mtech-ai-local-runner 0.1.110 → 0.1.111

package/README.md

@@ -1,3 +1,21 @@
+## 0.1.111: Work Rooms in the menu bar app
+
+The menu bar window now has a **Rooms** tab (Gateway Work Item b35d65cb); the menu's **Show Rooms (n unread)…** opens
+it. Pick a Room, then a thread: it shows the newest 20 messages and every unread one, with unread ones marked.
+**Mark read (n)** marks them read. Write a reply and press **Review reply**; it is posted only after you confirm the
+members it goes to ("Post to 3 members: …?"). If the members changed meanwhile, the window shows the new list and asks
+again. A Room notice opens the Rooms tab at that Room while the runner is connected.
+
+- For the Rooms tab the runner calls only `work_room_read`, `work_room_receipt_report` and `work_room_write` operation
+  `post`, one at a time, with your own runner sign-in. Room creation, members, new threads and outcome shares stay in
+  your AI session; archived Rooms are read-only.
+- Room names, titles and messages stay in memory: neither the runner nor the app writes them to disk or a log.
+  Notifications stay generic.
+- A reply is at most 8,000 bytes, the Gateway's own limit.
+
+0.1.111 also carries the D4 bounded CLI review wiring merged after 0.1.110 (PR #938). Nothing supplies a D4 execution
+host yet, so D4 execution stays closed.
+
 ## 0.1.110: Claude returns its report through `--json-schema`
 
 Claude jobs now pass `--json-schema`, and the model returns its completion report by calling Claude Code's

package/dist/src/adapters/claude-code/adapter.js

@@ -1,4 +1,4 @@
-import { assertD4PackageLimitSupport, assertCurrentD4LimitSupport } from '../../safety/d4-execution-limits.js';
+import { assertD4PackageLimitSupport, assertCurrentD4LimitSupport, D4ObservedLimitWatchdog, D4CliUsageTracker } from '../../safety/d4-execution-limits.js';
 import { CLAUDE_TOKEN_FD, CLAUDE_TOKEN_FD_ENV, pathWithKeychainStub } from "../../safety/claude-runner-token.js";
 import { candidateReviewCompletion } from '../../safety/candidate-review-report.js';
 import path from "node:path";
@@ -104,6 +104,9 @@ export class ClaudeCodeAdapter {
     started = false;
     p1 = false;
     candidateReview = false;
+    d4Limits;
+    d4Guard;
+    d4Usage = new D4CliUsageTracker();
     startupAcquisition;
     revokedTools;
     revokeFailed = false;
@@ -135,7 +138,9 @@ export class ClaudeCodeAdapter {
         let acquired;
         this.startupAcquisition = new Promise(resolve => { acquired = resolve; });
         try {
-            assertD4PackageLimitSupport(ctx.taskPackage, ctx.approvedTaskPackage, ctx.resumeSessionId);
+            this.d4Limits = assertD4PackageLimitSupport(ctx.taskPackage, ctx.approvedTaskPackage, ctx.resumeSessionId);
+            if (this.d4Limits && !this.options.d4ExecutionHost)
+                throw Error('D4_REVIEW_HOST_REQUIRED');
             const generation = ctx.generation;
             if (!Number.isSafeInteger(generation) || generation === undefined || generation < 1)
                 throw new Error("JOB_SECURITY_REJECTED");
@@ -160,8 +165,25 @@ export class ClaudeCodeAdapter {
             assertAdmission();
             const toolInventory = claudeJobToolInventory(this.options.securityPolicy);
             this.candidateReview = toolInventory === 'local-tools-d4-review-v1';
-            if (this.candidateReview)
+            if (this.candidateReview && !this.d4Limits)
                 assertCurrentD4LimitSupport();
+            if (this.d4Limits && !this.candidateReview)
+                throw Error('D4_REVIEW_INVENTORY_REJECTED');
+            const assertD4Host = async () => {
+                if (!this.d4Limits)
+                    return;
+                // Recheck both immutable packages around asynchronous preparation; equality alone is not host authority.
+                assertD4PackageLimitSupport(ctx.taskPackage, ctx.approvedTaskPackage, ctx.resumeSessionId);
+                const descriptor = ctx.approvedTaskPackage.candidate_review_execution;
+                const profile = descriptor.profile, host = this.options.d4ExecutionHost;
+                if (ctx.generation !== 1 || resolvedModelId !== profile.model_id || host.runnerReleaseSha256 !== profile.runner_release_sha256 || host.hostPolicySha256 !== profile.host_policy_sha256
+                    || this.options.securityPolicy?.pin.toolsSha256 !== profile.tools_sha256 || this.options.securityPolicy?.pin.requirementsSha256 !== profile.cli_security_fingerprint
+                    || this.options.securityPolicy?.pin.securityMode !== CLAUDE_RELEASE_MODE)
+                    throw Error('D4_REVIEW_HOST_REQUIRED');
+                await host.assertCurrent(structuredClone(descriptor));
+            };
+            if (this.d4Limits)
+                await assertD4Host();
             if (!ctx.securityBinding)
                 throw new Error('SECURITY_REQUIREMENTS_REJECTED');
             this.receipt = createJobSecurityReceipt(this.options.securityPolicy, { jobId: this.options.jobId ?? ctx.bindingId, generation, modelId: resolvedModelId, sourceSha: this.options.securityPolicy.pin.sourceSha, ...ctx.securityBinding, requirements: ctx.approvedTaskPackage?.security_requirements });
@@ -196,7 +218,7 @@ export class ClaudeCodeAdapter {
             const mcpConfigPath = this.options.writeLocalMcpConfig(endpoint);
             const maxBudgetUsd = unbounded
                 ? null
-                : Math.min(this.options.maxBudgetUsd, contractBudget(ctx.taskPackage));
+                : Math.min(this.options.maxBudgetUsd, this.d4Limits ? this.d4Limits.max_estimated_cost_microusd / 1_000_000 : contractBudget(ctx.taskPackage));
             const hookPolicy = buildHookPolicy({
                 taskPackage: ctx.taskPackage,
                 worktreeRoot: this.options.worktreeRoot,
@@ -227,12 +249,43 @@ export class ClaudeCodeAdapter {
             if (this.cancelled)
                 throw new Error('adapter startup cancelled');
             assertAdmission();
+            if (this.d4Limits)
+                await assertD4Host();
+            if (this.d4Limits)
+                await this.options.assertCurrentInputs?.();
+            if (this.cancelled)
+                throw new Error('adapter startup cancelled');
+            if (this.d4Limits) {
+                assertD4PackageLimitSupport(ctx.taskPackage, ctx.approvedTaskPackage, ctx.resumeSessionId);
+                assertAdmission();
+            }
             const handle = this.options.processHost.spawn(this.options.binaryPath ?? "claude", args, {
                 cwd,
                 env,
                 ...(claudeToken === null ? {} : { secretFd3: claudeToken }),
             });
             this.handle = handle;
+            if (this.d4Limits) {
+                this.d4Guard = new D4ObservedLimitWatchdog(this.d4Limits, { revoke: () => {
+                        this.localReadObservations();
+                        this.revokeSecurity();
+                        this.revokeTools(this.tools);
+                        if (this.revokeFailed)
+                            throw Error('D4_STOP_UNCONFIRMED');
+                    } });
+                try {
+                    this.d4Guard.attach(handle);
+                }
+                catch (error) {
+                    // We own this spawn but cannot certify its process group. Stop the child best-effort;
+                    // cleanup remains unconfirmed and must never turn into a passing review.
+                    try {
+                        handle.kill('SIGKILL');
+                    }
+                    catch { /* Preserve the failed ownership proof. */ }
+                    throw error;
+                }
+            }
             if (this.cancelled)
                 throw new Error("adapter startup cancelled");
             handle.stdin.write(claudeUserInput(prompt));
@@ -257,7 +310,8 @@ export class ClaudeCodeAdapter {
         });
         let sawTerminal = false;
         try {
-            for await (const line of handle.stdout) {
+            const lines = this.d4Guard ? this.d4Lines(handle, this.d4Guard) : handle.stdout;
+            for await (const line of lines) {
                 let message;
                 try {
                     const value = JSON.parse(line);
@@ -271,6 +325,29 @@ export class ClaudeCodeAdapter {
                 // A nested agent message is not evidence that the executor has finished.
                 if (message.parent_tool_use_id != null)
                     continue;
+                if (this.d4Guard && message.type === 'assistant') {
+                    const observed = this.d4Usage.assistant(message);
+                    if (observed) {
+                        await this.d4Guard.observe(observed);
+                        if (this.d4Guard.diagnostic().status !== 'active') {
+                            yield { eventType: 'failed', summary: this.d4Guard.diagnostic().reason_code ?? 'D4_USAGE_UNAVAILABLE' };
+                            return;
+                        }
+                    }
+                }
+                let d4Usage;
+                if (this.d4Guard && message.type === 'result') {
+                    try {
+                        d4Usage = this.d4Usage.final(message);
+                        await this.d4Guard.complete(d4Usage);
+                    }
+                    catch (error) {
+                        if (this.d4Guard.diagnostic().status === 'active')
+                            await this.d4Guard.complete().catch(() => { });
+                        yield { eventType: 'failed', summary: this.d4Guard.diagnostic().reason_code ?? 'D4_USAGE_UNAVAILABLE' };
+                        return;
+                    }
+                }
                 let parsed = parseClaudeLine(line, this.options.worktreeRoot, { p1: this.p1 });
                 if (!parsed)
                     continue;
@@ -279,6 +356,8 @@ export class ClaudeCodeAdapter {
                     parsed = structuredCompletionEvent(message, parsed.payload?.cost_usd);
                     if (this.candidateReview)
                         parsed = candidateReviewCompletion(parsed);
+                    if (d4Usage)
+                        parsed = { ...parsed, payload: { ...parsed.payload, d4_usage: { ...d4Usage, policy: 'observed_stop_possible_overshoot' } } };
                     if (this.p1)
                         parsed = p1ModelEvent({ ...parsed, payload: { ...parsed.payload, usage: observedUsage } });
                 }
@@ -294,11 +373,20 @@ export class ClaudeCodeAdapter {
                 yield { eventType: "failed", summary: `claude process exited unexpectedly (code ${exitInfo.code ?? "unknown"})` };
             }
         }
+        catch (error) {
+            if (!this.d4Guard)
+                throw error;
+            if (this.d4Guard.diagnostic().status === 'active')
+                await this.d4Guard.complete().catch(() => { });
+            yield { eventType: 'failed', summary: this.d4Guard.diagnostic().reason_code ?? 'D4_USAGE_UNAVAILABLE' };
+        }
         finally {
             await this.cleanup();
         }
     }
     async command(command) {
+        if (this.candidateReview)
+            throw Error('D4_SUPERVISOR_CONTINUATION_REJECTED');
         if (!ALLOWED_SUPERVISOR_COMMANDS.has(command.command)) {
             throw new Error(`unsupported supervisor command: ${command.command} is not allowed for this adapter`);
         }
@@ -394,7 +482,9 @@ export class ClaudeCodeAdapter {
                 failed = true;
             }
             try {
-                if (handle?.terminateOwned)
+                if (this.d4Guard)
+                    await this.d4Guard.cancel();
+                else if (handle?.terminateOwned)
                     await handle.terminateOwned();
                 else
                     handle?.kill('SIGKILL');
@@ -415,6 +505,18 @@ export class ClaudeCodeAdapter {
             this.cleanupPromise = operation;
         return operation;
     }
+    /** Race a silent CLI against the owned watchdog; stop evidence never depends on another stdout line. */
+    async *d4Lines(handle, guard) {
+        const iterator = handle.stdout[Symbol.asyncIterator]();
+        for (;;) {
+            const next = await Promise.race([iterator.next(), guard.stopped().then(() => null)]);
+            if (next === null)
+                throw Error(guard.diagnostic().reason_code ?? 'D4_STOP_UNCONFIRMED');
+            if (next.done)
+                return;
+            yield next.value;
+        }
+    }
     /** Claude Code treats a hook it cannot run as no objection, so the hook runs through Node. */
     requireTrustedHookCommand() {
         return formatHookCommand({

package/dist/src/adapters/claude-code/runtime-options.js

@@ -73,6 +73,7 @@ export function createClaudeCodeAdapterOptions(input) {
         throw new Error('Claude account configuration path must be absolute');
     const tokenStore = new ClaudeRunnerTokenStore({ stateRoot: state });
     return {
+        d4ExecutionHost: input.d4ExecutionHost,
         processHost: new NodeProcessGroupHost(), worktreeRoot: checkout, jobId: input.jobId, claudeToken: () => tokenStore.load(), keychainStub: () => ensureClaudeKeychainStub(state), get securityPolicy() { return securityPolicy; },
         ...(input.securityHost ? { prepareSecurity: async (ctx) => {
                 try {

package/dist/src/daemon/execution-coordinator.js

@@ -1,6 +1,7 @@
 import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt } from '../verification/continuation-runner-contract.js';
 import { completionRejectionDiagnostic } from '../adapters/completion-report.js';
 import { assertCandidateReviewPackages, candidateReviewReport } from '../safety/candidate-review-report.js';
+import { D4_OBSERVED_EXECUTION_SCHEMA } from '../safety/d4-execution-limits.js';
 import { publicationError } from '../publication/failure.js';
 import { PublicationOutcomeUnknownError } from '../publication/publisher.js';
 import { assertP1Bindings, hasP1, p1ModelEvent } from '../verification/p1-execution-host.js';
@@ -178,6 +179,9 @@ export class ExecutionCoordinator {
             assertBoundExecutionAttempt(job, binding.taskPackage, binding.iterationId);
             if (executionAttempt && binding.bindingReplayed !== false)
                 throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
+            if (pkg.candidate_review_execution?.schema_version === D4_OBSERVED_EXECUTION_SCHEMA
+                && (job.generation !== 1 || binding.bindingReplayed !== false))
+                throw Error('D4_BINDING_RECONCILIATION_REQUIRED');
             binding = immutable(structuredClone(binding));
             assertCandidateReviewPackages(pkg, binding.taskPackage);
             if (isP1)
@@ -445,8 +449,10 @@ export class ExecutionCoordinator {
             if (isP1 && !hostProof)
                 event = p1ModelEvent(event);
             const previousStage = executionStage;
+            const d4StopAck = job.taskPackage.candidate_review_execution?.schema_version === D4_OBSERVED_EXECUTION_SCHEMA
+                && ['failed', 'cancelled', 'blocked'].includes(event.eventType);
             let payload = event.payload;
-            if (isTerminalEventType(event.eventType)) {
+            if (isTerminalEventType(event.eventType) && !d4StopAck) {
                 await fenced(observeCleanup());
                 executionStage = 'terminal_evidence';
                 requireControlFence();
@@ -456,6 +462,8 @@ export class ExecutionCoordinator {
                 if (isP1 && event.eventType === 'completed' && p1Result)
                     payload = { ...payload, candidate_commit_sha: p1Result.candidate_commit_sha, snapshot_fingerprint: p1Result.snapshot_fingerprint, changed_paths: p1Result.changed_paths, verification_receipt_ids: [...p1ReceiptIds] };
             }
+            if (d4StopAck)
+                await fenced(observeCleanup());
             // A vendor report cannot supply host observations, even when its shape looks valid.
             if (payload) {
                 payload = { ...payload };
@@ -463,10 +471,10 @@ export class ExecutionCoordinator {
                 delete payload.local_fix_publication;
             }
             // Memory use is bound to this binding's bundle receipt by the runner, never taken from the model (WI 35a84e52).
-            payload = withMemoryUsage(payload, binding.taskPackage, isTerminalEventType(event.eventType));
+            payload = d4StopAck ? undefined : withMemoryUsage(payload, binding.taskPackage, isTerminalEventType(event.eventType));
             if (event.eventType === "completed" && localFixPublication)
                 payload = { ...payload, local_fix_publication: structuredClone(localFixPublication) };
-            if (isTerminalEventType(event.eventType) || event.eventType === 'blocked' || event.eventType === 'scope_conflict') {
+            if (!d4StopAck && (isTerminalEventType(event.eventType) || event.eventType === 'blocked' || event.eventType === 'scope_conflict')) {
                 const reads = safeLocalReadObservations(adapter.localReadObservations?.());
                 if (reads)
                     payload = { ...payload, local_read_observations: reads };

package/dist/src/daemon/runtime.js

@@ -15,6 +15,7 @@ import { CodexPlugin } from "../adapters/codex/plugin.js";
 import { buildCodexJobOptions } from "../adapters/codex/runtime-options.js";
 import { AdapterRegistry } from "../adapters/registry.js";
 import { ClaudeCodePlugin } from "../adapters/claude-code/adapter.js";
+import { D4_OBSERVED_EXECUTION_CAPABILITY } from '../safety/d4-execution-limits.js';
 import { createClaudeCodeAdapterOptions } from "../adapters/claude-code/runtime-options.js";
 import { ClaudeRunnerTokenStore, ensureClaudeKeychainStub } from "../safety/claude-runner-token.js";
 import { WorkspaceManager } from "../workspace/workspace-manager.js";
@@ -123,6 +124,7 @@ export async function buildDaemon(input) {
             securityHost: claude.securityHost, binaryIdentity: await claude.binaryIdentity(),
             pullRequestEvidence: (args, signal) => gateway.readPullRequestEvidence(args, signal),
             readCandidateReviewContext: loopId => gateway.readCandidateReviewContext(loopId),
+            d4ExecutionHost: input.d4ExecutionHost,
         }),
     });
     const codex = new CodexPlugin({
@@ -299,7 +301,7 @@ export async function buildDaemon(input) {
             return {
                 deviceFingerprint: runnerDeviceFingerprint(input.gatewayMcpUrl),
                 displayName: runnerDisplayName(), packageVersion: packageVersion(),
-                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode, ['claude_code_cli', ...(production ? ['codex_cli'] : [])]), poller.accepting),
+                capabilities: acceptingJobs(localRunnerCapabilities(probes, !!localFixHost, localFixHost?.verificationModes ?? localFixHost?.verificationMode, ['claude_code_cli', ...(production ? ['codex_cli'] : [])], input.d4ExecutionHost), poller.accepting),
                 mode: "full",
                 ...(sessionOpen ? { sessionOpen: { ...sessionOpen, ...(askInbox ? { ask_inbox: askInbox } : {}) } } : {}),
                 ...(guidance ? { guidance } : {}),
@@ -462,12 +464,14 @@ export async function reconcilePreparationState(previous, deps) {
     return true;
 }
 /** Vendor capability text cannot claim a host-owned publication facility. */
-export function localRunnerCapabilities(probes, trustedLocalFixHost = false, verificationMode, pullRequestEvidenceAdapters = []) {
+export function localRunnerCapabilities(probes, trustedLocalFixHost = false, verificationMode, pullRequestEvidenceAdapters = [], d4Host) {
+    if (d4Host && (!/^[a-f0-9]{64}$/.test(d4Host.runnerReleaseSha256) || !/^[a-f0-9]{64}$/.test(d4Host.hostPolicySha256) || typeof d4Host.assertCurrent !== 'function'))
+        throw Error('D4_REVIEW_HOST_REQUIRED');
     const modes = verificationMode === undefined ? [] : typeof verificationMode === 'string' ? [verificationMode] : verificationMode;
     return probes.map(probe => {
         const status = adapterStatus(probe);
         const authenticated = status.authenticated;
-        const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1' && value !== 'pull_request_evidence_v1');
+        const capabilities = probe.capabilities.filter(value => value !== 'local_fix_publication_v1' && value !== 'local_fix_gateway_ci_v1' && value !== 'local_fix_gateway_publish_v1' && value !== 'pull_request_evidence_v1' && value !== D4_OBSERVED_EXECUTION_CAPABILITY);
         if (trustedLocalFixHost && authenticated && isLocalFixAdapter(probe.id)) {
             capabilities.push('local_fix_publication_v1');
             if (modes.includes('gateway_ci_v1'))
@@ -478,6 +482,9 @@ export function localRunnerCapabilities(probes, trustedLocalFixHost = false, ver
         // The host owns the Gateway call behind local_pull_request_read, so only the host can claim it (Work Decision 842179e6).
         if (authenticated && pullRequestEvidenceAdapters.includes(probe.id))
             capabilities.push('pull_request_evidence_v1');
-        return { adapter: probe.id, version: probe.version, ...status, capabilities };
+        const d4 = authenticated && probe.id === 'claude_code_cli' && d4Host;
+        if (d4)
+            capabilities.push(D4_OBSERVED_EXECUTION_CAPABILITY);
+        return { adapter: probe.id, version: probe.version, ...status, capabilities, ...(d4 ? { runner_release_sha256: d4.runnerReleaseSha256, host_policy_sha256: d4.hostPolicySha256 } : {}) };
     });
 }

package/dist/src/gateway-client.js

@@ -28,6 +28,8 @@ export class GatewayToolError extends Error {
 const ROOM_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const PANEL_ITEMS = 50;
 const PANEL_TITLE = 300;
+/** The menu bar Rooms tab (Work Item b35d65cb). Ids are lowercase UUIDs, as the Gateway makes them. */
+const PANEL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const SUSPENDED_JOB_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** A malformed answer is dropped, never a reason to refuse the sync: the runner then stays suspended. */
 function parseSuspendedJob(value) {
@@ -789,6 +791,102 @@ export class McpGatewayClient {
     async answerWorkRequest(requestId, body, signal) {
         await this.callTool('work_request_answer', { request_id: requestId, body }, signal);
     }
+    /** work_room_read activity, share_only (the projection the runner counts), for the menu bar Rooms tab: one page of 50. */
+    async readRoomListPage(afterRoomId, signal) {
+        const invalid = () => new GatewayToolError('Invalid Room list page', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        if (afterRoomId !== '' && !PANEL_ID.test(afterRoomId))
+            throw invalid();
+        const body = record(await this.callTool('work_room_read', { operation: 'activity', share_only: true, after_room_id: afterRoomId, limit: 50 }, signal));
+        if (!body || !Array.isArray(body.rooms) || body.rooms.length > 50)
+            throw invalid();
+        const rooms = body.rooms.map(row => {
+            const item = record(row) ?? {};
+            if (typeof item.room_id !== 'string' || !PANEL_ID.test(item.room_id) || !isCount(item.unread_count))
+                throw invalid();
+            return { roomId: item.room_id, name: text(item.name).slice(0, PANEL_TITLE), unreadCount: item.unread_count };
+        });
+        const next = body.next_cursor;
+        if (next !== null && (typeof next !== 'string' || rooms.length === 0 || next !== rooms[rooms.length - 1].roomId))
+            throw invalid();
+        return { rooms, nextCursor: next };
+    }
+    /** work_room_read show for the Rooms tab: the Room's current members and membership revision. */
+    async showRoomForPanel(roomId, signal) {
+        const invalid = () => new GatewayToolError('Invalid Work Room', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        const room = record(record(await this.callTool('work_room_read', { operation: 'show', room_id: roomId }, signal))?.room);
+        if (!room || room.id !== roomId || !isCount(room.membership_revision) || room.membership_revision < 1 || !Array.isArray(room.members)) {
+            throw invalid();
+        }
+        const members = room.members.map(row => {
+            const member = record(row) ?? {};
+            if (typeof member.actor_id !== 'string' || member.actor_id === '')
+                throw invalid();
+            return { actorId: member.actor_id, name: (text(member.display_name) || member.actor_id).slice(0, PANEL_TITLE) };
+        });
+        return { id: roomId, name: text(room.name).slice(0, PANEL_TITLE), status: text(room.status),
+            membershipRevision: room.membership_revision, members };
+    }
+    /** work_room_read threads for the Rooms tab: one page of up to 100 threads after a creation sequence. */
+    async readRoomThreadsPage(roomId, afterSequence, signal) {
+        const invalid = () => new GatewayToolError('Invalid Room threads', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        const body = record(await this.callTool('work_room_read', { operation: 'threads', room_id: roomId, after_sequence: afterSequence, limit: 100 }, signal));
+        if (!body || !Array.isArray(body.threads) || body.threads.length > 100
+            || !(body.next_cursor === null || (isCount(body.next_cursor) && body.next_cursor > afterSequence))) {
+            throw invalid();
+        }
+        const threads = body.threads.map(row => {
+            const item = record(row) ?? {};
+            if (typeof item.id !== 'string' || !PANEL_ID.test(item.id) || !isCount(item.unread_count) || !isCount(item.latest_message_sequence)) {
+                throw invalid();
+            }
+            return { id: item.id, title: text(item.title).slice(0, PANEL_TITLE), unreadCount: item.unread_count,
+                latestMessageSequence: item.latest_message_sequence };
+        });
+        return { threads, nextCursor: body.next_cursor };
+    }
+    /**
+     * work_room_read messages for the Rooms tab: the newest 20, or the unread ones up to 100, oldest first. The Gateway
+     * records fetched for exactly these rows; fetched is not presented.
+     */
+    async readRoomMessages(roomId, threadId, mode, signal) {
+        const invalid = () => new GatewayToolError('Invalid Room messages', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        const limit = mode === 'latest' ? 20 : 100;
+        const body = record(await this.callTool('work_room_read', { operation: 'messages', room_id: roomId, thread_id: threadId,
+            limit, ...(mode === 'latest' ? { latest: true } : { unread_only: true }) }, signal));
+        if (!body || !Array.isArray(body.messages) || body.messages.length > limit)
+            throw invalid();
+        return body.messages.map(row => {
+            const item = record(row) ?? {};
+            if (typeof item.id !== 'string' || !PANEL_ID.test(item.id) || item.thread_id !== threadId || !isCount(item.room_sequence)
+                || typeof item.author_actor_id !== 'string' || typeof item.kind !== 'string' || typeof item.body !== 'string') {
+                throw invalid();
+            }
+            return { id: item.id, sequence: item.room_sequence, authorActorId: item.author_actor_id, kind: item.kind, body: item.body,
+                createdAt: isCount(item.created_at) ? item.created_at : 0 };
+        });
+    }
+    /** work_room_receipt_report presented, for up to 100 messages the window has drawn on screen. */
+    async reportRoomPresented(roomId, messageIds, signal) {
+        return this.roomReceipt(roomId, { state: 'presented' }, messageIds, signal);
+    }
+    /** work_room_receipt_report user_acknowledged, only from the person's explicit Mark read in the window. */
+    async acknowledgeRoomMessages(roomId, messageIds, signal) {
+        return this.roomReceipt(roomId, { state: 'user_acknowledged', human_confirmed: true }, messageIds, signal);
+    }
+    /** work_room_write post for the Rooms tab, sent only after the person confirmed the members in the window. */
+    async postRoomReply(input, signal) {
+        await this.callTool('work_room_write', { operation: 'post', room_id: input.roomId, thread_id: input.threadId,
+            body: input.body, membership_revision: input.membershipRevision, idempotency_key: input.idempotencyKey }, signal);
+    }
+    async roomReceipt(roomId, state, messageIds, signal) {
+        const invalid = () => new GatewayToolError('Invalid Room receipt', 'work_room_receipt_report', 'GATEWAY_INVALID_TOOL_RESULT');
+        if (messageIds.length < 1 || messageIds.length > 100)
+            throw invalid();
+        const receipt = record(record(await this.callTool('work_room_receipt_report', { room_id: roomId, ...state, message_ids: [...messageIds] }, signal))?.receipt);
+        if (!receipt || !Array.isArray(receipt.message_ids))
+            throw invalid();
+        return receipt.message_ids.length;
+    }
     async authorizeRunnerChannel(socketId, signal) {
         const result = await this.callTool("local_agent_runner_channel_auth", {
             runner_id: this.runnerId,
@@ -1066,3 +1164,6 @@ function record(value) {
 function text(value) {
     return typeof value === 'string' ? value : '';
 }
+function isCount(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}

package/dist/src/menubar/channel.js

@@ -4,7 +4,7 @@ import { createServer } from "node:net";
 import { dirname, join } from "node:path";
 import { MAX_SOCKET_PATH_BYTES } from "../asks/hub-protocol.js";
 import { removeStaleSocket } from "../asks/hub.js";
-import { MAX_MENUBAR_LINE_BYTES, MENUBAR_SOCKET, noticeLine, parseAppLine, replyLine, stateLine } from "./protocol.js";
+import { MAX_MENUBAR_LINE_BYTES, MENUBAR_SOCKET, isPanelRequest, noticeLine, parseAppLine, replyLine, stateLine } from "./protocol.js";
 /** A notice the app has not confirmed by then goes to the osascript notice instead. */
 export const NOTICE_ACK_MS = 2_000;
 const PANEL_FAILED = { ok: false, error: "failed", message: "The runner could not answer. Try again." };
@@ -35,7 +35,7 @@ export class MenubarChannel {
     on(event, listener) {
         this.listeners[event].push(listener);
     }
-    /** The handler for the request panel's list, show and answer; without one each request is answered failed. */
+    /** The handler for the window's request panel and Rooms tab; without one each request is answered failed. */
     onPanel(handler) {
         this.panel = handler;
     }
@@ -158,7 +158,7 @@ export class MenubarChannel {
     handle(message, socket) {
         if (message === null)
             return;
-        if (message.type === "list" || message.type === "show" || message.type === "answer") {
+        if (isPanelRequest(message)) {
             void this.answerPanel(message, socket);
             return;
         }

package/dist/src/menubar/panel.js

@@ -1,14 +1,16 @@
 import { MAX_ANSWER_BYTES } from "./protocol.js";
-/** Each Gateway call the panel makes is given up after this long. */
+import { callRoom, checkRoomRequest } from "./room-panel.js";
+/** Each app message the panel answers is given up after this long. */
 export const PANEL_CALL_MS = 30_000;
 const ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const MAX_REASON = 300;
 const FAILED = "The runner could not reach the AI Gateway. Try again.";
+const AUDIENCE_CHANGED = "The Room members changed. Check the new list and post again.";
 /**
- * The daemon's side of the menu bar request panel (Gateway Work Item d2b6d0da). It is the allowlist for what the app
- * may ask: list what waits for the person, show one Work Request, answer one. Ids and the answer are checked before
- * any call, one call runs at a time, and nothing is kept after the reply. Logs carry the request type and an error
- * code only, never a title, body or answer.
+ * The daemon's side of the menu bar window (Gateway Work Items d2b6d0da and b35d65cb). It is the allowlist for what
+ * the app may ask: the request panel lists, shows and answers Work Requests; the Rooms tab's messages are checked and
+ * called in room-panel.ts. Ids and text are checked before any call, one call runs at a time, and nothing is kept
+ * after the reply. Logs carry the message type, an error code and counts only, never a name, title or body.
  */
 export function createPanelHandler(input) {
     let running = false;
@@ -32,6 +34,8 @@ export function createPanelHandler(input) {
             case "answer":
                 await input.gateway.answerWorkRequest(request.requestId, request.body.trim(), signal);
                 return { answered: true };
+            default:
+                return callRoom(request, input.gateway, signal);
         }
     };
     return async (request) => {
@@ -50,6 +54,17 @@ export function createPanelHandler(input) {
                 }
                 catch { /* A refresh that fails never undoes a sent answer. */ }
             }
+            if (request.type === "room_presented")
+                log({ event: "menubar_panel_presented", count: data.presented });
+            if (request.type === "room_mark_read") {
+                log({ event: "menubar_panel_marked_read", count: data.acknowledged });
+                try {
+                    input.onMarkedRead?.();
+                }
+                catch { /* A rescan that fails never undoes a receipt. */ }
+            }
+            if (request.type === "room_post")
+                log({ event: "menubar_panel_posted" });
             return { ok: true, data };
         }
         catch (error) {
@@ -57,6 +72,8 @@ export function createPanelHandler(input) {
             log({ event: "menubar_panel_failed", request: request.type, code });
             const reason = error?.reason;
             if (code === "GATEWAY_TOOL_REJECTED" && typeof reason === "string" && reason !== "") {
+                if (request.type === "room_post" && reason.includes("Room audience changed"))
+                    return refusal("audience_changed", AUDIENCE_CHANGED);
                 return refusal("refused", reason.slice(0, MAX_REASON));
             }
             return refusal("failed", FAILED);
@@ -69,6 +86,8 @@ export function createPanelHandler(input) {
 function check(request) {
     if (request.type === "list")
         return null;
+    if (request.type !== "show" && request.type !== "answer")
+        return checkRoomRequest(request);
     if (!ID.test(request.requestId))
         return "That request id is not valid.";
     if (request.type === "answer") {

package/dist/src/menubar/protocol.js

@@ -19,14 +19,34 @@
  *   {"v":1,"type":"answer","req":"<uuid>","request_id":"<uuid>","body":"…"}
  *   {"v":1,"type":"reply","req":"<uuid>","ok":true,"data":{…}}
  *   {"v":1,"type":"reply","req":"<uuid>","ok":false,"error":"busy|invalid|refused|failed","message":"…"}
+ *
+ * The Rooms tab (Work Item b35d65cb) adds, each answered by one reply:
+ *   {"v":1,"type":"room_list","req":"<uuid>"}
+ *   {"v":1,"type":"room_show","req":"<uuid>","room_id":"<uuid>"}
+ *   {"v":1,"type":"room_thread","req":"<uuid>","room_id":"<uuid>","thread_id":"<uuid>"}
+ *   {"v":1,"type":"room_presented","req":"<uuid>","room_id":"<uuid>","message_ids":["<uuid>",…]}
+ *   {"v":1,"type":"room_mark_read","req":"<uuid>","room_id":"<uuid>","message_ids":["<uuid>",…]}   the person pressed Mark read
+ *   {"v":1,"type":"room_post","req":"<uuid>","room_id":"<uuid>","thread_id":"<uuid>","body":"…","membership_revision":n,
+ *    "idempotency_key":"<uuid>"}                                     sent only after the person confirmed the members
+ *   a refused post can reply with "error":"audience_changed"
  */
 export const MENUBAR_SOCKET = "menubar.sock";
-/** A request body is at most 8,000 characters and a list at most 50 items, so every legitimate line fits. */
-export const MAX_MENUBAR_LINE_BYTES = 256 * 1024;
+/** A Room thread reply holds at most 120 messages of at most 8,000 bytes, so every legitimate line fits. */
+export const MAX_MENUBAR_LINE_BYTES = 4 * 1024 * 1024;
 /** The Gateway's own limit for one answer, in UTF-8 bytes after trimming. */
 export const MAX_ANSWER_BYTES = 8_000;
+/** The Gateway's own limit for one Room message, in UTF-8 bytes after trimming. */
+export const MAX_ROOM_POST_BYTES = 8_000;
 const NOTICE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const APP_VERSION = /^\d+\.\d+\.\d+$/;
+/** No legitimate message carries more ids than this; the handler checks the real limits. */
+const MAX_LIST_ITEMS = 1_000;
+const PANEL_TYPES = new Set(["list", "show", "answer", "room_list", "room_show", "room_thread", "room_presented",
+    "room_mark_read", "room_post"]);
+/** True for every message the panel handler answers with a reply. */
+export function isPanelRequest(message) {
+    return PANEL_TYPES.has(message.type);
+}
 export function stateLine(state) {
     return `${JSON.stringify({ v: 1, type: "state", room_unread: state.roomUnread, requests: state.requests,
         runner_version: state.runnerVersion, inbox_url: state.inboxUrl })}\n`;
@@ -72,6 +92,24 @@ export function parseAppLine(line) {
         case "answer":
             return keys === 5 && isId(record.req) && typeof record.request_id === "string" && typeof record.body === "string"
                 ? { type: "answer", req: record.req, requestId: record.request_id, body: record.body } : null;
+        case "room_list":
+            return keys === 3 && isId(record.req) ? { type: "room_list", req: record.req } : null;
+        case "room_show":
+            return keys === 4 && isId(record.req) && typeof record.room_id === "string"
+                ? { type: "room_show", req: record.req, roomId: record.room_id } : null;
+        case "room_thread":
+            return keys === 5 && isId(record.req) && typeof record.room_id === "string" && typeof record.thread_id === "string"
+                ? { type: "room_thread", req: record.req, roomId: record.room_id, threadId: record.thread_id } : null;
+        case "room_presented":
+        case "room_mark_read":
+            return keys === 5 && isId(record.req) && typeof record.room_id === "string" && isStringList(record.message_ids)
+                ? { type: record.type, req: record.req, roomId: record.room_id, messageIds: [...record.message_ids] } : null;
+        case "room_post":
+            return keys === 8 && isId(record.req) && typeof record.room_id === "string" && typeof record.thread_id === "string"
+                && typeof record.body === "string" && typeof record.membership_revision === "number"
+                && typeof record.idempotency_key === "string"
+                ? { type: "room_post", req: record.req, roomId: record.room_id, threadId: record.thread_id, body: record.body,
+                    membershipRevision: record.membership_revision, idempotencyKey: record.idempotency_key } : null;
         default:
             return null;
     }
@@ -79,3 +117,6 @@ export function parseAppLine(line) {
 function isId(value) {
     return typeof value === "string" && NOTICE_ID.test(value);
 }
+function isStringList(value) {
+    return Array.isArray(value) && value.length <= MAX_LIST_ITEMS && value.every(item => typeof item === "string");
+}

package/dist/src/menubar/room-panel.js

@@ -0,0 +1,115 @@
+import { MAX_ROOM_POST_BYTES } from "./protocol.js";
+/** The Room list reads at most this many activity pages of 50 (500 Rooms, as the web Inbox). */
+export const ROOM_LIST_PAGES = 10;
+/** A Room shows at most this many thread pages of 100. */
+export const ROOM_THREAD_PAGES = 5;
+/** A thread shows the newest 20 and at most 100 unread messages, so at most 120 are reported presented. */
+export const MAX_PRESENTED_IDS = 120;
+/** The Gateway takes at most 100 ids per receipt call. */
+export const MAX_RECEIPT_IDS = 100;
+const ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** Why a Room request is refused before any Gateway call, or null. */
+export function checkRoomRequest(request) {
+    switch (request.type) {
+        case "room_list":
+            return null;
+        case "room_show":
+            return checkRoomId(request.roomId);
+        case "room_thread":
+            return checkRoomId(request.roomId) ?? checkThreadId(request.threadId);
+        case "room_presented":
+            return checkRoomId(request.roomId) ?? checkIds(request.messageIds, MAX_PRESENTED_IDS);
+        case "room_mark_read":
+            return checkRoomId(request.roomId) ?? checkIds(request.messageIds, MAX_RECEIPT_IDS);
+        case "room_post": {
+            const bad = checkRoomId(request.roomId) ?? checkThreadId(request.threadId);
+            if (bad !== null)
+                return bad;
+            if (!ID.test(request.idempotencyKey))
+                return "That reply key is not valid.";
+            if (!Number.isSafeInteger(request.membershipRevision) || request.membershipRevision < 1)
+                return "That membership revision is not valid.";
+            const bytes = Buffer.byteLength(request.body.trim());
+            if (bytes === 0)
+                return "Write a reply first.";
+            if (bytes > MAX_ROOM_POST_BYTES)
+                return `A reply can be at most ${MAX_ROOM_POST_BYTES} bytes.`;
+            return null;
+        }
+    }
+}
+/** The Gateway calls behind one checked Room request, and the reply data the app reads. */
+export async function callRoom(request, gateway, signal) {
+    switch (request.type) {
+        case "room_list": {
+            const rooms = [];
+            let cursor = "";
+            for (let page = 0; page < ROOM_LIST_PAGES; page += 1) {
+                const read = await gateway.readRoomListPage(cursor, signal);
+                rooms.push(...read.rooms);
+                if (read.nextCursor === null)
+                    return { rooms: rooms.map(roomRow), complete: true };
+                cursor = read.nextCursor;
+            }
+            return { rooms: rooms.map(roomRow), complete: false };
+        }
+        case "room_show": {
+            const room = await gateway.showRoomForPanel(request.roomId, signal);
+            const threads = [];
+            let after = 0;
+            for (let page = 0; page < ROOM_THREAD_PAGES; page += 1) {
+                const read = await gateway.readRoomThreadsPage(request.roomId, after, signal);
+                threads.push(...read.threads);
+                if (read.nextCursor === null)
+                    break;
+                after = read.nextCursor;
+            }
+            return {
+                room: { id: room.id, name: room.name, status: room.status, membership_revision: room.membershipRevision,
+                    members: room.members.map(member => ({ actor_id: member.actorId, name: member.name })) },
+                threads: threads.map(thread => ({ id: thread.id, title: thread.title, unread_count: thread.unreadCount,
+                    latest_message_sequence: thread.latestMessageSequence })),
+            };
+        }
+        case "room_thread": {
+            const latest = await gateway.readRoomMessages(request.roomId, request.threadId, "latest", signal);
+            const unread = await gateway.readRoomMessages(request.roomId, request.threadId, "unread", signal);
+            const unreadIds = new Set(unread.map(message => message.id));
+            const byId = new Map();
+            for (const message of [...latest, ...unread])
+                byId.set(message.id, message);
+            return { messages: [...byId.values()].sort((a, b) => a.sequence - b.sequence).map(message => ({ id: message.id,
+                    author_actor_id: message.authorActorId, kind: message.kind, body: message.body, created_at: message.createdAt,
+                    unread: unreadIds.has(message.id) })) };
+        }
+        case "room_presented": {
+            let presented = 0;
+            for (let start = 0; start < request.messageIds.length; start += MAX_RECEIPT_IDS) {
+                presented += await gateway.reportRoomPresented(request.roomId, request.messageIds.slice(start, start + MAX_RECEIPT_IDS), signal);
+            }
+            return { presented };
+        }
+        case "room_mark_read":
+            return { acknowledged: await gateway.acknowledgeRoomMessages(request.roomId, request.messageIds, signal) };
+        case "room_post":
+            await gateway.postRoomReply({ roomId: request.roomId, threadId: request.threadId, body: request.body.trim(),
+                membershipRevision: request.membershipRevision, idempotencyKey: request.idempotencyKey }, signal);
+            return { posted: true };
+    }
+}
+function roomRow(room) {
+    return { room_id: room.roomId, name: room.name, unread_count: room.unreadCount };
+}
+function checkRoomId(value) {
+    return ID.test(value) ? null : "That Room id is not valid.";
+}
+function checkThreadId(value) {
+    return ID.test(value) ? null : "That thread id is not valid.";
+}
+function checkIds(ids, max) {
+    if (ids.length < 1 || ids.length > max)
+        return `Send 1 to ${max} message ids.`;
+    if (new Set(ids).size !== ids.length || !ids.every(value => ID.test(value)))
+        return "The message ids are not valid.";
+    return null;
+}

package/dist/src/menubar/wiring.js

@@ -18,7 +18,8 @@ export function buildMenubar(input) {
     channel.on("quit", () => input.log({ event: "menubar_app_quit" }));
     if (input.panel !== undefined) {
         channel.onPanel(createPanelHandler({ gateway: input.panel, log: input.log,
-            onAnswered: () => { void runtime.refreshRequests(true); } }));
+            onAnswered: () => { void runtime.refreshRequests(true); },
+            onMarkedRead: () => { void input.rescanRooms?.().catch(() => input.log({ event: "menubar_room_rescan_failed" })); } }));
     }
     const launch = input.launch ?? (() => launchMenubarApp({ home: input.home, stateRoot: input.stateRoot, socketPath }));
     const quit = input.quit ?? (() => quitMenubarApp());

package/dist/src/safety/candidate-review-report.js

@@ -66,7 +66,10 @@ export function assertCandidateReviewPackages(approved, bound) {
             approved.local_fix_scope !== undefined || approved.verification !== undefined ||
             !approved.candidate_review_record || !bound.candidate_review_record ||
             protocolHash(approved.candidate_review) !== protocolHash(bound.candidate_review) ||
-            protocolHash(approved.candidate_review_record) !== protocolHash(bound.candidate_review_record))
+            protocolHash(approved.candidate_review_record) !== protocolHash(bound.candidate_review_record) ||
+            ((approved.candidate_review_execution !== undefined || bound.candidate_review_execution !== undefined)
+                && (approved.candidate_review_execution === undefined || bound.candidate_review_execution === undefined
+                    || protocolHash(approved.candidate_review_execution) !== protocolHash(bound.candidate_review_execution))))
             throw Error();
     }
     catch {

package/dist/src/safety/d4-execution-limits.js

@@ -23,6 +23,12 @@ export function assertCurrentD4LimitSupport() { return reject('D4_STRICT_USAGE_E
 const d4 = (p) => ['candidate_review', 'candidate_review_record', 'candidate_review_execution'].some(k => Object.hasOwn(p, k))
     || p.contract_purpose === 'candidate_review' || p.tool_inventory === D4_REVIEW_INVENTORY;
 /** Before token/security/tool acquisition. The later inventory check also catches a D4 security pin without package markers. */
+export const D4_OBSERVED_EXECUTION_SCHEMA = 'd4-review-execution-v2';
+export const D4_OBSERVED_EXECUTION_STAGE = 'cli_observed_usage_v1';
+export const D4_OBSERVED_EXECUTION_CAPABILITY = 'd4_review_observed_usage_v1';
+const PROFILE_KEYS = ['schema_version', 'decision_revision_id', 'runtime_adapter', 'provider', 'model_id', 'tool_inventory', 'tools_sha256', 'cli_security_fingerprint',
+    'runner_release_sha256', 'host_policy_sha256', 'review_status', 'limits', 'usage_enforcement'];
+/** Version 2 accepts observed-stop limits only. It does not make strict caps available or authorize a launch. */
 export function assertD4PackageLimitSupport(bound, approved, resume) {
     if (![bound, approved].some(p => object(p) && d4(p)))
         return;
@@ -37,8 +43,19 @@ export function assertD4PackageLimitSupport(bound, approved, resume) {
         return reject('D4_LIMIT_PROFILE_REQUIRED');
     if (protocolHash(a) !== protocolHash(b))
         return reject('D4_LIMIT_PROFILE_CHANGED');
-    assessD4LimitEnforcement(a.profile.limits);
-    return assertCurrentD4LimitSupport();
+    if (a.schema_version !== D4_OBSERVED_EXECUTION_SCHEMA)
+        return assertCurrentD4LimitSupport();
+    const p = a.profile, u = p.usage_enforcement;
+    if (!keys(a, ['schema_version', 'stage', 'profile', 'profile_fingerprint', 'registration_fingerprint']) || a.stage !== D4_OBSERVED_EXECUTION_STAGE
+        || !keys(p, PROFILE_KEYS) || p.schema_version !== 'd4-review-execution-profile-v2' || p.review_status !== 'reviewed'
+        || p.runtime_adapter !== 'claude_code_cli' || p.provider !== 'anthropic' || p.model_id !== 'claude-sonnet-5-5' || p.tool_inventory !== D4_REVIEW_INVENTORY
+        || typeof p.decision_revision_id !== 'string' || !(/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/).test(p.decision_revision_id)
+        || !['tools_sha256', 'cli_security_fingerprint', 'runner_release_sha256', 'host_policy_sha256'].every(k => typeof p[k] === 'string' && /^[a-f0-9]{64}$/.test(p[k]))
+        || typeof a.registration_fingerprint !== 'string' || !/^[a-f0-9]{64}$/.test(a.registration_fingerprint)
+        || a.profile_fingerprint !== protocolHash(p) || !object(u) || !keys(u, ['tokens', 'estimated_cost', 'hard_stop'])
+        || u.tokens !== 'observed_stop' || u.estimated_cost !== 'observed_stop' || u.hard_stop !== false)
+        return reject('D4_LIMIT_PROFILE_REJECTED');
+    return parseD4Limits(p.limits);
 }
 /** Conservative diagnostic interpretation only. All token partitions and the CLI's estimated cost must be explicit.
  * This does not establish that a CLI result is cumulative, timely, complete or an invoice/weekly-limit measurement. */
@@ -56,6 +73,38 @@ export function parseD4ResultUsage(value, sequence) {
         return reject('D4_USAGE_UNAVAILABLE');
     return { sequence, total_tokens: tokens, estimated_cost_microusd: micro };
 }
+/** CLI transport observations only. Message IDs deduplicate cumulative revisions of the same assistant message.
+ * Cost is available only when the CLI reports total_cost_usd; absent intermediate cost is not a zero-cost claim.
+ * Final root usage must cover every observation. Never consume usage embedded in model text/tool output. */
+export class D4CliUsageTracker {
+    messages = new Map();
+    sequence = 0;
+    tokens = 0;
+    assistant(value) {
+        if (value.type !== 'assistant' || !object(value.message) || value.message.usage === undefined)
+            return;
+        const m = value.message, id = m.id;
+        if (typeof id !== 'string' || !id || id.length > 191 || this.messages.size >= 4096 && !this.messages.has(id))
+            return reject('D4_USAGE_UNAVAILABLE');
+        const parsed = parseD4ResultUsage({ type: 'result', usage: m.usage, total_cost_usd: 0 }, 1), previous = this.messages.get(id);
+        if (previous !== undefined && parsed.total_tokens < previous)
+            return reject('D4_USAGE_UNAVAILABLE');
+        if (previous !== parsed.total_tokens) {
+            this.tokens += parsed.total_tokens - (previous ?? 0);
+            this.messages.set(id, parsed.total_tokens);
+            this.sequence++;
+        }
+        if (!integer(this.tokens))
+            return reject('D4_USAGE_UNAVAILABLE');
+        return { sequence: Math.max(1, this.sequence), total_tokens: this.tokens, estimated_cost_microusd: 0 };
+    }
+    final(value) {
+        const final = parseD4ResultUsage(value, ++this.sequence);
+        if (final.total_tokens < this.tokens)
+            return reject('D4_USAGE_UNAVAILABLE');
+        return final;
+    }
+}
 const STOP_TIMEOUT_MS = 6000;
 /** Local owned-process primitive for synthetic feasibility tests and a future reviewed runtime.
  * It grants no admission; the production adapter above remains blocked. Observed caps may already have overshot.
@@ -71,9 +120,12 @@ export class D4ObservedLimitWatchdog {
     reason;
     status = 'idle';
     stopPromise;
+    stoppedSignal;
+    signalStopped;
     constructor(limits, host) {
         this.host = host;
         this.limits = parseD4Limits(limits);
+        this.stoppedSignal = new Promise(resolve => { this.signalStopped = resolve; });
     }
     now() { const n = (this.host.now ?? (() => performance.now()))(); if (!Number.isFinite(n) || n < this.lastNow)
         return reject('D4_USAGE_UNAVAILABLE'); this.lastNow = n; return n; }
@@ -90,6 +142,8 @@ export class D4ObservedLimitWatchdog {
     }
     diagnostic() { return { status: this.status, reason_code: this.status === 'unconfirmed' ? 'D4_STOP_UNCONFIRMED' : this.reason ?? null }; }
     settled() { return this.stopPromise ?? Promise.resolve(); }
+    /** Wakes a silent stream consumer after a stop attempt, including unconfirmed cleanup. */
+    stopped() { return this.stoppedSignal; }
     async observe(snapshot) {
         if (this.stopPromise)
             return this.stopPromise;
@@ -170,6 +224,7 @@ export class D4ObservedLimitWatchdog {
             }
             finally {
                 clearTimeout(timer);
+                this.signalStopped();
             }
         });
         return this.stopPromise;

package/native/app/AI Gateway.app/Contents/Info.plist

@@ -7,8 +7,8 @@
   <key>CFBundleDisplayName</key><string>AI Gateway</string>
   <key>CFBundleExecutable</key><string>AIGatewayMenubar</string>
   <key>CFBundlePackageType</key><string>APPL</string>
-  <key>CFBundleShortVersionString</key><string>1.1.0</string>
-  <key>CFBundleVersion</key><string>2</string>
+  <key>CFBundleShortVersionString</key><string>1.2.0</string>
+  <key>CFBundleVersion</key><string>3</string>
   <key>LSMinimumSystemVersion</key><string>13.0</string>
   <key>LSUIElement</key><true/>
 </dict>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtech-ai-local-runner",
-  "version": "0.1.110",
+  "version": "0.1.111",
   "private": false,
   "license": "UNLICENSED",
   "bin": {