flowviant 0.125.7 → 0.125.9

package/bin/lib/turnOutput.mjs

@@ -0,0 +1,63 @@
+/** The human output contract for one CLI invocation. Each sink write is a
+ * complete record; no turn leaves a prefix or an unfinished line in the
+ * shared stream. `work` is local attribution, never a new machine event.
+ * Callers supply { kind, name, id, turnId }; the writer also receives the
+ * complete sanitized record as its third argument for subsequent local sinks.
+ * Its fourth argument is retention: true / failed false / unconfigured null.
+ */
+import { randomUUID } from 'node:crypto';
+import { basename } from 'node:path';
+import { format } from 'node:util';
+import { printableLine, printableText } from './printable.mjs';
+import { formatTurnRecord } from './turnRecord.mjs';
+import { retainTurnRecord } from './daemonLogging.mjs';
+import { createLocalDetailScrubber } from './uplinkScrub.mjs';
+import { closeActivityTurn, presentTurnRecord } from './activityFeed.mjs';
+
+const nameOf = (value) => printableLine(printableText(value), 120);
+const idOf = (value) => typeof value === 'string' && value ? printableLine(printableText(value), Infinity) : null;
+
+export function createTurnOutput({ work = {}, label, cwd, runtime = 'claude', mcpEnv }, {
+  now = Date.now,
+  write = (text, source) => (source === 'error' ? process.stderr : process.stdout).write(text),
+} = {}) {
+  // A lane without a server turn (wiki/pre-review/brief) gets a local
+  // invocation id. It is never presented as the CLI's native session id.
+  const redact = createLocalDetailScrubber(mcpEnv);
+  const retain = (text, meta = {}) => retainTurnRecord({ ...identity, ...meta, kind: redact.text(work.kind || (label ? identity.kind : runtime)), name: redact.text(work.name || identity.name),
+    text: printableText(meta.source === 'stderr' ? redact.stderr(text) : redact.text(text)) });
+  const runtimeName = nameOf(runtime) || 'CLI';
+  const turnId = idOf(work.turnId) || randomUUID();
+  const identity = Object.freeze({
+    kind: nameOf(work.kind) || nameOf(printableText(label)) || runtimeName,
+    name: nameOf(work.name) || nameOf(cwd ? basename(cwd) : '') || runtimeName,
+    workId: idOf(work.id) || turnId,
+    turnId,
+  });
+  const emit = (raw, { observedAt = now(), agentId, source = 'activity', full, kind: activityKind } = {}) => {
+    const text = printableText(String(raw));
+    if (!text) return;
+    const child = idOf(agentId);
+    const record = Object.freeze({ ...identity, observedAt, source, text, ...(activityKind ? { activityKind } : {}), ...(child ? { agentId: child } : {}) });
+    const retained = retain(typeof full === 'string' ? full : String(raw), { observedAt, source, ...(child ? { agentId: child } : {}) });
+    presentTurnRecord(record, formatTurnRecord(record, { label }), retained, write);
+  };
+  const tool = (name, input, meta = {}, observedAt = now()) => {
+    try {
+      const heading = meta.result ? `tool result ${meta.id || ''}${meta.isError ? ' (failed)' : ''}${meta.exitCode !== undefined ? ` exit=${meta.exitCode}` : ''}` : `tool call ${name || 'tool'}${meta.id ? ` id=${meta.id}` : ''}`;
+      // Scrub strings before JSON escaping can hide multiline secret values.
+      const value = meta.result ? meta.detail ?? meta.output ?? '' : input;
+      const data = typeof value === 'string' ? value : JSON.stringify(value, (_key, field) => typeof field === 'string' ? redact.text(field) : field, 2);
+      if (meta.result && (meta.isError === true || typeof meta.exitCode === 'number' && meta.exitCode !== 0))
+        emit(data || heading, { observedAt, agentId: meta.agentId, source: 'error' });
+      return retain(heading + '\n' + data, { observedAt, source: meta.result ? 'tool_result' : 'tool_call', ...(meta.agentId ? { agentId: idOf(meta.agentId) } : {}) });
+    } catch { return retain('[tool detail unavailable: could not serialize the supplied data]', { observedAt, source: 'tool_call' }); }
+  };
+  return {
+    identity, emit, tool,
+    event: (text, event = 'lifecycle') => emit(text, { source: event }),
+    close: () => closeActivityTurn(turnId),
+    detail: (text, meta = {}) => retain(text, { observedAt: now(), source: 'activity', ...meta }),
+    error: (error) => emit(format(error), { source: 'error' }),
+  };
+}

package/bin/lib/turnRecord.mjs

@@ -0,0 +1,11 @@
+/** One complete attributable human record. Shared by live output and replay. */
+import { c, stamp } from './ui.mjs';
+import { printableText } from './printable.mjs';
+
+export function formatTurnRecord(record, { label, color = true } = {}) {
+  const { observedAt, kind, name, workId, turnId, agentId, text } = record;
+  const lane = `[${kind}]`;
+  const prefix = `${color ? stamp(observedAt) : printableText(stamp(observedAt))} ${label || (color ? c.cyan(lane) : lane)} ${JSON.stringify(name)} work=${JSON.stringify(workId)} turn=${JSON.stringify(turnId)}${agentId ? ` child=${JSON.stringify(agentId)}` : ''} `;
+  const body = text.endsWith('\n') ? text.slice(0, -1) : text;
+  return body.split('\n').map(line => prefix + line).join('\n') + '\n';
+}

package/bin/lib/turnSubagents.mjs

@@ -23,6 +23,7 @@ import { handleStreamLine } from './claudeStream.mjs';
 import { createClaudeSubagents } from './claudeSubagents.mjs';
 import { createClaudeSubagentProgress } from './claudeSubagentProgress.mjs';
 import { createCodexSubagentReader } from './codexSubagents.mjs';
+import { humanizeClaudeTool } from './runtimeEvents.mjs';
 import { SUBAGENT_CAP } from './subagentBounds.mjs';
 
 /**
@@ -30,7 +31,7 @@ import { SUBAGENT_CAP } from './subagentBounds.mjs';
  * sinks, which a Claude child's transcript rows feed as its stream does.
  */
 export function createTurnSubagents({ runtime, cwd, since, env, owned, onSubagent, onSpawnResult, resumeThreadId,
-  sinks: { emit, onActivity, onToolEvent, appendText } }) {
+  sinks: { emit, onActivity, onToolEvent, appendText, onDetail } }) {
   // An orchestrator bounds its own records and settles them at close
   // (orchestrator.mjs). Counted here by stream id, refused retries used up
   // the 32 and later children's updates were dropped; the exit sweep
@@ -48,11 +49,20 @@ export function createTurnSubagents({ runtime, cwd, since, env, owned, onSubagen
   const claudeProgress = runtime === 'claude' && onSubagent ? createClaudeSubagentProgress({
     cwd, since, env,
     onLine: line => handleStreamLine(line, { cwd, emit, onActivity, onToolEvent, appendText,
-      answerFromResult: true, subagents }),
+      answerFromResult: true, subagents, onDetail }),
   }) : null;
   const codexAgents = runtime === 'codex' && onSubagent ? createCodexSubagentReader({
     since, env,
-    onSubagent: reportSubagent, onActivity, onToolEvent,
+    onSubagent: reportSubagent,
+    onActivity: (activity) => {
+      emit(activity.kind === 'error' ? activity.full ?? activity.label : activity.label + '\n', activity);
+      onActivity?.(activity);
+    },
+    onToolEvent: (name, input, meta) => {
+      const activity = humanizeClaudeTool(name, input, cwd);
+      if (activity && !meta?.result) emit(activity.label + '\n', { ...activity, ...meta });
+      onToolEvent?.(name, input, meta);
+    },
     onSpawnResult,
   }) : null;
   const resumed = runtime === 'codex' && typeof resumeThreadId === 'string' ? resumeThreadId : null;

package/bin/lib/ui.mjs

@@ -9,8 +9,8 @@ export const c = {
   blue: wrap(34), magenta: wrap(35), cyan: wrap(36), gray: wrap(90),
 };
 
-const stamp = () => {
-  const d = new Date();
+export const stamp = (observedAt = Date.now()) => {
+  const d = new Date(observedAt);
   const p = (n) => String(n).padStart(2, '0');
   return c.gray(`${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`);
 };

package/bin/lib/uplinkScrub.mjs

@@ -528,3 +528,52 @@ export function secretIn(bytes) {
   }
   return null;
 }
+
+/** Local diagnostic retention has the same learned values and token shapes.
+ * A supplied per-turn MCP/login credential is known directly, even before an
+ * env rescan. stderr arrives as complete physical lines, so keep PEM masking
+ * state and mask the lines of learned multiline secrets too. This does not
+ * change uplink scrubbing or the CLI's foreground output.
+ */
+export function createLocalDetailScrubber(extraEnv = {}) {
+  const extras = Object.entries(extraEnv).filter(([name, value]) =>
+    /(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|AUTH|CAPABILITY)(?:_|$)/i.test(name) && typeof value === 'string' && value);
+  const text = raw => {
+    let out = scrub(String(raw ?? ''));
+    const known = [...values.map(v => [v.name, v.value]), ...extras].sort((a, b) => b[1].length - a[1].length);
+    for (const [name, value] of known) {
+      const pieces = value.includes('\n') ? [value, ...value.split(/\r?\n/).filter(Boolean)] : [value];
+      for (const piece of pieces) out = out.split(piece).join(`[REDACTED:${name}]`);
+    }
+    return out;
+  };
+  let privateKey = false;
+  return {
+    text,
+    stderr(raw) {
+      const value = String(raw), trailing = value.endsWith('\n');
+      const lines = value.split('\n');
+      if (trailing) lines.pop();
+      return lines.map(line => {
+        PEM_BEGIN_RE.lastIndex = 0;
+        const begin = PEM_BEGIN_RE.exec(line);
+        PEM_END_RE.lastIndex = begin ? begin.index + begin[0].length : 0;
+        const end = PEM_END_RE.exec(line);
+        if (privateKey || begin) {
+          const prefix = privateKey ? '' : line.slice(0, begin.index);
+          privateKey = !end;
+          return text(prefix + '[REDACTED:PRIVATE_KEY]' + (end ? line.slice(end.index + end[0].length) : ''));
+        }
+        return text(line);
+      }).join('\n') + (trailing ? '\n' : '');
+    },
+  };
+}
+
+/** Durable handoff fields share the portable server filter (parity checked). */
+export function filterResearchText(text) {
+  return text
+    .replace(/(\bBearer\s+)[A-Za-z0-9._~+\/-]+=*/gi, '$1[REDACTED:credential]')
+    .replace(/(["']?(?:[A-Za-z0-9_]*(?:api[_-]?key|token|secret|password|passwd|credential)|authorization)["']?\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;\n}]+)/gi, '$1[REDACTED:credential]')
+    .replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/gi, '$1[REDACTED:credential]@');
+}

package/bin/lib/views.mjs

@@ -8,8 +8,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { closeSync, existsSync, openSync, readSync, statSync } from 'node:fs';
-import { StringDecoder } from 'node:string_decoder';
+import { statSync } from 'node:fs';
 import { APP_URL, FLEET_URL, USER_AGENT, VERSION } from './config.mjs';
 import { detectRepoRoot, listStoredProjects, projectLabel, resolveStoredCredential } from './credentials.mjs';
 import { desktopStatusRemote, installChannel } from './desktopContract.mjs';
@@ -17,9 +16,11 @@ import { daemonLogPath } from './daemonState.mjs';
 import { git as runGit } from './git.mjs';
 import { daemonRunningFor } from './instance.mjs';
 import { agoFrom } from './machineListing.mjs';
-import { printable, printableText } from './printable.mjs';
+import { printable, printableLine, printableText } from './printable.mjs';
 import { detectRuntimes } from './runtimeDetection.mjs';
 import { c } from './ui.mjs';
+import { createLogReader } from './logReplay.mjs';
+import { scrub } from './uplinkScrub.mjs';
 import { versionBelow } from './versionOrder.mjs';
 
 // "Behind" in these views is versionBelow (versionOrder.mjs): an unreadable
@@ -101,67 +102,57 @@ export function resolveProjectForView(argv = process.argv, cwd = process.cwd())
   };
 }
 
-/**
- * The last `count` lines of a file, read from its end — PRINTABLE (2026-10-10,
- * the audit's F133). A daemon before this release logged member-written card
- * titles raw, so a replay could carry an OSC 52 into whichever terminal runs
- * `flowviant logs`. `printableText` keeps the lines' shape; a log written on a
- * TTY loses its colours with everything else.
- */
+/** Compatibility readout over the same retained-history reader as logs -f. */
 export function tailLines(path, count) {
-  const size = statSync(path).size;
-  const want = Math.min(size, 256 * 1024);
-  const buf = Buffer.alloc(want);
-  const fd = openSync(path, 'r');
-  try { readSync(fd, buf, 0, want, size - want); } finally { closeSync(fd); }
-  const lines = printableText(buf.toString('utf8')).split('\n');
-  if (lines.at(-1) === '') lines.pop();
-  if (want < size) lines.shift(); // the first line is cut mid-way
-  return { text: lines.slice(-count).join('\n'), size };
+  const reader = createLogReader(path);
+  try { return { text: reader.snapshot(count).text, size: statSync(path).size }; }
+  finally { reader.close(); }
 }
 
-/**
- * What `logs -f` prints of each new chunk: decoded as a STREAM, because a read
- * can end inside a multi-byte character, and scrubbed like the tail. A sequence
- * split across two reads loses its ESC in the first and its terminator in the
- * second, so what is left of it is plain text.
- */
-export function createLogFollower() {
-  const decoder = new StringDecoder('utf8');
-  return (buf) => printableText(decoder.write(buf));
-}
-
-export async function runLogs(argv = process.argv) {
-  const which = resolveProjectForView(argv);
-  if (!which.entry) { console.error(which.message); process.exit(1); }
-  const path = daemonLogPath(which.entry.projectId);
+export async function runLogs(argv = process.argv, {
+  resolveProject = resolveProjectForView, pathFor = daemonLogPath,
+  write = text => process.stdout.write(text), say = text => console.error(text),
+  signal, intervalMs = 500,
+} = {}) {
+  const atTurn = argv.indexOf('--turn');
+  const turnId = atTurn >= 0 ? argv[atTurn + 1] : argv.find(a => a.startsWith('--turn='))?.slice(7) ?? null;
+  if (turnId !== null && (!turnId || turnId.startsWith('-'))) {
+    say('error: --turn needs the exact turn id printed in an activity line');
+    process.exitCode = 1; return;
+  }
+  const which = resolveProject(argv);
+  if (!which.entry) { say(which.message); process.exitCode = 1; return; }
+  const path = pathFor(which.entry.projectId);
   const at = argv.indexOf('-n');
-  const count = at >= 0 && Number(argv[at + 1]) > 0 ? Math.floor(Number(argv[at + 1])) : 80;
+  const count = at >= 0 && Number.isFinite(Number(argv[at + 1])) && Number(argv[at + 1]) > 0 ? Math.max(1, Math.floor(Number(argv[at + 1]))) : 80;
   const follow = argv.includes('-f') || argv.includes('--follow');
-  if (!existsSync(path)) {
-    console.log(`No log yet for ${projectLabel(which.entry)}. It starts when the daemon first runs: ${c.cyan('flowviant')} in its repo.`);
+  const reader = createLogReader(path, { turnId });
+  try {
+    const snapshot = reader.snapshot(count);
+    if (snapshot.text) write(snapshot.text + '\n');
+    if (!follow && snapshot.pending) say('An unfinished trailing log record was not replayed.');
+    if (snapshot.omitted) say(`Showing the last ${count} retained lines; earlier retained lines were omitted.`);
+    if (turnId !== null) {
+      if (!snapshot.matched) say(`No retained detail for turn ${printableLine(scrub(turnId), 200)}. It may have expired or predate local detail recording.${follow ? ' Waiting for new detail.' : ''}`);
+      else say('Local detail retains at most two 2 MiB files; older detail may have expired.');
+    } else if (!snapshot.found) {
+      say(`No log yet for ${projectLabel(which.entry)}. It starts when the daemon first runs: flowviant in its repo.`);
+    }
     if (!follow) return;
-  } else {
-    const { text } = tailLines(path, count);
-    if (text) console.log(text);
-  }
-  if (!follow) return;
-  // Poll rather than fs.watch: the daemon rotates the file (a rename), and a
-  // watch on the old inode would go quiet exactly then.
-  let offset = existsSync(path) ? statSync(path).size : 0;
-  const followed = createLogFollower();
-  for (;;) {
-    await new Promise((resolve) => setTimeout(resolve, 500));
-    if (!existsSync(path)) continue;
-    const size = statSync(path).size;
-    if (size < offset) offset = 0; // rotated
-    if (size === offset) continue;
-    const buf = Buffer.alloc(size - offset);
-    const fd = openSync(path, 'r');
-    try { readSync(fd, buf, 0, buf.length, offset); } finally { closeSync(fd); }
-    process.stdout.write(followed(buf));
-    offset = size;
-  }
+    while (!signal?.aborted) {
+      await new Promise(resolve => {
+        const done = () => { clearTimeout(timer); signal?.removeEventListener('abort', done); resolve(); };
+        const timer = setTimeout(done, intervalMs);
+        signal?.addEventListener('abort', done, { once: true });
+      });
+      if (signal?.aborted) break;
+      const next = reader.poll();
+      if (next.text) write(next.text);
+    }
+  } catch (error) {
+    say(`Could not read the local log (${printableText(String(error?.code || 'read failed'))}).`);
+    process.exitCode = 1;
+  } finally { reader.close(); }
 }
 
 /** The command that opens a URL in this computer's browser. Inside WSL that is

package/bin/lib/wikiRunner.mjs

@@ -442,7 +442,7 @@ export function createWikiRunner({
               profile: 'wiki',
               vaultDir,
               runtime: wikiRt,
-              label: c.cyan('[wiki]'),
+              work: { kind: 'wiki', id: vaultDir, name: 'Wiki sweep' },
               // No skills or connectors are harvested off a wiki turn: it is
               // fenced (no settings source, strict MCP), so its init names less
               // than the machine has (runTurn.mjs, `initHarvestFor`).
@@ -492,7 +492,7 @@ export function createWikiRunner({
                 profile: 'wiki',
                 vaultDir,
                 runtime: wikiRt,
-                label: c.cyan('[wiki]'),
+                work: { kind: 'wiki', id: vaultDir, name: task.title },
                 onActivity,
                 onUsage: onUsage(wikiRt),
                 onSpawn: (ch) => {

package/bin/lib/work.mjs

@@ -27,7 +27,6 @@
  * whole — `workBusy` and the returned surface. A pure rule or constant
  * (REPO_PLACE, the resume-id guards, brainFor, the turn lock) is IMPORTED by
  * every lane that reads it, never carried through here.
- *
  *   workPlaces.mjs         where a session works, its worktree, its markers
  *   workSessionGroups.mjs  which process groups each tab started
  *   workChildren.mjs       the live CLI children, teardown, the admission
@@ -36,7 +35,7 @@
  *   workArtifactReconcile.mjs an idle agent's stored delivery against its worktree
  *   workReportQueue.mjs    every settle, held and retried until delivered
  *   workSessionTokens.mjs  the per-session work credential
- *   workNarration.mjs      the tab's live line and the deferral sentence
+ *   workNarration.mjs      the tab's live line; workActivity.mjs — local outcomes and destinations
  *   workAttachments.mjs    files the human attached, brought to disk (tabs and agents)
  *   workSessionRuntime.mjs which CLI a tab speaks, which conversation resumes
  *   workAdoptCarry.mjs     adoption's dirty carry
@@ -48,6 +47,7 @@
  *   workCommandAudit.mjs   one turn's `$ …` audit, batched to the server
  *   workBrain.mjs          the model and effort a turn may put on argv (pure)
  *   workIntake.mjs         one incoming ticket drafted into a card, read-only (2026-09-28)
+ *   workPlanRecovery.mjs  read-only diagnosis and attempt cancellation
  *   workCappedTurn.mjs     one capped read-only consult turn: its child, its slot,
  *                          its cap and its transcript — the planner, the pre-review
  *                          and intake all run one (2026-10-10)

package/bin/lib/workActivity.mjs

@@ -0,0 +1,65 @@
+/** Local lifecycle presentation. Inputs are the lane's validated settlement,
+ * never a phrase guessed from narration or a successful process exit.
+ */
+import { APP_URL, PROJECT_ID } from './config.mjs';
+import { createTurnOutput } from './turnOutput.mjs';
+
+export const agentWork = job => ({ kind: 'agent', id: job.agentId,
+  name: job.task?.title || job.agentName || job.agentId, turnId: job.id });
+export const sessionWork = job => ({ kind: 'tab', id: job.sessionId,
+  name: job.sessionName || job.sessionId, turnId: job.id });
+export const planWork = job => ({ kind: 'plan', id: job.id,
+  name: (Array.isArray(job.tasks) ? job.tasks : []).map(task => task?.title).filter(Boolean).join(' · ') || 'Planning', turnId: job.id });
+
+export function workDestination(work, { projectId = PROJECT_ID, appUrl = APP_URL, taskId } = {}) {
+  const safe = id => typeof id === 'string' && id && id !== '.' && id !== '..';
+  if (!safe(projectId) || !safe(work.id)) return null;
+  const base = `${appUrl}/projects/${encodeURIComponent(projectId)}`;
+  if (work.kind === 'agent') return `${base}/v2/agents/${encodeURIComponent(work.id)}${safe(taskId) ? `?${new URLSearchParams({ task: taskId })}` : ''}`;
+  if (work.kind === 'tab') return `${base}/v2/terminal?${new URLSearchParams({ tab: work.id })}`;
+  return `${base}/board`;
+}
+
+export function reportWorkOutcome(work, body, destination = workDestination(work)) {
+  const output = createTurnOutput({ work });
+  let text;
+  if (body.interrupted) text = 'Interrupted';
+  else if (body.outcome === 'question') text = `Needs input in Flowviant\n${body.answer || ''}`;
+  else if (body.outcome === 'delivered') text = 'Delivered for review';
+  else if (body.outcome === 'replied') text = 'Replied in the session';
+  else if (body.outcome === 'drafted') text = 'Ticket draft ready for review';
+  else if (body.outcome === 'proposed') text = 'Plan ready for review';
+  else if (body.outcome === 'merged') text = 'Merged on the base branch';
+  else text = `Failed\n${body.answer || 'The turn returned no outcome.'}`;
+  if (destination) text += `\n${body.outcome === 'question' ? 'Answer in Flowviant: ' : ''}${destination}`;
+  output.event(text, body.outcome === 'question' ? 'question' : 'outcome');
+  output.close();
+}
+
+/** Recovery settlements describe the retained operation, rather than a new
+ * review decision. The caller emits this once, before retrying its receipt. */
+export function reportPlanOutcome(job, body) {
+  const work = planWork(job);
+  if (body.question) return reportWorkOutcome(work, { outcome: 'question',
+    answer: [body.question.question, body.question.context].filter(Boolean).join('\n\n') });
+  if (job.recovery?.start && body.proposal) {
+    const output = createTurnOutput({ work });
+    output.event('Start diagnosis complete; continuing the approved Start', 'outcome');
+    output.close();
+    return;
+  }
+  reportWorkOutcome(work, { outcome: body.proposal ? 'proposed' : 'nothing', answer: body.error });
+}
+
+export function reportAgentOutcome(job, body) {
+  const work = agentWork(job);
+  if (job.kind === 'merge_resolve' && body.outcome === 'delivered') {
+    const output = createTurnOutput({ work });
+    output.event(body.mergeResolved === true
+      ? 'Merge repair verified; continuing the approved Merge'
+      : 'Merge repair returned; verification is still needed', 'outcome');
+    output.close();
+    return;
+  }
+  reportWorkOutcome(work, body, workDestination(work, { taskId: job.task?.id }));
+}

package/bin/lib/workAgentBriefRunner.mjs

@@ -14,7 +14,7 @@ import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
 import { scrub } from './uplinkScrub.mjs';
 
 export function createAgentBriefRunner({ admit, workChildren, run = runTurn, request = fleetRequest }) {
-  return ({ agentId, turnId, runtime, model }) => {
+  return ({ agentId, turnId, workName, runtime, model }) => {
     const identity = { agentId, turnId, instance: DAEMON_INSTANCE };
     return makeAgentBrief({ runtime, model, scrub, models: knownCodexModels,
       context: async (signal) => {
@@ -46,7 +46,7 @@ export function createAgentBriefRunner({ admit, workChildren, run = runTurn, req
           cwd = mkdtempSync(join(tmpdir(), 'flowviant-brief-'));
           const result = await runCappedTurn({ runTurn: run, workChildren, releaseSlot, signal,
             capMs: 60_000, transcriptCwd: cwd,
-            turnArgs: { ...turnArgs, cwd, profile: 'consult', answerFromResult: true, label: '[brief]',
+            turnArgs: { ...turnArgs, cwd, profile: 'consult', answerFromResult: true, work: { kind: 'brief', id: agentId, name: workName || 'Work brief' },
               onUsage: (u) => { usage = { ...u, runtime: turnArgs.runtime }; } } });
           return result.wedged ? '' : { out: result.out, usage };
         } finally {

package/bin/lib/workAgentMerges.mjs

@@ -1,3 +1,5 @@
+import { reportWorkOutcome } from './workActivity.mjs';
+import { createTurnOutput } from './turnOutput.mjs';
 import { mergeRepositoryPlace } from './repositoryMerge.mjs';
 import { fleetRequest } from './fleetPost.mjs';
 /** Agent merge claims, pull-request approval, and branch cleanup. */
@@ -13,7 +15,9 @@ import { gitMergeIn } from './gitMergeIdentity.mjs';
 import { warn } from './ui.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
-import { claimFleetLease, settleLease } from './fleetPost.mjs';
+import { claimFleetLease } from './fleetPost.mjs';
+import { createMergeReports } from './agentMergeReports.mjs';
+import { gitReportedConflict, recordMergeFailure, clearMergeFailure } from './agentMergeResolution.mjs';
 import { worktreePath } from './workPlaces.mjs';
 
 /** Git puts merge conflicts on stdout, while refusals usually use stderr.
@@ -46,7 +50,7 @@ export function createWorkAgentMerges({
   agentPublished,
 }) {
   const AGENT_MERGE_CLAIM_URL = fleetEndpoint('agent-merge-claim', FLEET_URL);
-  const AGENT_MERGE_DONE_URL = fleetEndpoint('agent-merge-done', FLEET_URL);
+
 
   // ── THE MERGE ──────────────────────────────────────────────────────────────
   //
@@ -63,9 +67,28 @@ export function createWorkAgentMerges({
   // The peer may hold it; doing nothing is the safe answer.
   const claimAgentMerge = (agentId) => claimFleetLease(AGENT_MERGE_CLAIM_URL, { agentId });
 
-  // On a failure the lease lapses and the job is re-offered — a merge is
-  // idempotent against an already-merged branch, which mergeOutward detects.
-  const postAgentMerge = (body) => settleLease(AGENT_MERGE_DONE_URL, body, { timeoutMs: 30_000 });
+  const retirements = new Map();
+  // Remote cleanup is tail work, after acknowledgement and outside the place
+  // lock, for both immediate delivery and journal replay.
+  const retireAgentMerge = async (id) => {
+    const held = retirements.get(id);
+    if (!held) return;
+    retirements.delete(id);
+    const { body, place, publishedRef } = held;
+    if (!isSafePathSegment(place)) return;
+    clearMergeFailure(worktreePath(baseDir, place));
+    agentPublished.delete(place);
+    agentRemoteAt.delete(place);
+    const args = publishDeleteArgs(publishedRef);
+    if (args) {
+      try { gitNet(args, 60_000); }
+      catch (e) { warn(`agent ${body.agentId}: the published branch could not be deleted — ${publishErrorText(envScrub(e?.stderr?.toString?.() || e?.message || ''))}`); }
+    }
+  };
+  const reports = createMergeReports({ baseDir, delivered: async (held, settled) => {
+    if (held.body.ok && settled) retirements.set(String(held.body.agentId), held);
+  } });
+  const postAgentMerge = (body, meta) => reports.report(body, meta);
 
   // A merge COMMIT needs an identity the machine may not have; the probe and
   // the daemon's fallback live in gitMergeIdentity.mjs.
@@ -81,6 +104,8 @@ export function createWorkAgentMerges({
       return;
     }
     if (!(await claimAgentMerge(agentId))) return;
+    const activity = createTurnOutput({ work: { kind: 'merge', id: agentId, name: job.agentName || agentId } });
+    activity.event('Merge started', 'start');
 
     /**
      * NO EXIT PATH MAY LEAVE A CLAIMED MERGE UNREPORTED — the same belt the
@@ -111,11 +136,17 @@ export function createWorkAgentMerges({
      * landed is the case it exists for. It is recorded in `report` rather than
      * at the three success sites so a fourth one cannot forget it.
      */
-    let landedRef = null;
     const report = async (body) => {
+      const wt = worktreePath(baseDir, place);
+      if (!job.repositoryMerge && !body.ok) {
+        body.conflict ??= gitReportedConflict(null, wt);
+        recordMergeFailure(wt, baseRef(), body.conflict);
+      }
+      // From here the journal owns retries, including a dropped 200 or a
+      // restart. The catch must not overwrite this measured outcome.
       reported = true;
-      if (body?.ok === true) landedRef = job.publishedRef ?? null;
-      await postAgentMerge({ ...body, ...(body.detail ? { detail: relayedText(String(body.detail)).slice(0, 2000) } : {}) });
+      reportWorkOutcome({ ...activity.identity, id: activity.identity.workId }, { outcome: body.ok ? 'merged' : 'nothing', answer: body.detail });
+      await postAgentMerge({ ...body, ...(body.detail ? { detail: relayedText(String(body.detail)).slice(0, 2000) } : {}) }, { place, publishedRef: job.publishedRef ?? null });
     };
 
     // A WRITER on the place, exactly as a ship is. It folds base in and pushes
@@ -160,6 +191,7 @@ export function createWorkAgentMerges({
             agentId,
             ok: false,
             detail: agentMergeFailureDetail(e),
+            conflict: gitReportedConflict(e, wt),
           });
           return;
         }
@@ -168,7 +200,11 @@ export function createWorkAgentMerges({
         // anything merges: a failed merge sends the agent BACK to review, which
         // is a review-entry beat like any other, and a stale reading standing
         // over a rebased branch is exactly what `precheckSha` exists to void.
-        await runReviewEntry(agentId, wt, job.agentName);
+        const check = await runReviewEntry(agentId, wt, job.agentName);
+        if (check?.status === 'failed') {
+          await report({ agentId, ok: false, detail: check.text || check.output || 'The repository check failed after folding base.' });
+          return;
+        }
       }
       // `git()` THROWS on a non-zero exit, and `symbolic-ref` exits non-zero on
       // a detached HEAD — so the guard below was unreachable and the throw
@@ -367,11 +403,11 @@ export function createWorkAgentMerges({
           agentId,
           ok: false,
           // WHOSE FIX IT IS (0.108.0), when the merge said: a refusal about
-          // the person's side (`shipMerge.mjs`'s dirty checkout) queues no
-          // resolve turn on the server. A conflict says nothing, and the
-          // agent resolves it in its worktree as before.
+          // person's side must become a question during diagnosis; it is
+          // never permission to modify that checkout or its credentials.
           ...(e?.fix === 'person' ? { fix: 'person' } : {}),
           detail: agentMergeFailureDetail(e),
+          conflict: gitReportedConflict(e, wt),
         });
         return;
       }
@@ -388,62 +424,31 @@ export function createWorkAgentMerges({
     } finally {
       if (!reported) {
         // Belt over braces. A merge this daemon claimed and cannot account for
-        // is a FAILURE, said out loud, so the agent goes back to Review with a
+        // is a FAILURE, said out loud, so the agent resumes diagnosis with a
         // reason instead of waiting out an expiry that blames nobody.
         await postAgentMerge({
           agentId,
           ok: false,
           detail: 'the merge did not complete — check the daemon log',
-        }).catch(() => {});
-      }
-      /**
-       * …AND THE RETIREMENT IS TAIL WORK, OUTSIDE THE PLACE LOCK — the same
-       * placement the turn's publish argues for, for the same reason.
-       *
-       * `gitNet` is `execFileSync`: it blocks the whole event loop for up to its
-       * timeout, and inside `inPlace(place, true, …)` it would hold this
-       * agent's WRITER lock through a remote's bad day, with the merge already
-       * settled and nothing left that the delay serves. This block is PAST the
-       * lock: `inPlace` has returned (or thrown) before a `finally` runs.
-       *
-       * IN THE `finally` rather than after it, so a throw between the ok settle
-       * and the end of the locked block cannot strand the ref. `landedRef` is
-       * set only by a reported success, so there is nothing here to run on any
-       * other path — and a remote that refuses the delete only warns: the merge
-       * is the thing that matters, and a landed branch must not become a failed
-       * approval.
-       *
-       * The record goes with the ref. `agentPublished` is what the SWEEP
-       * republishes from, so leaving the entry behind would let the next sweep
-       * push the ref straight back — an orphan no later merge job can ever
-       * carry, and therefore one nothing can delete.
-       */
-      if (landedRef) {
-        agentPublished.delete(place);
-        agentRemoteAt.delete(place);
-        const args = publishDeleteArgs(landedRef);
-        if (args) {
-          try {
-            gitNet(args, 60_000);
-          } catch (e) {
-            warn(
-              `agent ${agentId}: the published branch ${landedRef} could not be deleted — ${publishErrorText(envScrub(e?.stderr?.toString?.() || e?.message || ''))}`
-            );
-          }
-        }
+        }, { place, publishedRef: job.publishedRef ?? null }).catch(() => {});
       }
+      await retireAgentMerge(agentId);
     }
   };
 
   const processAgentMergeJobs = (jobs) => {
+    void (async () => {
+      await reports.flush();
+      for (const id of [...retirements.keys()]) if (!agentMerges.has(id)) await retireAgentMerge(id);
+    })().catch(() => {});
     if (!Array.isArray(jobs) || jobs.length === 0) return;
     for (const job of jobs.slice(0, 2)) {
       const id = String(job?.batch?.spec?.id || job?.agentId || '');
-      if (!id || agentMerges.has(id)) continue;
+      if (!id || agentMerges.has(id) || reports.pending.has(id)) continue;
       agentMerges.add(id);
       void (job.batch ? runBatch(job) : runAgentMerge(job)).finally(() => agentMerges.delete(id));
     }
   };
 
-  return { processAgentMergeJobs, agentMerges };
+  return { processAgentMergeJobs, agentMerges, pendingMergeReports: reports.pending };
 }