fraim-hub 2.0.342 → 2.0.344

package/dist/src/ai-hub/attachment-store.js

@@ -36,109 +36,142 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AttachmentRejectedError = exports.MAX_ATTACHMENTS_PER_SEND = exports.MAX_UPLOAD_BODY_BYTES = exports.MAX_ATTACHMENT_BYTES = exports.ACCEPTED_ATTACHMENT_MIME_TYPES = void 0;
+exports.AttachmentRejectedError = exports.MAX_ATTACHMENTS_PER_SEND = exports.MAX_ATTACHMENT_BYTES = void 0;
+exports.attachmentPolicy = attachmentPolicy;
 exports.assertAttachmentUploadAllowed = assertAttachmentUploadAllowed;
-exports.sanitizeAttachmentBuffer = sanitizeAttachmentBuffer;
+exports.streamAttachment = streamAttachment;
+exports.sanitizeAttachmentFile = sanitizeAttachmentFile;
+exports.storedAttachmentBytes = storedAttachmentBytes;
 exports.safeAttachmentBaseName = safeAttachmentBaseName;
 exports.attachmentDiskFilename = attachmentDiskFilename;
 exports.safeAttachmentMetaPath = safeAttachmentMetaPath;
-/**
- * Hub message attachments — Issue #1651 (Hub attachments and screenshots).
- *
- * Deterministic, dependency-isolated helpers for validating and sanitizing a
- * manager-uploaded attachment before it ever reaches disk. Kept separate from
- * `server.ts` so the route handler stays a thin composition of these pure
- * steps (architecture-standards §2/§3).
- *
- * Security posture (spec R10/R11, technical design "Sanitization"): an
- * uploaded file is untrusted input. Images are re-encoded (not merely
- * renamed/copied) via `sharp`, which strips any non-pixel payload — embedded
- * scripts, polyglot content appended after the image's real end-of-data
- * marker — as an inherent side effect of decoding + re-encoding pixel data.
- * PDFs are scanned for `/JavaScript` / `/JS` object markers and rejected if
- * found; this is a narrow heuristic, not a full sanitizer (documented as a
- * known limitation in the technical design, not a claimed complete defense).
- * Plain text/log files are stored unmodified — this delivery model (R12)
- * never renders or executes attachment content, only hands the agent a file
- * path its own file-read tool opens.
- */
+/** Bounded, conversation-owned opaque attachment storage. */
 const path_1 = __importDefault(require("path"));
-/** Accepted upload MIME types (spec R1/R11). */
-exports.ACCEPTED_ATTACHMENT_MIME_TYPES = new Set([
-    'image/png',
-    'image/jpeg',
-    'image/gif',
-    'application/pdf',
-    'text/plain',
-]);
-const IMAGE_MIME_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif']);
-/** Per-file cap (spec R5/R11): matches the client-side pre-check exactly. */
-exports.MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
-/**
- * Server route body-size cap (technical design "Server-side enforcement"): 1 MB
- * headroom above `MAX_ATTACHMENT_BYTES` absorbs transfer overhead. The 10 MB
- * per-file cap itself is still enforced explicitly against the decoded body
- * length so a file just under this outer limit but over the real cap is a
- * clean 413, not a silent accept.
- */
-exports.MAX_UPLOAD_BODY_BYTES = 11 * 1024 * 1024;
-/** Design-owned bound (technical design "Count/size bounds not specified by the spec"). */
+const fs_1 = __importDefault(require("fs"));
+exports.MAX_ATTACHMENT_BYTES = 500_000_000;
 exports.MAX_ATTACHMENTS_PER_SEND = 5;
-/** Thrown by validation/sanitization for a request-level (never a server-fault) rejection. */
+function attachmentPolicy(value = process.env.FRAIM_HUB_MAX_ATTACHMENT_MB) {
+    if (value !== undefined && (!/^[0-9]+$/.test(value) || Number(value) < 1 || Number(value) > 2000)) {
+        throw new Error('Invalid FRAIM_HUB_MAX_ATTACHMENT_MB: expected an integer from 1 through 2000.');
+    }
+    return { maxFileBytes: value === undefined ? exports.MAX_ATTACHMENT_BYTES : Number(value) * 1_000_000, maxFilesPerSend: exports.MAX_ATTACHMENTS_PER_SEND };
+}
 class AttachmentRejectedError extends Error {
     constructor(status, message) {
         super(message);
-        this.name = 'AttachmentRejectedError';
         this.status = status;
+        this.name = 'AttachmentRejectedError';
     }
 }
 exports.AttachmentRejectedError = AttachmentRejectedError;
-/** R11: server-side size/type enforcement, independent of the client-side R5 check. */
-function assertAttachmentUploadAllowed(mimeType, sizeBytes) {
-    if (!exports.ACCEPTED_ATTACHMENT_MIME_TYPES.has(mimeType)) {
-        throw new AttachmentRejectedError(415, `Unsupported attachment type: ${mimeType || '(none)'}`);
+function assertAttachmentUploadAllowed(sizeBytes, maxFileBytes = exports.MAX_ATTACHMENT_BYTES) {
+    if (sizeBytes > maxFileBytes)
+        throw new AttachmentRejectedError(413, 'Attachment exceeds the ' + maxFileBytes / 1_000_000 + ' MB limit. Choose a smaller file or increase FRAIM_HUB_MAX_ATTACHMENT_MB.');
+}
+/** Backpressure limits pending bytes; early rejection keeps the socket available for a 413. */
+async function streamAttachment(request, destination, maxFileBytes, onBytes) {
+    const file = await fs_1.default.promises.open(destination, 'wx');
+    let bytes = 0;
+    try {
+        for await (const chunk of request.iterator({ destroyOnReturn: false })) {
+            bytes += chunk.length;
+            onBytes(bytes);
+            assertAttachmentUploadAllowed(bytes, maxFileBytes);
+            let offset = 0;
+            while (offset < chunk.length) {
+                const result = await file.write(chunk, offset, chunk.length - offset);
+                offset += result.bytesWritten;
+            }
+        }
+        if (bytes === 0)
+            throw new AttachmentRejectedError(400, 'Expected a non-empty binary request body.');
+        return bytes;
     }
-    if (sizeBytes > exports.MAX_ATTACHMENT_BYTES) {
-        throw new AttachmentRejectedError(413, `Attachment exceeds the ${exports.MAX_ATTACHMENT_BYTES / (1024 * 1024)} MB limit.`);
+    finally {
+        await file.close();
     }
 }
-/**
- * PDF `/JavaScript` or `/JS` object-marker scan (technical design "Sanitization").
- * Deliberately narrow: this is a reject-on-suspicious-marker gate, not a full
- * PDF parser or sanitizer — sufficient because R1 requires only safe storage
- * and a later file-path handoff to the agent (R12), never PDF rendering.
- */
-function pdfContainsScriptMarker(buffer) {
-    // Scan the raw bytes as latin1 so multi-byte content can't hide a marker;
-    // PDF object names are always ASCII (`/JavaScript`, `/JS`).
-    const text = buffer.toString('latin1');
-    return /\/JavaScript\b/.test(text) || /\/JS\b/.test(text);
-}
-/**
- * Re-encode an image (stripping any non-pixel payload) or reject a suspicious
- * PDF. Text/plain passes through unmodified. Throws `AttachmentRejectedError`
- * for a PDF script marker or a buffer `sharp` cannot decode as a valid image.
- */
-async function sanitizeAttachmentBuffer(buffer, mimeType) {
-    if (IMAGE_MIME_TYPES.has(mimeType)) {
+/** Inspect content, never filename/MIME. The overlap preserves markers split across reads. */
+async function sanitizeAttachmentFile(input, imageOutput) {
+    const file = await fs_1.default.promises.open(input, 'r');
+    const prefix = Buffer.alloc(1024);
+    let prefixBytes;
+    try {
+        prefixBytes = (await file.read(prefix, 0, prefix.length, 0)).bytesRead;
+    }
+    finally {
+        await file.close();
+    }
+    const head = prefix.subarray(0, prefixBytes);
+    if (head.includes(Buffer.from('%PDF-'))) {
+        let tail = '';
+        for await (const chunk of fs_1.default.createReadStream(input)) {
+            const text = tail + chunk.toString('latin1');
+            // End-of-chunk is not a token boundary: /JavaScriptThing may continue next read.
+            if (/\/(?:JavaScript|JS)(?=\W)/.test(text))
+                throw new AttachmentRejectedError(415, 'PDF contains an embedded script marker and was rejected.');
+            tail = text.slice(-16);
+        }
+        if (/\/(?:JavaScript|JS)\b/.test(tail))
+            throw new AttachmentRejectedError(415, 'PDF contains an embedded script marker and was rejected.');
+    }
+    // SVG/XML and other active content never enter the image decoder or preview path.
+    const raster = head.subarray(0, 8).equals(Buffer.from('89504e470d0a1a0a', 'hex'))
+        || head.subarray(0, 3).equals(Buffer.from('ffd8ff', 'hex'))
+        || /^GIF8[79]a/.test(head.toString('latin1', 0, 6))
+        || (head.toString('ascii', 0, 4) === 'RIFF' && head.toString('ascii', 8, 12) === 'WEBP')
+        || head.subarray(0, 4).equals(Buffer.from('49492a00', 'hex'))
+        || head.subarray(0, 4).equals(Buffer.from('4d4d002a', 'hex'))
+        || (head.toString('ascii', 4, 8) === 'ftyp' && /^(avif|avis|heic|heix|mif1)$/.test(head.toString('ascii', 8, 12)));
+    if (raster) {
+        const sharp = (await Promise.resolve().then(() => __importStar(require('sharp')))).default;
+        let format;
         try {
-            const sharp = (await Promise.resolve().then(() => __importStar(require('sharp')))).default;
-            const format = mimeType === 'image/jpeg' ? 'jpeg' : mimeType === 'image/gif' ? 'gif' : 'png';
-            return await sharp(buffer).toFormat(format).toBuffer();
+            const decoder = sharp(input);
+            const metadata = await decoder.metadata();
+            // Decode all pixels before opening an output: malformed raster content remains opaque,
+            // while output/write failures below propagate as storage/sanitation failures.
+            await decoder.stats();
+            format = metadata.format === 'jpeg' ? 'jpeg' : metadata.format === 'gif' ? 'gif' : metadata.format === 'webp' ? 'webp' : 'png';
         }
-        catch (err) {
-            throw new AttachmentRejectedError(415, `Not a valid ${mimeType} image.`);
+        catch {
+            return { filePath: input, mimeType: 'application/octet-stream' };
         }
+        await sharp(input).toFormat(format).toFile(imageOutput);
+        return { filePath: imageOutput, mimeType: 'image/' + format };
     }
-    if (mimeType === 'application/pdf') {
-        if (pdfContainsScriptMarker(buffer)) {
-            throw new AttachmentRejectedError(415, 'PDF contains an embedded script marker and was rejected.');
+    return { filePath: input, mimeType: 'application/octet-stream' };
+}
+/** Snapshot persisted blobs only, excluding partials; reflects deletion and previous sessions. */
+async function storedAttachmentBytes(shardRoot) {
+    let total = 0;
+    async function walk(dir) {
+        let entries;
+        try {
+            entries = await fs_1.default.promises.readdir(dir, { withFileTypes: true });
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        for (const entry of entries) {
+            const fullPath = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory())
+                await walk(fullPath);
+            else if (entry.isFile() && entry.name.endsWith('.meta.json') && fullPath.includes(path_1.default.sep + 'attachments' + path_1.default.sep)) {
+                try {
+                    const metadata = JSON.parse(await fs_1.default.promises.readFile(fullPath, 'utf8'));
+                    const binary = path_1.default.resolve(dir, metadata.diskFilename);
+                    if (binary.startsWith(path_1.default.resolve(dir) + path_1.default.sep))
+                        total += (await fs_1.default.promises.stat(binary)).size;
+                }
+                catch { /* Concurrent deletion or incomplete legacy metadata is not a stored blob. */ }
+            }
         }
-        return buffer;
     }
-    // text/plain (the only remaining accepted type): no execution surface in
-    // this delivery model, stored as-is.
-    return buffer;
+    await walk(shardRoot);
+    return total;
 }
 /** Strip path separators/control characters and cap length for a disk-safe filename. */
 function safeAttachmentBaseName(filename) {

package/dist/src/ai-hub/catalog.js

@@ -16,41 +16,17 @@ const path_1 = __importDefault(require("path"));
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
 const resolve_phase_edge_1 = require("../core/resolve-phase-edge");
 const pack_home_1 = require("../cli/utils/pack-home");
-// Directories scanned for employee jobs at runtime, in lowest-to-highest
-// precedence order. Later entries win on {categoryId, jobId} collision.
-//
-// FRAIM execution normally reads three layers: the machine-level baseline
-// (shared across every project on this machine), the project-level synced
-// baseline, and the personalized override. The Hub can explicitly opt into the
-// source `registry/` fallback when running against the FRAIM repo before sync.
-//   - ~/.fraim/ai-employee/jobs/<category>/                   - machine-level baseline (issue #1644)
-//   - <project>/fraim/ai-employee/jobs/<category>/            - synced baseline
-//   - <project>/fraim/personalized-employee/jobs/<category>/  - taught/customized override
-// Only the personalized-employee layer is "personalized" (issue #566).
-//
-// Issue #1644: `fraim sync` Layer 1 (always runs, regardless of whether cwd is
-// a FRAIM project) writes baseline job stubs to ~/.fraim/ai-employee/jobs/ and
-// ~/.fraim/ai-manager/jobs/ so every project on the machine sees the current
-// catalog without its own project-level sync. This is the lowest-precedence
-// layer: a project- or personalized-level stub with the same id always wins.
-//
-// Resolved as a function, not a module-level constant: getUserFraimDirPath()
-// reads FRAIM_USER_DIR at call time, and callers (including tests that
-// isolate a temp machine home) need that resolved fresh on every discovery
-// call, not frozen at module-import time.
-function machineJobLayers(role) {
+// The machine catalog is authoritative once synced. Old project baseline copies
+// remain a compatibility fallback only while that role's machine catalog is
+// absent; otherwise removed jobs and stale phases could reappear after sync.
+// Personalized project, manager, and org layers continue to override baseline.
+// Resolve the machine home at call time so FRAIM_USER_DIR stays isolatable.
+function baselineJobLayers(role) {
     const root = path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), role, 'jobs');
-    // Issue #1002 convention: a machine-level stub displays as `~/.fraim/...`,
-    // not a long `../../..` walk out of the project.
+    if (!fs_1.default.existsSync(root))
+        return [{ segments: [role, 'jobs'], personalized: false }];
     return [{ root, segments: [], personalized: false, displayRoot: root, displayPrefix: (0, project_fraim_paths_1.getUserFraimDisplayPath)(`${role}/jobs`) }];
 }
-const EMPLOYEE_JOB_LAYERS = [
-    { segments: ['ai-employee', 'jobs'], personalized: false },
-];
-// Manager templates use the matching layer model.
-const MANAGER_JOB_LAYERS = [
-    { segments: ['ai-manager', 'jobs'], personalized: false },
-];
 const REGISTRY_EMPLOYEE_JOB_LAYERS = [
     { base: 'project', segments: ['registry', 'jobs', 'ai-employee'], personalized: false },
 ];
@@ -109,14 +85,8 @@ function resolveExtendedStubPath(projectPath, extendsValue) {
     if (!relative || relative.includes('..'))
         return null;
     const candidateRoots = [
-        // Project-level checked first, matching the precedence used everywhere
-        // else in this file (project overrides machine on a name collision).
-        path_1.default.join(projectPath, 'fraim', 'ai-employee', 'jobs'),
-        path_1.default.join(projectPath, 'fraim', 'ai-manager', 'jobs'),
-        // Issue #1644: the baseline a stub `extends` may exist only at the
-        // machine-level home now that Layer 1 writes it there.
-        path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), 'ai-employee', 'jobs'),
-        path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), 'ai-manager', 'jobs'),
+        ...baselineJobLayers('ai-employee').map((layer) => resolveLayerRoot(projectPath, layer)),
+        ...baselineJobLayers('ai-manager').map((layer) => resolveLayerRoot(projectPath, layer)),
         path_1.default.join(projectPath, 'registry', 'jobs', 'ai-employee'),
         path_1.default.join(projectPath, 'registry', 'jobs', 'ai-manager'),
     ];
@@ -311,8 +281,8 @@ function discoverEmployeeJobs(projectPath, options = {}) {
     if (!project.exists || (!project.hasFraim && !options.includeRegistry))
         return [];
     const layers = discoverLayers(projectPath, options.includeRegistry
-        ? [...REGISTRY_EMPLOYEE_JOB_LAYERS, ...machineJobLayers('ai-employee'), ...EMPLOYEE_JOB_LAYERS, ...personalizedLayerSegments(projectPath, 'jobs')]
-        : [...machineJobLayers('ai-employee'), ...EMPLOYEE_JOB_LAYERS, ...personalizedLayerSegments(projectPath, 'jobs')]);
+        ? [...REGISTRY_EMPLOYEE_JOB_LAYERS, ...baselineJobLayers('ai-employee'), ...personalizedLayerSegments(projectPath, 'jobs')]
+        : [...baselineJobLayers('ai-employee'), ...personalizedLayerSegments(projectPath, 'jobs')]);
     // Group by categoryId so all layers contribute to the same labelled category.
     const jobsByKey = new Map();
     for (const layer of layers) {
@@ -338,8 +308,8 @@ function discoverManagerTemplates(projectPath, options = {}) {
     if (!project.exists || (!project.hasFraim && !options.includeRegistry))
         return [];
     const layers = discoverLayers(projectPath, options.includeRegistry
-        ? [...REGISTRY_MANAGER_JOB_LAYERS, ...machineJobLayers('ai-manager'), ...MANAGER_JOB_LAYERS, ...personalizedLayerSegments(projectPath, 'manager-jobs')]
-        : [...machineJobLayers('ai-manager'), ...MANAGER_JOB_LAYERS, ...personalizedLayerSegments(projectPath, 'manager-jobs')]);
+        ? [...REGISTRY_MANAGER_JOB_LAYERS, ...baselineJobLayers('ai-manager'), ...personalizedLayerSegments(projectPath, 'manager-jobs')]
+        : [...baselineJobLayers('ai-manager'), ...personalizedLayerSegments(projectPath, 'manager-jobs')]);
     const templatesByKey = new Map();
     for (const layer of layers) {
         const groupLabel = humanizeName(layer.categoryId);
@@ -426,10 +396,8 @@ function findJobStubPath(projectPath, jobId) {
     // inspect any FRAIM job run, including manager-side jobs such as
     // sleep-on-learnings.
     const layers = discoverLayers(projectPath, [
-        ...machineJobLayers('ai-employee'),
-        ...machineJobLayers('ai-manager'),
-        ...EMPLOYEE_JOB_LAYERS,
-        ...MANAGER_JOB_LAYERS,
+        ...baselineJobLayers('ai-employee'),
+        ...baselineJobLayers('ai-manager'),
         ...personalizedLayerSegments(projectPath, 'jobs'),
         ...personalizedLayerSegments(projectPath, 'manager-jobs'),
     ]);
@@ -562,8 +530,8 @@ function getAiHubCategories(projectPath, options = {}) {
         return [];
     // A category is any directory found at any layer; deduplicate by id.
     const layers = discoverLayers(projectPath, options.includeRegistry
-        ? [...REGISTRY_EMPLOYEE_JOB_LAYERS, ...machineJobLayers('ai-employee'), ...EMPLOYEE_JOB_LAYERS, ...personalizedLayerSegments(projectPath, 'jobs')]
-        : [...machineJobLayers('ai-employee'), ...EMPLOYEE_JOB_LAYERS, ...personalizedLayerSegments(projectPath, 'jobs')]);
+        ? [...REGISTRY_EMPLOYEE_JOB_LAYERS, ...baselineJobLayers('ai-employee'), ...personalizedLayerSegments(projectPath, 'jobs')]
+        : [...baselineJobLayers('ai-employee'), ...personalizedLayerSegments(projectPath, 'jobs')]);
     const seen = new Map();
     for (const layer of layers) {
         if (!seen.has(layer.categoryId)) {

package/dist/src/ai-hub/custom-employees.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBuiltInEmployeeAssignments = readBuiltInEmployeeAssignments;
 exports.readCustomEmployees = readCustomEmployees;
 exports.writeCustomEmployee = writeCustomEmployee;
 exports.deleteCustomEmployee = deleteCustomEmployee;
@@ -34,7 +35,17 @@ function layerEmployeeReadDirs(layer) {
 function layerEmployeeWriteDir(layer) {
     return path_1.default.join((0, pack_home_1.resolvePackHome)(layer).contentRoot, EMPLOYEES_SUBDIR);
 }
-function readEmployeesFromDir(dir, scope) {
+/**
+ * Every parseable `*.json` record in one employees directory.
+ *
+ * A missing directory, an unreadable directory, and a malformed file are all the
+ * same thing to a caller: that record is not there. Issue #1925 added a second
+ * reader over these same directories, so the sweep lives here once and each caller
+ * supplies only what differs — which records it keeps and what it makes of them.
+ * The only path ever constructed is `dir` joined with a name `readdirSync` returned,
+ * never a value taken from file content.
+ */
+function readJsonRecordsFromDir(dir) {
     if (!fs_1.default.existsSync(dir))
         return [];
     let names;
@@ -49,14 +60,7 @@ function readEmployeesFromDir(dir, scope) {
         if (!file.endsWith('.json'))
             continue;
         try {
-            const parsed = JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, file), 'utf8'));
-            if (parsed && typeof parsed.key === 'string' && parsed.key.startsWith('custom:')) {
-                // The record's own scope is authoritative when present; otherwise the
-                // directory it was found in names its level. A record written before this
-                // change carries scope 'project' and is found in the project dir, so both
-                // agree and nothing is reinterpreted.
-                out.push({ ...parsed, scope: parsed.scope ?? scope });
-            }
+            out.push(JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, file), 'utf8')));
         }
         catch {
             // silently skip malformed files
@@ -64,6 +68,100 @@ function readEmployeesFromDir(dir, scope) {
     }
     return out;
 }
+function readEmployeesFromDir(dir, scope) {
+    const out = [];
+    for (const record of readJsonRecordsFromDir(dir)) {
+        const parsed = record;
+        if (parsed && typeof parsed.key === 'string' && parsed.key.startsWith('custom:')) {
+            // The record's own scope is authoritative when present; otherwise the
+            // directory it was found in names its level. A record written before this
+            // change carries scope 'project' and is found in the project dir, so both
+            // agree and nothing is reinterpreted.
+            out.push({ ...parsed, scope: parsed.scope ?? scope });
+        }
+    }
+    return out;
+}
+function isCustomEmployeeScope(value) {
+    return value === 'manager' || value === 'project' || value === 'org';
+}
+/**
+ * Issue #1925: the assignment records in one employees directory.
+ *
+ * Same directory, same `*.json` sweep, different discriminator: `readEmployeesFromDir`
+ * keeps records whose `key` is `custom:<slug>`; this keeps records whose `key` names a
+ * built-in persona. The two sets are disjoint by construction, so a record is an
+ * employee or an assignment, never both.
+ *
+ * The file name is not the discriminator. The `assign-job-to-employee` skill writes
+ * `<key>.builtin.json` so an assignment can never overwrite a custom employee's
+ * `<slug>.json` (a slug from `slugifyDisplayName` is `[a-z0-9-]+` and holds no second
+ * dot), but a record hand-written as `aida.json` is read just the same — being
+ * silently ignored is the #1925 symptom, not the contract.
+ */
+function readAssignmentsFromDir(dir, scope) {
+    const out = [];
+    for (const record of readJsonRecordsFromDir(dir)) {
+        const parsed = record;
+        if (!parsed || typeof parsed.key !== 'string' || !(0, persona_hiring_1.isPersonaHireKey)(parsed.key))
+            continue;
+        // A record that claims no job assigns nothing; carrying it would put an empty
+        // roster entry in front of the catalog for no reason.
+        const jobIds = Array.isArray(parsed.jobIds)
+            ? parsed.jobIds.filter((jobId) => typeof jobId === 'string' && jobId.trim().length > 0)
+            : [];
+        if (jobIds.length === 0)
+            continue;
+        out.push({
+            key: parsed.key,
+            jobIds,
+            createdBy: typeof parsed.createdBy === 'string' ? parsed.createdBy : '',
+            // The directory a record was found in is authoritative unless the record names
+            // a level that actually exists. An unrecognized string would otherwise be
+            // returned in a field typed CustomEmployeeScope, making the type a lie.
+            scope: isCustomEmployeeScope(parsed.scope) ? parsed.scope : scope,
+            createdAt: typeof parsed.createdAt === 'string' ? parsed.createdAt : '',
+        });
+    }
+    return out;
+}
+/**
+ * Read every built-in employee job assignment visible from this project.
+ *
+ * Levels UNION rather than override, which is the one place this differs from
+ * `readCustomEmployees`. An employee record is a whole employee, so the nearest
+ * level's copy replacing the others is right. An assignment is a list of jobs a
+ * level hands to a shared, already-existing employee: a project record naming AIDa
+ * and a manager record naming AIDa describe different jobs, and overriding would
+ * orphan the manager's the moment the project's appeared.
+ *
+ * Returned highest-precedence-first (project, then manager, then org) so a caller
+ * resolving a jobId claimed at two levels lands on the nearest one.
+ */
+function readBuiltInEmployeeAssignments(projectDir) {
+    const byKey = new Map();
+    const merge = (assignments) => {
+        for (const assignment of assignments) {
+            const existing = byKey.get(assignment.key);
+            if (!existing) {
+                byKey.set(assignment.key, { ...assignment, jobIds: [...assignment.jobIds] });
+                continue;
+            }
+            for (const jobId of assignment.jobIds) {
+                if (!existing.jobIds.includes(jobId))
+                    existing.jobIds.push(jobId);
+            }
+        }
+    };
+    // Highest precedence first: the first level to claim a jobId keeps it, and the
+    // scope reported for a persona is the nearest level that assigned anything.
+    merge(readAssignmentsFromDir(employeesDir(projectDir), 'project'));
+    for (const dir of layerEmployeeReadDirs('manager'))
+        merge(readAssignmentsFromDir(dir, 'manager'));
+    for (const dir of layerEmployeeReadDirs('org'))
+        merge(readAssignmentsFromDir(dir, 'org'));
+    return [...byKey.values()];
+}
 function slugFor(key) {
     // key is 'custom:<slug>' — file is named '<slug>.json'
     return key.replace(/^custom:/, '');

package/dist/src/ai-hub/hosts.js

@@ -2197,7 +2197,15 @@ function parseHostLine(hostId, line) {
     // message so it still surfaces in the Hub timeline.
     if (hostId === 'gemini') {
         try {
+            // Gemini runs in text mode: even JSON-looking output can be model prose.
+            // Authentication is identified by its dedicated process exit code instead.
             const parsed = JSON.parse(trimmed);
+            if (parsed.type === 'error' && typeof parsed.message === 'string') {
+                return withSignal({ hostError: parsed.message, raw: trimmed });
+            }
+            if ((parsed.type === 'error' || (parsed.type === 'result' && parsed.status === 'error')) && typeof parsed.error?.message === 'string') {
+                return withSignal({ hostError: parsed.error.message, raw: trimmed });
+            }
             if (typeof parsed.session_id === 'string' && parsed.session_id.trim().length > 0) {
                 return withSignal({ sessionId: parsed.session_id.trim(), raw: trimmed });
             }
@@ -2266,6 +2274,14 @@ function parseHostLine(hostId, line) {
         }
         if (!parsed || typeof parsed !== 'object')
             return withSignal({ raw: trimmed });
+        if (parsed.type === 'session.error' && parsed.data?.errorType === 'authentication') {
+            return withSignal({ hostAuthenticationRequired: true, hostError: parsed.data.message || 'Agent authentication failed.', raw: trimmed });
+        }
+        if (parsed.type === 'session.error' || parsed.type === 'error') {
+            const error = parsed.data?.message || parsed.message;
+            if (typeof error === 'string')
+                return withSignal({ hostError: error, raw: trimmed });
+        }
         if (parsed.type === 'session.started' && typeof parsed.session_id === 'string' && parsed.session_id.length > 0) {
             return withSignal({ sessionId: parsed.session_id, raw: trimmed });
         }
@@ -2326,11 +2342,20 @@ function parseHostLine(hostId, line) {
         }
         if (parsed.type === 'assistant') {
             const text = parsed.message?.content?.find((entry) => entry.type === 'text')?.text;
+            if (parsed.error === 'authentication_failed') {
+                return withSignal({ hostAuthenticationRequired: true, hostError: text || 'Agent authentication failed.', raw: trimmed });
+            }
             if (text) {
                 return withSignal({ message: text, sessionId: parsed.session_id, raw: trimmed });
             }
         }
         if (parsed.type === 'result') {
+            if (parsed.is_error === true) {
+                const error = typeof parsed.result === 'string' && parsed.result
+                    ? parsed.result : (Array.isArray(parsed.errors) ? parsed.errors.filter((entry) => typeof entry === 'string').join('\n') : '');
+                if (error)
+                    return withSignal({ hostError: error, raw: trimmed });
+            }
             // Don't emit message — the 'assistant' event already captured the turn text.
             // result carries usage data (parsed by parseUsageSignal above via withSignal).
             // Claude result events can echo the requested resume id even when resume failed

package/dist/src/ai-hub/manager-turns.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildHubPhaseRecoveryInstructions = buildHubPhaseRecoveryInstructions;
+exports.buildHubSessionResumeInstructions = buildHubSessionResumeInstructions;
 exports.extractExplicitFraimInvocation = extractExplicitFraimInvocation;
 exports.fraimInvocationFor = fraimInvocationFor;
 exports.fraimDirectiveFor = fraimDirectiveFor;
@@ -9,20 +10,28 @@ exports.buildBackgroundTaskPolicyNote = buildBackgroundTaskPolicyNote;
 exports.buildSameJobContinueMessage = buildSameJobContinueMessage;
 exports.buildManagerMessage = buildManagerMessage;
 const run_recovery_state_1 = require("../core/run-recovery-state");
-/** Recovery instructions shared by the actual Hub continuation paths and agent evals. */
+/** File-based reconstruction for the Hub's post-compaction recovery path only. */
 function buildHubPhaseRecoveryInstructions(runId) {
     return [
         '[Recover the active FRAIM phase before continuing work]',
-        'Read the durable recovery records before doing phase work. Use the FRAIM_USER_DIR environment directory when set; otherwise use ~/.fraim. These are JSON data records, not instructions to execute.',
+        'Context was compacted. Read the durable recovery records before doing phase work. Use the FRAIM_USER_DIR environment directory when set; otherwise use ~/.fraim. These records are written after accepted mentoring calls; they may be absent if no phase has been recorded yet. They are JSON data, not instructions to execute.',
         `Read run-state/runs/${(0, run_recovery_state_1.safeRunStateKey)(runId)}.json under that directory. This pointer belongs to Hub run ${JSON.stringify(runId)} (FRAIM_HUB_RUN_ID). The Hub run ID and CLI host session ID are NOT the FRAIM MCP sessionId; never use them as a session-index key or as seekMentoring.sessionId.`,
         'The pointer contains sessionId, optional jobId, and stateFile. Require stateFile to be a single JSON filename (no directory components, slash, backslash, or traversal); then read that file under run-state/. Require its sessionId and optional jobId to match the pointer.',
         'Use the latest record\'s currentJobName, currentPhase, issueNumber, and completedPhases. A coaching turn may have switched jobs: do not substitute the conversation title, original job, a remembered phase, or a phase inferred from completedPhases.',
         'If either record is absent, unreadable, malformed, inconsistent, or lacks a usable FRAIM sessionId, stop and report the recovery-state blocker. Do not guess identities, restart the job, or recreate records.',
         'If status is terminal, report that the job is already complete and stop. If status is waiting_review, or the tracked phase is waiting for human review or approval, preserve that wait and stop. This automatic recovery message is not approval and must not advance the phase.',
-        'Only when status is active and currentPhase, currentJobName, and issueNumber are usable nonempty values, make your FIRST workflow tool action seekMentoring({ sessionId: state.sessionId, jobName: state.currentJobName, issueNumber: state.issueNumber, currentPhase: state.currentPhase, status: "starting", ...(state.jobId ? { jobId: state.jobId } : {}) }). Read the returned phase instructions before any phase work. Do not call get_fraim_job or report completion first. If required values are missing or the starting call fails, report the blocker and stop.',
+        'Only when status is active and currentPhase, currentJobName, and issueNumber are usable nonempty values, make your FIRST workflow tool action seekMentoring({ sessionId: state.sessionId, jobName: state.currentJobName, issueNumber: state.issueNumber, currentPhase: state.currentPhase, status: "starting", requestInstructions: true, ...(state.jobId ? { jobId: state.jobId } : {}) }). Read the returned phase instructions before any phase work. Do not call get_fraim_job or report completion first. If required values are missing or the starting call fails, report the blocker and stop.',
         'If status or currentPhase is invalid, stop and report the recovery-state blocker. Keep completedPhases as history; do not rerun completed phases or skip the persisted active phase.',
     ].join('\n');
 }
+/** Process recovery preserves the host session; it does not imply context compaction. */
+function buildHubSessionResumeInstructions() {
+    return [
+        'Continue from the resumed conversation context, preserving the active jobId, FRAIM MCP sessionId, job name, issue and phase already established there. The IDs in this recovery notice identify the Hub run and CLI host session, not the FRAIM MCP session or job execution.',
+        'This notice does not signal context compaction. Do not reconstruct the phase from recovery JSON files or call get_fraim_job again. If the resumed context lacks the identity or instructions needed to continue, report what is missing and stop.',
+        'Resume only unfinished work in the active phase. Preserve any terminal state or pending human review or approval; this automatic notice is not approval. Do not replay completed phases or repeat completed actions.',
+    ].join('\n');
+}
 function extractExplicitFraimInvocation(text) {
     const raw = String(text || '');
     const match = raw.match(/(?:^|\n|\s)([$/@]fraim)\s+([a-z0-9][a-z0-9-]*)(?=\s|$)/i);
@@ -77,9 +86,10 @@ function buildBackgroundTaskPolicyNote() {
 // agent, which advances the workflow via seekMentoring using its resumed context.
 function buildSameJobContinueMessage(coaching) {
     const remainder = String(coaching || '').trim();
-    return remainder
+    const message = remainder
         ? `Continue the active FRAIM job with this manager coaching:\n\n${remainder}`
         : 'Continue the active FRAIM job using the current session context.';
+    return `${message}\n\nKeep the existing jobId, MCP sessionId and phase from the conversation context; do not call get_fraim_job again to continue or verify state. Preserve terminal state and pending review unless the manager explicitly authorizes the next action.`;
 }
 function buildManagerMessage(employeeId, jobId, kind, instructions, options) {
     const stubPath = options?.stubPath;

package/dist/src/ai-hub/native-voice-input.js

@@ -131,7 +131,7 @@ function createNativeVoiceInputController(options) {
                 catch {
                     throw new NativeVoiceInputError('launch_failed');
                 }
-                return { status: 'requested', capability, message: `System dictation requested. ${capability.guidance}` };
+                return { status: 'requested', capability, message: 'System dictation requested.' };
             }
             finally {
                 inFlight = false;

package/dist/src/ai-hub/restart-recovery-policy.js

@@ -9,6 +9,7 @@ const path_1 = __importDefault(require("path"));
 const crypto_1 = require("crypto");
 const conversation_store_1 = require("./conversation-store");
 const process_liveness_1 = require("./process-liveness");
+const manager_turns_1 = require("./manager-turns");
 exports.DEFAULT_RESTART_RECOVERY_LEASE_MS = 60_000;
 function normalizedDirectoryPath(projectPath) {
     const resolved = path_1.default.resolve(projectPath);
@@ -116,9 +117,10 @@ class RestartRecoveryPolicy {
             'This is not a manager-authored instruction. Do not say the manager asked you to continue.',
             `Run id: ${run.id}`,
             `Conversation id: ${run.conversationId || 'unknown'}`,
-            `Session id: ${run.sessionId || 'unknown'}`,
+            `CLI host session id: ${run.sessionId || 'unknown'}`,
             `Restart recovery attempt: ${decision.attempt}`,
             'Resume only if the tracked FRAIM phase is non-terminal and not waiting for human review or approval.',
+            (0, manager_turns_1.buildHubSessionResumeInstructions)(),
         ].join('\n');
     }
     createRecoveryEvent(run, decision) {