flowviant 0.125.7 → 0.125.12

package/bin/lib/testFindings.mjs

@@ -0,0 +1,60 @@
+/** Tests claims and read-only git receipts. No test or job executes here. */
+import { createHash } from 'node:crypto';
+import { git, gitRaw, gitOrNull } from './git.mjs';
+import { relayedText } from './prWorkflow.mjs';
+
+export function parseTestFindings(value, scrub = s => s) {
+  if (!Array.isArray(value) || value.length > 20) return undefined;
+  const ids = new Set();
+  const findings = [];
+  for (const f of value) {
+    if (!f || typeof f.id !== 'string' || !/^[A-Za-z0-9_-]{1,80}$/.test(f.id) || ids.has(f.id)) return undefined;
+    const fields = { title: 300, details: Infinity, command: Infinity, output: Infinity, expected: Infinity, environment: Infinity };
+    if (Object.entries(fields).some(([k, max]) => typeof f[k] !== 'string' || f[k].length > max) || !f.title.trim() || !f.details.trim()) return undefined;
+    if (f.repository !== null && (typeof f.repository !== 'string' || f.repository.length > 300)) return undefined;
+    if (!Array.isArray(f.files) || f.files.length > 30 || f.files.some(p => typeof p !== 'string' || !p || p.length > 500)) return undefined;
+    ids.add(f.id);
+    findings.push({ id: f.id, ...Object.fromEntries(Object.keys(fields).map(k => [k, scrub(f[k])])), repository: f.repository === null ? null : scrub(f.repository), files: f.files.map(p => scrub(p)) });
+  }
+  return findings;
+}
+
+const safePath = p => !/[\\\x00-\x1f\x7f:]/.test(p) && !p.split('/').some(s => !s || s === '.' || s === '..' || s === '.git');
+const sha256 = s => createHash('sha256').update(s).digest('hex');
+export function measureTestFindings(findings, sources, scrub = s => s) {
+  let remaining = 512 * 1024;
+  return { findings, evidence: findings.map(f => {
+    const source = sources.find(r => f.repository && (r.id === f.repository || r.name === f.repository)) ?? (!f.repository && sources.length === 1 ? sources[0] : null);
+    const r = { findingId: f.id, measuredAt: new Date().toISOString(), repositoryId: source?.id ?? null, repositoryName: source?.name ?? null,
+      remote: source ? scrub(relayedText(gitOrNull(['remote', 'get-url', 'origin'], source.wt))) || null : null,
+      sha: source ? gitOrNull(['rev-parse', '--verify', 'HEAD^{commit}'], source.wt) : null, baseRef: source?.baseRef ?? null,
+      baseSha: source?.baseRef ? gitOrNull(['rev-parse', '--verify', `${source.baseRef}^{commit}`], source.wt) : null,
+      testCommits: null, commitsOnBase: null, patch: null, patchSha256: null, unavailable: null };
+    try {
+      if (!source || !r.sha) throw new Error('The source repository or committed HEAD could not be measured.');
+      if (!f.files.length || f.files.some(p => !safePath(p))) throw new Error('No safe test/fixture paths were reported.');
+      for (const path of f.files) {
+        if (git(['cat-file', '-t', `${r.sha}:${path}`], source.wt) !== 'blob') throw new Error('A reported test/fixture path is not a committed file.');
+      }
+      const commits = f.files.map(path => gitOrNull(['--literal-pathspecs', 'log', '-1', '--format=%H', r.sha, '--', path], source.wt));
+      if (commits.every(Boolean)) r.testCommits = [...new Set(commits)];
+      if (r.testCommits && r.baseSha) {
+        const ancestry = r.testCommits.map(commit => {
+          try { git(['merge-base', '--is-ancestor', commit, r.baseSha], source.wt); return true; }
+          catch (e) { return e.status === 1 ? false : null; }
+        });
+        r.commitsOnBase = ancestry.includes(false) ? false : ancestry.includes(null) ? null : true;
+      }
+      if (git(['--literal-pathspecs', 'status', '--porcelain', '--', ...f.files], source.wt)) throw new Error('A reported test/fixture has uncommitted changes; committed bytes do not establish the reported test.');
+      const empty = git(['hash-object', '-t', 'tree', '--stdin'], source.wt, { input: '' });
+      const bytes = gitRaw(['--literal-pathspecs', 'diff', '--no-color', '--src-prefix=a/', '--dst-prefix=b/', '--no-ext-diff', '--no-textconv', '--full-index', '--binary', empty, r.sha, '--', ...f.files], source.wt, { encoding: 'buffer', maxBuffer: 128 * 1024, timeout: 5000 });
+      const patch = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+      if (!patch || patch.includes('GIT binary patch') || scrub(patch) !== patch || Buffer.byteLength(patch) > remaining) throw new Error('Exact fixture patch unavailable: empty, binary, redacted or larger than the retained evidence limit.');
+      if (gitOrNull(['rev-parse', 'HEAD'], source.wt) !== r.sha) throw new Error('The source HEAD changed while reading fixtures.');
+      r.patch = patch; r.patchSha256 = sha256(patch); remaining -= Buffer.byteLength(patch);
+    } catch (e) {
+      r.unavailable = e.code || e.status !== undefined ? 'Git could not retain the complete test/fixture patch within the evidence limit.' : e.message;
+    }
+    return r;
+  }) };
+}

package/bin/lib/testFindingsContract.mjs

@@ -0,0 +1,2 @@
+export const TESTS_SCOPE = `This is Tests work: add tests and fixtures only; change no production code, even for an unrelated bug. Report discovered bugs for the person to select later; do not repair them or file them as already-fixed raised cards. A failing test alone is not proof of a production bug: explain the evidence and alternative causes. This scope also binds every child and every continuation.`;
+export const TESTS_REPORT = `In the delivered JSON add testFindings, an array (empty when none) of {id,title,details,repository,files,command,output,expected,environment}. Keep id stable for the same finding across deliveries. details states why this appears to be a production bug and what remains uncertain; command/output retain the exact reproduction command and actual failure, never invented output. Name unrun checks and unknown environment facts explicitly. repository is the catalog id/name or null for the sole repository; files lists exact repository-relative committed test/fixture paths needed to reproduce (no production paths). The daemon measures repository identity, HEAD and local base ancestry, and retains those test files as a patch; do not author those measurements. Do not repair a reported bug during Tests work.`;

package/bin/lib/turnDiagnostics.mjs

@@ -12,6 +12,7 @@ import { scrub } from './uplinkScrub.mjs';
 import { printableText } from './printable.mjs';
 import { measuredRuntimeVersion } from './runtimeDetection.mjs';
 import { VERSION } from './config.mjs';
+import { diagnostic } from './daemonLogging.mjs';
 
 let active = 0;
 const authNames = (env) => AUTH_ENV_VARS.filter((name) =>
@@ -42,7 +43,7 @@ export function startTurnDiagnostics(options) {
 }
 
 function createTurnDiagnostics({ runtime, bin, env, cwd = process.cwd(), profile,
-  planId = null, args = [], stdinBytes = 0, version, write = (row) => console.info(`[cli-turn] ${JSON.stringify(row)}`) }) {
+  planId = null, args = [], stdinBytes = 0, version, write = (row) => diagnostic(`[cli-turn] ${JSON.stringify(row)}`) }) {
   const startedAt = Date.now();
   const turnId = randomUUID();
   const executable = executableFor(bin, env, cwd);

package/bin/lib/turnOutput.mjs

@@ -0,0 +1,63 @@
+/** The human output contract for one CLI invocation. Each sink write is a
+ * complete record; no turn leaves a prefix or an unfinished line in the
+ * shared stream. `work` is local attribution, never a new machine event.
+ * Callers supply { kind, name, id, turnId }; the writer also receives the
+ * complete sanitized record as its third argument for subsequent local sinks.
+ * Its fourth argument is retention: true / failed false / unconfigured null.
+ */
+import { randomUUID } from 'node:crypto';
+import { basename } from 'node:path';
+import { format } from 'node:util';
+import { printableLine, printableText } from './printable.mjs';
+import { formatTurnRecord } from './turnRecord.mjs';
+import { retainTurnRecord } from './daemonLogging.mjs';
+import { createLocalDetailScrubber } from './uplinkScrub.mjs';
+import { closeActivityTurn, presentTurnRecord } from './activityFeed.mjs';
+
+const nameOf = (value) => printableLine(printableText(value), 120);
+const idOf = (value) => typeof value === 'string' && value ? printableLine(printableText(value), Infinity) : null;
+
+export function createTurnOutput({ work = {}, label, cwd, runtime = 'claude', mcpEnv }, {
+  now = Date.now,
+  write = (text, source) => (source === 'error' ? process.stderr : process.stdout).write(text),
+} = {}) {
+  // A lane without a server turn (wiki/pre-review/brief) gets a local
+  // invocation id. It is never presented as the CLI's native session id.
+  const redact = createLocalDetailScrubber(mcpEnv);
+  const retain = (text, meta = {}) => retainTurnRecord({ ...identity, ...meta, kind: redact.text(work.kind || (label ? identity.kind : runtime)), name: redact.text(work.name || identity.name),
+    text: printableText(meta.source === 'stderr' ? redact.stderr(text) : redact.text(text)) });
+  const runtimeName = nameOf(runtime) || 'CLI';
+  const turnId = idOf(work.turnId) || randomUUID();
+  const identity = Object.freeze({
+    kind: nameOf(work.kind) || nameOf(printableText(label)) || runtimeName,
+    name: nameOf(work.name) || nameOf(cwd ? basename(cwd) : '') || runtimeName,
+    workId: idOf(work.id) || turnId,
+    turnId,
+  });
+  const emit = (raw, { observedAt = now(), agentId, source = 'activity', full, kind: activityKind } = {}) => {
+    const text = printableText(String(raw));
+    if (!text) return;
+    const child = idOf(agentId);
+    const record = Object.freeze({ ...identity, observedAt, source, text, ...(activityKind ? { activityKind } : {}), ...(child ? { agentId: child } : {}) });
+    const retained = retain(typeof full === 'string' ? full : String(raw), { observedAt, source, ...(child ? { agentId: child } : {}) });
+    presentTurnRecord(record, formatTurnRecord(record, { label }), retained, write);
+  };
+  const tool = (name, input, meta = {}, observedAt = now()) => {
+    try {
+      const heading = meta.result ? `tool result ${meta.id || ''}${meta.isError ? ' (failed)' : ''}${meta.exitCode !== undefined ? ` exit=${meta.exitCode}` : ''}` : `tool call ${name || 'tool'}${meta.id ? ` id=${meta.id}` : ''}`;
+      // Scrub strings before JSON escaping can hide multiline secret values.
+      const value = meta.result ? meta.detail ?? meta.output ?? '' : input;
+      const data = typeof value === 'string' ? value : JSON.stringify(value, (_key, field) => typeof field === 'string' ? redact.text(field) : field, 2);
+      if (meta.result && (meta.isError === true || typeof meta.exitCode === 'number' && meta.exitCode !== 0))
+        emit(data || heading, { observedAt, agentId: meta.agentId, source: 'error' });
+      return retain(heading + '\n' + data, { observedAt, source: meta.result ? 'tool_result' : 'tool_call', ...(meta.agentId ? { agentId: idOf(meta.agentId) } : {}) });
+    } catch { return retain('[tool detail unavailable: could not serialize the supplied data]', { observedAt, source: 'tool_call' }); }
+  };
+  return {
+    identity, emit, tool,
+    event: (text, event = 'lifecycle') => emit(text, { source: event }),
+    close: () => closeActivityTurn(turnId),
+    detail: (text, meta = {}) => retain(text, { observedAt: now(), source: 'activity', ...meta }),
+    error: (error) => emit(format(error), { source: 'error' }),
+  };
+}

package/bin/lib/turnRecord.mjs

@@ -0,0 +1,11 @@
+/** One complete attributable human record. Shared by live output and replay. */
+import { c, stamp } from './ui.mjs';
+import { printableText } from './printable.mjs';
+
+export function formatTurnRecord(record, { label, color = true } = {}) {
+  const { observedAt, kind, name, workId, turnId, agentId, text } = record;
+  const lane = `[${kind}]`;
+  const prefix = `${color ? stamp(observedAt) : printableText(stamp(observedAt))} ${label || (color ? c.cyan(lane) : lane)} ${JSON.stringify(name)} work=${JSON.stringify(workId)} turn=${JSON.stringify(turnId)}${agentId ? ` child=${JSON.stringify(agentId)}` : ''} `;
+  const body = text.endsWith('\n') ? text.slice(0, -1) : text;
+  return body.split('\n').map(line => prefix + line).join('\n') + '\n';
+}

package/bin/lib/turnSubagents.mjs

@@ -23,6 +23,7 @@ import { handleStreamLine } from './claudeStream.mjs';
 import { createClaudeSubagents } from './claudeSubagents.mjs';
 import { createClaudeSubagentProgress } from './claudeSubagentProgress.mjs';
 import { createCodexSubagentReader } from './codexSubagents.mjs';
+import { humanizeClaudeTool } from './runtimeEvents.mjs';
 import { SUBAGENT_CAP } from './subagentBounds.mjs';
 
 /**
@@ -30,7 +31,7 @@ import { SUBAGENT_CAP } from './subagentBounds.mjs';
  * sinks, which a Claude child's transcript rows feed as its stream does.
  */
 export function createTurnSubagents({ runtime, cwd, since, env, owned, onSubagent, onSpawnResult, resumeThreadId,
-  sinks: { emit, onActivity, onToolEvent, appendText } }) {
+  sinks: { emit, onActivity, onToolEvent, appendText, onDetail } }) {
   // An orchestrator bounds its own records and settles them at close
   // (orchestrator.mjs). Counted here by stream id, refused retries used up
   // the 32 and later children's updates were dropped; the exit sweep
@@ -48,11 +49,20 @@ export function createTurnSubagents({ runtime, cwd, since, env, owned, onSubagen
   const claudeProgress = runtime === 'claude' && onSubagent ? createClaudeSubagentProgress({
     cwd, since, env,
     onLine: line => handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText,
-      answerFromResult: true, subagents }),
+      answerFromResult: true, subagents, onDetail }),
   }) : null;
   const codexAgents = runtime === 'codex' && onSubagent ? createCodexSubagentReader({
     since, env,
-    onSubagent: reportSubagent, onActivity, onToolEvent,
+    onSubagent: reportSubagent,
+    onActivity: (activity) => {
+      emit(activity.kind === 'error' ? activity.full ?? activity.label : activity.label + '\n', activity);
+      onActivity?.(activity);
+    },
+    onToolEvent: (name, input, meta) => {
+      const activity = humanizeClaudeTool(name, input, cwd);
+      if (activity && !meta?.result) emit(activity.label + '\n', { ...activity, ...meta });
+      onToolEvent?.(name, input, meta);
+    },
     onSpawnResult,
   }) : null;
   const resumed = runtime === 'codex' && typeof resumeThreadId === 'string' ? resumeThreadId : null;

package/bin/lib/ui.mjs

@@ -9,8 +9,8 @@ export const c = {
   blue: wrap(34), magenta: wrap(35), cyan: wrap(36), gray: wrap(90),
 };
 
-const stamp = () => {
-  const d = new Date();
+export const stamp = (observedAt = Date.now()) => {
+  const d = new Date(observedAt);
   const p = (n) => String(n).padStart(2, '0');
   return c.gray(`${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`);
 };

package/bin/lib/uplinkScrub.mjs

@@ -528,3 +528,52 @@ export function secretIn(bytes) {
   }
   return null;
 }
+
+/** Local diagnostic retention has the same learned values and token shapes.
+ * A supplied per-turn MCP/login credential is known directly, even before an
+ * env rescan. stderr arrives as complete physical lines, so keep PEM masking
+ * state and mask the lines of learned multiline secrets too. This does not
+ * change uplink scrubbing or the CLI's foreground output.
+ */
+export function createLocalDetailScrubber(extraEnv = {}) {
+  const extras = Object.entries(extraEnv).filter(([name, value]) =>
+    /(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|AUTH|CAPABILITY)(?:_|$)/i.test(name) && typeof value === 'string' && value);
+  const text = raw => {
+    let out = scrub(String(raw ?? ''));
+    const known = [...values.map(v => [v.name, v.value]), ...extras].sort((a, b) => b[1].length - a[1].length);
+    for (const [name, value] of known) {
+      const pieces = value.includes('\n') ? [value, ...value.split(/\r?\n/).filter(Boolean)] : [value];
+      for (const piece of pieces) out = out.split(piece).join(`[REDACTED:${name}]`);
+    }
+    return out;
+  };
+  let privateKey = false;
+  return {
+    text,
+    stderr(raw) {
+      const value = String(raw), trailing = value.endsWith('\n');
+      const lines = value.split('\n');
+      if (trailing) lines.pop();
+      return lines.map(line => {
+        PEM_BEGIN_RE.lastIndex = 0;
+        const begin = PEM_BEGIN_RE.exec(line);
+        PEM_END_RE.lastIndex = begin ? begin.index + begin[0].length : 0;
+        const end = PEM_END_RE.exec(line);
+        if (privateKey || begin) {
+          const prefix = privateKey ? '' : line.slice(0, begin.index);
+          privateKey = !end;
+          return text(prefix + '[REDACTED:PRIVATE_KEY]' + (end ? line.slice(end.index + end[0].length) : ''));
+        }
+        return text(line);
+      }).join('\n') + (trailing ? '\n' : '');
+    },
+  };
+}
+
+/** Durable handoff fields share the portable server filter (parity checked). */
+export function filterResearchText(text) {
+  return text
+    .replace(/(\bBearer\s+)[A-Za-z0-9._~+\/-]+=*/gi, '$1[REDACTED:credential]')
+    .replace(/(["']?(?:[A-Za-z0-9_]*(?:api[_-]?key|token|secret|password|passwd|credential)|authorization)["']?\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;\n}]+)/gi, '$1[REDACTED:credential]')
+    .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gi, '$1[REDACTED:credential]@');
+}

package/bin/lib/views.mjs

@@ -8,8 +8,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { closeSync, existsSync, openSync, readSync, statSync } from 'node:fs';
-import { StringDecoder } from 'node:string_decoder';
+import { statSync } from 'node:fs';
 import { APP_URL, FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
 import { detectRepoRoot, listStoredProjects, projectLabel, resolveStoredCredential } from './credentials.mjs';
 import { desktopStatusRemote, installChannel } from './desktopContract.mjs';
@@ -17,9 +16,11 @@ import { daemonLogPath } from './daemonState.mjs';
 import { git as runGit } from './git.mjs';
 import { daemonRunningFor } from './instance.mjs';
 import { agoFrom } from './machineListing.mjs';
-import { printable, printableText } from './printable.mjs';
+import { printable, printableLine, printableText } from './printable.mjs';
 import { detectRuntimes } from './runtimeDetection.mjs';
 import { c } from './ui.mjs';
+import { createLogReader } from './logReplay.mjs';
+import { scrub } from './uplinkScrub.mjs';
 import { versionBelow } from './versionOrder.mjs';
 
 // "Behind" in these views is versionBelow (versionOrder.mjs): an unreadable
@@ -101,67 +102,57 @@ export function resolveProjectForView(argv = process.argv, cwd = process.cwd())
   };
 }
 
-/**
- * The last `count` lines of a file, read from its end — PRINTABLE (2026-10-10,
- * the audit's F133). A daemon before this release logged member-written card
- * titles raw, so a replay could carry an OSC 52 into whichever terminal runs
- * `flowviant logs`. `printableText` keeps the lines' shape; a log written on a
- * TTY loses its colours with everything else.
- */
+/** Compatibility readout over the same retained-history reader as logs -f. */
 export function tailLines(path, count) {
-  const size = statSync(path).size;
-  const want = Math.min(size, 256 * 1024);
-  const buf = Buffer.alloc(want);
-  const fd = openSync(path, 'r');
-  try { readSync(fd, buf, 0, want, size - want); } finally { closeSync(fd); }
-  const lines = printableText(buf.toString('utf8')).split('\n');
-  if (lines.at(-1) === '') lines.pop();
-  if (want < size) lines.shift(); // the first line is cut mid-way
-  return { text: lines.slice(-count).join('\n'), size };
+  const reader = createLogReader(path);
+  try { return { text: reader.snapshot(count).text, size: statSync(path).size }; }
+  finally { reader.close(); }
 }
 
-/**
- * What `logs -f` prints of each new chunk: decoded as a STREAM, because a read
- * can end inside a multi-byte character, and scrubbed like the tail. A sequence
- * split across two reads loses its ESC in the first and its terminator in the
- * second, so what is left of it is plain text.
- */
-export function createLogFollower() {
-  const decoder = new StringDecoder('utf8');
-  return (buf) => printableText(decoder.write(buf));
-}
-
-export async function runLogs(argv = process.argv) {
-  const which = resolveProjectForView(argv);
-  if (!which.entry) { console.error(which.message); process.exit(1); }
-  const path = daemonLogPath(which.entry.projectId);
+export async function runLogs(argv = process.argv, {
+  resolveProject = resolveProjectForView, pathFor = daemonLogPath,
+  write = text => process.stdout.write(text), say = text => console.error(text),
+  signal, intervalMs = 500,
+} = {}) {
+  const atTurn = argv.indexOf('--turn');
+  const turnId = atTurn >= 0 ? argv[atTurn + 1] : argv.find(a => a.startsWith('--turn='))?.slice(7) ?? null;
+  if (turnId !== null && (!turnId || turnId.startsWith('-'))) {
+    say('error: --turn needs the exact turn id printed in an activity line');
+    process.exitCode = 1; return;
+  }
+  const which = resolveProject(argv);
+  if (!which.entry) { say(which.message); process.exitCode = 1; return; }
+  const path = pathFor(which.entry.projectId);
   const at = argv.indexOf('-n');
-  const count = at >= 0 && Number(argv[at + 1]) > 0 ? Math.floor(Number(argv[at + 1])) : 80;
+  const count = at >= 0 && Number.isFinite(Number(argv[at + 1])) && Number(argv[at + 1]) > 0 ? Math.max(1, Math.floor(Number(argv[at + 1]))) : 80;
   const follow = argv.includes('-f') || argv.includes('--follow');
-  if (!existsSync(path)) {
-    console.log(`No log yet for ${projectLabel(which.entry)}. It starts when the daemon first runs: ${c.cyan('flowviant')} in its repo.`);
+  const reader = createLogReader(path, { turnId });
+  try {
+    const snapshot = reader.snapshot(count);
+    if (snapshot.text) write(snapshot.text + '\n');
+    if (!follow && snapshot.pending) say('An unfinished trailing log record was not replayed.');
+    if (snapshot.omitted) say(`Showing the last ${count} retained lines; earlier retained lines were omitted.`);
+    if (turnId !== null) {
+      if (!snapshot.matched) say(`No retained detail for turn ${printableLine(scrub(turnId), 200)}. It may have expired or predate local detail recording.${follow ? ' Waiting for new detail.' : ''}`);
+      else say('Local detail retains at most two 2 MiB files; older detail may have expired.');
+    } else if (!snapshot.found) {
+      say(`No log yet for ${projectLabel(which.entry)}. It starts when the daemon first runs: flowviant in its repo.`);
+    }
     if (!follow) return;
-  } else {
-    const { text } = tailLines(path, count);
-    if (text) console.log(text);
-  }
-  if (!follow) return;
-  // Poll rather than fs.watch: the daemon rotates the file (a rename), and a
-  // watch on the old inode would go quiet exactly then.
-  let offset = existsSync(path) ? statSync(path).size : 0;
-  const followed = createLogFollower();
-  for (;;) {
-    await new Promise((resolve) => setTimeout(resolve, 500));
-    if (!existsSync(path)) continue;
-    const size = statSync(path).size;
-    if (size < offset) offset = 0; // rotated
-    if (size === offset) continue;
-    const buf = Buffer.alloc(size - offset);
-    const fd = openSync(path, 'r');
-    try { readSync(fd, buf, 0, buf.length, offset); } finally { closeSync(fd); }
-    process.stdout.write(followed(buf));
-    offset = size;
-  }
+    while (!signal?.aborted) {
+      await new Promise(resolve => {
+        const done = () => { clearTimeout(timer); signal?.removeEventListener('abort', done); resolve(); };
+        const timer = setTimeout(done, intervalMs);
+        signal?.addEventListener('abort', done, { once: true });
+      });
+      if (signal?.aborted) break;
+      const next = reader.poll();
+      if (next.text) write(next.text);
+    }
+  } catch (error) {
+    say(`Could not read the local log (${printableText(String(error?.code || 'read failed'))}).`);
+    process.exitCode = 1;
+  } finally { reader.close(); }
 }
 
 /** The command that opens a URL in this computer's browser. Inside WSL that is

package/bin/lib/wikiRunner.mjs

@@ -442,7 +442,7 @@ export function createWikiRunner({
               profile: 'wiki',
               vaultDir,
               runtime: wikiRt,
-              label: c.cyan('[wiki]'),
+              work: { kind: 'wiki', id: vaultDir, name: 'Wiki sweep' },
               // No skills or connectors are harvested off a wiki turn: it is
               // fenced (no settings source, strict MCP), so its init names less
               // than the machine has (runTurn.mjs, `initHarvestFor`).
@@ -492,7 +492,7 @@ export function createWikiRunner({
                 profile: 'wiki',
                 vaultDir,
                 runtime: wikiRt,
-                label: c.cyan('[wiki]'),
+                work: { kind: 'wiki', id: vaultDir, name: task.title },
                 onActivity,
                 onUsage: onUsage(wikiRt),
                 onSpawn: (ch) => {

package/bin/lib/work.mjs

@@ -27,7 +27,6 @@
  * whole — `workBusy` and the returned surface. A pure rule or constant
  * (REPO_PLACE, the resume-id guards, brainFor, the turn lock) is IMPORTED by
  * every lane that reads it, never carried through here.
- *
  *   workPlaces.mjs         where a session works, its worktree, its markers
  *   workSessionGroups.mjs  which process groups each tab started
  *   workChildren.mjs       the live CLI children, teardown, the admission
@@ -36,7 +35,7 @@
  *   workArtifactReconcile.mjs an idle agent's stored delivery against its worktree
  *   workReportQueue.mjs    every settle, held and retried until delivered
  *   workSessionTokens.mjs  the per-session work credential
- *   workNarration.mjs      the tab's live line and the deferral sentence
+ *   workNarration.mjs      the tab's live line; workActivity.mjs — local outcomes and destinations
  *   workAttachments.mjs    files the human attached, brought to disk (tabs and agents)
  *   workSessionRuntime.mjs which CLI a tab speaks, which conversation resumes
  *   workAdoptCarry.mjs     adoption's dirty carry
@@ -48,6 +47,7 @@
  *   workCommandAudit.mjs   one turn's `$ …` audit, batched to the server
  *   workBrain.mjs          the model and effort a turn may put on argv (pure)
  *   workIntake.mjs         one incoming ticket drafted into a card, read-only (2026-09-28)
+ *   workPlanRecovery.mjs  read-only diagnosis and attempt cancellation
  *   workCappedTurn.mjs     one capped read-only consult turn: its child, its slot,
  *                          its cap and its transcript — the planner, the pre-review
  *                          and intake all run one (2026-10-10)

package/bin/lib/workActivity.mjs

@@ -0,0 +1,65 @@
+/** Local lifecycle presentation. Inputs are the lane's validated settlement,
+ * never a phrase guessed from narration or a successful process exit.
+ */
+import { APP_URL, PROJECT_ID } from './config.mjs';
+import { createTurnOutput } from './turnOutput.mjs';
+
+export const agentWork = job => ({ kind: 'agent', id: job.agentId,
+  name: job.task?.title || job.agentName || job.agentId, turnId: job.id });
+export const sessionWork = job => ({ kind: 'tab', id: job.sessionId,
+  name: job.sessionName || job.sessionId, turnId: job.id });
+export const planWork = job => ({ kind: 'plan', id: job.id,
+  name: (Array.isArray(job.tasks) ? job.tasks : []).map(task => task?.title).filter(Boolean).join(' · ') || 'Planning', turnId: job.id });
+
+export function workDestination(work, { projectId = PROJECT_ID, appUrl = APP_URL, taskId } = {}) {
+  const safe = id => typeof id === 'string' && id && id !== '.' && id !== '..';
+  if (!safe(projectId) || !safe(work.id)) return null;
+  const base = `${appUrl}/projects/${encodeURIComponent(projectId)}`;
+  if (work.kind === 'agent') return `${base}/v2/agents/${encodeURIComponent(work.id)}${safe(taskId) ? `?${new URLSearchParams({ task: taskId })}` : ''}`;
+  if (work.kind === 'tab') return `${base}/v2/terminal?${new URLSearchParams({ tab: work.id })}`;
+  return `${base}/board`;
+}
+
+export function reportWorkOutcome(work, body, destination = workDestination(work)) {
+  const output = createTurnOutput({ work });
+  let text;
+  if (body.interrupted) text = 'Interrupted';
+  else if (body.outcome === 'question') text = `Needs input in Flowviant\n${body.answer || ''}`;
+  else if (body.outcome === 'delivered') text = 'Delivered for review';
+  else if (body.outcome === 'replied') text = 'Replied in the session';
+  else if (body.outcome === 'drafted') text = 'Ticket draft ready for review';
+  else if (body.outcome === 'proposed') text = 'Plan ready for review';
+  else if (body.outcome === 'merged') text = 'Merged on the base branch';
+  else text = `Failed\n${body.answer || 'The turn returned no outcome.'}`;
+  if (destination) text += `\n${body.outcome === 'question' ? 'Answer in Flowviant: ' : ''}${destination}`;
+  output.event(text, body.outcome === 'question' ? 'question' : 'outcome');
+  output.close();
+}
+
+/** Recovery settlements describe the retained operation, rather than a new
+ * review decision. The caller emits this once, before retrying its receipt. */
+export function reportPlanOutcome(job, body) {
+  const work = planWork(job);
+  if (body.question) return reportWorkOutcome(work, { outcome: 'question',
+    answer: [body.question.question, body.question.context].filter(Boolean).join('\n\n') });
+  if (job.recovery?.start && body.proposal) {
+    const output = createTurnOutput({ work });
+    output.event('Start diagnosis complete; continuing the approved Start', 'outcome');
+    output.close();
+    return;
+  }
+  reportWorkOutcome(work, { outcome: body.proposal ? 'proposed' : 'nothing', answer: body.error });
+}
+
+export function reportAgentOutcome(job, body) {
+  const work = agentWork(job);
+  if (job.kind === 'merge_resolve' && body.outcome === 'delivered') {
+    const output = createTurnOutput({ work });
+    output.event(body.mergeResolved === true
+      ? 'Merge repair verified; continuing the approved Merge'
+      : 'Merge repair returned; verification is still needed', 'outcome');
+    output.close();
+    return;
+  }
+  reportWorkOutcome(work, body, workDestination(work, { taskId: job.task?.id }));
+}

package/bin/lib/workAgentBriefRunner.mjs

@@ -14,7 +14,7 @@ import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
 import { scrub } from './uplinkScrub.mjs';
 
 export function createAgentBriefRunner({ admit, workChildren, run = runTurn, request = fleetRequest }) {
-  return ({ agentId, turnId, runtime, model }) => {
+  return ({ agentId, turnId, workName, runtime, model }) => {
     const identity = { agentId, turnId, instance: DAEMON_INSTANCE };
     return makeAgentBrief({ runtime, model, scrub, models: knownCodexModels,
       context: async (signal) => {
@@ -46,7 +46,7 @@ export function createAgentBriefRunner({ admit, workChildren, run = runTurn, req
           cwd = mkdtempSync(join(tmpdir(), 'flowviant-brief-'));
           const result = await runCappedTurn({ runTurn: run, workChildren, releaseSlot, signal,
             capMs: 60_000, transcriptCwd: cwd,
-            turnArgs: { ...turnArgs, cwd, profile: 'consult', answerFromResult: true, label: '[brief]',
+            turnArgs: { ...turnArgs, cwd, profile: 'consult', answerFromResult: true, work: { kind: 'brief', id: agentId, name: workName || 'Work brief' },
               onUsage: (u) => { usage = { ...u, runtime: turnArgs.runtime }; } } });
           return result.wedged ? '' : { out: result.out, usage };
         } finally {