAsked = null;
+  let ctxAt = 0;
+  let ctxOwed = null;
+  let compacting = false;
+  let lastContext = null;
+  const sayContext = (ctx) => {
+    lastContext = ctx;
+    try { onContext(ctx); } catch { /* a readout never fails a turn */ }
+  };
+  const askContext = (now = false) => {
+    if (!onContext || ended || broken || child.stdin.destroyed || child.stdin.writableEnded) return;
+    if (ctxAsked || (!now && Date.now() - ctxAt < CONTEXT_EVERY_MS)) {
+      if (ctxOwed !== 'now') ctxOwed = now ? 'now' : 'later';
+      return;
+    }
+    ctxAsked = `fv-context-${++ctxSeq}`;
+    ctxAt = Date.now();
+    ctxOwed = null;
+    const request = { type: 'control_request', request_id: ctxAsked, request: { subtype: 'get_context_usage', detail: 'summary' } };
+    try { child.stdin.write(JSON.stringify(request) + '\n'); } catch { ctxAsked = null; }
+  };
   const send = (id, prompt) => {
     if (draining || broken || ended || sent.has(id) || child.stdin.destroyed || child.stdin.writableEnded) return false;
     const message = { type: 'user', uuid: id, session_id: '', message: { role: 'user', content: prompt }, parent_tool_use_id: null };
@@ -34,6 +79,21 @@ export function createClaudeInput(child, { onTaken = () => {} } = {}) {
     send,
     event(event) {
       if (event.type === 'user' && event.isReplay === true && pending.delete(event.uuid)) onTaken(event.uuid);
+      if (event.type === 'control_response' && ctxAsked && event.response?.request_id === ctxAsked) {
+        ctxAsked = null;
+        const ctx = event.response.subtype === 'success' ? contextFromUsage(event.response.response) : null;
+        if (ctx) sayContext({ ...ctx, compacting });
+        if (ctxOwed) askContext(ctxOwed === 'now');
+      }
+      if (event.type === 'system' && event.subtype === 'init') askContext(true);
+      if (event.type === 'assistant') askContext();
+      if (event.type === 'system' && event.subtype === 'status') {
+        const now = event.status === 'compacting';
+        if (now && !compacting && lastContext) sayContext({ ...lastContext, compacting: true });
+        if (!now && compacting) askContext(true);
+        compacting = now;
+      }
+      if (event.type === 'system' && event.subtype === 'compact_boundary') { compacting = false; askContext(true); }
       if (event.type === 'system' && event.subtype === 'background_tasks_changed' && Array.isArray(event.tasks)) {
         agents = event.tasks.filter(task => task?.task_type === 'local_agent').length;
         if (agents > 0) draining = false; // a drained message's turn started agents

package/bin/lib/claudePosture.mjs

@@ -478,6 +478,27 @@ export function researchPerm(knowledgeDir, projectMcp = []) {
 /** The list with no library — what a project that keeps none runs under. */
 export const RESEARCH_PERM = researchPerm(null);
 
+/**
+ * AN ORCHESTRATED RESEARCH CARD'S LIST (2026-10-19): the `Agent` its fence
+ * denies is allowed instead, so the gate's children can start. MEASURED on
+ * Claude Code 2.1.303 (offline): a research child inherits the parent's rules
+ * — a Write to `src/` and a `touch` were refused, `/etc/hostname` and `.env`
+ * unreadable, its PreToolUse hooks carried `agent_id` — but its Write under
+ * `.flowviant/artifacts/` landed, so the gate refuses a child's file writes
+ * (orchestrator.mjs, nativeAgentTools.mjs `write`). Every other entry stays.
+ */
+export function withNativeChildren(perm) {
+  const out = [];
+  let denying = false;
+  for (const arg of perm) {
+    if (arg.startsWith('--')) denying = arg === '--disallowedTools';
+    if (denying && arg === 'Agent') continue;
+    out.push(arg);
+    if (arg === '--allowedTools') out.push('Agent');
+  }
+  return out;
+}
+
 /**
  * CLAUDE'S PERMISSION LIST FOR A TURN PROFILE, by the profile's name — one
  * entry per profile Claude declares, plus plan-mode (runtimeClaude.mjs

package/bin/lib/claudeStream.mjs

@@ -79,8 +79,28 @@ export function usageFromResult(ev) {
 // container that reports no spend, which is indistinguishable from an older
 // daemon by design. A callback that is silent when it breaks has to be called
 // directly by something.
+/**
+ * One TaskCreate/TaskUpdate result, applied to a turn's task list (`tasks`, a
+ * Map of id → `{ content, status }` in creation order). True when the list
+ * changed. A task an earlier turn created is not on this turn's list, and an
+ * update to it changes nothing here: its subject was never said.
+ */
+export function taskPlanChanged(tasks, result) {
+  if (!result || typeof result !== 'object') return false;
+  const made = result.task;
+  if (made && typeof made.id === 'string' && typeof made.subject === 'string' && made.subject.trim()) {
+    tasks.set(made.id, { content: made.subject, status: 'pending' });
+    return true;
+  }
+  const to = result.statusChange?.to;
+  if (typeof result.taskId !== 'string' || typeof to !== 'string' || !tasks.has(result.taskId)) return false;
+  if (to === 'deleted') tasks.delete(result.taskId);
+  else tasks.set(result.taskId, { ...tasks.get(result.taskId), status: to });
+  return true;
+}
+
 export function handleStreamLine(line, options) {
-  const { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit, onUsage, onRateLimit, onModel, subagents } = options;
+  const { cwd, emit, onActivity, onToolEvent, appendText, answerFromResult, onInit, onUsage, onRateLimit, onModel, subagents, tasks, onDetail } = options;
   let ev;
   try {
     ev = JSON.parse(line);
@@ -98,9 +118,11 @@ export function handleStreamLine(line, options) {
   // A sidechain with no identity must never be attributed to the parent.
   if (ev.isSidechain && !agentId) return;
   subagents?.observe(ev);
+  if (ev.type === 'result' && !ev.is_error && typeof ev.result === 'string')
+    onDetail?.(ev.result, { source: 'answer', ...(agentId ? { agentId } : {}) });
   const push = (a) => {
     if (!a || !a.label) return;
-    emit(a.label + '\n');
+    emit(a.kind === 'error' ? a.full ?? a.label : a.label + '\n', { ...a, ...(agentId ? { agentId } : {}) });
     onActivity?.({ ...a, ...(agentId ? { agentId } : {}) });
   };
   if (ev.type === 'stream_event') {
@@ -164,11 +186,21 @@ export function handleStreamLine(line, options) {
       }
     }
   } else if (ev.type === 'user' && Array.isArray(ev.message?.content)) {
+    // THE TASK LIST IS THE PLAN NOW (2026-10-19). Claude Code 2.1.303 offers
+    // TaskCreate/TaskUpdate and no TodoWrite (measured: the tools a `-p` turn
+    // is handed), so the plan card — built from TodoWrite — never drew. Each
+    // result says what it did (`tool_use_result`: the created task's id and
+    // subject, or a task's status change), so the turn's own list is kept here
+    // and handed on in TodoWrite's shape, which the card already reads.
+    if (!agentId && tasks && taskPlanChanged(tasks, ev.tool_use_result)) {
+      onToolEvent?.('TodoWrite', { todos: [...tasks.values()] }, { id: 'claude-task-list' });
+    }
     for (const b of ev.message.content) {
       if (b.type === 'tool_result') onToolEvent?.(null, {}, {
         id: b.tool_use_id, result: true, isError: b.is_error === true,
         ...(agentId ? { agentId } : {}),
         output: typeof b.content === 'string' ? b.content : Array.isArray(b.content) ? b.content.slice(0, 8).filter(x => x?.type === 'text' && typeof x.text === 'string').map(x => x.text).join('\n') : '',
+        detail: typeof b.content === 'string' ? b.content : Array.isArray(b.content) ? b.content.filter(x => x?.type === 'text' && typeof x.text === 'string').map(x => x.text).join('\n') : '',
         exitCode: ev.tool_use_result?.exit_code ?? ev.tool_use_result?.exitCode,
       });
     }
@@ -208,6 +240,13 @@ export function handleStreamLine(line, options) {
         tools: Array.isArray(ev.tools) ? ev.tools : undefined,
       });
     }
+  } else if (ev.type === 'result' && agentId && ev.is_error) {
+    // A child's failure belongs in its record, never in the parent's answer
+    // or token count. The stream's observed spawn-call id remains its owner.
+    const listed = Array.isArray(ev.errors) ? ev.errors.filter(e => typeof e === 'string' && e.trim()).join('\n') : '';
+    const msg = listed || ev.result || ev.error?.message || ev.error || ev.subtype;
+    const full = typeof msg === 'string' ? msg : JSON.stringify(msg);
+    if (full) push({ kind: 'error', label: oneLine(full), full });
   } else if (ev.type === 'result' && !agentId) {
     /**
      * WHAT THE TURN SPENT, BEFORE ANYTHING ELSE IN THIS BRANCH.
@@ -222,7 +261,10 @@ export function handleStreamLine(line, options) {
     const usage = usageFromResult(ev);
     if (usage) onUsage?.(usage);
     // The final assistant text (carries WIKI_DONE / REGROUND_DONE).
-    if (typeof ev.result === 'string') appendText(ev.result + '\n');
+    if (typeof ev.result === 'string') {
+      appendText(ev.result + '\n');
+      if (ev.is_error) push({ kind: 'error', label: oneLine(ev.result), full: ev.result });
+    }
     else if (ev.is_error || ev.subtype) {
       // A result that carries no text is a FAILED turn (a limit, a refused
       // permission, an aborted run). Under `answerFromResult` this is the only
@@ -239,7 +281,15 @@ export function handleStreamLine(line, options) {
         ? ev.errors.filter((e) => typeof e === 'string' && e.trim()).join('; ')
         : '';
       const msg = listed || ev.error?.message || ev.error || ev.subtype;
-      appendText(`${typeof msg === 'string' ? msg : JSON.stringify(msg)}\n`);
+      const text = typeof msg === 'string' ? msg : JSON.stringify(msg);
+      appendText(`${text}\n`);
+      if (ev.is_error || listed || ev.error || String(ev.subtype).startsWith('error'))
+        push({ kind: 'error', label: oneLine(text), full: listed ? ev.errors.filter(e => typeof e === 'string' && e.trim()).join('\n') : text });
+    }
+  } else if (ev.type === 'error') {
+    const text = ev.error?.message ?? ev.message;
+    if (typeof text === 'string' && text) {
+      push({ kind: 'error', label: oneLine(text), full: text });
     }
   } else if (ev.type === 'rate_limit_event') {
     /**

package/bin/lib/codexContract.mjs

@@ -0,0 +1,52 @@
+/**
+ * A CODEX TAB'S CONTRACT, SENT WHEN IT IS NEWS (2026-10-19).
+ *
+ * Codex has no system prompt for a resumed `exec`: the tab's contract rode at
+ * the head of EVERY turn's message, so each turn added its ~6 KB to the thread
+ * again — measured offline on 0.163, the third turn's request carried it three
+ * times — and a long tab compacted early, on copies of the same instructions.
+ * `developer_instructions` is no way out: a resumed thread keeps the ones it
+ * started with and ignores a changed value (measured the same way), and the
+ * contract does change (the knowledge and artifact paragraphs).
+ *
+ * So a resumed thread is sent the contract only when it is news: a thread this
+ * marker has not seen, a contract whose text changed, or every
+ * `CONTRACT_RESEND_EVERY`th turn — a bound on what a compaction may have
+ * summarised away. A fresh thread is always sent it. The marker sits beside
+ * the tab's thread marker, scoped by session, owner-only, best-effort: an
+ * unreadable one sends the contract, as before.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+
+export const CODEX_CONTRACT_MARKER = 'flowviant-codex-contract';
+export const CONTRACT_RESEND_EVERY = 8;
+
+const digest = (text) => createHash('sha256').update(String(text ?? '')).digest('hex');
+const read = (path) => {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+};
+
+/** Does the resumed `thread` already hold this `system` text, recently? */
+export function codexContractKnown(path, thread, system) {
+  if (!path || !thread) return false;
+  const m = read(path);
+  return m?.thread === thread && m.hash === digest(system) && Number.isInteger(m.since) && m.since < CONTRACT_RESEND_EVERY;
+}
+
+/** After a turn: what `thread` now holds, and how many turns since it was
+ *  last sent the contract (`sent`: whether this turn carried it). */
+export function recordCodexContract(path, thread, system, sent) {
+  if (!path || !thread) return;
+  const m = sent ? null : read(path);
+  const since = !sent && m?.thread === thread && Number.isInteger(m.since) ? m.since + 1 : 0;
+  try {
+    writeFileSync(path, JSON.stringify({ thread, hash: digest(system), since }), { mode: 0o600 });
+  } catch {
+    /* best-effort: the next turn sends the contract */
+  }
+}