harnery 0.33.0 → 0.34.0

package/dist/core/agents/codex-archive-v3.js

@@ -0,0 +1,110 @@
+import { copyFileSync, existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { createRequire } from "node:module";
+import { homedir, tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { normalizeNativeIdV3 } from "../events/v3/canonical.js";
+import { readEventV3ControlState } from "../events/v3/control.js";
+import { fingerprintContextV3 } from "../events/v3/fingerprint-keys.js";
+import { listHookProducerStateRecordsV3 } from "../events/v3/producers/recorder.js";
+const require = createRequire(import.meta.url);
+/** bun:sqlite is Bun-only. The web dashboard runs under Node and must be able
+ * to import this module without crashing; a missing engine returns no rows. */
+function openReadonlyDatabase(path) {
+    try {
+        const { Database } = require("bun:sqlite");
+        return new Database(path, { readonly: true, strict: true });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read only Codex's durable lifecycle columns. Conversation content, titles,
+ * working directories, and model metadata never leave the adapter database.
+ */
+export function readCodexArchiveObservationsV3(coordRoot, options = {}) {
+    const diagnostics = [];
+    const databasePath = options.databasePath ?? locateCodexStateDatabase();
+    if (!databasePath)
+        return { observations: [], diagnostics: ["codex_state_database_missing"] };
+    const control = readEventV3ControlState(coordRoot);
+    if (control.state !== "candidate" && control.state !== "active") {
+        return { observations: [], diagnostics: ["event_v3_control_unavailable"] };
+    }
+    const context = fingerprintContextV3(coordRoot, control.genesis.event.scope.root_id, undefined, control.genesis.profile.privacy_key_epoch);
+    const liveCodexStateIds = new Set(listHookProducerStateRecordsV3(coordRoot)
+        .filter(({ state }) => state.adapter === "codex")
+        .map(({ path }) => basename(path, ".json")));
+    const snapshotDir = mkdtempSync(join(tmpdir(), "harnery-codex-state-"));
+    const snapshotPath = join(snapshotDir, basename(databasePath));
+    try {
+        copyFileSync(databasePath, snapshotPath);
+        for (const suffix of ["-wal", "-shm"]) {
+            const source = `${databasePath}${suffix}`;
+            if (existsSync(source))
+                copyFileSync(source, `${snapshotPath}${suffix}`);
+        }
+        const db = openReadonlyDatabase(snapshotPath);
+        if (!db) {
+            diagnostics.push("codex_archive_sqlite_unavailable");
+            return { observations: [], diagnostics };
+        }
+        try {
+            const rows = db
+                .query("SELECT id, archived, archived_at, updated_at_ms FROM threads")
+                .all();
+            return {
+                observations: rows
+                    .filter((row) => liveCodexStateIds.has(normalizeNativeIdV3(context, "codex.session", row.id)))
+                    .map((row) => ({
+                    adapter: "codex",
+                    native_session_id: row.id,
+                    archived: row.archived === 1,
+                    observed_at: epochToIso(row.archived_at) ??
+                        epochToIso(row.updated_at_ms) ??
+                        options.observedAt ??
+                        new Date().toISOString(),
+                })),
+                diagnostics,
+            };
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch (error) {
+        diagnostics.push(`codex_archive_scan_failed:${error.message}`);
+        return { observations: [], diagnostics };
+    }
+    finally {
+        rmSync(snapshotDir, { recursive: true, force: true });
+    }
+}
+function locateCodexStateDatabase() {
+    const explicit = process.env.HARNERY_CODEX_STATE_DB?.trim();
+    if (explicit && existsSync(explicit))
+        return explicit;
+    for (const candidate of [
+        join(homedir(), ".codex", "state_5.sqlite"),
+        join(homedir(), ".codex", "sqlite", "state_5.sqlite"),
+    ]) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    const usersRoot = "/mnt/c/Users";
+    if (!existsSync(usersRoot))
+        return null;
+    for (const user of readdirSync(usersRoot).sort()) {
+        const candidate = join(usersRoot, user, ".codex", "state_5.sqlite");
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+function epochToIso(value) {
+    if (value === null || !Number.isFinite(value) || value <= 0)
+        return null;
+    const milliseconds = value < 10_000_000_000 ? value * 1_000 : value;
+    const date = new Date(milliseconds);
+    return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}

package/dist/core/agents/coord-client.d.ts

@@ -21,47 +21,6 @@ export declare function assertSafeInstanceId(value: unknown): asserts value is s
  * caller constructs a filename from a different untrusted source.
  */
 export declare function resolveContainedFile(directory: string, fileName: string): string;
-export interface Heartbeat {
-    instance_id: string;
-    name?: string;
-    kind?: string;
-    session_id: string;
-    agent_id: string;
-    model: string;
-    started_at: string;
-    last_heartbeat: string;
-    files_touched: string[];
-    agent_type?: string;
-    /** Most recent tool name stamped by the PostToolUse hook. Phase 1. */
-    last_tool?: string;
-    /** Short string identifying what the last tool acted on (file path, command head, URL). Phase 1. */
-    last_tool_target?: string;
-    /** Free-form task/intent string set via `harn agents set-task`. Phase 2. */
-    task?: string;
-    /** UTC ISO-8601 timestamp when task was last set/cleared. Used by adapters without Stop enforcement to compute staleness. 2026-05-24. */
-    task_updated_at?: string | null;
-    /** Current evidence-derived activity axis. */
-    activity?: "unknown" | "working" | "needs_input" | "idle";
-    activity_updated_at?: string;
-    activity_source?: string;
-    /** Explicit task lifecycle axis. */
-    task_state?: "active" | "blocked" | "done";
-    task_state_updated_at?: string;
-    task_state_reason?: string;
-    /** Session name built on the first non-empty set-task; its presence means "this session has been named". 2026-08-09. */
-    suggested_session_name?: string;
-    /** Stamped by turn.stop once the suggested name is seen in assistant reply text. 2026-08-09. */
-    session_name_seen_at?: string;
-    /** Which suggested name the latest sighting covered. */
-    session_name_seen_for?: string;
-    /** Auto-generated per-turn summary written by the Stop hook via Haiku. 2026-05-23. */
-    turn_summary?: string | null;
-    /** UTC ISO-8601 timestamp when turn_summary was last refreshed. */
-    turn_summary_updated_at?: string | null;
-    /** Hook client: `claude-code` (default) or `cursor`. Cursor Phase 1. */
-    platform?: string;
-    workflow_run_id?: string;
-}
 /**
  * Resolve the monorepo root for coord-state purposes.
  *
@@ -73,8 +32,8 @@ export declare function monorepoRoot(): string | null;
  * THE coordination-root resolution. Every surface — the hooks, the CLI's reads,
  * and the CLI's canonical emits — resolves through this one function, because a
  * root the two layers disagree about is a root that silently breaks the
- * end-of-turn rules: the hook evaluates `state.status_checked` from the stream
- * it reads, so an emit into a different `.harnery/events.ndjson` is invisible
+ * end-of-turn rules: the hook evaluates `coord.status_observed` from the stream
+ * it reads, so an emit into a different V3 ledger root is invisible
  * and rule 1/3 blocks a turn that did run `agents status`, with no sequence of
  * CLI commands able to satisfy it.
  *
@@ -108,7 +67,7 @@ export declare function nearestCoordRoot(start: string): string | null;
  * Does this root's `.harnery/` already know the process asking?
  *
  * Two discriminators, both genuinely about *this* session: the adapter-exported
- * session id matching a live heartbeat, and a pid-map row on our own ppid
+ * session id matching live V3 producer state, and a pid-map row on our own ppid
  * chain. Deliberately NOT the single-live-agent fallback that owner resolution
  * ends with — a lone stranger in the wrong root is exactly how `whoami` came to
  * report another agent's name and task as its own.
@@ -171,52 +130,31 @@ export declare function resolveOwnerByPidmap(root: string): {
     owner: string | null;
     source: "pidmap" | "pidmap_fallback" | "none";
 };
+/** Read normalized candidates from the first non-empty adapter session-id env var. */
 /**
- * Resolve the owner by matching the adapter session-id env var against the
- * `session_id` of a live heartbeat in this coord root. Returns the matching
- * `instance_id`, or null if there's no session-id env var or no live heartbeat
- * carries it. "Live" reuses the same 10-minute freshness window the singleton
- * fallback applies, so a stale heartbeat from a prior session of the same id
- * doesn't resolve. When legacy Cursor Glass state contains both the canonical
- * bare id and its raw `bc-` alias, candidate order wins first; ties prefer a
- * named heartbeat, then the newest heartbeat, with instance id as a stable
- * final tie-breaker. Filesystem enumeration order never decides identity.
+ * First adapter/bridge-stamped session id from the environment, WITHOUT the
+ * live-heartbeat validation resolveOwnerBySessionEnv applies. A fresh session
+ * has no heartbeat until its first set-task, so heartbeat-validated resolution
+ * returns null there by design; commands that REGISTER a session (set-task)
+ * may use this id directly — it carries the same trust as an explicit
+ * `--session-id` argument, because the adapter or connector stamped it.
+ */
+export declare function sessionIdentityFromEnv(): string | null;
+/**
+ * Resolve the owner by joining adapter session environment to the live V3
+ * hook-producer state. A missing, terminal, or ambiguous generation fails
+ * closed. The disposable cache is consulted only to recover the native
+ * instance label bound to an already-authoritative canonical instance.
  *
  * Exported for unit testing with an injectable root.
  */
 export declare function resolveOwnerBySessionEnv(root: string): string | null;
 /**
- * Return the instance_id of the sole live agent in this coord root, or null
- * if there are zero or more than one. "Live" reuses the 10-minute heartbeat
- * freshness window the rest of the agents surface applies (kept inline as a
- * literal so this file stays node-builtins-only for vendored downstream use).
+ * Return the native instance label of the sole live V3 generation in this
+ * coord root, or null if there are zero or more than one.
  *
  * Exported for unit testing with an injectable root (the caller in
  * `resolveOwnerWithSource` passes `monorepoRoot()`).
  */
 export declare function resolveSingleActiveOwner(root: string): string | null;
-/**
- * Read and parse a heartbeat file. Returns null if the file is missing,
- * unreadable, or contains malformed JSON. Does not throw.
- *
- * Phase 8 cleanup (2026-05-27): the v1/v2 dual-write bridge is gone; the
- * projector writes additively-merged heartbeats directly to
- * `.harnery/active/<id>.json` (the canonical location every reader expects).
- */
-export declare function readHeartbeat(instanceId: string): Heartbeat | null;
-/**
- * Render the display form for an instance_id: `agent-<Name>` if the heartbeat
- * carries a non-empty `.name`, else `agent-<8-char-hex-prefix>`.
- *
- * Hex fallback handles three cases cleanly:
- *  - heartbeat written before this feature shipped (no `name` field)
- *  - heartbeat pruned but instance_id still appears in older log lines
- *  - the narrow window between instance_id resolution and heartbeat read
- */
-export declare function displayName(instanceId: string): string;
-/**
- * Convenience: resolve self via ppid walk, then render. Returns
- * `agent-unknown` when the walk fails.
- */
-export declare function selfDisplayName(): string;
 //# sourceMappingURL=coord-client.d.ts.map

package/dist/core/agents/coord-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yIAAyI;IACzI,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,CAAC;IAC1D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IAC3C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wHAAwH;IACxH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gGAAgG;IAChG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mEAAmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CA+B7E;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAiED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2CxD;AAgCD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CAwCA;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC;CAC/C,CAyBA;AA2DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgDpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMlE;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC"}
+{"version":3,"file":"coord-client.d.ts","sourceRoot":"","sources":["../../../src/core/agents/coord-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAWhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAI5E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOhF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CA+B7E;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7D;AAeD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAiED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2CxD;AAgCD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;CAC5F,CA2CA;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,QAAQ,GAAG,iBAAiB,GAAG,MAAM,CAAC;CAC/C,CAyBA;AAqBD,sFAAsF;AACtF;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAEtD;AAuCD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYpE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOpE"}

package/dist/core/agents/coord-client.js

@@ -9,6 +9,7 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
+import { listHookProducerStateRecordsV3, readHookProducerStateV3, } from "../events/v3/producers/recorder.js";
 // NOTE: kept dependency-free (node builtins only); this file is vendored verbatim into
 // a downstream consumer, so it cannot import the coordEnv helper.
 const MAX_INSTANCE_ID_LENGTH = 128;
@@ -63,8 +64,8 @@ export function monorepoRoot() {
  * THE coordination-root resolution. Every surface — the hooks, the CLI's reads,
  * and the CLI's canonical emits — resolves through this one function, because a
  * root the two layers disagree about is a root that silently breaks the
- * end-of-turn rules: the hook evaluates `state.status_checked` from the stream
- * it reads, so an emit into a different `.harnery/events.ndjson` is invisible
+ * end-of-turn rules: the hook evaluates `coord.status_observed` from the stream
+ * it reads, so an emit into a different V3 ledger root is invisible
  * and rule 1/3 blocks a turn that did run `agents status`, with no sequence of
  * CLI commands able to satisfy it.
  *
@@ -121,7 +122,7 @@ export function resolveCoordRoot(start = process.cwd()) {
     if (gitRoots.length > 0)
         return gitRoots[0];
     // Nothing carries `.harnery/` yet. Hand back the enclosing checkout so a
-    // first run (`harn init`, agent-hook's session.start) has somewhere to
+    // first run (`harn init`, agent-hook's session.started) has somewhere to
     // create it.
     return gitToplevel(start);
 }
@@ -147,7 +148,7 @@ function ancestorCoordRoots(start) {
  * Does this root's `.harnery/` already know the process asking?
  *
  * Two discriminators, both genuinely about *this* session: the adapter-exported
- * session id matching a live heartbeat, and a pid-map row on our own ppid
+ * session id matching live V3 producer state, and a pid-map row on our own ppid
  * chain. Deliberately NOT the single-live-agent fallback that owner resolution
  * ends with — a lone stranger in the wrong root is exactly how `whoami` came to
  * report another agent's name and task as its own.
@@ -193,7 +194,7 @@ function gitToplevel(start) {
     return gitRevParse(start, "--show-toplevel");
 }
 function gitRevParse(cwd, flag) {
-    const key = `${cwd}${flag}`;
+    const key = `${cwd}\0${flag}`;
     const cached = gitRevParseCache.get(key);
     if (cached !== undefined)
         return cached;
@@ -353,33 +354,36 @@ export function resolveOwner() {
  * is propagating or the ppid-walk is the load-bearing path.
  */
 export function resolveOwnerWithSource() {
+    const bridge = process.env.HARNERY_AGENT_COORD_BRIDGE?.trim();
     const envOwner = process.env.HARNERY_AGENT_COORD_OWNER?.trim();
-    if (envOwner) {
+    // A bridge-marked child must prove identity through a live V3 producer. An
+    // inherited owner override is only a string, so trusting it here would let a
+    // stale or foreign environment bypass the bridge's fail-closed contract.
+    if (envOwner && !bridge) {
         return { owner: envOwner, source: "env" };
     }
     const root = monorepoRoot();
     if (!root)
         return { owner: null, source: "none" };
-    // Every supported adapter exports its session id into the env of the
-    // subprocess it spawns for a tool call, and each heartbeat records the
-    // session id it was minted under. Matching the two names us outright, even
-    // with many live agents, so it goes ahead of the ppid walk rather than
-    // catching what the walk drops. Cursor needed this first because its
-    // Glass/Agents UI runs several chats under one node ancestor, making that row
-    // last-writer-wins; pid recycling generalises the same hazard to every
-    // adapter.
+    // Every supported adapter exports its native session id into subprocesses.
+    // Match it against the live V3 producer state, never a disposable cache.
     if (shouldPreferSessionEnv()) {
         const bySession = resolveOwnerBySessionEnv(root);
         if (bySession) {
             return { owner: bySession, source: "session_env" };
         }
     }
+    // Connector children cross process-tree boundaries where pid ancestry is
+    // not logical session identity. Once marked, a missing V3 generation is
+    // terminal: never guess through pid-map or singleton fallback.
+    if (bridge)
+        return { owner: null, source: "none" };
     if (!existsSync(resolve(root, ".harnery", "pid-map")))
         return { owner: null, source: "none" };
     const byPidmap = resolveOwnerByPidmap(root);
     if (byPidmap.owner)
         return byPidmap;
-    // Last resort: if exactly one agent is live in this coord root, it's
+    // Last resort: if exactly one V3 generation is live in this coord root, it's
     // unambiguously us — resolve to it. This is what lets the bare `agents
     // status` / `set-task` the stop hook recommends work without a `--session-id`
     // flag in the common single-agent case. With 0 or 2+ live agents it would be
@@ -442,6 +446,17 @@ const SESSION_ID_ENV_VARS = [
     "CODEX_THREAD_ID",
 ];
 /** Read normalized candidates from the first non-empty adapter session-id env var. */
+/**
+ * First adapter/bridge-stamped session id from the environment, WITHOUT the
+ * live-heartbeat validation resolveOwnerBySessionEnv applies. A fresh session
+ * has no heartbeat until its first set-task, so heartbeat-validated resolution
+ * returns null there by design; commands that REGISTER a session (set-task)
+ * may use this id directly — it carries the same trust as an explicit
+ * `--session-id` argument, because the adapter or connector stamped it.
+ */
+export function sessionIdentityFromEnv() {
+    return sessionIdsFromEnv()[0] ?? null;
+}
 function sessionIdsFromEnv() {
     for (const key of SESSION_ID_ENV_VARS) {
         const v = process.env[key]?.trim();
@@ -471,22 +486,17 @@ function sessionIdFromEnv() {
  * agent's name and file list.
  *
  * This only reorders the two. Session-env resolution still requires a live
- * heartbeat carrying that session id, so when it does not match, the walk runs
+ * V3 producer carrying that session id, so when it does not match, the walk runs
  * exactly as before.
  */
 function shouldPreferSessionEnv() {
     return sessionIdFromEnv() !== null;
 }
 /**
- * Resolve the owner by matching the adapter session-id env var against the
- * `session_id` of a live heartbeat in this coord root. Returns the matching
- * `instance_id`, or null if there's no session-id env var or no live heartbeat
- * carries it. "Live" reuses the same 10-minute freshness window the singleton
- * fallback applies, so a stale heartbeat from a prior session of the same id
- * doesn't resolve. When legacy Cursor Glass state contains both the canonical
- * bare id and its raw `bc-` alias, candidate order wins first; ties prefer a
- * named heartbeat, then the newest heartbeat, with instance id as a stable
- * final tie-breaker. Filesystem enumeration order never decides identity.
+ * Resolve the owner by joining adapter session environment to the live V3
+ * hook-producer state. A missing, terminal, or ambiguous generation fails
+ * closed. The disposable cache is consulted only to recover the native
+ * instance label bound to an already-authoritative canonical instance.
  *
  * Exported for unit testing with an injectable root.
  */
@@ -494,152 +504,52 @@ export function resolveOwnerBySessionEnv(root) {
     const sessionIds = sessionIdsFromEnv();
     if (sessionIds.length === 0)
         return null;
-    const activeDir = resolve(root, ".harnery", "active");
-    if (!existsSync(activeDir))
-        return null;
-    const FRESHNESS_SECS = 600;
-    const cutoffMs = Date.now() - FRESHNESS_SECS * 1000;
-    let files;
-    try {
-        files = readdirSync(activeDir);
-    }
-    catch {
-        return null;
-    }
-    const matches = [];
-    for (const file of files) {
-        if (!file.endsWith(".json"))
-            continue;
-        try {
-            const parsed = JSON.parse(readFileSync(resolve(activeDir, file), "utf8"));
-            if (!parsed)
-                continue;
-            const sessionPreference = sessionIds.indexOf(parsed.session_id);
-            if (sessionPreference === -1)
-                continue;
-            if (typeof parsed.instance_id !== "string")
-                continue;
-            const ts = Date.parse(parsed.last_heartbeat);
-            if (!Number.isFinite(ts) || ts < cutoffMs)
-                continue;
-            matches.push({
-                instanceId: parsed.instance_id,
-                sessionPreference,
-                hasName: typeof parsed.name === "string" && parsed.name.trim().length > 0,
-                lastHeartbeatMs: ts,
-            });
-        }
-        catch {
-            // skip malformed
+    const adapters = adapterCandidatesFromEnv();
+    const matches = new Set();
+    for (const sessionId of sessionIds) {
+        for (const adapter of adapters) {
+            const state = readHookProducerStateV3(root, adapter, sessionId);
+            if (state && !state.terminal)
+                matches.add(nativeOwnerForV3Instance(root, state.instance_id));
         }
     }
-    matches.sort((a, b) => a.sessionPreference - b.sessionPreference ||
-        Number(b.hasName) - Number(a.hasName) ||
-        b.lastHeartbeatMs - a.lastHeartbeatMs ||
-        a.instanceId.localeCompare(b.instanceId));
-    return matches[0]?.instanceId ?? null;
+    return matches.size === 1 ? [...matches][0] : null;
 }
 /**
- * Return the instance_id of the sole live agent in this coord root, or null
- * if there are zero or more than one. "Live" reuses the 10-minute heartbeat
- * freshness window the rest of the agents surface applies (kept inline as a
- * literal so this file stays node-builtins-only for vendored downstream use).
+ * Return the native instance label of the sole live V3 generation in this
+ * coord root, or null if there are zero or more than one.
  *
  * Exported for unit testing with an injectable root (the caller in
  * `resolveOwnerWithSource` passes `monorepoRoot()`).
  */
 export function resolveSingleActiveOwner(root) {
-    const activeDir = resolve(root, ".harnery", "active");
-    if (!existsSync(activeDir))
-        return null;
-    const FRESHNESS_SECS = 600;
-    const cutoffMs = Date.now() - FRESHNESS_SECS * 1000;
-    const live = [];
-    let files;
-    try {
-        files = readdirSync(activeDir);
-    }
-    catch {
-        return null;
-    }
-    for (const file of files) {
-        if (!file.endsWith(".json"))
-            continue;
-        try {
-            const parsed = JSON.parse(readFileSync(resolve(activeDir, file), "utf8"));
-            if (!parsed || typeof parsed.instance_id !== "string")
-                continue;
-            const ts = Date.parse(parsed.last_heartbeat);
-            if (Number.isFinite(ts) && ts >= cutoffMs)
-                live.push(parsed.instance_id);
-        }
-        catch {
-            // skip malformed
-        }
-        if (live.length > 1)
-            return null; // ambiguous; bail early
-    }
-    return live.length === 1 ? live[0] : null;
+    const live = new Set(listHookProducerStateRecordsV3(root, { includeTerminal: false }).map(({ state }) => nativeOwnerForV3Instance(root, state.instance_id)));
+    return live.size === 1 ? [...live][0] : null;
 }
-/**
- * Read and parse a heartbeat file. Returns null if the file is missing,
- * unreadable, or contains malformed JSON. Does not throw.
- *
- * Phase 8 cleanup (2026-05-27): the v1/v2 dual-write bridge is gone; the
- * projector writes additively-merged heartbeats directly to
- * `.harnery/active/<id>.json` (the canonical location every reader expects).
- */
-export function readHeartbeat(instanceId) {
-    if (!isSafeInstanceId(instanceId))
-        return null;
-    const root = monorepoRoot();
-    if (!root)
-        return null;
-    const path = resolveContainedFile(resolve(root, ".harnery", "active"), `${instanceId}.json`);
-    return readJsonHeartbeatFile(path);
+function adapterCandidatesFromEnv() {
+    const value = process.env.HARNERY_AGENT_COORD_PLATFORM?.trim();
+    if (value === "claude-code" || value === "codex" || value === "cursor")
+        return [value];
+    return ["claude-code", "codex", "cursor"];
 }
-function readJsonHeartbeatFile(path) {
-    if (!existsSync(path))
-        return null;
+function nativeOwnerForV3Instance(root, instanceId) {
+    const activeDir = resolve(root, ".harnery", "active");
     try {
-        const raw = readFileSync(path, "utf8");
-        const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === "object" && typeof parsed.instance_id === "string") {
-            return parsed;
+        for (const file of readdirSync(activeDir)) {
+            if (!file.endsWith(".json"))
+                continue;
+            const parsed = JSON.parse(readFileSync(resolve(activeDir, file), "utf8"));
+            if (parsed.schema_version === 2 &&
+                parsed.v3_instance_id === instanceId &&
+                typeof parsed.instance_id === "string") {
+                return parsed.instance_id;
+            }
         }
-        return null;
     }
     catch {
-        return null;
-    }
-}
-/**
- * Render the display form for an instance_id: `agent-<Name>` if the heartbeat
- * carries a non-empty `.name`, else `agent-<8-char-hex-prefix>`.
- *
- * Hex fallback handles three cases cleanly:
- *  - heartbeat written before this feature shipped (no `name` field)
- *  - heartbeat pruned but instance_id still appears in older log lines
- *  - the narrow window between instance_id resolution and heartbeat read
- */
-export function displayName(instanceId) {
-    if (!instanceId)
-        return "agent-unknown";
-    const hb = readHeartbeat(instanceId);
-    if (hb && typeof hb.name === "string" && hb.name.length > 0) {
-        return `agent-${hb.name}`;
+        // The producer state remains authoritative; fall through to the canonical label.
     }
-    return `agent-${instanceId.slice(0, 8)}`;
-}
-/**
- * Convenience: resolve self via ppid walk, then render. Returns
- * `agent-unknown` when the walk fails.
- */
-export function selfDisplayName() {
-    const owner = resolveOwner();
-    if (!owner)
-        return "agent-unknown";
-    return displayName(owner);
+    return instanceId.startsWith("inst_") ? instanceId.slice(5) : instanceId;
 }
 function readPpid(pid) {
     // Linux/WSL fast path: /proc/<pid>/status carries `PPid:`.

package/dist/core/agents/finalization.d.ts

@@ -11,6 +11,9 @@ export interface GitFinalizationResult {
     claim_history_complete: boolean;
     dirty_paths: string[];
     unpushed_repos: string[];
+    behind_repos: string[];
+    stale_submodules: string[];
+    diverged_submodules: string[];
     host_output_paths: string[];
     unsupported_paths: UnsupportedFinalizationPath[];
     unverifiable_paths: string[];
@@ -49,7 +52,7 @@ export interface SessionWriteClaims {
  * a commit. Current heartbeat claims describe dirty ownership; this history is
  * what keeps the touched repository in scope until its commits are pushed.
  */
-export declare function readSessionWriteClaims(coordRoot: string, instanceId: string, sessionId: string): SessionWriteClaims;
+export declare function readSessionWriteClaims(coordRoot: string, instanceId: string, _sessionId: string): SessionWriteClaims;
 /**
  * Resolve one guarded write to the host's single supported end-turn
  * disposition. Claim event data never grants authority: every call starts from

package/dist/core/agents/finalization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finalization.d.ts","sourceRoot":"","sources":["../../../src/core/agents/finalization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,KAAK,4BAA4B,EAA2B,MAAM,cAAc,CAAC;AA4B1F,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,sBAAsB,EAAE,OAAO,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,EAAE,2BAA2B,EAAE,CAAC;IACjD,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,6BAA6B,GACrC,4BAA4B,GAC5B,2BAA2B,GAC3B,8BAA8B,GAC9B,gCAAgC,GAChC,4BAA4B,GAC5B,oBAAoB,CAAC;AAEzB,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,4BAA4B,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,KAAK,EAAE,IAAI,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,GACD;IACE,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,6BAA6B,CAAC;CACvC,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,kBAAkB,CA+BpB;AA+JD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,yBAAyB,CA2D3B;AA2ED,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,qBAAqB,CA6EvB;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAkD/F;AAmBD,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,OAAO,CAAC,yBAAyB,EAAE;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC,EAC9D,GAAG,EAAE,MAAM,GACV,MAAM,CAQR"}
+{"version":3,"file":"finalization.d.ts","sourceRoot":"","sources":["../../../src/core/agents/finalization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,KAAK,4BAA4B,EAA2B,MAAM,cAAc,CAAC;AA2B1F,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,sBAAsB,EAAE,OAAO,CAAC;IAChC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,EAAE,2BAA2B,EAAE,CAAC;IACjD,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,MAAM,6BAA6B,GACrC,4BAA4B,GAC5B,2BAA2B,GAC3B,8BAA8B,GAC9B,gCAAgC,GAChC,4BAA4B,GAC5B,oBAAoB,CAAC;AAEzB,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,6BAA6B,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,4BAA4B,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,KAAK,EAAE,IAAI,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,2BAA2B,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,GACD;IACE,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,6BAA6B,CAAC;CACvC,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CASpB;AA+JD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,yBAAyB,CA2D3B;AAqID,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/C,qBAAqB,CA2FvB;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAgF/F;AAmBD,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,OAAO,CAAC,yBAAyB,EAAE;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,CAAC,EAC9D,GAAG,EAAE,MAAM,GACV,MAAM,CAQR"}