fraim-hub 2.0.236 → 2.0.238

package/bin/fraim-hub-2.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+try {
+  const { createFraimHub2Program } = require('../dist/src/cli/fraim-hub-2.js');
+  createFraimHub2Program().parseAsync(process.argv).catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+} catch (error) {
+  console.error('Unable to start FRAIM Hub 2. Run npm install -g fraim-hub again to refresh the package.');
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}

package/dist/src/ai-hub/cli.js

@@ -75,7 +75,7 @@ function resolveDesktopEntry() {
     }
     return null;
 }
-function openDesktopWindow(projectPath, preferredPort) {
+function openDesktopWindow(projectPath, preferredPort, runtimeId) {
     const electronBinary = resolveElectronBinary();
     const desktopEntry = resolveDesktopEntry();
     if (!electronBinary || !desktopEntry) {
@@ -84,6 +84,9 @@ function openDesktopWindow(projectPath, preferredPort) {
     const args = projectPath
         ? [desktopEntry, '--project-path', projectPath, '--port', String(preferredPort)]
         : [desktopEntry, '--port', String(preferredPort)];
+    if (runtimeId && runtimeId !== 'hub') {
+        args.push('--hub-runtime-id', runtimeId);
+    }
     const child = (0, child_process_1.spawn)(electronBinary, args, {
         detached: true,
         stdio: 'ignore',
@@ -204,8 +207,8 @@ function fetchRunningHubVersion(port) {
         req.on('timeout', () => { req.destroy(); resolve(null); });
     });
 }
-async function reconcileRunningHub(flags) {
-    const running = (0, hub_runtime_file_1.readHubRuntimeFile)((0, project_fraim_paths_1.getUserFraimDirPath)());
+async function reconcileRunningHub(flags, runtimeId = 'hub') {
+    const running = (0, hub_runtime_file_1.readHubRuntimeFile)((0, project_fraim_paths_1.getUserFraimDirPath)(), runtimeId);
     const confirmedVersion = running ? await fetchRunningHubVersion(running.port) : null;
     const live = !!(running && confirmedVersion && isProcessAlive(running.pid));
     const effective = live && running ? { ...running, version: confirmedVersion } : null;
@@ -222,7 +225,9 @@ async function reconcileRunningHub(flags) {
         await waitForPortFree(effective.port);
         // #921: after killing the registered pid, scan for orphan Hub processes that were
         // never registered in hub-runtime.json (e.g. older versions started via bare npx).
-        await scanAndKillOrphanHubs(effective.pid);
+        if (runtimeId === 'hub') {
+            await scanAndKillOrphanHubs(effective.pid);
+        }
     }
     else if (decision.action === 'focus-existing' && effective) {
         console.log(`A Hub (v${effective.version}) is already running - focusing it. Use --restart to replace it.`);
@@ -232,12 +237,13 @@ async function runHub(options) {
     const { AiHubServer, findAvailablePort } = await Promise.resolve().then(() => __importStar(require('./server')));
     const preferredPort = options.port || (0, git_utils_1.getPort)() + 100;
     const projectPath = options.projectPath ? path_1.default.resolve(options.projectPath) : undefined;
+    const runtimeId = options.runtimeId || process.env.FRAIM_HUB_RUNTIME_ID || 'hub';
     if (options.open) {
         const wantDesktop = !options.browser;
         if (wantDesktop) {
-            await reconcileRunningHub({ restart: !!options.restart, keepRunning: !!options.keepRunning });
+            await reconcileRunningHub({ restart: !!options.restart, keepRunning: !!options.keepRunning }, runtimeId);
         }
-        const openedDesktop = wantDesktop && openDesktopWindow(projectPath, preferredPort);
+        const openedDesktop = wantDesktop && openDesktopWindow(projectPath, preferredPort, runtimeId);
         if (!openedDesktop) {
             const port = await findAvailablePort(preferredPort);
             const server = new AiHubServer(projectPath ? { projectPath } : {});

package/dist/src/ai-hub/desktop-main.js

@@ -37,6 +37,7 @@ function preferredWindowSize() {
 function parseArgs(argv) {
     let projectPath;
     let preferredPort = 43091;
+    let runtimeId = process.env.FRAIM_HUB_RUNTIME_ID || 'hub';
     for (let i = 0; i < argv.length; i += 1) {
         if (argv[i] === '--project-path' && argv[i + 1]) {
             projectPath = argv[i + 1];
@@ -46,8 +47,12 @@ function parseArgs(argv) {
             preferredPort = Number(argv[i + 1]) || preferredPort;
             i += 1;
         }
+        if (argv[i] === '--hub-runtime-id' && argv[i + 1]) {
+            runtimeId = argv[i + 1];
+            i += 1;
+        }
     }
-    return { projectPath, preferredPort };
+    return { projectPath, preferredPort, runtimeId };
 }
 function applyUserDataOverride() {
     const userDataDir = process.env.FRAIM_AI_HUB_USER_DATA_DIR;
@@ -115,10 +120,14 @@ function ensureWordSideload(projectPath, httpPort) {
 // ---------------------------------------------------------------------------
 // Tray setup
 // ---------------------------------------------------------------------------
-function buildTrayMenu(hubUrl) {
+function displayName(runtimeId = process.env.FRAIM_HUB_RUNTIME_ID || 'hub') {
+    return process.env.FRAIM_HUB_DISPLAY_NAME || (runtimeId === 'hub2' ? 'FRAIM Hub 2' : 'FRAIM Hub');
+}
+function buildTrayMenu(hubUrl, runtimeId) {
+    const name = displayName(runtimeId);
     return electron_1.Menu.buildFromTemplate([
         {
-            label: 'Open FRAIM Hub',
+            label: `Open ${name}`,
             click: () => {
                 if (mainWindow) {
                     mainWindow.show();
@@ -131,12 +140,12 @@ function buildTrayMenu(hubUrl) {
         },
         {
             // #755: surface the running build version so staleness is diagnosable at a glance.
-            label: 'About FRAIM Hub',
+            label: `About ${name}`,
             click: () => {
                 void electron_1.dialog.showMessageBox({
                     type: 'info',
-                    title: 'About FRAIM Hub',
-                    message: 'FRAIM Hub',
+                    title: `About ${name}`,
+                    message: name,
                     detail: `Version ${(0, version_utils_1.getFraimVersion)()}\nIdentity: ~/.fraim/config.json\nLocal server: ${hubUrl}`,
                     buttons: ['OK'],
                 });
@@ -159,7 +168,7 @@ function buildTrayMenu(hubUrl) {
         },
         { type: 'separator' },
         {
-            label: 'Quit FRAIM',
+            label: `Quit ${name}`,
             click: () => {
                 isQuitting = true;
                 electron_1.app.quit();
@@ -167,10 +176,11 @@ function buildTrayMenu(hubUrl) {
         },
     ]);
 }
-function createTray(hubUrl) {
+function createTray(hubUrl, runtimeId) {
+    const name = displayName(runtimeId);
     tray = new electron_1.Tray(resolveTrayIcon());
-    tray.setToolTip('FRAIM AI Hub');
-    tray.setContextMenu(buildTrayMenu(hubUrl));
+    tray.setToolTip(name);
+    tray.setContextMenu(buildTrayMenu(hubUrl, runtimeId));
     tray.on('double-click', () => {
         if (mainWindow) {
             mainWindow.show();
@@ -184,12 +194,12 @@ function createTray(hubUrl) {
 // ---------------------------------------------------------------------------
 // BrowserWindow
 // ---------------------------------------------------------------------------
-async function createWindow(url) {
+async function createWindow(url, runtimeId = process.env.FRAIM_HUB_RUNTIME_ID || 'hub') {
     const { width, height } = preferredWindowSize();
     const isMac = process.platform === 'darwin';
     const isWin = process.platform === 'win32';
     mainWindow = new electron_1.BrowserWindow({
-        title: 'FRAIM AI Hub',
+        title: displayName(runtimeId),
         width,
         height,
         minWidth: 1200,
@@ -309,6 +319,7 @@ function stopServerOnce() {
 // Launch
 // ---------------------------------------------------------------------------
 async function launchDesktopShell(options) {
+    const runtimeId = options.runtimeId || process.env.FRAIM_HUB_RUNTIME_ID || 'hub';
     const httpPort = await (0, server_1.findAvailablePort)(options.preferredPort);
     const httpsPort = await (0, server_1.findAvailablePortExcluding)(43092, new Set([httpPort]));
     // Generate (or load cached) self-signed cert for HTTPS.
@@ -339,15 +350,15 @@ async function launchDesktopShell(options) {
             port: httpPort,
             version: (0, version_utils_1.getFraimVersion)(),
             startedAt: new Date().toISOString(),
-        });
+        }, runtimeId);
     }
     catch (err) {
-        console.warn('[fraim] could not write hub-runtime.json:', err);
+        console.warn('[fraim] could not write hub runtime file:', err);
     }
     ensureWordSideload(resolvedProjectPath, httpPort);
     const hubUrl = `http://127.0.0.1:${httpPort}/ai-hub/`;
-    createTray(hubUrl);
-    await createWindow(hubUrl);
+    createTray(hubUrl, runtimeId);
+    await createWindow(hubUrl, runtimeId);
 }
 // ---------------------------------------------------------------------------
 // Bootstrap
@@ -372,7 +383,7 @@ async function bootstrap() {
         }
     });
     await electron_1.app.whenReady();
-    electron_1.app.setName('FRAIM Hub');
+    electron_1.app.setName(displayName(options.runtimeId));
     // First-launch housekeeping (idempotent, fast on subsequent runs)
     ensureLoginItem();
     configureAutoUpdater();
@@ -388,7 +399,7 @@ async function bootstrap() {
         // #755: clear the runtime file so a later `fraim hub` doesn't treat a
         // cleanly-exited instance as live.
         try {
-            (0, hub_runtime_file_1.removeHubRuntimeFile)((0, project_fraim_paths_1.getUserFraimDirPath)());
+            (0, hub_runtime_file_1.removeHubRuntimeFile)((0, project_fraim_paths_1.getUserFraimDirPath)(), options.runtimeId);
         }
         catch { /* best-effort */ }
         void stopServerOnce();

package/dist/src/ai-hub/hub-runtime-file.js

@@ -13,17 +13,23 @@ const path_1 = __importDefault(require("path"));
 // `fraim hub` CLI can discover a live instance (pid/port/version) before deciding
 // whether to replace a stale build. `fraimDir` is injected (never hard-coded to
 // the real ~/.fraim) so tests isolate via a temp directory.
-const RUNTIME_FILE = 'hub-runtime.json';
-function hubRuntimeFilePath(fraimDir) {
-    return path_1.default.join(fraimDir, RUNTIME_FILE);
+const DEFAULT_RUNTIME_ID = 'hub';
+function runtimeFileName(runtimeId = DEFAULT_RUNTIME_ID) {
+    if (runtimeId === DEFAULT_RUNTIME_ID)
+        return 'hub-runtime.json';
+    const safeRuntimeId = runtimeId.toLowerCase().replace(/[^a-z0-9_-]/g, '-').replace(/^-+|-+$/g, '');
+    return `${safeRuntimeId || DEFAULT_RUNTIME_ID}-runtime.json`;
 }
-function writeHubRuntimeFile(fraimDir, info) {
+function hubRuntimeFilePath(fraimDir, runtimeId = DEFAULT_RUNTIME_ID) {
+    return path_1.default.join(fraimDir, runtimeFileName(runtimeId));
+}
+function writeHubRuntimeFile(fraimDir, info, runtimeId = DEFAULT_RUNTIME_ID) {
     fs_1.default.mkdirSync(fraimDir, { recursive: true });
-    fs_1.default.writeFileSync(hubRuntimeFilePath(fraimDir), JSON.stringify(info, null, 2));
+    fs_1.default.writeFileSync(hubRuntimeFilePath(fraimDir, runtimeId), JSON.stringify(info, null, 2));
 }
-function readHubRuntimeFile(fraimDir) {
+function readHubRuntimeFile(fraimDir, runtimeId = DEFAULT_RUNTIME_ID) {
     try {
-        const parsed = JSON.parse(fs_1.default.readFileSync(hubRuntimeFilePath(fraimDir), 'utf8'));
+        const parsed = JSON.parse(fs_1.default.readFileSync(hubRuntimeFilePath(fraimDir, runtimeId), 'utf8'));
         if (typeof parsed.pid !== 'number' || typeof parsed.port !== 'number' || typeof parsed.version !== 'string') {
             return null;
         }
@@ -33,9 +39,9 @@ function readHubRuntimeFile(fraimDir) {
         return null;
     }
 }
-function removeHubRuntimeFile(fraimDir) {
+function removeHubRuntimeFile(fraimDir, runtimeId = DEFAULT_RUNTIME_ID) {
     try {
-        fs_1.default.rmSync(hubRuntimeFilePath(fraimDir), { force: true });
+        fs_1.default.rmSync(hubRuntimeFilePath(fraimDir, runtimeId), { force: true });
     }
     catch {
         /* no-op: absent file is fine */

package/dist/src/ai-hub/hub2-remote-config.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HUB2_REMOTE_UI_PUBLIC_KEY_PEM = exports.HUB2_REMOTE_UI_ASSET_ORIGIN = exports.HUB2_REMOTE_UI_RELEASE_ID = exports.HUB2_REMOTE_UI_CHANNEL = void 0;
+exports.hub2RemoteManifestUrl = hub2RemoteManifestUrl;
+exports.hub2TrustedOrigins = hub2TrustedOrigins;
+const remote_hub_gateway_1 = require("./remote-hub-gateway");
+exports.HUB2_REMOTE_UI_CHANNEL = 'hub2';
+exports.HUB2_REMOTE_UI_RELEASE_ID = '2026.07.25.1';
+exports.HUB2_REMOTE_UI_ASSET_ORIGIN = 'https://fraim.wellnessatwork.me';
+exports.HUB2_REMOTE_UI_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAn53Ks3CQSqzflw4/6KIJbKmZeWy94V5H7LYlWhMOePo=
+-----END PUBLIC KEY-----
+`;
+function hub2RemoteManifestUrl(remoteBaseUrl = (0, remote_hub_gateway_1.resolveFraimRemoteUrl)()) {
+    const target = new URL('/api/ai-hub/ui/releases/latest', remoteBaseUrl);
+    target.searchParams.set('channel', exports.HUB2_REMOTE_UI_CHANNEL);
+    return target.toString();
+}
+function hub2TrustedOrigins(remoteBaseUrl = (0, remote_hub_gateway_1.resolveFraimRemoteUrl)()) {
+    return Array.from(new Set([new URL(remoteBaseUrl).origin, exports.HUB2_REMOTE_UI_ASSET_ORIGIN])).join(',');
+}

package/dist/src/ai-hub/server.js

@@ -66,6 +66,8 @@ const user_config_1 = require("../cli/utils/user-config");
 const org_publish_1 = require("../cli/utils/org-publish");
 const version_utils_1 = require("../cli/utils/version-utils");
 const hub_latest_version_1 = require("./hub-latest-version");
+const ui_runtime_1 = require("./ui-runtime");
+const ui_cache_1 = require("./ui-cache");
 const semver = __importStar(require("semver"));
 const BOOTSTRAP_PERSONA_FIRST_PAINT_BUDGET_MS = 250;
 let personaHiringModule;
@@ -1571,6 +1573,12 @@ class AiHubServer {
         this.folderPicker = options.folderPicker ?? pickProjectPath;
         this.httpsPort = options.httpsPort;
         this.certBundle = options.certBundle;
+        this.hubUiCacheDir = options.hubUiCacheDir || process.env.FRAIM_HUB_UI_CACHE_DIR || (0, ui_cache_1.defaultHubUiCacheDir)();
+        this.hubUiPublicKeyPem = options.hubUiPublicKeyPem || process.env.FRAIM_HUB_UI_PUBLIC_KEY;
+        this.hubUiManifestUrl = options.hubUiManifestUrl || process.env.FRAIM_HUB_UI_MANIFEST_URL;
+        this.hubUiTrustedOrigins = options.hubUiTrustedOrigins || parseHubUiTrustedOrigins();
+        this.hubUiRemoteEnabled = options.hubUiRemoteEnabled;
+        this.hubUiAllowInsecureLoopback = options.hubUiAllowInsecureLoopback || process.env.NODE_ENV === 'test';
         this.managedBrowser = options.managedBrowser || new managed_browser_1.ManagedBrowser({
             channel: process.env.FRAIM_BROWSER_CHANNEL || 'auto',
             port: process.env.FRAIM_BROWSER_PORT ? Number(process.env.FRAIM_BROWSER_PORT) : undefined,
@@ -1626,6 +1634,39 @@ class AiHubServer {
             next();
         });
         this.app.use('/ai-hub', express_1.default.static(resolveAiHubPublicDir()));
+        this.app.use('/_fraim-hub-ui', (req, res, next) => {
+            try {
+                const pathname = new URL(req.url, 'http://localhost').pathname;
+                const parts = pathname.split('/').filter(Boolean).map((part) => decodeURIComponent(part));
+                const [releaseId, ...assetParts] = parts;
+                const assetPath = assetParts.join('/');
+                (0, ui_cache_1.assertSafeHubUiAssetPath)(releaseId);
+                (0, ui_cache_1.assertSafeHubUiAssetPath)(assetPath);
+                const releaseDir = (0, ui_cache_1.hubUiReleaseDir)(this.hubUiCacheDir, releaseId);
+                const filePath = path_1.default.join(releaseDir, assetPath);
+                if (!filePath.startsWith(releaseDir + path_1.default.sep) && filePath !== releaseDir) {
+                    res.status(403).end();
+                    return;
+                }
+                const contentTypes = {
+                    '.html': 'text/html; charset=utf-8',
+                    '.css': 'text/css; charset=utf-8',
+                    '.js': 'application/javascript; charset=utf-8',
+                };
+                fs_1.default.readFile(filePath, (err, data) => {
+                    if (err) {
+                        next();
+                        return;
+                    }
+                    res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+                    res.setHeader('Content-Type', contentTypes[path_1.default.extname(filePath)] || 'application/octet-stream');
+                    res.end(data);
+                });
+            }
+            catch {
+                res.status(403).end();
+            }
+        });
         // Issue #489: Serve the Word task pane assets at /word-taskpane/*.
         // Office JS appends ?_host_Info=Word$Win32$... to every request — we must
         // strip the query string before resolving the file path, otherwise every
@@ -1704,6 +1745,17 @@ class AiHubServer {
                 next();
             });
         }
+        this.app.get('/api/ai-hub/bridge', (_req, res) => {
+            res.json(this.hubUiBridgeInfo());
+        });
+        this.app.get('/api/ai-hub/ui-runtime', async (_req, res) => {
+            try {
+                res.json(await this.resolveHubUiRuntimeResponse());
+            }
+            catch (error) {
+                res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
+            }
+        });
         this.registerRoutes();
     }
     getApp() {
@@ -1793,6 +1845,45 @@ class AiHubServer {
         this.managedBrowser.stop();
     }
     getHttpsPort() { return this.httpsPort; }
+    isHubUiRemoteEnabled() {
+        if (this.hubUiRemoteEnabled !== undefined)
+            return this.hubUiRemoteEnabled;
+        return process.env.FRAIM_HUB_REMOTE_UI === '1';
+    }
+    hubUiBridgeInfo() {
+        return (0, ui_runtime_1.createAiHubBridgeInfo)({
+            bridgeVersion: (0, version_utils_1.getFraimVersion)(),
+            remoteBaseUrl: (0, remote_hub_gateway_1.resolveFraimRemoteUrl)(),
+            remoteUiEnabled: this.isHubUiRemoteEnabled(),
+        });
+    }
+    resolveHubUiManifestUrl() {
+        if (this.hubUiManifestUrl)
+            return this.hubUiManifestUrl;
+        if (!this.isHubUiRemoteEnabled())
+            return undefined;
+        return `${(0, remote_hub_gateway_1.resolveFraimRemoteUrl)()}/api/ai-hub/ui/releases/latest`;
+    }
+    resolveHubUiTrustedOrigins(manifestUrl) {
+        if (this.hubUiTrustedOrigins?.length)
+            return this.hubUiTrustedOrigins;
+        if (!manifestUrl)
+            return [];
+        return [new URL(manifestUrl).origin];
+    }
+    resolveHubUiRuntimeResponse() {
+        const bridge = this.hubUiBridgeInfo();
+        const manifestUrl = this.resolveHubUiManifestUrl();
+        return (0, ui_runtime_1.resolveHubUiRuntime)({
+            bridge,
+            cacheDir: this.hubUiCacheDir,
+            remoteEnabled: this.isHubUiRemoteEnabled(),
+            manifestUrl,
+            trustedOrigins: this.resolveHubUiTrustedOrigins(manifestUrl),
+            publicKeyPem: this.hubUiPublicKeyPem,
+            allowInsecureLoopback: this.hubUiAllowInsecureLoopback,
+        });
+    }
     knownProjects(projectPath, extras = [], options = {}) {
         // #866 R2: guard against path.resolve('') === cwd. When there is no active
         // project, keep the path empty so no invocation-directory project is injected.
@@ -1960,7 +2051,7 @@ class AiHubServer {
                 },
             };
         }
-        if (existing.jobId && existing.jobId !== '__freeform__' && existing.jobId !== options.jobId) {
+        if (existing.jobId && existing.jobId !== options.jobId) {
             console.warn('[ai-hub] hub.conversation_continuity.rejected', {
                 conversationId,
                 existingJobId: existing.jobId,
@@ -1978,15 +2069,6 @@ class AiHubServer {
         }
         return { ok: true, continuityDecision: 'same_continuity' };
     }
-    resolveImplicitResumeConversation(options) {
-        const candidates = this.conversationStore.loadProject(options.projectPath).conversations.filter((conversation) => {
-            if (conversation.jobId !== options.jobId)
-                return false;
-            const existingAgentId = this.configuredAgentIdForConversation(conversation, options.employees);
-            return existingAgentId === options.requestedAgent.id;
-        });
-        return candidates.length === 1 ? candidates[0] : null;
-    }
     isTrustedHubOrigin(req) {
         const origin = req.get('origin');
         if (!origin)
@@ -3352,7 +3434,15 @@ class AiHubServer {
             const version = (0, version_utils_1.getFraimVersion)();
             const latest = await (0, hub_latest_version_1.getLatestPublishedVersion)();
             const updateAvailable = !!(latest && semver.valid(version) && semver.valid(latest) && semver.gt(latest, version));
-            return res.json({ version, latest, updateAvailable });
+            const uiRuntime = await this.resolveHubUiRuntimeResponse();
+            return res.json({
+                version,
+                latest,
+                updateAvailable,
+                uiReleaseId: uiRuntime.releaseId,
+                uiMode: uiRuntime.mode,
+                uiUpdateAvailable: uiRuntime.mode === 'remote-cache',
+            });
         });
         // #921: expose the server's pid so the orphan scanner in cli.ts can identify and
         // kill Hub processes that are not registered in hub-runtime.json.
@@ -4070,18 +4160,13 @@ class AiHubServer {
                     throw new Error('A jobId is required to resume.');
                 if (!instructions)
                     throw new Error('Provide an instruction to continue.');
-                const employees = this.hostRuntime.detectEmployees();
-                const { hostId, agent: configuredAgent, launchContext } = this.resolveLaunchAgent(body.configuredAgentId, requestedHostId, employees);
-                const requestedConversationId = typeof body.conversationId === 'string' && body.conversationId.trim()
+                const { hostId, agent: configuredAgent, launchContext } = this.resolveLaunchAgent(body.configuredAgentId, requestedHostId);
+                const conversationId = typeof body.conversationId === 'string' && body.conversationId.trim()
                     ? body.conversationId.trim()
                     : undefined;
-                const inferredConversation = requestedConversationId
-                    ? null
-                    : this.resolveImplicitResumeConversation({ projectPath, jobId, requestedAgent: configuredAgent, employees });
-                const conversationId = requestedConversationId || inferredConversation?.id;
-                const persistedConversation = requestedConversationId
-                    ? this.conversationStore.loadProject(projectPath).conversations.find((entry) => entry.id === requestedConversationId)
-                    : inferredConversation ?? undefined;
+                const persistedConversation = conversationId
+                    ? this.conversationStore.loadProject(projectPath).conversations.find((entry) => entry.id === conversationId)
+                    : undefined;
                 const persistedRun = readPersistedRunProjection(persistedConversation);
                 const now = new Date().toISOString();
                 const run = {
@@ -4092,16 +4177,12 @@ class AiHubServer {
                     jobId, hostId, configuredAgentId: configuredAgent.id, configuredAgentLabel: configuredAgent.label, baseHostId: configuredAgent.baseHostId, projectPath, status: 'running', sessionId,
                     createdAt: now, updatedAt: now, messages: [],
                     events: [(0, hosts_1.createHubEvent)('system', `Resuming ${configuredAgent.label} (${hostId}) session ${sessionId} in ${projectPath}`)],
-                    // Only carry phase state forward when the prior run was interrupted mid-job
-                    // (status !== 'completed'). A completed conversation is a finished run;
-                    // resuming the session starts a fresh job, so the tracker must be blank.
-                    currentPhase: persistedConversation?.status !== 'completed' ? (persistedRun?.currentPhase || null) : null,
-                    phaseHistory: persistedConversation?.status !== 'completed' ? (persistedRun?.phaseHistory || []) : [],
+                    currentPhase: persistedRun?.currentPhase || null,
+                    phaseHistory: persistedRun?.phaseHistory || [],
                     totals: persistedRun?.totals || emptyTotals(),
                     lastStatusChangeAt: now,
-                    runDiscriminant: persistedConversation?.status !== 'completed' ? (persistedRun?.runDiscriminant || undefined) : undefined,
+                    runDiscriminant: persistedRun?.runDiscriminant || undefined,
                     personaKey: getHubPersonaForJob(jobId),
-                    continuityDecision: conversationId ? 'same_continuity' : 'new_conversation',
                 };
                 // Continue-turn message (FRAIM invocation for the job + instructions) plus
                 // the shared-browser note so the resumed agent knows about it.
@@ -5071,6 +5152,13 @@ function resolveAiHubPublicDir() {
     }
     throw new Error('Could not locate public/ai-hub assets.');
 }
+function parseHubUiTrustedOrigins() {
+    const raw = process.env.FRAIM_HUB_UI_TRUSTED_ORIGINS;
+    if (!raw)
+        return undefined;
+    const origins = raw.split(',').map((part) => part.trim()).filter(Boolean);
+    return origins.length ? origins : undefined;
+}
 // Issue #489: Resolve the word taskpane static assets directory.
 // Returns null (not throws) when the directory does not exist so the Hub
 // can start without the Word add-in assets present (e.g., older installs).

package/dist/src/ai-hub/ui-cache.js

@@ -0,0 +1,96 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultHubUiCacheDir = defaultHubUiCacheDir;
+exports.assertSafeHubUiAssetPath = assertSafeHubUiAssetPath;
+exports.hubUiReleaseDir = hubUiReleaseDir;
+exports.readHubUiCacheState = readHubUiCacheState;
+exports.writeHubUiCacheFailure = writeHubUiCacheFailure;
+exports.writeVerifiedHubUiRelease = writeVerifiedHubUiRelease;
+exports.readCachedHubUiManifest = readCachedHubUiManifest;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
+function defaultHubUiCacheDir() {
+    return path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), 'hub-ui-cache');
+}
+function assertSafeHubUiAssetPath(assetPath) {
+    if (!assetPath ||
+        path_1.default.isAbsolute(assetPath) ||
+        assetPath.includes('\\') ||
+        assetPath.split('/').includes('..')) {
+        throw new Error(`unsafe-asset-path:${assetPath}`);
+    }
+}
+function hubUiReleaseDir(cacheDir, releaseId) {
+    assertSafeHubUiAssetPath(releaseId);
+    return path_1.default.join(cacheDir, 'releases', releaseId);
+}
+function readHubUiCacheState(cacheDir) {
+    const statePath = path_1.default.join(cacheDir, 'state.json');
+    try {
+        if (!fs_1.default.existsSync(statePath))
+            return null;
+        return JSON.parse(fs_1.default.readFileSync(statePath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function writeHubUiCacheFailure(cacheDir, reason) {
+    const existing = readHubUiCacheState(cacheDir);
+    fs_1.default.mkdirSync(cacheDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(cacheDir, 'state.json'), JSON.stringify({
+        version: 1,
+        activeReleaseId: existing?.activeReleaseId || 'bundled',
+        lastKnownGoodReleaseId: existing?.lastKnownGoodReleaseId || 'bundled',
+        lastSuccessfulUpdateAt: existing?.lastSuccessfulUpdateAt || '',
+        lastFailure: reason,
+    }, null, 2));
+}
+async function writeVerifiedHubUiRelease(options) {
+    assertSafeHubUiAssetPath(options.manifest.releaseId);
+    const releaseDir = hubUiReleaseDir(options.cacheDir, options.manifest.releaseId);
+    const tmpDir = `${releaseDir}.tmp-${process.pid}-${Date.now()}`;
+    await fs_1.default.promises.rm(tmpDir, { force: true, recursive: true });
+    await fs_1.default.promises.mkdir(tmpDir, { recursive: true });
+    try {
+        for (const asset of options.manifest.assets) {
+            assertSafeHubUiAssetPath(asset.path);
+            const body = options.assets.get(asset.path);
+            if (!body) {
+                throw new Error(`missing-verified-asset:${asset.path}`);
+            }
+            const destination = path_1.default.join(tmpDir, asset.path);
+            await fs_1.default.promises.mkdir(path_1.default.dirname(destination), { recursive: true });
+            await fs_1.default.promises.writeFile(destination, body);
+        }
+        await fs_1.default.promises.writeFile(path_1.default.join(tmpDir, 'manifest.json'), JSON.stringify(options.manifest, null, 2));
+        await fs_1.default.promises.rm(releaseDir, { force: true, recursive: true });
+        await fs_1.default.promises.mkdir(path_1.default.dirname(releaseDir), { recursive: true });
+        await fs_1.default.promises.rename(tmpDir, releaseDir);
+        await fs_1.default.promises.mkdir(options.cacheDir, { recursive: true });
+        await fs_1.default.promises.writeFile(path_1.default.join(options.cacheDir, 'state.json'), JSON.stringify({
+            version: 1,
+            activeReleaseId: options.manifest.releaseId,
+            lastKnownGoodReleaseId: options.manifest.releaseId,
+            lastSuccessfulUpdateAt: new Date().toISOString(),
+            lastFailure: null,
+        }, null, 2));
+        return { releaseId: options.manifest.releaseId, releaseDir };
+    }
+    catch (error) {
+        await fs_1.default.promises.rm(tmpDir, { force: true, recursive: true });
+        throw error;
+    }
+}
+function readCachedHubUiManifest(cacheDir, releaseId) {
+    try {
+        return JSON.parse(fs_1.default.readFileSync(path_1.default.join(hubUiReleaseDir(cacheDir, releaseId), 'manifest.json'), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}