harnery 0.32.0 → 0.34.0

package/dist/core/events/v3/live-feed.js

@@ -0,0 +1,246 @@
+import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, rmSync, statSync, writeSync, } from "node:fs";
+import { basename, join, resolve } from "node:path";
+const DEFAULT_TTL_MS = 15 * 60 * 1_000;
+const HARD_MAX_TTL_MS = 60 * 60 * 1_000;
+const MAX_INTENT_CHARS = 240;
+const MAX_TARGET_LABELS = 16;
+const MAX_TARGET_CHARS = 160;
+const MAX_ROW_BYTES = 8 * 1_024;
+const GENERATION_PATTERN = /^gen_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const EVENT_PATTERN = /^evt_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const EXECUTABLE_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._+-]{0,63}$/;
+const TARGET_PATTERN = /^[a-zA-Z0-9._@+-]+(?:\/[a-zA-Z0-9._@+ -]+)*$/;
+export const EVENT_V3_LIVE_RELATIVE_ROOT = ".harnery/live/v3";
+/**
+ * Append one best-effort operator-display row. The narrow input shape has no
+ * fields for prompts, argv, tool input, output, exception bodies, or messages.
+ */
+export function writeLiveDisplayV3(coordRoot, input, now = () => new Date()) {
+    assertLiveIds(input.generation_id, input.event_id);
+    const ttlMs = input.ttl_ms ?? DEFAULT_TTL_MS;
+    if (!Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > HARD_MAX_TTL_MS) {
+        throw new Error("V3 live-display TTL must be between 1 ms and 1 hour");
+    }
+    if (input.executable !== undefined && !EXECUTABLE_PATTERN.test(input.executable)) {
+        throw new Error("V3 live-display executable is invalid");
+    }
+    const writtenAt = now();
+    const intentDisplay = safeIntentDisplayV3(input.intent_display);
+    const targetLabels = safeTargetLabels(input.target_labels);
+    const row = {
+        format: "harnery-event-v3-live-display",
+        format_version: 1,
+        row_id: `live_${randomUUID()}`,
+        generation_id: input.generation_id,
+        event_id: input.event_id,
+        written_at: writtenAt.toISOString(),
+        expires_at: new Date(writtenAt.getTime() + ttlMs).toISOString(),
+        ...(input.executable ? { executable: input.executable } : {}),
+        ...(intentDisplay ? { intent_display: intentDisplay } : {}),
+        ...(targetLabels.length > 0 ? { target_labels: targetLabels } : {}),
+    };
+    const serialized = `${JSON.stringify(row)}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > MAX_ROW_BYTES) {
+        throw new Error("V3 live-display row exceeds its bounded size");
+    }
+    const root = liveRoot(coordRoot);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    chmodSync(root, 0o700);
+    const path = join(root, `${input.generation_id}.ndjson`);
+    const fd = openSync(path, "a", 0o600);
+    try {
+        writeSync(fd, serialized, undefined, "utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+    chmodSync(path, 0o600);
+    return row;
+}
+/**
+ * Best-effort overlay write for producers. Never throws: the live feed is
+ * presentation-only and must not fail a durable ledger append.
+ */
+export function tryWriteLiveDisplayV3(coordRoot, input, now = () => new Date()) {
+    try {
+        return writeLiveDisplayV3(coordRoot, input, now);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Return every unexpired live-display row across generations. */
+export function listLiveDisplayV3(coordRoot, now = () => new Date()) {
+    const root = liveRoot(coordRoot);
+    if (!existsSync(root))
+        return [];
+    const rows = [];
+    for (const name of readdirSync(root)) {
+        if (!name.endsWith(".ndjson"))
+            continue;
+        const generationId = name.slice(0, -".ndjson".length);
+        if (!GENERATION_PATTERN.test(generationId))
+            continue;
+        rows.push(...readLiveDisplayV3(coordRoot, generationId, now));
+    }
+    return rows;
+}
+/** Return only unexpired, structurally valid rows. Expiry is enforced before cleanup. */
+export function readLiveDisplayV3(coordRoot, generationId, now = () => new Date()) {
+    if (!GENERATION_PATTERN.test(generationId))
+        throw new Error("V3 live-display generation ID is invalid");
+    const path = join(liveRoot(coordRoot), `${generationId}.ndjson`);
+    if (!existsSync(path))
+        return [];
+    const nowMs = now().getTime();
+    return readFileSync(path, "utf8")
+        .split("\n")
+        .filter(Boolean)
+        .flatMap((frame) => {
+        try {
+            const row = validateLiveRow(JSON.parse(frame));
+            const writtenMs = Date.parse(row.written_at);
+            const expiresMs = Date.parse(row.expires_at);
+            if (expiresMs <= nowMs || writtenMs + HARD_MAX_TTL_MS <= nowMs)
+                return [];
+            return [row];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+/** Remove fully expired generation files; malformed residue is bounded by the hard maximum. */
+export function janitorLiveDisplayV3(coordRoot, now = () => new Date()) {
+    const root = liveRoot(coordRoot);
+    if (!existsSync(root))
+        return { scanned: 0, removed: 0, retained: 0 };
+    const nowMs = now().getTime();
+    let scanned = 0;
+    let removed = 0;
+    let retained = 0;
+    for (const name of readdirSync(root)) {
+        if (!name.endsWith(".ndjson"))
+            continue;
+        scanned += 1;
+        const path = join(root, basename(name));
+        const visible = GENERATION_PATTERN.test(name.slice(0, -".ndjson".length))
+            ? readLiveDisplayV3(coordRoot, name.slice(0, -".ndjson".length), now)
+            : [];
+        const hardExpired = statSync(path).mtimeMs + HARD_MAX_TTL_MS <= nowMs;
+        if (visible.length === 0 || hardExpired) {
+            rmSync(path, { force: true });
+            removed += 1;
+        }
+        else {
+            retained += 1;
+        }
+    }
+    return { scanned, removed, retained };
+}
+/** Conservative allowlist scrubber: uncertainty omits the display instead of partially rendering it. */
+export function safeIntentDisplayV3(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.normalize("NFC").replace(/\s+/g, " ").trim();
+    if (normalized.length === 0 || normalized.length > MAX_INTENT_CHARS)
+        return undefined;
+    if ([...normalized].some((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint < 32 || codePoint === 127;
+    })) {
+        return undefined;
+    }
+    if (/\b(?:password|passwd|secret|token|api[_-]?key|authorization|cookie)\s*[:=]/i.test(normalized)) {
+        return undefined;
+    }
+    if (/\b(?:sk-[a-z0-9_-]{8,}|gh[pousr]_[a-z0-9]{8,}|xox[baprs]-|AKIA[A-Z0-9]{12}|AIza[\w-]{12,})/i.test(normalized)) {
+        return undefined;
+    }
+    if (/-----BEGIN [A-Z ]+PRIVATE KEY-----|\beyJ[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{8,}/.test(normalized)) {
+        return undefined;
+    }
+    if (/\b[A-Za-z0-9_+/=-]{32,}\b/.test(normalized))
+        return undefined;
+    if (/\b[\w.+-]+@[\w.-]+\.[A-Za-z]{2,}\b/.test(normalized))
+        return undefined;
+    if (/(?:^|\s)(?:\/[A-Za-z]|[A-Za-z]:\\|\\\\|\/\/wsl)/.test(normalized))
+        return undefined;
+    if (/[`]|\$\(|&&|\|\||(?:^|\s)--[a-z]/.test(normalized))
+        return undefined;
+    return normalized;
+}
+function safeTargetLabels(values) {
+    if (!values || values.length > MAX_TARGET_LABELS)
+        return [];
+    const safe = values
+        .map((value) => value.normalize("NFC").trim())
+        .filter((value) => value.length > 0 &&
+        value.length <= MAX_TARGET_CHARS &&
+        TARGET_PATTERN.test(value) &&
+        !value.startsWith("/") &&
+        !value.split("/").includes("..") &&
+        safeIntentDisplayV3(value) !== undefined);
+    return [...new Set(safe)];
+}
+function validateLiveRow(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("invalid live-display row");
+    }
+    const row = value;
+    const allowed = new Set([
+        "format",
+        "format_version",
+        "row_id",
+        "generation_id",
+        "event_id",
+        "written_at",
+        "expires_at",
+        "executable",
+        "intent_display",
+        "target_labels",
+    ]);
+    if (Object.keys(row).some((key) => !allowed.has(key)))
+        throw new Error("invalid live-display row");
+    if (row.format !== "harnery-event-v3-live-display" ||
+        row.format_version !== 1 ||
+        typeof row.row_id !== "string" ||
+        !/^live_[0-9a-f-]{36}$/.test(row.row_id) ||
+        typeof row.generation_id !== "string" ||
+        typeof row.event_id !== "string" ||
+        typeof row.written_at !== "string" ||
+        typeof row.expires_at !== "string") {
+        throw new Error("invalid live-display row");
+    }
+    assertLiveIds(row.generation_id, row.event_id);
+    if (typeof row.executable === "string" && !EXECUTABLE_PATTERN.test(row.executable)) {
+        throw new Error("invalid live-display row");
+    }
+    if (typeof row.intent_display === "string" &&
+        safeIntentDisplayV3(row.intent_display) !== row.intent_display) {
+        throw new Error("invalid live-display row");
+    }
+    if (row.target_labels !== undefined &&
+        (!Array.isArray(row.target_labels) ||
+            safeTargetLabels(row.target_labels).length !== row.target_labels.length)) {
+        throw new Error("invalid live-display row");
+    }
+    const writtenMs = Date.parse(row.written_at);
+    const expiresMs = Date.parse(row.expires_at);
+    if (Number.isNaN(writtenMs) ||
+        Number.isNaN(expiresMs) ||
+        expiresMs <= writtenMs ||
+        expiresMs - writtenMs > HARD_MAX_TTL_MS) {
+        throw new Error("invalid live-display row");
+    }
+    return row;
+}
+function assertLiveIds(generationId, eventId) {
+    if (!GENERATION_PATTERN.test(generationId) || !EVENT_PATTERN.test(eventId)) {
+        throw new Error("V3 live-display identity is invalid");
+    }
+}
+function liveRoot(coordRoot) {
+    return join(resolve(coordRoot), EVENT_V3_LIVE_RELATIVE_ROOT);
+}

package/dist/core/events/v3/live-observation.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Privacy-bounded coordination observations accepted by live V3 emitters.
+ *
+ * This is a dependency-free shared contract so downstream mirrors can type
+ * their emit surfaces without importing the authority implementation.
+ */
+export type LiveCoordinationObservationV3 = {
+    event_type: "coord.status_observed";
+    status: string;
+    subject?: string;
+} | {
+    event_type: "coord.presence_changed";
+    prior_state?: string;
+    new_state: string;
+    reason: string;
+} | {
+    event_type: "coord.message_observed";
+    message_id?: string;
+    direction: "sent" | "received";
+    body: string;
+    subject?: string;
+} | {
+    event_type: "council.state_changed";
+    council_id: string;
+    prior_state?: string;
+    new_state: string;
+    record: unknown;
+} | {
+    event_type: "decision.state_changed";
+    decision_id: string;
+    prior_state?: string;
+    new_state: string;
+    record: unknown;
+};
+//# sourceMappingURL=live-observation.d.ts.map

package/dist/core/events/v3/live-observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-observation.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/live-observation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,6BAA6B,GACrC;IACE,UAAU,EAAE,uBAAuB,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACD;IACE,UAAU,EAAE,wBAAwB,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IACE,UAAU,EAAE,wBAAwB,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACD;IACE,UAAU,EAAE,uBAAuB,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IACE,UAAU,EAAE,wBAAwB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC"}

package/dist/core/events/v3/live-observation.js

@@ -0,0 +1 @@
+export {};

package/dist/core/events/v3/live-routing.d.ts

@@ -0,0 +1,57 @@
+import type { Adapter } from "../../adapter.js";
+import type { ParsedPayload } from "../../hooks/adapter/parse.js";
+import { type EventV3WriteMode } from "./control.js";
+import type { HookSignalV3 } from "./producers/hook.js";
+import type { TurnRitualEvidenceV3 } from "./producers/hook-base.js";
+import { type RecordHookSignalV3Result } from "./producers/recorder.js";
+export declare const LIVE_HOOK_V3_PRODUCER_ID: "prd_agent-hook";
+export declare const LIVE_COMMAND_V3_PRODUCER_ID: "prd_session-tee";
+export type LiveEventLedgerRouteV3 = {
+    state: "v3";
+    mode: EventV3WriteMode;
+    build_id: `build_${string}`;
+} | {
+    state: "blocked";
+    reason: string;
+};
+/**
+ * Resolve the V3-only ledger route. A root without an initialized V3 control
+ * packet is blocked; no producer or consumer may fall back to an older ledger.
+ * Manifest-first crashes are repaired from the immutable packet and every
+ * other invalid state closes the writer gate.
+ */
+export declare function resolveLiveEventLedgerRouteV3(coordRoot: string): LiveEventLedgerRouteV3;
+export declare function liveEventV3BuildId(harneryCommit: string): `build_${string}`;
+export declare function liveInstanceIdV3(instanceId: string): `inst_${string}`;
+/**
+ * The adapter-native id a canonical `inst_*` id carries, for display and for
+ * joins against native-keyed records. Only the direct prefix form round-trips:
+ * a hashed id has no recoverable native form and is returned unchanged, so
+ * never treat this as a guaranteed inverse of `liveInstanceIdV3`.
+ */
+export declare function nativeInstanceIdV3(instanceId: string): string;
+export declare function hookSignalV3(eventName: string): HookSignalV3 | undefined;
+export declare function recordLiveHookSignalV3(input: {
+    coordRoot: string;
+    route: Extract<LiveEventLedgerRouteV3, {
+        state: "v3";
+    }>;
+    eventName: string;
+    payload: ParsedPayload | null;
+    adapter: Adapter;
+    instanceId: string;
+    run_id?: `run_${string}`;
+    workflow_id?: `wf_${string}`;
+    workflow_agent_id?: string;
+    bridge?: "codex-wsl";
+    monotonic_ns?: string;
+    hook_name?: string;
+    hook_duration_ms?: number;
+    stop_remediation?: boolean;
+    turn_ritual?: TurnRitualEvidenceV3;
+    defer_drain?: boolean;
+}): RecordHookSignalV3Result | {
+    state: "ignored";
+};
+export declare function livePlatformV3(): "linux" | "windows" | "macos" | "unknown";
+//# sourceMappingURL=live-routing.d.ts.map

package/dist/core/events/v3/live-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-routing.d.ts","sourceRoot":"","sources":["../../../../src/core/events/v3/live-routing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,KAAK,wBAAwB,EAAsB,MAAM,yBAAyB,CAAC;AAE5F,eAAO,MAAM,wBAAwB,EAAG,gBAAyB,CAAC;AAClE,eAAO,MAAM,2BAA2B,EAAG,iBAA0B,CAAC;AAEtE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACpE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAYvF;AAED,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAI3E;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,MAAM,EAAE,CAIrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAuBxE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC,sBAAsB,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,wBAAwB,GAAG;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAwBlD;AAED,wBAAgB,cAAc,IAAI,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAK1E"}

package/dist/core/events/v3/live-routing.js

@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import { readEventV3ControlState, repairEventV3ControlPair, } from "./control.js";
+import { recordHookSignalV3 } from "./producers/recorder.js";
+export const LIVE_HOOK_V3_PRODUCER_ID = "prd_agent-hook";
+export const LIVE_COMMAND_V3_PRODUCER_ID = "prd_session-tee";
+/**
+ * Resolve the V3-only ledger route. A root without an initialized V3 control
+ * packet is blocked; no producer or consumer may fall back to an older ledger.
+ * Manifest-first crashes are repaired from the immutable packet and every
+ * other invalid state closes the writer gate.
+ */
+export function resolveLiveEventLedgerRouteV3(coordRoot) {
+    let control = readEventV3ControlState(coordRoot);
+    if (control.state === "closed")
+        return { state: "blocked", reason: "v3_not_initialized" };
+    if (control.state === "repairable")
+        control = repairEventV3ControlPair(coordRoot);
+    if (control.state !== "candidate" && control.state !== "active") {
+        return { state: "blocked", reason: `${control.state}:${control.reason}` };
+    }
+    const buildId = liveEventV3BuildId(control.genesis.profile.harnery_commit);
+    if (!control.genesis.profile.producer_build_ids.includes(buildId)) {
+        return { state: "blocked", reason: "live_producer_build_not_approved" };
+    }
+    return { state: "v3", mode: control.state, build_id: buildId };
+}
+export function liveEventV3BuildId(harneryCommit) {
+    const exact = harneryCommit.normalize("NFC");
+    if (/^[a-zA-Z0-9._-]{1,120}$/.test(exact))
+        return `build_${exact}`;
+    return `build_${createHash("sha256").update(exact).digest("hex")}`;
+}
+export function liveInstanceIdV3(instanceId) {
+    if (/^inst_[a-zA-Z0-9._-]{1,128}$/.test(instanceId))
+        return instanceId;
+    if (/^[a-zA-Z0-9._-]{1,128}$/.test(instanceId))
+        return `inst_${instanceId}`;
+    return `inst_${createHash("sha256").update(instanceId.normalize("NFC")).digest("hex")}`;
+}
+/**
+ * The adapter-native id a canonical `inst_*` id carries, for display and for
+ * joins against native-keyed records. Only the direct prefix form round-trips:
+ * a hashed id has no recoverable native form and is returned unchanged, so
+ * never treat this as a guaranteed inverse of `liveInstanceIdV3`.
+ */
+export function nativeInstanceIdV3(instanceId) {
+    return instanceId.startsWith("inst_") ? instanceId.slice("inst_".length) : instanceId;
+}
+export function hookSignalV3(eventName) {
+    switch (eventName) {
+        case "session-start":
+        case "session-end":
+        case "user-prompt-submit":
+        case "stop":
+        case "stop-failure":
+        case "pre-tool-use":
+        case "post-tool-use":
+        case "post-tool-use-failure":
+        case "permission-request":
+        case "sub-agent-start":
+        case "sub-agent-stop":
+        case "pre-compact":
+        case "post-compact":
+            return eventName;
+        case "before-shell-execution":
+            return "pre-tool-use";
+        case "after-shell-execution":
+            return "post-tool-use";
+        default:
+            return undefined;
+    }
+}
+export function recordLiveHookSignalV3(input) {
+    const signal = hookSignalV3(input.eventName);
+    if (!signal)
+        return { state: "ignored" };
+    return recordHookSignalV3({
+        coordRoot: input.coordRoot,
+        mode: input.route.mode,
+        signal,
+        payload: input.payload ?? { raw: {} },
+        adapter: input.adapter,
+        instance_id: liveInstanceIdV3(input.instanceId),
+        run_id: input.run_id,
+        workflow_id: input.workflow_id,
+        workflow_agent_id: input.workflow_agent_id,
+        producer_id: LIVE_HOOK_V3_PRODUCER_ID,
+        build_id: input.route.build_id,
+        platform: livePlatformV3(),
+        ...(input.bridge ? { bridge: input.bridge } : {}),
+        monotonic_ns: input.monotonic_ns,
+        hook_name: input.hook_name,
+        hook_duration_ms: input.hook_duration_ms,
+        stop_remediation: input.stop_remediation,
+        turn_ritual: input.turn_ritual,
+        ...(input.defer_drain ? { writerOptions: { deferDrain: true } } : {}),
+    });
+}
+export function livePlatformV3() {
+    if (process.platform === "linux")
+        return "linux";
+    if (process.platform === "win32")
+        return "windows";
+    if (process.platform === "darwin")
+        return "macos";
+    return "unknown";
+}

package/dist/core/events/v3/producers/command-recorder.d.ts

@@ -0,0 +1,67 @@
+import type { Adapter } from "../../../adapter.js";
+import type { EventV3 } from "../contract.js";
+import { type EventV3WriteMode } from "../control.js";
+import { type WriteEventV3Options, type WriteEventV3Result } from "../writer.js";
+import { type CommandObservationV3, type CommandSignalV3 } from "./command.js";
+export interface RecordCommandSignalV3Input {
+    coordRoot: string;
+    mode: EventV3WriteMode;
+    signal: CommandSignalV3;
+    observation: CommandObservationV3;
+    adapter: Adapter;
+    instance_id: `inst_${string}`;
+    producer_id: `prd_${string}`;
+    build_id: `build_${string}`;
+    platform: "linux" | "windows" | "macos" | "unknown";
+    bridge?: "codex-wsl";
+    monotonic_ns?: string;
+    observed_at?: string;
+    writerOptions?: WriteEventV3Options;
+}
+export type RecordCommandSignalV3Result = {
+    state: "gate_closed";
+    reason: string;
+} | {
+    state: "generation_unavailable";
+    reason: string;
+} | {
+    state: "command_span_unstarted";
+} | {
+    state: "missing_observation_id";
+} | {
+    state: "already_recorded";
+    event_id: string;
+} | {
+    state: "recorded";
+    event: EventV3;
+    durability: WriteEventV3Result;
+    recovered: boolean;
+};
+/**
+ * Join a CLI/session-tee command to an already-started hook generation and
+ * record it through its own crash-recoverable producer sequence. This is
+ * inert until the exact candidate or active control gate is open.
+ */
+export declare function recordCommandSignalV3(input: RecordCommandSignalV3Input): RecordCommandSignalV3Result;
+export interface CloseAbandonedCommandSpansV3Input {
+    coordRoot: string;
+    mode: EventV3WriteMode;
+    generation_id: `gen_${string}`;
+    build_id: `build_${string}`;
+    platform: "linux" | "windows" | "macos" | "unknown";
+    observed_at: string;
+    writerOptions?: WriteEventV3Options;
+}
+export interface CloseAbandonedCommandSpansV3Result {
+    closed: number;
+    skipped: number;
+}
+/**
+ * Session-end command closer (ADR 0078): every non-terminal command span of
+ * the ending generation gets a derived `command.completed` with an unknown
+ * outcome, so a `process.exit` or SIGKILL that outran the CLI's finalize can
+ * no longer leave the generation with an unpaired command forever. Command
+ * spans never block turns; this exists for corpus honesty and invariant 11.
+ */
+export declare function closeAbandonedCommandSpansV3(input: CloseAbandonedCommandSpansV3Input): CloseAbandonedCommandSpansV3Result;
+//# sourceMappingURL=command-recorder.d.ts.map

package/dist/core/events/v3/producers/command-recorder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-recorder.d.ts","sourceRoot":"","sources":["../../../../../src/core/events/v3/producers/command-recorder.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAOnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,KAAK,gBAAgB,EAA2B,MAAM,eAAe,CAAC;AAM/E,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAExB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAErB,MAAM,cAAc,CAAC;AA0CtB,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,eAAe,CAAC;IACxB,WAAW,EAAE,oBAAoB,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE,OAAO,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,KAAK,EAAE,wBAAwB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,KAAK,EAAE,wBAAwB,CAAA;CAAE,GACnC;IAAE,KAAK,EAAE,wBAAwB,CAAA;CAAE,GACnC;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC;AAE9F;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,0BAA0B,GAChC,2BAA2B,CAgI7B;AAED,MAAM,WAAW,iCAAiC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,aAAa,EAAE,OAAO,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,iCAAiC,GACvC,kCAAkC,CA8HpC"}