fraim-hub 2.0.348 → 2.0.349

package/dist/src/ai-hub/hosts.js

@@ -2399,11 +2399,14 @@ function detectCodexCompactTaskFailure(line) {
     return null;
 }
 function wireHostProcess(hostId, child, handlers, spawnCwd) {
-    // Exec's JSON error has no auth code. Require independent provider stderr
-    // provenance AND the same terminal protocol error; never scan tool/prose text.
+    // Exec's JSON error has no auth code. Refresh failures need corroborating
+    // stderr; workspace-routing 401 needs the exact terminal provider event.
+    // Both require a failed process exit; never scan tool/prose text.
     const codexRefreshFailure = 'Your access token could not be refreshed because your refresh token was already used. Please log out and sign in again.';
+    const codexWorkspaceRoutingFailure = 'workspace routing discovery unauthorized (401)';
     let codexAuthDiagnostic = false;
     let codexTerminalAuthFailure = false;
+    let codexTerminalWorkspaceAuthFailure = false;
     const observeCodexAuth = (line, channel) => {
         if (hostId !== 'codex')
             return;
@@ -2416,11 +2419,15 @@ function wireHostProcess(hostId, child, handlers, spawnCwd) {
         }
         try {
             const event = JSON.parse(line);
+            if (event.type === 'turn.failed') {
+                codexTerminalWorkspaceAuthFailure = event.error?.message === codexWorkspaceRoutingFailure;
+            }
             if (event.type === 'turn.failed' || event.type === 'error') {
                 codexTerminalAuthFailure = (event.type === 'turn.failed' ? event.error?.message : event.message) === codexRefreshFailure;
             }
             else if (event.type === 'turn.started' || event.type === 'turn.completed') {
                 codexTerminalAuthFailure = false;
+                codexTerminalWorkspaceAuthFailure = false;
             }
         }
         catch { /* Plain stdout cannot establish authentication failure. */ }
@@ -2474,8 +2481,9 @@ function wireHostProcess(hostId, child, handlers, spawnCwd) {
     // `exitCode ?? 0` guard. Pass -1 for any signal-terminated child so the
     // non-zero branch fires and recovery is attempted.
     child.on('close', (code, signal) => {
-        if (!signal && code !== null && code !== 0 && codexAuthDiagnostic && codexTerminalAuthFailure) {
-            handlers.onEvent({ hostAuthenticationRequired: true, hostError: codexRefreshFailure, raw: codexRefreshFailure }, 'system');
+        if (!signal && code !== null && code !== 0 && ((codexAuthDiagnostic && codexTerminalAuthFailure) || codexTerminalWorkspaceAuthFailure)) {
+            const failure = codexTerminalWorkspaceAuthFailure ? codexWorkspaceRoutingFailure : codexRefreshFailure;
+            handlers.onEvent({ hostAuthenticationRequired: true, hostError: failure, raw: failure }, 'system');
         }
         handlers.onExit(signal ? -1 : code);
     });

package/dist/src/core/utils/local-registry-resolver.js

@@ -50,6 +50,7 @@ class LocalRegistryResolver {
     constructor(options) {
         this.workspaceRoot = options.workspaceRoot;
         this.effectiveFraimDir = options.effectiveFraimDir;
+        this.userLevelOnly = options.userLevelOnly ?? false;
         this.remoteContentResolver = options.remoteContentResolver;
         this.parser = new inheritance_parser_1.InheritanceParser(options.maxDepth);
         this.shouldFilter = options.shouldFilter;
@@ -87,7 +88,14 @@ class LocalRegistryResolver {
      * Check if a local override exists for the given path
      */
     hasLocalOverride(path) {
-        return (0, fs_1.existsSync)(this.getOverridePath(path));
+        return !this.userLevelOnly && (0, fs_1.existsSync)(this.getOverridePath(path));
+    }
+    /** Whether an effective personalized layer should replace a remote baseline response. */
+    hasPersonalizedOverride(path) {
+        return this.hasLocalOverride(path)
+            || this.readManagerLocalOverlayFile(path) !== null
+            || this.readManagerOverlayFile(path) !== null
+            || this.readOrgOverlayFile(path) !== null;
     }
     /**
      * Find the actual relative path for a registry item by searching subdirectories.
@@ -108,11 +116,11 @@ class LocalRegistryResolver {
             // `jobs/<category>/<name>.md`, so the job was reported not found even
             // though the file existed.
             const searchRoots = [
-                this.getFraimPath('personalized-employee', dir),
+                ...(!this.userLevelOnly ? [this.getFraimPath('personalized-employee', dir)] : []),
                 (0, path_1.join)(this.managerLocalRoot, dir),
                 (0, path_1.join)(this.managerCacheRoot, dir),
                 (0, path_1.join)(this.orgCacheRoot, dir),
-                (0, path_1.join)(this.workspaceRoot, 'registry', dir),
+                ...(!this.userLevelOnly ? [(0, path_1.join)(this.workspaceRoot, 'registry', dir)] : []),
                 // Installed projects discover categorized capabilities in machine catalogs.
                 this.getSyncedCatalogRoot('ai-employee', dir),
                 ...(type !== 'skills' ? [this.getSyncedCatalogRoot('ai-manager', dir)] : []),
@@ -326,6 +334,8 @@ class LocalRegistryResolver {
         }
     }
     readWorkspaceRegistryFile(path) {
+        if (this.userLevelOnly)
+            return null;
         const normalizedPath = path.replace(/\\/g, '/').replace(/^\/+/, '');
         const registryRoot = (0, path_1.join)(this.workspaceRoot, 'registry');
         const registryPath = (0, path_1.join)(registryRoot, ...normalizedPath.split('/'));

package/dist/src/local-mcp-server/learning-context-builder.js

@@ -1535,6 +1535,7 @@ function readRejectedProposals(workspaceRoot, userId) {
         return [];
     const out = [];
     const seen = new Set();
+    const projectOwnerPath = (0, owner_identity_1.ownerPath)((0, project_fraim_paths_1.getWorkspaceFraimDir)(workspaceRoot));
     const headingRe = /^## (Rejected|Superseded): (.+)$/m;
     const reasonRe = /^Reason: (.+)$/m;
     const revisitRe = /^Revisit when: (.+)$/m;
@@ -1567,7 +1568,9 @@ function readRejectedProposals(workspaceRoot, userId) {
             let proposal = {};
             if (json) {
                 try {
-                    proposal = JSON.parse(json[1]);
+                    const parsed = JSON.parse(json[1]);
+                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+                        proposal = parsed;
                 }
                 catch {
                     // Keep the human-readable half; the JSON only enriches it.
@@ -1576,12 +1579,24 @@ function readRejectedProposals(workspaceRoot, userId) {
             const decision = (proposal.decision || {});
             const content = (proposal.content || {});
             const trace = (content.trace || {});
+            let targetOwner;
+            try {
+                const owner = proposal.target?.owner;
+                (0, owner_identity_1.validateOwner)(owner);
+                targetOwner = { level: owner.level, path: owner.path };
+            }
+            catch {
+                // Older/damaged targets remain visible as unknown; never infer
+                // their project from the shared history file's location.
+            }
+            if (targetOwner?.level === 'Project' && targetOwner.path !== projectOwnerPath)
+                continue;
             const claimKey = typeof proposal.claimKey === 'string' && proposal.claimKey
                 ? proposal.claimKey
                 : parts[1] || heading[2];
             // The same claim can appear in more than one configured base. The first
             // base supplies display metadata for that same recorded decision.
-            const key = `${claimKey}:${String(decision.at || '')}`;
+            const key = JSON.stringify([claimKey, String(decision.at || ''), targetOwner?.level, targetOwner?.path]);
             if (seen.has(key))
                 continue;
             seen.add(key);
@@ -1596,6 +1611,7 @@ function readRejectedProposals(workspaceRoot, userId) {
                 rejectedAt: typeof decision.at === 'string' ? decision.at : '',
                 ...(typeof trace.recurrences === 'number' ? { recurrencesAtRejection: trace.recurrences } : {}),
                 displayPath,
+                ...(targetOwner ? { targetOwner } : {}),
             });
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-hub",
-  "version": "2.0.348",
+  "version": "2.0.349",
   "description": "FRAIM Hub local companion package.",
   "author": "Sid Mathur <sid.mathur@gmail.com>",
   "homepage": "https://github.com/mathursrus/FRAIM#readme",
@@ -246,7 +246,7 @@
     "electron-updater": "^6.8.9",
     "express": "^5.2.1",
     "extract-zip": "^2.0.1",
-    "fraim": "2.0.348",
+    "fraim": "2.0.349",
     "mongodb": "^7.0.0",
     "node-cron": "4.2.1",
     "node-edge-tts": "^1.2.10",

package/public/ai-hub/review.css

@@ -833,6 +833,13 @@
 }
 
 /* Card body clamp */
+.learn-prop .lr-owner {
+  min-width: 0;
+  max-width: 100%;
+  flex-shrink: 1;
+  overflow-wrap: anywhere;
+}
+
 .learn-prop .lp-body.lp-clamped {
   display: -webkit-box;
   -webkit-line-clamp: 3;

package/public/ai-hub/script.js

@@ -7346,85 +7346,9 @@ function renderLearningProposalTurn(conv) {
   const host = els['messages'];
   if (!host) return;
   renderLearningProposalHistory(conv);
+  // Issue #2045: sleep conversational cards disabled — not working as expected.
   const existing = host.querySelector('#learn-proposal-turn');
-  if (!tfConvHasProposals(conv)) {
-    if (existing) existing.remove();
-    return;
-  }
-
-  // Issue #1857: the scope arrives on the set rather than being re-derived from
-  // the kickoff text, so a decision reaches the corpus its run was scoped to even
-  // when the kickoff wording is ambiguous.
-  const scope = conv.proposalSet.runScope || tfProposalScopeForConversation(conv);
-  const proposals = tfPendingProposals(conv);
-  if (!proposals.length) {
-    if (existing) existing.remove();
-    return;
-  }
-  const signature = JSON.stringify([conv.id, tfProposalSubmissions.has(conv.id), conv.proposalSet, proposals.map((p) => {
-    const key = tfProposalStateKey(p);
-    const override = tfProposalOverrides[key] || {};
-    return [tfProposalDecisions[key], override.level, override.skipped];
-  })]);
-  if (existing && existing.proposalSignature === signature) return;
   if (existing) existing.remove();
-
-  const row = document.createElement('article');
-  row.className = 'message employee review-turn learn-proposal-turn';
-  row.id = 'learn-proposal-turn';
-  row.dataset.testid = 'learn-proposal-turn';
-  row.proposalSignature = signature;
-  const bubble = document.createElement('div');
-  bubble.className = 'bubble';
-
-  const label = document.createElement('div');
-  label.className = 'review-turn-label';
-  const undecided = proposals.filter((p) => !tfProposalDecisions[tfProposalStateKey(p)]).length;
-  label.textContent = undecided
-    ? `${undecided} lesson${undecided === 1 ? '' : 's'} waiting on your decision`
-    : 'Lessons reviewed';
-  bubble.appendChild(label);
-
-  if (undecided) bubble.appendChild(tfLearningBatchBar(proposals, scope));
-  const list = document.createElement('div');
-  list.className = 'learn-list';
-  for (const p of proposals) list.appendChild(tfProposalCard(p, scope));
-  bubble.appendChild(list);
-
-  // Issue #1857 R7. A claim the manager already decided is not a card, because
-  // re-asking a settled question is the cost this issue exists to remove. It is
-  // also not silence: suppression the manager cannot see is a system quietly
-  // deciding on their behalf. One line each, after the batch.
-  const suppressed = tfSuppressedClaims(conv);
-  if (suppressed.length) {
-    const note = document.createElement('div');
-    note.className = 'learn-suppressed';
-    note.dataset.testid = 'learn-suppressed';
-    const lead = document.createElement('div');
-    lead.className = 'ls-lead';
-    lead.textContent = `Not shown: ${suppressed.length} claim${suppressed.length === 1 ? '' : 's'} `
-      + `matched ${suppressed.length === 1 ? 'a decision' : 'decisions'} you already made.`;
-    note.appendChild(lead);
-    for (const claim of suppressed) {
-      const line = document.createElement('div');
-      line.className = 'ls-row';
-      // D2: a claim a rule or skill now owns was promoted, not refused. Saying
-      // "you rejected this" about work the manager approved elsewhere is wrong.
-      line.textContent = claim.kind === 'superseded'
-        ? `"${claim.claimKey}" superseded ${claim.rejectedAt}: ${claim.reason}`
-        : `"${claim.claimKey}" rejected ${claim.rejectedAt}: "${claim.reason}"`
-          + (claim.newSourceCount ? ` - ${claim.newSourceCount} new source${claim.newSourceCount === 1 ? '' : 's'}` : '');
-      note.appendChild(line);
-    }
-    bubble.appendChild(note);
-  }
-
-  row.appendChild(bubble);
-  if (tfProposalSubmissions.has(conv.id)) {
-    row.querySelectorAll('button, textarea').forEach((control) => { control.disabled = true; });
-  }
-  // Below the thread, above the deliverables/next-job furniture.
-  host.insertBefore(row, host.querySelector('#deliverables-bar, #next-job-section'));
 }
 
 // Like ordinary reviewTurns, acknowledged proposals belong to conversation history.
@@ -15389,17 +15313,42 @@ async function tfFetchPreservedLearnings(scope, level) {
  * `undefined` = not loaded yet, so a first render can say "Loading" rather than
  * claiming there are no rejections.
  */
-function tfRejectionsCache() { return state._rejections; }
+let tfRejectionsGeneration = 0;
+function tfRejectionsCache() {
+  return state._rejectionsProject === tfCanonicalProjectPath(state.projectPath || '') ? state._rejections : undefined;
+}
+function tfInvalidateRejections() {
+  tfRejectionsGeneration += 1;
+  state._rejections = undefined;
+  state._rejectionsPending = undefined;
+  state._rejectionsProject = undefined;
+}
 async function tfFetchRejections() {
+  const projectPath = state.projectPath || '';
+  const projectKey = tfCanonicalProjectPath(projectPath);
+  if (state._rejectionsPending?.projectKey === projectKey) return state._rejectionsPending.promise;
+  const generation = ++tfRejectionsGeneration;
   const params = new URLSearchParams();
-  if (state.projectPath) params.set('projectPath', state.projectPath);
-  try {
-    const data = await requestJson('/api/ai-hub/rejections?' + params.toString());
-    state._rejections = Array.isArray(data.entries) ? data.entries : [];
-  } catch {
-    state._rejections = [];
-  }
-  return state._rejections;
+  if (projectPath) params.set('projectPath', projectPath);
+  const promise = (async () => {
+    let entries;
+    try {
+      const data = await requestJson('/api/ai-hub/rejections?' + params.toString());
+      entries = Array.isArray(data.entries) ? data.entries : [];
+    } catch {
+      entries = [];
+    }
+    // Both identity and generation matter: an A -> B -> A switch must not
+    // resurrect a response from the first visit to A.
+    if (generation === tfRejectionsGeneration && projectKey === tfCanonicalProjectPath(state.projectPath || '')) {
+      state._rejections = entries;
+      state._rejectionsProject = projectKey;
+      state._rejectionsPending = undefined;
+    }
+    return entries;
+  })();
+  state._rejectionsPending = { projectKey, promise };
+  return promise;
 }
 
 /**
@@ -15408,13 +15357,13 @@ async function tfFetchRejections() {
  * because a refused claim is settled and the library is about what the employee
  * knows, not what it was told no about.
  */
-function tfRejectedSection(rejections) {
+function tfRejectedSection(rejections, unknownScope = false) {
   const box = document.createElement('details');
   box.className = 'learn-dormant-section learn-rejected-section';
-  box.dataset.testid = 'rejected-section';
+  box.dataset.testid = unknownScope ? 'unknown-rejection-section' : 'rejected-section';
   const summary = document.createElement('summary');
   summary.className = 'learn-dormant-header';
-  summary.textContent = `Rejected (${rejections.length})`;
+  summary.textContent = `${unknownScope ? 'History with unknown scope' : 'Rejected'} (${rejections.length})`;
   box.appendChild(summary);
 
   for (const r of rejections) {
@@ -15445,6 +15394,14 @@ function tfRejectedSection(rejections) {
 
     const meta = document.createElement('div');
     meta.className = 'lp-stats';
+    const owner = document.createElement('span');
+    owner.className = 'lp-score lr-owner';
+    owner.dataset.testid = 'lr-owner';
+    const targetOwner = r.targetOwner;
+    owner.textContent = targetOwner
+      ? `${targetOwner.level === 'Org' ? 'Company' : targetOwner.level}: ${targetOwner.path}`
+      : 'Scope unknown';
+    meta.appendChild(owner);
     if (r.rejectedAt) {
       const when = document.createElement('span');
       when.className = 'lp-score';
@@ -16096,14 +16053,23 @@ function tfRenderLearningsList(host, scope, level, emptyText) {
     if (preserved === undefined) return;
   }
 
-  // Issue #1857 R19. Rejections are personal to the manager, so only their own
-  // surface asks for them; the company and reverse-mentoring lists are other
-  // people's corpora and a refusal there is not this manager's to review.
+  // The reader scopes Project targets to the request's project. Each Info
+  // surface then selects its own recorded level from that project-keyed cache.
+  // Org history delivery is separate from these personal/project surfaces.
   const showsRejections = scope === 'manager';
   if (showsRejections && tfRejectionsCache() === undefined) {
     tfFetchRejections().then(() => tfReRenderScope(scope, level)).catch(() => {});
   }
-  const rejections = showsRejections && Array.isArray(tfRejectionsCache()) ? tfRejectionsCache() : [];
+  const history = showsRejections && Array.isArray(tfRejectionsCache()) ? tfRejectionsCache() : [];
+  const ownerLevel = level === 'project' ? 'Project' : level === 'machine' ? 'Manager' : undefined;
+  const rejections = history.filter(entry => ownerLevel && entry.targetOwner?.level === ownerLevel);
+  // Unknown ownership has one inspection home, separate from Manager's owned
+  // rejection count. Keeping it visible does not assign it Manager ownership.
+  const unknownHistory = level === 'machine' ? history.filter(entry => !entry.targetOwner) : [];
+  const appendRejectionHistory = () => {
+    if (rejections.length) host.appendChild(tfRejectedSection(rejections));
+    if (unknownHistory.length) host.appendChild(tfRejectedSection(unknownHistory, true));
+  };
 
   const addCategories = scope === 'reverse' ? ['coaching']
     : scope === 'org' ? ['avoid', 'preference', 'repeat', 'coaching']
@@ -16209,7 +16175,7 @@ function tfRenderLearningsList(host, scope, level, emptyText) {
 
   if (list.children.length) {
     host.appendChild(list);
-    if (rejections.length && !shareMode) host.appendChild(tfRejectedSection(rejections));
+    if (!shareMode) appendRejectionHistory();
     if (!shareMode) { host.appendChild(addBtn); wireAdd(); }
     if (shareMode) tfUpdateShareBar(host, scope, level);
     return;
@@ -16232,7 +16198,7 @@ function tfRenderLearningsList(host, scope, level, emptyText) {
   empty.appendChild(emoji); empty.appendChild(title); empty.appendChild(sub);
   host.appendChild(empty);
   if (shareMode) { tfUpdateShareBar(host, scope, level); return; }
-  if (rejections.length) host.appendChild(tfRejectedSection(rejections));
+  appendRejectionHistory();
   host.appendChild(addBtn);
   wireAdd();
 }
@@ -17833,6 +17799,7 @@ async function tfSwitchProjectFolder(folderPath, options) {
     return;
   }
   state.projectPath = normalized.folderPath;
+  tfInvalidateRejections();
   // Cross-project leak fix (docs/rca/hub-conversation-cross-project-leak.md): drop the previous
   // project's active conversation on switch. Otherwise the just-finished run stays state.activeId
   // while state.projectPath is the new project, and a debounced conversation PUT during the