fraim-hub 2.0.301 → 2.0.302

package/README.md

@@ -312,7 +312,7 @@ Use these defaults:
 - `feature-specification` when the request is still fuzzy or needs clarified requirements, UX, or acceptance criteria.
 - `technical-design` after the spec is approved and you need the implementation plan, file touchpoints, and risk handling.
 - `feature-implementation` for code changes, bug fixes, and documentation updates that should be executed and validated.
-- `test-execution` when you need reproduction coverage, missing tests, or stronger regression protection before implementation.
+- `test-authoring` when you need reproduction coverage, missing tests, or stronger regression protection before implementation.
 - `browser-application-validation` or `ui-polish-validation` after user-facing UI changes or when the ask is explicitly browser validation.
 - `implementation-feature-review` when you need to verify the delivered behavior matches the feature spec.
 - `implementation-design-review` when you need to verify the code matches the approved technical design.

package/dist/src/ai-hub/conversation-store.js

@@ -689,6 +689,13 @@ class AiHubConversationStore {
         const { headers } = this.loadIndex(this.bucketDir(key), key);
         return headers.map((h) => ({ ...h }));
     }
+    // Issue #1477: the active conversation id, from the same cheap index used by
+    // loadProjectHeaders, so a headers-only list response can still report it.
+    loadProjectActiveId(projectPath) {
+        this.ensureMigrated();
+        const key = normalizeConversationKey(projectPath);
+        return this.loadIndex(this.bucketDir(key), key).activeId;
+    }
     // Lazy body read: one full conversation.
     loadConversation(projectPath, conversationId) {
         this.ensureMigrated();

package/dist/src/ai-hub/hosts.js

@@ -16,6 +16,7 @@ exports.__clearEmployeeDetectionMemoryCacheForTests = __clearEmployeeDetectionMe
 exports.__setEmployeeDetectionTtlForTests = __setEmployeeDetectionTtlForTests;
 exports.__getEmployeeProbeRoundsForTests = __getEmployeeProbeRoundsForTests;
 exports.__resetEmployeeProbeRoundsForTests = __resetEmployeeProbeRoundsForTests;
+exports.isEmployeeDetectionRefreshing = isEmployeeDetectionRefreshing;
 exports.detectEmployeesAsync = detectEmployeesAsync;
 exports.detectEmployees = detectEmployees;
 exports.prepareCodexBrowserHome = prepareCodexBrowserHome;
@@ -895,10 +896,11 @@ function resolveHostInvocation(plan) {
         args: ['/d', '/s', '/c', [command, ...args].map(escapeWindowsArg).join(' ')],
     };
 }
+// Issue #1256 (slice a, AC-A3): delegates to the shared recovery helper so this probe agrees
+// with server.ts's hubCommandVersion() and fraim doctor's health check on the same PATH,
+// instead of each independently deciding what "the agent's PATH" means.
 function buildAgentVersionProbePath(basePath) {
-    const withoutManaged = (0, managed_agent_paths_1.stripManagedAgentBinDirsFromPath)(basePath);
-    const withoutProjectBins = (0, managed_agent_paths_1.stripProjectLocalNodeBinDirs)(withoutManaged);
-    return (0, managed_agent_paths_1.appendBinDirsToPath)(withoutProjectBins, (0, managed_agent_paths_1.getManagedAgentBinDirs)());
+    return (0, managed_agent_paths_1.buildRecoveredAgentPath)(basePath);
 }
 // Single source for the probe environment, shared by the sync and async probes so the two
 // cannot drift on how agent bin directories are put on PATH. Project-local npm shims are
@@ -918,7 +920,10 @@ const availableByVersionProbe = (command) => {
     });
     if (result.status !== 0 || result.error)
         return null;
-    return (result.stdout || result.stderr || '').trim() || null;
+    // Issue #1256 (AC-D1/D2): only stdout counts as a version — an agent that exits 0 while
+    // writing only to stderr (e.g. GitHub Copilot CLI's current failure mode) is broken, not
+    // "available with an odd version string".
+    return (0, managed_agent_paths_1.versionFromProbeOutput)(result.stdout, result.stderr);
 };
 // Issue #1010: the async counterpart of availableByVersionProbe. Same semantics (exit 0
 // from `<agent> --version` means the CLI is installed AND actually runs), but non-blocking
@@ -937,7 +942,11 @@ const availableByVersionProbeAsync = (command) => new Promise((resolve) => {
     let settled = false;
     let timer;
     let child;
-    const chunks = [];
+    // Issue #1256 (AC-D1/D2): kept as separate stdout/stderr buffers rather than one combined
+    // buffer, so a broken CLI that exits 0 while writing only to stderr cannot have its error
+    // text mistaken for a version string.
+    const stdoutChunks = [];
+    const stderrChunks = [];
     const finish = (value) => {
         if (settled)
             return;
@@ -951,8 +960,8 @@ const availableByVersionProbeAsync = (command) => new Promise((resolve) => {
             env: versionProbeEnv(),
             stdio: ['ignore', 'pipe', 'pipe'],
         });
-        child.stdout?.on('data', (chunk) => chunks.push(chunk));
-        child.stderr?.on('data', (chunk) => chunks.push(chunk));
+        child.stdout?.on('data', (chunk) => stdoutChunks.push(chunk));
+        child.stderr?.on('data', (chunk) => stderrChunks.push(chunk));
         timer = setTimeout(() => {
             console.warn(`[ai-hub] agent version probe timed out after ${VERSION_PROBE_TIMEOUT_MS}ms: ${command}`);
             try {
@@ -965,8 +974,9 @@ const availableByVersionProbeAsync = (command) => new Promise((resolve) => {
         timer.unref?.();
         child.on('error', () => finish(null));
         child.on('close', (code) => {
-            const raw = Buffer.concat(chunks).toString('utf8').trim();
-            finish(code === 0 ? (raw || null) : null);
+            const stdout = Buffer.concat(stdoutChunks).toString('utf8');
+            const stderr = Buffer.concat(stderrChunks).toString('utf8');
+            finish(code === 0 ? (0, managed_agent_paths_1.versionFromProbeOutput)(stdout, stderr) : null);
         });
     }
     catch {
@@ -1158,6 +1168,16 @@ function buildEmployeeStatus(id, version) {
         supportsRaw: supportsDirectPath(id),
     };
 }
+/**
+ * Issue #1256 (slice b, AC-B1): true when a background re-probe is currently in flight —
+ * i.e. the most recent detectEmployees()/detectEmployeesAsync() answer may have been served
+ * from a stale persisted snapshot rather than a fresh probe. bootstrapResponse reads this
+ * right after detection so the client can be told to poll again shortly instead of latching
+ * a one-shot answer.
+ */
+function isEmployeeDetectionRefreshing() {
+    return inFlightDetection !== null;
+}
 /**
  * Non-blocking employee detection. Probes every agent CONCURRENTLY, so the cost is the
  * slowest single probe rather than the sum of all of them, and the event loop stays free
@@ -2140,6 +2160,11 @@ class CliHostRuntime {
     detectEmployeesAsync() {
         return detectEmployeesAsync();
     }
+    // Issue #1256 (slice b): lets bootstrapResponse tell the client whether the roster it just
+    // served may be stale while a background re-probe lands.
+    isEmployeeDetectionRefreshing() {
+        return isEmployeeDetectionRefreshing();
+    }
     startRun(hostId, projectPath, message, handlers, sessionId, launchContext) {
         // R11: start/startDirect mint sessions rather than resuming one, so they
         // stay outside the continuation queue entirely.

package/dist/src/ai-hub/server.js

@@ -41,6 +41,8 @@ exports.selfHealBrokenManagedAgents = selfHealBrokenManagedAgents;
 exports.configureFraimForHubAgent = configureFraimForHubAgent;
 exports.installAgentAndRefreshDetection = installAgentAndRefreshDetection;
 exports.hubCommandVersion = hubCommandVersion;
+exports.__setAgentInstallTimeoutMsForTests = __setAgentInstallTimeoutMsForTests;
+exports.hubRunProcess = hubRunProcess;
 exports.buildOpenFileInvocation = buildOpenFileInvocation;
 const express_1 = __importDefault(require("express"));
 const path_1 = __importDefault(require("path"));
@@ -56,6 +58,9 @@ const brand_store_1 = require("../core/brand-store");
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
 const catalog_1 = require("./catalog");
 const job_visualization_1 = require("../core/job-visualization");
+// Issue #1491: reserved sentinel phase a recurring job parks at between
+// scheduled checks (registry/delivery/recurring-checkpoint.md).
+const resolve_phase_edge_1 = require("../core/resolve-phase-edge");
 const custom_employees_1 = require("./custom-employees");
 const agent_token_prices_1 = require("../local-mcp-server/agent-token-prices");
 const hosts_1 = require("./hosts");
@@ -281,6 +286,12 @@ const MACHINE_LEVEL_JOB_IDS = new Set([
 const DEFAULT_CONVERSATION_FLUSH_DELAY_MS = 2000;
 const HUB_RESTART_RECOVERY_LOCK_TIMEOUT_MS = 5000;
 const HUB_RESTART_RECOVERY_LOCK_STALE_MS = 10000;
+// The complete catalog (fraim/ai-employee/jobs + the registry/ source fallback), used
+// everywhere the Hub needs to know about every job it could ever offer or resolve —
+// state.bootstrap.jobs, the firstRun job count, and resolveHubJob. A caller that omits
+// includeRegistry only sees the synced fraim/ layer, which is empty for a project (like
+// this repo) that runs against source registry/ content before it has been synced.
+const FULL_JOB_CATALOG_OPTIONS = { includeRegistry: true };
 function conversationFlushDelayMs() {
     const configured = Number(process.env.FRAIM_HUB_CONVERSATION_FLUSH_MS);
     if (Number.isFinite(configured) && configured >= 0)
@@ -1674,6 +1685,12 @@ function applySeekMentoringSignal(run, signal) {
             applyReviewHandoffToRun(run, signal.reviewHandoff);
         verifyReviewHandoffReflectsSubmission(run, signal.reviewHandoff, isCrossJob ? callJobName : null);
     }
+    else if (!isCrossJob) {
+        // Issue #1501: No reviewHandoff in this same-job call. Clear any prior reviewHandoff so
+        // run.reviewHandoff always reflects the most recent seekMentoring intent,
+        // not a stale flag from an earlier submit phase.
+        run.reviewHandoff = null;
+    }
     if (isCrossJob)
         return;
     // Issue #848: capture the issue number the call carries so a launched follow-on
@@ -1929,25 +1946,32 @@ function hubCommandVersion(command, extraBinDirs, basePath) {
     if (process.env.NODE_ENV === 'test' && process.env.FRAIM_TEST_HUB_COMMAND_VERSION_EMPTY === '1') {
         return null;
     }
-    const pathValue = extraBinDirs && extraBinDirs.length > 0
+    const suppliedPath = extraBinDirs && extraBinDirs.length > 0
         ? (0, managed_agent_paths_1.appendBinDirsToPath)(basePath ?? process.env.PATH, extraBinDirs)
         : basePath;
+    // Issue #1256 (AC-A3/AC-C3): route through the same shared recovery helper the version
+    // probe (hosts.ts) and fraim doctor use, so both callers of this function — the install
+    // route's existing-version check and check-agent — find a CLI installed outside FRAIM's
+    // own managed directory (npm-global, ~/.local/bin, a vendor installer) exactly like the
+    // probe does. A strict superset of whatever `suppliedPath`/`process.env.PATH` already had.
+    const recoveredPath = (0, managed_agent_paths_1.buildRecoveredAgentPath)(suppliedPath ?? process.env.PATH);
     // Issue #1284/#1285 (Defect D, §0): resolve to a real absolute path — with
     // project-local node_modules/.bin stripped — instead of handing the bare
     // command name to cmd.exe's own PATH search, which does not exclude those
     // shims. Falls back to the bare command (today's behavior, resolves to
     // null below) when no system install is found on the constructed PATH.
-    const resolvedCommand = (0, command_resolution_1.getSystemCommandPath)(command, pathValue ?? process.env.PATH) || command;
+    const resolvedCommand = (0, command_resolution_1.getSystemCommandPath)(command, recoveredPath) || command;
     const executable = process.platform === 'win32' ? 'cmd.exe' : resolvedCommand;
     const args = process.platform === 'win32'
         ? ['/d', '/s', '/c', `${(0, hosts_1.escapeWindowsArg)(resolvedCommand)} --version`]
         : ['--version'];
-    const env = pathValue === undefined ? undefined : { ...process.env, PATH: pathValue };
-    const result = (0, child_process_1.spawnSync)(executable, args, { encoding: 'utf8', timeout: 5000, ...(env ? { env } : {}) });
+    // Issue #1256: set both casings — see the matching comment in resolveNpmGlobalBinDirs().
+    const env = { ...process.env, PATH: recoveredPath, Path: recoveredPath };
+    const result = (0, child_process_1.spawnSync)(executable, args, { encoding: 'utf8', timeout: 5000, env });
     if (result.status !== 0 || result.error)
         return null;
-    const raw = (result.stdout || result.stderr || '').trim();
-    return raw || null;
+    // Issue #1256 (AC-D1/D2): only stdout counts as a version — see versionFromProbeOutput.
+    return (0, managed_agent_paths_1.versionFromProbeOutput)(result.stdout, result.stderr);
 }
 function hubRunSync(command, args, env) {
     const resolvedCommand = (0, command_resolution_1.getSystemCommandPath)(command, process.env.PATH) || command;
@@ -1974,6 +1998,22 @@ function hubRunSync(command, args, env) {
         ...(result.error ? { error: result.error } : {}),
     };
 }
+// Issue #1256 (slice c, AC-C1/AC-C4): the root cause of "Installing…" hanging forever.
+// hubRunProcess runs the actual `npm install -g <package>` behind the install-agent route,
+// and previously had NO bound — only `close` resolved the promise. A stalled npm (registry
+// timeout, an interactive auth prompt with nothing to answer it, a proxy stall) never closed,
+// so this promise never settled, the route handler's `await` never returned, and the client's
+// button stayed greyed at "Installing…" with no way back. 90s is generous for a real install
+// (typically seconds) while still bounding the failure the way AC-C1 requires.
+const DEFAULT_AGENT_INSTALL_TIMEOUT_MS = 90_000;
+let agentInstallTimeoutMs = DEFAULT_AGENT_INSTALL_TIMEOUT_MS;
+/** Test seam only. Mirrors __setEmployeeDetectionTtlForTests in hosts.ts — proves the bound
+ * actually fires without a real 90s hang. Pass null to restore the production value. */
+function __setAgentInstallTimeoutMsForTests(ms) {
+    agentInstallTimeoutMs = ms ?? DEFAULT_AGENT_INSTALL_TIMEOUT_MS;
+}
+// Exported for direct unit testing (issue #1256, AC-C1/AC-C4): asserting a process that never
+// closes still rejects within the bound, without needing a real 90s-hanging npm install.
 function hubRunProcess(command, args, env) {
     if (process.env.NODE_ENV === 'test' && command === 'npm' && process.env.FRAIM_TEST_HUB_NPM_ERROR) {
         return Promise.reject(new Error(process.env.FRAIM_TEST_HUB_NPM_ERROR));
@@ -1995,15 +2035,46 @@ function hubRunProcess(command, args, env) {
         });
         let stdout = '';
         let stderr = '';
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            // Issue #1256: tree-kill, not child.kill() — on win32 `child` is the cmd.exe wrapper
+            // (see realCmd/realArgs above); killing only that leaves the real supervised process
+            // (e.g. npm.exe, or a grandchild it spawns) running as an orphan, and — since cmd.exe
+            // typically shares its stdout/stderr pipe handles with what it launches — can keep
+            // those pipes open after the wrapper dies, which is exactly what stopped this promise's
+            // own process from exiting cleanly during this phase's validation run. Same pattern as
+            // HostProcessRegistry.stop() above.
+            if (child.pid != null) {
+                try {
+                    (0, tree_kill_1.default)(child.pid, 'SIGTERM');
+                }
+                catch { /* already gone */ }
+            }
+            reject(new Error(`${command} ${args.join(' ')} did not complete within ${agentInstallTimeoutMs / 1000}s.`));
+        }, agentInstallTimeoutMs);
+        timer.unref?.();
         child.stdout.on('data', (d) => { stdout += d.toString(); });
         child.stderr.on('data', (d) => { stderr += d.toString(); });
         child.on('close', (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
             if (code === 0)
                 resolve({ stdout, stderr });
             else
                 reject(new Error(stderr || `Process exited with code ${code}`));
         });
-        child.on('error', reject);
+        child.on('error', (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(error);
+        });
     });
 }
 function hubOpenTerminal(command) {
@@ -2566,6 +2637,15 @@ function classifyExit(run, exitCode) {
                 // real description, not the post-clear fallback.
                 return { action: 'resume', pauseReason: 'working', recoveryKind: 'background_task_lost', systemNote: describeKilledBackgroundTasks(run) };
             }
+            // Issue #1491: a non-final scheduled/webhook check parks at the reserved
+            // recurring-checkpoint sentinel by design (registry/delivery/recurring-checkpoint.md).
+            // This is not a human-decision gate — the scheduler resumes it on its own. Gated on
+            // sourceTrigger so a manager-initiated run that somehow lands on the sentinel phase
+            // (not expected in normal operation) keeps today's conservative awaiting_user default.
+            if (currentPhase === resolve_phase_edge_1.WAITING_FOR_NEXT_INVOCATION
+                && (run.sourceTrigger === 'scheduled' || run.sourceTrigger === 'webhook')) {
+                return { action: 'park', pauseReason: 'parked_recurring' };
+            }
             return { action: 'park', pauseReason: 'awaiting_user' };
         }
         if (compactingActive) {
@@ -2932,6 +3012,18 @@ class AiHubServer {
             }
         });
         this.registerRoutes();
+        // Issue #1477 R8: global error handler, registered after every route. Express's
+        // default handler for an error that escapes a route (e.g. the RangeError a
+        // JSON.stringify overflow used to throw from the conversations list route) renders
+        // an HTML page with the stack trace. This returns structured JSON instead — the
+        // stack still goes to the server log, never to the response.
+        this.app.use((err, _req, res, next) => {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error('[ai-hub] unhandled route error:', err instanceof Error ? err.stack : message);
+            if (res.headersSent)
+                return next(err);
+            res.status(500).json({ error: message });
+        });
     }
     getApp() {
         return this.app;
@@ -3192,8 +3284,7 @@ class AiHubServer {
             }
         }
         const project = (0, catalog_1.summarizeProject)(normalizedProjectPath);
-        const catalogOptions = { includeRegistry: true };
-        const rawJobs = (0, catalog_1.discoverEmployeeJobs)(normalizedProjectPath, catalogOptions);
+        const rawJobs = (0, catalog_1.discoverEmployeeJobs)(normalizedProjectPath, FULL_JOB_CATALOG_OPTIONS);
         // Issue #566 (R7): jobs already carry `personalized` from catalog discovery
         // (true for the fraim/personalized-employee layer). The Hub renders a plain
         // "Personalized" marking from that flag — no author/attribution is tracked.
@@ -3213,7 +3304,7 @@ class AiHubServer {
             ...job,
             requiredPersonaKey: getProtectedPersonaForHubJob(job.id) ?? GENERIC_WORKER_PERSONA_KEY,
         }));
-        const managerTemplates = (0, catalog_1.discoverManagerTemplates)(normalizedProjectPath, catalogOptions);
+        const managerTemplates = (0, catalog_1.discoverManagerTemplates)(normalizedProjectPath, FULL_JOB_CATALOG_OPTIONS);
         // Issue #750: the apiKey always comes from ~/.fraim/config.json — no header
         // override, no ai-hub-state.json copy, no fallback chain.
         const resolvedApiKey = resolveApiKey();
@@ -3261,11 +3352,15 @@ class AiHubServer {
             // ~/.fraim/config.json, so public/ai-hub/script.js's existing
             // tfConnectedApiKey()/tfConnectedSurfaceUrl read path needs no changes.
             preferences: { ...preferences, apiKey: resolvedApiKey },
-            categories: (0, catalog_1.getAiHubCategories)(normalizedProjectPath, catalogOptions),
+            categories: (0, catalog_1.getAiHubCategories)(normalizedProjectPath, FULL_JOB_CATALOG_OPTIONS),
             jobs,
             internalJobs,
             managerTemplates,
             employees,
+            // Issue #1256 (slice b, AC-B1): true when `employees` above may be a stale persisted
+            // snapshot while a background re-probe is in flight. The client uses this to schedule
+            // a bounded follow-up refresh instead of trusting a one-shot bootstrap forever.
+            employeesRefreshing: this.hostRuntime.isEmployeeDetectionRefreshing?.() ?? false,
             configuredAgents,
             personas,
             // Issue #1005: lets the client tell a resolved projection from the first-paint
@@ -4585,7 +4680,13 @@ class AiHubServer {
     resolveHubJob(projectPath, jobId) {
         if (!jobId || jobId === '__freeform__')
             return null;
-        const employeeJob = (0, catalog_1.discoverEmployeeJobs)(projectPath).find((job) => job.id === jobId);
+        // Issue #1477: include the source registry/ fallback, matching FULL_JOB_CATALOG_OPTIONS
+        // used to build state.bootstrap.jobs (the list the UI's job pickers, including the
+        // New Assignment modal, actually offer). Without it, a job that only ships from
+        // registry/ (never synced into fraim/ai-employee/jobs, as on the FRAIM repo itself)
+        // was selectable in the UI but unresolvable here — the exact gap that let
+        // travel-fare-watch's title/persona silently fail to resolve at fire time.
+        const employeeJob = (0, catalog_1.discoverEmployeeJobs)(projectPath, FULL_JOB_CATALOG_OPTIONS).find((job) => job.id === jobId);
         if (employeeJob) {
             return {
                 id: employeeJob.id,
@@ -4594,7 +4695,7 @@ class AiHubServer {
                 personaKey: employeeJob.requiredPersonaKey ?? getCustomPersonaForJob(projectPath, employeeJob.id) ?? getHubPersonaForJob(employeeJob.id),
             };
         }
-        const managerTemplate = (0, catalog_1.discoverManagerTemplates)(projectPath).find((job) => job.id === jobId);
+        const managerTemplate = (0, catalog_1.discoverManagerTemplates)(projectPath, FULL_JOB_CATALOG_OPTIONS).find((job) => job.id === jobId);
         if (managerTemplate) {
             return {
                 id: managerTemplate.id,
@@ -4605,6 +4706,16 @@ class AiHubServer {
         }
         return null;
     }
+    // Issue #1477 R1-R3: shared 400 message for a schedules jobId that doesn't resolve
+    // to a catalog entry. Names the correct shape (catalog slug) and explicitly rules out
+    // the per-run tracking UUID get_fraim_job prints, since that UUID was mistaken for
+    // this field in the reported repro.
+    invalidScheduleJobIdError(jobId) {
+        return {
+            error: `Unknown jobId "${String(jobId)}". jobId must be a catalog job slug (e.g. "travel-fare-watch") ` +
+                'from the Hub job catalog, not the per-run tracking UUID returned by get_fraim_job\'s "Job ID" field.',
+        };
+    }
     applySeekMentoringSignalToRun(run, signal) {
         // Issue #732: promote using the stable jobName slug, not the per-call UUID
         // jobId (resolveHubJob would never match a UUID, leaving a freeform run
@@ -5031,7 +5142,7 @@ class AiHubServer {
             // not to the directory the Hub launched from.
             const { personas, subscriptionActive, workspaceId, userKey, identityAuthoritative } = await this.computePersonas(apiKey, managerTeamPromise, projectPath);
             const managerTeam = await managerTeamPromise;
-            const jobCount = (0, catalog_1.discoverEmployeeJobs)(projectPath, { includeRegistry: true })
+            const jobCount = (0, catalog_1.discoverEmployeeJobs)(projectPath, FULL_JOB_CATALOG_OPTIONS)
                 .filter((job) => !FRAIM_INTERNAL_JOB_IDS.has(job.id))
                 .length;
             res.json({
@@ -5171,7 +5282,6 @@ class AiHubServer {
             // Issue #820: lazy read surfaces so the UI never has to parse the whole store.
             // ?conversationId=<id> -> one full body (lazy load on open).
             // ?headersOnly=1 -> newest-first headers, no bodies (fast list / first paint).
-            // (default) -> full project (backwards compatible).
             if (conversationId) {
                 const conversation = this.conversationStore.loadConversation(key, conversationId);
                 if (!conversation)
@@ -5184,12 +5294,28 @@ class AiHubServer {
                 // Issue #1090: ownership is derived on read, never served from the frozen record.
                 return res.json({ projectPath: key, scope: scope ?? 'project', conversation: withDerivedPersona(withFreshStages, key), source: 'disk' });
             }
+            // Issue #1477 R6: a project-scoped list request (no conversationId) always serves
+            // headers only now, never the full project body — the removed full-payload branch
+            // could exceed V8's max string length in JSON.stringify once a project's
+            // conversation store accumulates enough embedded message/event content, which
+            // reached the client as an unhandled RangeError rendered as a raw HTML stack trace.
+            // forcedHeadersOnly tells the caller this response is headers-only regardless of
+            // whether it asked for headersOnly=1. Scope-based (manager/company) buckets are
+            // unaffected and keep the headersOnly/full-body branches below.
+            if (!scope) {
+                const customOwners = buildCustomJobOwnerIndex(key);
+                const headers = this.conversationStore.loadProjectHeaders(key)
+                    .map((header) => withDerivedPersona(header, key, customOwners));
+                const activeId = this.conversationStore.loadProjectActiveId(key);
+                return res.json({ projectPath: key, scope: 'project', activeId, headersOnly: true, forcedHeadersOnly: true, conversations: headers, source: 'disk' });
+            }
             if (req.query.headersOnly === '1' || req.query.headersOnly === 'true') {
                 // One disk walk for the whole list, not one per conversation.
                 const customOwners = buildCustomJobOwnerIndex(key);
                 const headers = this.conversationStore.loadProjectHeaders(key)
                     .map((header) => withDerivedPersona(header, key, customOwners));
-                return res.json({ projectPath: key, scope: scope ?? 'project', headersOnly: true, conversations: headers, source: 'disk' });
+                const activeId = this.conversationStore.loadProjectActiveId(key);
+                return res.json({ projectPath: key, scope, activeId, headersOnly: true, conversations: headers, source: 'disk' });
             }
             const loaded = this.conversationStore.loadProject(key);
             const fullCustomOwners = buildCustomJobOwnerIndex(key);
@@ -5197,7 +5323,7 @@ class AiHubServer {
                 ...loaded,
                 conversations: (loaded.conversations || []).map((conversation) => withDerivedPersona(conversation, key, fullCustomOwners)),
             };
-            return res.json({ projectPath: key, scope: scope ?? 'project', ...derived, source: 'disk' });
+            return res.json({ projectPath: key, scope, ...derived, source: 'disk' });
         });
         this.app.put('/api/ai-hub/conversations', (req, res) => {
             try {
@@ -6987,6 +7113,12 @@ class AiHubServer {
             catch (err) {
                 return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid schedule request.' });
             }
+            // Issue #1477 R1/R2: reject a jobId that doesn't resolve to a known catalog entry
+            // (e.g. the per-run tracking UUID from get_fraim_job, mistaken for this field in
+            // the reported repro) before the deployment is ever persisted.
+            if (!this.resolveHubJob(resolvedProjectPath, jobId)) {
+                return res.status(400).json(this.invalidScheduleJobIdError(jobId));
+            }
             const normalizedConversationId = typeof conversationId === 'string' && conversationId.trim()
                 ? conversationId.trim()
                 : undefined;
@@ -7084,6 +7216,11 @@ class AiHubServer {
             const existing = this.deploymentStore.load().find((d) => d.id === id && d.type === 'scheduled');
             if (!existing)
                 return res.status(404).json({ error: 'Deployment not found.' });
+            // Issue #1477 R3: same catalog validation as create, applied only when jobId is
+            // actually part of this update.
+            if (jobId !== undefined && !this.resolveHubJob(resolvedProjectPath !== undefined ? resolvedProjectPath : existing.projectPath, jobId)) {
+                return res.status(400).json(this.invalidScheduleJobIdError(jobId));
+            }
             const nextHostId = hostId !== undefined && validEmployees.includes(hostId) ? hostId : existing.hostId;
             const nextConfiguredAgentId = configuredAgentId !== undefined
                 ? (typeof configuredAgentId === 'string' && configuredAgentId.trim() ? configuredAgentId.trim() : undefined)

package/dist/src/cli/doctor/checks/agent-cli-health-checks.js

@@ -45,7 +45,8 @@ function probeVersion(commandPath) {
         const result = (0, child_process_1.spawnSync)(executable, args, { encoding: 'utf8', timeout: 5000 });
         if (result.status !== 0 || result.error)
             return null;
-        return (result.stdout || result.stderr || '').trim() || null;
+        // Issue #1256 (AC-D1/D2): only stdout counts as a version — see versionFromProbeOutput.
+        return (0, managed_agent_paths_1.versionFromProbeOutput)(result.stdout, result.stderr);
     }
     catch {
         return null;
@@ -86,9 +87,32 @@ async function runAgentCliHealthCheck(cli) {
     const managedSearchPath = (0, managed_agent_paths_1.buildPathWithManagedAgentBins)(process.env.PATH);
     const managedPath = (0, command_resolution_1.getSystemCommandPath)(cli.command, managedSearchPath);
     if (!ambientPath && !managedPath) {
+        // Issue #1256 (AC-A3): before concluding the CLI is absent, try the same shared
+        // location-agnostic recovery the Hub's version probe and check-agent route use. This
+        // only changes the answer for a CLI this process's raw/managed PATH cannot see at all
+        // (e.g. doctor itself invoked from a PATH-truncated context) — it never overrides a
+        // drift verdict computed from a real ambient/managed hit above.
+        const recoveredSearchPath = (0, managed_agent_paths_1.buildRecoveredAgentPath)(process.env.PATH);
+        const recoveredPath = (0, command_resolution_1.getSystemCommandPath)(cli.command, recoveredSearchPath);
+        if (!recoveredPath) {
+            return {
+                status: 'passed',
+                message: `${cli.label} is not installed; nothing to check.`,
+            };
+        }
+        const recoveredVersion = probeVersion(recoveredPath);
+        if (!recoveredVersion) {
+            return {
+                status: 'error',
+                message: `${cli.label} is installed at ${recoveredPath} but failed to run (\`${cli.command} --version\` produced no output).`,
+                suggestion: `Reinstall ${cli.label}, then run "${cli.command} --version" again to confirm it's fixed.`,
+                details: { recoveredPath },
+            };
+        }
         return {
             status: 'passed',
-            message: `${cli.label} is not installed; nothing to check.`,
+            message: `${cli.label} is consistent (${recoveredVersion}).`,
+            details: { recoveredPath, recoveredVersion },
         };
     }
     const ambientVersion = ambientPath ? probeVersion(ambientPath) : null;

package/dist/src/cli/setup/ide-detector.js

@@ -3,12 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.expandPath = exports.findIDEByName = exports.getAllSupportedIDEs = exports.detectInstalledIDEs = exports.CLI_PROBE_CONFIGTYPES = exports.IDE_CONFIGS = void 0;
+exports.expandPath = exports.findIDEByName = exports.getAllSupportedIDEs = exports.detectInstalledIDEs = exports.CLI_PROBE_CONFIGTYPES = exports.IDE_CONFIGS = exports.detectCodexDesktop = exports.CODEX_DESKTOP_DOWNLOAD_URL = exports.CODEX_DESKTOP_BUNDLE_ID = void 0;
 exports.getAdapterConfigType = getAdapterConfigType;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const child_process_1 = require("child_process");
+const managed_agent_paths_1 = require("../utils/managed-agent-paths");
 /** Returns the configType to use for adapter file filtering. Falls back to configType when adapterConfigType is not set. */
 function getAdapterConfigType(ide) {
     return ide.adapterConfigType ?? ide.configType;
@@ -78,10 +79,12 @@ const guiAppDetect = (configSurfaceCheck, appName, options = {}) => {
 const availableByVersionProbe = (command) => {
     if (process.env.FRAIM_DETECT_DISABLE_CLI_PROBES === '1')
         return false;
+    const recoveredPath = (0, managed_agent_paths_1.buildRecoveredAgentPath)(process.env.PATH ?? process.env.Path);
+    const env = { ...process.env, PATH: recoveredPath, Path: recoveredPath };
     const result = process.platform === 'win32'
-        ? (0, child_process_1.spawnSync)('cmd.exe', ['/d', '/s', '/c', `${command} --version`], { encoding: 'utf8', timeout: 1500 })
-        : (0, child_process_1.spawnSync)(command, ['--version'], { encoding: 'utf8', timeout: 1500 });
-    return result.status === 0;
+        ? (0, child_process_1.spawnSync)('cmd.exe', ['/d', '/s', '/c', `${command} --version`], { encoding: 'utf8', timeout: 1500, env })
+        : (0, child_process_1.spawnSync)(command, ['--version'], { encoding: 'utf8', timeout: 1500, env });
+    return result.status === 0 && !result.error && (0, managed_agent_paths_1.versionFromProbeOutput)(result.stdout, result.stderr) !== null;
 };
 const detectClaude = () => {
     const paths = [
@@ -151,6 +154,73 @@ const detectCodexSurface = () => {
     ];
     return checkMultiplePaths(paths);
 };
+// Issue #1478: OpenAI folded the standalone Codex desktop app into the unified
+// ChatGPT desktop app (Codex is now a view inside it). That app has no CLI
+// config folder to detect and, unlike Claude Desktop, no local MCP config
+// file for FRAIM to bootstrap — so it is intentionally NOT an IDE_CONFIGS
+// entry. Adding it there would flow into ~13 other detectInstalledIDEs()
+// consumers (auto-mcp-setup, doctor checks, add-ide, sync, init-project) that
+// all assume every catalog entry is MCP-configurable, producing a false
+// "Unsupported config type" failure for a product that was never meant to
+// have one. Detection here is standalone; callers splice its result directly
+// into the surfaces/rows that need it (see session-service.ts).
+//
+// Detection matches a stable package/bundle identity, not a display name or
+// guessed path — openai/codex#32631 documents the Codex CLI's own equivalent
+// bug (searching for the old name `Codex.app`, broken by the rename to
+// `ChatGPT.app`) as the live precedent for why name/path matching fails.
+exports.CODEX_DESKTOP_BUNDLE_ID = 'com.openai.codex';
+// detectCodexDesktop() runs on every platform, so this row renders for
+// macOS/Windows/Linux users alike — a platform-specific doc page (e.g. the
+// Windows-only install guide) would be wrong for everyone else. Use OpenAI's
+// own universal download page, matching every sibling IDE_CONFIGS entry's
+// convention of linking the vendor's own top-level product/download page,
+// not a platform subpage (e.g. `claude.ai/download`, `cursor.com`).
+exports.CODEX_DESKTOP_DOWNLOAD_URL = 'https://chatgpt.com/download/';
+const detectCodexDesktopMac = () => {
+    if (process.env.FRAIM_DETECT_DISABLE_PROCESS_CHECK === '1')
+        return false;
+    const result = (0, child_process_1.spawnSync)('mdfind', [`kMDItemCFBundleIdentifier == '${exports.CODEX_DESKTOP_BUNDLE_ID}'`], { encoding: 'utf8', timeout: 2000 });
+    return result.status === 0 && Boolean((result.stdout || '').trim());
+};
+const detectCodexDesktopWindows = () => {
+    if (process.env.FRAIM_DETECT_DISABLE_PROCESS_CHECK === '1')
+        return false;
+    // The exact PackageFamilyName for the ChatGPT desktop app's MSIX package
+    // (Store ProductId 9PLM9XGG6VKS) is not yet confirmed against a real install
+    // (spec Open Question #2) — Get-AppxPackage's own `Name` property (a fixed
+    // publisher-assigned identifier, distinct from the mutable Start-menu
+    // display name) is queried by a name pattern as the best-available proxy.
+    const psCmd = `(Get-AppxPackage | Where-Object { $_.Name -like '*ChatGPT*' } | Select-Object -First 1).PackageFamilyName`;
+    const result = (0, child_process_1.spawnSync)('powershell', ['-NoProfile', '-NonInteractive', '-Command', psCmd], { encoding: 'utf8', timeout: 3000 });
+    return result.status === 0 && Boolean((result.stdout || '').trim());
+};
+const detectCodexDesktopOverride = () => {
+    const value = process.env.FRAIM_DETECT_CODEX_DESKTOP_OVERRIDE;
+    if (value === '1')
+        return true;
+    if (value === '0')
+        return false;
+    return null;
+};
+/**
+ * Issue #1478 R1: detects the Codex view inside OpenAI's ChatGPT desktop app,
+ * independent of IDE_CONFIGS (see comment above). Linux is not yet
+ * implemented — the app is a public preview (Aug 2026) with no confirmed
+ * package identity (spec Open Question #1); this is a deliberate, documented
+ * scope boundary, not an oversight.
+ */
+const detectCodexDesktop = () => {
+    const override = detectCodexDesktopOverride();
+    if (override !== null)
+        return override;
+    if (process.platform === 'darwin')
+        return detectCodexDesktopMac();
+    if (process.platform === 'win32')
+        return detectCodexDesktopWindows();
+    return false;
+};
+exports.detectCodexDesktop = detectCodexDesktop;
 const detectGrokSurface = () => {
     const paths = [
         '~/.grok',