mtech-ai-local-runner 0.1.110 → 0.1.112

package/dist/src/gateway-client.js

@@ -28,6 +28,8 @@ export class GatewayToolError extends Error {
 const ROOM_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const PANEL_ITEMS = 50;
 const PANEL_TITLE = 300;
+/** The menu bar Rooms tab (Work Item b35d65cb). Ids are lowercase UUIDs, as the Gateway makes them. */
+const PANEL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const SUSPENDED_JOB_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** A malformed answer is dropped, never a reason to refuse the sync: the runner then stays suspended. */
 function parseSuspendedJob(value) {
@@ -789,6 +791,102 @@ export class McpGatewayClient {
     async answerWorkRequest(requestId, body, signal) {
         await this.callTool('work_request_answer', { request_id: requestId, body }, signal);
     }
+    /** work_room_read activity, share_only (the projection the runner counts), for the menu bar Rooms tab: one page of 50. */
+    async readRoomListPage(afterRoomId, signal) {
+        const invalid = () => new GatewayToolError('Invalid Room list page', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        if (afterRoomId !== '' && !PANEL_ID.test(afterRoomId))
+            throw invalid();
+        const body = record(await this.callTool('work_room_read', { operation: 'activity', share_only: true, after_room_id: afterRoomId, limit: 50 }, signal));
+        if (!body || !Array.isArray(body.rooms) || body.rooms.length > 50)
+            throw invalid();
+        const rooms = body.rooms.map(row => {
+            const item = record(row) ?? {};
+            if (typeof item.room_id !== 'string' || !PANEL_ID.test(item.room_id) || !isCount(item.unread_count))
+                throw invalid();
+            return { roomId: item.room_id, name: text(item.name).slice(0, PANEL_TITLE), unreadCount: item.unread_count };
+        });
+        const next = body.next_cursor;
+        if (next !== null && (typeof next !== 'string' || rooms.length === 0 || next !== rooms[rooms.length - 1].roomId))
+            throw invalid();
+        return { rooms, nextCursor: next };
+    }
+    /** work_room_read show for the Rooms tab: the Room's current members and membership revision. */
+    async showRoomForPanel(roomId, signal) {
+        const invalid = () => new GatewayToolError('Invalid Work Room', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        const room = record(record(await this.callTool('work_room_read', { operation: 'show', room_id: roomId }, signal))?.room);
+        if (!room || room.id !== roomId || !isCount(room.membership_revision) || room.membership_revision < 1 || !Array.isArray(room.members)) {
+            throw invalid();
+        }
+        const members = room.members.map(row => {
+            const member = record(row) ?? {};
+            if (typeof member.actor_id !== 'string' || member.actor_id === '')
+                throw invalid();
+            return { actorId: member.actor_id, name: (text(member.display_name) || member.actor_id).slice(0, PANEL_TITLE) };
+        });
+        return { id: roomId, name: text(room.name).slice(0, PANEL_TITLE), status: text(room.status),
+            membershipRevision: room.membership_revision, members };
+    }
+    /** work_room_read threads for the Rooms tab: one page of up to 100 threads after a creation sequence. */
+    async readRoomThreadsPage(roomId, afterSequence, signal) {
+        const invalid = () => new GatewayToolError('Invalid Room threads', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        const body = record(await this.callTool('work_room_read', { operation: 'threads', room_id: roomId, after_sequence: afterSequence, limit: 100 }, signal));
+        if (!body || !Array.isArray(body.threads) || body.threads.length > 100
+            || !(body.next_cursor === null || (isCount(body.next_cursor) && body.next_cursor > afterSequence))) {
+            throw invalid();
+        }
+        const threads = body.threads.map(row => {
+            const item = record(row) ?? {};
+            if (typeof item.id !== 'string' || !PANEL_ID.test(item.id) || !isCount(item.unread_count) || !isCount(item.latest_message_sequence)) {
+                throw invalid();
+            }
+            return { id: item.id, title: text(item.title).slice(0, PANEL_TITLE), unreadCount: item.unread_count,
+                latestMessageSequence: item.latest_message_sequence };
+        });
+        return { threads, nextCursor: body.next_cursor };
+    }
+    /**
+     * work_room_read messages for the Rooms tab: the newest 20, or the unread ones up to 100, oldest first. The Gateway
+     * records fetched for exactly these rows; fetched is not presented.
+     */
+    async readRoomMessages(roomId, threadId, mode, signal) {
+        const invalid = () => new GatewayToolError('Invalid Room messages', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        const limit = mode === 'latest' ? 20 : 100;
+        const body = record(await this.callTool('work_room_read', { operation: 'messages', room_id: roomId, thread_id: threadId,
+            limit, ...(mode === 'latest' ? { latest: true } : { unread_only: true }) }, signal));
+        if (!body || !Array.isArray(body.messages) || body.messages.length > limit)
+            throw invalid();
+        return body.messages.map(row => {
+            const item = record(row) ?? {};
+            if (typeof item.id !== 'string' || !PANEL_ID.test(item.id) || item.thread_id !== threadId || !isCount(item.room_sequence)
+                || typeof item.author_actor_id !== 'string' || typeof item.kind !== 'string' || typeof item.body !== 'string') {
+                throw invalid();
+            }
+            return { id: item.id, sequence: item.room_sequence, authorActorId: item.author_actor_id, kind: item.kind, body: item.body,
+                createdAt: isCount(item.created_at) ? item.created_at : 0 };
+        });
+    }
+    /** work_room_receipt_report presented, for up to 100 messages the window has drawn on screen. */
+    async reportRoomPresented(roomId, messageIds, signal) {
+        return this.roomReceipt(roomId, { state: 'presented' }, messageIds, signal);
+    }
+    /** work_room_receipt_report user_acknowledged, only from the person's explicit Mark read in the window. */
+    async acknowledgeRoomMessages(roomId, messageIds, signal) {
+        return this.roomReceipt(roomId, { state: 'user_acknowledged', human_confirmed: true }, messageIds, signal);
+    }
+    /** work_room_write post for the Rooms tab, sent only after the person confirmed the members in the window. */
+    async postRoomReply(input, signal) {
+        await this.callTool('work_room_write', { operation: 'post', room_id: input.roomId, thread_id: input.threadId,
+            body: input.body, membership_revision: input.membershipRevision, idempotency_key: input.idempotencyKey }, signal);
+    }
+    async roomReceipt(roomId, state, messageIds, signal) {
+        const invalid = () => new GatewayToolError('Invalid Room receipt', 'work_room_receipt_report', 'GATEWAY_INVALID_TOOL_RESULT');
+        if (messageIds.length < 1 || messageIds.length > 100)
+            throw invalid();
+        const receipt = record(record(await this.callTool('work_room_receipt_report', { room_id: roomId, ...state, message_ids: [...messageIds] }, signal))?.receipt);
+        if (!receipt || !Array.isArray(receipt.message_ids))
+            throw invalid();
+        return receipt.message_ids.length;
+    }
     async authorizeRunnerChannel(socketId, signal) {
         const result = await this.callTool("local_agent_runner_channel_auth", {
             runner_id: this.runnerId,
@@ -1066,3 +1164,6 @@ function record(value) {
 function text(value) {
     return typeof value === 'string' ? value : '';
 }
+function isCount(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}

package/dist/src/menubar/channel.js

@@ -4,7 +4,7 @@ import { createServer } from "node:net";
 import { dirname, join } from "node:path";
 import { MAX_SOCKET_PATH_BYTES } from "../asks/hub-protocol.js";
 import { removeStaleSocket } from "../asks/hub.js";
-import { MAX_MENUBAR_LINE_BYTES, MENUBAR_SOCKET, noticeLine, parseAppLine, replyLine, stateLine } from "./protocol.js";
+import { MAX_MENUBAR_LINE_BYTES, MENUBAR_SOCKET, isPanelRequest, noticeLine, parseAppLine, replyLine, stateLine } from "./protocol.js";
 /** A notice the app has not confirmed by then goes to the osascript notice instead. */
 export const NOTICE_ACK_MS = 2_000;
 const PANEL_FAILED = { ok: false, error: "failed", message: "The runner could not answer. Try again." };
@@ -35,7 +35,7 @@ export class MenubarChannel {
     on(event, listener) {
         this.listeners[event].push(listener);
     }
-    /** The handler for the request panel's list, show and answer; without one each request is answered failed. */
+    /** The handler for the window's request panel and Rooms tab; without one each request is answered failed. */
     onPanel(handler) {
         this.panel = handler;
     }
@@ -158,7 +158,7 @@ export class MenubarChannel {
     handle(message, socket) {
         if (message === null)
             return;
-        if (message.type === "list" || message.type === "show" || message.type === "answer") {
+        if (isPanelRequest(message)) {
             void this.answerPanel(message, socket);
             return;
         }

package/dist/src/menubar/panel.js

@@ -1,14 +1,16 @@
 import { MAX_ANSWER_BYTES } from "./protocol.js";
-/** Each Gateway call the panel makes is given up after this long. */
+import { callRoom, checkRoomRequest } from "./room-panel.js";
+/** Each app message the panel answers is given up after this long. */
 export const PANEL_CALL_MS = 30_000;
 const ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const MAX_REASON = 300;
 const FAILED = "The runner could not reach the AI Gateway. Try again.";
+const AUDIENCE_CHANGED = "The Room members changed. Check the new list and post again.";
 /**
- * The daemon's side of the menu bar request panel (Gateway Work Item d2b6d0da). It is the allowlist for what the app
- * may ask: list what waits for the person, show one Work Request, answer one. Ids and the answer are checked before
- * any call, one call runs at a time, and nothing is kept after the reply. Logs carry the request type and an error
- * code only, never a title, body or answer.
+ * The daemon's side of the menu bar window (Gateway Work Items d2b6d0da and b35d65cb). It is the allowlist for what
+ * the app may ask: the request panel lists, shows and answers Work Requests; the Rooms tab's messages are checked and
+ * called in room-panel.ts. Ids and text are checked before any call, one call runs at a time, and nothing is kept
+ * after the reply. Logs carry the message type, an error code and counts only, never a name, title or body.
  */
 export function createPanelHandler(input) {
     let running = false;
@@ -32,6 +34,8 @@ export function createPanelHandler(input) {
             case "answer":
                 await input.gateway.answerWorkRequest(request.requestId, request.body.trim(), signal);
                 return { answered: true };
+            default:
+                return callRoom(request, input.gateway, signal);
         }
     };
     return async (request) => {
@@ -50,6 +54,17 @@ export function createPanelHandler(input) {
                 }
                 catch { /* A refresh that fails never undoes a sent answer. */ }
             }
+            if (request.type === "room_presented")
+                log({ event: "menubar_panel_presented", count: data.presented });
+            if (request.type === "room_mark_read") {
+                log({ event: "menubar_panel_marked_read", count: data.acknowledged });
+                try {
+                    input.onMarkedRead?.();
+                }
+                catch { /* A rescan that fails never undoes a receipt. */ }
+            }
+            if (request.type === "room_post")
+                log({ event: "menubar_panel_posted" });
             return { ok: true, data };
         }
         catch (error) {
@@ -57,6 +72,8 @@ export function createPanelHandler(input) {
             log({ event: "menubar_panel_failed", request: request.type, code });
             const reason = error?.reason;
             if (code === "GATEWAY_TOOL_REJECTED" && typeof reason === "string" && reason !== "") {
+                if (request.type === "room_post" && reason.includes("Room audience changed"))
+                    return refusal("audience_changed", AUDIENCE_CHANGED);
                 return refusal("refused", reason.slice(0, MAX_REASON));
             }
             return refusal("failed", FAILED);
@@ -69,6 +86,8 @@ export function createPanelHandler(input) {
 function check(request) {
     if (request.type === "list")
         return null;
+    if (request.type !== "show" && request.type !== "answer")
+        return checkRoomRequest(request);
     if (!ID.test(request.requestId))
         return "That request id is not valid.";
     if (request.type === "answer") {

package/dist/src/menubar/protocol.js

@@ -19,14 +19,34 @@
  *   {"v":1,"type":"answer","req":"<uuid>","request_id":"<uuid>","body":"…"}
  *   {"v":1,"type":"reply","req":"<uuid>","ok":true,"data":{…}}
  *   {"v":1,"type":"reply","req":"<uuid>","ok":false,"error":"busy|invalid|refused|failed","message":"…"}
+ *
+ * The Rooms tab (Work Item b35d65cb) adds, each answered by one reply:
+ *   {"v":1,"type":"room_list","req":"<uuid>"}
+ *   {"v":1,"type":"room_show","req":"<uuid>","room_id":"<uuid>"}
+ *   {"v":1,"type":"room_thread","req":"<uuid>","room_id":"<uuid>","thread_id":"<uuid>"}
+ *   {"v":1,"type":"room_presented","req":"<uuid>","room_id":"<uuid>","message_ids":["<uuid>",…]}
+ *   {"v":1,"type":"room_mark_read","req":"<uuid>","room_id":"<uuid>","message_ids":["<uuid>",…]}   the person pressed Mark read
+ *   {"v":1,"type":"room_post","req":"<uuid>","room_id":"<uuid>","thread_id":"<uuid>","body":"…","membership_revision":n,
+ *    "idempotency_key":"<uuid>"}                                     sent only after the person confirmed the members
+ *   a refused post can reply with "error":"audience_changed"
  */
 export const MENUBAR_SOCKET = "menubar.sock";
-/** A request body is at most 8,000 characters and a list at most 50 items, so every legitimate line fits. */
-export const MAX_MENUBAR_LINE_BYTES = 256 * 1024;
+/** A Room thread reply holds at most 120 messages of at most 8,000 bytes, so every legitimate line fits. */
+export const MAX_MENUBAR_LINE_BYTES = 4 * 1024 * 1024;
 /** The Gateway's own limit for one answer, in UTF-8 bytes after trimming. */
 export const MAX_ANSWER_BYTES = 8_000;
+/** The Gateway's own limit for one Room message, in UTF-8 bytes after trimming. */
+export const MAX_ROOM_POST_BYTES = 8_000;
 const NOTICE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const APP_VERSION = /^\d+\.\d+\.\d+$/;
+/** No legitimate message carries more ids than this; the handler checks the real limits. */
+const MAX_LIST_ITEMS = 1_000;
+const PANEL_TYPES = new Set(["list", "show", "answer", "room_list", "room_show", "room_thread", "room_presented",
+    "room_mark_read", "room_post"]);
+/** True for every message the panel handler answers with a reply. */
+export function isPanelRequest(message) {
+    return PANEL_TYPES.has(message.type);
+}
 export function stateLine(state) {
     return `${JSON.stringify({ v: 1, type: "state", room_unread: state.roomUnread, requests: state.requests,
         runner_version: state.runnerVersion, inbox_url: state.inboxUrl })}\n`;
@@ -72,6 +92,24 @@ export function parseAppLine(line) {
         case "answer":
             return keys === 5 && isId(record.req) && typeof record.request_id === "string" && typeof record.body === "string"
                 ? { type: "answer", req: record.req, requestId: record.request_id, body: record.body } : null;
+        case "room_list":
+            return keys === 3 && isId(record.req) ? { type: "room_list", req: record.req } : null;
+        case "room_show":
+            return keys === 4 && isId(record.req) && typeof record.room_id === "string"
+                ? { type: "room_show", req: record.req, roomId: record.room_id } : null;
+        case "room_thread":
+            return keys === 5 && isId(record.req) && typeof record.room_id === "string" && typeof record.thread_id === "string"
+                ? { type: "room_thread", req: record.req, roomId: record.room_id, threadId: record.thread_id } : null;
+        case "room_presented":
+        case "room_mark_read":
+            return keys === 5 && isId(record.req) && typeof record.room_id === "string" && isStringList(record.message_ids)
+                ? { type: record.type, req: record.req, roomId: record.room_id, messageIds: [...record.message_ids] } : null;
+        case "room_post":
+            return keys === 8 && isId(record.req) && typeof record.room_id === "string" && typeof record.thread_id === "string"
+                && typeof record.body === "string" && typeof record.membership_revision === "number"
+                && typeof record.idempotency_key === "string"
+                ? { type: "room_post", req: record.req, roomId: record.room_id, threadId: record.thread_id, body: record.body,
+                    membershipRevision: record.membership_revision, idempotencyKey: record.idempotency_key } : null;
         default:
             return null;
     }
@@ -79,3 +117,6 @@ export function parseAppLine(line) {
 function isId(value) {
     return typeof value === "string" && NOTICE_ID.test(value);
 }
+function isStringList(value) {
+    return Array.isArray(value) && value.length <= MAX_LIST_ITEMS && value.every(item => typeof item === "string");
+}

package/dist/src/menubar/room-panel.js

@@ -0,0 +1,115 @@
+import { MAX_ROOM_POST_BYTES } from "./protocol.js";
+/** The Room list reads at most this many activity pages of 50 (500 Rooms, as the web Inbox). */
+export const ROOM_LIST_PAGES = 10;
+/** A Room shows at most this many thread pages of 100. */
+export const ROOM_THREAD_PAGES = 5;
+/** A thread shows the newest 20 and at most 100 unread messages, so at most 120 are reported presented. */
+export const MAX_PRESENTED_IDS = 120;
+/** The Gateway takes at most 100 ids per receipt call. */
+export const MAX_RECEIPT_IDS = 100;
+const ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** Why a Room request is refused before any Gateway call, or null. */
+export function checkRoomRequest(request) {
+    switch (request.type) {
+        case "room_list":
+            return null;
+        case "room_show":
+            return checkRoomId(request.roomId);
+        case "room_thread":
+            return checkRoomId(request.roomId) ?? checkThreadId(request.threadId);
+        case "room_presented":
+            return checkRoomId(request.roomId) ?? checkIds(request.messageIds, MAX_PRESENTED_IDS);
+        case "room_mark_read":
+            return checkRoomId(request.roomId) ?? checkIds(request.messageIds, MAX_RECEIPT_IDS);
+        case "room_post": {
+            const bad = checkRoomId(request.roomId) ?? checkThreadId(request.threadId);
+            if (bad !== null)
+                return bad;
+            if (!ID.test(request.idempotencyKey))
+                return "That reply key is not valid.";
+            if (!Number.isSafeInteger(request.membershipRevision) || request.membershipRevision < 1)
+                return "That membership revision is not valid.";
+            const bytes = Buffer.byteLength(request.body.trim());
+            if (bytes === 0)
+                return "Write a reply first.";
+            if (bytes > MAX_ROOM_POST_BYTES)
+                return `A reply can be at most ${MAX_ROOM_POST_BYTES} bytes.`;
+            return null;
+        }
+    }
+}
+/** The Gateway calls behind one checked Room request, and the reply data the app reads. */
+export async function callRoom(request, gateway, signal) {
+    switch (request.type) {
+        case "room_list": {
+            const rooms = [];
+            let cursor = "";
+            for (let page = 0; page < ROOM_LIST_PAGES; page += 1) {
+                const read = await gateway.readRoomListPage(cursor, signal);
+                rooms.push(...read.rooms);
+                if (read.nextCursor === null)
+                    return { rooms: rooms.map(roomRow), complete: true };
+                cursor = read.nextCursor;
+            }
+            return { rooms: rooms.map(roomRow), complete: false };
+        }
+        case "room_show": {
+            const room = await gateway.showRoomForPanel(request.roomId, signal);
+            const threads = [];
+            let after = 0;
+            for (let page = 0; page < ROOM_THREAD_PAGES; page += 1) {
+                const read = await gateway.readRoomThreadsPage(request.roomId, after, signal);
+                threads.push(...read.threads);
+                if (read.nextCursor === null)
+                    break;
+                after = read.nextCursor;
+            }
+            return {
+                room: { id: room.id, name: room.name, status: room.status, membership_revision: room.membershipRevision,
+                    members: room.members.map(member => ({ actor_id: member.actorId, name: member.name })) },
+                threads: threads.map(thread => ({ id: thread.id, title: thread.title, unread_count: thread.unreadCount,
+                    latest_message_sequence: thread.latestMessageSequence })),
+            };
+        }
+        case "room_thread": {
+            const latest = await gateway.readRoomMessages(request.roomId, request.threadId, "latest", signal);
+            const unread = await gateway.readRoomMessages(request.roomId, request.threadId, "unread", signal);
+            const unreadIds = new Set(unread.map(message => message.id));
+            const byId = new Map();
+            for (const message of [...latest, ...unread])
+                byId.set(message.id, message);
+            return { messages: [...byId.values()].sort((a, b) => a.sequence - b.sequence).map(message => ({ id: message.id,
+                    author_actor_id: message.authorActorId, kind: message.kind, body: message.body, created_at: message.createdAt,
+                    unread: unreadIds.has(message.id) })) };
+        }
+        case "room_presented": {
+            let presented = 0;
+            for (let start = 0; start < request.messageIds.length; start += MAX_RECEIPT_IDS) {
+                presented += await gateway.reportRoomPresented(request.roomId, request.messageIds.slice(start, start + MAX_RECEIPT_IDS), signal);
+            }
+            return { presented };
+        }
+        case "room_mark_read":
+            return { acknowledged: await gateway.acknowledgeRoomMessages(request.roomId, request.messageIds, signal) };
+        case "room_post":
+            await gateway.postRoomReply({ roomId: request.roomId, threadId: request.threadId, body: request.body.trim(),
+                membershipRevision: request.membershipRevision, idempotencyKey: request.idempotencyKey }, signal);
+            return { posted: true };
+    }
+}
+function roomRow(room) {
+    return { room_id: room.roomId, name: room.name, unread_count: room.unreadCount };
+}
+function checkRoomId(value) {
+    return ID.test(value) ? null : "That Room id is not valid.";
+}
+function checkThreadId(value) {
+    return ID.test(value) ? null : "That thread id is not valid.";
+}
+function checkIds(ids, max) {
+    if (ids.length < 1 || ids.length > max)
+        return `Send 1 to ${max} message ids.`;
+    if (new Set(ids).size !== ids.length || !ids.every(value => ID.test(value)))
+        return "The message ids are not valid.";
+    return null;
+}

package/dist/src/menubar/wiring.js

@@ -18,7 +18,8 @@ export function buildMenubar(input) {
     channel.on("quit", () => input.log({ event: "menubar_app_quit" }));
     if (input.panel !== undefined) {
         channel.onPanel(createPanelHandler({ gateway: input.panel, log: input.log,
-            onAnswered: () => { void runtime.refreshRequests(true); } }));
+            onAnswered: () => { void runtime.refreshRequests(true); },
+            onMarkedRead: () => { void input.rescanRooms?.().catch(() => input.log({ event: "menubar_room_rescan_failed" })); } }));
     }
     const launch = input.launch ?? (() => launchMenubarApp({ home: input.home, stateRoot: input.stateRoot, socketPath }));
     const quit = input.quit ?? (() => quitMenubarApp());

package/dist/src/safety/candidate-review-report.js

@@ -66,7 +66,10 @@ export function assertCandidateReviewPackages(approved, bound) {
             approved.local_fix_scope !== undefined || approved.verification !== undefined ||
             !approved.candidate_review_record || !bound.candidate_review_record ||
             protocolHash(approved.candidate_review) !== protocolHash(bound.candidate_review) ||
-            protocolHash(approved.candidate_review_record) !== protocolHash(bound.candidate_review_record))
+            protocolHash(approved.candidate_review_record) !== protocolHash(bound.candidate_review_record) ||
+            ((approved.candidate_review_execution !== undefined || bound.candidate_review_execution !== undefined)
+                && (approved.candidate_review_execution === undefined || bound.candidate_review_execution === undefined
+                    || protocolHash(approved.candidate_review_execution) !== protocolHash(bound.candidate_review_execution))))
             throw Error();
     }
     catch {

package/dist/src/safety/claude-review-provider.js

@@ -23,6 +23,14 @@ function textOf(content) {
     const parts = content.filter((block) => record(block) && block.type === 'text' && typeof block.text === 'string').map(block => block.text);
     return parts.length ? parts.join('') : null;
 }
+/** Tool evidence accepts text only. Never discard an unrecognized block and salvage a passing JSON object. */
+function toolResultText(content) {
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content) || content.length === 0 || !content.every((block) => record(block) && Object.keys(block).length === 2 && block.type === 'text' && typeof block.text === 'string'))
+        return 'CLAUDE_REVIEW_TOOL_RESULT_CONTENT_REJECTED';
+    return content.map(block => block.text).join('');
+}
 const REMINDER = /<system-reminder>[\s\S]*?<\/system-reminder>/g;
 /** The user's own text. The real CLI prepends context in system-reminder tags, in its own block or the same one. */
 function userText(content) {
@@ -131,7 +139,7 @@ export async function startClaudeReviewProvider(script) {
                         continue;
                     toolResultIds.push(block.tool_use_id);
                     if (!toolResults.has(block.tool_use_id))
-                        toolResults.set(block.tool_use_id, { isError: block.is_error === true, text: typeof block.content === 'string' ? block.content : JSON.stringify(block.content ?? '') });
+                        toolResults.set(block.tool_use_id, { isError: block.is_error === true, text: toolResultText(block.content) });
                 }
         const firstUser = messages.find(message => message.role === 'user'), { text: firstUserText, reminders } = firstUser ? userText(firstUser.content) : { text: null, reminders: 0 };
         // The scripted turn: the launched model, the exact review prompt as the first user text and an offered tool list.

package/dist/src/safety/d4-execution-limits.js

@@ -1,6 +1,14 @@
 import { protocolHash } from '../publication/candidate.js';
 import { D4_REVIEW_INVENTORY } from './local-tool-policy.js';
 const LIMIT_KEYS = ['max_candidates', 'max_process_starts', 'max_runtime_seconds', 'automatic_retries', 'max_total_tokens', 'max_estimated_cost_microusd'];
+export function parseD4RecordLimits(value) {
+    const names = LIMIT_KEYS.slice(0, 4);
+    if (!object(value) || !keys(value, names) || !names.every(k => integer(value[k]))
+        || value.max_candidates !== 1 || value.max_process_starts !== 1 || value.automatic_retries !== 0
+        || !integer(value.max_runtime_seconds, 1) || value.max_runtime_seconds > 900)
+        return reject('D4_LIMIT_PROFILE_REJECTED');
+    return Object.freeze({ ...value });
+}
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const keys = (v, expected) => Object.keys(v).length === expected.length && expected.every(k => Object.hasOwn(v, k));
 const integer = (v, min = 0) => typeof v === 'number' && Number.isSafeInteger(v) && v >= min;
@@ -23,6 +31,15 @@ export function assertCurrentD4LimitSupport() { return reject('D4_STRICT_USAGE_E
 const d4 = (p) => ['candidate_review', 'candidate_review_record', 'candidate_review_execution'].some(k => Object.hasOwn(p, k))
     || p.contract_purpose === 'candidate_review' || p.tool_inventory === D4_REVIEW_INVENTORY;
 /** Before token/security/tool acquisition. The later inventory check also catches a D4 security pin without package markers. */
+export const D4_OBSERVED_EXECUTION_SCHEMA = 'd4-review-execution-v2';
+export const D4_OBSERVED_EXECUTION_STAGE = 'cli_observed_usage_v1';
+export const D4_OBSERVED_EXECUTION_CAPABILITY = 'd4_review_observed_usage_v1';
+export const D4_RECORDED_EXECUTION_SCHEMA = 'd4-review-execution-v3';
+export const D4_RECORDED_EXECUTION_CAPABILITY = 'd4_review_recorded_usage_v1';
+export const isD4ExecutionSchema = (s) => s === D4_OBSERVED_EXECUTION_SCHEMA || s === D4_RECORDED_EXECUTION_SCHEMA;
+const PROFILE_KEYS = ['schema_version', 'decision_revision_id', 'runtime_adapter', 'provider', 'model_id', 'tool_inventory', 'tools_sha256', 'cli_security_fingerprint',
+    'runner_release_sha256', 'host_policy_sha256', 'review_status', 'limits', 'usage_enforcement'];
+/** Immutable v2 observed-stop and v3 recording-only packages; neither grants launch authority. */
 export function assertD4PackageLimitSupport(bound, approved, resume) {
     if (![bound, approved].some(p => object(p) && d4(p)))
         return;
@@ -37,8 +54,20 @@ export function assertD4PackageLimitSupport(bound, approved, resume) {
         return reject('D4_LIMIT_PROFILE_REQUIRED');
     if (protocolHash(a) !== protocolHash(b))
         return reject('D4_LIMIT_PROFILE_CHANGED');
-    assessD4LimitEnforcement(a.profile.limits);
-    return assertCurrentD4LimitSupport();
+    if (!isD4ExecutionSchema(a.schema_version))
+        return assertCurrentD4LimitSupport();
+    const recordOnly = a.schema_version === D4_RECORDED_EXECUTION_SCHEMA;
+    const p = a.profile, u = p.usage_enforcement;
+    if (!keys(a, ['schema_version', 'stage', 'profile', 'profile_fingerprint', 'registration_fingerprint']) || a.stage !== (recordOnly ? 'cli_recorded_usage_v1' : D4_OBSERVED_EXECUTION_STAGE)
+        || !keys(p, PROFILE_KEYS) || p.schema_version !== (recordOnly ? 'd4-review-execution-profile-v3' : 'd4-review-execution-profile-v2') || p.review_status !== 'reviewed'
+        || p.runtime_adapter !== 'claude_code_cli' || p.provider !== 'anthropic' || p.model_id !== 'claude-sonnet-5-5' || p.tool_inventory !== D4_REVIEW_INVENTORY
+        || typeof p.decision_revision_id !== 'string' || !(/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/).test(p.decision_revision_id)
+        || !['tools_sha256', 'cli_security_fingerprint', 'runner_release_sha256', 'host_policy_sha256'].every(k => typeof p[k] === 'string' && /^[a-f0-9]{64}$/.test(p[k]))
+        || typeof a.registration_fingerprint !== 'string' || !/^[a-f0-9]{64}$/.test(a.registration_fingerprint)
+        || a.profile_fingerprint !== protocolHash(p) || !object(u) || !keys(u, ['tokens', 'estimated_cost', 'hard_stop'])
+        || u.tokens !== (recordOnly ? 'record_only' : 'observed_stop') || u.estimated_cost !== (recordOnly ? 'record_only' : 'observed_stop') || u.hard_stop !== false)
+        return reject('D4_LIMIT_PROFILE_REJECTED');
+    return recordOnly ? parseD4RecordLimits(p.limits) : parseD4Limits(p.limits);
 }
 /** Conservative diagnostic interpretation only. All token partitions and the CLI's estimated cost must be explicit.
  * This does not establish that a CLI result is cumulative, timely, complete or an invoice/weekly-limit measurement. */
@@ -56,9 +85,41 @@ export function parseD4ResultUsage(value, sequence) {
         return reject('D4_USAGE_UNAVAILABLE');
     return { sequence, total_tokens: tokens, estimated_cost_microusd: micro };
 }
+/** CLI transport observations only. Message IDs deduplicate cumulative revisions of the same assistant message.
+ * Cost is available only when the CLI reports total_cost_usd; absent intermediate cost is not a zero-cost claim.
+ * Final root usage must cover every observation. Never consume usage embedded in model text/tool output. */
+export class D4CliUsageTracker {
+    messages = new Map();
+    sequence = 0;
+    tokens = 0;
+    assistant(value) {
+        if (value.type !== 'assistant' || !object(value.message) || value.message.usage === undefined)
+            return;
+        const m = value.message, id = m.id;
+        if (typeof id !== 'string' || !id || id.length > 191 || this.messages.size >= 4096 && !this.messages.has(id))
+            return reject('D4_USAGE_UNAVAILABLE');
+        const parsed = parseD4ResultUsage({ type: 'result', usage: m.usage, total_cost_usd: 0 }, 1), previous = this.messages.get(id);
+        if (previous !== undefined && parsed.total_tokens < previous)
+            return reject('D4_USAGE_UNAVAILABLE');
+        if (previous !== parsed.total_tokens) {
+            this.tokens += parsed.total_tokens - (previous ?? 0);
+            this.messages.set(id, parsed.total_tokens);
+            this.sequence++;
+        }
+        if (!integer(this.tokens))
+            return reject('D4_USAGE_UNAVAILABLE');
+        return { sequence: Math.max(1, this.sequence), total_tokens: this.tokens, estimated_cost_microusd: 0 };
+    }
+    final(value) {
+        const final = parseD4ResultUsage(value, ++this.sequence);
+        if (final.total_tokens < this.tokens)
+            return reject('D4_USAGE_UNAVAILABLE');
+        return final;
+    }
+}
 const STOP_TIMEOUT_MS = 6000;
-/** Local owned-process primitive for synthetic feasibility tests and a future reviewed runtime.
- * It grants no admission; the production adapter above remains blocked. Observed caps may already have overshot.
+/** Local owned-process watchdog. It grants no admission; the adapter also requires a trusted reviewed host.
+ * V2 stops on observed thresholds (possible overshoot); V3 records usage without numeric stopping.
  * In-memory start accounting is not a durable restart fence; existing Job/lease owners must provide that later. */
 export class D4ObservedLimitWatchdog {
     host;
@@ -71,9 +132,12 @@ export class D4ObservedLimitWatchdog {
     reason;
     status = 'idle';
     stopPromise;
+    stoppedSignal;
+    signalStopped;
     constructor(limits, host) {
         this.host = host;
-        this.limits = parseD4Limits(limits);
+        this.limits = object(limits) && !Object.hasOwn(limits, 'max_total_tokens') ? parseD4RecordLimits(limits) : parseD4Limits(limits);
+        this.stoppedSignal = new Promise(resolve => { this.signalStopped = resolve; });
     }
     now() { const n = (this.host.now ?? (() => performance.now()))(); if (!Number.isFinite(n) || n < this.lastNow)
         return reject('D4_USAGE_UNAVAILABLE'); this.lastNow = n; return n; }
@@ -90,6 +154,8 @@ export class D4ObservedLimitWatchdog {
     }
     diagnostic() { return { status: this.status, reason_code: this.status === 'unconfirmed' ? 'D4_STOP_UNCONFIRMED' : this.reason ?? null }; }
     settled() { return this.stopPromise ?? Promise.resolve(); }
+    /** Wakes a silent stream consumer after a stop attempt, including unconfirmed cleanup. */
+    stopped() { return this.stoppedSignal; }
     async observe(snapshot) {
         if (this.stopPromise)
             return this.stopPromise;
@@ -113,9 +179,9 @@ export class D4ObservedLimitWatchdog {
                 return this.stop('D4_USAGE_UNAVAILABLE');
         }
         this.last = { ...s };
-        if (s.total_tokens >= this.limits.max_total_tokens)
+        if ('max_total_tokens' in this.limits && s.total_tokens >= this.limits.max_total_tokens)
             return this.stop('D4_OBSERVED_TOKEN_LIMIT');
-        if (s.estimated_cost_microusd >= this.limits.max_estimated_cost_microusd)
+        if ('max_estimated_cost_microusd' in this.limits && s.estimated_cost_microusd >= this.limits.max_estimated_cost_microusd)
             return this.stop('D4_OBSERVED_COST_LIMIT');
     }
     cancel() { return this.stop('D4_CANCELLED'); }
@@ -170,6 +236,7 @@ export class D4ObservedLimitWatchdog {
             }
             finally {
                 clearTimeout(timer);
+                this.signalStopped();
             }
         });
         return this.stopPromise;